diff --git a/.dockerignore b/.dockerignore
index 9c4c55bc..ed39380a 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,3 +6,11 @@ docs/
 specs/
 *.md
 LICENSE
+**/.env
+**/.env.*
+**/node_modules
+**/__pycache__
+**/.venv
+**/.pulumi
+.DS_Store
+**/.DS_Store
diff --git a/.github/actions/load-image/action.yml b/.github/actions/load-image/action.yml
index bb231ba4..6d99c439 100644
--- a/.github/actions/load-image/action.yml
+++ b/.github/actions/load-image/action.yml
@@ -5,7 +5,7 @@ runs:
   using: "composite"
   steps:
     - name: Download image artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         name: rustack-image
         path: /tmp
diff --git a/.github/workflows/promote-docker.yml b/.github/workflows/promote-docker.yml
new file mode 100644
index 00000000..9fc7363e
--- /dev/null
+++ b/.github/workflows/promote-docker.yml
@@ -0,0 +1,60 @@
+name: promote-docker
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_run_id:
+        description: Successful same-commit release-docker candidate run
+        required: true
+        type: string
+      qualification_run_id:
+        description: Successful same-commit qualify-workflows run
+        required: true
+        type: string
+      version:
+        description: Numeric major.minor.patch version to promote
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  promote:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+      packages: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      CANDIDATE_RUN_ID: ${{ inputs.candidate_run_id }}
+      QUALIFICATION_RUN_ID: ${{ inputs.qualification_run_id }}
+      RELEASE_VERSION: ${{ inputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          run-id: ${{ inputs.qualification_run_id }}
+          name: workflows-qualified-release
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/qualification
+      - name: Recheck raw qualification before registry login
+        run: make workflows-release-preflight WORKFLOWS_RELEASE_BUNDLE="${{ runner.temp }}/qualification"
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Promote the qualified archives without rebuilding
+        run: make workflows-release-promote WORKFLOWS_RELEASE_BUNDLE="${{ runner.temp }}/qualification"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: workflows-promotion-receipt
+          path: ${{ runner.temp }}/qualification/promotion.json
+          if-no-files-found: error
diff --git a/.github/workflows/qualify-workflows.yml b/.github/workflows/qualify-workflows.yml
new file mode 100644
index 00000000..3b93f8bd
--- /dev/null
+++ b/.github/workflows/qualify-workflows.yml
@@ -0,0 +1,54 @@
+name: qualify-workflows
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_run_id:
+        description: Successful same-commit release-docker run containing the exact archives
+        required: true
+        type: string
+      evidence_run_id:
+        description: Successful same-commit run containing the complete workflows-evidence artifact
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  assemble:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Fence source runs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CANDIDATE_RUN_ID: ${{ inputs.candidate_run_id }}
+          EVIDENCE_RUN_ID: ${{ inputs.evidence_run_id }}
+        run: make workflows-release-input-runs
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          run-id: ${{ inputs.evidence_run_id }}
+          name: workflows-evidence
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/qualification
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          run-id: ${{ inputs.candidate_run_id }}
+          pattern: release-candidate-*
+          merge-multiple: true
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/qualification
+      - name: Require complete raw evidence and exact candidates
+        run: make verify-workflows WORKFLOWS_RELEASE_BUNDLE="${{ runner.temp }}/qualification" WORKFLOWS_RELEASE_REPORT="${{ runner.temp }}/qualification/release-report.json"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: workflows-qualified-release
+          path: ${{ runner.temp }}/qualification/
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
index b36155ae..9393a652 100644
--- a/.github/workflows/release-docker.yml
+++ b/.github/workflows/release-docker.yml
@@ -2,71 +2,63 @@ name: release-docker
 
 on:
   push:
-    tags:
-      - v*
+    tags: [v*]
   workflow_dispatch:
 
+# Candidates are local Docker archives. Publication belongs to promote-docker.
 permissions:
   contents: read
-  packages: write
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository_owner }}/rustack
 
 jobs:
-  # Wait for the build workflow to pass before pushing the Docker image.
-  wait-for-build:
-    if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+  candidate:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - architecture: arm64
+            runner: ubuntu-24.04-arm
+          - architecture: amd64
+            runner: ubuntu-24.04
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
     steps:
-      - name: Wait for build workflow
-        uses: lewagon/wait-on-check-action@v1.3.4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.ref }}
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          check-name: build-rust (ubuntu-latest)
-          wait-interval: 15
-          allowed-conclusions: success
-
-  build-and-push:
-    needs: [wait-for-build]
-    if: always() && (needs.wait-for-build.result == 'success' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Set up QEMU (for multi-arch builds)
-        uses: docker/setup-qemu-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=raw,value=latest
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
+          persist-credentials: false
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - name: Allocate candidate directory
+        run: mkdir -m 700 "${{ runner.temp }}/candidate"
+      - name: Build without publication
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.docker-meta.outputs.tags }}
-          labels: ${{ steps.docker-meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          platforms: linux/${{ matrix.architecture }}
+          push: false
+          provenance: false
+          tags: rustack/workflows-release:integration-${{ matrix.architecture }}
+          outputs: type=docker,dest=${{ runner.temp }}/candidate/release-${{ matrix.architecture }}.tar
+          cache-from: type=gha,scope=release-${{ matrix.architecture }}
+          cache-to: type=gha,mode=max,scope=release-${{ matrix.architecture }}
+      - name: Load and seal exact archive
+        env:
+          ARCHITECTURE: ${{ matrix.architecture }}
+          CANDIDATE: ${{ runner.temp }}/candidate
+        run: |
+          docker image load --input "$CANDIDATE/release-$ARCHITECTURE.tar"
+          make workflows-release-seal WORKFLOWS_ARCH="$ARCHITECTURE" WORKFLOWS_RELEASE_BUNDLE="$CANDIDATE"
+      - name: Record execution scope
+        env:
+          ARCHITECTURE: ${{ matrix.architecture }}
+        run: |
+          if [ "$ARCHITECTURE" = amd64 ]; then
+            echo 'D100: distribution build only; Linux x86_64 execution is waived.' >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo 'Candidate awaits complete exact-image platform qualification; no promotion occurred.' >> "$GITHUB_STEP_SUMMARY"
+          fi
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: release-candidate-${{ matrix.architecture }}
+          path: ${{ runner.temp }}/candidate/
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 8e5334cd..a1bc9c9e 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -31,13 +31,13 @@ jobs:
     name: "Build Docker image"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           load: true
@@ -49,7 +49,7 @@ jobs:
         run: docker save "$IMAGE" | gzip > /tmp/rustack-image.tar.gz
 
       - name: Upload image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rustack-image
           path: /tmp/rustack-image.tar.gz
@@ -63,7 +63,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
@@ -247,6 +247,59 @@ jobs:
           aws lambda get-account-settings | jq -e '.AccountLimit'
           echo "Lambda OK"
 
+      - name: "Step Functions: execute pure ASL and verify exact history"
+        timeout-minutes: 2
+        run: |
+          set -euo pipefail
+          timeout --signal=TERM --kill-after=3s 60s bash <<'SMOKE'
+          set -euo pipefail
+          [[ "$AWS_ENDPOINT_URL" =~ ^http://localhost:[0-9]{1,5}$ ]]
+          unset AWS_PROFILE AWS_DEFAULT_PROFILE AWS_SESSION_TOKEN AWS_SECURITY_TOKEN AWS_ENDPOINT_URL_STEPFUNCTIONS
+          export AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null
+          export AWS_MAX_ATTEMPTS=1 AWS_EC2_METADATA_DISABLED=true AWS_PAGER=""
+          sfn() {
+            timeout --signal=TERM --kill-after=2s 8s aws \
+              --endpoint-url "$AWS_ENDPOINT_URL" --region "$AWS_DEFAULT_REGION" \
+              --cli-connect-timeout 2 --cli-read-timeout 3 --no-cli-pager --no-paginate \
+              stepfunctions "$@"
+          }
+          machine=""
+          cleanup() {
+            status=$?
+            trap - EXIT
+            if [ -n "$machine" ]; then
+              sfn delete-state-machine --state-machine-arn "$machine" || status=1
+            fi
+            exit "$status"
+          }
+          trap cleanup EXIT
+          name="action-pure-$(python3 -c 'import uuid; print(uuid.uuid4().hex)')"
+          machine=$(sfn create-state-machine --name "$name" --type STANDARD \
+            --role-arn arn:aws:iam::000000000000:role/ActionPure \
+            --definition '{"StartAt":"Double","States":{"Double":{"Type":"Pass","Parameters":{"result.$":"States.MathAdd($.n, $.n)"},"End":true}}}' \
+            --query stateMachineArn --output text)
+          execution=$(sfn start-execution --state-machine-arn "$machine" --input '{"n":21}' \
+            --query executionArn --output text)
+          for attempt in $(seq 1 20); do
+            result=$(sfn describe-execution --execution-arn "$execution")
+            state=$(jq -er '.status' <<<"$result")
+            [ "$state" != RUNNING ] && break
+            sleep 0.2
+          done
+          jq -e '.status == "SUCCEEDED" and (.output | fromjson) == {result:42}' <<<"$result"
+          history=$(sfn get-execution-history --execution-arn "$execution" --max-results 10)
+          jq -e '
+            (has("nextToken") | not) and
+            [.events[].type] == ["ExecutionStarted","PassStateEntered","PassStateExited","ExecutionSucceeded"] and
+            [.events[].id] == [1,2,3,4] and [.events[].previousEventId] == [0,0,2,3] and
+            (.events[0].executionStartedEventDetails.input | fromjson) == {n:21} and
+            .events[1].stateEnteredEventDetails.name == "Double" and
+            (.events[2].stateExitedEventDetails.output | fromjson) == {result:42} and
+            (.events[3].executionSucceededEventDetails.output | fromjson) == {result:42}
+          ' <<<"$history"
+          echo "Step Functions pure ASL 21 -> 42 and exact four-event history OK"
+          SMOKE
+
       # ── CloudWatch smoke test ─────────────────────────────────────────
       - name: "CloudWatch: put metric + list metrics"
         run: |
@@ -462,7 +515,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
@@ -514,7 +567,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
@@ -557,7 +610,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
@@ -596,7 +649,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
@@ -671,7 +724,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
@@ -712,7 +765,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
@@ -741,7 +794,7 @@ jobs:
     needs: build-image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Load Docker image
         uses: ./.github/actions/load-image
diff --git a/.github/workflows/workflows-evidence.yml b/.github/workflows/workflows-evidence.yml
new file mode 100644
index 00000000..03a760b0
--- /dev/null
+++ b/.github/workflows/workflows-evidence.yml
@@ -0,0 +1,36 @@
+name: workflows-evidence
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_run_id:
+        description: Candidate run whose exact archives were qualified on every required lane
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  retain:
+    # Operators stage the complete same-source receipts on this dedicated runner.
+    # Missing Desktop/reference/rootless receipts fail; this never waives a lane.
+    runs-on: [self-hosted, rustack-qualification]
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Pack only fully verified evidence
+        env:
+          CANDIDATE_RUN_ID: ${{ inputs.candidate_run_id }}
+          WORKFLOWS_EVIDENCE_ROOT: ${{ vars.WORKFLOWS_EVIDENCE_ROOT }}
+          WORKFLOWS_EVIDENCE_OUTPUT: ${{ runner.temp }}/workflows-evidence
+        run: make workflows-release-evidence
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: workflows-evidence
+          path: ${{ runner.temp }}/workflows-evidence/
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
diff --git a/.gitignore b/.gitignore
index 80a40a5e..e5f4bcdd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 node_modules/
 .pulumi/
 .pulumi-home/
+.DS_Store
diff --git a/.gitmodules b/.gitmodules
index bcc7d616..732c2408 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,12 @@
 [submodule "vendors/localstack"]
 	path = vendors/localstack
 	url = https://github.com/localstack/localstack.git
+[submodule "vendors/bollard"]
+	path = vendors/bollard
+	url = https://github.com/fussybeaver/bollard.git
+[submodule "vendors/moby"]
+	path = vendors/moby
+	url = https://github.com/moby/moby.git
+[submodule "vendors/pulumi"]
+	path = vendors/pulumi
+	url = https://github.com/pulumi/pulumi.git
diff --git a/Cargo.lock b/Cargo.lock
index 885ed16c..4f32638c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -77,6 +77,45 @@ version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
 
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.92"
@@ -102,9 +141,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-config"
-version = "1.12.0"
+version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8d7b388a9fc3a6db15a5ec778c38b354eff1364882c94d08e0252f7a47dcaa4"
+checksum = "939e256cfe0ed68e96d32f194339d88210d5c10685cff0787400158f852c6819"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -113,10 +152,10 @@ dependencies = [
  "aws-sdk-sts",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.65.0",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -133,9 +172,9 @@ dependencies = [
 
 [[package]]
 name = "aws-credential-types"
-version = "1.3.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e"
+checksum = "576e8da35751dc85409ec1cd15999f692c277a1fbe9336780fe6f15e49dd637d"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -169,9 +208,9 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.9.2"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef47857a1d4488b528f4a5d5715fa7c3300820897824152234d3fa22b1426657"
+checksum = "9a0cc2144962cc5e358467b16e3d82981b1d424a7c3d34602be0036103814a1a"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -206,11 +245,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -232,13 +271,13 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
- "aws-smithy-xml",
+ "aws-smithy-xml 0.62.0",
  "aws-types",
  "fastrand",
  "http 0.2.12",
@@ -260,11 +299,11 @@ dependencies = [
  "aws-smithy-cbor",
  "aws-smithy-compression",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "fastrand",
@@ -289,11 +328,11 @@ dependencies = [
  "aws-smithy-async",
  "aws-smithy-eventstream",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -315,11 +354,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -342,11 +381,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -368,11 +407,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -394,14 +433,14 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
- "aws-smithy-query",
+ "aws-smithy-query 0.62.0",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
- "aws-smithy-xml",
+ "aws-smithy-xml 0.62.0",
  "aws-types",
  "fastrand",
  "http 0.2.12",
@@ -422,11 +461,11 @@ dependencies = [
  "aws-smithy-async",
  "aws-smithy-eventstream",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -448,11 +487,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -475,11 +514,11 @@ dependencies = [
  "aws-smithy-async",
  "aws-smithy-eventstream",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -504,25 +543,25 @@ dependencies = [
  "aws-smithy-checksums",
  "aws-smithy-eventstream",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
- "aws-smithy-xml",
+ "aws-smithy-xml 0.62.0",
  "aws-types",
  "bytes",
  "fastrand",
  "hex",
- "hmac 0.13.0",
+ "hmac",
  "http 0.2.12",
  "http 1.5.0",
  "http-body 1.1.0",
  "lru",
  "percent-encoding",
  "regex-lite",
- "sha2 0.11.0",
+ "sha2",
  "tracing",
  "url",
 ]
@@ -538,11 +577,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -564,14 +603,14 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
- "aws-smithy-query",
+ "aws-smithy-query 0.62.0",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
- "aws-smithy-xml",
+ "aws-smithy-xml 0.62.0",
  "aws-types",
  "fastrand",
  "http 0.2.12",
@@ -580,6 +619,31 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "aws-sdk-sfn"
+version = "1.123.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c149c59d61748e843ef40e47db88a884148300dfa560c0d84b0fcf04f0c85c2f"
+dependencies = [
+ "arc-swap",
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json 0.65.0",
+ "aws-smithy-observability",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema 1.1.0",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "http 1.5.0",
+ "regex-lite",
+ "tracing",
+]
+
 [[package]]
 name = "aws-sdk-sns"
 version = "1.111.0"
@@ -591,14 +655,14 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
- "aws-smithy-query",
+ "aws-smithy-query 0.62.0",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
- "aws-smithy-xml",
+ "aws-smithy-xml 0.62.0",
  "aws-types",
  "fastrand",
  "http 0.2.12",
@@ -618,11 +682,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -644,11 +708,11 @@ dependencies = [
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.63.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -661,25 +725,24 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sso"
-version = "1.109.0"
+version = "1.117.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3cfe74df5d9ad2fedd691973ad3521ebf4f27a3c68c792556686aedb5519bab"
+checksum = "5316813498fa9c403877007934ae448aa44b18136f58051f8fa3c5b79b44bdc6"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.65.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
  "fastrand",
- "http 0.2.12",
  "http 1.5.0",
  "regex-lite",
  "tracing",
@@ -687,25 +750,24 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.111.0"
+version = "1.119.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81b0ec31ed6191bd11350aae4b2004198f2db21350cb0a20c57e0a92e55dd161"
+checksum = "31db35e5662787b786daba15f431e4393c7ea512b70fa112bd048d1f3ecf877a"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.65.0",
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
  "aws-types",
  "bytes",
  "fastrand",
- "http 0.2.12",
  "http 1.5.0",
  "regex-lite",
  "tracing",
@@ -713,26 +775,25 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.114.0"
+version = "1.122.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef45745026107ec30c4ef86bd8ae4b002e7e5f6a86e4225240bdf6b06a0b944a"
+checksum = "a10491638d9e560db90c484dbc77d73b8ad202780cdc9b9e92180603acb07ada"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
  "aws-smithy-http",
- "aws-smithy-json",
+ "aws-smithy-json 0.65.0",
  "aws-smithy-observability",
- "aws-smithy-query",
+ "aws-smithy-query 0.64.0",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
- "aws-smithy-xml",
+ "aws-smithy-xml 0.64.0",
  "aws-types",
  "fastrand",
- "http 0.2.12",
  "http 1.5.0",
  "regex-lite",
  "tracing",
@@ -740,9 +801,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sigv4"
-version = "1.5.1"
+version = "1.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723c2234ad7511ceef63eab016b7ba6ff7c55590fefb96fa8467af014a07309f"
+checksum = "9d3d48355cb86b15ccbb38b8bc6b87500c824ee4ed8cbc10a961b435242b5e16"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-eventstream",
@@ -750,26 +811,21 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "crypto-bigint 0.5.5",
  "form_urlencoded",
  "hex",
- "hmac 0.13.0",
- "http 0.2.12",
+ "hmac",
  "http 1.5.0",
- "p256",
  "percent-encoding",
- "sha2 0.11.0",
- "subtle",
+ "sha2",
  "time",
  "tracing",
- "zeroize",
 ]
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.3.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316"
+checksum = "de681a9df7ff79823b759ee17061076ec049cd61a8fa28ece4293d89c9f6964e"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -783,7 +839,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f069169abdc367533ea89b869b7dfaadd4134a9bc287c13dbe5ff364ff13228"
 dependencies = [
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
  "aws-smithy-types",
  "minicbor",
  "num-bigint",
@@ -806,7 +862,7 @@ dependencies = [
  "md-5",
  "pin-project-lite",
  "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2",
  "tracing",
 ]
 
@@ -830,9 +886,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.61.2"
+version = "0.61.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6de526c7b567420a31bc283657a7921b45c4cafe0827fdf2490713dcc770c28f"
+checksum = "14c8a643d0e114cae39e45415e3225793a6396698b7779a0c9e3ede731d8fc71"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -841,9 +897,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http"
-version = "0.64.0"
+version = "0.64.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37843d9add67c3aff5856f409c6dc315d3cdff60f9c0cb5b670dab1e9920306d"
+checksum = "ba8960956e0ee0ca3f3161e62913a61bc65a7ef638ca3ef1d4c7159f8443e398"
 dependencies = [
  "aws-smithy-eventstream",
  "aws-smithy-runtime-api",
@@ -857,15 +913,14 @@ dependencies = [
  "http-body-util",
  "percent-encoding",
  "pin-project-lite",
- "pin-utils",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.4.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebfd138fac0337cee7516c352757ea73b9f2266e57d0bcb5bc70e9547e45aef1"
+checksum = "aeca69f65362f7375891008ea525fd440ad6db1836458ac188c87b126804114e"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -892,7 +947,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3dc65a121adb4b33729919fcfa14fa36fb33c1555a8f06bb0e2188dbfdc1d9ef"
 dependencies = [
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
+ "aws-smithy-types",
+]
+
+[[package]]
+name = "aws-smithy-json"
+version = "0.65.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f6835fb38bc6fc8c91e584b0366eb4ff595e5c485134dbf4f0bdeaa18856666"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
 ]
 
@@ -912,43 +978,53 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "512346c7212ab7436df2d77a16d976a468ae44a418835511d2a69269810aaf62"
 dependencies = [
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
+ "aws-smithy-types",
+ "aws-smithy-xml 0.62.0",
+ "urlencoding",
+]
+
+[[package]]
+name = "aws-smithy-query"
+version = "0.64.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "165f6265342a313ad6f7a1ac17a0cdba30c522039d3f41d8d6871ce8a2b34ecd"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
- "aws-smithy-xml",
+ "aws-smithy-xml 0.64.0",
  "urlencoding",
 ]
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.14.0"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b82e438d30e02a825d363bd639a9efaed68a8089d86101054b0081e7e0d3e606"
+checksum = "79cef0c41e8ca40f74f68ed8ee4d1ddbde12bb847b95ef9b3c025681ddfae58a"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
  "aws-smithy-http-client",
  "aws-smithy-observability",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
  "bytes",
  "fastrand",
- "http 0.2.12",
  "http 1.5.0",
- "http-body 0.4.6",
  "http-body 1.1.0",
  "http-body-util",
  "pin-project-lite",
- "pin-utils",
  "tokio",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.16.0"
+version = "1.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c054752dd9e4dc73d0b75748c99ac2d0feafbf2f25c7b0516f03a3534161223"
+checksum = "06788004dea79018413f381891da6dcca23196acd79c4d51b767fbdacc76eae4"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api-macros",
@@ -984,11 +1060,22 @@ dependencies = [
  "http 1.5.0",
 ]
 
+[[package]]
+name = "aws-smithy-schema"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bec8dae1015a6d959a5faf86fbdf77486cfe19e4ccb6ee009d8a46efc45028a4"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "http 1.5.0",
+]
+
 [[package]]
 name = "aws-smithy-types"
-version = "1.6.3"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f94d16e797ec62cd999fc9d5942b48fa7050c3093ddadff48e4d7528d16fcb9"
+checksum = "55752025c39c0e094962fd73f1c57014b191f678612e517f219468e575af9822"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -1002,7 +1089,6 @@ dependencies = [
  "itoa",
  "num-integer",
  "pin-project-lite",
- "pin-utils",
  "ryu",
  "serde",
  "time",
@@ -1017,21 +1103,33 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce84f71c72fee2cbbadde6e7d082f5fb466e3a84733855295fa7aafd1b31b7d8"
 dependencies = [
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 0.2.0",
+ "aws-smithy-types",
+ "xmlparser",
+]
+
+[[package]]
+name = "aws-smithy-xml"
+version = "0.64.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6581618a2fd006159016d1c36881d94d61b4a017f4a8d631310875e18252413"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
  "xmlparser",
 ]
 
 [[package]]
 name = "aws-types"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "209f3a6d82a6e9e5f94abbed94c7a26e1c052341002bf57a5fb5481f625896fc"
+checksum = "6ba0d970d3947bb064d2ae1d823efa186c1dbde88f88afa8f6549946e5d8deee"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-async",
  "aws-smithy-runtime-api",
- "aws-smithy-schema",
+ "aws-smithy-schema 1.1.0",
  "aws-smithy-types",
  "rustc_version",
  "tracing",
@@ -1085,12 +1183,6 @@ dependencies = [
  "tower-service",
 ]
 
-[[package]]
-name = "base16ct"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
-
 [[package]]
 name = "base16ct"
 version = "1.0.0"
@@ -1103,6 +1195,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64-simd"
 version = "0.8.0"
@@ -1119,6 +1217,15 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitcode"
 version = "0.6.9"
@@ -1176,6 +1283,17 @@ dependencies = [
  "objc2",
 ]
 
+[[package]]
+name = "bollard-stubs"
+version = "1.53.1-rc.29.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce412eb6f7096743011dc3cb5c674caeb24ced61d8c498fe07cf7998a4fea889"
+dependencies = [
+ "serde",
+ "serde_json",
+ "serde_repr",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -1239,7 +1357,7 @@ checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.1",
- "rand_core 0.10.1",
+ "rand_core",
 ]
 
 [[package]]
@@ -1320,12 +1438,6 @@ dependencies = [
  "yaml-rust2",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
-
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -1460,28 +1572,16 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "crypto-bigint"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "crypto-bigint"
-version = "0.7.5"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+checksum = "9c035cb64cba03dad2fb921f3e218785e8cf9a41790da5eb3a1400f62fa2be11"
 dependencies = [
  "cpubits",
  "ctutils",
  "getrandom 0.4.3",
  "hybrid-array",
  "num-traits",
- "rand_core 0.10.1",
+ "rand_core",
  "subtle",
  "zeroize",
 ]
@@ -1504,14 +1604,14 @@ checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "getrandom 0.4.3",
  "hybrid-array",
- "rand_core 0.10.1",
+ "rand_core",
 ]
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "fe3e9d21d39e6f39ff46e03d5b621424f88ee23d8a1672c6bfc9ccc7f2da4f6a"
 dependencies = [
  "cmov",
  "subtle",
@@ -1532,15 +1632,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "der"
-version = "0.7.10"
+name = "data-encoding"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
-dependencies = [
- "const-oid 0.9.6",
- "pem-rfc7468",
- "zeroize",
-]
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
 [[package]]
 name = "der"
@@ -1548,10 +1643,24 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
 dependencies = [
- "const-oid 0.10.2",
+ "const-oid",
  "zeroize",
 ]
 
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -1565,9 +1674,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid 0.9.6",
  "crypto-common 0.1.6",
- "subtle",
 ]
 
 [[package]]
@@ -1577,7 +1684,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
- "const-oid 0.10.2",
+ "const-oid",
  "crypto-common 0.2.2",
  "ctutils",
 ]
@@ -1599,32 +1706,18 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
-[[package]]
-name = "ecdsa"
-version = "0.16.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
-dependencies = [
- "der 0.7.10",
- "digest 0.10.7",
- "elliptic-curve 0.13.8",
- "rfc6979 0.4.0",
- "signature 2.2.0",
- "spki 0.7.3",
-]
-
 [[package]]
 name = "ecdsa"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
 dependencies = [
- "der 0.8.2",
+ "der",
  "digest 0.11.3",
- "elliptic-curve 0.14.1",
- "rfc6979 0.6.0",
- "signature 3.0.0",
- "spki 0.8.0",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
  "zeroize",
 ]
 
@@ -1634,42 +1727,22 @@ version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
-[[package]]
-name = "elliptic-curve"
-version = "0.13.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
-dependencies = [
- "base16ct 0.2.0",
- "crypto-bigint 0.5.5",
- "digest 0.10.7",
- "ff 0.13.1",
- "generic-array",
- "group 0.13.0",
- "pem-rfc7468",
- "pkcs8 0.10.2",
- "rand_core 0.6.4",
- "sec1 0.7.3",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "elliptic-curve"
 version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
 dependencies = [
- "base16ct 1.0.0",
- "crypto-bigint 0.7.5",
+ "base16ct",
+ "crypto-bigint",
  "crypto-common 0.2.2",
  "digest 0.11.3",
- "ff 0.14.0",
- "group 0.14.0",
+ "ff",
+ "group",
  "hybrid-array",
- "pkcs8 0.11.0",
- "rand_core 0.10.1",
- "sec1 0.8.1",
+ "pkcs8",
+ "rand_core",
+ "sec1",
  "subtle",
  "zeroize",
 ]
@@ -1713,22 +1786,22 @@ checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "ff"
-version = "0.13.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
 dependencies = [
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
 [[package]]
-name = "ff"
-version = "0.14.0"
+name = "filetime"
+version = "0.2.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
 dependencies = [
- "rand_core 0.10.1",
- "subtle",
+ "cfg-if",
+ "libc",
 ]
 
 [[package]]
@@ -1871,7 +1944,6 @@ checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
 dependencies = [
  "typenum",
  "version_check",
- "zeroize",
 ]
 
 [[package]]
@@ -1897,7 +1969,7 @@ dependencies = [
  "js-sys",
  "libc",
  "r-efi",
- "rand_core 0.10.1",
+ "rand_core",
  "wasm-bindgen",
 ]
 
@@ -1908,15 +1980,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e762b9b188634fc508d4ec54b62ea3d352c43fd431d18d05d46f559f217f4725"
 
 [[package]]
-name = "group"
-version = "0.13.0"
+name = "glob"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
-dependencies = [
- "ff 0.13.1",
- "rand_core 0.6.4",
- "subtle",
-]
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
 [[package]]
 name = "group"
@@ -1924,16 +1991,16 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
 dependencies = [
- "ff 0.14.0",
- "rand_core 0.10.1",
+ "ff",
+ "rand_core",
  "subtle",
 ]
 
 [[package]]
 name = "h2"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2000,15 +2067,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
-[[package]]
-name = "hmac"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "hmac"
 version = "0.13.0"
@@ -2098,9 +2156,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2137,16 +2195,17 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-util",
  "http 1.5.0",
  "http-body 1.1.0",
+ "httparse",
  "hyper",
  "ipnet",
  "libc",
@@ -2387,11 +2446,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "93f50113171a713f4a4231ef82eb26703607139b35dcb56241f0ceab2ae1f7d8"
 dependencies = [
  "cpubits",
- "ecdsa 0.17.0",
- "elliptic-curve 0.14.1",
- "primeorder 0.14.0",
- "sha2 0.11.0",
- "signature 3.0.0",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+ "signature",
  "wnaf",
 ]
 
@@ -2495,6 +2554,12 @@ dependencies = [
  "half",
 ]
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.9.1"
@@ -2544,6 +2609,28 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2602,6 +2689,15 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
 
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -2620,18 +2716,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
 
-[[package]]
-name = "p256"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
-dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
- "primeorder 0.13.6",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -2661,15 +2745,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
-[[package]]
-name = "pem-rfc7468"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
-dependencies = [
- "base64ct",
-]
-
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -2682,30 +2757,14 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
-[[package]]
-name = "pkcs8"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
-dependencies = [
- "der 0.7.10",
- "spki 0.7.3",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
- "der 0.8.2",
- "spki 0.8.0",
+ "der",
+ "spki",
 ]
 
 [[package]]
@@ -2735,30 +2794,21 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
 dependencies = [
- "crypto-bigint 0.7.5",
+ "crypto-bigint",
  "crypto-common 0.2.2",
- "ff 0.14.0",
- "rand_core 0.10.1",
+ "ff",
+ "rand_core",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "primeorder"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
-dependencies = [
- "elliptic-curve 0.13.8",
-]
-
 [[package]]
 name = "primeorder"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
 dependencies = [
- "elliptic-curve 0.14.1",
+ "elliptic-curve",
  "once_cell",
  "primefield",
  "serdect",
@@ -2774,6 +2824,22 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "proptest"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8530004ccb15eae51c7e40009fbe317f341f804db54dc033eec1c50be28cfa0"
+dependencies = [
+ "bitflags",
+ "chacha20",
+ "core_detect",
+ "num-traits",
+ "rand",
+ "rand_xorshift",
+ "regex-syntax",
+ "unarray",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.41.0"
@@ -2805,9 +2871,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.17"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "aws-lc-rs",
  "bytes",
@@ -2863,16 +2929,7 @@ checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
+ "rand_core",
 ]
 
 [[package]]
@@ -2887,7 +2944,29 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
 dependencies = [
- "rand_core 0.10.1",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60aa6af80be32871323012e02e6e65f8a7cc7890931ae421d217ad8fe0df2ccf"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.14.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8774e05a7d0de114588e6a28fe7e71694b82614ed569d86d8b389dfbc98b8ad8"
+dependencies = [
+ "aws-lc-rs",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
 ]
 
 [[package]]
@@ -2934,13 +3013,19 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
+[[package]]
+name = "relative-path"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
+
 [[package]]
 name = "reqwest"
 version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-core",
  "http 1.5.0",
@@ -2978,7 +3063,7 @@ version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "encoding_rs",
  "futures-core",
@@ -3012,24 +3097,14 @@ dependencies = [
  "web-sys",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
-dependencies = [
- "hmac 0.12.1",
- "subtle",
-]
-
 [[package]]
 name = "rfc6979"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
 dependencies = [
- "crypto-bigint 0.7.5",
- "hmac 0.13.0",
+ "crypto-bigint",
+ "hmac",
 ]
 
 [[package]]
@@ -3046,12 +3121,38 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rstest"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b376e512f30a7686a8dbc6aeaace99b3ade1c26c1c63473473a817ade226dafc"
+dependencies = [
+ "rstest_macros",
+]
+
+[[package]]
+name = "rstest_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88512dbfb5b73a0dfa38aef7bc73b5657035fce477b923faf12d332dd83051ea"
+dependencies = [
+ "cfg-if",
+ "glob",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "relative-path",
+ "rustc_version",
+ "syn 2.0.119",
+ "unicode-ident",
+]
+
 [[package]]
 name = "rustack-apigatewayv2-core"
 version = "0.11.0"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -3105,15 +3206,15 @@ dependencies = [
 name = "rustack-auth"
 version = "0.11.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "chrono",
  "digest 0.11.3",
  "hex",
- "hmac 0.13.0",
+ "hmac",
  "http 1.5.0",
  "percent-encoding",
  "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2",
  "subtle",
  "thiserror",
  "tokio",
@@ -3129,16 +3230,23 @@ dependencies = [
  "aws-config",
  "aws-credential-types",
  "aws-sdk-dynamodb",
+ "aws-sdk-lambda",
  "aws-sdk-s3",
+ "aws-sdk-sfn",
  "aws-sdk-sqs",
  "aws-smithy-runtime-api",
+ "base64 0.22.1",
  "bytes",
  "ciborium",
  "crc32fast",
+ "getrandom 0.4.3",
  "http 1.5.0",
  "http-body-util",
  "hyper",
  "hyper-util",
+ "nix",
+ "proptest",
+ "rstest",
  "rustack-apigatewayv2-core",
  "rustack-apigatewayv2-http",
  "rustack-auth",
@@ -3163,6 +3271,7 @@ dependencies = [
  "rustack-kms-http",
  "rustack-lambda-core",
  "rustack-lambda-http",
+ "rustack-lambda-model",
  "rustack-logs-core",
  "rustack-logs-http",
  "rustack-s3-core",
@@ -3179,15 +3288,24 @@ dependencies = [
  "rustack-sqs-model",
  "rustack-ssm-core",
  "rustack-ssm-http",
+ "rustack-stepfunctions-core",
+ "rustack-stepfunctions-http",
+ "rustack-stepfunctions-model",
  "rustack-sts-core",
  "rustack-sts-http",
  "serde",
  "serde_json",
+ "sha2",
+ "tar",
  "tempfile",
+ "thiserror",
  "tokio",
  "tokio-test",
  "tracing",
  "tracing-subscriber",
+ "uuid",
+ "yaml-rust2",
+ "zip",
  "zstd",
 ]
 
@@ -3237,7 +3355,7 @@ dependencies = [
 name = "rustack-cloudfront-http"
 version = "0.11.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "form_urlencoded",
@@ -3336,6 +3454,8 @@ dependencies = [
  "http 1.5.0",
  "http-body 1.1.0",
  "http-body-util",
+ "proptest",
+ "rstest",
  "serde",
  "serde_json",
  "thiserror",
@@ -3395,7 +3515,7 @@ dependencies = [
 name = "rustack-dynamodb-model"
 version = "0.9.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "http 1.5.0",
@@ -3595,7 +3715,7 @@ dependencies = [
  "aws-sdk-ssm",
  "aws-sdk-sts",
  "aws-smithy-runtime-api",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures",
  "rand",
@@ -3619,7 +3739,7 @@ name = "rustack-kinesis-core"
 version = "0.11.0"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -3665,7 +3785,7 @@ dependencies = [
 name = "rustack-kinesis-model"
 version = "0.9.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "http 1.5.0",
@@ -3679,7 +3799,7 @@ version = "0.11.0"
 dependencies = [
  "anyhow",
  "aws-lc-rs",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -3723,7 +3843,7 @@ dependencies = [
 name = "rustack-kms-model"
 version = "0.10.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "http 1.5.0",
@@ -3737,28 +3857,42 @@ version = "0.11.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "base64",
+ "base64 0.22.1",
+ "bollard-stubs",
  "bytes",
  "chrono",
  "dashmap",
+ "form_urlencoded",
+ "hex",
  "http 1.5.0",
  "http-body-util",
  "hyper",
  "hyper-util",
+ "nix",
  "parking_lot",
+ "percent-encoding",
+ "proptest",
+ "rstest",
  "rustack-auth",
  "rustack-core",
  "rustack-lambda-http",
  "rustack-lambda-model",
+ "rustack-lambda-runtime",
+ "secrecy",
  "serde",
  "serde_json",
- "sha2 0.11.0",
+ "sha2",
  "squib",
+ "tar",
  "tempfile",
  "thiserror",
  "tokio",
  "tracing",
+ "tracing-subscriber",
+ "typed-builder",
  "uuid",
+ "winnow",
+ "yaml-rust2",
  "zip",
 ]
 
@@ -3766,13 +3900,21 @@ dependencies = [
 name = "rustack-lambda-echo-bootstrap"
 version = "0.9.0"
 dependencies = [
- "base64",
+ "anyhow",
+ "aws-credential-types",
+ "aws-sdk-sfn",
+ "base64 0.22.1",
  "rustack-lambda-core",
  "rustack-lambda-model",
+ "secrecy",
+ "serde",
  "serde_json",
  "tempfile",
  "tokio",
+ "typed-builder",
  "ureq",
+ "url",
+ "uuid",
  "zip",
 ]
 
@@ -3807,6 +3949,49 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "rustack-lambda-runtime"
+version = "0.9.0"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "ciborium",
+ "getrandom 0.4.3",
+ "http 1.5.0",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "proptest",
+ "rcgen",
+ "rstest",
+ "rustls",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+ "tracing-core",
+ "tracing-subscriber",
+ "typed-builder",
+ "url",
+ "uuid",
+ "webpki-roots",
+]
+
+[[package]]
+name = "rustack-lambda-runtime-verifier"
+version = "0.9.0"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "rustack-lambda-core",
+ "rustack-lambda-model",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
 [[package]]
 name = "rustack-logs-core"
 version = "0.11.0"
@@ -3865,7 +4050,7 @@ name = "rustack-s3-core"
 version = "0.11.0"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "crc32c",
@@ -3887,7 +4072,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2",
  "tempfile",
  "thiserror",
  "tokio",
@@ -3918,7 +4103,7 @@ dependencies = [
  "rustack-s3-core",
  "rustack-s3-model",
  "rustack-s3-xml",
- "sha2 0.11.0",
+ "sha2",
  "thiserror",
  "tokio",
  "tokio-test",
@@ -3952,7 +4137,7 @@ dependencies = [
 name = "rustack-secretsmanager-core"
 version = "0.11.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -3994,7 +4179,7 @@ dependencies = [
 name = "rustack-secretsmanager-model"
 version = "0.9.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "http 1.5.0",
@@ -4007,7 +4192,7 @@ name = "rustack-ses-core"
 version = "0.11.0"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -4064,7 +4249,7 @@ version = "0.11.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -4077,7 +4262,7 @@ dependencies = [
  "rustack-sns-model",
  "serde",
  "serde_json",
- "sha2 0.11.0",
+ "sha2",
  "thiserror",
  "tokio",
  "tracing",
@@ -4119,7 +4304,7 @@ name = "rustack-sqs-core"
 version = "0.11.0"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -4133,7 +4318,7 @@ dependencies = [
  "rustack-sqs-model",
  "serde",
  "serde_json",
- "sha2 0.11.0",
+ "sha2",
  "thiserror",
  "tokio",
  "tracing",
@@ -4166,7 +4351,7 @@ dependencies = [
 name = "rustack-sqs-model"
 version = "0.9.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "http 1.5.0",
  "serde",
@@ -4178,7 +4363,7 @@ name = "rustack-ssm-core"
 version = "0.11.0"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -4226,11 +4411,75 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "rustack-stepfunctions-core"
+version = "0.9.0"
+dependencies = [
+ "bytes",
+ "chrono",
+ "ciborium",
+ "getrandom 0.4.3",
+ "hex",
+ "proptest",
+ "regex",
+ "rstest",
+ "rustack-core",
+ "rustack-stepfunctions-model",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "sha2",
+ "subtle",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "uuid",
+ "winnow",
+]
+
+[[package]]
+name = "rustack-stepfunctions-http"
+version = "0.9.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bytes",
+ "chrono",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "rstest",
+ "rustack-auth",
+ "rustack-core",
+ "rustack-stepfunctions-model",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "rustack-stepfunctions-model"
+version = "0.9.0"
+dependencies = [
+ "chrono",
+ "http 1.5.0",
+ "rstest",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "typed-builder",
+]
+
 [[package]]
 name = "rustack-sts-core"
 version = "0.11.0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chrono",
  "dashmap",
@@ -4291,6 +4540,15 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -4306,9 +4564,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "once_cell",
@@ -4370,9 +4628,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.15"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -4418,29 +4676,24 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "sec1"
-version = "0.7.3"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
 dependencies = [
- "base16ct 0.2.0",
- "der 0.7.10",
- "generic-array",
- "pkcs8 0.10.2",
+ "base16ct",
+ "ctutils",
+ "der",
+ "hybrid-array",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
-name = "sec1"
-version = "0.8.1"
+name = "secrecy"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
+checksum = "e891af845473308773346dc847b2c23ee78fe442e0472ac50e22a18a93d3ae5a"
 dependencies = [
- "base16ct 1.0.0",
- "ctutils",
- "der 0.8.2",
- "hybrid-array",
- "subtle",
  "zeroize",
 ]
 
@@ -4531,6 +4784,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -4549,7 +4813,7 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
 dependencies = [
- "base16ct 1.0.0",
+ "base16ct",
  "serde",
 ]
 
@@ -4581,17 +4845,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
 
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
 [[package]]
 name = "sha2"
 version = "0.11.0"
@@ -4628,16 +4881,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "signature"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "digest 0.10.7",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "signature"
 version = "3.0.0"
@@ -4645,7 +4888,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
 dependencies = [
  "digest 0.11.3",
- "rand_core 0.10.1",
+ "rand_core",
 ]
 
 [[package]]
@@ -4701,16 +4944,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
-[[package]]
-name = "spki"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
-dependencies = [
- "base64ct",
- "der 0.7.10",
-]
-
 [[package]]
 name = "spki"
 version = "0.8.0"
@@ -4718,7 +4951,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
 dependencies = [
  "base64ct",
- "der 0.8.2",
+ "der",
 ]
 
 [[package]]
@@ -4857,8 +5090,6 @@ dependencies = [
 [[package]]
 name = "squib-loader"
 version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5bd137eb148a011bc2debae200a3c428d5e6c0934c242c64e1c89c374af1a69c"
 dependencies = [
  "flate2",
  "squib-arch",
@@ -4873,7 +5104,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "312eb6febdc4336a85e5be8bd92e207e729651ce0ee7380225fcb9d8960d5069"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "parking_lot",
  "serde_json",
@@ -5038,6 +5269,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+]
+
 [[package]]
 name = "target-features"
 version = "0.1.6"
@@ -5143,9 +5384,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.53.1"
+version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
  "bytes",
  "libc",
@@ -5170,9 +5411,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.5"
+version = "0.26.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c85f2c3ef0b1cd58b36682f4b17aaa995f0e5db534d85692b4903abce21f67"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
 dependencies = [
  "rustls",
  "tokio",
@@ -5202,9 +5443,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.19"
+version = "0.7.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
 dependencies = [
  "bytes",
  "futures-core",
@@ -5363,9 +5604,9 @@ dependencies = [
 
 [[package]]
 name = "typed-path"
-version = "0.12.3"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
 
 [[package]]
 name = "typenum"
@@ -5373,6 +5614,12 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -5397,7 +5644,7 @@ version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "log",
  "once_cell",
  "url",
@@ -5475,9 +5722,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
 dependencies = [
  "try-lock",
 ]
@@ -5565,18 +5812,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -5757,8 +6004,8 @@ version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
 dependencies = [
- "ff 0.14.0",
- "group 0.14.0",
+ "ff",
+ "group",
  "hybrid-array",
  "primefield",
 ]
@@ -5769,6 +6016,24 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs",
+ "aws-lc-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
 [[package]]
 name = "xmlparser"
 version = "0.13.6"
@@ -5786,6 +6051,16 @@ dependencies = [
  "hashlink",
 ]
 
+[[package]]
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec",
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.3"
@@ -5891,15 +6166,18 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "518b847fd864440c379748ad684c449f293af68978a485a4ff16f7c901c1f7c4"
 dependencies = [
  "crc32fast",
  "flate2",
+ "getrandom 0.4.3",
  "indexmap",
  "memchr",
+ "nix",
  "typed-path",
+ "windows-sys 0.61.2",
  "zopfli",
 ]
 
@@ -5929,27 +6207,27 @@ dependencies = [
 
 [[package]]
 name = "zstd"
-version = "0.13.3"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "7.3.0"
+version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.1.0+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index f0c41f55..30e68679 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,8 +4,9 @@ members = [
   "apps/*",
   "tests/integration",
   "tests/lambda-fixtures/echo-bootstrap",
+  "tests/lambda-fixtures/runtime-verifier",
 ]
-exclude = ["codegen", "tools/lambda-squib-agent"]
+exclude = ["codegen", "tools/lambda-squib-agent", "patches/squib-loader"]
 resolver = "3"
 
 [workspace.package]
@@ -16,6 +17,7 @@ authors = ["Tyr Chen <tyr.chen@gmail.com>"]
 repository = "https://github.com/tyrchen/rustack"
 
 [workspace.lints.rust]
+rust_2024_compatibility = "warn"
 missing_docs = "warn"
 missing_debug_implementations = "warn"
 
@@ -50,6 +52,10 @@ rustack-sns-core = { version = "0.11.0", path = "crates/rustack-sns-core" }
 rustack-lambda-model = { version = "0.9.0", path = "crates/rustack-lambda-model" }
 rustack-lambda-http = { version = "0.11.0", path = "crates/rustack-lambda-http" }
 rustack-lambda-core = { version = "0.11.0", path = "crates/rustack-lambda-core" }
+rustack-lambda-runtime = { version = "0.9.0", path = "crates/rustack-lambda-runtime" }
+rustack-stepfunctions-model = { version = "0.9.0", path = "crates/rustack-stepfunctions-model" }
+rustack-stepfunctions-http = { version = "0.9.0", path = "crates/rustack-stepfunctions-http" }
+rustack-stepfunctions-core = { version = "0.9.0", path = "crates/rustack-stepfunctions-core" }
 rustack-events-model = { version = "0.10.0", path = "crates/rustack-events-model" }
 rustack-logs-model = { version = "0.9.0", path = "crates/rustack-logs-model" }
 rustack-logs-http = { version = "0.11.0", path = "crates/rustack-logs-http" }
@@ -90,7 +96,7 @@ rustack-cloudfront-dataplane = { version = "0.11.0", path = "crates/rustack-clou
 squib = "0.2.0"
 
 # Async runtime
-tokio = { version = "1.53", features = [
+tokio = { version = "1.54", features = [
   "rt-multi-thread",
   "macros",
   "signal",
@@ -103,7 +109,7 @@ tokio = { version = "1.53", features = [
 ] }
 
 # HTTP / networking
-hyper = { version = "1.11", features = ["server", "http1", "http2"] }
+hyper = { version = "1.12", features = ["server", "client", "http1", "http2"] }
 hyper-util = { version = "0.1", features = [
   "tokio",
   "server-auto",
@@ -115,18 +121,29 @@ http-body-util = "0.1"
 
 # Validated runtime configuration (YAML only).
 config = { version = "0.15.25", default-features = false, features = ["yaml"] }
+# Reuse config's audited event-parser cohort for shallow private credentials.
+yaml-rust2 = { version = "~0.11.1", default-features = false }
+# Owned endpoint probe TLS; explicitly select aws-lc despite feature unification.
+rustls = { version = "~0.23.46", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
+tokio-rustls = { version = "~0.26.6", default-features = false, features = ["aws_lc_rs", "tls12"] }
+webpki-roots = "~1.0.11"
+rcgen = { version = "~0.14.10", default-features = false, features = ["crypto", "aws_lc_rs"] }
 url = "2.5.8"
 
 # Serialization
+bollard-stubs = { version = "=1.53.1-rc.29.3.1", default-features = false }
 serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
+serde_json = { version = "1.0", features = ["float_roundtrip"] }
+getrandom = { version = "0.4.3", features = ["std"] }
 ciborium = "0.2"
 quick-xml = "0.41"
-zstd = { version = "0.13.3", default-features = false }
+zstd = { version = "~0.14.3", default-features = false }
 
 # Error handling
 anyhow = "1.0"
 thiserror = "2.0"
+# Safe relative-descriptor ownership IO; also resolved by ZIP9.
+nix = { version = "0.31.3", default-features = false, features = ["fs", "user", "dir"] }
 
 # Concurrent data structures
 dashmap = "6.2"
@@ -144,6 +161,7 @@ hex = "0.4"
 hmac = "0.13"
 digest = "0.11"
 subtle = "2.6"
+secrecy = "~0.10.3"
 
 # Time / IDs
 chrono = { version = "0.4", features = ["serde"] }
@@ -152,6 +170,7 @@ uuid = { version = "1.26", features = ["v4"] }
 
 # Logging / tracing
 tracing = "0.1"
+tracing-core = "0.1.36"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
 # Async utilities
@@ -164,17 +183,21 @@ regex = "1.13"
 bytes = "1.12"
 rand = "0.10"
 tempfile = "3.27"
-zip = { version = "8", default-features = false, features = ["deflate"] }
+zip = { version = "9.1.1", default-features = false, features = ["deflate"] }
+tar = { version = "0.4.46", default-features = false }
 percent-encoding = "2.3"
 mime = "0.3"
 futures = "0.3"
 pin-project-lite = "0.2"
 typed-builder = "0.23"
+winnow = { version = "1.0", default-features = false, features = ["std", "parser"] }
 form_urlencoded = "1.2"
 
 # Testing
+rstest = { version = "0.28", default-features = false }
+proptest = { version = "1.12", default-features = false, features = ["std"] }
 tokio-test = "0.4"
-aws-config = { version = "1.12", default-features = false, features = [
+aws-config = { version = "1.13", default-features = false, features = [
   "credentials-process",
   "default-https-client",
   "rt-tokio",
@@ -184,7 +207,6 @@ aws-sdk-s3 = { version = "1.145", default-features = false, features = [
   "default-https-client",
   "http-1x",
   "rt-tokio",
-  "sigv4a",
 ] }
 aws-sdk-dynamodb = { version = "1.124", default-features = false, features = [
   "default-https-client",
@@ -194,6 +216,10 @@ aws-sdk-dynamodbstreams = { version = "1", default-features = false, features =
   "default-https-client",
   "rt-tokio",
 ] }
+aws-sdk-sfn = { version = "1.123", default-features = false, features = [
+  "default-https-client",
+  "rt-tokio",
+] }
 aws-sdk-sqs = { version = "1.109", default-features = false, features = [
   "default-https-client",
   "rt-tokio",
@@ -221,7 +247,6 @@ aws-sdk-cloudwatchlogs = { version = "1.150", default-features = false, features
 aws-sdk-eventbridge = { version = "1.116", default-features = false, features = [
   "default-https-client",
   "rt-tokio",
-  "sigv4a",
 ] }
 aws-sdk-kms = { version = "1", default-features = false, features = [
   "default-https-client",
@@ -250,7 +275,6 @@ aws-sdk-iam = { version = "1", default-features = false, features = [
 aws-sdk-sts = { version = "1", default-features = false, features = [
   "default-https-client",
   "rt-tokio",
-  "sigv4a",
 ] }
 aws-sdk-cloudfront = { version = "1", default-features = false, features = [
   "default-https-client",
@@ -259,3 +283,7 @@ aws-sdk-cloudfront = { version = "1", default-features = false, features = [
 reqwest = { version = "0.13", features = ["json"] }
 aws-credential-types = "1.3"
 aws-smithy-runtime-api = "1.16"
+
+[patch.crates-io]
+# D69: source-identical loader with the patched compression dependency.
+squib-loader = { path = "patches/squib-loader" }
diff --git a/Dockerfile b/Dockerfile
index 6f43b209..d34ef4ee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,34 +1,43 @@
 # syntax=docker/dockerfile:1
 
 # Match the repository toolchain pin and add musl targets to that toolchain.
-FROM rust:1.99.0-slim AS builder
+FROM rust:1.99.1-slim AS builder
 RUN apt-get update && apt-get install -y --no-install-recommends musl-tools ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 COPY rust-toolchain.toml ./
 RUN rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl
 COPY Cargo.toml Cargo.lock ./
+COPY patches/ patches/
 COPY crates/ crates/
 COPY apps/ apps/
 COPY tests/ tests/
 
 ARG TARGETARCH
+ARG CARGO_BUILD_JOBS=2
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target \
+    case "$CARGO_BUILD_JOBS" in 1|2|3|4|5|6|7|8) ;; \
+      *) echo "CARGO_BUILD_JOBS must be between 1 and 8" >&2; exit 1 ;; esac && \
     case "$TARGETARCH" in \
       arm64) RUST_TARGET=aarch64-unknown-linux-musl ;; \
       amd64) RUST_TARGET=x86_64-unknown-linux-musl ;; \
       *) echo "unsupported target architecture" >&2; exit 1 ;; \
     esac && \
-    cargo build --locked --release --target "$RUST_TARGET" -p rustack-cli --bin rustack && \
+    rustc --version && cargo --version && \
+    cargo build --locked --release --target "$RUST_TARGET" -p rustack-cli --bin rustack --features stepfunctions && \
     cp "/src/target/$RUST_TARGET/release/rustack" /rustack
-RUN mkdir -p /runtime/tmp /runtime/data && chmod 1777 /runtime/tmp
+RUN mkdir -p /runtime/tmp /runtime/data /runtime/run/rustack \
+    && chmod 1777 /runtime/tmp && chmod 0700 /runtime/data \
+    && chown 65532:65532 /runtime/tmp /runtime/data \
+    && touch /runtime/run/rustack/docker.sock \
+    && chmod 0555 /runtime/run /runtime/run/rustack \
+    && chmod 0444 /runtime/run/rustack/docker.sock
 
 FROM scratch
 COPY --from=builder /rustack /rustack
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY --from=builder --chown=65532:65532 /runtime/tmp /tmp
-COPY --from=builder --chown=65532:65532 /runtime/data /data
+COPY --from=builder /runtime/ /
 WORKDIR /data
 USER 65532:65532
 # Containers opt in to all-interface binding; bare binaries default to loopback.
diff --git a/Makefile b/Makefile
index 4dc8ed10..5726f37d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,63 @@
 build:
 	@cargo build
 
+# P0 evidence tooling is isolated from the production workspace/runtime.
+WORKFLOWS_SPIKE_DIR ?= /tmp/rustack-spikes
+WORKFLOWS_DOCKER_SOCKET ?= /var/run/docker.sock
+WORKFLOWS_OTHER_DOCKER_SOCKET ?=
+WORKFLOWS_ARCH ?= $(if $(filter arm64 aarch64,$(shell uname -m)),arm64,amd64)
+WORKFLOWS_IMAGE_BUILDER ?= docker buildx
+LAMBDA_RUNTIME_DIR ?= /tmp/rustack-lambda-runtime
+LAMBDA_RUNTIME_IMAGE ?= rustack/lambda-runtime:integration-$(WORKFLOWS_ARCH)
+
+lambda-runtime-build:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@cargo lambda build -p rustack-lambda-runtime --bin rustack-lambda-runtime --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release --lambda-dir "$(LAMBDA_RUNTIME_DIR)/$(WORKFLOWS_ARCH)"
+
+lambda-runtime-image: lambda-runtime-build
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --platform "linux/$(WORKFLOWS_ARCH)" --file assets/lambda/runtime/Dockerfile --tag "$(LAMBDA_RUNTIME_IMAGE)" "$(LAMBDA_RUNTIME_DIR)/$(WORKFLOWS_ARCH)/rustack-lambda-runtime"
+
+lambda-runtime-fixture-image:
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --platform "linux/$(WORKFLOWS_ARCH)" --file tools/workflows-spikes/Handler.Dockerfile --tag "rustack-p0-handler:$(WORKFLOWS_ARCH)" tools/workflows-spikes
+
+test-lambda-runtime-docker: lambda-runtime-image lambda-runtime-fixture-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test -p rustack-lambda-runtime --test docker -- --ignored --test-threads=1
+
+test-lambda-docker-wire: lambda-runtime-image lambda-runtime-fixture-image lambda-custom-ric-images lambda-zip-code-build
+	@RUSTACK_ZIP_CODE_BOOTSTRAP="$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/zip-code-bootstrap/bootstrap" RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test -p rustack-lambda-core --test docker_wire -- --ignored --test-threads=1
+
+.PHONY: lambda-runtime-build lambda-runtime-image lambda-runtime-fixture-image test-lambda-runtime-docker test-lambda-docker-wire
+
+workflows-model-check:
+	@python3 -c 'import hashlib,json,pathlib; p=pathlib.Path("codegen/smithy-model"); m=json.loads((p/"stepfunctions.provenance.json").read_text()); raw=(p/"stepfunctions.json").read_bytes(); assert len(raw)==m["bytes"] and hashlib.sha256(raw).hexdigest()==m["sha256"], "SFN source hash mismatch"; s=json.loads(raw)["shapes"][m["service"]]; assert s["version"]=="2016-11-23" and "aws.protocols#awsJson1_0" in s["traits"] and s["traits"]["aws.auth#sigv4"]["name"]=="states"; print("Pinned SFN model verified:",len(s["operations"]),"operations")'
+
+workflows-fixture-check: workflows-model-check
+	@python3 -c 'import json,pathlib; p=pathlib.Path("tests/workflows"); f=json.loads((p/"semantic-cases.json").read_text()); m=json.loads((p/"provenance.json").read_text()); source=json.loads(pathlib.Path("codegen/smithy-model/stepfunctions.provenance.json").read_text()); ids=[c["id"] for c in f["cases"]]; assert f["schemaVersion"]==1 and len(ids)==len(set(ids)) and all(c["source"] in f["sources"] for c in f["cases"]); assert m["awsModelCommit"]==source["commit"] and m["awsModelSha256"]==source["sha256"]; print("Fixture catalog structure/provenance verified:",len(ids),"cases; interpreter execution is not claimed")'
+
+workflows-wire-probe:
+	@PYTHONDONTWRITEBYTECODE=1 uv run --no-project --python 3.13 --with-requirements tests/workflows/requirements.txt python -m unittest discover -s tests/workflows -p 'test_botocore_wire.py' -v
+
+workflows-codegen-spike: workflows-model-check
+	@cargo run --manifest-path codegen/Cargo.toml -- --config codegen/services/stepfunctions.toml --model codegen/smithy-model/stepfunctions.json --output "$(WORKFLOWS_SPIKE_DIR)/stepfunctions-generated/src"
+
+test-workflows-spikes:
+	@cargo test --manifest-path tools/workflows-spikes/Cargo.toml
+	@cargo clippy --manifest-path tools/workflows-spikes/Cargo.toml --all-targets -- -D warnings
+
+workflows-relay-spike-build:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@cargo lambda build --manifest-path tools/workflows-spikes/Cargo.toml --bin relay --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release --lambda-dir "$(WORKFLOWS_SPIKE_DIR)/$(WORKFLOWS_ARCH)"
+
+workflows-relay-spike-images: workflows-relay-spike-build
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --platform "linux/$(WORKFLOWS_ARCH)" --file tools/workflows-spikes/Relay.Dockerfile --tag "rustack-p0-relay:$(WORKFLOWS_ARCH)" "$(WORKFLOWS_SPIKE_DIR)/$(WORKFLOWS_ARCH)/relay"
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --platform "linux/$(WORKFLOWS_ARCH)" --file tools/workflows-spikes/Handler.Dockerfile --tag "rustack-p0-handler:$(WORKFLOWS_ARCH)" tools/workflows-spikes
+
+workflows-relay-spike: workflows-relay-spike-images
+	@cargo run --manifest-path tools/workflows-spikes/Cargo.toml --bin driver -- "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_ARCH)"
+
+.PHONY: workflows-model-check workflows-fixture-check workflows-wire-probe workflows-codegen-spike \
+	test-workflows-spikes workflows-relay-spike-build workflows-relay-spike-images workflows-relay-spike
+
 check:
 	@cargo check --all-targets --all-features
 
@@ -10,6 +67,12 @@ test:
 fmt:
 	@cargo +nightly fmt
 
+fmt-check:
+	@cargo fmt --all -- --check
+	@cargo +nightly fmt --all -- --check
+
+.PHONY: fmt-check
+
 clippy:
 	@cargo clippy --all-targets --all-features -- -D warnings
 
@@ -69,6 +132,285 @@ codegen-lambda:
 	@cd codegen && cargo run -- --config services/lambda.toml --model smithy-model/lambda.json --output ../crates/rustack-lambda-model/src
 	@cargo +nightly fmt -p rustack-lambda-model
 
+codegen-stepfunctions:
+	@cargo run --manifest-path codegen/Cargo.toml -- --config codegen/services/stepfunctions.toml --model codegen/smithy-model/stepfunctions.json --output crates/rustack-stepfunctions-model/src
+	@cargo +nightly fmt -p rustack-stepfunctions-model
+
+check-stepfunctions-codegen:
+	@set -eu; generated=$$(mktemp -d /tmp/rustack-sfn-codegen.XXXXXX); \
+	trap 'rm -rf "$$generated"' EXIT; \
+	cargo run --manifest-path codegen/Cargo.toml -- --config codegen/services/stepfunctions.toml --model codegen/smithy-model/stepfunctions.json --output "$$generated"; \
+	rustup run nightly rustfmt --edition 2024 --config-path rustfmt.toml "$$generated"/*.rs; \
+	diff -r "$$generated" crates/rustack-stepfunctions-model/src
+
+test-stepfunctions-model: check-stepfunctions-codegen
+	@cargo test --manifest-path codegen/Cargo.toml
+	@cargo clippy --manifest-path codegen/Cargo.toml --all-targets -- -D warnings
+	@cargo test -p rustack-stepfunctions-model
+	@cargo clippy -p rustack-stepfunctions-model --lib --no-deps -- -D warnings -W clippy::pedantic -W clippy::missing_errors_doc -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: codegen-stepfunctions check-stepfunctions-codegen test-stepfunctions-model
+
+test-stepfunctions-http:
+	@cargo test -p rustack-stepfunctions-http
+	@cargo clippy -p rustack-stepfunctions-http --lib --no-deps -- -D warnings -W clippy::pedantic -W clippy::missing_errors_doc -W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+test-stepfunctions-http-sdk: test-workflows-manifest
+	@cargo test -p rustack-stepfunctions-http --test network test_should_exchange_signed_boto3_requests_with_typed_transport -- --ignored --test-threads=1
+
+.PHONY: test-stepfunctions-http test-stepfunctions-http-sdk
+
+test-stepfunctions-core:
+	@cargo test -p rustack-stepfunctions-core
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order dataflow::callback_tests
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order payload::tests
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order expression::tests
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order engine::callback
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order compiler::tests
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order engine::fanout::tests
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order engine::scheduler::tests
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order engine::runtime::tests::structured
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order engine::runtime::tests::callback
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order engine::runtime::structured::callback::tests
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order registry::callback
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order registry::tests::nested
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order registry::tests::children
+	@cargo test -p rustack-stepfunctions-core --features serde_json/preserve_order registry::actor::clock_tests::children
+	@cargo clippy -p rustack-stepfunctions-core --all-targets -- -D warnings
+	@cargo clippy -p rustack-stepfunctions-core --lib --no-deps -- -D warnings -W clippy::pedantic -W clippy::missing_errors_doc -W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-stepfunctions-core
+
+test-stepfunctions-bridge:
+	@cargo test -p rustack-cli --lib --features stepfunctions
+	@cargo test -p rustack-cli --doc --features stepfunctions
+	@cargo clippy -p rustack-cli --all-targets --features stepfunctions -- -D warnings
+	@cargo clippy -p rustack-cli --lib --features stepfunctions --no-deps -- -D warnings -W clippy::pedantic -W clippy::missing_errors_doc -W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+test-stepfunctions-bridge-native: test-workflows-manifest
+	@cargo build -p rustack-lambda-echo-bootstrap
+	@RUSTACK_WORKFLOWS_BOOTSTRAP="$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/debug/bootstrap" cargo test -p rustack-cli --lib --features stepfunctions native_e2e -- --ignored --test-threads=1
+
+# The shared binary-support gate covers real API, pagination and Lambda bridge.
+test-stepfunctions-api: test-stepfunctions-bridge
+
+.PHONY: test-stepfunctions-bridge test-stepfunctions-bridge-native test-stepfunctions-api
+
+# Actual main composition and both minimal/runtime feature shapes.
+test-stepfunctions-runtime: test-stepfunctions-api
+	@cargo test -p rustack-cli --bin rustack --features stepfunctions
+	@cargo test -p rustack-cli --bin rustack --no-default-features --features stepfunctions
+	@cargo clippy -p rustack-cli --all-targets --no-default-features --features stepfunctions -- -D warnings
+
+	@cargo clippy -p rustack-cli --bin rustack --features stepfunctions --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+	@cargo clippy -p rustack-cli --bin rustack --no-default-features --features stepfunctions --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-stepfunctions-runtime
+
+# Dedicated build artifact: uv's ephemeral run environment disappears on exit.
+workflows-sdk-python:
+	@uv venv --python 3.13 --allow-existing "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python"
+	@uv pip install --python "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" --requirement tests/workflows/requirements.txt
+
+# Actual provided-runtime handler and strict fixture boundary checks.
+test-stepfunctions-handler-fixture:
+	@cargo build -p rustack-lambda-echo-bootstrap --features sdk-callback --bin callback-bootstrap
+	@cargo clippy -p rustack-lambda-echo-bootstrap --features sdk-callback --bin callback-bootstrap --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+	@python3 -c 'import ast,pathlib; ast.parse(pathlib.Path("tests/lambda-fixtures/callback_bootstrap.py").read_text())'
+
+# Both ordinary SDKs directly own their real client and server processes.
+test-stepfunctions-sdk: test-workflows-manifest workflows-sdk-python test-stepfunctions-handler-fixture
+	@cargo build -p rustack-lambda-echo-bootstrap
+	@RUSTACK_WORKFLOWS_PYTHON="$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" RUSTACK_CALLBACK_BOOTSTRAP="$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/debug/callback-bootstrap" RUSTACK_WORKFLOWS_BOOTSTRAP="$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/debug/bootstrap" cargo test -p rustack-cli --test workflows_sdk --features stepfunctions -- --ignored --test-threads=1 --nocapture
+
+.PHONY: workflows-sdk-python test-stepfunctions-handler-fixture test-stepfunctions-sdk
+
+audit-codegen:
+	@cargo audit --file codegen/Cargo.lock
+
+# D69: source-preserving loader overlay and the complete patched codec graph.
+verify-workflows-compression:
+	@python3 -I -c 'import hashlib,json,pathlib; p=pathlib.Path("patches/squib-loader"); v=json.loads((p/"provenance.json").read_text()); names={"src/lib.rs","Cargo.toml.registry","Cargo.toml.orig",".cargo_vcs_info.json","LICENSE.md"}; assert v["schemaVersion"]==1 and v["package"]=="squib-loader" and v["version"]=="0.2.0"; assert set(v["sha256"])==names; assert all(hashlib.sha256((p/n).read_bytes()).hexdigest()==h for n,h in v["sha256"].items()); original=(p/"Cargo.toml.registry").read_text(); before="[dependencies.zstd]\nversion = \"0.13\""; after="[dependencies.zstd]\nversion = \"0.14.3\""; assert original.count(before)==1 and (p/"Cargo.toml").read_text()==original.replace(before,after); f=pathlib.Path("apps/rustack/src/snapshot/fixtures"); a=json.loads((f/"legacy-v2-meta-provenance.json").read_text()); assert hashlib.sha256((f/a["fixture"]).read_bytes()).hexdigest()==a["sha256"]'
+	@cargo metadata --locked --format-version 1 | python3 -I -c 'import json,pathlib,sys; data=json.load(sys.stdin); minimum={"zstd":(0,14,3),"zstd-safe":(8,2,0),"zstd-sys":(2,1,2)}; codecs=[p for p in data["packages"] if p["name"] in minimum]; assert len(codecs)==3 and {p["name"] for p in codecs}==set(minimum); assert all(tuple(map(int,p["version"].split("+")[0].split(".")))>=minimum[p["name"]] for p in codecs); loader=[p for p in data["packages"] if p["name"]=="squib-loader"]; assert len(loader)==1 and loader[0]["source"] is None and pathlib.Path(loader[0]["manifest_path"]).resolve()==pathlib.Path("patches/squib-loader/Cargo.toml").resolve()'
+
+test-workflows-compression: verify-workflows-compression
+	@cargo test --locked -p squib-loader --lib
+	@cargo test --locked -p rustack-cli --bin rustack --features stepfunctions snapshot::
+
+.PHONY: verify-workflows-compression test-workflows-compression
+
+# D70: installed archive parser/encoder boundaries, including minimal binary builds.
+test-workflows-archive:
+	@cargo test --locked -p rustack-cli --bin rustack --features stepfunctions snapshot::
+	@cargo test --locked -p rustack-cli --bin rustack --no-default-features --features stepfunctions snapshot::
+	@cargo clippy --locked -p rustack-cli --bin rustack --features stepfunctions --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+	@cargo clippy --locked -p rustack-cli --bin rustack --no-default-features --features stepfunctions --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-workflows-archive
+
+# D71: sealed ownership/export, exact history codec and selected runtime consumer.
+test-workflows-snapshot-export:
+	@cargo test --locked -p rustack-stepfunctions-core snapshot
+	@cargo test --locked -p rustack-stepfunctions-core --features serde_json/preserve_order snapshot
+	@cargo clippy --locked -p rustack-stepfunctions-core --lib --no-deps -- -D warnings -W clippy::pedantic -W clippy::missing_errors_doc -W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-workflows-snapshot-export
+
+# D72: startup-only atomic restore, original quotas, complete history and no replay.
+test-workflows-snapshot-restore:
+	@cargo test --locked -p rustack-stepfunctions-core registry::snapshot::restore
+	@cargo test --locked -p rustack-stepfunctions-core --features serde_json/preserve_order registry::snapshot::restore
+	@cargo clippy --locked -p rustack-stepfunctions-core --lib --no-deps -- -D warnings -W clippy::pedantic -W clippy::missing_errors_doc -W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-workflows-snapshot-restore
+
+# D73: actual service archives and signed Native binary restart without replay.
+test-workflows-persistence:
+	@cargo test --locked -p rustack-stepfunctions-core registry::snapshot::archive
+	@cargo test --locked -p rustack-cli --bin rustack --features stepfunctions snapshot::
+	@cargo test --locked -p rustack-cli --bin rustack --no-default-features --features stepfunctions snapshot::
+	@cargo test --locked -p rustack-cli --test workflows_sdk --features stepfunctions persistence::
+	@cargo build --locked -p rustack-lambda-echo-bootstrap --bin bootstrap
+	@RUSTACK_WORKFLOWS_BOOTSTRAP="$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/debug/bootstrap" cargo test --locked -p rustack-cli --test workflows_sdk --features stepfunctions persistence:: -- --ignored --test-threads=1 --nocapture
+
+.PHONY: test-workflows-persistence
+
+# D74: actual pure-workflow latency, bounded loops and one-slot Stop reuse.
+test-workflows-performance:
+	@cargo test --locked -p rustack-cli --test workflows_sdk --features stepfunctions performance::
+	@cargo test --locked -p rustack-cli --test workflows_sdk --features stepfunctions performance:: -- --ignored --test-threads=1 --nocapture
+	@cargo clippy --locked -p rustack-cli --test workflows_sdk --features stepfunctions --no-deps -- -D warnings -W clippy::pedantic
+
+.PHONY: test-workflows-performance
+
+# D101: direct native arm64 Linux measurements, separate from dedicated-reference acceptance.
+WORKFLOWS_LINUX_PROFILE ?= rustack-workflows-performance-arm64
+WORKFLOWS_LINUX_EVIDENCE_DIR ?= $(shell cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-linux-performance
+
+test-workflows-performance-linux-controls:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_linux_performance.py -v
+
+workflows-performance-linux-provision: test-workflows-performance-linux-controls
+	@python3 -I -B tests/workflows/linux_performance.py provision "$(WORKFLOWS_LINUX_PROFILE)" "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')"
+
+workflows-performance-linux-build: test-workflows-server-linker test-workflows-performance-linux-controls
+	@mkdir -p "$(WORKFLOWS_LINUX_EVIDENCE_DIR)"
+	@CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER="$(CURDIR)/tests/workflows/server_linker.py" WORKFLOWS_SERVER_LINKER_TOOL="$$(command -v cargo-zigbuild)" WORKFLOWS_SERVER_LINKER_TARGET=aarch64-linux-gnu CARGO_ZIGBUILD_ZIG_VERSION="$$(zig version)" cargo zigbuild --locked -p rustack-cli --test workflows_sdk --no-default-features --features lambda,stepfunctions,s3,dynamodb --target aarch64-unknown-linux-gnu --message-format=json >"$(WORKFLOWS_LINUX_EVIDENCE_DIR)/build.json"
+
+test-workflows-performance-linux: workflows-performance-linux-build
+	@python3 -I -B tests/workflows/linux_performance.py host "$(WORKFLOWS_LINUX_PROFILE)" "$(WORKFLOWS_LINUX_EVIDENCE_DIR)/build.json"
+
+.PHONY: test-workflows-performance-linux-controls workflows-performance-linux-provision workflows-performance-linux-build test-workflows-performance-linux
+
+# D102: actual image samples and causal log-flood/timeout cleanup.
+test-workflows-image-performance-controls:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_image_performance.py -v
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_image_performance_channel.py -v
+	@$(MAKE) --no-print-directory test-workflows-performance-linux-controls
+
+test-workflows-image-performance: test-workflows-image-performance-controls test-lambda-docker-manifest
+	@set -eu; for performance_case in \
+		test_should_measure_one_hundred_warm_image_invocations \
+		test_should_measure_twenty_preloaded_cold_image_environments \
+		test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts; do \
+		$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) "$$performance_case" -- --ignored --exact --nocapture --test-threads=1; \
+	done
+
+workflows-image-performance-linux-build: test-workflows-server-linker test-workflows-image-performance-controls
+	@mkdir -p "$(WORKFLOWS_LINUX_EVIDENCE_DIR)"
+	@CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER="$(CURDIR)/tests/workflows/server_linker.py" WORKFLOWS_SERVER_LINKER_TOOL="$$(command -v cargo-zigbuild)" WORKFLOWS_SERVER_LINKER_TARGET=aarch64-linux-gnu CARGO_ZIGBUILD_ZIG_VERSION="$$(zig version)" cargo zigbuild --locked -p rustack-cli --test docker_startup --no-default-features --features lambda,stepfunctions,s3,dynamodb --target aarch64-unknown-linux-gnu --message-format=json >"$(WORKFLOWS_LINUX_EVIDENCE_DIR)/image-build.json"
+
+workflows-image-performance-linux-images:
+	@python3 -I -B tests/workflows/image_performance_images.py prepare "$(WORKFLOWS_LINUX_PROFILE)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_LINUX_EVIDENCE_DIR)" v1
+
+test-workflows-image-performance-linux: workflows-image-performance-linux-build test-lambda-docker-manifest
+	@python3 -I -B tests/workflows/linux_image_performance.py host "$(WORKFLOWS_LINUX_PROFILE)" "$(WORKFLOWS_LINUX_EVIDENCE_DIR)/image-build.json" "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/lib/python3.13/site-packages"
+
+.PHONY: test-workflows-image-performance-controls test-workflows-image-performance workflows-image-performance-linux-build workflows-image-performance-linux-images test-workflows-image-performance-linux
+
+# D103: isolated rootless infrastructure; full platform qualification stays separate.
+WORKFLOWS_ROOTLESS_PROFILE ?= rustack-workflows-rootless-arm64
+WORKFLOWS_ROOTLESS_PREVIOUS_EVIDENCE_DIR ?=
+WORKFLOWS_ROOTLESS_EVIDENCE_DIR ?= $(shell cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-rootless-d103
+
+test-workflows-rootless-controls:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_rootless_platform.py -v
+
+workflows-rootless-provision: test-workflows-rootless-controls
+	@python3 -I -B tests/workflows/rootless_platform.py provision "$(WORKFLOWS_ROOTLESS_PROFILE)" "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')" "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)"
+
+workflows-rootless-attest: test-workflows-rootless-controls
+	@python3 -I -B tests/workflows/rootless_platform.py attest "$(WORKFLOWS_ROOTLESS_PROFILE)" "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)"
+
+workflows-rootless-resume-setup: test-workflows-rootless-controls
+	@python3 -I -B tests/workflows/rootless_platform.py resume "$(WORKFLOWS_ROOTLESS_PROFILE)" "$(WORKFLOWS_ROOTLESS_PREVIOUS_EVIDENCE_DIR)" "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)"
+
+workflows-rootless-recover-attestation: test-workflows-rootless-controls
+	@python3 -I -B tests/workflows/rootless_platform.py recover-attest "$(WORKFLOWS_ROOTLESS_PROFILE)" "$(WORKFLOWS_ROOTLESS_PREVIOUS_EVIDENCE_DIR)" "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)"
+
+.PHONY: test-workflows-rootless-controls workflows-rootless-provision workflows-rootless-attest workflows-rootless-resume-setup workflows-rootless-recover-attestation
+
+# D104: explicit preloaded rootless resource consumers, preserving D103 installation.
+WORKFLOWS_ROOTLESS_FORWARD_DIR ?= /tmp/rustack-rootless-forward-d104
+WORKFLOWS_ROOTLESS_RESOURCE_DIR ?= $(shell cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-rootless-resources-d104
+
+test-workflows-rootless-resource-controls:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_rootless_resources.py -v
+
+workflows-rootless-forward: test-workflows-rootless-resource-controls
+	@python3 -I -B tests/workflows/rootless_resources.py forward "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)" "$(WORKFLOWS_ROOTLESS_FORWARD_DIR)"
+
+workflows-rootless-kernel-images: test-workflows-rootless-resource-controls
+	@python3 -I -B tests/workflows/rootless_resources.py prepare "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_ROOTLESS_FORWARD_DIR)" "$(WORKFLOWS_ROOTLESS_RESOURCE_DIR)"
+
+workflows-rootless-functional-images: test-workflows-rootless-resource-controls
+	@python3 -I -B tests/workflows/rootless_resources.py prepare-full "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_ROOTLESS_FORWARD_DIR)" "$(WORKFLOWS_ROOTLESS_RESOURCE_DIR)"
+
+test-workflows-rootless-kernel: test-workflows-rootless-resource-controls
+	@python3 -I -B tests/workflows/rootless_resources.py kernel "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)" "$(WORKFLOWS_ROOTLESS_FORWARD_DIR)" "$(WORKFLOWS_ROOTLESS_RESOURCE_DIR)" "$(WORKFLOWS_DOCKER_TARGET_DIR)"
+
+test-workflows-rootless-functional: test-workflows-rootless-resource-controls
+	@python3 -I -B tests/workflows/rootless_functional.py "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)" "$(WORKFLOWS_ROOTLESS_FORWARD_DIR)" "$(WORKFLOWS_ROOTLESS_RESOURCE_DIR)" "$(WORKFLOWS_DOCKER_TARGET_DIR)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/arm64" "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" "$(WORKFLOWS_OTHER_DOCKER_SOCKET)"
+
+test-workflows-rootless-server: test-workflows-rootless-resource-controls
+	@python3 -I -B tests/workflows/rootless_functional.py --server-focus "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)" "$(WORKFLOWS_ROOTLESS_FORWARD_DIR)" "$(WORKFLOWS_ROOTLESS_RESOURCE_DIR)" "$(WORKFLOWS_DOCKER_TARGET_DIR)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/arm64" "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" "$(WORKFLOWS_OTHER_DOCKER_SOCKET)"
+
+.PHONY: test-workflows-rootless-resource-controls workflows-rootless-forward workflows-rootless-kernel-images workflows-rootless-functional-images test-workflows-rootless-kernel test-workflows-rootless-functional test-workflows-rootless-server
+
+WORKFLOWS_RUST_EVIDENCE_DIR ?= $(shell cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-rust-verification
+
+verify-workflows-rust:
+	@python3 -I -B tests/workflows/rust_gates.py "$(WORKFLOWS_RUST_EVIDENCE_DIR)"
+
+.PHONY: verify-workflows-rust
+
+# D75: exact same-feature resource inventories, before any resource execution.
+test-workflows-manifest:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_required_suites.py -v
+	@set -eu; \
+		workflow_manifest_dir=$$(mktemp -d); \
+		trap 'rm -rf "$$workflow_manifest_dir"' EXIT; \
+		cargo test --locked -p rustack-cli --lib --features stepfunctions -- --ignored --list --color never >"$$workflow_manifest_dir/native-bridge.txt"; \
+		cargo test --locked -p rustack-cli --test workflows_sdk --features stepfunctions -- --ignored --list --color never >"$$workflow_manifest_dir/registered-sdk.txt"; \
+		cargo test --locked -p rustack-stepfunctions-http --test network -- --ignored --list --color never >"$$workflow_manifest_dir/typed-http-sdk.txt"; \
+		python3 -I -B tests/workflows/required_suites.py "$$workflow_manifest_dir"
+
+# This owned pure-service smoke needs no Native bootstrap, uv, boto3 or Docker.
+smoke-workflows: test-workflows-manifest
+	@cargo test --locked -p rustack-cli --test workflows_sdk --features stepfunctions test_should_execute_documented_pure_workflow_in_owned_strict_service -- --ignored --exact --nocapture
+
+# Explicit current-host workflow scope; the full image/platform release gate remains open.
+verify-workflows-native: test-workflows-manifest
+	@$(MAKE) --no-print-directory -j1 test-stepfunctions-model test-stepfunctions-http test-stepfunctions-http-sdk test-stepfunctions-core test-stepfunctions-runtime test-stepfunctions-bridge-native test-stepfunctions-sdk test-workflows-persistence test-workflows-performance test-workflows-archive test-workflows-compression
+	@echo 'Verified native-workflow-only suites; image/ZIP/IaC/reference-platform release acceptance remains required.'
+
+.PHONY: test-workflows-manifest smoke-workflows verify-workflows-native
+
+deny-codegen:
+	@cargo deny --manifest-path codegen/Cargo.toml check
+
+.PHONY: audit-codegen deny-codegen
+
 codegen-kms:
 	@cd codegen && cargo run -- --config services/kms.toml --model smithy-model/kms.json --output ../crates/rustack-kms-model/src
 	@cargo +nightly fmt -p rustack-kms-model
@@ -158,6 +500,8 @@ SERVICE_SMOKE_TESTS := \
 	test_sts::tests::test_should_get_caller_identity_root \
 	test_lambda::tests::test_should_create_and_get_function \
 	test_lambda::tests::test_should_invoke_dry_run \
+	test_lambda::tests::test_should_enforce_revision_preconditions_through_the_sdk_wire \
+	test_lambda::tests::test_should_dry_run_code_without_mutation_and_reject_unsupported_deployment_fields \
 	test_lambda::tests::test_should_create_function_with_s3_code \
 	test_lambda::tests::test_should_update_function_code_from_s3_and_read_new_metadata \
 	test_lambda::tests::test_should_fail_create_function_with_missing_s3_bucket \
@@ -197,6 +541,68 @@ smoke:
 integration:
 	@cargo test -p rustack-integration -- --ignored
 
+# Shared runtime protocol tests and strict production boundary checks.
+test-json-boundaries:
+	@cargo test -p rustack-core
+	@cargo clippy -p rustack-core --lib --no-deps -- \
+		-D warnings -W clippy::pedantic -W clippy::missing_errors_doc \
+		-W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used \
+		-W clippy::indexing_slicing -W clippy::panic
+
+# Requires a running Lambda HTTP service at SMOKE_ENDPOINT; executes actual AWS SDK IO.
+test-lambda-revision-wire:
+	@S3_ENDPOINT_URL="$(SMOKE_ENDPOINT)" cargo test -p rustack-integration --lib test_lambda::tests::test_should_enforce_revision_preconditions_through_the_sdk_wire -- --ignored --exact --test-threads=1
+
+.PHONY: test-lambda-revision-wire
+
+test-lambda-validation-wire:
+	@S3_ENDPOINT_URL="$(SMOKE_ENDPOINT)" cargo test -p rustack-integration --lib test_lambda::tests::test_should_dry_run_code_without_mutation_and_reject_unsupported_deployment_fields -- --ignored --exact --test-threads=1
+
+.PHONY: test-lambda-validation-wire
+
+# Deployment state, retained image preparation ownership and provider control-plane tests.
+test-lambda-deployments:
+	@cargo test -p rustack-lambda-core --lib deployment
+
+.PHONY: test-lambda-deployments
+
+test-lambda-runtime:
+	@cargo test -p rustack-lambda-runtime
+	@cargo clippy -p rustack-lambda-runtime --lib --no-deps -- \
+		-D warnings -W clippy::pedantic -W clippy::missing_errors_doc \
+		-W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used \
+		-W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-json-boundaries test-lambda-runtime
+
+# Strict production-library boundary gate; unit, integration and doctest regressions.
+test-lambda-boundaries:
+	@cargo test -p rustack-auth -p rustack-core -p rustack-lambda-model -p rustack-lambda-http -p rustack-lambda-core -p rustack-lambda-runtime
+	@cargo clippy -p rustack-auth -p rustack-core -p rustack-lambda-model -p rustack-lambda-http -p rustack-lambda-core -p rustack-lambda-runtime --lib --no-deps -- \
+		-D warnings -W clippy::pedantic -W clippy::missing_errors_doc \
+		-W clippy::doc_markdown -W clippy::unwrap_used -W clippy::expect_used \
+		-W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-lambda-boundaries
+
+# Descriptor lifetime, persisted namespace identity and cleanup ownership.
+test-lambda-ownership:
+	@cargo test -p rustack-lambda-core --lib docker::ownership::tests
+	@cargo test -p rustack-lambda-core --lib test_should_retain_the_directory_lock_through_abandoned_image_owner_cleanup
+
+.PHONY: test-lambda-ownership
+
+# Bounded function output, snapshot/read fairness and joined attachment cleanup.
+test-lambda-logs:
+	@cargo test -p rustack-lambda-core --lib docker::logs::tests
+
+.PHONY: test-lambda-logs
+
+test-lambda-environment-plans:
+	@cargo test -p rustack-lambda-core --lib docker::plan::tests
+
+.PHONY: test-lambda-environment-plans
+
 # Real-execution Lambda invoke tests (native backend).
 # Builds a Rust bootstrap fixture and invokes it through the rustack provider.
 test-lambda-invoke-native:
@@ -756,3 +1162,671 @@ test-iam-integration:
 	test-iam-unit test-iam-integration
 
 .PHONY: smoke smoke-services smoke-regressions
+
+# Explicit real two-container environment lifecycle qualification.
+test-lambda-environments-docker: lambda-runtime-image lambda-runtime-fixture-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test -p rustack-lambda-core --test docker_environment -- --ignored --test-threads=1
+
+.PHONY: test-lambda-environments-docker
+
+# Pure ownership/failure regressions plus transport failure precedence.
+test-lambda-environments:
+	@cargo test -p rustack-lambda-core --lib docker::environment::tests
+	@cargo test -p rustack-lambda-runtime --lib test_should_preserve_transport_worker_failure_after_a_prior_scope_error
+
+.PHONY: test-lambda-environments
+
+# Warm checkout ownership, bounded FIFO, LRU and result-consumption regressions.
+test-lambda-pool:
+	@cargo test -p rustack-lambda-core --lib docker::pool::tests
+
+# Includes the real warm-counter/revision-eviction case and owner regressions.
+test-lambda-pool-docker: test-lambda-environments-docker
+
+.PHONY: test-lambda-pool test-lambda-pool-docker
+
+# Actual Docker Executor/provider/HTTP composition via pinned ordinary boto3.
+test-lambda-executor:
+	@cargo test -p rustack-lambda-core --lib docker::executor::tests
+	@cargo test -p rustack-lambda-core --lib handler::tests
+
+test-lambda-executor-docker: lambda-runtime-image lambda-runtime-fixture-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test -p rustack-lambda-core --test docker_executor -- --ignored --test-threads=1
+
+.PHONY: test-lambda-executor test-lambda-executor-docker
+
+# Container-origin gateway proof requires an explicit operator bridge/host.
+WORKFLOWS_GATEWAY_HOST ?=
+
+test-lambda-endpoints:
+	@cargo test --locked -p rustack-lambda-runtime --lib probe::endpoint
+	@cargo test --locked -p rustack-lambda-runtime --lib diagnostics::
+	@cargo test --locked -p rustack-lambda-core --lib docker::probe
+	@cargo test --locked -p rustack-cli --bin rustack gateway::endpoint_tests
+
+test-lambda-endpoints-docker: lambda-runtime-image lambda-runtime-fixture-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" RUSTACK_RUNTIME_NETWORK="$(WORKFLOWS_NETWORK)" RUSTACK_RUNTIME_GATEWAY_HOST="$(WORKFLOWS_GATEWAY_HOST)" cargo test --locked -p rustack-lambda-core --test docker_endpoint -- --ignored --nocapture --test-threads=1
+
+.PHONY: test-lambda-endpoints test-lambda-endpoints-docker
+
+# The bridge lane requires an explicit pre-provisioned operator network.
+test-lambda-probes:
+	@cargo test -p rustack-lambda-runtime --lib probe::
+	@cargo test -p rustack-lambda-core --lib docker::network::tests
+	@cargo test -p rustack-lambda-core --lib docker::probe::tests
+
+test-lambda-probes-docker: lambda-runtime-image lambda-runtime-fixture-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" RUSTACK_RUNTIME_NETWORK="$(WORKFLOWS_NETWORK)" cargo test -p rustack-lambda-core --test docker_probe -- --ignored --test-threads=1
+
+.PHONY: test-lambda-probes test-lambda-probes-docker
+
+# Durable container identities, uncertain absence and actual restart recovery.
+test-lambda-recovery:
+	@cargo test -p rustack-lambda-core --lib docker::ownership::journal::tests
+	@cargo test -p rustack-lambda-core --lib docker::recovery::tests
+	@cargo test -p rustack-lambda-core --lib docker::environment::tests::test_should_publish_intent_before_create_and_retain_reservation_until_durable_erase
+
+test-lambda-recovery-docker: lambda-runtime-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test -p rustack-lambda-core --lib docker::recovery::tests::test_should_reconcile_real_previous_run_containers_from_durable_intents -- --ignored --test-threads=1
+
+.PHONY: test-lambda-recovery test-lambda-recovery-docker
+
+# Durable private tag intents and container-ordered historical alias recovery.
+test-lambda-image-recovery:
+	@cargo test -p rustack-lambda-core --lib docker::ownership::images::tests
+	@cargo test -p rustack-lambda-core --lib docker::recovery::images::tests
+	@cargo test -p rustack-lambda-core --lib docker::lease::tests
+
+test-lambda-image-recovery-docker: lambda-runtime-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test -p rustack-lambda-core --lib docker::recovery::images::tests::test_should_recover_real_private_alias_across_directory_reacquisition -- --ignored --test-threads=1
+
+.PHONY: test-lambda-image-recovery test-lambda-image-recovery-docker
+
+# Persisted engine scope and same-connection identity fences before owned IO.
+test-lambda-daemon-binding:
+	@cargo test -p rustack-lambda-core --lib docker::binding::tests
+	@cargo test -p rustack-lambda-core --lib docker::ownership::daemon::tests
+
+test-lambda-daemon-binding-docker:
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_OTHER_DOCKER_SOCKET="$(WORKFLOWS_OTHER_DOCKER_SOCKET)" cargo test -p rustack-lambda-core --lib docker::binding::tests::real::test_should_bind_real_installation_across_reacquisition_and_reject_other_daemon -- --ignored --exact --test-threads=1
+
+.PHONY: test-lambda-daemon-binding test-lambda-daemon-binding-docker
+
+# Recorded retirement plus complete bounded startup namespace inventories.
+test-lambda-namespace:
+	@cargo test -p rustack-lambda-core --lib docker::recovery::namespace::tests
+	@cargo test -p rustack-lambda-core --lib docker::recovery::inventory::tests
+
+test-lambda-namespace-docker: lambda-runtime-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test -p rustack-lambda-core --lib docker::recovery::namespace::tests::real::test_should_reconcile_real_namespace_and_preserve_unrecorded_observations -- --ignored --test-threads=1
+
+.PHONY: test-lambda-namespace test-lambda-namespace-docker
+
+# Pure operator settings, private YAML files and retained read-worker limits.
+test-lambda-docker-settings:
+	@cargo test --locked -p rustack-core --lib settings::docker_tests
+	@cargo test --locked -p rustack-lambda-core --lib docker::config
+
+.PHONY: test-lambda-docker-settings
+
+# Exact registry policy, retained pull streams and image-preparation integration.
+WORKFLOWS_PULL_IMAGE ?= public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79
+
+test-lambda-pull:
+	@cargo test --locked -p rustack-lambda-core --lib docker::pull
+
+test-lambda-pull-docker:
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_PULL_IMAGE="$(WORKFLOWS_PULL_IMAGE)" cargo test --locked -p rustack-lambda-core --lib docker::pull::tests::real::test_should_pull_approved_immutable_image_prepare_live_pin_and_join_cleanup -- --ignored --exact --nocapture --test-threads=1
+
+.PHONY: test-lambda-pull test-lambda-pull-docker
+
+# Delivery clocks, protocol-v2 correlation and actual Native process retirement.
+test-lambda-timeouts:
+	@cargo test -p rustack-lambda-runtime --lib
+	@cargo test -p rustack-lambda-echo-bootstrap --test hardening
+
+# Captured handler-timeout/retirement/replacement through the real image pool.
+test-lambda-timeouts-docker: test-lambda-environments-docker
+
+.PHONY: test-lambda-timeouts test-lambda-timeouts-docker
+
+# Invocation log capabilities/receipts and independent diagnostic capture.
+test-lambda-log-windows:
+	@cargo test -p rustack-lambda-core --lib docker::logs::tests
+
+# Includes requested/silent/uncaptured warm-call log isolation on actual images.
+test-lambda-log-windows-docker: test-lambda-environments-docker
+
+.PHONY: test-lambda-log-windows test-lambda-log-windows-docker
+
+
+# Ordinary production startup consumes actual receipts; no fixture readiness injection.
+# Isolate the executable from concurrent plain/minimal workspace builds.
+WORKFLOWS_DOCKER_CLI_FEATURES := lambda,stepfunctions,s3,dynamodb
+WORKFLOWS_DOCKER_TARGET_DIR ?= $(shell cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-docker
+test-lambda-startup:
+	@cargo test --locked -p rustack-core --lib startup_tests
+	@cargo test --locked -p rustack-lambda-core --lib docker::startup
+	@cargo test --locked -p rustack-lambda-core --lib docker::ownership::tests
+	@cargo test --locked -p rustack-cli --bin rustack --features stepfunctions lambda_docker
+
+test-lambda-startup-docker: lambda-docker-fixtures
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) -- --ignored --nocapture --test-threads=1
+
+.PHONY: test-lambda-startup test-lambda-startup-docker
+
+
+# Independent custom Rust RIC fixtures consumed through ordinary production startup.
+LAMBDA_IMAGE_FIXTURE_DIR ?= /tmp/rustack-image-fixture
+lambda-zip-code-build:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@cargo lambda build --locked -p rustack-lambda-echo-bootstrap --bin zip-code-bootstrap --features zip-code --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release --lambda-dir "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)"
+
+test-lambda-provided-fixture:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_provided_zip_fixture.py -v
+	@cargo test --locked -p rustack-lambda-core --lib docker::zip::tests
+	@cargo test --locked -p rustack-lambda-core --lib provider::provided_zip_tests
+	@cargo test --locked -p rustack-lambda-core --lib test_should_acquire_code_profile_with_retained_job
+	@cargo test --locked -p rustack-lambda-core --lib test_should_distinguish_unconfigured_zip
+	@cargo clippy --locked -p rustack-lambda-echo-bootstrap --bin bootstrap --features provided-qualification --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+	@cargo clippy --locked -p rustack-lambda-runtime-verifier --all-targets --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-lambda-provided-fixture
+
+test-lambda-code-fixture: test-lambda-provided-fixture test-lambda-zip-archive
+	@cargo test --locked -p rustack-lambda-core --lib docker::code_volume::tests
+	@cargo test --locked -p rustack-lambda-core --lib docker::ownership::codes::tests
+	@cargo test --locked -p rustack-lambda-core --lib docker::recovery::code::tests
+	@cargo test --locked -p rustack-lambda-core --lib docker::code::tests
+	@cargo test --locked -p rustack-lambda-core --lib docker::volumes::tests
+	@cargo test --locked -p rustack-lambda-core --lib storage::zip_layout::tests
+	@cargo clippy --locked -p rustack-lambda-echo-bootstrap --bin zip-code-bootstrap --features zip-code --no-deps -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+WORKFLOWS_ZIP_BASE_IMAGE ?= public.ecr.aws/lambda/provided@sha256:612c98f126c2a95e77a016d56fed50a83055e11d636132ee6ebdd461f01b9617
+
+# Same Linux bootstrap source and byte-for-byte Native verifier for provided ZIPs.
+lambda-provided-zip-build:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@cargo lambda build --locked -p rustack-lambda-echo-bootstrap --bin bootstrap --features provided-qualification --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release --lambda-dir "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/provided"
+	@python3 -I -B tests/workflows/provided_zip_fixture.py "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/provided/bootstrap/bootstrap" "$(WORKFLOWS_ARCH)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/provided"
+
+lambda-provided-base-image:
+	@python3 -I -B -c 'import re,subprocess,sys; re.fullmatch(r"public\.ecr\.aws/lambda/provided@sha256:[0-9a-f]{64}", sys.argv[1]) or sys.exit("immutable provided base fixture required"); subprocess.run([sys.argv[2], "--host", "unix://" + sys.argv[3], "image", "pull", "--platform", "linux/" + sys.argv[4], sys.argv[1]], check=True, timeout=120)' "$(WORKFLOWS_ZIP_BASE_IMAGE)" "$(WORKFLOWS_DOCKER_BIN)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_ARCH)"
+
+lambda-zip-native-verifier-build:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@cargo lambda build --locked -p rustack-lambda-runtime-verifier --bin rustack-lambda-runtime-verifier --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release --lambda-dir "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/native-verifier"
+
+.PHONY: lambda-provided-zip-build lambda-zip-native-verifier-build lambda-provided-base-image
+
+.PHONY: lambda-zip-code-build test-lambda-code-fixture
+
+lambda-custom-ric-build:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@cargo lambda build --locked -p rustack-lambda-echo-bootstrap --bin image-bootstrap --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release --lambda-dir "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)"
+
+lambda-custom-ric-images: lambda-custom-ric-build
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --platform "linux/$(WORKFLOWS_ARCH)" --file tests/lambda-fixtures/image.Dockerfile --build-arg IMAGE_REVISION=A --tag "rustack-custom-ric:a-$(WORKFLOWS_ARCH)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/image-bootstrap"
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --platform "linux/$(WORKFLOWS_ARCH)" --file tests/lambda-fixtures/image.Dockerfile --build-arg IMAGE_REVISION=B --tag "rustack-custom-ric:b-$(WORKFLOWS_ARCH)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/image-bootstrap"
+
+.PHONY: lambda-custom-ric-build lambda-custom-ric-images
+
+# Explicit caches: genuine incompatible metadata and an independent protocol-free process.
+lambda-negative-build:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@cargo lambda build --locked -p rustack-lambda-echo-bootstrap --bin no-runtime-bootstrap --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release --lambda-dir "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)"
+	@python3 -B tests/lambda-fixtures/negative_images.py "$(WORKFLOWS_ARCH)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/negative"
+
+lambda-negative-images: lambda-negative-build
+	@$(WORKFLOWS_DOCKER_BIN) --host "unix://$(WORKFLOWS_DOCKER_SOCKET)" image load --input "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/negative/os.tar"
+	@$(WORKFLOWS_DOCKER_BIN) --host "unix://$(WORKFLOWS_DOCKER_SOCKET)" image load --input "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/negative/architecture.tar"
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --platform "linux/$(WORKFLOWS_ARCH)" --file tests/lambda-fixtures/no-runtime.Dockerfile --tag "rustack-no-runtime:$(WORKFLOWS_ARCH)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/no-runtime-bootstrap"
+
+.PHONY: lambda-negative-build lambda-negative-images
+
+# Preserved baseline; the interrupted-pull case owns only the extra port443 reference.
+lambda-pull-fixture-image:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@python3 -I -B -c 'import re,subprocess,sys; re.fullmatch(r"public\.ecr\.aws/lambda/nodejs@sha256:[0-9a-f]{64}", sys.argv[1]) or sys.exit("immutable public Node fixture required"); subprocess.run([sys.argv[2], "--host", "unix://" + sys.argv[3], "image", "pull", "--platform", "linux/" + sys.argv[4], sys.argv[1]], check=True, timeout=120)' "$(WORKFLOWS_PULL_IMAGE)" "$(WORKFLOWS_DOCKER_BIN)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_ARCH)"
+
+.PHONY: lambda-pull-fixture-image
+
+WORKFLOWS_DOCKER_BIN ?= $(shell command -v docker)
+test-lambda-custom-ric-docker: test-lambda-startup-docker
+
+.PHONY: test-lambda-custom-ric-docker
+
+test-lambda-custom-ric-fixture: workflows-sdk-python
+	@cargo test --locked -p rustack-lambda-echo-bootstrap --bin image-bootstrap
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_custom_ric_collector.py -v
+	@cargo clippy --locked -p rustack-lambda-echo-bootstrap --bin image-bootstrap -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-lambda-custom-ric-fixture
+
+# Real user-code failures, causal signed client cancellation and Event admission.
+test-lambda-faults-docker: test-lambda-startup-docker
+
+test-lambda-faults:
+	@cargo test --locked -p rustack-lambda-core --lib impossible_memory
+	@cargo test --locked -p rustack-lambda-core --lib work::tests
+
+.PHONY: test-lambda-faults test-lambda-faults-docker
+
+test-lambda-fault-fixture: workflows-sdk-python
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_lambda_faults.py -v
+	@cargo clippy --locked -p rustack-lambda-echo-bootstrap --bin image-bootstrap -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-lambda-fault-fixture
+
+# Real management IO barriers keep the ordinary server and real daemon in charge.
+test-lambda-io-faults-docker: test-lambda-startup-docker
+
+test-lambda-io-faults: workflows-sdk-python
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_docker_io_proxy.py -v
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_negative_images.py -v
+
+.PHONY: test-lambda-io-faults test-lambda-io-faults-docker
+
+test-lambda-deadline-fixture: test-lambda-io-faults
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_lambda_admission.py -v
+	@cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) test_should_validate_pull_completion_before_granting_cache_cleanup
+	@cargo clippy --locked -p rustack-lambda-echo-bootstrap --bin no-runtime-bootstrap -- -D warnings -W clippy::pedantic -W clippy::unwrap_used -W clippy::expect_used -W clippy::indexing_slicing -W clippy::panic
+
+.PHONY: test-lambda-deadline-fixture
+
+# Fixed inventories are compared before any resource test is executed.
+test-lambda-docker-manifest:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_required_suites.py -v
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_docker_required_suites.py -v
+	@set -eu; docker_manifest_dir="$$(mktemp -d)"; \
+		trap 'rm -rf "$$docker_manifest_dir"' EXIT; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) -- --ignored --list --color never >"$$docker_manifest_dir/ordinary-startup.txt"; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --lib -- --ignored --list --color never >"$$docker_manifest_dir/docker-core.txt"; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_environment -- --ignored --list --color never >"$$docker_manifest_dir/docker-environment.txt"; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_executor -- --ignored --list --color never >"$$docker_manifest_dir/docker-executor.txt"; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_endpoint -- --ignored --list --color never >"$$docker_manifest_dir/docker-endpoint.txt"; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_probe -- --ignored --list --color never >"$$docker_manifest_dir/docker-probe.txt"; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_wire -- --ignored --list --color never >"$$docker_manifest_dir/docker-wire.txt"; \
+		cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-runtime --test docker -- --ignored --list --color never >"$$docker_manifest_dir/relay-runtime.txt"; \
+		python3 -B tests/workflows/docker_required_suites.py "$$docker_manifest_dir"
+
+WORKFLOWS_DOCKER_TEST_ENV = PATH="$(dir $(WORKFLOWS_DOCKER_BIN)):$(PATH)" \
+	RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" \
+	RUSTACK_OTHER_DOCKER_SOCKET="$(WORKFLOWS_OTHER_DOCKER_SOCKET)" \
+	RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" \
+	RUSTACK_RUNTIME_NETWORK="$(WORKFLOWS_NETWORK)" RUSTACK_RUNTIME_GATEWAY_HOST="$(WORKFLOWS_GATEWAY_HOST)" \
+	RUSTACK_PROVIDED_ZIP_A="$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/provided/provided-a.zip" \
+	RUSTACK_PROVIDED_ZIP_B="$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/provided/provided-b.zip" \
+	RUSTACK_ZIP_NATIVE_VERIFIER="$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/native-verifier/rustack-lambda-runtime-verifier/bootstrap" \
+	RUSTACK_ZIP_BASE_IMAGE="$(WORKFLOWS_ZIP_BASE_IMAGE)" \
+	RUSTACK_ZIP_CODE_BOOTSTRAP="$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/zip-code-bootstrap/bootstrap" \
+	RUSTACK_CUSTOM_IMAGE_A="rustack-custom-ric:a-$(WORKFLOWS_ARCH)" RUSTACK_CUSTOM_IMAGE_B="rustack-custom-ric:b-$(WORKFLOWS_ARCH)" \
+	RUSTACK_NODE_IMAGE="rustack-official-node:$(WORKFLOWS_ARCH)" \
+	RUSTACK_HANDLER_SDK_IMAGE="rustack-handler-sdk:$(WORKFLOWS_ARCH)" \
+	RUSTACK_CALLBACK_IMAGE="rustack-callback:$(WORKFLOWS_ARCH)" \
+	RUSTACK_PULUMI_IMAGE="rustack-pulumi:$(WORKFLOWS_ARCH)" \
+	RUSTACK_SERVER_IMAGE="$(WORKFLOWS_SERVER_IMAGE)" \
+	RUSTACK_RELEASE_IMAGE="$(WORKFLOWS_RELEASE_IMAGE)" \
+	RUSTACK_SERVER_DAEMON_SOCKET="$(WORKFLOWS_DOCKER_DAEMON_SOCKET)" \
+	RUSTACK_SERVER_SOCKET_GID="$(WORKFLOWS_DOCKER_DAEMON_SOCKET_GID)" \
+	RUSTACK_DOCKER_BIN="$(WORKFLOWS_DOCKER_BIN)" RUSTACK_PULL_IMAGE="$(WORKFLOWS_PULL_IMAGE)" \
+	RUSTACK_WORKFLOWS_PYTHON="$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python"
+
+# Functional Docker scope only. Keep orchestration sequential even under parent make -j.
+test-lambda-docker:
+	@test -n "$(WORKFLOWS_DOCKER_SOCKET)" && test -n "$(WORKFLOWS_OTHER_DOCKER_SOCKET)" && test "$(WORKFLOWS_DOCKER_SOCKET)" != "$(WORKFLOWS_OTHER_DOCKER_SOCKET)" && test -n "$(WORKFLOWS_NETWORK)" && test -n "$(WORKFLOWS_GATEWAY_HOST)" && test -x "$(WORKFLOWS_DOCKER_BIN)"
+	@test -n "$(WORKFLOWS_DOCKER_DAEMON_SOCKET)" && test -n "$(WORKFLOWS_DOCKER_DAEMON_SOCKET_GID)"
+	@$(MAKE) --no-print-directory lambda-docker-fixtures
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) -- --ignored --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --lib -- --ignored --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_environment -- --ignored --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_executor -- --ignored --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_endpoint -- --ignored --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_probe -- --ignored --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_wire -- --ignored --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-runtime --test docker -- --ignored --nocapture --test-threads=1
+	@echo 'Verified docker-image-functional resources; required arm64/reference/Desktop/rootless and complete release acceptance remain required.'
+
+.PHONY: test-lambda-docker-manifest test-lambda-docker
+
+# Durable code namespace recovery only; ordinary runtime qualification is separate.
+test-lambda-code-recovery-docker: lambda-runtime-image
+	@RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_ARCH="$(WORKFLOWS_ARCH)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test --locked -p rustack-lambda-core --lib docker::recovery::code::tests::real::test_should_recover_real_code_volume_and_unstarted_loader_across_reacquisition -- --ignored --exact --nocapture --test-threads=1
+
+.PHONY: test-lambda-code-recovery-docker
+
+# Focused ordinary provided-runtime and byte-identical Linux Native qualification.
+test-lambda-provided-docker: test-lambda-docker-manifest
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) test_should_execute_ordinary_provided_zip_and_join_owned_retirement -- --ignored --nocapture --test-threads=1
+	@$(MAKE) --no-print-directory test-lambda-provided-native-docker
+
+test-lambda-provided-io-docker: test-lambda-docker-manifest
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) zip_ -- --ignored --nocapture --test-threads=1
+
+test-lambda-provided-native-docker: test-lambda-docker-manifest
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-lambda-core --test docker_wire code::test_should_execute_the_same_provided_zip_bytes_through_real_linux_native_and_join_children -- --ignored --exact --nocapture --test-threads=1
+
+.PHONY: test-lambda-provided-docker test-lambda-provided-native-docker test-lambda-provided-io-docker
+
+
+# D93: bounded managed archive data/profile/candidate and raw codec controls.
+test-lambda-zip-archive: workflows-sdk-python
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_provided_zip_archive.py -v
+	@cargo test --locked -p rustack-lambda-core --lib provider::snapshot
+	@cargo test --locked -p rustack-lambda-core --lib storage::restore_zip
+	@cargo test --locked -p rustack-lambda-core --lib deployment::manager::tests::restore
+	@cargo test --locked -p rustack-cli --bin rustack --no-default-features --features lambda,stepfunctions snapshot::archive::cbor
+	@cargo test --locked -p rustack-cli --bin rustack --no-default-features --features lambda,stepfunctions snapshot::image_tests
+
+test-lambda-provided-archive-docker: lambda-runtime-image lambda-runtime-fixture-image lambda-provided-zip-build lambda-provided-base-image workflows-sdk-python test-lambda-docker-manifest
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) provided_zip_archives -- --ignored --nocapture --test-threads=1
+
+.PHONY: test-lambda-zip-archive test-lambda-provided-archive-docker
+
+# D94: official pinned Node24 RIC, explicit selected-platform source and SDK observer.
+lambda-node-fixture-image: lambda-pull-fixture-image
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --provenance=false --platform "linux/$(WORKFLOWS_ARCH)" --file tests/lambda-fixtures/node.Dockerfile --tag "rustack-official-node:$(WORKFLOWS_ARCH)" tests/lambda-fixtures
+
+test-lambda-node-fixture: workflows-sdk-python
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_node_image.py -v
+	@cargo test --locked -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) node::tests
+	@cargo test --locked -p rustack-lambda-runtime --lib http::tests
+	@cargo test --locked -p rustack-lambda-runtime --lib session::tests::test_should_charge_http_body
+
+test-lambda-node-docker:
+	@$(MAKE) --no-print-directory -j1 lambda-runtime-image lambda-runtime-fixture-image lambda-node-fixture-image workflows-sdk-python test-lambda-node-fixture test-lambda-docker-manifest
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) test_should_execute_official_node_image_with_signed_sdks_and_asl -- --ignored --exact --nocapture --test-threads=1
+
+.PHONY: lambda-node-fixture-image test-lambda-node-fixture test-lambda-node-docker
+
+# D95: one ordinary CLI cohort and a complete sequential fixture prerequisite set.
+workflows-retain-fixture-sources:
+	@python3 -I -B tests/workflows/image_performance_images.py retain "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_ARCH)" v1
+
+lambda-docker-fixtures:
+	@$(MAKE) --no-print-directory -j1 workflows-retain-fixture-sources
+	@$(MAKE) --no-print-directory -j1 lambda-runtime-image lambda-runtime-fixture-image lambda-custom-ric-images lambda-zip-code-build lambda-provided-zip-build lambda-zip-native-verifier-build lambda-provided-base-image lambda-negative-images lambda-pull-fixture-image lambda-node-fixture-image lambda-handler-sdk-fixture-image lambda-callback-fixture-image lambda-pulumi-fixture-image lambda-workflows-server-image lambda-workflows-release-image workflows-sdk-python test-workflows-iac-fixture test-workflows-server-fixture test-workflows-release-fixture test-lambda-code-fixture test-lambda-deadline-fixture test-lambda-fault-fixture test-lambda-custom-ric-fixture test-lambda-node-fixture test-lambda-handler-sdk-fixture test-lambda-callback-fixture test-lambda-docker-manifest
+
+.PHONY: workflows-retain-fixture-sources
+
+lambda-handler-sdk-fixture-image: lambda-pull-fixture-image
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --provenance=false --platform "linux/$(WORKFLOWS_ARCH)" --file tests/lambda-fixtures/handler-sdk.Dockerfile --tag "rustack-handler-sdk:$(WORKFLOWS_ARCH)" tests/lambda-fixtures
+
+test-lambda-handler-sdk-fixture: workflows-sdk-python
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_handler_sdk_image.py -v
+	@cargo test --locked -p rustack-lambda-core --lib sdk
+	@cargo clippy --locked -p rustack-cli --bin rustack --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) --no-deps -- -D warnings -W clippy::pedantic
+
+test-lambda-handler-sdk-docker: lambda-docker-fixtures
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) test_should_execute_local_s3_and_dynamodb_from_an_explicit_image_sdk_context -- --ignored --exact --nocapture --test-threads=1
+	@$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) test_should_reject_wrong_image_sdk_credentials_without_ambient_fallback -- --ignored --exact --nocapture --test-threads=1
+
+.PHONY: lambda-docker-fixtures lambda-handler-sdk-fixture-image test-lambda-handler-sdk-fixture test-lambda-handler-sdk-docker
+
+# Requalify the shared image SDK owner against already recorded source images.
+test-lambda-image-sdk-consumers-docker:
+	@$(MAKE) --no-print-directory -j1 test-lambda-node-fixture test-lambda-handler-sdk-fixture test-lambda-docker-manifest
+	@set -eu; for image_sdk_case in \
+		test_should_execute_local_s3_and_dynamodb_from_an_explicit_image_sdk_context \
+		test_should_reject_wrong_image_sdk_credentials_without_ambient_fallback \
+		test_should_execute_official_node_image_with_signed_sdks_and_asl; do \
+		$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) "$$image_sdk_case" -- --ignored --exact --nocapture --test-threads=1; \
+	done
+
+.PHONY: test-lambda-image-sdk-consumers-docker
+
+lambda-callback-fixture-image: lambda-pull-fixture-image
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --provenance=false --platform "linux/$(WORKFLOWS_ARCH)" --file tests/lambda-fixtures/callback.Dockerfile --tag "rustack-callback:$(WORKFLOWS_ARCH)" tests/lambda-fixtures
+
+test-lambda-callback-fixture: workflows-sdk-python
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_callback_image.py -v
+	@cargo test --locked -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) callback::audit::tests
+	@cargo clippy --locked -p rustack-cli --bin rustack --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) --no-deps -- -D warnings -W clippy::pedantic
+
+test-lambda-callback-docker: lambda-docker-fixtures
+	@set -eu; for callback_case in \
+		test_should_execute_real_image_callbacks_before_and_after_lambda_response \
+		test_should_enforce_image_callback_retry_heartbeat_timeouts_and_stop; do \
+		$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) "$$callback_case" -- --ignored --exact --nocapture --test-threads=1; \
+	done
+
+.PHONY: lambda-callback-fixture-image test-lambda-callback-fixture test-lambda-callback-docker
+
+# Private fixture dependencies; no global npm/Pulumi configuration or install scripts.
+WORKFLOWS_IAC_NPM_CACHE ?= $(LAMBDA_IMAGE_FIXTURE_DIR)/iac-npm
+
+workflows-iac-node-dependencies:
+	@python3 -I -B tests/workflows/pulumi_dependencies.py "$(WORKFLOWS_IAC_NPM_CACHE)"
+
+test-workflows-iac-dependencies: workflows-iac-node-dependencies
+	@PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests/workflows -p test_pulumi_dependencies.py -v
+	@node --test tests/lambda-fixtures/pulumi/dependency-controls.js
+	@env -i PATH="$(PATH)" NPM_CONFIG_UPDATE_NOTIFIER=false npm --prefix tests/lambda-fixtures/pulumi audit --registry=https://registry.npmjs.org --userconfig="$(WORKFLOWS_IAC_NPM_CACHE)/config/user" --globalconfig="$(WORKFLOWS_IAC_NPM_CACHE)/config/global" --cache="$(WORKFLOWS_IAC_NPM_CACHE)"
+
+.PHONY: workflows-iac-node-dependencies test-workflows-iac-dependencies
+
+# Bounded, checksummed Linux executable provisioning; downloads are never executed on the host.
+lambda-pulumi-tools:
+	@python3 -I -B tests/lambda-fixtures/pulumi_tools.py "$(WORKFLOWS_ARCH)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/pulumi-tools"
+
+test-workflows-iac-tools:
+	@PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests/workflows -p test_pulumi_tools.py -v
+
+.PHONY: lambda-pulumi-tools test-workflows-iac-tools
+
+lambda-pulumi-fixture-image: lambda-pull-fixture-image lambda-pulumi-tools
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --provenance=false --platform "linux/$(WORKFLOWS_ARCH)" --build-context "pulumi-tools=$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/pulumi-tools" --file tests/lambda-fixtures/pulumi.Dockerfile --tag "rustack-pulumi:$(WORKFLOWS_ARCH)" tests/lambda-fixtures
+
+test-workflows-iac-fixture: test-workflows-iac-dependencies test-workflows-iac-tools workflows-sdk-python
+	@node --test tests/lambda-fixtures/pulumi/program-controls.js tests/lambda-fixtures/pulumi/child-controls.js tests/lambda-fixtures/pulumi/input-controls.js tests/lambda-fixtures/pulumi/evidence-controls.js
+	@node --check tests/lambda-fixtures/iac.js
+	@node --check tests/lambda-fixtures/pulumi/iac_session.js
+	@node --check tests/lambda-fixtures/pulumi/iac_runtime.js
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_pulumi_archive.py -v
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_pulumi_replay.py -v
+
+.PHONY: lambda-pulumi-fixture-image test-workflows-iac-fixture
+
+
+test-workflows-iac-docker: lambda-docker-fixtures
+	@set -eu; for iac_case in \
+		test_should_manage_a_real_image_workflow_through_pulumi_lifecycle \
+		test_should_retire_the_pulumi_plugin_tree_after_controller_stop; do \
+		$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) "$$iac_case" -- --ignored --exact --nocapture --test-threads=1; \
+	done
+
+.PHONY: test-workflows-iac-docker
+
+# Actual Linux server fixture; credentials arrive only through a private env file.
+WORKFLOWS_SERVER_IMAGE ?= rustack/workflows-server:integration-$(WORKFLOWS_ARCH)
+WORKFLOWS_DOCKER_DAEMON_SOCKET ?=
+WORKFLOWS_DOCKER_DAEMON_SOCKET_GID ?=
+
+test-workflows-server-linker:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_server_linker.py -v
+
+lambda-workflows-server-build: test-workflows-server-linker
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@CARGO_TARGET_$(if $(filter arm64,$(WORKFLOWS_ARCH)),AARCH64,X86_64)_UNKNOWN_LINUX_GNU_LINKER="$(CURDIR)/tests/workflows/server_linker.py" WORKFLOWS_SERVER_LINKER_TOOL="$$(command -v cargo-zigbuild)" WORKFLOWS_SERVER_LINKER_TARGET="$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-linux-gnu" CARGO_ZIGBUILD_ZIG_VERSION="$$(zig version)" cargo zigbuild --locked -p rustack-cli --bin rustack --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) --target "$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu" --release
+	@mkdir -p "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/server-image"
+	@cp "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/$(if $(filter arm64,$(WORKFLOWS_ARCH)),aarch64,x86_64)-unknown-linux-gnu/release/rustack" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/server-image/rustack"
+
+lambda-workflows-server-image: lambda-workflows-server-build lambda-provided-base-image
+	@cp tests/lambda-fixtures/server-config.yaml "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/server-image/config.yaml"
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --provenance=false --platform "linux/$(WORKFLOWS_ARCH)" --build-arg "BASE_IMAGE=$(WORKFLOWS_ZIP_BASE_IMAGE)" --file tests/lambda-fixtures/server.Dockerfile --tag "$(WORKFLOWS_SERVER_IMAGE)" "$(LAMBDA_IMAGE_FIXTURE_DIR)/$(WORKFLOWS_ARCH)/server-image"
+
+.PHONY: test-workflows-server-linker lambda-workflows-server-build lambda-workflows-server-image
+
+test-workflows-server-fixture: workflows-sdk-python test-workflows-server-linker
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_server_container_import.py -v
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_stepfunctions_history.py -v
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_server_container_oracle.py -v
+	@PYTHONDONTWRITEBYTECODE=1 "$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" -m unittest discover -s tests/workflows -p test_handler_sdk_image.py -v
+	@cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) container_server::
+	@cargo clippy --locked -p rustack-cli --bin rustack --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) --no-deps -- -D warnings -W clippy::pedantic
+
+test-workflows-server-docker:
+	@test -n "$(WORKFLOWS_DOCKER_DAEMON_SOCKET)" && test -n "$(WORKFLOWS_DOCKER_DAEMON_SOCKET_GID)"
+	@$(MAKE) --no-print-directory lambda-docker-fixtures
+	@set -eu; for server_container_case in \
+		test_should_execute_image_sdk_and_nested_asl_from_a_server_container \
+		test_should_refuse_unreachable_server_container_gateway_and_join_startup_cleanup; do \
+		$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) "$$server_container_case" -- --ignored --exact --nocapture --test-threads=1; \
+	done
+
+.PHONY: test-workflows-server-fixture test-workflows-server-docker
+
+# D99: the actual release recipe; source defaults remain unchanged.
+WORKFLOWS_RELEASE_IMAGE ?= rustack/workflows-release:integration-$(WORKFLOWS_ARCH)
+WORKFLOWS_RELEASE_BUILD_JOBS ?= 2
+
+lambda-workflows-release-image:
+	@case "$(WORKFLOWS_ARCH)" in arm64|amd64) ;; *) echo "WORKFLOWS_ARCH must be arm64 or amd64" >&2; exit 1;; esac
+	@case "$(WORKFLOWS_RELEASE_BUILD_JOBS)" in 1|2|3|4|5|6|7|8) ;; *) echo "WORKFLOWS_RELEASE_BUILD_JOBS must be between 1 and 8" >&2; exit 1;; esac
+	@DOCKER_HOST="unix://$(WORKFLOWS_DOCKER_SOCKET)" $(WORKFLOWS_IMAGE_BUILDER) build --load --provenance=false --platform "linux/$(WORKFLOWS_ARCH)" --build-arg "CARGO_BUILD_JOBS=$(WORKFLOWS_RELEASE_BUILD_JOBS)" --file Dockerfile --tag "$(WORKFLOWS_RELEASE_IMAGE)" .
+	@$(MAKE) --no-print-directory test-workflows-release-image
+
+test-workflows-release-image:
+	@python3 -B tests/workflows/release_image.py "$(WORKFLOWS_ARCH)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_RELEASE_IMAGE)" "$(WORKFLOWS_DOCKER_BIN)"
+
+.PHONY: lambda-workflows-release-image test-workflows-release-image
+
+# Independent process-control qualification, separate from Native/Docker resources.
+test-workflows-action-manifest:
+	@PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests/workflows -p test_action_required_suites.py -v
+	@set -eu; action_inventory_dir=$$(mktemp -d); chmod 700 "$$action_inventory_dir"; \
+	cargo test --locked -p rustack-cli --test workflows_action -- --ignored --list --color never >"$$action_inventory_dir/composite-action.txt"; \
+	python3 -B tests/workflows/action_required_suites.py "$$action_inventory_dir"; \
+	rm -r "$$action_inventory_dir"
+
+test-workflows-action-fixture: workflows-sdk-python test-workflows-action-manifest
+	@RUSTACK_WORKFLOWS_PYTHON="$$(cargo metadata --format-version 1 --no-deps | python3 -c 'import json,sys; print(json.load(sys.stdin)["target_directory"])')/workflows-sdk-python/bin/python" cargo test --locked -p rustack-cli --test workflows_action test_should_execute_actual_action_process_controls -- --ignored --exact --nocapture
+
+.PHONY: test-workflows-action-manifest test-workflows-action-fixture
+
+# Actual release image policy, Action and complete both-topology regression inputs.
+test-workflows-release-fixture: test-workflows-action-fixture
+	@PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests/workflows -p test_release_image.py -v
+	@cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) container_server::
+	@cargo clippy --locked -p rustack-cli --test workflows_action --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) --no-deps -- -D warnings -W clippy::pedantic
+
+test-workflows-release-docker:
+	@test -n "$(WORKFLOWS_DOCKER_DAEMON_SOCKET)" && test -n "$(WORKFLOWS_DOCKER_DAEMON_SOCKET_GID)"
+	@$(MAKE) --no-print-directory lambda-docker-fixtures
+	@set -eu; for release_image_case in \
+		test_should_execute_image_sdk_and_nested_asl_from_the_release_image \
+		test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup; do \
+		$(WORKFLOWS_DOCKER_TEST_ENV) cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test docker_startup --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) "$$release_image_case" -- --ignored --exact --nocapture --test-threads=1; \
+	done
+
+.PHONY: test-workflows-release-fixture test-workflows-release-docker
+
+# Final M4 evidence gate. Missing platforms/reference receipts are hard failures.
+WORKFLOWS_RELEASE_BUNDLE ?=
+WORKFLOWS_RELEASE_REPORT ?=
+verify-workflows:
+	@test -n "$(WORKFLOWS_RELEASE_BUNDLE)" && test -n "$(WORKFLOWS_RELEASE_REPORT)"
+	@python3 -I -B tests/workflows/release_qualification.py "$(WORKFLOWS_RELEASE_BUNDLE)" "$(WORKFLOWS_RELEASE_REPORT)"
+
+.PHONY: verify-workflows
+
+WORKFLOWS_IMAGE_REFRESH_BUILD_DIR ?=
+WORKFLOWS_ROOTLESS_PREVIOUS_RESOURCE_DIR ?=
+workflows-refresh-production-images:
+	@test -n "$(WORKFLOWS_IMAGE_REFRESH_BUILD_DIR)"
+	@python3 -I -B tests/workflows/image_refresh_build.py "$(WORKFLOWS_IMAGE_REFRESH_BUILD_DIR)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_IMAGE_BUILDER)"
+
+workflows-rootless-refresh-images:
+	@test -n "$(WORKFLOWS_ROOTLESS_PREVIOUS_RESOURCE_DIR)" && test -n "$(WORKFLOWS_IMAGE_REFRESH_BUILD_DIR)"
+	@python3 -I -B tests/workflows/rootless_resources.py refresh-full "$(WORKFLOWS_ROOTLESS_EVIDENCE_DIR)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_ROOTLESS_FORWARD_DIR)" "$(WORKFLOWS_ROOTLESS_RESOURCE_DIR)" "$(WORKFLOWS_ROOTLESS_PREVIOUS_RESOURCE_DIR)" "$(WORKFLOWS_IMAGE_REFRESH_BUILD_DIR)"
+
+.PHONY: workflows-refresh-production-images workflows-rootless-refresh-images
+
+workflows-release-seal:
+	@test -n "$(WORKFLOWS_RELEASE_BUNDLE)"
+	@python3 -I -B tests/workflows/release_delivery.py seal "$(WORKFLOWS_RELEASE_BUNDLE)" "$(WORKFLOWS_ARCH)"
+
+workflows-release-preflight:
+	@test -n "$(WORKFLOWS_RELEASE_BUNDLE)"
+	@python3 -I -B tests/workflows/release_delivery.py verify "$(WORKFLOWS_RELEASE_BUNDLE)"
+
+# Explicit publication entry point; never a prerequisite of a local test/build.
+workflows-release-promote:
+	@test -n "$(WORKFLOWS_RELEASE_BUNDLE)"
+	@python3 -I -B tests/workflows/release_delivery.py promote "$(WORKFLOWS_RELEASE_BUNDLE)"
+
+.PHONY: workflows-release-seal workflows-release-preflight workflows-release-promote
+
+workflows-release-input-runs:
+	@python3 -I -B tests/workflows/release_delivery.py input-runs
+
+.PHONY: workflows-release-input-runs
+
+WORKFLOWS_PLATFORM_REPORT ?=
+workflows-platform-receipt:
+	@test -n "$(WORKFLOWS_PLATFORM_REPORT)"
+	@python3 -I -B tests/workflows/platform_receipt.py "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_PLATFORM_REPORT)"
+
+.PHONY: workflows-platform-receipt
+
+WORKFLOWS_EVIDENCE_ROOT ?=
+WORKFLOWS_EVIDENCE_OUTPUT ?=
+workflows-release-evidence:
+	@test -n "$(WORKFLOWS_EVIDENCE_ROOT)" && test -n "$(WORKFLOWS_EVIDENCE_OUTPUT)"
+	@python3 -I -B tests/workflows/release_bundle.py "$(WORKFLOWS_EVIDENCE_ROOT)" "$(WORKFLOWS_EVIDENCE_OUTPUT)"
+
+.PHONY: workflows-release-evidence
+
+test-workflows-release-qualification-controls:
+	@python3 -I -B -m unittest discover -s tests/workflows -p test_release_qualification.py -v
+
+.PHONY: test-workflows-release-qualification-controls
+
+WORKFLOWS_FUNCTIONAL_CONFIG ?=
+WORKFLOWS_FUNCTIONAL_EVIDENCE ?=
+test-workflows-docker-functional:
+	@test -n "$(WORKFLOWS_FUNCTIONAL_CONFIG)" && test -n "$(WORKFLOWS_FUNCTIONAL_EVIDENCE)"
+	@python3 -I -B tests/workflows/docker_functional.py "$(WORKFLOWS_FUNCTIONAL_CONFIG)" "$(WORKFLOWS_FUNCTIONAL_EVIDENCE)"
+
+.PHONY: test-workflows-docker-functional
+
+WORKFLOWS_NATIVE_EVIDENCE_DIR ?=
+verify-workflows-native-recorded:
+	@test -n "$(WORKFLOWS_NATIVE_EVIDENCE_DIR)"
+	@python3 -I -B tests/workflows/native_gates.py "$(WORKFLOWS_NATIVE_EVIDENCE_DIR)"
+
+.PHONY: verify-workflows-native-recorded
+
+# Original pinned LocalStack pytest tests; no baseline updates or cloud execution.
+WORKFLOWS_LOCALSTACK_PYTHON_DIR ?= $(HOME)/.target/workflows-localstack-python
+WORKFLOWS_LOCALSTACK_PYTHON ?= $(WORKFLOWS_LOCALSTACK_PYTHON_DIR)/bin/python
+WORKFLOWS_LOCALSTACK_EVIDENCE ?=
+WORKFLOWS_LOCALSTACK_IMAGES ?=
+WORKFLOWS_LOCALSTACK_BUILDER ?=
+
+workflows-localstack-python:
+	@test -x "$(WORKFLOWS_LOCALSTACK_PYTHON)" || uv venv --python 3.13 "$(WORKFLOWS_LOCALSTACK_PYTHON_DIR)"
+	@uv pip sync --python "$(WORKFLOWS_LOCALSTACK_PYTHON)" tests/workflows/localstack-requirements.txt
+	@uv pip install --python "$(WORKFLOWS_LOCALSTACK_PYTHON)" --no-deps -e vendors/localstack
+
+workflows-localstack-images:
+	@test -n "$(WORKFLOWS_LOCALSTACK_IMAGES)" && test -n "$(WORKFLOWS_LOCALSTACK_BUILDER)"
+	@python3 -I -B tests/workflows/localstack_images.py "$(WORKFLOWS_LOCALSTACK_IMAGES)" "$(WORKFLOWS_DOCKER_SOCKET)" "$(WORKFLOWS_LOCALSTACK_BUILDER)"
+
+test-workflows-localstack-controls:
+	@"$(WORKFLOWS_LOCALSTACK_PYTHON)" -I -B -m unittest discover -s tests/workflows -p test_localstack_policy.py -v
+
+check-workflows-localstack: test-workflows-localstack-controls
+	@cargo clippy --locked -p rustack-cli --lib --test localstack_compat --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) --no-deps -- -D warnings -W clippy::pedantic
+
+test-workflows-localstack-pure:
+	@test -n "$(WORKFLOWS_LOCALSTACK_EVIDENCE)"
+	@RUSTACK_WORKFLOWS_PYTHON="$(WORKFLOWS_LOCALSTACK_PYTHON)" RUSTACK_LOCALSTACK_EVIDENCE="$(WORKFLOWS_LOCALSTACK_EVIDENCE)" cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test localstack_compat --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) test_should_execute_original_localstack_pure_cases -- --ignored --exact --nocapture --test-threads=1
+
+test-workflows-localstack-docker:
+	@test -n "$(WORKFLOWS_LOCALSTACK_EVIDENCE)" && test -n "$(WORKFLOWS_LOCALSTACK_IMAGES)"
+	@RUSTACK_WORKFLOWS_PYTHON="$(WORKFLOWS_LOCALSTACK_PYTHON)" RUSTACK_LOCALSTACK_EVIDENCE="$(WORKFLOWS_LOCALSTACK_EVIDENCE)" RUSTACK_LOCALSTACK_IMAGES="$(WORKFLOWS_LOCALSTACK_IMAGES)/images.json" RUSTACK_RUNTIME_DOCKER_SOCKET="$(WORKFLOWS_DOCKER_SOCKET)" RUSTACK_RUNTIME_IMAGE="$(LAMBDA_RUNTIME_IMAGE)" cargo test --locked --target-dir "$(WORKFLOWS_DOCKER_TARGET_DIR)" -p rustack-cli --test localstack_compat --no-default-features --features $(WORKFLOWS_DOCKER_CLI_FEATURES) test_should_execute_original_localstack_image_cases -- --ignored --exact --nocapture --test-threads=1
+
+.PHONY: workflows-localstack-python workflows-localstack-images test-workflows-localstack-controls test-workflows-localstack-pure test-workflows-localstack-docker
+
+.PHONY: check-workflows-localstack
diff --git a/README.md b/README.md
index bd063bbf..20d6124f 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,8 @@
 
 A local AWS service emulator written in Rust, with **18 service adapters**. Routed operation counts describe API surface—not full AWS semantics, authorization enforcement, execution support, or persistence. See the [capability and safety guide](docs/runtime-hardening.md) before choosing a test workload.
 
+An opt-in source build also provides [Step Functions workflows](docs/workflows-guide.md), including real Native and Docker Image Lambda integration and named Native/pure workflow snapshots. Docker requires explicit qualified startup; image archive restoration, ZIP and final platform/release qualification remain in progress.
+
 ## Install
 
 ```bash
@@ -289,7 +291,7 @@ Set `RUSTACK_CONFIG` to a YAML file; environment values override the correspondi
 | `GATEWAY_LISTEN` | `127.0.0.1:4566` | Bind address and port; container image explicitly binds `0.0.0.0` |
 | `RUSTACK_CONFIG` | *(unset)* | YAML configuration file |
 | `RUSTACK_ADVERTISED_ENDPOINT` | *(derived from bind address)* | Public local HTTP(S) authority for generated URLs |
-| `LAMBDA_EXECUTOR` | `disabled` | Explicit `native`/`squib` selection required for execution; Docker unsupported |
+| `LAMBDA_EXECUTOR` | `disabled` | Explicit backend selection required; Docker Image needs configured and qualified ownership, daemon, relay, network and kernel startup |
 | `SERVICES` | *(empty = all)* | Comma-separated list of services to enable |
 | `LOG_LEVEL` | `info` | Log level (`error`, `warn`, `info`, `debug`, `trace`) |
 | `RUST_LOG` | | Fine-grained tracing filter (overrides `LOG_LEVEL`) |
diff --git a/action.yml b/action.yml
index 0fb59b47..c03418a8 100644
--- a/action.yml
+++ b/action.yml
@@ -1,5 +1,5 @@
 name: "Rustack"
-description: "Start a high-performance AWS-compatible server (S3 + DynamoDB + SQS + SSM + SNS + Lambda) on localhost:4566 (drop-in replacement for LocalStack)"
+description: "Start a high-performance AWS-compatible server (S3, DynamoDB, Lambda and Step Functions) on localhost:4566 (drop-in replacement for LocalStack)"
 author: "Tyr Chen"
 
 branding:
@@ -28,11 +28,11 @@ inputs:
     required: false
     default: "30"
   access-key:
-    description: "AWS access key for authentication (set to empty to disable auth)"
+    description: "AWS access key (empty pair omits credentials; enabled strict services require a pair)"
     required: false
     default: "test"
   secret-key:
-    description: "AWS secret key for authentication (set to empty to disable auth)"
+    description: "AWS secret key (empty pair omits credentials; skip-auth flags still govern)"
     required: false
     default: "test"
   s3-skip-auth:
@@ -59,6 +59,10 @@ inputs:
     description: "Skip Lambda signature validation (true/false)"
     required: false
     default: "true"
+  stepfunctions-skip-auth:
+    description: "Skip Step Functions signature validation (true/false)"
+    required: false
+    default: "true"
   persistence:
     description: "Enable durable storage persistence (true/false)"
     required: false
@@ -79,66 +83,25 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Pull Rustack image
-      shell: bash
-      run: |
-        IMAGE="ghcr.io/tyrchen/rustack:${{ inputs.image-tag }}"
-        if docker image inspect "$IMAGE" > /dev/null 2>&1; then
-          echo "Image $IMAGE already available locally"
-        else
-          docker pull "$IMAGE"
-        fi
-
-    - name: Start Rustack
+    - name: Validate, start and qualify Rustack
       id: start
       shell: bash
-      run: |
-        CONTAINER_ID=$(docker run -d \
-          --name rustack \
-          -p "${{ inputs.port }}:4566" \
-          -e "DEFAULT_REGION=${{ inputs.default-region }}" \
-          -e "LOG_LEVEL=${{ inputs.log-level }}" \
-          -e "S3_SKIP_SIGNATURE_VALIDATION=${{ inputs.s3-skip-auth }}" \
-          -e "DYNAMODB_SKIP_SIGNATURE_VALIDATION=${{ inputs.dynamodb-skip-auth }}" \
-          -e "SQS_SKIP_SIGNATURE_VALIDATION=${{ inputs.sqs-skip-auth }}" \
-          -e "SSM_SKIP_SIGNATURE_VALIDATION=${{ inputs.ssm-skip-auth }}" \
-          -e "SNS_SKIP_SIGNATURE_VALIDATION=${{ inputs.sns-skip-auth }}" \
-          -e "LAMBDA_SKIP_SIGNATURE_VALIDATION=${{ inputs.lambda-skip-auth }}" \
-          -e "ACCESS_KEY=${{ inputs.access-key }}" \
-          -e "SECRET_KEY=${{ inputs.secret-key }}" \
-          -e "PERSISTENCE=${{ inputs.persistence }}" \
-          -e "SERVICES=${{ inputs.services }}" \
-          "ghcr.io/tyrchen/rustack:${{ inputs.image-tag }}")
-
-        echo "container_id=$CONTAINER_ID" >> "$GITHUB_OUTPUT"
-        echo "endpoint=http://localhost:${{ inputs.port }}" >> "$GITHUB_OUTPUT"
-
-    - name: Wait for healthy
-      shell: bash
-      run: |
-        ENDPOINT="http://localhost:${{ inputs.port }}"
-        TIMEOUT=${{ inputs.wait-timeout }}
-        ELAPSED=0
-
-        echo "Waiting for Rustack at $ENDPOINT ..."
-
-        until curl -sf "$ENDPOINT/_localstack/health" > /dev/null 2>&1; do
-          if [ "$ELAPSED" -ge "$TIMEOUT" ]; then
-            echo "::error::Rustack did not become healthy within ${TIMEOUT}s"
-            docker logs rustack
-            exit 1
-          fi
-          sleep 0.5
-          ELAPSED=$((ELAPSED + 1))
-        done
-
-        echo "Rustack is ready at $ENDPOINT (S3 + DynamoDB + SQS + SSM + SNS + Lambda)"
-
-    - name: Export environment
-      shell: bash
-      run: |
-        echo "AWS_ENDPOINT_URL=http://localhost:${{ inputs.port }}" >> "$GITHUB_ENV"
-        echo "LOCALSTACK_ENDPOINT=http://localhost:${{ inputs.port }}" >> "$GITHUB_ENV"
-        echo "AWS_DEFAULT_REGION=${{ inputs.default-region }}" >> "$GITHUB_ENV"
-        echo "AWS_ACCESS_KEY_ID=${{ inputs.access-key }}" >> "$GITHUB_ENV"
-        echo "AWS_SECRET_ACCESS_KEY=${{ inputs.secret-key }}" >> "$GITHUB_ENV"
+      env:
+        RUSTACK_ACTION_ROOT: ${{ github.action_path }}
+        RUSTACK_ACTION_IMAGE_TAG: ${{ inputs.image-tag }}
+        RUSTACK_ACTION_PORT: ${{ inputs.port }}
+        RUSTACK_ACTION_DEFAULT_REGION: ${{ inputs.default-region }}
+        RUSTACK_ACTION_LOG_LEVEL: ${{ inputs.log-level }}
+        RUSTACK_ACTION_WAIT_TIMEOUT: ${{ inputs.wait-timeout }}
+        RUSTACK_ACTION_ACCESS_KEY: ${{ inputs.access-key }}
+        RUSTACK_ACTION_SECRET_KEY: ${{ inputs.secret-key }}
+        RUSTACK_ACTION_PERSISTENCE: ${{ inputs.persistence }}
+        RUSTACK_ACTION_SERVICES: ${{ inputs.services }}
+        RUSTACK_ACTION_S3_SKIP_AUTH: ${{ inputs.s3-skip-auth }}
+        RUSTACK_ACTION_DYNAMODB_SKIP_AUTH: ${{ inputs.dynamodb-skip-auth }}
+        RUSTACK_ACTION_SQS_SKIP_AUTH: ${{ inputs.sqs-skip-auth }}
+        RUSTACK_ACTION_SSM_SKIP_AUTH: ${{ inputs.ssm-skip-auth }}
+        RUSTACK_ACTION_SNS_SKIP_AUTH: ${{ inputs.sns-skip-auth }}
+        RUSTACK_ACTION_LAMBDA_SKIP_AUTH: ${{ inputs.lambda-skip-auth }}
+        RUSTACK_ACTION_STEPFUNCTIONS_SKIP_AUTH: ${{ inputs.stepfunctions-skip-auth }}
+      run: exec python3 -B "$RUSTACK_ACTION_ROOT/tools/github-action/runtime.py"
diff --git a/apps/rustack/Cargo.toml b/apps/rustack/Cargo.toml
index d3c426cd..dd38a982 100644
--- a/apps/rustack/Cargo.toml
+++ b/apps/rustack/Cargo.toml
@@ -23,6 +23,7 @@ sqs = ["dep:rustack-sqs-core", "dep:rustack-sqs-http"]
 ssm = ["dep:rustack-ssm-core", "dep:rustack-ssm-http"]
 sns = ["dep:rustack-sns-core", "dep:rustack-sns-http", "dep:rustack-sqs-model", "sqs"]
 lambda = ["dep:rustack-lambda-core", "dep:rustack-lambda-http"]
+stepfunctions = ["dep:rustack-stepfunctions-core", "dep:rustack-stepfunctions-http", "dep:rustack-stepfunctions-model", "dep:getrandom", "dep:thiserror"]
 events = ["dep:rustack-events-core", "dep:rustack-events-http", "dep:rustack-sqs-model", "sqs"]
 logs = ["dep:rustack-logs-core", "dep:rustack-logs-http"]
 kms = ["dep:rustack-kms-core", "dep:rustack-kms-http"]
@@ -63,6 +64,12 @@ rustack-sns-core = { workspace = true, optional = true }
 rustack-sns-http = { workspace = true, optional = true }
 rustack-sqs-model = { workspace = true, optional = true }
 
+# Internal Step Functions composition support (main registration is separate)
+rustack-stepfunctions-core = { workspace = true, optional = true }
+rustack-stepfunctions-http = { workspace = true, optional = true }
+rustack-stepfunctions-model = { workspace = true, optional = true }
+getrandom = { workspace = true, optional = true }
+
 # Internal crates - Lambda (optional, gated by "lambda" feature)
 rustack-lambda-core = { workspace = true, optional = true }
 rustack-lambda-http = { workspace = true, optional = true }
@@ -133,6 +140,7 @@ ciborium = { workspace = true }
 
 # Error handling
 anyhow = { workspace = true }
+thiserror = { workspace = true, optional = true }
 
 # Logging
 tracing = { workspace = true }
@@ -146,12 +154,28 @@ bytes = { workspace = true }
 crc32fast = { workspace = true }
 zstd = { workspace = true }
 
+[target.'cfg(unix)'.dependencies]
+nix = { workspace = true, features = ["signal", "process"] }
+
 [dev-dependencies]
+sha2 = { workspace = true }
+proptest = { workspace = true }
+rstest = { workspace = true }
+tokio = { workspace = true, features = ["test-util"] }
 tokio-test = { workspace = true }
 aws-config = { workspace = true }
 aws-sdk-s3 = { workspace = true }
 aws-sdk-dynamodb = { workspace = true }
 aws-sdk-sqs = { workspace = true }
+aws-sdk-sfn = { workspace = true }
+aws-sdk-lambda = { workspace = true }
 aws-credential-types = { workspace = true }
 aws-smithy-runtime-api = { workspace = true }
 tempfile = { workspace = true }
+tar = { workspace = true }
+yaml-rust2 = { workspace = true }
+
+rustack-lambda-model = { workspace = true }
+base64 = { workspace = true }
+zip = { workspace = true }
+uuid = { workspace = true }
diff --git a/apps/rustack/src/events_bridge.rs b/apps/rustack/src/events_bridge.rs
index cfd4208c..82a20f2b 100644
--- a/apps/rustack/src/events_bridge.rs
+++ b/apps/rustack/src/events_bridge.rs
@@ -1,4 +1,4 @@
-//! Application-owned EventBridge → SQS delivery bridge.
+//! Application-owned `EventBridge` → SQS delivery bridge.
 use std::sync::Arc;
 
 use async_trait::async_trait;
diff --git a/apps/rustack/src/gateway.rs b/apps/rustack/src/gateway.rs
index 2f87ec84..67a1f869 100644
--- a/apps/rustack/src/gateway.rs
+++ b/apps/rustack/src/gateway.rs
@@ -16,7 +16,7 @@ use std::{
 use bytes::Bytes;
 use http::{
     Method, Response, StatusCode,
-    header::{CONTENT_TYPE, RETRY_AFTER},
+    header::{ALLOW, CACHE_CONTROL, CONTENT_LENGTH, CONTENT_TYPE, RETRY_AFTER},
 };
 use http_body_util::BodyExt;
 use hyper::{
@@ -27,6 +27,8 @@ use rustack_core::{
     http::{BodyBudget, BudgetedBody},
     settings::RuntimeBudgets,
 };
+#[cfg(feature = "lambda")]
+use rustack_lambda_core::docker::{GatewayInstanceId, GatewayReply};
 use serde::Serialize;
 use tokio::sync::{OwnedSemaphorePermit, Semaphore};
 
@@ -35,9 +37,13 @@ use crate::{
     service::{GatewayBody, ServiceRouter, gateway_body_from_string},
 };
 
+const RUNTIME_PROBE_PATH: &str = "/_rustack/runtime-probe";
+
 /// Process state is independent from whether any service supports snapshots.
 #[derive(Debug)]
 pub(crate) struct RuntimeStatus {
+    #[cfg(feature = "lambda")]
+    instance: Option<GatewayInstanceId>,
     ready: AtomicBool,
     workers: Arc<RuntimeWorkers>,
 }
@@ -76,6 +82,8 @@ impl GatewayService {
             admission: Arc::new(Semaphore::new(budgets.requests)),
             budgets,
             state: Arc::new(RuntimeStatus {
+                #[cfg(feature = "lambda")]
+                instance: None,
                 ready: AtomicBool::new(true),
                 workers: Arc::new(RuntimeWorkers::default()),
             }),
@@ -85,12 +93,62 @@ impl GatewayService {
 
     pub(crate) fn with_workers(mut self, workers: Arc<RuntimeWorkers>) -> Self {
         self.state = Arc::new(RuntimeStatus {
-            ready: AtomicBool::new(true),
+            #[cfg(feature = "lambda")]
+            instance: self.state.instance,
+            ready: AtomicBool::new(self.state.ready.load(Ordering::Acquire)),
             workers,
         });
         self
     }
 
+    #[cfg(feature = "lambda")]
+    pub(crate) fn with_runtime_identity(mut self, instance: GatewayInstanceId) -> Self {
+        self.state = Arc::new(RuntimeStatus {
+            ready: AtomicBool::new(self.state.ready.load(Ordering::Acquire)),
+            workers: self.state.workers.clone(),
+            instance: Some(instance),
+        });
+        self
+    }
+    fn runtime_probe<T: Serialize>(method: &Method, installed: Option<T>) -> Response<GatewayBody> {
+        let mut response = match installed {
+            Some(reply) if matches!(*method, Method::GET | Method::HEAD) => {
+                json_response(StatusCode::OK, &reply)
+            }
+            Some(_) => {
+                let mut reply = json_response(
+                    StatusCode::METHOD_NOT_ALLOWED,
+                    &serde_json::json!({"error":"runtime probe requires GET or HEAD"}),
+                );
+                reply
+                    .headers_mut()
+                    .insert(ALLOW, http::HeaderValue::from_static("GET, HEAD"));
+                reply
+            }
+            None => json_response(
+                StatusCode::NOT_FOUND,
+                &serde_json::json!({"error":"runtime probe is not installed"}),
+            ),
+        };
+        response
+            .headers_mut()
+            .insert(CACHE_CONTROL, http::HeaderValue::from_static("no-store"));
+        if *method == Method::HEAD {
+            if let Some(size) = response.body().size_hint().exact() {
+                response
+                    .headers_mut()
+                    .insert(CONTENT_LENGTH, http::HeaderValue::from(size));
+            }
+            *response.body_mut() = gateway_body_from_string("");
+        }
+        response
+    }
+    #[cfg(all(test, feature = "stepfunctions"))]
+    pub(crate) fn with_request_seconds(mut self, seconds: std::num::NonZeroU64) -> Self {
+        self.budgets.request_seconds = seconds.get();
+        self
+    }
+
     pub(crate) fn service_names(&self) -> Vec<&'static str> {
         self.services.iter().map(|service| service.name()).collect()
     }
@@ -107,6 +165,13 @@ impl GatewayService {
 
     fn diagnostics(&self, req: &http::Request<Incoming>) -> Option<Response<GatewayBody>> {
         let path = req.uri().path();
+        if path == RUNTIME_PROBE_PATH {
+            #[cfg(feature = "lambda")]
+            let reply = self.state.instance.map(GatewayReply::new);
+            #[cfg(not(feature = "lambda"))]
+            let reply = None::<serde_json::Value>;
+            return Some(Self::runtime_probe(req.method(), reply));
+        }
         if !(is_health_check(req.method(), path)
             || matches!(*req.method(), Method::GET | Method::HEAD)
                 && path == "/_rustack/capabilities")
@@ -128,9 +193,13 @@ impl GatewayService {
                 .iter()
                 .map(|service| capability(service.name()))
                 .collect();
+            #[cfg(feature = "stepfunctions")]
+            let workflows = self.state.workers.workflow_capabilities();
+            #[cfg(not(feature = "stepfunctions"))]
+            let workflows = None::<serde_json::Value>;
             json_response(
                 status,
-                &serde_json::json!({"version": env!("CARGO_PKG_VERSION"), "ready": ready, "services": capabilities, "workers": workers, "localEndpoints": {"apiGateway": "/_aws/execute-api/{apiId}/{stage}", "lambda": "/lambda-url/{functionName}/", "cloudFront": "/_aws/cloudfront/{distributionId}/"}, "limitations": ["No multi-tenant isolation or production IAM enforcement", "Snapshot resources-only services do not retain messages", "routed does not imply complete operation semantics"]}),
+                &serde_json::json!({"version": env!("CARGO_PKG_VERSION"), "ready": ready, "services": capabilities, "workers": workers, "workflows": workflows, "localEndpoints": {"apiGateway": "/_aws/execute-api/{apiId}/{stage}", "lambda": "/lambda-url/{functionName}/", "cloudFront": "/_aws/cloudfront/{distributionId}/"}, "limitations": ["No multi-tenant isolation or production IAM enforcement", "Snapshot resources-only services do not retain messages", "routed does not imply complete operation semantics"]}),
             )
         } else {
             let services: std::collections::BTreeMap<_, _> = self
@@ -186,10 +255,15 @@ impl Service<http::Request<Incoming>> for GatewayService {
             }
             _ => self.budgets.request_seconds,
         };
+        let owns_deadline = selected.is_some_and(|service| service.owns_request_deadline());
         let service_future = selected.map(|service| service.call(req));
         let budget = self.budgets.clone();
         Box::pin(async move {
             let response = match service_future {
+                Some(future) if owns_deadline => match future.await {
+                    Ok(response) => response,
+                    Err(never) => match never {},
+                },
                 Some(future) => {
                     match tokio::time::timeout(Duration::from_secs(request_seconds), future).await {
                         Ok(Ok(response)) => response,
@@ -264,6 +338,9 @@ fn capability(name: &'static str) -> Capability {
     let snapshot = crate::snapshot::snapshot_coverage(name);
     let execution = match name {
         "lambda" => "explicit backend required; native is trusted-code-only",
+        "stepfunctions" => {
+            "M1 STANDARD JSONPath; actual integrations and limits in workflows capability"
+        }
         "sns" | "events" => "SQS targets only; target availability validated",
         _ => "partial AWS compatibility; see service capability documentation",
     };
@@ -310,7 +387,7 @@ fn unavailable(message: &str) -> Response<GatewayBody> {
     response
 }
 
-fn json_response(status: StatusCode, value: &serde_json::Value) -> Response<GatewayBody> {
+fn json_response<T: Serialize>(status: StatusCode, value: &T) -> Response<GatewayBody> {
     let (status, body) = match serde_json::to_string(value) {
         Ok(body) => (status, body),
         Err(_) => (
@@ -376,3 +453,6 @@ mod tests {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod endpoint_tests;
diff --git a/apps/rustack/src/gateway/endpoint_tests.rs b/apps/rustack/src/gateway/endpoint_tests.rs
new file mode 100644
index 00000000..785e2d96
--- /dev/null
+++ b/apps/rustack/src/gateway/endpoint_tests.rs
@@ -0,0 +1,112 @@
+#[cfg(feature = "lambda")]
+use std::sync::Arc;
+use std::time::Duration;
+
+use http::Method;
+use hyper::server::conn::http1;
+use hyper_util::rt::TokioIo;
+#[cfg(feature = "lambda")]
+use rustack_lambda_core::docker::{GatewayInstanceId, GatewayReply};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+    time::timeout,
+};
+
+use super::GatewayService;
+#[cfg(feature = "lambda")]
+use crate::runtime::RuntimeWorkers;
+
+async fn exchange(gateway: GatewayService, method: &str, path: &str) -> String {
+    timeout(Duration::from_secs(10), async {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = async {
+            let (stream, _) = listener.accept().await.unwrap();
+            http1::Builder::new()
+                .serve_connection(TokioIo::new(stream), gateway)
+                .await
+                .unwrap();
+        };
+        let client = async {
+            let mut stream = TcpStream::connect(address).await.unwrap();
+            stream
+                .write_all(
+                    format!(
+                        "{method} {path} HTTP/1.1\r\nHost: fixture\r\nConnection: \
+                         close\r\nContent-Length: 0\r\n\r\n"
+                    )
+                    .as_bytes(),
+                )
+                .await
+                .unwrap();
+            let mut bytes = Vec::new();
+            stream.take(8193).read_to_end(&mut bytes).await.unwrap();
+            assert!(bytes.len() <= 8192);
+            String::from_utf8(bytes).unwrap()
+        };
+        let ((), wire) = tokio::join!(server, client);
+        wire
+    })
+    .await
+    .unwrap()
+}
+#[tokio::test]
+async fn test_should_return_disabled_probe_404_without_claiming_an_identity() {
+    let wire = exchange(
+        GatewayService::new(Vec::new()),
+        "GET",
+        "/_rustack/runtime-probe",
+    )
+    .await;
+    assert!(wire.starts_with("HTTP/1.1 404"));
+    assert!(wire.contains("cache-control: no-store"));
+    assert!(!wire.contains("instanceId"));
+}
+#[cfg(feature = "lambda")]
+#[tokio::test]
+async fn test_should_preserve_probe_identity_across_workers_clone_closed_and_saturated_admission() {
+    let id = GatewayInstanceId::generate().unwrap();
+    let gateway = GatewayService::new(Vec::new())
+        .with_runtime_identity(id)
+        .with_workers(Arc::new(RuntimeWorkers::default()))
+        .health_only();
+    let _permits = gateway
+        .admission
+        .clone()
+        .acquire_many_owned(u32::try_from(gateway.budgets.requests).unwrap())
+        .await
+        .unwrap();
+    gateway.state().drain();
+    let wire = exchange(gateway.clone(), "GET", "/_rustack/runtime-probe").await;
+    assert!(wire.starts_with("HTTP/1.1 200"));
+    assert!(wire.contains("cache-control: no-store"));
+    let (_, body) = wire.split_once("\r\n\r\n").unwrap();
+    let reply: GatewayReply = serde_json::from_str(body).unwrap();
+    assert_eq!(reply.instance_id(), id);
+    assert!(
+        exchange(gateway, "GET", "/bucket")
+            .await
+            .starts_with("HTTP/1.1 503")
+    );
+}
+#[cfg(feature = "lambda")]
+#[tokio::test]
+async fn test_should_bound_head_reply_framing_and_reject_probe_business_methods() {
+    let gateway = GatewayService::new(Vec::new())
+        .with_runtime_identity(GatewayInstanceId::generate().unwrap());
+    let wire = exchange(gateway.clone(), "HEAD", "/_rustack/runtime-probe").await;
+    assert!(wire.starts_with("HTTP/1.1 200"));
+    assert_eq!(wire.split_once("\r\n\r\n").unwrap().1, "");
+    assert!(wire.contains("content-length:"));
+    let wire = exchange(gateway, "POST", "/_rustack/runtime-probe").await;
+    assert!(wire.starts_with("HTTP/1.1 405"));
+    assert!(wire.contains("allow: GET, HEAD"));
+}
+#[test]
+fn test_should_keep_probe_method_outside_normal_health_aliases() {
+    assert!(!super::is_health_check(
+        &Method::POST,
+        "/_rustack/runtime-probe"
+    ));
+}
diff --git a/apps/rustack/src/lambda_docker.rs b/apps/rustack/src/lambda_docker.rs
new file mode 100644
index 00000000..90821899
--- /dev/null
+++ b/apps/rustack/src/lambda_docker.rs
@@ -0,0 +1,242 @@
+//! Retained diagnostic-only listener while the exact Docker owner qualifies.
+
+use std::{future::Future, sync::Arc, time::Duration};
+
+use anyhow::{Context, Result, bail, ensure};
+use hyper::server::conn::http1;
+use hyper_util::rt::{TokioIo, TokioTimer};
+use rustack_lambda_core::docker::{DockerRuntime, GatewayInstanceId};
+use tokio::{
+    net::TcpListener,
+    runtime::Handle,
+    sync::watch,
+    task::{JoinHandle, JoinSet},
+    time::{Instant, timeout_at},
+};
+
+pub(crate) async fn qualify(
+    listener: Arc<TcpListener>,
+    owner: &mut DockerRuntime,
+    instance: GatewayInstanceId,
+    deadline: Instant,
+) -> Result<()> {
+    observe(
+        listener,
+        instance,
+        async {
+            owner
+                .qualify(deadline)
+                .await
+                .context("qualify production Docker runtime")
+        },
+        deadline,
+    )
+    .await
+}
+
+pub(crate) async fn observe<T>(
+    listener: Arc<TcpListener>,
+    instance: GatewayInstanceId,
+    work: impl Future<Output = Result<T>>,
+    deadline: Instant,
+) -> Result<T> {
+    let mut owner = DiagnosticOwner::start(listener, instance, deadline);
+    let mut terminate = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
+        .context("register startup SIGTERM")?;
+    tokio::pin!(work);
+    let result = tokio::select! {biased;
+        result=tokio::signal::ctrl_c()=>result.context("observe startup SIGINT").and_then(|()|Err(anyhow::anyhow!("runtime startup interrupted"))),
+        _=terminate.recv()=>Err(anyhow::anyhow!("runtime startup interrupted")),
+        ()=tokio::time::sleep_until(deadline)=>Err(anyhow::anyhow!("runtime startup observation expired")),
+        result=&mut work=>result,
+        result=owner.join()=>result.and_then(|()|Err(anyhow::anyhow!("startup diagnostic listener stopped before activation"))),
+    };
+    // The deadline selects a result; it never cancels this retained join.
+    let cleanup = owner.shutdown().await;
+    let output = result?;
+    cleanup?;
+    ensure!(
+        Instant::now() < deadline,
+        "runtime startup observation expired"
+    );
+    Ok(output)
+}
+
+#[derive(Debug)]
+struct DiagnosticOwner {
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<()>>>,
+    settled: Option<Result<(), Arc<anyhow::Error>>>,
+    runtime: Handle,
+}
+impl DiagnosticOwner {
+    fn start(listener: Arc<TcpListener>, instance: GatewayInstanceId, deadline: Instant) -> Self {
+        let (stop, stopped) = watch::channel(false);
+        let runtime = Handle::current();
+        Self {
+            stop,
+            task: Some(runtime.spawn(serve(listener, instance, stopped, deadline))),
+            settled: None,
+            runtime,
+        }
+    }
+    async fn shutdown(&mut self) -> Result<()> {
+        self.stop.send_replace(true);
+        self.join().await
+    }
+    async fn join(&mut self) -> Result<()> {
+        if self.settled.is_none() {
+            let result = match self.task.as_mut() {
+                Some(task) => task
+                    .await
+                    .context("startup diagnostic supervisor failed")
+                    .and_then(|result| result),
+                None => Ok(()),
+            };
+            self.task.take();
+            self.settled = Some(result.map_err(Arc::new));
+        }
+        match &self.settled {
+            Some(Ok(())) => Ok(()),
+            Some(Err(error)) => Err(anyhow::anyhow!(
+                "startup diagnostic cleanup failed: {error:#}"
+            )),
+            None => bail!("startup diagnostic unsettled"),
+        }
+    }
+}
+impl Drop for DiagnosticOwner {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+        if let Some(task) = self.task.take() {
+            // An abandoned observer cannot abort the actor's child joins. This
+            // retained reaper observes the exact supervisor on the captured runtime.
+            self.runtime.spawn(async move {
+                if !matches!(task.await, Ok(Ok(()))) {
+                    tracing::error!("abandoned startup diagnostic cleanup failed");
+                }
+            });
+        }
+    }
+}
+async fn serve(
+    listener: Arc<TcpListener>,
+    instance: GatewayInstanceId,
+    mut stopped: watch::Receiver<bool>,
+    deadline: Instant,
+) -> Result<()> {
+    let service = crate::gateway::GatewayService::new(Vec::new())
+        .with_runtime_identity(instance)
+        .health_only();
+    service.state().drain();
+    let mut tasks = JoinSet::new();
+    let result=async {loop {
+        tokio::select! {biased;
+            _=stopped.wait_for(|stop|*stop)=>break Ok(()),
+            ()=tokio::time::sleep_until(deadline)=>break Ok(()),
+            result=tasks.join_next(),if !tasks.is_empty()=>{if let Some(Err(error))=result{bail!("startup diagnostic worker failed: {error}");}},
+            connection=listener.accept()=>{
+                let (stream,_)=connection.context("accept startup diagnostic connection")?;
+                if tasks.len()>=8{drop(stream);continue;}
+                let service=service.clone();
+                tasks.spawn(async move {
+                    let mut http=http1::Builder::new();
+                    http.timer(TokioTimer::new()).header_read_timeout(Duration::from_secs(rustack_core::settings::budgets().header_seconds)).max_headers(32).max_buf_size(16*1024);
+                    let _=timeout_at(deadline,http.serve_connection(TokioIo::new(stream),service)).await;
+                });
+            }
+        }
+    }}.await;
+    tasks.abort_all();
+    let mut joined = true;
+    while let Some(result) = tasks.join_next().await {
+        if let Err(error) = result {
+            joined &= error.is_cancelled();
+        }
+    }
+    result?;
+    ensure!(joined, "startup diagnostic workers failed during join");
+    Ok(())
+}
+pub(crate) async fn shutdown(owner: &mut Option<DockerRuntime>, deadline: Instant) -> Result<()> {
+    if let Some(owner) = owner {
+        owner
+            .shutdown(deadline)
+            .await
+            .context("Docker runtime cleanup incomplete")?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::future::pending;
+
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpStream,
+        time::{sleep, timeout},
+    };
+
+    use super::*;
+    #[tokio::test]
+    async fn test_should_join_held_diagnostic_connections_before_deadline_result() {
+        let listener = Arc::new(TcpListener::bind("127.0.0.1:0").await.unwrap());
+        let address = listener.local_addr().unwrap();
+        let observed = listener.clone();
+        let job = tokio::spawn(observe(
+            observed,
+            GatewayInstanceId::generate().unwrap(),
+            pending::<Result<()>>(),
+            Instant::now() + Duration::from_millis(50),
+        ));
+        let mut client = TcpStream::connect(address).await.unwrap();
+        client
+            .write_all(b"GET /_rustack/runtime-probe HTTP/1.1\r\n")
+            .await
+            .unwrap();
+        assert!(job.await.unwrap().is_err());
+        assert_eq!(Arc::strong_count(&listener), 1);
+        assert_eq!(
+            timeout(Duration::from_secs(1), client.read(&mut [0]))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+        assert!(TcpListener::bind(address).await.is_err());
+    }
+    #[tokio::test]
+    async fn test_should_retain_diagnostic_join_after_startup_observer_abandonment() {
+        let listener = Arc::new(TcpListener::bind("127.0.0.1:0").await.unwrap());
+        let address = listener.local_addr().unwrap();
+        let job = tokio::spawn(observe(
+            listener.clone(),
+            GatewayInstanceId::generate().unwrap(),
+            pending::<Result<()>>(),
+            Instant::now() + Duration::from_secs(5),
+        ));
+        let mut client = TcpStream::connect(address).await.unwrap();
+        client
+            .write_all(b"GET /_rustack/runtime-probe HTTP/1.1\r\n")
+            .await
+            .unwrap();
+        sleep(Duration::from_millis(10)).await;
+        job.abort();
+        assert!(job.await.unwrap_err().is_cancelled());
+        timeout(Duration::from_secs(1), async {
+            while Arc::strong_count(&listener) != 1 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+        assert_eq!(
+            timeout(Duration::from_secs(1), client.read(&mut [0]))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+    }
+}
diff --git a/apps/rustack/src/lib.rs b/apps/rustack/src/lib.rs
new file mode 100644
index 00000000..38d1515b
--- /dev/null
+++ b/apps/rustack/src/lib.rs
@@ -0,0 +1,12 @@
+//! Composition adapters shared by the Rustack binary and integration harnesses.
+//!
+//! Exporting an adapter does not register or advertise a gateway service.
+
+#![forbid(unsafe_code)]
+
+#[cfg(all(feature = "lambda", feature = "stepfunctions"))]
+pub mod stepfunctions_bridge;
+
+/// Real registry-backed Step Functions API and stable pagination ownership.
+#[cfg(feature = "stepfunctions")]
+pub mod stepfunctions_api;
diff --git a/apps/rustack/src/main.rs b/apps/rustack/src/main.rs
index c52530a4..7d7198d2 100644
--- a/apps/rustack/src/main.rs
+++ b/apps/rustack/src/main.rs
@@ -36,6 +36,8 @@ mod events_bridge;
 mod gateway;
 #[cfg(feature = "s3")]
 mod handler;
+#[cfg(all(feature = "lambda", unix))]
+mod lambda_docker;
 #[cfg(all(feature = "lambda", feature = "s3"))]
 mod lambda_s3_bridge;
 mod runtime;
@@ -43,6 +45,8 @@ mod service;
 mod snapshot;
 #[cfg(feature = "sns")]
 mod sns_bridge;
+#[cfg(feature = "stepfunctions")]
+mod workflows;
 
 use std::{net::SocketAddr, sync::Arc, time::Duration};
 
@@ -137,9 +141,17 @@ use rustack_lambda_core::code::{S3CodeFetcher, UnavailableS3CodeFetcher};
 #[cfg(feature = "lambda")]
 use rustack_lambda_core::config::LambdaConfig;
 #[cfg(feature = "lambda")]
+use rustack_lambda_core::docker::GatewayInstanceId;
+#[cfg(feature = "lambda")]
 use rustack_lambda_core::handler::RustackLambdaHandler;
 #[cfg(feature = "lambda")]
 use rustack_lambda_core::provider::RustackLambda;
+#[cfg(all(feature = "lambda", unix))]
+use rustack_lambda_core::{
+    docker::{DockerInstallation, DockerRuntime, DockerRuntimeSettings, DockerStartupConfig},
+    executor::ExecutorBackend,
+    storage::FunctionStore,
+};
 #[cfg(feature = "lambda")]
 use rustack_lambda_http::service::{LambdaHttpConfig, LambdaHttpService};
 #[cfg(feature = "logs")]
@@ -196,6 +208,10 @@ use rustack_ssm_core::handler::RustackSsmHandler;
 use rustack_ssm_core::provider::RustackSsm;
 #[cfg(feature = "ssm")]
 use rustack_ssm_http::service::{SsmHttpConfig, SsmHttpService};
+#[cfg(feature = "stepfunctions")]
+use rustack_stepfunctions_core::TenantScope;
+#[cfg(feature = "stepfunctions")]
+use rustack_stepfunctions_http::{RequestScope, StepFunctionsHttpConfig, StepFunctionsHttpService};
 #[cfg(feature = "sts")]
 use rustack_sts_core::config::StsConfig;
 #[cfg(feature = "sts")]
@@ -212,11 +228,13 @@ use tracing_subscriber::EnvFilter;
 use crate::events_bridge::LocalTargetDelivery;
 #[cfg(feature = "sns")]
 use crate::sns_bridge::RustackSqsPublisher;
+#[cfg(feature = "stepfunctions")]
+use crate::workflows::{WorkflowRuntime, WorkflowSupervisor};
 use crate::{
     gateway::GatewayService,
     runtime::RuntimeWorkers,
     service::ServiceRouter,
-    snapshot::{RuntimeProviders, SnapshotConfig},
+    snapshot::{RuntimeProviders, SnapshotConfig, SnapshotSession},
 };
 
 /// Server version reported in health check responses.
@@ -604,7 +622,7 @@ fn build_sts_http_config(config: &StsConfig) -> StsHttpConfig {
 }
 
 /// Build a credential provider from `ACCESS_KEY` / `SECRET_KEY` environment
-/// variables (used by MinIO Mint and other test harnesses).
+/// variables (used by `MinIO` Mint and other test harnesses).
 #[cfg(any(
     feature = "s3",
     feature = "dynamodb",
@@ -612,6 +630,7 @@ fn build_sts_http_config(config: &StsConfig) -> StsHttpConfig {
     feature = "ssm",
     feature = "sns",
     feature = "lambda",
+    feature = "stepfunctions",
     feature = "events",
     feature = "logs",
     feature = "kms",
@@ -643,7 +662,11 @@ fn build_credential_provider() -> Option<Arc<dyn rustack_auth::CredentialProvide
 }
 
 /// Accept bounded connections, then return the shared shutdown deadline and drain result.
-async fn serve(listener: TcpListener, service: GatewayService) -> Result<(Instant, Result<()>)> {
+async fn serve(
+    listener: Arc<TcpListener>,
+    service: GatewayService,
+    cleanup_reserve: Duration,
+) -> Result<(Instant, Result<()>)> {
     let budgets = settings::budgets();
     let graceful = hyper_util::server::graceful::GracefulShutdown::new();
     let mut http = HttpConnBuilder::new(TokioExecutor::new());
@@ -700,7 +723,7 @@ async fn serve(listener: TcpListener, service: GatewayService) -> Result<(Instan
     drop(listener);
     let deadline = Instant::now() + Duration::from_secs(budgets.shutdown_seconds);
     info!("stopped ingress; draining connections");
-    let drain_deadline = deadline - shutdown_cleanup_reserve();
+    let drain_deadline = deadline - cleanup_reserve;
     let drained = tokio::time::timeout_at(drain_deadline, graceful.shutdown())
         .await
         .context("HTTP drain deadline exceeded");
@@ -725,6 +748,7 @@ fn is_compiled_in(name: &str) -> bool {
         || (name == "ssm" && cfg!(feature = "ssm"))
         || (name == "sns" && cfg!(feature = "sns"))
         || (name == "lambda" && cfg!(feature = "lambda"))
+        || (name == "stepfunctions" && cfg!(feature = "stepfunctions"))
         || (name == "events" && cfg!(feature = "events"))
         || (name == "logs" && cfg!(feature = "logs"))
         || (name == "kms" && cfg!(feature = "kms"))
@@ -770,6 +794,9 @@ fn parse_services_value(raw: &str) -> Vec<String> {
         if cfg!(feature = "sns") {
             all.push("sns".to_string());
         }
+        if cfg!(feature = "stepfunctions") {
+            all.push("stepfunctions".to_owned());
+        }
         if cfg!(feature = "lambda") {
             all.push("lambda".to_string());
         }
@@ -890,7 +917,7 @@ async fn run_health_check(addr: &str) -> Result<()> {
 /// Read the gateway listen address from the environment.
 ///
 /// Checks `GATEWAY_LISTEN` (the canonical var) and falls back to the
-/// S3Config default when S3 is compiled in.
+/// `S3Config` default when S3 is compiled in.
 fn gateway_listen_addr() -> String {
     settings::var("GATEWAY_LISTEN").unwrap_or_else(|_| "127.0.0.1:4566".to_string())
 }
@@ -900,18 +927,79 @@ fn log_level() -> String {
     settings::var("LOG_LEVEL").unwrap_or_else(|_| "info".to_string())
 }
 
+fn enforce_startup_deadline(deadline: Instant) -> Result<()> {
+    if Instant::now() >= deadline {
+        anyhow::bail!("runtime startup observation deadline exceeded");
+    }
+    Ok(())
+}
+
+async fn bind_before_deadline(address: SocketAddr, deadline: Instant) -> Result<TcpListener> {
+    enforce_startup_deadline(deadline)?;
+    let listener = TcpListener::bind(address)
+        .await
+        .with_context(|| format!("failed to bind to {address}"))?;
+    enforce_startup_deadline(deadline)?;
+    Ok(listener)
+}
+
 /// Built runtime services and provider handles.
 struct Runtime {
     services: Vec<Box<dyn ServiceRouter>>,
     providers: RuntimeProviders,
     workers: RuntimeWorkers,
+    #[cfg(feature = "stepfunctions")]
+    workflows: Option<WorkflowSupervisor>,
+}
+
+impl Runtime {
+    /// Join constructed owners even when startup never opens the public listener.
+    async fn abort_startup(&mut self, deadline: Instant) -> Result<()> {
+        #[cfg(feature = "stepfunctions")]
+        let workflow = match &mut self.workflows {
+            Some(workflows) => workflows.shutdown(deadline).await,
+            None => Ok(()),
+        };
+        let workers = tokio::time::timeout_at(deadline, self.workers.shutdown(deadline))
+            .await
+            .context("startup provider cleanup observation expired")?;
+        #[cfg(feature = "stepfunctions")]
+        workflow?;
+        workers
+    }
+}
+
+#[cfg(all(test, feature = "stepfunctions"))]
+fn build_services(is_enabled: impl Fn(&str) -> bool) -> Result<Runtime> {
+    build_services_with_runtime(
+        is_enabled,
+        #[cfg(all(feature = "lambda", unix))]
+        None,
+    )
 }
 
 /// Build all enabled service routers based on environment configuration.
 #[allow(clippy::too_many_lines)]
-fn build_services(is_enabled: impl Fn(&str) -> bool) -> Result<Runtime> {
+fn build_services_with_runtime(
+    is_enabled: impl Fn(&str) -> bool,
+    #[cfg(all(feature = "lambda", unix))] installation: Option<DockerInstallation>,
+) -> Result<Runtime> {
     let mut services: Vec<Box<dyn ServiceRouter>> = Vec::new();
-    let mut providers = RuntimeProviders::default();
+    let providers = RuntimeProviders::default();
+    #[cfg(any(
+        feature = "stepfunctions",
+        feature = "s3",
+        feature = "dynamodb",
+        feature = "dynamodbstreams",
+        feature = "sqs",
+        feature = "ssm",
+        feature = "iam",
+        feature = "lambda",
+        feature = "apigatewayv2",
+        feature = "cloudfront",
+        feature = "cloudfront-dataplane"
+    ))]
+    let mut providers = providers;
     let mut workers = RuntimeWorkers::default();
 
     // ----- DynamoDB + DynamoDB Streams (register before S3: S3 is the catch-all) -----
@@ -922,7 +1010,9 @@ fn build_services(is_enabled: impl Fn(&str) -> bool) -> Result<Runtime> {
             dynamodb_skip_signature_validation = dynamodb_config.skip_signature_validation,
             "initializing DynamoDB service",
         );
-        let mut dynamodb_provider = RustackDynamoDB::new(dynamodb_config.clone());
+        let dynamodb_provider = RustackDynamoDB::new(dynamodb_config.clone());
+        #[cfg(feature = "dynamodbstreams")]
+        let mut dynamodb_provider = dynamodb_provider;
 
         // Wire in DynamoDB Streams emitter and lifecycle manager if enabled.
         #[cfg(feature = "dynamodbstreams")]
@@ -1254,8 +1344,16 @@ fn build_services(is_enabled: impl Fn(&str) -> bool) -> Result<Runtime> {
         };
         #[cfg(not(feature = "s3"))]
         let code_fetcher: Arc<dyn S3CodeFetcher> = Arc::new(UnavailableS3CodeFetcher);
-        let lambda_provider =
-            Arc::new(RustackLambda::new(lambda_config.clone()).with_code_fetcher(code_fetcher));
+        #[cfg(all(feature = "lambda", unix))]
+        let lambda_provider = match installation {
+            Some(installation) => installation.provider(FunctionStore::new(
+                lambda_data_directory().join("lambda-code"),
+            ))?,
+            None => RustackLambda::new(lambda_config.clone()),
+        };
+        #[cfg(not(unix))]
+        let lambda_provider = RustackLambda::new(lambda_config.clone());
+        let lambda_provider = Arc::new(lambda_provider.with_code_fetcher(code_fetcher));
         providers.register_lambda(Arc::clone(&lambda_provider));
         workers.lambda = Some(Arc::clone(&lambda_provider));
         let lambda_handler = RustackLambdaHandler::new(Arc::clone(&lambda_provider));
@@ -1264,6 +1362,34 @@ fn build_services(is_enabled: impl Fn(&str) -> bool) -> Result<Runtime> {
         services.push(Box::new(service::LambdaServiceRouter::new(lambda_service)));
     }
 
+    #[cfg(feature = "stepfunctions")]
+    let workflows = if is_enabled("stepfunctions") {
+        let region = settings::var("DEFAULT_REGION").unwrap_or_else(|_| "us-east-1".to_owned());
+        let account =
+            settings::var("DEFAULT_ACCOUNT_ID").unwrap_or_else(|_| "000000000000".to_owned());
+        let scope = TenantScope::new("aws", &region, &account)?;
+        let skip = settings::var("STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION")
+            .map_or(true, |value| value == "true");
+        let config = StepFunctionsHttpConfig::new(
+            RequestScope::new("aws".to_owned(), region, account)?,
+            skip,
+            build_credential_provider(),
+        )?;
+        let workflow = WorkflowRuntime::new(
+            scope,
+            settings::budgets(),
+            #[cfg(feature = "lambda")]
+            workers.lambda.clone(),
+        )?;
+        providers.register_workflows(workflow.archive);
+        workers.workflows = Some(workflow.status);
+        let http = StepFunctionsHttpService::new(workflow.api, config);
+        services.insert(0, Box::new(service::StepFunctionsServiceRouter::new(http)));
+        Some(workflow.owner)
+    } else {
+        None
+    };
+
     // ----- CloudFront (management + data plane, register before S3 catch-all) -----
     #[cfg(feature = "cloudfront")]
     if is_enabled("cloudfront") {
@@ -1312,11 +1438,22 @@ fn build_services(is_enabled: impl Fn(&str) -> bool) -> Result<Runtime> {
         services,
         providers,
         workers,
+        #[cfg(feature = "stepfunctions")]
+        workflows,
     })
 }
 
-fn shutdown_cleanup_reserve() -> Duration {
-    (Duration::from_secs(settings::budgets().shutdown_seconds) / 10).min(Duration::from_secs(1))
+#[cfg(all(feature = "lambda", unix))]
+fn lambda_data_directory() -> std::path::PathBuf {
+    settings::var("DATA_DIR").map_or_else(
+        |_| rustack_core::RustackConfig::default().data_dir.into(),
+        Into::into,
+    )
+}
+
+fn shutdown_cleanup_reserve(shutdown: Duration, docker_cleanup: Option<Duration>) -> Duration {
+    let floor = (shutdown / 10).min(Duration::from_secs(1));
+    docker_cleanup.map_or(floor, |cleanup| cleanup.min(shutdown / 2).max(floor))
 }
 
 fn main() -> Result<()> {
@@ -1392,7 +1529,95 @@ async fn run() -> Result<()> {
     }
     config.validate_credentials(&enabled)?;
     info!(settings = ?config, "validated runtime configuration");
-    let runtime = build_services(|name| enabled.iter().any(|s| s == name))?;
+    let startup_deadline =
+        Instant::now() + Duration::from_secs(settings::budgets().startup_seconds);
+    #[cfg(feature = "lambda")]
+    let gateway_instance = if enabled.iter().any(|name| name == "lambda") {
+        Some(
+            GatewayInstanceId::generate_owned(
+                startup_deadline.min(Instant::now() + Duration::from_secs(60)),
+            )
+            .await
+            .context("generate runtime gateway identity")?,
+        )
+    } else {
+        None
+    };
+    #[cfg(all(feature = "lambda", unix))]
+    let mut docker: Option<DockerRuntime> = None;
+    #[cfg(all(feature = "lambda", unix))]
+    let mut startup_listener = None;
+    #[cfg(all(feature = "lambda", unix))]
+    let installation = if enabled.iter().any(|name| name == "lambda") {
+        let lambda = LambdaConfig::from_env()?;
+        if lambda.executor == ExecutorBackend::Docker {
+            let settings = DockerRuntimeSettings::from_lookup(
+                |key| settings::var(key).ok(),
+                &settings::budgets(),
+                lambda.idle_timeout,
+            )?;
+            let instance = gateway_instance.context("Lambda gateway identity absent")?;
+            let startup =
+                DockerStartupConfig::new(settings, lambda_data_directory(), instance, lambda)?;
+            let mut owner = DockerRuntime::new(startup)?;
+            let qualification = async {
+                let addr: SocketAddr = listen_addr.parse().context("invalid bind address")?;
+                let listener = Arc::new(bind_before_deadline(addr, startup_deadline).await?);
+                lambda_docker::qualify(listener.clone(), &mut owner, instance, startup_deadline)
+                    .await?;
+                let installed = owner.installation()?;
+                Result::<_>::Ok((listener, installed))
+            }
+            .await;
+            let (listener, installed) = match qualification {
+                Ok(qualified) => qualified,
+                Err(error) => {
+                    let cleanup = owner
+                        .shutdown(
+                            Instant::now()
+                                + Duration::from_secs(settings::budgets().shutdown_seconds),
+                        )
+                        .await;
+                    if cleanup.is_err() {
+                        tracing::error!("startup Docker cleanup remains owned");
+                    }
+                    return Err(error);
+                }
+            };
+            startup_listener = Some(listener);
+            docker = Some(owner);
+            Some(installed)
+        } else {
+            None
+        }
+    } else {
+        None
+    };
+    let construction = build_services_with_runtime(
+        |name| enabled.iter().any(|s| s == name),
+        #[cfg(all(feature = "lambda", unix))]
+        installation,
+    );
+    let mut runtime = match construction {
+        Ok(runtime) => runtime,
+        Err(error) => {
+            #[cfg(all(feature = "lambda", unix))]
+            if lambda_docker::shutdown(
+                &mut docker,
+                Instant::now() + Duration::from_secs(settings::budgets().shutdown_seconds),
+            )
+            .await
+            .is_err()
+            {
+                tracing::error!("startup Docker cleanup remains owned");
+            }
+            return Err(error);
+        }
+    };
+    #[cfg(all(feature = "lambda", unix))]
+    if let Some(owner) = &docker {
+        runtime.workers.docker = Some(owner.status());
+    }
 
     if runtime.services.is_empty() {
         anyhow::bail!(
@@ -1401,32 +1626,103 @@ async fn run() -> Result<()> {
         );
     }
 
-    let _snapshot_lease = match snapshot_config.as_ref() {
-        Some(config) => Some(config.acquire_lease().await?),
-        None => None,
+    let mut snapshot = SnapshotSession::new(snapshot_config);
+    #[cfg(all(feature = "lambda", unix))]
+    let diagnostic_startup = startup_listener.is_some();
+    let startup_work = async {
+        let work = async {
+            snapshot.load(&runtime.providers, startup_deadline).await?;
+            #[cfg(feature = "lambda")]
+            if let Some(lambda) = &runtime.workers.lambda {
+                lambda.validate_runtime_restore()?;
+            }
+            #[cfg(all(feature = "lambda", unix))]
+            if let Some(owner) = &docker {
+                owner.installation()?;
+            }
+            Result::<()>::Ok(())
+        };
+        #[cfg(all(feature = "lambda", unix))]
+        match startup_listener.as_ref() {
+            Some(listener) => {
+                lambda_docker::observe(
+                    listener.clone(),
+                    gateway_instance.context("Lambda gateway identity absent")?,
+                    work,
+                    startup_deadline,
+                )
+                .await?;
+            }
+            None => work.await?,
+        }
+        #[cfg(not(all(feature = "lambda", unix)))]
+        work.await?;
+        let addr: SocketAddr = listen_addr
+            .parse()
+            .with_context(|| format!("invalid bind address: {listen_addr}"))?;
+        #[cfg(all(feature = "lambda", unix))]
+        let listener = match startup_listener.take() {
+            Some(listener) => listener,
+            None => Arc::new(bind_before_deadline(addr, startup_deadline).await?),
+        };
+        #[cfg(not(all(feature = "lambda", unix)))]
+        let listener = Arc::new(bind_before_deadline(addr, startup_deadline).await?);
+        Result::<_>::Ok((addr, listener))
+    };
+    #[cfg(all(feature = "lambda", unix))]
+    let startup = if diagnostic_startup {
+        startup_work.await
+    } else {
+        tokio::time::timeout_at(startup_deadline, startup_work)
+            .await
+            .context("runtime startup observation deadline exceeded")
+            .and_then(|result| result)
+    };
+    #[cfg(not(all(feature = "lambda", unix)))]
+    let startup = tokio::time::timeout_at(startup_deadline, startup_work)
+        .await
+        .context("runtime startup observation deadline exceeded")
+        .and_then(|result| result);
+    let (addr, listener) = match startup {
+        Ok(started) => started,
+        Err(error) => {
+            let cleanup_deadline =
+                Instant::now() + Duration::from_secs(settings::budgets().shutdown_seconds);
+            if let Err(cleanup) = snapshot.finish(cleanup_deadline).await {
+                tracing::error!(error = %cleanup, "startup snapshot cleanup incomplete");
+            }
+            let cleanup = runtime.abort_startup(cleanup_deadline).await;
+            #[cfg(all(feature = "lambda", unix))]
+            if lambda_docker::shutdown(&mut docker, cleanup_deadline)
+                .await
+                .is_err()
+            {
+                tracing::error!("startup Docker cleanup remains owned");
+            }
+            snapshot.quarantine();
+            if let Err(cleanup) = cleanup {
+                tracing::error!(error = %cleanup, "startup cleanup incomplete");
+            }
+            return Err(error);
+        }
     };
-    if let Some(config) = snapshot_config.as_ref() {
-        info!(coverage = ?runtime.providers.coverage(), "snapshot includes only declared state; other services and SQS messages are not persisted");
-        config.load(&runtime.providers).await?;
-    }
 
     let Runtime {
         services,
         providers,
         workers,
+        #[cfg(feature = "stepfunctions")]
+        mut workflows,
     } = runtime;
     let workers = Arc::new(workers);
     let gateway = GatewayService::new(services).with_workers(Arc::clone(&workers));
+    #[cfg(feature = "lambda")]
+    let gateway = match gateway_instance {
+        Some(instance) => gateway.with_runtime_identity(instance),
+        None => gateway,
+    };
     let service_names = gateway.service_names();
 
-    let addr: SocketAddr = listen_addr
-        .parse()
-        .with_context(|| format!("invalid bind address: {listen_addr}"))?;
-
-    let listener = TcpListener::bind(addr)
-        .await
-        .with_context(|| format!("failed to bind to {addr}"))?;
-
     info!(
         %addr,
         services = ?service_names,
@@ -1434,38 +1730,66 @@ async fn run() -> Result<()> {
         "starting Rustack Server",
     );
 
-    let (deadline, serve_result) = match serve(listener, gateway).await {
+    #[cfg(all(feature = "lambda", unix))]
+    let docker_cleanup = workers
+        .docker
+        .as_ref()
+        .map(|_| Duration::from_secs(settings::budgets().lambda_docker_cleanup_seconds));
+    #[cfg(not(all(feature = "lambda", unix)))]
+    let docker_cleanup = None;
+    let cleanup_reserve = shutdown_cleanup_reserve(
+        Duration::from_secs(settings::budgets().shutdown_seconds),
+        docker_cleanup,
+    );
+    let (deadline, serve_result) = match serve(listener, gateway, cleanup_reserve).await {
         Ok(outcome) => outcome,
         Err(error) => (
             Instant::now() + Duration::from_secs(settings::budgets().shutdown_seconds),
             Err(error),
         ),
     };
-    let work_deadline = deadline - shutdown_cleanup_reserve();
+    let work_deadline = deadline - cleanup_reserve;
     let save_result = async {
         serve_result?;
-        workers
-            .quiesce(work_deadline.saturating_duration_since(Instant::now()))
-            .await?;
-        if let Some(config) = snapshot_config.as_ref() {
-            tokio::time::timeout_at(work_deadline, config.save(&providers, VERSION))
-                .await
-                .context("snapshot save deadline exceeded")??;
+        workers.quiesce_producers(work_deadline).await?;
+        #[cfg(feature = "stepfunctions")]
+        if let Some(workflows) = &mut workflows {
+            workflows.quiesce(work_deadline).await?;
         }
+        workers.quiesce_consumers(work_deadline).await?;
+        snapshot.save(&providers, VERSION, work_deadline).await?;
         Result::<()>::Ok(())
     }
     .await;
     let stop_result = async {
-        match tokio::time::timeout_at(deadline, workers.shutdown()).await {
-            Ok(result) => result.context("runtime shutdown failed")?,
-            Err(_) => anyhow::bail!(
-                "resource cleanup incomplete: shutdown deadline exceeded; dropping providers now \
-                 (kill_on_drop reaps remaining children)"
-            ),
-        }
+        let snapshot_result = snapshot.finish(deadline).await;
+        #[cfg(feature = "stepfunctions")]
+        let workflow_result = match &mut workflows {
+            Some(workflows) => workflows.shutdown(deadline).await,
+            None => Ok(()),
+        };
+        let worker_result =
+            match tokio::time::timeout_at(deadline, workers.shutdown(deadline)).await {
+                Ok(result) => result.context("runtime shutdown failed"),
+                Err(_) => Err(anyhow::anyhow!(
+                    "resource cleanup incomplete: shutdown deadline exceeded; dropping providers \
+                     now (kill_on_drop reaps remaining children)"
+                )),
+            };
+        #[cfg(all(feature = "lambda", unix))]
+        let docker_result = lambda_docker::shutdown(&mut docker, deadline).await;
+        snapshot_result?;
+        #[cfg(feature = "stepfunctions")]
+        workflow_result?;
+        worker_result?;
+        #[cfg(all(feature = "lambda", unix))]
+        docker_result?;
         Result::<()>::Ok(())
     }
     .await;
+    if save_result.is_err() || stop_result.is_err() {
+        snapshot.quarantine();
+    }
     save_result?;
     stop_result?;
     Ok(())
@@ -1473,7 +1797,48 @@ async fn run() -> Result<()> {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn test_should_reserve_docker_cleanup_within_the_deadline_and_preserve_native_grace() {
+        for (seconds, cleanup, expected_millis) in [
+            (30, None, 1000),
+            (60, None, 1000),
+            (1, None, 100),
+            (30, Some(10), 10000),
+            (60, Some(60), 30000),
+            (1, Some(60), 500),
+        ] {
+            assert_eq!(
+                shutdown_cleanup_reserve(
+                    Duration::from_secs(seconds),
+                    cleanup.map(Duration::from_secs)
+                ),
+                Duration::from_millis(expected_millis)
+            );
+        }
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn test_should_refuse_expired_startup_before_opening_listener() -> Result<()> {
+        let reservation = TcpListener::bind("127.0.0.1:0").await?;
+        let address = reservation.local_addr()?;
+        drop(reservation);
+        let deadline = Instant::now() + Duration::from_secs(1);
+        tokio::time::advance(Duration::from_secs(2)).await;
+        assert!(bind_before_deadline(address, deadline).await.is_err());
+        assert!(tokio::net::TcpStream::connect(address).await.is_err());
+        Ok(())
+    }
+
+    #[cfg(feature = "stepfunctions")]
+    use std::num::NonZeroU64;
+
+    #[cfg(feature = "stepfunctions")]
+    use hyper::server::conn::http1;
+    #[cfg(feature = "stepfunctions")]
+    use rustack_core::http::BodyBudget;
     use tokio::io::AsyncWriteExt;
+    #[cfg(feature = "stepfunctions")]
+    use tokio::{io::AsyncReadExt, net::TcpStream};
 
     use super::*;
 
@@ -1497,6 +1862,246 @@ mod tests {
         Ok(result)
     }
 
+    #[cfg(feature = "stepfunctions")]
+    async fn gateway_exchange(gateway: GatewayService, wire: String) -> Result<String> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let address = listener.local_addr()?;
+        let deadline = Instant::now() + Duration::from_secs(10);
+        let server = async {
+            let (stream, _) = listener.accept().await?;
+            http1::Builder::new()
+                .serve_connection(TokioIo::new(stream), gateway)
+                .await?;
+            Result::<()>::Ok(())
+        };
+        let client = async {
+            let mut stream = TcpStream::connect(address).await?;
+            stream.write_all(wire.as_bytes()).await?;
+            let mut response = Vec::new();
+            stream.take(32_769).read_to_end(&mut response).await?;
+            anyhow::ensure!(response.len() <= 32_768, "fixture response exceeded cap");
+            Result::<String>::Ok(String::from_utf8(response)?)
+        };
+        let (server, client) = tokio::join!(
+            tokio::time::timeout_at(deadline, server),
+            tokio::time::timeout_at(deadline, client)
+        );
+        server??;
+        client?
+    }
+
+    #[cfg(feature = "stepfunctions")]
+    #[tokio::test]
+    async fn test_should_prioritize_workflow_target_over_conflicting_path_and_signing_scope()
+    -> Result<()> {
+        let runtime = build_services(|name| {
+            ["stepfunctions", "lambda", "sns", "sqs", "s3", "dynamodb"].contains(&name)
+        })?;
+        let Runtime {
+            services,
+            workers,
+            mut workflows,
+            ..
+        } = runtime;
+        assert_eq!(
+            services.first().map(|service| service.name()),
+            Some("stepfunctions")
+        );
+        let workers = Arc::new(workers);
+        let gateway = GatewayService::new(services).with_workers(workers.clone());
+        let result = async {
+            for (path, headers) in [
+                (
+                    "/2015-03-31/functions/Fn/invocations",
+                    "X-Amz-Target: AWSStepFunctions.ListStateMachines\r\nContent-Type: \
+                     application/x-amz-json-1.0\r\n",
+                ),
+                (
+                    "/",
+                    "X-Amz-Target: AWSStepFunctions.ListStateMachines\r\nContent-Type: \
+                     application/x-www-form-urlencoded\r\nAuthorization: AWS4-HMAC-SHA256 \
+                     Credential=local/date/us-east-1/sns/aws4_request\r\n",
+                ),
+                (
+                    "/",
+                    "X-Amz-Target: DynamoDB_20120810.ListTables\r\nX-Amz-Target: \
+                     AWSStepFunctions.ListStateMachines\r\nContent-Type: \
+                     application/x-amz-json-1.0\r\n",
+                ),
+            ] {
+                let wire = format!(
+                    "POST {path} HTTP/1.1\r\nHost: localhost\r\n{headers}Content-Length: \
+                     2\r\nConnection: close\r\n\r\n{{}}"
+                );
+                let response = gateway_exchange(gateway.clone(), wire).await?;
+                anyhow::ensure!(
+                    response.starts_with("HTTP/1.1 400"),
+                    "wrong route response: {response}"
+                );
+                let (_, body) = response.split_once("\r\n\r\n").context("error body")?;
+                let error: serde_json::Value = serde_json::from_str(body)?;
+                assert_eq!(error["__type"], "ValidationException");
+                assert_eq!(error["message"], "Invalid HTTP request envelope");
+            }
+            Result::<()>::Ok(())
+        }
+        .await;
+        workflows
+            .as_mut()
+            .context("workflow owner")?
+            .shutdown(Instant::now() + Duration::from_secs(5))
+            .await?;
+        workers
+            .shutdown(Instant::now() + Duration::from_secs(30))
+            .await?;
+        result
+    }
+
+    #[cfg(feature = "stepfunctions")]
+    #[tokio::test]
+    async fn test_should_preserve_modeled_timeout_envelope_through_actual_gateway() -> Result<()> {
+        let runtime = WorkflowRuntime::new(
+            TenantScope::default(),
+            settings::RuntimeBudgets::default(),
+            #[cfg(feature = "lambda")]
+            None,
+        )?;
+        let scope = RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into())?;
+        let total = Duration::from_secs(1);
+        let body = BodyBudget::new(2 * 1024 * 1024, total, total)?;
+        let config = StepFunctionsHttpConfig::new(scope, true, None)?.with_budgets(body, total)?;
+        let router = service::StepFunctionsServiceRouter::new(StepFunctionsHttpService::new(
+            runtime.api,
+            config,
+        ));
+        let gateway = GatewayService::new(vec![Box::new(router)])
+            .with_request_seconds(NonZeroU64::new(1).context("request duration")?);
+        let mut owner = runtime.owner;
+        let response = gateway_exchange(
+            gateway,
+            "POST / HTTP/1.1\r\nHost: localhost\r\nX-Amz-Target: \
+             AWSStepFunctions.ListStateMachines\r\nContent-Type: \
+             application/x-amz-json-1.0\r\nContent-Length: 2\r\nConnection: close\r\n\r\n{"
+                .to_owned(),
+        )
+        .await;
+        owner
+            .quiesce(Instant::now() + Duration::from_secs(5))
+            .await?;
+        let response = response?;
+        assert!(response.starts_with("HTTP/1.1 408"), "{response}");
+        assert!(
+            response.to_ascii_lowercase().contains("x-amzn-requestid:"),
+            "{response}"
+        );
+        let (_, body) = response.split_once("\r\n\r\n").context("timeout body")?;
+        let error: serde_json::Value = serde_json::from_str(body)?;
+        assert_eq!(error["__type"], "RequestTimeoutException");
+        Ok(())
+    }
+
+    #[cfg(feature = "stepfunctions")]
+    #[tokio::test]
+    async fn test_should_route_actual_socket_requests_to_real_workflow_and_capabilities()
+    -> Result<()> {
+        let runtime = build_services(|name| name == "stepfunctions")?;
+        let Runtime {
+            services,
+            workers,
+            mut workflows,
+            ..
+        } = runtime;
+        let gateway = GatewayService::new(services).with_workers(Arc::new(workers));
+        let result = async {
+            let response = gateway_exchange(
+                gateway.clone(),
+                "POST / HTTP/1.1\r\nHost: localhost\r\nX-Amz-Target: \
+                 AWSStepFunctions.ListStateMachines\r\nContent-Type: \
+                 application/x-amz-json-1.0\r\nContent-Length: 2\r\nConnection: close\r\n\r\n{}"
+                    .to_owned(),
+            )
+            .await?;
+            anyhow::ensure!(
+                response.starts_with("HTTP/1.1 200"),
+                "workflow route did not succeed"
+            );
+            anyhow::ensure!(
+                response.contains("\"stateMachines\":[]"),
+                "real empty registry response missing"
+            );
+            let response = gateway_exchange(
+                gateway,
+                "GET /_rustack/capabilities HTTP/1.1\r\nHost: localhost\r\nConnection: \
+                 close\r\n\r\n"
+                    .to_owned(),
+            )
+            .await?;
+            let (_, body) = response.split_once("\r\n\r\n").context("capability body")?;
+            let capabilities: serde_json::Value = serde_json::from_str(body)?;
+            anyhow::ensure!(capabilities["ready"] == true, "workflow gateway not ready");
+            anyhow::ensure!(
+                capabilities["workflows"]["stateTypes"]
+                    .as_array()
+                    .is_some_and(|states| states.len() == 8
+                        && states.contains(&serde_json::json!("Parallel"))
+                        && states.contains(&serde_json::json!("Map")))
+                    && capabilities["workflows"]["limits"]["frames"] == 4096,
+                "installed structured profile or frame limit not reported"
+            );
+            anyhow::ensure!(
+                capabilities["workflows"]["lambdaRequestResponse"] == false,
+                "pure service advertised Lambda"
+            );
+            anyhow::ensure!(
+                capabilities["workflows"]["snapshot"] == "resources-and-history",
+                "snapshot coverage was overstated"
+            );
+            Result::<()>::Ok(())
+        }
+        .await;
+        let cleanup = workflows
+            .as_mut()
+            .context("workflow owner")?
+            .quiesce(Instant::now() + Duration::from_secs(5))
+            .await;
+        cleanup?;
+        result
+    }
+
+    #[cfg(feature = "stepfunctions")]
+    #[tokio::test]
+    async fn test_should_register_real_workflow_service_and_shared_health() -> Result<()> {
+        let mut runtime = build_services(|name| name == "stepfunctions" || name == "s3")?;
+        let workflow = runtime
+            .services
+            .iter()
+            .position(|service| service.name() == "stepfunctions")
+            .context("workflow router")?;
+        if let Some(s3) = runtime
+            .services
+            .iter()
+            .position(|service| service.name() == "s3")
+        {
+            assert!(workflow < s3);
+        }
+        assert!(is_compiled_in("stepfunctions"));
+        assert!(
+            parse_services_value("")
+                .iter()
+                .any(|name| name == "stepfunctions")
+        );
+        assert!(runtime.workers.diagnostics().ready);
+        assert!(runtime.workers.workflow_capabilities().is_some());
+        runtime
+            .workflows
+            .as_mut()
+            .context("workflow owner")?
+            .quiesce(Instant::now() + Duration::from_secs(5))
+            .await?;
+        assert!(!runtime.workers.diagnostics().ready);
+        Ok(())
+    }
+
     #[tokio::test]
     async fn test_should_parse_health_status_not_substrings() -> Result<()> {
         let valid = r#"{"ready":true,"services":{"s3":"running"}}"#;
diff --git a/apps/rustack/src/runtime.rs b/apps/rustack/src/runtime.rs
index 1b251c9f..45370c84 100644
--- a/apps/rustack/src/runtime.rs
+++ b/apps/rustack/src/runtime.rs
@@ -1,13 +1,38 @@
 //! Runtime worker ownership independent of snapshot participation.
 
-use std::{collections::BTreeMap, fmt, sync::Arc, time::Duration};
+#[cfg(not(all(
+    any(feature = "events", feature = "sns", feature = "dynamodb"),
+    any(feature = "lambda", feature = "sqs")
+)))]
+use std::future::{Ready, ready};
+#[cfg(any(
+    feature = "dynamodb",
+    feature = "events",
+    feature = "sns",
+    feature = "lambda",
+    feature = "sqs"
+))]
+use std::sync::Arc;
+use std::{collections::BTreeMap, fmt};
 
-use anyhow::{Context, Result};
+#[cfg(any(
+    feature = "events",
+    feature = "sns",
+    feature = "dynamodb",
+    feature = "sqs"
+))]
+use anyhow::Context;
+use anyhow::Result;
+#[cfg(feature = "lambda")]
+use rustack_lambda_core::diagnostics::InvocationWorkStatus;
 use serde::Serialize;
+use tokio::runtime::Handle;
 
 /// Handles retained until quiescence, snapshot publication, and final shutdown.
 #[derive(Default)]
 pub(crate) struct RuntimeWorkers {
+    #[cfg(feature = "stepfunctions")]
+    pub(crate) workflows: Option<crate::workflows::WorkflowStatus>,
     #[cfg(feature = "dynamodb")]
     pub(crate) dynamodb: Option<Arc<rustack_dynamodb_core::provider::RustackDynamoDB>>,
     #[cfg(feature = "events")]
@@ -16,6 +41,8 @@ pub(crate) struct RuntimeWorkers {
     pub(crate) sns: Option<Arc<rustack_sns_core::provider::RustackSns>>,
     #[cfg(feature = "lambda")]
     pub(crate) lambda: Option<Arc<rustack_lambda_core::provider::RustackLambda>>,
+    #[cfg(all(feature = "lambda", unix))]
+    pub(crate) docker: Option<rustack_lambda_core::docker::DockerRuntimeStatus>,
     #[cfg(feature = "sqs")]
     pub(crate) sqs: Option<Arc<rustack_sqs_core::provider::RustackSqs>>,
 }
@@ -40,6 +67,14 @@ pub(crate) struct DeliverySummary {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub(crate) struct WorkerDiagnostics {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    runtime_tasks: Option<usize>,
+    #[cfg(feature = "lambda")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    lambda_admission: Option<InvocationWorkStatus>,
+    #[cfg(all(feature = "lambda", unix))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub(crate) docker: Option<rustack_lambda_core::docker::DockerCapabilities>,
     pub(crate) ready: bool,
     pub(crate) services: BTreeMap<&'static str, &'static str>,
     delivery: BTreeMap<&'static str, DeliverySummary>,
@@ -49,6 +84,14 @@ impl RuntimeWorkers {
     /// Report live supervisor state, independently of historical delivery failures.
     pub(crate) fn diagnostics(&self) -> WorkerDiagnostics {
         let readiness: &[Option<(&'static str, bool)>] = &[
+            #[cfg(feature = "lambda")]
+            self.lambda
+                .as_ref()
+                .map(|provider| ("lambda", provider.is_ready())),
+            #[cfg(feature = "stepfunctions")]
+            self.workflows
+                .as_ref()
+                .map(|workflow| ("stepfunctions", workflow.is_ready())),
             #[cfg(feature = "events")]
             self.events
                 .as_ref()
@@ -95,6 +138,16 @@ impl RuntimeWorkers {
             }),
         ];
         WorkerDiagnostics {
+            runtime_tasks: Handle::try_current()
+                .ok()
+                .map(|handle| handle.metrics().num_alive_tasks()),
+            #[cfg(feature = "lambda")]
+            lambda_admission: self.lambda.as_ref().map(|provider| provider.work_status()),
+            #[cfg(all(feature = "lambda", unix))]
+            docker: self
+                .docker
+                .as_ref()
+                .map(rustack_lambda_core::docker::DockerRuntimeStatus::capabilities),
             ready: readiness.iter().flatten().all(|(_, ready)| *ready),
             services: readiness
                 .iter()
@@ -105,9 +158,17 @@ impl RuntimeWorkers {
         }
     }
 
-    /// Stop new cross-service work before collecting the supported snapshot state.
-    pub(crate) async fn quiesce(&self, remaining: Duration) -> Result<()> {
-        let deadline = tokio::time::Instant::now() + remaining;
+    #[cfg(feature = "stepfunctions")]
+    pub(crate) fn workflow_capabilities(&self) -> Option<serde_json::Value> {
+        self.workflows
+            .as_ref()
+            .map(crate::workflows::WorkflowStatus::capabilities)
+    }
+
+    /// Quiesce producers before the unique workflow supervisor drains.
+    #[cfg(any(feature = "events", feature = "sns", feature = "dynamodb"))]
+    pub(crate) async fn quiesce_producers(&self, deadline: tokio::time::Instant) -> Result<()> {
+        check_deadline(deadline)?;
         #[cfg(feature = "events")]
         if let Some(events) = &self.events {
             tokio::time::timeout_at(deadline, events.quiesce())
@@ -126,6 +187,13 @@ impl RuntimeWorkers {
                 .await
                 .context("DynamoDB quiesce deadline exceeded")??;
         }
+        Ok(())
+    }
+
+    /// Downstream consumers stay available until workflow cleanup joins.
+    #[cfg(any(feature = "lambda", feature = "sqs"))]
+    pub(crate) async fn quiesce_consumers(&self, deadline: tokio::time::Instant) -> Result<()> {
+        check_deadline(deadline)?;
         #[cfg(feature = "lambda")]
         if let Some(lambda) = &self.lambda {
             lambda
@@ -141,11 +209,22 @@ impl RuntimeWorkers {
         Ok(())
     }
 
+    #[cfg(not(any(feature = "events", feature = "sns", feature = "dynamodb")))]
+    pub(crate) fn quiesce_producers(&self, deadline: tokio::time::Instant) -> Ready<Result<()>> {
+        tracing::debug!(workers = ?self.diagnostics(), "No producer services require quiescence");
+        ready(check_deadline(deadline))
+    }
+    #[cfg(not(any(feature = "lambda", feature = "sqs")))]
+    pub(crate) fn quiesce_consumers(&self, deadline: tokio::time::Instant) -> Ready<Result<()>> {
+        tracing::debug!(workers = ?self.diagnostics(), "No consumer services require quiescence");
+        ready(check_deadline(deadline))
+    }
+
     /// Final resource destruction. Call only after the snapshot decision.
-    pub(crate) async fn shutdown(&self) -> Result<()> {
+    pub(crate) async fn shutdown(&self, deadline: tokio::time::Instant) -> Result<()> {
         // After the snapshot decision, stop independent resource owners together:
         // a failed queue worker must not delay killing Lambda child processes.
-        let (events_result, (), (), ()) = tokio::join!(
+        let (events_result, (), lambda_result, ()) = tokio::join!(
             async {
                 #[cfg(feature = "events")]
                 if let Some(events) = &self.events {
@@ -162,8 +241,9 @@ impl RuntimeWorkers {
             async {
                 #[cfg(feature = "lambda")]
                 if let Some(lambda) = &self.lambda {
-                    lambda.shutdown().await;
+                    lambda.shutdown_before(deadline).await?;
                 }
+                Result::<()>::Ok(())
             },
             async {
                 #[cfg(feature = "sqs")]
@@ -172,6 +252,48 @@ impl RuntimeWorkers {
                 }
             },
         );
-        events_result
+        events_result?;
+        lambda_result?;
+        check_deadline(deadline)
+    }
+}
+
+fn check_deadline(deadline: tokio::time::Instant) -> Result<()> {
+    anyhow::ensure!(
+        tokio::time::Instant::now() < deadline,
+        "runtime quiescence deadline exceeded"
+    );
+    Ok(())
+}
+
+#[cfg(test)]
+mod diagnostic_tests {
+    #[cfg(feature = "lambda")]
+    use rustack_lambda_core::{config::LambdaConfig, provider::RustackLambda};
+
+    use super::*;
+
+    #[test]
+    fn test_should_omit_admission_counts_without_an_installed_lambda_provider() {
+        let value = serde_json::to_value(RuntimeWorkers::default().diagnostics()).unwrap();
+        assert!(value.get("lambdaAdmission").is_none());
+    }
+
+    #[cfg(feature = "lambda")]
+    #[tokio::test]
+    async fn test_should_project_the_actual_installed_lambda_admission_without_starting_work() {
+        let provider = Arc::new(RustackLambda::new(LambdaConfig::default()));
+        let workers = RuntimeWorkers {
+            lambda: Some(provider.clone()),
+            ..RuntimeWorkers::default()
+        };
+        let value = serde_json::to_value(workers.diagnostics()).unwrap();
+        assert_eq!(
+            value.get("lambdaAdmission"),
+            Some(&serde_json::json!({"acceptedInvocations":0,
+            "activeExecutions":0,"accepting":true,"limits":{"acceptedInvocations":128,
+            "activeExecutions":32,"defaultFunctionExecutions":8}}))
+        );
+        assert_eq!(provider.work_status().active_executions, 0);
     }
 }
diff --git a/apps/rustack/src/service.rs b/apps/rustack/src/service.rs
index ed7e62ed..23f40727 100644
--- a/apps/rustack/src/service.rs
+++ b/apps/rustack/src/service.rs
@@ -1,6 +1,6 @@
 //! Service router abstraction for the gateway.
 //!
-//! Each AWS service (S3, DynamoDB, etc.) implements [`ServiceRouter`] to
+//! Each AWS service (S3, `DynamoDB`, etc.) implements [`ServiceRouter`] to
 //! declare how it matches incoming requests and handles them. The gateway
 //! holds a list of routers and dispatches to the first match.
 //!
@@ -9,6 +9,15 @@
 use std::{convert::Infallible, future::Future, io, pin::Pin};
 
 use bytes::Bytes;
+#[cfg(any(
+    feature = "sns",
+    feature = "ses",
+    feature = "cloudwatch",
+    feature = "iam",
+    feature = "sts",
+    feature = "cloudfront"
+))]
+use http::HeaderMap;
 use http_body_util::{BodyExt, Full, combinators::BoxBody};
 use hyper::body::Incoming;
 
@@ -66,6 +75,13 @@ pub trait ServiceRouter: Send + Sync {
     /// Returns `true` if this router should handle the given request.
     fn matches(&self, req: &http::Request<Incoming>) -> bool;
 
+    /// Whether this bounded transport owns its complete modeled request timeout.
+    ///
+    /// Other services keep the gateway's generic deadline.
+    fn owns_request_deadline(&self) -> bool {
+        false
+    }
+
     /// Handle the request, producing a response with a type-erased body.
     fn call(
         &self,
@@ -73,6 +89,20 @@ pub trait ServiceRouter: Send + Sync {
     ) -> Pin<Box<dyn Future<Output = Result<http::Response<GatewayBody>, Infallible>> + Send>>;
 }
 
+#[cfg(any(
+    feature = "sns",
+    feature = "ses",
+    feature = "cloudwatch",
+    feature = "iam",
+    feature = "sts",
+    feature = "cloudfront"
+))]
+fn extract_sigv4_service(headers: &HeaderMap) -> Option<&str> {
+    let auth = headers.get("authorization")?.to_str().ok()?;
+    let (_, rest) = auth.split_once("Credential=")?;
+    rest.split(',').next()?.split('/').nth(3)
+}
+
 // ---------------------------------------------------------------------------
 // S3
 // ---------------------------------------------------------------------------
@@ -143,7 +173,7 @@ mod dynamodb_router {
 
     use super::{GatewayBody, ServiceRouter};
 
-    /// Routes requests to the DynamoDB service.
+    /// Routes requests to the `DynamoDB` service.
     ///
     /// Matches requests whose `X-Amz-Target` header starts with `DynamoDB_`.
     pub struct DynamoDBServiceRouter<H: DynamoDBHandler> {
@@ -202,7 +232,7 @@ mod dynamodbstreams_router {
 
     use super::{GatewayBody, ServiceRouter};
 
-    /// Routes requests to the DynamoDB Streams service.
+    /// Routes requests to the `DynamoDB` Streams service.
     ///
     /// Matches requests whose `X-Amz-Target` header starts with `DynamoDBStreams_`.
     pub struct DynamoDBStreamsServiceRouter<H: DynamoDBStreamsHandler> {
@@ -371,29 +401,12 @@ mod sns_router {
     use hyper::{body::Incoming, service::Service};
     use rustack_sns_http::{dispatch::SnsHandler, service::SnsHttpService};
 
-    use super::{GatewayBody, ServiceRouter};
-
-    /// Extract the SigV4 service name from the Authorization header.
-    fn extract_sigv4_service(headers: &http::HeaderMap) -> Option<&str> {
-        let auth = headers.get("authorization")?.to_str().ok()?;
-        let credential_start = auth.find("Credential=")? + "Credential=".len();
-        let credential_end = auth[credential_start..]
-            .find(',')
-            .map_or(auth.len(), |i| credential_start + i);
-        let credential = &auth[credential_start..credential_end];
-        // Format: AKID/date/region/service/aws4_request
-        let parts: Vec<&str> = credential.split('/').collect();
-        if parts.len() >= 4 {
-            Some(parts[3])
-        } else {
-            None
-        }
-    }
+    use super::{GatewayBody, ServiceRouter, extract_sigv4_service};
 
     /// Routes requests to the SNS service.
     ///
     /// Matches `POST /` requests with `Content-Type: application/x-www-form-urlencoded`
-    /// where the SigV4 signing service is `sns`. SNS uses the `awsQuery` protocol
+    /// where the `SigV4` signing service is `sns`. SNS uses the `awsQuery` protocol
     /// where the operation is determined by the `Action=` parameter in the form body.
     pub struct SnsServiceRouter<H: SnsHandler> {
         inner: SnsHttpService<H>,
@@ -411,8 +424,8 @@ mod sns_router {
             "sns"
         }
 
-        /// SNS matches form-urlencoded POST requests signed with `sns` SigV4
-        /// service name. All SNS operations require SigV4 authentication.
+        /// SNS matches form-urlencoded POST requests signed with `sns` `SigV4`
+        /// service name. All SNS operations require `SigV4` authentication.
         fn matches(&self, req: &http::Request<Incoming>) -> bool {
             if *req.method() != http::Method::POST {
                 return false;
@@ -463,57 +476,18 @@ mod lambda_router {
     /// Lambda API uses multiple date-versioned path prefixes.
     /// The SDK may use different dates than the spec documents.
     fn is_lambda_path(path: &str) -> bool {
-        // Function CRUD and invoke paths.
-        if path.contains("/functions") {
-            // Match any date prefix for /YYYY-MM-DD/functions
-            if let Some(rest) = path.strip_prefix('/') {
-                let parts: Vec<&str> = rest.splitn(2, '/').collect();
-                if parts.len() == 2 && parts[0].len() == 10 && parts[1].starts_with("functions") {
-                    return true;
-                }
-            }
-        }
-        // Tags paths (e.g., /2017-03-31/tags/{arn}).
-        if path.contains("/tags/") {
-            if let Some(rest) = path.strip_prefix('/') {
-                let parts: Vec<&str> = rest.splitn(2, '/').collect();
-                if parts.len() == 2 && parts[0].len() == 10 && parts[1].starts_with("tags/") {
-                    return true;
-                }
-            }
-        }
-        // Account settings paths.
-        if path.contains("/account-settings") {
-            if let Some(rest) = path.strip_prefix('/') {
-                let parts: Vec<&str> = rest.splitn(2, '/').collect();
-                if parts.len() == 2 && parts[0].len() == 10 && parts[1] == "account-settings" {
-                    return true;
-                }
-            }
-        }
-        // Layer paths (e.g., /2018-10-31/layers/{name}/versions).
-        if path.contains("/layers") {
-            if let Some(rest) = path.strip_prefix('/') {
-                let parts: Vec<&str> = rest.splitn(2, '/').collect();
-                if parts.len() == 2 && parts[0].len() == 10 && parts[1].starts_with("layers") {
-                    return true;
-                }
-            }
-        }
-        // Event source mapping paths (e.g., /2015-03-31/event-source-mappings/).
-        if path.contains("/event-source-mappings") {
-            if let Some(rest) = path.strip_prefix('/') {
-                let parts: Vec<&str> = rest.splitn(2, '/').collect();
-                if parts.len() == 2
-                    && parts[0].len() == 10
-                    && parts[1].starts_with("event-source-mappings")
-                {
-                    return true;
-                }
-            }
-        }
-        // Function URL invocation paths.
         path.starts_with("/lambda-url/")
+            || path
+                .strip_prefix('/')
+                .and_then(|rest| rest.split_once('/'))
+                .is_some_and(|(date, resource)| {
+                    date.len() == 10
+                        && (resource.starts_with("functions")
+                            || resource.starts_with("tags/")
+                            || resource == "account-settings"
+                            || resource.starts_with("layers")
+                            || resource.starts_with("event-source-mappings"))
+                })
     }
 
     /// Routes requests to the Lambda service.
@@ -553,6 +527,36 @@ mod lambda_router {
             })
         }
     }
+    #[cfg(test)]
+    mod tests {
+        use super::is_lambda_path;
+
+        #[test]
+        fn test_should_preserve_lambda_prefix_classification_without_indexing() {
+            for path in [
+                "/2015-03-31/functions/Fn/invocations",
+                "/2017-03-31/tags/arn",
+                "/2016-08-19/account-settings",
+                "/2018-10-31/layers/L/versions",
+                "/2015-03-31/event-source-mappings/",
+                "/lambda-url/Fn/",
+            ] {
+                assert!(is_lambda_path(path), "{path}");
+            }
+            for path in [
+                "",
+                "/",
+                "/functions",
+                "/2015-03-3/functions",
+                "/2015-03-311/functions",
+                "/2015-03-31/tags",
+                "/2015-03-31/account-settings/other",
+                "/bucket/key",
+            ] {
+                assert!(!is_lambda_path(path), "{path}");
+            }
+        }
+    }
 }
 
 #[cfg(feature = "lambda")]
@@ -572,7 +576,7 @@ mod events_router {
 
     use super::{GatewayBody, ServiceRouter};
 
-    /// Routes requests to the EventBridge service.
+    /// Routes requests to the `EventBridge` service.
     ///
     /// Matches requests whose `X-Amz-Target` header starts with `AWSEvents.`.
     pub struct EventsServiceRouter<H: EventsHandler> {
@@ -629,7 +633,7 @@ mod logs_router {
 
     use super::{GatewayBody, ServiceRouter};
 
-    /// Routes requests to the CloudWatch Logs service.
+    /// Routes requests to the `CloudWatch` Logs service.
     ///
     /// Matches requests whose `X-Amz-Target` header starts with `Logs_20140328.`.
     pub struct LogsServiceRouter<H: LogsHandler> {
@@ -857,30 +861,11 @@ mod ses_router {
     use hyper::{body::Incoming, service::Service};
     use rustack_ses_http::{dispatch::SesHandler, service::SesHttpService, v2::SesV2HttpService};
 
-    use super::{GatewayBody, ServiceRouter};
-
-    /// Extract the SigV4 service name from the Authorization header.
-    ///
-    /// Parses `Credential=AKID/date/region/SERVICE/aws4_request` and returns SERVICE.
-    fn extract_sigv4_service(headers: &http::HeaderMap) -> Option<&str> {
-        let auth = headers.get("authorization")?.to_str().ok()?;
-        let credential_start = auth.find("Credential=")? + "Credential=".len();
-        let credential_end = auth[credential_start..]
-            .find(',')
-            .map_or(auth.len(), |i| credential_start + i);
-        let credential = &auth[credential_start..credential_end];
-        // Format: AKID/date/region/service/aws4_request
-        let parts: Vec<&str> = credential.split('/').collect();
-        if parts.len() >= 4 {
-            Some(parts[3])
-        } else {
-            None
-        }
-    }
+    use super::{GatewayBody, ServiceRouter, extract_sigv4_service};
 
     /// Routes requests to the SES service.
     ///
-    /// Matches SES v1 (`awsQuery` via SigV4 service=`email`) and SES v2
+    /// Matches SES v1 (`awsQuery` via `SigV4` service=`email`) and SES v2
     /// (`restJson1` via `/v2/email/` path prefix). Also handles the
     /// `/_aws/ses` retrospection endpoint.
     pub struct SesServiceRouter<H: SesHandler> {
@@ -906,7 +891,7 @@ mod ses_router {
         /// SES matches in three ways:
         /// 1. SES v2: path starts with `/v2/email/`
         /// 2. SES retrospection: path starts with `/_aws/ses`
-        /// 3. SES v1: form-urlencoded POST with SigV4 service=`email`
+        /// 3. SES v1: form-urlencoded POST with `SigV4` service=`email`
         fn matches(&self, req: &http::Request<Incoming>) -> bool {
             let path = req.uri().path();
 
@@ -1218,29 +1203,12 @@ mod cloudwatch_router {
     use hyper::{body::Incoming, service::Service};
     use rustack_cloudwatch_http::{dispatch::CloudWatchHandler, service::CloudWatchHttpService};
 
-    use super::{GatewayBody, ServiceRouter};
-
-    /// Extract the SigV4 service name from the Authorization header.
-    fn extract_sigv4_service(headers: &http::HeaderMap) -> Option<&str> {
-        let auth = headers.get("authorization")?.to_str().ok()?;
-        let credential_start = auth.find("Credential=")? + "Credential=".len();
-        let credential_end = auth[credential_start..]
-            .find(',')
-            .map_or(auth.len(), |i| credential_start + i);
-        let credential = &auth[credential_start..credential_end];
-        // Format: AKID/date/region/service/aws4_request
-        let parts: Vec<&str> = credential.split('/').collect();
-        if parts.len() >= 4 {
-            Some(parts[3])
-        } else {
-            None
-        }
-    }
+    use super::{GatewayBody, ServiceRouter, extract_sigv4_service};
 
-    /// Routes requests to the CloudWatch Metrics service.
+    /// Routes requests to the `CloudWatch` Metrics service.
     ///
     /// Matches awsQuery requests (`POST /` with form-urlencoded body signed
-    /// with `monitoring` SigV4 service) and rpcv2Cbor requests (POST to
+    /// with `monitoring` `SigV4` service) and rpcv2Cbor requests (POST to
     /// `/service/GraniteServiceVersion20100801/operation/{Op}`).
     pub struct CloudWatchServiceRouter<H: CloudWatchHandler> {
         inner: CloudWatchHttpService<H>,
@@ -1258,11 +1226,11 @@ mod cloudwatch_router {
             "cloudwatch"
         }
 
-        /// CloudWatch Metrics matches in three ways:
-        /// 1. awsQuery: form-urlencoded POST signed with `monitoring` SigV4 service.
+        /// `CloudWatch` Metrics matches in three ways:
+        /// 1. awsQuery: form-urlencoded POST signed with `monitoring` `SigV4` service.
         /// 2. rpcv2Cbor path: POST to `/service/GraniteServiceVersion20100801/...`.
         /// 3. rpcv2Cbor header: POST with `smithy-protocol: rpc-v2-cbor` signed with `monitoring`
-        ///    SigV4 service (AWS SDK v1.108+).
+        ///    `SigV4` service (AWS SDK v1.108+).
         fn matches(&self, req: &http::Request<Incoming>) -> bool {
             if *req.method() != http::Method::POST {
                 return false;
@@ -1338,29 +1306,12 @@ mod iam_router {
     use hyper::{body::Incoming, service::Service};
     use rustack_iam_http::{dispatch::IamHandler, service::IamHttpService};
 
-    use super::{GatewayBody, ServiceRouter};
-
-    /// Extract the SigV4 service name from the Authorization header.
-    fn extract_sigv4_service(headers: &http::HeaderMap) -> Option<&str> {
-        let auth = headers.get("authorization")?.to_str().ok()?;
-        let credential_start = auth.find("Credential=")? + "Credential=".len();
-        let credential_end = auth[credential_start..]
-            .find(',')
-            .map_or(auth.len(), |i| credential_start + i);
-        let credential = &auth[credential_start..credential_end];
-        // Format: AKID/date/region/service/aws4_request
-        let parts: Vec<&str> = credential.split('/').collect();
-        if parts.len() >= 4 {
-            Some(parts[3])
-        } else {
-            None
-        }
-    }
+    use super::{GatewayBody, ServiceRouter, extract_sigv4_service};
 
     /// Routes requests to the IAM service.
     ///
     /// Matches `POST /` requests with `Content-Type: application/x-www-form-urlencoded`
-    /// where the SigV4 signing service is `iam`.
+    /// where the `SigV4` signing service is `iam`.
     pub struct IamServiceRouter<H: IamHandler> {
         inner: IamHttpService<H>,
     }
@@ -1378,7 +1329,7 @@ mod iam_router {
         }
 
         /// IAM matches form-urlencoded POST requests signed
-        /// with the `iam` SigV4 service name.
+        /// with the `iam` `SigV4` service name.
         fn matches(&self, req: &http::Request<Incoming>) -> bool {
             if *req.method() != http::Method::POST {
                 return false;
@@ -1424,29 +1375,12 @@ mod sts_router {
     use hyper::{body::Incoming, service::Service};
     use rustack_sts_http::{dispatch::StsHandler, service::StsHttpService};
 
-    use super::{GatewayBody, ServiceRouter};
-
-    /// Extract the SigV4 service name from the Authorization header.
-    fn extract_sigv4_service(headers: &http::HeaderMap) -> Option<&str> {
-        let auth = headers.get("authorization")?.to_str().ok()?;
-        let credential_start = auth.find("Credential=")? + "Credential=".len();
-        let credential_end = auth[credential_start..]
-            .find(',')
-            .map_or(auth.len(), |i| credential_start + i);
-        let credential = &auth[credential_start..credential_end];
-        // Format: AKID/date/region/service/aws4_request
-        let parts: Vec<&str> = credential.split('/').collect();
-        if parts.len() >= 4 {
-            Some(parts[3])
-        } else {
-            None
-        }
-    }
+    use super::{GatewayBody, ServiceRouter, extract_sigv4_service};
 
     /// Routes requests to the STS service.
     ///
     /// Matches `POST /` requests with `Content-Type: application/x-www-form-urlencoded`
-    /// where the SigV4 signing service is `sts`.
+    /// where the `SigV4` signing service is `sts`.
     pub struct StsServiceRouter<H: StsHandler> {
         inner: StsHttpService<H>,
     }
@@ -1463,10 +1397,10 @@ mod sts_router {
             "sts"
         }
 
-        /// STS matches form-urlencoded POST requests signed with `sts` SigV4
+        /// STS matches form-urlencoded POST requests signed with `sts` `SigV4`
         /// service name, or unsigned form-urlencoded requests (for federation
         /// operations like `AssumeRoleWithWebIdentity` and `AssumeRoleWithSAML`
-        /// which do not require SigV4 signing).
+        /// which do not require `SigV4` signing).
         fn matches(&self, req: &http::Request<Incoming>) -> bool {
             if *req.method() != http::Method::POST {
                 return false;
@@ -1521,26 +1455,11 @@ mod cloudfront_router {
     use hyper::{body::Incoming, service::Service};
     use rustack_cloudfront_http::{dispatch::CloudFrontHandler, service::CloudFrontHttpService};
 
-    use super::{GatewayBody, ServiceRouter};
+    use super::{GatewayBody, ServiceRouter, extract_sigv4_service};
 
-    /// Extract SigV4 service name.
-    fn extract_sigv4_service(headers: &http::HeaderMap) -> Option<&str> {
-        let auth = headers.get("authorization")?.to_str().ok()?;
-        let credential_start = auth.find("Credential=")? + "Credential=".len();
-        let credential_end = auth[credential_start..]
-            .find(',')
-            .map_or(auth.len(), |i| credential_start + i);
-        let parts: Vec<&str> = auth[credential_start..credential_end].split('/').collect();
-        if parts.len() >= 4 {
-            Some(parts[3])
-        } else {
-            None
-        }
-    }
-
-    /// Routes requests to the CloudFront management service.
+    /// Routes requests to the `CloudFront` management service.
     ///
-    /// Matches `/2020-05-31/` path prefix OR SigV4 signing service `cloudfront`.
+    /// Matches `/2020-05-31/` path prefix OR `SigV4` signing service `cloudfront`.
     pub struct CloudFrontServiceRouter<H: CloudFrontHandler> {
         inner: CloudFrontHttpService<H>,
     }
@@ -1598,7 +1517,7 @@ mod cloudfront_dataplane_router {
 
     use super::{GatewayBody, ServiceRouter};
 
-    /// Routes requests to the CloudFront pass-through data plane.
+    /// Routes requests to the `CloudFront` pass-through data plane.
     pub struct CloudFrontDataPlaneRouter {
         plane: DataPlane,
     }
@@ -1666,3 +1585,94 @@ mod cloudfront_dataplane_router {
 
 #[cfg(feature = "cloudfront-dataplane")]
 pub use cloudfront_dataplane_router::CloudFrontDataPlaneRouter;
+
+#[cfg(feature = "stepfunctions")]
+mod stepfunctions_router {
+    use std::{convert::Infallible, future::Future, pin::Pin};
+
+    use http_body_util::BodyExt;
+    use hyper::body::Incoming;
+    use rustack_stepfunctions_http::{StepFunctionsHttpService, claims_request};
+
+    use super::{GatewayBody, ServiceRouter};
+
+    /// Claims the exact target family, including unsupported operations.
+    pub struct StepFunctionsServiceRouter {
+        inner: StepFunctionsHttpService,
+    }
+    impl StepFunctionsServiceRouter {
+        pub fn new(inner: StepFunctionsHttpService) -> Self {
+            Self { inner }
+        }
+    }
+    impl ServiceRouter for StepFunctionsServiceRouter {
+        fn name(&self) -> &'static str {
+            "stepfunctions"
+        }
+        fn matches(&self, request: &http::Request<Incoming>) -> bool {
+            claims_request(request.headers())
+        }
+        fn owns_request_deadline(&self) -> bool {
+            true
+        }
+        fn call(
+            &self,
+            request: http::Request<Incoming>,
+        ) -> Pin<Box<dyn Future<Output = Result<http::Response<GatewayBody>, Infallible>> + Send>>
+        {
+            let service = self.inner.clone();
+            Box::pin(async move {
+                Ok(service
+                    .handle(request)
+                    .await
+                    .map(|body| body.map_err(|never: Infallible| match never {}).boxed()))
+            })
+        }
+    }
+}
+#[cfg(feature = "stepfunctions")]
+pub use stepfunctions_router::StepFunctionsServiceRouter;
+
+#[cfg(all(
+    test,
+    any(
+        feature = "sns",
+        feature = "ses",
+        feature = "cloudwatch",
+        feature = "iam",
+        feature = "sts",
+        feature = "cloudfront"
+    )
+))]
+mod routing_boundary_tests {
+    use http::{HeaderMap, HeaderValue};
+
+    use super::extract_sigv4_service;
+
+    #[test]
+    fn test_should_classify_credential_service_without_slicing_or_allocating() {
+        for (header, expected) in [
+            (
+                "AWS4-HMAC-SHA256 Credential=key/date/region/ses/aws4_request, SignedHeaders=host",
+                Some("ses"),
+            ),
+            (
+                "Credential=key/date/region/states/aws4_request",
+                Some("states"),
+            ),
+            ("Credential=key/date/region/sts", Some("sts")),
+            ("Credential=key/date/region", None),
+            (
+                "Credential=, Credential=key/date/region/iam/aws4_request",
+                None,
+            ),
+            ("Credential", None),
+            ("", None),
+        ] {
+            let mut headers = HeaderMap::new();
+            headers.insert("authorization", HeaderValue::from_static(header));
+            assert_eq!(extract_sigv4_service(&headers), expected);
+        }
+        assert_eq!(extract_sigv4_service(&HeaderMap::new()), None);
+    }
+}
diff --git a/apps/rustack/src/snapshot.rs b/apps/rustack/src/snapshot.rs
index 02494284..acb3df7e 100644
--- a/apps/rustack/src/snapshot.rs
+++ b/apps/rustack/src/snapshot.rs
@@ -1,8 +1,10 @@
 //! Runtime snapshot loading and saving for the Rustack gateway.
+//! `SnapshotService` uses async-trait because the registry stores object-safe dyn services.
 
 use std::{
     collections::BTreeMap,
     io::ErrorKind,
+    mem,
     path::{Path, PathBuf},
     sync::Arc,
     time::{Duration, Instant, SystemTime, UNIX_EPOCH},
@@ -10,9 +12,9 @@ use std::{
 
 use anyhow::{Context, Result, bail};
 use archive::{
-    ArchiveKind, ArchiveSection, ArchiveStats, SECTION_MANIFEST_CBOR, SECTION_STATE_CBOR,
-    from_cbor, get_required_section, pack_data_archive, read_archive, to_cbor, unpack_data_archive,
-    validated_relative_path, write_archive,
+    ArchiveKind, ArchiveSection, ArchiveStats, BudgetLimit, SECTION_MANIFEST_CBOR,
+    SECTION_STATE_CBOR, from_cbor, get_required_section, pack_data_archive, read_archive,
+    read_archive_limited, to_cbor, unpack_data_archive, validated_relative_path, write_archive,
 };
 use async_trait::async_trait;
 #[cfg(feature = "apigatewayv2")]
@@ -35,11 +37,36 @@ use rustack_s3_core::{RustackS3, snapshot::S3Snapshot};
 use rustack_sqs_core::provider::{RustackSqs, SqsSnapshot};
 #[cfg(feature = "ssm")]
 use rustack_ssm_core::{provider::RustackSsm, storage::ParameterStoreSnapshot};
-use serde::{Deserialize, Serialize, de::DeserializeOwned};
-use tokio::{fs, io::AsyncWriteExt as _, sync::Semaphore, task::JoinSet};
+#[cfg(any(
+    feature = "stepfunctions",
+    feature = "s3",
+    feature = "dynamodb",
+    feature = "dynamodbstreams",
+    feature = "sqs",
+    feature = "ssm",
+    feature = "iam",
+    feature = "lambda",
+    feature = "apigatewayv2",
+    feature = "cloudfront",
+    feature = "cloudfront-dataplane"
+))]
+use serde::de::DeserializeOwned;
+use serde::{Deserialize, Serialize};
+use tokio::{
+    fs, io::AsyncWriteExt as _, sync::Semaphore, task::JoinSet, time::Instant as Deadline,
+};
 use tracing::{info, warn};
 
 mod archive;
+mod lease;
+mod session;
+mod task;
+pub(crate) use session::SnapshotSession;
+mod worker;
+pub(crate) use task::SnapshotTask;
+use worker::WorkerFailure;
+#[cfg(feature = "stepfunctions")]
+pub(crate) mod workflows;
 
 const SNAPSHOT_SCHEMA_VERSION: u32 = 2;
 const SNAPSHOT_ROOT_ENV: &str = "RUSTACK_SNAPSHOT_DIR";
@@ -52,14 +79,20 @@ const SERVICES_DIR: &str = "services";
 const STAGING_DIR: &str = ".staging";
 const LOAD_STAGING_PREFIX: &str = ".load";
 const SNAPSHOT_SERVICE_PARALLELISM: usize = 4;
+type ArchiveLimits = BTreeMap<&'static str, usize>;
 
 /// Registry of services that support runtime snapshots.
-#[derive(Default)]
+#[derive(Default, Clone)]
 pub(crate) struct RuntimeProviders {
     services: Vec<Arc<dyn SnapshotService>>,
 }
 
 impl RuntimeProviders {
+    #[cfg(feature = "stepfunctions")]
+    pub(crate) fn register_workflows(&mut self, archive: workflows::WorkflowArchive) {
+        self.register(archive);
+    }
+
     #[cfg(feature = "s3")]
     pub(crate) fn register_s3(&mut self, provider: Arc<RustackS3>) {
         self.register(S3SnapshotService { provider });
@@ -110,6 +143,19 @@ impl RuntimeProviders {
         self.register(CloudFrontCacheSnapshotService { plane });
     }
 
+    #[cfg(any(
+        feature = "stepfunctions",
+        feature = "s3",
+        feature = "dynamodb",
+        feature = "dynamodbstreams",
+        feature = "sqs",
+        feature = "ssm",
+        feature = "iam",
+        feature = "lambda",
+        feature = "apigatewayv2",
+        feature = "cloudfront",
+        feature = "cloudfront-dataplane"
+    ))]
     fn register<T>(&mut self, service: T)
     where
         T: SnapshotService + 'static,
@@ -130,6 +176,16 @@ impl RuntimeProviders {
             .collect()
     }
 
+    fn limits(&self) -> ArchiveLimits {
+        self.services
+            .iter()
+            .filter_map(|service| {
+                service
+                    .payload_limit()
+                    .map(|limit| (service.service_name(), limit))
+            })
+            .collect()
+    }
     fn services(&self) -> &[Arc<dyn SnapshotService>] {
         &self.services
     }
@@ -141,6 +197,7 @@ pub(crate) fn snapshot_coverage(service: &str) -> &'static str {
         "s3" | "dynamodb" => "resources-and-data",
         "dynamodbstreams" => "resources-and-records",
         "lambda" => "resources-and-code",
+        "stepfunctions" => "resources-and-history",
         "cloudfront-cache" | "cloudfront-dataplane" => "cache-data",
         "sqs" | "ssm" | "iam" | "apigatewayv2" | "cloudfront" => "resources-only",
         _ => "unsupported",
@@ -155,9 +212,27 @@ trait SnapshotService: Send + Sync {
         SnapshotKind::Resource
     }
 
+    fn payload_limit(&self) -> Option<usize> {
+        None
+    }
+    fn data_file(&self) -> Option<&'static str> {
+        None
+    }
+
     async fn save_meta(&self, data_staging_dir: &Path) -> Result<Vec<u8>>;
 
-    async fn load_meta(&self, state_cbor: &[u8], data_staging_dir: &Path) -> Result<()>;
+    async fn load_meta(&self, state_cbor: Vec<u8>, data_staging_dir: &Path) -> Result<()>;
+
+    async fn load_meta_before(
+        &self,
+        state_cbor: Vec<u8>,
+        data_staging_dir: &Path,
+        deadline: Deadline,
+    ) -> Result<()> {
+        check_load_deadline(deadline)?;
+        self.load_meta(state_cbor, data_staging_dir).await?;
+        check_load_deadline(deadline)
+    }
 }
 
 #[cfg(feature = "s3")]
@@ -181,8 +256,8 @@ impl SnapshotService for S3SnapshotService {
         encode_state(&snapshot)
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], data_staging_dir: &Path) -> Result<()> {
-        let snapshot: S3Snapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, data_staging_dir: &Path) -> Result<()> {
+        let snapshot: S3Snapshot = decode_state(&state_cbor)?;
         self.provider
             .import_snapshot(snapshot, data_staging_dir)
             .await?;
@@ -210,8 +285,8 @@ impl SnapshotService for DynamoDBSnapshotService {
         encode_state(&self.provider.export_snapshot())
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: DynamoDBSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: DynamoDBSnapshot = decode_state(&state_cbor)?;
         self.provider.import_snapshot(snapshot)?;
         Ok(())
     }
@@ -233,8 +308,8 @@ impl SnapshotService for DynamoDBStreamsSnapshotService {
         encode_state(&self.store.export_snapshot())
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: StreamStoreSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: StreamStoreSnapshot = decode_state(&state_cbor)?;
         self.store.import_snapshot(snapshot);
         Ok(())
     }
@@ -256,8 +331,8 @@ impl SnapshotService for SqsSnapshotService {
         encode_state(&self.provider.export_snapshot().await?)
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: SqsSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: SqsSnapshot = decode_state(&state_cbor)?;
         self.provider.import_snapshot(snapshot).await?;
         Ok(())
     }
@@ -279,8 +354,8 @@ impl SnapshotService for SsmSnapshotService {
         encode_state(&self.provider.export_snapshot())
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: ParameterStoreSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: ParameterStoreSnapshot = decode_state(&state_cbor)?;
         self.provider.import_snapshot(snapshot);
         Ok(())
     }
@@ -302,8 +377,8 @@ impl SnapshotService for IamSnapshotService {
         encode_state(&self.provider.export_snapshot())
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: IamStoreSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: IamStoreSnapshot = decode_state(&state_cbor)?;
         self.provider.import_snapshot(snapshot);
         Ok(())
     }
@@ -321,12 +396,43 @@ impl SnapshotService for LambdaSnapshotService {
         "lambda"
     }
 
+    fn payload_limit(&self) -> Option<usize> {
+        self.provider.archive_payload_limit()
+    }
+
+    async fn load_meta_before(
+        &self,
+        state_cbor: Vec<u8>,
+        _data_staging_dir: &Path,
+        deadline: Deadline,
+    ) -> Result<()> {
+        check_load_deadline(deadline)?;
+        let snapshot: LambdaSnapshot = match self.provider.docker_archive_profile() {
+            Some(profile) => archive::from_cbor_lambda(&state_cbor, profile)?,
+            None => decode_state(&state_cbor)?,
+        };
+        self.provider
+            .import_snapshot_before(snapshot, deadline)
+            .await?;
+        check_load_deadline(deadline)
+    }
+
     async fn save_meta(&self, _data_staging_dir: &Path) -> Result<Vec<u8>> {
-        encode_state(&self.provider.export_snapshot())
+        let snapshot = self
+            .provider
+            .export_snapshot_before(Deadline::now() + Duration::from_secs(300))
+            .await?;
+        match self.provider.docker_archive_profile() {
+            Some(profile) => archive::to_cbor_lambda(&snapshot, profile),
+            None => encode_state(&snapshot),
+        }
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: LambdaSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: LambdaSnapshot = match self.provider.docker_archive_profile() {
+            Some(profile) => archive::from_cbor_lambda(&state_cbor, profile)?,
+            None => decode_state(&state_cbor)?,
+        };
         self.provider.import_snapshot(snapshot).await?;
         Ok(())
     }
@@ -348,8 +454,8 @@ impl SnapshotService for ApiGatewayV2SnapshotService {
         encode_state(&self.provider.export_snapshot())
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: ApiStoreSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: ApiStoreSnapshot = decode_state(&state_cbor)?;
         self.provider.import_snapshot(snapshot);
         Ok(())
     }
@@ -371,8 +477,8 @@ impl SnapshotService for CloudFrontSnapshotService {
         encode_state(&self.provider.export_snapshot())
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], _data_staging_dir: &Path) -> Result<()> {
-        let snapshot: CloudFrontStoreSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+        let snapshot: CloudFrontStoreSnapshot = decode_state(&state_cbor)?;
         self.provider.import_snapshot(snapshot);
         Ok(())
     }
@@ -403,8 +509,8 @@ impl SnapshotService for CloudFrontCacheSnapshotService {
         encode_state(&snapshot)
     }
 
-    async fn load_meta(&self, state_cbor: &[u8], data_staging_dir: &Path) -> Result<()> {
-        let snapshot: CloudFrontCacheSnapshot = decode_state(state_cbor)?;
+    async fn load_meta(&self, state_cbor: Vec<u8>, data_staging_dir: &Path) -> Result<()> {
+        let snapshot: CloudFrontCacheSnapshot = decode_state(&state_cbor)?;
         self.plane
             .import_cache_snapshot(snapshot, data_staging_dir)
             .await
@@ -427,38 +533,15 @@ pub(crate) struct SnapshotLease {
     _file: std::fs::File,
 }
 
-impl SnapshotConfig {
-    /// Acquire an OS-released exclusive lease before loading or serving a named snapshot.
-    ///
-    /// The blocking std file API is required for advisory locking and is isolated
-    /// inside a blocking worker; tokio offers no equivalent lock surface.
-    #[allow(clippy::disallowed_types, clippy::disallowed_methods)]
-    pub(crate) async fn acquire_lease(&self) -> Result<SnapshotLease> {
-        let root = self.root.clone();
-        let name = self.name.as_str().to_owned();
-        tokio::task::spawn_blocking(move || {
-            std::fs::create_dir_all(&root).context("create snapshot root for lease")?;
-            let lock_path = root.join(format!(".{name}.lock"));
-            if std::fs::symlink_metadata(&lock_path)
-                .is_ok_and(|metadata| metadata.file_type().is_symlink())
-            {
-                bail!("snapshot lock path must not be a symbolic link");
-            }
-            let file = std::fs::OpenOptions::new()
-                .create(true)
-                .truncate(false)
-                .read(true)
-                .write(true)
-                .open(&lock_path)
-                .context("open snapshot lease")?;
-            file.try_lock()
-                .context("snapshot is already owned by another runtime")?;
-            Ok(SnapshotLease { _file: file })
-        })
-        .await
-        .context("snapshot lease task failed")?
+impl SnapshotLease {
+    /// Fail closed until process exit when async storage retirement is unproven.
+    /// There is at most one named lease in a runtime; OS exit releases the lock.
+    pub(crate) fn quarantine(self: Arc<Self>) {
+        mem::forget(self);
     }
+}
 
+impl SnapshotConfig {
     /// Build snapshot configuration from a CLI-provided name.
     ///
     /// # Errors
@@ -479,11 +562,22 @@ impl SnapshotConfig {
     /// # Errors
     ///
     /// Returns an error if the snapshot exists but cannot be parsed or applied.
+    #[cfg(test)]
     pub(crate) async fn load(&self, providers: &RuntimeProviders) -> Result<()> {
+        self.load_before(providers, Deadline::now() + Duration::from_secs(3600))
+            .await
+    }
+
+    pub(crate) async fn load_before(
+        &self,
+        providers: &RuntimeProviders,
+        deadline: Deadline,
+    ) -> Result<()> {
+        check_load_deadline(deadline)?;
         let started = Instant::now();
         let dir = self.snapshot_dir();
         cleanup_stale_staging(&self.root, self.name.as_str()).await?;
-        recover_snapshot(&self.root, &dir, self.name.as_str()).await?;
+        recover_snapshot(&self.root, &dir, self.name.as_str(), &providers.limits()).await?;
         if !path_exists(&dir).await? {
             info!(snapshot = %self.name.as_str(), path = %dir.display(), "snapshot not found, starting empty");
             return Ok(());
@@ -536,20 +630,31 @@ impl SnapshotConfig {
                         .acquire_owned()
                         .await
                         .context("snapshot load semaphore closed")?;
-                    load_service_snapshot(service, snapshot_dir, staging_root, entry).await
+                    load_service_snapshot(service, snapshot_dir, staging_root, entry, deadline)
+                        .await
                 });
             }
         }
         let load_result = async {
+            let mut failure = None;
             while let Some(result) = join_set.join_next().await {
-                result.context("snapshot load task failed")??;
+                if let Err(error) = result
+                    .map_err(WorkerFailure::new)
+                    .context("snapshot load task failed")
+                    .and_then(|value| value)
+                {
+                    if failure.is_none() {
+                        failure = Some(error);
+                    }
+                }
             }
-            Result::<()>::Ok(())
+            failure.map_or(Ok(()), Err)
         }
         .await;
         let cleanup_result = remove_dir_if_exists(&load_staging).await;
         load_result?;
         cleanup_result?;
+        retire_previous_checked(&self.root, self.name.as_str(), Some(deadline)).await?;
 
         record_snapshot_timing("load_ms", started.elapsed()).await;
         info!(snapshot = %self.name.as_str(), path = %dir.display(), "loaded runtime snapshot");
@@ -560,7 +665,7 @@ impl SnapshotConfig {
     ///
     /// # Errors
     ///
-    /// Returns an error if state export, JSON serialization, or atomic directory
+    /// Returns an error if state export, CBOR serialization, or atomic directory
     /// replacement fails.
     pub(crate) async fn save(&self, providers: &RuntimeProviders, version: &str) -> Result<()> {
         let started = Instant::now();
@@ -597,14 +702,35 @@ impl SnapshotConfig {
                 save_service_snapshot(service, snapshot_dir).await
             });
         }
+        let mut failure = None;
         while let Some(result) = join_set.join_next().await {
-            let service = result.context("snapshot save task failed")??;
-            manifest.add_service(service.name, service.manifest);
+            match result
+                .map_err(WorkerFailure::new)
+                .context("snapshot save task failed")
+                .and_then(|value| value)
+            {
+                Ok(service) => manifest.add_service(service.name, service.manifest),
+                Err(error) => {
+                    if failure.is_none() {
+                        failure = Some(error);
+                    }
+                }
+            }
+        }
+        if let Some(error) = failure {
+            return Err(error);
         }
         remove_dir_if_exists(&temp.join(STAGING_DIR)).await?;
 
         write_manifest(&temp.join(MANIFEST_FILE), &manifest).await?;
-        replace_directory(&temp, &target, &self.root, self.name.as_str()).await?;
+        replace_directory(
+            &temp,
+            &target,
+            &self.root,
+            self.name.as_str(),
+            &providers.limits(),
+        )
+        .await?;
 
         record_snapshot_timing("save_ms", started.elapsed()).await;
         info!(snapshot = %self.name.as_str(), path = %target.display(), "saved runtime snapshot");
@@ -765,7 +891,9 @@ async fn load_service_snapshot(
     snapshot_dir: PathBuf,
     staging_root: PathBuf,
     manifest: SnapshotServiceManifest,
+    deadline: Deadline,
 ) -> Result<()> {
+    check_load_deadline(deadline)?;
     let service_name = service.service_name();
     let started = Instant::now();
     let staging_dir = staging_root.join(service_name);
@@ -779,18 +907,39 @@ async fn load_service_snapshot(
 
     if let Some(data_file) = manifest.data_file.as_ref() {
         let data_path = snapshot_child(&snapshot_dir, data_file)?;
-        unpack_data_archive(&data_path, &staging_dir)
-            .await
-            .with_context(|| format!("failed to load snapshot data archive for {service_name}"))?;
+        unpack_data_archive(
+            &data_path,
+            &staging_dir,
+            service.payload_limit(),
+            service.data_file(),
+        )
+        .await
+        .with_context(|| format!("failed to load snapshot data archive for {service_name}"))?;
     }
 
     let meta_path = snapshot_child(&snapshot_dir, &manifest.meta_file)?;
-    let sections = read_archive(&meta_path, ArchiveKind::ServiceMeta)
-        .await
-        .with_context(|| format!("failed to read snapshot metadata archive for {service_name}"))?;
-    let state_cbor = get_required_section(&sections, SECTION_STATE_CBOR)?;
+    let sections = read_archive_limited(
+        &meta_path,
+        ArchiveKind::ServiceMeta,
+        service.payload_limit(),
+    )
+    .await
+    .with_context(|| format!("failed to read snapshot metadata archive for {service_name}"))?;
+    if service.payload_limit().is_some()
+        && (sections.len() != 1
+            || sections
+                .first()
+                .is_none_or(|section| section.kind != SECTION_STATE_CBOR || section.row_count != 1))
+    {
+        bail!("invalid service metadata section layout");
+    }
+    let state_cbor = sections
+        .into_iter()
+        .find(|section| section.kind == SECTION_STATE_CBOR)
+        .ok_or_else(|| anyhow::anyhow!("missing snapshot state section"))?
+        .bytes;
     service
-        .load_meta(state_cbor, &staging_dir)
+        .load_meta_before(state_cbor, &staging_dir, deadline)
         .await
         .with_context(|| format!("failed to load snapshot metadata for {service_name}"))?;
 
@@ -805,6 +954,18 @@ async fn load_service_snapshot(
     Ok(())
 }
 
+#[cfg(any(
+    feature = "s3",
+    feature = "dynamodb",
+    feature = "dynamodbstreams",
+    feature = "sqs",
+    feature = "ssm",
+    feature = "iam",
+    feature = "lambda",
+    feature = "apigatewayv2",
+    feature = "cloudfront",
+    feature = "cloudfront-dataplane"
+))]
 fn encode_state<T>(value: &T) -> Result<Vec<u8>>
 where
     T: Serialize,
@@ -812,6 +973,19 @@ where
     to_cbor(value)
 }
 
+#[cfg(any(
+    feature = "stepfunctions",
+    feature = "s3",
+    feature = "dynamodb",
+    feature = "dynamodbstreams",
+    feature = "sqs",
+    feature = "ssm",
+    feature = "iam",
+    feature = "lambda",
+    feature = "apigatewayv2",
+    feature = "cloudfront",
+    feature = "cloudfront-dataplane"
+))]
 fn decode_state<T>(bytes: &[u8]) -> Result<T>
 where
     T: DeserializeOwned,
@@ -886,12 +1060,19 @@ async fn remove_dir_if_exists(path: &Path) -> Result<()> {
     }
 }
 
-async fn replace_directory(temp: &Path, target: &Path, root: &Path, name: &str) -> Result<()> {
-    recover_snapshot(root, target, name).await?;
-    validate_generation(temp, name)
+async fn replace_directory(
+    temp: &Path,
+    target: &Path,
+    root: &Path,
+    name: &str,
+    limits: &ArchiveLimits,
+) -> Result<()> {
+    recover_snapshot(root, target, name, limits).await?;
+    validate_generation(temp, name, limits)
         .await
         .context("validate prepared snapshot")?;
     sync_tree(temp).await?;
+    retire_previous(root, name).await?;
     let backup = root.join(format!(".{name}.previous"));
     let had_target = path_exists(target).await?;
     if had_target {
@@ -921,8 +1102,44 @@ async fn replace_directory(temp: &Path, target: &Path, root: &Path, name: &str)
     Ok(())
 }
 
+/// Call only after successful domain import or fully validated/synced prepare.
+fn check_load_deadline(deadline: Deadline) -> Result<()> {
+    if Deadline::now() >= deadline {
+        bail!("snapshot import commit deadline exceeded");
+    }
+    Ok(())
+}
+
+async fn retire_previous(root: &Path, name: &str) -> Result<()> {
+    retire_previous_checked(root, name, None).await
+}
+
+async fn retire_previous_checked(
+    root: &Path,
+    name: &str,
+    deadline: Option<Deadline>,
+) -> Result<()> {
+    if let Some(deadline) = deadline {
+        check_load_deadline(deadline)?;
+    }
+    let previous = root.join(format!(".{name}.previous"));
+    if path_exists(&previous).await? {
+        if let Some(deadline) = deadline {
+            check_load_deadline(deadline)?;
+        }
+        remove_dir_if_exists(&previous).await?;
+        sync_directory(root).await?;
+    }
+    Ok(())
+}
+
 /// Recover an interrupted publish, including the legacy randomly named backups.
-async fn recover_snapshot(root: &Path, target: &Path, name: &str) -> Result<()> {
+async fn recover_snapshot(
+    root: &Path,
+    target: &Path,
+    name: &str,
+    limits: &ArchiveLimits,
+) -> Result<()> {
     if !path_exists(root).await? {
         return Ok(());
     }
@@ -953,12 +1170,16 @@ async fn recover_snapshot(root: &Path, target: &Path, name: &str) -> Result<()>
     let Some(backup) = backup else {
         return Ok(());
     };
-    if path_exists(target).await? && validate_generation(target, name).await.is_ok() {
-        remove_dir_if_exists(&backup).await?;
-        sync_directory(root).await?;
-        return Ok(());
+    if path_exists(target).await? {
+        match validate_generation(target, name, limits).await {
+            // Only physical selection is proven here. Domain import can still
+            // reject this generation; retain its previous completed copy.
+            Ok(()) => return Ok(()),
+            Err(error) if error.is::<BudgetLimit>() => return Err(error),
+            Err(_) => {}
+        }
     }
-    validate_generation(&backup, name)
+    validate_generation(&backup, name, limits)
         .await
         .context("previous snapshot is not a valid recovery generation")?;
     if path_exists(target).await? {
@@ -997,20 +1218,27 @@ async fn cleanup_stale_staging(root: &Path, name: &str) -> Result<()> {
     Ok(())
 }
 
-async fn validate_generation(directory: &Path, name: &str) -> Result<()> {
+async fn validate_generation(directory: &Path, name: &str, limits: &ArchiveLimits) -> Result<()> {
     let manifest = read_manifest(&directory.join(MANIFEST_FILE)).await?;
     if manifest.schema_version != SNAPSHOT_SCHEMA_VERSION || manifest.snapshot_name != name {
         bail!("snapshot generation name/schema mismatch");
     }
-    for entry in manifest.services.values() {
-        let meta = read_archive(
+    for (service, entry) in &manifest.services {
+        let limit = limits.get(service.as_str()).copied();
+        let meta = read_archive_limited(
             &snapshot_child(directory, &entry.meta_file)?,
             ArchiveKind::ServiceMeta,
+            limit,
         )
         .await?;
         get_required_section(&meta, SECTION_STATE_CBOR)?;
         if let Some(data) = &entry.data_file {
-            read_archive(&snapshot_child(directory, data)?, ArchiveKind::ServiceData).await?;
+            read_archive_limited(
+                &snapshot_child(directory, data)?,
+                ArchiveKind::ServiceData,
+                limit,
+            )
+            .await?;
         }
     }
     Ok(())
@@ -1069,8 +1297,126 @@ fn now_unix_millis() -> Result<u64> {
 
 #[cfg(test)]
 mod tests {
+    use ciborium::Value;
+    #[cfg(feature = "dynamodb")]
+    use rustack_dynamodb_core::config::DynamoDBConfig;
+    #[cfg(feature = "dynamodb")]
+    use serde_json::json;
+
     use super::*;
 
+    #[cfg(feature = "dynamodb")]
+    #[tokio::test]
+    async fn test_should_preserve_long_dynamodb_names_through_actual_archive_import() -> Result<()>
+    {
+        let source = Arc::new(RustackDynamoDB::new(DynamoDBConfig::default()));
+        source.handle_create_table(serde_json::from_value(json!({
+            "TableName": "ArchiveNames",
+            "KeySchema": [{"AttributeName": "pk", "KeyType": "HASH"}],
+            "AttributeDefinitions": [{"AttributeName": "pk", "AttributeType": "S"}],
+            "BillingMode": "PAY_PER_REQUEST"
+        }))?)?;
+        // Existing PutItem accepts these ordinary attribute names within400KiB.
+        // They are data keys, unrelated to a workflow identifier's allowance.
+        let names = ["a".repeat(4097), "b".repeat(65535), "c".repeat(300_000)];
+        for (index, name) in names.iter().enumerate() {
+            source.handle_put_item(serde_json::from_value(json!({
+                "TableName": "ArchiveNames",
+                "Item": {"pk": {"S": index.to_string()}, name: {"S": "preserved"}}
+            }))?)?;
+        }
+        let directory = tempfile::tempdir()?;
+        let service = DynamoDBSnapshotService { provider: source };
+        let cbor = service.save_meta(directory.path()).await?;
+        let archive = directory.path().join(META_FILE);
+        write_archive(
+            &archive,
+            ArchiveKind::ServiceMeta,
+            vec![ArchiveSection::new(SECTION_STATE_CBOR, cbor, 1)],
+        )
+        .await?;
+        let restored = Arc::new(RustackDynamoDB::new(DynamoDBConfig::default()));
+        let service = DynamoDBSnapshotService {
+            provider: restored.clone(),
+        };
+        let sections = read_archive(&archive, ArchiveKind::ServiceMeta).await?;
+        service
+            .load_meta(
+                get_required_section(&sections, SECTION_STATE_CBOR)?.to_vec(),
+                directory.path(),
+            )
+            .await?;
+        for (index, name) in names.iter().enumerate() {
+            let result = restored.handle_get_item(serde_json::from_value(json!({
+                "TableName": "ArchiveNames", "Key": {"pk": {"S": index.to_string()}}
+            }))?)?;
+            let item = serde_json::to_value(result)?;
+            assert_eq!(
+                item.get("Item")
+                    .and_then(|item| item.get(name))
+                    .and_then(|value| value.get("S")),
+                Some(&json!("preserved"))
+            );
+        }
+        Ok(())
+    }
+
+    struct CborService {
+        value: Value,
+    }
+
+    #[async_trait]
+    impl SnapshotService for CborService {
+        fn service_name(&self) -> &'static str {
+            "cbor-test"
+        }
+
+        async fn save_meta(&self, _data_staging_dir: &Path) -> Result<Vec<u8>> {
+            to_cbor(&self.value)
+        }
+
+        async fn load_meta(&self, state_cbor: Vec<u8>, _data_staging_dir: &Path) -> Result<()> {
+            let value: Value = from_cbor(&state_cbor)?;
+            if value != self.value {
+                bail!("unexpected test service state");
+            }
+            Ok(())
+        }
+    }
+
+    #[tokio::test]
+    async fn test_should_preserve_committed_snapshot_when_cbor_profile_validation_fails()
+    -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let config = SnapshotConfig {
+            root: root.path().to_owned(),
+            name: SnapshotName::try_from("dev".to_owned())?,
+        };
+        let valid = RuntimeProviders {
+            services: vec![Arc::new(CborService { value: Value::Null })],
+        };
+        config.save(&valid, "committed").await?;
+        let invalid = RuntimeProviders {
+            services: vec![Arc::new(CborService {
+                value: Value::Map(vec![
+                    (Value::Text("private-key".into()), Value::Null),
+                    (Value::Text("private-key".into()), Value::Null),
+                ]),
+            })],
+        };
+        let result = config.save(&invalid, "rejected").await;
+        assert!(result.is_err());
+        if let Err(error) = result {
+            let message = format!("{error:#}");
+            assert!(message.contains("duplicate snapshot CBOR key"));
+            assert!(!message.contains("private-key"));
+        }
+        let manifest = read_manifest(&config.snapshot_dir().join(MANIFEST_FILE)).await?;
+        assert_eq!(manifest.rustack_version, "committed");
+        config.load(&valid).await?;
+        Ok(())
+    }
+
     #[test]
     fn test_should_accept_valid_snapshot_name() {
         let name = SnapshotName::try_from("dev.snapshot-1".to_owned());
@@ -1117,7 +1463,7 @@ mod tests {
         let root = tempfile::tempdir()?;
         let target = generation(root.path(), "dev", "old").await?;
         fs::rename(&target, root.path().join(".dev.previous")).await?;
-        recover_snapshot(root.path(), &target, "dev").await?;
+        recover_snapshot(root.path(), &target, "dev", &BTreeMap::new()).await?;
         assert_eq!(
             read_manifest(&target.join(MANIFEST_FILE))
                 .await?
@@ -1132,13 +1478,20 @@ mod tests {
         let root = tempfile::tempdir()?;
         let target = generation(root.path(), "dev", "new").await?;
         let previous = generation(root.path(), ".dev.previous", "old").await?;
-        recover_snapshot(root.path(), &target, "dev").await?;
+        recover_snapshot(root.path(), &target, "dev", &BTreeMap::new()).await?;
         assert_eq!(
             read_manifest(&target.join(MANIFEST_FILE))
                 .await?
                 .rustack_version,
             "new"
         );
+        assert!(path_exists(&previous).await?);
+        SnapshotConfig {
+            root: root.path().to_owned(),
+            name: SnapshotName::try_from("dev".to_owned())?,
+        }
+        .load(&RuntimeProviders::default())
+        .await?;
         assert!(!path_exists(&previous).await?);
         Ok(())
     }
@@ -1149,7 +1502,7 @@ mod tests {
         let target = generation(root.path(), "dev", "new").await?;
         generation(root.path(), ".dev.previous", "old").await?;
         fs::write(target.join(MANIFEST_FILE), b"corrupt").await?;
-        recover_snapshot(root.path(), &target, "dev").await?;
+        recover_snapshot(root.path(), &target, "dev", &BTreeMap::new()).await?;
         assert_eq!(
             read_manifest(&target.join(MANIFEST_FILE))
                 .await?
@@ -1176,10 +1529,14 @@ mod tests {
         let root = tempfile::tempdir()?;
         let target = root.path().join("dev");
         generation(root.path(), ".dev.bak.legacy", "old").await?;
-        recover_snapshot(root.path(), &target, "dev").await?;
+        recover_snapshot(root.path(), &target, "dev", &BTreeMap::new()).await?;
         fs::rename(&target, root.path().join(".dev.bak.one")).await?;
         generation(root.path(), ".dev.bak.two", "other").await?;
-        assert!(recover_snapshot(root.path(), &target, "dev").await.is_err());
+        assert!(
+            recover_snapshot(root.path(), &target, "dev", &BTreeMap::new())
+                .await
+                .is_err()
+        );
         Ok(())
     }
 
@@ -1203,7 +1560,7 @@ mod tests {
         let root = tempfile::tempdir()?;
         let target = generation(root.path(), "dev", "old").await?;
         let staged = generation(root.path(), ".dev.tmp.new", "new").await?;
-        replace_directory(&staged, &target, root.path(), "dev").await?;
+        replace_directory(&staged, &target, root.path(), "dev", &BTreeMap::new()).await?;
         assert_eq!(
             read_manifest(&target.join(MANIFEST_FILE))
                 .await?
@@ -1213,7 +1570,7 @@ mod tests {
         let invalid = root.path().join(".dev.tmp.invalid");
         fs::create_dir(&invalid).await?;
         assert!(
-            replace_directory(&invalid, &target, root.path(), "dev")
+            replace_directory(&invalid, &target, root.path(), "dev", &BTreeMap::new())
                 .await
                 .is_err()
         );
@@ -1255,3 +1612,9 @@ mod tests {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod policy_tests;
+
+#[cfg(all(test, feature = "lambda"))]
+mod image_tests;
diff --git a/apps/rustack/src/snapshot/archive.rs b/apps/rustack/src/snapshot/archive.rs
index 2d8dd855..6816539d 100644
--- a/apps/rustack/src/snapshot/archive.rs
+++ b/apps/rustack/src/snapshot/archive.rs
@@ -2,14 +2,23 @@
 
 use std::{
     collections::BTreeSet,
+    error::Error as StdError,
+    fmt,
     io::{Cursor, Read as _},
     path::{Component, Path, PathBuf},
 };
 
 use anyhow::{Context, Result, bail};
 use crc32fast::Hasher;
+#[cfg(unix)]
+use nix::fcntl::OFlag;
+#[cfg(feature = "lambda")]
+use rustack_lambda_core::provider::DockerArchiveProfile;
 use serde::{Deserialize, Serialize, de::DeserializeOwned};
-use tokio::fs;
+use tokio::{fs, io::AsyncReadExt};
+
+mod cbor;
+use super::worker::WorkerFailure;
 
 const MAGIC: [u8; 8] = *b"RSSNAP\0\x02";
 const HEADER_LEN: usize = 36;
@@ -99,16 +108,35 @@ pub(super) fn to_cbor<T>(value: &T) -> Result<Vec<u8>>
 where
     T: Serialize,
 {
-    let mut bytes = Vec::new();
-    ciborium::into_writer(value, &mut bytes).context("failed to encode snapshot CBOR")?;
-    Ok(bytes)
+    Ok(cbor::encode(value)?)
 }
 
 pub(super) fn from_cbor<T>(bytes: &[u8]) -> Result<T>
 where
     T: DeserializeOwned,
 {
-    ciborium::from_reader(bytes).context("failed to decode snapshot CBOR")
+    Ok(cbor::decode(bytes)?)
+}
+
+#[cfg(feature = "lambda")]
+pub(super) fn from_cbor_lambda<T: DeserializeOwned>(
+    bytes: &[u8],
+    profile: DockerArchiveProfile,
+) -> Result<T> {
+    Ok(cbor::decode_lambda(bytes, profile)?)
+}
+
+#[cfg(feature = "lambda")]
+pub(super) fn to_cbor_lambda<T: Serialize>(
+    value: &T,
+    profile: DockerArchiveProfile,
+) -> Result<Vec<u8>> {
+    Ok(cbor::encode_lambda(value, profile)?)
+}
+
+#[cfg(feature = "stepfunctions")]
+pub(super) fn to_cbor_bounded<T: Serialize>(value: &T, bytes: usize) -> Result<Vec<u8>> {
+    Ok(cbor::encode_bounded(value, bytes)?)
 }
 
 pub(super) async fn write_archive(
@@ -134,25 +162,126 @@ pub(super) async fn write_archive(
     })
 }
 
-pub(super) async fn read_archive(
+/// Policy exhaustion is not evidence that a committed generation is corrupt.
+#[derive(Debug)]
+pub(super) struct BudgetLimit;
+impl fmt::Display for BudgetLimit {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("snapshot configured archive byte limit exceeded")
+    }
+}
+impl StdError for BudgetLimit {}
+#[derive(Debug)]
+struct ExpansionLimit;
+impl fmt::Display for ExpansionLimit {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("decompressed snapshot archive exceeds maximum size")
+    }
+}
+impl StdError for ExpansionLimit {}
+
+/// Bounded regular-file streaming read, including a single detection byte.
+pub(super) async fn read_file_bounded(path: &Path, limit: u64) -> Result<Vec<u8>> {
+    read_file_bounded_owned(
+        path,
+        limit,
+        #[cfg(test)]
+        None,
+    )
+    .await
+}
+async fn read_file_bounded_owned(
     path: &Path,
-    expected_kind: ArchiveKind,
-) -> Result<Vec<ArchiveSection>> {
-    let metadata = fs::metadata(path)
+    limit: u64,
+    #[cfg(test)] gate: Option<&bounded_tests::OpenGate>,
+) -> Result<Vec<u8>> {
+    if !fs::symlink_metadata(path)
         .await
-        .with_context(|| format!("failed to inspect snapshot archive {}", path.display()))?;
+        .context("inspect snapshot input path")?
+        .file_type()
+        .is_file()
+    {
+        bail!("snapshot input must be a regular file");
+    }
+    #[cfg(test)]
+    if let Some(gate) = gate {
+        gate.wait().await;
+    }
+    let mut options = fs::OpenOptions::new();
+    options.read(true);
+    #[cfg(unix)]
+    options.custom_flags((OFlag::O_NONBLOCK | OFlag::O_NOFOLLOW).bits());
+    let file = options
+        .open(path)
+        .await
+        .context("open bounded snapshot input")?;
+    let metadata = file
+        .metadata()
+        .await
+        .context("inspect bounded snapshot input")?;
     if !metadata.is_file() {
-        bail!("snapshot archive is not a regular file: {}", path.display());
+        bail!("snapshot input must be a regular file");
     }
-    if metadata.len() > MAX_ARCHIVE_BYTES {
-        bail!(
-            "snapshot archive {} exceeds maximum size of {MAX_ARCHIVE_BYTES} bytes",
-            path.display()
-        );
+    if metadata.len() > limit {
+        return Err(BudgetLimit.into());
     }
-    let compressed = fs::read(path)
+    let detection = limit.checked_add(1).ok_or(BudgetLimit)?;
+    let mut reader = file.take(detection);
+    let mut bytes = Vec::new();
+    reader
+        .read_to_end(&mut bytes)
+        .await
+        .context("read bounded snapshot input")?;
+    if usize_to_u64(bytes.len())? > limit {
+        return Err(BudgetLimit.into());
+    }
+    Ok(bytes)
+}
+
+pub(super) async fn read_archive_limited(
+    path: &Path,
+    kind: ArchiveKind,
+    payload: Option<usize>,
+) -> Result<Vec<ArchiveSection>> {
+    let Some(payload) = payload else {
+        return read_archive(path, kind).await;
+    };
+    let framed = usize_to_u64(payload)?
+        .checked_add(1024)
+        .ok_or(BudgetLimit)?;
+    let compressed = framed
+        .checked_mul(2)
+        .and_then(|n| n.checked_add(1024 * 1024))
+        .ok_or(BudgetLimit)?
+        .min(MAX_ARCHIVE_BYTES);
+    let bytes = read_file_bounded(path, compressed).await?;
+    let inner = tokio::task::spawn_blocking(move || decode_zstd_with_limit(bytes, framed))
+        .await
+        .map_err(WorkerFailure::new)
+        .context("bounded snapshot decompression worker failed")?
+        .map_err(|error| {
+            if error.is::<ExpansionLimit>() {
+                BudgetLimit.into()
+            } else {
+                error
+            }
+        })?;
+    parse_archive_limited(&inner, kind, Some(payload))
+}
+
+pub(super) async fn read_archive(
+    path: &Path,
+    expected_kind: ArchiveKind,
+) -> Result<Vec<ArchiveSection>> {
+    let compressed = read_file_bounded(path, MAX_ARCHIVE_BYTES)
         .await
-        .with_context(|| format!("failed to read snapshot archive {}", path.display()))?;
+        .map_err(|error| {
+            if error.is::<BudgetLimit>() {
+                anyhow::anyhow!("snapshot archive exceeds maximum size")
+            } else {
+                error
+            }
+        })?;
     let inner = decompress(compressed).await?;
     parse_archive(&inner, expected_kind)
 }
@@ -214,11 +343,27 @@ pub(super) async fn pack_data_archive(
     Ok(Some(stats))
 }
 
-pub(super) async fn unpack_data_archive(archive_path: &Path, target_dir: &Path) -> Result<()> {
-    let sections = read_archive(archive_path, ArchiveKind::ServiceData).await?;
+pub(super) async fn unpack_data_archive(
+    archive_path: &Path,
+    target_dir: &Path,
+    payload: Option<usize>,
+    expected_file: Option<&str>,
+) -> Result<()> {
+    let sections = read_archive_limited(archive_path, ArchiveKind::ServiceData, payload).await?;
     let directory_bytes = get_required_section(&sections, SECTION_DATA_DIRECTORY_CBOR)?;
     let data = get_required_section(&sections, SECTION_DATA_BYTES)?;
-    let entries: Vec<DataDirectoryEntry> = from_cbor(directory_bytes)?;
+    let entries: Vec<DataDirectoryEntry> = if let Some(expected) = expected_file {
+        if sections.len() != 2 || directory_bytes.len() > 1024 {
+            bail!("invalid workflow data section layout");
+        }
+        let [entry]: [DataDirectoryEntry; 1] = from_cbor(directory_bytes)?;
+        if entry.relative_path != expected {
+            bail!("invalid workflow data payload path");
+        }
+        vec![entry]
+    } else {
+        from_cbor(directory_bytes)?
+    };
 
     fs::create_dir_all(target_dir).await.with_context(|| {
         format!(
@@ -346,6 +491,13 @@ fn encode_archive(kind: ArchiveKind, sections: Vec<ArchiveSection>) -> Result<Ve
 }
 
 fn parse_archive(bytes: &[u8], expected_kind: ArchiveKind) -> Result<Vec<ArchiveSection>> {
+    parse_archive_limited(bytes, expected_kind, None)
+}
+fn parse_archive_limited(
+    bytes: &[u8],
+    expected_kind: ArchiveKind,
+    payload: Option<usize>,
+) -> Result<Vec<ArchiveSection>> {
     let min_len = checked_add_usize(HEADER_LEN, FOOTER_LEN)?;
     if bytes.len() < min_len {
         bail!("snapshot archive is too short");
@@ -425,6 +577,9 @@ fn parse_archive(bytes: &[u8], expected_kind: ArchiveKind) -> Result<Vec<Archive
     for entry in entries {
         let start = u64_to_usize(entry.offset)?;
         let len = u64_to_usize(entry.len)?;
+        if payload.is_some_and(|limit| len > limit) {
+            return Err(BudgetLimit.into());
+        }
         let end = checked_add_usize(start, len)?;
         let section_bytes = bytes
             .get(start..end)
@@ -516,7 +671,11 @@ async fn decompress(bytes: Vec<u8>) -> Result<Vec<u8>> {
 }
 
 fn decode_zstd_bounded(bytes: Vec<u8>) -> Result<Vec<u8>> {
-    let read_limit = MAX_ARCHIVE_BYTES
+    decode_zstd_with_limit(bytes, MAX_ARCHIVE_BYTES)
+}
+
+fn decode_zstd_with_limit(bytes: Vec<u8>, limit: u64) -> Result<Vec<u8>> {
+    let read_limit = limit
         .checked_add(1)
         .ok_or_else(|| anyhow::anyhow!("snapshot archive size overflow"))?;
     let decoder = zstd::stream::read::Decoder::new(Cursor::new(bytes))
@@ -526,8 +685,8 @@ fn decode_zstd_bounded(bytes: Vec<u8>) -> Result<Vec<u8>> {
     limited
         .read_to_end(&mut output)
         .context("failed to decompress snapshot archive")?;
-    if usize_to_u64(output.len())? > MAX_ARCHIVE_BYTES {
-        bail!("decompressed snapshot archive exceeds maximum size");
+    if usize_to_u64(output.len())? > limit {
+        return Err(ExpansionLimit.into());
     }
     Ok(output)
 }
@@ -678,10 +837,115 @@ fn u64_to_usize(value: u64) -> Result<usize> {
 
 #[cfg(test)]
 mod tests {
+    use std::io::{Read, Write};
+
     use tempfile::tempdir;
+    use zstd::{
+        stream::{read::Decoder as ZstdReader, write::Encoder as ZstdWriter},
+        zstd_safe::{CCtx, DCtx},
+    };
 
     use super::*;
 
+    const LEGACY_V2: &[u8] = include_bytes!("fixtures/legacy-v2-meta.ss.zst");
+
+    #[test]
+    fn test_should_preserve_original_zstd_0133_snapshot_envelope() -> Result<()> {
+        let plain = decode_zstd_bounded(LEGACY_V2.to_vec())?;
+        assert_eq!(plain.len(), 88);
+        let sections = parse_archive(&plain, ArchiveKind::ServiceMeta)?;
+        let section = sections.first().context("legacy section")?;
+        assert_eq!(sections.len(), 1);
+        assert_eq!(
+            (section.kind, section.flags, section.row_count),
+            (SECTION_STATE_CBOR, 0, 7)
+        );
+        assert_eq!(section.bytes, b"legacy-state");
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_reject_every_truncated_legacy_frame_and_reencoded_corrupt_envelope() -> Result<()>
+    {
+        for end in 0..LEGACY_V2.len() {
+            let prefix = LEGACY_V2.get(..end).context("bounded prefix")?;
+            assert!(
+                decode_zstd_bounded(prefix.to_vec())
+                    .and_then(|plain| parse_archive(&plain, ArchiveKind::ServiceMeta))
+                    .is_err(),
+                "truncated prefix {end}"
+            );
+        }
+        let mut plain = decode_zstd_bounded(LEGACY_V2.to_vec())?;
+        let index = plain.len().checked_sub(FOOTER_LEN).context("CRC offset")?;
+        let crc = plain.get_mut(index).context("CRC byte")?;
+        *crc = crc.wrapping_add(1);
+        let frame = zstd::stream::encode_all(Cursor::new(plain), ZSTD_LEVEL)?;
+        let plain = decode_zstd_bounded(frame)?;
+        assert!(parse_archive(&plain, ArchiveKind::ServiceMeta).is_err());
+        Ok(())
+    }
+
+    #[rstest::rstest]
+    #[case(0)]
+    #[case(1)]
+    #[case(4096)]
+    #[test]
+    fn test_should_enforce_exact_decompressed_byte_boundary(#[case] limit: usize) -> Result<()> {
+        let exact = zstd::stream::encode_all(Cursor::new(vec![b'x'; limit]), ZSTD_LEVEL)?;
+        assert_eq!(
+            decode_zstd_with_limit(exact, u64::try_from(limit)?)?.len(),
+            limit
+        );
+        let excess = zstd::stream::encode_all(Cursor::new(vec![b'x'; limit + 1]), ZSTD_LEVEL)?;
+        assert!(decode_zstd_with_limit(excess, u64::try_from(limit)?).is_err());
+        assert!(decode_zstd_with_limit(Vec::new(), u64::MAX).is_err());
+        Ok(())
+    }
+
+    #[rstest::rstest]
+    #[case(1)]
+    #[case(4096)]
+    #[case(131_071)]
+    #[test]
+    fn test_should_discard_abandoned_encoder_input_before_reusing_context(
+        #[case] size: usize,
+    ) -> Result<()> {
+        let mut context = CCtx::create();
+        {
+            let mut abandoned = ZstdWriter::with_context(Vec::new(), &mut context);
+            abandoned.write_all(&vec![b'X'; size])?;
+        }
+        let mut current = ZstdWriter::with_context(Vec::new(), &mut context);
+        current.write_all(b"current-stream")?;
+        let frame = current.finish()?;
+        assert_eq!(decode_zstd_with_limit(frame, 64)?, b"current-stream");
+        Ok(())
+    }
+
+    #[rstest::rstest]
+    #[case(4096)]
+    #[case(131_072)]
+    #[test]
+    fn test_should_discard_abandoned_decoder_output_before_reusing_context(
+        #[case] size: usize,
+    ) -> Result<()> {
+        let mut context = DCtx::create();
+        let previous = zstd::stream::encode_all(Cursor::new(vec![b'X'; size]), ZSTD_LEVEL)?;
+        {
+            let mut abandoned = ZstdReader::with_context(Cursor::new(previous), &mut context);
+            let mut byte = [0_u8; 1];
+            abandoned.read_exact(&mut byte)?;
+            assert_eq!(byte, [b'X']);
+        }
+        let frame = zstd::stream::encode_all(Cursor::new(b"current-stream"), ZSTD_LEVEL)?;
+        let mut current = ZstdReader::with_context(Cursor::new(frame), &mut context).take(64);
+        let mut output = Vec::new();
+        current.read_to_end(&mut output)?;
+        assert_eq!(output, b"current-stream");
+        Ok(())
+    }
+
     #[tokio::test]
     async fn test_should_round_trip_archive_sections() -> Result<()> {
         let dir = tempdir()?;
@@ -770,7 +1034,7 @@ mod tests {
         assert!(stats.compressed_bytes > 0);
 
         let target = dir.path().join("target");
-        unpack_data_archive(&archive, &target).await?;
+        unpack_data_archive(&archive, &target, None, None).await?;
         let restored = fs::read(target.join("objects").join("0.bin"))
             .await
             .context("restored file should be readable")?;
@@ -809,7 +1073,7 @@ mod tests {
         )
         .await?;
 
-        let result = unpack_data_archive(&archive, &dir.path().join("target")).await;
+        let result = unpack_data_archive(&archive, &dir.path().join("target"), None, None).await;
         assert!(result.is_err());
         Ok(())
     }
@@ -820,3 +1084,6 @@ mod tests {
         assert!(result.is_err());
     }
 }
+
+#[cfg(test)]
+mod bounded_tests;
diff --git a/apps/rustack/src/snapshot/archive/bounded_tests.rs b/apps/rustack/src/snapshot/archive/bounded_tests.rs
new file mode 100644
index 00000000..31e26f8b
--- /dev/null
+++ b/apps/rustack/src/snapshot/archive/bounded_tests.rs
@@ -0,0 +1,168 @@
+//! Workflow payload limits allow framing and reject before section allocation.
+
+use serde::{Serialize, Serializer};
+
+use super::*;
+
+#[derive(Debug)]
+struct Blob(Vec<u8>);
+impl Serialize for Blob {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_bytes(&self.0)
+    }
+}
+fn noise() -> Vec<u8> {
+    let mut state = 0x9e37_79b9_7f4a_7c15_u64;
+    (0..4096)
+        .map(|_| {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            let [byte, ..] = state.to_le_bytes();
+            byte
+        })
+        .collect()
+}
+#[tokio::test]
+async fn test_should_allow_incompressible_payload_at_exact_limit_with_frame_overhead() -> Result<()>
+{
+    let directory = tempfile::tempdir()?;
+    let path = directory.path().join("meta.ss.zst");
+    let raw = noise();
+    let payload = to_cbor(&Blob(raw.clone()))?;
+    let limit = payload.len();
+    let stats = write_archive(
+        &path,
+        ArchiveKind::ServiceMeta,
+        vec![ArchiveSection::new(SECTION_STATE_CBOR, payload.clone(), 1)],
+    )
+    .await?;
+    assert!(
+        stats.compressed_bytes > usize_to_u64(limit)?,
+        "fixture failed to exercise compressed overhead"
+    );
+    let read = read_archive_limited(&path, ArchiveKind::ServiceMeta, Some(limit)).await?;
+    assert_eq!(get_required_section(&read, SECTION_STATE_CBOR)?, payload);
+    let decoded: ciborium::Value = from_cbor(get_required_section(&read, SECTION_STATE_CBOR)?)?;
+    assert_eq!(decoded, ciborium::Value::Bytes(raw));
+    let error = read_archive_limited(&path, ArchiveKind::ServiceMeta, Some(limit - 1))
+        .await
+        .err()
+        .ok_or_else(|| anyhow::anyhow!("accepted oversized section"))?;
+    assert!(error.is::<BudgetLimit>());
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_reject_compressed_and_expansion_limits_as_policy_errors() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let path = directory.path().join("meta.ss.zst");
+    fs::write(&path, vec![0; 1024 * 1024 + 4096]).await?;
+    assert!(
+        read_archive_limited(&path, ArchiveKind::ServiceMeta, Some(1))
+            .await
+            .err()
+            .is_some_and(|error| error.is::<BudgetLimit>())
+    );
+    write_archive(
+        &path,
+        ArchiveKind::ServiceMeta,
+        vec![ArchiveSection::new(SECTION_STATE_CBOR, vec![0; 4096], 1)],
+    )
+    .await?;
+    assert!(
+        read_archive_limited(&path, ArchiveKind::ServiceMeta, Some(1))
+            .await
+            .err()
+            .is_some_and(|error| error.is::<BudgetLimit>())
+    );
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_reject_wrong_or_extra_workflow_data_entries_before_extraction() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    for extra in [false, true] {
+        let staging = directory.path().join(if extra { "two" } else { "wrong" });
+        fs::create_dir(&staging).await?;
+        fs::write(staging.join("unexpected"), b"private payload").await?;
+        if extra {
+            fs::write(staging.join("history.cbor"), b"history").await?;
+        }
+        let path = directory.path().join("data.ss.zst");
+        pack_data_archive(&staging, &path).await?;
+        let target = directory.path().join("not-created");
+        assert!(
+            unpack_data_archive(&path, &target, Some(4096), Some("history.cbor"))
+                .await
+                .is_err()
+        );
+        assert!(!fs::try_exists(target).await?);
+    }
+    Ok(())
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_reject_fifo_without_a_writer_and_join_the_exact_read_task() -> Result<()> {
+    use nix::{sys::stat::Mode, unistd::mkfifo};
+    use tokio::time::{Duration, timeout};
+
+    let directory = tempfile::tempdir()?;
+    let path = directory.path().join("meta.ss.zst");
+    let create = path.clone();
+    tokio::task::spawn_blocking(move || mkfifo(&create, Mode::S_IRUSR | Mode::S_IWUSR)).await??;
+    let mut task = tokio::spawn(async move {
+        read_archive_limited(&path, ArchiveKind::ServiceMeta, Some(4096)).await
+    });
+    let result = timeout(Duration::from_secs(2), &mut task).await??;
+    assert!(result.is_err());
+    assert!(task.is_finished());
+    Ok(())
+}
+
+#[derive(Debug, Default)]
+pub(super) struct OpenGate {
+    entered: tokio::sync::Notify,
+    released: tokio::sync::Notify,
+}
+impl OpenGate {
+    pub(super) async fn wait(&self) {
+        let release = self.released.notified();
+        self.entered.notify_one();
+        release.await;
+    }
+}
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_reject_fifo_and_symlink_swap_after_regular_file_precheck() -> Result<()> {
+    use std::sync::Arc;
+
+    use nix::{sys::stat::Mode, unistd::mkfifo};
+    use tokio::time::{Duration, timeout};
+
+    for symlink in [false, true] {
+        let directory = tempfile::tempdir()?;
+        let path = directory.path().join("meta.ss.zst");
+        let victim = directory.path().join("private");
+        fs::write(&path, b"regular input").await?;
+        fs::write(&victim, b"private file").await?;
+        let gate = Arc::new(OpenGate::default());
+        let delayed = gate.clone();
+        let input = path.clone();
+        let mut task =
+            tokio::spawn(
+                async move { read_file_bounded_owned(&input, 4096, Some(&delayed)).await },
+            );
+        timeout(Duration::from_secs(2), gate.entered.notified()).await?;
+        fs::remove_file(&path).await?;
+        if symlink {
+            fs::symlink(&victim, &path).await?;
+        } else {
+            tokio::task::spawn_blocking(move || mkfifo(&path, Mode::S_IRUSR | Mode::S_IWUSR))
+                .await??;
+        }
+        gate.released.notify_one();
+        assert!(timeout(Duration::from_secs(2), &mut task).await??.is_err());
+        assert!(task.is_finished());
+    }
+    Ok(())
+}
diff --git a/apps/rustack/src/snapshot/archive/cbor.rs b/apps/rustack/src/snapshot/archive/cbor.rs
new file mode 100644
index 00000000..da22cdc2
--- /dev/null
+++ b/apps/rustack/src/snapshot/archive/cbor.rs
@@ -0,0 +1,408 @@
+//! Borrowed structural validation before typed snapshot CBOR allocation.
+//!
+//! The v2 profile intentionally excludes tags, indefinite strings and compound
+//! map keys. All generated snapshot DTOs use scalar keys and definite strings.
+
+#![forbid(unsafe_code)]
+
+use std::{
+    collections::BTreeSet,
+    error::Error as StdError,
+    fmt,
+    io::{self, Cursor, Write},
+    str,
+};
+
+#[cfg(feature = "lambda")]
+use rustack_lambda_core::provider::DockerArchiveProfile;
+use serde::{Serialize, de::DeserializeOwned};
+
+mod lambda;
+use lambda::{Budget as LambdaBudget, Path as LambdaPath};
+
+const TYPED_RECURSION_LIMIT: usize = 256;
+
+const LIMITS: Limits = Limits {
+    bytes: 2 * 1024 * 1024 * 1024,
+    depth: 128,
+    nodes: 8_000_000,
+    collection: 1_000_000,
+    scalar: 128 * 1024 * 1024,
+    key: 128 * 1024 * 1024,
+};
+
+#[derive(Debug, Clone, Copy)]
+struct Limits {
+    bytes: usize,
+    depth: usize,
+    nodes: usize,
+    collection: usize,
+    scalar: usize,
+    key: usize,
+}
+
+/// Fixed classes: parser/serde diagnostics must never echo snapshot data.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Failure {
+    Bytes,
+    Depth,
+    Nodes,
+    Collection,
+    Scalar,
+    Key,
+    Duplicate,
+    Syntax,
+    Profile,
+    Trailing,
+    Schema,
+    Encoding,
+    Allocation,
+}
+impl fmt::Display for Failure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::Bytes => "snapshot CBOR byte limit exceeded",
+            Self::Depth => "snapshot CBOR depth limit exceeded",
+            Self::Nodes => "snapshot CBOR value limit exceeded",
+            Self::Collection => "snapshot CBOR collection limit exceeded",
+            Self::Scalar => "snapshot CBOR scalar limit exceeded",
+            Self::Key => "snapshot CBOR key limit exceeded",
+            Self::Duplicate => "duplicate snapshot CBOR key",
+            Self::Syntax => "invalid snapshot CBOR syntax",
+            Self::Profile => "unsupported snapshot CBOR profile",
+            Self::Trailing => "trailing snapshot CBOR data",
+            Self::Schema => "invalid snapshot CBOR schema",
+            Self::Encoding => "failed to encode snapshot CBOR",
+            Self::Allocation => "snapshot CBOR allocation failed",
+        })
+    }
+}
+impl StdError for Failure {}
+
+#[derive(Debug, PartialEq, Eq, PartialOrd, Ord)]
+enum Key<'a> {
+    Unsigned(u64),
+    Negative(u64),
+    Text(&'a str),
+}
+
+struct Scan<'a> {
+    input: &'a [u8],
+    offset: usize,
+    remaining: usize,
+    limits: Limits,
+    lambda: Option<LambdaBudget>,
+}
+impl<'a> Scan<'a> {
+    fn validate(input: &'a [u8], limits: Limits) -> Result<(), Failure> {
+        if input.len() > limits.bytes {
+            return Err(Failure::Bytes);
+        }
+        let mut scan = Self {
+            input,
+            offset: 0,
+            remaining: limits.nodes,
+            limits,
+            lambda: None,
+        };
+        scan.item(0, LambdaPath::Root)?;
+        if scan.offset != input.len() {
+            return Err(Failure::Trailing);
+        }
+        Ok(())
+    }
+    fn read(&mut self, len: usize) -> Result<&'a [u8], Failure> {
+        if let Some(budget) = &mut self.lambda {
+            budget.metadata = budget.metadata.checked_sub(len).ok_or(Failure::Bytes)?;
+        }
+        self.read_unaccounted(len)
+    }
+    fn read_unaccounted(&mut self, len: usize) -> Result<&'a [u8], Failure> {
+        let end = self.offset.checked_add(len).ok_or(Failure::Syntax)?;
+        let bytes = self.input.get(self.offset..end).ok_or(Failure::Syntax)?;
+        self.offset = end;
+        Ok(bytes)
+    }
+    fn byte(&mut self) -> Result<u8, Failure> {
+        self.read(1)?.first().copied().ok_or(Failure::Syntax)
+    }
+    fn header(&mut self) -> Result<(u8, Option<u64>), Failure> {
+        self.remaining = self.remaining.checked_sub(1).ok_or(Failure::Nodes)?;
+        let initial = self.byte()?;
+        let major = initial >> 5;
+        let value = match initial & 31 {
+            value @ 0..=23 => Some(u64::from(value)),
+            24 => {
+                let value = self.byte()?;
+                if major == 7 && value < 32 {
+                    return Err(Failure::Syntax);
+                }
+                Some(u64::from(value))
+            }
+            25 => Some(u64::from(u16::from_be_bytes(
+                self.read(2)?.try_into().map_err(|_| Failure::Syntax)?,
+            ))),
+            26 => Some(u64::from(u32::from_be_bytes(
+                self.read(4)?.try_into().map_err(|_| Failure::Syntax)?,
+            ))),
+            27 => Some(u64::from_be_bytes(
+                self.read(8)?.try_into().map_err(|_| Failure::Syntax)?,
+            )),
+            31 => None,
+            _ => return Err(Failure::Syntax),
+        };
+        Ok((major, value))
+    }
+    fn scalar(&mut self, len: Option<u64>, key: bool) -> Result<&'a [u8], Failure> {
+        let len = len.ok_or(Failure::Profile)?;
+        let len = usize::try_from(len).map_err(|_| Failure::Scalar)?;
+        if key && len > self.limits.key {
+            return Err(Failure::Key);
+        }
+        if len > self.limits.scalar {
+            return Err(Failure::Scalar);
+        }
+        self.read(len)
+    }
+    fn key(&mut self) -> Result<Key<'a>, Failure> {
+        let (major, value) = self.header()?;
+        match major {
+            0 => Ok(Key::Unsigned(value.ok_or(Failure::Syntax)?)),
+            1 => Ok(Key::Negative(value.ok_or(Failure::Syntax)?)),
+            3 => Ok(Key::Text(
+                str::from_utf8(self.scalar(value, true)?).map_err(|_| Failure::Syntax)?,
+            )),
+            _ => Err(Failure::Profile),
+        }
+    }
+    fn item(&mut self, depth: usize, path: LambdaPath) -> Result<(), Failure> {
+        let (major, value) = self.header()?;
+        let path = path.shape(major);
+        match major {
+            0 | 1 | 7 => {
+                value.ok_or(Failure::Syntax)?;
+            }
+            2 => {
+                self.scalar(value, false)?;
+            }
+            3 => {
+                if path == LambdaPath::Zip && self.lambda.as_ref().is_some_and(|budget| budget.zip)
+                {
+                    let len = usize::try_from(value.ok_or(Failure::Profile)?)
+                        .map_err(|_| Failure::Scalar)?;
+                    let bytes = self.read_unaccounted(len)?;
+                    self.lambda.as_mut().ok_or(Failure::Profile)?.blob(bytes)?;
+                    str::from_utf8(bytes).map_err(|_| Failure::Syntax)?;
+                } else {
+                    str::from_utf8(self.scalar(value, false)?).map_err(|_| Failure::Syntax)?;
+                }
+            }
+            4 | 5 => {
+                let depth = depth.checked_add(1).ok_or(Failure::Depth)?;
+                if depth > self.limits.depth {
+                    return Err(Failure::Depth);
+                }
+                self.collection(major == 5, value, depth, path)?;
+            }
+            _ => return Err(Failure::Profile),
+        }
+        Ok(())
+    }
+    fn collection(
+        &mut self,
+        map: bool,
+        count: Option<u64>,
+        depth: usize,
+        path: LambdaPath,
+    ) -> Result<(), Failure> {
+        let count = count
+            .map(|count| usize::try_from(count).map_err(|_| Failure::Collection))
+            .transpose()?;
+        if let Some(count) = count {
+            if let Some(budget) = &self.lambda {
+                budget.collection(path, count)?;
+            }
+            if count > self.limits.collection {
+                return Err(Failure::Collection);
+            }
+            let minimum = count
+                .checked_mul(if map { 2 } else { 1 })
+                .ok_or(Failure::Collection)?;
+            if minimum > self.remaining {
+                return Err(Failure::Nodes);
+            }
+            if minimum > self.input.len().saturating_sub(self.offset) {
+                return Err(Failure::Syntax);
+            }
+        }
+        let mut keys = BTreeSet::new();
+        let mut visited = 0_usize;
+        loop {
+            if count == Some(visited) {
+                return Ok(());
+            }
+            if count.is_none() && self.input.get(self.offset) == Some(&0xff) {
+                self.byte()?;
+                return Ok(());
+            }
+            visited = visited.checked_add(1).ok_or(Failure::Collection)?;
+            if visited > self.limits.collection {
+                return Err(Failure::Collection);
+            }
+            let key = if map { Some(self.key()?) } else { None };
+            if let Some(budget) = &mut self.lambda {
+                budget.member(path, key.as_ref())?;
+            }
+            let child = path.child(key.as_ref());
+            if let Some(key) = key {
+                if !keys.insert(key) {
+                    return Err(Failure::Duplicate);
+                }
+            }
+            self.item(depth, child)?;
+        }
+    }
+}
+
+struct CappedWriter {
+    bytes: Vec<u8>,
+    limit: usize,
+    failure: Option<Failure>,
+}
+impl Write for CappedWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let result = self.append(bytes);
+        if let Err(failure) = result {
+            self.failure = Some(failure);
+        }
+        result.map_err(io::Error::other)
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+impl CappedWriter {
+    fn append(&mut self, bytes: &[u8]) -> Result<usize, Failure> {
+        let next = self
+            .bytes
+            .len()
+            .checked_add(bytes.len())
+            .filter(|next| *next <= self.limit)
+            .ok_or(Failure::Bytes)?;
+        if next > self.bytes.capacity() {
+            let capacity = self
+                .bytes
+                .capacity()
+                .saturating_mul(2)
+                .max(next)
+                .min(self.limit);
+            self.bytes
+                .try_reserve_exact(capacity.saturating_sub(self.bytes.len()))
+                .map_err(|_| Failure::Allocation)?;
+        }
+        self.bytes.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+}
+
+pub(super) fn encode<T: Serialize>(value: &T) -> Result<Vec<u8>, Failure> {
+    encode_with_limits(value, LIMITS)
+}
+#[cfg(feature = "stepfunctions")]
+pub(super) fn encode_bounded<T: Serialize>(value: &T, bytes: usize) -> Result<Vec<u8>, Failure> {
+    encode_with_limits(
+        value,
+        Limits {
+            bytes: bytes.min(LIMITS.bytes),
+            ..LIMITS
+        },
+    )
+}
+fn encode_with_limits<T: Serialize>(value: &T, limits: Limits) -> Result<Vec<u8>, Failure> {
+    let mut writer = CappedWriter {
+        bytes: Vec::new(),
+        limit: limits.bytes,
+        failure: None,
+    };
+    let result = ciborium::into_writer(value, &mut writer);
+    if let Some(failure) = writer.failure {
+        return Err(failure);
+    }
+    result.map_err(|_| Failure::Encoding)?;
+    Scan::validate(&writer.bytes, limits)?;
+    Ok(writer.bytes)
+}
+
+pub(super) fn decode<T: DeserializeOwned>(bytes: &[u8]) -> Result<T, Failure> {
+    decode_with_limits(bytes, LIMITS)
+}
+fn decode_with_limits<T: DeserializeOwned>(bytes: &[u8], limits: Limits) -> Result<T, Failure> {
+    Scan::validate(bytes, limits)?;
+    decode_typed(bytes)
+}
+fn decode_typed<T: DeserializeOwned>(bytes: &[u8]) -> Result<T, Failure> {
+    let mut reader = Cursor::new(bytes);
+    let value = ciborium::de::from_reader_with_recursion_limit(&mut reader, TYPED_RECURSION_LIMIT)
+        .map_err(|_| Failure::Schema)?;
+    if usize::try_from(reader.position()).map_err(|_| Failure::Trailing)? != bytes.len() {
+        return Err(Failure::Trailing);
+    }
+    Ok(value)
+}
+
+#[cfg(feature = "lambda")]
+fn validate_lambda(bytes: &[u8], profile: DockerArchiveProfile) -> Result<(), Failure> {
+    if bytes.len() > profile.payload_limit() {
+        return Err(Failure::Bytes);
+    }
+    let mut scan = Scan {
+        input: bytes,
+        offset: 0,
+        remaining: 131_073,
+        limits: Limits {
+            bytes: profile.payload_limit(),
+            depth: 64,
+            nodes: 131_073,
+            collection: 65_536,
+            scalar: 128 * 1024,
+            key: 1024,
+        },
+        lambda: Some(LambdaBudget::new(profile)),
+    };
+    scan.item(0, LambdaPath::Root)?;
+    if scan.offset != bytes.len() {
+        return Err(Failure::Trailing);
+    }
+    Ok(())
+}
+
+#[cfg(feature = "lambda")]
+pub(super) fn decode_lambda<T: DeserializeOwned>(
+    bytes: &[u8],
+    profile: DockerArchiveProfile,
+) -> Result<T, Failure> {
+    validate_lambda(bytes, profile)?;
+    decode_typed(bytes)
+}
+
+#[cfg(feature = "lambda")]
+pub(super) fn encode_lambda<T: Serialize>(
+    value: &T,
+    profile: DockerArchiveProfile,
+) -> Result<Vec<u8>, Failure> {
+    let bytes = encode_with_limits(
+        value,
+        Limits {
+            bytes: profile.payload_limit(),
+            ..LIMITS
+        },
+    )?;
+    validate_lambda(&bytes, profile)?;
+    Ok(bytes)
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(all(test, feature = "lambda"))]
+mod lambda_tests;
diff --git a/apps/rustack/src/snapshot/archive/cbor/lambda.rs b/apps/rustack/src/snapshot/archive/cbor/lambda.rs
new file mode 100644
index 00000000..e7f07343
--- /dev/null
+++ b/apps/rustack/src/snapshot/archive/cbor/lambda.rs
@@ -0,0 +1,133 @@
+//! Exact-path metadata accounting, shared by the existing CBOR scanner.
+
+#[cfg(feature = "lambda")]
+use rustack_lambda_core::provider::DockerArchiveProfile;
+
+use super::{Failure, Key};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Path {
+    Root,
+    Functions,
+    Rows,
+    Function,
+    Versions,
+    Version,
+    Zip,
+    Other,
+}
+impl Path {
+    pub(super) fn shape(self, major: u8) -> Self {
+        match (self, major) {
+            (Self::Root | Self::Functions | Self::Function | Self::Versions | Self::Version, 5)
+            | (Self::Rows, 4)
+            | (Self::Zip, 3) => self,
+            _ => Self::Other,
+        }
+    }
+    pub(super) fn child(self, key: Option<&Key<'_>>) -> Self {
+        match (self, key) {
+            (Self::Root, Some(Key::Text("functions"))) => Self::Functions,
+            (Self::Functions, Some(Key::Text("functions"))) => Self::Rows,
+            (Self::Rows, None) => Self::Function,
+            (Self::Function, Some(Key::Text("latest")))
+            | (Self::Versions, Some(Key::Unsigned(_))) => Self::Version,
+            (Self::Function, Some(Key::Text("versions"))) => Self::Versions,
+            (Self::Version, Some(Key::Text("zipBytesBase64"))) => Self::Zip,
+            _ => Self::Other,
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct Budget {
+    pub(super) metadata: usize,
+    members: usize,
+    functions: usize,
+    revisions: usize,
+    zip_remaining: usize,
+    zip_maximum: usize,
+    pub(super) zip: bool,
+}
+impl Budget {
+    #[cfg(feature = "lambda")]
+    pub(super) fn new(profile: DockerArchiveProfile) -> Self {
+        Self {
+            metadata: DockerArchiveProfile::METADATA_BYTES,
+            members: 65_536,
+            functions: DockerArchiveProfile::MAX_FUNCTIONS,
+            revisions: DockerArchiveProfile::MAX_REVISIONS,
+            zip_remaining: DockerArchiveProfile::MAX_ZIP_DATA_BYTES,
+            zip_maximum: DockerArchiveProfile::MAX_ZIP_BYTES,
+            zip: profile.zip_architecture().is_some(),
+        }
+    }
+    pub(super) fn collection(&self, path: Path, count: usize) -> Result<(), Failure> {
+        if count > self.members
+            || (path == Path::Rows && count > self.functions)
+            || (path == Path::Versions && count > self.revisions)
+        {
+            return Err(Failure::Collection);
+        }
+        Ok(())
+    }
+    pub(super) fn member(&mut self, path: Path, key: Option<&Key<'_>>) -> Result<(), Failure> {
+        self.members = self.members.checked_sub(1).ok_or(Failure::Nodes)?;
+        if path == Path::Rows {
+            self.functions = self.functions.checked_sub(1).ok_or(Failure::Collection)?;
+        }
+        if path == Path::Versions
+            || (path == Path::Function && matches!(key, Some(Key::Text("latest"))))
+        {
+            self.revisions = self.revisions.checked_sub(1).ok_or(Failure::Collection)?;
+        }
+        Ok(())
+    }
+    pub(super) fn blob(&mut self, bytes: &[u8]) -> Result<(), Failure> {
+        let maximum = self
+            .zip_maximum
+            .div_ceil(3)
+            .checked_mul(4)
+            .ok_or(Failure::Scalar)?;
+        if bytes.len() > maximum || !bytes.len().is_multiple_of(4) {
+            return Err(Failure::Scalar);
+        }
+        let padding = if bytes.ends_with(b"==") {
+            2
+        } else {
+            usize::from(bytes.ends_with(b"="))
+        };
+        let decoded = bytes
+            .len()
+            .checked_div(4)
+            .and_then(|n| n.checked_mul(3))
+            .and_then(|n| n.checked_sub(padding))
+            .ok_or(Failure::Scalar)?;
+        if decoded > self.zip_maximum {
+            return Err(Failure::Scalar);
+        }
+        self.zip_remaining = self
+            .zip_remaining
+            .checked_sub(decoded)
+            .ok_or(Failure::Bytes)?;
+        Ok(())
+    }
+}
+
+#[cfg(all(test, feature = "lambda"))]
+mod tests {
+    use rustack_lambda_core::{artifact::Architecture, provider::DockerArchiveProfile};
+
+    use super::*;
+    #[test]
+    fn test_should_bound_each_blob_and_aggregate_before_typed_allocation() {
+        let mut budget = Budget::new(DockerArchiveProfile::ProvidedZip(Architecture::Arm64));
+        budget.zip_maximum = 3;
+        budget.zip_remaining = 5;
+        assert_eq!(budget.blob(b"AAAA"), Ok(()));
+        assert_eq!(budget.blob(b"AAA="), Ok(()));
+        assert_eq!(budget.blob(b"AA=="), Err(Failure::Bytes));
+        assert_eq!(budget.blob(b"AAAAAAAA"), Err(Failure::Scalar));
+        assert_eq!(budget.blob(b"AAA"), Err(Failure::Scalar));
+    }
+}
diff --git a/apps/rustack/src/snapshot/archive/cbor/lambda_tests.rs b/apps/rustack/src/snapshot/archive/cbor/lambda_tests.rs
new file mode 100644
index 00000000..4e454ea3
--- /dev/null
+++ b/apps/rustack/src/snapshot/archive/cbor/lambda_tests.rs
@@ -0,0 +1,219 @@
+//! Raw Lambda path and metadata barriers must precede typed allocation.
+
+use std::cell::Cell;
+
+use ciborium::Value;
+use rstest::rstest;
+use rustack_lambda_core::{artifact::Architecture, provider::DockerArchiveProfile};
+use serde::{
+    Deserialize, Deserializer, Serialize, Serializer,
+    de::IgnoredAny,
+    ser::{SerializeMap, SerializeSeq},
+};
+
+use super::*;
+
+thread_local! { static VISITS: Cell<usize> = const { Cell::new(0) }; }
+#[derive(Debug)]
+struct Sentinel;
+impl<'de> Deserialize<'de> for Sentinel {
+    fn deserialize<D: Deserializer<'de>>(decoder: D) -> Result<Self, D::Error> {
+        VISITS.set(VISITS.get().saturating_add(1));
+        IgnoredAny::deserialize(decoder)?;
+        Ok(Self)
+    }
+}
+fn managed() -> DockerArchiveProfile {
+    DockerArchiveProfile::ProvidedZip(Architecture::Arm64)
+}
+fn map(values: Vec<(&str, Value)>) -> Value {
+    Value::Map(
+        values
+            .into_iter()
+            .map(|(key, value)| (Value::Text(key.into()), value))
+            .collect(),
+    )
+}
+fn body() -> Value {
+    Value::Text("A".repeat(128 * 1024 + 4))
+}
+fn version() -> Value {
+    map(vec![("zipBytesBase64", body())])
+}
+fn row(published: bool) -> Value {
+    if published {
+        map(vec![(
+            "versions",
+            Value::Map(vec![(Value::Integer(1_u64.into()), version())]),
+        )])
+    } else {
+        map(vec![("latest", version())])
+    }
+}
+fn rows(value: Value) -> Value {
+    map(vec![(
+        "functions",
+        map(vec![("functions", Value::Array(vec![value]))]),
+    )])
+}
+fn rejected(value: &Value, profile: DockerArchiveProfile, expected: Failure) {
+    let mut bytes = Vec::new();
+    ciborium::into_writer(value, &mut bytes).unwrap();
+    VISITS.set(0);
+    assert_eq!(
+        decode_lambda::<Sentinel>(&bytes, profile).err(),
+        Some(expected)
+    );
+    assert_eq!(VISITS.get(), 0);
+}
+
+struct Indefinite<'a>(&'a Value);
+impl Serialize for Indefinite<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        match self.0 {
+            Value::Map(values) => {
+                let mut map = serializer.serialize_map(None)?;
+                for (key, value) in values {
+                    map.serialize_entry(key, &Self(value))?;
+                }
+                map.end()
+            }
+            Value::Array(values) => {
+                let mut sequence = serializer.serialize_seq(None)?;
+                for value in values {
+                    sequence.serialize_element(&Self(value))?;
+                }
+                sequence.end()
+            }
+            value => value.serialize(serializer),
+        }
+    }
+}
+#[rstest]
+#[case(false, false)]
+#[case(false, true)]
+#[case(true, false)]
+#[case(true, true)]
+fn test_should_allow_only_known_latest_and_unsigned_version_body_paths(
+    #[case] published: bool,
+    #[case] indefinite: bool,
+) {
+    let value = rows(row(published));
+    let bytes = if indefinite {
+        encode(&Indefinite(&value)).unwrap()
+    } else {
+        encode(&value).unwrap()
+    };
+    let decoded: Value = decode_lambda(&bytes, managed()).unwrap();
+    assert_eq!(decoded, value);
+    assert!(matches!(
+        decode_lambda::<Sentinel>(&bytes, DockerArchiveProfile::ImageOnly),
+        Err(Failure::Scalar)
+    ));
+    assert_eq!(
+        encode_lambda(&value, managed()).unwrap(),
+        encode(&value).unwrap()
+    );
+}
+
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(2)]
+#[case(3)]
+#[case(4)]
+#[case(5)]
+#[case(6)]
+#[case(7)]
+fn test_should_reject_misplaced_and_unknown_lookalikes_before_deserialization(
+    #[case] location: usize,
+) {
+    let value = match location {
+        0 => map(vec![("unknown", rows(row(false)))]),
+        1 => map(vec![("functions", map(vec![("unknown", version())]))]),
+        2 => rows(map(vec![("policy", map(vec![("latest", version())]))])),
+        3 => rows(map(vec![("latest", map(vec![("unknown", version())]))])),
+        4 => map(vec![("layers", map(vec![("latest", version())]))]),
+        5 => rows(map(vec![(
+            "versions",
+            Value::Map(vec![(Value::Text("1".into()), version())]),
+        )])),
+        6 => rows(map(vec![(
+            "versions",
+            Value::Map(vec![(Value::Integer((-1_i64).into()), version())]),
+        )])),
+        _ => map(vec![(
+            "functions",
+            map(vec![("functions", map(vec![("latest", version())]))]),
+        )]),
+    };
+    rejected(&value, managed(), Failure::Scalar);
+}
+#[test]
+fn test_should_reject_duplicate_keys_even_when_both_values_are_authorized_zip_slots() {
+    rejected(
+        &rows(map(vec![("latest", version()), ("latest", version())])),
+        managed(),
+        Failure::Duplicate,
+    );
+}
+#[rstest]
+#[case(false)]
+#[case(true)]
+fn test_should_bound_function_and_revision_counts_before_typed_allocation(#[case] revisions: bool) {
+    let value = if revisions {
+        let versions = (1_u64..=1024)
+            .map(|n| (Value::Integer(n.into()), Value::Null))
+            .collect();
+        rows(map(vec![
+            ("latest", Value::Null),
+            ("versions", Value::Map(versions)),
+        ]))
+    } else {
+        map(vec![(
+            "functions",
+            map(vec![("functions", Value::Array(vec![Value::Null; 257]))]),
+        )])
+    };
+    for bytes in [
+        encode(&value).unwrap(),
+        encode(&Indefinite(&value)).unwrap(),
+    ] {
+        VISITS.set(0);
+        assert!(matches!(
+            decode_lambda::<Sentinel>(&bytes, managed()),
+            Err(Failure::Collection)
+        ));
+        assert_eq!(VISITS.get(), 0);
+    }
+}
+#[test]
+fn test_should_charge_headers_and_keys_but_exempt_only_exact_body_contents() {
+    let bytes = encode(&rows(row(false))).unwrap();
+    let metadata = bytes.len().checked_sub(128 * 1024 + 4).unwrap();
+    for (allowed, expected) in [
+        (metadata, Ok(())),
+        (metadata.checked_sub(1).unwrap(), Err(Failure::Bytes)),
+    ] {
+        let mut budget = LambdaBudget::new(managed());
+        budget.metadata = allowed;
+        let mut scan = Scan {
+            input: &bytes,
+            offset: 0,
+            remaining: LIMITS.nodes,
+            limits: LIMITS,
+            lambda: Some(budget),
+        };
+        assert_eq!(scan.item(0, LambdaPath::Root), expected);
+    }
+}
+#[test]
+fn test_should_preserve_pair_and_array_member_budget_semantics() {
+    let exact = encode(&vec![(); 65_536]).unwrap();
+    assert!(decode_lambda::<IgnoredAny>(&exact, managed()).is_ok());
+    rejected(
+        &Value::Array(vec![Value::Null; 65_537]),
+        managed(),
+        Failure::Collection,
+    );
+}
diff --git a/apps/rustack/src/snapshot/archive/cbor/tests.rs b/apps/rustack/src/snapshot/archive/cbor/tests.rs
new file mode 100644
index 00000000..f9d126d6
--- /dev/null
+++ b/apps/rustack/src/snapshot/archive/cbor/tests.rs
@@ -0,0 +1,505 @@
+//! Profile, resource and before-deserialization barriers for snapshot imports.
+
+use std::{cell::Cell, collections::BTreeMap, error::Error};
+
+use ciborium::Value;
+use proptest::{collection, prelude::*};
+use rstest::rstest;
+use serde::{
+    Deserialize, Deserializer, Serialize, Serializer,
+    de::IgnoredAny,
+    ser::{Error as _, SerializeSeq},
+};
+
+use super::{
+    CappedWriter, Failure, LIMITS, Limits, Scan, decode, decode_with_limits, encode,
+    encode_with_limits,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+thread_local! {
+    static VISITS: Cell<usize> = const { Cell::new(0) };
+}
+
+#[derive(Debug)]
+struct Sentinel;
+impl<'de> Deserialize<'de> for Sentinel {
+    fn deserialize<D: Deserializer<'de>>(decoder: D) -> Result<Self, D::Error> {
+        VISITS.set(VISITS.get().saturating_add(1));
+        IgnoredAny::deserialize(decoder)?;
+        Ok(Self)
+    }
+}
+
+fn rejected(bytes: &[u8], limits: Limits, expected: Failure) {
+    VISITS.set(0);
+    assert_eq!(
+        decode_with_limits::<Sentinel>(bytes, limits).err(),
+        Some(expected)
+    );
+    assert_eq!(VISITS.get(), 0, "typed allocation must follow preflight");
+}
+
+#[rstest]
+#[case(&[], Failure::Syntax)]
+#[case(&[0xff], Failure::Syntax)]
+#[case(&[0x1f], Failure::Syntax)]
+#[case(&[0x3f], Failure::Syntax)]
+#[case(&[0x1c], Failure::Syntax)]
+#[case(&[0x1d], Failure::Syntax)]
+#[case(&[0x1e], Failure::Syntax)]
+#[case(&[0x18], Failure::Syntax)]
+#[case(&[0x19, 0x01], Failure::Syntax)]
+#[case(&[0x1a, 0x00, 0x00, 0x00], Failure::Syntax)]
+#[case(&[0x1b, 0x00, 0x00, 0x00, 0x00], Failure::Syntax)]
+#[case(&[0x61], Failure::Syntax)]
+#[case(&[0x81], Failure::Syntax)]
+#[case(&[0xa1, 0x00], Failure::Syntax)]
+#[case(&[0x9f], Failure::Syntax)]
+#[case(&[0xbf, 0x61, b'a', 0xff], Failure::Syntax)]
+#[case(&[0x81, 0xff], Failure::Syntax)]
+#[case(&[0xa1, 0xff, 0x00], Failure::Profile)]
+#[case(&[0x62, 0xc0, 0xaf], Failure::Syntax)]
+#[case(&[0xa1, 0x61, 0xff, 0x00], Failure::Syntax)]
+#[case(&[0xf8, 0x00], Failure::Syntax)]
+#[case(&[0xf8, 0x1f], Failure::Syntax)]
+#[case(&[0xfc], Failure::Syntax)]
+#[case(&[0xfd], Failure::Syntax)]
+#[case(&[0xfe], Failure::Syntax)]
+#[case(&[0xc0, 0x60], Failure::Profile)]
+#[case(&[0x5f, 0xff], Failure::Profile)]
+#[case(&[0x7f, 0xff], Failure::Profile)]
+#[case(&[0xa1, 0x80, 0x00], Failure::Profile)]
+#[case(&[0xa1, 0x40, 0x00], Failure::Profile)]
+#[case(&[0xa1, 0xf5, 0x00], Failure::Profile)]
+#[case(&[0xa1, 0xf9, 0x00, 0x00, 0x00], Failure::Profile)]
+#[case(&[0x00, 0x00], Failure::Trailing)]
+#[case(&[0x00, 0xff], Failure::Trailing)]
+#[case(&[0x80, 0x61, b'a'], Failure::Trailing)]
+fn test_should_reject_hostile_structure_before_typed_visitors(
+    #[case] bytes: &[u8],
+    #[case] expected: Failure,
+) {
+    rejected(bytes, LIMITS, expected);
+}
+
+#[rstest]
+#[case(&[0xa2, 0x61, b'x', 0x00, 0x61, b'x', 0x01])]
+#[case(&[0xa2, 0x61, b'x', 0x00, 0x78, 0x01, b'x', 0x01])]
+#[case(&[0xa2, 0x01, 0x00, 0x18, 0x01, 0x01])]
+#[case(&[0xa2, 0x20, 0x00, 0x38, 0x00, 0x01])]
+#[case(&[0xbf, 0x61, b'x', 0x00, 0x61, b'x', 0x01, 0xff])]
+fn test_should_reject_semantically_duplicate_keys(#[case] bytes: &[u8]) {
+    rejected(bytes, LIMITS, Failure::Duplicate);
+}
+
+fn numeric_header(major: u8, width: usize, value: u8) -> Vec<u8> {
+    match width {
+        0 => vec![(major << 5) | value],
+        1 => vec![(major << 5) | 0x18, value],
+        2 => vec![(major << 5) | 0x19, 0, value],
+        4 => vec![(major << 5) | 0x1a, 0, 0, 0, value],
+        8 => vec![(major << 5) | 0x1b, 0, 0, 0, 0, 0, 0, 0, value],
+        _ => Vec::new(),
+    }
+}
+
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(2)]
+#[case(4)]
+#[case(8)]
+fn test_should_accept_every_header_width_without_requiring_canonical_order(
+    #[case] width: usize,
+) -> TestResult {
+    assert_eq!(decode::<u64>(&numeric_header(0, width, 1))?, 1);
+    assert_eq!(decode::<i64>(&numeric_header(1, width, 1))?, -2);
+    let mut text = numeric_header(3, width, 1);
+    text.push(b'a');
+    assert_eq!(decode::<String>(&text)?, "a");
+    let mut bytes = numeric_header(2, width, 1);
+    bytes.push(0xff);
+    assert_eq!(decode::<Value>(&bytes)?, Value::Bytes(vec![0xff]));
+    let mut array = numeric_header(4, width, 1);
+    array.push(0x00);
+    assert_eq!(decode::<Vec<u8>>(&array)?, vec![0]);
+    let mut map = numeric_header(5, width, 1);
+    map.extend_from_slice(&[0x61, b'a', 0x00]);
+    assert_eq!(decode::<BTreeMap<String, u8>>(&map)?.get("a"), Some(&0));
+    Ok(())
+}
+
+#[rstest]
+#[case(&[0xf4], Value::Bool(false))]
+#[case(&[0xf5], Value::Bool(true))]
+#[case(&[0xf6], Value::Null)]
+#[case(&[0x40], Value::Bytes(vec![]))]
+#[case(&[0x60], Value::Text(String::new()))]
+#[case(&[0x80], Value::Array(vec![]))]
+#[case(&[0xa0], Value::Map(vec![]))]
+#[case(&[0x9f, 0x00, 0x01, 0xff], Value::Array(vec![0.into(), 1.into()]))]
+#[case(&[0xbf, 0x00, 0x00, 0xff], Value::Map(vec![(0.into(), 0.into())]))]
+#[case(&[0xf9, 0x3e, 0x00], Value::Float(1.5))]
+#[case(&[0xfa, 0x3f, 0xc0, 0x00, 0x00], Value::Float(1.5))]
+#[case(&[0xfb, 0x3f, 0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00], Value::Float(1.5))]
+fn test_should_preserve_supported_cbor_values(
+    #[case] bytes: &[u8],
+    #[case] expected: Value,
+) -> TestResult {
+    assert_eq!(decode::<Value>(bytes)?, expected);
+    Ok(())
+}
+
+#[test]
+fn test_should_allow_integer_keyed_versions_and_nested_key_reuse() -> TestResult {
+    let value = BTreeMap::from([
+        (0_u64, BTreeMap::from([("same".to_owned(), vec![0, 1, 2])])),
+        (
+            u64::MAX,
+            BTreeMap::from([("same".to_owned(), vec![3, 4, 5])]),
+        ),
+    ]);
+    assert_eq!(
+        decode::<BTreeMap<u64, BTreeMap<String, Vec<i32>>>>(&encode(&value)?)?,
+        value
+    );
+    let negative: BTreeMap<i64, u8> = decode(&[0xa2, 0x20, 0x01, 0x00, 0x02])?;
+    assert_eq!(negative, BTreeMap::from([(-1, 1), (0, 2)]));
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_section_bytes_at_the_exact_boundary() -> TestResult {
+    let bytes = [0x61, b'a'];
+    let limits = Limits { bytes: 2, ..LIMITS };
+    assert_eq!(decode_with_limits::<String>(&bytes, limits)?, "a");
+    assert_eq!(encode_with_limits(&"a", limits)?, bytes);
+    rejected(&bytes, Limits { bytes: 1, ..limits }, Failure::Bytes);
+    assert_eq!(
+        encode_with_limits(&"a", Limits { bytes: 1, ..limits }),
+        Err(Failure::Bytes)
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_all_aggregate_nodes_including_keys_and_containers() -> TestResult {
+    // The root map, key, array and two scalar elements occupy five nodes.
+    let bytes = [0xa1, 0x61, b'k', 0x82, 0x00, 0x01];
+    let limits = Limits { nodes: 5, ..LIMITS };
+    assert!(decode_with_limits::<Value>(&bytes, limits).is_ok());
+    rejected(&bytes, Limits { nodes: 4, ..limits }, Failure::Nodes);
+    rejected(&[0x00], Limits { nodes: 0, ..limits }, Failure::Nodes);
+    Scan::validate(&[0x00], Limits { nodes: 1, ..limits })?;
+    Ok(())
+}
+
+#[rstest]
+#[case(&[0x82, 0x00, 0x01])]
+#[case(&[0x9f, 0x00, 0x01, 0xff])]
+#[case(&[0xa2, 0x00, 0x00, 0x01, 0x01])]
+#[case(&[0xbf, 0x00, 0x00, 0x01, 0x01, 0xff])]
+fn test_should_bound_definite_and_indefinite_collection_counts(#[case] bytes: &[u8]) {
+    let limits = Limits {
+        collection: 2,
+        ..LIMITS
+    };
+    assert!(decode_with_limits::<Value>(bytes, limits).is_ok());
+    rejected(
+        bytes,
+        Limits {
+            collection: 1,
+            ..limits
+        },
+        Failure::Collection,
+    );
+}
+
+#[test]
+fn test_should_bound_actual_container_depth_without_counting_scalars() -> TestResult {
+    Scan::validate(&[0x00], Limits { depth: 0, ..LIMITS })?;
+    rejected(&[0x80], Limits { depth: 0, ..LIMITS }, Failure::Depth);
+    let limits = Limits { depth: 2, ..LIMITS };
+    Scan::validate(&[0x81, 0x81, 0x00], limits)?;
+    rejected(&[0x81, 0x81, 0x80], limits, Failure::Depth);
+    let mut bytes = vec![0x81; LIMITS.depth];
+    bytes.push(0x00);
+    let _: Value = decode(&bytes)?;
+    bytes.insert(0, 0x81);
+    rejected(&bytes, LIMITS, Failure::Depth);
+    Ok(())
+}
+
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+enum Tree {
+    Leaf,
+    Seq(Vec<Self>),
+}
+
+#[test]
+fn test_should_round_trip_derived_enums_at_exact_wire_depth_with_typed_headroom() -> TestResult {
+    let mut value = Tree::Leaf;
+    for _ in 0..64 {
+        value = Tree::Seq(vec![value]);
+    }
+    let bytes = encode(&value)?;
+    Scan::validate(&bytes, LIMITS)?;
+    // W190: a scalar Leaf also consumes the typed decoder's enum guard.
+    assert!(
+        ciborium::de::from_reader_with_recursion_limit::<Tree, _>(bytes.as_slice(), 128).is_err()
+    );
+    assert_eq!(decode::<Tree>(&bytes)?, value);
+    Ok(())
+}
+
+#[rstest]
+#[case(&[0x63, b'a', b'b', b'c'])]
+#[case(&[0x43, 0x00, 0x01, 0xff])]
+fn test_should_bound_definite_scalar_lengths_before_content(#[case] bytes: &[u8]) -> TestResult {
+    Scan::validate(
+        bytes,
+        Limits {
+            scalar: 3,
+            ..LIMITS
+        },
+    )?;
+    rejected(
+        bytes,
+        Limits {
+            scalar: 2,
+            ..LIMITS
+        },
+        Failure::Scalar,
+    );
+    let claim = numeric_header(3, 8, 3);
+    rejected(
+        &claim,
+        Limits {
+            scalar: 2,
+            ..LIMITS
+        },
+        Failure::Scalar,
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_decoded_text_keys_in_bytes() -> TestResult {
+    // The Unicode key contains two bytes, one character.
+    let bytes = [0xa1, 0x62, 0xc3, 0xa9, 0x00];
+    Scan::validate(&bytes, Limits { key: 2, ..LIMITS })?;
+    rejected(&bytes, Limits { key: 1, ..LIMITS }, Failure::Key);
+    let claim = [0xa1, 0x62, 0x00];
+    rejected(&claim, Limits { key: 1, ..LIMITS }, Failure::Key);
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_extreme_external_lengths_without_allocation() {
+    for (major, expected) in [
+        (2, Failure::Scalar),
+        (3, Failure::Scalar),
+        (4, Failure::Collection),
+        (5, Failure::Collection),
+    ] {
+        let mut bytes = vec![(major << 5) | 0x1b];
+        bytes.extend_from_slice(&u64::MAX.to_be_bytes());
+        rejected(&bytes, LIMITS, expected);
+    }
+}
+
+#[test]
+fn test_should_reject_all_truncated_prefixes_of_a_nested_value() -> TestResult {
+    let value = BTreeMap::from([("outer", vec![vec!["hello", "world"], vec!["é"]])]);
+    let bytes = encode(&value)?;
+    for len in 0..bytes.len() {
+        let prefix = bytes.get(..len).ok_or("invalid test prefix")?;
+        VISITS.set(0);
+        assert!(decode::<Sentinel>(prefix).is_err());
+        assert_eq!(VISITS.get(), 0);
+    }
+    Ok(())
+}
+
+#[test]
+fn test_should_remove_attacker_data_from_schema_errors_and_sources() {
+    let secret = "private-snapshot-content";
+    let mut raw = Vec::new();
+    assert!(ciborium::into_writer(&secret, &mut raw).is_ok());
+    let error = decode::<u64>(&raw).err();
+    assert_eq!(error, Some(Failure::Schema));
+    assert!(!format!("{error:?}").contains(secret));
+    if let Some(error) = error {
+        assert!(error.source().is_none());
+        assert_eq!(error.to_string(), "invalid snapshot CBOR schema");
+    }
+}
+
+struct FailingSerializer;
+impl Serialize for FailingSerializer {
+    fn serialize<S: Serializer>(&self, _serializer: S) -> Result<S::Ok, S::Error> {
+        Err(S::Error::custom("private-serialization-content"))
+    }
+}
+
+#[test]
+fn test_should_redact_serializer_failures() {
+    let error = encode(&FailingSerializer).err();
+    assert_eq!(error, Some(Failure::Encoding));
+    assert!(!format!("{error:?}").contains("private-serialization-content"));
+}
+
+struct ManyValues;
+impl Serialize for ManyValues {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let mut sequence = serializer.serialize_seq(None)?;
+        for _ in 0..1_000_000 {
+            VISITS.set(VISITS.get().saturating_add(1));
+            sequence.serialize_element(&0_u8)?;
+        }
+        sequence.end()
+    }
+}
+
+#[test]
+fn test_should_stop_oversized_serialization_before_finishing_the_input() {
+    VISITS.set(0);
+    assert_eq!(
+        encode_with_limits(&ManyValues, Limits { bytes: 8, ..LIMITS }),
+        Err(Failure::Bytes)
+    );
+    assert!(VISITS.get() <= 8);
+}
+
+#[test]
+fn test_should_keep_capped_writer_bytes_unchanged_on_oversize() -> TestResult {
+    let mut writer = CappedWriter {
+        bytes: Vec::new(),
+        limit: 3,
+        failure: None,
+    };
+    assert_eq!(writer.append(&[0, 1])?, 2);
+    assert_eq!(writer.append(&[2, 3]), Err(Failure::Bytes));
+    assert_eq!(writer.bytes, [0, 1]);
+    assert_eq!(writer.append(&[2])?, 1);
+    assert_eq!(writer.bytes, [0, 1, 2]);
+    Ok(())
+}
+
+#[test]
+fn test_should_apply_profile_checks_to_newly_encoded_values() {
+    assert_eq!(
+        encode(&Value::Tag(0, Box::new(Value::Text("date".into())))),
+        Err(Failure::Profile)
+    );
+    assert_eq!(
+        encode(&Value::Map(vec![(Value::Bool(true), Value::Null)])),
+        Err(Failure::Profile)
+    );
+    assert_eq!(
+        encode(&Value::Map(vec![
+            (Value::Text("x".into()), Value::Null),
+            (Value::Text("x".into()), Value::Null)
+        ])),
+        Err(Failure::Duplicate)
+    );
+    assert_eq!(
+        encode_with_limits(
+            &vec![0; 3],
+            Limits {
+                collection: 2,
+                ..LIMITS
+            }
+        ),
+        Err(Failure::Collection)
+    );
+    assert_eq!(
+        encode_with_limits(
+            &"abc",
+            Limits {
+                scalar: 2,
+                ..LIMITS
+            }
+        ),
+        Err(Failure::Scalar)
+    );
+}
+
+struct Early;
+impl<'de> Deserialize<'de> for Early {
+    fn deserialize<D: Deserializer<'de>>(_decoder: D) -> Result<Self, D::Error> {
+        Ok(Self)
+    }
+}
+
+#[test]
+fn test_should_require_the_typed_reader_to_consume_the_single_root() {
+    assert!(matches!(decode::<Early>(&[0x00]), Err(Failure::Trailing)));
+}
+
+#[test]
+fn test_should_demonstrate_preflight_is_required_for_trailing_and_duplicate_input() -> TestResult {
+    assert_eq!(ciborium::from_reader::<u8, _>([0x00, 0x01].as_slice())?, 0);
+    rejected(&[0x00, 0x01], LIMITS, Failure::Trailing);
+    let duplicate = [0xa2, 0x61, b'x', 0x00, 0x61, b'x', 0x01];
+    assert_eq!(
+        ciborium::from_reader::<BTreeMap<String, u8>, _>(duplicate.as_slice())?.get("x"),
+        Some(&1)
+    );
+    rejected(&duplicate, LIMITS, Failure::Duplicate);
+    Ok(())
+}
+
+fn profile_values() -> impl Strategy<Value = Value> {
+    prop_oneof![
+        any::<bool>().prop_map(Value::Bool),
+        any::<i64>().prop_map(|v| Value::Integer(v.into())),
+        "[a-zé水0-9]{0,32}".prop_map(Value::Text),
+        collection::vec(any::<u8>(), 0..64).prop_map(Value::Bytes),
+        Just(Value::Null),
+    ]
+    .prop_recursive(6, 128, 12, |inner| {
+        prop_oneof![
+            collection::vec(inner.clone(), 0..12).prop_map(Value::Array),
+            collection::btree_map("[a-zA-Z0-9]{0,16}", inner, 0..8).prop_map(|map| Value::Map(
+                map.into_iter()
+                    .map(|(key, value)| (Value::Text(key), value))
+                    .collect()
+            )),
+        ]
+    })
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+
+    #[test]
+    fn test_should_round_trip_bounded_nested_profile_values(value in profile_values()) {
+        let encoded = encode(&value);
+        prop_assert!(encoded.is_ok());
+        if let Ok(bytes) = encoded {
+            let mut original = Vec::new();
+            let original_result = ciborium::into_writer(&value, &mut original);
+            prop_assert!(original_result.is_ok());
+            prop_assert_eq!(bytes.as_slice(), original.as_slice());
+            let decoded = decode::<Value>(&bytes);
+            prop_assert!(decoded.is_ok());
+            if let Ok(decoded) = decoded {
+                prop_assert_eq!(decoded, value);
+            }
+        }
+    }
+
+    #[test]
+    fn test_should_never_deserialize_rejected_arbitrary_bytes(bytes in collection::vec(any::<u8>(), 0..4096)) {
+        let rejected = Scan::validate(&bytes, LIMITS).is_err();
+        VISITS.set(0);
+        let _result = decode::<Sentinel>(&bytes);
+        if rejected {
+            prop_assert_eq!(VISITS.get(), 0);
+        }
+    }
+}
diff --git a/apps/rustack/src/snapshot/fixtures/legacy-v2-meta-provenance.json b/apps/rustack/src/snapshot/fixtures/legacy-v2-meta-provenance.json
new file mode 100644
index 00000000..cc60bc38
--- /dev/null
+++ b/apps/rustack/src/snapshot/fixtures/legacy-v2-meta-provenance.json
@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 1,
+  "fixture": "legacy-v2-meta.ss.zst",
+  "sha256": "fdc3d7c32dc2d84cd8bc5590bce9d1e894b680380ce54aef686df0f71ebcd870",
+  "generatedWith": {
+    "zstd": "0.13.3",
+    "zstd-safe": "7.3.0",
+    "zstd-sys": "2.1.0+zstd.1.5.7",
+    "compressionLevel": 1
+  },
+  "archive": {
+    "magicHex": "5253534e41500002",
+    "kind": 2,
+    "flags": 0,
+    "headerBytes": 36,
+    "fileBytes": 88,
+    "section": {
+      "kind": 1,
+      "flags": 0,
+      "offset": 64,
+      "length": 12,
+      "rows": 7,
+      "data": "legacy-state"
+    },
+    "footer": "IEEE CRC32 and little-endian payload length"
+  },
+  "generation": "Generated before dependency migration using the original resolved Cargo.lock codec cohort; no credentials or business payloads."
+}
diff --git a/apps/rustack/src/snapshot/fixtures/legacy-v2-meta.ss.zst b/apps/rustack/src/snapshot/fixtures/legacy-v2-meta.ss.zst
new file mode 100644
index 00000000..8e7818fd
Binary files /dev/null and b/apps/rustack/src/snapshot/fixtures/legacy-v2-meta.ss.zst differ
diff --git a/apps/rustack/src/snapshot/image_tests.rs b/apps/rustack/src/snapshot/image_tests.rs
new file mode 100644
index 00000000..4bf0f2f7
--- /dev/null
+++ b/apps/rustack/src/snapshot/image_tests.rs
@@ -0,0 +1,233 @@
+//! Image export budget failures must preserve both existing archive generations.
+
+use std::io::{Cursor, Write};
+
+use anyhow::ensure;
+use async_trait::async_trait;
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rustack_lambda_core::{
+    artifact::Architecture,
+    config::LambdaConfig,
+    executor::{Executor, ExecutorBackend, ExecutorError, InvokeRequest, InvokeResponse},
+    invocation::InvocationContext,
+    storage::{LayerRecord, LayerStoreSnapshot, PolicyStatement},
+};
+use rustack_lambda_model::{
+    input::{CreateFunctionInput, PublishVersionInput},
+    types::FunctionCode,
+};
+use zip::{ZipWriter, write::SimpleFileOptions};
+
+use super::*;
+
+#[derive(Debug)]
+struct MetadataOnlyExecutor;
+#[async_trait]
+impl Executor for MetadataOnlyExecutor {
+    fn image_available(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+    fn available(&self, _: &InvokeRequest) -> Result<(), ExecutorError> {
+        Err(ExecutorError::Unsupported("metadata-only fixture".into()))
+    }
+    async fn invoke(
+        &self,
+        _: InvokeRequest,
+        _: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        Err(ExecutorError::Unsupported("metadata-only fixture".into()))
+    }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+}
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_preserve_generations_when_live_image_metadata_cannot_be_exported(
+    #[case] deep: bool,
+) -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = SnapshotConfig {
+        root: directory.path().to_owned(),
+        name: SnapshotName::try_from("image-export".to_owned())?,
+    };
+    config.save(&RuntimeProviders::default(), "good").await?;
+    let previous = directory.path().join(".image-export.previous");
+    fs::create_dir_all(&previous).await?;
+    let original = fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?;
+    fs::write(previous.join(MANIFEST_FILE), &original).await?;
+    let provider = Arc::new(RustackLambda::with_executor(
+        rustack_lambda_core::storage::FunctionStore::new(directory.path().join("code")),
+        LambdaConfig {
+            executor: ExecutorBackend::Docker,
+            ..LambdaConfig::default()
+        },
+        Arc::new(MetadataOnlyExecutor),
+    ));
+    let mut layer: LayerRecord = serde_json::from_value(
+        serde_json::json!({"name":"bad","layerArn":"arn:aws:lambda:us-east-1:000000000000:layer:bad","nextVersion":2,
+        "versions":{"1":{"version":1,"description":"","compatibleRuntimes":[],"compatibleArchitectures":[],"licenseInfo":null,"codeSha256":"unused","codeSize":0,"createdDate":"2026-10-27T00:00:00Z","layerArn":"arn:aws:lambda:us-east-1:000000000000:layer:bad","layerVersionArn":"arn:aws:lambda:us-east-1:000000000000:layer:bad:1","policy":{"statements":[]}}}}),
+    )?;
+    let version = layer
+        .versions
+        .get_mut(&1)
+        .context("layer fixture version")?;
+    if deep {
+        let mut condition = serde_json::Value::Null;
+        for _ in 0..50_000 {
+            condition = serde_json::Value::Array(vec![condition]);
+        }
+        version.policy.statements.push(PolicyStatement {
+            sid: "deep".into(),
+            effect: "Allow".into(),
+            principal: "*".into(),
+            action: "lambda:GetLayerVersion".into(),
+            resource: "*".into(),
+            condition: Some(condition),
+        });
+    } else {
+        version.description = "x".repeat(20 * 1024 * 1024);
+    }
+    provider.layer_store().import_snapshot(LayerStoreSnapshot {
+        layers: vec![layer],
+    });
+    let mut providers = RuntimeProviders::default();
+    providers.register_lambda(provider);
+    let error = config
+        .save(&providers, "bad")
+        .await
+        .err()
+        .context("accepted oversized/deep live Image export")?;
+    assert!(format!("{error:#}").contains("Invalid or oversized Docker archive metadata"));
+    assert_eq!(
+        fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?,
+        original
+    );
+    assert_eq!(fs::read(previous.join(MANIFEST_FILE)).await?, original);
+    Ok(())
+}
+
+#[derive(Debug)]
+struct ManagedZipMetadataExecutor;
+#[async_trait]
+impl Executor for ManagedZipMetadataExecutor {
+    fn image_available(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+    fn docker_zip_architecture(&self) -> Option<Architecture> {
+        Some(Architecture::Arm64)
+    }
+    fn zip_available(&self, architecture: Architecture) -> Result<(), ExecutorError> {
+        if architecture == Architecture::Arm64 {
+            Ok(())
+        } else {
+            Err(ExecutorError::Unsupported(
+                "controlled ZIP architecture".into(),
+            ))
+        }
+    }
+    async fn invoke(
+        &self,
+        _: InvokeRequest,
+        _: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        Err(ExecutorError::Unsupported("snapshot-only fixture".into()))
+    }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+}
+fn deep_tree_zip() -> Result<String> {
+    let mut elf = vec![0_u8; 64];
+    elf.get_mut(..7)
+        .context("ELF prefix")?
+        .copy_from_slice(b"\x7fELF\x02\x01\x01");
+    elf.get_mut(16..18)
+        .context("ELF type")?
+        .copy_from_slice(&2_u16.to_le_bytes());
+    elf.get_mut(18..20)
+        .context("ELF architecture")?
+        .copy_from_slice(&183_u16.to_le_bytes());
+    elf.get_mut(20..24)
+        .context("ELF version")?
+        .copy_from_slice(&1_u32.to_le_bytes());
+    elf.get_mut(52..54)
+        .context("ELF header")?
+        .copy_from_slice(&64_u16.to_le_bytes());
+    let mut zip = ZipWriter::new(Cursor::new(Vec::new()));
+    zip.start_file(
+        "bootstrap",
+        SimpleFileOptions::default().unix_permissions(0o755),
+    )?;
+    zip.write_all(&elf)?;
+    for branch in 0..16 {
+        let path = format!("branch{branch}/{}/payload", vec!["d"; 32].join("/"));
+        zip.start_file(path, SimpleFileOptions::default())?;
+    }
+    Ok(STANDARD.encode(zip.finish()?.into_inner()))
+}
+#[tokio::test]
+async fn test_should_preserve_both_generations_when_shared_zip_revisions_exceed_restore_node_budget()
+-> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = SnapshotConfig {
+        root: directory.path().to_owned(),
+        name: SnapshotName::try_from("zip-export".to_owned())?,
+    };
+    config.save(&RuntimeProviders::default(), "good").await?;
+    let previous = directory.path().join(".zip-export.previous");
+    fs::create_dir_all(&previous).await?;
+    let original = fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?;
+    fs::write(previous.join(MANIFEST_FILE), &original).await?;
+    let provider = Arc::new(RustackLambda::with_executor(
+        rustack_lambda_core::storage::FunctionStore::new(directory.path().join("code")),
+        LambdaConfig {
+            executor: ExecutorBackend::Docker,
+            ..Default::default()
+        },
+        Arc::new(ManagedZipMetadataExecutor),
+    ));
+    provider
+        .create_function(CreateFunctionInput {
+            function_name: "bounded-zip".into(),
+            runtime: Some("provided.al2023".into()),
+            handler: Some("handler.entry".into()),
+            role: "arn:aws:iam::000000000000:role/test".into(),
+            architectures: Some(vec!["arm64".into()]),
+            code: FunctionCode {
+                zip_file: Some(deep_tree_zip()?),
+                ..Default::default()
+            },
+            ..Default::default()
+        })
+        .await?;
+    // Original artifact ownership is shared; each saved revision still charges nodes.
+    for _ in 0..39 {
+        provider.publish_version("bounded-zip", &PublishVersionInput::default())?;
+    }
+    let mut providers = RuntimeProviders::default();
+    providers.register_lambda(provider.clone());
+    let error = config
+        .save(&providers, "over-profile")
+        .await
+        .err()
+        .context("accepted unrestorable ZIP generation")?;
+    ensure!(
+        format!("{error:#}").contains("Invalid or oversized Docker ZIP archive candidate"),
+        "wrong producer guard rejected ZIP archive"
+    );
+    ensure!(
+        fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await? == original,
+        "current generation replaced"
+    );
+    ensure!(
+        fs::read(previous.join(MANIFEST_FILE)).await? == original,
+        "previous generation replaced"
+    );
+    provider
+        .shutdown_before(Deadline::now() + Duration::from_secs(10))
+        .await?;
+    Ok(())
+}
diff --git a/apps/rustack/src/snapshot/lease.rs b/apps/rustack/src/snapshot/lease.rs
new file mode 100644
index 00000000..259730c9
--- /dev/null
+++ b/apps/rustack/src/snapshot/lease.rs
@@ -0,0 +1,123 @@
+//! Unique retained OS-lease acquisition survives observing timeout/drop.
+
+#[cfg(unix)]
+use std::os::unix::fs::OpenOptionsExt;
+use std::{io::ErrorKind, mem, sync::Arc};
+
+use anyhow::{Context, Result, bail};
+#[cfg(unix)]
+use nix::fcntl::OFlag;
+#[cfg(test)]
+use tokio::time::Duration;
+use tokio::{
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+
+use super::{SnapshotConfig, SnapshotLease, task::Failure, worker::WorkerFailure};
+
+#[derive(Debug)]
+pub(crate) struct LeaseAcquisition {
+    join: Option<JoinHandle<Result<SnapshotLease>>>,
+    result: Option<Result<Arc<SnapshotLease>, Failure>>,
+}
+impl SnapshotConfig {
+    /// Start the same blocking acquisition once; keep its owner above timeouts.
+    pub(crate) fn begin_lease(&self) -> LeaseAcquisition {
+        self.begin_owned_lease(
+            #[cfg(test)]
+            None,
+        )
+    }
+    #[allow(clippy::disallowed_types, clippy::disallowed_methods)] // Existing lease std-IO boundary; Tokio has no advisory lock equivalent.
+    fn begin_owned_lease(&self, #[cfg(test)] gate: Option<Arc<tests::Gate>>) -> LeaseAcquisition {
+        let root = self.root.clone();
+        let name = self.name.as_str().to_owned();
+        let join = tokio::task::spawn_blocking(move || {
+            #[cfg(test)]
+            if let Some(gate) = &gate {
+                gate.enter();
+            }
+            std::fs::create_dir_all(&root).context("create snapshot root for lease")?;
+            let path = root.join(format!(".{name}.lock"));
+            match std::fs::symlink_metadata(&path) {
+                Ok(metadata) if !metadata.file_type().is_file() => {
+                    bail!("snapshot lock must be a regular file")
+                }
+                Ok(_) => {}
+                Err(error) if error.kind() == ErrorKind::NotFound => {}
+                Err(error) => return Err(error).context("inspect snapshot lease path"),
+            }
+            let mut options = std::fs::OpenOptions::new();
+            options.create(true).truncate(false).read(true).write(true);
+            #[cfg(unix)]
+            {
+                options.custom_flags((OFlag::O_NONBLOCK | OFlag::O_NOFOLLOW).bits());
+            }
+            let file = options.open(&path).context("open snapshot lease")?;
+            if !file
+                .metadata()
+                .context("inspect opened snapshot lease")?
+                .is_file()
+            {
+                bail!("snapshot lock must be a regular file");
+            }
+            file.try_lock()
+                .context("snapshot is already owned by another runtime")?;
+            Ok(SnapshotLease { _file: file })
+        });
+        LeaseAcquisition {
+            join: Some(join),
+            result: None,
+        }
+    }
+    #[cfg(test)]
+    pub(crate) async fn acquire_lease(&self) -> Result<Arc<SnapshotLease>> {
+        self.begin_lease()
+            .wait(Instant::now() + Duration::from_secs(5))
+            .await
+    }
+}
+impl LeaseAcquisition {
+    pub(super) fn quarantine(&mut self) {
+        if let Some(join) = self.join.take() {
+            mem::forget(join);
+        }
+        if let Some(Ok(lease)) = self.result.take() {
+            lease.quarantine();
+        }
+    }
+    pub(crate) async fn wait(&mut self, deadline: Instant) -> Result<Arc<SnapshotLease>> {
+        if let Some(join) = &mut self.join {
+            let result = timeout_at(deadline, join)
+                .await
+                .context("snapshot lease acquisition observation expired")?;
+            self.join = None;
+            let result = result
+                .map_err(WorkerFailure::new)
+                .map_err(anyhow::Error::from)
+                .and_then(|result| result);
+            self.result = Some(result.map(Arc::new).map_err(Failure::new));
+            if Instant::now() >= deadline {
+                bail!("snapshot lease acquisition observation expired");
+            }
+        }
+        match &self.result {
+            Some(Ok(lease)) => Ok(lease.clone()),
+            Some(Err(error)) => Err(error.clone().into()),
+            None => bail!("snapshot lease acquisition result missing"),
+        }
+    }
+}
+impl Drop for LeaseAcquisition {
+    fn drop(&mut self) {
+        // At most one pending lock acquisition exists in main. A lost owner is
+        // not proof that its late-acquired OS lock is safe to release.
+        if let Some(join) = self.join.take() {
+            mem::forget(join);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/rustack/src/snapshot/lease/tests.rs b/apps/rustack/src/snapshot/lease/tests.rs
new file mode 100644
index 00000000..8edbdc58
--- /dev/null
+++ b/apps/rustack/src/snapshot/lease/tests.rs
@@ -0,0 +1,76 @@
+//! Both inner deadline expiry and a dropped observer keep the exact acquisition.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use tokio::{sync::Notify, time::timeout_at};
+
+use super::*;
+use crate::snapshot::SnapshotName;
+
+#[derive(Debug, Default)]
+pub(super) struct Gate {
+    entered: Notify,
+    released: AtomicBool,
+}
+impl Gate {
+    pub(super) fn enter(&self) {
+        self.entered.notify_one();
+        while !self.released.load(Ordering::Acquire) {
+            std::thread::park_timeout(Duration::from_millis(1));
+        }
+    }
+}
+#[derive(Debug)]
+struct Release(Arc<Gate>);
+impl Drop for Release {
+    fn drop(&mut self) {
+        self.0.released.store(true, Ordering::Release);
+    }
+}
+#[tokio::test]
+async fn test_should_retain_delayed_lease_acquisition_after_timeout_or_observer_drop() -> Result<()>
+{
+    for inner_deadline in [false, true] {
+        let directory = tempfile::tempdir()?;
+        let config = SnapshotConfig {
+            root: directory.path().to_owned(),
+            name: SnapshotName::try_from("lease".to_owned())?,
+        };
+        let gate = Arc::new(Gate::default());
+        let release = Release(gate.clone());
+        let mut acquisition = config.begin_owned_lease(Some(gate.clone()));
+        timeout_at(
+            Instant::now() + Duration::from_secs(2),
+            gate.entered.notified(),
+        )
+        .await?;
+        let short = Instant::now() + Duration::from_millis(5);
+        if inner_deadline {
+            assert!(acquisition.wait(short).await.is_err());
+        } else {
+            assert!(
+                timeout_at(
+                    short,
+                    acquisition.wait(Instant::now() + Duration::from_secs(2))
+                )
+                .await
+                .is_err()
+            );
+        }
+        assert!(
+            acquisition
+                .join
+                .as_ref()
+                .is_some_and(|join| !join.is_finished())
+        );
+        drop(release);
+        let lease = acquisition
+            .wait(Instant::now() + Duration::from_secs(2))
+            .await?;
+        assert!(config.acquire_lease().await.is_err());
+        drop(lease);
+        drop(acquisition);
+        let _next = config.acquire_lease().await?;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/src/snapshot/policy_tests.rs b/apps/rustack/src/snapshot/policy_tests.rs
new file mode 100644
index 00000000..c3522c6c
--- /dev/null
+++ b/apps/rustack/src/snapshot/policy_tests.rs
@@ -0,0 +1,74 @@
+//! A configured limit is not evidence of corruption of a committed generation.
+
+use super::*;
+
+async fn generation(root: &Path, directory: &str, version: &str, bytes: usize) -> Result<PathBuf> {
+    let target = root.join(directory);
+    let meta = target.join("services/limited/meta.ss.zst");
+    let stats = write_archive(
+        &meta,
+        ArchiveKind::ServiceMeta,
+        vec![ArchiveSection::new(
+            SECTION_STATE_CBOR,
+            to_cbor(&"x".repeat(bytes))?,
+            1,
+        )],
+    )
+    .await?;
+    let mut manifest = SnapshotManifest::new("budget", version)?;
+    manifest.add_service(
+        "limited".into(),
+        SnapshotServiceManifest {
+            kind: SnapshotKind::Resource,
+            meta_file: "services/limited/meta.ss.zst".into(),
+            data_file: None,
+            meta: stats,
+            data: None,
+        },
+    );
+    write_manifest(&target.join(MANIFEST_FILE), &manifest).await?;
+    Ok(target)
+}
+#[tokio::test]
+async fn test_should_refuse_reduced_policy_without_replacing_valid_current_or_previous_generation()
+-> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let current = generation(directory.path(), "budget", "new", 4096).await?;
+    let previous = generation(directory.path(), ".budget.previous", "old", 1).await?;
+    let new_bytes = fs::read(current.join(MANIFEST_FILE)).await?;
+    let old_bytes = fs::read(previous.join(MANIFEST_FILE)).await?;
+    let error = recover_snapshot(
+        directory.path(),
+        &current,
+        "budget",
+        &BTreeMap::from([("limited", 4098)]),
+    )
+    .await
+    .err()
+    .context("accepted reduced budget")?;
+    assert!(error.is::<BudgetLimit>());
+    assert_eq!(fs::read(current.join(MANIFEST_FILE)).await?, new_bytes);
+    assert_eq!(fs::read(previous.join(MANIFEST_FILE)).await?, old_bytes);
+    recover_snapshot(
+        directory.path(),
+        &current,
+        "budget",
+        &BTreeMap::from([("limited", 8192)]),
+    )
+    .await?;
+    assert_eq!(
+        read_manifest(&current.join(MANIFEST_FILE))
+            .await?
+            .rustack_version,
+        "new"
+    );
+    assert!(fs::try_exists(&previous).await?);
+    SnapshotConfig {
+        root: directory.path().to_owned(),
+        name: SnapshotName::try_from("budget".to_owned())?,
+    }
+    .load(&RuntimeProviders::default())
+    .await?;
+    assert!(!fs::try_exists(previous).await?);
+    Ok(())
+}
diff --git a/apps/rustack/src/snapshot/session.rs b/apps/rustack/src/snapshot/session.rs
new file mode 100644
index 00000000..2c3a15d1
--- /dev/null
+++ b/apps/rustack/src/snapshot/session.rs
@@ -0,0 +1,129 @@
+//! Main keeps one session above all startup/save/final-cleanup observations.
+
+use std::fmt;
+
+use anyhow::{Result, bail};
+use tokio::time::Instant;
+
+use super::{RuntimeProviders, SnapshotConfig, SnapshotTask, lease::LeaseAcquisition};
+
+#[derive(Debug)]
+enum Operation {
+    Load(SnapshotTask),
+    Save(SnapshotTask),
+}
+impl Operation {
+    async fn wait(&mut self, deadline: Instant) -> Result<()> {
+        match self {
+            Self::Load(task) | Self::Save(task) => task.wait(deadline).await,
+        }
+    }
+}
+#[derive(Debug)]
+struct Named {
+    config: SnapshotConfig,
+    lease: LeaseAcquisition,
+    transaction: Option<Operation>,
+    loaded: bool,
+}
+pub(crate) struct SnapshotSession {
+    named: Option<Named>,
+}
+impl fmt::Debug for SnapshotSession {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SnapshotSession(<redacted>)")
+    }
+}
+impl SnapshotSession {
+    pub(crate) fn new(config: Option<SnapshotConfig>) -> Self {
+        Self {
+            named: config.map(|config| Named {
+                lease: config.begin_lease(),
+                config,
+                transaction: None,
+                loaded: false,
+            }),
+        }
+    }
+    pub(crate) async fn load(
+        &mut self,
+        providers: &RuntimeProviders,
+        deadline: Instant,
+    ) -> Result<()> {
+        let Some(named) = &mut self.named else {
+            return Ok(());
+        };
+        if named.loaded {
+            return Ok(());
+        }
+        let lease = named.lease.wait(deadline).await?;
+        if named.transaction.is_none() {
+            if Instant::now() >= deadline {
+                bail!("snapshot startup observation expired");
+            }
+            tracing::info!(coverage = ?providers.coverage(), "snapshot includes only declared state; other services and SQS messages are not persisted");
+            named.transaction = Some(Operation::Load(SnapshotTask::start(
+                named.config.clone(),
+                providers.clone(),
+                lease,
+                None,
+                deadline,
+            )));
+        }
+        match &mut named.transaction {
+            Some(Operation::Load(task)) => task.wait(deadline).await?,
+            _ => bail!("invalid snapshot startup transaction"),
+        }
+        named.loaded = true;
+        named.transaction = None;
+        Ok(())
+    }
+    pub(crate) async fn save(
+        &mut self,
+        providers: &RuntimeProviders,
+        version: &'static str,
+        deadline: Instant,
+    ) -> Result<()> {
+        let Some(named) = &mut self.named else {
+            return Ok(());
+        };
+        if !named.loaded {
+            bail!("cannot publish snapshot after failed startup");
+        }
+        let lease = named.lease.wait(deadline).await?;
+        if named.transaction.is_none() {
+            if Instant::now() >= deadline {
+                bail!("snapshot save observation expired");
+            }
+            named.transaction = Some(Operation::Save(SnapshotTask::start(
+                named.config.clone(),
+                providers.clone(),
+                lease,
+                Some(version),
+                deadline,
+            )));
+        }
+        match &mut named.transaction {
+            Some(Operation::Save(task)) => task.wait(deadline).await,
+            _ => bail!("invalid snapshot save transaction"),
+        }
+    }
+    pub(crate) async fn finish(&mut self, deadline: Instant) -> Result<()> {
+        let Some(named) = &mut self.named else {
+            return Ok(());
+        };
+        let lease = named.lease.wait(deadline).await;
+        if let Some(operation) = &mut named.transaction {
+            operation.wait(deadline).await?;
+        }
+        lease.map(|_| ())
+    }
+    pub(crate) fn quarantine(&mut self) {
+        if let Some(named) = &mut self.named {
+            named.lease.quarantine();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/rustack/src/snapshot/session/tests.rs b/apps/rustack/src/snapshot/session/tests.rs
new file mode 100644
index 00000000..a8ee6c98
--- /dev/null
+++ b/apps/rustack/src/snapshot/session/tests.rs
@@ -0,0 +1,65 @@
+//! One named session owns acquisition and never reissues accepted transactions.
+
+use tokio::{fs, time::Duration};
+
+use super::*;
+use crate::snapshot::{MANIFEST_FILE, SnapshotName, read_manifest};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+#[tokio::test]
+async fn test_should_retain_named_ownership_and_observe_the_same_publication() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = SnapshotConfig {
+        root: directory.path().to_owned(),
+        name: SnapshotName::try_from("session".to_owned())?,
+    };
+    let providers = RuntimeProviders::default();
+    let mut session = SnapshotSession::new(Some(config.clone()));
+    session.load(&providers, deadline()).await?;
+    session.load(&providers, deadline()).await?;
+    assert!(config.acquire_lease().await.is_err());
+    session.save(&providers, "original", deadline()).await?;
+    let original = fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?;
+    session
+        .save(&providers, "must-not-reissue", deadline())
+        .await?;
+    assert_eq!(
+        fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?,
+        original
+    );
+    assert_eq!(
+        read_manifest(&config.snapshot_dir().join(MANIFEST_FILE))
+            .await?
+            .rustack_version,
+        "original"
+    );
+    session.finish(deadline()).await?;
+    drop(session);
+    let _next = config.acquire_lease().await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_refuse_publication_after_failed_startup() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = SnapshotConfig {
+        root: directory.path().to_owned(),
+        name: SnapshotName::try_from("session".to_owned())?,
+    };
+    let providers = RuntimeProviders::default();
+    config.save(&providers, "old").await?;
+    let manifest = config.snapshot_dir().join(MANIFEST_FILE);
+    fs::write(&manifest, b"corrupt generation").await?;
+    let mut session = SnapshotSession::new(Some(config));
+    assert!(session.load(&providers, deadline()).await.is_err());
+    assert!(
+        session
+            .save(&providers, "invalid", deadline())
+            .await
+            .is_err()
+    );
+    assert_eq!(fs::read(&manifest).await?, b"corrupt generation");
+    assert!(session.finish(deadline()).await.is_err());
+    Ok(())
+}
diff --git a/apps/rustack/src/snapshot/task.rs b/apps/rustack/src/snapshot/task.rs
new file mode 100644
index 00000000..2958ab86
--- /dev/null
+++ b/apps/rustack/src/snapshot/task.rs
@@ -0,0 +1,121 @@
+//! An observing deadline never aborts the snapshot transaction or its IO joins.
+
+use std::{error::Error, fmt, mem, sync::Arc};
+
+use anyhow::{Context, Result};
+use tokio::{
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+
+use super::{RuntimeProviders, SnapshotConfig, SnapshotLease, worker::WorkerFailure};
+
+pub(crate) struct SnapshotTask {
+    join: Option<JoinHandle<Result<()>>>,
+    failure: Option<Failure>,
+}
+impl fmt::Debug for SnapshotTask {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SnapshotTask(<redacted>)")
+    }
+}
+#[derive(Clone)]
+pub(super) struct Failure(Arc<anyhow::Error>);
+impl Failure {
+    pub(super) fn new(error: anyhow::Error) -> Self {
+        Self(Arc::new(error))
+    }
+}
+impl fmt::Debug for Failure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl fmt::Display for Failure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("snapshot transaction failed")
+    }
+}
+impl Error for Failure {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        Some(self.0.as_ref().as_ref())
+    }
+}
+struct Guard {
+    lease: Option<Arc<SnapshotLease>>,
+    providers: Option<RuntimeProviders>,
+    finished: bool,
+}
+impl fmt::Debug for Guard {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SnapshotGuard(<redacted>)")
+    }
+}
+impl Drop for Guard {
+    fn drop(&mut self) {
+        if !self.finished {
+            // A panic/cancellation cannot prove sibling filesystem retirement.
+            if let Some(lease) = self.lease.take() {
+                mem::forget(lease);
+            }
+            if let Some(providers) = self.providers.take() {
+                mem::forget(providers);
+            }
+        }
+    }
+}
+impl SnapshotTask {
+    pub(crate) fn start(
+        config: SnapshotConfig,
+        providers: RuntimeProviders,
+        lease: Arc<SnapshotLease>,
+        version: Option<&'static str>,
+        deadline: Instant,
+    ) -> Self {
+        let join = tokio::spawn(async move {
+            let mut guard = Guard {
+                lease: Some(lease),
+                providers: Some(providers),
+                finished: false,
+            };
+            let providers = guard
+                .providers
+                .as_ref()
+                .context("snapshot transaction providers missing")?;
+            let result = match version {
+                Some(version) => config.save(providers, version).await,
+                None => config.load_before(providers, deadline).await,
+            };
+            guard.finished = true;
+            result
+        });
+        Self {
+            join: Some(join),
+            failure: None,
+        }
+    }
+    pub(crate) async fn wait(&mut self, deadline: Instant) -> Result<()> {
+        if let Some(join) = &mut self.join {
+            let result = timeout_at(deadline, join)
+                .await
+                .context("snapshot transaction observation expired")?;
+            self.join = None;
+            let result = result
+                .map_err(WorkerFailure::new)
+                .map_err(anyhow::Error::from)
+                .and_then(|result| result);
+            if let Err(error) = result {
+                self.failure = Some(Failure::new(error));
+            }
+            if Instant::now() >= deadline {
+                anyhow::bail!("snapshot transaction observation expired");
+            }
+        }
+        self.failure
+            .as_ref()
+            .map_or(Ok(()), |error| Err(error.clone().into()))
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/rustack/src/snapshot/task/tests.rs b/apps/rustack/src/snapshot/task/tests.rs
new file mode 100644
index 00000000..9a99339d
--- /dev/null
+++ b/apps/rustack/src/snapshot/task/tests.rs
@@ -0,0 +1,240 @@
+//! Retained transaction observation and complete sibling retirement on error.
+
+use std::path::Path;
+
+use async_trait::async_trait;
+use tokio::{
+    fs,
+    sync::{Notify, watch},
+    time::{Duration, advance, timeout},
+};
+
+use super::*;
+use crate::snapshot::{MANIFEST_FILE, SnapshotName, SnapshotService, to_cbor};
+
+#[derive(Debug)]
+struct GateService {
+    name: &'static str,
+    fail: bool,
+    entered: Arc<Notify>,
+    release: watch::Receiver<bool>,
+}
+impl GateService {
+    async fn hold(&self) -> Result<()> {
+        self.entered.notify_one();
+        let mut release = self.release.clone();
+        release
+            .wait_for(|ready| *ready)
+            .await
+            .context("test gate lost")?;
+        Ok(())
+    }
+}
+#[async_trait]
+impl SnapshotService for GateService {
+    fn service_name(&self) -> &'static str {
+        self.name
+    }
+    async fn save_meta(&self, _directory: &Path) -> Result<Vec<u8>> {
+        if self.fail {
+            anyhow::bail!("controlled service failure");
+        }
+        self.hold().await?;
+        to_cbor(&())
+    }
+    async fn load_meta(&self, _metadata: Vec<u8>, directory: &Path) -> Result<()> {
+        if self.fail {
+            anyhow::bail!("controlled service failure");
+        }
+        self.hold().await?;
+        anyhow::ensure!(
+            fs::metadata(directory).await?.is_dir(),
+            "staging removed before sibling retirement"
+        );
+        Ok(())
+    }
+}
+fn config(directory: &tempfile::TempDir) -> Result<SnapshotConfig> {
+    Ok(SnapshotConfig {
+        root: directory.path().to_owned(),
+        name: SnapshotName::try_from("transaction".to_owned())?,
+    })
+}
+#[tokio::test]
+async fn test_should_keep_transaction_and_named_lease_after_observer_expiry() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    let entered = Arc::new(Notify::new());
+    let (release, receiver) = watch::channel(false);
+    let providers = RuntimeProviders {
+        services: vec![Arc::new(GateService {
+            name: "owned",
+            fail: false,
+            entered: entered.clone(),
+            release: receiver,
+        })],
+    };
+    let lease = config.acquire_lease().await?;
+    let mut task = SnapshotTask::start(
+        config.clone(),
+        providers,
+        lease,
+        Some("test"),
+        Instant::now() + Duration::from_secs(30),
+    );
+    timeout(Duration::from_secs(2), entered.notified()).await?;
+    assert!(
+        task.wait(Instant::now() + Duration::from_millis(5))
+            .await
+            .is_err()
+    );
+    assert!(task.join.as_ref().is_some_and(|join| !join.is_finished()));
+    assert!(config.acquire_lease().await.is_err());
+    release.send_replace(true);
+    task.wait(Instant::now() + Duration::from_secs(5)).await?;
+    let _new = config.acquire_lease().await?;
+    Ok(())
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_cache_ready_completion_but_reject_first_late_observation() -> Result<()> {
+    let entered = Arc::new(Notify::new());
+    let signal = entered.clone();
+    let mut task = SnapshotTask {
+        join: Some(tokio::spawn(async move {
+            signal.notify_one();
+            Ok(())
+        })),
+        failure: None,
+    };
+    let deadline = Instant::now() + Duration::from_secs(1);
+    entered.notified().await;
+    assert!(task.join.as_ref().is_some_and(JoinHandle::is_finished));
+    advance(Duration::from_secs(2)).await;
+    assert!(task.wait(deadline).await.is_err());
+    assert!(task.join.is_none());
+    task.wait(Instant::now() + Duration::from_secs(1)).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_drain_started_load_and_save_siblings_before_returning_first_error()
+-> Result<()> {
+    for saving in [false, true] {
+        let directory = tempfile::tempdir()?;
+        let config = config(&directory)?;
+        let (ready, receiver) = watch::channel(true);
+        let original = RuntimeProviders {
+            services: ["broken", "slow"]
+                .into_iter()
+                .map(|name| {
+                    Arc::new(GateService {
+                        name,
+                        fail: false,
+                        entered: Arc::new(Notify::new()),
+                        release: receiver.clone(),
+                    }) as Arc<dyn SnapshotService>
+                })
+                .collect(),
+        };
+        config.save(&original, "old").await?;
+        let original_manifest = fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?;
+        let entered = Arc::new(Notify::new());
+        let (release, receiver) = watch::channel(false);
+        let replacement = RuntimeProviders {
+            services: vec![
+                Arc::new(GateService {
+                    name: "broken",
+                    fail: true,
+                    entered: Arc::new(Notify::new()),
+                    release: receiver.clone(),
+                }),
+                Arc::new(GateService {
+                    name: "slow",
+                    fail: false,
+                    entered: entered.clone(),
+                    release: receiver,
+                }),
+            ],
+        };
+        let requested = config.clone();
+        let mut task = tokio::spawn(async move {
+            if saving {
+                requested.save(&replacement, "invalid").await
+            } else {
+                requested.load(&replacement).await
+            }
+        });
+        timeout(Duration::from_secs(2), entered.notified()).await?;
+        assert!(timeout(Duration::from_millis(5), &mut task).await.is_err());
+        assert!(!task.is_finished(), "returned before sibling retirement");
+        release.send_replace(true);
+        assert!(timeout(Duration::from_secs(5), task).await??.is_err());
+        assert_eq!(
+            fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?,
+            original_manifest
+        );
+        drop(ready);
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_join_expired_domain_import_without_retiring_previous_generation() -> Result<()>
+{
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    let (_, ready) = watch::channel(true);
+    let source = RuntimeProviders {
+        services: vec![Arc::new(GateService {
+            name: "owned",
+            fail: false,
+            entered: Arc::new(Notify::new()),
+            release: ready,
+        })],
+    };
+    config.save(&source, "current").await?;
+    let previous = directory.path().join(".transaction.previous");
+    fs::create_dir_all(previous.join("services/owned")).await?;
+    let files = [MANIFEST_FILE, "services/owned/meta.ss.zst"];
+    let mut original = Vec::new();
+    for file in files {
+        let bytes = fs::read(config.snapshot_dir().join(file)).await?;
+        fs::write(previous.join(file), &bytes).await?;
+        original.push(bytes);
+    }
+    let entered = Arc::new(Notify::new());
+    let (release, wait) = watch::channel(false);
+    let target = RuntimeProviders {
+        services: vec![Arc::new(GateService {
+            name: "owned",
+            fail: false,
+            entered: entered.clone(),
+            release: wait,
+        })],
+    };
+    let lease = config.acquire_lease().await?;
+    let deadline = Instant::now() + Duration::from_secs(3600);
+    let mut task = SnapshotTask::start(config.clone(), target, lease, None, deadline);
+    timeout(Duration::from_secs(10), entered.notified()).await?;
+    // Advance only after positive import entry, then resume real IO observation.
+    tokio::time::pause();
+    advance(Duration::from_secs(3601)).await;
+    tokio::time::resume();
+    assert!(task.wait(Instant::now()).await.is_err());
+    assert!(task.join.is_some());
+    release.send_replace(true);
+    assert!(
+        task.wait(Instant::now() + Duration::from_secs(10))
+            .await
+            .is_err()
+    );
+    assert!(
+        task.join.is_none(),
+        "transaction must join rather than merely expire its observer"
+    );
+    assert!(task.failure.is_some());
+    for (file, bytes) in files.into_iter().zip(original) {
+        assert_eq!(fs::read(config.snapshot_dir().join(file)).await?, bytes);
+        assert_eq!(fs::read(previous.join(file)).await?, bytes);
+    }
+    Ok(())
+}
diff --git a/apps/rustack/src/snapshot/worker.rs b/apps/rustack/src/snapshot/worker.rs
new file mode 100644
index 00000000..6e983a8c
--- /dev/null
+++ b/apps/rustack/src/snapshot/worker.rs
@@ -0,0 +1,77 @@
+//! Retain typed worker evidence without displaying potentially secret panic text.
+
+use std::{error::Error, fmt};
+
+use tokio::task::JoinError;
+
+pub(super) struct WorkerFailure {
+    source: JoinError,
+}
+impl WorkerFailure {
+    pub(super) fn new(source: JoinError) -> Self {
+        Self { source }
+    }
+    /// Explicit typed inspection; raw `JoinError` Display must not reach diagnostics.
+    pub(super) fn join_error(&self) -> &JoinError {
+        &self.source
+    }
+}
+impl fmt::Debug for WorkerFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl fmt::Display for WorkerFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(if self.join_error().is_panic() {
+            "snapshot worker panicked"
+        } else {
+            "snapshot worker cancelled"
+        })
+    }
+}
+// The original is retained for explicit typed inspection. Chaining it would leak
+// JoinError's panic payload through main's formatted anyhow diagnostic chain.
+impl Error for WorkerFailure {}
+
+#[cfg(test)]
+mod tests {
+    use std::future::pending;
+
+    use anyhow::{Context, Result};
+
+    use super::*;
+
+    fn panic_source() {
+        panic!("private-panic-payload");
+    }
+    #[tokio::test]
+    async fn test_should_retain_panic_and_cancellation_without_exposing_panic_text() -> Result<()> {
+        for panic in [false, true] {
+            let task = tokio::spawn(async move {
+                if panic {
+                    panic_source();
+                } else {
+                    pending::<()>().await;
+                }
+            });
+            if !panic {
+                task.abort();
+            }
+            let original = task.await.err().context("missing controlled failure")?;
+            let failure = WorkerFailure::new(original);
+            assert_eq!(failure.join_error().is_panic(), panic);
+            assert_eq!(failure.join_error().is_cancelled(), !panic);
+            let error = anyhow::Error::new(failure).context("outer archive owner");
+            for diagnostic in [
+                format!("{error}"),
+                format!("{error:#}"),
+                format!("{error:?}"),
+            ] {
+                assert!(!diagnostic.contains("private-panic-payload"));
+            }
+            assert!(error.downcast_ref::<WorkerFailure>().is_some());
+        }
+        Ok(())
+    }
+}
diff --git a/apps/rustack/src/snapshot/workflows.rs b/apps/rustack/src/snapshot/workflows.rs
new file mode 100644
index 00000000..c8d8dd05
--- /dev/null
+++ b/apps/rustack/src/snapshot/workflows.rs
@@ -0,0 +1,287 @@
+//! One retained archive operation/CPU/IO lane above observer cancellation.
+
+use std::{
+    error::Error,
+    fmt, mem,
+    path::{Path, PathBuf},
+    sync::Arc,
+    time::Duration,
+};
+
+use anyhow::{Context, Result, bail};
+use async_trait::async_trait;
+use rustack_stepfunctions_core::{
+    PreparedSnapshot, Registry, RegistryError, RegistryReceipt, RegistryResult, RegistrySnapshot,
+    SnapshotLimits,
+};
+use tokio::{
+    sync::{OwnedSemaphorePermit, Semaphore, mpsc, oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+
+use super::{
+    SnapshotKind, SnapshotService,
+    archive::{read_file_bounded, to_cbor_bounded},
+    decode_state,
+    worker::WorkerFailure,
+};
+
+mod io;
+mod owner;
+
+const HISTORY_FILE: &str = "history.cbor";
+
+#[derive(Clone)]
+pub(crate) struct WorkflowArchive {
+    sender: mpsc::Sender<Envelope>,
+    capacity: Arc<Semaphore>,
+    closing: watch::Sender<bool>,
+    ready: watch::Receiver<bool>,
+    bytes: usize,
+    io_budget: Duration,
+}
+impl fmt::Debug for WorkflowArchive {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("WorkflowArchive(<redacted>)")
+    }
+}
+#[derive(Debug)]
+pub(crate) struct ArchiveSupervisor {
+    closing: watch::Sender<bool>,
+    join: Option<JoinHandle<Result<()>>>,
+    failure: Option<Failure>,
+}
+#[derive(Clone)]
+struct Failure(Arc<anyhow::Error>);
+impl fmt::Debug for Failure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl fmt::Display for Failure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("workflow archive owner failed")
+    }
+}
+impl Error for Failure {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        Some(self.0.as_ref().as_ref())
+    }
+}
+enum Command {
+    Save(PathBuf),
+    Load(Vec<u8>, PathBuf),
+}
+impl fmt::Debug for Command {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ArchiveCommand(<redacted>)")
+    }
+}
+#[derive(Debug)]
+struct Envelope {
+    command: Option<Command>,
+    deadline: Instant,
+    reply: oneshot::Sender<Result<Reply>>,
+    permit: OwnedSemaphorePermit,
+}
+struct Reply {
+    bytes: Vec<u8>,
+    _permit: OwnedSemaphorePermit,
+}
+impl fmt::Debug for Reply {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ArchiveReply(<redacted>)")
+    }
+}
+enum Materialized {
+    Saved { metadata: Vec<u8>, history: Vec<u8> },
+    Prepared(PreparedSnapshot),
+}
+impl fmt::Debug for Materialized {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ArchiveMaterialized(<redacted>)")
+    }
+}
+#[derive(Debug)]
+struct Owner {
+    registry: Registry,
+    bytes: usize,
+    inbox: mpsc::Receiver<Envelope>,
+    closing: watch::Sender<bool>,
+    ready: watch::Sender<bool>,
+    active: Option<Envelope>,
+    cpu: Option<JoinHandle<Result<Materialized>>>,
+    io: Option<JoinHandle<Result<io::Output>>>,
+    receipt: Option<RegistryReceipt>,
+    fatal: bool,
+    #[cfg(test)]
+    hooks: Option<Arc<tests::Hooks>>,
+}
+
+impl WorkflowArchive {
+    pub(crate) fn new(
+        registry: Registry,
+        bytes: usize,
+        io_budget: Duration,
+    ) -> Result<(Self, ArchiveSupervisor)> {
+        Self::new_owned(
+            registry,
+            bytes,
+            io_budget,
+            #[cfg(test)]
+            None,
+        )
+    }
+    fn new_owned(
+        registry: Registry,
+        bytes: usize,
+        io_budget: Duration,
+        #[cfg(test)] hooks: Option<Arc<tests::Hooks>>,
+    ) -> Result<(Self, ArchiveSupervisor)> {
+        SnapshotLimits::try_from(bytes)?;
+        if io_budget.is_zero() {
+            bail!("invalid workflow archive IO deadline");
+        }
+        let (sender, inbox) = mpsc::channel(1);
+        let (closing, _) = watch::channel(false);
+        let (ready, status) = watch::channel(true);
+        let owner = Owner {
+            registry,
+            bytes,
+            inbox,
+            closing: closing.clone(),
+            ready,
+            active: None,
+            cpu: None,
+            io: None,
+            receipt: None,
+            fatal: false,
+            #[cfg(test)]
+            hooks,
+        };
+        let join = tokio::spawn(owner.run());
+        Ok((
+            Self {
+                sender,
+                capacity: Arc::new(Semaphore::new(1)),
+                closing: closing.clone(),
+                ready: status,
+                bytes,
+                io_budget,
+            },
+            ArchiveSupervisor {
+                closing,
+                join: Some(join),
+                failure: None,
+            },
+        ))
+    }
+    pub(crate) fn is_ready(&self) -> bool {
+        !*self.closing.borrow() && *self.ready.borrow()
+    }
+    async fn execute(&self, command: Command) -> Result<Vec<u8>> {
+        if !self.is_ready() {
+            bail!("workflow archive owner unavailable");
+        }
+        let permit = self
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .context("workflow archive capacity exhausted")?;
+        let deadline = Instant::now()
+            .checked_add(self.io_budget)
+            .context("workflow archive deadline overflow")?;
+        let (reply, receipt) = oneshot::channel();
+        self.sender
+            .try_send(Envelope {
+                command: Some(command),
+                deadline,
+                reply,
+                permit,
+            })
+            .map_err(|_| anyhow::anyhow!("workflow archive admission unavailable"))?;
+        let response = receipt
+            .await
+            .context("workflow archive reply owner lost")??;
+        Ok(response.bytes)
+    }
+}
+impl ArchiveSupervisor {
+    pub(crate) fn close(&self) {
+        self.closing.send_replace(true);
+    }
+    pub(crate) async fn shutdown(&mut self, deadline: Instant) -> Result<()> {
+        self.close();
+        if let Some(join) = &mut self.join {
+            let result = timeout_at(deadline, join)
+                .await
+                .context("workflow archive shutdown observation expired")?;
+            self.join = None;
+            let result = result
+                .map_err(WorkerFailure::new)
+                .map_err(anyhow::Error::from)
+                .and_then(|result| result);
+            if let Err(error) = result {
+                self.failure = Some(Failure(Arc::new(error)));
+            }
+        }
+        self.failure
+            .as_ref()
+            .map_or(Ok(()), |error| Err(error.clone().into()))
+    }
+}
+impl Drop for ArchiveSupervisor {
+    fn drop(&mut self) {
+        // The retained root keeps accepted CPU/IO/commit work until joined completion.
+        self.close();
+    }
+}
+
+#[async_trait]
+impl SnapshotService for WorkflowArchive {
+    fn service_name(&self) -> &'static str {
+        "stepfunctions"
+    }
+    fn snapshot_kind(&self) -> SnapshotKind {
+        SnapshotKind::Data
+    }
+    fn payload_limit(&self) -> Option<usize> {
+        Some(self.bytes)
+    }
+    fn data_file(&self) -> Option<&'static str> {
+        Some(HISTORY_FILE)
+    }
+    async fn save_meta(&self, staging: &Path) -> Result<Vec<u8>> {
+        self.execute(Command::Save(staging.to_owned())).await
+    }
+    async fn load_meta(&self, metadata: Vec<u8>, staging: &Path) -> Result<()> {
+        self.execute(Command::Load(metadata, staging.to_owned()))
+            .await?;
+        Ok(())
+    }
+}
+impl Drop for Owner {
+    fn drop(&mut self) {
+        self.closing.send_replace(true);
+        self.ready.send_replace(false);
+        if self.active.is_some() {
+            // A root panic is not a cleanup receipt. Preserve the bounded job graph.
+            if let Some(cpu) = self.cpu.take() {
+                mem::forget(cpu);
+            }
+            if let Some(io) = self.io.take() {
+                mem::forget(io);
+            }
+            if let Some(receipt) = self.receipt.take() {
+                mem::forget(receipt);
+            }
+            if let Some(active) = self.active.take() {
+                mem::forget(active);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/rustack/src/snapshot/workflows/io.rs b/apps/rustack/src/snapshot/workflows/io.rs
new file mode 100644
index 00000000..e889033f
--- /dev/null
+++ b/apps/rustack/src/snapshot/workflows/io.rs
@@ -0,0 +1,59 @@
+//! Disk futures are retained in a joined task, including after observation expiry.
+
+use std::{
+    fmt,
+    path::{Path, PathBuf},
+};
+
+use anyhow::{Context, Result, bail};
+use tokio::fs;
+
+use super::{HISTORY_FILE, read_file_bounded};
+
+pub(super) enum Output {
+    History(Vec<u8>),
+    Written,
+}
+impl fmt::Debug for Output {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ArchiveIoOutput(<redacted>)")
+    }
+}
+async fn check(directory: &Path, required: bool) -> Result<()> {
+    let mut entries = fs::read_dir(directory)
+        .await
+        .context("read workflow archive staging directory")?;
+    let first = entries
+        .next_entry()
+        .await
+        .context("read workflow history entry")?;
+    match first {
+        Some(entry) => {
+            if entry.file_name() != HISTORY_FILE
+                || !entry.file_type().await?.is_file()
+                || entries.next_entry().await?.is_some()
+            {
+                bail!("invalid workflow history payload directory");
+            }
+        }
+        None if required => bail!("missing workflow history payload"),
+        None => {}
+    }
+    Ok(())
+}
+pub(super) async fn read(directory: PathBuf, bytes: usize) -> Result<Output> {
+    check(&directory, true).await?;
+    let history = read_file_bounded(
+        &directory.join(HISTORY_FILE),
+        u64::try_from(bytes).context("workflow archive byte overflow")?,
+    )
+    .await?;
+    Ok(Output::History(history))
+}
+pub(super) async fn write(directory: PathBuf, bytes: Vec<u8>) -> Result<Output> {
+    check(&directory, false).await?;
+    fs::write(directory.join(HISTORY_FILE), bytes)
+        .await
+        .context("write workflow history payload")?;
+    Ok(Output::Written)
+}
diff --git a/apps/rustack/src/snapshot/workflows/owner.rs b/apps/rustack/src/snapshot/workflows/owner.rs
new file mode 100644
index 00000000..494edd34
--- /dev/null
+++ b/apps/rustack/src/snapshot/workflows/owner.rs
@@ -0,0 +1,213 @@
+//! Retained CPU/IO and accepted registry commits outlive individual observers.
+
+use std::{future::Future, sync::Arc, time::Duration};
+
+use anyhow::{Context, Result, bail};
+use rustack_stepfunctions_core::{RegistryHistories, RegistryMetadata};
+use tokio::{
+    task::{spawn, spawn_blocking},
+    time::{Instant, timeout_at},
+};
+
+use super::{
+    Command, Failure, Materialized, Owner, RegistryError, RegistryResult, RegistrySnapshot, Reply,
+    SnapshotLimits, WorkerFailure, decode_state, io, to_cbor_bounded,
+};
+
+impl Owner {
+    pub(super) async fn run(mut self) -> Result<()> {
+        let mut closing = self.closing.subscribe();
+        loop {
+            if *closing.borrow() {
+                self.inbox.close();
+            }
+            let envelope = tokio::select! {
+                biased;
+                _ = closing.changed(), if !self.inbox.is_closed() => { self.inbox.close(); continue; }
+                envelope = self.inbox.recv() => envelope,
+            };
+            let Some(envelope) = envelope else {
+                break;
+            };
+            self.active = Some(envelope);
+            let result = self.process().await;
+            let (result, fatal) = if self.fatal {
+                let error = match result {
+                    Err(error) => error,
+                    Ok(_) => anyhow::anyhow!("workflow archive fatal-state invariant failed"),
+                };
+                let failure = Failure(Arc::new(error));
+                (Err(failure.clone().into()), Some(failure))
+            } else {
+                (result, None)
+            };
+            let envelope = self
+                .active
+                .take()
+                .context("workflow archive envelope lost")?;
+            let reply = result.map(|bytes| Reply {
+                bytes,
+                _permit: envelope.permit,
+            });
+            let _observed = envelope.reply.send(reply);
+            if let Some(failure) = fatal {
+                return Err(failure.into());
+            }
+        }
+        Ok(())
+    }
+    async fn process(&mut self) -> Result<Vec<u8>> {
+        let active = self
+            .active
+            .as_mut()
+            .context("workflow archive envelope missing")?;
+        let deadline = active.deadline;
+        let command = active
+            .command
+            .take()
+            .context("workflow archive command missing")?;
+        Self::check_deadline(deadline)?;
+        let registry = self.registry.clone();
+        let bytes = self.bytes;
+        match command {
+            Command::Save(directory) => {
+                #[cfg(test)]
+                let hooks = self.hooks.clone();
+                self.cpu = Some(spawn_blocking(move || {
+                    let document = registry.export_snapshot(SnapshotLimits::try_from(bytes)?)?;
+                    let (metadata, history) = document.into_archive_parts()?;
+                    let result = Ok(Materialized::Saved {
+                        metadata: to_cbor_bounded(&metadata, bytes)?,
+                        history: to_cbor_bounded(&history, bytes)?,
+                    });
+                    #[cfg(test)]
+                    if let Some(hooks) = hooks {
+                        hooks.cpu_wait();
+                    }
+                    result
+                }));
+                let Materialized::Saved { metadata, history } = self.join_cpu().await? else {
+                    bail!("invalid workflow archive save result");
+                };
+                Self::check_deadline(deadline)?;
+                self.start_io(io::write(directory, history));
+                if !matches!(self.join_io(deadline).await?, io::Output::Written) {
+                    bail!("invalid workflow archive write result");
+                }
+                Ok(metadata)
+            }
+            Command::Load(metadata, directory) => {
+                if metadata.len() > bytes {
+                    bail!("workflow archive metadata byte limit exceeded");
+                }
+                self.start_io(io::read(directory, bytes));
+                let io::Output::History(history) = self.join_io(deadline).await? else {
+                    bail!("invalid workflow archive read result");
+                };
+                Self::check_deadline(deadline)?;
+                #[cfg(test)]
+                let hooks = self.hooks.clone();
+                self.cpu = Some(spawn_blocking(move || {
+                    let metadata: RegistryMetadata = decode_state(&metadata)?;
+                    let history: RegistryHistories = decode_state(&history)?;
+                    let document = registry.prepare_snapshot(
+                        RegistrySnapshot::from_archive_parts(metadata, history)?,
+                        SnapshotLimits::try_from(bytes)?,
+                    )?;
+                    #[cfg(test)]
+                    if let Some(hooks) = hooks {
+                        hooks.cpu_wait();
+                    }
+                    Ok(Materialized::Prepared(document))
+                }));
+                let Materialized::Prepared(prepared) = self.join_cpu().await? else {
+                    bail!("invalid workflow archive prepare result");
+                };
+                Self::check_deadline(deadline)?;
+                self.receipt = Some(self.registry.restore_snapshot(prepared)?);
+                // Accepted commit ownership is independent of the command observer's deadline.
+                loop {
+                    let receipt = self
+                        .receipt
+                        .as_mut()
+                        .context("workflow archive restore receipt missing")?;
+                    match receipt.wait(Instant::now() + Duration::from_secs(1)).await {
+                        Err(RegistryError::Deadline) => {}
+                        Ok(RegistryResult::Restored) => {
+                            self.receipt = None;
+                            return Ok(Vec::new());
+                        }
+                        Ok(_) => {
+                            self.receipt = None;
+                            bail!("invalid workflow archive restore acknowledgement");
+                        }
+                        Err(error) => {
+                            self.receipt = None;
+                            return Err(error.into());
+                        }
+                    }
+                }
+            }
+        }
+    }
+    fn check_deadline(deadline: Instant) -> Result<()> {
+        if Instant::now() >= deadline {
+            bail!("workflow archive operation deadline exceeded");
+        }
+        Ok(())
+    }
+    fn start_io(&mut self, operation: impl Future<Output = Result<io::Output>> + Send + 'static) {
+        #[cfg(test)]
+        let task = {
+            let hooks = self.hooks.clone();
+            spawn(async move {
+                if let Some(hooks) = hooks {
+                    hooks.io_wait().await?;
+                }
+                operation.await
+            })
+        };
+        #[cfg(not(test))]
+        let task = spawn(operation);
+        self.io = Some(task);
+    }
+    async fn join_cpu(&mut self) -> Result<Materialized> {
+        let result = self
+            .cpu
+            .as_mut()
+            .context("workflow archive CPU join missing")?
+            .await;
+        self.cpu = None;
+        result.map_err(|error| {
+            self.fatal = true;
+            anyhow::Error::from(WorkerFailure::new(error))
+        })?
+    }
+    async fn join_io(&mut self, deadline: Instant) -> Result<io::Output> {
+        let task = self
+            .io
+            .as_mut()
+            .context("workflow archive IO join missing")?;
+        let (expired, result) = if let Ok(result) = timeout_at(deadline, &mut *task).await {
+            (false, result)
+        } else {
+            self.ready.send_replace(false);
+            (true, task.await)
+        };
+        self.io = None;
+        let result = result.map_err(|error| {
+            self.fatal = true;
+            anyhow::Error::from(WorkerFailure::new(error))
+        })?;
+        if expired {
+            self.ready.send_replace(true);
+            bail!("workflow archive IO observation expired");
+        }
+        let output = result?;
+        Self::check_deadline(deadline)?;
+        Ok(output)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/rustack/src/snapshot/workflows/owner/tests.rs b/apps/rustack/src/snapshot/workflows/owner/tests.rs
new file mode 100644
index 00000000..76fcef98
--- /dev/null
+++ b/apps/rustack/src/snapshot/workflows/owner/tests.rs
@@ -0,0 +1,105 @@
+//! Ready-before-timer ordering and retained typed worker failures.
+
+use std::sync::Arc;
+
+use rustack_stepfunctions_core::{
+    ExecutionLimits, ExecutionSupervisor, HistoryLimits, Registry, RegistryLimits,
+    RegistrySupervisor, RuntimeLimits, TenantScope,
+};
+use tokio::{
+    sync::{Notify, mpsc, watch},
+    task::JoinHandle,
+    time::advance,
+};
+
+use super::*;
+
+fn owner() -> Result<(Owner, RegistrySupervisor)> {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::new(25000, 1024 * 1024)?,
+        8 * 1024 * 1024,
+        None,
+    )?;
+    let (registry, supervisor) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+    )?;
+    let (_, inbox) = mpsc::channel(1);
+    let (closing, _) = watch::channel(false);
+    let (ready, _) = watch::channel(true);
+    Ok((
+        Owner {
+            registry,
+            bytes: 1024 * 1024,
+            inbox,
+            closing,
+            ready,
+            active: None,
+            cpu: None,
+            io: None,
+            receipt: None,
+            fatal: false,
+            hooks: None,
+        },
+        supervisor,
+    ))
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_ready_io_first_observed_after_absolute_deadline() -> Result<()> {
+    let (mut owner, mut registry) = owner()?;
+    let gate = Arc::new(Notify::new());
+    let signal = gate.clone();
+    owner.io = Some(tokio::spawn(async move {
+        signal.notify_one();
+        Ok(io::Output::Written)
+    }));
+    let deadline = Instant::now() + Duration::from_secs(1);
+    gate.notified().await;
+    assert!(owner.io.as_ref().is_some_and(JoinHandle::is_finished));
+    advance(Duration::from_secs(2)).await;
+    assert!(owner.join_io(deadline).await.is_err());
+    assert!(owner.io.is_none(), "physical task was not joined");
+    drop(owner);
+    registry
+        .shutdown(Instant::now() + Duration::from_secs(1))
+        .await?;
+    Ok(())
+}
+fn panic_source() -> Result<Materialized> {
+    panic!("private-cpu-payload");
+}
+fn panic_io() -> Result<io::Output> {
+    panic!("private-io-payload");
+}
+#[tokio::test]
+async fn test_should_retain_typed_cpu_and_io_failures() -> Result<()> {
+    for cpu in [false, true] {
+        let (mut owner, mut registry) = owner()?;
+        let result = if cpu {
+            owner.cpu = Some(spawn_blocking(panic_source));
+            owner.join_cpu().await.map(|_| ())
+        } else {
+            owner.io = Some(tokio::spawn(async { panic_io() }));
+            owner
+                .join_io(Instant::now() + Duration::from_secs(2))
+                .await
+                .map(|_| ())
+        };
+        let error = result.err().context("missing worker failure")?;
+        assert!(
+            error
+                .downcast_ref::<WorkerFailure>()
+                .is_some_and(|failure| failure.join_error().is_panic())
+        );
+        assert!(!format!("{error:#?}").contains("private-"));
+        assert!(owner.fatal);
+        drop(owner);
+        registry
+            .shutdown(Instant::now() + Duration::from_secs(2))
+            .await?;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/src/snapshot/workflows/tests.rs b/apps/rustack/src/snapshot/workflows/tests.rs
new file mode 100644
index 00000000..ef2d79e1
--- /dev/null
+++ b/apps/rustack/src/snapshot/workflows/tests.rs
@@ -0,0 +1,189 @@
+//! Actual service archives, metadata/history joins and atomic startup binding.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use http::StatusCode;
+use rustack_core::settings::RuntimeBudgets;
+use rustack_stepfunctions_core::RegistryMetadata;
+use serde_json::json;
+use tempfile::TempDir;
+use tokio::{
+    fs,
+    sync::{Notify, watch},
+};
+
+use super::*;
+use crate::{
+    snapshot::{
+        MANIFEST_FILE, RuntimeProviders, SnapshotConfig, SnapshotName,
+        archive::{ArchiveKind, from_cbor, read_archive},
+    },
+    workflows::tests::{request, runtime, start},
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn config(root: &TempDir) -> Result<SnapshotConfig> {
+    Ok(SnapshotConfig {
+        name: SnapshotName::try_from("workflows".to_owned())?,
+        root: root.path().to_owned(),
+    })
+}
+fn providers(client: WorkflowArchive) -> RuntimeProviders {
+    let mut providers = RuntimeProviders::default();
+    providers.register_workflows(client);
+    providers
+}
+#[tokio::test]
+async fn test_should_use_real_meta_data_generation_and_restore_exact_old_execution() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    let mut source = runtime(RuntimeBudgets::default())?;
+    let mut target = runtime(RuntimeBudgets::default())?;
+    let result = async {
+        let captured = start(&source, 0).await?;
+        source.owner.quiesce(deadline()).await?;
+        assert!(source.archive.is_ready(), "quiesce closed the save lane");
+        let expected = serde_json::to_value(captured.handle().snapshot().history().page(1, 1000, true)?.events())?;
+        config.save(&providers(source.archive.clone()), "test").await?;
+        let service = config.snapshot_dir().join("services/stepfunctions");
+        assert!(fs::metadata(service.join("meta.ss.zst")).await?.is_file());
+        assert!(fs::metadata(service.join("data.ss.zst")).await?.is_file());
+        assert!(fs::metadata(config.snapshot_dir().join(MANIFEST_FILE)).await?.is_file());
+        let parts = read_archive(&service.join("meta.ss.zst"), ArchiveKind::ServiceMeta).await?;
+        let metadata: RegistryMetadata = from_cbor(&parts.first().context("missing metadata section")?.bytes)?;
+        assert_eq!(serde_json::to_value(metadata)?.pointer("/executions/0/history"), Some(&json!([])));
+        config.load(&providers(target.archive.clone())).await?;
+        let (status, saved) = request(target.api.clone(), "DescribeExecution", json!({"executionArn":captured.arn().as_str()})).await?;
+        assert_eq!(status, StatusCode::OK, "{saved}");
+        assert_eq!(saved.get("status"), Some(&json!("SUCCEEDED")));
+        assert_eq!(saved.get("input"), Some(&json!("{\"answer\":42}")));
+        let (status, history) = request(target.api.clone(), "GetExecutionHistory", json!({"executionArn":captured.arn().as_str()})).await?;
+        assert_eq!(status, StatusCode::OK, "{history}");
+        assert_eq!(history.get("events"), Some(&expected));
+        let (status, duplicate) = request(target.api.clone(), "StartExecution", json!({"stateMachineArn":captured.arn().machine().as_str(),"name":"Run","input":"{\"answer\":42}"})).await?;
+        assert_eq!(status, StatusCode::BAD_REQUEST, "{duplicate}");
+        let (status, next) = request(target.api.clone(), "StartExecution", json!({"stateMachineArn":captured.arn().machine().as_str(),"name":"After","input":"{}"})).await?;
+        assert_eq!(status, StatusCode::OK, "{next}");
+        assert_eq!(target.status.capabilities()["snapshot"], "resources-and-history");
+        assert_eq!(providers(target.archive.clone()).coverage(), vec![("stepfunctions", "resources-and-history")]);
+        Ok(())
+    }.await;
+    let one = source.owner.shutdown(deadline()).await;
+    let two = target.owner.shutdown(deadline()).await;
+    one?;
+    two?;
+    result
+}
+#[tokio::test]
+async fn test_should_save_empty_registry_with_required_history_data() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    let mut source = runtime(RuntimeBudgets::default())?;
+    let mut target = runtime(RuntimeBudgets::default())?;
+    let result = async {
+        source.owner.quiesce(deadline()).await?;
+        config
+            .save(&providers(source.archive.clone()), "test")
+            .await?;
+        config.load(&providers(target.archive.clone())).await?;
+        let (status, rows) = request(target.api.clone(), "ListStateMachines", json!({})).await?;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(rows.get("stateMachines"), Some(&json!([])));
+        Ok(())
+    }
+    .await;
+    let one = source.owner.shutdown(deadline()).await;
+    let two = target.owner.shutdown(deadline()).await;
+    one?;
+    two?;
+    result
+}
+#[tokio::test]
+async fn test_should_preserve_old_generation_when_export_is_not_sealed() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    let mut source = runtime(RuntimeBudgets::default())?;
+    let mut live = runtime(RuntimeBudgets::default())?;
+    let result = async {
+        start(&source, 0).await?;
+        source.owner.quiesce(deadline()).await?;
+        config
+            .save(&providers(source.archive.clone()), "old")
+            .await?;
+        let before = fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?;
+        assert!(
+            config
+                .save(&providers(live.archive.clone()), "unproven")
+                .await
+                .is_err()
+        );
+        assert_eq!(
+            fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?,
+            before
+        );
+        Ok(())
+    }
+    .await;
+    let one = source.owner.shutdown(deadline()).await;
+    let two = live.owner.shutdown(deadline()).await;
+    one?;
+    two?;
+    result
+}
+
+mod rejection;
+
+#[derive(Debug)]
+pub(super) struct Hooks {
+    cpu: bool,
+    cpu_entered: Notify,
+    cpu_released: AtomicBool,
+    io: bool,
+    io_entered: Notify,
+    io_released: watch::Sender<bool>,
+}
+impl Hooks {
+    fn new(cpu: bool, io: bool) -> Arc<Self> {
+        Arc::new(Self {
+            cpu,
+            cpu_entered: Notify::new(),
+            cpu_released: AtomicBool::new(false),
+            io,
+            io_entered: Notify::new(),
+            io_released: watch::channel(false).0,
+        })
+    }
+    pub(super) fn cpu_wait(&self) {
+        if self.cpu {
+            self.cpu_entered.notify_one();
+            while !self.cpu_released.load(Ordering::Acquire) {
+                std::thread::park_timeout(Duration::from_millis(1));
+            }
+        }
+    }
+    pub(super) async fn io_wait(&self) -> Result<()> {
+        if self.io {
+            self.io_entered.notify_one();
+            let mut release = self.io_released.subscribe();
+            release
+                .wait_for(|ready| *ready)
+                .await
+                .context("owned IO test gate lost")?;
+        }
+        Ok(())
+    }
+    fn release(&self) {
+        self.cpu_released.store(true, Ordering::Release);
+        self.io_released.send_replace(true);
+    }
+}
+#[derive(Debug)]
+struct Release(Arc<Hooks>);
+impl Drop for Release {
+    fn drop(&mut self) {
+        self.0.release();
+    }
+}
+mod ownership;
diff --git a/apps/rustack/src/snapshot/workflows/tests/ownership.rs b/apps/rustack/src/snapshot/workflows/tests/ownership.rs
new file mode 100644
index 00000000..7b5a783e
--- /dev/null
+++ b/apps/rustack/src/snapshot/workflows/tests/ownership.rs
@@ -0,0 +1,172 @@
+//! Loss of service observers preserves prepared graphs and actual IO retirement.
+
+use rustack_stepfunctions_core::{
+    ExecutionLimits, ExecutionSupervisor, HistoryLimits, Payload, RegistryCapacities,
+    RegistryCommand, RegistryLimits, RegistrySupervisor, RuntimeLimits, StateSupport, TenantScope,
+};
+use tokio::time::{advance, pause, resume, timeout};
+
+use super::*;
+
+fn registry() -> Result<(Registry, RegistrySupervisor)> {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::new(25000, 1024 * 1024)?,
+        8 * 1024 * 1024,
+        None,
+    )?;
+    Ok(Registry::new_with_state_support(
+        TenantScope::default(),
+        RegistryLimits::new(
+            RegistryCapacities::new(1, 2, 1, 2)?,
+            Duration::from_secs(60),
+            8,
+        )?,
+        runtime,
+        ExecutionLimits::default(),
+        StateSupport::Structured,
+    )?)
+}
+#[tokio::test]
+async fn test_should_keep_prepared_graph_and_commit_once_after_service_observer_drop() -> Result<()>
+{
+    let directory = tempfile::tempdir()?;
+    let mut source = runtime(RuntimeBudgets::default())?;
+    let (registry, mut registry_owner) = registry()?;
+    let hooks = Hooks::new(true, false);
+    let release = Release(hooks.clone());
+    let (archive, mut owner) = WorkflowArchive::new_owned(
+        registry.clone(),
+        1024 * 1024,
+        Duration::from_secs(10),
+        Some(hooks.clone()),
+    )?;
+    let result = async {
+        start(&source, 0).await?;
+        source.owner.quiesce(deadline()).await?;
+        let metadata = source.archive.save_meta(directory.path()).await?;
+        let client = archive.clone();
+        let path = directory.path().to_owned();
+        let observer = tokio::spawn(async move { client.load_meta(metadata, &path).await });
+        timeout(Duration::from_secs(2), hooks.cpu_entered.notified()).await?;
+        assert!(
+            !registry.status().ready,
+            "prepared lease did not block business admission"
+        );
+        assert!(registry.submit(RegistryCommand::Machines).is_err());
+        observer.abort();
+        assert!(
+            observer
+                .await
+                .err()
+                .is_some_and(|error| error.is_cancelled())
+        );
+        assert!(
+            owner
+                .shutdown(Instant::now() + Duration::from_millis(5))
+                .await
+                .is_err()
+        );
+        assert!(!registry.status().ready);
+        hooks.release();
+        owner.shutdown(deadline()).await?;
+        let rows = registry
+            .submit(RegistryCommand::Machines)?
+            .wait(deadline())
+            .await?;
+        let RegistryResult::Machines(machines) = rows else {
+            anyhow::bail!("missing committed machine");
+        };
+        assert_eq!(machines.len(), 1);
+        let machine = machines.first().context("missing imported machine")?;
+        let capacity = registry
+            .submit(RegistryCommand::Start(
+                machine.arn().clone(),
+                Some("next".parse()?),
+                Payload::parse(b"{}")?,
+                None,
+            ))?
+            .wait(deadline())
+            .await;
+        assert!(
+            matches!(capacity, Err(RegistryError::Capacity)),
+            "import bypassed original record pool"
+        );
+        Ok(())
+    }
+    .await;
+    drop(release);
+    let archive = owner.shutdown(deadline()).await;
+    let records = registry_owner.shutdown(deadline()).await;
+    let original = source.owner.shutdown(deadline()).await;
+    archive?;
+    records?;
+    original?;
+    result
+}
+#[tokio::test]
+async fn test_should_join_expired_io_after_observer_drop_without_starting_preparation() -> Result<()>
+{
+    let directory = tempfile::tempdir()?;
+    let mut source = runtime(RuntimeBudgets::default())?;
+    let (registry, mut registry_owner) = registry()?;
+    let hooks = Hooks::new(false, true);
+    let release = Release(hooks.clone());
+    let (archive, mut owner) = WorkflowArchive::new_owned(
+        registry.clone(),
+        1024 * 1024,
+        Duration::from_secs(1),
+        Some(hooks.clone()),
+    )?;
+    let mut paused = false;
+    let result = async {
+        start(&source, 0).await?;
+        source.owner.quiesce(deadline()).await?;
+        let metadata = source.archive.save_meta(directory.path()).await?;
+        pause();
+        paused = true;
+        let client = archive.clone();
+        let path = directory.path().to_owned();
+        let observer = tokio::spawn(async move { client.load_meta(metadata, &path).await });
+        timeout(Duration::from_secs(2), hooks.io_entered.notified()).await?;
+        advance(Duration::from_secs(2)).await;
+        resume();
+        paused = false;
+        let mut ready = archive.ready.clone();
+        timeout(Duration::from_secs(2), ready.wait_for(|ready| !*ready)).await??;
+        observer.abort();
+        assert!(
+            observer
+                .await
+                .err()
+                .is_some_and(|error| error.is_cancelled())
+        );
+        assert!(
+            owner
+                .shutdown(Instant::now() + Duration::from_millis(5))
+                .await
+                .is_err()
+        );
+        assert!(registry.status().ready, "IO delay started preparation");
+        hooks.release();
+        owner.shutdown(deadline()).await?;
+        let rows = registry
+            .submit(RegistryCommand::Machines)?
+            .wait(deadline())
+            .await?;
+        assert!(matches!(rows,RegistryResult::Machines(machines) if machines.is_empty()));
+        Ok(())
+    }
+    .await;
+    if paused {
+        resume();
+    }
+    drop(release);
+    let archive = owner.shutdown(deadline()).await;
+    let records = registry_owner.shutdown(deadline()).await;
+    let original = source.owner.shutdown(deadline()).await;
+    archive?;
+    records?;
+    original?;
+    result
+}
diff --git a/apps/rustack/src/snapshot/workflows/tests/rejection.rs b/apps/rustack/src/snapshot/workflows/tests/rejection.rs
new file mode 100644
index 00000000..0a00d4e8
--- /dev/null
+++ b/apps/rustack/src/snapshot/workflows/tests/rejection.rs
@@ -0,0 +1,241 @@
+//! Valid-envelope corruption cannot publish a partial workflow graph.
+
+use rstest::rstest;
+use rustack_stepfunctions_core::RegistryHistories;
+
+use super::*;
+use crate::snapshot::{
+    archive::{
+        ArchiveSection, SECTION_STATE_CBOR, pack_data_archive, to_cbor, unpack_data_archive,
+        write_archive,
+    },
+    read_manifest, write_manifest,
+};
+
+#[rstest]
+#[case("schema")]
+#[case("profile")]
+#[case("hash")]
+#[case("missing-data")]
+#[case("orphan-data")]
+#[case("unknown-field")]
+#[case("quota")]
+#[case("missing-file")]
+#[tokio::test]
+async fn test_should_reject_invalid_archive_before_publishing_any_workflow(
+    #[case] corruption: &str,
+) -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    let mut source = runtime(RuntimeBudgets::default())?;
+    let mut budgets = RuntimeBudgets::default();
+    if corruption == "quota" {
+        budgets.workflow_registry_records = 1;
+    }
+    let mut target = runtime(budgets)?;
+    let result = async {
+        let first = start(&source, 0).await?;
+        let (status, reply) = request(
+            source.api.clone(),
+            "StartExecution",
+            json!({"stateMachineArn":first.arn().machine().as_str(),"name":"second","input":"{}"}),
+        )
+        .await?;
+        assert_eq!(status, StatusCode::OK, "{reply}");
+        source.owner.quiesce(deadline()).await?;
+        config
+            .save(&providers(source.archive.clone()), "source")
+            .await?;
+        let service = config.snapshot_dir().join("services/stepfunctions");
+        let meta_path = service.join("meta.ss.zst");
+        let data_path = service.join("data.ss.zst");
+        let sections = read_archive(&meta_path, ArchiveKind::ServiceMeta).await?;
+        let mut metadata = serde_json::to_value(from_cbor::<RegistryMetadata>(
+            &sections.first().context("missing metadata")?.bytes,
+        )?)?;
+        let history_dir = directory.path().join("mutated-history");
+        unpack_data_archive(
+            &data_path,
+            &history_dir,
+            Some(1024 * 1024),
+            Some(HISTORY_FILE),
+        )
+        .await?;
+        let mut histories = serde_json::to_value(from_cbor::<RegistryHistories>(
+            &fs::read(history_dir.join(HISTORY_FILE)).await?,
+        )?)?;
+        match corruption {
+            "schema" => metadata["schemaVersion"] = json!(2),
+            "profile" => metadata["profileVersion"] = json!(2),
+            "hash" => metadata["revisions"][0]["sourceHash"] = json!(vec![0; 32]),
+            "missing-data" => histories["histories"] = json!([]),
+            "orphan-data" => {
+                histories["histories"][0]["arn"] =
+                    json!("arn:aws:states:us-east-1:000000000000:execution:Machine:orphan");
+            }
+            "unknown-field" => metadata["private-archive-marker"] = json!("private-archive-marker"),
+            "quota" => {}
+            "missing-file" => {
+                let mut manifest =
+                    read_manifest(&config.snapshot_dir().join(MANIFEST_FILE)).await?;
+                let service = manifest
+                    .services
+                    .get_mut("stepfunctions")
+                    .context("missing service entry")?;
+                service.data_file = None;
+                service.data = None;
+                write_manifest(&config.snapshot_dir().join(MANIFEST_FILE), &manifest).await?;
+            }
+            _ => anyhow::bail!("unknown corruption"),
+        }
+        write_archive(
+            &meta_path,
+            ArchiveKind::ServiceMeta,
+            vec![ArchiveSection::new(
+                SECTION_STATE_CBOR,
+                to_cbor(&metadata)?,
+                1,
+            )],
+        )
+        .await?;
+        fs::write(history_dir.join(HISTORY_FILE), to_cbor(&histories)?).await?;
+        pack_data_archive(&history_dir, &data_path).await?;
+        let before = fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?;
+        let error = config
+            .load(&providers(target.archive.clone()))
+            .await
+            .err()
+            .context("accepted invalid workflow archive")?;
+        assert!(!format!("{error:#?}").contains("private-archive-marker"));
+        let (status, machines) =
+            request(target.api.clone(), "ListStateMachines", json!({})).await?;
+        assert_eq!(status, StatusCode::OK, "{machines}");
+        assert_eq!(machines.get("stateMachines"), Some(&json!([])));
+        assert_eq!(
+            fs::read(config.snapshot_dir().join(MANIFEST_FILE)).await?,
+            before
+        );
+        Ok(())
+    }
+    .await;
+    let one = source.owner.shutdown(deadline()).await;
+    let two = target.owner.shutdown(deadline()).await;
+    one?;
+    two?;
+    result
+}
+#[tokio::test]
+async fn test_should_load_old_generation_without_workflow_service_as_empty() -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    config.save(&RuntimeProviders::default(), "old").await?;
+    let mut target = runtime(RuntimeBudgets::default())?;
+    let result = async {
+        config.load(&providers(target.archive.clone())).await?;
+        let (status, machines) =
+            request(target.api.clone(), "ListStateMachines", json!({})).await?;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(machines.get("stateMachines"), Some(&json!([])));
+        Ok(())
+    }
+    .await;
+    target.owner.shutdown(deadline()).await?;
+    result
+}
+
+#[rstest]
+#[case("profile")]
+#[case("hash")]
+#[case("scope")]
+#[tokio::test]
+async fn test_should_retain_both_generations_until_domain_import_succeeds(
+    #[case] corruption: &str,
+) -> Result<()> {
+    let directory = tempfile::tempdir()?;
+    let config = config(&directory)?;
+    let mut source = runtime(RuntimeBudgets::default())?;
+    let mut target = runtime(RuntimeBudgets::default())?;
+    let result = async {
+        start(&source, 0).await?;
+        source.owner.quiesce(deadline()).await?;
+        let providers = providers(source.archive.clone());
+        config.save(&providers, "previous").await?;
+        let previous = directory.path().join(".workflows.previous");
+        fs::rename(config.snapshot_dir(), &previous).await?;
+        config.save(&providers, "current").await?;
+        // Recreate the post-publish/pre-retirement crash window with two
+        // physically valid generations, before corrupting only domain data.
+        fs::create_dir_all(previous.join("services/stepfunctions")).await?;
+        let files = [
+            MANIFEST_FILE,
+            "services/stepfunctions/meta.ss.zst",
+            "services/stepfunctions/data.ss.zst",
+        ];
+        let mut original = Vec::new();
+        for relative in files {
+            let bytes = fs::read(config.snapshot_dir().join(relative)).await?;
+            fs::write(previous.join(relative), &bytes).await?;
+            original.push(bytes);
+        }
+        let meta_path = config.snapshot_dir().join(files[1]);
+        let sections = read_archive(&meta_path, ArchiveKind::ServiceMeta).await?;
+        let mut metadata = serde_json::to_value(from_cbor::<RegistryMetadata>(
+            &sections.first().context("missing metadata")?.bytes,
+        )?)?;
+        match corruption {
+            "profile" => metadata["profileVersion"] = json!(2),
+            "hash" => metadata["revisions"][0]["sourceHash"] = json!(vec![0; 32]),
+            "scope" => metadata["scope"]["account"] = json!("111111111111"),
+            _ => anyhow::bail!("unknown corruption"),
+        }
+        write_archive(
+            &meta_path,
+            ArchiveKind::ServiceMeta,
+            vec![ArchiveSection::new(
+                SECTION_STATE_CBOR,
+                to_cbor(&metadata)?,
+                1,
+            )],
+        )
+        .await?;
+        let corrupted = fs::read(&meta_path).await?;
+        let target_providers = super::providers(target.archive.clone());
+        assert!(config.load(&target_providers).await.is_err());
+        for (relative, bytes) in files.into_iter().zip(&original) {
+            assert_eq!(&fs::read(previous.join(relative)).await?, bytes);
+        }
+        assert_eq!(fs::read(&meta_path).await?, corrupted);
+        let (status, machines) =
+            request(target.api.clone(), "ListStateMachines", json!({})).await?;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(machines.get("stateMachines"), Some(&json!([])));
+        fs::write(
+            &meta_path,
+            original.get(1).context("missing original metadata")?,
+        )
+        .await?;
+        target.owner.shutdown(deadline()).await?;
+        target = runtime(RuntimeBudgets::default())?;
+        config
+            .load(&super::providers(target.archive.clone()))
+            .await?;
+        assert!(!fs::try_exists(&previous).await?);
+        let (status, machines) =
+            request(target.api.clone(), "ListStateMachines", json!({})).await?;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(
+            machines
+                .get("stateMachines")
+                .and_then(serde_json::Value::as_array)
+                .map(Vec::len),
+            Some(1)
+        );
+        Ok(())
+    }
+    .await;
+    let one = source.owner.shutdown(deadline()).await;
+    let two = target.owner.shutdown(deadline()).await;
+    one?;
+    two?;
+    result
+}
diff --git a/apps/rustack/src/stepfunctions_api.rs b/apps/rustack/src/stepfunctions_api.rs
new file mode 100644
index 00000000..a18877ce
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api.rs
@@ -0,0 +1,427 @@
+//! Registry-backed API, retained preparation and charged stable cursors.
+//!
+//! Compilation follows the registry's immutable installed instruction profile.
+//! async-trait is required by the transport's object-safe handler port.
+
+use std::{collections::HashMap, fmt, sync::Arc, time::Duration};
+
+use async_trait::async_trait;
+use rustack_stepfunctions_core::{Registry, TaskSupport, TenantScope};
+use rustack_stepfunctions_http::{Request, RequestContext, Response, StepFunctionsHandler};
+use rustack_stepfunctions_model::{StepFunctionsError, StepFunctionsErrorCode as Code};
+use tokio::{
+    runtime::Handle,
+    spawn,
+    sync::{OwnedSemaphorePermit, Semaphore, mpsc, oneshot, watch},
+    task::{Id, JoinError, JoinHandle, JoinSet},
+    time::{Instant, MissedTickBehavior, interval, timeout_at},
+};
+
+mod error;
+mod pages;
+mod prepare;
+mod render;
+#[cfg(test)]
+mod tests;
+mod worker;
+
+pub use error::ApiError;
+
+/// Validated API, preparation and stable-pagination admission limits.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct ApiLimits {
+    accepted: usize,
+    cpu: usize,
+    tokens: usize,
+    bytes: usize,
+}
+impl ApiLimits {
+    /// Validate accepted1..128, workers1..32≤accepted, tokens1..100k and8MiB..1GiB.
+    ///
+    /// # Errors
+    /// Rejects zero/excessive or inconsistent trusted limits.
+    ///
+    /// ```
+    /// let limits=rustack_cli::stepfunctions_api::ApiLimits::new(32,8,10000,64*1024*1024)?;
+    /// # Ok::<(),rustack_cli::stepfunctions_api::ApiError>(())
+    /// ```
+    pub fn new(accepted: usize, cpu: usize, tokens: usize, bytes: usize) -> Result<Self, ApiError> {
+        if !(1..=128).contains(&accepted)
+            || !(1..=32).contains(&cpu)
+            || cpu > accepted
+            || !(1..=100_000).contains(&tokens)
+            || !(8 * 1024 * 1024..=1024 * 1024 * 1024).contains(&bytes)
+        {
+            return Err(ApiError::Configuration);
+        }
+        Ok(Self {
+            accepted,
+            cpu,
+            tokens,
+            bytes,
+        })
+    }
+}
+impl Default for ApiLimits {
+    fn default() -> Self {
+        Self {
+            accepted: 32,
+            cpu: 8,
+            tokens: 10_000,
+            bytes: 64 * 1024 * 1024,
+        }
+    }
+}
+struct Admission {
+    sender: mpsc::Sender<Envelope>,
+    capacity: Arc<Semaphore>,
+    closing: watch::Sender<bool>,
+    diagnostic: watch::Receiver<Option<Arc<ApiError>>>,
+}
+struct Context {
+    scope: TenantScope,
+    tasks: TaskSupport,
+    registry: Registry,
+    cpu: Arc<Semaphore>,
+    pages: mpsc::Sender<pages::Command>,
+}
+struct Envelope {
+    request: Request,
+    deadline: Instant,
+    reply: oneshot::Sender<Reply>,
+    permit: OwnedSemaphorePermit,
+}
+struct Reply {
+    result: Result<Response, StepFunctionsError>,
+    permit: Option<OwnedSemaphorePermit>,
+}
+struct Slot {
+    reply: oneshot::Sender<Reply>,
+    permit: OwnedSemaphorePermit,
+}
+struct Io {
+    requests: mpsc::Receiver<Envelope>,
+    pages: mpsc::Receiver<pages::Command>,
+    context: Arc<Context>,
+    closing: watch::Sender<bool>,
+    diagnostic: watch::Sender<Option<Arc<ApiError>>>,
+}
+struct State {
+    io: Io,
+    jobs: JoinSet<Result<Response, StepFunctionsError>>,
+    slots: HashMap<Id, Slot>,
+    quarantine: Vec<OwnedSemaphorePermit>,
+    store: pages::Store,
+}
+struct Owner {
+    state: Option<State>,
+}
+
+/// Real typed handler with bounded caller-independent work ownership.
+#[non_exhaustive]
+pub struct StepFunctionsApi {
+    admission: Arc<Admission>,
+    scope: TenantScope,
+}
+impl fmt::Debug for StepFunctionsApi {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("StepFunctionsApi(<redacted>)")
+    }
+}
+impl StepFunctionsApi {
+    /// Compose the real registry with compiler capability supplied by its owner.
+    ///
+    /// # Errors
+    /// Requires active Tokio and matching trusted registry/operator scope.
+    ///
+    /// ```no_run
+    /// # fn compose(registry:rustack_stepfunctions_core::Registry)->Result<(),rustack_cli::stepfunctions_api::ApiError>{
+    /// let(handler,owner)=rustack_cli::stepfunctions_api::StepFunctionsApi::new(Default::default(),rustack_stepfunctions_core::TaskSupport::Disabled,registry,Default::default())?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        scope: TenantScope,
+        tasks: TaskSupport,
+        registry: Registry,
+        limits: ApiLimits,
+    ) -> Result<(Arc<Self>, ApiSupervisor), ApiError> {
+        let (api, owner, stop) = Self::compose(scope, tasks, registry, limits)?;
+        let supervisor = ApiSupervisor {
+            closing: api.admission.closing.clone(),
+            join: Some(spawn(owner.run(stop))),
+            result: None,
+        };
+        Ok((api, supervisor))
+    }
+    fn compose(
+        scope: TenantScope,
+        tasks: TaskSupport,
+        registry: Registry,
+        limits: ApiLimits,
+    ) -> Result<(Arc<Self>, Owner, watch::Receiver<bool>), ApiError> {
+        Handle::try_current().map_err(|_| ApiError::Configuration)?;
+        let other = registry.scope();
+        if scope.partition() != other.partition()
+            || scope.region() != other.region()
+            || scope.account() != other.account()
+            || registry.callback_support() && tasks != TaskSupport::Lambda
+        {
+            return Err(ApiError::Configuration);
+        }
+        let (sender, requests) = mpsc::channel(limits.accepted);
+        let (page_tx, pages) = mpsc::channel(limits.accepted);
+        let (closing, stop) = watch::channel(false);
+        let (diagnostic, diagnostics) = watch::channel(None);
+        let context = Arc::new(Context {
+            scope: scope.clone(),
+            tasks,
+            registry,
+            cpu: Arc::new(Semaphore::new(limits.cpu)),
+            pages: page_tx,
+        });
+        let owner = Owner {
+            state: Some(State {
+                io: Io {
+                    requests,
+                    pages,
+                    context,
+                    closing: closing.clone(),
+                    diagnostic,
+                },
+                jobs: JoinSet::new(),
+                slots: HashMap::new(),
+                quarantine: Vec::new(),
+                store: pages::Store::new(limits),
+            }),
+        };
+        let api = Arc::new(Self {
+            scope,
+            admission: Arc::new(Admission {
+                sender,
+                capacity: Arc::new(Semaphore::new(limits.accepted)),
+                closing: closing.clone(),
+                diagnostic: diagnostics,
+            }),
+        });
+        Ok((api, owner, stop))
+    }
+    /// Inspect a retained typed failure without exposing source text in Debug.
+    ///
+    /// ```
+    /// # fn inspect(api:&rustack_cli::stepfunctions_api::StepFunctionsApi){let diagnostic=api.diagnostic();}
+    /// ```
+    #[must_use]
+    pub fn diagnostic(&self) -> Option<Arc<ApiError>> {
+        self.admission.diagnostic.borrow().clone()
+    }
+    /// Inspect admission/root health without exposing request data.
+    ///
+    /// ```
+    /// # fn inspect(api:&rustack_cli::stepfunctions_api::StepFunctionsApi){let ready=api.is_ready();}
+    /// ```
+    #[must_use]
+    pub fn is_ready(&self) -> bool {
+        !*self.admission.closing.borrow() && self.admission.diagnostic.borrow().is_none()
+    }
+}
+#[async_trait]
+impl StepFunctionsHandler for StepFunctionsApi {
+    #[tracing::instrument(name = "stepfunctions.api", skip_all)]
+    async fn handle(
+        &self,
+        context: RequestContext,
+        request: Request,
+    ) -> Result<Response, StepFunctionsError> {
+        let scope = context.scope();
+        if scope.partition() != self.scope.partition()
+            || scope.region() != self.scope.region()
+            || scope.account() != self.scope.account()
+        {
+            return Err(error::error(Code::AccessDeniedException));
+        }
+        let deadline = context.deadline();
+        error::check(deadline)?;
+        if *self.admission.closing.borrow() {
+            return Err(error::error(Code::ServiceUnavailable));
+        }
+        let permit = self
+            .admission
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| error::error(Code::ThrottlingException))?;
+        let (reply, receiver) = oneshot::channel();
+        self.admission
+            .sender
+            .try_send(Envelope {
+                request,
+                deadline,
+                reply,
+                permit,
+            })
+            .map_err(|e| match e {
+                mpsc::error::TrySendError::Full(_) => error::error(Code::ThrottlingException),
+                mpsc::error::TrySendError::Closed(_) => error::error(Code::ServiceUnavailable),
+            })?;
+        let reply = timeout_at(deadline, receiver)
+            .await
+            .map_err(|_| error::error(Code::RequestTimeoutException))?
+            .map_err(|_| error::error(Code::ServiceUnavailable))?;
+        let result = reply.result;
+        drop(reply.permit);
+        error::check(deadline)?;
+        result
+    }
+}
+impl Owner {
+    async fn run(mut self, stop: watch::Receiver<bool>) -> Result<(), ApiError> {
+        let result = match self.state.as_mut() {
+            Some(state) => state.run(stop).await,
+            None => Err(ApiError::Quarantined),
+        };
+        if result.is_ok() {
+            drop(self.state.take());
+        }
+        result
+    }
+}
+impl Drop for Owner {
+    fn drop(&mut self) {
+        if let Some(mut state) = self.state.take() {
+            state.io.closing.send_replace(true);
+            state.io.diagnostic.send_if_modified(|current| {
+                if current.is_some() {
+                    false
+                } else {
+                    *current = Some(Arc::new(ApiError::Quarantined));
+                    true
+                }
+            });
+            state.io.requests.close();
+            while let Ok(envelope) = state.io.requests.try_recv() {
+                let _sent = envelope.reply.send(Reply {
+                    result: Err(error::error(Code::ServiceUnavailable)),
+                    permit: Some(envelope.permit),
+                });
+            }
+            let _retained = Box::leak(Box::new(state));
+        }
+    }
+}
+impl State {
+    async fn run(&mut self, mut stop: watch::Receiver<bool>) -> Result<(), ApiError> {
+        let mut closed = false;
+        let mut incoming = true;
+        let mut timer = interval(Duration::from_secs(1));
+        timer.set_missed_tick_behavior(MissedTickBehavior::Skip);
+        loop {
+            if !closed && (*stop.borrow() || stop.has_changed().is_err()) {
+                closed = true;
+                self.io.closing.send_replace(true);
+                self.io.requests.close();
+            }
+            if !incoming && self.jobs.is_empty() {
+                return if self.quarantine.is_empty() {
+                    Ok(())
+                } else {
+                    Err(ApiError::Quarantined)
+                };
+            }
+            tokio::select! {biased;
+                _=stop.changed(),if !closed=>{},
+                joined=self.jobs.join_next_with_id(),if !self.jobs.is_empty()=>if let Some(joined)=joined{self.finish(joined);},
+                command=self.io.pages.recv()=>if let Some(command)=command{self.store.dispatch(command);},
+                envelope=self.io.requests.recv(),if incoming=>if let Some(envelope)=envelope{self.start(envelope);}else{incoming=false;closed=true;self.io.closing.send_replace(true);},
+                _=timer.tick()=>self.store.expire(Instant::now()),
+            }
+        }
+    }
+    fn start(&mut self, envelope: Envelope) {
+        let context = self.io.context.clone();
+        let job = self
+            .jobs
+            .spawn(worker::run(context, envelope.request, envelope.deadline));
+        self.slots.insert(
+            job.id(),
+            Slot {
+                reply: envelope.reply,
+                permit: envelope.permit,
+            },
+        );
+    }
+    fn finish(&mut self, joined: Result<(Id, Result<Response, StepFunctionsError>), JoinError>) {
+        match joined {
+            Ok((id, result)) => {
+                if let Some(slot) = self.slots.remove(&id) {
+                    let _sent = slot.reply.send(Reply {
+                        result,
+                        permit: Some(slot.permit),
+                    });
+                }
+            }
+            Err(error) => {
+                let id = error.id();
+                let diagnostic = Arc::new(ApiError::Worker(error));
+                self.io.diagnostic.send_replace(Some(diagnostic.clone()));
+                if let Some(slot) = self.slots.remove(&id) {
+                    let _sent = slot.reply.send(Reply {
+                        result: Err(error::source(Code::InternalFailure, diagnostic)),
+                        permit: None,
+                    });
+                    self.quarantine.push(slot.permit);
+                }
+            }
+        }
+    }
+}
+/// Unique resumable API-root shutdown controller.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct ApiSupervisor {
+    closing: watch::Sender<bool>,
+    join: Option<JoinHandle<Result<(), ApiError>>>,
+    result: Option<Result<(), Arc<ApiError>>>,
+}
+impl ApiSupervisor {
+    /// Close admission; all accepted work remains owned until joined.
+    ///
+    /// ```
+    /// # fn close(owner:&rustack_cli::stepfunctions_api::ApiSupervisor){owner.close();}
+    /// ```
+    pub fn close(&self) {
+        self.closing.send_replace(true);
+    }
+    /// Join the same root through an absolute observation deadline.
+    ///
+    /// # Errors
+    /// Deadline preserves its handle; worker/quarantine errors remain cached.
+    ///
+    /// ```no_run
+    /// # async fn join(owner:&mut rustack_cli::stepfunctions_api::ApiSupervisor,deadline:tokio::time::Instant){let result=owner.shutdown(deadline).await;}
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), ApiError> {
+        self.close();
+        if self.result.is_none() {
+            let join = self.join.as_mut().ok_or(ApiError::Quarantined)?;
+            let joined = timeout_at(deadline, join)
+                .await
+                .map_err(|_| ApiError::Deadline)?;
+            self.join = None;
+            self.result = Some(match joined {
+                Ok(result) => result.map_err(Arc::new),
+                Err(error) => Err(Arc::new(ApiError::Worker(error))),
+            });
+        }
+        match self.result.as_ref() {
+            Some(Ok(())) => Ok(()),
+            Some(Err(error)) => Err(ApiError::Owner(error.clone())),
+            None => Err(ApiError::Quarantined),
+        }
+    }
+}
+impl Drop for ApiSupervisor {
+    fn drop(&mut self) {
+        self.close(); /* Detach only the owning root; it joins its accepted jobs. */
+    }
+}
diff --git a/apps/rustack/src/stepfunctions_api/error.rs b/apps/rustack/src/stepfunctions_api/error.rs
new file mode 100644
index 00000000..9ed93a58
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api/error.rs
@@ -0,0 +1,102 @@
+//! Static service diagnostics and retained typed sources.
+
+use std::{error::Error, fmt, sync::Arc};
+
+use http::StatusCode;
+use rustack_stepfunctions_core::{CallbackError, ExecutionError, RegistryError};
+use rustack_stepfunctions_model::{
+    StepFunctionsError, StepFunctionsErrorCode as Code, StepFunctionsOperation,
+};
+use thiserror::Error;
+use tokio::{task::JoinError, time::Instant};
+
+/// API-owner failures; Debug and public error text never project business data.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum ApiError {
+    /// Invalid trusted capacities/scope/runtime configuration.
+    #[error("invalid workflow API configuration")]
+    Configuration,
+    /// An observation expired while its owner remains live.
+    #[error("workflow API observation expired")]
+    Deadline,
+    /// Work remains uncertain after unexpected worker failure.
+    #[error("workflow API cleanup retained")]
+    Quarantined,
+    /// Supervised root/worker failure with redacted diagnostics.
+    #[error("workflow API worker failed")]
+    Worker(#[source] JoinError),
+    /// Cached root failure.
+    #[error("workflow API owner failed")]
+    Owner(#[source] Arc<ApiError>),
+}
+impl fmt::Debug for ApiError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+pub(super) fn error(code: Code) -> StepFunctionsError {
+    StepFunctionsError::new(code)
+}
+pub(super) fn source(code: Code, cause: impl Error + Send + Sync + 'static) -> StepFunctionsError {
+    let mut error = error(code);
+    error.source = Some(Box::new(cause));
+    error
+}
+pub(super) fn registry(
+    cause: RegistryError,
+    operation: StepFunctionsOperation,
+) -> StepFunctionsError {
+    let code = match &cause {
+        RegistryError::Validation => Code::ValidationException,
+        RegistryError::MachineMissing => match operation {
+            StepFunctionsOperation::TagResource
+            | StepFunctionsOperation::UntagResource
+            | StepFunctionsOperation::ListTagsForResource => Code::ResourceNotFound,
+            _ => Code::StateMachineDoesNotExist,
+        },
+        RegistryError::TagLimit => Code::TooManyTags,
+        RegistryError::MachineExists => Code::StateMachineAlreadyExists,
+        RegistryError::Deleting => Code::StateMachineDeleting,
+        RegistryError::ExecutionMissing => Code::ExecutionDoesNotExist,
+        RegistryError::ExecutionExists => Code::ExecutionAlreadyExists,
+        RegistryError::Capacity => match operation {
+            StepFunctionsOperation::CreateStateMachine => Code::StateMachineLimitExceeded,
+            StepFunctionsOperation::StartExecution => Code::ExecutionLimitExceeded,
+            _ => Code::ThrottlingException,
+        },
+        RegistryError::Deadline => Code::RequestTimeoutException,
+        RegistryError::Unavailable => Code::ServiceUnavailable,
+        RegistryError::Execution(ExecutionError::Capacity) => Code::ExecutionLimitExceeded,
+        _ => Code::InternalFailure,
+    };
+    let mut result = source(code, cause);
+    if code == Code::ResourceNotFound {
+        result.status_code = StatusCode::BAD_REQUEST;
+    }
+    result
+}
+pub(super) fn check(deadline: Instant) -> Result<(), StepFunctionsError> {
+    if Instant::now() >= deadline {
+        Err(error(Code::RequestTimeoutException))
+    } else {
+        Ok(())
+    }
+}
+
+pub(super) fn callback(cause: CallbackError) -> StepFunctionsError {
+    source(callback_code(&cause), cause)
+}
+fn callback_code(cause: &CallbackError) -> Code {
+    match cause {
+        CallbackError::Cached(cause) => callback_code(cause),
+        CallbackError::InvalidToken => Code::InvalidToken,
+        CallbackError::TaskTimedOut => Code::TaskTimedOut,
+        CallbackError::Data(_) => Code::InvalidOutput,
+        CallbackError::Validation => Code::ValidationException,
+        CallbackError::Capacity => Code::ThrottlingException,
+        CallbackError::Deadline => Code::RequestTimeoutException,
+        CallbackError::Unavailable => Code::ServiceUnavailable,
+        _ => Code::InternalFailure,
+    }
+}
diff --git a/apps/rustack/src/stepfunctions_api/pages.rs b/apps/rustack/src/stepfunctions_api/pages.rs
new file mode 100644
index 00000000..1bd66178
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api/pages.rs
@@ -0,0 +1,383 @@
+//! Actor-owned opaque cursors over shared charged immutable captures.
+
+use std::{
+    collections::HashMap,
+    fmt::{self, Write},
+    mem::size_of,
+    sync::Arc,
+    time::Duration,
+};
+
+use getrandom::fill;
+use rustack_stepfunctions_core::{ExecutionSnapshot, MachineSnapshot, RegistryResult};
+use rustack_stepfunctions_http::Response;
+use rustack_stepfunctions_model::{
+    StepFunctionsError, StepFunctionsErrorCode as Code, StepFunctionsOperation as Op, output,
+    types::ExecutionStatus,
+};
+use tokio::{
+    sync::{OwnedSemaphorePermit, Semaphore, oneshot},
+    time::Instant,
+};
+
+use super::{
+    ApiLimits,
+    error::{check, error, source},
+    render,
+};
+
+#[derive(Clone, PartialEq, Eq)]
+pub(super) struct Flags {
+    pub(super) size: usize,
+    pub(super) status: Option<ExecutionStatus>,
+    pub(super) reverse: bool,
+    pub(super) data: bool,
+}
+impl Flags {
+    pub(super) fn new(
+        size: Option<i32>,
+        status: Option<ExecutionStatus>,
+        reverse: bool,
+        data: bool,
+    ) -> Result<Self, StepFunctionsError> {
+        let size = match size {
+            None | Some(0) => 100,
+            Some(n) => usize::try_from(n)
+                .ok()
+                .filter(|n| *n <= 1000)
+                .ok_or_else(|| error(Code::ValidationException))?,
+        };
+        Ok(Self {
+            size,
+            status,
+            reverse,
+            data,
+        })
+    }
+}
+#[derive(Clone, PartialEq, Eq)]
+pub(super) struct Binding {
+    pub(super) op: Op,
+    pub(super) resource: String,
+    pub(super) flags: Flags,
+}
+pub(super) enum Data {
+    Machines(Vec<MachineSnapshot>),
+    Executions(Vec<ExecutionSnapshot>),
+    History(ExecutionSnapshot),
+}
+impl Data {
+    pub(super) fn capture(
+        binding: &Binding,
+        result: RegistryResult,
+    ) -> Result<Self, StepFunctionsError> {
+        match (binding.op, result) {
+            (Op::ListStateMachines, RegistryResult::Machines(values)) => Ok(Self::Machines(values)),
+            (Op::ListExecutions, RegistryResult::Executions(values)) => {
+                let mut captured = Vec::new();
+                for value in values {
+                    let status = render::status(&value)?;
+                    if binding
+                        .flags
+                        .status
+                        .as_ref()
+                        .is_none_or(|filter| filter == &status)
+                    {
+                        captured.push(value);
+                    }
+                }
+                Ok(Self::Executions(captured))
+            }
+            (Op::GetExecutionHistory, RegistryResult::Execution(value)) => Ok(Self::History(value)),
+            _ => Err(error(Code::InternalFailure)),
+        }
+    }
+    fn bytes(&self) -> Result<u32, StepFunctionsError> {
+        let bytes = match self {
+            Self::Machines(v) => v.capacity().checked_mul(size_of::<MachineSnapshot>()),
+            Self::Executions(v) => v.capacity().checked_mul(size_of::<ExecutionSnapshot>()),
+            Self::History(v) => Some(v.view().history().charged_bytes()),
+        }
+        .and_then(|n| n.checked_add(512))
+        .and_then(|n| u32::try_from(n).ok())
+        .ok_or_else(|| error(Code::ThrottlingException))?;
+        Ok(bytes)
+    }
+}
+pub(super) struct Snapshot {
+    data: Data,
+    _permit: OwnedSemaphorePermit,
+}
+#[derive(Clone)]
+pub(super) struct Cursor {
+    pub(super) binding: Binding,
+    pub(super) snapshot: Arc<Snapshot>,
+    pub(super) position: u32,
+}
+struct Token {
+    cursor: Cursor,
+    expires: Instant,
+}
+pub(super) struct Store {
+    tokens: HashMap<String, Token>,
+    capacity: usize,
+    bytes: Arc<Semaphore>,
+}
+impl Store {
+    pub(super) fn new(limits: ApiLimits) -> Self {
+        Self {
+            tokens: HashMap::new(),
+            capacity: limits.tokens,
+            bytes: Arc::new(Semaphore::new(limits.bytes)),
+        }
+    }
+    pub(super) fn expire(&mut self, now: Instant) {
+        self.tokens.retain(|_, token| token.expires > now);
+    }
+    fn reserve(&mut self, data: Data) -> Result<Arc<Snapshot>, StepFunctionsError> {
+        self.expire(Instant::now());
+        let permit = self
+            .bytes
+            .clone()
+            .try_acquire_many_owned(data.bytes()?)
+            .map_err(|_| error(Code::ThrottlingException))?;
+        Ok(Arc::new(Snapshot {
+            data,
+            _permit: permit,
+        }))
+    }
+    fn read(&mut self, token: &str, binding: &Binding) -> Result<Cursor, StepFunctionsError> {
+        self.expire(Instant::now());
+        let value = self
+            .tokens
+            .get(token)
+            .filter(|v| v.cursor.binding == *binding)
+            .ok_or_else(|| error(Code::InvalidToken))?;
+        Ok(value.cursor.clone())
+    }
+    fn save(&mut self, token: String, cursor: Cursor) -> Result<(), StepFunctionsError> {
+        self.expire(Instant::now());
+        if self.tokens.len() >= self.capacity {
+            return Err(error(Code::ThrottlingException));
+        }
+        if self.tokens.contains_key(&token) {
+            return Err(error(Code::InternalFailure));
+        }
+        let expires = Instant::now()
+            .checked_add(Duration::from_hours(24))
+            .ok_or_else(|| error(Code::InternalFailure))?;
+        self.tokens.insert(token, Token { cursor, expires });
+        Ok(())
+    }
+    pub(super) fn dispatch(&mut self, command: Command) {
+        let deadline = command.deadline;
+        match command.request {
+            Request::Reserve(data, reply) => {
+                let result = check(deadline).and_then(|()| self.reserve(data));
+                let _sent = reply.send(result);
+            }
+            Request::Read(token, binding, reply) => {
+                let result = check(deadline).and_then(|()| self.read(&token, &binding));
+                let _sent = reply.send(result);
+            }
+            Request::Save(token, cursor, reply) => {
+                let result = check(deadline).and_then(|()| self.save(token, cursor));
+                let _sent = reply.send(result);
+            }
+        }
+    }
+}
+pub(super) struct Command {
+    pub(super) deadline: Instant,
+    pub(super) request: Request,
+}
+pub(super) enum Request {
+    Reserve(
+        Data,
+        oneshot::Sender<Result<Arc<Snapshot>, StepFunctionsError>>,
+    ),
+    Read(
+        String,
+        Binding,
+        oneshot::Sender<Result<Cursor, StepFunctionsError>>,
+    ),
+    Save(
+        String,
+        Cursor,
+        oneshot::Sender<Result<(), StepFunctionsError>>,
+    ),
+}
+pub(super) fn first(binding: Binding, snapshot: Arc<Snapshot>) -> Cursor {
+    let position = match &snapshot.data {
+        Data::History(e) if binding.flags.reverse => e.view().history().len(),
+        Data::History(_) => 1,
+        _ => 0,
+    };
+    Cursor {
+        binding,
+        snapshot,
+        position,
+    }
+}
+pub(super) struct Page {
+    pub(super) response: Response,
+    pub(super) next: Option<Cursor>,
+    pub(super) token: String,
+}
+pub(super) fn page(cursor: Cursor) -> Result<Page, StepFunctionsError> {
+    let flags = &cursor.binding.flags;
+    let (response, next) = match &cursor.snapshot.data {
+        Data::Machines(values) => {
+            let (slice, next) = slice(values, cursor.position, flags.size)?;
+            let mut out = output::ListStateMachinesOutput::default();
+            out.state_machines = slice.iter().map(render::machine_item).collect();
+            (out.into(), next)
+        }
+        Data::Executions(values) => {
+            let (slice, next) = slice(values, cursor.position, flags.size)?;
+            let mut out = output::ListExecutionsOutput::default();
+            out.executions = slice
+                .iter()
+                .map(render::execution_item)
+                .collect::<Result<Vec<_>, _>>()?;
+            (out.into(), next)
+        }
+        Data::History(value) => {
+            let history = value.view().history();
+            let page = if flags.reverse {
+                history.page_reverse(cursor.position, flags.size, flags.data)
+            } else {
+                history.page(cursor.position, flags.size, flags.data)
+            }
+            .map_err(|e| source(Code::InternalFailure, e))?;
+            let mut out = output::GetExecutionHistoryOutput::default();
+            out.events = page.events().to_vec();
+            (out.into(), page.next_id())
+        }
+    };
+    let token = if next.is_some() {
+        nonce()?
+    } else {
+        String::new()
+    };
+    Ok(Page {
+        response,
+        next: next.map(|position| Cursor { position, ..cursor }),
+        token,
+    })
+}
+fn slice<T>(
+    values: &[T],
+    position: u32,
+    size: usize,
+) -> Result<(&[T], Option<u32>), StepFunctionsError> {
+    let start = usize::try_from(position).map_err(|e| source(Code::InternalFailure, e))?;
+    let end = start
+        .checked_add(size)
+        .ok_or_else(|| error(Code::InternalFailure))?
+        .min(values.len());
+    let slice = values
+        .get(start..end)
+        .ok_or_else(|| error(Code::InternalFailure))?;
+    let next = if end < values.len() {
+        Some(u32::try_from(end).map_err(|e| source(Code::InternalFailure, e))?)
+    } else {
+        None
+    };
+    Ok((slice, next))
+}
+fn nonce() -> Result<String, StepFunctionsError> {
+    let mut bytes = [0_u8; 32];
+    fill(&mut bytes).map_err(|e| source(Code::InternalFailure, e))?;
+    let mut out = String::with_capacity(64);
+    for byte in bytes {
+        write!(out, "{byte:02x}").map_err(|e| source(Code::InternalFailure, e))?;
+    }
+    Ok(out)
+}
+pub(super) fn attach(response: &mut Response, token: String) -> Result<(), StepFunctionsError> {
+    match response {
+        Response::ListStateMachines(v) => v.next_token = Some(token),
+        Response::ListExecutions(v) => v.next_token = Some(token),
+        Response::GetExecutionHistory(v) => v.next_token = Some(token),
+        _ => return Err(error(Code::InternalFailure)),
+    }
+    Ok(())
+}
+impl fmt::Debug for Store {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("PageStore(<redacted>)")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn binding() -> Binding {
+        Binding {
+            op: Op::ListStateMachines,
+            resource: String::new(),
+            flags: Flags::new(Some(1), None, false, true).unwrap(),
+        }
+    }
+    #[test]
+    fn test_should_charge_sparse_vector_capacity_and_release_only_after_final_snapshot() {
+        let mut store = Store::new(ApiLimits::new(1, 1, 100, 8 * 1024 * 1024).unwrap());
+        let mut snapshots = Vec::new();
+        for _ in 0..5 {
+            snapshots.push(
+                store
+                    .reserve(Data::Executions(Vec::with_capacity(100_000)))
+                    .unwrap(),
+            );
+        }
+        assert!(
+            store
+                .reserve(Data::Executions(Vec::with_capacity(100_000)))
+                .is_err()
+        );
+        let held = snapshots.pop().unwrap();
+        let clone = held.clone();
+        drop(held);
+        assert!(
+            store
+                .reserve(Data::Executions(Vec::with_capacity(100_000)))
+                .is_err()
+        );
+        drop(clone);
+        assert!(
+            store
+                .reserve(Data::Executions(Vec::with_capacity(100_000)))
+                .is_ok()
+        );
+    }
+    #[test]
+    fn test_should_preserve_live_tokens_at_capacity_and_expire_them_before_read() {
+        let mut store = Store::new(ApiLimits::new(1, 1, 1, 8 * 1024 * 1024).unwrap());
+        let snapshot = store.reserve(Data::Machines(Vec::new())).unwrap();
+        let cursor = first(binding(), snapshot);
+        store.save("a".repeat(64), cursor.clone()).unwrap();
+        assert!(store.save("b".repeat(64), cursor.clone()).is_err());
+        assert!(store.read(&"a".repeat(64), &binding()).is_ok());
+        let expired = Instant::now() + Duration::from_hours(24);
+        store.expire(expired);
+        assert!(store.read(&"a".repeat(64), &binding()).is_err());
+        store.save("b".repeat(64), cursor).unwrap();
+        assert!(store.read(&"b".repeat(64), &binding()).is_ok());
+    }
+    #[test]
+    fn test_should_reject_binding_changes_and_random_handle_collisions_without_overwriting() {
+        let mut store = Store::new(ApiLimits::default());
+        let snapshot = store.reserve(Data::Machines(Vec::new())).unwrap();
+        let cursor = first(binding(), snapshot);
+        store.save("a".repeat(64), cursor.clone()).unwrap();
+        assert!(store.save("a".repeat(64), cursor).is_err());
+        let mut changed = binding();
+        changed.flags.data = false;
+        assert_eq!(
+            store.read(&"a".repeat(64), &changed).err().unwrap().code,
+            Code::InvalidToken
+        );
+        assert!(store.read(&"a".repeat(64), &binding()).is_ok());
+    }
+}
diff --git a/apps/rustack/src/stepfunctions_api/prepare.rs b/apps/rustack/src/stepfunctions_api/prepare.rs
new file mode 100644
index 00000000..fe00937e
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api/prepare.rs
@@ -0,0 +1,375 @@
+//! Retained blocking preparation under the installed STANDARD/JSONPath profile.
+
+use rustack_stepfunctions_core::{
+    AslCompiler, CallbackCommand, CallbackToken, DiagnosticSeverity, ExecutionArn, Payload,
+    PreparedDefinition, RegistryCommand, RoleArn, StateMachineArn, StopReason, Tags, TenantScope,
+};
+use rustack_stepfunctions_http::{HttpError, Request, Response};
+use rustack_stepfunctions_model::{
+    StepFunctionsError, StepFunctionsErrorCode as Code, StepFunctionsOperation as Op, input,
+    output,
+    types::{
+        EncryptionConfiguration, EncryptionType, ExecutionStatus, IncludedData, LogLevel,
+        LoggingConfiguration, StateMachineType, Tag, TracingConfiguration,
+        ValidateStateMachineDefinitionDiagnostic, ValidateStateMachineDefinitionResultCode,
+        ValidateStateMachineDefinitionSeverity,
+    },
+};
+
+use super::{
+    error::{callback, error, source},
+    pages::{Binding, Flags},
+};
+
+pub(super) enum Prepared {
+    Command(RegistryCommand, Op),
+    Page(Binding, Option<String>, RegistryCommand),
+    Callback(CallbackCommand, Op),
+    Ready(Response),
+}
+pub(super) fn prepare(
+    request: Request,
+    compiler: &AslCompiler,
+    scope: &TenantScope,
+    callbacks: bool,
+) -> Result<Prepared, StepFunctionsError> {
+    request.validate().map_err(|e| {
+        let code = match &e {
+            HttpError::Field(code) => *code,
+            _ => Code::ValidationException,
+        };
+        source(code, e)
+    })?;
+    let op = request.operation();
+    let command = match request {
+        Request::CreateStateMachine(v) => create(*v, compiler, scope)?,
+        Request::UpdateStateMachine(v) => update(&v, compiler, scope)?,
+        Request::DeleteStateMachine(v) => {
+            RegistryCommand::Delete(machine(&v.state_machine_arn, scope)?)
+        }
+        Request::DescribeStateMachine(v) => {
+            included(v.included_data.as_ref())?;
+            RegistryCommand::Machine(machine(&v.state_machine_arn, scope)?)
+        }
+        Request::ListStateMachineVersions(v) => {
+            let arn = machine(&v.state_machine_arn, scope)?;
+            if v.next_token.is_some() {
+                return Err(error(Code::InvalidToken));
+            }
+            RegistryCommand::Machine(arn)
+        }
+        Request::StartExecution(v) => RegistryCommand::Start(
+            machine(&v.state_machine_arn, scope)?,
+            v.name
+                .as_deref()
+                .map(str::parse)
+                .transpose()
+                .map_err(|e| source(Code::InvalidName, e))?,
+            Payload::parse(v.input.as_deref().unwrap_or("{}").as_bytes())
+                .map_err(|e| source(Code::InvalidExecutionInput, e))?,
+            v.trace_header,
+        ),
+        Request::DescribeExecution(v) => {
+            included(v.included_data.as_ref())?;
+            RegistryCommand::Execution(execution(&v.execution_arn, scope)?)
+        }
+        Request::StopExecution(v) => RegistryCommand::Stop(
+            execution(&v.execution_arn, scope)?,
+            StopReason::new(v.error, v.cause).map_err(|e| source(Code::ValidationException, e))?,
+        ),
+        Request::DescribeStateMachineForExecution(v) => {
+            included(v.included_data.as_ref())?;
+            RegistryCommand::Execution(execution(&v.execution_arn, scope)?)
+        }
+        Request::TagResource(v) => {
+            RegistryCommand::Tag(machine(&v.resource_arn, scope)?, tags(v.tags)?)
+        }
+        Request::UntagResource(v) => RegistryCommand::Untag(
+            machine(&v.resource_arn, scope)?,
+            Tags::new(v.tag_keys.into_iter().map(|k| (k, String::new())).collect())
+                .map_err(|e| source(Code::ValidationException, e))?,
+        ),
+        Request::ListTagsForResource(v) => {
+            RegistryCommand::Machine(machine(&v.resource_arn, scope)?)
+        }
+        Request::ValidateStateMachineDefinition(v) => {
+            return Ok(Prepared::Ready(validate(&v, compiler)?.into()));
+        }
+        Request::ListStateMachines(v) => {
+            return Ok(Prepared::Page(
+                Binding {
+                    op,
+                    resource: String::new(),
+                    flags: Flags::new(v.max_results, None, false, true)?,
+                },
+                token(v.next_token)?,
+                RegistryCommand::Machines,
+            ));
+        }
+        Request::ListExecutions(v) => {
+            if v.map_run_arn.is_some()
+                || v.redrive_filter.is_some()
+                || matches!(v.status_filter, Some(ExecutionStatus::PendingRedrive))
+            {
+                return Err(error(Code::UnsupportedOperation));
+            }
+            let arn = machine(
+                v.state_machine_arn
+                    .as_deref()
+                    .ok_or_else(|| error(Code::ValidationException))?,
+                scope,
+            )?;
+            return Ok(Prepared::Page(
+                Binding {
+                    op,
+                    resource: arn.as_str().into(),
+                    flags: Flags::new(v.max_results, v.status_filter, false, true)?,
+                },
+                token(v.next_token)?,
+                RegistryCommand::Executions(arn),
+            ));
+        }
+        Request::GetExecutionHistory(v) => return history(*v, scope),
+        request => return callback_request(request, callbacks),
+    };
+    Ok(Prepared::Command(command, op))
+}
+fn callback_request(request: Request, enabled: bool) -> Result<Prepared, StepFunctionsError> {
+    if !enabled {
+        return Err(error(Code::UnsupportedOperation));
+    }
+    let op = request.operation();
+    let command = match request {
+        Request::SendTaskSuccess(v) => CallbackCommand::success(
+            CallbackToken::try_from(v.task_token).map_err(callback)?,
+            v.output.as_bytes(),
+        )
+        .map_err(callback)?,
+        Request::SendTaskFailure(v) => CallbackCommand::failure(
+            CallbackToken::try_from(v.task_token).map_err(callback)?,
+            v.error,
+            v.cause,
+        )
+        .map_err(callback)?,
+        Request::SendTaskHeartbeat(v) => {
+            CallbackCommand::heartbeat(CallbackToken::try_from(v.task_token).map_err(callback)?)
+        }
+        _ => return Err(error(Code::UnsupportedOperation)),
+    };
+    Ok(Prepared::Callback(command, op))
+}
+
+fn history(
+    v: input::GetExecutionHistoryInput,
+    scope: &TenantScope,
+) -> Result<Prepared, StepFunctionsError> {
+    let arn = execution(&v.execution_arn, scope)?;
+    Ok(Prepared::Page(
+        Binding {
+            op: Op::GetExecutionHistory,
+            resource: arn.as_str().into(),
+            flags: Flags::new(
+                v.max_results,
+                None,
+                v.reverse_order.unwrap_or(false),
+                v.include_execution_data.unwrap_or(true),
+            )?,
+        },
+        token(v.next_token)?,
+        RegistryCommand::Execution(arn),
+    ))
+}
+fn create(
+    v: input::CreateStateMachineInput,
+    compiler: &AslCompiler,
+    scope: &TenantScope,
+) -> Result<RegistryCommand, StepFunctionsError> {
+    profile(
+        v.r#type.as_ref(),
+        v.logging_configuration.as_ref(),
+        v.tracing_configuration.as_ref(),
+        v.encryption_configuration.as_ref(),
+        v.publish,
+        v.version_description.as_deref(),
+    )?;
+    Ok(RegistryCommand::Create(
+        v.name.parse().map_err(|e| source(Code::InvalidName, e))?,
+        definition(compiler, &v.definition)?,
+        role(&v.role_arn, scope)?,
+        tags(v.tags)?,
+    ))
+}
+fn update(
+    v: &input::UpdateStateMachineInput,
+    compiler: &AslCompiler,
+    scope: &TenantScope,
+) -> Result<RegistryCommand, StepFunctionsError> {
+    profile(
+        None,
+        v.logging_configuration.as_ref(),
+        v.tracing_configuration.as_ref(),
+        v.encryption_configuration.as_ref(),
+        v.publish,
+        v.version_description.as_deref(),
+    )?;
+    if v.definition.is_none() && v.role_arn.is_none() {
+        return Err(error(Code::MissingRequiredParameter));
+    }
+    Ok(RegistryCommand::Update(
+        machine(&v.state_machine_arn, scope)?,
+        v.definition
+            .as_deref()
+            .map(|v| definition(compiler, v))
+            .transpose()?,
+        v.role_arn.as_deref().map(|v| role(v, scope)).transpose()?,
+    ))
+}
+fn definition(
+    compiler: &AslCompiler,
+    text: &str,
+) -> Result<PreparedDefinition, StepFunctionsError> {
+    Ok(PreparedDefinition::new(
+        compiler
+            .compile(text.as_bytes())
+            .map_err(|e| source(Code::InvalidDefinition, e))?
+            .machine()
+            .clone(),
+    ))
+}
+fn role(text: &str, scope: &TenantScope) -> Result<RoleArn, StepFunctionsError> {
+    let role: RoleArn = text.parse().map_err(|e| source(Code::InvalidArn, e))?;
+    if !role.as_str().starts_with(&format!(
+        "arn:{}:iam::{}:role/",
+        scope.partition(),
+        scope.account()
+    )) {
+        return Err(error(Code::InvalidArn));
+    }
+    Ok(role)
+}
+fn tags(values: Vec<Tag>) -> Result<Tags, StepFunctionsError> {
+    Tags::new(
+        values
+            .into_iter()
+            .map(|t| {
+                Ok((
+                    t.key.ok_or_else(|| error(Code::ValidationException))?,
+                    t.value.unwrap_or_default(),
+                ))
+            })
+            .collect::<Result<Vec<_>, StepFunctionsError>>()?,
+    )
+    .map_err(|e| source(Code::ValidationException, e))
+}
+fn scoped(text: &str, scope: &TenantScope) -> Result<(), StepFunctionsError> {
+    if text.starts_with(&format!(
+        "arn:{}:states:{}:{}:",
+        scope.partition(),
+        scope.region(),
+        scope.account()
+    )) {
+        Ok(())
+    } else {
+        Err(error(Code::InvalidArn))
+    }
+}
+fn machine(text: &str, scope: &TenantScope) -> Result<StateMachineArn, StepFunctionsError> {
+    let value: StateMachineArn = text.parse().map_err(|e| source(Code::InvalidArn, e))?;
+    scoped(value.as_str(), scope)?;
+    Ok(value)
+}
+fn execution(text: &str, scope: &TenantScope) -> Result<ExecutionArn, StepFunctionsError> {
+    let value: ExecutionArn = text.parse().map_err(|e| source(Code::InvalidArn, e))?;
+    scoped(value.as_str(), scope)?;
+    Ok(value)
+}
+fn token(value: Option<String>) -> Result<Option<String>, StepFunctionsError> {
+    if value.as_ref().is_some_and(|t| {
+        t.len() != 64
+            || !t
+                .bytes()
+                .all(|b| b.is_ascii_digit() || matches!(b, b'a'..=b'f'))
+    }) {
+        return Err(error(Code::InvalidToken));
+    }
+    Ok(value)
+}
+fn included(value: Option<&IncludedData>) -> Result<(), StepFunctionsError> {
+    if value.is_some_and(|v| v != &IncludedData::AllData) {
+        Err(error(Code::UnsupportedOperation))
+    } else {
+        Ok(())
+    }
+}
+fn profile(
+    kind: Option<&StateMachineType>,
+    logging: Option<&LoggingConfiguration>,
+    tracing: Option<&TracingConfiguration>,
+    encryption: Option<&EncryptionConfiguration>,
+    publish: Option<bool>,
+    version: Option<&str>,
+) -> Result<(), StepFunctionsError> {
+    if kind.is_some_and(|v| v != &StateMachineType::Standard) {
+        return Err(error(Code::StateMachineTypeNotSupported));
+    }
+    if publish == Some(true)
+        || version.is_some()
+        || logging.is_some_and(|v| {
+            v.level.as_ref().is_some_and(|l| l != &LogLevel::Off) || !v.destinations.is_empty()
+        })
+        || tracing.is_some_and(|v| v.enabled == Some(true))
+        || encryption.is_some_and(|v| {
+            v.r#type != EncryptionType::AwsOwnedKey
+                || v.kms_key_id.is_some()
+                || v.kms_data_key_reuse_period_seconds.is_some()
+        })
+    {
+        return Err(error(Code::ValidationException));
+    }
+    Ok(())
+}
+fn validate(
+    v: &input::ValidateStateMachineDefinitionInput,
+    compiler: &AslCompiler,
+) -> Result<output::ValidateStateMachineDefinitionOutput, StepFunctionsError> {
+    profile(v.r#type.as_ref(), None, None, None, None, None)?;
+    let limit = match v.max_results {
+        None | Some(0) => 100,
+        Some(n) => usize::try_from(n)
+            .ok()
+            .filter(|n| *n <= 100)
+            .ok_or_else(|| error(Code::ValidationException))?,
+    };
+    let mut response = output::ValidateStateMachineDefinitionOutput::default();
+    let diagnostics = match compiler.compile(v.definition.as_bytes()) {
+        Ok(artifact) => {
+            response.result = ValidateStateMachineDefinitionResultCode::Ok;
+            artifact.warnings().to_vec()
+        }
+        Err(error) => {
+            response.result = ValidateStateMachineDefinitionResultCode::Fail;
+            vec![error.diagnostic().clone()]
+        }
+    };
+    let warnings = v.severity == Some(ValidateStateMachineDefinitionSeverity::Warning);
+    let mut diagnostics: Vec<_> = diagnostics
+        .iter()
+        .filter(|d| warnings || d.severity() == DiagnosticSeverity::Error)
+        .map(|d| {
+            let mut out = ValidateStateMachineDefinitionDiagnostic::default();
+            out.code = d.code().into();
+            out.message = d.message().into();
+            out.location = Some(d.location().into());
+            out.severity = if d.severity() == DiagnosticSeverity::Error {
+                ValidateStateMachineDefinitionSeverity::Error
+            } else {
+                ValidateStateMachineDefinitionSeverity::Warning
+            };
+            out
+        })
+        .collect();
+    response.truncated = Some(diagnostics.len() > limit);
+    diagnostics.truncate(limit);
+    response.diagnostics = diagnostics;
+    Ok(response)
+}
diff --git a/apps/rustack/src/stepfunctions_api/render.rs b/apps/rustack/src/stepfunctions_api/render.rs
new file mode 100644
index 00000000..1c7fd799
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api/render.rs
@@ -0,0 +1,187 @@
+//! Exact modeled M1 replies from immutable core captures.
+
+use std::{str, sync::Arc};
+
+use rustack_stepfunctions_core::{
+    ExecutionOutcome, ExecutionSnapshot, MachineSnapshot, MachineStatus, RegistryResult,
+};
+use rustack_stepfunctions_http::Response;
+use rustack_stepfunctions_model::{
+    StepFunctionsError, StepFunctionsErrorCode as Code, StepFunctionsOperation as Op, output,
+    types::{
+        CloudWatchEventsExecutionDataDetails, EncryptionConfiguration, EncryptionType,
+        ExecutionListItem, ExecutionStatus, LogLevel, LoggingConfiguration, StateMachineListItem,
+        StateMachineStatus, StateMachineType, Tag, TracingConfiguration,
+    },
+};
+
+use super::error::{error, source};
+
+pub(super) fn text(bytes: &[u8]) -> Result<String, StepFunctionsError> {
+    str::from_utf8(bytes)
+        .map(str::to_owned)
+        .map_err(|e| source(Code::InternalFailure, e))
+}
+pub(super) fn status(value: &ExecutionSnapshot) -> Result<ExecutionStatus, StepFunctionsError> {
+    Ok(match value.view().outcome().map(Arc::as_ref) {
+        None => ExecutionStatus::Running,
+        Some(ExecutionOutcome::Succeeded(_)) => ExecutionStatus::Succeeded,
+        Some(ExecutionOutcome::Failed(_)) => ExecutionStatus::Failed,
+        Some(ExecutionOutcome::TimedOut) => ExecutionStatus::TimedOut,
+        Some(ExecutionOutcome::Aborted(_)) => ExecutionStatus::Aborted,
+        _ => return Err(error(Code::InternalFailure)),
+    })
+}
+fn off() -> LoggingConfiguration {
+    let mut value = LoggingConfiguration::default();
+    value.level = Some(LogLevel::Off);
+    value
+}
+fn tracing() -> TracingConfiguration {
+    let mut value = TracingConfiguration::default();
+    value.enabled = Some(false);
+    value
+}
+fn encryption() -> EncryptionConfiguration {
+    let mut value = EncryptionConfiguration::default();
+    value.r#type = EncryptionType::AwsOwnedKey;
+    value
+}
+pub(super) fn tag(key: &str, value: &str) -> Tag {
+    let mut out = Tag::default();
+    out.key = Some(key.into());
+    out.value = Some(value.into());
+    out
+}
+pub(super) fn machine_item(m: &MachineSnapshot) -> StateMachineListItem {
+    let mut out = StateMachineListItem::default();
+    out.creation_date = m.creation_date();
+    out.name = m.arn().name().as_str().into();
+    out.state_machine_arn = m.arn().as_str().into();
+    out.r#type = StateMachineType::Standard;
+    out
+}
+pub(super) fn execution_item(
+    e: &ExecutionSnapshot,
+) -> Result<ExecutionListItem, StepFunctionsError> {
+    let mut out = ExecutionListItem::default();
+    out.execution_arn = e.arn().as_str().into();
+    out.name = e.arn().name().as_str().into();
+    out.start_date = e.start_date();
+    out.state_machine_arn = e.arn().machine().as_str().into();
+    out.status = status(e)?;
+    out.stop_date = e.view().stop_date();
+    Ok(out)
+}
+pub(super) fn render(op: Op, result: RegistryResult) -> Result<Response, StepFunctionsError> {
+    match (op, result) {
+        (Op::CreateStateMachine, RegistryResult::Machine(m)) => {
+            let mut out = output::CreateStateMachineOutput::default();
+            out.creation_date = m.creation_date();
+            out.state_machine_arn = m.arn().as_str().into();
+            Ok(out.into())
+        }
+        (Op::UpdateStateMachine, RegistryResult::Machine(m)) => {
+            let mut out = output::UpdateStateMachineOutput::default();
+            out.update_date = m.update_date();
+            out.revision_id = Some(m.revision().id().into());
+            Ok(out.into())
+        }
+        (Op::DeleteStateMachine, RegistryResult::Deleted) => {
+            Ok(output::DeleteStateMachineOutput::default().into())
+        }
+        (Op::TagResource, RegistryResult::Tags(_)) => {
+            Ok(output::TagResourceOutput::default().into())
+        }
+        (Op::UntagResource, RegistryResult::Tags(_)) => {
+            Ok(output::UntagResourceOutput::default().into())
+        }
+        (Op::ListTagsForResource, RegistryResult::Machine(m)) => {
+            let mut out = output::ListTagsForResourceOutput::default();
+            out.tags = m.tags().values().iter().map(|(k, v)| tag(k, v)).collect();
+            Ok(out.into())
+        }
+        (Op::ListStateMachineVersions, RegistryResult::Machine(_)) => {
+            Ok(output::ListStateMachineVersionsOutput::default().into())
+        }
+        (Op::DescribeStateMachine, RegistryResult::Machine(m)) => describe_machine(&m),
+        (Op::StartExecution, RegistryResult::Execution(e)) => {
+            let mut out = output::StartExecutionOutput::default();
+            out.execution_arn = e.arn().as_str().into();
+            out.start_date = e.start_date();
+            Ok(out.into())
+        }
+        (Op::DescribeExecution, RegistryResult::Execution(e)) => describe_execution(&e),
+        (Op::StopExecution, RegistryResult::Execution(e)) => {
+            let mut out = output::StopExecutionOutput::default();
+            out.stop_date = e
+                .view()
+                .stop_date()
+                .ok_or_else(|| error(Code::InternalFailure))?;
+            Ok(out.into())
+        }
+        (Op::DescribeStateMachineForExecution, RegistryResult::Execution(e)) => {
+            let mut out = output::DescribeStateMachineForExecutionOutput::default();
+            out.definition = text(e.revision().machine().original_bytes())?;
+            out.name = e.arn().machine().name().as_str().into();
+            out.role_arn = e.revision().role().as_str().into();
+            out.state_machine_arn = e.arn().machine().as_str().into();
+            out.revision_id = Some(e.revision().id().into());
+            out.update_date = e.revision().publication_date();
+            out.logging_configuration = Some(off());
+            out.tracing_configuration = Some(tracing());
+            out.encryption_configuration = Some(encryption());
+            Ok(out.into())
+        }
+        _ => Err(error(Code::InternalFailure)),
+    }
+}
+fn describe_machine(m: &MachineSnapshot) -> Result<Response, StepFunctionsError> {
+    let mut out = output::DescribeStateMachineOutput::default();
+    out.definition = text(m.revision().machine().original_bytes())?;
+    out.creation_date = m.creation_date();
+    out.name = m.arn().name().as_str().into();
+    out.role_arn = m.revision().role().as_str().into();
+    out.state_machine_arn = m.arn().as_str().into();
+    out.revision_id = Some(m.revision().id().into());
+    out.r#type = StateMachineType::Standard;
+    out.status = Some(match m.status() {
+        MachineStatus::Active => StateMachineStatus::Active,
+        MachineStatus::Deleting => StateMachineStatus::Deleting,
+        _ => return Err(error(Code::InternalFailure)),
+    });
+    out.logging_configuration = Some(off());
+    out.tracing_configuration = Some(tracing());
+    out.encryption_configuration = Some(encryption());
+    Ok(out.into())
+}
+fn describe_execution(e: &ExecutionSnapshot) -> Result<Response, StepFunctionsError> {
+    let mut out = output::DescribeExecutionOutput::default();
+    out.execution_arn = e.arn().as_str().into();
+    out.state_machine_arn = e.arn().machine().as_str().into();
+    out.start_date = e.start_date();
+    out.stop_date = e.view().stop_date();
+    out.status = status(e)?;
+    out.name = Some(e.arn().name().as_str().into());
+    out.input = Some(text(e.input().original_bytes())?);
+    out.trace_header = e.trace_header().map(str::to_owned);
+    let mut details = CloudWatchEventsExecutionDataDetails::default();
+    details.included = Some(true);
+    out.input_details = Some(details.clone());
+    match e.view().outcome().map(Arc::as_ref) {
+        Some(ExecutionOutcome::Succeeded(payload)) => {
+            out.output = Some(text(payload.original_bytes())?);
+            out.output_details = Some(details);
+        }
+        Some(ExecutionOutcome::Failed(f)) => {
+            out.error = f.error().map(str::to_owned);
+            out.cause = f.cause().map(str::to_owned);
+        }
+        Some(ExecutionOutcome::Aborted(f)) => {
+            out.error = f.details().error().map(str::to_owned);
+            out.cause = f.details().cause().map(str::to_owned);
+        }
+        _ => {}
+    }
+    Ok(out.into())
+}
diff --git a/apps/rustack/src/stepfunctions_api/tests.rs b/apps/rustack/src/stepfunctions_api/tests.rs
new file mode 100644
index 00000000..8f51bd62
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api/tests.rs
@@ -0,0 +1,942 @@
+//! Real typed HTTP → API owner → registry → execution semantics.
+
+use std::{sync::Arc, time::Duration};
+
+use bytes::Bytes;
+use http::{Request as HttpRequest, StatusCode};
+use http_body_util::{BodyExt, Full};
+use rustack_stepfunctions_core::{
+    ExecutionLimits, ExecutionSupervisor, HistoryLimits, RegistryLimits, RegistrySupervisor,
+    RuntimeLimits,
+};
+use rustack_stepfunctions_http::{
+    CONTENT_TYPE, RequestScope, StepFunctionsHttpConfig, StepFunctionsHttpService,
+};
+use serde_json::{Value, json};
+
+use super::*;
+
+struct Fixture {
+    service: StepFunctionsHttpService,
+    api: ApiSupervisor,
+    registry: RegistrySupervisor,
+    handle: Arc<StepFunctionsApi>,
+}
+impl Fixture {
+    fn new(limits: ApiLimits) -> Self {
+        let scope = TenantScope::default();
+        let runtime = ExecutionSupervisor::new(
+            RuntimeLimits::default(),
+            HistoryLimits::default(),
+            256 * 1024 * 1024,
+            None,
+        )
+        .unwrap();
+        let (registry, owner) = Registry::new(
+            scope.clone(),
+            RegistryLimits::default(),
+            runtime,
+            ExecutionLimits::default(),
+        )
+        .unwrap();
+        Self::from_registry(registry, owner, TaskSupport::Disabled, limits)
+    }
+    fn from_registry(
+        registry: Registry,
+        owner: RegistrySupervisor,
+        tasks: TaskSupport,
+        limits: ApiLimits,
+    ) -> Self {
+        let scope = registry.scope().clone();
+        let (handle, api) = StepFunctionsApi::new(scope.clone(), tasks, registry, limits).unwrap();
+        let config = StepFunctionsHttpConfig::new(
+            RequestScope::new(
+                scope.partition().into(),
+                scope.region().into(),
+                scope.account().into(),
+            )
+            .unwrap(),
+            true,
+            None,
+        )
+        .unwrap();
+        Self {
+            service: StepFunctionsHttpService::new(handle.clone(), config),
+            api,
+            registry: owner,
+            handle,
+        }
+    }
+    async fn call(&self, action: &str, input: Value) -> (StatusCode, Value) {
+        let request = HttpRequest::builder()
+            .method("POST")
+            .uri("/")
+            .header("content-type", CONTENT_TYPE)
+            .header("x-amz-target", format!("AWSStepFunctions.{action}"))
+            .body(Full::new(Bytes::from(serde_json::to_vec(&input).unwrap())))
+            .unwrap();
+        let response = self.service.handle(request).await;
+        let status = response.status();
+        assert!(response.headers().contains_key("x-amzn-requestid"));
+        let body = response.into_body().collect().await.unwrap().to_bytes();
+        (
+            status,
+            if body.is_empty() {
+                Value::Null
+            } else {
+                serde_json::from_slice(&body).unwrap()
+            },
+        )
+    }
+    async fn create(&self, name: &str, definition: Value) -> String {
+        let(status,response)=self.call("CreateStateMachine",json!({"name":name,"roleArn":"arn:aws:iam::000000000000:role/Workflow","definition":definition.to_string()})).await;
+        assert_eq!(status, StatusCode::OK, "{response}");
+        response["stateMachineArn"].as_str().unwrap().into()
+    }
+    async fn wait(&self, arn: &str) -> Value {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        loop {
+            let (status, response) = self
+                .call("DescribeExecution", json!({"executionArn":arn}))
+                .await;
+            assert_eq!(status, StatusCode::OK);
+            if response["status"] != "RUNNING" {
+                return response;
+            }
+            assert!(Instant::now() < deadline);
+            tokio::task::yield_now().await;
+        }
+    }
+    async fn close(&mut self) {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        let api = self.api.shutdown(deadline).await;
+        let registry = self.registry.shutdown(deadline).await;
+        assert!(api.is_ok(), "{api:?}");
+        assert!(registry.is_ok(), "{registry:?}");
+    }
+}
+
+mod callback;
+fn succeed() -> Value {
+    json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}})
+}
+fn wait() -> Value {
+    json!({"StartAt":"Waiting","States":{"Waiting":{"Type":"Wait","Seconds":60,"Next":"Done"},"Done":{"Type":"Succeed"}}})
+}
+async fn tag_roundtrip(f: &Fixture, arn: &str) {
+    let (status, _) = f
+        .call(
+            "TagResource",
+            json!({"resourceArn":arn,"tags":[{"key":"team","value":"workflow"}]}),
+        )
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    let (_, tags) = f
+        .call("ListTagsForResource", json!({"resourceArn":arn}))
+        .await;
+    assert_eq!(tags["tags"][0]["value"], "workflow");
+    assert_eq!(
+        f.call(
+            "UntagResource",
+            json!({"resourceArn":arn,"tagKeys":["team"]})
+        )
+        .await
+        .0,
+        StatusCode::OK
+    );
+}
+#[tokio::test]
+async fn test_should_serve_all_fifteen_real_m1_operations_and_captured_revisions() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let arn = f.create("Workflow", succeed()).await;
+    let (status, original) = f
+        .call("DescribeStateMachine", json!({"stateMachineArn":arn}))
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(original["status"], "ACTIVE");
+    assert!(original["creationDate"].is_number());
+    tag_roundtrip(&f, &arn).await;
+    let (_, started) = f
+        .call(
+            "StartExecution",
+            json!({"stateMachineArn":arn,"name":"first","input":" {\"n\":7} ","traceHeader":""}),
+        )
+        .await;
+    let execution = started["executionArn"].as_str().unwrap();
+    let finished = f.wait(execution).await;
+    assert_eq!(finished["status"], "SUCCEEDED");
+    assert_eq!(finished["input"], " {\"n\":7} ");
+    assert_eq!(
+        serde_json::from_str::<Value>(finished["output"].as_str().unwrap()).unwrap(),
+        json!({"n":7})
+    );
+    let (_, updated) = f
+        .call(
+            "UpdateStateMachine",
+            json!({"stateMachineArn":arn,"definition":wait().to_string()}),
+        )
+        .await;
+    assert_ne!(updated["revisionId"], original["revisionId"]);
+    let (_, captured) = f
+        .call(
+            "DescribeStateMachineForExecution",
+            json!({"executionArn":execution}),
+        )
+        .await;
+    assert_eq!(captured["revisionId"], original["revisionId"]);
+    assert_eq!(captured["definition"], original["definition"]);
+    assert_eq!(captured["updateDate"], original["creationDate"]);
+    let (_, list) = f
+        .call("ListExecutions", json!({"stateMachineArn":arn}))
+        .await;
+    assert_eq!(list["executions"].as_array().unwrap().len(), 1);
+    let (_, history) = f
+        .call("GetExecutionHistory", json!({"executionArn":execution}))
+        .await;
+    assert_eq!(
+        history["events"].as_array().unwrap().last().unwrap()["type"],
+        "ExecutionSucceeded"
+    );
+    assert_eq!(
+        f.call(
+            "ValidateStateMachineDefinition",
+            json!({"definition":succeed().to_string()})
+        )
+        .await
+        .1["result"],
+        "OK"
+    );
+    assert_eq!(
+        f.call("ListStateMachines", json!({})).await.1["stateMachines"]
+            .as_array()
+            .unwrap()
+            .len(),
+        1
+    );
+    let (_, running) = f
+        .call(
+            "StartExecution",
+            json!({"stateMachineArn":arn,"name":"stop"}),
+        )
+        .await;
+    let stop = running["executionArn"].as_str().unwrap();
+    let (_, stopped) = f
+        .call(
+            "StopExecution",
+            json!({"executionArn":stop,"error":"","cause":""}),
+        )
+        .await;
+    let terminal = f.wait(stop).await;
+    assert_eq!(terminal["status"], "ABORTED");
+    assert_eq!(terminal["stopDate"], stopped["stopDate"]);
+    assert_eq!(terminal["error"], "");
+    assert_eq!(
+        f.call("DeleteStateMachine", json!({"stateMachineArn":arn}))
+            .await
+            .0,
+        StatusCode::OK
+    );
+    assert_eq!(
+        f.call("DescribeExecution", json!({"executionArn":execution}))
+            .await
+            .0,
+        StatusCode::OK
+    );
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_filter_validate_diagnostics_without_mutation_and_reject_profiles() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let definition = json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"},"Unused":{"Type":"Succeed"},"Other":{"Type":"Succeed"}}});
+    let (_, errors) = f
+        .call(
+            "ValidateStateMachineDefinition",
+            json!({"definition":definition.to_string()}),
+        )
+        .await;
+    assert_eq!(errors["result"], "OK");
+    assert_eq!(errors["diagnostics"], json!([]));
+    let (_, warnings) = f
+        .call(
+            "ValidateStateMachineDefinition",
+            json!({"definition":definition.to_string(),"severity":"WARNING","maxResults":1}),
+        )
+        .await;
+    assert_eq!(warnings["diagnostics"].as_array().unwrap().len(), 1);
+    assert_eq!(warnings["truncated"], true);
+    let (status, invalid) = f
+        .call(
+            "ValidateStateMachineDefinition",
+            json!({"definition":"not json"}),
+        )
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(invalid["result"], "FAIL");
+    for extra in [
+        json!({"type":"EXPRESS"}),
+        json!({"publish":true}),
+        json!({"tracingConfiguration":{"enabled":true}}),
+        json!({"loggingConfiguration":{"level":"ALL"}}),
+        json!({"encryptionConfiguration":{"type":"CUSTOMER_MANAGED_KMS_KEY"}}),
+    ] {
+        let mut input = json!({"name":"Rejected","roleArn":"arn:aws:iam::000000000000:role/Workflow","definition":succeed().to_string()});
+        input
+            .as_object_mut()
+            .unwrap()
+            .extend(extra.as_object().unwrap().clone());
+        assert_eq!(
+            f.call("CreateStateMachine", input).await.0,
+            StatusCode::BAD_REQUEST
+        );
+    }
+    assert_eq!(
+        f.call("ListStateMachines", json!({})).await.1["stateMachines"]
+            .as_array()
+            .unwrap()
+            .len(),
+        0
+    );
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_bind_stable_machine_cursor_to_full_query_and_replay_after_deletion() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let a = f.create("A", succeed()).await;
+    let b = f.create("B", succeed()).await;
+    let (_, first) = f.call("ListStateMachines", json!({"maxResults":1})).await;
+    let token = first["nextToken"].as_str().unwrap();
+    assert_eq!(token.len(), 64);
+    f.call("DeleteStateMachine", json!({"stateMachineArn":b}))
+        .await;
+    f.create("C", succeed()).await;
+    for _ in 0..2 {
+        let (status, next) = f
+            .call(
+                "ListStateMachines",
+                json!({"maxResults":1,"nextToken":token}),
+            )
+            .await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(next["stateMachines"][0]["name"], "B");
+        assert!(next.get("nextToken").is_none());
+    }
+    for (op, input) in [
+        (
+            "ListStateMachines",
+            json!({"maxResults":2,"nextToken":token}),
+        ),
+        (
+            "ListExecutions",
+            json!({"stateMachineArn":a,"maxResults":1,"nextToken":token}),
+        ),
+        (
+            "ListStateMachines",
+            json!({"maxResults":1,"nextToken":"f".repeat(64)}),
+        ),
+    ] {
+        let (status, error) = f.call(op, input).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert_eq!(error["__type"], "InvalidToken");
+    }
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_page_reverse_and_data_disabled_history_with_fixed_high_water() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let arn = f.create("History", succeed()).await;
+    let (_, started) = f
+        .call(
+            "StartExecution",
+            json!({"stateMachineArn":arn,"input":"{\"secret\":7}"}),
+        )
+        .await;
+    let arn = started["executionArn"].as_str().unwrap();
+    f.wait(arn).await;
+    let(_,first)=f.call("GetExecutionHistory",json!({"executionArn":arn,"maxResults":1,"reverseOrder":true,"includeExecutionData":false})).await;
+    assert_eq!(first["events"][0]["type"], "ExecutionSucceeded");
+    assert!(
+        first["events"][0]["executionSucceededEventDetails"]
+            .get("output")
+            .is_none()
+    );
+    let token = first["nextToken"].clone();
+    let(_,next)=f.call("GetExecutionHistory",json!({"executionArn":arn,"maxResults":1,"reverseOrder":true,"includeExecutionData":false,"nextToken":token})).await;
+    assert!(next["events"][0]["id"].as_i64().unwrap() < first["events"][0]["id"].as_i64().unwrap());
+    let(_,invalid)=f.call("GetExecutionHistory",json!({"executionArn":arn,"maxResults":1,"reverseOrder":false,"includeExecutionData":false,"nextToken":token})).await;
+    assert_eq!(invalid["__type"], "InvalidToken");
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_preserve_running_start_idempotency_and_raw_input_rejection_over_http() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let arn = f.create("Wait", wait()).await;
+    let input = json!({"stateMachineArn":arn,"name":"run","input":" {\"n\":7}"});
+    let (_, first) = f.call("StartExecution", input.clone()).await;
+    let (_, second) = f.call("StartExecution", input).await;
+    assert_eq!(first, second);
+    assert_eq!(
+        f.call(
+            "StartExecution",
+            json!({"stateMachineArn":arn,"name":"run","input":"{\"n\":7}"})
+        )
+        .await
+        .1["__type"],
+        "ExecutionAlreadyExists"
+    );
+    assert_eq!(
+        f.call("StartExecution", json!({"stateMachineArn":arn,"input":""}))
+            .await
+            .0,
+        StatusCode::BAD_REQUEST
+    );
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_report_explicit_unsupported_fields_and_keep_scope_and_readiness() {
+    let mut f = Fixture::new(ApiLimits::default());
+    assert!(f.handle.is_ready());
+    let arn = f.create("Scope", succeed()).await;
+    assert_eq!(
+        f.call(
+            "UpdateStateMachine",
+            json!({"stateMachineArn":arn,"loggingConfiguration":{"level":"OFF"}})
+        )
+        .await
+        .1["__type"],
+        "MissingRequiredParameter"
+    );
+    for (op, input) in [
+        (
+            "DescribeStateMachine",
+            json!({"stateMachineArn":arn,"includedData":"METADATA_ONLY"}),
+        ),
+        (
+            "ListExecutions",
+            json!({"stateMachineArn":arn,"statusFilter":"PENDING_REDRIVE"}),
+        ),
+        ("SendTaskHeartbeat", json!({"taskToken":"opaque"})),
+    ] {
+        assert_eq!(f.call(op, input).await.1["__type"], "UnsupportedOperation");
+    }
+    assert_eq!(
+        f.call(
+            "DescribeStateMachine",
+            json!({"stateMachineArn":"arn:aws:states:us-west-2:000000000000:stateMachine:Scope"})
+        )
+        .await
+        .1["__type"],
+        "InvalidArn"
+    );
+    f.close().await;
+    assert!(!f.handle.is_ready());
+}
+
+#[tokio::test]
+async fn test_should_map_missing_tag_resources_and_reject_cumulative_tag_quota_atomically() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let missing = "arn:aws:states:us-east-1:000000000000:stateMachine:Missing";
+    for (op, input) in [
+        ("TagResource", json!({"resourceArn":missing,"tags":[]})),
+        ("UntagResource", json!({"resourceArn":missing,"tagKeys":[]})),
+        ("ListTagsForResource", json!({"resourceArn":missing})),
+    ] {
+        let (status, reply) = f.call(op, input).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert_eq!(reply["__type"], "ResourceNotFound");
+    }
+    let arn = f.create("Tags", succeed()).await;
+    let tags: Vec<_> = (0..50)
+        .map(|n| json!({"key":format!("key{n}"),"value":"v"}))
+        .collect();
+    assert_eq!(
+        f.call("TagResource", json!({"resourceArn":arn,"tags":tags}))
+            .await
+            .0,
+        StatusCode::OK
+    );
+    let (status, reply) = f
+        .call(
+            "TagResource",
+            json!({"resourceArn":arn,"tags":[{"key":"extra"}]}),
+        )
+        .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert_eq!(reply["__type"], "TooManyTags");
+    assert_eq!(
+        f.call("ListTagsForResource", json!({"resourceArn":arn}))
+            .await
+            .1["tags"]
+            .as_array()
+            .unwrap()
+            .len(),
+        50
+    );
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_hold_execution_status_cursor_boundary_across_later_stop() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let arn = f.create("Filtered", wait()).await;
+    let mut executions = Vec::new();
+    for name in ["a", "b", "c"] {
+        executions.push(
+            f.call("StartExecution", json!({"stateMachineArn":arn,"name":name}))
+                .await
+                .1["executionArn"]
+                .as_str()
+                .unwrap()
+                .to_owned(),
+        );
+    }
+    let (_, first) = f
+        .call(
+            "ListExecutions",
+            json!({"stateMachineArn":arn,"statusFilter":"RUNNING","maxResults":1}),
+        )
+        .await;
+    let token = first["nextToken"].clone();
+    for execution in executions {
+        f.call("StopExecution", json!({"executionArn":execution}))
+            .await;
+    }
+    let(status,second)=f.call("ListExecutions",json!({"stateMachineArn":arn,"statusFilter":"RUNNING","maxResults":1,"nextToken":token})).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(second["executions"][0]["status"], "RUNNING");
+    assert_ne!(
+        first["executions"][0]["executionArn"],
+        second["executions"][0]["executionArn"]
+    );
+    assert_eq!(
+        f.call(
+            "ListExecutions",
+            json!({"stateMachineArn":arn,"statusFilter":"ABORTED","maxResults":1,"nextToken":token})
+        )
+        .await
+        .1["__type"],
+        "InvalidToken"
+    );
+    f.close().await;
+}
+fn controlled(
+    work: impl FnOnce() -> Result<Response, StepFunctionsError> + Send + 'static,
+    deadline: Instant,
+    panic_worker: bool,
+) -> (
+    Arc<StepFunctionsApi>,
+    ApiSupervisor,
+    RegistrySupervisor,
+    oneshot::Receiver<Reply>,
+) {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )
+    .unwrap();
+    let (registry, registry_owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+    )
+    .unwrap();
+    let (api, mut owner, stop) = StepFunctionsApi::compose(
+        TenantScope::default(),
+        TaskSupport::Disabled,
+        registry,
+        ApiLimits::new(1, 1, 32, 8 * 1024 * 1024).unwrap(),
+    )
+    .unwrap();
+    let state = owner.state.as_mut().unwrap();
+    let context = state.io.context.clone();
+    let (reply, receiver) = oneshot::channel();
+    let permit = api.admission.capacity.clone().try_acquire_owned().unwrap();
+    let job = state.jobs.spawn(async move {
+        assert!(!panic_worker, "controlled API worker failure");
+        worker::cpu(&context, deadline, work).await
+    });
+    state.slots.insert(job.id(), Slot { reply, permit });
+    let supervisor = ApiSupervisor {
+        closing: api.admission.closing.clone(),
+        join: Some(spawn(owner.run(stop))),
+        result: None,
+    };
+    (api, supervisor, registry_owner, receiver)
+}
+fn ready_response() -> Response {
+    rustack_stepfunctions_model::output::ListStateMachinesOutput::default().into()
+}
+#[tokio::test]
+async fn test_should_join_same_blocking_work_after_shutdown_observation_expires() {
+    let (entered, ready) = oneshot::channel();
+    let (release, gate) = std::sync::mpsc::channel::<()>();
+    let (api, mut owner, mut registry, receiver) = controlled(
+        move || {
+            let _sent = entered.send(());
+            let _released = gate.recv();
+            Ok(ready_response())
+        },
+        Instant::now() + Duration::from_secs(5),
+        false,
+    );
+    ready.await.unwrap();
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_millis(5))
+            .await,
+        Err(ApiError::Deadline)
+    ));
+    assert_eq!(api.admission.capacity.available_permits(), 0);
+    drop(release);
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+    let reply = receiver.await.unwrap();
+    assert!(reply.result.is_ok());
+    assert_eq!(api.admission.capacity.available_permits(), 0);
+    drop(reply.permit);
+    assert_eq!(api.admission.capacity.available_permits(), 1);
+    registry
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+#[tokio::test]
+async fn test_should_retain_root_slot_after_abort_even_when_blocking_work_finishes() {
+    let (entered, ready) = oneshot::channel();
+    let (release, gate) = std::sync::mpsc::channel::<()>();
+    let (done, finished) = oneshot::channel();
+    let (api, mut owner, mut registry, _receiver) = controlled(
+        move || {
+            let _sent = entered.send(());
+            let _released = gate.recv();
+            let _done = done.send(());
+            Ok(ready_response())
+        },
+        Instant::now() + Duration::from_secs(5),
+        false,
+    );
+    ready.await.unwrap();
+    owner.join.as_ref().unwrap().abort();
+    assert!(
+        owner
+            .shutdown(Instant::now() + Duration::from_secs(5))
+            .await
+            .is_err()
+    );
+    drop(release);
+    finished.await.unwrap();
+    assert_eq!(api.admission.capacity.available_permits(), 0);
+    assert!(!api.is_ready());
+    registry
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+#[tokio::test]
+async fn test_should_keep_worker_diagnostic_after_quarantined_shutdown() {
+    let (api, mut owner, mut registry, receiver) = controlled(
+        || Ok(ready_response()),
+        Instant::now() + Duration::from_secs(5),
+        true,
+    );
+    let reply = receiver.await.unwrap();
+    assert_eq!(reply.result.unwrap_err().code, Code::InternalFailure);
+    assert!(matches!(
+        api.diagnostic().as_deref(),
+        Some(ApiError::Worker(_))
+    ));
+    assert!(
+        owner
+            .shutdown(Instant::now() + Duration::from_secs(5))
+            .await
+            .is_err()
+    );
+    assert!(matches!(
+        api.diagnostic().as_deref(),
+        Some(ApiError::Worker(_))
+    ));
+    assert_eq!(api.admission.capacity.available_permits(), 0);
+    registry
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_join_cpu_then_reject_a_ready_result_after_its_deadline() {
+    let (entered, mut ready) = oneshot::channel();
+    let (release, gate) = std::sync::mpsc::channel::<()>();
+    let deadline = Instant::now() + Duration::from_secs(5);
+    let (_, mut owner, mut registry, receiver) = controlled(
+        move || {
+            let _sent = entered.send(());
+            let _released = gate.recv();
+            Ok(ready_response())
+        },
+        deadline,
+        false,
+    );
+    let observed = std::time::Instant::now() + Duration::from_secs(5);
+    loop {
+        match ready.try_recv() {
+            Ok(()) => break,
+            Err(oneshot::error::TryRecvError::Empty) => {
+                assert!(std::time::Instant::now() < observed);
+                tokio::task::yield_now().await;
+            }
+            Err(oneshot::error::TryRecvError::Closed) => panic!("CPU worker did not enter"),
+        }
+    }
+    tokio::time::advance(Duration::from_secs(6)).await;
+    drop(release);
+    let error = receiver.await.unwrap().result.unwrap_err();
+    assert_eq!(error.code, Code::RequestTimeoutException);
+    assert_eq!(error.status_code, StatusCode::REQUEST_TIMEOUT);
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+    registry
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+#[derive(Default)]
+struct WakeFlag(std::sync::atomic::AtomicBool);
+impl std::task::Wake for WakeFlag {
+    fn wake(self: Arc<Self>) {
+        self.0.store(true, std::sync::atomic::Ordering::SeqCst);
+    }
+}
+struct CaptureContext(mpsc::Sender<RequestContext>);
+#[async_trait]
+impl StepFunctionsHandler for CaptureContext {
+    async fn handle(
+        &self,
+        context: RequestContext,
+        _request: Request,
+    ) -> Result<Response, StepFunctionsError> {
+        self.0.send(context).await.unwrap();
+        Ok(ready_response())
+    }
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_an_already_ready_typed_reply_when_observer_resumes_after_deadline() {
+    let mut fixture = Fixture::new(ApiLimits::default());
+    let (tx, mut rx) = mpsc::channel(1);
+    let config = StepFunctionsHttpConfig::new(
+        RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into()).unwrap(),
+        true,
+        None,
+    )
+    .unwrap()
+    .with_budgets(
+        rustack_core::http::BodyBudget::control(),
+        Duration::from_secs(1),
+    )
+    .unwrap();
+    let service = StepFunctionsHttpService::new(Arc::new(CaptureContext(tx)), config);
+    let request = HttpRequest::builder()
+        .method("POST")
+        .uri("/")
+        .header("content-type", CONTENT_TYPE)
+        .header("x-amz-target", "AWSStepFunctions.ListStateMachines")
+        .body(Full::new(Bytes::from_static(b"{}")))
+        .unwrap();
+    service.handle(request).await;
+    let context = rx.recv().await.unwrap();
+    let deadline = context.deadline();
+    let api = fixture.handle.clone();
+    let request = Request::decode(
+        rustack_stepfunctions_model::StepFunctionsOperation::ListStateMachines,
+        b"{}",
+    )
+    .unwrap();
+    let mut future = api.handle(context, request);
+    let flag = Arc::new(WakeFlag::default());
+    let waker = std::task::Waker::from(flag.clone());
+    let mut task = std::task::Context::from_waker(&waker);
+    assert!(future.as_mut().poll(&mut task).is_pending());
+    let observed = std::time::Instant::now() + Duration::from_secs(5);
+    while !flag.0.load(std::sync::atomic::Ordering::SeqCst) {
+        assert!(std::time::Instant::now() < observed);
+        assert!(Instant::now() < deadline);
+        tokio::task::yield_now().await;
+    }
+    assert!(Instant::now() < deadline);
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert_eq!(
+        future.await.unwrap_err().code,
+        Code::RequestTimeoutException
+    );
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_mismatched_trusted_http_scope_before_dispatch() {
+    let mut fixture = Fixture::new(ApiLimits::default());
+    let config = StepFunctionsHttpConfig::new(
+        RequestScope::new("aws".into(), "us-west-2".into(), "111111111111".into()).unwrap(),
+        true,
+        None,
+    )
+    .unwrap();
+    fixture.service = StepFunctionsHttpService::new(fixture.handle.clone(), config);
+    let (status, body) = fixture.call("ListStateMachines", json!({})).await;
+    assert_eq!(status, StatusCode::FORBIDDEN);
+    assert_eq!(body["__type"], "AccessDeniedException");
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_preserve_optional_failure_fields_in_describe_and_terminal_history() {
+    let mut f = Fixture::new(ApiLimits::default());
+    for (name, state) in [
+        ("OmittedFailure", json!({"Type":"Fail"})),
+        (
+            "NamedFailure",
+            json!({"Type":"Fail","Error":"BusinessError","Cause":"quoted \"cause\" 中文"}),
+        ),
+    ] {
+        let arn = f
+            .create(name, json!({"StartAt":"F","States":{"F":state}}))
+            .await;
+        let (_, started) = f
+            .call("StartExecution", json!({"stateMachineArn":arn}))
+            .await;
+        let execution = started["executionArn"].as_str().unwrap();
+        let description = f.wait(execution).await;
+        let (_, history) = f
+            .call(
+                "GetExecutionHistory",
+                json!({"executionArn":execution,"reverseOrder":true}),
+            )
+            .await;
+        assert_eq!(description["status"], "FAILED");
+        assert_eq!(description.get("error"), state.get("Error"));
+        assert_eq!(description.get("cause"), state.get("Cause"));
+        assert_eq!(description.get("output"), None);
+        let details = &history["events"][0]["executionFailedEventDetails"];
+        assert_eq!(details.get("error"), description.get("error"));
+        assert_eq!(details.get("cause"), description.get("cause"));
+    }
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_map_execution_timeout_consistently_after_start_request_has_completed() {
+    let mut f = Fixture::new(ApiLimits::default());
+    let mut definition = wait();
+    definition["TimeoutSeconds"] = json!(1);
+    let arn = f.create("Timeout", definition).await;
+    let (_, started) = f
+        .call("StartExecution", json!({"stateMachineArn":arn}))
+        .await;
+    let execution = started["executionArn"].as_str().unwrap();
+    let description = f.wait(execution).await;
+    let (_, history) = f
+        .call(
+            "GetExecutionHistory",
+            json!({"executionArn":execution,"reverseOrder":true}),
+        )
+        .await;
+    assert_eq!(description["status"], "TIMED_OUT");
+    assert!(description.get("error").is_none());
+    assert!(description.get("cause").is_none());
+    let details = &history["events"][0]["executionTimedOutEventDetails"];
+    assert!(details.get("error").is_none());
+    assert!(details.get("cause").is_none());
+    assert_eq!(history["events"][0]["type"], "ExecutionTimedOut");
+    f.close().await;
+}
+
+#[tokio::test]
+async fn test_should_list_only_empty_published_inventory_for_existing_scoped_machines() {
+    let mut fixture = Fixture::new(ApiLimits::default());
+    let arn = fixture.create("UnpublishedInventory", succeed()).await;
+    let before = fixture
+        .call("DescribeStateMachine", json!({"stateMachineArn":arn}))
+        .await
+        .1;
+    for maximum in [None, Some(0), Some(1), Some(1000)] {
+        let mut input = json!({"stateMachineArn":arn});
+        if let Some(maximum) = maximum {
+            input["maxResults"] = json!(maximum);
+        }
+        let (status, response) = fixture.call("ListStateMachineVersions", input).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(response, json!({"stateMachineVersions":[]}));
+    }
+    for (input, code) in [
+        (
+            json!({"stateMachineArn":arn,"nextToken":"unissued"}),
+            "InvalidToken",
+        ),
+        (
+            json!({"stateMachineArn":arn,"nextToken":""}),
+            "InvalidToken",
+        ),
+        (
+            json!({"stateMachineArn":arn,"nextToken":"x".repeat(1025)}),
+            "InvalidToken",
+        ),
+        (
+            json!({"stateMachineArn":arn,"nextToken":"é"}),
+            "InvalidToken",
+        ),
+        (
+            json!({"stateMachineArn":arn,"maxResults":-1}),
+            "ValidationException",
+        ),
+        (
+            json!({"stateMachineArn":arn,"maxResults":1001}),
+            "ValidationException",
+        ),
+        (json!({"stateMachineArn":format!("{arn}:1")}), "InvalidArn"),
+        (
+            json!({"stateMachineArn":format!("{arn}:alias")}),
+            "InvalidArn",
+        ),
+        (
+            json!({"stateMachineArn":"arn:aws:states:us-west-2:000000000000:stateMachine:Foreign"}),
+            "InvalidArn",
+        ),
+        (
+            json!({"stateMachineArn":"arn:aws:states:us-east-1:000000000000:stateMachine:Missing"}),
+            "StateMachineDoesNotExist",
+        ),
+    ] {
+        let (status, response) = fixture.call("ListStateMachineVersions", input).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert_eq!(response["__type"], code);
+    }
+    let (status, response) = fixture
+        .call(
+            "UpdateStateMachine",
+            json!({"stateMachineArn":arn,"publish":true}),
+        )
+        .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert_eq!(response["__type"], "ValidationException");
+    assert_eq!(
+        fixture
+            .call("DescribeStateMachine", json!({"stateMachineArn":arn}))
+            .await
+            .1,
+        before
+    );
+    assert_eq!(
+        fixture
+            .call("DeleteStateMachine", json!({"stateMachineArn":arn}))
+            .await
+            .0,
+        StatusCode::OK
+    );
+    let (status, response) = fixture
+        .call("ListStateMachineVersions", json!({"stateMachineArn":arn}))
+        .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert_eq!(response["__type"], "StateMachineDoesNotExist");
+    fixture.close().await;
+}
diff --git a/apps/rustack/src/stepfunctions_api/tests/callback.rs b/apps/rustack/src/stepfunctions_api/tests/callback.rs
new file mode 100644
index 00000000..e13dd227
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api/tests/callback.rs
@@ -0,0 +1,746 @@
+//! Real public callback requests over a registered observed ASL port.
+
+use rustack_stepfunctions_core::{
+    AslError, CallbackCommand, CallbackError, CallbackInvocationMetadata, CallbackLimits,
+    CallbackRegistry, CallbackSupervisor, CallbackToken, ExecutionOutcome, LambdaTaskCommand,
+    LambdaTaskPort, Payload, RegistryCommand, RegistryResult, StateSupport, TaskCall, TaskFailure,
+    TaskResponder,
+};
+use rustack_stepfunctions_model::StepFunctionsOperation as Op;
+use tokio::time::{sleep, sleep_until, timeout_at};
+use uuid::Uuid;
+
+use super::*;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+#[derive(Debug)]
+struct Port(mpsc::Sender<(LambdaTaskCommand, TaskResponder)>);
+impl LambdaTaskPort for Port {
+    fn start(&self, command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        let (call, responder) = TaskCall::channel();
+        self.0
+            .try_send((command, responder))
+            .map_err(|_| TaskFailure::service_exception())?;
+        Ok(call)
+    }
+}
+struct CallbackFixture {
+    inner: Fixture,
+    registry: Registry,
+    callbacks: CallbackSupervisor,
+    calls: mpsc::Receiver<(LambdaTaskCommand, TaskResponder)>,
+}
+impl CallbackFixture {
+    fn new() -> Self {
+        Self::scoped(TenantScope::default())
+    }
+    fn scoped(scope: TenantScope) -> Self {
+        let (callbacks, callback_owner) =
+            CallbackRegistry::new(scope.clone(), CallbackLimits::default()).unwrap();
+        let (sender, calls) = mpsc::channel(8);
+        let mut runtime = ExecutionSupervisor::new(
+            RuntimeLimits::new(8, 1, 2).unwrap(),
+            HistoryLimits::default(),
+            256 * 1024 * 1024,
+            Some(Arc::new(Port(sender))),
+        )
+        .unwrap();
+        runtime.install_callbacks(callbacks).unwrap();
+        let (registry, owner) = Registry::new_with_state_support(
+            scope,
+            RegistryLimits::default(),
+            runtime,
+            ExecutionLimits::default(),
+            StateSupport::Structured,
+        )
+        .unwrap();
+        let inner = Fixture::from_registry(
+            registry.clone(),
+            owner,
+            TaskSupport::Lambda,
+            ApiLimits::default(),
+        );
+        Self {
+            inner,
+            registry,
+            callbacks: callback_owner,
+            calls,
+        }
+    }
+    async fn start(&self, extra: Value) -> String {
+        let mut task = json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","TimeoutSeconds":60,"Parameters":{"FunctionName":"Worker","Payload":{"token.$":"$$.Task.Token","retry.$":"$$.State.RetryCount"}},"End":true});
+        task.as_object_mut()
+            .unwrap()
+            .extend(extra.as_object().unwrap().clone());
+        let arn = self
+            .inner
+            .create("Callback", json!({"StartAt":"Call","States":{"Call":task}}))
+            .await;
+        let (status, response) = self
+            .inner
+            .call("StartExecution", json!({"stateMachineArn":arn}))
+            .await;
+        assert_eq!(status, StatusCode::OK);
+        response["executionArn"].as_str().unwrap().into()
+    }
+    async fn next(&mut self) -> (LambdaTaskCommand, TaskResponder) {
+        timeout_at(deadline(), self.calls.recv())
+            .await
+            .unwrap()
+            .unwrap()
+    }
+    async fn pending(&self, execution: &str) {
+        assert_eq!(
+            self.inner
+                .call("DescribeExecution", json!({"executionArn":execution}))
+                .await
+                .1["status"],
+            "RUNNING"
+        );
+    }
+    async fn history(&self, execution: &str) -> Value {
+        self.inner
+            .call("GetExecutionHistory", json!({"executionArn":execution}))
+            .await
+            .1
+    }
+    async fn submitted(&self, execution: &str) {
+        timeout_at(deadline(), async {
+            loop {
+                if self.history(execution).await["events"]
+                    .as_array()
+                    .unwrap()
+                    .iter()
+                    .any(|v| v["type"] == "TaskSubmitted")
+                {
+                    break;
+                }
+                sleep(Duration::from_millis(1)).await;
+            }
+        })
+        .await
+        .unwrap();
+    }
+    async fn close(&mut self) {
+        self.inner.close().await;
+        self.callbacks.shutdown(deadline()).await.unwrap();
+    }
+}
+fn token(command: &LambdaTaskCommand) -> String {
+    command.dispatch().parameters().value()["Payload"]["token"]
+        .as_str()
+        .unwrap()
+        .into()
+}
+fn report(
+    command: &mut LambdaTaskCommand,
+    responder: &mut TaskResponder,
+    result: Result<(), TaskFailure>,
+) {
+    responder.started().unwrap();
+    command
+        .take_callback_reporter()
+        .unwrap()
+        .unwrap()
+        .complete_at(
+            result.map(|()| CallbackInvocationMetadata::new(Uuid::new_v4(), "$LATEST").unwrap()),
+            Instant::now(),
+        )
+        .unwrap();
+}
+fn finish(mut command: LambdaTaskCommand, mut responder: TaskResponder) {
+    report(&mut command, &mut responder, Ok(()));
+    responder.finish(Ok(Payload::parse(b"null").unwrap()));
+}
+async fn success(f: &CallbackFixture, token: &str, output: Value) {
+    let (status, body) = f
+        .inner
+        .call(
+            "SendTaskSuccess",
+            json!({"taskToken":token,"output":output.to_string()}),
+        )
+        .await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(body, Value::Null);
+}
+#[rstest::rstest]
+#[case(true, json!({"answer":42}))]
+#[case(false, json!([1,"value",null]))]
+#[case(false, json!(true))]
+#[case(false, Value::Null)]
+#[tokio::test]
+async fn test_should_route_public_success_before_or_after_invocation_without_double_encoding(
+    #[case] early: bool,
+    #[case] output: Value,
+) {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    if early {
+        success(&f, &token, output.clone()).await;
+        f.pending(&execution).await;
+    }
+    finish(command, responder);
+    if !early {
+        f.submitted(&execution).await;
+        f.pending(&execution).await;
+        success(&f, &token, output.clone()).await;
+    }
+    let done = f.inner.wait(&execution).await;
+    assert_eq!(done["status"], "SUCCEEDED");
+    assert_eq!(
+        serde_json::from_str::<Value>(done["output"].as_str().unwrap()).unwrap(),
+        output
+    );
+    assert!(!f.history(&execution).await.to_string().contains(&token));
+    for action in ["SendTaskSuccess", "SendTaskFailure", "SendTaskHeartbeat"] {
+        let mut input = json!({"taskToken":token});
+        if action == "SendTaskSuccess" {
+            input["output"] = json!("null");
+        }
+        let (status, body) = f.inner.call(action, input).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert_eq!(body["__type"], "TaskTimedOut");
+        assert!(!body.to_string().contains(&token));
+    }
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_preserve_real_invocation_failure_after_public_early_success() {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (mut command, mut responder) = f.next().await;
+    success(&f, &token(&command), json!({"falseSuccess":true})).await;
+    report(
+        &mut command,
+        &mut responder,
+        Err(TaskFailure::new("HandlerFailure", Some("actual failure")).unwrap()),
+    );
+    responder.finish(Err(TaskFailure::service_exception()));
+    let done = f.inner.wait(&execution).await;
+    assert_eq!(done["status"], "FAILED");
+    assert_eq!(done["error"], "HandlerFailure");
+    assert!(done.get("output").is_none());
+    f.close().await;
+}
+#[rstest::rstest]
+#[case(None, None)]
+#[case(Some(""), Some(""))]
+#[case(Some("ExternalFailure"), Some("quoted \"cause\" 中文"))]
+#[tokio::test]
+async fn test_should_route_public_failure_and_preserve_omitted_or_empty_fields(
+    #[case] error: Option<&str>,
+    #[case] cause: Option<&str>,
+) {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    finish(command, responder);
+    f.submitted(&execution).await;
+    let mut input = json!({"taskToken":token});
+    if let Some(error) = error {
+        input["error"] = json!(error);
+    }
+    if let Some(cause) = cause {
+        input["cause"] = json!(cause);
+    }
+    assert_eq!(
+        f.inner.call("SendTaskFailure", input).await,
+        (StatusCode::OK, Value::Null)
+    );
+    let done = f.inner.wait(&execution).await;
+    assert_eq!(done["status"], "FAILED");
+    assert_eq!(done.get("error"), error.map(|_| &done["error"]));
+    assert_eq!(done["error"], json!(error));
+    assert_eq!(done["cause"], json!(cause));
+    assert!(!f.history(&execution).await.to_string().contains(&token));
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_route_public_heartbeat_without_history_mutation_then_complete() {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({"HeartbeatSeconds":30})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    finish(command, responder);
+    f.submitted(&execution).await;
+    let before = f.history(&execution).await;
+    for _ in 0..3 {
+        assert_eq!(
+            f.inner
+                .call("SendTaskHeartbeat", json!({"taskToken":token}))
+                .await,
+            (StatusCode::OK, Value::Null)
+        );
+    }
+    assert_eq!(f.history(&execution).await, before);
+    f.pending(&execution).await;
+    success(&f, &token, json!(42)).await;
+    assert_eq!(f.inner.wait(&execution).await["status"], "SUCCEEDED");
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_route_public_retry_with_new_token_and_reject_old_attempt() {
+    let mut f = CallbackFixture::new();
+    let execution=f.start(json!({"Retry":[{"ErrorEquals":["ExternalFailure"],"IntervalSeconds":1,"MaxAttempts":1}]})).await;
+    let (command, responder) = f.next().await;
+    let old = token(&command);
+    finish(command, responder);
+    assert_eq!(
+        f.inner
+            .call(
+                "SendTaskFailure",
+                json!({"taskToken":old,"error":"ExternalFailure"})
+            )
+            .await
+            .0,
+        StatusCode::OK
+    );
+    let (command, responder) = f.next().await;
+    let next = token(&command);
+    assert_ne!(old, next);
+    assert_eq!(
+        command.dispatch().parameters().value()["Payload"]["retry"],
+        1
+    );
+    assert_eq!(
+        f.inner
+            .call("SendTaskHeartbeat", json!({"taskToken":old}))
+            .await
+            .1["__type"],
+        "TaskTimedOut"
+    );
+    success(&f, &next, json!({"retried":true})).await;
+    finish(command, responder);
+    assert_eq!(f.inner.wait(&execution).await["status"], "SUCCEEDED");
+    f.close().await;
+}
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_reject_closed_public_token_after_absolute_or_heartbeat_timeout(
+    #[case] heartbeat: bool,
+) {
+    let mut f = CallbackFixture::new();
+    let extra = if heartbeat {
+        json!({"HeartbeatSeconds":1})
+    } else {
+        json!({"TimeoutSeconds":1})
+    };
+    let execution = f.start(extra).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    finish(command, responder);
+    let done = f.inner.wait(&execution).await;
+    assert_eq!(
+        done["error"],
+        if heartbeat {
+            "States.HeartbeatTimeout"
+        } else {
+            "States.Timeout"
+        }
+    );
+    assert_eq!(
+        f.inner
+            .call("SendTaskHeartbeat", json!({"taskToken":token}))
+            .await
+            .1["__type"],
+        "TaskTimedOut"
+    );
+    assert!(
+        f.history(&execution).await["events"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|e| e["type"] == "TaskTimedOut")
+    );
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_revoke_public_token_on_stop_and_join_physical_call() {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    let (status, _) = f
+        .inner
+        .call("StopExecution", json!({"executionArn":execution}))
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    let mut cancelled = responder.cancellation();
+    timeout_at(deadline(), async {
+        while !*cancelled.borrow_and_update() {
+            cancelled.changed().await.unwrap();
+        }
+    })
+    .await
+    .unwrap();
+    responder.finish(Err(TaskFailure::service_exception()));
+    drop(command);
+    assert_eq!(f.inner.wait(&execution).await["status"], "ABORTED");
+    assert_eq!(
+        f.inner
+            .call("SendTaskHeartbeat", json!({"taskToken":token}))
+            .await
+            .1["__type"],
+        "TaskTimedOut"
+    );
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_reject_invalid_public_output_or_credentials_without_consuming_valid_token() {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    for (action, input, code) in [
+        (
+            "SendTaskSuccess",
+            json!({"taskToken":token,"output":"{"}),
+            "InvalidOutput",
+        ),
+        (
+            "SendTaskSuccess",
+            json!({"taskToken":token,"output":"x".repeat(262_145)}),
+            "InvalidOutput",
+        ),
+        (
+            "SendTaskFailure",
+            json!({"taskToken":token,"error":"x".repeat(257)}),
+            "ValidationException",
+        ),
+        (
+            "SendTaskFailure",
+            json!({"taskToken":token,"cause":"x".repeat(32769)}),
+            "ValidationException",
+        ),
+        (
+            "SendTaskHeartbeat",
+            json!({"taskToken":"malformed"}),
+            "InvalidToken",
+        ),
+        (
+            "SendTaskHeartbeat",
+            json!({"taskToken":"f".repeat(64)}),
+            "InvalidToken",
+        ),
+    ] {
+        let (status, body) = f.inner.call(action, input).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert_eq!(body["__type"], code);
+        assert!(!body.to_string().contains(&token));
+    }
+    success(&f, &token, json!("still-live")).await;
+    finish(command, responder);
+    assert_eq!(f.inner.wait(&execution).await["status"], "SUCCEEDED");
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_bind_callback_epoch_and_trusted_http_scope() {
+    let mut f = CallbackFixture::new();
+    let mut other_epoch = CallbackFixture::new();
+    let mut foreign =
+        CallbackFixture::scoped(TenantScope::new("aws", "us-west-2", "111111111111").unwrap());
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    assert_eq!(
+        other_epoch
+            .inner
+            .call("SendTaskHeartbeat", json!({"taskToken":token}))
+            .await
+            .1["__type"],
+        "InvalidToken"
+    );
+    assert_eq!(
+        foreign
+            .inner
+            .call("SendTaskHeartbeat", json!({"taskToken":token}))
+            .await
+            .1["__type"],
+        "InvalidToken"
+    );
+    let config = StepFunctionsHttpConfig::new(
+        RequestScope::new("aws".into(), "us-west-2".into(), "111111111111".into()).unwrap(),
+        true,
+        None,
+    )
+    .unwrap();
+    let original = f.inner.service.clone();
+    f.inner.service = StepFunctionsHttpService::new(f.inner.handle.clone(), config);
+    assert_eq!(
+        f.inner
+            .call("SendTaskHeartbeat", json!({"taskToken":token}))
+            .await
+            .1["__type"],
+        "AccessDeniedException"
+    );
+    f.inner.service = original;
+    success(&f, &token, json!(42)).await;
+    finish(command, responder);
+    assert_eq!(f.inner.wait(&execution).await["status"], "SUCCEEDED");
+    f.close().await;
+    foreign.close().await;
+    other_epoch.close().await;
+}
+#[tokio::test]
+async fn test_should_reject_unbound_or_closed_callback_api_and_inconsistent_compiler_composition() {
+    let mut unbound = Fixture::new(ApiLimits::default());
+    for action in ["SendTaskSuccess", "SendTaskFailure", "SendTaskHeartbeat"] {
+        let mut input = json!({"taskToken":"a".repeat(64)});
+        if action == "SendTaskSuccess" {
+            input["output"] = json!("null");
+        }
+        assert_eq!(
+            unbound.call(action, input).await.1["__type"],
+            "UnsupportedOperation"
+        );
+    }
+    unbound.close().await;
+    let mut f = CallbackFixture::new();
+    assert!(matches!(
+        StepFunctionsApi::new(
+            TenantScope::default(),
+            TaskSupport::Disabled,
+            f.registry.clone(),
+            ApiLimits::default()
+        ),
+        Err(ApiError::Configuration)
+    ));
+    f.callbacks.close();
+    assert_eq!(
+        f.inner
+            .call("SendTaskHeartbeat", json!({"taskToken":"a".repeat(64)}))
+            .await
+            .1["__type"],
+        "ServiceUnavailable"
+    );
+    f.close().await;
+    assert!(matches!(
+        f.registry.submit_callback(CallbackCommand::heartbeat(
+            CallbackToken::try_from("a".repeat(64)).unwrap()
+        )),
+        Err(CallbackError::Unavailable)
+    ));
+}
+#[tokio::test]
+async fn test_should_submit_callback_independently_of_metadata_admission() {
+    let mut f = CallbackFixture::new();
+    let mut metadata = Vec::new();
+    for _ in 0..256 {
+        match f.registry.submit(RegistryCommand::Machines) {
+            Ok(receipt) => metadata.push(receipt),
+            Err(_) => break,
+        }
+    }
+    assert!(!metadata.is_empty());
+    assert!(f.registry.submit(RegistryCommand::Machines).is_err());
+    let error = f
+        .registry
+        .submit_callback(CallbackCommand::heartbeat(
+            "a".repeat(64).try_into().unwrap(),
+        ))
+        .unwrap()
+        .wait(deadline())
+        .await
+        .unwrap_err();
+    assert_eq!(
+        super::super::error::callback(error).code,
+        Code::InvalidToken
+    );
+    drop(metadata);
+    f.close().await;
+}
+
+#[tokio::test]
+async fn test_should_return_public_callback_throttling_without_consuming_the_live_token() {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    let mut acknowledgments = Vec::new();
+    for _ in 0..2048 {
+        match f.registry.submit_callback(CallbackCommand::heartbeat(
+            "a".repeat(64).try_into().unwrap(),
+        )) {
+            Ok(ack) => acknowledgments.push(ack),
+            Err(CallbackError::Capacity) => break,
+            Err(error) => panic!("unexpected admission error: {error:?}"),
+        }
+    }
+    assert!(!acknowledgments.is_empty());
+    let (status, error) = f
+        .inner
+        .call("SendTaskSuccess", json!({"taskToken":token,"output":"42"}))
+        .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST);
+    assert_eq!(error["__type"], "ThrottlingException");
+    drop(acknowledgments);
+    timeout_at(deadline(), async {
+        loop {
+            let (status, body) = f
+                .inner
+                .call("SendTaskHeartbeat", json!({"taskToken":token}))
+                .await;
+            if status == StatusCode::OK {
+                break;
+            }
+            assert_eq!(body["__type"], "ThrottlingException");
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    success(&f, &token, json!(42)).await;
+    finish(command, responder);
+    assert_eq!(f.inner.wait(&execution).await["status"], "SUCCEEDED");
+    f.close().await;
+}
+
+async fn caller_context() -> RequestContext {
+    let (tx, mut rx) = mpsc::channel(1);
+    let config = StepFunctionsHttpConfig::new(
+        RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into()).unwrap(),
+        true,
+        None,
+    )
+    .unwrap()
+    .with_budgets(
+        rustack_core::http::BodyBudget::control(),
+        Duration::from_secs(1),
+    )
+    .unwrap();
+    let service = StepFunctionsHttpService::new(Arc::new(CaptureContext(tx)), config);
+    service
+        .handle(
+            HttpRequest::builder()
+                .method("POST")
+                .uri("/")
+                .header("content-type", CONTENT_TYPE)
+                .header("x-amz-target", "AWSStepFunctions.ListStateMachines")
+                .body(Full::new(Bytes::from_static(b"{}")))
+                .unwrap(),
+        )
+        .await;
+    rx.recv().await.unwrap()
+}
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_keep_accepted_public_callback_after_abandoned_or_late_ready_observer(
+    #[case] late: bool,
+) {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    let context = caller_context().await;
+    let caller_deadline = context.deadline();
+    let request = Request::decode(
+        Op::SendTaskSuccess,
+        &serde_json::to_vec(&json!({"taskToken":token,"output":"42"})).unwrap(),
+    )
+    .unwrap();
+    let mut future = f.inner.handle.handle(context, request);
+    let flag = Arc::new(WakeFlag::default());
+    let waker = std::task::Waker::from(flag.clone());
+    assert!(
+        future
+            .as_mut()
+            .poll(&mut std::task::Context::from_waker(&waker))
+            .is_pending()
+    );
+    if late {
+        timeout_at(caller_deadline, async {
+            while !flag.0.load(std::sync::atomic::Ordering::SeqCst) {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+        sleep_until(caller_deadline).await;
+        assert_eq!(
+            future.await.unwrap_err().code,
+            Code::RequestTimeoutException
+        );
+    } else {
+        drop(future);
+    }
+    // API intake is independently joined before the actual Lambda report.
+    f.inner.api.shutdown(deadline()).await.unwrap();
+    finish(command, responder);
+    let mut receipt = f
+        .registry
+        .submit(RegistryCommand::Execution(execution.parse().unwrap()))
+        .unwrap();
+    let RegistryResult::Execution(snapshot) = receipt.wait(deadline()).await.unwrap() else {
+        panic!("execution");
+    };
+    let view = snapshot.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(output) if output.value()==&json!(42))
+    );
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_reject_expired_public_request_before_consuming_live_token() {
+    let mut f = CallbackFixture::new();
+    let execution = f.start(json!({})).await;
+    let (command, responder) = f.next().await;
+    let token = token(&command);
+    let context = caller_context().await;
+    sleep_until(context.deadline()).await;
+    let request = Request::decode(
+        Op::SendTaskFailure,
+        &serde_json::to_vec(&json!({"taskToken":token,"error":"must-not-run"})).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        f.inner
+            .handle
+            .handle(context, request)
+            .await
+            .unwrap_err()
+            .code,
+        Code::RequestTimeoutException
+    );
+    success(&f, &token, json!(true)).await;
+    finish(command, responder);
+    assert_eq!(f.inner.wait(&execution).await["status"], "SUCCEEDED");
+    f.close().await;
+}
+#[rstest::rstest]
+#[case(CallbackError::InvalidToken, Code::InvalidToken, 400)]
+#[case(CallbackError::TaskTimedOut, Code::TaskTimedOut, 400)]
+#[case(CallbackError::Data(AslError::DataLimit), Code::InvalidOutput, 400)]
+#[case(CallbackError::Validation, Code::ValidationException, 400)]
+#[case(CallbackError::Capacity, Code::ThrottlingException, 400)]
+#[case(CallbackError::Deadline, Code::RequestTimeoutException, 408)]
+#[case(CallbackError::Unavailable, Code::ServiceUnavailable, 503)]
+#[case(CallbackError::OwnerLost, Code::InternalFailure, 500)]
+#[case(CallbackError::Progress, Code::InternalFailure, 500)]
+#[case(CallbackError::AttemptExists, Code::InternalFailure, 500)]
+#[test]
+fn test_should_map_cached_callback_sources_to_static_action_errors(
+    #[case] cause: CallbackError,
+    #[case] code: Code,
+    #[case] status: u16,
+) {
+    let error = super::super::error::callback(CallbackError::Cached(Arc::new(cause)));
+    assert_eq!(error.code, code);
+    assert_eq!(error.status_code.as_u16(), status);
+    assert!(
+        error
+            .source
+            .as_ref()
+            .unwrap()
+            .downcast_ref::<CallbackError>()
+            .is_some()
+    );
+}
diff --git a/apps/rustack/src/stepfunctions_api/worker.rs b/apps/rustack/src/stepfunctions_api/worker.rs
new file mode 100644
index 00000000..f94e19fb
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_api/worker.rs
@@ -0,0 +1,184 @@
+//! Retained CPU preparation, registry commands and immutable response projection.
+
+use std::{future::Future, sync::Arc};
+
+use rustack_stepfunctions_core::{AslCompiler, ExecutionError, RegistryCommand, RegistryResult};
+use rustack_stepfunctions_http::{Request, Response};
+use rustack_stepfunctions_model::{
+    StepFunctionsError, StepFunctionsErrorCode as Code, StepFunctionsOperation as Op, output,
+};
+use tokio::{
+    sync::oneshot,
+    task::JoinSet,
+    time::{Instant, timeout_at},
+};
+
+use super::{
+    Context,
+    error::{callback, check, error, registry, source},
+    pages,
+    prepare::{self, Prepared},
+    render,
+};
+
+pub(super) async fn run(
+    context: Arc<Context>,
+    request: Request,
+    deadline: Instant,
+) -> Result<Response, StepFunctionsError> {
+    let scope = context.scope.clone();
+    let tasks = context.tasks;
+    let states = context.registry.state_support();
+    let callbacks = context.registry.callback_support();
+    let prepared = cpu(&context, deadline, move || {
+        prepare::prepare(
+            request,
+            &AslCompiler::new(scope.clone(), tasks)
+                .with_state_support(states)
+                .with_child_support(true)
+                .with_callback_support(callbacks),
+            &scope,
+            callbacks,
+        )
+    })
+    .await?;
+    check(deadline)?;
+    match prepared {
+        Prepared::Ready(response) => Ok(response),
+        Prepared::Callback(command, op) => {
+            let mut acknowledgment = context
+                .registry
+                .submit_callback(command)
+                .map_err(callback)?;
+            acknowledgment.wait(deadline).await.map_err(callback)?;
+            match op {
+                Op::SendTaskSuccess => Ok(output::SendTaskSuccessOutput::default().into()),
+                Op::SendTaskFailure => Ok(output::SendTaskFailureOutput::default().into()),
+                Op::SendTaskHeartbeat => Ok(output::SendTaskHeartbeatOutput::default().into()),
+                _ => Err(error(Code::InternalFailure)),
+            }
+        }
+        Prepared::Command(command, op) => {
+            let mut result = submit_registry(&context, command, op, deadline).await?;
+            if op == Op::StopExecution {
+                let RegistryResult::Execution(snapshot) = result else {
+                    return Err(error(Code::InternalFailure));
+                };
+                result = RegistryResult::Execution(snapshot.wait(deadline).await.map_err(|e| {
+                    source(
+                        if matches!(e, ExecutionError::Deadline) {
+                            Code::RequestTimeoutException
+                        } else {
+                            Code::InternalFailure
+                        },
+                        e,
+                    )
+                })?);
+            }
+            cpu(&context, deadline, move || render::render(op, result)).await
+        }
+        Prepared::Page(binding, token, initial) => {
+            let cursor = if let Some(token) = token {
+                let (reply, receiver) = oneshot::channel();
+                page_command(
+                    &context,
+                    deadline,
+                    pages::Request::Read(token, binding, reply),
+                    receiver,
+                )
+                .await?
+            } else {
+                let result = submit_registry(&context, initial, binding.op, deadline).await?;
+                let captured = binding.clone();
+                let data = cpu(&context, deadline, move || {
+                    pages::Data::capture(&captured, result)
+                })
+                .await?;
+                let (reply, receiver) = oneshot::channel();
+                let snapshot = page_command(
+                    &context,
+                    deadline,
+                    pages::Request::Reserve(data, reply),
+                    receiver,
+                )
+                .await?;
+                pages::first(binding, snapshot)
+            };
+            let mut page = cpu(&context, deadline, move || pages::page(cursor)).await?;
+            if let Some(next) = page.next {
+                let (reply, receiver) = oneshot::channel();
+                page_command(
+                    &context,
+                    deadline,
+                    pages::Request::Save(page.token.clone(), next, reply),
+                    receiver,
+                )
+                .await?;
+                pages::attach(&mut page.response, page.token)?;
+            }
+            Ok(page.response)
+        }
+    }
+}
+async fn submit_registry(
+    context: &Context,
+    command: RegistryCommand,
+    op: Op,
+    deadline: Instant,
+) -> Result<RegistryResult, StepFunctionsError> {
+    check(deadline)?;
+    let mut receipt = context
+        .registry
+        .submit(command)
+        .map_err(|e| registry(e, op))?;
+    receipt.wait(deadline).await.map_err(|e| registry(e, op))
+}
+async fn page_command<T>(
+    context: &Context,
+    deadline: Instant,
+    request: pages::Request,
+    receiver: oneshot::Receiver<Result<T, StepFunctionsError>>,
+) -> Result<T, StepFunctionsError> {
+    let operation = async {
+        context
+            .pages
+            .send(pages::Command { deadline, request })
+            .await
+            .map_err(|_| error(Code::ServiceUnavailable))?;
+        receiver
+            .await
+            .map_err(|_| error(Code::ServiceUnavailable))?
+    };
+    observe(deadline, operation).await
+}
+async fn observe<T>(
+    deadline: Instant,
+    future: impl Future<Output = Result<T, StepFunctionsError>>,
+) -> Result<T, StepFunctionsError> {
+    timeout_at(deadline, future)
+        .await
+        .map_err(|_| error(Code::RequestTimeoutException))?
+}
+pub(super) async fn cpu<T: Send + 'static>(
+    context: &Context,
+    deadline: Instant,
+    work: impl FnOnce() -> Result<T, StepFunctionsError> + Send + 'static,
+) -> Result<T, StepFunctionsError> {
+    check(deadline)?;
+    let permit = timeout_at(deadline, context.cpu.clone().acquire_owned())
+        .await
+        .map_err(|_| error(Code::RequestTimeoutException))?
+        .map_err(|_| error(Code::ServiceUnavailable))?;
+    check(deadline)?;
+    let mut jobs = JoinSet::new();
+    jobs.spawn_blocking(move || (work(), permit));
+    match jobs.join_next().await {
+        Some(Ok((result, permit))) => {
+            drop(permit);
+            check(deadline)?;
+            result
+        }
+        Some(Err(e)) => Err(source(Code::InternalFailure, e)),
+        None => Err(error(Code::InternalFailure)),
+    }
+}
diff --git a/apps/rustack/src/stepfunctions_bridge.rs b/apps/rustack/src/stepfunctions_bridge.rs
new file mode 100644
index 00000000..007c7ece
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge.rs
@@ -0,0 +1,443 @@
+//! Retained Step Functions → actual Lambda provider composition.
+//!
+//! The port queues synchronously. Its independent manager retains each start,
+//! response and cleanup receipt; dropping an ASL observer never drops the real
+//! invocation future. No SDK, HTTP loopback or disabled-executor fallback is used.
+
+use std::{
+    collections::HashMap,
+    fmt,
+    mem::replace,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use rustack_lambda_core::{
+    executor::ExecutorBackend, invocation::InvocationHandle, provider::RustackLambda,
+    resolver::function_arn,
+};
+use rustack_stepfunctions_core::{
+    LambdaTaskCommand, LambdaTaskPort, QuarantinedTask, TaskCall, TaskFailure, TaskResponder,
+    TenantScope,
+};
+use tokio::{
+    runtime::Handle,
+    sync::{OwnedSemaphorePermit, Semaphore, mpsc, watch},
+    task::{Id, JoinError, JoinHandle, JoinSet},
+    time::{Instant, timeout_at},
+};
+
+mod error;
+mod mapping;
+#[cfg(test)]
+mod tests;
+mod worker;
+
+pub use error::BridgeError;
+
+/// Validated accepted-work and independent cleanup wait bounds.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct BridgeLimits {
+    accepted: usize,
+    cleanup: Duration,
+}
+impl BridgeLimits {
+    /// Validate1..=1,024 accepted calls and1..=60s cleanup observation.
+    ///
+    /// # Errors
+    /// Rejects zero/excessive capacities or cleanup durations.
+    ///
+    /// ```
+    /// let limits=rustack_cli::stepfunctions_bridge::BridgeLimits::new(128,std::time::Duration::from_secs(10))?;
+    /// # Ok::<(),rustack_cli::stepfunctions_bridge::BridgeError>(())
+    /// ```
+    pub fn new(accepted: usize, cleanup: Duration) -> Result<Self, BridgeError> {
+        if !(1..=1024).contains(&accepted)
+            || !(Duration::from_secs(1)..=Duration::from_secs(60)).contains(&cleanup)
+        {
+            return Err(BridgeError::Configuration);
+        }
+        Ok(Self { accepted, cleanup })
+    }
+}
+impl Default for BridgeLimits {
+    fn default() -> Self {
+        Self {
+            accepted: 128,
+            cleanup: Duration::from_secs(10),
+        }
+    }
+}
+struct Context {
+    provider: Arc<RustackLambda>,
+    scope: TenantScope,
+    limits: BridgeLimits,
+}
+impl fmt::Debug for Context {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("LambdaBridgeContext")
+            .field("limits", &self.limits)
+            .finish_non_exhaustive()
+    }
+}
+#[derive(Debug)]
+struct Shared {
+    context: Context,
+    accepting: AtomicBool,
+    unhealthy: AtomicBool,
+    capacity: Arc<Semaphore>,
+    diagnostic: watch::Sender<Option<Arc<BridgeError>>>,
+}
+#[derive(Debug)]
+struct Submission {
+    command: LambdaTaskCommand,
+    responder: TaskResponder,
+    permit: OwnedSemaphorePermit,
+}
+#[derive(Debug)]
+struct Retained {
+    _permit: OwnedSemaphorePermit,
+    _resource: Option<Uncertain>,
+}
+#[derive(Debug)]
+struct Uncertain {
+    _handle: InvocationHandle,
+    _receipt: QuarantinedTask,
+}
+#[derive(Debug)]
+struct WorkerExit {
+    uncertain: Option<Uncertain>,
+    diagnostic: Option<Arc<BridgeError>>,
+}
+#[derive(Debug)]
+struct ManagerState {
+    queue: mpsc::Receiver<Submission>,
+    stop: watch::Receiver<bool>,
+    jobs: JoinSet<WorkerExit>,
+    active: HashMap<Id, OwnedSemaphorePermit>,
+    quarantine: Vec<Retained>,
+}
+#[derive(Debug)]
+struct ManagerOwner {
+    state: ManagerState,
+    shared: Arc<Shared>,
+}
+
+/// Synchronous bounded adapter, installed only for an explicitly selected backend.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct StepFunctionsLambdaBridge {
+    queue: mpsc::Sender<Submission>,
+    shared: Arc<Shared>,
+}
+/// Independent join controller; a dropped waiter retains its exact manager handle.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct LambdaBridgeSupervisor {
+    stop: watch::Sender<bool>,
+    manager: Option<JoinHandle<Result<(), Arc<BridgeError>>>>,
+    shared: Arc<Shared>,
+    joined: Option<Result<(), Arc<BridgeError>>>,
+}
+impl StepFunctionsLambdaBridge {
+    /// Read actual port readiness without acquiring task admission.
+    ///
+    /// ```
+    /// # fn inspect(port:&rustack_cli::stepfunctions_bridge::StepFunctionsLambdaBridge){let ready=port.is_ready();}
+    /// ```
+    #[must_use]
+    pub fn is_ready(&self) -> bool {
+        self.shared.accepting.load(Ordering::Acquire)
+            && !self.shared.unhealthy.load(Ordering::Acquire)
+    }
+    /// Start one retained manager before exposing the task port.
+    ///
+    /// The caller injects an actual provider and its trusted tenant scope. This
+    /// exports a composition adapter; it does not register a gateway service.
+    ///
+    /// # Errors
+    /// Returns Unavailable outside an active Tokio runtime.
+    ///
+    /// ```no_run
+    /// # fn build(provider:std::sync::Arc<rustack_lambda_core::provider::RustackLambda>) -> Result<(),rustack_cli::stepfunctions_bridge::BridgeError> {
+    /// use rustack_cli::stepfunctions_bridge::{StepFunctionsLambdaBridge,BridgeLimits};
+    /// let (port,owner)=StepFunctionsLambdaBridge::new(provider,rustack_stepfunctions_core::TenantScope::default(),BridgeLimits::default())?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        provider: Arc<RustackLambda>,
+        scope: TenantScope,
+        limits: BridgeLimits,
+    ) -> Result<(Arc<Self>, LambdaBridgeSupervisor), BridgeError> {
+        let config = provider.config();
+        let expected = format!(
+            "arn:{}:lambda:{}:{}:function:",
+            scope.partition(),
+            scope.region(),
+            scope.account()
+        );
+        if config.executor == ExecutorBackend::Disabled
+            || (config.executor == ExecutorBackend::Docker
+                && provider.executor().image_available().is_err())
+            || !function_arn(
+                &config.default_region,
+                &config.account_id,
+                "BridgeScopeProbe",
+            )
+            .starts_with(&expected)
+        {
+            return Err(BridgeError::Configuration);
+        }
+        let runtime = Handle::try_current().map_err(|_| BridgeError::Unavailable)?;
+        let (queue, receiver) = mpsc::channel(limits.accepted);
+        let (stop, cancelled) = watch::channel(false);
+        let (diagnostic, _) = watch::channel(None);
+        let shared = Arc::new(Shared {
+            context: Context {
+                provider,
+                scope,
+                limits,
+            },
+            accepting: AtomicBool::new(true),
+            unhealthy: AtomicBool::new(false),
+            capacity: Arc::new(Semaphore::new(limits.accepted)),
+            diagnostic,
+        });
+        let owner = ManagerOwner {
+            state: ManagerState {
+                queue: receiver,
+                stop: cancelled,
+                jobs: JoinSet::new(),
+                active: HashMap::new(),
+                quarantine: Vec::new(),
+            },
+            shared: shared.clone(),
+        };
+        let manager = runtime.spawn(owner.run());
+        Ok((
+            Arc::new(Self {
+                queue,
+                shared: shared.clone(),
+            }),
+            LambdaBridgeSupervisor {
+                stop,
+                manager: Some(manager),
+                shared,
+                joined: None,
+            },
+        ))
+    }
+}
+impl LambdaTaskPort for StepFunctionsLambdaBridge {
+    fn start(&self, command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        let scope = command.machine().scope();
+        let configured = &self.shared.context.scope;
+        if !self.shared.accepting.load(Ordering::Acquire)
+            || self.queue.is_closed()
+            || scope.partition() != configured.partition()
+            || scope.region() != configured.region()
+            || scope.account() != configured.account()
+            || Instant::now() >= Instant::from_std(command.dispatch().deadline())
+        {
+            return Err(TaskFailure::service_exception());
+        }
+        let permit = self
+            .shared
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| TaskFailure::throttled())?;
+        let (call, responder) = TaskCall::channel();
+        self.queue
+            .try_send(Submission {
+                command,
+                responder,
+                permit,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => TaskFailure::throttled(),
+                mpsc::error::TrySendError::Closed(_) => TaskFailure::service_exception(),
+            })?;
+        Ok(call)
+    }
+}
+impl LambdaBridgeSupervisor {
+    /// Stop accepting new tasks and request cancellation of all owned workers.
+    ///
+    /// ```
+    /// # fn close(owner:&rustack_cli::stepfunctions_bridge::LambdaBridgeSupervisor) {owner.close();}
+    /// ```
+    pub fn close(&self) {
+        self.shared.accepting.store(false, Ordering::Release);
+        self.stop.send_replace(true);
+    }
+    /// Join the same manager through an absolute deadline, retaining it on expiry.
+    ///
+    /// Call before quiescing the underlying Lambda provider.
+    ///
+    /// # Errors
+    /// Returns Deadline, a supervised worker source, or retained Quarantined status.
+    ///
+    /// ```no_run
+    /// # async fn drain(owner:&mut rustack_cli::stepfunctions_bridge::LambdaBridgeSupervisor,deadline:tokio::time::Instant) {
+    /// let result=owner.shutdown(deadline).await;
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), Arc<BridgeError>> {
+        self.close();
+        if let Some(result) = &self.joined {
+            return result.clone();
+        }
+        let Some(manager) = &mut self.manager else {
+            return Err(Arc::new(BridgeError::Unavailable));
+        };
+        let result = timeout_at(deadline, manager)
+            .await
+            .map_err(|_| Arc::new(BridgeError::Deadline))?;
+        self.manager = None;
+        let result = result.unwrap_or_else(|error| Err(Arc::new(BridgeError::Worker(error))));
+        if let Err(error) = &result {
+            self.shared.diagnostic.send_replace(Some(error.clone()));
+        }
+        self.joined = Some(result.clone());
+        result
+    }
+    /// Read the most recent redacted internal source; never a public ASL cause.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_cli::stepfunctions_bridge::LambdaBridgeSupervisor) {let source=owner.diagnostic();}
+    /// ```
+    #[must_use]
+    pub fn diagnostic(&self) -> Option<Arc<BridgeError>> {
+        self.shared.diagnostic.borrow().clone()
+    }
+    /// Read accepted/uncertain calls still holding bridge admission capacity.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_cli::stepfunctions_bridge::LambdaBridgeSupervisor) {let active=owner.owned_calls();}
+    /// ```
+    #[must_use]
+    pub fn owned_calls(&self) -> usize {
+        self.shared
+            .context
+            .limits
+            .accepted
+            .saturating_sub(self.shared.capacity.available_permits())
+    }
+}
+impl Drop for LambdaBridgeSupervisor {
+    fn drop(&mut self) {
+        self.close();
+        // Intentional detached manager: its own Drop guard retains unresolved
+        // jobs/slots through public-controller loss and runtime cancellation.
+        if let Some(manager) = self.manager.take() {
+            drop(manager);
+        }
+    }
+}
+impl ManagerOwner {
+    async fn run(mut self) -> Result<(), Arc<BridgeError>> {
+        loop {
+            if signal(&self.state.stop) {
+                self.shared.accepting.store(false, Ordering::Release);
+                self.state.queue.close();
+                self.reject_queued();
+            }
+            if self.state.queue.is_closed()
+                && self.state.queue.is_empty()
+                && self.state.jobs.is_empty()
+            {
+                break;
+            }
+            tokio::select! {
+                biased;
+                _=self.state.stop.changed(),if !signal(&self.state.stop)=>{},
+                result=self.state.jobs.join_next_with_id(),if !self.state.jobs.is_empty()=>if let Some(result)=result {self.finish(result);},
+                submission=self.state.queue.recv(),if !self.state.queue.is_closed() || !self.state.queue.is_empty()=>if let Some(submission)=submission {
+                    let Submission {command,responder,permit}=submission;
+                    let shared=self.shared.clone();let stop=self.state.stop.clone();
+                    let task=self.state.jobs.spawn(worker::invoke(shared,command,responder,stop));self.state.active.insert(task.id(),permit);
+                },
+            }
+        }
+        self.shared.accepting.store(false, Ordering::Release);
+        if self.state.quarantine.is_empty() {
+            Ok(())
+        } else {
+            Err(Arc::new(BridgeError::Quarantined))
+        }
+    }
+    fn reject_queued(&mut self) {
+        while let Ok(submission) = self.state.queue.try_recv() {
+            submission
+                .responder
+                .finish(Err(TaskFailure::service_exception()));
+        }
+    }
+    fn finish(&mut self, result: Result<(Id, WorkerExit), JoinError>) {
+        match result {
+            Ok((id, exit)) => {
+                if let Some(diagnostic) = exit.diagnostic {
+                    self.shared.diagnostic.send_replace(Some(diagnostic));
+                }
+                if let Some(permit) = self.state.active.remove(&id) {
+                    if let Some(resource) = exit.uncertain {
+                        self.shared.unhealthy.store(true, Ordering::Release);
+                        self.state.quarantine.push(Retained {
+                            _permit: permit,
+                            _resource: Some(resource),
+                        });
+                    }
+                }
+            }
+            Err(error) => {
+                self.shared.unhealthy.store(true, Ordering::Release);
+                let id = error.id();
+                self.shared
+                    .diagnostic
+                    .send_replace(Some(Arc::new(BridgeError::Worker(error))));
+                if let Some(permit) = self.state.active.remove(&id) {
+                    self.state.quarantine.push(Retained {
+                        _permit: permit,
+                        _resource: None,
+                    });
+                }
+            }
+        }
+    }
+}
+impl Drop for ManagerOwner {
+    fn drop(&mut self) {
+        self.shared.accepting.store(false, Ordering::Release);
+        self.state.queue.close();
+        self.reject_queued();
+        if self.state.jobs.is_empty()
+            && self.state.active.is_empty()
+            && self.state.quarantine.is_empty()
+        {
+            return;
+        }
+        // Retain the bounded ownership graph if normal shutdown cannot prove clean.
+        // This guard also covers an unpolled manager and runtime teardown.
+        let state = ManagerState {
+            queue: mpsc::channel(1).1,
+            stop: watch::channel(true).1,
+            jobs: JoinSet::new(),
+            active: HashMap::new(),
+            quarantine: Vec::new(),
+        };
+        let retained = replace(&mut self.state, state);
+        tracing::error!(
+            calls = retained.active.len() + retained.quarantine.len(),
+            "Lambda task bridge retains uncertain cleanup"
+        );
+        let _retained = Box::leak(Box::new((self.shared.clone(), retained)));
+    }
+}
+fn signal(receiver: &watch::Receiver<bool>) -> bool {
+    *receiver.borrow() || receiver.has_changed().is_err()
+}
diff --git a/apps/rustack/src/stepfunctions_bridge/error.rs b/apps/rustack/src/stepfunctions_bridge/error.rs
new file mode 100644
index 00000000..4c34b9f0
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge/error.rs
@@ -0,0 +1,53 @@
+//! Redacted internal bridge errors; sources never become ASL public causes.
+
+use std::{fmt, sync::Arc};
+
+use rustack_lambda_core::{error::LambdaServiceError, executor::ExecutorError};
+use rustack_stepfunctions_core::{AslError, CallbackError};
+use thiserror::Error;
+use tokio::task::JoinError;
+
+/// Bridge lifecycle/internal errors with bounded static public descriptions.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum BridgeError {
+    /// Invalid operator bridge limits.
+    #[error("invalid Lambda task bridge configuration")]
+    Configuration,
+    /// No Tokio runtime is active for owned admission.
+    #[error("Lambda task bridge runtime unavailable")]
+    Unavailable,
+    /// Evaluated optimized parameters violate the supported schema.
+    #[error("invalid Lambda task parameters")]
+    Parameters,
+    /// An observer deadline expired; the manager remains owned.
+    #[error("Lambda task bridge observation deadline exceeded")]
+    Deadline,
+    /// Cleanup ownership remains uncertain and charged.
+    #[error("Lambda task bridge cleanup quarantined")]
+    Quarantined,
+    /// Provider failure, retained without copying its host/business text.
+    #[error("Lambda task provider failed")]
+    Service(#[source] Arc<LambdaServiceError>),
+    /// Execution/cleanup failure from an actual backend.
+    #[error("Lambda task execution failed")]
+    Executor(#[source] Arc<ExecutorError>),
+    /// Bounded JSON/invariant failure.
+    #[error("Lambda task data conversion failed")]
+    Evaluation(
+        #[from]
+        #[source]
+        AslError,
+    ),
+    /// Invalid or closed real callback invocation reporting control.
+    #[error("Lambda callback invocation report failed")]
+    Callback(#[source] Arc<CallbackError>),
+    /// A supervised worker panicked or was unexpectedly cancelled.
+    #[error("Lambda task bridge worker failed")]
+    Worker(#[source] JoinError),
+}
+impl fmt::Debug for BridgeError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
diff --git a/apps/rustack/src/stepfunctions_bridge/mapping.rs b/apps/rustack/src/stepfunctions_bridge/mapping.rs
new file mode 100644
index 00000000..f113e11d
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge/mapping.rs
@@ -0,0 +1,471 @@
+//! Validated per-attempt plans and bounded direct/optimized result mapping.
+
+use std::{
+    fmt,
+    io::{Error as IoError, Result as IoResult, Write},
+    str,
+    sync::Arc,
+};
+
+use rustack_core::json::JsonError;
+use rustack_lambda_core::{
+    error::LambdaServiceError,
+    executor::{ExecutorError, InvokeResponse},
+};
+use rustack_stepfunctions_core::{
+    AslError, CallbackError, CallbackInvocationMetadata, Integration, LambdaTaskCommand,
+    MAX_PAYLOAD_BYTES, Payload, StateView, TaskFailure, TenantScope, UuidSource,
+};
+use serde_json::{Value, json};
+use tokio::time::Instant;
+
+use super::BridgeError;
+
+const CAUSE_LIMIT: usize = 32_768;
+const TRUNCATION_MARKER: &str = " [truncated]";
+
+struct CauseWriter {
+    prefix: Vec<u8>,
+    truncated: bool,
+}
+impl fmt::Debug for CauseWriter {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("LambdaCauseWriter(<redacted>)")
+    }
+}
+impl Write for CauseWriter {
+    fn write(&mut self, bytes: &[u8]) -> IoResult<usize> {
+        let count = CAUSE_LIMIT
+            .saturating_sub(self.prefix.len())
+            .min(bytes.len());
+        self.prefix.extend_from_slice(
+            bytes
+                .get(..count)
+                .ok_or_else(|| IoError::other("invalid Cause prefix"))?,
+        );
+        self.truncated |= count < bytes.len();
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> IoResult<()> {
+        Ok(())
+    }
+}
+
+pub(super) struct CallPlan {
+    pub(super) function: String,
+    pub(super) qualifier: Option<String>,
+    pub(super) payload: Payload,
+    pub(super) mode: ResponseMode,
+    pub(super) deadline: Instant,
+}
+#[derive(Debug, Clone, Copy)]
+pub(super) enum ResponseMode {
+    Direct,
+    Optimized,
+    ObservedCallback,
+}
+impl fmt::Debug for CallPlan {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("LambdaCallPlan(<redacted>)")
+    }
+}
+#[derive(Debug)]
+pub(super) struct Mapped {
+    pub(super) result: Result<Payload, TaskFailure>,
+    pub(super) diagnostic: Option<BridgeError>,
+}
+impl CallPlan {
+    pub(super) fn compile(command: &LambdaTaskCommand) -> Result<Self, BridgeError> {
+        let call = command.dispatch();
+        let StateView::Task { resource, .. } = command.machine().state(call.state())? else {
+            return Err(BridgeError::Parameters);
+        };
+        let (function, qualifier, payload, optimized) = match resource {
+            Integration::DirectLambda(arn) => {
+                (arn.as_str().into(), None, call.parameters().clone(), false)
+            }
+            Integration::LambdaInvoke | Integration::LambdaCallback(_) => {
+                if matches!(resource, Integration::LambdaCallback(_))
+                    && !command.is_observed_callback()
+                {
+                    return Err(BridgeError::Parameters);
+                }
+                let object = call
+                    .parameters()
+                    .value()
+                    .as_object()
+                    .ok_or(BridgeError::Parameters)?;
+                if object.keys().any(|key| {
+                    !matches!(
+                        key.as_str(),
+                        "FunctionName" | "Payload" | "Qualifier" | "InvocationType"
+                    )
+                }) {
+                    return Err(BridgeError::Parameters);
+                }
+                let function = object
+                    .get("FunctionName")
+                    .and_then(Value::as_str)
+                    .filter(|v| !v.is_empty() && v.len() <= 256)
+                    .ok_or(BridgeError::Parameters)?
+                    .to_owned();
+                validate_reference(&function, command.machine().scope())?;
+                let qualifier = object
+                    .get("Qualifier")
+                    .map(|v| {
+                        v.as_str()
+                            .filter(|q| !q.is_empty() && q.len() <= 128)
+                            .map(str::to_owned)
+                            .ok_or(BridgeError::Parameters)
+                    })
+                    .transpose()?;
+                if object
+                    .get("InvocationType")
+                    .is_some_and(|v| v.as_str() != Some("RequestResponse"))
+                {
+                    return Err(BridgeError::Parameters);
+                }
+                let payload = match object.get("Payload") {
+                    None | Some(Value::Null) => Payload::parse(b"{}")?,
+                    Some(Value::String(text)) => Payload::parse(text.as_bytes())?,
+                    Some(value) => Payload::from_value(value)?,
+                };
+                (function, qualifier, payload, true)
+            }
+            _ => return Err(BridgeError::Parameters),
+        };
+        Ok(Self {
+            function,
+            qualifier,
+            payload,
+            mode: if command.is_observed_callback() {
+                if !optimized {
+                    return Err(BridgeError::Parameters);
+                }
+                ResponseMode::ObservedCallback
+            } else if optimized {
+                ResponseMode::Optimized
+            } else {
+                ResponseMode::Direct
+            },
+            deadline: Instant::from_std(call.deadline()),
+        })
+    }
+}
+pub(super) struct ServiceTarget {
+    function: String,
+    qualifier: Option<String>,
+    scope: TenantScope,
+}
+impl fmt::Debug for ServiceTarget {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("LambdaServiceTarget(<redacted>)")
+    }
+}
+impl ServiceTarget {
+    pub(super) fn new(plan: &CallPlan, scope: &TenantScope) -> Self {
+        Self {
+            function: plan.function.clone(),
+            qualifier: plan.qualifier.clone(),
+            scope: scope.clone(),
+        }
+    }
+    fn qualified_arn(&self) -> Result<String, BridgeError> {
+        validate_reference(&self.function, &self.scope)?;
+        let prefix = format!(
+            "arn:{}:lambda:{}:{}:function:",
+            self.scope.partition(),
+            self.scope.region(),
+            self.scope.account()
+        );
+        let reference = self
+            .function
+            .strip_prefix(&prefix)
+            .unwrap_or(&self.function);
+        let mut parts = reference.split(':');
+        let name = parts.next().ok_or(BridgeError::Parameters)?;
+        let embedded = parts.next();
+        if parts.next().is_some()
+            || embedded
+                .zip(self.qualifier.as_deref())
+                .is_some_and(|(left, right)| left != right)
+        {
+            return Err(BridgeError::Parameters);
+        }
+        let qualifier = embedded.or(self.qualifier.as_deref()).unwrap_or("$LATEST");
+        if qualifier.is_empty()
+            || qualifier.len() > 128
+            || !qualifier
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-' | b'$'))
+        {
+            return Err(BridgeError::Parameters);
+        }
+        let arn = format!("{prefix}{name}:{qualifier}");
+        if arn.len() > 512 {
+            return Err(BridgeError::Parameters);
+        }
+        Ok(arn)
+    }
+}
+
+fn validate_reference(reference: &str, scope: &TenantScope) -> Result<(), BridgeError> {
+    let valid_name = |name: &str| {
+        !name.is_empty()
+            && name.len() <= 64
+            && name
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-'))
+    };
+    if reference.starts_with("arn:") {
+        let prefix = format!(
+            "arn:{}:lambda:{}:{}:function:",
+            scope.partition(),
+            scope.region(),
+            scope.account()
+        );
+        let suffix = reference
+            .strip_prefix(&prefix)
+            .ok_or(BridgeError::Parameters)?;
+        let mut parts = suffix.split(':');
+        let name = parts.next().ok_or(BridgeError::Parameters)?;
+        if !valid_name(name)
+            || parts.next().is_some_and(|q| {
+                q.is_empty()
+                    || q.len() > 128
+                    || !q
+                        .bytes()
+                        .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-' | b'$'))
+            })
+            || parts.next().is_some()
+        {
+            return Err(BridgeError::Parameters);
+        }
+    } else if !valid_name(reference) {
+        return Err(BridgeError::Parameters);
+    }
+    Ok(())
+}
+fn failure(name: &str, cause: &str) -> Result<Mapped, BridgeError> {
+    Ok(Mapped {
+        result: Err(TaskFailure::new(name, Some(cause))?),
+        diagnostic: None,
+    })
+}
+pub(super) fn parameters(error: BridgeError) -> Result<Mapped, BridgeError> {
+    let mut mapped = failure("States.Runtime", "Invalid evaluated Lambda task parameters")?;
+    mapped.diagnostic = Some(error);
+    Ok(mapped)
+}
+pub(super) fn response(
+    response: &InvokeResponse,
+    optimized: bool,
+    request_id: &str,
+) -> Result<Mapped, BridgeError> {
+    if response.status != 200 {
+        return failure(
+            "Lambda.ServiceException",
+            "Unexpected Lambda response status",
+        );
+    }
+    if response.payload.len() > MAX_PAYLOAD_BYTES {
+        return failure(
+            "States.DataLimitExceeded",
+            "Lambda result exceeds the ASL payload limit",
+        );
+    }
+    let payload = match Payload::parse(&response.payload) {
+        Ok(payload) => payload,
+        Err(error) => {
+            let name = if response.function_error.is_some() {
+                "Lambda.Unknown"
+            } else {
+                "States.Runtime"
+            };
+            let mut mapped = failure(name, "Lambda returned invalid JSON")?;
+            mapped.diagnostic = Some(error.into());
+            return Ok(mapped);
+        }
+    };
+    if response.function_error.is_some() {
+        let error = payload
+            .value()
+            .get("errorType")
+            .and_then(Value::as_str)
+            .filter(|name| {
+                !name.is_empty()
+                    && name.len() <= 256
+                    && !name.starts_with("States.")
+                    && !name.chars().any(char::is_control)
+            })
+            .unwrap_or("Lambda.Unknown");
+        return failure(error, &bounded_cause(payload.value())?);
+    }
+    if !optimized {
+        return Ok(Mapped {
+            result: Ok(payload),
+            diagnostic: None,
+        });
+    }
+    if response.executed_version.is_empty()
+        || response.executed_version.len() > 128
+        || !response
+            .executed_version
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-' | b'$'))
+    {
+        return failure("Lambda.ServiceException", "Invalid Lambda version metadata");
+    }
+    let envelope = json!({"Payload":payload.value(),"StatusCode":200,"ExecutedVersion":response.executed_version,
+        "SdkHttpMetadata":{"HttpStatusCode":200},"SdkResponseMetadata":{"RequestId":request_id}});
+    match Payload::from_value(&envelope) {
+        Ok(payload) => Ok(Mapped {
+            result: Ok(payload),
+            diagnostic: None,
+        }),
+        Err(error) => {
+            let name = match &error {
+                AslError::DataLimit
+                | AslError::Json(JsonError::Bytes | JsonError::String | JsonError::Key) => {
+                    "States.DataLimitExceeded"
+                }
+                AslError::Encoding(_) | AslError::Allocation(_) | AslError::Entropy(_) => {
+                    "Lambda.ServiceException"
+                }
+                _ => "States.Runtime",
+            };
+            let mut mapped = failure(
+                name,
+                "Lambda result envelope exceeds the ASL payload profile",
+            )?;
+            mapped.diagnostic = Some(error.into());
+            Ok(mapped)
+        }
+    }
+}
+pub(super) fn observed_response(
+    invocation: &InvokeResponse,
+    metadata: Result<CallbackInvocationMetadata, CallbackError>,
+) -> Result<(Mapped, Option<CallbackInvocationMetadata>), BridgeError> {
+    // FunctionError keeps the ordinary bounded failure path. Successful callback
+    // invocations never parse or retain the synchronous function business body.
+    if invocation.status != 200 || invocation.function_error.is_some() {
+        return response(invocation, false, "").map(|mapped| (mapped, None));
+    }
+    let metadata = match metadata {
+        Ok(metadata) => metadata,
+        Err(error) => {
+            let mut mapped = failure(
+                "Lambda.ServiceException",
+                "Invalid Lambda invocation metadata",
+            )?;
+            mapped.diagnostic = Some(BridgeError::Callback(Arc::new(error)));
+            return Ok((mapped, None));
+        }
+    };
+    let output = metadata.payload()?;
+    Ok((
+        Mapped {
+            result: Ok(output),
+            diagnostic: None,
+        },
+        Some(metadata),
+    ))
+}
+fn bounded_cause(value: &Value) -> Result<String, BridgeError> {
+    let mut writer = CauseWriter {
+        prefix: Vec::with_capacity(CAUSE_LIMIT),
+        truncated: false,
+    };
+    serde_json::to_writer(&mut writer, value).map_err(AslError::Encoding)?;
+    if writer.truncated {
+        writer
+            .prefix
+            .truncate(CAUSE_LIMIT.saturating_sub(TRUNCATION_MARKER.len()));
+    }
+    let prefix = match str::from_utf8(&writer.prefix) {
+        Ok(prefix) => prefix,
+        Err(error) if writer.truncated && error.error_len().is_none() => str::from_utf8(
+            writer
+                .prefix
+                .get(..error.valid_up_to())
+                .ok_or(BridgeError::Parameters)?,
+        )
+        .map_err(|_| BridgeError::Parameters)?,
+        Err(_) => return Err(BridgeError::Parameters),
+    };
+    let mut cause = prefix.to_owned();
+    if writer.truncated {
+        cause.push_str(TRUNCATION_MARKER);
+    }
+    Ok(cause)
+}
+pub(super) fn service<S: UuidSource + ?Sized>(
+    error: LambdaServiceError,
+    target: &ServiceTarget,
+    source: &mut S,
+) -> Result<Mapped, BridgeError> {
+    let name = match &error {
+        #[cfg(unix)]
+        LambdaServiceError::ImageRestore { .. } | LambdaServiceError::ImageRestoreWorker { .. } => {
+            "Lambda.ServiceException"
+        }
+        LambdaServiceError::TooManyRequests => "Lambda.TooManyRequestsException",
+        LambdaServiceError::FunctionNotFound { .. }
+        | LambdaServiceError::VersionNotFound { .. }
+        | LambdaServiceError::AliasNotFound { .. }
+        | LambdaServiceError::EventSourceMappingNotFound { .. }
+        | LambdaServiceError::PolicyNotFound { .. }
+        | LambdaServiceError::EventInvokeConfigNotFound { .. } => {
+            "Lambda.ResourceNotFoundException"
+        }
+        LambdaServiceError::ResourceConflict { .. } => "Lambda.ResourceConflictException",
+        LambdaServiceError::PreconditionFailed => "Lambda.PreconditionFailedException",
+        LambdaServiceError::InvalidParameter { .. }
+        | LambdaServiceError::InvalidZipFile { .. }
+        | LambdaServiceError::InvalidArn { .. } => "Lambda.InvalidParameterValueException",
+        LambdaServiceError::ResourceNotReady { .. } => "Lambda.ResourceNotReadyException",
+        LambdaServiceError::RequestTooLarge { .. } => "Lambda.RequestTooLargeException",
+        LambdaServiceError::ArtifactIo { .. }
+        | LambdaServiceError::DockerNotAvailable
+        | LambdaServiceError::Internal { .. } => "Lambda.ServiceException",
+    };
+    let mut mapped = if matches!(
+        &error,
+        LambdaServiceError::FunctionNotFound { .. }
+            | LambdaServiceError::VersionNotFound { .. }
+            | LambdaServiceError::AliasNotFound { .. }
+    ) {
+        let arn = target.qualified_arn()?;
+        let id = source.next_uuid()?;
+        // The RFC 4122/9562 variant has leading bits 10 in the ninth byte.
+        if id.get_version_num() != 4 || id.as_bytes().get(8).is_none_or(|byte| byte & 0xc0 != 0x80)
+        {
+            return Err(BridgeError::Parameters);
+        }
+        failure(
+            name,
+            &format!(
+                "Function not found: {arn} (Service: AWSLambda; Status Code: 404; Error Code: \
+                 ResourceNotFoundException; Request ID: {id}; Proxy: null)"
+            ),
+        )?
+    } else {
+        failure(name, "Lambda invocation admission failed")?
+    };
+    mapped.diagnostic = Some(BridgeError::Service(Arc::new(error)));
+    Ok(mapped)
+}
+pub(super) fn executor(error: ExecutorError) -> Result<Mapped, BridgeError> {
+    let name = match &error {
+        ExecutorError::Timeout(_) => "Sandbox.Timedout",
+        ExecutorError::Unsupported(_)
+        | ExecutorError::InvalidCode(_)
+        | ExecutorError::InitFailed(_) => "Runtime.InvalidEntrypoint",
+        ExecutorError::RuntimeExited(_) => "Runtime.ExitError",
+        _ => "Lambda.ServiceException",
+    };
+    let mut mapped = failure(name, "Lambda execution failed")?;
+    mapped.diagnostic = Some(BridgeError::Executor(Arc::new(error)));
+    Ok(mapped)
+}
diff --git a/apps/rustack/src/stepfunctions_bridge/tests.rs b/apps/rustack/src/stepfunctions_bridge/tests.rs
new file mode 100644
index 00000000..ee322914
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge/tests.rs
@@ -0,0 +1,950 @@
+//! Controlled provider tests plus separately gated actual Native process fixtures.
+
+use std::{
+    collections::{BTreeSet, HashMap},
+    io::{Cursor, Write},
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use async_trait::async_trait;
+use base64::{Engine, engine::general_purpose::STANDARD};
+use bytes::Bytes;
+use rustack_lambda_core::{
+    config::LambdaConfig,
+    error::LambdaServiceError,
+    executor::{Executor, ExecutorBackend, ExecutorError, InvokeRequest, InvokeResponse},
+    invocation::InvocationContext,
+    provider::RustackLambda,
+    storage::FunctionStore,
+};
+use rustack_lambda_model::{
+    input::CreateFunctionInput,
+    types::{Environment, FunctionCode},
+};
+use rustack_stepfunctions_core::{
+    AslCompiler, AslError, ClockSample, EvaluationContext, ExecutionDriver, ExecutionLimits,
+    ExecutionOutcome, ExecutionSupervisor, HistoryLimits, Payload, RuntimeLimits, SystemUuidSource,
+    TaskSupport, TenantScope, UuidSource,
+};
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::{
+    sync::Semaphore,
+    time::{Instant, timeout},
+};
+use uuid::Uuid;
+use zip::{ZipWriter, write::SimpleFileOptions};
+
+use super::*;
+
+#[derive(Debug)]
+struct TestExecutor {
+    calls: AtomicUsize,
+    entered: Arc<Semaphore>,
+    release: Arc<Semaphore>,
+    cleanup: Arc<Semaphore>,
+    fail_cleanup: bool,
+}
+#[async_trait]
+impl Executor for TestExecutor {
+    async fn invoke(
+        &self,
+        req: InvokeRequest,
+        context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        self.calls.fetch_add(1, Ordering::SeqCst);
+        self.entered.add_permits(1);
+        tokio::select! {biased;_=context.cancelled()=>{},permit=self.release.acquire()=>{if let Ok(permit)=permit {permit.forget();}}}
+        if let Ok(permit) = self.cleanup.acquire().await {
+            permit.forget();
+        }
+        if self.fail_cleanup {
+            return Err(ExecutorError::CleanupFailed(
+                "controlled cleanup failure".into(),
+            ));
+        }
+        Ok(InvokeResponse::success(req.payload, "$LATEST".into()))
+    }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+}
+fn executor() -> Arc<TestExecutor> {
+    Arc::new(TestExecutor {
+        calls: AtomicUsize::new(0),
+        entered: Arc::new(Semaphore::new(0)),
+        release: Arc::new(Semaphore::new(1)),
+        cleanup: Arc::new(Semaphore::new(1)),
+        fail_cleanup: false,
+    })
+}
+fn zip(bytes: &[u8], marker: &str) -> Vec<u8> {
+    let mut zip = ZipWriter::new(Cursor::new(Vec::new()));
+    let options = SimpleFileOptions::default().unix_permissions(0o755);
+    zip.start_file("bootstrap", options).unwrap();
+    zip.write_all(bytes).unwrap();
+    zip.start_file("revision.txt", options).unwrap();
+    zip.write_all(marker.as_bytes()).unwrap();
+    zip.finish().unwrap().into_inner()
+}
+fn create(code: &[u8], env: &[(&str, &str)]) -> CreateFunctionInput {
+    let architecture = match std::env::consts::ARCH {
+        "aarch64" => "arm64",
+        _ => "x86_64",
+    };
+    CreateFunctionInput {
+        function_name: "Worker".into(),
+        runtime: Some("provided.al2023".into()),
+        handler: Some("bootstrap".into()),
+        role: "arn:aws:iam::000000000000:role/test".into(),
+        timeout: Some(5),
+        architectures: Some(vec![architecture.into()]),
+        code: FunctionCode {
+            zip_file: Some(STANDARD.encode(code)),
+            ..FunctionCode::default()
+        },
+        environment: Some(Environment {
+            variables: Some(
+                env.iter()
+                    .map(|(k, v)| (k.to_string(), v.to_string()))
+                    .collect::<HashMap<_, _>>(),
+            ),
+        }),
+        ..CreateFunctionInput::default()
+    }
+}
+fn provider(executor: Arc<TestExecutor>) -> (Arc<RustackLambda>, TempDir) {
+    let directory = tempfile::tempdir().unwrap();
+    let config = LambdaConfig {
+        executor: ExecutorBackend::Native,
+        ..LambdaConfig::default()
+    };
+    (
+        Arc::new(RustackLambda::with_executor(
+            FunctionStore::new(directory.path()),
+            config,
+            executor,
+        )),
+        directory,
+    )
+}
+fn definition(resource: &str, parameters: Option<Value>) -> Value {
+    let mut state = json!({"Type":"Task","Resource":resource,"End":true});
+    if let Some(parameters) = parameters {
+        state["Parameters"] = parameters;
+    }
+    json!({"StartAt":"Call","States":{"Call":state}})
+}
+fn direct() -> Value {
+    definition(
+        "arn:aws:lambda:us-east-1:000000000000:function:Worker",
+        None,
+    )
+}
+fn driver(definition: &Value, input: &Value) -> ExecutionDriver {
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(&serde_json::to_vec(definition).unwrap())
+        .unwrap()
+        .machine()
+        .clone();
+    let payload = Payload::from_value(input).unwrap();
+    ExecutionDriver::new(
+        machine,
+        payload,
+        EvaluationContext::from_value(
+            &json!({"Execution":{"Input":input,"Id":"execution-fixture"}}),
+        )
+        .unwrap(),
+        ClockSample::new(
+            Instant::now().into_std(),
+            std::time::SystemTime::now().into(),
+        ),
+        ExecutionLimits::new(Duration::from_secs(20), 1000).unwrap(),
+    )
+    .unwrap()
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn executions(bridge: Arc<StepFunctionsLambdaBridge>) -> ExecutionSupervisor {
+    ExecutionSupervisor::new(
+        RuntimeLimits::new(8, 8, 2).unwrap(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        Some(bridge),
+    )
+    .unwrap()
+}
+fn output(outcome: &ExecutionOutcome) -> &Value {
+    match outcome {
+        ExecutionOutcome::Succeeded(output) => output.value(),
+        other => panic!("expected success, got {other:?}"),
+    }
+}
+async fn clean(
+    owner: &mut ExecutionSupervisor,
+    bridge: &mut LambdaBridgeSupervisor,
+    provider: &RustackLambda,
+) {
+    let workflow = owner.drain(deadline()).await;
+    let joined = bridge.shutdown(deadline()).await;
+    let provider = provider.quiesce(Duration::from_secs(10)).await;
+    assert!(workflow.is_ok(), "workflow cleanup {workflow:?}");
+    assert!(joined.is_ok(), "bridge cleanup {joined:?}");
+    assert!(provider.is_ok(), "provider cleanup {provider:?}");
+}
+#[tokio::test]
+async fn test_should_invoke_shared_provider_direct_and_optimized_without_http_loopback() {
+    for optimized in [false, true] {
+        let exec = executor();
+        let (provider, _dir) = provider(exec.clone());
+        provider
+            .create_function(create(&zip(b"fixture", "v1"), &[]))
+            .await
+            .unwrap();
+        let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+            provider.clone(),
+            TenantScope::default(),
+            BridgeLimits::default(),
+        )
+        .unwrap();
+        let mut owner = executions(port);
+        let def = if optimized {
+            definition(
+                "arn:aws:states:::lambda:invoke",
+                Some(json!({"FunctionName":"Worker","Payload.$":"$"})),
+            )
+        } else {
+            direct()
+        };
+        let mut handle = owner.start(driver(&def, &json!({"number":7}))).unwrap();
+        let result = handle.wait(deadline()).await;
+        clean(&mut owner, &mut bridge, &provider).await;
+        let result = result.unwrap();
+        let body = output(result.outcome().unwrap());
+        if optimized {
+            assert_eq!(body.get("Payload"), Some(&json!({"number":7})));
+            assert_eq!(body.get("StatusCode"), Some(&json!(200)));
+            assert!(
+                body.pointer("/SdkResponseMetadata/RequestId")
+                    .and_then(Value::as_str)
+                    .is_some_and(|v| v.len() == 36)
+            );
+        } else {
+            assert_eq!(body, &json!({"number":7}));
+        }
+        assert_eq!(exec.calls.load(Ordering::SeqCst), 1);
+    }
+}
+#[tokio::test]
+async fn test_should_reject_dynamic_partial_and_cross_scope_references_before_execution() {
+    for function in [
+        "999999999999:function:Worker",
+        "000000000000:function:Worker",
+        "999999999999:function:Worker:1",
+        "arn:aws:lambda:us-west-2:000000000000:function:Worker",
+        "arn:aws:lambda:us-east-1:999999999999:function:Worker",
+    ] {
+        let exec = executor();
+        let (provider, _dir) = provider(exec.clone());
+        provider
+            .create_function(create(&zip(b"fixture", "v1"), &[]))
+            .await
+            .unwrap();
+        let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+            provider.clone(),
+            TenantScope::default(),
+            BridgeLimits::default(),
+        )
+        .unwrap();
+        let mut owner = executions(port);
+        let def = definition(
+            "arn:aws:states:::lambda:invoke",
+            Some(json!({"FunctionName.$":"$.function"})),
+        );
+        let mut handle = owner
+            .start(driver(&def, &json!({"function":function})))
+            .unwrap();
+        let result = handle.wait(deadline()).await;
+        clean(&mut owner, &mut bridge, &provider).await;
+        assert!(
+            matches!(result.unwrap().outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Runtime"))
+        );
+        assert_eq!(exec.calls.load(Ordering::SeqCst), 0);
+    }
+}
+#[test]
+fn test_should_map_function_error_only_from_transport_flag_and_bound_causes() {
+    let payload = Bytes::from_static(
+        br#"{"errorType":"BusinessError","errorMessage":"boom","FunctionError":"business data"}"#,
+    );
+    let response = InvokeResponse::success(payload.clone(), "$LATEST".into());
+    let mapped = mapping::response(&response, false, "id").unwrap();
+    assert!(mapped.result.is_ok());
+    let mut response = InvokeResponse::success(payload, "$LATEST".into());
+    response.function_error = Some("Unhandled".into());
+    let mapped = mapping::response(&response, false, "id").unwrap();
+    assert!(format!("{mapped:?}").find("boom").is_none());
+    assert!(
+        matches!(mapped.result,Err(ref failure) if failure.details().error()==Some("BusinessError"))
+    );
+}
+
+mod native;
+
+#[test]
+fn test_should_redact_call_plan_names_and_reject_invalid_limits() {
+    let plan = mapping::CallPlan {
+        function: "function-debug-marker".into(),
+        qualifier: Some("qualifier-debug-marker".into()),
+        payload: Payload::parse(b"{}").unwrap(),
+        mode: mapping::ResponseMode::Optimized,
+        deadline: deadline(),
+    };
+    let debug = format!("{plan:?}");
+    assert!(!debug.contains("function-debug-marker"));
+    assert!(!debug.contains("qualifier-debug-marker"));
+    for (accepted, seconds) in [(0, 1), (1025, 1), (1, 0), (1, 61)] {
+        assert!(BridgeLimits::new(accepted, Duration::from_secs(seconds)).is_err());
+    }
+}
+#[test]
+fn test_should_enforce_result_quota_utf8_json_and_envelope_depth() {
+    for bytes in [Bytes::from_static(b"not-json"), Bytes::from_static(&[0xff])] {
+        let mapped = mapping::response(
+            &InvokeResponse::success(bytes, "$LATEST".into()),
+            false,
+            "id",
+        )
+        .unwrap();
+        assert!(matches!(mapped.result,Err(f) if f.details().error()==Some("States.Runtime")));
+        assert!(mapped.diagnostic.is_some());
+    }
+    let exact = Bytes::from(serde_json::to_vec(&"x".repeat(262_142)).unwrap());
+    assert_eq!(exact.len(), 262_144);
+    assert!(
+        mapping::response(
+            &InvokeResponse::success(exact.clone(), "$LATEST".into()),
+            false,
+            "id"
+        )
+        .unwrap()
+        .result
+        .is_ok()
+    );
+    let optimized = mapping::response(
+        &InvokeResponse::success(exact, "$LATEST".into()),
+        true,
+        "id",
+    )
+    .unwrap();
+    assert!(
+        matches!(optimized.result,Err(f) if f.details().error()==Some("States.DataLimitExceeded"))
+    );
+    let oversized = Bytes::from(vec![b' '; 262_145]);
+    let mapped = mapping::response(
+        &InvokeResponse::success(oversized, "$LATEST".into()),
+        false,
+        "id",
+    )
+    .unwrap();
+    assert!(
+        matches!(mapped.result,Err(f) if f.details().error()==Some("States.DataLimitExceeded"))
+    );
+    let mut nested = Value::Null;
+    for _ in 0..64 {
+        nested = json!([nested]);
+    }
+    let nested = Bytes::from(serde_json::to_vec(&nested).unwrap());
+    let mapped = mapping::response(
+        &InvokeResponse::success(nested, "$LATEST".into()),
+        true,
+        "id",
+    )
+    .unwrap();
+    assert!(matches!(mapped.result,Err(f) if f.details().error()==Some("States.Runtime")));
+}
+#[test]
+fn test_should_bound_function_error_type_and_utf8_cause_without_leaking_debug_data() {
+    for error_type in [
+        "States.Timeout".to_owned(),
+        String::new(),
+        "x".repeat(257),
+        "bad\nname".to_owned(),
+        "BusinessError".to_owned(),
+    ] {
+        let body =
+            serde_json::to_vec(&json!({"errorType":error_type,"errorMessage":"é".repeat(40_000)}))
+                .unwrap();
+        let mut response = InvokeResponse::success(Bytes::from(body), "$LATEST".into());
+        response.function_error = Some("Unhandled".into());
+        let mapped = mapping::response(&response, false, "id").unwrap();
+        let failure = mapped.result.unwrap_err();
+        assert_eq!(
+            failure.details().error(),
+            Some(if error_type == "BusinessError" {
+                "BusinessError"
+            } else {
+                "Lambda.Unknown"
+            })
+        );
+        let cause = failure.details().cause().unwrap();
+        assert!(cause.len() <= 32_768);
+        assert!(cause.ends_with(" [truncated]"));
+        assert!(!format!("{failure:?}").contains("errorMessage"));
+    }
+}
+#[tokio::test]
+async fn test_should_preserve_cleanup_after_stop_and_resume_same_shutdown_waiter() {
+    let exec = Arc::new(TestExecutor {
+        calls: AtomicUsize::new(0),
+        entered: Arc::new(Semaphore::new(0)),
+        release: Arc::new(Semaphore::new(0)),
+        cleanup: Arc::new(Semaphore::new(0)),
+        fail_cleanup: false,
+    });
+    let (provider, _directory) = provider(exec.clone());
+    provider
+        .create_function(create(&zip(b"fixture", "v1"), &[]))
+        .await
+        .unwrap();
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::new(1, Duration::from_secs(1)).unwrap(),
+    )
+    .unwrap();
+    let mut owner = executions(port);
+    let mut handle = owner.start(driver(&direct(), &json!({}))).unwrap();
+    timeout(Duration::from_secs(5), exec.entered.acquire())
+        .await
+        .unwrap()
+        .unwrap()
+        .forget();
+    let stopped = handle
+        .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+        .await
+        .unwrap();
+    assert!(matches!(
+        stopped.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    assert!(
+        matches!(bridge.shutdown(Instant::now()+Duration::from_millis(20)).await,Err(e) if matches!(e.as_ref(),BridgeError::Deadline))
+    );
+    assert_eq!(bridge.owned_calls(), 1);
+    // Keep the same handle alive past the first bounded cleanup observation.
+    tokio::time::sleep(Duration::from_millis(1100)).await;
+    assert_eq!(bridge.owned_calls(), 1);
+    exec.cleanup.add_permits(1);
+    clean(&mut owner, &mut bridge, &provider).await;
+    assert_eq!(bridge.owned_calls(), 0);
+    assert_eq!(
+        handle.snapshot().cleanup(),
+        rustack_stepfunctions_core::CleanupState::Clean
+    );
+}
+#[tokio::test]
+async fn test_should_reject_evaluated_invalid_invocation_type_without_executing() {
+    let exec = executor();
+    let (provider, _directory) = provider(exec.clone());
+    provider
+        .create_function(create(&zip(b"fixture", "v1"), &[]))
+        .await
+        .unwrap();
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let mut owner = executions(port);
+    let definition = definition(
+        "arn:aws:states:::lambda:invoke",
+        Some(json!({"FunctionName":"Worker","InvocationType.$":"$.kind"})),
+    );
+    let mut handle = owner
+        .start(driver(&definition, &json!({"kind":"Event"})))
+        .unwrap();
+    let result = handle.wait(deadline()).await;
+    clean(&mut owner, &mut bridge, &provider).await;
+    assert!(
+        matches!(result.unwrap().outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Runtime"))
+    );
+    assert_eq!(exec.calls.load(Ordering::SeqCst), 0);
+}
+#[tokio::test]
+async fn test_should_refuse_mismatched_provider_scope_and_disabled_backend() {
+    let exec = executor();
+    let (provider, _directory) = provider(exec);
+    let scope = TenantScope::new("aws", "us-west-2", "000000000000").unwrap();
+    assert!(matches!(
+        StepFunctionsLambdaBridge::new(provider, scope, BridgeLimits::default()),
+        Err(BridgeError::Configuration)
+    ));
+    let provider = Arc::new(RustackLambda::new(LambdaConfig::default()));
+    assert!(matches!(
+        StepFunctionsLambdaBridge::new(provider, TenantScope::default(), BridgeLimits::default()),
+        Err(BridgeError::Configuration)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_retain_uncertain_backend_cleanup_and_refuse_clean_shutdown() {
+    let exec = Arc::new(TestExecutor {
+        calls: AtomicUsize::new(0),
+        entered: Arc::new(Semaphore::new(0)),
+        release: Arc::new(Semaphore::new(1)),
+        cleanup: Arc::new(Semaphore::new(1)),
+        fail_cleanup: true,
+    });
+    let (provider, _directory) = provider(exec);
+    provider
+        .create_function(create(&zip(b"fixture", "v1"), &[]))
+        .await
+        .unwrap();
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::new(1, Duration::from_secs(1)).unwrap(),
+    )
+    .unwrap();
+    let mut owner = executions(port);
+    let mut handle = owner.start(driver(&direct(), &json!({}))).unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Lambda.ServiceException"))
+    );
+    assert!(
+        matches!(bridge.shutdown(deadline()).await,Err(e) if matches!(e.as_ref(),BridgeError::Quarantined))
+    );
+    assert_eq!(bridge.owned_calls(), 1);
+    assert!(matches!(
+        owner
+            .drain(Instant::now() + Duration::from_millis(20))
+            .await,
+        Err(rustack_stepfunctions_core::ExecutionError::Deadline)
+    ));
+    assert!(!format!("{:?}", bridge.diagnostic()).contains("controlled cleanup"));
+}
+#[tokio::test]
+async fn test_should_preserve_root_admission_permit_after_manager_abort() {
+    let exec = Arc::new(TestExecutor {
+        calls: AtomicUsize::new(0),
+        entered: Arc::new(Semaphore::new(0)),
+        release: Arc::new(Semaphore::new(0)),
+        cleanup: Arc::new(Semaphore::new(0)),
+        fail_cleanup: false,
+    });
+    let (provider, _directory) = provider(exec.clone());
+    provider
+        .create_function(create(&zip(b"fixture", "v1"), &[]))
+        .await
+        .unwrap();
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::new(1, Duration::from_secs(1)).unwrap(),
+    )
+    .unwrap();
+    let mut owner = executions(port);
+    let mut handle = owner.start(driver(&direct(), &json!({}))).unwrap();
+    timeout(Duration::from_secs(5), exec.entered.acquire())
+        .await
+        .unwrap()
+        .unwrap()
+        .forget();
+    bridge.manager.as_ref().unwrap().abort();
+    assert!(
+        matches!(bridge.shutdown(deadline()).await,Err(e) if matches!(e.as_ref(),BridgeError::Worker(_)))
+    );
+    assert_eq!(bridge.owned_calls(), 1);
+    exec.cleanup.add_permits(1);
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Failed(_)
+    ));
+    owner.drain(deadline()).await.unwrap();
+    provider.quiesce(Duration::from_secs(10)).await.unwrap();
+    assert_eq!(bridge.owned_calls(), 1);
+}
+
+#[tokio::test]
+async fn test_should_keep_bridge_ready_after_settled_missing_function_diagnostic() {
+    let exec = executor();
+    let (provider, _directory) = provider(exec.clone());
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let mut owner = executions(port.clone());
+    let mut handle = owner.start(driver(&direct(), &json!({}))).unwrap();
+    let outcome = handle.wait(deadline()).await;
+    let settled = timeout(Duration::from_secs(5), async {
+        while bridge.owned_calls() != 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await;
+    let ready = port.is_ready();
+    let diagnostic = bridge.diagnostic();
+    clean(&mut owner, &mut bridge, &provider).await;
+    assert!(settled.is_ok());
+    assert!(
+        matches!(outcome.unwrap().outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Lambda.ResourceNotFoundException"))
+    );
+    assert!(diagnostic.is_some());
+    assert!(ready, "historical diagnostic is not owner failure");
+    assert_eq!(exec.calls.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn test_should_ignore_callback_success_body_but_preserve_function_failures_and_actual_metadata() {
+    use rustack_stepfunctions_core::CallbackInvocationMetadata;
+    use uuid::Uuid;
+
+    let id = Uuid::new_v4();
+    for body in [
+        Bytes::from_static(b"not-json"),
+        Bytes::from_static(&[0xff]),
+        Bytes::from(vec![b'x'; 262_145]),
+    ] {
+        let response = InvokeResponse::success(body, "42".into());
+        assert!(
+            mapping::response(&response, true, &id.to_string())
+                .unwrap()
+                .result
+                .is_err()
+        );
+        let (mapped, metadata) =
+            mapping::observed_response(&response, CallbackInvocationMetadata::new(id, "42"))
+                .unwrap();
+        let output = mapped.result.unwrap();
+        assert!(output.value().get("Payload").is_none());
+        assert_eq!(output.value()["ExecutedVersion"], "42");
+        assert_eq!(
+            output.value()["SdkResponseMetadata"]["RequestId"],
+            id.to_string()
+        );
+        assert_eq!(metadata.unwrap().request_id(), id);
+    }
+    let mut response = InvokeResponse::success(
+        Bytes::from_static(br#"{"errorType":"RealFailure"}"#),
+        "$LATEST".into(),
+    );
+    response.function_error = Some("Unhandled".into());
+    let (mapped, metadata) =
+        mapping::observed_response(&response, CallbackInvocationMetadata::new(id, "$LATEST"))
+            .unwrap();
+    assert!(matches!(mapped.result,Err(f) if f.details().error()==Some("RealFailure")));
+    assert!(metadata.is_none());
+    response.function_error = None;
+    let (mapped, metadata) =
+        mapping::observed_response(&response, CallbackInvocationMetadata::new(id, "alias"))
+            .unwrap();
+    assert!(matches!(mapped.result,Err(f) if f.details().error()==Some("Lambda.ServiceException")));
+    assert!(mapped.diagnostic.is_some());
+    assert!(metadata.is_none());
+}
+
+#[rstest::rstest]
+#[case(Value::Null, json!({}))]
+#[case(json!("null"), Value::Null)]
+#[case(json!("42"), json!(42))]
+#[case(json!("\"hello\""), json!("hello"))]
+#[case(json!("[1,true]"), json!([1,true]))]
+#[case(json!({"number":7}), json!({"number":7}))]
+#[tokio::test]
+async fn test_should_decode_optimized_serialized_payload_without_double_encoding(
+    #[case] payload: Value,
+    #[case] expected: Value,
+) {
+    let exec = executor();
+    let (provider, _directory) = provider(exec.clone());
+    provider
+        .create_function(create(&zip(b"fixture", "v1"), &[]))
+        .await
+        .unwrap();
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let mut owner = executions(port);
+    let def = definition(
+        "arn:aws:states:::lambda:invoke",
+        Some(json!({"FunctionName":"Worker","Payload":payload})),
+    );
+    let mut handle = owner.start(driver(&def, &json!({}))).unwrap();
+    let result = handle.wait(deadline()).await;
+    clean(&mut owner, &mut bridge, &provider).await;
+    assert_eq!(
+        output(result.unwrap().outcome().unwrap()).get("Payload"),
+        Some(&expected)
+    );
+    assert_eq!(exec.calls.load(Ordering::SeqCst), 1);
+}
+
+#[tokio::test]
+async fn test_should_report_missing_optimized_function_as_started_service_failure() {
+    let exec = executor();
+    let (provider, _directory) = provider(exec.clone());
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let mut owner = executions(port);
+    let def = definition(
+        "arn:aws:states:::lambda:invoke",
+        Some(json!({"FunctionName":"Worker"})),
+    );
+    let mut handle = owner.start(driver(&def, &json!({}))).unwrap();
+    let result = handle.wait(deadline()).await;
+    clean(&mut owner, &mut bridge, &provider).await;
+    let result = result.unwrap();
+    let page = result.history().page(1, 100, true).unwrap();
+    assert_eq!(
+        page.events()
+            .iter()
+            .map(|e| e.r#type.as_str())
+            .collect::<Vec<_>>(),
+        [
+            "ExecutionStarted",
+            "TaskStateEntered",
+            "TaskScheduled",
+            "TaskStarted",
+            "TaskFailed",
+            "ExecutionFailed"
+        ]
+    );
+    assert_eq!(exec.calls.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn test_should_compact_function_error_cause_without_changing_its_values() {
+    let mut response = InvokeResponse::success(
+        Bytes::from_static(br#"{ "errorType" : "Oops", "errorMessage" : "line\nvalue" }"#),
+        "$LATEST".into(),
+    );
+    response.function_error = Some("Unhandled".into());
+    let mapped = mapping::response(&response, false, "id").unwrap();
+    let failure = mapped.result.unwrap_err();
+    assert_eq!(
+        failure.details().cause(),
+        Some(r#"{"errorMessage":"line\nvalue","errorType":"Oops"}"#)
+    );
+}
+
+#[test]
+fn test_should_preserve_function_error_when_compact_numeric_cause_expands_past_payload_limit() {
+    let mut raw = String::from(r#"{"errorType":"Oops","items":["#);
+    raw.push_str(&vec!["1e9"; 40_000].join(","));
+    raw.push_str("]}");
+    assert!(raw.len() < 262_144);
+    let mut response = InvokeResponse::success(Bytes::from(raw), "$LATEST".into());
+    response.function_error = Some("Unhandled".into());
+    let failure = mapping::response(&response, false, "id")
+        .unwrap()
+        .result
+        .unwrap_err();
+    assert_eq!(failure.details().error(), Some("Oops"));
+    let cause = failure.details().cause().unwrap();
+    assert_eq!(cause.len(), 32_768);
+    assert!(cause.ends_with(" [truncated]"));
+    assert!(cause.starts_with(r#"{"errorType":"Oops","items":[1000000000.0"#));
+}
+
+#[derive(Debug)]
+struct FixedServiceId(Uuid);
+impl UuidSource for FixedServiceId {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        Ok(self.0)
+    }
+}
+#[derive(Debug)]
+struct FailedServiceId;
+impl UuidSource for FailedServiceId {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        Err(AslError::IntrinsicValue)
+    }
+}
+fn service_plan(function: &str, qualifier: Option<&str>) -> mapping::CallPlan {
+    mapping::CallPlan {
+        function: function.into(),
+        qualifier: qualifier.map(str::to_owned),
+        payload: Payload::parse(b"{}").unwrap(),
+        mode: mapping::ResponseMode::Optimized,
+        deadline: deadline(),
+    }
+}
+
+#[rstest::rstest]
+#[case("Worker", None, "$LATEST")]
+#[case("Worker", Some("alias"), "alias")]
+#[case(
+    "arn:aws-cn:lambda:cn-north-1:123456789012:function:Worker:2",
+    None,
+    "2"
+)]
+#[case(
+    "arn:aws-cn:lambda:cn-north-1:123456789012:function:Worker:alias",
+    Some("alias"),
+    "alias"
+)]
+#[case(
+    "arn:aws-cn:lambda:cn-north-1:123456789012:function:Worker",
+    None,
+    "$LATEST"
+)]
+fn test_should_render_missing_function_cause_from_validated_target_and_scope(
+    #[case] function: &str,
+    #[case] qualifier: Option<&str>,
+    #[case] expected: &str,
+) {
+    let scope = TenantScope::new("aws-cn", "cn-north-1", "123456789012").unwrap();
+    let target = mapping::ServiceTarget::new(&service_plan(function, qualifier), &scope);
+    let id = Uuid::parse_str("5a09f4e4-fbdc-49eb-9a92-9194264473cf").unwrap();
+    let mapped = mapping::service(
+        LambdaServiceError::FunctionNotFound {
+            name: "private-provider-name\n/host/path".into(),
+        },
+        &target,
+        &mut FixedServiceId(id),
+    )
+    .unwrap();
+    assert!(!format!("{target:?} {mapped:?}").contains("Worker"));
+    let failure = mapped.result.unwrap_err();
+    assert_eq!(
+        failure.details().error(),
+        Some("Lambda.ResourceNotFoundException")
+    );
+    assert_eq!(
+        failure.details().cause(),
+        Some(
+            format!(
+                "Function not found: \
+                 arn:aws-cn:lambda:cn-north-1:123456789012:function:Worker:{expected} (Service: \
+                 AWSLambda; Status Code: 404; Error Code: ResourceNotFoundException; Request ID: \
+                 {id}; Proxy: null)"
+            )
+            .as_str()
+        )
+    );
+}
+
+#[test]
+fn test_should_preserve_missing_version_alias_and_unrelated_service_error_categories() {
+    let target = mapping::ServiceTarget::new(
+        &service_plan("Worker", Some("missing")),
+        &TenantScope::default(),
+    );
+    for error in [
+        LambdaServiceError::VersionNotFound {
+            function_name: "private".into(),
+            version: "123".into(),
+        },
+        LambdaServiceError::AliasNotFound {
+            function_name: "private".into(),
+            alias: "private".into(),
+        },
+    ] {
+        let failure = mapping::service(error, &target, &mut SystemUuidSource::default())
+            .unwrap()
+            .result
+            .unwrap_err();
+        assert!(failure.details().cause().unwrap().starts_with(
+            "Function not found: arn:aws:lambda:us-east-1:000000000000:function:Worker:missing "
+        ));
+    }
+    let mapped = mapping::service(
+        LambdaServiceError::TooManyRequests,
+        &target,
+        &mut FailedServiceId,
+    )
+    .unwrap();
+    assert!(
+        matches!(mapped.result,Err(f) if f.details().error()==Some("Lambda.TooManyRequestsException") && f.details().cause()==Some("Lambda invocation admission failed"))
+    );
+}
+
+#[test]
+fn test_should_reject_invalid_service_targets_and_failed_or_invalid_identity_sources() {
+    let id = Uuid::parse_str("5a09f4e4-fbdc-49eb-9a92-9194264473cf").unwrap();
+    for (function, qualifier) in [
+        (
+            "arn:aws:lambda:us-west-2:000000000000:function:Worker",
+            None,
+        ),
+        ("Worker", Some("bad\nqualifier")),
+        (
+            "arn:aws:lambda:us-east-1:000000000000:function:Worker:1",
+            Some("2"),
+        ),
+    ] {
+        let target = mapping::ServiceTarget::new(
+            &service_plan(function, qualifier),
+            &TenantScope::default(),
+        );
+        assert!(
+            mapping::service(
+                LambdaServiceError::FunctionNotFound {
+                    name: "ignored".into()
+                },
+                &target,
+                &mut FixedServiceId(id)
+            )
+            .is_err()
+        );
+    }
+    let target =
+        mapping::ServiceTarget::new(&service_plan("Worker", None), &TenantScope::default());
+    assert!(
+        mapping::service(
+            LambdaServiceError::FunctionNotFound {
+                name: "ignored".into()
+            },
+            &target,
+            &mut FailedServiceId
+        )
+        .is_err()
+    );
+    for id in [
+        Uuid::nil(),
+        Uuid::from_u128(0x0000_0000_0000_4000_c000_0000_0000_0000),
+    ] {
+        assert!(
+            mapping::service(
+                LambdaServiceError::FunctionNotFound {
+                    name: "ignored".into()
+                },
+                &target,
+                &mut FixedServiceId(id)
+            )
+            .is_err()
+        );
+    }
+    let mut causes = BTreeSet::new();
+    for _ in 0..2 {
+        let failure = mapping::service(
+            LambdaServiceError::FunctionNotFound {
+                name: "ignored".into(),
+            },
+            &target,
+            &mut SystemUuidSource::default(),
+        )
+        .unwrap()
+        .result
+        .unwrap_err();
+        assert!(causes.insert(failure.details().cause().unwrap().to_owned()));
+    }
+}
diff --git a/apps/rustack/src/stepfunctions_bridge/tests/native.rs b/apps/rustack/src/stepfunctions_bridge/tests/native.rs
new file mode 100644
index 00000000..284d3276
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge/tests/native.rs
@@ -0,0 +1,1287 @@
+//! Actual host process → Runtime API → ASL fixtures. Built by the Makefile gate.
+
+use std::{
+    collections::BTreeSet,
+    env,
+    error::Error,
+    path::Path,
+    process::{self, ExitStatus, Stdio},
+    time::{Duration, SystemTime},
+};
+
+use http::{Request as HttpRequest, StatusCode};
+use http_body_util::{BodyExt, Full};
+use rustack_lambda_model::input::{
+    CreateAliasInput, UpdateAliasInput, UpdateFunctionCodeInput, UpdateFunctionConfigurationInput,
+};
+use rustack_stepfunctions_core::{
+    ChildPattern, ChildStartParameters, ExecutionSnapshot, PreparedDefinition, Registry,
+    RegistryCommand, RegistryError, RegistryLimits, RegistryResult, RegistrySupervisor,
+    SnapshotLimits, StateMachineArn, StateSupport, Tags,
+};
+use rustack_stepfunctions_http::{RequestScope, StepFunctionsHttpConfig, StepFunctionsHttpService};
+use tokio::{
+    fs,
+    io::AsyncReadExt,
+    process::{Child, Command},
+    time::{error::Elapsed, sleep, timeout, timeout_at},
+};
+
+use super::*;
+use crate::stepfunctions_api::{ApiLimits, StepFunctionsApi};
+
+#[derive(Debug)]
+struct NativeFixture {
+    provider: Arc<RustackLambda>,
+    owner: ExecutionSupervisor,
+    bridge: LambdaBridgeSupervisor,
+    port: Arc<StepFunctionsLambdaBridge>,
+    directory: Option<TempDir>,
+    bootstrap: Bytes,
+}
+impl NativeFixture {
+    async fn new(env: &[(&str, &str)], publish: bool) -> Self {
+        let path = env::var_os("RUSTACK_WORKFLOWS_BOOTSTRAP")
+            .expect("run make test-stepfunctions-bridge-native");
+        let bootstrap = Bytes::from(fs::read(path).await.unwrap());
+        let directory = tempfile::tempdir().unwrap();
+        let config = LambdaConfig {
+            executor: ExecutorBackend::Native,
+            init_timeout: Duration::from_secs(5),
+            max_warm_instances: 2,
+            ..LambdaConfig::default()
+        };
+        let provider = Arc::new(RustackLambda::with_store(
+            FunctionStore::new(directory.path()),
+            config,
+        ));
+        let bytes = bootstrap.clone();
+        let code = tokio::task::spawn_blocking(move || zip(&bytes, "native-v1"))
+            .await
+            .unwrap();
+        let marker = directory.path().join("invocation.json");
+        let mut variables = env.to_vec();
+        variables.push(("INVOCATION_FILE", marker.to_str().unwrap()));
+        let mut input = create(&code, &variables);
+        input.publish = Some(publish);
+        provider.create_function(input).await.unwrap();
+        let (port, bridge) = StepFunctionsLambdaBridge::new(
+            provider.clone(),
+            TenantScope::default(),
+            BridgeLimits::default(),
+        )
+        .unwrap();
+        Self {
+            provider,
+            owner: executions(port.clone()),
+            port,
+            bridge,
+            directory: Some(directory),
+            bootstrap,
+        }
+    }
+    async fn ready_after_calls(&self) -> bool {
+        timeout_at(deadline(), async {
+            while self.bridge.owned_calls() != 0 {
+                sleep(Duration::from_millis(1)).await;
+            }
+            self.port.is_ready()
+        })
+        .await
+        .unwrap_or(false)
+    }
+    async fn cleanup(&mut self) {
+        self.cleanup_at(Instant::now() + Duration::from_secs(15))
+            .await;
+    }
+    async fn cleanup_at(&mut self, absolute: Instant) {
+        let workflow = self.owner.drain(absolute).await;
+        let bridge = self.bridge.shutdown(absolute).await;
+        let provider = self
+            .provider
+            .quiesce(absolute.saturating_duration_since(Instant::now()))
+            .await;
+        let processes = timeout_at(absolute, self.provider.executor().shutdown()).await;
+        if workflow.is_err()
+            || bridge.is_err()
+            || provider.is_err()
+            || !matches!(&processes, Ok(Ok(())))
+        {
+            // Unproven process retirement must not remove its still-owned files.
+            if let Some(directory) = self.directory.take() {
+                let _retained = directory.keep();
+            }
+        }
+        assert!(workflow.is_ok(), "workflow cleanup: {workflow:?}");
+        assert!(bridge.is_ok(), "bridge cleanup: {bridge:?}");
+        assert!(provider.is_ok(), "provider cleanup: {provider:?}");
+        assert!(
+            matches!(processes, Ok(Ok(()))),
+            "native process cleanup: {processes:?}"
+        );
+    }
+}
+fn workflow(optimized: bool) -> Value {
+    let parameters = json!({"n.$":"$.n","retryCount.$":"$$.State.RetryCount"});
+    if optimized {
+        definition(
+            "arn:aws:states:::lambda:invoke",
+            Some(json!({"FunctionName":"Worker","Payload":parameters})),
+        )
+    } else {
+        definition(
+            "arn:aws:lambda:us-east-1:000000000000:function:Worker",
+            Some(parameters),
+        )
+    }
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_execute_computation_and_return_actual_invocation_metadata() {
+    for optimized in [false, true] {
+        let mut fixture = NativeFixture::new(&[("WORKFLOW_MODE", "1")], false).await;
+        let mut handle = fixture
+            .owner
+            .start(driver(&workflow(optimized), &json!({"n":21})))
+            .unwrap();
+        let result = handle.wait(deadline()).await;
+        fixture.cleanup().await;
+        let view = result.unwrap();
+        let response = output(view.outcome().unwrap());
+        let body = if optimized {
+            response.get("Payload").unwrap()
+        } else {
+            response
+        };
+        assert_eq!(body.get("computed"), Some(&json!(42)));
+        assert_eq!(body.get("codeMarker"), Some(&json!("native-v1")));
+        assert_ne!(
+            body.get("pid").and_then(Value::as_u64).unwrap(),
+            u64::from(process::id())
+        );
+        let request_id = body.get("request_id").and_then(Value::as_str).unwrap();
+        assert_eq!(request_id.len(), 36);
+        if optimized {
+            assert_eq!(
+                response
+                    .pointer("/SdkResponseMetadata/RequestId")
+                    .and_then(Value::as_str),
+                Some(request_id)
+            );
+            assert_eq!(response.get("StatusCode"), Some(&json!(200)));
+        }
+    }
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_retry_function_error_and_recalculate_parameters() {
+    let mut fixture = NativeFixture::new(
+        &[("WORKFLOW_MODE", "1"), ("WORKFLOW_FAIL_ONCE", "1")],
+        false,
+    )
+    .await;
+    let mut definition = workflow(false);
+    definition["States"]["Call"]["Retry"] =
+        json!([{"ErrorEquals":["WorkflowTransient"],"MaxAttempts":1,"IntervalSeconds":1}]);
+    let mut handle = fixture
+        .owner
+        .start(driver(&definition, &json!({"n":6})))
+        .unwrap();
+    let result = handle.wait(deadline()).await;
+    fixture.cleanup().await;
+    let view = result.unwrap();
+    let response = output(view.outcome().unwrap());
+    assert_eq!(response.get("computed"), Some(&json!(12)));
+    assert_eq!(response.get("retryCount"), Some(&json!(1)));
+    let history = view.history().page(1, 100, true).unwrap();
+    let kinds = history
+        .events()
+        .iter()
+        .map(|e| e.r#type.as_str())
+        .collect::<Vec<_>>();
+    assert_eq!(
+        kinds.iter().filter(|&&k| k == "TaskStateEntered").count(),
+        1
+    );
+    assert_eq!(
+        kinds
+            .iter()
+            .filter(|&&k| k == "LambdaFunctionStarted")
+            .count(),
+        2
+    );
+    assert_eq!(
+        kinds
+            .iter()
+            .filter(|&&k| k == "LambdaFunctionFailed")
+            .count(),
+        1
+    );
+    assert_eq!(kinds.last().copied(), Some("ExecutionSucceeded"));
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_resolve_alias_again_on_retry_and_capture_new_version() {
+    let mut fixture =
+        NativeFixture::new(&[("WORKFLOW_MODE", "1"), ("WORKFLOW_FAIL_ONCE", "1")], true).await;
+    let bytes = fixture.bootstrap.clone();
+    let code = tokio::task::spawn_blocking(move || zip(&bytes, "native-v2"))
+        .await
+        .unwrap();
+    fixture
+        .provider
+        .update_function_code(
+            "Worker",
+            UpdateFunctionCodeInput {
+                zip_file: Some(STANDARD.encode(code)),
+                publish: Some(true),
+                ..UpdateFunctionCodeInput::default()
+            },
+        )
+        .await
+        .unwrap();
+    fixture
+        .provider
+        .create_alias(
+            "Worker",
+            CreateAliasInput {
+                name: "live".into(),
+                function_version: "1".into(),
+                ..CreateAliasInput::default()
+            },
+        )
+        .unwrap();
+    let mut definition = workflow(true);
+    definition["States"]["Call"]["Parameters"]["Qualifier"] = json!("live");
+    definition["States"]["Call"]["Retry"] =
+        json!([{"ErrorEquals":["WorkflowTransient"],"MaxAttempts":1,"IntervalSeconds":1}]);
+    let mut handle = fixture
+        .owner
+        .start(driver(&definition, &json!({"n":5})))
+        .unwrap();
+    let failed = timeout_at(deadline(), async {
+        loop {
+            let view = handle.snapshot();
+            let history = view.history().page(1, 100, true).unwrap();
+            if history
+                .events()
+                .iter()
+                .any(|e| e.r#type.as_str() == "TaskFailed")
+            {
+                break;
+            }
+            sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await;
+    let updated = fixture.provider.update_alias(
+        "Worker",
+        "live",
+        &UpdateAliasInput {
+            function_version: Some("2".into()),
+            ..UpdateAliasInput::default()
+        },
+    );
+    let result = handle.wait(deadline()).await;
+    fixture.cleanup().await;
+    failed.unwrap();
+    updated.unwrap();
+    let view = result.unwrap();
+    let response = output(view.outcome().unwrap());
+    assert_eq!(response.get("ExecutedVersion"), Some(&json!("2")));
+    assert_eq!(
+        response.pointer("/Payload/codeMarker"),
+        Some(&json!("native-v2"))
+    );
+    assert_eq!(response.pointer("/Payload/computed"), Some(&json!(10)));
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_catch_actual_function_error() {
+    let mut fixture = NativeFixture::new(&[("FAIL_MODE", "panic")], false).await;
+    let mut definition = direct();
+    definition["States"]["Call"]["Catch"] =
+        json!([{"ErrorEquals":["TestError"],"ResultPath":"$.failure","Next":"Recovered"}]);
+    definition["States"]["Recovered"] = json!({"Type":"Succeed"});
+    let mut handle = fixture
+        .owner
+        .start(driver(&definition, &json!({"keep":7})))
+        .unwrap();
+    let result = handle.wait(deadline()).await;
+    fixture.cleanup().await;
+    let view = result.unwrap();
+    let response = output(view.outcome().unwrap());
+    assert_eq!(response.get("keep"), Some(&json!(7)));
+    assert_eq!(
+        response.pointer("/failure/Error"),
+        Some(&json!("TestError"))
+    );
+    assert!(
+        response
+            .pointer("/failure/Cause")
+            .and_then(Value::as_str)
+            .unwrap()
+            .contains("boom")
+    );
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_cancel_actual_process_on_stop_and_task_timeout() {
+    for stop in [false, true] {
+        let mut fixture = NativeFixture::new(&[("SLEEP_SECS", "5")], false).await;
+        let mut definition = direct();
+        definition["States"]["Call"]["TimeoutSeconds"] = json!(1);
+        let mut handle = fixture
+            .owner
+            .start(driver(&definition, &json!({})))
+            .unwrap();
+        let marker = fixture
+            .directory
+            .as_ref()
+            .unwrap()
+            .path()
+            .join("invocation.json");
+        let started = timeout_at(deadline(), async {
+            loop {
+                match fs::read_to_string(&marker).await {
+                    Ok(body) => match serde_json::from_str::<Value>(&body) {
+                        Ok(marker) => break Ok(marker),
+                        Err(_) => sleep(Duration::from_millis(5)).await,
+                    },
+                    Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                        sleep(Duration::from_millis(5)).await;
+                    }
+                    Err(error) => break Err(error),
+                }
+            }
+        })
+        .await;
+        let result = if stop {
+            handle
+                .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+                .await
+        } else {
+            handle.wait(deadline()).await
+        };
+        let ready = fixture.ready_after_calls().await;
+        fixture.cleanup().await;
+        assert!(ready, "settled Task timeout/Stop poisoned bridge readiness");
+        let marker = started.unwrap().unwrap();
+        let pid = marker.get("pid").and_then(Value::as_u64).unwrap();
+        assert!(pid > 1 && pid != u64::from(process::id()));
+        assert_eq!(
+            marker
+                .get("request_id")
+                .and_then(Value::as_str)
+                .unwrap()
+                .len(),
+            36
+        );
+        verify_absent_probe(pid).await.unwrap();
+        let view = result.unwrap();
+        if stop {
+            assert!(matches!(
+                view.outcome().unwrap().as_ref(),
+                ExecutionOutcome::Aborted(_)
+            ));
+        } else {
+            assert!(
+                matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Timeout"))
+            );
+        }
+        assert_eq!(
+            handle.snapshot().cleanup(),
+            rustack_stepfunctions_core::CleanupState::Clean
+        );
+    }
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_preserve_optimized_payload_json_types_and_default() {
+    let mut fixture = NativeFixture::new(&[], false).await;
+    let mut results = Vec::new();
+    for (payload, expected) in [
+        (None, json!({})),
+        (Some(Value::Null), json!({})),
+        (Some(json!(r#""json-string""#)), json!("json-string")),
+        (Some(json!([1, 2])), json!([1, 2])),
+        (Some(json!("null")), Value::Null),
+    ] {
+        let mut params = json!({"FunctionName":"Worker"});
+        if let Some(payload) = &payload {
+            params["Payload"] = payload.clone();
+        }
+        let definition = definition("arn:aws:states:::lambda:invoke", Some(params));
+        let result = match fixture
+            .owner
+            .start(driver(&definition, &json!({"notForwarded":true})))
+        {
+            Ok(mut handle) => handle.wait(deadline()).await,
+            Err(error) => Err(error),
+        };
+        let failed = result.is_err();
+        results.push((expected, result));
+        if failed {
+            break;
+        }
+    }
+    fixture.cleanup().await;
+    assert_eq!(results.len(), 5);
+    for (expected, result) in results {
+        let view = result.unwrap();
+        assert_eq!(
+            output(view.outcome().unwrap()).pointer("/Payload/echo"),
+            Some(&expected)
+        );
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_preserve_function_timeout_class_for_asl_catch() {
+    let mut fixture = NativeFixture::new(&[("SLEEP_SECS", "5")], false).await;
+    fixture
+        .provider
+        .update_function_configuration(
+            "Worker",
+            &UpdateFunctionConfigurationInput {
+                timeout: Some(1),
+                ..UpdateFunctionConfigurationInput::default()
+            },
+        )
+        .unwrap();
+    let mut definition = direct();
+    definition["States"]["Call"]["Catch"] =
+        json!([{"ErrorEquals":["Sandbox.Timedout"],"Next":"Recovered"}]);
+    definition["States"]["Recovered"] = json!({"Type":"Succeed"});
+    let mut handle = fixture
+        .owner
+        .start(driver(&definition, &json!({})))
+        .unwrap();
+    let result = handle.wait(deadline()).await;
+    let ready = fixture.ready_after_calls().await;
+    fixture.cleanup().await;
+    assert!(ready, "settled function timeout poisoned bridge readiness");
+    let view = result.unwrap();
+    assert_eq!(
+        output(view.outcome().unwrap()).get("Error"),
+        Some(&json!("Sandbox.Timedout"))
+    );
+}
+
+async fn run_registry_case(
+    registry: &Registry,
+) -> Result<(ExecutionSnapshot, ExecutionSnapshot, ExecutionSnapshot), Box<dyn Error>> {
+    let compiler = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda);
+    let prepared = PreparedDefinition::new(
+        compiler
+            .compile(&serde_json::to_vec(&workflow(true))?)?
+            .machine()
+            .clone(),
+    );
+    let mut create = registry.submit(RegistryCommand::Create(
+        "NativeWorkflow".parse()?,
+        prepared,
+        "arn:aws:iam::000000000000:role/Workflow".parse()?,
+        Tags::default(),
+    ))?;
+    let RegistryResult::Machine(machine) = create.wait(deadline()).await? else {
+        return Err(RegistryError::Unavailable.into());
+    };
+    let mut start = registry.submit(RegistryCommand::Start(
+        machine.arn().clone(),
+        Some("first".parse()?),
+        Payload::parse(br#"{"n":21}"#)?,
+        None,
+    ))?;
+    let RegistryResult::Execution(first) = start.wait(deadline()).await? else {
+        return Err(RegistryError::Unavailable.into());
+    };
+    first.handle().wait(deadline()).await?;
+    let mut updated = workflow(true);
+    updated["States"]["Call"]["Parameters"]["Payload"] = json!({"n":22,"retryCount":0});
+    let prepared = PreparedDefinition::new(
+        compiler
+            .compile(&serde_json::to_vec(&updated)?)?
+            .machine()
+            .clone(),
+    );
+    let mut update = registry.submit(RegistryCommand::Update(
+        machine.arn().clone(),
+        Some(prepared),
+        None,
+    ))?;
+    update.wait(deadline()).await?;
+    let mut start = registry.submit(RegistryCommand::Start(
+        machine.arn().clone(),
+        Some("second".parse()?),
+        Payload::parse(br#"{"n":21}"#)?,
+        None,
+    ))?;
+    let RegistryResult::Execution(second) = start.wait(deadline()).await? else {
+        return Err(RegistryError::Unavailable.into());
+    };
+    second.handle().wait(deadline()).await?;
+    let mut delete = registry.submit(RegistryCommand::Delete(machine.arn().clone()))?;
+    delete.wait(deadline()).await?;
+    let mut read = registry.submit(RegistryCommand::Execution(first.arn().clone()))?;
+    let RegistryResult::Execution(first_final) = read.wait(deadline()).await? else {
+        return Err(RegistryError::Unavailable.into());
+    };
+    let mut read = registry.submit(RegistryCommand::Execution(second.arn().clone()))?;
+    let RegistryResult::Execution(second_final) = read.wait(deadline()).await? else {
+        return Err(RegistryError::Unavailable.into());
+    };
+    Ok((first, first_final, second_final))
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_execute_captured_registry_revisions_and_read_after_machine_deletion() {
+    let mut fixture = NativeFixture::new(&[("WORKFLOW_MODE", "1")], false).await;
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        fixture.provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let (registry, mut owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        executions(port),
+        ExecutionLimits::default(),
+    )
+    .unwrap();
+    let result = run_registry_case(&registry).await;
+    let absolute = Instant::now() + Duration::from_secs(15);
+    let workflow = owner.shutdown(absolute).await;
+    let calls = bridge.shutdown(absolute).await;
+    if workflow.is_err() || calls.is_err() {
+        if let Some(directory) = fixture.directory.take() {
+            let _retained = directory.keep();
+        }
+    }
+    fixture.cleanup().await;
+    assert!(workflow.is_ok(), "registry cleanup: {workflow:?}");
+    assert!(calls.is_ok(), "bridge cleanup: {calls:?}");
+    let (first, captured, second) = result.unwrap();
+    let archived =
+        serde_json::to_value(registry.export_snapshot(SnapshotLimits::default()).unwrap()).unwrap();
+    assert_eq!(archived.get("machines"), Some(&json!([])));
+    assert_eq!(archived.get("lambdaSupport"), Some(&json!(true)));
+    assert_eq!(
+        archived
+            .get("revisions")
+            .and_then(Value::as_array)
+            .map(Vec::len),
+        Some(2)
+    );
+    for execution in [&captured, &second] {
+        let saved = archived
+            .get("executions")
+            .and_then(Value::as_array)
+            .unwrap()
+            .iter()
+            .find(|row| row.get("arn").and_then(Value::as_str) == Some(execution.arn().as_str()))
+            .unwrap();
+        let saved_output: Value = serde_json::from_str(
+            saved
+                .pointer("/outcome/output")
+                .and_then(Value::as_str)
+                .unwrap(),
+        )
+        .unwrap();
+        assert_eq!(&saved_output, output(execution.view().outcome().unwrap()));
+        let history = saved.get("history").and_then(Value::as_array).unwrap();
+        assert_eq!(
+            history.len(),
+            usize::try_from(execution.view().history().len()).unwrap()
+        );
+        for (row, event) in history.iter().zip(
+            execution
+                .view()
+                .history()
+                .page(1, 100, true)
+                .unwrap()
+                .events(),
+        ) {
+            assert_eq!(
+                row.get("eventJson"),
+                Some(&json!(serde_json::to_string(event).unwrap()))
+            );
+            assert_eq!(
+                row.get("timestamp"),
+                Some(&serde_json::to_value(event.timestamp).unwrap())
+            );
+        }
+    }
+    assert_eq!(first.revision().id(), captured.revision().id());
+    assert_ne!(captured.revision().id(), second.revision().id());
+    let first_result = output(captured.view().outcome().unwrap());
+    let second_result = output(second.view().outcome().unwrap());
+    assert_eq!(first_result.pointer("/Payload/computed"), Some(&json!(42)));
+    assert_eq!(second_result.pointer("/Payload/computed"), Some(&json!(44)));
+    for response in [first_result, second_result] {
+        let actual = response
+            .pointer("/Payload/request_id")
+            .and_then(Value::as_str)
+            .unwrap();
+        assert_eq!(actual.len(), 36);
+        assert_eq!(
+            response
+                .pointer("/SdkResponseMetadata/RequestId")
+                .and_then(Value::as_str),
+            Some(actual)
+        );
+    }
+    assert_ne!(
+        first_result.pointer("/Payload/request_id"),
+        second_result.pointer("/Payload/request_id")
+    );
+}
+
+async fn api_json(
+    service: &StepFunctionsHttpService,
+    action: &str,
+    input: Value,
+) -> Result<Value, Box<dyn Error>> {
+    let request = HttpRequest::builder()
+        .method("POST")
+        .uri("/")
+        .header("content-type", "application/x-amz-json-1.0")
+        .header("x-amz-target", format!("AWSStepFunctions.{action}"))
+        .body(Full::new(Bytes::from(serde_json::to_vec(&input)?)))?;
+    let response = service.handle(request).await;
+    let status = response.status();
+    let body = response.into_body().collect().await?.to_bytes();
+    let value = serde_json::from_slice(&body)?;
+    if status != StatusCode::OK {
+        return Err(RegistryError::Unavailable.into());
+    }
+    Ok(value)
+}
+async fn run_http_registry_case(
+    service: &StepFunctionsHttpService,
+) -> Result<(Value, Value, Value), Box<dyn Error>> {
+    let created=api_json(service,"CreateStateMachine",json!({"name":"HttpNative","roleArn":"arn:aws:iam::000000000000:role/Workflow","definition":workflow(true).to_string()})).await?;
+    let started=api_json(service,"StartExecution",json!({"stateMachineArn":created["stateMachineArn"],"name":"computed","input":"{\"n\":21}"})).await?;
+    let absolute = deadline();
+    let description = loop {
+        let description = api_json(
+            service,
+            "DescribeExecution",
+            json!({"executionArn":started["executionArn"]}),
+        )
+        .await?;
+        if description["status"] != "RUNNING" {
+            break description;
+        }
+        if Instant::now() >= absolute {
+            return Err(RegistryError::Deadline.into());
+        }
+        sleep(Duration::from_millis(10)).await;
+    };
+    let history=api_json(service,"GetExecutionHistory",json!({"executionArn":started["executionArn"],"reverseOrder":true,"includeExecutionData":false,"maxResults":1})).await?;
+    api_json(
+        service,
+        "DeleteStateMachine",
+        json!({"stateMachineArn":created["stateMachineArn"]}),
+    )
+    .await?;
+    let next=api_json(service,"GetExecutionHistory",json!({"executionArn":started["executionArn"],"reverseOrder":true,"includeExecutionData":false,"maxResults":1,"nextToken":history["nextToken"]})).await?;
+    Ok((description, history, next))
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_execute_real_lambda_through_typed_http_api_and_paginated_history() {
+    let mut fixture = NativeFixture::new(&[("WORKFLOW_MODE", "1")], false).await;
+    let (port, mut bridge) = StepFunctionsLambdaBridge::new(
+        fixture.provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let (registry, mut owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        executions(port),
+        ExecutionLimits::default(),
+    )
+    .unwrap();
+    let (handler, mut api) = StepFunctionsApi::new(
+        TenantScope::default(),
+        TaskSupport::Lambda,
+        registry,
+        ApiLimits::default(),
+    )
+    .unwrap();
+    let config = StepFunctionsHttpConfig::new(
+        RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into()).unwrap(),
+        true,
+        None,
+    )
+    .unwrap();
+    let service = StepFunctionsHttpService::new(handler, config);
+    let result = run_http_registry_case(&service).await;
+    let absolute = Instant::now() + Duration::from_secs(15);
+    let requests = api.shutdown(absolute).await;
+    let workflows = owner.shutdown(absolute).await;
+    let calls = bridge.shutdown(absolute).await;
+    if requests.is_err() || workflows.is_err() || calls.is_err() {
+        if let Some(directory) = fixture.directory.take() {
+            let _retained = directory.keep();
+        }
+    }
+    fixture.cleanup_at(absolute).await;
+    assert!(requests.is_ok(), "API cleanup: {requests:?}");
+    assert!(workflows.is_ok(), "registry cleanup: {workflows:?}");
+    assert!(calls.is_ok(), "bridge cleanup: {calls:?}");
+    let (description, history, next) = result.unwrap();
+    assert_eq!(description["status"], "SUCCEEDED");
+    let result: Value = serde_json::from_str(description["output"].as_str().unwrap()).unwrap();
+    assert_eq!(result["Payload"]["computed"], 42);
+    assert_eq!(
+        result["Payload"]["request_id"],
+        result["SdkResponseMetadata"]["RequestId"]
+    );
+    assert_eq!(result["Payload"]["request_id"].as_str().unwrap().len(), 36);
+    assert_eq!(history["events"][0]["type"], "ExecutionSucceeded");
+    assert!(
+        history["events"][0]["executionSucceededEventDetails"]
+            .get("output")
+            .is_none()
+    );
+    assert!(
+        next["events"][0]["id"].as_i64().unwrap() < history["events"][0]["id"].as_i64().unwrap()
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_execute_overlapping_parallel_functions_through_structured_owner()
+-> Result<(), Box<dyn Error>> {
+    let gate = tempfile::tempdir()?;
+    let release = gate.path().join("release");
+    let release_text = release.to_str().ok_or("invalid gate path")?;
+    let consumed = gate.path().join("consumed");
+    fs::create_dir(&consumed).await?;
+    let consumed_text = consumed.to_str().ok_or("invalid consumed marker path")?;
+    let mut fixture = NativeFixture::new(
+        &[
+            ("WORKFLOW_MODE", "1"),
+            ("WORKFLOW_GATE_FILE", release_text),
+            ("WORKFLOW_INVOCATION_DIR", consumed_text),
+        ],
+        false,
+    )
+    .await;
+    let result = async {
+        let definition = json!({
+            "StartAt": "Parallel",
+            "States": {"Parallel": {
+                "Type": "Parallel",
+                "Branches": [workflow(false), workflow(false)],
+                "End": true
+            }}
+        });
+        let compiled = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+            .with_state_support(StateSupport::Structured)
+            .compile(&serde_json::to_vec(&definition)?)?;
+        let input = Payload::from_value(&json!({"n": 21}))?;
+        let driver = ExecutionDriver::for_structured_owner(
+            compiled.machine().clone(),
+            input.clone(),
+            EvaluationContext::from(&input),
+            ClockSample::new(Instant::now().into_std(), SystemTime::now().into()),
+            ExecutionLimits::default(),
+        )?;
+        let mut handle = fixture.owner.start_structured(driver)?;
+        let markers = timeout_at(deadline(), consumed_invocations(&consumed)).await??;
+        fs::write(&release, b"release").await?;
+        let view = handle.wait(deadline()).await?;
+        Ok::<_, Box<dyn Error>>((view, markers))
+    }
+    .await;
+    let released = fs::write(&release, b"release").await;
+    fixture.cleanup().await;
+    released?;
+    let (view, markers) = result?;
+    let values = output(view.outcome().ok_or("outcome")?)
+        .as_array()
+        .ok_or("expected ordered array")?;
+    assert_eq!(values.len(), 2);
+    let returned: BTreeSet<_> = values
+        .iter()
+        .map(|value| {
+            Ok((
+                value
+                    .get("pid")
+                    .and_then(Value::as_u64)
+                    .ok_or("missing PID")?,
+                value
+                    .get("request_id")
+                    .and_then(Value::as_str)
+                    .ok_or("missing request ID")?
+                    .to_owned(),
+            ))
+        })
+        .collect::<Result<_, Box<dyn Error>>>()?;
+    assert_eq!(returned, markers);
+    for value in values {
+        assert_eq!(value.get("computed"), Some(&json!(42)));
+        assert_eq!(value.get("codeMarker"), Some(&json!("native-v1")));
+        assert_ne!(
+            value.get("pid").and_then(Value::as_u64),
+            Some(u64::from(process::id()))
+        );
+    }
+    assert_ne!(
+        values.first().and_then(|v| v.get("request_id")),
+        values.get(1).and_then(|v| v.get("request_id"))
+    );
+    Ok(())
+}
+
+async fn consumed_invocations(directory: &Path) -> Result<BTreeSet<(u64, String)>, Box<dyn Error>> {
+    loop {
+        let mut entries = fs::read_dir(directory).await?;
+        let mut markers = BTreeSet::new();
+        let mut count = 0;
+        while let Some(entry) = entries.next_entry().await? {
+            if entry
+                .path()
+                .extension()
+                .is_none_or(|extension| extension != "json")
+            {
+                continue;
+            }
+            count += 1;
+            if count > 2 || entry.metadata().await?.len() > 1024 {
+                return Err("unexpected consumed marker count or size".into());
+            }
+            let marker: Value = serde_json::from_slice(&fs::read(entry.path()).await?)?;
+            let pid = marker
+                .get("pid")
+                .and_then(Value::as_u64)
+                .filter(|pid| *pid > 0)
+                .ok_or("invalid consumed PID")?;
+            let request_id = marker
+                .get("request_id")
+                .and_then(Value::as_str)
+                .filter(|id| id.len() == 36)
+                .ok_or("invalid consumed request ID")?;
+            markers.insert((pid, request_id.to_owned()));
+        }
+        if markers.len() == 2 {
+            let pids: BTreeSet<_> = markers.iter().map(|(pid, _)| *pid).collect();
+            let requests: BTreeSet<_> = markers.iter().map(|(_, request)| request).collect();
+            if pids.len() != 2 || requests.len() != 2 {
+                return Err("handlers did not consume distinct concurrent invocations".into());
+            }
+            return Ok(markers);
+        }
+        sleep(Duration::from_millis(1)).await;
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_execute_and_cancel_real_child_through_atomic_registry_port()
+-> Result<(), Box<dyn Error>> {
+    for cancel in [false, true] {
+        let directory = tempfile::tempdir()?;
+        let release = directory.path().join("release");
+        let mut fixture = NativeFixture::new(
+            &[
+                ("WORKFLOW_MODE", "1"),
+                ("WORKFLOW_GATE_FILE", release.to_str().ok_or("gate path")?),
+            ],
+            false,
+        )
+        .await;
+        let runtime = ExecutionSupervisor::new(
+            RuntimeLimits::new(8, 1, 4)?,
+            HistoryLimits::default(),
+            256 * 1024 * 1024,
+            Some(fixture.port.clone()),
+        )?;
+        let (registry, mut owner) = Registry::new(
+            TenantScope::default(),
+            RegistryLimits::default(),
+            runtime,
+            ExecutionLimits::default(),
+        )?;
+        let result = match timeout(
+            Duration::from_secs(30),
+            run_native_child_port(&fixture, &registry, &release, cancel),
+        )
+        .await
+        {
+            Ok(Ok(Some(pid))) => verify_absent_probe(pid).await,
+            Ok(Ok(None)) => Ok(()),
+            Ok(Err(error)) => Err(error),
+            Err(error) => Err(Box::<dyn Error>::from(error)),
+        };
+        let cleanup = owner
+            .shutdown(Instant::now() + Duration::from_secs(15))
+            .await;
+        let released = fs::write(&release, b"release").await;
+        fixture.cleanup().await;
+        cleanup?;
+        released?;
+        result?;
+    }
+    Ok(())
+}
+async fn child_port_machine(
+    registry: &Registry,
+    name: &str,
+    definition: &Value,
+) -> Result<StateMachineArn, Box<dyn Error>> {
+    let compiled = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(&serde_json::to_vec(definition)?)?;
+    let result = registry
+        .submit(RegistryCommand::Create(
+            name.parse()?,
+            PreparedDefinition::new(compiled.machine().clone()),
+            "arn:aws:iam::000000000000:role/Workflows".parse()?,
+            Tags::default(),
+        ))?
+        .wait(deadline())
+        .await?;
+    match result {
+        RegistryResult::Machine(machine) => Ok(machine.arn().clone()),
+        _ => Err("machine".into()),
+    }
+}
+async fn run_native_child_port(
+    fixture: &NativeFixture,
+    registry: &Registry,
+    release: &Path,
+    cancel: bool,
+) -> Result<Option<u64>, Box<dyn Error>> {
+    fixture.provider.update_function_configuration(
+        "Worker",
+        &UpdateFunctionConfigurationInput {
+            timeout: Some(900),
+            ..UpdateFunctionConfigurationInput::default()
+        },
+    )?;
+    let parent = child_port_machine(
+        registry,
+        "PortParent",
+        &json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":3600,"End":true}}}),
+    )
+    .await?;
+    let target = child_port_machine(registry, "PortChild", &workflow(false)).await?;
+    let RegistryResult::Execution(parent) = registry
+        .submit(RegistryCommand::Start(
+            parent,
+            Some("parent".parse()?),
+            Payload::parse(b"{}")?,
+            None,
+        ))?
+        .wait(deadline())
+        .await?
+    else {
+        return Err("parent".into());
+    };
+    let parameters = ChildStartParameters::parse(
+        &TenantScope::default(),
+        &Payload::from_value(&json!({"StateMachineArn":target.as_str(),"Input":{"n":21}}))?,
+    )?;
+    let mut submission = registry.child_port().start(
+        parent.child_parent(),
+        parameters,
+        ChildPattern::Sync2,
+        Instant::now() + Duration::from_secs(300),
+    )?;
+    submission.admitted(deadline()).await?;
+    let mut child = submission.into_execution()?;
+    let marker = child_port_marker(fixture).await?;
+    let pid = marker
+        .get("pid")
+        .and_then(Value::as_u64)
+        .filter(|pid| *pid > 1 && *pid != u64::from(process::id()))
+        .ok_or("handler PID")?;
+    let request = marker
+        .get("request_id")
+        .and_then(Value::as_str)
+        .filter(|id| id.len() == 36)
+        .ok_or("request ID")?;
+    if child.snapshot().handle().snapshot().outcome().is_some() {
+        return Err("child completed before consumed gate release".into());
+    }
+    if cancel {
+        child.cancel();
+    } else {
+        fs::write(release, b"release").await?;
+    }
+    child.wait(deadline()).await?;
+    child.wait_cleanup(deadline()).await?;
+    let result = child.result()?;
+    if cancel {
+        let failure = result.err().ok_or("cancelled child succeeded")?;
+        if failure.details().error() != Some("States.TaskFailed") {
+            return Err("child cancellation error class".into());
+        }
+        let cause: Value = serde_json::from_str(failure.details().cause().ok_or("cause")?)?;
+        if cause.get("Status").and_then(Value::as_str) != Some("ABORTED") {
+            return Err("child was not aborted".into());
+        }
+        return Ok(Some(pid));
+    }
+    let result = result.map_err(|_| "child failed")?;
+    let output = result.value().get("Output").ok_or("Output")?;
+    if output.get("computed") != Some(&json!(42))
+        || output.get("pid").and_then(Value::as_u64) != Some(pid)
+        || output.get("request_id").and_then(Value::as_str) != Some(request)
+    {
+        return Err("child result did not match consumed Native invocation".into());
+    }
+    Ok(None)
+}
+
+async fn child_port_marker(fixture: &NativeFixture) -> Result<Value, Box<dyn Error>> {
+    let marker = fixture
+        .directory
+        .as_ref()
+        .ok_or("directory")?
+        .path()
+        .join("invocation.json");
+    timeout_at(deadline(), async {
+        loop {
+            match fs::read(&marker).await {
+                Ok(bytes) => {
+                    if bytes.len() > 1024 {
+                        return Err("marker size".into());
+                    }
+                    if let Ok(value) = serde_json::from_slice::<Value>(&bytes) {
+                        return Ok::<_, Box<dyn Error>>(value);
+                    }
+                }
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                Err(error) => return Err(error.into()),
+            }
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await?
+}
+
+async fn verify_absent_probe(pid: u64) -> Result<(), Box<dyn Error>> {
+    let child = Command::new("/bin/kill")
+        .arg("-0")
+        .arg(pid.to_string())
+        .env_clear()
+        .env("LC_ALL", "C")
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::piped())
+        .kill_on_drop(true)
+        .spawn()?;
+    let (mut child, status) = reap_probe(child, deadline()).await?;
+    let stderr = child.stderr.take().ok_or("probe stderr")?;
+    let mut text = Vec::new();
+    timeout_at(deadline(), stderr.take(1025).read_to_end(&mut text)).await??;
+    if status.success()
+        || text.len() > 1024
+        || !String::from_utf8_lossy(&text).contains("No such process")
+    {
+        return Err("owned cancellation did not retire consumed PID before global cleanup".into());
+    }
+    Ok(())
+}
+
+async fn reap_probe(
+    mut child: Child,
+    until: Instant,
+) -> Result<(Child, ExitStatus), Box<dyn Error>> {
+    let status = match timeout_at(until, child.wait()).await {
+        Ok(Ok(status)) => status,
+        observed => {
+            let saved: Box<dyn Error> = match observed {
+                Ok(Err(error)) => Box::new(error),
+                Err(error) => Box::new(error),
+                Ok(Ok(_)) => return Err("probe wait invariant".into()),
+            };
+            let killed = child.start_kill();
+            match timeout_at(deadline(), child.wait()).await {
+                Ok(Ok(_)) => {}
+                failed => {
+                    // Unproven helper retirement retains the exact process handle.
+                    let _retained = Box::leak(Box::new(child));
+                    return Err(format!("PID probe retirement unproven: {failed:?}").into());
+                }
+            }
+            killed?;
+            return Err(saved);
+        }
+    };
+    if Instant::now() >= until {
+        return Err("PID probe observation expired after joined exit".into());
+    }
+    Ok((child, status))
+}
+
+#[tokio::test]
+#[ignore = "requires Unix process tools; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_kill_and_reap_timed_out_owned_probe_before_returning_error()
+-> Result<(), Box<dyn Error>> {
+    let child = Command::new("/bin/sleep")
+        .arg("60")
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .kill_on_drop(true)
+        .spawn()?;
+    let pid = child.id().ok_or("owned probe PID")?;
+    let result = reap_probe(child, Instant::now() + Duration::from_millis(10)).await;
+    verify_absent_probe(u64::from(pid)).await?;
+    let error = result
+        .err()
+        .ok_or("slow probe did not report its observation timeout")?;
+    if error.downcast_ref::<Elapsed>().is_none() {
+        return Err("probe failed without observing its execution timeout".into());
+    }
+    Ok(())
+}
+
+mod callback;
+
+mod registered_callback;
+
+async fn run_restored_native_case(
+    source: &Registry,
+    source_owner: &mut RegistrySupervisor,
+    target: &Registry,
+    marker: &Path,
+) -> Result<(), Box<dyn Error>> {
+    let prepared = PreparedDefinition::new(
+        AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+            .compile(&serde_json::to_vec(&workflow(true))?)?
+            .machine()
+            .clone(),
+    );
+    let mut create = source.submit(RegistryCommand::Create(
+        "NativeWorkflow".parse()?,
+        prepared,
+        "arn:aws:iam::000000000000:role/Workflow".parse()?,
+        Tags::default(),
+    ))?;
+    let RegistryResult::Machine(machine) = create.wait(deadline()).await? else {
+        return Err("missing source machine".into());
+    };
+    let mut receipt = source.submit(RegistryCommand::Start(
+        machine.arn().clone(),
+        Some("before".parse()?),
+        Payload::parse(br#"{"n":21}"#)?,
+        None,
+    ))?;
+    let RegistryResult::Execution(original) = receipt.wait(deadline()).await? else {
+        return Err("missing original execution".into());
+    };
+    let original_view = original.handle().wait(deadline()).await?;
+    source_owner.shutdown(deadline()).await?;
+    let before = fs::read(marker).await?;
+    let document = source.export_snapshot(SnapshotLimits::default())?;
+    let mut bytes = Vec::new();
+    ciborium::into_writer(&document, &mut bytes)?;
+    let decoded = ciborium::from_reader(bytes.as_slice())?;
+    let prepared = target.prepare_snapshot(decoded, SnapshotLimits::default())?;
+    let mut receipt = target.restore_snapshot(prepared)?;
+    if !matches!(receipt.wait(deadline()).await?, RegistryResult::Restored) {
+        return Err("missing restore acknowledgement".into());
+    }
+    let mut read = target.submit(RegistryCommand::Execution(original.arn().clone()))?;
+    let RegistryResult::Execution(saved) = read.wait(deadline()).await? else {
+        return Err("missing restored execution".into());
+    };
+    let unchanged = fs::read(marker).await?;
+    if before != unchanged
+        || output(saved.view().outcome().ok_or("missing old outcome")?).pointer("/Payload/computed")
+            != Some(&json!(42))
+        || serde_json::to_value(original_view.history().page(1, 1000, true)?.events())?
+            != serde_json::to_value(saved.view().history().page(1, 1000, true)?.events())?
+    {
+        return Err("restore replayed work or changed output/history".into());
+    }
+    let mut receipt = target.submit(RegistryCommand::Start(
+        machine.arn().clone(),
+        Some("after".parse()?),
+        Payload::parse(br#"{"n":22}"#)?,
+        None,
+    ))?;
+    let RegistryResult::Execution(next) = receipt.wait(deadline()).await? else {
+        return Err("missing new execution".into());
+    };
+    let completed = next.handle().wait(deadline()).await?;
+    if output(completed.outcome().ok_or("missing new outcome")?).pointer("/Payload/computed")
+        != Some(&json!(44))
+        || before == fs::read(marker).await?
+    {
+        return Err("restored machine did not execute a new real Lambda call".into());
+    }
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_restore_without_replay_and_execute_new_lambda_requests() {
+    let mut fixture = NativeFixture::new(&[("WORKFLOW_MODE", "1")], false).await;
+    let (first_port, mut first_bridge) = StepFunctionsLambdaBridge::new(
+        fixture.provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let (second_port, mut second_bridge) = StepFunctionsLambdaBridge::new(
+        fixture.provider.clone(),
+        TenantScope::default(),
+        BridgeLimits::default(),
+    )
+    .unwrap();
+    let (source, mut source_owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        executions(first_port),
+        ExecutionLimits::default(),
+    )
+    .unwrap();
+    let (target, mut target_owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        executions(second_port),
+        ExecutionLimits::default(),
+    )
+    .unwrap();
+    let marker = fixture
+        .directory
+        .as_ref()
+        .unwrap()
+        .path()
+        .join("invocation.json");
+    let result = run_restored_native_case(&source, &mut source_owner, &target, &marker).await;
+    // Join both independent registry/bridge owners even when any assertion path fails.
+    let absolute = Instant::now() + Duration::from_secs(15);
+    let first = source_owner.shutdown(absolute).await;
+    let second = target_owner.shutdown(absolute).await;
+    let first_calls = first_bridge.shutdown(absolute).await;
+    let second_calls = second_bridge.shutdown(absolute).await;
+    if first.is_err() || second.is_err() || first_calls.is_err() || second_calls.is_err() {
+        if let Some(directory) = fixture.directory.take() {
+            let _retained = directory.keep();
+        }
+    }
+    fixture.cleanup().await;
+    assert!(first.is_ok(), "source cleanup: {first:?}");
+    assert!(second.is_ok(), "target cleanup: {second:?}");
+    assert!(
+        first_calls.is_ok(),
+        "source bridge cleanup: {first_calls:?}"
+    );
+    assert!(
+        second_calls.is_ok(),
+        "target bridge cleanup: {second_calls:?}"
+    );
+    assert!(result.is_ok(), "restore case: {result:?}");
+}
diff --git a/apps/rustack/src/stepfunctions_bridge/tests/native/callback.rs b/apps/rustack/src/stepfunctions_bridge/tests/native/callback.rs
new file mode 100644
index 00000000..88dee727
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge/tests/native/callback.rs
@@ -0,0 +1,356 @@
+//! Real Native invocation composition; ASL callback activation is separately gated.
+
+use rustack_stepfunctions_core::{
+    CallbackAttempt, CallbackCommand, CallbackDispatch, CallbackInvocation,
+    CallbackInvocationMetadata, CallbackLimits, CallbackOutcome, CallbackRegistry, CallbackTask,
+    DriverStep, FrameCallId, FrameCapacity, FrameLimits, FrameScheduler, FrameUpdate,
+    LambdaTaskCommand, SystemUuidSource, TaskCall, TaskEvent, TaskFailure, TaskSettlement,
+};
+use uuid::Uuid;
+
+use super::*;
+use crate::stepfunctions_bridge::{mapping::Mapped, worker};
+
+fn observed_dispatch() -> Result<(CallbackDispatch, FrameCallId), Box<dyn Error>> {
+    let mut definition = workflow(true);
+    definition["States"]["Call"]["Resource"] =
+        json!("arn:aws:states:::lambda:invoke.waitForTaskToken");
+    definition["States"]["Call"]["Parameters"]["Payload"]["token.$"] = json!("$$.Task.Token");
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_callback_support(true)
+        .compile(&serde_json::to_vec(&definition)?)?
+        .machine()
+        .clone();
+    let now = ClockSample::new(Instant::now().into_std(), SystemTime::now().into());
+    let input = Payload::from_value(&json!({"n":21}))?;
+    let driver = ExecutionDriver::for_structured_owner(
+        machine,
+        input.clone(),
+        EvaluationContext::from_value(&json!({}))?,
+        now,
+        ExecutionLimits::default(),
+    )?;
+    let mut frames = FrameScheduler::new(
+        driver,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )?;
+    for _ in 0..20 {
+        if let FrameUpdate::Transition(t) = frames.advance(now, &mut SystemUuidSource::default()) {
+            if let DriverStep::Callback(effect) = t.step() {
+                return Ok((effect.clone(), t.call().ok_or("call")?));
+            }
+        }
+    }
+    Err("missing deferred callback".into())
+}
+
+fn command(
+    effect: &CallbackDispatch,
+    call: FrameCallId,
+    task: &mut CallbackTask,
+) -> Result<LambdaTaskCommand, Box<dyn Error>> {
+    let (dispatch, history) =
+        effect.prepare_with_source(task.token(), &mut SystemUuidSource::default())?;
+    let scheduled = effect.scheduled_event(&history, SystemTime::now().into())?;
+    if !history.redacted() || serde_json::to_string(&scheduled)?.contains(task.token().expose()) {
+        return Err("unsafe callback scheduling projection".into());
+    }
+    Ok(LambdaTaskCommand::observed_callback(
+        effect.machine().clone(),
+        dispatch,
+        call,
+        task.take_invocation_reporter()?,
+    )?)
+}
+
+async fn success(registry: &CallbackRegistry, task: &CallbackTask) -> Result<(), Box<dyn Error>> {
+    registry
+        .submit(
+            &TenantScope::default(),
+            CallbackCommand::success(task.token().expose().parse()?, br#"{"external":42}"#)?,
+        )?
+        .wait(deadline())
+        .await?;
+    Ok(())
+}
+async fn result(call: &mut TaskCall) -> Result<Payload, Box<dyn Error>> {
+    loop {
+        match call.next().await? {
+            TaskEvent::Completed(result) => return result.map_err(|_| "invocation failed".into()),
+            TaskEvent::Started | TaskEvent::Submitted(_) => {}
+            _ => return Err("unexpected task event".into()),
+        }
+    }
+}
+async fn run(
+    fixture: &NativeFixture,
+    registry: &Registry,
+    callbacks: &CallbackRegistry,
+    release: &Path,
+    kind: u8,
+) -> Result<Option<u64>, Box<dyn Error>> {
+    fixture.provider.update_function_configuration(
+        "Worker",
+        &UpdateFunctionConfigurationInput {
+            timeout: Some(900),
+            ..UpdateFunctionConfigurationInput::default()
+        },
+    )?;
+    let arn = child_port_machine(
+        registry,
+        "CallbackParent",
+        &json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":3600,"End":true}}}),
+    )
+    .await?;
+    let RegistryResult::Execution(parent) = registry
+        .submit(RegistryCommand::Start(
+            arn,
+            Some("parent".parse()?),
+            Payload::parse(b"{}")?,
+            None,
+        ))?
+        .wait(deadline())
+        .await?
+    else {
+        return Err("parent".into());
+    };
+    let (effect, call_id) = observed_dispatch()?;
+    let mut mint = callbacks.register(CallbackAttempt::new(
+        &parent,
+        call_id,
+        Instant::from_std(effect.deadline()),
+        effect.heartbeat(),
+    )?)?;
+    mint.admitted(deadline()).await?;
+    let mut task = mint.into_task()?;
+    let secret = task.token().expose().to_owned();
+    let command = command(&effect, call_id, &mut task)?;
+    let mut call = fixture
+        .port
+        .start(command)
+        .map_err(|_| "bridge admission")?;
+    let marker = child_port_marker(fixture).await?;
+    let pid = marker.get("pid").and_then(Value::as_u64).ok_or("pid")?;
+    let request = marker
+        .get("request_id")
+        .and_then(Value::as_str)
+        .ok_or("request")?;
+    if !matches!(task.snapshot().as_ref(), CallbackOutcome::Invoking)
+        || task.invocation().is_some()
+        || call.settlement() != TaskSettlement::Pending
+    {
+        return Err("gated invocation completed".into());
+    }
+    if kind == 3 {
+        task.revoke();
+        call.cancel();
+        timeout_at(deadline(), call.settled()).await??;
+        if !matches!(
+            task.wait(deadline()).await?.as_ref(),
+            CallbackOutcome::Revoked
+        ) {
+            return Err("callback cancellation".into());
+        }
+        return Ok(Some(pid));
+    }
+    if kind != 1 {
+        success(callbacks, &task).await?;
+    }
+    if !matches!(task.snapshot().as_ref(), CallbackOutcome::Invoking) {
+        return Err("early callback bypassed invocation".into());
+    }
+    fs::write(release, b"release").await?;
+    let report = task.wait_invocation(deadline()).await?;
+    if kind == 2 {
+        if report.failure().and_then(|f| f.details().error()) != Some("TestError")
+            || !matches!(
+                task.wait(deadline()).await?.as_ref(),
+                CallbackOutcome::InvocationFailed(_)
+            )
+        {
+            return Err("function failure hidden by callback".into());
+        }
+        timeout_at(deadline(), call.settled()).await??;
+        return Ok(None);
+    }
+    finish(
+        callbacks, &mut task, &mut call, report, request, &secret, kind,
+    )
+    .await?;
+    Ok(None)
+}
+async fn finish(
+    callbacks: &CallbackRegistry,
+    task: &mut CallbackTask,
+    call: &mut TaskCall,
+    report: Arc<CallbackInvocation>,
+    request: &str,
+    secret: &str,
+    kind: u8,
+) -> Result<(), Box<dyn Error>> {
+    let metadata = report.metadata().ok_or("actual metadata")?;
+    if metadata.request_id().to_string() != request || metadata.executed_version() != "$LATEST" {
+        return Err("invented invocation metadata".into());
+    }
+    if kind == 1 {
+        // Waiting is published independently; repeat heartbeat as an actor barrier.
+        callbacks
+            .submit(
+                &TenantScope::default(),
+                CallbackCommand::heartbeat(task.token().expose().parse()?),
+            )?
+            .wait(deadline())
+            .await?;
+        if !matches!(task.snapshot().as_ref(), CallbackOutcome::Waiting { .. }) {
+            return Err("not waiting after real response".into());
+        }
+        success(callbacks, task).await?;
+    }
+    let outcome = task.wait(deadline()).await?;
+    if !matches!(outcome.as_ref(),CallbackOutcome::Succeeded(p) if p.value()==&json!({"external":42}))
+    {
+        return Err("synchronous body replaced callback output".into());
+    }
+    let output = timeout_at(deadline(), result(call)).await??;
+    timeout_at(deadline(), call.settled()).await??;
+    if output.value().get("Payload").is_some()
+        || output.value()["SdkResponseMetadata"]["RequestId"] != request
+        || format!("{report:?}{output:?}").contains(secret)
+    {
+        return Err("unsafe callback metadata".into());
+    }
+    Ok(())
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_observe_callbacks_before_and_after_real_return_prioritize_failure_and_reap_cancelled_process()
+-> Result<(), Box<dyn Error>> {
+    for kind in 0..4 {
+        let directory = tempfile::tempdir()?;
+        let release = directory.path().join("release");
+        let mut vars = vec![
+            ("WORKFLOW_MODE", "1"),
+            (
+                "WORKFLOW_GATE_FILE",
+                release.to_str().ok_or("release path")?,
+            ),
+        ];
+        if kind == 2 {
+            vars.push(("FAIL_MODE", "panic"));
+        }
+        let mut fixture = NativeFixture::new(&vars, false).await;
+        let (registry, mut owner) = Registry::new(
+            TenantScope::default(),
+            RegistryLimits::default(),
+            executions(fixture.port.clone()),
+            ExecutionLimits::default(),
+        )?;
+        let (callbacks, mut callback_owner) =
+            CallbackRegistry::new(TenantScope::default(), CallbackLimits::default())?;
+        let outcome = timeout_at(
+            deadline(),
+            run(&fixture, &registry, &callbacks, &release, kind),
+        )
+        .await;
+        let probe = match &outcome {
+            Ok(Ok(Some(pid))) => verify_absent_probe(*pid).await,
+            _ => Ok(()),
+        };
+        let released = fs::write(&release, b"release").await;
+        let callback_join = callback_owner.shutdown(deadline()).await;
+        let joined = owner.shutdown(deadline()).await;
+        if callback_join.is_err() || joined.is_err() {
+            if let Some(dir) = fixture.directory.take() {
+                let _retained = dir.keep();
+            }
+        }
+        fixture.cleanup().await;
+        released?;
+        callback_join?;
+        joined?;
+        probe?;
+        outcome??;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_publish_return_before_bridge_settlement_and_preserve_report_on_quarantine()
+-> Result<(), Box<dyn Error>> {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    let (registry, mut owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+    )?;
+    let (callbacks, mut callback_owner) =
+        CallbackRegistry::new(TenantScope::default(), CallbackLimits::default())?;
+    let outcome = async {
+        let arn = child_port_machine(
+            &registry,
+            "ReportParent",
+            &json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":3600,"End":true}}}),
+        )
+        .await?;
+        let RegistryResult::Execution(parent) = registry
+            .submit(RegistryCommand::Start(
+                arn,
+                Some("parent".parse()?),
+                Payload::parse(b"{}")?,
+                None,
+            ))?
+            .wait(deadline())
+            .await?
+        else {
+            return Err::<(), Box<dyn Error>>("parent".into());
+        };
+        let (_, call_id) = observed_dispatch()?;
+        let mut mint =
+            callbacks.register(CallbackAttempt::new(&parent, call_id, deadline(), None)?)?;
+        mint.admitted(deadline()).await?;
+        let mut task = mint.into_task()?;
+        let mut reporter = Some(task.take_invocation_reporter()?);
+        let metadata = CallbackInvocationMetadata::new(Uuid::new_v4(), "$LATEST")?;
+        let mut mapped = Mapped {
+            result: Ok(metadata.payload()?),
+            diagnostic: None,
+        };
+        let (mut call, mut responder) = TaskCall::channel();
+        responder.started()?;
+        worker::report(&mut reporter, &mut mapped, Some(metadata), Instant::now());
+        let report = task.wait_invocation(deadline()).await?;
+        if !report.succeeded() || call.settlement() != TaskSettlement::Pending {
+            return Err("report depended on settlement".into());
+        }
+        success(&callbacks, &task).await?;
+        task.wait(deadline()).await?;
+        let retained = responder.quarantine(TaskFailure::service_exception());
+        if call.settlement() != TaskSettlement::Quarantined
+            || !Arc::ptr_eq(&report, &task.wait_invocation(deadline()).await?)
+        {
+            return Err("cleanup rewrote invocation report".into());
+        }
+        if timeout(Duration::from_millis(1), call.settled())
+            .await
+            .is_ok()
+        {
+            return Err("quarantine fabricated clean".into());
+        }
+        retained.settle();
+        call.settled().await?;
+        Ok(())
+    }
+    .await;
+    let a = callback_owner.shutdown(deadline()).await;
+    let b = owner.shutdown(deadline()).await;
+    a?;
+    b?;
+    outcome
+}
diff --git a/apps/rustack/src/stepfunctions_bridge/tests/native/registered_callback.rs b/apps/rustack/src/stepfunctions_bridge/tests/native/registered_callback.rs
new file mode 100644
index 00000000..0422dfd5
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge/tests/native/registered_callback.rs
@@ -0,0 +1,277 @@
+//! Actual registered ASL callback owner → Native Lambda; API activation is separate.
+
+use rustack_stepfunctions_core::{
+    CallbackCommand, CallbackLimits, CallbackRegistry, CallbackToken, ExecutionView,
+    LambdaTaskCommand, LambdaTaskPort, TaskCall, TaskFailure,
+};
+use tokio::sync::mpsc;
+
+use super::*;
+
+/// Explicit bounded harness credential transport; never a service history/log sink.
+#[derive(Debug)]
+struct Capture {
+    inner: Arc<StepFunctionsLambdaBridge>,
+    tokens: mpsc::Sender<CallbackToken>,
+}
+impl LambdaTaskPort for Capture {
+    fn start(&self, command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        let token = command
+            .dispatch()
+            .parameters()
+            .value()
+            .pointer("/Payload/token")
+            .and_then(Value::as_str)
+            .ok_or_else(TaskFailure::service_exception)?
+            .parse()
+            .map_err(|_| TaskFailure::service_exception())?;
+        self.tokens
+            .try_send(token)
+            .map_err(|_| TaskFailure::service_exception())?;
+        self.inner.start(command)
+    }
+}
+async fn machine(registry: &Registry) -> Result<StateMachineArn, Box<dyn Error>> {
+    let source = json!({"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","TimeoutSeconds":300,"Parameters":{"FunctionName":"Worker","Payload":{"n.$":"$.n","retryCount.$":"$$.State.RetryCount","token.$":"$$.Task.Token"}},"End":true}}});
+    let compiled = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_callback_support(true)
+        .compile(&serde_json::to_vec(&source)?)?;
+    let RegistryResult::Machine(machine) = registry
+        .submit(RegistryCommand::Create(
+            "NativeCallback".parse()?,
+            PreparedDefinition::new(compiled.machine().clone()),
+            "arn:aws:iam::000000000000:role/Worker".parse()?,
+            Tags::default(),
+        ))?
+        .wait(deadline())
+        .await?
+    else {
+        return Err("machine".into());
+    };
+    Ok(machine.arn().clone())
+}
+async fn run(
+    fixture: &NativeFixture,
+    registry: &Registry,
+    callbacks: &CallbackRegistry,
+    tokens: &mut mpsc::Receiver<CallbackToken>,
+    release: &Path,
+    kind: u8,
+) -> Result<Option<u64>, Box<dyn Error>> {
+    fixture.provider.update_function_configuration(
+        "Worker",
+        &UpdateFunctionConfigurationInput {
+            timeout: Some(900),
+            ..UpdateFunctionConfigurationInput::default()
+        },
+    )?;
+    let machine = machine(registry).await?;
+    let RegistryResult::Execution(execution) = registry
+        .submit(RegistryCommand::Start(
+            machine,
+            Some("run".parse()?),
+            Payload::parse(br#"{"n":21}"#)?,
+            None,
+        ))?
+        .wait(deadline())
+        .await?
+    else {
+        return Err("execution".into());
+    };
+    let token = timeout_at(deadline(), tokens.recv())
+        .await?
+        .ok_or("token capture")?;
+    let marker = child_port_marker(fixture).await?;
+    let pid = marker
+        .get("pid")
+        .and_then(Value::as_u64)
+        .filter(|pid| *pid > 1 && *pid != u64::from(process::id()))
+        .ok_or("consumed PID")?;
+    let request = marker
+        .get("request_id")
+        .and_then(Value::as_str)
+        .ok_or("consumed request")?;
+    if execution.handle().snapshot().outcome().is_some() {
+        return Err("callback completed before consumed gate release".into());
+    }
+    if kind == 3 {
+        execution
+            .handle()
+            .request_stop(TaskFailure::new("Stopped", None).map_err(|_| "stop failure")?);
+        let view = execution.handle().wait(deadline()).await?;
+        if !matches!(
+            view.outcome().map(Arc::as_ref),
+            Some(ExecutionOutcome::Aborted(_))
+        ) {
+            return Err("callback stop outcome".into());
+        }
+        execution.handle().wait_cleanup(deadline()).await?;
+        if callbacks
+            .submit(
+                &TenantScope::default(),
+                CallbackCommand::success(token.expose().parse()?, b"true")?,
+            )?
+            .wait(deadline())
+            .await
+            .is_ok()
+        {
+            return Err("stopped token remained live".into());
+        }
+        return Ok(Some(pid));
+    }
+    if kind != 1 {
+        send(callbacks, &token).await?;
+    }
+    if execution.handle().snapshot().outcome().is_some() {
+        return Err("early callback bypassed actual Native return".into());
+    }
+    fs::write(release, b"release").await?;
+    if kind == 1 {
+        wait_submitted(&execution).await?;
+        if execution.handle().snapshot().outcome().is_some() {
+            return Err("Lambda body completed callback Task".into());
+        }
+        send(callbacks, &token).await?;
+    }
+    let view = execution.handle().wait(deadline()).await?;
+    execution.handle().wait_cleanup(deadline()).await?;
+    verify(&view, &token, request, kind)?;
+    Ok(None)
+}
+async fn send(callbacks: &CallbackRegistry, token: &CallbackToken) -> Result<(), Box<dyn Error>> {
+    callbacks
+        .submit(
+            &TenantScope::default(),
+            CallbackCommand::success(token.expose().parse()?, br#"{"external":42}"#)?,
+        )?
+        .wait(deadline())
+        .await?;
+    Ok(())
+}
+async fn wait_submitted(execution: &ExecutionSnapshot) -> Result<(), Box<dyn Error>> {
+    timeout_at(deadline(), async {
+        loop {
+            let view = execution.handle().snapshot();
+            if view
+                .history()
+                .page(1, 1000, true)?
+                .events()
+                .iter()
+                .any(|event| event.task_submitted_event_details.is_some())
+            {
+                return Ok::<_, Box<dyn Error>>(());
+            }
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await?
+}
+fn verify(
+    view: &ExecutionView,
+    token: &CallbackToken,
+    request: &str,
+    kind: u8,
+) -> Result<(), Box<dyn Error>> {
+    if kind == 2 {
+        if !matches!(view.outcome().map(Arc::as_ref),Some(ExecutionOutcome::Failed(f)) if f.error()==Some("TestError"))
+        {
+            return Err("Native failure hidden by provisional callback".into());
+        }
+    } else if !matches!(view.outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(p)) if p.value()==&json!({"external":42}))
+    {
+        return Err("callback output was replaced by function body".into());
+    }
+    let page = view.history().page(1, 1000, true)?;
+    let events = page.events();
+    if serde_json::to_string(events)?.contains(token.expose()) {
+        return Err("plaintext token in callback history".into());
+    }
+    let scheduled = events
+        .iter()
+        .find_map(|e| e.task_scheduled_event_details.as_ref())
+        .ok_or("scheduled history")?;
+    let parameters: Value = serde_json::from_str(&scheduled.parameters)?;
+    if parameters.pointer("/Payload/token") != Some(&Value::Null) {
+        return Err("callback history provenance missing".into());
+    }
+    if kind != 2 {
+        let submitted = events
+            .iter()
+            .find_map(|e| e.task_submitted_event_details.as_ref())
+            .ok_or("submitted history")?;
+        let output: Value = serde_json::from_str(submitted.output.as_deref().ok_or("metadata")?)?;
+        if output
+            .pointer("/SdkResponseMetadata/RequestId")
+            .and_then(Value::as_str)
+            != Some(request)
+            || output.get("Payload").is_some()
+            || output.get("ExecutedVersion").and_then(Value::as_str) != Some("$LATEST")
+            || submitted.output_details.as_ref().and_then(|d| d.truncated) != Some(true)
+        {
+            return Err("actual Native metadata or callback truncation mismatch".into());
+        }
+    }
+    Ok(())
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires the actual host bootstrap; run make test-stepfunctions-bridge-native"]
+async fn native_e2e_should_execute_registered_asl_callbacks_and_join_consumed_native_cancellation()
+-> Result<(), Box<dyn Error>> {
+    for kind in 0..4 {
+        let gate = tempfile::tempdir()?;
+        let release = gate.path().join("release");
+        let mut vars = vec![
+            ("WORKFLOW_MODE", "1"),
+            ("WORKFLOW_GATE_FILE", release.to_str().ok_or("gate path")?),
+        ];
+        if kind == 2 {
+            vars.push(("FAIL_MODE", "panic"));
+        }
+        let mut fixture = NativeFixture::new(&vars, false).await;
+        let (sender, mut tokens) = mpsc::channel(8);
+        let port = Arc::new(Capture {
+            inner: fixture.port.clone(),
+            tokens: sender,
+        });
+        let (callbacks, mut callback_owner) =
+            CallbackRegistry::new(TenantScope::default(), CallbackLimits::default())?;
+        let mut runtime = ExecutionSupervisor::new(
+            RuntimeLimits::new(8, 1, 2)?,
+            HistoryLimits::default(),
+            256 * 1024 * 1024,
+            Some(port),
+        )?;
+        runtime.install_callbacks(callbacks.clone())?;
+        let (registry, mut owner) = Registry::new_with_state_support(
+            TenantScope::default(),
+            RegistryLimits::default(),
+            runtime,
+            ExecutionLimits::new(Duration::from_secs(300), 10000)?,
+            StateSupport::Structured,
+        )?;
+        let result = timeout_at(
+            Instant::now() + Duration::from_secs(30),
+            run(&fixture, &registry, &callbacks, &mut tokens, &release, kind),
+        )
+        .await;
+        let probe = match &result {
+            Ok(Ok(Some(pid))) => verify_absent_probe(*pid).await,
+            _ => Ok(()),
+        };
+        let released = fs::write(&release, b"release").await;
+        let workflow = owner.shutdown(deadline()).await;
+        let callback = callback_owner.shutdown(deadline()).await;
+        if workflow.is_err() || callback.is_err() {
+            if let Some(dir) = fixture.directory.take() {
+                let _retained = dir.keep();
+            }
+        }
+        fixture.cleanup().await;
+        released?;
+        workflow?;
+        callback?;
+        probe?;
+        result??;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/src/stepfunctions_bridge/worker.rs b/apps/rustack/src/stepfunctions_bridge/worker.rs
new file mode 100644
index 00000000..913fab26
--- /dev/null
+++ b/apps/rustack/src/stepfunctions_bridge/worker.rs
@@ -0,0 +1,360 @@
+//! Retained start/result/cleanup sequence for exactly one actual provider call.
+
+use std::{future::Future, pin::pin, sync::Arc};
+
+use rustack_lambda_core::{
+    error::LambdaServiceError,
+    executor::{ExecutorError, InvokeResponse},
+    invocation::InvocationHandle,
+};
+use rustack_stepfunctions_core::{
+    CallbackError, CallbackInvocationMetadata, CallbackInvocationReporter, LambdaTaskCommand,
+    SystemUuidSource, TaskFailure, TaskResponder,
+};
+use tokio::{sync::watch, task::JoinSet, time::Instant};
+
+use super::{
+    BridgeError, Shared, Uncertain, WorkerExit,
+    mapping::{self, CallPlan, Mapped, ResponseMode, ServiceTarget},
+    signal,
+};
+
+async fn observe<F: Future>(
+    future: F,
+    core: &mut watch::Receiver<bool>,
+    manager: &mut watch::Receiver<bool>,
+    relay: &watch::Sender<bool>,
+) -> F::Output {
+    let mut future = pin!(future);
+    loop {
+        let core_stopped = signal(core);
+        let manager_stopped = signal(manager);
+        if core_stopped || manager_stopped {
+            relay.send_replace(true);
+        }
+        tokio::select! {
+            biased;
+            _=core.changed(),if !core_stopped=>{},
+            _=manager.changed(),if !manager_stopped=>{},
+            result=&mut future=>return result,
+        }
+    }
+}
+fn checked(mapped: Result<Mapped, BridgeError>) -> Mapped {
+    mapped.unwrap_or_else(|error| Mapped {
+        result: Err(TaskFailure::service_exception()),
+        diagnostic: Some(error),
+    })
+}
+#[tracing::instrument(name = "stepfunctions.lambda", skip_all)]
+pub(super) async fn invoke(
+    shared: Arc<Shared>,
+    mut command: LambdaTaskCommand,
+    mut responder: TaskResponder,
+    mut manager: watch::Receiver<bool>,
+) -> WorkerExit {
+    let mut core = responder.cancellation();
+    let (relay, cancellation) = watch::channel(signal(&core) || signal(&manager));
+    let plan = CallPlan::compile(&command);
+    let mut reporter = match command.take_callback_reporter() {
+        Ok(reporter) => reporter,
+        Err(error) => {
+            responder.finish(Err(TaskFailure::service_exception()));
+            return WorkerExit {
+                uncertain: None,
+                diagnostic: Some(Arc::new(BridgeError::Callback(Arc::new(error)))),
+            };
+        }
+    };
+    let plan = match plan {
+        Ok(plan) => plan,
+        Err(error) => {
+            return finish_unsubmitted(
+                checked(mapping::parameters(error)),
+                &mut reporter,
+                responder,
+            );
+        }
+    };
+    let integration_started = matches!(plan.mode, ResponseMode::Optimized);
+    if integration_started && responder.started().is_err() {
+        relay.send_replace(true);
+    }
+    let start = shared.context.provider.start_invocation_owned(
+        &plan.function,
+        plan.qualifier.as_deref(),
+        plan.payload.original_bytes(),
+        Some(plan.deadline),
+        cancellation,
+    );
+    let submission = observe(start, &mut core, &mut manager, &relay).await;
+    let mut submission = match submission {
+        Ok(submission) => submission,
+        Err(error) => {
+            let mapped = map_service(
+                error,
+                ServiceTarget::new(&plan, command.machine().scope()),
+                &mut core,
+                &mut manager,
+                &relay,
+            )
+            .await;
+            return finish_unsubmitted(mapped, &mut reporter, responder);
+        }
+    };
+    let admitted = observe(submission.admitted(), &mut core, &mut manager, &relay).await;
+    let failed_admission = admitted.is_err();
+    let mut handle = submission.into_handle();
+    if failed_admission {
+        handle.cancel();
+    }
+    let (mut mapped, metadata, observed) = match admitted {
+        Ok(()) => {
+            if !integration_started && responder.started().is_err() {
+                relay.send_replace(true);
+            }
+            receive_response(&mut handle, plan.mode, &mut core, &mut manager, &relay).await
+        }
+        Err(error) => (
+            map_service(
+                error,
+                ServiceTarget::new(&plan, command.machine().scope()),
+                &mut core,
+                &mut manager,
+                &relay,
+            )
+            .await,
+            None,
+            Instant::now(),
+        ),
+    };
+    report(&mut reporter, &mut mapped, metadata, observed);
+    let exit = cleanup(
+        &shared,
+        handle,
+        responder,
+        mapped,
+        &mut core,
+        &mut manager,
+        &relay,
+    )
+    .await;
+    // Keep the external cancellation relay alive through the owned cleanup join.
+    drop(relay);
+    exit
+}
+
+fn finish_unsubmitted(
+    mut mapped: Mapped,
+    reporter: &mut Option<CallbackInvocationReporter>,
+    responder: TaskResponder,
+) -> WorkerExit {
+    report(reporter, &mut mapped, None, Instant::now());
+    responder.finish(mapped.result);
+    WorkerExit {
+        uncertain: None,
+        diagnostic: mapped.diagnostic.map(Arc::new),
+    }
+}
+
+async fn map_service(
+    error: LambdaServiceError,
+    target: ServiceTarget,
+    core: &mut watch::Receiver<bool>,
+    manager: &mut watch::Receiver<bool>,
+    relay: &watch::Sender<bool>,
+) -> Mapped {
+    let mut workers = JoinSet::new();
+    workers
+        .spawn_blocking(move || mapping::service(error, &target, &mut SystemUuidSource::default()));
+    match observe(workers.join_next(), core, manager, relay).await {
+        Some(Ok(mapped)) => checked(mapped),
+        Some(Err(error)) => checked(Err(BridgeError::Worker(error))),
+        None => checked(Err(BridgeError::Unavailable)),
+    }
+}
+
+async fn receive_response(
+    handle: &mut InvocationHandle,
+    mode: ResponseMode,
+    core: &mut watch::Receiver<bool>,
+    manager: &mut watch::Receiver<bool>,
+    relay: &watch::Sender<bool>,
+) -> (Mapped, Option<CallbackInvocationMetadata>, Instant) {
+    match observe(handle.wait_response(), core, manager, relay).await {
+        Ok(response) => {
+            let observed = Instant::now();
+            let request_id = handle.id();
+            let (mapped, metadata) = map_response(
+                CallbackInvocationMetadata::new(request_id, &response.executed_version),
+                response,
+                mode,
+                request_id.to_string(),
+                core,
+                manager,
+                relay,
+            )
+            .await;
+            (mapped, metadata, observed)
+        }
+        Err(error) => (checked(mapping::executor(error)), None, Instant::now()),
+    }
+}
+
+async fn map_response(
+    metadata: Result<CallbackInvocationMetadata, CallbackError>,
+    response: InvokeResponse,
+    mode: ResponseMode,
+    request_id: String,
+    core: &mut watch::Receiver<bool>,
+    manager: &mut watch::Receiver<bool>,
+    relay: &watch::Sender<bool>,
+) -> (Mapped, Option<CallbackInvocationMetadata>) {
+    let mut workers = JoinSet::new();
+    workers.spawn_blocking(move || match mode {
+        ResponseMode::ObservedCallback => mapping::observed_response(&response, metadata),
+        ResponseMode::Direct | ResponseMode::Optimized => mapping::response(
+            &response,
+            matches!(mode, ResponseMode::Optimized),
+            &request_id,
+        )
+        .map(|mapped| (mapped, None)),
+    });
+    match observe(workers.join_next(), core, manager, relay).await {
+        Some(Ok(Ok(mapped))) => mapped,
+        Some(Ok(Err(error))) => (checked(Err(error)), None),
+        Some(Err(error)) => (checked(Err(BridgeError::Worker(error))), None),
+        None => (checked(Err(BridgeError::Unavailable)), None),
+    }
+}
+
+pub(super) fn report(
+    reporter: &mut Option<CallbackInvocationReporter>,
+    mapped: &mut Mapped,
+    metadata: Option<CallbackInvocationMetadata>,
+    observed: Instant,
+) {
+    let Some(reporter) = reporter.as_mut() else {
+        return;
+    };
+    let result = match &mapped.result {
+        Err(failure) => Err(failure.clone()),
+        Ok(_) => metadata.ok_or_else(TaskFailure::service_exception),
+    };
+    if let Err(error) = reporter.complete_at(result, observed) {
+        mapped.result = Err(TaskFailure::service_exception());
+        mapped.diagnostic = Some(BridgeError::Callback(Arc::new(error)));
+    }
+}
+
+async fn cleanup(
+    shared: &Shared,
+    mut handle: InvocationHandle,
+    responder: TaskResponder,
+    mapped: Mapped,
+    core: &mut watch::Receiver<bool>,
+    manager: &mut watch::Receiver<bool>,
+    relay: &watch::Sender<bool>,
+) -> WorkerExit {
+    if signal(core) || signal(manager) {
+        relay.send_replace(true);
+        handle.cancel();
+    }
+    let cleanup = match Instant::now().checked_add(shared.context.limits.cleanup) {
+        Some(deadline) => observe(handle.wait_settlement(deadline), core, manager, relay).await,
+        None => Err(ExecutorError::CleanupFailed(
+            "Invalid cleanup deadline".into(),
+        )),
+    };
+    match cleanup {
+        Ok(()) => {
+            responder.finish(mapped.result);
+            WorkerExit {
+                uncertain: None,
+                diagnostic: mapped.diagnostic.map(Arc::new),
+            }
+        }
+        Err(error) => {
+            handle.cancel();
+            let failure = mapped
+                .result
+                .err()
+                .unwrap_or_else(TaskFailure::service_exception);
+            let receipt = responder.quarantine(failure);
+            let diagnostic = Arc::new(BridgeError::Executor(Arc::new(error)));
+            shared.diagnostic.send_replace(Some(diagnostic.clone()));
+            match observe(handle.wait_cleanup(), core, manager, relay).await {
+                Ok(()) => {
+                    receipt.settle();
+                    WorkerExit {
+                        uncertain: None,
+                        diagnostic: Some(diagnostic),
+                    }
+                }
+                Err(error) => WorkerExit {
+                    uncertain: Some(Uncertain {
+                        _handle: handle,
+                        _receipt: receipt,
+                    }),
+                    diagnostic: Some(Arc::new(BridgeError::Executor(Arc::new(error)))),
+                },
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{sync::mpsc, time::Duration};
+
+    use super::*;
+
+    #[tokio::test]
+    async fn test_should_relay_caller_and_manager_cancellation_without_dropping_mapping_join() {
+        for manager_cancel in [false, true] {
+            let (caller, mut core) = watch::channel(false);
+            let (stop, mut manager) = watch::channel(false);
+            let (relay, mut relayed) = watch::channel(false);
+            let (entered, waiting) = tokio::sync::oneshot::channel();
+            let (release, held) = mpsc::sync_channel(1);
+            let mut mapping = JoinSet::new();
+            mapping.spawn_blocking(move || {
+                let _ = entered.send(());
+                held.recv_timeout(Duration::from_secs(5)).unwrap();
+                42
+            });
+            let mut owners = JoinSet::new();
+            owners.spawn(async move {
+                observe(mapping.join_next(), &mut core, &mut manager, &relay).await
+            });
+            tokio::time::timeout(Duration::from_secs(5), waiting)
+                .await
+                .unwrap()
+                .unwrap();
+            if manager_cancel {
+                stop.send_replace(true);
+            } else {
+                caller.send_replace(true);
+            }
+            tokio::time::timeout(Duration::from_secs(5), relayed.wait_for(|v| *v))
+                .await
+                .unwrap()
+                .unwrap();
+            assert!(
+                owners.try_join_next().is_none(),
+                "mapping ownership ended before its CPU job"
+            );
+            release.send(()).unwrap();
+            assert_eq!(
+                tokio::time::timeout(Duration::from_secs(5), owners.join_next())
+                    .await
+                    .unwrap()
+                    .unwrap()
+                    .unwrap()
+                    .unwrap()
+                    .unwrap(),
+                42
+            );
+        }
+    }
+}
diff --git a/apps/rustack/src/workflows.rs b/apps/rustack/src/workflows.rs
new file mode 100644
index 00000000..c434436f
--- /dev/null
+++ b/apps/rustack/src/workflows.rs
@@ -0,0 +1,406 @@
+//! Actual gateway workflow composition and unique resumable shutdown ownership.
+
+use std::{error::Error, fmt, sync::Arc, time::Duration};
+
+use anyhow::{Context, Result};
+use rustack_cli::stepfunctions_api::{ApiError, ApiLimits, ApiSupervisor, StepFunctionsApi};
+#[cfg(feature = "lambda")]
+use rustack_cli::stepfunctions_bridge::{
+    BridgeError, BridgeLimits, LambdaBridgeSupervisor, StepFunctionsLambdaBridge,
+};
+use rustack_core::settings::RuntimeBudgets;
+#[cfg(feature = "lambda")]
+use rustack_lambda_core::{executor::ExecutorBackend, provider::RustackLambda};
+#[cfg(feature = "lambda")]
+use rustack_stepfunctions_core::LambdaTaskPort;
+use rustack_stepfunctions_core::{
+    CallbackError, CallbackLimits, CallbackRegistry, CallbackSupervisor, ExecutionLimits,
+    ExecutionSupervisor, FrameCapacity, FrameLimits, HistoryLimits, Registry, RegistryCapacities,
+    RegistryError, RegistryLimits, RegistrySupervisor, RuntimeLimits, StateSupport, TaskSupport,
+    TenantScope,
+};
+use serde_json::{Value, json};
+use tokio::time::Instant;
+
+use crate::snapshot::workflows::{ArchiveSupervisor, WorkflowArchive};
+
+/// Shared health reads never acquire business admission or unique controllers.
+#[derive(Debug, Clone)]
+pub(crate) struct WorkflowStatus {
+    api: Arc<StepFunctionsApi>,
+    registry: Registry,
+    budgets: RuntimeBudgets,
+    archive: WorkflowArchive,
+    callbacks: Option<CallbackRegistry>,
+    #[cfg(feature = "lambda")]
+    port: Option<Arc<StepFunctionsLambdaBridge>>,
+}
+impl WorkflowStatus {
+    pub(crate) fn is_ready(&self) -> bool {
+        let ready = self.archive.is_ready()
+            && self.api.is_ready()
+            && self.registry.status().ready
+            && self
+                .callbacks
+                .as_ref()
+                .is_none_or(|callbacks| callbacks.status().ready);
+        #[cfg(feature = "lambda")]
+        let ready = ready && self.port.as_ref().is_none_or(|port| port.is_ready());
+        ready
+    }
+    pub(crate) fn capabilities(&self) -> Value {
+        #[cfg(feature = "lambda")]
+        let lambda = self.port.is_some();
+        #[cfg(not(feature = "lambda"))]
+        let lambda = false;
+        let limits = json!({
+            "apiAccepted": self.budgets.workflow_api_accepted,
+            "apiWorkers": self.budgets.workflow_api_workers,
+            "paginationBytes": self.budgets.workflow_pagination_bytes,
+            "paginationTokens": self.budgets.workflow_pagination_tokens,
+            "machines": self.budgets.workflow_registry_machines,
+            "versions": self.budgets.workflow_registry_versions,
+            "records": self.budgets.workflow_registry_records,
+            "commands": self.budgets.workflow_registry_commands,
+            "nameTombstones": self.budgets.workflow_name_tombstones,
+            "retentionSeconds": self.budgets.workflow_retention_seconds,
+            "openExecutions": self.budgets.workflow_open_executions,
+            "evaluations": self.budgets.workflow_evaluations,
+            "dispatches": self.budgets.workflow_dispatches,
+            "maxDurationSeconds": self.budgets.workflow_max_duration_seconds,
+            "transitions": self.budgets.workflow_transitions,
+            "frames": self.budgets.workflow_frames,
+            "framesPerExecution": self.budgets.workflow_frames_per_execution,
+            "resultBytes": self.budgets.workflow_result_bytes,
+            "resultBytesPerExecution": self.budgets.workflow_result_bytes_per_execution,
+            "historyEvents": 25000, "historyBytes": self.budgets.workflow_history_bytes,
+            "totalHistoryBytes": self.budgets.workflow_total_history_bytes,
+            "snapshotBytes": self.budgets.workflow_snapshot_bytes,
+            "lambdaAcceptedCalls": self.budgets.workflow_lambda_accepted_calls,
+            "lambdaCleanupSeconds": self.budgets.workflow_lambda_cleanup_seconds,
+            "drainSeconds": self.budgets.workflow_drain_seconds,
+            "callbackTokens": self.budgets.workflow_callback_tokens,
+            "callbackTombstones": self.budgets.workflow_callback_tombstones,
+            "callbackCommands": self.budgets.workflow_callback_commands,
+            "callbackWorkers": self.budgets.workflow_callback_workers,
+            "callbackRetentionSeconds": self.budgets.workflow_retention_seconds
+        });
+        json!({
+            "type": "STANDARD", "queryLanguage": "JSONPath",
+            "stateTypes": ["Pass", "Choice", "Wait", "Task", "Succeed", "Fail", "Parallel", "Map"],
+            "inlineMapMaxConcurrency": 40,
+            "lambdaRequestResponse": lambda, "nestedSync": true, "callbacks": self.registry.callback_support(),
+            "snapshot": "resources-and-history", "snapshotResume": false, "paginationEpoch": "fresh-on-restart", "dockerQualified": false,
+            "limits": limits
+        })
+    }
+}
+#[derive(Debug, Clone, Copy)]
+enum Phase {
+    Accepting,
+    Api(Instant),
+    ClosingApi,
+    Grace(Instant),
+    Registry,
+    Callbacks,
+    Bridge,
+    Done,
+}
+/// Kept by main, outside `Arc<RuntimeWorkers>`; never protected by a mutex.
+#[derive(Debug)]
+pub(crate) struct WorkflowSupervisor {
+    api: ApiSupervisor,
+    archive: ArchiveSupervisor,
+    registry: RegistrySupervisor,
+    status: WorkflowStatus,
+    callbacks: Option<CallbackSupervisor>,
+    #[cfg(feature = "lambda")]
+    bridge: Option<LambdaBridgeSupervisor>,
+    phase: Phase,
+    failure: Option<WorkflowFailure>,
+}
+#[derive(Clone)]
+struct WorkflowFailure(Arc<anyhow::Error>);
+impl fmt::Display for WorkflowFailure {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("workflow cleanup failed")
+    }
+}
+impl fmt::Debug for WorkflowFailure {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, formatter)
+    }
+}
+impl Error for WorkflowFailure {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        Some(self.0.as_ref().as_ref())
+    }
+}
+pub(crate) struct WorkflowRuntime {
+    pub(crate) api: Arc<StepFunctionsApi>,
+    pub(crate) archive: WorkflowArchive,
+    pub(crate) status: WorkflowStatus,
+    pub(crate) owner: WorkflowSupervisor,
+}
+impl WorkflowRuntime {
+    pub(crate) fn new(
+        scope: TenantScope,
+        budgets: RuntimeBudgets,
+        #[cfg(feature = "lambda")] provider: Option<Arc<RustackLambda>>,
+    ) -> Result<Self> {
+        budgets.validate().context("validate workflow budgets")?;
+        #[cfg(feature = "lambda")]
+        let (port, bridge) =
+            match provider.filter(|p| p.config().executor != ExecutorBackend::Disabled) {
+                Some(provider) => {
+                    let (port, owner) = StepFunctionsLambdaBridge::new(
+                        provider,
+                        scope.clone(),
+                        BridgeLimits::new(
+                            budgets.workflow_lambda_accepted_calls,
+                            Duration::from_secs(budgets.workflow_lambda_cleanup_seconds),
+                        )?,
+                    )?;
+                    (Some(port), Some(owner))
+                }
+                None => (None, None),
+            };
+        #[cfg(feature = "lambda")]
+        let task_port = port
+            .as_ref()
+            .map(|port| port.clone() as Arc<dyn LambdaTaskPort>);
+        #[cfg(not(feature = "lambda"))]
+        let task_port = None;
+        let tasks = if task_port.is_some() {
+            TaskSupport::Lambda
+        } else {
+            TaskSupport::Disabled
+        };
+        let mut runtime = ExecutionSupervisor::new_with_frames(
+            RuntimeLimits::new(
+                budgets.workflow_open_executions,
+                budgets.workflow_dispatches,
+                budgets.workflow_evaluations,
+            )?,
+            HistoryLimits::new(25000, budgets.workflow_history_bytes)?,
+            budgets.workflow_total_history_bytes,
+            task_port,
+            Arc::new(FrameCapacity::new(
+                budgets.workflow_frames,
+                budgets.workflow_result_bytes,
+            )?),
+            FrameLimits::new(
+                budgets.workflow_frames_per_execution,
+                budgets.workflow_result_bytes_per_execution,
+            )?,
+        )?;
+        let (callbacks, callback_owner) =
+            callback_runtime(&scope, &budgets, &mut runtime, tasks)?.unzip();
+        let (registry, owner) = Registry::new_with_state_support(
+            scope.clone(),
+            RegistryLimits::new(
+                RegistryCapacities::new(
+                    budgets.workflow_registry_machines,
+                    budgets.workflow_registry_versions,
+                    budgets.workflow_registry_records,
+                    budgets.workflow_name_tombstones,
+                )?,
+                Duration::from_secs(budgets.workflow_retention_seconds),
+                budgets.workflow_registry_commands,
+            )?,
+            runtime,
+            ExecutionLimits::new(
+                Duration::from_secs(budgets.workflow_max_duration_seconds),
+                budgets.workflow_transitions,
+            )?,
+            StateSupport::Structured,
+        )?;
+        let (api, api_owner) = api_runtime(scope, tasks, registry.clone(), &budgets)?;
+        let (archive, archive_owner) = WorkflowArchive::new(
+            registry.clone(),
+            budgets.workflow_snapshot_bytes,
+            Duration::from_secs(budgets.request_seconds),
+        )?;
+        let status = WorkflowStatus {
+            archive: archive.clone(),
+            api: api.clone(),
+            registry,
+            budgets,
+            callbacks,
+            #[cfg(feature = "lambda")]
+            port,
+        };
+        Ok(Self {
+            api,
+            archive,
+            status: status.clone(),
+            owner: WorkflowSupervisor {
+                api: api_owner,
+                archive: archive_owner,
+                registry: owner,
+                status,
+                callbacks: callback_owner,
+                #[cfg(feature = "lambda")]
+                bridge,
+                phase: Phase::Accepting,
+                failure: None,
+            },
+        })
+    }
+}
+fn api_runtime(
+    scope: TenantScope,
+    tasks: TaskSupport,
+    registry: Registry,
+    budgets: &RuntimeBudgets,
+) -> Result<(Arc<StepFunctionsApi>, ApiSupervisor)> {
+    Ok(StepFunctionsApi::new(
+        scope,
+        tasks,
+        registry,
+        ApiLimits::new(
+            budgets.workflow_api_accepted,
+            budgets.workflow_api_workers,
+            budgets.workflow_pagination_tokens,
+            budgets.workflow_pagination_bytes,
+        )?,
+    )?)
+}
+fn callback_runtime(
+    scope: &TenantScope,
+    budgets: &RuntimeBudgets,
+    runtime: &mut ExecutionSupervisor,
+    tasks: TaskSupport,
+) -> Result<Option<(CallbackRegistry, CallbackSupervisor)>> {
+    if tasks != TaskSupport::Lambda {
+        return Ok(None);
+    }
+    let (callbacks, owner) = CallbackRegistry::new(
+        scope.clone(),
+        CallbackLimits::new(
+            budgets.workflow_callback_tokens,
+            budgets.workflow_callback_tombstones,
+            budgets.workflow_callback_commands,
+            budgets.workflow_callback_workers,
+            Duration::from_secs(budgets.workflow_retention_seconds),
+        )?,
+    )?;
+    runtime.install_callbacks(callbacks.clone())?;
+    Ok(Some((callbacks, owner)))
+}
+
+impl WorkflowSupervisor {
+    /// Resume the same controllers; a dropped/expired observer never restarts grace.
+    pub(crate) async fn quiesce(&mut self, deadline: Instant) -> Result<()> {
+        if matches!(self.phase, Phase::Accepting) {
+            let cutoff =
+                Instant::now() + Duration::from_secs(self.status.budgets.workflow_drain_seconds);
+            self.api.close();
+            self.phase = Phase::Api(cutoff);
+        }
+        loop {
+            match self.phase {
+                Phase::Accepting => anyhow::bail!("workflow shutdown phase invariant failed"),
+                Phase::Api(_) | Phase::ClosingApi => {
+                    let cutoff = if let Phase::Api(cutoff) = self.phase {
+                        Some(cutoff)
+                    } else {
+                        None
+                    };
+                    match self.api.shutdown(deadline).await {
+                        Ok(()) => {}
+                        Err(ApiError::Deadline) => {
+                            anyhow::bail!("workflow API shutdown observation expired")
+                        }
+                        Err(error) => self.fail(error.into()),
+                    }
+                    self.phase = cutoff.map_or(Phase::Registry, Phase::Grace);
+                }
+                Phase::Grace(cutoff) => {
+                    match self.status.registry.wait_idle(cutoff.min(deadline)).await {
+                        Err(RegistryError::Deadline) if Instant::now() < cutoff => {
+                            anyhow::bail!("workflow grace observation expired")
+                        }
+                        Ok(()) | Err(RegistryError::Deadline) => {}
+                        Err(error) => self.fail(error.into()),
+                    }
+                    self.phase = Phase::Registry;
+                }
+                Phase::Registry => {
+                    match self.registry.shutdown(deadline).await {
+                        Ok(()) => {}
+                        Err(RegistryError::Deadline) => {
+                            anyhow::bail!("workflow registry shutdown observation expired")
+                        }
+                        Err(error) => self.fail(error.into()),
+                    }
+                    self.phase = Phase::Callbacks;
+                }
+                Phase::Callbacks => {
+                    if let Some(callbacks) = &mut self.callbacks {
+                        match callbacks.shutdown(deadline).await {
+                            Ok(()) => {}
+                            Err(CallbackError::Deadline) => {
+                                anyhow::bail!("workflow callback shutdown observation expired")
+                            }
+                            Err(error) => self.fail(error.into()),
+                        }
+                    }
+                    self.phase = Phase::Bridge;
+                }
+                Phase::Bridge => {
+                    #[cfg(feature = "lambda")]
+                    if let Some(bridge) = &mut self.bridge {
+                        if let Err(error) = bridge.shutdown(deadline).await {
+                            if matches!(*error, BridgeError::Deadline) {
+                                anyhow::bail!("workflow bridge shutdown observation expired");
+                            }
+                            self.fail(anyhow::anyhow!(error));
+                        }
+                    }
+                    self.phase = Phase::Done;
+                }
+                Phase::Done => {
+                    return match &self.failure {
+                        Some(error) => Err(error.clone().into()),
+                        None => Ok(()),
+                    };
+                }
+            }
+        }
+    }
+    /// Final cleanup skips grace and signals every owner on observer expiry.
+    pub(crate) async fn shutdown(&mut self, deadline: Instant) -> Result<()> {
+        self.api.close();
+        self.phase = match self.phase {
+            Phase::Accepting | Phase::Api(_) => Phase::ClosingApi,
+            Phase::Grace(_) => Phase::Registry,
+            phase => phase,
+        };
+        let archive = self.archive.shutdown(deadline).await;
+        // A lost archive observer may still own preparation or an accepted commit.
+        // Attempt the remaining controllers even when its final join fails.
+        let result = self.quiesce(deadline).await.and(archive);
+        if result.is_err() {
+            // No successful consistency cut is claimed; cancel retained owners
+            // before main attempts provider destruction under the same deadline.
+            self.registry.close();
+            if let Some(callbacks) = &self.callbacks {
+                callbacks.close();
+            }
+            #[cfg(feature = "lambda")]
+            if let Some(bridge) = &self.bridge {
+                bridge.close();
+            }
+        }
+        result
+    }
+    fn fail(&mut self, error: anyhow::Error) {
+        if self.failure.is_none() {
+            self.failure = Some(WorkflowFailure(Arc::new(error)));
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests;
diff --git a/apps/rustack/src/workflows/tests.rs b/apps/rustack/src/workflows/tests.rs
new file mode 100644
index 00000000..7be2e8fd
--- /dev/null
+++ b/apps/rustack/src/workflows/tests.rs
@@ -0,0 +1,528 @@
+//! Real controller composition, observer loss and admission-independent health.
+
+use bytes::Bytes;
+use http::{Request, StatusCode};
+use http_body_util::{BodyExt, Full};
+use rustack_stepfunctions_core::{ExecutionOutcome, RegistryCommand, RegistryResult};
+use rustack_stepfunctions_http::{RequestScope, StepFunctionsHttpConfig, StepFunctionsHttpService};
+use serde_json::json;
+
+use super::*;
+
+pub(crate) fn runtime(budgets: RuntimeBudgets) -> Result<WorkflowRuntime> {
+    WorkflowRuntime::new(
+        TenantScope::default(),
+        budgets,
+        #[cfg(feature = "lambda")]
+        None,
+    )
+}
+pub(crate) async fn request(
+    api: Arc<StepFunctionsApi>,
+    operation: &str,
+    body: Value,
+) -> Result<(StatusCode, Value)> {
+    let config = StepFunctionsHttpConfig::new(
+        RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into())?,
+        true,
+        None,
+    )?;
+    let service = StepFunctionsHttpService::new(api, config);
+    let request = Request::builder()
+        .method("POST")
+        .uri("/")
+        .header("x-amz-target", format!("AWSStepFunctions.{operation}"))
+        .header("content-type", "application/x-amz-json-1.0")
+        .body(Full::new(Bytes::from(serde_json::to_vec(&body)?)))?;
+    let response = service.handle(request).await;
+    let status = response.status();
+    let body = response.into_body().collect().await?.to_bytes();
+    Ok((
+        status,
+        if body.is_empty() {
+            Value::Null
+        } else {
+            serde_json::from_slice(&body)?
+        },
+    ))
+}
+pub(crate) async fn start(
+    runtime: &WorkflowRuntime,
+    seconds: u32,
+) -> Result<rustack_stepfunctions_core::ExecutionSnapshot> {
+    let definition =
+        json!({"StartAt":"Wait", "States":{"Wait":{"Type":"Wait","Seconds":seconds,"End":true}}})
+            .to_string();
+    let (status, created) = request(runtime.api.clone(), "CreateStateMachine", json!({"name":"Machine","roleArn":"arn:aws:iam::000000000000:role/Test","definition":definition})).await?;
+    assert_eq!(status, StatusCode::OK, "{created}");
+    let (status, started) = request(runtime.api.clone(), "StartExecution", json!({"stateMachineArn":created["stateMachineArn"],"name":"Run","input":"{\"answer\":42}"})).await?;
+    assert_eq!(status, StatusCode::OK, "{started}");
+    let arn = started["executionArn"]
+        .as_str()
+        .context("execution ARN")?
+        .parse()?;
+    let mut receipt = runtime
+        .status
+        .registry
+        .submit(RegistryCommand::Execution(arn))?;
+    let RegistryResult::Execution(snapshot) = receipt
+        .wait(Instant::now() + Duration::from_secs(5))
+        .await?
+    else {
+        anyhow::bail!("unexpected capture")
+    };
+    Ok(snapshot)
+}
+#[tokio::test]
+async fn test_should_finish_accepted_execution_during_grace_before_registry_close() -> Result<()> {
+    let mut runtime = runtime(RuntimeBudgets::default())?;
+    let snapshot = start(&runtime, 1).await?;
+    assert!(runtime.status.is_ready());
+    assert_eq!(runtime.status.registry.status().owned_executions, 1);
+    runtime
+        .owner
+        .quiesce(Instant::now() + Duration::from_secs(10))
+        .await?;
+    assert!(!runtime.status.is_ready());
+    let complete = snapshot
+        .wait(Instant::now() + Duration::from_secs(1))
+        .await?;
+    assert!(matches!(
+        complete.view().outcome().map(Arc::as_ref),
+        Some(ExecutionOutcome::Succeeded(_))
+    ));
+    assert_eq!(
+        complete.view().cleanup(),
+        rustack_stepfunctions_core::CleanupState::Clean
+    );
+    runtime
+        .owner
+        .quiesce(Instant::now() + Duration::from_secs(1))
+        .await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_resume_same_grace_after_cancelled_shutdown_observer() -> Result<()> {
+    let mut runtime = runtime(RuntimeBudgets::default())?;
+    let snapshot = start(&runtime, 3600).await?;
+    tokio::time::pause();
+    let deadline = Instant::now() + Duration::from_secs(100);
+    assert!(
+        tokio::time::timeout(Duration::from_millis(1), runtime.owner.quiesce(deadline))
+            .await
+            .is_err()
+    );
+    let Phase::Grace(cutoff) = runtime.owner.phase else {
+        anyhow::bail!("grace not reached")
+    };
+    assert!(!runtime.status.is_ready());
+    tokio::time::advance(cutoff.saturating_duration_since(Instant::now())).await;
+    runtime.owner.quiesce(deadline).await?;
+    let complete = snapshot.wait(deadline).await?;
+    let Some(ExecutionOutcome::Aborted(failure)) = complete.view().outcome().map(Arc::as_ref)
+    else {
+        anyhow::bail!("execution was not aborted")
+    };
+    assert_eq!(failure.details().error(), Some("Rustack.Shutdown"));
+    let page = complete.view().history().page(1, 100, true)?;
+    assert!(page.events().iter().any(|event| {
+        event
+            .execution_aborted_event_details
+            .as_ref()
+            .is_some_and(|details| details.error.as_deref() == Some("Rustack.Shutdown"))
+    }));
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_preserve_grace_cutoff_after_expired_observer() -> Result<()> {
+    let mut runtime = runtime(RuntimeBudgets::default())?;
+    let snapshot = start(&runtime, 3600).await?;
+    tokio::time::pause();
+    assert!(
+        runtime
+            .owner
+            .quiesce(Instant::now() + Duration::from_millis(10))
+            .await
+            .is_err()
+    );
+    let Phase::Grace(cutoff) = runtime.owner.phase else {
+        anyhow::bail!("grace not retained")
+    };
+    tokio::time::advance(Duration::from_secs(6)).await;
+    runtime
+        .owner
+        .quiesce(Instant::now() + Duration::from_secs(10))
+        .await?;
+    assert!(Instant::now() >= cutoff);
+    assert!(matches!(
+        snapshot
+            .wait(Instant::now() + Duration::from_secs(1))
+            .await?
+            .view()
+            .outcome()
+            .map(Arc::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_read_health_when_registry_command_admission_is_full() -> Result<()> {
+    let mut budgets = RuntimeBudgets::default();
+    budgets.workflow_registry_commands = 1;
+    let mut runtime = runtime(budgets)?;
+    let mut receipt = runtime.status.registry.submit(RegistryCommand::Machines)?;
+    assert!(matches!(
+        runtime.status.registry.submit(RegistryCommand::Machines),
+        Err(RegistryError::Capacity)
+    ));
+    assert!(runtime.status.is_ready());
+    receipt
+        .wait(Instant::now() + Duration::from_secs(5))
+        .await?;
+    runtime
+        .owner
+        .quiesce(Instant::now() + Duration::from_secs(5))
+        .await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_report_pure_profile_and_reject_lambda_without_actual_port() -> Result<()> {
+    let mut runtime = runtime(RuntimeBudgets::default())?;
+    let capabilities = runtime.status.capabilities();
+    assert_eq!(capabilities["lambdaRequestResponse"], false);
+    assert_eq!(capabilities["snapshot"], "resources-and-history");
+    assert_eq!(capabilities["dockerQualified"], false);
+    assert_eq!(capabilities["limits"]["apiWorkers"], 8);
+    assert_eq!(capabilities["nestedSync"], true);
+    assert_eq!(capabilities["callbacks"], false);
+    assert!(runtime.status.callbacks.is_none());
+    let child = json!({"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}});
+    let (status, created) = request(runtime.api.clone(), "CreateStateMachine", json!({"name":"PureChild","definition":child.to_string(),"roleArn":"arn:aws:iam::000000000000:role/Test"})).await?;
+    assert_eq!(status, StatusCode::OK, "{created}");
+    let parent = json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::states:startExecution.sync:2","Parameters":{"StateMachineArn":created["stateMachineArn"],"Input":{"answer":42}},"End":true}}});
+    let (status, created) = request(runtime.api.clone(), "CreateStateMachine", json!({"name":"PureParent","definition":parent.to_string(),"roleArn":"arn:aws:iam::000000000000:role/Test"})).await?;
+    assert_eq!(status, StatusCode::OK, "{created}");
+    let (status, started) = request(
+        runtime.api.clone(),
+        "StartExecution",
+        json!({"stateMachineArn":created["stateMachineArn"],"input":"{}"}),
+    )
+    .await?;
+    assert_eq!(status, StatusCode::OK, "{started}");
+    let arn = started["executionArn"]
+        .as_str()
+        .context("nested execution ARN")?
+        .parse()?;
+    let RegistryResult::Execution(snapshot) = runtime
+        .status
+        .registry
+        .submit(RegistryCommand::Execution(arn))?
+        .wait(Instant::now() + Duration::from_secs(5))
+        .await?
+    else {
+        anyhow::bail!("nested execution missing");
+    };
+    let complete = snapshot
+        .wait(Instant::now() + Duration::from_secs(5))
+        .await?;
+    assert!(
+        matches!(complete.view().outcome().map(Arc::as_ref), Some(ExecutionOutcome::Succeeded(output)) if output.value()["Output"] == json!({"answer":42}))
+    );
+    let definition = json!({"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Fn","End":true}}}).to_string();
+    let (status, body) = request(runtime.api.clone(), "CreateStateMachine", json!({"name":"Task","definition":definition,"roleArn":"arn:aws:iam::000000000000:role/Test"})).await?;
+    assert_eq!(status, StatusCode::BAD_REQUEST, "{body}");
+    runtime
+        .owner
+        .quiesce(Instant::now() + Duration::from_secs(5))
+        .await?;
+    Ok(())
+}
+#[cfg(feature = "lambda")]
+#[tokio::test]
+async fn test_should_install_only_registered_selected_actual_lambda_provider() -> Result<()> {
+    use rustack_lambda_core::config::LambdaConfig;
+
+    let config =
+        LambdaConfig::from_lookup(|key| (key == "LAMBDA_EXECUTOR").then(|| "native".to_owned()))?;
+    let provider = Arc::new(RustackLambda::new(config));
+    let mut runtime = WorkflowRuntime::new(
+        TenantScope::default(),
+        RuntimeBudgets::default(),
+        Some(provider.clone()),
+    )?;
+    assert_eq!(runtime.status.capabilities()["lambdaRequestResponse"], true);
+    assert_eq!(runtime.status.capabilities()["callbacks"], true);
+    assert_eq!(
+        runtime.status.capabilities()["limits"]["callbackTokens"],
+        4096
+    );
+    assert_eq!(
+        runtime.status.capabilities()["limits"]["callbackTombstones"],
+        100_000
+    );
+    assert_eq!(
+        runtime.status.capabilities()["limits"]["callbackCommands"],
+        1024
+    );
+    assert_eq!(
+        runtime.status.capabilities()["limits"]["callbackWorkers"],
+        8
+    );
+    assert_eq!(
+        runtime.status.capabilities()["limits"]["callbackRetentionSeconds"],
+        86_400
+    );
+    assert!(runtime.status.is_ready());
+    let callback = json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","Parameters":{"FunctionName":"Missing","Payload":{"token.$":"$$.Task.Token"}},"End":true}}});
+    assert_eq!(request(runtime.api.clone(),"CreateStateMachine",json!({"name":"Callback","roleArn":"arn:aws:iam::000000000000:role/Test","definition":callback.to_string()})).await?.0,StatusCode::OK);
+    assert_eq!(
+        request(
+            runtime.api.clone(),
+            "SendTaskHeartbeat",
+            json!({"taskToken":"a".repeat(64)})
+        )
+        .await?
+        .1["__type"],
+        "InvalidToken"
+    );
+    runtime
+        .owner
+        .quiesce(Instant::now() + Duration::from_secs(5))
+        .await?;
+    provider.quiesce(Duration::from_secs(5)).await?;
+    provider.shutdown().await;
+    assert!(
+        !runtime
+            .status
+            .callbacks
+            .as_ref()
+            .context("callback root")?
+            .status()
+            .ready
+    );
+    Ok(())
+}
+
+#[cfg(feature = "lambda")]
+#[tokio::test]
+async fn test_should_reject_unqualified_manual_docker_provider() {
+    use rustack_lambda_core::config::LambdaConfig;
+
+    let provider = Arc::new(RustackLambda::new(LambdaConfig {
+        executor: ExecutorBackend::Docker,
+        ..LambdaConfig::default()
+    }));
+    assert!(
+        WorkflowRuntime::new(
+            TenantScope::default(),
+            RuntimeBudgets::default(),
+            Some(provider)
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn test_should_retain_typed_cleanup_source_and_redact_debug() {
+    let failure = WorkflowFailure(Arc::new(anyhow::anyhow!("sensitive-marker")));
+    assert!(!format!("{failure:?}").contains("sensitive-marker"));
+    assert!(failure.source().is_some());
+}
+
+#[cfg(feature = "lambda")]
+#[tokio::test]
+async fn test_should_observe_callback_failure_without_business_admission_and_resume_same_callback_join()
+-> Result<()> {
+    use rustack_lambda_core::config::LambdaConfig;
+
+    let config =
+        LambdaConfig::from_lookup(|key| (key == "LAMBDA_EXECUTOR").then(|| "native".to_owned()))?;
+    let provider = Arc::new(RustackLambda::new(config));
+    let mut budgets = RuntimeBudgets::default();
+    budgets.workflow_registry_commands = 1;
+    budgets.workflow_callback_tokens = 2;
+    budgets.workflow_callback_tombstones = 3;
+    budgets.workflow_callback_commands = 4;
+    budgets.workflow_callback_workers = 1;
+    let mut runtime =
+        WorkflowRuntime::new(TenantScope::default(), budgets, Some(provider.clone()))?;
+    let callbacks = runtime
+        .status
+        .callbacks
+        .clone()
+        .context("callback handle")?;
+    let receipt = runtime.status.registry.submit(RegistryCommand::Machines)?;
+    assert!(runtime.status.is_ready());
+    runtime
+        .owner
+        .callbacks
+        .as_ref()
+        .context("callback controller")?
+        .close();
+    assert!(!callbacks.status().ready);
+    assert!(!runtime.status.is_ready());
+    assert_eq!(runtime.status.capabilities()["limits"]["callbackTokens"], 2);
+    assert_eq!(
+        runtime.status.capabilities()["limits"]["callbackTombstones"],
+        3
+    );
+    assert_eq!(
+        request(
+            runtime.api.clone(),
+            "SendTaskHeartbeat",
+            json!({"taskToken":"a".repeat(64)})
+        )
+        .await?
+        .1["__type"],
+        "ServiceUnavailable"
+    );
+    drop(receipt);
+    let deadline = Instant::now() + Duration::from_secs(5);
+    runtime.owner.api.shutdown(deadline).await?;
+    runtime.owner.registry.shutdown(deadline).await?;
+    runtime.owner.phase = Phase::Callbacks;
+    assert!(runtime.owner.quiesce(Instant::now()).await.is_err());
+    assert!(matches!(runtime.owner.phase, Phase::Callbacks));
+    runtime.owner.quiesce(deadline).await?;
+    assert!(matches!(runtime.owner.phase, Phase::Done));
+    provider.quiesce(Duration::from_secs(5)).await?;
+    provider.shutdown().await;
+    Ok(())
+}
+
+#[cfg(feature = "lambda")]
+#[tokio::test]
+async fn test_should_signal_callback_root_when_final_shutdown_observation_expires() -> Result<()> {
+    use rustack_lambda_core::config::LambdaConfig;
+
+    let config =
+        LambdaConfig::from_lookup(|key| (key == "LAMBDA_EXECUTOR").then(|| "native".to_owned()))?;
+    let provider = Arc::new(RustackLambda::new(config));
+    let mut runtime = WorkflowRuntime::new(
+        TenantScope::default(),
+        RuntimeBudgets::default(),
+        Some(provider.clone()),
+    )?;
+    let callbacks = runtime
+        .status
+        .callbacks
+        .clone()
+        .context("callback handle")?;
+    assert!(runtime.owner.shutdown(Instant::now()).await.is_err());
+    assert!(!callbacks.status().ready);
+    assert!(!runtime.status.is_ready());
+    assert!(!matches!(
+        runtime.owner.phase,
+        Phase::Accepting | Phase::Done
+    ));
+    runtime
+        .owner
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await?;
+    assert!(matches!(runtime.owner.phase, Phase::Done));
+    provider.quiesce(Duration::from_secs(5)).await?;
+    provider.shutdown().await;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_skip_grace_on_final_cleanup_and_cancel_before_provider_destruction()
+-> Result<()> {
+    let mut budgets = RuntimeBudgets::default();
+    budgets.workflow_drain_seconds = 60;
+    let mut runtime = runtime(budgets)?;
+    let snapshot = start(&runtime, 3600).await?;
+    runtime
+        .owner
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await?;
+    assert!(matches!(runtime.owner.phase, Phase::Done));
+    let complete = snapshot
+        .wait(Instant::now() + Duration::from_secs(1))
+        .await?;
+    assert!(
+        matches!(complete.view().outcome().map(Arc::as_ref), Some(ExecutionOutcome::Aborted(failure)) if failure.details().error() == Some("Rustack.Shutdown"))
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_compile_validate_update_and_execute_structured_profile_through_real_api()
+-> Result<()> {
+    let mut budgets = RuntimeBudgets::default();
+    budgets.workflow_frames = 16;
+    budgets.workflow_frames_per_execution = 8;
+    budgets.workflow_result_bytes = 2 * 1024 * 1024;
+    budgets.workflow_result_bytes_per_execution = 1024 * 1024;
+    let mut runtime = runtime(budgets)?;
+    let result = async {
+        let definition = json!({"StartAt":"M","States":{"M":{"Type":"Map","ItemProcessor":{"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}},"End":true}}}).to_string();
+        let (status, validated) = request(runtime.api.clone(), "ValidateStateMachineDefinition", json!({"definition":definition})).await?;
+        assert_eq!(status, StatusCode::OK, "{validated}");
+        assert_eq!(validated["result"], "OK");
+        let (status, created) = request(runtime.api.clone(), "CreateStateMachine", json!({"name":"Structured","roleArn":"arn:aws:iam::000000000000:role/Test","definition":definition})).await?;
+        assert_eq!(status, StatusCode::OK, "{created}");
+        let definition = json!({"StartAt":"P","States":{"P":{"Type":"Parallel","Branches":[serde_json::from_str::<Value>(&definition)?,serde_json::from_str::<Value>(&definition)?],"End":true}}}).to_string();
+        let (status, updated) = request(runtime.api.clone(), "UpdateStateMachine", json!({"stateMachineArn":created["stateMachineArn"],"definition":definition})).await?;
+        assert_eq!(status, StatusCode::OK, "{updated}");
+        let (status, started) = request(runtime.api.clone(), "StartExecution", json!({"stateMachineArn":created["stateMachineArn"],"input":"[1,null,3]"})).await?;
+        assert_eq!(status, StatusCode::OK, "{started}");
+        let arn = started["executionArn"].as_str().context("execution ARN")?.parse()?;
+        let RegistryResult::Execution(snapshot) = runtime.status.registry.submit(RegistryCommand::Execution(arn))?.wait(Instant::now()+Duration::from_secs(5)).await? else { anyhow::bail!("missing execution"); };
+        let complete = snapshot.wait(Instant::now()+Duration::from_secs(5)).await?;
+        assert!(matches!(complete.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(value)) if value.value()==&json!([[1,null,3],[1,null,3]])));
+        let capabilities = runtime.status.capabilities();
+        assert_eq!(capabilities["stateTypes"].as_array().context("states")?.len(), 8);
+        assert_eq!(capabilities["inlineMapMaxConcurrency"], 40);
+        assert_eq!(capabilities["limits"]["frames"], 16);
+        assert_eq!(capabilities["limits"]["framesPerExecution"], 8);
+        assert_eq!(capabilities["limits"]["resultBytes"], 2*1024*1024);
+        assert_eq!(capabilities["limits"]["resultBytesPerExecution"], 1024*1024);
+        let invalid = json!({"StartAt":"M","States":{"M":{"Type":"Map","ItemProcessor":{"ProcessorConfig":{"Mode":"DISTRIBUTED"},"StartAt":"D","States":{"D":{"Type":"Succeed"}}},"End":true}}}).to_string();
+        let (_, validation) = request(runtime.api.clone(), "ValidateStateMachineDefinition", json!({"definition":invalid})).await?;
+        assert_eq!(validation["result"], "FAIL");
+        Ok(())
+    }.await;
+    runtime
+        .owner
+        .quiesce(Instant::now() + Duration::from_secs(10))
+        .await?;
+    result
+}
+
+#[tokio::test]
+async fn test_should_enforce_configured_frame_and_result_limits_in_public_execution_view()
+-> Result<()> {
+    for (frames, bytes, expected) in [
+        (1, 1024 * 1024, "Rustack.FrameLimitExceeded"),
+        (8, 4096, "Rustack.ResultLimitExceeded"),
+    ] {
+        let mut budgets = RuntimeBudgets::default();
+        budgets.workflow_frames = frames;
+        budgets.workflow_frames_per_execution = frames;
+        budgets.workflow_result_bytes = bytes;
+        budgets.workflow_result_bytes_per_execution = bytes;
+        let mut runtime = runtime(budgets)?;
+        let result = async {
+            let definition = json!({"StartAt":"P","States":{"P":{"Type":"Parallel","Branches":[{"StartAt":"D","States":{"D":{"Type":"Pass","Result":"x".repeat(3000),"End":true}}}],"End":true}}}).to_string();
+            let (status, created) = request(runtime.api.clone(), "CreateStateMachine", json!({"name":"Quota","roleArn":"arn:aws:iam::000000000000:role/Test","definition":definition})).await?;
+            assert_eq!(status, StatusCode::OK, "{created}");
+            let (status, started) = request(runtime.api.clone(), "StartExecution", json!({"stateMachineArn":created["stateMachineArn"],"name":"Run"})).await?;
+            assert_eq!(status, StatusCode::OK, "{started}");
+            let arn = started["executionArn"].as_str().context("ARN")?.parse()?;
+            let RegistryResult::Execution(snapshot) = runtime.status.registry.submit(RegistryCommand::Execution(arn))?.wait(Instant::now()+Duration::from_secs(5)).await? else { anyhow::bail!("missing execution"); };
+            snapshot.wait(Instant::now()+Duration::from_secs(5)).await?;
+            let (status, described) = request(runtime.api.clone(), "DescribeExecution", json!({"executionArn":started["executionArn"]})).await?;
+            assert_eq!(status, StatusCode::OK, "{described}");
+            assert_eq!(described["status"], "FAILED");
+            assert_eq!(described["error"], expected);
+            Ok(())
+        }.await;
+        runtime
+            .owner
+            .quiesce(Instant::now() + Duration::from_secs(5))
+            .await?;
+        result?;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup.rs b/apps/rustack/tests/docker_startup.rs
new file mode 100644
index 00000000..c29f0d2d
--- /dev/null
+++ b/apps/rustack/tests/docker_startup.rs
@@ -0,0 +1,698 @@
+//! Ordinary binary qualification; no injected readiness or replacement executor.
+#![cfg(all(unix, feature = "lambda", feature = "stepfunctions"))]
+#![forbid(unsafe_code)]
+
+#[path = "docker_startup/archive.rs"]
+mod archive;
+#[path = "docker_startup/archive_rejection.rs"]
+mod archive_rejection;
+#[path = "docker_startup/callback.rs"]
+mod callback;
+#[path = "docker_startup/container_server.rs"]
+mod container_server;
+#[path = "docker_startup/custom.rs"]
+mod custom;
+#[path = "docker_startup/faults.rs"]
+mod faults;
+#[path = "docker_startup/handler_sdk.rs"]
+mod handler_sdk;
+#[path = "docker_startup/iac.rs"]
+mod iac;
+#[path = "docker_startup/image_sdk.rs"]
+mod image_sdk;
+#[path = "docker_startup/io_faults.rs"]
+mod io_faults;
+#[path = "docker_startup/node.rs"]
+mod node;
+#[path = "docker_startup/performance.rs"]
+mod performance;
+#[path = "docker_startup/process.rs"]
+mod process;
+#[path = "docker_startup/provided.rs"]
+mod provided;
+#[path = "docker_startup/provided_archive.rs"]
+mod provided_archive;
+#[path = "docker_startup/recovery_gate.rs"]
+mod recovery_gate;
+#[path = "workflows_sdk/runner.rs"]
+mod runner;
+#[path = "docker_startup/sdk.rs"]
+mod sdk;
+
+use std::{
+    collections::BTreeMap,
+    env,
+    ffi::OsString,
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use process::{Profile, Server};
+use rstest::rstest;
+use sha2::{Digest, Sha256};
+use tokio::{
+    fs,
+    io::AsyncReadExt,
+    time::{Instant, timeout},
+};
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit Linux server/socket/image prerequisites; run make \
+            test-workflows-server-docker"]
+async fn test_should_execute_image_sdk_and_nested_asl_from_a_server_container() -> Result<()> {
+    container_server::exercise(
+        container_server::Mode::Sdk,
+        container_server::ImageProfile::Fixture,
+    )
+    .await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit Linux server/socket/image prerequisites; run make \
+            test-workflows-server-docker"]
+async fn test_should_refuse_unreachable_server_container_gateway_and_join_startup_cleanup()
+-> Result<()> {
+    container_server::exercise(
+        container_server::Mode::Unreachable,
+        container_server::ImageProfile::Fixture,
+    )
+    .await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit official Node image prerequisites; run make test-lambda-node-docker"]
+async fn test_should_execute_official_node_image_with_signed_sdks_and_asl() -> Result<()> {
+    node::exercise().await
+}
+
+#[rstest]
+#[case::disconnected(Profile::Disconnected)]
+#[case::connected(Profile::Connected)]
+#[case::missing_relay(Profile::MissingRelay)]
+#[case::legacy(Profile::Legacy)]
+#[case::wrong_endpoint(Profile::WrongEndpoint)]
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit two-daemon image prerequisites; run make test-lambda-startup-docker"]
+async fn test_should_qualify_ordinary_binary_and_retain_negative_startup_cleanup(
+    #[case] profile: Profile,
+) -> Result<()> {
+    let mut server = Server::spawn(profile).await?;
+    let result = timeout(Duration::from_secs(360), async {
+        if profile.rejects() {
+            server.failure().await?;
+            return Ok(());
+        }
+        server.ready().await?;
+        sdk::exercise(
+            &server.endpoint,
+            &process::handler()?,
+            &process::architecture()?,
+            profile == Profile::Connected,
+            false,
+        )
+        .await?;
+        ensure!(
+            process::get(&server.endpoint, "/_rustack/capabilities")
+                .await?
+                .1["ready"]
+                == true,
+            "ordinary FunctionError poisoned backend readiness"
+        );
+        if profile == Profile::Disconnected {
+            boto(&server).await?;
+            let before = process::get(&server.endpoint, "/_rustack/runtime-probe")
+                .await?
+                .1;
+            let owner =
+                fs::read(server.path()?.join("data/.rustack-lambda-docker/owner.v1")).await?;
+            server.stop(true).await?;
+            server.audit().await?;
+            server.restart().await?;
+            server.ready().await?;
+            let after = process::get(&server.endpoint, "/_rustack/runtime-probe")
+                .await?
+                .1;
+            ensure!(
+                before["instanceId"] != after["instanceId"],
+                "restart retained stale gateway identity"
+            );
+            ensure!(
+                fs::read(server.path()?.join("data/.rustack-lambda-docker/owner.v1")).await?
+                    == owner,
+                "restart replaced immutable namespace identity"
+            );
+        }
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("ordinary startup SDK observer expired")
+    .and_then(|result| result);
+    let cleanup = server.stop(!profile.rejects()).await;
+    let audit = server.audit().await;
+    if result.is_err() || cleanup.is_err() || audit.is_err() {
+        server.retain_on_error().await;
+    }
+    cleanup?;
+    audit?;
+    result
+}
+async fn boto(server: &Server) -> Result<()> {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let arguments = [
+        root.join("tests/workflows/docker_startup_sdk.py")
+            .into_os_string(),
+        OsString::from(&server.endpoint),
+        OsString::from(process::handler()?),
+        OsString::from(if process::architecture()? == "arm64" {
+            "arm64"
+        } else {
+            "x86_64"
+        }),
+    ];
+    let mut job = runner::Runner::spawn(&runner::interpreter()?, &arguments)?;
+    let barrier = job.await_pid().await;
+    let deadline = if barrier.is_ok() {
+        Instant::now() + Duration::from_secs(180)
+    } else {
+        Instant::now()
+    };
+    let report = job.wait(deadline).await?;
+    let pid = barrier?;
+    ensure!(
+        pid == report.pid && !report.forced && report.status.success(),
+        "ordinary boto3 image exercise failed: {}",
+        String::from_utf8_lossy(&report.stderr)
+    );
+    let value: serde_json::Value = serde_json::from_slice(&report.stdout)?;
+    ensure!(
+        value["computed"] == 42 && value["warmCounter"] == 2 && value["functionError"] == true,
+        "missing boto3 evidence"
+    );
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual production Docker startup; run make test-lambda-startup-docker"]
+async fn test_should_restore_real_image_archive_and_preserve_generations_after_rejection()
+-> Result<()> {
+    let mut server = Server::spawn(Profile::Archive).await?;
+    server
+        .root
+        .as_mut()
+        .context("image archive evidence guard")?
+        .disable_cleanup(true);
+    eprintln!("image archive evidence: {}", server.path()?.display());
+    let result = timeout(Duration::from_secs(360), async {
+        server.ready().await?;
+        sdk::exercise(
+            &server.endpoint,
+            &process::handler()?,
+            &process::architecture()?,
+            false,
+            true,
+        )
+        .await?;
+        let checkpoint = sdk::archive_checkpoint(&server.endpoint).await?;
+        server.stop(true).await?;
+        server.audit().await?;
+        let original = serde_json::to_value(archive::read(server.path()?).await?)?;
+        let snapshots = server.path()?.join("snapshots");
+        let current = snapshots.join("images");
+        let previous = snapshots.join(".images.previous");
+        copy_tree(&current, &previous).await?;
+        server.restart().await?;
+        server.ready().await?;
+        ensure!(
+            !fs::try_exists(&previous).await?,
+            "successful domain import did not retire previous generation"
+        );
+        sdk::verify_archive(&server.endpoint, &checkpoint).await?;
+        server.stop(true).await?;
+        server.audit().await?;
+        ensure!(
+            serde_json::to_value(archive::read(server.path()?).await?)? == original,
+            "restored Lambda metadata/resource/revision identity changed"
+        );
+        copy_tree(&current, &previous).await?;
+        archive::corrupt_size(server.path()?).await?;
+        let before = fingerprint(&snapshots).await?;
+        server.restart().await?;
+        server.failure().await?;
+        ensure!(
+            fingerprint(&snapshots).await? == before,
+            "rejected immutable image proof modified current/previous archive generations"
+        );
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("image archive observer expired")
+    .and_then(|result| result);
+    let cleanup = server.stop(false).await;
+    let audit = server.audit().await;
+    if result.is_err() || cleanup.is_err() || audit.is_err() {
+        server.retain_on_error().await;
+    }
+    cleanup?;
+    audit?;
+    result?;
+    server
+        .root
+        .as_mut()
+        .context("image archive evidence guard")?
+        .disable_cleanup(false);
+    Ok(())
+}
+async fn copy_tree(source: &Path, target: &Path) -> Result<()> {
+    ensure!(
+        !fs::try_exists(target).await?,
+        "previous generation already exists"
+    );
+    let mut queue = vec![(source.to_owned(), target.to_owned())];
+    let mut visited = 0;
+    while let Some((source, target)) = queue.pop() {
+        visited += 1;
+        ensure!(visited <= 128, "fixture directory cap");
+        fs::create_dir_all(&target).await?;
+        let mut entries = fs::read_dir(&source).await?;
+        while let Some(entry) = entries.next_entry().await? {
+            let kind = entry.file_type().await?;
+            if kind.is_dir() {
+                queue.push((entry.path(), target.join(entry.file_name())));
+            } else {
+                ensure!(
+                    kind.is_file(),
+                    "fixture refuses symlink/special archive entry"
+                );
+                fs::copy(entry.path(), target.join(entry.file_name())).await?;
+            }
+        }
+    }
+    Ok(())
+}
+async fn fingerprint(root: &Path) -> Result<BTreeMap<PathBuf, Vec<u8>>> {
+    let mut queue = vec![root.to_owned()];
+    let mut result = BTreeMap::new();
+    let mut total = 0_usize;
+    let mut visited = 0;
+    while let Some(directory) = queue.pop() {
+        visited += 1;
+        ensure!(visited <= 128, "fixture directory cap");
+        let mut entries = fs::read_dir(directory).await?;
+        while let Some(entry) = entries.next_entry().await? {
+            let kind = entry.file_type().await?;
+            if kind.is_dir() {
+                queue.push(entry.path());
+                continue;
+            }
+            ensure!(
+                kind.is_file() && result.len() < 512,
+                "fixture archive file cap/kind"
+            );
+            let mut bytes = Vec::new();
+            fs::File::open(entry.path())
+                .await?
+                .take(16 * 1024 * 1024 + 1)
+                .read_to_end(&mut bytes)
+                .await?;
+            total = total
+                .checked_add(bytes.len())
+                .context("fixture size overflow")?;
+            ensure!(
+                bytes.len() <= 16 * 1024 * 1024 && total <= 64 * 1024 * 1024,
+                "fixture archive byte cap"
+            );
+            result.insert(
+                entry.path().strip_prefix(root)?.to_owned(),
+                Sha256::digest(&bytes).to_vec(),
+            );
+        }
+    }
+    Ok(result)
+}
+
+#[test]
+fn test_should_reject_earlier_startup_failure_as_negative_stage_evidence() {
+    assert!(
+        !Profile::WrongEndpoint.matches_failure("Docker startup probe failed: resource mismatch")
+    );
+    assert!(
+        !Profile::MissingRelay
+            .matches_failure("Docker startup daemon failed: Docker response status 404 Not Found")
+    );
+    assert!(!Profile::MissingRelay.matches_failure(
+        "Docker startup relay preparation failed: Docker response status 500 Internal Server Error"
+    ));
+    assert!(!Profile::ZipArchiveNoSource.matches_failure("Docker ownership profile mismatch"));
+    assert!(!Profile::ZipArchive.matches_failure("Docker startup resource probe failed"));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit custom RIC images and bridge; run make test-lambda-custom-ric-docker"]
+async fn test_should_execute_custom_ric_imageconfig_and_immutable_revisions_through_ordinary_service()
+-> Result<()> {
+    let mut server = Server::spawn(Profile::Connected).await?;
+    // Keep alias intent even if the outer test panics or its future is dropped.
+    server
+        .root
+        .as_mut()
+        .context("custom fixture evidence")?
+        .disable_cleanup(true);
+    eprintln!("custom RIC evidence: {}", server.path()?.display());
+    let result = custom::exercise(&mut server).await;
+    let cleanup = server.stop(true).await;
+    let audit = server.audit().await;
+    if result.is_err() || cleanup.is_err() || audit.is_err() {
+        server.retain_on_error().await;
+    }
+    result?;
+    cleanup?;
+    audit?;
+    server
+        .root
+        .as_mut()
+        .context("custom fixture evidence")?
+        .disable_cleanup(false);
+    Ok(())
+}
+
+#[rstest]
+#[case::typed_faults(faults::Case::Faults)]
+#[case::initializing_disconnect(faults::Case::Initializing)]
+#[case::busy_disconnect(faults::Case::Busy)]
+#[case::accepted_work_shutdown(faults::Case::Saturation)]
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires real Docker fault fixtures; run make test-lambda-faults-docker"]
+async fn test_should_settle_real_image_faults_and_public_cancellation_admission(
+    #[case] case: faults::Case,
+) -> Result<()> {
+    let mut server = Server::spawn(case.profile()).await?;
+    server
+        .root
+        .as_mut()
+        .context("fault evidence guard")?
+        .disable_cleanup(true);
+    eprintln!("fault evidence: {}", server.path()?.display());
+    let result = faults::exercise(&mut server, case).await;
+    let cleanup = server.stop(case != faults::Case::Saturation).await;
+    let audit = server.audit().await;
+    let logs = faults::check_logs(&server).await;
+    if result.is_err() || cleanup.is_err() || audit.is_err() || logs.is_err() {
+        server.retain_on_error().await;
+    }
+    result?;
+    cleanup?;
+    audit?;
+    logs?;
+    server
+        .root
+        .as_mut()
+        .context("fault evidence guard")?
+        .disable_cleanup(false);
+    Ok(())
+}
+
+#[rstest]
+#[case::allocating(io_faults::Case::Create)]
+#[case::cleanup(io_faults::Case::Delete)]
+#[case::daemon_loss(io_faults::Case::Loss)]
+#[case::deployment_saturation(io_faults::Case::Saturation)]
+#[case::create_io_timeout(io_faults::Case::CreateTimeout)]
+#[case::delete_ack_timeout(io_faults::Case::DeleteTimeout)]
+#[case::interrupted_pull(io_faults::Case::Pull)]
+#[case::negative_images(io_faults::Case::Negative)]
+#[case::runtime_http_bounds(io_faults::Case::RuntimeBounds)]
+#[case::global_execution_limit(io_faults::Case::GlobalLimit)]
+#[case::default_function_limit(io_faults::Case::DefaultLimit)]
+#[case::independent_memory_limit(io_faults::Case::MemoryLimit)]
+#[case::independent_environment_limit(io_faults::Case::EnvironmentLimit)]
+#[case::zip_allocating(io_faults::Case::ZipCreate)]
+#[case::zip_cleanup(io_faults::Case::ZipDelete)]
+#[case::composite_pressure(io_faults::Case::CompositePressure)]
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit real-daemon IO proxy fixtures; run make test-lambda-io-faults-docker"]
+async fn test_should_retain_actual_management_io_through_cancellation_and_deployment_faults(
+    #[case] case: io_faults::Case,
+) -> Result<()> {
+    io_faults::exercise(case).await
+}
+
+#[rstest]
+#[case::deployments("deployments")]
+#[case::faults("faults")]
+#[case::initializing("initializing")]
+#[case::busy("busy")]
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual provided runtime and original ZIP files; run make test-lambda-docker"]
+async fn test_should_execute_ordinary_provided_zip_and_join_owned_retirement(
+    #[case] phase: &str,
+) -> Result<()> {
+    provided::exercise(phase).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual ZIP/Image archive startup; run make test-lambda-provided-archive-docker"]
+async fn test_should_restore_provided_zip_archives_without_replay_and_preserve_invalid_generations()
+-> Result<()> {
+    provided_archive::exercise(false).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires configured and image-only real startup; run make \
+            test-lambda-provided-archive-docker"]
+async fn test_should_refuse_provided_zip_archives_without_configured_runtime() -> Result<()> {
+    provided_archive::exercise(true).await
+}
+
+#[tokio::test]
+#[ignore = "requires actual root release image and explicit Docker resources"]
+async fn test_should_execute_image_sdk_and_nested_asl_from_the_release_image() -> Result<()> {
+    container_server::exercise(
+        container_server::Mode::Sdk,
+        container_server::ImageProfile::Release,
+    )
+    .await
+}
+
+#[tokio::test]
+#[ignore = "requires actual root release image and explicit Docker resources"]
+async fn test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup()
+-> Result<()> {
+    container_server::exercise(
+        container_server::Mode::Unreachable,
+        container_server::ImageProfile::Release,
+    )
+    .await
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker socket, fixtures and qualified gateway"]
+async fn test_should_execute_local_s3_and_dynamodb_from_an_explicit_image_sdk_context() -> Result<()>
+{
+    handler_sdk::exercise(false).await
+}
+#[tokio::test]
+#[ignore = "requires explicit Docker socket, fixtures and qualified gateway"]
+async fn test_should_reject_wrong_image_sdk_credentials_without_ambient_fallback() -> Result<()> {
+    handler_sdk::exercise(true).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit callback image, Docker socket and qualified gateway"]
+async fn test_should_execute_real_image_callbacks_before_and_after_lambda_response() -> Result<()> {
+    callback::exercise(callback::Group::Causal).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit callback image, Docker socket and qualified gateway"]
+async fn test_should_enforce_image_callback_retry_heartbeat_timeouts_and_stop() -> Result<()> {
+    callback::exercise(callback::Group::Timing).await
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Pulumi image, Docker socket and qualified gateway"]
+async fn test_should_manage_a_real_image_workflow_through_pulumi_lifecycle() -> Result<()> {
+    iac::exercise(iac::Mode::Lifecycle).await
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Pulumi image, Docker socket and qualified gateway"]
+async fn test_should_retire_the_pulumi_plugin_tree_after_controller_stop() -> Result<()> {
+    iac::exercise(iac::Mode::Stop).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "actual image timings; run make test-workflows-image-performance"]
+async fn test_should_measure_one_hundred_warm_image_invocations() -> Result<()> {
+    performance::exercise("warm").await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "actual cold environment timings; run make test-workflows-image-performance"]
+async fn test_should_measure_twenty_preloaded_cold_image_environments() -> Result<()> {
+    performance::exercise("cold").await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "actual log-flood/timeout cleanup; run make test-workflows-image-performance"]
+async fn test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts() -> Result<()> {
+    performance::exercise("cycles").await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires two actual binaries on one explicit daemon; run make \
+            test-lambda-startup-docker"]
+async fn test_should_preserve_live_warm_instance_during_other_owner_crash_recovery() -> Result<()> {
+    let mut gate =
+        recovery_gate::Gate::start(&PathBuf::from(env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")?))?;
+    let mut survivor = Server::spawn(Profile::Connected).await?;
+    let mut owned_crashed = None;
+    let result = timeout(Duration::from_secs(360), async {
+        owned_crashed =
+            Some(Server::spawn_with_socket(Profile::Connected, Some(&gate.socket)).await?);
+        let crashed = owned_crashed.as_mut().context("second owned binary")?;
+        survivor.ready().await?;
+        crashed.ready().await?;
+        ensure!(
+            survivor.observation_identity().await?.0 != crashed.observation_identity().await?.0,
+            "two live binaries shared installation identity"
+        );
+        let mut warm = sdk::Witness::start(&survivor).await?;
+        let mut abandoned = sdk::Witness::start(crashed).await?;
+        let stable = sdk::owned_containers(&survivor).await?;
+        let old = sdk::owned_containers(crashed).await?;
+        ensure!(
+            stable.len() == 2 && old.len() == 2 && stable.is_disjoint(&old),
+            "live owner scopes differ"
+        );
+        abandoned.advance().await?;
+        crashed.crash().await?;
+        warm.advance().await?;
+        gate.arm();
+        crashed.restart().await?;
+        gate.blocked().await?;
+        let witness = async {
+            for _ in 0..3 {
+                warm.advance().await?;
+                let (status, value) =
+                    process::get(&survivor.endpoint, "/_rustack/capabilities").await?;
+                ensure!(
+                    status == 200 && value["ready"] == true,
+                    "survivor lost readiness during recovery"
+                );
+            }
+            Ok::<(), anyhow::Error>(())
+        };
+        witness.await?;
+        gate.release();
+        crashed.ready().await?;
+        ensure!(
+            sdk::owned_containers(&survivor).await? == stable
+                && sdk::owned_containers(crashed).await?.is_disjoint(&old),
+            "recovery retired foreign containers or retained abandoned containers"
+        );
+        warm.advance().await?;
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("two-instance crash recovery observer expired")
+    .and_then(|value| value);
+    gate.release();
+    let first = if let Some(crashed) = &mut owned_crashed {
+        crashed.stop(true).await
+    } else {
+        Ok(())
+    };
+    let second = survivor.stop(true).await;
+    let first_audit = if let Some(crashed) = &owned_crashed {
+        crashed.audit().await
+    } else {
+        Ok(())
+    };
+    let second_audit = survivor.audit().await;
+    if result.is_err()
+        || first.is_err()
+        || second.is_err()
+        || first_audit.is_err()
+        || second_audit.is_err()
+    {
+        if let Some(crashed) = &mut owned_crashed {
+            crashed.retain_on_error().await;
+        }
+        survivor.retain_on_error().await;
+    }
+    let proxy = gate.close().await;
+    first?;
+    second?;
+    first_audit?;
+    second_audit?;
+    proxy?;
+    result
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires real saved images and affiliations; run make test-lambda-startup-docker"]
+async fn test_should_restore_saved_image_after_tag_move_and_reject_absent_or_foreign_candidates()
+-> Result<()> {
+    archive_rejection::exercise().await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires real cleanup failure and snapshot recovery; run make \
+            test-lambda-startup-docker"]
+async fn test_should_preserve_previous_snapshot_when_docker_cleanup_cannot_be_confirmed()
+-> Result<()> {
+    let mut gate =
+        recovery_gate::Gate::start(&PathBuf::from(env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")?))?;
+    let mut server = Server::spawn_with_socket(Profile::Archive, Some(&gate.socket)).await?;
+    let result = timeout(Duration::from_secs(480), async {
+        server.ready().await?;
+        let _committed = sdk::Witness::start(&server).await?;
+        server.stop(true).await?;
+        server.audit().await?;
+        let snapshots = server.path()?.join("snapshots");
+        let saved = fingerprint(&snapshots).await?;
+        server.restart().await?;
+        server.ready().await?;
+        let unsaved = sdk::Witness::start(&server).await?;
+        let old = sdk::owned_containers(&server).await?;
+        ensure!(
+            old.len() == 2,
+            "cleanup-failure fixture lacked live containers"
+        );
+        gate.disconnect().await?;
+        server.stop(false).await?;
+        ensure!(
+            fingerprint(&snapshots).await? == saved,
+            "unconfirmed cleanup published a snapshot generation"
+        );
+        gate.resume().await?;
+        server.restart().await?;
+        server.ready().await?;
+        unsaved.missing().await?;
+        ensure!(
+            sdk::owned_containers(&server).await?.is_disjoint(&old),
+            "restart retained abandoned owned containers"
+        );
+        server.stop(true).await?;
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("failed-cleanup snapshot observer expired")
+    .and_then(|value| value);
+    gate.release();
+    let stopped = server.stop_after_transport_loss().await;
+    let audit = if result.is_ok() {
+        server.audit().await
+    } else {
+        Ok(())
+    };
+    if result.is_err() || stopped.is_err() || audit.is_err() {
+        server.retain_on_error().await;
+    }
+    let proxy = gate.close().await;
+    stopped?;
+    audit?;
+    proxy?;
+    result
+}
diff --git a/apps/rustack/tests/docker_startup/archive.rs b/apps/rustack/tests/docker_startup/archive.rs
new file mode 100644
index 00000000..254d6a36
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/archive.rs
@@ -0,0 +1,261 @@
+//! Independent bounded fixture codec for one real v2 Lambda metadata section.
+
+use std::{
+    io::{Cursor, Read},
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rustack_lambda_core::{
+    artifact::{ImageMetadata, ResolvedImage},
+    provider::LambdaSnapshot,
+};
+use serde::{Serialize, de::DeserializeOwned};
+use sha2::{Digest, Sha256};
+use tokio::{fs, io::AsyncReadExt, task::spawn_blocking, time::timeout};
+use uuid::Uuid;
+
+const PLAIN_LIMIT: usize = 16 * 1024 * 1024;
+const COMPRESSED_LIMIT: u64 = 4 * 1024 * 1024;
+fn metadata(root: &Path) -> PathBuf {
+    root.join("snapshots/images/services/lambda/meta.ss.zst")
+}
+async fn bytes(path: &Path) -> Result<Vec<u8>> {
+    let file = fs::File::open(path).await?;
+    let mut bytes = Vec::new();
+    file.take(COMPRESSED_LIMIT + 1)
+        .read_to_end(&mut bytes)
+        .await?;
+    ensure!(
+        u64::try_from(bytes.len())? <= COMPRESSED_LIMIT,
+        "fixture compressed metadata cap"
+    );
+    Ok(bytes)
+}
+fn u16_at(bytes: &[u8], at: usize) -> Result<u16> {
+    Ok(u16::from_le_bytes(
+        bytes
+            .get(at..at.checked_add(2).context("offset")?)
+            .context("u16")?
+            .try_into()?,
+    ))
+}
+fn u32_at(bytes: &[u8], at: usize) -> Result<u32> {
+    Ok(u32::from_le_bytes(
+        bytes
+            .get(at..at.checked_add(4).context("offset")?)
+            .context("u32")?
+            .try_into()?,
+    ))
+}
+fn u64_at(bytes: &[u8], at: usize) -> Result<u64> {
+    Ok(u64::from_le_bytes(
+        bytes
+            .get(at..at.checked_add(8).context("offset")?)
+            .context("u64")?
+            .try_into()?,
+    ))
+}
+pub(super) fn decode(bytes: &[u8]) -> Result<LambdaSnapshot> {
+    let mut decoder = zstd::stream::read::Decoder::new(Cursor::new(bytes))?.take(
+        u64::try_from(PLAIN_LIMIT)?
+            .checked_add(1)
+            .context("plain cap")?,
+    );
+    let mut plain = Vec::new();
+    decoder.read_to_end(&mut plain)?;
+    decode_plain(&plain)
+}
+pub(super) fn decode_plain<T: DeserializeOwned>(plain: &[u8]) -> Result<T> {
+    ensure!(
+        plain.len() <= PLAIN_LIMIT && plain.len() >= 76,
+        "fixture plain metadata cap/header"
+    );
+    ensure!(
+        plain.get(..8) == Some(b"RSSNAP\0\x02")
+            && u16_at(plain, 8)? == 2
+            && u16_at(plain, 10)? == 0,
+        "fixture v2 metadata kind"
+    );
+    ensure!(
+        u32_at(plain, 12)? == 36
+            && u32_at(plain, 16)? == 1
+            && u64_at(plain, 20)? == u64::try_from(plain.len())?
+            && u64_at(plain, 28)? == 0,
+        "fixture metadata layout"
+    );
+    ensure!(
+        u16_at(plain, 36)? == 1
+            && u16_at(plain, 38)? == 0
+            && u64_at(plain, 40)? == 64
+            && u64_at(plain, 56)? == 1,
+        "fixture single state section"
+    );
+    let end = plain.len().checked_sub(12).context("footer")?;
+    ensure!(
+        u64_at(plain, 48)? == u64::try_from(end.checked_sub(64).context("payload")?)?
+            && u64_at(plain, end.checked_add(4).context("footer length")?)? == u64::try_from(end)?,
+        "fixture section bounds"
+    );
+    ensure!(
+        crc32fast::hash(plain.get(..end).context("CRC range")?) == u32_at(plain, end)?,
+        "fixture CRC"
+    );
+    let payload = plain.get(64..end).context("state payload")?;
+    let mut reader = Cursor::new(payload);
+    let snapshot = ciborium::de::from_reader_with_recursion_limit(&mut reader, 128)?;
+    ensure!(
+        reader.position() == u64::try_from(payload.len())?,
+        "fixture trailing CBOR"
+    );
+    Ok(snapshot)
+}
+pub(super) fn encode<T: Serialize>(snapshot: &T) -> Result<Vec<u8>> {
+    let mut state = Vec::new();
+    ciborium::ser::into_writer(snapshot, &mut state)?;
+    let total = state.len().checked_add(76).context("archive length")?;
+    ensure!(total <= PLAIN_LIMIT, "fixture encoded cap");
+    let mut plain = Vec::with_capacity(total);
+    plain.extend_from_slice(b"RSSNAP\0\x02");
+    plain.extend_from_slice(&2u16.to_le_bytes());
+    plain.extend_from_slice(&0u16.to_le_bytes());
+    plain.extend_from_slice(&36u32.to_le_bytes());
+    plain.extend_from_slice(&1u32.to_le_bytes());
+    plain.extend_from_slice(&u64::try_from(total)?.to_le_bytes());
+    plain.extend_from_slice(&0u64.to_le_bytes());
+    plain.extend_from_slice(&1u16.to_le_bytes());
+    plain.extend_from_slice(&0u16.to_le_bytes());
+    plain.extend_from_slice(&64u64.to_le_bytes());
+    plain.extend_from_slice(&u64::try_from(state.len())?.to_le_bytes());
+    plain.extend_from_slice(&1u64.to_le_bytes());
+    plain.extend_from_slice(&state);
+    let payload_len = u64::try_from(plain.len())?;
+    plain.extend_from_slice(&crc32fast::hash(&plain).to_le_bytes());
+    plain.extend_from_slice(&payload_len.to_le_bytes());
+    ensure!(plain.len() == total, "fixture encoded layout");
+    let compressed = zstd::stream::encode_all(Cursor::new(plain), 1)?;
+    ensure!(
+        u64::try_from(compressed.len())? <= COMPRESSED_LIMIT,
+        "fixture compressed output cap"
+    );
+    Ok(compressed)
+}
+pub(super) async fn read(root: &Path) -> Result<LambdaSnapshot> {
+    let bytes = bytes(&metadata(root)).await?;
+    let mut job = spawn_blocking(move || decode(&bytes));
+    timeout(Duration::from_secs(30), &mut job).await??
+}
+pub(super) async fn corrupt_size(root: &Path) -> Result<()> {
+    let path = metadata(root);
+    let original = bytes(&path).await?;
+    let mut job = spawn_blocking(move || {
+        let mut snapshot = decode(&original)?;
+        let target = snapshot
+            .functions
+            .functions
+            .iter_mut()
+            .find(|function| {
+                function.latest.state == "Active" && function.latest.resolved_image.is_some()
+            })
+            .context("actual saved usable image")?;
+        target.latest.code_size = target
+            .latest
+            .code_size
+            .checked_add(1)
+            .context("code size")?;
+        encode(&snapshot)
+    });
+    let corrupted = timeout(Duration::from_secs(30), &mut job).await???;
+    fs::write(path, corrupted).await?;
+    Ok(())
+}
+
+pub(super) async fn corrupt_zip(root: &Path) -> Result<()> {
+    let path = metadata(root);
+    let original = bytes(&path).await?;
+    let mut job = spawn_blocking(move || {
+        let mut snapshot = decode(&original)?;
+        let version = &mut snapshot
+            .functions
+            .functions
+            .iter_mut()
+            .find(|function| function.latest.package_type == "Zip")
+            .context("actual saved provided ZIP")?
+            .latest;
+        let source = b"invalid ZIP archive source";
+        version.zip_bytes_base64 = Some(STANDARD.encode(source));
+        version.code_sha256 = STANDARD.encode(Sha256::digest(source));
+        version.code_size = u64::try_from(source.len())?;
+        encode(&snapshot)
+    });
+    let corrupted = timeout(Duration::from_secs(30), &mut job).await???;
+    fs::write(path, corrupted).await?;
+    Ok(())
+}
+
+pub(super) async fn missing_image(root: &Path) -> Result<String> {
+    let path = metadata(root);
+    let original = bytes(&path).await?;
+    let mut job = spawn_blocking(move || {
+        let mut snapshot = decode(&original)?;
+        let version = &mut snapshot
+            .functions
+            .functions
+            .iter_mut()
+            .find(|function| function.latest.resolved_image.is_some())
+            .context("saved image")?
+            .latest;
+        let mut metadata: ImageMetadata = version
+            .resolved_image
+            .take()
+            .context("saved resolved image")?
+            .into();
+        let absent = format!(
+            "sha256:{}{}",
+            Uuid::new_v4().simple(),
+            Uuid::new_v4().simple()
+        );
+        metadata.image_id = absent.parse()?;
+        metadata.selected_manifest = None;
+        metadata.registry_manifest = None;
+        metadata.inspection_hash = ImageMetadata::execution_fingerprint(
+            &metadata.image_id,
+            None,
+            metadata.architecture,
+            metadata.size_bytes,
+            &metadata.execution,
+        )?;
+        let resolved = ResolvedImage::try_from(metadata)?;
+        version.code_sha256 = resolved.code_sha256()?;
+        version.resolved_image = Some(resolved);
+        Ok::<_, anyhow::Error>((encode(&snapshot)?, absent))
+    });
+    let (corrupted, absent) = timeout(Duration::from_secs(30), &mut job).await???;
+    fs::write(path, corrupted).await?;
+    Ok(absent)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn test_should_refuse_truncated_wrong_kind_and_invalid_crc_fixture_frames() -> Result<()> {
+        let source = encode(&LambdaSnapshot::default())?;
+        assert!(decode(source.get(..source.len() / 2).context("truncated source")?).is_err());
+        for at in [8usize, 36, 64] {
+            let mut plain = zstd::stream::decode_all(Cursor::new(&source))?;
+            *plain.get_mut(at).context("fixed corrupt offset")? ^= 1;
+            let corrupted = zstd::stream::encode_all(Cursor::new(plain), 1)?;
+            assert!(decode(&corrupted).is_err());
+        }
+        Ok(())
+    }
+    #[test]
+    fn test_should_refuse_fixture_decompression_above_the_plain_cap() -> Result<()> {
+        let compressed = zstd::stream::encode_all(Cursor::new(vec![0; PLAIN_LIMIT + 1]), 1)?;
+        assert!(decode(&compressed).is_err());
+        Ok(())
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/archive_rejection.rs b/apps/rustack/tests/docker_startup/archive_rejection.rs
new file mode 100644
index 00000000..0837cfa5
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/archive_rejection.rs
@@ -0,0 +1,136 @@
+//! Real archive restore with moved references and valid but foreign affiliations.
+
+use std::{env, path::Path, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::{
+    artifact::ImageReference,
+    docker::{DockerError, DockerWire},
+};
+use sha2::{Digest, Sha256};
+use tokio::{
+    fs,
+    time::{Instant, timeout},
+};
+use uuid::Uuid;
+
+use super::{
+    archive, copy_tree,
+    custom::Alias,
+    fingerprint,
+    process::{self, Profile, Server},
+    sdk,
+};
+
+pub(super) async fn exercise() -> Result<()> {
+    let mut server = Server::spawn(Profile::Archive).await?;
+    let mut alias = None;
+    let result = timeout(Duration::from_secs(600), async {
+        server.ready().await?;
+        let a = env::var("RUSTACK_CUSTOM_IMAGE_A")?;
+        let b = env::var("RUSTACK_CUSTOM_IMAGE_B")?;
+        let ids = [server.track_image(&a).await?, server.track_image(&b).await?];
+        ensure!(
+            ids.first() != ids.get(1),
+            "moving-tag sources are identical"
+        );
+        alias = Some(Alias::new(&server, ids).await?);
+        let moving = alias.as_mut().context("retained source alias")?;
+        moving.select(0).await?;
+        let mut witness = sdk::Witness::start_image(&server, moving.name()).await?;
+        server.stop(true).await?;
+        server.audit().await?;
+        moving.select(1).await?;
+        server.restart().await?;
+        server.ready().await?;
+        witness.cold_revision("A").await?;
+        server.stop(true).await?;
+        server.audit().await?;
+        let snapshots = server.path()?.join("snapshots");
+        let current = snapshots.join("images");
+        let previous = snapshots.join(".images.previous");
+        copy_tree(&current, &previous).await?;
+        let meta = current.join("services/lambda/meta.ss.zst");
+        let original_meta = fs::read(&meta).await?;
+        let absent = archive::missing_image(server.path()?).await?;
+        let at = Instant::now() + Duration::from_secs(10);
+        let mut wire = DockerWire::connect(process::socket()?.parse()?, at).await?;
+        let missing: ImageReference = absent.parse()?;
+        let observed = wire.port().inspect_image(&missing, at).await;
+        let joined = wire.shutdown().await;
+        joined?;
+        ensure!(
+            matches!(observed, Err(DockerError::Status(status)) if status.as_u16() == 404),
+            "absent-image fixture unexpectedly exists"
+        );
+        let before = fingerprint(&snapshots).await?;
+        server.restart().await?;
+        server
+            .failure_with(Some("Lambda immutable image restore failed"))
+            .await?;
+        ensure!(
+            fingerprint(&snapshots).await? == before,
+            "missing image changed snapshot generations"
+        );
+        server.stop(false).await?;
+        fs::write(&meta, original_meta).await?;
+        reject_affiliations(&mut server, &snapshots).await?;
+        server.audit().await?;
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("archive rejection observer expired")
+    .and_then(|value| value);
+    let cleanup = server.reap().await;
+    let alias_cleanup = if let Some(moving) = &mut alias {
+        moving.cleanup().await
+    } else {
+        Ok(())
+    };
+    let audit = server.audit().await;
+    if result.is_err() || cleanup.is_err() || alias_cleanup.is_err() || audit.is_err() {
+        server.retain_on_error().await;
+    }
+    result?;
+    cleanup?;
+    alias_cleanup?;
+    audit?;
+    Ok(())
+}
+
+async fn reject_affiliations(server: &mut Server, snapshots: &Path) -> Result<()> {
+    let affiliation = server.path()?.join("data/.rustack-lambda-docker/daemon.v1");
+    let original = fs::read(&affiliation).await?;
+    ensure!(original.len() == 72, "daemon record fixture length");
+    fs::write(server.path()?.join("affiliation-original.v1"), &original).await?;
+    for (range, role) in [(8..24, "owner"), (24..40, "engine")] {
+        let mut changed = original.clone();
+        changed
+            .get_mut(range)
+            .context("affiliation UUID")?
+            .copy_from_slice(Uuid::new_v4().as_bytes());
+        let hash = Sha256::digest(changed.get(..40).context("affiliation payload")?);
+        changed
+            .get_mut(40..)
+            .context("affiliation checksum")?
+            .copy_from_slice(&hash);
+        fs::write(
+            server.path()?.join(format!("affiliation-{role}-intent.v1")),
+            &changed,
+        )
+        .await?;
+        fs::write(&affiliation, &changed).await?;
+        let before = fingerprint(snapshots).await?;
+        server.restart().await?;
+        server
+            .failure_with(Some("invalid Docker ownership state"))
+            .await?;
+        server.stop(false).await?;
+        ensure!(
+            fingerprint(snapshots).await? == before && fs::read(&affiliation).await? == changed,
+            "foreign affiliation was rewritten or snapshot changed"
+        );
+        fs::write(&affiliation, &original).await?;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/callback.rs b/apps/rustack/tests/docker_startup/callback.rs
new file mode 100644
index 00000000..bdd9a57b
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/callback.rs
@@ -0,0 +1,178 @@
+//! Actual image callback consumers and confirmed-save credential observations.
+
+#[path = "callback/audit.rs"]
+mod audit;
+
+use std::{collections::HashSet, env, ffi::OsString, path::PathBuf, time::Duration};
+
+use anyhow::{Context, Result, anyhow, ensure};
+use serde::Deserialize;
+use serde_json::Value;
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{
+    image_sdk,
+    process::{self, Profile, Server},
+};
+
+#[derive(Debug, Clone, Copy)]
+pub(super) enum Group {
+    Causal,
+    Timing,
+}
+impl Group {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Causal => "causal",
+            Self::Timing => "timing",
+        }
+    }
+    fn cases(self) -> &'static [&'static str] {
+        match self {
+            Self::Causal => &["early", "late", "externalFailure", "invocationFailure"],
+            Self::Timing => &[
+                "retry",
+                "heartbeat",
+                "absoluteTimeout",
+                "heartbeatTimeout",
+                "stop",
+            ],
+        }
+    }
+}
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Versions {
+    lambda: String,
+    sfn: String,
+    dynamodb: String,
+}
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Evidence {
+    schema_version: u8,
+    group: String,
+    cases: Vec<String>,
+    versions: Versions,
+    functions: [String; 2],
+    executions: Vec<String>,
+    worker_requests: Vec<String>,
+    hashes: Vec<String>,
+    history_candidates: usize,
+    history_bytes: usize,
+}
+fn evidence(group: Group, observed: &Value) -> Result<Evidence> {
+    ensure!(
+        serde_json::to_vec(observed)?.len() <= 16 * 1024,
+        "callback report byte cap"
+    );
+    let value: Evidence = serde_json::from_value(observed.clone())
+        .map_err(|_| anyhow!("invalid callback report shape"))?;
+    let (hashes, workers) = match group {
+        Group::Causal => (4, 1),
+        Group::Timing => (6, 4),
+    };
+    ensure!(
+        value.schema_version == 1
+            && value.group == group.name()
+            && value
+                .cases
+                .iter()
+                .map(String::as_str)
+                .eq(group.cases().iter().copied())
+            && [
+                &value.versions.lambda,
+                &value.versions.sfn,
+                &value.versions.dynamodb
+            ]
+            .into_iter()
+            .all(|version| version == "3.1105.0"),
+        "callback semantic/version inventory differs"
+    );
+    ensure!(
+        value
+            .functions
+            .iter()
+            .all(|name| (1..=64).contains(&name.len())
+                && name
+                    .bytes()
+                    .all(|b| b.is_ascii_alphanumeric() || b"_-".contains(&b)))
+            && value.functions.iter().collect::<HashSet<_>>().len() == 2,
+        "invalid callback function collection"
+    );
+    ensure!(
+        value.executions.len() == 5
+            && value.executions.iter().all(|arn| arn.len() <= 256
+                && arn.starts_with("arn:aws:states:us-east-1:000000000000:execution:")
+                && arn
+                    .bytes()
+                    .all(|b| b.is_ascii_alphanumeric() || b"_:-".contains(&b)))
+            && value.executions.iter().collect::<HashSet<_>>().len() == 5,
+        "invalid retained callback execution collection"
+    );
+    ensure!(
+        value.worker_requests.len() == workers
+            && value.worker_requests.iter().all(|id| id.len() == 36
+                && Uuid::parse_str(id)
+                    .is_ok_and(|uuid| uuid.get_version_num() == 4 && uuid.to_string() == *id))
+            && value.worker_requests.iter().collect::<HashSet<_>>().len() == workers,
+        "invalid completed callback Event collection"
+    );
+    ensure!(
+        value.hashes.len() == hashes
+            && value.hashes.iter().collect::<HashSet<_>>().len() == hashes
+            && value.hashes.iter().all(|hash| audit::valid_hash(hash))
+            && value.history_candidates <= 65_536
+            && value.history_bytes <= 16 * 1024 * 1024,
+        "invalid callback privacy evidence"
+    );
+    Ok(value)
+}
+
+pub(super) async fn exercise(group: Group) -> Result<()> {
+    image_sdk::exercise_with_audit(
+        Profile::Callback,
+        async |server: &mut Server| {
+            let image = env::var("RUSTACK_CALLBACK_IMAGE").context("explicit callback image")?;
+            server.track_image(&image).await?;
+            let capabilities = server.ready().await?;
+            ensure!(
+                capabilities["workflows"]["callbacks"] == true
+                    && capabilities["workflows"]["lambdaRequestResponse"] == true
+                    && capabilities["workflows"]["limits"]["dispatches"] == 1,
+                "image callback capability/profile mismatch"
+            );
+            let (owner, engine) = server.observation_identity().await?;
+            Ok(vec![
+                PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                    .join("../../tests/workflows/callback_image_sdk.py")
+                    .into_os_string(),
+                OsString::from(&server.endpoint),
+                OsString::from(image),
+                OsString::from(if process::architecture()? == "arm64" {
+                    "arm64"
+                } else {
+                    "x86_64"
+                }),
+                env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("callback metadata socket")?,
+                OsString::from(owner),
+                OsString::from(engine),
+                OsString::from(group.name()),
+            ])
+        },
+        |observed| evidence(group, observed).map(|_| ()),
+        async |server: &Server, observed: &Value| {
+            let input = evidence(group, observed)?;
+            let root = server.path()?.to_owned();
+            let deadline = Instant::now() + Duration::from_secs(30);
+            audit::run(&root, &input, deadline).await?;
+            eprintln!(
+                "actual image callback SDK versions: 3.1105.0; {}",
+                group.name()
+            );
+            Ok(())
+        },
+    )
+    .await
+}
diff --git a/apps/rustack/tests/docker_startup/callback/audit.rs b/apps/rustack/tests/docker_startup/callback/audit.rs
new file mode 100644
index 00000000..08285168
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/callback/audit.rs
@@ -0,0 +1,559 @@
+//! Bounded independent plaintext/hash observations over one stopped private generation.
+
+use std::{
+    collections::HashSet,
+    fmt::{Formatter, Result as FmtResult, Write},
+    future::Future,
+    io::{Cursor, Read, Result as IoResult},
+    path::{Path, PathBuf},
+};
+
+use anyhow::{Context, Result, anyhow, ensure};
+use nix::libc::{O_NOFOLLOW, O_NONBLOCK};
+use rustack_lambda_core::provider::LambdaSnapshot;
+use serde::{
+    Deserialize, Deserializer,
+    de::{Error as DeError, SeqAccess, Visitor},
+};
+use sha2::{Digest, Sha256};
+use tokio::{
+    fs::{self, OpenOptions},
+    io::AsyncReadExt,
+    task::{JoinHandle, spawn_blocking},
+    time::{Instant, timeout_at},
+};
+use zstd::stream::read::Decoder;
+
+use super::{super::archive, Evidence};
+
+const COMPRESSED: usize = 4 * 1024 * 1024;
+const PLAIN: usize = 16 * 1024 * 1024;
+const TOTAL_COMPRESSED: usize = 16 * 1024 * 1024;
+const TOTAL_PLAIN: usize = 64 * 1024 * 1024;
+const CANDIDATES: usize = 65_536;
+
+pub(super) fn valid_hash(value: &str) -> bool {
+    value.len() == 64
+        && value
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+}
+
+fn hex_digest(bytes: &[u8]) -> Result<String> {
+    let mut encoded = String::with_capacity(64);
+    for byte in Sha256::digest(bytes) {
+        write!(&mut encoded, "{byte:02x}")?;
+    }
+    Ok(encoded)
+}
+#[derive(Debug)]
+struct Scan {
+    hashes: HashSet<String>,
+    candidates: usize,
+    plain: usize,
+    deadline: Instant,
+    failed: bool,
+}
+impl Scan {
+    fn new(hashes: &[String], candidates: usize, plain: usize, deadline: Instant) -> Result<Self> {
+        ensure!(
+            (1..=64).contains(&hashes.len())
+                && hashes.iter().all(|h| valid_hash(h))
+                && candidates <= CANDIDATES
+                && plain <= PLAIN,
+            "invalid callback scan input"
+        );
+        Ok(Self {
+            hashes: hashes.iter().cloned().collect(),
+            candidates,
+            plain,
+            deadline,
+            failed: false,
+        })
+    }
+    fn scan(&mut self, bytes: &[u8]) -> Result<()> {
+        ensure!(!self.failed, "callback scan already failed");
+        let result = self.scan_inner(bytes);
+        if result.is_err() {
+            self.failed = true;
+        }
+        result
+    }
+    fn scan_inner(&mut self, bytes: &[u8]) -> Result<()> {
+        ensure!(
+            Instant::now() < self.deadline && bytes.len() <= PLAIN,
+            "callback scan source/deadline cap"
+        );
+        self.plain = self
+            .plain
+            .checked_add(bytes.len())
+            .context("callback plain bytes")?;
+        ensure!(self.plain <= TOTAL_PLAIN, "callback aggregate plain cap");
+        for credential in [b"local-key".as_slice(), b"local-secret".as_slice()] {
+            ensure!(
+                !bytes.windows(credential.len()).any(|v| v == credential),
+                "injected SDK credential persisted"
+            );
+        }
+        let mut run = 0usize;
+        for (at, byte) in bytes.iter().enumerate() {
+            run = if byte.is_ascii_digit() || (b'a'..=b'f').contains(byte) {
+                run.checked_add(1).context("callback hex run")?
+            } else {
+                0
+            };
+            if run < 64 {
+                continue;
+            }
+            self.candidates = self
+                .candidates
+                .checked_add(1)
+                .context("callback candidates")?;
+            ensure!(
+                self.candidates <= CANDIDATES,
+                "callback aggregate candidate cap"
+            );
+            let start = at.checked_sub(63).context("callback candidate offset")?;
+            let value = bytes.get(start..=at).context("callback candidate window")?;
+            let digest = hex_digest(value)?;
+            ensure!(
+                !self.hashes.contains(&digest),
+                "callback credential persisted"
+            );
+        }
+        ensure!(
+            Instant::now() < self.deadline,
+            "late callback scan observation"
+        );
+        Ok(())
+    }
+}
+
+fn fresh(deadline: Instant) -> Result<()> {
+    ensure!(Instant::now() < deadline, "callback observation expired");
+    Ok(())
+}
+async fn io<T>(deadline: Instant, future: impl Future<Output = IoResult<T>>) -> Result<T> {
+    fresh(deadline)?;
+    let value = timeout_at(deadline, future)
+        .await
+        .context("callback IO deadline")??;
+    fresh(deadline)?;
+    Ok(value)
+}
+async fn files(root: &Path, deadline: Instant) -> Result<Vec<PathBuf>> {
+    ensure!(
+        io(deadline, fs::symlink_metadata(root))
+            .await?
+            .file_type()
+            .is_dir(),
+        "invalid callback generation root"
+    );
+    let root = io(deadline, fs::canonicalize(root)).await?;
+    let mut stack = vec![(root.clone(), 0usize)];
+    let mut entries = 0usize;
+    let mut found = Vec::new();
+    while let Some((directory, depth)) = stack.pop() {
+        fresh(deadline)?;
+        ensure!(depth <= 8, "callback archive depth cap");
+        let mut directory = io(deadline, fs::read_dir(directory)).await?;
+        while let Some(entry) = io(deadline, directory.next_entry()).await? {
+            entries = entries.checked_add(1).context("callback archive nodes")?;
+            ensure!(entries <= 128, "callback archive entry cap");
+            let kind = io(deadline, entry.file_type()).await?;
+            let path = entry.path();
+            ensure!(
+                path.as_os_str().len() <= 4096
+                    && !kind.is_symlink()
+                    && io(deadline, fs::canonicalize(&path))
+                        .await?
+                        .starts_with(&root),
+                "unsafe callback archive path"
+            );
+            if kind.is_dir() {
+                stack.push((
+                    path,
+                    depth.checked_add(1).context("callback archive depth")?,
+                ));
+            } else {
+                ensure!(
+                    kind.is_file() && found.len() < 64,
+                    "callback archive file kind/count"
+                );
+                found.push(path);
+            }
+        }
+    }
+    Ok(found)
+}
+async fn read(path: &Path, cap: usize, deadline: Instant) -> Result<Vec<u8>> {
+    let file = io(
+        deadline,
+        OpenOptions::new()
+            .read(true)
+            .custom_flags(O_NOFOLLOW | O_NONBLOCK)
+            .open(path),
+    )
+    .await?;
+    let metadata = io(deadline, file.metadata()).await?;
+    ensure!(
+        metadata.is_file() && metadata.len() <= u64::try_from(cap)?,
+        "callback observed file cap/kind"
+    );
+    let limit = u64::try_from(cap)?
+        .checked_add(1)
+        .context("callback read cap")?;
+    let mut bytes = Vec::new();
+    io(deadline, file.take(limit).read_to_end(&mut bytes)).await?;
+    ensure!(bytes.len() <= cap, "callback observed read cap");
+    Ok(bytes)
+}
+async fn owned_cpu<T>(deadline: Instant, mut job: JoinHandle<Result<T>>) -> Result<T> {
+    let result = if let Ok(result) = timeout_at(deadline, &mut job).await {
+        result.map_err(|_| anyhow!("callback observer worker failed"))?
+    } else {
+        // Preserve ownership of the original bounded CPU job after expiry.
+        let _late = job.await;
+        return Err(anyhow!("callback observer worker expired"));
+    };
+    fresh(deadline)?;
+    result
+}
+fn plain(bytes: &[u8]) -> Result<Vec<u8>> {
+    let mut decoder = Decoder::new(Cursor::new(bytes))?.take(
+        u64::try_from(PLAIN)?
+            .checked_add(1)
+            .context("callback decoder cap")?,
+    );
+    let mut out = Vec::new();
+    decoder.read_to_end(&mut out)?;
+    ensure!(out.len() <= PLAIN, "callback decompressed cap");
+    Ok(out)
+}
+
+// Deliberately project only durable execution identities/outcomes; definitions and
+// arbitrary business payloads cannot satisfy this independent presence oracle.
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct Workflows {
+    schema_version: u32,
+    #[serde(deserialize_with = "executions")]
+    executions: Vec<Execution>,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct Execution {
+    arn: String,
+    stopped_at: Option<String>,
+    outcome: Outcome,
+}
+#[derive(Debug, Deserialize)]
+#[serde(tag = "status", rename_all = "SCREAMING_SNAKE_CASE")]
+enum Outcome {
+    Running,
+    Succeeded,
+    Failed,
+    TimedOut,
+    Aborted,
+}
+fn executions<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Vec<Execution>, D::Error> {
+    struct Rows;
+    impl<'de> Visitor<'de> for Rows {
+        type Value = Vec<Execution>;
+        fn expecting(&self, formatter: &mut Formatter<'_>) -> FmtResult {
+            formatter.write_str("bounded callback execution rows")
+        }
+        fn visit_seq<A: SeqAccess<'de>>(self, mut rows: A) -> Result<Self::Value, A::Error> {
+            let mut values = Vec::new();
+            while let Some(row) = rows.next_element::<Execution>()? {
+                if values.len() >= 64
+                    || row.arn.len() > 256
+                    || row.stopped_at.as_ref().is_some_and(|v| v.len() > 64)
+                {
+                    return Err(A::Error::custom("callback execution projection cap"));
+                }
+                values.push(row);
+            }
+            Ok(values)
+        }
+    }
+    deserializer.deserialize_seq(Rows)
+}
+fn workflows(data: &[u8], expected: &[String]) -> Result<()> {
+    let snapshot: Workflows =
+        archive::decode_plain(data).map_err(|_| anyhow!("invalid saved callback executions"))?;
+    ensure!(snapshot.schema_version == 1, "callback metadata schema");
+    let mut actual = HashSet::new();
+    for row in snapshot.executions {
+        ensure!(
+            actual.insert(row.arn.clone()),
+            "duplicate callback execution row"
+        );
+        if expected.contains(&row.arn) {
+            ensure!(
+                row.stopped_at.is_some() && !matches!(row.outcome, Outcome::Running),
+                "callback execution not terminal"
+            );
+        }
+    }
+    ensure!(
+        expected.iter().all(|arn| actual.contains(arn)),
+        "actual terminal callback executions absent from archive"
+    );
+    Ok(())
+}
+#[derive(Debug, Clone, Copy)]
+enum Kind {
+    Other,
+    Lambda,
+    Workflows,
+}
+fn inspect(
+    mut scan: Scan,
+    bytes: Vec<u8>,
+    compressed: bool,
+    kind: Kind,
+    expected: &[String],
+) -> Result<Scan> {
+    let data = if compressed { plain(&bytes)? } else { bytes };
+    scan.scan(&data)?;
+    match kind {
+        Kind::Other => (),
+        Kind::Lambda => {
+            let snapshot: LambdaSnapshot = archive::decode_plain(&data)
+                .map_err(|_| anyhow!("invalid saved callback functions"))?;
+            let names: HashSet<_> = snapshot
+                .functions
+                .functions
+                .iter()
+                .map(|f| f.name.as_str())
+                .collect();
+            ensure!(
+                names == expected.iter().map(String::as_str).collect(),
+                "actual callback functions absent from archive"
+            );
+        }
+        Kind::Workflows => workflows(&data, expected)?,
+    }
+    fresh(scan.deadline)?;
+    Ok(scan)
+}
+pub(super) async fn run(root: &Path, input: &Evidence, deadline: Instant) -> Result<()> {
+    let selected = root.join("snapshots/images");
+    ensure!(
+        io(deadline, fs::symlink_metadata(&selected))
+            .await?
+            .file_type()
+            .is_dir(),
+        "linked callback generation"
+    );
+    let generation = io(deadline, fs::canonicalize(&selected)).await?;
+    let mut scan = Scan::new(
+        &input.hashes,
+        input.history_candidates,
+        input.history_bytes,
+        deadline,
+    )?;
+    let log = read(&root.join("server.log"), 1024 * 1024, deadline).await?;
+    fresh(deadline)?;
+    scan = owned_cpu(
+        deadline,
+        spawn_blocking(move || inspect(scan, log, false, Kind::Other, &[])),
+    )
+    .await?;
+    let mut compressed = 0usize;
+    let mut lambda = false;
+    let mut registry = false;
+    for path in files(&generation, deadline).await? {
+        let bytes = read(&path, COMPRESSED, deadline).await?;
+        compressed = compressed
+            .checked_add(bytes.len())
+            .context("callback compressed bytes")?;
+        ensure!(
+            compressed <= TOTAL_COMPRESSED,
+            "callback aggregate compressed cap"
+        );
+        let relative = path.strip_prefix(&generation)?;
+        let (kind, expected) = if relative == Path::new("services/lambda/meta.ss.zst") {
+            lambda = true;
+            (Kind::Lambda, input.functions.to_vec())
+        } else if relative == Path::new("services/stepfunctions/meta.ss.zst") {
+            registry = true;
+            (Kind::Workflows, input.executions.clone())
+        } else {
+            (Kind::Other, Vec::new())
+        };
+        let compressed = path.extension().is_some_and(|v| v == "zst");
+        fresh(deadline)?;
+        scan = owned_cpu(
+            deadline,
+            spawn_blocking(move || inspect(scan, bytes, compressed, kind, &expected)),
+        )
+        .await?;
+    }
+    ensure!(
+        lambda && registry,
+        "callback saved service metadata missing"
+    );
+    fresh(deadline)?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use nix::{sys::stat::Mode, unistd::mkfifo};
+    use serde_json::Value;
+    use tokio::net::UnixListener;
+
+    use super::*;
+
+    fn digest(bytes: &[u8]) -> Result<String> {
+        hex_digest(bytes)
+    }
+    fn scan(hashes: &[String]) -> Result<Scan> {
+        Scan::new(hashes, 0, 0, Instant::now() + Duration::from_secs(10))
+    }
+    #[test]
+    fn test_should_detect_every_embedded_and_chunk_split_token() -> Result<()> {
+        let token = b"0123456789abcdef".repeat(4);
+        for offset in 0..64 {
+            let mut bytes = vec![b'a'; offset];
+            bytes.extend_from_slice(&token);
+            bytes.extend_from_slice(b"ffff");
+            assert!(scan(&[digest(&token)?])?.scan(&bytes).is_err());
+        }
+        let encoded = zstd::stream::encode_all(Cursor::new(&token), 1)?;
+        let decoded = plain(&encoded)?;
+        assert!(scan(&[digest(&token)?])?.scan(&decoded).is_err());
+        Ok(())
+    }
+    #[test]
+    fn test_should_charge_overlapping_candidates_across_all_sources_and_fail_closed() -> Result<()>
+    {
+        let mut state = scan(&[digest(b"not a token")?])?;
+        state.scan(&vec![b'a'; CANDIDATES + 63])?;
+        assert_eq!(state.candidates, CANDIDATES);
+        assert!(state.scan(&[b'c'; 64]).is_err());
+        assert!(state.scan(b"safe").is_err());
+        assert!(Scan::new(&["invalid".into()], 0, 0, Instant::now()).is_err());
+        assert!(Scan::new(&[digest(b"safe")?], CANDIDATES + 1, 0, Instant::now()).is_err());
+        Ok(())
+    }
+    #[test]
+    fn test_should_refuse_decoder_expansion_and_late_or_oversized_observations() -> Result<()> {
+        let encoded = zstd::stream::encode_all(Cursor::new(vec![0; PLAIN + 1]), 1)?;
+        assert!(plain(&encoded).is_err());
+        assert!(
+            scan(&[digest(b"safe")?])?
+                .scan(&vec![0; PLAIN + 1])
+                .is_err()
+        );
+        assert!(
+            Scan::new(&[digest(b"safe")?], 0, 0, Instant::now())?
+                .scan(b"safe")
+                .is_err()
+        );
+        Ok(())
+    }
+    #[tokio::test]
+    async fn test_should_reject_linked_special_deep_and_excessive_archive_entries() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        fs::symlink("/outside", root.path().join("link")).await?;
+        assert!(
+            files(root.path(), Instant::now() + Duration::from_secs(5))
+                .await
+                .is_err()
+        );
+        fs::remove_file(root.path().join("link")).await?;
+        let socket = UnixListener::bind(root.path().join("socket"))?;
+        assert!(
+            files(root.path(), Instant::now() + Duration::from_secs(5))
+                .await
+                .is_err()
+        );
+        drop(socket);
+        fs::remove_file(root.path().join("socket")).await?;
+        let mut deep = root.path().to_owned();
+        for _ in 0..9 {
+            deep.push("nested");
+        }
+        fs::create_dir_all(&deep).await?;
+        assert!(
+            files(root.path(), Instant::now() + Duration::from_secs(5))
+                .await
+                .is_err()
+        );
+        fs::remove_dir_all(root.path().join("nested")).await?;
+        for index in 0..65 {
+            fs::write(root.path().join(index.to_string()), b"").await?;
+        }
+        assert!(
+            files(root.path(), Instant::now() + Duration::from_secs(5))
+                .await
+                .is_err()
+        );
+        Ok(())
+    }
+    #[test]
+    fn test_should_reject_both_private_sdk_values_with_redacted_errors() -> Result<()> {
+        for value in [b"local-key".as_slice(), b"local-secret".as_slice()] {
+            let error = scan(&[digest(b"safe")?])?
+                .scan(value)
+                .err()
+                .context("credential leak accepted")?;
+            assert_eq!(error.to_string(), "injected SDK credential persisted");
+        }
+        Ok(())
+    }
+    #[test]
+    fn test_should_require_framed_actual_terminal_execution_rows() -> Result<()> {
+        let arn = "arn:aws:states:us-east-1:000000000000:execution:machine:case";
+        let expected = vec![arn.to_owned()];
+        let frame = |value: &Value| -> Result<Vec<u8>> { plain(&archive::encode(value)?) };
+        let empty = serde_json::json!({"schemaVersion":1,"executions":[],"unrelated":arn});
+        assert!(workflows(&frame(&empty)?, &expected).is_err());
+        let mut actual = serde_json::json!({"schemaVersion":1,"executions":[{
+            "arn":arn,"stoppedAt":"2026-10-30T00:00:00Z","outcome":{"status":"SUCCEEDED","output":"42"}
+        }]});
+        let valid = frame(&actual)?;
+        workflows(&valid, &expected)?;
+        assert!(workflows(arn.as_bytes(), &expected).is_err());
+        let mut bad_crc = valid.clone();
+        *bad_crc.get_mut(64).context("CRC corruption")? ^= 1;
+        assert!(workflows(&bad_crc, &expected).is_err());
+        actual["executions"][0]["outcome"]["status"] = "RUNNING".into();
+        assert!(workflows(&frame(&actual)?, &expected).is_err());
+        actual["executions"][0]["outcome"]["status"] = "FAILED".into();
+        actual["executions"][0]["stoppedAt"] = Value::Null;
+        assert!(workflows(&frame(&actual)?, &expected).is_err());
+        Ok(())
+    }
+    #[tokio::test]
+    async fn test_should_reject_replaced_fifo_before_any_blocking_read() -> Result<()> {
+        let root = tempfile::tempdir()?;
+        let path = root.path().join("server.log");
+        fs::write(&path, b"safe").await?;
+        let deadline = Instant::now() + Duration::from_secs(2);
+        assert_eq!(
+            files(root.path(), deadline).await?,
+            vec![fs::canonicalize(&path).await?]
+        );
+        fs::remove_file(&path).await?;
+        mkfifo(&path, Mode::from_bits_truncate(0o600))?;
+        assert!(read(&path, 1024, deadline).await.is_err());
+        assert!(Instant::now() < deadline);
+        Ok(())
+    }
+    #[tokio::test]
+    async fn test_should_reject_completed_worker_observed_at_cutoff() -> Result<()> {
+        let job = spawn_blocking(|| Ok(42));
+        while !job.is_finished() {
+            tokio::task::yield_now().await;
+        }
+        let deadline = Instant::now();
+        assert!(owned_cpu(deadline, job).await.is_err());
+        Ok(())
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/container_server.rs b/apps/rustack/tests/docker_startup/container_server.rs
new file mode 100644
index 00000000..0e288b57
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server.rs
@@ -0,0 +1,338 @@
+//! Actual Linux server container; normal production readiness and retirement.
+#![warn(
+    clippy::pedantic,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+#[path = "container_server/cli.rs"]
+mod cli;
+#[path = "container_server/image_profile.rs"]
+mod image_profile;
+#[path = "container_server/logs.rs"]
+mod logs;
+#[path = "container_server/owner.rs"]
+mod owner;
+#[path = "container_server/policy.rs"]
+mod policy;
+#[path = "container_server/records.rs"]
+mod records;
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    ffi::OsString,
+    path::PathBuf,
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+pub(super) use image_profile::ImageProfile;
+use owner::Owner;
+use serde::Deserialize;
+use tokio::time::Instant;
+
+use super::{
+    image_sdk::join_with_pid_before,
+    runner::{Runner, interpreter},
+};
+
+#[derive(Debug, Clone, Copy)]
+pub(super) enum Mode {
+    Sdk,
+    Unreachable,
+}
+impl Mode {
+    fn gateway_port(self) -> u16 {
+        match self {
+            Self::Sdk => 4566,
+            Self::Unreachable => 9,
+        }
+    }
+    fn name(self) -> &'static str {
+        match self {
+            Self::Sdk => "sdk-nested",
+            Self::Unreachable => "gateway-rejection",
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Versions {
+    s3: String,
+    dynamodb: String,
+    node: String,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Evidence {
+    schema_version: u8,
+    cases: Vec<String>,
+    versions: Versions,
+    computed: Vec<u16>,
+    counters: Vec<u8>,
+    warm: BTreeMap<String, String>,
+    parent_execution: String,
+    child_execution: String,
+}
+
+pub(super) async fn exercise(mode: Mode, profile: ImageProfile) -> Result<()> {
+    let cutoff = Instant::now() + Duration::from_secs(600);
+    let mut owner = Owner::new(mode, profile, cutoff).await?;
+    let observed = async {
+        owner.prepare(cutoff).await?;
+        match mode {
+            Mode::Sdk => {
+                owner.ready(cutoff).await?;
+                sdk(&owner, cutoff).await?;
+            }
+            Mode::Unreachable => owner.rejection(cutoff).await?,
+        }
+        Ok::<(), anyhow::Error>(())
+    }
+    .await;
+    // No outer timeout drops a live CLI wait or the root's cleanup authority.
+    let cleaned = owner.cleanup().await;
+    observed?;
+    cleaned?;
+    if profile == ImageProfile::Release {
+        let receipt = owner.publication_receipt(mode.name()).await?;
+        println!(
+            "WORKFLOWS_RELEASE_RESOURCE {}",
+            serde_json::to_string(&receipt)?
+        );
+    }
+    owner.release();
+    let topology = if profile == ImageProfile::Release {
+        "release-image server-container"
+    } else {
+        "server-container"
+    };
+    println!(
+        "actual {topology} linux/{}: {}",
+        owner.inputs.architecture,
+        mode.name()
+    );
+    Ok(())
+}
+
+async fn sdk(owner: &Owner, cutoff: Instant) -> Result<()> {
+    let identity = owner.identity()?;
+    let script = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../tests/workflows/server_container_sdk.py");
+    let architecture = if owner.inputs.architecture == "arm64" {
+        "arm64"
+    } else {
+        "x86_64"
+    };
+    let socket = owner
+        .inputs
+        .client
+        .strip_prefix("unix://")
+        .context("client socket prefix")?;
+    let args: Vec<OsString> = [
+        script.into_os_string(),
+        owner.endpoint()?.into(),
+        owner.inputs.sdk_image.clone().into(),
+        architecture.into(),
+        socket.into(),
+        identity.owner.to_string().into(),
+        identity.engine.to_string().into(),
+        format!("http://{}:4566/", owner.expected.name).into(),
+        owner.source(&owner.inputs.sdk_image)?.into(),
+        owner.source(&owner.inputs.relay)?.into(),
+        owner.expected.network.clone().into(),
+    ]
+    .into();
+    let child = Runner::spawn(&interpreter()?, &args)?;
+    let (entered, report) = join_with_pid_before(child, cutoff).await?;
+    ensure!(
+        report.pid == entered.context("server SDK child did not publish its execution PID")?
+            && !report.forced,
+        "server SDK process failed its execution barrier"
+    );
+    if !report.status.success() {
+        anyhow::bail!(
+            "server SDK consumer failed: {} ({})",
+            failure_stage(&report.stderr),
+            failure_origin(&report.stderr)
+        );
+    }
+    let observed: Evidence = cli::decode(&report.stdout)?;
+    validate(&observed)?;
+    let actual: BTreeSet<_> = owner.runtime_ids(cutoff).await?.into_iter().collect();
+    let reported: BTreeSet<_> = observed.warm.values().cloned().collect();
+    ensure!(
+        actual == reported && actual.len() == 2,
+        "warm server runtime pair did not survive until shutdown"
+    );
+    Ok(())
+}
+
+fn failure_stage(stderr: &[u8]) -> &'static str {
+    let Ok(text) = std::str::from_utf8(stderr) else {
+        return "invalid diagnostic";
+    };
+    let Some(stage) = text
+        .lines()
+        .next()
+        .and_then(|line| line.strip_prefix("server-container SDK oracle failed at "))
+    else {
+        return "unclassified diagnostic";
+    };
+    match stage {
+        "input" => "input",
+        "create-data" => "create-data",
+        "create-function" => "create-function",
+        "direct-first" => "direct-first",
+        "direct-second" => "direct-second",
+        "nested" => "nested",
+        "delete-data" => "delete-data",
+        _ => "invalid diagnostic stage",
+    }
+}
+
+fn failure_origin(stderr: &[u8]) -> String {
+    let origin = std::str::from_utf8(stderr)
+        .ok()
+        .filter(|text| text.len() <= 512 && text.lines().count() == 2)
+        .and_then(|text| text.lines().nth(1))
+        .and_then(|line| line.strip_prefix("origin "))
+        .and_then(|value| value.split_once(':'));
+    if let Some((name, line)) = origin {
+        let allowed = [
+            "server_container_sdk.py",
+            "server_container_oracle.py",
+            "handler_sdk_image.py",
+            "lambda_fault_support.py",
+            "stepfunctions_history.py",
+            "stepfunctions_nested.py",
+        ];
+        if allowed.contains(&name)
+            && line
+                .parse::<u16>()
+                .is_ok_and(|number| (1..=10000).contains(&number) && number.to_string() == line)
+        {
+            return format!("{name}:{line}");
+        }
+    }
+    "unknown source coordinate".to_owned()
+}
+
+fn validate(evidence: &Evidence) -> Result<()> {
+    ensure!(
+        evidence.schema_version == 1
+            && evidence.cases.iter().map(String::as_str).eq([
+                "direct-sdk-cold",
+                "direct-sdk-warm",
+                "nested-sync2-sdk",
+                "internal-dns-origin",
+                "no-server-mounts",
+                "warm-for-shutdown"
+            ])
+            && evidence.versions.s3 == "3.1105.0"
+            && evidence.versions.dynamodb == "3.1105.0"
+            && evidence.versions.node == "24.22.1"
+            && evidence.computed == [42, 46, 50]
+            && evidence.counters == [1, 2, 3]
+            && evidence.warm.len() == 2
+            && evidence.warm.contains_key("function")
+            && evidence.warm.contains_key("relay"),
+        "server SDK catalog or literal outputs differ"
+    );
+    let ids = evidence
+        .warm
+        .values()
+        .map(|id| cli::container_id(id))
+        .collect::<Result<BTreeSet<_>>>()?;
+    ensure!(
+        ids.len() == 2,
+        "server SDK reported duplicate environment IDs"
+    );
+    execution(&evidence.parent_execution, "ServerParent")?;
+    execution(&evidence.child_execution, "ServerChild")?;
+    ensure!(
+        evidence.parent_execution != evidence.child_execution,
+        "nested execution identity reused"
+    );
+    Ok(())
+}
+
+fn execution(value: &str, expected: &str) -> Result<()> {
+    ensure!(value.len() <= 256, "execution ARN byte bound");
+    let tail = value
+        .strip_prefix("arn:aws:states:us-east-1:000000000000:execution:")
+        .context("execution ARN scope")?;
+    let (name, run) = tail.split_once(':').context("execution ARN resource")?;
+    ensure!(
+        name.starts_with(expected)
+            && [name, run].iter().all(|part| (1..=80).contains(&part.len())
+                && part
+                    .bytes()
+                    .all(|b| b.is_ascii_alphanumeric() || b"_-".contains(&b))),
+        "execution ARN name grammar"
+    );
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_should_reject_invalid_daemon_socket_and_gid_before_cli_dispatch() -> Result<()> {
+        for source in [
+            "",
+            "/",
+            "relative/docker.sock",
+            "/run//docker.sock",
+            "/run/../docker.sock",
+            "/run/./docker.sock",
+            "/run/docker.sock/",
+            "/run/a,b",
+            "/run/a\n",
+        ] {
+            assert!(policy::socket_source(source).is_err());
+        }
+        policy::socket_source("/run/user/1000/docker.sock")?;
+        for gid in ["", "-1", "01", "2147483648", "4294967296", "991\n"] {
+            assert!(policy::socket_gid(gid).is_err());
+        }
+        assert_eq!(policy::socket_gid("0")?, 0);
+        assert_eq!(policy::socket_gid("991")?, 991);
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_never_project_untrusted_sdk_diagnostics() {
+        assert_eq!(failure_origin(b"server-container SDK oracle failed at direct-first\norigin server_container_oracle.py:50\n"), "server_container_oracle.py:50");
+        for origin in [
+            "local-secret:50",
+            "server_container_oracle.py:local-secret",
+            "server_container_oracle.py:050",
+            "server_container_oracle.py:0",
+            "server_container_oracle.py:10001",
+            "server_container_oracle.py:50\nlocal-secret",
+        ] {
+            let diagnostic =
+                format!("server-container SDK oracle failed at nested\norigin {origin}\n");
+            assert_eq!(
+                failure_origin(diagnostic.as_bytes()),
+                "unknown source coordinate"
+            );
+        }
+        assert_eq!(
+            failure_stage(b"server-container SDK oracle failed at nested\n"),
+            "nested"
+        );
+        for bytes in [
+            b"raw-private-diagnostic".as_slice(),
+            b"server-container SDK oracle failed at arbitrary\n",
+            b"\xff",
+        ] {
+            assert!(!["raw-private-diagnostic", "arbitrary"].contains(&failure_stage(bytes)));
+        }
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/cli.rs b/apps/rustack/tests/docker_startup/container_server/cli.rs
new file mode 100644
index 00000000..0e58d9df
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/cli.rs
@@ -0,0 +1,151 @@
+//! Direct bounded CLI observers; every child is joined before interpretation.
+
+use std::{
+    ffi::OsString,
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rustack_core::json::{JsonLimits, from_slice};
+use serde::de::DeserializeOwned;
+use sha2::{Digest, Sha256};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::super::runner::{Report, Runner};
+
+#[derive(Debug)]
+pub(super) struct Cli {
+    program: PathBuf,
+    socket: String,
+    pub engine: Uuid,
+}
+
+impl Cli {
+    pub async fn connect(program: PathBuf, socket: String, cutoff: Instant) -> Result<Self> {
+        let bytes = command(&program, &socket, &info_arguments(), cutoff).await?;
+        let engine = uuid(&decode::<String>(&bytes.stdout)?)?;
+        Ok(Self {
+            program,
+            socket,
+            engine,
+        })
+    }
+
+    pub async fn run(&self, args: &[String], cutoff: Instant) -> Result<Vec<u8>> {
+        Ok(self.output(args, cutoff).await?.stdout)
+    }
+
+    pub async fn output(&self, args: &[String], cutoff: Instant) -> Result<Report> {
+        let at = command_deadline(args, cutoff);
+        self.require_engine(at).await?;
+        let bytes = command(&self.program, &self.socket, args, at).await?;
+        self.require_engine(at).await?;
+        ensure!(Instant::now() < at, "late Docker CLI observation");
+        Ok(bytes)
+    }
+
+    pub async fn json<T: DeserializeOwned>(&self, args: &[String], cutoff: Instant) -> Result<T> {
+        decode(&self.run(args, cutoff).await?)
+    }
+
+    async fn require_engine(&self, cutoff: Instant) -> Result<()> {
+        let bytes = command(&self.program, &self.socket, &info_arguments(), cutoff).await?;
+        ensure!(
+            uuid(&decode::<String>(&bytes.stdout)?)? == self.engine,
+            "fixture Docker daemon identity changed"
+        );
+        Ok(())
+    }
+}
+
+pub(super) fn decode<T: DeserializeOwned>(raw: &[u8]) -> Result<T> {
+    // Docker configuration paths/env entries require4KiB strings; the whole
+    // response, depth, keys and aggregate members retain independent caps.
+    Ok(from_slice(
+        raw,
+        JsonLimits::new(32768, 16, 2048, 4096, 256)?,
+    )?)
+}
+
+pub(super) fn uuid(text: &str) -> Result<Uuid> {
+    ensure!(
+        text.len() == 36
+            && text
+                .bytes()
+                .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b) || b == b'-'),
+        "invalid fixture UUID grammar"
+    );
+    let id = Uuid::parse_str(text)?;
+    ensure!(
+        !id.is_nil() && id.to_string() == text,
+        "noncanonical fixture UUID"
+    );
+    Ok(id)
+}
+
+pub(super) fn container_id(text: &str) -> Result<String> {
+    ensure!(
+        text.len() == 64
+            && text
+                .bytes()
+                .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b)),
+        "invalid full container ID"
+    );
+    Ok(text.to_owned())
+}
+
+pub(super) fn arguments(parts: &[&str]) -> Vec<String> {
+    parts.iter().map(|part| (*part).to_owned()).collect()
+}
+
+fn info_arguments() -> Vec<String> {
+    arguments(&["info", "--format", "{{json .ID}}"])
+}
+
+fn command_deadline(args: &[String], cutoff: Instant) -> Instant {
+    let seconds = if args.first().is_some_and(|arg| arg == "wait") {
+        70
+    } else {
+        60
+    };
+    cutoff.min(Instant::now() + Duration::from_secs(seconds))
+}
+
+async fn command(program: &Path, socket: &str, args: &[String], cutoff: Instant) -> Result<Report> {
+    let cutoff = command_deadline(args, cutoff);
+    ensure!(
+        Instant::now() < cutoff,
+        "Docker CLI deadline expired before dispatch"
+    );
+    ensure!(
+        (1..=96).contains(&args.len())
+            && args
+                .iter()
+                .all(|arg| arg.len() <= 4096 && !arg.chars().any(char::is_control)),
+        "Docker CLI argv boundary"
+    );
+    let mut invocation = vec![OsString::from("--host"), OsString::from(socket)];
+    invocation.extend(args.iter().map(OsString::from));
+    let child = Runner::spawn(program, &invocation)?;
+    let report = child
+        .wait(cutoff)
+        .await
+        .context("join exact Docker CLI child")?;
+    // stderr may contain daemon-selected text. Preserve only its digest in
+    // diagnostics, never a response body or a private env-file value.
+    ensure!(
+        !report.forced && report.status.success(),
+        "Docker CLI failed (exit {:?}, forced {}, stderr SHA256/base64 {})",
+        report.status.code(),
+        report.forced,
+        STANDARD.encode(Sha256::digest(&report.stderr))
+    );
+    ensure!(
+        Instant::now() < cutoff,
+        "Docker CLI result expired after join"
+    );
+    Ok(report)
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/image_profile.rs b/apps/rustack/tests/docker_startup/container_server/image_profile.rs
new file mode 100644
index 00000000..859795bd
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/image_profile.rs
@@ -0,0 +1,164 @@
+//! Exact image contracts; release health remains enabled and independently observed.
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::docker::models::{
+    ContainerInspectResponse, HealthConfig, HealthStatusEnum,
+};
+use serde::Deserialize;
+use tokio::time::Instant;
+
+use super::cli::{Cli, arguments};
+
+const CONTRACT: &str = r#"{"user":{{json .Config.User}},"workingDir":{{json .Config.WorkingDir}},"entrypoint":{{json .Config.Entrypoint}},"cmd":{{json .Config.Cmd}},"health":{{json .Config.Healthcheck}}}"#;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ImageProfile {
+    Fixture,
+    Release,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Contract {
+    user: String,
+    working_dir: String,
+    entrypoint: Vec<String>,
+    cmd: Option<Vec<String>>,
+    health: Option<HealthConfig>,
+}
+
+impl ImageProfile {
+    pub(super) fn variable(self) -> &'static str {
+        match self {
+            Self::Fixture => "RUSTACK_SERVER_IMAGE",
+            Self::Release => "RUSTACK_RELEASE_IMAGE",
+        }
+    }
+    pub(super) fn configuration(self) -> &'static str {
+        match self {
+            Self::Fixture => "/etc/rustack/config.yaml",
+            Self::Release => "/data/qualification.yaml",
+        }
+    }
+    pub(super) async fn source(self, cli: &Cli, id: &str, cutoff: Instant) -> Result<()> {
+        let contract: Contract = cli
+            .json(
+                &arguments(&["image", "inspect", "--format", CONTRACT, id]),
+                cutoff,
+            )
+            .await?;
+        ensure!(
+            contract.user == "65532:65532"
+                && contract.working_dir == "/data"
+                && contract
+                    .entrypoint
+                    .iter()
+                    .map(String::as_str)
+                    .eq(["/rustack"])
+                && contract.cmd.as_ref().is_none_or(Vec::is_empty),
+            "server image execution contract differs"
+        );
+        self.health(contract.health.as_ref())
+    }
+    pub(super) fn health(self, health: Option<&HealthConfig>) -> Result<()> {
+        let health = health.context("server image healthcheck missing")?;
+        let command = health
+            .test
+            .as_ref()
+            .context("server image health command missing")?;
+        match self {
+            Self::Fixture => ensure!(
+                command.iter().map(String::as_str).eq(["NONE"])
+                    && [
+                        health.interval,
+                        health.timeout,
+                        health.retries,
+                        health.start_period,
+                        health.start_interval
+                    ]
+                    .iter()
+                    .all(|v| v.is_none_or(|v| v == 0)),
+                "fixture image health differs"
+            ),
+            Self::Release => ensure!(
+                command
+                    .iter()
+                    .map(String::as_str)
+                    .eq(["CMD", "/rustack", "--health-check"])
+                    && health.interval == Some(2_000_000_000)
+                    && health.timeout == Some(4_000_000_000)
+                    && health.start_period == Some(1_000_000_000)
+                    && health.retries == Some(3)
+                    && health.start_interval.is_none_or(|v| v == 0),
+                "release image health differs"
+            ),
+        }
+        Ok(())
+    }
+    pub(super) fn healthy(self, view: &ContainerInspectResponse) -> bool {
+        self == Self::Fixture
+            || view
+                .state
+                .as_ref()
+                .and_then(|s| s.health.as_ref())
+                .and_then(|h| h.status)
+                == Some(HealthStatusEnum::HEALTHY)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::{super::cli::decode, *};
+
+    #[test]
+    fn test_should_require_exact_release_exec_health_without_shell_or_disable() -> Result<()> {
+        let value = json!({"Test":["CMD","/rustack","--health-check"],"Interval":2_000_000_000_i64,
+            "Timeout":4_000_000_000_i64,"StartPeriod":1_000_000_000_i64,"Retries":3});
+        ImageProfile::Release
+            .health(Some(&decode::<HealthConfig>(&serde_json::to_vec(&value)?)?))?;
+        for (field, replacement) in [
+            ("Test", json!(["NONE"])),
+            ("Test", json!(["CMD-SHELL", "/rustack --health-check"])),
+            ("Interval", json!(0)),
+            ("Timeout", json!(1)),
+            ("StartPeriod", json!(0)),
+            ("Retries", json!(1)),
+            ("StartInterval", json!(1)),
+        ] {
+            let mut changed = value.clone();
+            changed
+                .as_object_mut()
+                .context("health fixture")?
+                .insert(field.into(), replacement);
+            assert!(
+                ImageProfile::Release
+                    .health(Some(&decode::<HealthConfig>(&serde_json::to_vec(
+                        &changed
+                    )?)?))
+                    .is_err()
+            );
+        }
+        assert!(ImageProfile::Release.health(None).is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_keep_fixture_none_and_require_actual_release_healthy_state() -> Result<()> {
+        let none: HealthConfig = decode(br#"{"Test":["NONE"]}"#)?;
+        ImageProfile::Fixture.health(Some(&none))?;
+        assert!(ImageProfile::Release.health(Some(&none)).is_err());
+        for state in ["starting", "unhealthy", "none", ""] {
+            let view: ContainerInspectResponse = decode(&serde_json::to_vec(
+                &json!({"State":{"Health":{"Status":state}}}),
+            )?)?;
+            assert!(ImageProfile::Fixture.healthy(&view));
+            assert!(!ImageProfile::Release.healthy(&view));
+        }
+        let view: ContainerInspectResponse =
+            decode(br#"{"State":{"Health":{"Status":"healthy"}}}"#)?;
+        assert!(ImageProfile::Release.healthy(&view));
+        Ok(())
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/logs.rs b/apps/rustack/tests/docker_startup/container_server/logs.rs
new file mode 100644
index 00000000..952ecdfb
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/logs.rs
@@ -0,0 +1,89 @@
+//! D97's raw plus decoded-JSON-token privacy profile, bounded for server logs.
+
+use anyhow::{Context, Result, ensure};
+use rustack_core::json::{JsonLimits, from_slice};
+
+pub(super) fn check(bytes: &[u8]) -> Result<()> {
+    ensure!(bytes.len() <= 65536, "server diagnostic byte cap");
+    std::str::from_utf8(bytes).context("invalid server diagnostic encoding")?;
+    private(bytes)?;
+    let mut start = None;
+    let mut escaped = false;
+    let mut tokens = 0usize;
+    let mut decoded = 0usize;
+    for (offset, byte) in bytes.iter().enumerate() {
+        let Some(begin) = start else {
+            if *byte == b'"' {
+                start = Some(offset);
+            }
+            continue;
+        };
+        if *byte == b'"' && !escaped {
+            tokens = tokens
+                .checked_add(1)
+                .context("server diagnostic token count")?;
+            ensure!(tokens <= 4096, "server diagnostic token cap");
+            let raw = bytes
+                .get(begin..=offset)
+                .context("server diagnostic token range")?;
+            let value: String = from_slice(raw, JsonLimits::new(65536, 1, 1, 65536, 256)?)?;
+            decoded = decoded
+                .checked_add(value.len())
+                .context("server decoded diagnostic bytes")?;
+            ensure!(decoded <= 65536, "server decoded diagnostic byte cap");
+            private(value.as_bytes())?;
+            start = None;
+        }
+        escaped = *byte == b'\\' && !escaped;
+    }
+    ensure!(start.is_none(), "unclosed server diagnostic JSON token");
+    Ok(())
+}
+
+fn private(bytes: &[u8]) -> Result<()> {
+    ensure!(
+        ![b"local-key".as_slice(), b"local-secret"]
+            .iter()
+            .any(|needle| bytes.windows(needle.len()).any(|window| window == *needle)),
+        "server diagnostic credential leak"
+    );
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_should_reject_raw_and_json_escaped_keys_and_credentials_without_echo() -> Result<()> {
+        for bytes in [
+            b"local-key".as_slice(),
+            b"local-secret",
+            br#"{"\u006cocal-key":"ignored"}"#,
+            br#"{"credential":"\u006cocal-\u0073ecret"}"#,
+            br#"mixed> {"credential":"\u006cocal-key"}"#,
+        ] {
+            let error = check(bytes)
+                .err()
+                .context("escaped diagnostic leak accepted")?;
+            assert_eq!(error.to_string(), "server diagnostic credential leak");
+        }
+        Ok(())
+    }
+    #[test]
+    fn test_should_accept_safe_structured_and_mixed_diagnostics_with_escaped_quotes() -> Result<()>
+    {
+        check(br#"{"message":"quoted \"safe\" content","details":{"ok":true}}"#)?;
+        check(br#"plain> "trailing\\" "safe""#)?;
+        check(b"plain safe diagnostic\n")?;
+        Ok(())
+    }
+    #[test]
+    fn test_should_fail_closed_on_malformed_or_over_budget_diagnostics() {
+        for bytes in [b"log \"unterminated".as_slice(), b"\xff", b"\"\x00\""] {
+            assert!(check(bytes).is_err());
+        }
+        assert!(check(&vec![b'a'; 65537]).is_err());
+        assert!(check("\"x\" ".repeat(4097).as_bytes()).is_err());
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/owner.rs b/apps/rustack/tests/docker_startup/container_server/owner.rs
new file mode 100644
index 00000000..bcee279a
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/owner.rs
@@ -0,0 +1,498 @@
+//! One retained owner above every CLI/SDK observer and all daemon effects.
+
+#[path = "owner/cleanup.rs"]
+mod cleanup;
+#[path = "owner/configuration.rs"]
+mod configuration;
+#[path = "owner/data.rs"]
+mod data;
+
+use std::{
+    fs::Permissions,
+    os::unix::fs::PermissionsExt,
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::docker::models::{ContainerInspectResponse, NetworkInspect, Volume};
+use serde::Deserialize;
+use serde_json::json;
+use tempfile::TempDir;
+use tokio::{
+    fs,
+    io::{AsyncReadExt, AsyncWriteExt},
+    time::{Instant, sleep, timeout_at},
+};
+
+use self::data::{DataOperation, DataOutput, commit_identity};
+use super::{
+    ImageProfile, Mode,
+    cli::{self, Cli, arguments},
+    policy::{self, Expected, Inputs},
+    records::Identity,
+};
+
+const INSPECT: &str = r#"{"Id":{{json .Id}},"Name":{{json .Name}},"Image":{{json .Image}},"State":{{json .State}},"Config":{"Image":{{json .Config.Image}},"User":{{json .Config.User}},"WorkingDir":{{json .Config.WorkingDir}},"Entrypoint":{{json .Config.Entrypoint}},"Cmd":{{json .Config.Cmd}},"Labels":{{json .Config.Labels}},"Healthcheck":{{json .Config.Healthcheck}}},"HostConfig":{{json .HostConfig}},"NetworkSettings":{{json .NetworkSettings}},"Mounts":{{json .Mounts}}}"#;
+const SOURCE: &str =
+    r#"{"id":{{json .Id}},"os":{{json .Os}},"architecture":{{json .Architecture}}}"#;
+
+#[derive(Debug)]
+enum Resources {
+    Intent,
+    Volume(Volume),
+    Server { volume: Volume, id: String },
+}
+#[derive(Debug, Clone, Copy)]
+enum ExpectedExit {
+    Success,
+    EndpointRejected(i64),
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Source {
+    id: String,
+    os: String,
+    architecture: String,
+}
+#[derive(Debug)]
+pub(super) struct Owner {
+    root: TempDir,
+    profile: ImageProfile,
+    path: PathBuf,
+    pub cli: Cli,
+    pub inputs: Inputs,
+    pub expected: Expected,
+    resources: Resources,
+    uncertain: bool,
+    identity: Option<Identity>,
+    endpoint: Option<String>,
+    expected_exit: ExpectedExit,
+    sources: Vec<(String, String)>,
+}
+
+impl Owner {
+    pub async fn new(mode: Mode, profile: ImageProfile, cutoff: Instant) -> Result<Self> {
+        let inputs = Inputs::load(profile)?;
+        let root = tempfile::tempdir()?;
+        timeout_at(
+            cutoff,
+            fs::set_permissions(root.path(), Permissions::from_mode(0o700)),
+        )
+        .await??;
+        let path = timeout_at(cutoff, fs::canonicalize(root.path())).await??;
+        let visible = path.to_str().context("private evidence path encoding")?;
+        ensure!(
+            visible.len() <= 4096 && !visible.chars().any(char::is_control),
+            "private evidence path bound"
+        );
+        let cli = Cli::connect(inputs.program.clone(), inputs.client.clone(), cutoff).await?;
+        let [network]: [NetworkInspect; 1] = cli
+            .json(&arguments(&["network", "inspect", &inputs.network]), cutoff)
+            .await?;
+        let network = policy::network(&network, &inputs.network)?;
+        let mut sources = Vec::new();
+        for reference in [&inputs.image, &inputs.sdk_image, &inputs.relay] {
+            let value: Source = cli
+                .json(
+                    &arguments(&["image", "inspect", "--format", SOURCE, reference]),
+                    cutoff,
+                )
+                .await?;
+            ensure!(
+                value.os == "linux" && value.architecture == inputs.architecture,
+                "server fixture source platform differs"
+            );
+            sources.push((reference.clone(), policy::source_id(&value.id)?));
+        }
+        let source = sources.first().context("server source capture")?.1.clone();
+        profile.source(&cli, &source, cutoff).await?;
+        let nonce = uuid::Uuid::new_v4().simple().to_string();
+        let expected = Expected {
+            name: format!("rustack-server-{nonce}"),
+            volume: format!("rustack-server-data-{nonce}"),
+            nonce,
+            engine: cli.engine,
+            source,
+            network,
+            socket: inputs.source_socket.clone(),
+            gid: inputs.gid.clone(),
+        };
+        let mut owner = Self {
+            root,
+            profile,
+            path,
+            cli,
+            inputs,
+            expected,
+            resources: Resources::Intent,
+            uncertain: false,
+            identity: None,
+            endpoint: None,
+            expected_exit: ExpectedExit::Success,
+            sources,
+        };
+        owner.write_environment(mode, cutoff).await?;
+        owner.write("intent.json", &serde_json::to_vec(&json!({
+            "schemaVersion":1,"engine":owner.expected.engine.to_string(),"nonce":owner.expected.nonce,
+            "server":owner.expected.name,"volume":owner.expected.volume,"source":owner.expected.source,
+            "network":owner.expected.network,"daemonSocket":owner.expected.socket,"socketGid":owner.expected.gid,
+            "sources":owner.sources
+        }))?, cutoff).await?;
+        owner.root.disable_cleanup(true);
+        eprintln!("server-container evidence: {}", owner.path.display());
+        Ok(owner)
+    }
+
+    pub async fn prepare(&mut self, cutoff: Instant) -> Result<()> {
+        let mut args = arguments(&["volume", "create", "--driver", "local"]);
+        for (key, value) in self.expected.labels("server-data") {
+            args.extend(["--label".into(), format!("{key}={value}")]);
+        }
+        args.push(self.expected.volume.clone());
+        self.uncertain = true;
+        let reply = self.cli.run(&args, cutoff).await?;
+        ensure!(
+            reply == format!("{}\n", self.expected.volume).as_bytes(),
+            "volume creation reply differs"
+        );
+        let data = self.inspect_volume(cutoff).await?;
+        policy::volume(&data, &self.expected)?;
+        self.resources = Resources::Volume(data.clone());
+        self.write("volume.json", &serde_json::to_vec(&data)?, cutoff)
+            .await?;
+        self.uncertain = false;
+        let args = self.create_arguments()?;
+        self.uncertain = true;
+        let reply = self.cli.run(&args, cutoff).await?;
+        let text = std::str::from_utf8(&reply)?
+            .strip_suffix('\n')
+            .context("container creation newline")?;
+        let id = cli::container_id(text)?;
+        self.resources = Resources::Server {
+            volume: data,
+            id: id.clone(),
+        };
+        self.write("server.json", &serde_json::to_vec(&json!({"id":id,"engine":self.expected.engine.to_string(),
+            "nonce":self.expected.nonce,"source":self.expected.source,"volume":self.expected.volume}))?, cutoff).await?;
+        self.inspect_server(cutoff).await?;
+        self.uncertain = false;
+        if self.profile == ImageProfile::Release {
+            self.install_public_configuration(cutoff).await?;
+        }
+        self.uncertain = true;
+        let started = self.cli.run(&arguments(&["start", &id]), cutoff).await?;
+        ensure!(
+            started == format!("{id}\n").as_bytes(),
+            "server start reply differs"
+        );
+        self.uncertain = false;
+        Ok(())
+    }
+
+    fn create_arguments(&self) -> Result<Vec<String>> {
+        let environment = self.path.join("server.env");
+        let environment = environment
+            .to_str()
+            .context("private environment path encoding")?;
+        let mut args = arguments(&[
+            "create",
+            "--pull=never",
+            "--name",
+            &self.expected.name,
+            "--platform",
+            &format!("linux/{}", self.inputs.architecture),
+            "--user",
+            "65532:65532",
+            "--group-add",
+            &self.expected.gid,
+            "--read-only",
+            "--cap-drop",
+            "ALL",
+            "--security-opt",
+            "no-new-privileges:true",
+            "--cgroupns",
+            "private",
+            "--memory",
+            "512m",
+            "--memory-swap",
+            "512m",
+            "--cpus",
+            "1",
+            "--pids-limit",
+            "128",
+            "--tmpfs",
+            &format!("/tmp:{}", policy::TEMPORARY),
+            "--log-driver",
+            "json-file",
+            "--log-opt",
+            "max-size=1m",
+            "--log-opt",
+            "max-file=1",
+            "--restart",
+            "no",
+            "--network",
+            &self.expected.network,
+            "--network-alias",
+            &self.expected.name,
+            "--publish",
+            "127.0.0.1::4566",
+            "--env-file",
+            environment,
+            "--mount",
+            &format!(
+                "type=bind,source={},target=/run/rustack/docker.sock,readonly",
+                self.expected.socket
+            ),
+            "--mount",
+            &format!("type=volume,source={},target=/data", self.expected.volume),
+        ]);
+        for (key, value) in self.expected.labels("server") {
+            args.extend(["--label".into(), format!("{key}={value}")]);
+        }
+        args.push(self.expected.source.clone());
+        Ok(args)
+    }
+
+    pub async fn ready(&mut self, cutoff: Instant) -> Result<()> {
+        let at = cutoff.min(Instant::now() + Duration::from_secs(180));
+        loop {
+            let view = self.inspect_server(at).await?;
+            ensure!(
+                view.state.as_ref().and_then(|s| s.running) == Some(true),
+                "server exited before readiness"
+            );
+            let endpoint = policy::endpoint(&view, &self.expected)?;
+            self.endpoint = Some(endpoint.clone());
+            if let Ok((status, value)) =
+                super::super::process::get(&endpoint, "/_rustack/capabilities").await
+            {
+                if value.get("ready").and_then(serde_json::Value::as_bool) == Some(true)
+                    && self.profile.healthy(&view)
+                {
+                    ensure!(
+                        status == 200
+                            && value
+                                .pointer("/workers/docker/ready")
+                                .and_then(serde_json::Value::as_bool)
+                                == Some(true)
+                            && value
+                                .pointer("/workers/docker/sdkGateway")
+                                .and_then(serde_json::Value::as_bool)
+                                == Some(true)
+                            && value
+                                .pointer("/workflows/lambdaRequestResponse")
+                                .and_then(serde_json::Value::as_bool)
+                                == Some(true)
+                            && value
+                                .pointer("/workflows/nestedSync")
+                                .and_then(serde_json::Value::as_bool)
+                                == Some(true)
+                            && value
+                                .pointer("/workflows/stateTypes")
+                                .and_then(serde_json::Value::as_array)
+                                .is_some_and(|s| s.len() == 8)
+                            && value
+                                .pointer("/workers/docker/platform")
+                                .and_then(serde_json::Value::as_str)
+                                == Some(format!("linux/{}", self.inputs.architecture).as_str()),
+                        "false server-container readiness"
+                    );
+                    ensure!(Instant::now() < at, "late server-container readiness");
+                    self.capture_identity(at).await?;
+                    return Ok(());
+                }
+            }
+            ensure!(Instant::now() < at, "server-container readiness deadline");
+            sleep(Duration::from_millis(100)).await;
+        }
+    }
+
+    pub async fn rejection(&mut self, cutoff: Instant) -> Result<()> {
+        let at = cutoff.min(Instant::now() + Duration::from_secs(180));
+        loop {
+            let view = self.inspect_server(at).await?;
+            let state = view.state.as_ref().context("server startup state")?;
+            if state.running == Some(false) {
+                let code = state.exit_code.context("server startup exit code")?;
+                ensure!(
+                    code != 0 && state.oom_killed == Some(false),
+                    "unrelated server startup exit"
+                );
+                let logs = self.logs(at).await?;
+                let text = std::str::from_utf8(&logs)?;
+                ensure!(
+                    text.contains("Docker startup endpoint qualification failed"),
+                    "server rejected an unrelated startup prerequisite"
+                );
+                self.capture_identity(at).await?;
+                self.expected_exit = ExpectedExit::EndpointRejected(code);
+                return Ok(());
+            }
+            if let Ok(endpoint) = policy::endpoint(&view, &self.expected) {
+                if let Ok((_, value)) =
+                    super::super::process::get(&endpoint, "/_rustack/capabilities").await
+                {
+                    ensure!(
+                        value.get("ready").and_then(serde_json::Value::as_bool) != Some(true),
+                        "unreachable server gateway became ready"
+                    );
+                }
+            }
+            ensure!(Instant::now() < at, "server gateway rejection deadline");
+            sleep(Duration::from_millis(100)).await;
+        }
+    }
+
+    pub fn endpoint(&self) -> Result<&str> {
+        self.endpoint
+            .as_deref()
+            .context("qualified server endpoint")
+    }
+    pub fn identity(&self) -> Result<Identity> {
+        self.identity
+            .context("verified server installation identity")
+    }
+    pub fn source(&self, reference: &str) -> Result<&str> {
+        self.sources
+            .iter()
+            .find(|(name, _)| name == reference)
+            .map(|(_, id)| id.as_str())
+            .context("captured source ID")
+    }
+    pub async fn publication_receipt(&self, mode: &str) -> Result<serde_json::Value> {
+        let at = Instant::now() + Duration::from_secs(10);
+        let mut documents = Vec::new();
+        for name in ["server.json", "shutdown.json", "cleanup.json"] {
+            let value = timeout_at(at, async {
+                let file = fs::File::open(self.path.join(name)).await?;
+                let mut bytes = Vec::new();
+                file.take(8193).read_to_end(&mut bytes).await?;
+                ensure!(bytes.len() <= 8192, "publication receipt bound");
+                cli::decode::<serde_json::Value>(&bytes)
+            })
+            .await??;
+            documents.push(value);
+        }
+        let mut documents = documents.into_iter();
+        let server = documents.next().context("server receipt")?;
+        let shutdown = documents.next().context("shutdown receipt")?;
+        let cleanup = documents.next().context("cleanup receipt")?;
+        Ok(json!({"schemaVersion":1,"profile":"release","mode":mode,
+            "architecture":self.inputs.architecture,"server":server,"shutdown":shutdown,"cleanup":cleanup}))
+    }
+    pub fn release(&mut self) {
+        self.root.disable_cleanup(false);
+    }
+
+    async fn inspect_volume(&self, cutoff: Instant) -> Result<Volume> {
+        let [volume]: [Volume; 1] = self
+            .cli
+            .json(
+                &arguments(&["volume", "inspect", &self.expected.volume]),
+                cutoff,
+            )
+            .await?;
+        Ok(volume)
+    }
+    async fn inspect_server(&self, cutoff: Instant) -> Result<ContainerInspectResponse> {
+        let Resources::Server { volume, id } = &self.resources else {
+            anyhow::bail!("server container not captured");
+        };
+        let view: ContainerInspectResponse = self
+            .cli
+            .json(
+                &arguments(&["container", "inspect", "--format", INSPECT, id]),
+                cutoff,
+            )
+            .await?;
+        ensure!(
+            view.id.as_deref() == Some(id.as_str()),
+            "server inspected a different container"
+        );
+        policy::server(&view, &self.expected, volume)?;
+        self.profile
+            .health(view.config.as_ref().and_then(|c| c.healthcheck.as_ref()))?;
+        Ok(view)
+    }
+    async fn capture_identity(&mut self, cutoff: Instant) -> Result<()> {
+        self.inspect_server(cutoff).await?;
+        let archives = match self.transfer_data(DataOperation::Identity, cutoff).await {
+            Ok(DataOutput::Identity(archives)) => Ok(archives),
+            Ok(DataOutput::Configuration(_)) => {
+                Err(anyhow::anyhow!("incorrect data-volume identity operation"))
+            }
+            Err(error) => Err(error),
+        };
+        commit_identity(
+            &mut self.uncertain,
+            &mut self.identity,
+            archives,
+            self.cli.engine,
+            &self.path,
+            cutoff,
+        )
+        .await
+    }
+    async fn logs(&self, cutoff: Instant) -> Result<Vec<u8>> {
+        let Resources::Server { id, .. } = &self.resources else {
+            anyhow::bail!("server logs without container");
+        };
+        let output = self.cli.output(&arguments(&["logs", id]), cutoff).await?;
+        let mut bytes = output.stdout;
+        bytes.extend_from_slice(&output.stderr);
+        super::logs::check(&bytes)?;
+        Ok(bytes)
+    }
+    async fn write(&self, name: &str, bytes: &[u8], cutoff: Instant) -> Result<()> {
+        write_private(&self.path, name, bytes, cutoff).await
+    }
+    async fn write_environment(&self, mode: Mode, cutoff: Instant) -> Result<()> {
+        let relay = self.source(&self.inputs.relay)?;
+        let configuration = self.profile.configuration();
+        let text = format!(
+            concat!(
+                "SERVICES=lambda,stepfunctions,s3,dynamodb\n",
+                "GATEWAY_LISTEN=0.0.0.0:4566\n",
+                "RUSTACK_CONFIG={configuration}\n",
+                "DATA_DIR=/data/state\n",
+                "LAMBDA_EXECUTOR=docker\n",
+                "LAMBDA_DOCKER_SOCKET=unix:///run/rustack/docker.sock\n",
+                "LAMBDA_DOCKER_RELAY_IMAGE={relay}\n",
+                "LAMBDA_DOCKER_NETWORK={network}\n",
+                "LAMBDA_DOCKER_GATEWAY_ENDPOINT=http://{server}:{port}/\n",
+                "LAMBDA_DOCKER_CROSS_ARCHITECTURE=false\n",
+                "LAMBDA_INIT_TIMEOUT_SECS=20\n",
+                "LOG_LEVEL=error\n",
+                "LAMBDA_SKIP_SIGNATURE_VALIDATION=false\n",
+                "STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION=false\n",
+                "S3_SKIP_SIGNATURE_VALIDATION=false\n",
+                "DYNAMODB_SKIP_SIGNATURE_VALIDATION=false\n",
+                "ACCESS_KEY=local-key\n",
+                "SECRET_KEY=local-secret\n",
+                "AWS_ACCESS_KEY_ID=local-key\n",
+                "AWS_SECRET_ACCESS_KEY=local-secret\n",
+                "AWS_EC2_METADATA_DISABLED=true\n",
+                "LAMBDA_DOCKER_SDK_ACCESS_KEY_ID=local-key\n",
+                "LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY=local-secret\n",
+            ),
+            configuration = configuration,
+            relay = relay,
+            network = self.expected.network,
+            server = self.expected.name,
+            port = mode.gateway_port(),
+        );
+        self.write("server.env", text.as_bytes(), cutoff).await
+    }
+}
+
+async fn write_private(directory: &Path, name: &str, bytes: &[u8], cutoff: Instant) -> Result<()> {
+    let at = cutoff.min(Instant::now() + Duration::from_secs(10));
+    let mut options = fs::OpenOptions::new();
+    options.write(true).create_new(true).mode(0o600);
+    let mut file = timeout_at(at, options.open(directory.join(name))).await??;
+    timeout_at(at, file.write_all(bytes)).await??;
+    timeout_at(at, file.sync_all()).await??;
+    ensure!(Instant::now() < at, "private server evidence write expired");
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/owner/cleanup.rs b/apps/rustack/tests/docker_startup/container_server/owner/cleanup.rs
new file mode 100644
index 00000000..03d60df5
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/owner/cleanup.rs
@@ -0,0 +1,335 @@
+//! Shutdown receipt precedes namespace audit and exact stopped-resource removal.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result, ensure};
+use serde::Deserialize;
+use serde_json::json;
+use tokio::time::Instant;
+
+use super::{
+    super::{
+        cli::{self, arguments},
+        policy,
+    },
+    ExpectedExit, Owner, Resources, SOURCE, Source,
+};
+
+#[derive(Debug, Deserialize)]
+struct ImageRow {
+    #[serde(rename = "Repository")]
+    repository: String,
+}
+
+impl Owner {
+    pub(crate) async fn cleanup(&mut self) -> Result<()> {
+        let cutoff = Instant::now() + Duration::from_secs(180);
+        if matches!(self.resources, Resources::Server { .. }) {
+            self.stop_server(cutoff).await?;
+            ensure!(
+                !self.uncertain,
+                "uncertain server mutation remains retained"
+            );
+            if self.identity.is_none() {
+                self.capture_identity(cutoff).await?;
+            }
+            self.audit_runtime(cutoff).await?;
+            self.remove_server(cutoff).await?;
+        }
+        ensure!(
+            !self.uncertain,
+            "uncertain server/volume creation remains retained"
+        );
+        if let Resources::Volume(_) = self.resources {
+            self.remove_volume(cutoff).await?;
+        }
+        self.verify_sources(cutoff).await?;
+        self.write(
+            "cleanup.json",
+            &serde_json::to_vec(&json!({
+                "schemaVersion":1,"serverAbsent":true,"volumeAbsent":true,
+                "uncertain":false,"sourcesPreserved":self.sources,
+                "engine":self.expected.engine.to_string()
+            }))?,
+            cutoff,
+        )
+        .await?;
+        Ok(())
+    }
+
+    async fn stop_server(&mut self, cutoff: Instant) -> Result<()> {
+        let at = cutoff.min(Instant::now() + Duration::from_secs(70));
+        let view = self.inspect_server(at).await?;
+        let id = view.id.as_deref().context("owned server shutdown ID")?;
+        let state = view.state.as_ref().context("server shutdown state")?;
+        if state.running == Some(true) {
+            let prior = self.uncertain;
+            self.uncertain = true;
+            let stopped = self
+                .cli
+                .run(&arguments(&["kill", "--signal", "TERM", id]), at)
+                .await?;
+            ensure!(
+                stopped == format!("{id}\n").as_bytes(),
+                "server signal reply differs"
+            );
+            self.uncertain = prior;
+        }
+        let output = self.cli.run(&arguments(&["wait", id]), at).await?;
+        let text = std::str::from_utf8(&output)?
+            .strip_suffix('\n')
+            .context("server wait newline")?;
+        let code: i64 = text.parse()?;
+        ensure!(
+            (0..=255).contains(&code) && code.to_string() == text,
+            "invalid server exit receipt"
+        );
+        let expected = match self.expected_exit {
+            ExpectedExit::Success => 0,
+            ExpectedExit::EndpointRejected(code) => code,
+        };
+        let actual = self.inspect_server(at).await?;
+        let state = actual.state.as_ref().context("server final state")?;
+        ensure!(
+            code == expected
+                && state.running == Some(false)
+                && state.exit_code == Some(code)
+                && state.oom_killed == Some(false)
+                && state.dead != Some(true),
+            "unexpected or unjoined server shutdown"
+        );
+        let logs = self.logs(cutoff).await?;
+        self.write("server.log", &logs, cutoff).await?;
+        self.write(
+            "shutdown.json",
+            &serde_json::to_vec(&json!({"id":id,"exitCode":code,
+            "engine":self.expected.engine.to_string(),"physicallyStopped":true}))?,
+            cutoff,
+        )
+        .await?;
+        Ok(())
+    }
+
+    pub(in crate::container_server) async fn runtime_ids(
+        &self,
+        cutoff: Instant,
+    ) -> Result<Vec<String>> {
+        let identity = self.identity()?;
+        let raw = self
+            .cli
+            .run(
+                &arguments(&[
+                    "container",
+                    "ls",
+                    "--all",
+                    "--no-trunc",
+                    "--filter",
+                    &format!("label=rustack.lambda.ownerId={}", identity.owner),
+                    "--format",
+                    "{{json .ID}}",
+                ]),
+                cutoff,
+            )
+            .await?;
+        let text = std::str::from_utf8(&raw)?;
+        let mut ids = Vec::new();
+        for line in text.lines() {
+            ensure!(ids.len() < 64, "runtime container inventory count");
+            ids.push(cli::container_id(&cli::decode::<String>(line.as_bytes())?)?);
+        }
+        Ok(ids)
+    }
+
+    async fn audit_runtime(&self, cutoff: Instant) -> Result<()> {
+        ensure!(
+            self.runtime_ids(cutoff).await?.is_empty(),
+            "production server left runtime containers"
+        );
+        let identity = self.identity()?;
+        let volumes = self
+            .cli
+            .run(
+                &arguments(&[
+                    "volume",
+                    "ls",
+                    "--filter",
+                    &format!("label=rustack.lambda.ownerId={}", identity.owner),
+                    "--format",
+                    "{{json .Name}}",
+                ]),
+                cutoff,
+            )
+            .await?;
+        ensure!(
+            volumes.iter().all(u8::is_ascii_whitespace),
+            "production server left runtime volumes"
+        );
+        let raw = self
+            .cli
+            .run(
+                &arguments(&[
+                    "image",
+                    "ls",
+                    "--all",
+                    "--no-trunc",
+                    "--format",
+                    "{{json .}}",
+                ]),
+                cutoff,
+            )
+            .await?;
+        let text = std::str::from_utf8(&raw)?;
+        let prefix = format!("rustack-internal/lambda-{}/", identity.owner.simple());
+        for (index, line) in text.lines().enumerate() {
+            ensure!(index < 4096, "complete image inventory count");
+            let row: ImageRow = cli::decode(line.as_bytes())?;
+            ensure!(
+                row.repository.len() <= 1024 && !row.repository.chars().any(char::is_control),
+                "image repository inventory bound"
+            );
+            let familiar = canonical(&row.repository);
+            ensure!(
+                !familiar.starts_with(&prefix),
+                "production server left private image aliases"
+            );
+        }
+        Ok(())
+    }
+
+    async fn remove_server(&mut self, cutoff: Instant) -> Result<()> {
+        let view = self.inspect_server(cutoff).await?;
+        let state = view.state.as_ref().context("server removal state")?;
+        ensure!(
+            state.running == Some(false),
+            "refuse removal of a running server"
+        );
+        let Resources::Server { volume, id } = &self.resources else {
+            anyhow::bail!("server removal authority missing");
+        };
+        let data = volume.clone();
+        let id = id.clone();
+        self.uncertain = true;
+        let removed = self
+            .cli
+            .run(&arguments(&["container", "rm", &id]), cutoff)
+            .await?;
+        ensure!(
+            removed == format!("{id}\n").as_bytes(),
+            "server removal reply differs"
+        );
+        let remaining = self
+            .cli
+            .run(
+                &arguments(&[
+                    "container",
+                    "ls",
+                    "--all",
+                    "--no-trunc",
+                    "--filter",
+                    &format!("id={id}"),
+                    "--format",
+                    "{{json .ID}}",
+                ]),
+                cutoff,
+            )
+            .await?;
+        ensure!(
+            remaining.iter().all(u8::is_ascii_whitespace),
+            "server container remains after removal"
+        );
+        self.resources = Resources::Volume(data);
+        self.uncertain = false;
+        Ok(())
+    }
+
+    async fn remove_volume(&mut self, cutoff: Instant) -> Result<()> {
+        let Resources::Volume(recorded) = &self.resources else {
+            anyhow::bail!("server volume removal authority missing");
+        };
+        let volume = self.inspect_volume(cutoff).await?;
+        policy::volume(&volume, &self.expected)?;
+        ensure!(
+            volume.mountpoint == recorded.mountpoint,
+            "server volume mountpoint changed"
+        );
+        let attachments = self
+            .cli
+            .run(
+                &arguments(&[
+                    "container",
+                    "ls",
+                    "--all",
+                    "--no-trunc",
+                    "--filter",
+                    &format!("volume={}", self.expected.volume),
+                    "--format",
+                    "{{json .ID}}",
+                ]),
+                cutoff,
+            )
+            .await?;
+        ensure!(
+            attachments.iter().all(u8::is_ascii_whitespace),
+            "server volume still has an attachment"
+        );
+        self.uncertain = true;
+        let removed = self
+            .cli
+            .run(&arguments(&["volume", "rm", &self.expected.volume]), cutoff)
+            .await?;
+        ensure!(
+            removed == format!("{}\n", self.expected.volume).as_bytes(),
+            "server volume removal reply differs"
+        );
+        let remaining = self
+            .cli
+            .run(
+                &arguments(&[
+                    "volume",
+                    "ls",
+                    "--filter",
+                    &format!("label={}={}", policy::NONCE_LABEL, self.expected.nonce),
+                    "--format",
+                    "{{json .Name}}",
+                ]),
+                cutoff,
+            )
+            .await?;
+        ensure!(
+            remaining.iter().all(u8::is_ascii_whitespace),
+            "server task volume remains after removal"
+        );
+        self.resources = Resources::Intent;
+        self.uncertain = false;
+        Ok(())
+    }
+
+    async fn verify_sources(&self, cutoff: Instant) -> Result<()> {
+        for (reference, expected) in &self.sources {
+            let source: Source = self
+                .cli
+                .json(
+                    &arguments(&["image", "inspect", "--format", SOURCE, reference]),
+                    cutoff,
+                )
+                .await?;
+            ensure!(
+                source.id == *expected
+                    && source.os == "linux"
+                    && source.architecture == self.inputs.architecture,
+                "server fixture source image changed"
+            );
+        }
+        Ok(())
+    }
+}
+
+fn canonical(mut value: &str) -> &str {
+    for prefix in ["docker.io/", "index.docker.io/", "registry-1.docker.io/"] {
+        if let Some(tail) = value.strip_prefix(prefix) {
+            value = tail;
+            break;
+        }
+    }
+    value.strip_prefix("library/").unwrap_or(value)
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/owner/configuration.rs b/apps/rustack/tests/docker_startup/container_server/owner/configuration.rs
new file mode 100644
index 00000000..bdc1f6ae
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/owner/configuration.rs
@@ -0,0 +1,99 @@
+//! Release profile configuration copied into the existing exact data volume.
+
+use std::{fs::Permissions, os::unix::fs::PermissionsExt, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use base64::{Engine, engine::general_purpose::STANDARD};
+use serde_json::json;
+use sha2::{Digest, Sha256};
+use tokio::{
+    fs,
+    time::{Instant, timeout_at},
+};
+
+use super::{
+    super::{cli::arguments, records},
+    Owner, Resources,
+    data::{DataOperation, DataOutput},
+};
+
+const CONFIGURATION: &[u8] = include_bytes!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../tests/lambda-fixtures/server-config.yaml"
+));
+
+impl Owner {
+    pub(super) async fn install_public_configuration(&mut self, cutoff: Instant) -> Result<()> {
+        ensure!(
+            (1..=4096).contains(&CONFIGURATION.len()),
+            "public configuration byte bound"
+        );
+        self.inspect_server(cutoff).await?;
+        let Resources::Server { id, .. } = &self.resources else {
+            anyhow::bail!("public configuration without exact server");
+        };
+        let id = id.clone();
+        self.write("qualification.yaml", CONFIGURATION, cutoff)
+            .await?;
+        let path = self.path.join("qualification.yaml");
+        let at = cutoff.min(Instant::now() + Duration::from_secs(10));
+        timeout_at(
+            at,
+            fs::set_permissions(&path, Permissions::from_mode(0o644)),
+        )
+        .await??;
+        ensure!(
+            timeout_at(at, fs::metadata(&path))
+                .await??
+                .permissions()
+                .mode()
+                & 0o777
+                == 0o644,
+            "public configuration host mode differs"
+        );
+        let source = path
+            .to_str()
+            .context("public configuration path encoding")?;
+        let DataOutput::Configuration(observed) = self
+            .transfer_data(DataOperation::Configuration(source), cutoff)
+            .await?
+        else {
+            anyhow::bail!("incorrect data-volume configuration operation");
+        };
+        self.inspect_server(cutoff).await?;
+        records::configuration(&observed, CONFIGURATION)?;
+        self.write(
+            "configuration.json",
+            &serde_json::to_vec(&json!({
+                "schemaVersion":1,"id":id,"engine":self.expected.engine.to_string(),
+                "name":"qualification.yaml","bytes":CONFIGURATION.len(),"uid":65532,"gid":65532,"mode":420,
+                "sha256Base64":STANDARD.encode(Sha256::digest(CONFIGURATION))
+            }))?,
+            cutoff,
+        )
+        .await?;
+        self.uncertain = false;
+        Ok(())
+    }
+}
+
+pub(super) fn copy_arguments(source: &str, target: &str) -> Vec<String> {
+    // Moby's explicit CopyUIDGID branch binds extraction to Config.User.
+    // The default branch can preserve the host archive's UID/GID instead.
+    arguments(&["cp", "--archive", source, target])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::copy_arguments;
+
+    #[test]
+    fn test_should_request_explicit_container_user_ownership_for_public_copy() {
+        let source = "/private/controlled root/qualification.yaml";
+        let target = "controlled-id:/data/qualification.yaml";
+        assert_eq!(
+            copy_arguments(source, target),
+            ["cp", "--archive", source, target],
+        );
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/owner/data.rs b/apps/rustack/tests/docker_startup/container_server/owner/data.rs
new file mode 100644
index 00000000..e93c2183
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/owner/data.rs
@@ -0,0 +1,308 @@
+//! Exact unstarted volume helper; the actual server keeps its read-only socket.
+
+#[path = "data_policy.rs"]
+mod policy;
+
+use std::path::Path;
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::docker::models::ContainerInspectResponse;
+use serde_json::json;
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{
+    super::{
+        cli::{self, arguments},
+        policy::{Expected, volume},
+        records::{self, Identity},
+    },
+    INSPECT, Owner, configuration, write_private,
+};
+
+#[derive(Debug)]
+pub(super) enum DataOperation<'a> {
+    Identity,
+    Configuration(&'a str),
+}
+
+#[derive(Debug)]
+pub(super) enum DataOutput {
+    Identity([Vec<u8>; 2]),
+    Configuration(Vec<u8>),
+}
+
+impl Owner {
+    pub(super) async fn transfer_data(
+        &mut self,
+        operation: DataOperation<'_>,
+        cutoff: Instant,
+    ) -> Result<DataOutput> {
+        ensure!(!self.uncertain, "uncertain parent before data transfer");
+        let data = self.inspect_volume(cutoff).await?;
+        volume(&data, &self.expected)?;
+        let transfer = Uuid::new_v4().simple().to_string();
+        let name = format!("rustack-transfer-{}-{transfer}", self.expected.nonce);
+        let writing = matches!(operation, DataOperation::Configuration(_));
+        let args = create_arguments(&name, &self.expected);
+        self.write(&format!("data-{transfer}-intent.json"), &serde_json::to_vec(&json!({
+            "schemaVersion":1,"name":name,"engine":self.expected.engine.to_string(),
+            "parentNonce":self.expected.nonce,"source":self.expected.source,"volume":self.expected.volume,
+            "configurationWrite":writing,"argv":args
+        }))?, cutoff).await?;
+        self.uncertain = true;
+        let reply = self.cli.run(&args, cutoff).await?;
+        let text = std::str::from_utf8(&reply)?
+            .strip_suffix('\n')
+            .context("data helper create newline")?;
+        let id = cli::container_id(text)?;
+        self.write(&format!("data-{transfer}-created.json"), &serde_json::to_vec(&json!({
+            "id":id,"name":name,"engine":self.expected.engine.to_string(),"parentNonce":self.expected.nonce
+        }))?, cutoff).await?;
+        let result = async {
+            self.inspect_data(&id, &name, cutoff).await?;
+            match operation {
+                DataOperation::Identity => {
+                    let mut archives = [Vec::new(), Vec::new()];
+                    for (slot, filename) in archives.iter_mut().zip(["owner.v1", "daemon.v1"]) {
+                        let source = format!("{id}:/data/state/.rustack-lambda-docker/{filename}");
+                        *slot = self
+                            .cli
+                            .run(&arguments(&["cp", &source, "-"]), cutoff)
+                            .await?;
+                        self.write(&format!("data-{transfer}-{filename}.tar"), slot, cutoff)
+                            .await?;
+                    }
+                    Ok(DataOutput::Identity(archives))
+                }
+                DataOperation::Configuration(source) => {
+                    let target = format!("{id}:/data/qualification.yaml");
+                    drop(
+                        self.cli
+                            .run(&configuration::copy_arguments(source, &target), cutoff)
+                            .await?,
+                    );
+                    let archive = self
+                        .cli
+                        .run(&arguments(&["cp", &target, "-"]), cutoff)
+                        .await?;
+                    self.write(
+                        &format!("data-{transfer}-configuration.tar"),
+                        &archive,
+                        cutoff,
+                    )
+                    .await?;
+                    Ok(DataOutput::Configuration(archive))
+                }
+            }
+        }
+        .await;
+        self.inspect_data(&id, &name, cutoff).await?;
+        let removed = self.cli.run(&arguments(&["rm", &id]), cutoff).await?;
+        ensure!(
+            removed == format!("{id}\n").as_bytes(),
+            "data helper removal reply differs"
+        );
+        let remaining = self
+            .cli
+            .run(
+                &arguments(&[
+                    "container",
+                    "ls",
+                    "--all",
+                    "--no-trunc",
+                    "--filter",
+                    &format!("id={id}"),
+                    "--format",
+                    "{{json .ID}}",
+                ]),
+                cutoff,
+            )
+            .await?;
+        ensure!(remaining.is_empty(), "data helper removal unconfirmed");
+        self.write(
+            &format!("data-{transfer}-removed.json"),
+            &serde_json::to_vec(&json!({
+                "id":id,"engine":self.expected.engine.to_string(),"neverStarted":true,"absent":true
+            }))?,
+            cutoff,
+        )
+        .await?;
+        result
+    }
+
+    async fn inspect_data(&self, id: &str, name: &str, cutoff: Instant) -> Result<()> {
+        let view: ContainerInspectResponse = self
+            .cli
+            .json(
+                &arguments(&["container", "inspect", "--format", INSPECT, id]),
+                cutoff,
+            )
+            .await?;
+        policy::inspect(&view, &self.expected, id, name)
+    }
+}
+
+pub(super) async fn commit_identity(
+    uncertain: &mut bool,
+    slot: &mut Option<Identity>,
+    archives: Result<[Vec<u8>; 2]>,
+    engine: Uuid,
+    directory: &Path,
+    cutoff: Instant,
+) -> Result<()> {
+    let [owner, daemon] = archives?;
+    ensure!(*uncertain, "identity commit without retained transfer");
+    let identity = records::identity(&owner, &daemon, engine)?;
+    write_private(
+        directory,
+        "identity.json",
+        &serde_json::to_vec(&json!({
+            "owner":identity.owner.to_string(),"engine":identity.engine.to_string()
+        }))?,
+        cutoff,
+    )
+    .await?;
+    *slot = Some(identity);
+    *uncertain = false;
+    Ok(())
+}
+
+fn create_arguments(name: &str, expected: &Expected) -> Vec<String> {
+    let mut args = arguments(&[
+        "create",
+        "--pull=never",
+        "--name",
+        name,
+        "--user",
+        "65532:65532",
+        "--read-only",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges:true",
+        "--cgroupns",
+        "private",
+        "--network",
+        "none",
+        "--memory",
+        "32m",
+        "--memory-swap",
+        "32m",
+        "--cpus",
+        "0.1",
+        "--pids-limit",
+        "16",
+        "--restart",
+        "no",
+        "--no-healthcheck",
+        "--mount",
+        &format!(
+            "type=volume,source={},target=/data,volume-nocopy",
+            expected.volume
+        ),
+    ]);
+    for (key, value) in expected.labels("data-transfer") {
+        args.extend(["--label".into(), format!("{key}={value}")]);
+    }
+    args.push(expected.source.clone());
+    args
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use sha2::{Digest, Sha256};
+    use tar::{Builder, Header};
+    use tempfile::tempdir;
+    use tokio::fs;
+
+    use super::*;
+
+    fn archives(engine: Uuid) -> Result<[Vec<u8>; 2]> {
+        let owner = Uuid::from_u128(3);
+        let mut result = [Vec::new(), Vec::new()];
+        for (index, (name, magic)) in [("owner.v1", b"RSDKOWN2"), ("daemon.v1", b"RSDKDMD1")]
+            .into_iter()
+            .enumerate()
+        {
+            let mut data = magic.to_vec();
+            data.extend_from_slice(owner.as_bytes());
+            if index == 1 {
+                data.extend_from_slice(engine.as_bytes());
+            }
+            let checksum = Sha256::digest(&data);
+            data.extend_from_slice(&checksum);
+            let mut header = Header::new_ustar();
+            header.set_path(name)?;
+            header.set_size(u64::try_from(data.len())?);
+            header.set_uid(65532);
+            header.set_gid(65532);
+            header.set_mode(0o600);
+            header.set_cksum();
+            let mut builder = Builder::new(Vec::new());
+            builder.append(&header, data.as_slice())?;
+            *result.get_mut(index).context("controlled archive slot")? = builder.into_inner()?;
+        }
+        Ok(result)
+    }
+
+    #[rstest::rstest]
+    #[case::copy(0)]
+    #[case::affiliation(1)]
+    #[case::receipt(2)]
+    #[tokio::test]
+    async fn test_should_retain_identity_uncertainty_until_archive_oracle_and_receipt_commit(
+        #[case] failure: u8,
+    ) -> Result<()> {
+        let directory = tempdir()?;
+        let engine = Uuid::from_u128(2);
+        let mut uncertain = true;
+        let mut identity = None;
+        let input = match failure {
+            0 => Err(anyhow::anyhow!("controlled archive copy failure")),
+            1 => Ok(archives(Uuid::from_u128(9))?),
+            _ => {
+                fs::write(directory.path().join("identity.json"), b"original receipt").await?;
+                Ok(archives(engine)?)
+            }
+        };
+        assert!(
+            commit_identity(
+                &mut uncertain,
+                &mut identity,
+                input,
+                engine,
+                directory.path(),
+                Instant::now() + Duration::from_secs(10)
+            )
+            .await
+            .is_err()
+        );
+        assert!(uncertain);
+        assert!(identity.is_none());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_clear_identity_uncertainty_only_after_the_durable_receipt() -> Result<()> {
+        let directory = tempdir()?;
+        let engine = Uuid::from_u128(2);
+        let mut uncertain = true;
+        let mut identity = None;
+        commit_identity(
+            &mut uncertain,
+            &mut identity,
+            Ok(archives(engine)?),
+            engine,
+            directory.path(),
+            Instant::now() + Duration::from_secs(10),
+        )
+        .await?;
+        assert!(!uncertain);
+        assert_eq!(identity.context("committed identity")?.engine, engine);
+        assert!(directory.path().join("identity.json").is_file());
+        Ok(())
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/owner/data_policy.rs b/apps/rustack/tests/docker_startup/container_server/owner/data_policy.rs
new file mode 100644
index 00000000..5e0146fb
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/owner/data_policy.rs
@@ -0,0 +1,192 @@
+//! Independent inspected authority for a helper that must never execute.
+
+use std::collections::HashMap;
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::docker::models::{
+    ContainerInspectResponse, ContainerStateStatusEnum, HostConfigCgroupnsModeEnum, MountType,
+    RestartPolicyNameEnum,
+};
+
+use super::super::super::policy::Expected;
+
+pub(super) fn inspect(
+    view: &ContainerInspectResponse,
+    expected: &Expected,
+    id: &str,
+    name: &str,
+) -> Result<()> {
+    let config = view.config.as_ref().context("data helper configuration")?;
+    let state = view.state.as_ref().context("data helper state")?;
+    let labels = config.labels.as_ref().context("data helper labels")?;
+    ensure!(
+        view.id.as_deref() == Some(id)
+            && view.name.as_deref() == Some(format!("/{name}").as_str())
+            && view.image.as_deref() == Some(expected.source.as_str())
+            && config.image.as_deref() == Some(expected.source.as_str())
+            && config.user.as_deref() == Some("65532:65532")
+            && expected
+                .labels("data-transfer")
+                .iter()
+                .all(|(key, value)| labels.get(key) == Some(value))
+            && state.status == Some(ContainerStateStatusEnum::CREATED)
+            && state.running == Some(false)
+            && state.pid == Some(0)
+            && state.dead != Some(true),
+        "data helper identity or lifecycle differs"
+    );
+    let host = view
+        .host_config
+        .as_ref()
+        .context("data helper host policy")?;
+    ensure!(
+        host.readonly_rootfs == Some(true)
+            && host.privileged == Some(false)
+            && host.auto_remove == Some(false)
+            && host.publish_all_ports == Some(false)
+            && host.memory == Some(33_554_432)
+            && host.memory_swap == Some(33_554_432)
+            && host.nano_cpus == Some(100_000_000)
+            && host.pids_limit == Some(16)
+            && host.cgroupns_mode == Some(HostConfigCgroupnsModeEnum::PRIVATE)
+            && host.network_mode.as_deref() == Some("none")
+            && host.cap_drop.as_deref() == Some(["ALL".to_owned()].as_slice())
+            && host.cap_add.as_ref().is_none_or(Vec::is_empty)
+            && host.security_opt.as_deref()
+                == Some(["no-new-privileges:true".to_owned()].as_slice())
+            && host.group_add.as_ref().is_none_or(Vec::is_empty)
+            && host.binds.as_ref().is_none_or(Vec::is_empty)
+            && host.volumes_from.as_ref().is_none_or(Vec::is_empty)
+            && host.devices.as_ref().is_none_or(Vec::is_empty)
+            && host.device_requests.as_ref().is_none_or(Vec::is_empty)
+            && host.port_bindings.as_ref().is_none_or(HashMap::is_empty),
+        "data helper security policy differs"
+    );
+    let restart = host
+        .restart_policy
+        .as_ref()
+        .context("data helper restart policy")?;
+    ensure!(
+        restart.name == Some(RestartPolicyNameEnum::NO)
+            && restart.maximum_retry_count.unwrap_or_default() == 0,
+        "data helper restart policy differs"
+    );
+    let health = config
+        .healthcheck
+        .as_ref()
+        .context("data helper health policy")?;
+    ensure!(
+        health.test.as_deref() == Some(["NONE".to_owned()].as_slice()),
+        "data helper healthcheck enabled"
+    );
+    let requested = host
+        .mounts
+        .as_deref()
+        .context("data helper requested mounts")?;
+    let [mount] = requested else {
+        anyhow::bail!("extra data helper requested mount");
+    };
+    ensure!(
+        mount.typ == Some(MountType::VOLUME)
+            && mount.source.as_deref() == Some(expected.volume.as_str())
+            && mount.target.as_deref() == Some("/data")
+            && mount.read_only != Some(true)
+            && mount
+                .volume_options
+                .as_ref()
+                .is_some_and(|options| options.no_copy == Some(true)),
+        "data helper requested volume differs"
+    );
+    let actual = view
+        .mounts
+        .as_deref()
+        .context("data helper actual mounts")?;
+    let [mount] = actual else {
+        anyhow::bail!("extra data helper actual mount");
+    };
+    ensure!(
+        mount.typ.as_deref() == Some("volume")
+            && mount.name.as_deref() == Some(expected.volume.as_str())
+            && mount.destination.as_deref() == Some("/data")
+            && mount.rw == Some(true)
+            && mount.driver.as_deref() == Some("local"),
+        "data helper actual volume differs"
+    );
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::{Value, json};
+    use uuid::Uuid;
+
+    use super::*;
+    use crate::container_server::cli::decode;
+
+    fn fixture() -> (Expected, Value) {
+        let expected = Expected {
+            name: "rustack-server-parent".into(),
+            volume: "rustack-server-data-parent".into(),
+            nonce: "1".repeat(32),
+            engine: Uuid::from_u128(2),
+            source: format!("sha256:{}", "a".repeat(64)),
+            network: "f".repeat(64),
+            socket: "/run/user/501/docker.sock".into(),
+            gid: "991".into(),
+        };
+        let value = json!({
+            "Id":"c".repeat(64),"Name":"/rustack-transfer-test","Image":expected.source,
+            "State":{"Status":"created","Running":false,"Pid":0,"Dead":false},
+            "Config":{"Image":expected.source,"User":"65532:65532","Labels":expected.labels("data-transfer"),
+                "Healthcheck":{"Test":["NONE"]}},
+            "HostConfig":{"ReadonlyRootfs":true,"Privileged":false,"AutoRemove":false,"PublishAllPorts":false,
+                "Memory":33_554_432,"MemorySwap":33_554_432,"NanoCpus":100_000_000,"PidsLimit":16,
+                "CgroupnsMode":"private","NetworkMode":"none","CapDrop":["ALL"],
+                "CapAdd":[],"Binds":[],"PortBindings":{},
+                "SecurityOpt":["no-new-privileges:true"],"RestartPolicy":{"Name":"no","MaximumRetryCount":0},
+                "Mounts":[{"Type":"volume","Source":expected.volume,"Target":"/data","ReadOnly":false,
+                    "VolumeOptions":{"NoCopy":true}}]},
+            "Mounts":[{"Type":"volume","Name":expected.volume,"Destination":"/data","RW":true,"Driver":"local"}]
+        });
+        (expected, value)
+    }
+
+    #[test]
+    fn test_should_accept_only_an_owned_never_started_single_volume_helper() -> Result<()> {
+        let (expected, value) = fixture();
+        let view = decode(&serde_json::to_vec(&value)?)?;
+        inspect(&view, &expected, &"c".repeat(64), "rustack-transfer-test")
+    }
+
+    #[rstest::rstest]
+    #[case("/Id", json!("d".repeat(64)))]
+    #[case("/Image", json!(format!("sha256:{}", "b".repeat(64))))]
+    #[case("/Name", json!("/foreign"))]
+    #[case("/Config/User", json!("0:0"))]
+    #[case("/Config/Labels", json!({}))]
+    #[case("/State/Status", json!("exited"))]
+    #[case("/State/Running", json!(true))]
+    #[case("/State/Pid", json!(2))]
+    #[case("/HostConfig/NetworkMode", json!("host"))]
+    #[case("/HostConfig/Privileged", json!(true))]
+    #[case("/HostConfig/CapAdd", json!(["SYS_ADMIN"]))]
+    #[case("/HostConfig/Binds", json!(["/run/user/501/docker.sock:/socket"]))]
+    #[case("/HostConfig/PortBindings", json!({"80/tcp":[{"HostPort":"80"}]}))]
+    #[case("/HostConfig/Mounts/0/ReadOnly", json!(true))]
+    #[case("/HostConfig/Mounts/0/VolumeOptions/NoCopy", json!(false))]
+    #[case("/Mounts/0/Name", json!("foreign-volume"))]
+    #[case("/Mounts/0/RW", json!(false))]
+    #[case("/Config/Healthcheck/Test", json!(["CMD","/rustack"]))]
+    fn test_should_reject_identity_execution_privilege_and_mount_substitution(
+        #[case] pointer: &str,
+        #[case] replacement: Value,
+    ) -> Result<()> {
+        let (expected, mut value) = fixture();
+        *value
+            .pointer_mut(pointer)
+            .context("controlled fixture pointer")? = replacement;
+        let view = decode(&serde_json::to_vec(&value)?)?;
+        assert!(inspect(&view, &expected, &"c".repeat(64), "rustack-transfer-test").is_err());
+        Ok(())
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/policy.rs b/apps/rustack/tests/docker_startup/container_server/policy.rs
new file mode 100644
index 00000000..c1187081
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/policy.rs
@@ -0,0 +1,387 @@
+//! Independent inspected server policy and exact mutation authority.
+
+#[cfg(test)]
+#[path = "policy/tests.rs"]
+mod tests;
+
+use std::{collections::BTreeMap, env, path::PathBuf};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::{
+    artifact::ImageReference,
+    docker::{
+        DockerSocket, NetworkSelection,
+        models::{
+            ContainerInspectResponse, HostConfig, HostConfigCgroupnsModeEnum, MountType,
+            NetworkInspect, RestartPolicyNameEnum, Volume, VolumeScopeEnum,
+        },
+    },
+};
+use uuid::Uuid;
+
+use super::{ImageProfile, cli::container_id};
+
+pub(super) const NONCE_LABEL: &str = "rustack.test.server-container.nonce";
+pub(super) const ROLE_LABEL: &str = "rustack.test.server-container.role";
+pub(super) const ENGINE_LABEL: &str = "rustack.test.server-container.engine";
+pub(super) const MEMORY: i64 = 536_870_912;
+pub(super) const TEMPORARY: &str = "rw,noexec,nosuid,nodev,size=64m,mode=1777";
+
+#[derive(Debug)]
+pub(super) struct Inputs {
+    pub program: PathBuf,
+    pub client: String,
+    pub source_socket: String,
+    pub gid: String,
+    pub network: String,
+    pub image: String,
+    pub sdk_image: String,
+    pub relay: String,
+    pub architecture: String,
+}
+impl Inputs {
+    pub fn load(profile: ImageProfile) -> Result<Self> {
+        let program = env::var("RUSTACK_DOCKER_BIN")?;
+        ensure!(
+            program.len() <= 4096
+                && PathBuf::from(&program).is_absolute()
+                && !program.chars().any(char::is_control),
+            "absolute Docker CLI required"
+        );
+        let client = super::super::process::socket()?;
+        let _: DockerSocket = client.parse()?;
+        let source_socket = env::var("RUSTACK_SERVER_DAEMON_SOCKET")?;
+        socket_source(&source_socket)?;
+        let gid = env::var("RUSTACK_SERVER_SOCKET_GID")?;
+        socket_gid(&gid)?;
+        let network = env::var("RUSTACK_RUNTIME_NETWORK")?;
+        let _: NetworkSelection = network.parse()?;
+        ensure!(
+            network != "none",
+            "server container requires an explicit user bridge"
+        );
+        let image = image_variable(profile.variable())?;
+        let sdk_image = image_variable("RUSTACK_HANDLER_SDK_IMAGE")?;
+        let relay = image_variable("RUSTACK_RUNTIME_IMAGE")?;
+        let architecture = super::super::process::architecture()?;
+        Ok(Self {
+            program: PathBuf::from(program),
+            client,
+            source_socket,
+            gid,
+            network,
+            image,
+            sdk_image,
+            relay,
+            architecture,
+        })
+    }
+}
+
+fn image_variable(key: &str) -> Result<String> {
+    let value = env::var(key)?;
+    let _: ImageReference = value.parse()?;
+    Ok(value)
+}
+
+pub(super) fn socket_source(value: &str) -> Result<()> {
+    ensure!(
+        (2..=256).contains(&value.len())
+            && value.starts_with('/')
+            && value
+                .get(1..)
+                .context("socket path suffix")?
+                .split('/')
+                .all(|part| !part.is_empty()
+                    && part != "."
+                    && part != ".."
+                    && part
+                        .bytes()
+                        .all(|b| b.is_ascii_alphanumeric() || b"._-".contains(&b))),
+        "invalid explicit daemon-side socket path"
+    );
+    Ok(())
+}
+
+pub(super) fn socket_gid(value: &str) -> Result<u32> {
+    ensure!(
+        (1..=10).contains(&value.len()) && value.bytes().all(|b| b.is_ascii_digit()),
+        "invalid explicit daemon socket GID grammar"
+    );
+    let gid: u32 = value.parse()?;
+    ensure!(
+        gid <= 2_147_483_647 && gid.to_string() == value,
+        "invalid daemon socket GID range"
+    );
+    Ok(gid)
+}
+
+#[derive(Debug)]
+pub(super) struct Expected {
+    pub name: String,
+    pub volume: String,
+    pub nonce: String,
+    pub engine: Uuid,
+    pub source: String,
+    pub network: String,
+    pub socket: String,
+    pub gid: String,
+}
+impl Expected {
+    pub fn labels(&self, role: &str) -> BTreeMap<String, String> {
+        BTreeMap::from([
+            (NONCE_LABEL.into(), self.nonce.clone()),
+            (ROLE_LABEL.into(), role.into()),
+            (ENGINE_LABEL.into(), self.engine.to_string()),
+        ])
+    }
+}
+
+pub(super) fn source_id(value: &str) -> Result<String> {
+    let digest = value
+        .strip_prefix("sha256:")
+        .context("source image ID prefix")?;
+    container_id(digest)?;
+    Ok(value.to_owned())
+}
+
+pub(super) fn network(network: &NetworkInspect, requested: &str) -> Result<String> {
+    let id = network.id.as_deref().context("network full ID")?;
+    container_id(id)?;
+    let name = network.name.as_deref().context("network name")?;
+    ensure!(
+        (requested == id || requested == name)
+            && !matches!(name, "host" | "bridge" | "none" | "default")
+            && network.driver.as_deref() == Some("bridge")
+            && network.scope.as_deref() == Some("local")
+            && network.ingress == Some(false)
+            && network.config_only == Some(false)
+            && network
+                .options
+                .as_ref()
+                .and_then(|o| o.get("com.docker.network.bridge.default_bridge"))
+                .is_none_or(|value| value == "false"),
+        "server fixture network differs"
+    );
+    Ok(id.to_owned())
+}
+
+pub(super) fn volume(volume: &Volume, expected: &Expected) -> Result<()> {
+    ensure!(
+        volume.name == expected.volume
+            && volume.driver == "local"
+            && expected
+                .labels("server-data")
+                .iter()
+                .all(|(key, value)| volume.labels.get(key) == Some(value))
+            && volume.options.is_empty()
+            && volume.scope == Some(VolumeScopeEnum::LOCAL)
+            && volume.cluster_volume.is_none()
+            && volume.mountpoint.starts_with('/')
+            && volume.mountpoint.len() <= 4096,
+        "server volume ownership differs"
+    );
+    Ok(())
+}
+
+pub(super) fn server(
+    view: &ContainerInspectResponse,
+    expected: &Expected,
+    data: &Volume,
+) -> Result<()> {
+    volume(data, expected)?;
+    container_id(view.id.as_deref().context("server container ID")?)?;
+    let config = view.config.as_ref().context("server configuration")?;
+    let labels = config.labels.as_ref().context("server labels")?;
+    ensure!(
+        view.name.as_deref() == Some(format!("/{}", expected.name).as_str())
+            && view.image.as_deref() == Some(expected.source.as_str())
+            && config.image.as_deref() == Some(expected.source.as_str())
+            && config.user.as_deref() == Some("65532:65532")
+            && config.working_dir.as_deref() == Some("/data")
+            && config.entrypoint.as_deref() == Some(["/rustack".to_owned()].as_slice())
+            && config.cmd.as_ref().is_none_or(Vec::is_empty)
+            && expected
+                .labels("server")
+                .iter()
+                .all(|(key, value)| labels.get(key) == Some(value)),
+        "server immutable identity or execution policy differs"
+    );
+    let host = view.host_config.as_ref().context("server host policy")?;
+    host_policy(host, expected)?;
+    mount_policy(view, host, expected, data)?;
+    Ok(())
+}
+
+fn host_policy(host: &HostConfig, expected: &Expected) -> Result<()> {
+    ensure!(
+        host.readonly_rootfs == Some(true)
+            && host.privileged == Some(false)
+            && host.auto_remove == Some(false)
+            && host.publish_all_ports == Some(false)
+            && host.memory == Some(MEMORY)
+            && host.memory_swap == Some(MEMORY)
+            && host.nano_cpus == Some(1_000_000_000)
+            && host.pids_limit == Some(128)
+            && host.oom_kill_disable != Some(true)
+            && host.cap_drop.as_deref() == Some(["ALL".to_owned()].as_slice())
+            && host.cap_add.as_ref().is_none_or(Vec::is_empty)
+            && host.security_opt.as_deref()
+                == Some(["no-new-privileges:true".to_owned()].as_slice())
+            && host.group_add.as_deref() == Some([expected.gid.clone()].as_slice())
+            && host.network_mode.as_deref() == Some(expected.network.as_str())
+            && host.pid_mode.as_deref().is_none_or(str::is_empty)
+            && host.cgroupns_mode == Some(HostConfigCgroupnsModeEnum::PRIVATE)
+            && host.devices.as_ref().is_none_or(Vec::is_empty)
+            && host.device_requests.as_ref().is_none_or(Vec::is_empty)
+            && host.volumes_from.as_ref().is_none_or(Vec::is_empty)
+            && host.binds.as_ref().is_none_or(Vec::is_empty),
+        "server kernel/security policy differs"
+    );
+    let restart = host
+        .restart_policy
+        .as_ref()
+        .context("server restart policy")?;
+    ensure!(
+        restart.name == Some(RestartPolicyNameEnum::NO) && restart.maximum_retry_count == Some(0),
+        "server restart policy differs"
+    );
+    let logs = host.log_config.as_ref().context("server log policy")?;
+    let options = logs.config.as_ref().context("server bounded log options")?;
+    ensure!(
+        logs.typ.as_deref() == Some("json-file")
+            && options.len() == 2
+            && options.get("max-size").map(String::as_str) == Some("1m")
+            && options.get("max-file").map(String::as_str) == Some("1"),
+        "server log bounds differ"
+    );
+    let temporary = host.tmpfs.as_ref().context("server temporary mount")?;
+    ensure!(
+        temporary.len() == 1 && temporary.get("/tmp").map(String::as_str) == Some(TEMPORARY),
+        "server temporary storage policy differs"
+    );
+    let bindings = host
+        .port_bindings
+        .as_ref()
+        .context("server published port request")?;
+    ensure!(
+        bindings.len() == 1
+            && bindings
+                .get("4566/tcp")
+                .and_then(Option::as_ref)
+                .is_some_and(|rows| rows.len() == 1
+                    && rows
+                        .first()
+                        .is_some_and(|row| row.host_ip.as_deref() == Some("127.0.0.1"))),
+        "server loopback publication differs"
+    );
+    Ok(())
+}
+
+fn mount_policy(
+    view: &ContainerInspectResponse,
+    host: &HostConfig,
+    expected: &Expected,
+    data: &Volume,
+) -> Result<()> {
+    let requested = host.mounts.as_ref().context("server requested mounts")?;
+    ensure!(
+        requested.len() == 2
+            && requested
+                .iter()
+                .filter(|m| m.target.as_deref() == Some("/data"))
+                .count()
+                == 1
+            && requested
+                .iter()
+                .filter(|m| m.target.as_deref() == Some("/run/rustack/docker.sock"))
+                .count()
+                == 1
+            && requested
+                .iter()
+                .all(|mount| (mount.typ == Some(MountType::BIND)
+                    && mount.source.as_deref() == Some(expected.socket.as_str())
+                    && mount.target.as_deref() == Some("/run/rustack/docker.sock")
+                    && mount.read_only == Some(true))
+                    || (mount.typ == Some(MountType::VOLUME)
+                        && mount.source.as_deref() == Some(expected.volume.as_str())
+                        && mount.target.as_deref() == Some("/data")
+                        && mount.read_only != Some(true))),
+        "server mount request differs"
+    );
+    let mounts = view.mounts.as_ref().context("server actual mounts")?;
+    ensure!(
+        (2..=3).contains(&mounts.len())
+            && mounts
+                .iter()
+                .filter(|m| m.destination.as_deref() == Some("/data"))
+                .count()
+                == 1
+            && mounts
+                .iter()
+                .filter(|m| m.destination.as_deref() == Some("/run/rustack/docker.sock"))
+                .count()
+                == 1
+            && mounts
+                .iter()
+                .all(|mount| match mount.destination.as_deref() {
+                    Some("/data") =>
+                        mount.typ.as_deref() == Some("volume")
+                            && mount.name.as_deref() == Some(expected.volume.as_str())
+                            && mount.rw == Some(true)
+                            && mount.driver.as_deref() == Some("local")
+                            && mount.source.as_deref() == Some(data.mountpoint.as_str()),
+                    Some("/run/rustack/docker.sock") =>
+                        mount.typ.as_deref() == Some("bind")
+                            && mount.source.as_deref() == Some(expected.socket.as_str())
+                            && mount.rw == Some(false),
+                    Some("/tmp") => mount.typ.as_deref() == Some("tmpfs"),
+                    _ => false,
+                }),
+        "server actual mount affiliation differs"
+    );
+    Ok(())
+}
+
+pub(super) fn endpoint(view: &ContainerInspectResponse, expected: &Expected) -> Result<String> {
+    let network = view
+        .network_settings
+        .as_ref()
+        .context("server network settings")?;
+    let networks = network
+        .networks
+        .as_ref()
+        .context("server attached networks")?;
+    ensure!(
+        networks.len() == 1
+            && networks.values().all(|entry| entry.network_id.as_deref()
+                == Some(expected.network.as_str())
+                && entry
+                    .aliases
+                    .as_ref()
+                    .is_some_and(|names| names.contains(&expected.name))),
+        "server DNS/network affiliation differs"
+    );
+    let ports = network
+        .ports
+        .as_ref()
+        .context("server actual publication")?;
+    ensure!(ports.len() == 1, "extra server published port");
+    let rows = ports
+        .get("4566/tcp")
+        .and_then(Option::as_ref)
+        .context("server host port")?;
+    ensure!(rows.len() == 1, "ambiguous server host publication");
+    let row = rows.first().context("empty server port list")?;
+    ensure!(
+        row.host_ip.as_deref() == Some("127.0.0.1"),
+        "server port is not loopback"
+    );
+    let text = row.host_port.as_deref().context("server assigned port")?;
+    let port: u16 = text.parse()?;
+    ensure!(
+        port > 0 && port.to_string() == text,
+        "server assigned port grammar"
+    );
+    Ok(format!("http://127.0.0.1:{port}"))
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/policy/tests.rs b/apps/rustack/tests/docker_startup/container_server/policy/tests.rs
new file mode 100644
index 00000000..f9b226eb
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/policy/tests.rs
@@ -0,0 +1,148 @@
+//! Independent Docker-shaped fixture; mutations must remove cleanup authority.
+
+use serde_json::{Value, json};
+
+use super::{super::cli::decode, *};
+
+fn fixture() -> Result<(Expected, Volume, Value)> {
+    let expected = Expected {
+        name: "rustack-server-test".into(),
+        volume: "rustack-server-data-test".into(),
+        nonce: "1".repeat(32),
+        engine: Uuid::from_u128(2),
+        source: format!("sha256:{}", "a".repeat(64)),
+        network: "f".repeat(64),
+        socket: "/var/run/docker.sock".into(),
+        gid: "991".into(),
+    };
+    let data: Volume = decode(&serde_json::to_vec(&json!({
+        "Name":"rustack-server-data-test","Driver":"local","Mountpoint":"/volumes/test/_data",
+        "Scope":"local","Options":null,"Labels":{
+            "rustack.test.server-container.nonce":"1".repeat(32),
+            "rustack.test.server-container.role":"server-data",
+            "rustack.test.server-container.engine":Uuid::from_u128(2).to_string()}}))?)?;
+    let view = json!({
+        "Id":"c".repeat(64),"Name":"/rustack-server-test","Image":format!("sha256:{}","a".repeat(64)),
+        "Config":{"Image":format!("sha256:{}","a".repeat(64)),"User":"65532:65532","WorkingDir":"/data",
+            "Entrypoint":["/rustack"],"Cmd":[],"Labels":{
+                "rustack.test.server-container.nonce":"1".repeat(32),
+                "rustack.test.server-container.role":"server",
+                "rustack.test.server-container.engine":Uuid::from_u128(2).to_string()}},
+        "HostConfig":{"ReadonlyRootfs":true,"Privileged":false,"AutoRemove":false,"PublishAllPorts":false,
+            "Memory":536_870_912,"MemorySwap":536_870_912,"NanoCpus":1_000_000_000,"PidsLimit":128,
+            "CapDrop":["ALL"],"SecurityOpt":["no-new-privileges:true"],"GroupAdd":["991"],
+            "NetworkMode":"f".repeat(64),"PidMode":"","CgroupnsMode":"private",
+            "RestartPolicy":{"Name":"no","MaximumRetryCount":0},
+            "LogConfig":{"Type":"json-file","Config":{"max-size":"1m","max-file":"1"}},
+            "Tmpfs":{"/tmp":"rw,noexec,nosuid,nodev,size=64m,mode=1777"},
+            "Mounts":[{"Type":"bind","Source":"/var/run/docker.sock","Target":"/run/rustack/docker.sock","ReadOnly":true},
+                {"Type":"volume","Source":"rustack-server-data-test","Target":"/data"}],
+            "PortBindings":{"4566/tcp":[{"HostIp":"127.0.0.1","HostPort":""}]}},
+        "Mounts":[{"Type":"bind","Source":"/var/run/docker.sock","Destination":"/run/rustack/docker.sock","RW":false},
+            {"Type":"volume","Name":"rustack-server-data-test","Source":"/volumes/test/_data","Destination":"/data","RW":true,"Driver":"local"}],
+        "NetworkSettings":{"Networks":{"qualified":{"NetworkID":"f".repeat(64),"Aliases":["rustack-server-test"]}},
+            "Ports":{"4566/tcp":[{"HostIp":"127.0.0.1","HostPort":"49153"}]}},
+        "State":{"Running":true,"OOMKilled":false,"ExitCode":0,"Dead":false}
+    });
+    Ok((expected, data, view))
+}
+
+#[test]
+fn test_should_require_exact_server_identity_security_and_named_mount_affiliation() -> Result<()> {
+    let (expected, data, view) = fixture()?;
+    let inspected: ContainerInspectResponse = decode(&serde_json::to_vec(&view)?)?;
+    server(&inspected, &expected, &data)?;
+    for (path, replacement) in [
+        ("/Name", json!("/foreign")),
+        ("/Image", json!(format!("sha256:{}", "b".repeat(64)))),
+        (
+            "/Config/Labels/rustack.test.server-container.nonce",
+            json!("foreign"),
+        ),
+        ("/Config/User", json!("0:0")),
+        ("/HostConfig/ReadonlyRootfs", json!(false)),
+        ("/HostConfig/Privileged", json!(true)),
+        ("/HostConfig/NetworkMode", json!("host")),
+        ("/HostConfig/MemorySwap", json!(-1)),
+        ("/HostConfig/GroupAdd", json!(["0"])),
+        (
+            "/HostConfig/PortBindings/4566~1tcp/0/HostIp",
+            json!("0.0.0.0"),
+        ),
+        ("/Mounts/0/Source", json!("/foreign/socket")),
+        ("/Mounts/1/Name", json!("foreign-volume")),
+        ("/Mounts/1/Source", json!("/volumes/foreign/_data")),
+        ("/Mounts/1/RW", json!(false)),
+    ] {
+        let mut changed = view.clone();
+        *changed
+            .pointer_mut(path)
+            .context("policy fixture mutation path")? = replacement;
+        let inspected = decode(&serde_json::to_vec(&changed)?)?;
+        assert!(
+            server(&inspected, &expected, &data).is_err(),
+            "accepted policy mutation {path}"
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_should_refuse_wrong_actual_dns_network_or_public_host_port_metadata() -> Result<()> {
+    let (expected, _, view) = fixture()?;
+    let inspected = decode(&serde_json::to_vec(&view)?)?;
+    assert_eq!(endpoint(&inspected, &expected)?, "http://127.0.0.1:49153");
+    for (path, replacement) in [
+        (
+            "/NetworkSettings/Networks/qualified/NetworkID",
+            json!("e".repeat(64)),
+        ),
+        (
+            "/NetworkSettings/Networks/qualified/Aliases",
+            json!(["foreign"]),
+        ),
+        (
+            "/NetworkSettings/Ports/4566~1tcp/0/HostIp",
+            json!("0.0.0.0"),
+        ),
+        ("/NetworkSettings/Ports/4566~1tcp/0/HostPort", json!("0")),
+        (
+            "/NetworkSettings/Ports/4566~1tcp/0/HostPort",
+            json!("049153"),
+        ),
+        (
+            "/NetworkSettings/Ports/4566~1tcp/0/HostPort",
+            json!("65536"),
+        ),
+    ] {
+        let mut changed = view.clone();
+        *changed
+            .pointer_mut(path)
+            .context("endpoint fixture mutation path")? = replacement;
+        let inspected = decode(&serde_json::to_vec(&changed)?)?;
+        assert!(
+            endpoint(&inspected, &expected).is_err(),
+            "accepted endpoint mutation {path}"
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_foreign_or_driver_configured_server_volumes() -> Result<()> {
+    let (expected, data, _) = fixture()?;
+    volume(&data, &expected)?;
+    let mut foreign = data.clone();
+    foreign.name = "unrelated".into();
+    assert!(volume(&foreign, &expected).is_err());
+    let mut wrong_driver = data.clone();
+    wrong_driver.driver = "nfs".into();
+    assert!(volume(&wrong_driver, &expected).is_err());
+    let mut configured = data.clone();
+    configured.options.insert("device".into(), "/host".into());
+    assert!(volume(&configured, &expected).is_err());
+    let mut relabeled = data;
+    relabeled.labels.clear();
+    assert!(volume(&relabeled, &expected).is_err());
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/container_server/records.rs b/apps/rustack/tests/docker_startup/container_server/records.rs
new file mode 100644
index 00000000..a1168836
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/container_server/records.rs
@@ -0,0 +1,377 @@
+//! Bounded raw archives of persistent installation identity; never extraction.
+
+use std::{
+    collections::BTreeSet,
+    io::{Cursor, Read},
+};
+
+use anyhow::{Context, Result, ensure};
+use sha2::{Digest, Sha256};
+use tar::Archive;
+use uuid::Uuid;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) struct Identity {
+    pub owner: Uuid,
+    pub engine: Uuid,
+}
+
+pub(super) fn identity(owner: &[u8], daemon: &[u8], engine: Uuid) -> Result<Identity> {
+    let owner = record(owner, "owner.v1", *b"RSDKOWN2", 56)?;
+    let daemon = record(daemon, "daemon.v1", *b"RSDKDMD1", 72)?;
+    let id = Uuid::from_slice(owner.get(8..24).context("owner identity bytes")?)?;
+    let bound_owner = Uuid::from_slice(daemon.get(8..24).context("bound owner bytes")?)?;
+    let bound_engine = Uuid::from_slice(daemon.get(24..40).context("bound engine bytes")?)?;
+    ensure!(
+        !id.is_nil() && id == bound_owner && engine == bound_engine && !engine.is_nil(),
+        "installation identity affiliation differs"
+    );
+    Ok(Identity { owner: id, engine })
+}
+
+#[derive(Debug, Clone, Copy)]
+struct Member<'a> {
+    name: &'a str,
+    length: usize,
+    uid: u64,
+    gid: u64,
+    mode: u32,
+}
+
+fn member(raw: &[u8], expected: Member<'_>) -> Result<Vec<u8>> {
+    let Member {
+        name,
+        length,
+        uid,
+        gid,
+        mode,
+    } = expected;
+    ensure!(
+        (2048..=32768).contains(&raw.len()) && raw.len().is_multiple_of(512),
+        "identity archive byte bound"
+    );
+    let mut archive = Archive::new(Cursor::new(raw));
+    let mut payload = None;
+    let mut timing_seen = false;
+    for (index, entry) in archive.entries()?.raw(true).enumerate() {
+        ensure!(index < 2, "extra identity archive member");
+        let mut entry = entry?;
+        let path = entry.path_bytes();
+        ensure!(
+            !path.is_empty() && path.len() <= 256,
+            "identity archive path bound"
+        );
+        if entry.header().entry_type().is_pax_local_extensions() {
+            ensure!(
+                index == 0 && !timing_seen && entry.size() <= 1024,
+                "identity timing metadata bound"
+            );
+            ensure!(
+                path.is_ascii()
+                    && path.split(|byte| *byte == b'/').all(|part| !part.is_empty()
+                        && part != b"."
+                        && part != b".."
+                        && part
+                            .iter()
+                            .all(|b| b.is_ascii_alphanumeric() || b"._-".contains(b))),
+                "identity timing metadata path"
+            );
+            let mut bytes = Vec::new();
+            entry.read_to_end(&mut bytes)?;
+            timing(&bytes)?;
+            timing_seen = true;
+            continue;
+        }
+        ensure!(
+            payload.is_none()
+                && path.as_ref() == name.as_bytes()
+                && entry.header().entry_type().is_file()
+                && entry.size() == u64::try_from(length)?
+                && entry.header().uid()? == uid
+                && entry.header().gid()? == gid
+                && entry.header().mode()? == mode
+                && entry.link_name_bytes().is_none(),
+            "identity archive member differs"
+        );
+        let mut bytes = Vec::with_capacity(length);
+        entry.read_to_end(&mut bytes)?;
+        ensure!(bytes.len() == length, "truncated installation identity");
+        payload = Some(bytes);
+    }
+    let position = usize::try_from(archive.into_inner().position())?;
+    let tail = raw.get(position..).context("identity archive cursor")?;
+    ensure!(
+        tail.len() >= 512 && tail.iter().all(|byte| *byte == 0),
+        "identity archive terminator or trailing content"
+    );
+    let bytes = payload.context("missing installation identity")?;
+    Ok(bytes)
+}
+
+fn record(raw: &[u8], name: &str, magic: [u8; 8], length: usize) -> Result<Vec<u8>> {
+    let bytes = member(
+        raw,
+        Member {
+            name,
+            length,
+            uid: 65532,
+            gid: 65532,
+            mode: 0o600,
+        },
+    )?;
+    let end = length.checked_sub(32).context("identity checksum length")?;
+    let data = bytes.get(..end).context("identity checksum payload")?;
+    ensure!(
+        bytes.get(..8) == Some(magic.as_slice())
+            && bytes.get(end..) == Some(Sha256::digest(data).as_slice()),
+        "installation identity checksum or generation differs"
+    );
+    Ok(bytes)
+}
+
+pub(super) fn configuration(raw: &[u8], expected: &[u8]) -> Result<()> {
+    ensure!(
+        (1..=4096).contains(&expected.len()),
+        "public configuration byte bound"
+    );
+    let observed = member(
+        raw,
+        Member {
+            name: "qualification.yaml",
+            length: expected.len(),
+            uid: 65532,
+            gid: 65532,
+            mode: 0o644,
+        },
+    )?;
+    ensure!(observed == expected, "copied public configuration differs");
+    Ok(())
+}
+
+fn timing(mut bytes: &[u8]) -> Result<()> {
+    let mut seen = BTreeSet::new();
+    while !bytes.is_empty() {
+        ensure!(seen.len() < 4, "identity timing field count");
+        let space = bytes
+            .iter()
+            .position(|byte| *byte == b' ')
+            .context("PAX timing length")?;
+        let digits = bytes.get(..space).context("PAX timing length digits")?;
+        ensure!(
+            (1..=4).contains(&digits.len()) && digits.iter().all(u8::is_ascii_digit),
+            "PAX timing length grammar"
+        );
+        let length = std::str::from_utf8(digits)?.parse::<usize>()?;
+        let line = bytes.get(..length).context("PAX timing record bound")?;
+        ensure!(line.last() == Some(&b'\n'), "PAX timing newline");
+        let content = line
+            .get(space.saturating_add(1)..length.saturating_sub(1))
+            .context("PAX timing content")?;
+        let content = std::str::from_utf8(content)?;
+        let (key, value) = content.split_once('=').context("PAX timing pair")?;
+        ensure!(
+            matches!(key, "mtime" | "atime" | "ctime")
+                && seen.insert(key)
+                && (1..=64).contains(&value.len()),
+            "unexpected identity timing field"
+        );
+        let unsigned = value.strip_prefix('-').unwrap_or(value);
+        let mut parts = unsigned.split('.');
+        let integral = parts.next().context("PAX timing integer")?;
+        ensure!(
+            !integral.is_empty() && integral.bytes().all(|byte| byte.is_ascii_digit()),
+            "PAX timing integer grammar"
+        );
+        if let Some(fraction) = parts.next() {
+            ensure!(
+                (1..=9).contains(&fraction.len())
+                    && fraction.bytes().all(|byte| byte.is_ascii_digit()),
+                "PAX timing fraction grammar"
+            );
+        }
+        ensure!(parts.next().is_none(), "PAX timing extra component");
+        bytes = bytes.get(length..).context("PAX timing next record")?;
+    }
+    ensure!(!seen.is_empty(), "empty identity timing metadata");
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use tar::{Builder, EntryType, Header};
+
+    use super::*;
+
+    #[test]
+    fn test_should_require_exact_public_config_bytes_container_ownership_and_readable_mode()
+    -> Result<()> {
+        let bytes = b"budgets:\n  startupSeconds: 180\n";
+        for (name, uid, gid, mode, accepted) in [
+            ("qualification.yaml", 65532, 65532, 0o644, true),
+            ("other.yaml", 65532, 65532, 0o644, false),
+            ("qualification.yaml", 0, 0, 0o644, false),
+            ("qualification.yaml", 501, 20, 0o644, false),
+            ("qualification.yaml", 65532, 0, 0o644, false),
+            ("qualification.yaml", 0, 65532, 0o644, false),
+            ("qualification.yaml", 65532, 65532, 0o600, false),
+        ] {
+            let mut builder = Builder::new(Vec::new());
+            let mut header = Header::new_ustar();
+            header.set_entry_type(EntryType::Regular);
+            header.set_uid(uid);
+            header.set_gid(gid);
+            header.set_mode(mode);
+            header.set_size(u64::try_from(bytes.len())?);
+            header.set_cksum();
+            builder.append_data(&mut header, name, bytes.as_slice())?;
+            let raw = builder.into_inner()?;
+            assert_eq!(configuration(&raw, bytes).is_ok(), accepted);
+            assert!(configuration(&raw, b"budgets:\n  startupSeconds: 181\n").is_err());
+        }
+        Ok(())
+    }
+
+    fn payload(magic: [u8; 8], owner: Uuid, engine: Option<Uuid>) -> Vec<u8> {
+        let mut bytes = magic.to_vec();
+        bytes.extend_from_slice(owner.as_bytes());
+        if let Some(engine) = engine {
+            bytes.extend_from_slice(engine.as_bytes());
+        }
+        bytes.extend_from_slice(&Sha256::digest(&bytes));
+        bytes
+    }
+    fn append(
+        builder: &mut Builder<Vec<u8>>,
+        name: &str,
+        bytes: &[u8],
+        kind: EntryType,
+        uid: u64,
+        mode: u32,
+    ) -> Result<()> {
+        let mut header = Header::new_ustar();
+        header.set_entry_type(kind);
+        header.set_uid(uid);
+        header.set_gid(65532);
+        header.set_mode(mode);
+        header.set_size(u64::try_from(bytes.len())?);
+        header.set_cksum();
+        builder.append_data(&mut header, name, bytes)?;
+        Ok(())
+    }
+    fn archive(name: &str, bytes: &[u8]) -> Result<Vec<u8>> {
+        let mut builder = Builder::new(Vec::new());
+        append(&mut builder, name, bytes, EntryType::Regular, 65532, 0o600)?;
+        Ok(builder.into_inner()?)
+    }
+    #[test]
+    fn test_should_bind_the_actual_persisted_owner_and_engine_records() -> Result<()> {
+        let owner = Uuid::new_v4();
+        let engine = Uuid::new_v4();
+        let a = archive("owner.v1", &payload(*b"RSDKOWN2", owner, None))?;
+        let b = archive("daemon.v1", &payload(*b"RSDKDMD1", owner, Some(engine)))?;
+        assert_eq!(identity(&a, &b, engine)?, Identity { owner, engine });
+        assert!(identity(&a, &b, Uuid::new_v4()).is_err());
+        let foreign = archive(
+            "daemon.v1",
+            &payload(*b"RSDKDMD1", Uuid::new_v4(), Some(engine)),
+        )?;
+        assert!(identity(&a, &foreign, engine).is_err());
+        let nil = archive("owner.v1", &payload(*b"RSDKOWN2", Uuid::nil(), None))?;
+        assert!(identity(&nil, &b, engine).is_err());
+        Ok(())
+    }
+    #[test]
+    fn test_should_reject_record_replacement_paths_types_permissions_and_checksums() -> Result<()> {
+        let bytes = payload(*b"RSDKOWN2", Uuid::new_v4(), None);
+        for (name, kind, uid, mode) in [
+            ("unrelated", EntryType::Regular, 65532, 0o600),
+            ("sub/owner.v1", EntryType::Regular, 65532, 0o600),
+            ("owner.v1", EntryType::Symlink, 65532, 0o600),
+            ("owner.v1", EntryType::Regular, 0, 0o600),
+            ("owner.v1", EntryType::Regular, 65532, 0o644),
+        ] {
+            let mut builder = Builder::new(Vec::new());
+            append(&mut builder, name, &bytes, kind, uid, mode)?;
+            assert!(record(&builder.into_inner()?, "owner.v1", *b"RSDKOWN2", 56).is_err());
+        }
+        let mut bad = bytes.clone();
+        *bad.last_mut().context("test checksum byte")? ^= 1;
+        assert!(record(&archive("owner.v1", &bad)?, "owner.v1", *b"RSDKOWN2", 56).is_err());
+        assert!(record(&archive("owner.v1", &bytes)?, "owner.v1", *b"RSDKOWN3", 56).is_err());
+        Ok(())
+    }
+    #[test]
+    fn test_should_reject_duplicate_extra_truncated_and_concatenated_archives() -> Result<()> {
+        let bytes = payload(*b"RSDKOWN2", Uuid::new_v4(), None);
+        let mut builder = Builder::new(Vec::new());
+        append(
+            &mut builder,
+            "owner.v1",
+            &bytes,
+            EntryType::Regular,
+            65532,
+            0o600,
+        )?;
+        append(
+            &mut builder,
+            "owner.v1",
+            &bytes,
+            EntryType::Regular,
+            65532,
+            0o600,
+        )?;
+        assert!(record(&builder.into_inner()?, "owner.v1", *b"RSDKOWN2", 56).is_err());
+        let raw = archive("owner.v1", &bytes)?;
+        assert!(
+            record(
+                raw.get(..1024).context("test short archive")?,
+                "owner.v1",
+                *b"RSDKOWN2",
+                56
+            )
+            .is_err()
+        );
+        let mut joined = raw.clone();
+        joined.extend_from_slice(&raw);
+        assert!(record(&joined, "owner.v1", *b"RSDKOWN2", 56).is_err());
+        assert!(record(&vec![0; 33280], "owner.v1", *b"RSDKOWN2", 56).is_err());
+        Ok(())
+    }
+    #[test]
+    fn test_should_allow_only_bounded_unique_timing_pax_metadata() -> Result<()> {
+        timing(b"13 mtime=1.2\n")?;
+        for bytes in [
+            b"12 path=abc\n".as_slice(),
+            b"13 mtime=1.2\n13 mtime=1.2\n",
+            b"13 mtime=1e2\n",
+            b"9999 mtime=1\n",
+            b"",
+            b"0 \n",
+        ] {
+            assert!(timing(bytes).is_err());
+        }
+        let bytes = payload(*b"RSDKOWN2", Uuid::new_v4(), None);
+        let mut builder = Builder::new(Vec::new());
+        append(
+            &mut builder,
+            "PaxHeaders.0/owner.v1",
+            b"13 mtime=1.2\n",
+            EntryType::XHeader,
+            65532,
+            0o600,
+        )?;
+        append(
+            &mut builder,
+            "owner.v1",
+            &bytes,
+            EntryType::Regular,
+            65532,
+            0o600,
+        )?;
+        assert_eq!(
+            record(&builder.into_inner()?, "owner.v1", *b"RSDKOWN2", 56)?,
+            bytes
+        );
+        Ok(())
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/custom.rs b/apps/rustack/tests/docker_startup/custom.rs
new file mode 100644
index 00000000..88a4c653
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/custom.rs
@@ -0,0 +1,427 @@
+//! Custom-RIC contracts and a separately owned movable operator-side source alias.
+
+use std::{
+    env,
+    ffi::OsString,
+    future::pending,
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::{
+    artifact::ImageReference,
+    docker::{DockerError, DockerWire},
+};
+use serde::Deserialize;
+use serde_json::{Value, json};
+use tokio::{fs, io::AsyncReadExt, runtime::Handle, task::JoinHandle, time::Instant};
+use uuid::Uuid;
+
+use super::{
+    process::{self, Server},
+    runner, sdk,
+};
+
+#[derive(Debug)]
+pub(super) struct Alias {
+    name: String,
+    ids: [String; 2],
+    pending: Option<String>,
+    executable: PathBuf,
+    record: PathBuf,
+    command: Option<JoinHandle<Result<runner::Report>>>,
+    runtime: Handle,
+}
+// Observer cancellation leaves the exact process waiter running. This captured-
+// runtime reaper joins it; the evidence directory keeps any uncertain tag intent.
+impl Drop for Alias {
+    fn drop(&mut self) {
+        if let Some(command) = self.command.take() {
+            self.runtime.spawn(async move {
+                if command.await.is_err() {
+                    eprintln!(
+                        "custom alias command owner failed; retained intent requires \
+                         reconciliation"
+                    );
+                }
+            });
+        }
+    }
+}
+impl Alias {
+    pub(super) fn name(&self) -> &str {
+        &self.name
+    }
+    pub(super) async fn for_pull(server: &Server, name: String, id: String) -> Result<Self> {
+        ensure!(
+            name.starts_with("public.ecr.aws:443/lambda/nodejs@sha256:") && name.len() == 104,
+            "unexpected pull fixture reference"
+        );
+        let executable =
+            PathBuf::from(env::var_os("RUSTACK_DOCKER_BIN").context("explicit Docker CLI")?);
+        ensure!(executable.is_absolute(), "Docker CLI must be absolute");
+        let owner = Self {
+            name,
+            ids: [id.clone(), id.clone()],
+            pending: Some(id),
+            executable,
+            record: server.path()?.join("source-pull-intent.json"),
+            command: None,
+            runtime: Handle::current(),
+        };
+        ensure!(
+            owner.inspect().await?.is_none(),
+            "pull fixture reference already exists; preserved"
+        );
+        owner.save().await?;
+        Ok(owner)
+    }
+    pub(super) async fn cleanup_after_pull(&mut self, root: &Path) -> Result<()> {
+        let file = fs::File::open(root.join("pull-complete.json")).await?;
+        let mut bytes = Vec::new();
+        file.take(2049).read_to_end(&mut bytes).await?;
+        ensure!(bytes.len() <= 2048, "pull receipt byte cap");
+        confirm_pull_receipt(&bytes, &self.name, &self.ids)?;
+        self.cleanup().await
+    }
+    pub(super) async fn new(server: &Server, ids: [String; 2]) -> Result<Self> {
+        let executable =
+            PathBuf::from(env::var_os("RUSTACK_DOCKER_BIN").context("explicit Docker CLI")?);
+        ensure!(executable.is_absolute(), "Docker CLI must be absolute");
+        let nonce = Uuid::new_v4().simple().to_string();
+        let owner = Self {
+            name: format!("rustack-test-custom-ric-{nonce}:mutable"),
+            ids,
+            pending: None,
+            executable,
+            record: server.path()?.join(format!("source-alias-{nonce}.json")),
+            command: None,
+            runtime: Handle::current(),
+        };
+        ensure!(
+            owner.inspect().await?.is_none(),
+            "fixture source alias already exists"
+        );
+        owner.save().await?;
+        Ok(owner)
+    }
+    async fn inspect(&self) -> Result<Option<String>> {
+        let at = Instant::now() + Duration::from_secs(60);
+        let mut wire = DockerWire::connect(process::socket()?.parse()?, at).await?;
+        let reference: ImageReference = self.name.parse()?;
+        let result = wire.port().inspect_image(&reference, at).await;
+        let stopped = wire.shutdown().await;
+        stopped?;
+        match result {
+            Ok(image) => Ok(Some(image.id.context("source alias identity")?)),
+            Err(DockerError::Status(status)) if status.as_u16() == 404 => Ok(None),
+            Err(error) => Err(error.into()),
+        }
+    }
+    async fn save(&self) -> Result<()> {
+        let bytes = serde_json::to_vec(
+            &json!({"alias":self.name,"sourceIds":self.ids,"pendingTarget":self.pending}),
+        )?;
+        ensure!(bytes.len() <= 4096, "source intent exceeds limit");
+        let pending = self.record.with_extension("pending");
+        fs::write(&pending, bytes).await?;
+        // Keep the preceding complete identity visible if this observer drops
+        // during writing. Each Alias has its own immutable nonce/path pair.
+        fs::rename(pending, &self.record).await?;
+        Ok(())
+    }
+    async fn command(&mut self, arguments: &[&str]) -> Result<()> {
+        let mut args = vec![OsString::from("--host"), OsString::from(process::socket()?)];
+        args.extend(arguments.iter().map(OsString::from));
+        ensure!(self.command.is_none(), "alias command already running");
+        let child = runner::Runner::spawn(&self.executable, &args)?;
+        self.command = Some(tokio::spawn(async move {
+            child.wait(Instant::now() + Duration::from_secs(60)).await
+        }));
+        let outcome = self
+            .command
+            .as_mut()
+            .context("retained alias command")?
+            .await;
+        self.command.take();
+        let report = outcome.context("alias command owner join")??;
+        ensure!(
+            !report.forced && report.status.success(),
+            "owned alias command failed: {}",
+            String::from_utf8_lossy(&report.stderr)
+        );
+        Ok(())
+    }
+    pub(super) async fn select(&mut self, target: usize) -> Result<()> {
+        let id = self.ids.get(target).context("source image index")?.clone();
+        let current = self.inspect().await?;
+        if target == 0 {
+            ensure!(current.is_none(), "alias was concurrently created");
+        } else {
+            ensure!(
+                current.as_ref() == self.ids.first(),
+                "alias was concurrently retargeted"
+            );
+        }
+        self.pending = Some(id.clone());
+        self.save().await?;
+        let name = self.name.clone();
+        self.command(&["image", "tag", &id, &name]).await?;
+        ensure!(
+            self.inspect().await?.as_ref() == Some(&id),
+            "tag target did not settle"
+        );
+        self.pending = None;
+        self.save().await
+    }
+    pub(super) async fn cleanup(&mut self) -> Result<()> {
+        let current = self.inspect().await?;
+        if let Some(pending) = &self.pending {
+            ensure!(
+                current.as_ref() == Some(pending),
+                "uncertain alias mutation retained for reconciliation"
+            );
+            self.pending = None;
+        }
+        if let Some(current) = current {
+            ensure!(
+                self.ids.contains(&current),
+                "foreign alias target preserved"
+            );
+            let name = self.name.clone();
+            self.command(&["image", "rm", "--no-prune", &name]).await?;
+        }
+        ensure!(
+            self.inspect().await?.is_none(),
+            "fixture alias survived cleanup"
+        );
+        self.save().await
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct PullReceipt {
+    reference: String,
+    expected_id: String,
+    complete: bool,
+    records: u32,
+}
+
+fn confirm_pull_receipt(bytes: &[u8], name: &str, ids: &[String; 2]) -> Result<()> {
+    ensure!(bytes.len() <= 2048, "pull receipt byte cap");
+    let receipt: PullReceipt = serde_json::from_slice(bytes)?;
+    ensure!(
+        receipt.reference == name
+            && ids.contains(&receipt.expected_id)
+            && receipt.complete
+            && (1..=65536).contains(&receipt.records),
+        "pull completion unproven; source intent retained"
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_validate_pull_completion_before_granting_cache_cleanup() -> Result<()> {
+    let name = format!("public.ecr.aws:443/lambda/nodejs@sha256:{}", "a".repeat(64));
+    let ids = [
+        format!("sha256:{}", "b".repeat(64)),
+        format!("sha256:{}", "b".repeat(64)),
+    ];
+    let valid = json!({"reference":name,"expectedId":ids.first(),"complete":true,"records":2});
+    confirm_pull_receipt(&serde_json::to_vec(&valid)?, &name, &ids)?;
+    for (field, value) in [
+        ("reference", json!("foreign")),
+        ("expectedId", json!("foreign")),
+        ("complete", json!(false)),
+        ("records", json!(0)),
+        ("records", json!(65537)),
+        ("records", json!(true)),
+        ("unknown", json!(1)),
+    ] {
+        let mut invalid = valid.clone();
+        invalid
+            .as_object_mut()
+            .context("receipt object")?
+            .insert(field.to_owned(), value);
+        ensure!(
+            confirm_pull_receipt(&serde_json::to_vec(&invalid)?, &name, &ids).is_err(),
+            "invalid pull receipt accepted"
+        );
+    }
+    for raw in [
+        b"{".as_slice(),
+        b"{\"complete\":true,\"complete\":true}",
+        &[b' '; 2049],
+    ] {
+        ensure!(
+            confirm_pull_receipt(raw, &name, &ids).is_err(),
+            "unbounded or malformed pull receipt accepted"
+        );
+    }
+    Ok(())
+}
+
+async fn python(server: &Server, image: &str, phase: &str, name: &str, tag: &str) -> Result<Value> {
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let architecture = if process::architecture()? == "arm64" {
+        "arm64"
+    } else {
+        "x86_64"
+    };
+    let args = [
+        root.join("tests/workflows/custom_ric_sdk.py")
+            .into_os_string(),
+        OsString::from(&server.endpoint),
+        OsString::from(image),
+        OsString::from(architecture),
+        OsString::from(phase),
+        env::var_os("RUSTACK_RUNTIME_GATEWAY_HOST").context("explicit collector host")?,
+        OsString::from(name),
+        OsString::from(tag),
+    ];
+    let mut child = runner::Runner::spawn(&runner::interpreter()?, &args)?;
+    let barrier = child.await_pid().await;
+    let at = if barrier.is_ok() {
+        Instant::now() + Duration::from_secs(360)
+    } else {
+        Instant::now()
+    };
+    let report = child.wait(at).await?;
+    let pid = barrier?;
+    ensure!(
+        report.pid == pid && !report.forced && report.status.success(),
+        "custom RIC SDK phase failed: {}",
+        String::from_utf8_lossy(&report.stderr)
+    );
+    let output: Value = serde_json::from_slice(&report.stdout)?;
+    ensure!(
+        output["schemaVersion"] == 1,
+        "missing custom RIC report schema"
+    );
+    Ok(output)
+}
+
+async fn abandon_controls(server: &Server, ids: &[String; 2]) -> Result<()> {
+    for panic_after_tag in [false, true] {
+        let mut owner = Alias::new(server, ids.clone()).await?;
+        owner.select(0).await?;
+        let (name, record, executable) = (
+            owner.name.clone(),
+            owner.record.clone(),
+            owner.executable.clone(),
+        );
+        let (entered, observed) = tokio::sync::oneshot::channel();
+        let task = tokio::spawn(async move {
+            let _ = entered.send(());
+            assert!(
+                !panic_after_tag,
+                "deliberate fixture panic after committed owned tag"
+            );
+            pending::<()>().await;
+            drop(owner);
+        });
+        observed.await.context("alias abandonment control entry")?;
+        if !panic_after_tag {
+            task.abort();
+        }
+        let failure = task
+            .await
+            .expect_err("deliberately abandoned alias owner must fail");
+        ensure!(
+            if panic_after_tag {
+                failure.is_panic()
+            } else {
+                failure.is_cancelled()
+            },
+            "wrong fixture owner failure"
+        );
+        let file = fs::File::open(&record).await?;
+        let mut raw = Vec::new();
+        file.take(4097).read_to_end(&mut raw).await?;
+        ensure!(raw.len() <= 4096, "retained alias record exceeds cap");
+        let saved: Value = serde_json::from_slice(&raw)?;
+        ensure!(
+            saved["alias"] == name
+                && saved["sourceIds"] == json!(ids)
+                && saved["pendingTarget"].is_null(),
+            "abandoned fixture lost exact ownership evidence"
+        );
+        // Authority transfers only after the old task has joined and its Alias
+        // dropped; this controlled fully-committed tag has no pending command.
+        let mut recovered = Alias {
+            name,
+            ids: ids.clone(),
+            pending: None,
+            executable,
+            record,
+            command: None,
+            runtime: Handle::current(),
+        };
+        ensure!(
+            recovered.inspect().await?.as_ref() == ids.first(),
+            "abandoned tag identity differs"
+        );
+        recovered.cleanup().await?;
+    }
+    Ok(())
+}
+
+pub(super) async fn exercise(server: &mut Server) -> Result<()> {
+    server.ready().await?;
+    let a = env::var("RUSTACK_CUSTOM_IMAGE_A").context("explicit custom source A")?;
+    let b = env::var("RUSTACK_CUSTOM_IMAGE_B").context("explicit custom source B")?;
+    let ids = [server.track_image(&a).await?, server.track_image(&b).await?];
+    ensure!(
+        ids.first() != ids.get(1),
+        "custom fixture images are identical"
+    );
+    sdk::custom_compute(&server.endpoint, &a, &process::architecture()?).await?;
+    let mut alias = Alias::new(server, ids.clone()).await?;
+    let result = async {
+        let report = python(server, &a, "contracts", "", "").await?;
+        ensure!(
+            report["cases"]
+                == json!([
+                    "custom-ric-compute-error",
+                    "imageconfig-inherit-clear-replace",
+                    "literal-argv",
+                    "active-cross-invocation-rejection"
+                ]),
+            "custom RIC contract inventory differs"
+        );
+        alias.select(0).await?;
+        let name = format!("MovingImage{}", Uuid::new_v4().simple());
+        let report = python(server, &a, "deploy", &name, &alias.name).await?;
+        ensure!(
+            report["cases"] == json!(["published-A"]),
+            "missing publication evidence"
+        );
+        alias.select(1).await?;
+        let report = python(server, &a, "update", &name, &alias.name).await?;
+        ensure!(
+            report["coldRevisionCounters"] == json!([1, 1]),
+            "missing cold published/latest image evidence"
+        );
+        ensure!(
+            report["cases"]
+                == json!([
+                    "tag-move-retains-A",
+                    "update-selects-B",
+                    "published-alias-isolation",
+                    "published-inflight-A-completes-after-B-update"
+                ]),
+            "immutable revision evidence differs"
+        );
+        Ok::<(), anyhow::Error>(())
+    }
+    .await;
+    let cleanup = alias.cleanup().await;
+    if cleanup.is_err() && result.is_err() {
+        eprintln!("custom source alias cleanup remains unconfirmed; primary SDK failure retained");
+    }
+    result?;
+    cleanup?;
+    abandon_controls(server, &ids).await
+}
diff --git a/apps/rustack/tests/docker_startup/faults.rs b/apps/rustack/tests/docker_startup/faults.rs
new file mode 100644
index 00000000..77eb07f3
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/faults.rs
@@ -0,0 +1,164 @@
+//! Actual failing user code, signed caller loss and bounded accepted-work shutdown.
+
+use std::{env, ffi::OsString, path::PathBuf, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use serde_json::{Value, json};
+use tokio::{fs, io::AsyncReadExt, time::Instant};
+
+use super::{
+    process::{self, Profile, Server},
+    runner,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Case {
+    Faults,
+    Initializing,
+    Busy,
+    Saturation,
+}
+impl Case {
+    pub(super) fn profile(self) -> Profile {
+        if self == Self::Faults {
+            Profile::Connected
+        } else {
+            Profile::Controlled
+        }
+    }
+    fn phase(self) -> &'static str {
+        match self {
+            Self::Faults => "faults",
+            Self::Initializing => "initializing",
+            Self::Busy => "busy",
+            Self::Saturation => "saturation",
+        }
+    }
+    fn expected(self) -> Value {
+        match self {
+            Self::Faults => json!([
+                "init-error",
+                "prepoll-exit",
+                "bootstrap-timeout",
+                "handler-exit",
+                "cgroup-oom",
+                "handler-timeout"
+            ]),
+            Self::Initializing => json!([
+                "reserved-zero-no-allocation",
+                "reserved-range-atomic",
+                "held-reserved-one",
+                "initializing-disconnect-removal-before-expiry",
+                "cold-recovery"
+            ]),
+            Self::Busy => json!([
+                "reserved-zero-no-allocation",
+                "reserved-range-atomic",
+                "held-reserved-one",
+                "busy-disconnect-removal-before-expiry",
+                "cold-recovery"
+            ]),
+            Self::Saturation => json!([
+                "impossible-memory-429",
+                "event-capacity-128",
+                "event-129-throttled",
+                "two-pairs-384MiB",
+                "held-backlog-shutdown-cutoff"
+            ]),
+        }
+    }
+}
+
+pub(super) async fn exercise(server: &mut Server, case: Case) -> Result<()> {
+    server.ready().await?;
+    let source = env::var("RUSTACK_CUSTOM_IMAGE_A").context("explicit fault fixture source")?;
+    server.track_image(&source).await?;
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let architecture = if process::architecture()? == "arm64" {
+        "arm64"
+    } else {
+        "x86_64"
+    };
+    let (owner, engine) = server.observation_identity().await?;
+    let arguments = [
+        root.join("tests/workflows/lambda_fault_sdk.py")
+            .into_os_string(),
+        OsString::from(&server.endpoint),
+        OsString::from(source),
+        OsString::from(architecture),
+        OsString::from(case.phase()),
+        env::var_os("RUSTACK_RUNTIME_GATEWAY_HOST").context("explicit hold collector host")?,
+        env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit metadata socket")?,
+        OsString::from(owner),
+        OsString::from(engine),
+    ];
+    let mut child = runner::Runner::spawn(&runner::interpreter()?, &arguments)?;
+    let entered = child.await_pid().await;
+    let gate = if case == Case::Saturation && entered.is_ok() {
+        child
+            .await_pid_before(Instant::now() + Duration::from_secs(180))
+            .await
+            .map(Some)
+    } else {
+        Ok(None)
+    };
+    let shutdown_started = Instant::now();
+    let stopped = if case == Case::Saturation || entered.is_err() || gate.is_err() {
+        server.stop(case != Case::Saturation).await
+    } else {
+        Ok(())
+    };
+    let shutdown_elapsed = shutdown_started.elapsed();
+    let deadline = if entered.is_ok() && gate.is_ok() {
+        Instant::now() + Duration::from_secs(180)
+    } else {
+        Instant::now()
+    };
+    // Every barrier and server-stop outcome is saved before joining the same child.
+    let report = child.wait(deadline).await?;
+    let diagnostics = String::from_utf8_lossy(&report.stderr);
+    let pid = entered.with_context(|| format!("fault SDK entry failed: {diagnostics}"))?;
+    let ready = gate.with_context(|| format!("fault SDK shutdown gate failed: {diagnostics}"))?;
+    if let Some(ready) = ready {
+        ensure!(ready == pid, "shutdown gate PID changed");
+    }
+    stopped?;
+    if case == Case::Saturation {
+        ensure!(
+            shutdown_elapsed >= Duration::from_secs(25),
+            "server failed before the declared drain cutoff"
+        );
+        let file = fs::File::open(server.path()?.join("server.log")).await?;
+        let mut bytes = Vec::new();
+        file.take(32769).read_to_end(&mut bytes).await?;
+        ensure!(
+            bytes.len() <= 32768
+                && String::from_utf8_lossy(&bytes)
+                    .contains("Lambda quiesce did not confirm all invocation cleanup"),
+            "wrong shutdown failure instead of the declared drain cutoff"
+        );
+    }
+    ensure!(
+        report.pid == pid && !report.forced && report.status.success(),
+        "actual fault SDK process failed: {diagnostics}"
+    );
+    let observed: Value = serde_json::from_slice(&report.stdout)?;
+    ensure!(
+        observed["schemaVersion"] == 1 && observed["cases"] == case.expected(),
+        "fault semantic inventory differs"
+    );
+    Ok(())
+}
+
+pub(super) async fn check_logs(server: &Server) -> Result<()> {
+    let file = fs::File::open(server.path()?.join("server.log")).await?;
+    let mut bytes = Vec::new();
+    file.take(32769).read_to_end(&mut bytes).await?;
+    ensure!(bytes.len() <= 32768, "fault log evidence exceeds cap");
+    ensure!(
+        !String::from_utf8_lossy(&bytes).contains("fixture-init-payload-sentinel")
+            && !String::from_utf8_lossy(&bytes).contains("runtime-boundary-secret"),
+        "fixture payload/header leaked into diagnostics"
+    );
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/handler_sdk.rs b/apps/rustack/tests/docker_startup/handler_sdk.rs
new file mode 100644
index 00000000..29c4397f
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/handler_sdk.rs
@@ -0,0 +1,77 @@
+//! Actual default SDK provider chain on a qualified local gateway.
+
+use std::{env, ffi::OsString, path::PathBuf};
+
+use anyhow::{Context, Result, ensure};
+use serde_json::{Value, json};
+
+use super::{
+    image_sdk,
+    process::{self, Profile, Server},
+};
+
+pub(super) async fn exercise(wrong: bool) -> Result<()> {
+    ensure!(
+        cfg!(all(feature = "s3", feature = "dynamodb")),
+        "Docker handler SDK resource requires explicit s3,dynamodb source features"
+    );
+    let profile = if wrong {
+        Profile::SdkWrongCredentials
+    } else {
+        Profile::Sdk
+    };
+    image_sdk::exercise(
+        profile,
+        async |server: &mut Server| prepare(server, wrong).await,
+        |observed| validate(observed, wrong),
+    )
+    .await
+}
+async fn prepare(server: &mut Server, wrong: bool) -> Result<Vec<OsString>> {
+    let image = env::var("RUSTACK_HANDLER_SDK_IMAGE").context("explicit handler SDK image")?;
+    server.track_image(&image).await?;
+    server.ready().await?;
+    let (owner, engine) = server.observation_identity().await?;
+    let script = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../tests/workflows/handler_sdk_image.py");
+    Ok(vec![
+        script.into_os_string(),
+        OsString::from(&server.endpoint),
+        OsString::from(image),
+        OsString::from(if process::architecture()? == "arm64" {
+            "arm64"
+        } else {
+            "x86_64"
+        }),
+        env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("SDK metadata socket")?,
+        OsString::from(owner),
+        OsString::from(engine),
+        OsString::from(if wrong { "wrong" } else { "positive" }),
+        env::var_os("RUSTACK_RUNTIME_GATEWAY_HOST").context("qualified gateway host")?,
+    ])
+}
+fn validate(observed: &Value, wrong: bool) -> Result<()> {
+    let cases = if wrong {
+        json!([
+            "explicit-invalid-s3-authorization",
+            "explicit-invalid-dynamodb-authorization",
+            "no-ambient-fallback"
+        ])
+    } else {
+        json!([
+            "quiet-body-abort",
+            "local-s3-dynamodb-cold-warm",
+            "authoritative-SDK-env",
+            "metadata-secret-omission"
+        ])
+    };
+    ensure!(
+        observed["schemaVersion"] == 1
+            && observed["mode"] == if wrong { "wrong" } else { "positive" }
+            && observed["versions"] == json!({"s3":"3.1105.0","dynamodb":"3.1105.0"})
+            && observed["cases"] == cases,
+        "handler SDK semantic inventory differs"
+    );
+    eprintln!("actual handler SDK versions: {}", observed["versions"]);
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/iac.rs b/apps/rustack/tests/docker_startup/iac.rs
new file mode 100644
index 00000000..ac322c6c
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/iac.rs
@@ -0,0 +1,214 @@
+//! Actual Pulumi provider lifecycle and whole-function plugin ownership.
+
+use std::{collections::HashSet, env, ffi::OsString, path::PathBuf};
+
+use anyhow::{Context, Result, anyhow, ensure};
+use serde::Deserialize;
+use serde_json::Value;
+use uuid::Uuid;
+
+use super::{
+    image_sdk,
+    process::{self, Profile, Server},
+};
+
+const COMMANDS: [&str; 18] = [
+    "version",
+    "login",
+    "init",
+    "create",
+    "refresh-created",
+    "update",
+    "refresh-updated",
+    "reject-publish",
+    "recover-publish",
+    "settle-publish",
+    "reject-logging",
+    "recover-logging",
+    "settle-logging",
+    "reject-encryption",
+    "recover-encryption",
+    "settle-encryption",
+    "destroy",
+    "remove",
+];
+const STAGES: [(&str, u8); 13] = [
+    ("created", 4),
+    ("refreshed-created", 5),
+    ("updated", 6),
+    ("refreshed-updated", 7),
+    ("rejected-publish", 8),
+    ("recovered-publish", 10),
+    ("rejected-logging", 11),
+    ("recovered-logging", 13),
+    ("rejected-encryption", 14),
+    ("recovered-encryption", 16),
+    ("pre-destroy", 16),
+    ("post-destroy", 17),
+    ("post-removal", 18),
+];
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Mode {
+    Lifecycle,
+    Stop,
+}
+impl Mode {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Lifecycle => "lifecycle",
+            Self::Stop => "stop",
+        }
+    }
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Versions {
+    cli: String,
+    provider: String,
+    sdk: String,
+    aws: String,
+    node: String,
+    dynamodb: String,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Stage {
+    stage: String,
+    ordinal: u8,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Evidence {
+    schema_version: u8,
+    mode: String,
+    versions: Versions,
+    stages: Vec<Stage>,
+    audits: Vec<String>,
+    commands: Vec<String>,
+    executions: Vec<String>,
+    business_requests: Vec<String>,
+    request_id: String,
+    physical_stop: bool,
+    actual_destroy: bool,
+}
+
+fn validate(mode: Mode, observed: &Value) -> Result<()> {
+    ensure!(
+        serde_json::to_vec(observed)?.len() <= 16 * 1024,
+        "IaC report cap"
+    );
+    let value: Evidence = serde_json::from_value(observed.clone())
+        .map_err(|_| anyhow!("invalid managed IaC report"))?;
+    let positive = mode == Mode::Lifecycle;
+    ensure!(
+        value.schema_version == 1
+            && value.mode == mode.name()
+            && value.physical_stop != positive
+            && value.actual_destroy == positive
+            && value.versions.cli == "3.273.0"
+            && value.versions.sdk == "3.273.0"
+            && value.versions.provider == "7.52.1"
+            && value.versions.aws == "7.52.1"
+            && value.versions.node == "24.22.1"
+            && value.versions.dynamodb == "3.1105.0",
+        "IaC semantic or source versions differ"
+    );
+    let stages = STAGES
+        .get(..if positive { STAGES.len() } else { 1 })
+        .context("literal IaC stage catalog")?;
+    let commands = COMMANDS
+        .get(..if positive { COMMANDS.len() } else { 4 })
+        .context("literal IaC command catalog")?;
+    let audits: &[&str] = if positive {
+        &["pre-destroy", "post-destroy", "post-removal"]
+    } else {
+        &[]
+    };
+    ensure!(
+        value.stages.len() == stages.len()
+            && value
+                .stages
+                .iter()
+                .map(|row| (row.stage.as_str(), row.ordinal))
+                .eq(stages.iter().copied())
+            && value
+                .commands
+                .iter()
+                .map(String::as_str)
+                .eq(commands.iter().copied())
+            && value
+                .audits
+                .iter()
+                .map(String::as_str)
+                .eq(audits.iter().copied()),
+        "actual IaC lifecycle catalog differs"
+    );
+    ensure!(
+        value.request_id.len() == 36
+            && Uuid::parse_str(&value.request_id)
+                .is_ok_and(|id| id.get_version_num() == 4 && id.to_string() == value.request_id)
+            && value.business_requests.len() == if positive { 10 } else { 3 }
+            && value.business_requests.iter().collect::<HashSet<_>>().len()
+                == value.business_requests.len()
+            && value.business_requests.iter().all(|id| id.len() == 36
+                && Uuid::parse_str(id)
+                    .is_ok_and(|uuid| uuid.get_version_num() == 4 && uuid.to_string() == *id))
+            && value.executions.len() == if positive { 8 } else { 1 }
+            && value.executions.iter().collect::<HashSet<_>>().len() == value.executions.len()
+            && value
+                .executions
+                .iter()
+                .all(|arn| (1..=256).contains(&arn.len())
+                    && arn
+                        .starts_with("arn:aws:states:us-east-1:000000000000:execution:IacTarget")
+                    && arn
+                        .bytes()
+                        .all(|byte| byte.is_ascii_alphanumeric() || b"_:-".contains(&byte))),
+        "invalid IaC invocation or independent execution identities"
+    );
+    eprintln!(
+        "actual managed IaC CLI3.273.0/provider7.52.1: {}",
+        mode.name()
+    );
+    Ok(())
+}
+
+pub(super) async fn exercise(mode: Mode) -> Result<()> {
+    image_sdk::exercise(
+        Profile::Iac,
+        async |server: &mut Server| {
+            let tool = env::var("RUSTACK_PULUMI_IMAGE").context("explicit Pulumi image")?;
+            let business = env::var("RUSTACK_NODE_IMAGE").context("explicit business image")?;
+            server.track_image(&tool).await?;
+            server.track_image(&business).await?;
+            let capabilities = server.ready().await?;
+            ensure!(
+                capabilities["workflows"]["lambdaRequestResponse"] == true
+                    && capabilities["workflows"]["limits"]["dispatches"] == 2,
+                "IaC capability/profile mismatch"
+            );
+            let (owner, engine) = server.observation_identity().await?;
+            Ok(vec![
+                PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                    .join("../../tests/workflows/pulumi_image_sdk.py")
+                    .into_os_string(),
+                OsString::from(&server.endpoint),
+                OsString::from(tool),
+                OsString::from(business),
+                OsString::from(if process::architecture()? == "arm64" {
+                    "arm64"
+                } else {
+                    "x86_64"
+                }),
+                env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("IaC metadata socket")?,
+                OsString::from(owner),
+                OsString::from(engine),
+                OsString::from(mode.name()),
+                server.path()?.as_os_str().to_owned(),
+            ])
+        },
+        |observed| validate(mode, observed),
+    )
+    .await
+}
diff --git a/apps/rustack/tests/docker_startup/image_sdk.rs b/apps/rustack/tests/docker_startup/image_sdk.rs
new file mode 100644
index 00000000..4ebe50c6
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/image_sdk.rs
@@ -0,0 +1,101 @@
+//! Shared ordinary image SDK child and server ownership through every exit.
+
+use std::{ffi::OsString, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use serde_json::Value;
+use tokio::time::{Instant, timeout_at};
+
+use super::{
+    faults::check_logs,
+    process::{Profile, Server},
+    runner::{Report, Runner, interpreter},
+};
+
+pub(super) async fn exercise<F, V>(profile: Profile, prepare: F, validate: V) -> Result<()>
+where
+    F: for<'a> AsyncFnOnce(&'a mut Server) -> Result<Vec<OsString>>,
+    V: FnOnce(&Value) -> Result<()>,
+{
+    exercise_with_audit(profile, prepare, validate, async |_, _| Ok(())).await
+}
+
+pub(super) async fn exercise_with_audit<F, V, A>(
+    profile: Profile,
+    prepare: F,
+    validate: V,
+    after_stop: A,
+) -> Result<()>
+where
+    F: for<'a> AsyncFnOnce(&'a mut Server) -> Result<Vec<OsString>>,
+    V: FnOnce(&Value) -> Result<()>,
+    A: for<'a> AsyncFnOnce(&'a Server, &'a Value) -> Result<()>,
+{
+    let mut server = Server::spawn(profile).await?;
+    server
+        .root
+        .as_mut()
+        .context("image SDK evidence root")?
+        .disable_cleanup(true);
+    let cutoff =
+        Instant::now() + Duration::from_secs(if profile == Profile::Iac { 1020 } else { 480 });
+    let prepared = timeout_at(cutoff, prepare(&mut server))
+        .await
+        .context("ordinary image SDK preparation expired")
+        .and_then(|result| result);
+    let result = async {
+        let arguments = prepared?;
+        let child = Runner::spawn(&interpreter()?, &arguments)?;
+        let (entered, report) = join_with_pid_before(child, cutoff).await?;
+        ensure!(
+            report.pid == entered? && !report.forced && report.status.success(),
+            "ordinary image SDK failed: {}",
+            String::from_utf8_lossy(&report.stderr)
+        );
+        let observed: Value = serde_json::from_slice(&report.stdout)?;
+        validate(&observed)?;
+        Ok::<Value, anyhow::Error>(observed)
+    }
+    .await;
+    let stopped = server.stop(true).await;
+    let audited = server.audit().await;
+    let logs = check_logs(&server).await;
+    let saved = match &result {
+        Ok(observed) if stopped.is_ok() && audited.is_ok() && logs.is_ok() => {
+            after_stop(&server, observed).await
+        }
+        _ => Ok(()),
+    };
+    if result.is_err() || stopped.is_err() || audited.is_err() || logs.is_err() || saved.is_err() {
+        server.retain_on_error().await;
+    }
+    result?;
+    stopped?;
+    audited?;
+    logs?;
+    saved?;
+    server
+        .root
+        .as_mut()
+        .context("image SDK root after cleanup")?
+        .disable_cleanup(false);
+    Ok(())
+}
+
+/// Join this same child after the original-cutoff PID barrier, including failure.
+pub(super) async fn join_with_pid_before(
+    mut child: Runner,
+    cutoff: Instant,
+) -> Result<(Result<u32>, Report)> {
+    let entered = child
+        .await_pid_before(cutoff.min(Instant::now() + Duration::from_secs(5)))
+        .await;
+    let report = child
+        .wait(if entered.is_ok() {
+            cutoff
+        } else {
+            Instant::now()
+        })
+        .await?;
+    Ok((entered, report))
+}
diff --git a/apps/rustack/tests/docker_startup/io_faults.rs b/apps/rustack/tests/docker_startup/io_faults.rs
new file mode 100644
index 00000000..3593a23f
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/io_faults.rs
@@ -0,0 +1,348 @@
+//! A joined real-daemon proxy remains live through ordinary server cleanup.
+
+use std::{
+    env,
+    ffi::OsString,
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use serde_json::{Value, json};
+use tempfile::Builder;
+use tokio::{fs, time::Instant};
+
+use super::{
+    custom::Alias,
+    faults::check_logs,
+    process::{Profile, Server, architecture},
+    runner::{Runner, interpreter},
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Case {
+    Create,
+    Delete,
+    Loss,
+    Saturation,
+    CreateTimeout,
+    DeleteTimeout,
+    Pull,
+    Negative,
+    RuntimeBounds,
+    CompositePressure,
+    GlobalLimit,
+    DefaultLimit,
+    MemoryLimit,
+    EnvironmentLimit,
+    ZipCreate,
+    ZipDelete,
+}
+impl Case {
+    fn zip(self) -> bool {
+        matches!(self, Self::ZipCreate | Self::ZipDelete)
+    }
+    fn sources(self) -> Result<[String; 2]> {
+        let [first, second] = if self.zip() {
+            ["RUSTACK_PROVIDED_ZIP_A", "RUSTACK_PROVIDED_ZIP_B"]
+        } else {
+            ["RUSTACK_CUSTOM_IMAGE_A", "RUSTACK_CUSTOM_IMAGE_B"]
+        };
+        Ok([
+            env::var(first).context("explicit IO source A")?,
+            env::var(second).context("explicit IO source B")?,
+        ])
+    }
+    fn phase(self) -> &'static str {
+        match self {
+            Self::ZipCreate => "zip_create",
+            Self::ZipDelete => "zip_delete",
+            Self::Create => "create",
+            Self::Delete => "delete",
+            Self::Loss => "loss",
+            Self::Saturation => "saturation",
+            Self::CreateTimeout => "create_timeout",
+            Self::DeleteTimeout => "delete_timeout",
+            Self::Pull => "pull",
+            Self::Negative => "negative",
+            Self::RuntimeBounds => "runtime_bounds",
+            Self::CompositePressure => "composite_pressure",
+            Self::GlobalLimit => "global_limit",
+            Self::DefaultLimit => "default_limit",
+            Self::MemoryLimit => "memory_limit",
+            Self::EnvironmentLimit => "environment_limit",
+        }
+    }
+    fn expected(self) -> Value {
+        match self {
+            Self::ZipCreate | Self::ZipDelete | Self::Create | Self::Delete => json!([
+                format!("{}-held-real-io", self.phase()),
+                "retained-reserved-slot",
+                "caller-disconnected",
+                "post-release-physical-retirement",
+                "cold-computed-recovery"
+            ]),
+            Self::Loss => json!([
+                "image-management-ack-lost",
+                "failed-update-preserves-active-A",
+                "published-A-preserved",
+                "recovered-B-computation",
+                "missing-source-never-active",
+                "full-loss-revokes-readiness"
+            ]),
+            Self::Saturation => json!([
+                "two-held-pending-deployments",
+                "third-rejected-before-insertion",
+                "deleted-preparation-retains-capacity",
+                "deleted-job-never-resurrects",
+                "capacity-recovery-computation"
+            ]),
+            Self::CreateTimeout | Self::DeleteTimeout => json!([
+                format!("{}-held-after-effect", self.phase()),
+                "live-caller-production-io-expiration",
+                "physical-retirement-before-release",
+                "typed-primary-error",
+                "cold-computed-recovery"
+            ]),
+            Self::Pull => json!([
+                "actual-ifMissing-pull",
+                "truncated-progress-rejected",
+                "failed-update-preserves-active-A",
+                "backend-pull-positively-drained",
+                "recovered-B-computation"
+            ]),
+            Self::CompositePressure => json!([
+                "large-nested-map-owned-child",
+                "oversized-runtime-frame-under-load",
+                "live-ready-and-stop",
+                "physical-pair-retirement",
+                "typed-payload-quota",
+                "cold-slot-recovery"
+            ]),
+            Self::RuntimeBounds => json!([
+                "runtime-http-405-431-413-413-400",
+                "same-attempt-computed-result",
+                "warm-counter-two",
+                "retired-healthy"
+            ]),
+            Self::GlobalLimit | Self::DefaultLimit => json!([
+                format!("{}-positive-capacity-proof", self.phase()),
+                "held-delete-retains-charge",
+                "physical-retirement-before-recovery",
+                "computed-recovery"
+            ]),
+            Self::MemoryLimit | Self::EnvironmentLimit => json!([
+                format!("{}-independent-ceiling", self.phase()),
+                "admitted-B-waits-without-allocation",
+                "retained-until-old-pair-retired",
+                "B-cold-computed-recovery"
+            ]),
+            Self::Negative => json!([
+                "real-wrong-os-rejected",
+                "real-wrong-architecture-rejected",
+                "protocol-free-bootstrap-timeout",
+                "cold-computed-recovery"
+            ]),
+        }
+    }
+}
+
+pub(super) async fn exercise(case: Case) -> Result<()> {
+    let mut root = Builder::new().prefix("rustack-io-").tempdir_in("/tmp")?;
+    root.disable_cleanup(true);
+    eprintln!("management IO evidence: {}", root.path().display());
+    let repository = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let sources = case.sources()?;
+    let architecture = if architecture()? == "arm64" {
+        "arm64"
+    } else {
+        "x86_64"
+    };
+    let arguments = [
+        repository
+            .join("tests/workflows/lambda_io_fault_sdk.py")
+            .into_os_string(),
+        root.path().as_os_str().to_owned(),
+        env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit actual daemon")?,
+        OsString::from(&sources[0]),
+        OsString::from(&sources[1]),
+        OsString::from(architecture),
+        OsString::from(case.phase()),
+        env::var_os("RUSTACK_RUNTIME_GATEWAY_HOST").context("explicit init hold host")?,
+    ];
+    let mut child = Runner::spawn(&interpreter()?, &arguments)?;
+    let mut server = None;
+    let mut pull = None;
+    let semantic = handoff(
+        &mut server,
+        &mut pull,
+        &mut child,
+        root.path(),
+        &sources,
+        case,
+    )
+    .await;
+    // Keep the proxy transparent and alive through server shutdown on every result.
+    let restored = fs::write(root.path().join("restore"), b"restore").await;
+    let stopped = match &mut server {
+        Some(ordinary) => {
+            if case == Case::Loss {
+                ordinary.stop_after_transport_loss().await
+            } else {
+                ordinary.stop(true).await
+            }
+        }
+        None => Ok(()),
+    };
+    let cache_cleanup = match &mut pull {
+        Some(owner) => owner.cleanup_after_pull(root.path()).await,
+        None => Ok(()),
+    };
+    let (audited, logs) = match &server {
+        Some(ordinary) => (ordinary.audit().await, check_logs(ordinary).await),
+        None => (Ok(()), Ok(())),
+    };
+    let stop = fs::write(root.path().join("stop"), b"stop").await;
+    let joined = child.wait(Instant::now() + Duration::from_secs(15)).await;
+    let result = (|| {
+        let report = joined?;
+        let diagnostic = String::from_utf8_lossy(&report.stderr);
+        semantic.with_context(|| format!("IO SDK handoff failed: {diagnostic}"))?;
+        restored?;
+        stop?;
+        ensure!(
+            !report.forced && report.status.success(),
+            "IO SDK failed: {diagnostic}"
+        );
+        stopped?;
+        cache_cleanup?;
+        audited?;
+        logs?;
+        let observed: Value = serde_json::from_slice(&report.stdout)?;
+        ensure!(
+            observed["schemaVersion"] == 1 && observed["cases"] == case.expected(),
+            "IO semantic inventory differs"
+        );
+        Ok::<(), anyhow::Error>(())
+    })();
+    if result.is_err() {
+        if let Some(ordinary) = &mut server {
+            ordinary.retain_on_error().await;
+        }
+    } else {
+        root.disable_cleanup(false);
+        if let Some(ordinary) = &mut server {
+            ordinary
+                .root
+                .as_mut()
+                .context("ordinary evidence guard")?
+                .disable_cleanup(false);
+        }
+    }
+    result
+}
+
+async fn handoff(
+    server: &mut Option<Server>,
+    pull: &mut Option<Alias>,
+    child: &mut Runner,
+    root: &Path,
+    sources: &[String; 2],
+    case: Case,
+) -> Result<()> {
+    let pid = child.await_pid().await?;
+    ensure!(
+        child.await_pid().await? == pid,
+        "proxy readiness PID changed"
+    );
+    let profile = match case {
+        Case::ZipCreate | Case::ZipDelete => Profile::ZipControlled,
+        Case::CreateTimeout | Case::DeleteTimeout => Profile::Deadline,
+        Case::Pull => Profile::Pull,
+        Case::Negative => Profile::Negative,
+        Case::MemoryLimit => Profile::MemoryPressure,
+        Case::DefaultLimit | Case::EnvironmentLimit => Profile::EnvironmentPressure,
+        _ => Profile::Controlled,
+    };
+    let mut ordinary = Server::spawn_with_socket(profile, Some(&root.join("engine.sock"))).await?;
+    ordinary
+        .root
+        .as_mut()
+        .context("ordinary evidence guard")?
+        .disable_cleanup(true);
+    *server = Some(ordinary);
+    let ordinary = server.as_mut().context("ordinary server owner")?;
+    if case.zip() {
+        ordinary
+            .track_image(&env::var("RUSTACK_ZIP_BASE_IMAGE")?)
+            .await?;
+    } else {
+        for source in sources {
+            ordinary.track_image(source).await?;
+        }
+    }
+    let mut fixtures = Vec::new();
+    if case == Case::Negative {
+        let selected = architecture()?;
+        let opposite = if selected == "arm64" {
+            "amd64"
+        } else {
+            "arm64"
+        };
+        let mut identities = Vec::new();
+        for (name, os, arch) in [
+            ("invalid-os", "windows", "amd64"),
+            ("invalid-architecture", "linux", opposite),
+            ("no-runtime", "linux", selected.as_str()),
+        ] {
+            let reference = format!("rustack-{name}:{selected}");
+            let id = ordinary.track_platform_image(&reference, os, arch).await?;
+            ensure!(
+                !identities.contains(&id),
+                "negative fixtures share content identity"
+            );
+            identities.push(id.clone());
+            let proof = json!({"reference":reference,"id":id,"os":os,"architecture":arch});
+            fs::write(
+                root.join(format!("{name}-platform.json")),
+                serde_json::to_vec(&proof)?,
+            )
+            .await?;
+            fixtures.push(reference);
+        }
+    }
+    if case == Case::Pull {
+        let source =
+            env::var("RUSTACK_PULL_IMAGE").context("explicit immutable public pull fixture")?;
+        let suffix = source
+            .strip_prefix("public.ecr.aws/lambda/nodejs@sha256:")
+            .context("public Node digest fixture required")?;
+        ensure!(
+            suffix.len() == 64
+                && suffix
+                    .bytes()
+                    .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase()),
+            "canonical source digest required"
+        );
+        let id = ordinary.track_image(&source).await?;
+        let alternate = format!("public.ecr.aws:443/lambda/nodejs@sha256:{suffix}");
+        *pull = Some(Alias::for_pull(ordinary, alternate.clone(), id.clone()).await?);
+        fixtures.extend([source, alternate, id]);
+    }
+    ordinary.ready().await?;
+    let (owner, engine) = ordinary.observation_identity().await?;
+    let bytes = serde_json::to_vec(
+        &json!({"endpoint":ordinary.endpoint,"owner":owner,"engine":engine,"fixtures":fixtures}),
+    )?;
+    ensure!(bytes.len() <= 2048, "proxy handoff byte cap");
+    fs::write(root.join("config.pending"), bytes).await?;
+    fs::rename(root.join("config.pending"), root.join("config.json")).await?;
+    ensure!(
+        child
+            .await_pid_before(Instant::now() + Duration::from_secs(180))
+            .await?
+            == pid,
+        "SDK completion PID changed"
+    );
+    Ok::<(), anyhow::Error>(())
+}
diff --git a/apps/rustack/tests/docker_startup/node.rs b/apps/rustack/tests/docker_startup/node.rs
new file mode 100644
index 00000000..3867b6a0
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/node.rs
@@ -0,0 +1,95 @@
+//! Real official Node runtime consumption with retained server and SDK owners.
+
+use std::{env, ffi::OsString, path::PathBuf};
+
+use anyhow::{Context, Result, ensure};
+use serde_json::{Value, json};
+
+use super::{
+    image_sdk,
+    process::{self, Profile, Server},
+    sdk,
+};
+
+pub(super) async fn exercise() -> Result<()> {
+    image_sdk::exercise(Profile::Connected, prepare, validate).await
+}
+
+async fn prepare(server: &mut Server) -> Result<Vec<OsString>> {
+    let image = env::var("RUSTACK_NODE_IMAGE").context("explicit official Node fixture")?;
+    server.track_image(&image).await?;
+    server.ready().await?;
+    sdk::node_compute(&server.endpoint, &image, &process::architecture()?).await?;
+    let (owner, engine) = server.observation_identity().await?;
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+    Ok(vec![
+        root.join("tests/workflows/node_image_sdk.py")
+            .into_os_string(),
+        OsString::from(&server.endpoint),
+        OsString::from(image),
+        OsString::from(if process::architecture()? == "arm64" {
+            "arm64"
+        } else {
+            "x86_64"
+        }),
+        env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit Node metadata socket")?,
+        OsString::from(owner),
+        OsString::from(engine),
+    ])
+}
+
+fn validate(observed: &Value) -> Result<()> {
+    ensure!(
+        observed["schemaVersion"] == 1
+            && observed["cases"]
+                == json!([
+                    "cold-warm-context-filesystem-logs",
+                    "published-alias-command-isolation",
+                    "FunctionError-replacement-warm",
+                    "ASL-node-computation"
+                ])
+            && observed["nodeVersion"]
+                .as_str()
+                .is_some_and(|version| version.starts_with("24.")),
+        "Node semantic inventory or runtime differs"
+    );
+    eprintln!("official Node runtime version: {}", observed["nodeVersion"]);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{ffi::OsString, path::Path};
+
+    use anyhow::{Result, ensure};
+    use nix::{errno::Errno, sys::signal::kill, unistd::Pid};
+    use tokio::time::{Duration, Instant};
+
+    use super::super::{image_sdk::join_with_pid_before, runner::Runner};
+
+    #[tokio::test]
+    async fn test_should_join_late_node_sdk_child_before_reporting_expired_handshake() -> Result<()>
+    {
+        let cutoff = Instant::now() - Duration::from_millis(1);
+        let mut child = Runner::spawn(
+            Path::new("/bin/sh"),
+            &[
+                OsString::from("-c"),
+                OsString::from("echo $$; exec /bin/sleep 60"),
+            ],
+        )?;
+        let held = child.await_pid().await;
+        let (entered, report) = join_with_pid_before(child, cutoff).await?;
+        let held_pid = held?;
+        ensure!(
+            entered.is_err() && report.pid == held_pid && report.forced && !report.status.success(),
+            "late SDK accepted"
+        );
+        let pid = Pid::from_raw(i32::try_from(report.pid)?);
+        ensure!(
+            kill(pid, None) == Err(Errno::ESRCH),
+            "late SDK child remains after joined wait"
+        );
+        Ok(())
+    }
+}
diff --git a/apps/rustack/tests/docker_startup/performance.rs b/apps/rustack/tests/docker_startup/performance.rs
new file mode 100644
index 00000000..22a23613
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/performance.rs
@@ -0,0 +1,145 @@
+//! Real signed image measurements, published only after physical server cleanup.
+#![warn(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+use std::{env, ffi::OsString, path::PathBuf, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use serde_json::Value;
+use tokio::{
+    fs,
+    io::AsyncReadExt,
+    time::{Instant, timeout},
+};
+
+use super::{
+    image_sdk,
+    process::{Profile, Server, architecture},
+    runner::{Runner, interpreter},
+};
+
+pub(super) async fn exercise(phase: &'static str) -> Result<()> {
+    image_sdk::exercise_with_audit(
+        Profile::Performance,
+        async move |server| prepare(server, phase).await,
+        move |observed| validate(observed, phase),
+        async move |server, observed| audit(server, observed, phase).await,
+    )
+    .await
+}
+
+async fn prepare(server: &mut Server, phase: &str) -> Result<Vec<OsString>> {
+    server.ready().await?;
+    let baseline = read_log(server.path()?.join("server.log")).await?;
+    ensure!(
+        baseline.len() <= 32768 && baseline.ends_with(b"\n"),
+        "initialization baseline bound or framing"
+    );
+    timeout(
+        Duration::from_secs(5),
+        fs::write(server.path()?.join("initialization-baseline.log"), baseline),
+    )
+    .await
+    .context("initialization baseline write expired")??;
+    let source = env::var("RUSTACK_CUSTOM_IMAGE_A")?;
+    server.track_image(&source).await?;
+    let (owner, engine) = server.observation_identity().await?;
+    let script = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../tests/workflows/image_performance_sdk.py");
+    Ok(vec![
+        script.into_os_string(),
+        OsString::from(&server.endpoint),
+        OsString::from(source),
+        OsString::from(if architecture()? == "arm64" {
+            "arm64"
+        } else {
+            "x86_64"
+        }),
+        OsString::from(phase),
+        env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit metadata socket")?,
+        OsString::from(owner),
+        OsString::from(engine),
+        env::var_os("RUSTACK_RUNTIME_GATEWAY_HOST").context("explicit collector gateway")?,
+        OsString::from(server.process_id()?.to_string()),
+        OsString::from("v1"),
+        env::var_os("RUSTACK_WORKFLOWS_SDK_SITE_PACKAGES").unwrap_or_else(|| OsString::from("-")),
+    ])
+}
+
+fn validate(observed: &Value, phase: &str) -> Result<()> {
+    ensure!(
+        observed.get("schemaVersion") == Some(&Value::from(1))
+            && observed.get("phase").and_then(Value::as_str) == Some(phase)
+            && observed.get("emptyAfterWorkload") == Some(&Value::Bool(true))
+            && observed
+                .get("referenceQualification")
+                .and_then(Value::as_str)
+                == Some("pending"),
+        "image performance report identity or cleanup differs"
+    );
+    Ok(())
+}
+
+async fn audit(server: &Server, observed: &Value, phase: &str) -> Result<()> {
+    let log = read_log(server.path()?.join("server.log")).await?;
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../tests/workflows/image_performance_report.py");
+    let directory = server.path()?;
+    let input = directory.join("image-performance.json");
+    let mut observed = observed.clone();
+    observed
+        .as_object_mut()
+        .context("measurement report object")?
+        .insert(
+            "debugAssertions".to_owned(),
+            Value::Bool(cfg!(debug_assertions)),
+        );
+    timeout(
+        Duration::from_secs(5),
+        fs::write(&input, serde_json::to_vec(&observed)?),
+    )
+    .await
+    .context("measurement evidence write expired")??;
+    let child = Runner::spawn(
+        &interpreter()?,
+        &[
+            root.into_os_string(),
+            input.into_os_string(),
+            directory.join("server.log").into_os_string(),
+            OsString::from(phase),
+            directory
+                .join("initialization-baseline.log")
+                .into_os_string(),
+        ],
+    )?;
+    let (entered, report) =
+        image_sdk::join_with_pid_before(child, Instant::now() + Duration::from_secs(10)).await?;
+    ensure!(
+        report.pid == entered? && !report.forced && report.status.success(),
+        "independent image measurement validation failed: {}",
+        String::from_utf8_lossy(&report.stderr)
+    );
+    let qualified: Value = serde_json::from_slice(&report.stdout)?;
+    ensure!(!log.is_empty(), "missing actual initialization log");
+    println!(
+        "WORKFLOWS_IMAGE_PERFORMANCE {}",
+        serde_json::to_string(&qualified)?
+    );
+    Ok(())
+}
+
+async fn read_log(path: PathBuf) -> Result<Vec<u8>> {
+    timeout(Duration::from_secs(5), async {
+        let file = fs::File::open(path).await?;
+        let mut bytes = Vec::new();
+        file.take(32769).read_to_end(&mut bytes).await?;
+        ensure!(bytes.len() <= 32768, "initialization log evidence bound");
+        Ok(bytes)
+    })
+    .await
+    .context("initialization log read expired")?
+}
diff --git a/apps/rustack/tests/docker_startup/process.rs b/apps/rustack/tests/docker_startup/process.rs
new file mode 100644
index 00000000..665b7f3a
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/process.rs
@@ -0,0 +1,742 @@
+//! Exact owned executable, data directory and post-exit daemon audit.
+
+use std::{
+    env,
+    fs::Permissions,
+    io::SeekFrom,
+    os::unix::{fs::PermissionsExt, process::ExitStatusExt},
+    path::{Path, PathBuf},
+    process::{ExitStatus, Stdio},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use nix::{
+    sys::signal::{Signal, kill},
+    unistd::Pid,
+};
+use rustack_lambda_core::{
+    artifact::ImageReference,
+    docker::{DirectoryLease, DockerWire, reconcile_namespace},
+};
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+use tempfile::{Builder as TempDirBuilder, TempDir};
+use tokio::{
+    fs,
+    io::{AsyncReadExt, AsyncSeekExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+    process::{Child, Command},
+    time::{Instant, sleep, timeout},
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Profile {
+    Disconnected,
+    Connected,
+    Performance,
+    Sdk,
+    SdkWrongCredentials,
+    Callback,
+    Iac,
+    Controlled,
+    Deadline,
+    Pull,
+    Negative,
+    MemoryPressure,
+    EnvironmentPressure,
+    MissingRelay,
+    Legacy,
+    WrongEndpoint,
+    Archive,
+    Zip,
+    ZipControlled,
+    ZipArchive,
+    ZipArchiveNoSource,
+}
+impl Profile {
+    fn configure_diagnostics(self, command: &mut Command) {
+        if self == Self::Performance {
+            command
+                .env(
+                    "LOG_LEVEL",
+                    "error,rustack_lambda_core::docker::initialization=info",
+                )
+                .env("NO_COLOR", "1")
+                .env("LAMBDA_IDLE_TIMEOUT_SECS", "2");
+        } else {
+            command.env("LOG_LEVEL", "error");
+        }
+    }
+    fn sdk(self) -> bool {
+        matches!(
+            self,
+            Self::Sdk | Self::SdkWrongCredentials | Self::Callback | Self::Iac
+        )
+    }
+    fn services(self) -> &'static str {
+        if self.sdk() {
+            "lambda,stepfunctions,s3,dynamodb"
+        } else {
+            "lambda,stepfunctions"
+        }
+    }
+    pub fn rejects(self) -> bool {
+        matches!(
+            self,
+            Self::MissingRelay | Self::Legacy | Self::WrongEndpoint
+        )
+    }
+    pub(super) fn matches_failure(self, text: &str) -> bool {
+        let expected = match self {
+            Self::MissingRelay => {
+                "Docker startup relay preparation failed: Docker response status 404 Not Found"
+            }
+            Self::Legacy => "Docker ownership predates journal provenance",
+            Self::WrongEndpoint => "Docker startup endpoint qualification failed",
+            Self::Archive => "Restored image storage proof mismatch",
+            Self::ZipArchive => "Invalid or oversized Docker ZIP archive candidate",
+            Self::ZipArchiveNoSource => "snapshot CBOR scalar limit exceeded",
+            _ => return false,
+        };
+        text.contains(expected)
+    }
+    fn init_seconds(self) -> &'static str {
+        if matches!(
+            self,
+            Self::Sdk
+                | Self::Performance
+                | Self::SdkWrongCredentials
+                | Self::Callback
+                | Self::Iac
+                | Self::ZipControlled
+                | Self::Controlled
+                | Self::Deadline
+                | Self::Pull
+                | Self::MemoryPressure
+                | Self::EnvironmentPressure
+        ) {
+            "20"
+        } else {
+            "5"
+        }
+    }
+    fn zip(self) -> bool {
+        matches!(self, Self::Zip | Self::ZipControlled | Self::ZipArchive)
+    }
+    fn network(self) -> bool {
+        matches!(
+            self,
+            Self::Sdk
+                | Self::Performance
+                | Self::SdkWrongCredentials
+                | Self::Callback
+                | Self::Iac
+                | Self::Zip
+                | Self::ZipControlled
+                | Self::ZipArchive
+                | Self::Connected
+                | Self::Controlled
+                | Self::Deadline
+                | Self::Pull
+                | Self::Negative
+                | Self::MemoryPressure
+                | Self::EnvironmentPressure
+                | Self::WrongEndpoint
+        )
+    }
+}
+#[derive(Debug)]
+pub(super) struct Server {
+    child: Child,
+    pub root: Option<TempDir>,
+    pub endpoint: String,
+    profile: Profile,
+    sources: Vec<(ImageReference, String)>,
+    socket_override: Option<PathBuf>,
+    log_start: u64,
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+fn private_root() -> Result<TempDir> {
+    TempDirBuilder::new()
+        .permissions(Permissions::from_mode(0o700))
+        .tempdir()
+        .context("create private Docker fixture evidence")
+}
+pub(super) fn image() -> Result<String> {
+    Ok(env::var("RUSTACK_RUNTIME_IMAGE")?)
+}
+pub(super) fn architecture() -> Result<String> {
+    let value = env::var("RUSTACK_RUNTIME_ARCH")?;
+    ensure!(
+        matches!(value.as_str(), "arm64" | "amd64"),
+        "explicit runtime architecture"
+    );
+    Ok(value)
+}
+pub(super) fn handler() -> Result<String> {
+    match env::var("RUSTACK_RUNTIME_HANDLER_IMAGE") {
+        Ok(value) => Ok(value),
+        Err(env::VarError::NotPresent) => Ok(format!("rustack-p0-handler:{}", architecture()?)),
+        Err(error) => Err(error.into()),
+    }
+}
+pub(super) fn socket() -> Result<String> {
+    Ok(format!(
+        "unix://{}",
+        env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")?
+    ))
+}
+impl Server {
+    pub(super) fn process_id(&self) -> Result<u32> {
+        self.child.id().context("owned server PID")
+    }
+    pub async fn spawn(profile: Profile) -> Result<Self> {
+        Self::spawn_with_socket(profile, None).await
+    }
+    pub async fn spawn_with_socket(
+        profile: Profile,
+        socket_override: Option<&Path>,
+    ) -> Result<Self> {
+        let root = private_root()?;
+        let reserved = TcpListener::bind("0.0.0.0:0").await?;
+        let port = reserved.local_addr()?.port();
+        drop(reserved);
+        let config = root.path().join("config.yaml");
+        let mut text = "budgets:\n  startupSeconds: 180\n  shutdownSeconds: 60\n  \
+                        lambdaDockerIoSeconds: 60\n  lambdaDockerStartSeconds: 60\n  \
+                        lambdaDockerCleanupSeconds: 60\n  lambdaDockerEnvironments: 2\n  \
+                        lambdaDockerImagePins: 16\n  lambdaDockerDeploymentJobs: 2\n"
+            .to_owned();
+        if profile == Profile::Deadline {
+            text = text.replace("lambdaDockerIoSeconds: 60", "lambdaDockerIoSeconds: 5");
+        }
+        if matches!(
+            profile,
+            Profile::ZipControlled
+                | Profile::Controlled
+                | Profile::Deadline
+                | Profile::Pull
+                | Profile::Negative
+                | Profile::EnvironmentPressure
+        ) {
+            text.push_str("  lambdaDockerMemoryBytes: 402653184\n");
+        }
+        if profile == Profile::MemoryPressure {
+            text.push_str("  lambdaDockerMemoryBytes: 268435456\n");
+        }
+        if matches!(
+            profile,
+            Profile::EnvironmentPressure
+                | Profile::Sdk
+                | Profile::SdkWrongCredentials
+                | Profile::Performance
+        ) {
+            text = text.replace("lambdaDockerEnvironments: 2", "lambdaDockerEnvironments: 1");
+        }
+        if profile == Profile::Callback {
+            text.push_str(
+                "  lambdaDockerMemoryBytes: 805306368\n  workflowDispatches: 1\n  \
+                 workflowCallbackTokens: 2\n  workflowCallbackTombstones: 64\n  \
+                 workflowCallbackCommands: 8\n  workflowCallbackWorkers: 1\n",
+            );
+        }
+        if profile == Profile::Iac {
+            text.push_str("  lambdaDockerMemoryBytes: 1610612736\n  workflowDispatches: 2\n");
+        }
+        fs::write(&config, text).await?;
+        if profile == Profile::Pull {
+            let auth = root.path().join("registry.yaml");
+            fs::write(&auth, b"{}\n").await?;
+            fs::set_permissions(&auth, Permissions::from_mode(0o600)).await?;
+        }
+        if profile == Profile::Legacy {
+            let lease = DirectoryLease::acquire(root.path().join("data"), deadline()).await?;
+            drop(lease);
+            let file = root.path().join("data/.rustack-lambda-docker/owner.v1");
+            let mut bytes = fs::read(&file).await?;
+            bytes
+                .get_mut(..8)
+                .context("owner magic")?
+                .copy_from_slice(b"RSDKOWN1");
+            let digest = Sha256::digest(bytes.get(..24).context("owner payload")?);
+            bytes
+                .get_mut(24..)
+                .context("owner checksum")?
+                .copy_from_slice(&digest);
+            fs::write(&file, &bytes).await?;
+            fs::write(root.path().join("legacy.expected"), bytes).await?;
+        }
+        let sources = fixture_sources().await?;
+        fs::copy(env!("CARGO_BIN_EXE_rustack"), root.path().join("rustack")).await?;
+        let child = launch(root.path(), profile, port, socket_override).await?;
+        Ok(Self {
+            child,
+            root: Some(root),
+            endpoint: format!("http://127.0.0.1:{port}"),
+            profile,
+            sources,
+            socket_override: socket_override.map(Path::to_path_buf),
+            log_start: 0,
+        })
+    }
+    pub async fn track_image(&mut self, source: &str) -> Result<String> {
+        let reference: ImageReference = source.parse()?;
+        let mut wire = DockerWire::connect(socket()?.parse()?, deadline()).await?;
+        let result = wire.port().inspect_image(&reference, deadline()).await;
+        let stopped = wire.shutdown().await;
+        stopped?;
+        let id = result?.id.context("fixture source identity")?;
+        ensure!(
+            id.len() == 71
+                && id.starts_with("sha256:")
+                && id
+                    .get(7..)
+                    .is_some_and(|value| value.bytes().all(|byte| byte.is_ascii_hexdigit())),
+            "invalid source content identity"
+        );
+        self.sources.push((reference, id.clone()));
+        Ok(id)
+    }
+    pub async fn track_platform_image(
+        &mut self,
+        source: &str,
+        os: &str,
+        architecture: &str,
+    ) -> Result<String> {
+        let id = self.track_image(source).await?;
+        let reference: ImageReference = id.parse()?;
+        let mut wire = DockerWire::connect(socket()?.parse()?, deadline()).await?;
+        let observed = wire.port().inspect_image(&reference, deadline()).await;
+        let stopped = wire.shutdown().await;
+        stopped?;
+        let observed = observed?;
+        ensure!(
+            observed.id.as_ref() == Some(&id)
+                && observed.os.as_deref() == Some(os)
+                && observed.architecture.as_deref() == Some(architecture)
+                && observed.size.is_some_and(|size| size > 0),
+            "negative fixture platform/identity precondition differs"
+        );
+        Ok(id)
+    }
+    pub async fn observation_identity(&self) -> Result<(String, String)> {
+        let base = self.path()?.join("data/.rustack-lambda-docker");
+        let magic = if self.profile.zip() {
+            b"RSDKOWN3"
+        } else {
+            b"RSDKOWN2"
+        };
+        let owner = observation_record(base.join("owner.v1"), 56, magic).await?;
+        let id = uuid::Uuid::from_slice(owner.get(8..24).context("owner UUID")?)?;
+        ensure!(!id.is_nil(), "nil owner identity");
+        let daemon = observation_record(base.join("daemon.v1"), 72, b"RSDKDMD1").await?;
+        ensure!(
+            daemon.get(8..24) == Some(id.as_bytes().as_slice()),
+            "daemon record owner differs"
+        );
+        let engine = uuid::Uuid::from_slice(daemon.get(24..40).context("daemon UUID")?)?;
+        ensure!(!engine.is_nil(), "nil daemon identity");
+        Ok((id.to_string(), engine.to_string()))
+    }
+    pub fn path(&self) -> Result<&Path> {
+        Ok(self.root.as_ref().context("owned evidence root")?.path())
+    }
+    pub async fn ready(&mut self) -> Result<Value> {
+        let at = Instant::now() + Duration::from_secs(180);
+        loop {
+            ensure!(
+                self.child.try_wait()?.is_none(),
+                "ordinary binary exited before readiness"
+            );
+            if let Ok((status, value)) = get(&self.endpoint, "/_rustack/capabilities").await {
+                if value["ready"] == true {
+                    ensure!(
+                        status == 200 && value["workers"]["docker"]["ready"] == true,
+                        "false backend readiness"
+                    );
+                    ensure!(
+                        value["workers"]["docker"]["platform"]
+                            == format!("linux/{}", architecture()?),
+                        "wrong qualified platform"
+                    );
+                    ensure!(
+                        value["workers"]["docker"]["sdkGateway"] == self.profile.network(),
+                        "wrong endpoint capability"
+                    );
+                    ensure!(
+                        value["workers"]["docker"]["zip"] == self.profile.zip(),
+                        "false ZIP capability"
+                    );
+                    return Ok(value);
+                }
+            }
+            ensure!(Instant::now() < at, "ordinary startup observer expired");
+            sleep(Duration::from_millis(25)).await;
+        }
+    }
+    pub async fn failure(&mut self) -> Result<()> {
+        self.failure_with(None).await
+    }
+    pub async fn failure_with(&mut self, expected: Option<&str>) -> Result<()> {
+        let at = Instant::now() + Duration::from_secs(180);
+        loop {
+            if let Some(status) = self.child.try_wait()? {
+                ensure!(!status.success(), "negative startup exited successfully");
+                let mut file = fs::File::open(self.path()?.join("server.log")).await?;
+                file.seek(SeekFrom::Start(self.log_start)).await?;
+                let mut bytes = Vec::new();
+                file.take(32769).read_to_end(&mut bytes).await?;
+                ensure!(bytes.len() <= 32768, "negative startup log cap");
+                let text = std::str::from_utf8(&bytes)?;
+                ensure!(
+                    expected.map_or_else(
+                        || self.profile.matches_failure(text),
+                        |expected| text.contains(expected)
+                    ),
+                    "startup failed at an unrelated prerequisite: {text}"
+                );
+                return Ok(());
+            }
+            if let Ok((_, value)) = get(&self.endpoint, "/_rustack/capabilities").await {
+                ensure!(
+                    value["ready"] != true,
+                    "negative startup opened ordinary ingress"
+                );
+            }
+            ensure!(Instant::now() < at, "negative startup observer expired");
+            sleep(Duration::from_millis(25)).await;
+        }
+    }
+    pub async fn stop(&mut self, success: bool) -> Result<()> {
+        let status = self.stop_status().await?;
+        ensure!(
+            status.success() == success,
+            "unexpected ordinary server exit status"
+        );
+        Ok(())
+    }
+    pub async fn reap(&mut self) -> Result<()> {
+        self.stop_status().await?;
+        Ok(())
+    }
+    pub async fn stop_after_transport_loss(&mut self) -> Result<()> {
+        let status = self.stop_status().await?;
+        if !status.success() {
+            let file = fs::File::open(self.path()?.join("server.log")).await?;
+            let mut raw = Vec::new();
+            file.take(32769).read_to_end(&mut raw).await?;
+            ensure!(raw.len() <= 32768, "transport-loss diagnostic cap");
+            let text = String::from_utf8_lossy(&raw);
+            ensure!(
+                text.contains("Error: Docker not available")
+                    || text.contains("Lambda quiesce did not confirm all invocation cleanup"),
+                "unrelated shutdown error after transport loss"
+            );
+        }
+        Ok(())
+    }
+    async fn stop_status(&mut self) -> Result<ExitStatus> {
+        if self.child.try_wait()?.is_none() {
+            let id = self.child.id().context("owned server PID")?;
+            kill(Pid::from_raw(id.try_into()?), Signal::SIGTERM)?;
+        }
+        let result = timeout(Duration::from_secs(70), self.child.wait()).await;
+        let status = if let Ok(result) = result {
+            result?
+        } else {
+            self.child.start_kill()?;
+            timeout(Duration::from_secs(5), self.child.wait()).await??;
+            anyhow::bail!("forced server reap; graceful cleanup unproven");
+        };
+        Ok(status)
+    }
+    pub async fn crash(&mut self) -> Result<()> {
+        ensure!(
+            self.child.try_wait()?.is_none(),
+            "crash target already exited"
+        );
+        self.child.start_kill()?;
+        let status = timeout(Duration::from_secs(10), self.child.wait()).await??;
+        ensure!(
+            status.signal() == Some(Signal::SIGKILL as i32),
+            "crash did not join SIGKILL"
+        );
+        Ok(())
+    }
+    pub async fn restart(&mut self) -> Result<()> {
+        let port = self
+            .endpoint
+            .rsplit(':')
+            .next()
+            .context("owned endpoint port")?
+            .parse()?;
+        self.log_start = fs::metadata(self.path()?.join("server.log")).await?.len();
+        self.child = launch(
+            self.path()?,
+            self.profile,
+            port,
+            self.socket_override.as_deref(),
+        )
+        .await?;
+        Ok(())
+    }
+    pub async fn audit(&self) -> Result<()> {
+        ensure!(self.child.id().is_none(), "audit before child reap");
+        let path = self.path()?;
+        let lease = if self.profile.zip() {
+            DirectoryLease::acquire_code(path.join("data"), deadline()).await?
+        } else {
+            DirectoryLease::acquire(path.join("data"), deadline()).await?
+        };
+        let mut wire = DockerWire::connect(socket()?.parse()?, deadline()).await?;
+        let result = async {
+            if self.profile == Profile::Legacy {
+                ensure!(
+                    fs::read(path.join("data/.rustack-lambda-docker/owner.v1")).await?
+                        == fs::read(path.join("legacy.expected")).await?,
+                    "legacy identity was rewritten"
+                );
+                ensure!(
+                    !fs::try_exists(path.join("data/.rustack-lambda-docker/daemon.v1")).await?,
+                    "legacy startup reached daemon binding"
+                );
+            } else {
+                ensure!(
+                    fs::try_exists(path.join("data/.rustack-lambda-docker/daemon.v1")).await?,
+                    "fixture never reached production daemon binding"
+                );
+                let port = wire.port().bind_directory(&lease, deadline()).await?;
+                let recovery = reconcile_namespace(&lease, &port, deadline()).await?;
+                ensure!(
+                    recovery.containers.settled == 0
+                        && recovery.containers.remaining == 0
+                        && recovery.pins.settled == 0
+                        && recovery.pins.remaining == 0
+                        && recovery.code.settled == 0
+                        && recovery.code.remaining == 0,
+                    "ordinary shutdown required post-exit recovery"
+                );
+            }
+            for (reference, id) in &self.sources {
+                ensure!(
+                    wire.port()
+                        .inspect_image(reference, deadline())
+                        .await?
+                        .id
+                        .as_ref()
+                        == Some(id),
+                    "operator source changed"
+                );
+            }
+            Ok::<(), anyhow::Error>(())
+        }
+        .await;
+        let stopped = wire.shutdown().await;
+        result?;
+        stopped?;
+        Ok(())
+    }
+    pub async fn retain_on_error(&mut self) {
+        if let Ok(path) = self.path() {
+            if let Ok(file) = fs::File::open(path.join("server.log")).await {
+                let mut bytes = Vec::new();
+                let _ = file.take(32768).read_to_end(&mut bytes).await;
+                eprintln!(
+                    "ordinary server diagnostics: {}",
+                    String::from_utf8_lossy(&bytes)
+                );
+            }
+        }
+        if let Some(root) = self.root.take() {
+            eprintln!("retained startup evidence: {}", root.keep().display());
+        }
+    }
+}
+async fn fixture_sources() -> Result<Vec<(ImageReference, String)>> {
+    let mut wire = DockerWire::connect(socket()?.parse()?, deadline()).await?;
+    let result = async {
+        let mut sources = Vec::new();
+        for reference in [image()?, handler()?] {
+            let reference: ImageReference = reference.parse()?;
+            let id = wire
+                .port()
+                .inspect_image(&reference, deadline())
+                .await?
+                .id
+                .context("source image identity")?;
+            sources.push((reference, id));
+        }
+        Ok::<_, anyhow::Error>(sources)
+    }
+    .await;
+    let stopped = wire.shutdown().await;
+    stopped?;
+    result
+}
+async fn observation_record(path: PathBuf, length: usize, magic: &[u8; 8]) -> Result<Vec<u8>> {
+    ensure!((32..=72).contains(&length), "invalid fixture record cap");
+    let file = fs::File::open(path).await?;
+    let mut raw = Vec::new();
+    file.take(u64::try_from(length)? + 1)
+        .read_to_end(&mut raw)
+        .await?;
+    ensure!(
+        raw.len() == length && raw.get(..8) == Some(magic.as_slice()),
+        "unexpected runtime identity record"
+    );
+    let payload_end = length.checked_sub(32).context("identity checksum offset")?;
+    let payload = raw.get(..payload_end).context("identity payload")?;
+    ensure!(
+        raw.get(payload_end..) == Some(Sha256::digest(payload).as_slice()),
+        "identity record checksum"
+    );
+    Ok(raw)
+}
+fn configure_sdk(command: &mut Command, profile: Profile) {
+    if profile.sdk() {
+        let wrong = profile == Profile::SdkWrongCredentials;
+        command
+            .env("S3_SKIP_SIGNATURE_VALIDATION", "false")
+            .env("DYNAMODB_SKIP_SIGNATURE_VALIDATION", "false")
+            .env("LAMBDA_DOCKER_SDK_ACCESS_KEY_ID", "local-key")
+            .env(
+                "LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY",
+                if wrong {
+                    "sdk-wrong-secret"
+                } else {
+                    "local-secret"
+                },
+            )
+            .env("AWS_ACCESS_KEY_ID", "local-key")
+            .env("AWS_SECRET_ACCESS_KEY", "local-secret");
+    }
+}
+
+async fn launch(
+    root: &Path,
+    profile: Profile,
+    port: u16,
+    socket_override: Option<&Path>,
+) -> Result<Child> {
+    let log = fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(root.join("server.log"))
+        .await?
+        .into_std()
+        .await;
+    let mut command = Command::new(root.join("rustack"));
+    command
+        .env_clear()
+        .env("SERVICES", profile.services())
+        .env("GATEWAY_LISTEN", format!("0.0.0.0:{port}"))
+        .env("RUSTACK_CONFIG", root.join("config.yaml"))
+        .env("DATA_DIR", root.join("data"))
+        .env("LAMBDA_EXECUTOR", "docker")
+        .env(
+            "LAMBDA_DOCKER_SOCKET",
+            match socket_override {
+                Some(path) => format!("unix://{}", path.display()),
+                None => socket()?,
+            },
+        )
+        .env(
+            "LAMBDA_DOCKER_RELAY_IMAGE",
+            if profile == Profile::MissingRelay {
+                format!("missing-{}:never", uuid::Uuid::new_v4().simple())
+            } else {
+                image()?
+            },
+        )
+        .env(
+            "LAMBDA_DOCKER_CROSS_ARCHITECTURE",
+            if architecture()? == "amd64" {
+                "true"
+            } else {
+                "false"
+            },
+        )
+        .env("LAMBDA_INIT_TIMEOUT_SECS", profile.init_seconds())
+        .env("LAMBDA_SKIP_SIGNATURE_VALIDATION", "false")
+        .env("STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION", "false")
+        .env("ACCESS_KEY", "local-key")
+        .env("SECRET_KEY", "local-secret")
+        .stdin(Stdio::null())
+        .stdout(Stdio::from(log.try_clone()?))
+        .stderr(Stdio::from(log))
+        .kill_on_drop(true);
+    configure_sdk(&mut command, profile);
+    profile.configure_diagnostics(&mut command);
+    if profile.zip() {
+        command.env(
+            "LAMBDA_DOCKER_ZIP_IMAGE",
+            env::var("RUSTACK_ZIP_BASE_IMAGE")?,
+        );
+    }
+    if profile == Profile::Pull {
+        command
+            .env("LAMBDA_DOCKER_PULL_POLICY", "ifMissing")
+            .env("LAMBDA_DOCKER_REGISTRIES", "public.ecr.aws:443")
+            .env(
+                "LAMBDA_DOCKER_REGISTRY_AUTH_FILE",
+                fs::canonicalize(root.join("registry.yaml")).await?,
+            );
+    }
+    if profile.network() {
+        command.env(
+            "LAMBDA_DOCKER_NETWORK",
+            env::var("RUSTACK_RUNTIME_NETWORK")?,
+        );
+        let host = env::var("RUSTACK_RUNTIME_GATEWAY_HOST")?.parse::<std::net::IpAddr>()?;
+        let target = if profile == Profile::WrongEndpoint {
+            let closed = TcpListener::bind("0.0.0.0:0").await?;
+            closed.local_addr()?.port()
+        } else {
+            port
+        };
+        command.env(
+            "LAMBDA_DOCKER_GATEWAY_ENDPOINT",
+            format!("http://{}", std::net::SocketAddr::new(host, target)),
+        );
+    } else {
+        command.env("LAMBDA_DOCKER_NETWORK", "none");
+    }
+    if matches!(
+        profile,
+        Profile::Archive | Profile::ZipArchive | Profile::ZipArchiveNoSource | Profile::Callback
+    ) {
+        command
+            .arg("--snapshot")
+            .arg("images")
+            .env("RUSTACK_SNAPSHOT_DIR", root.join("snapshots"));
+    }
+    Ok(command.spawn()?)
+}
+pub(super) async fn get(endpoint: &str, path: &str) -> Result<(u16, Value)> {
+    timeout(Duration::from_secs(2), async {
+        let mut stream =
+            TcpStream::connect(endpoint.strip_prefix("http://").context("local endpoint")?).await?;
+        stream
+            .write_all(
+                format!("GET {path} HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
+                    .as_bytes(),
+            )
+            .await?;
+        let mut bytes = Vec::new();
+        stream.take(65537).read_to_end(&mut bytes).await?;
+        ensure!(bytes.len() <= 65536, "diagnostic response cap");
+        let text = std::str::from_utf8(&bytes)?;
+        let (head, body) = text.split_once("\r\n\r\n").context("HTTP framing")?;
+        let status = head
+            .split_whitespace()
+            .nth(1)
+            .context("HTTP status")?
+            .parse()?;
+        Ok((status, serde_json::from_str(body)?))
+    })
+    .await
+    .context("diagnostic observer expired")?
+}
diff --git a/apps/rustack/tests/docker_startup/provided.rs b/apps/rustack/tests/docker_startup/provided.rs
new file mode 100644
index 00000000..84029638
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/provided.rs
@@ -0,0 +1,142 @@
+//! Ordinary signed provided runtime operations; original ZIP files are shared with Native.
+
+use std::{env, ffi::OsString, path::PathBuf, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::storage::compute_sha256;
+use serde_json::{Value, json};
+use tokio::{
+    fs,
+    io::AsyncReadExt,
+    time::{Instant, timeout},
+};
+
+use super::{
+    faults::check_logs,
+    process::{self, Profile, Server},
+    runner::{Runner, interpreter},
+};
+
+pub(super) async fn exercise(phase: &str) -> Result<()> {
+    let mut server = Server::spawn(if matches!(phase, "initializing" | "busy") {
+        Profile::ZipControlled
+    } else {
+        Profile::Zip
+    })
+    .await?;
+    let result = timeout(Duration::from_secs(360), run(&mut server, phase))
+        .await
+        .context("ordinary provided runtime observer expired")
+        .and_then(|result| result);
+    let stopped = server.stop(true).await;
+    let audited = server.audit().await;
+    let logs = check_logs(&server).await;
+    if result.is_err() || stopped.is_err() || audited.is_err() || logs.is_err() {
+        server.retain_on_error().await;
+    }
+    result?;
+    stopped?;
+    audited?;
+    logs
+}
+
+async fn run(server: &mut Server, phase: &str) -> Result<()> {
+    server.ready().await?;
+    server
+        .track_image(&env::var("RUSTACK_ZIP_BASE_IMAGE")?)
+        .await?;
+    let (owner, engine) = server.observation_identity().await?;
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let arguments = [
+        root.join("tests/workflows/provided_zip_sdk.py")
+            .into_os_string(),
+        OsString::from(&server.endpoint),
+        env::var_os("RUSTACK_PROVIDED_ZIP_A").context("original provided ZIP A")?,
+        env::var_os("RUSTACK_PROVIDED_ZIP_B").context("original provided ZIP B")?,
+        OsString::from(if process::architecture()? == "arm64" {
+            "arm64"
+        } else {
+            "x86_64"
+        }),
+        OsString::from(phase),
+        env::var_os("RUSTACK_RUNTIME_GATEWAY_HOST").context("explicit hold collector host")?,
+        env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit actual metadata socket")?,
+        OsString::from(owner),
+        OsString::from(engine),
+    ];
+    let mut child = Runner::spawn(&interpreter()?, &arguments)?;
+    let entered = child.await_pid().await;
+    let report = child
+        .wait(if entered.is_ok() {
+            Instant::now() + Duration::from_secs(300)
+        } else {
+            Instant::now()
+        })
+        .await?;
+    let pid = entered?;
+    ensure!(
+        report.pid == pid && !report.forced && report.status.success(),
+        "ordinary provided SDK failed: {}",
+        String::from_utf8_lossy(&report.stderr)
+    );
+    let observed: Value = serde_json::from_slice(&report.stdout)?;
+    let expected = match phase {
+        "deployments" => json!([
+            "cold-warm-readonly",
+            "transactional-rejection",
+            "immutable-A-B-alias",
+            "ASL-Lambda-computation"
+        ]),
+        "faults" => json!([
+            "init-error",
+            "handler-exit",
+            "handler-timeout",
+            "FunctionError-recovery"
+        ]),
+        "initializing" | "busy" => json!([
+            format!("{phase}-causal-disconnect"),
+            "physical-retirement",
+            "cold-recovery"
+        ]),
+        _ => anyhow::bail!("unknown provided resource case"),
+    };
+    ensure!(
+        observed["schemaVersion"] == 1 && observed["cases"] == expected,
+        "ZIP semantic inventory differs"
+    );
+    verify_digests(&observed).await
+}
+
+pub(super) async fn verify_digests(observed: &Value) -> Result<()> {
+    let digests = observed["zipSha256"]
+        .as_array()
+        .context("ZIP identity report")?;
+    ensure!(
+        digests.len() == 2 && digests.first() != digests.get(1),
+        "ZIP revision identity differs"
+    );
+    for (index, key) in ["RUSTACK_PROVIDED_ZIP_A", "RUSTACK_PROVIDED_ZIP_B"]
+        .into_iter()
+        .enumerate()
+    {
+        let path = env::var(key)?;
+        let metadata = fs::symlink_metadata(&path).await?;
+        ensure!(
+            metadata.is_file() && metadata.len() <= 50 * 1024 * 1024,
+            "bounded original ZIP file"
+        );
+        let file = fs::File::open(path).await?;
+        let mut bytes = Vec::new();
+        file.take(50 * 1024 * 1024 + 1)
+            .read_to_end(&mut bytes)
+            .await?;
+        ensure!(bytes.len() <= 50 * 1024 * 1024, "original ZIP byte cap");
+        let hash = compute_sha256(&bytes);
+        ensure!(
+            digests.get(index).and_then(Value::as_str) == Some(hash.as_str()),
+            "SDK original ZIP digest changed"
+        );
+        eprintln!("provided original ZIP {index} digest: {hash}");
+    }
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/provided_archive.rs b/apps/rustack/tests/docker_startup/provided_archive.rs
new file mode 100644
index 00000000..46712b7f
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/provided_archive.rs
@@ -0,0 +1,211 @@
+//! Ordinary mixed archives; both server handles outlive every observer outcome.
+
+use std::{env, ffi::OsString, path::PathBuf, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use serde_json::Value;
+use tokio::{
+    fs,
+    time::{Instant, timeout},
+};
+
+use super::{
+    archive, copy_tree, fingerprint,
+    process::{self, Profile, Server},
+    provided::verify_digests,
+    runner::{Runner, interpreter},
+};
+
+fn guard(server: &mut Server, retained: bool) -> Result<()> {
+    server
+        .root
+        .as_mut()
+        .context("provided archive evidence guard")?
+        .disable_cleanup(retained);
+    Ok(())
+}
+pub(super) async fn exercise(no_source: bool) -> Result<()> {
+    let mut source = Server::spawn(Profile::ZipArchive).await?;
+    guard(&mut source, true)?;
+    eprintln!("provided archive evidence: {}", source.path()?.display());
+    let mut consumer = None;
+    let observed = timeout(
+        Duration::from_mins(12),
+        run(&mut source, &mut consumer, no_source),
+    )
+    .await
+    .context("provided archive observer expired")
+    .and_then(|result| result);
+    let source_stop = source.stop(no_source).await;
+    let source_audit = source.audit().await;
+    let consumer_cleanup = if let Some(server) = &mut consumer {
+        let stopped = server.stop(false).await;
+        let audit = server.audit().await;
+        stopped.and(audit)
+    } else {
+        Ok(())
+    };
+    if observed.is_err()
+        || source_stop.is_err()
+        || source_audit.is_err()
+        || consumer_cleanup.is_err()
+    {
+        source.retain_on_error().await;
+        if let Some(server) = &mut consumer {
+            server.retain_on_error().await;
+        }
+    }
+    observed?;
+    source_stop?;
+    source_audit?;
+    consumer_cleanup?;
+    guard(&mut source, false)?;
+    if let Some(server) = &mut consumer {
+        guard(server, false)?;
+    }
+    Ok(())
+}
+async fn run(source: &mut Server, consumer: &mut Option<Server>, no_source: bool) -> Result<()> {
+    source.ready().await?;
+    source
+        .track_image(&env::var("RUSTACK_ZIP_BASE_IMAGE")?)
+        .await?;
+    source.track_image(&process::handler()?).await?;
+    let saved = sdk(source, "prepare").await?;
+    let checkpoint = source.path()?.join("zip-checkpoint.json");
+    let bytes = serde_json::to_vec(&saved)?;
+    ensure!(bytes.len() <= 65536, "bounded archive checkpoint");
+    fs::write(&checkpoint, bytes).await?;
+    source.stop(true).await?;
+    source.audit().await?;
+    let snapshots = source.path()?.join("snapshots");
+    let current = snapshots.join("images");
+    if no_source {
+        *consumer = Some(Server::spawn(Profile::ZipArchiveNoSource).await?);
+        let target = consumer.as_mut().context("image-only archive consumer")?;
+        guard(target, true)?;
+        eprintln!(
+            "provided archive image-only evidence: {}",
+            target.path()?.display()
+        );
+        target.ready().await?;
+        ensure!(
+            process::get(&target.endpoint, "/_rustack/capabilities")
+                .await?
+                .1["workers"]["docker"]["zip"]
+                == false,
+            "negative archive source was installed"
+        );
+        target.stop(true).await?;
+        target.audit().await?;
+        let target_snapshots = target.path()?.join("snapshots");
+        let target_current = target_snapshots.join("images");
+        fs::rename(&target_current, target_snapshots.join(".baseline-empty")).await?;
+        copy_tree(&current, &target_current).await?;
+        copy_tree(&current, &target_snapshots.join(".images.previous")).await?;
+        let before = fingerprint(&target_snapshots).await?;
+        target.restart().await?;
+        target.failure().await?;
+        ensure!(
+            fingerprint(&target_snapshots).await? == before,
+            "unconfigured ZIP import changed complete archive generations"
+        );
+    } else {
+        let original = serde_json::to_value(archive::read(source.path()?).await?)?;
+        let previous = snapshots.join(".images.previous");
+        copy_tree(&current, &previous).await?;
+        source.restart().await?;
+        source.ready().await?;
+        ensure!(
+            !fs::try_exists(&previous).await?,
+            "successful ZIP import kept previous generation"
+        );
+        let checked = sdk(source, "verify").await?;
+        ensure!(
+            checked["checkpoint"] == saved["checkpoint"],
+            "SDK restored checkpoint changed"
+        );
+        source.stop(true).await?;
+        source.audit().await?;
+        ensure!(
+            serde_json::to_value(archive::read(source.path()?).await?)? == original,
+            "restored ZIP/Image metadata/resource/revision identity changed"
+        );
+        copy_tree(&current, &previous).await?;
+        archive::corrupt_zip(source.path()?).await?;
+        let before = fingerprint(&snapshots).await?;
+        source.restart().await?;
+        source.failure().await?;
+        ensure!(
+            fingerprint(&snapshots).await? == before,
+            "invalid ZIP import changed complete archive generations"
+        );
+    }
+    Ok(())
+}
+async fn sdk(server: &Server, phase: &str) -> Result<Value> {
+    let (owner, engine) = server.observation_identity().await?;
+    let repository = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let arguments = [
+        repository
+            .join("tests/workflows/provided_zip_archive_sdk.py")
+            .into_os_string(),
+        OsString::from(&server.endpoint),
+        env::var_os("RUSTACK_PROVIDED_ZIP_A").context("original archive ZIP A")?,
+        env::var_os("RUSTACK_PROVIDED_ZIP_B").context("original archive ZIP B")?,
+        OsString::from(if process::architecture()? == "arm64" {
+            "arm64"
+        } else {
+            "x86_64"
+        }),
+        OsString::from(process::handler()?),
+        OsString::from(phase),
+        server.path()?.join("zip-checkpoint.json").into_os_string(),
+        env::var_os("RUSTACK_RUNTIME_DOCKER_SOCKET").context("actual archive daemon socket")?,
+        OsString::from(owner),
+        OsString::from(engine),
+    ];
+    let mut child = Runner::spawn(&interpreter()?, &arguments)?;
+    let entered = child.await_pid().await;
+    let report = child
+        .wait(if entered.is_ok() {
+            Instant::now() + Duration::from_secs(300)
+        } else {
+            Instant::now()
+        })
+        .await?;
+    let pid = entered?;
+    ensure!(
+        report.pid == pid && !report.forced && report.status.success(),
+        "provided archive SDK failed: {}",
+        String::from_utf8_lossy(&report.stderr)
+    );
+    ensure!(
+        report.stdout.len() <= 65536,
+        "archive checkpoint output limit"
+    );
+    let observed: Value = serde_json::from_slice(&report.stdout)?;
+    let expected = if phase == "prepare" {
+        serde_json::json!([
+            "original-ZIP-revisions",
+            "mixed-Image",
+            "terminal-history-checkpoint"
+        ])
+    } else {
+        ensure!(phase == "verify", "unknown archive SDK phase");
+        serde_json::json!([
+            "original-ZIP-revisions",
+            "mixed-Image",
+            "terminal-history-no-replay",
+            "cold-warm-after-restart"
+        ])
+    };
+    ensure!(
+        observed["schemaVersion"] == 1
+            && observed["phase"] == phase
+            && observed["cases"] == expected,
+        "provided archive semantic inventory differs"
+    );
+    verify_digests(&observed).await?;
+    Ok(observed)
+}
diff --git a/apps/rustack/tests/docker_startup/recovery_gate.rs b/apps/rustack/tests/docker_startup/recovery_gate.rs
new file mode 100644
index 00000000..41a154ed
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/recovery_gate.rs
@@ -0,0 +1,157 @@
+//! Retained socket proxy with a causal startup barrier for one crashed owner.
+
+use std::{
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use tempfile::TempDir;
+use tokio::{
+    io::copy_bidirectional,
+    net::{UnixListener, UnixStream},
+    sync::watch,
+    task::{JoinHandle, JoinSet},
+    time::timeout,
+};
+
+#[derive(Debug)]
+pub(super) struct Gate {
+    directory: Option<TempDir>,
+    pub socket: PathBuf,
+    target: PathBuf,
+    held: watch::Sender<bool>,
+    entered: watch::Receiver<bool>,
+    stop: watch::Sender<bool>,
+    root: Option<JoinHandle<Result<()>>>,
+}
+impl Gate {
+    pub fn start(target: &Path) -> Result<Self> {
+        let mut directory = tempfile::tempdir()?;
+        directory.disable_cleanup(true);
+        let socket = directory.path().join("recovery.sock");
+        let listener = UnixListener::bind(&socket)?;
+        let (held, barrier) = watch::channel(false);
+        let (observed, entered) = watch::channel(false);
+        let (stop, shutdown) = watch::channel(false);
+        let target = target.to_owned();
+        let root = tokio::spawn(serve(listener, target.clone(), barrier, observed, shutdown));
+        Ok(Self {
+            directory: Some(directory),
+            socket,
+            target,
+            held,
+            entered,
+            stop,
+            root: Some(root),
+        })
+    }
+    pub fn arm(&mut self) {
+        self.held.send_replace(true);
+    }
+    pub async fn blocked(&mut self) -> Result<()> {
+        timeout(Duration::from_secs(20), async {
+            while !*self.entered.borrow() {
+                self.entered.changed().await?;
+            }
+            Ok::<_, anyhow::Error>(())
+        })
+        .await
+        .context("recovery did not reach held socket")??;
+        ensure!(*self.held.borrow(), "recovery barrier released early");
+        Ok(())
+    }
+    pub fn release(&self) {
+        self.held.send_replace(false);
+    }
+    pub async fn disconnect(&mut self) -> Result<()> {
+        self.release();
+        self.stop.send_replace(true);
+        if let Some(root) = &mut self.root {
+            timeout(Duration::from_secs(10), root)
+                .await
+                .context("proxy root retained")???;
+            self.root = None;
+        }
+        Ok(())
+    }
+    pub async fn resume(&mut self) -> Result<()> {
+        ensure!(self.root.is_none(), "proxy resumed before join");
+        tokio::fs::remove_file(&self.socket).await?;
+        let listener = UnixListener::bind(&self.socket)?;
+        let (held, barrier) = watch::channel(false);
+        let (observed, entered) = watch::channel(false);
+        let (stop, shutdown) = watch::channel(false);
+        self.held = held;
+        self.entered = entered;
+        self.stop = stop;
+        self.root = Some(tokio::spawn(serve(
+            listener,
+            self.target.clone(),
+            barrier,
+            observed,
+            shutdown,
+        )));
+        Ok(())
+    }
+    pub async fn close(&mut self) -> Result<()> {
+        self.disconnect().await?;
+        if let Some(mut directory) = self.directory.take() {
+            directory.disable_cleanup(false);
+        }
+        Ok(())
+    }
+}
+impl Drop for Gate {
+    fn drop(&mut self) {
+        self.held.send_replace(false);
+        self.stop.send_replace(true);
+        // The retained actor is intentionally detached on observer loss; its
+        // shutdown channel joins every connection. Evidence stays retained.
+        if let Some(root) = self.root.take() {
+            drop(root);
+        }
+    }
+}
+async fn serve(
+    listener: UnixListener,
+    target: PathBuf,
+    mut held: watch::Receiver<bool>,
+    entered: watch::Sender<bool>,
+    mut stop: watch::Receiver<bool>,
+) -> Result<()> {
+    let mut children = JoinSet::new();
+    loop {
+        tokio::select! {
+            biased;
+            _ = stop.changed() => break,
+            Some(result) = children.join_next() => { result.context("proxy connection panicked")?; },
+            accepted = listener.accept(), if children.len() < 16 => {
+                let (mut inbound, _) = accepted?;
+                if *held.borrow() {
+                    entered.send_replace(true);
+                    loop {
+                        if !*held.borrow() {break;}
+                        tokio::select! { _ = stop.changed() => break, _ = held.changed() => {} }
+                    }
+                    if *stop.borrow() {break;}
+                }
+                let target = target.clone();
+                let mut connection_stop = stop.clone();
+                children.spawn(async move {
+                    tokio::select! {
+                        _ = connection_stop.changed() => {},
+                        _ = timeout(Duration::from_secs(120), async {
+                            let mut outbound = UnixStream::connect(target).await?;
+                            copy_bidirectional(&mut inbound, &mut outbound).await
+                        }) => {},
+                    }
+                });
+            }
+        }
+    }
+    while let Some(result) = children.join_next().await {
+        result.context("proxy connection panicked")?;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/sdk.rs b/apps/rustack/tests/docker_startup/sdk.rs
new file mode 100644
index 00000000..dc033675
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/sdk.rs
@@ -0,0 +1,350 @@
+//! Signed ordinary SDK calls through the actual production startup consumer.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result, ensure};
+use aws_credential_types::Credentials;
+use aws_sdk_lambda::{
+    Client,
+    config::{BehaviorVersion, Region, retry::RetryConfig, timeout::TimeoutConfig},
+    primitives::Blob,
+    types::{Architecture, FunctionCode, ImageConfig, PackageType, Runtime, State},
+};
+use aws_sdk_sfn::{Client as States, error::ProvideErrorMetadata};
+use serde_json::{Value, json};
+use tokio::time::{Instant, sleep};
+use uuid::Uuid;
+
+fn timeouts() -> TimeoutConfig {
+    TimeoutConfig::builder()
+        .connect_timeout(Duration::from_secs(2))
+        .read_timeout(Duration::from_secs(60))
+        .operation_timeout(Duration::from_secs(60))
+        .build()
+}
+fn credentials() -> Credentials {
+    Credentials::new("local-key", "local-secret", None, None, "docker-fixture")
+}
+fn lambda(endpoint: &str) -> Client {
+    Client::from_conf(
+        aws_sdk_lambda::Config::builder()
+            .behavior_version(BehaviorVersion::latest())
+            .region(Region::new("us-east-1"))
+            .endpoint_url(endpoint)
+            .credentials_provider(credentials())
+            .retry_config(RetryConfig::disabled())
+            .timeout_config(timeouts())
+            .build(),
+    )
+}
+async fn active(client: &Client, name: &str, expected: &str) -> Result<()> {
+    let at = Instant::now() + Duration::from_secs(120);
+    loop {
+        let config = client
+            .get_function_configuration()
+            .function_name(name)
+            .send()
+            .await?;
+        ensure!(Instant::now() < at, "deployment observer expired");
+        let state = config.state().map(State::as_str);
+        if state == Some(expected) {
+            return Ok(());
+        }
+        ensure!(
+            state != Some("Failed"),
+            "deployment did not reach expected state"
+        );
+        sleep(Duration::from_millis(25)).await;
+    }
+}
+async fn invoke(client: &Client, name: &str, event: Value) -> Result<(Value, Option<String>)> {
+    let result = client
+        .invoke()
+        .function_name(name)
+        .payload(Blob::new(serde_json::to_vec(&event)?))
+        .send()
+        .await?;
+    ensure!(result.status_code() == 200, "Invoke status");
+    let value = serde_json::from_slice(result.payload().context("Invoke payload")?.as_ref())?;
+    Ok((value, result.function_error().map(str::to_owned)))
+}
+pub(super) async fn exercise(
+    endpoint: &str,
+    image: &str,
+    architecture: &str,
+    workflow: bool,
+    preserve: bool,
+) -> Result<()> {
+    let client = lambda(endpoint);
+    let name = format!("DockerStartup{}", Uuid::new_v4().simple());
+    let selected = if architecture == "arm64" {
+        Architecture::Arm64
+    } else {
+        Architecture::X8664
+    };
+    let created = client
+        .create_function()
+        .function_name(&name)
+        .role("arn:aws:iam::000000000000:role/Docker")
+        .package_type(PackageType::Image)
+        .architectures(selected.clone())
+        .memory_size(128)
+        .timeout(30)
+        .code(FunctionCode::builder().image_uri(image).build())
+        .send()
+        .await?;
+    let arn = created.function_arn().context("Image ARN")?.to_owned();
+    active(&client, &name, "Active").await?;
+    for (value, counter) in [(35, 1), (0, 2)] {
+        let (output, error) = invoke(&client, &name, json!({"value":value})).await?;
+        ensure!(
+            error.is_none()
+                && output["computed"] == value + 7
+                && output["counter"] == counter
+                && output["uid"] == 1000,
+            "real computed/warm/user evidence differs"
+        );
+        ensure!(
+            output["requestId"]
+                .as_str()
+                .is_some_and(|value| !value.is_empty()),
+            "missing RIC request identity"
+        );
+    }
+    let version = client.publish_version().function_name(&name).send().await?;
+    let version = version.version().context("published version")?;
+    client
+        .create_alias()
+        .function_name(&name)
+        .name("live")
+        .function_version(version)
+        .send()
+        .await?;
+    let alias = client
+        .invoke()
+        .function_name(&name)
+        .qualifier("live")
+        .payload(Blob::new(br#"{"value":1}"#.as_slice()))
+        .send()
+        .await?;
+    ensure!(
+        alias.executed_version() == Some(version) && alias.function_error().is_none(),
+        "published alias did not execute captured image"
+    );
+    let (_, failure) = invoke(&client, &name, json!({"fail":true,"value":1})).await?;
+    ensure!(
+        failure.as_deref() == Some("Unhandled"),
+        "FunctionError was not distinct from HTTP success"
+    );
+    let (wrong_name, stalled) = failure_cases(&client, image, selected, &name).await?;
+    if workflow {
+        workflow_image(endpoint, &arn).await?;
+    }
+    if !preserve {
+        client
+            .delete_function()
+            .function_name(&stalled)
+            .send()
+            .await?;
+        client
+            .delete_function()
+            .function_name(&wrong_name)
+            .send()
+            .await?;
+        client.delete_function().function_name(&name).send().await?;
+    }
+    Ok(())
+}
+async fn failure_cases(
+    client: &Client,
+    image: &str,
+    selected: Architecture,
+    name: &str,
+) -> Result<(String, String)> {
+    let zip = client
+        .create_function()
+        .function_name(format!("{name}Zip"))
+        .role("arn:aws:iam::000000000000:role/Docker")
+        .runtime(Runtime::Providedal2023)
+        .handler("bootstrap")
+        .code(
+            FunctionCode::builder()
+                .zip_file(Blob::new(b"unextracted".as_slice()))
+                .build(),
+        )
+        .send()
+        .await
+        .expect_err("Docker ZIP must reject before extraction");
+    ensure!(
+        zip.as_service_error().and_then(|error| error.code())
+            == Some("InvalidParameterValueException"),
+        "wrong Docker ZIP error"
+    );
+    let wrong_name = format!("{name}OtherArch");
+    client
+        .create_function()
+        .function_name(&wrong_name)
+        .role("arn:aws:iam::000000000000:role/Docker")
+        .package_type(PackageType::Image)
+        .architectures(if selected == Architecture::Arm64 {
+            Architecture::X8664
+        } else {
+            Architecture::Arm64
+        })
+        .code(FunctionCode::builder().image_uri(image).build())
+        .send()
+        .await?;
+    active(client, &wrong_name, "Failed").await?;
+    let stalled = format!("{name}NoRic");
+    client
+        .create_function()
+        .function_name(&stalled)
+        .role("arn:aws:iam::000000000000:role/Docker")
+        .package_type(PackageType::Image)
+        .architectures(selected)
+        .code(FunctionCode::builder().image_uri(image).build())
+        .image_config(
+            ImageConfig::builder()
+                .entry_point("/var/lang/bin/python3")
+                .entry_point("-c")
+                .entry_point("import time;time.sleep(60)")
+                .set_command(Some(Vec::new()))
+                .build(),
+        )
+        .send()
+        .await?;
+    active(client, &stalled, "Active").await?;
+    let started = Instant::now();
+    let result = client
+        .invoke()
+        .function_name(&stalled)
+        .payload(Blob::new(b"{}".as_slice()))
+        .send()
+        .await;
+    let error = result.expect_err("missing RIC must fail invocation");
+    ensure!(
+        started.elapsed() < Duration::from_secs(45)
+            && error
+                .as_service_error()
+                .and_then(|error| error.message())
+                .is_some_and(|message| message.contains("bootstrap initialization deadline")),
+        "independent bootstrap timeout was ignored or misclassified"
+    );
+    Ok((wrong_name, stalled))
+}
+async fn workflow_image(endpoint: &str, function: &str) -> Result<()> {
+    let client = States::from_conf(
+        aws_sdk_sfn::Config::builder()
+            .behavior_version(BehaviorVersion::latest())
+            .region(Region::new("us-east-1"))
+            .endpoint_url(endpoint)
+            .credentials_provider(credentials())
+            .retry_config(RetryConfig::disabled())
+            .timeout_config(timeouts())
+            .build(),
+    );
+    let machine=client.create_state_machine().name(format!("DockerWorkflow{}",Uuid::new_v4().simple())).role_arn("arn:aws:iam::000000000000:role/Docker")
+        .definition(json!({"StartAt":"Compute","States":{"Compute":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":function,"Payload.$":"$"},"OutputPath":"$.Payload","End":true}}}).to_string()).send().await?;
+    let machine = machine.state_machine_arn().to_owned();
+    let execution = client
+        .start_execution()
+        .state_machine_arn(&machine)
+        .input(r#"{"value":35}"#)
+        .send()
+        .await?;
+    let execution = execution.execution_arn();
+    let at = Instant::now() + Duration::from_secs(120);
+    loop {
+        let result = client
+            .describe_execution()
+            .execution_arn(execution)
+            .send()
+            .await?;
+        if result.status().as_str() != "RUNNING" {
+            ensure!(
+                result.status().as_str() == "SUCCEEDED",
+                "image workflow failed: {:?}",
+                result.error()
+            );
+            let output: Value = serde_json::from_str(result.output().context("workflow output")?)?;
+            ensure!(
+                output["computed"] == 42,
+                "ASL did not compute through actual image"
+            );
+            break;
+        }
+        ensure!(Instant::now() < at, "image workflow observer expired");
+        sleep(Duration::from_millis(25)).await;
+    }
+    client
+        .delete_state_machine()
+        .state_machine_arn(machine)
+        .send()
+        .await?;
+    Ok(())
+}
+
+#[derive(Debug, Clone, Copy)]
+enum ComputeFixture {
+    CustomRic,
+    OfficialNode,
+}
+
+pub(super) async fn custom_compute(endpoint: &str, image: &str, architecture: &str) -> Result<()> {
+    compute_image(endpoint, image, architecture, ComputeFixture::CustomRic).await
+}
+
+pub(super) async fn node_compute(endpoint: &str, image: &str, architecture: &str) -> Result<()> {
+    compute_image(endpoint, image, architecture, ComputeFixture::OfficialNode).await
+}
+
+async fn compute_image(
+    endpoint: &str,
+    image: &str,
+    architecture: &str,
+    fixture: ComputeFixture,
+) -> Result<()> {
+    let client = lambda(endpoint);
+    let name = format!("RustImage{}", Uuid::new_v4().simple());
+    let (memory, value) = match fixture {
+        ComputeFixture::CustomRic => (128, 35),
+        ComputeFixture::OfficialNode => (256, 21),
+    };
+    client
+        .create_function()
+        .function_name(&name)
+        .role("arn:aws:iam::000000000000:role/Docker")
+        .package_type(PackageType::Image)
+        .architectures(if architecture == "arm64" {
+            Architecture::Arm64
+        } else {
+            Architecture::X8664
+        })
+        .memory_size(memory)
+        .timeout(30)
+        .code(FunctionCode::builder().image_uri(image).build())
+        .send()
+        .await?;
+    active(&client, &name, "Active").await?;
+    let (output, error) = invoke(&client, &name, json!({"value":value})).await?;
+    let identity_matches = match fixture {
+        ComputeFixture::CustomRic => output["imageRevision"] == "A",
+        ComputeFixture::OfficialNode => {
+            output["runtime"] == "node24" && output["handler"] == "handler"
+        }
+    };
+    ensure!(
+        error.is_none() && output["computed"] == 42 && output["counter"] == 1 && identity_matches,
+        "Rust SDK image did not compute with the expected runtime"
+    );
+    client.delete_function().function_name(&name).send().await?;
+    Ok(())
+}
+
+#[path = "sdk/archive.rs"]
+mod archive;
+pub(super) use archive::{checkpoint as archive_checkpoint, verify as verify_archive};
+
+#[path = "sdk/recovery.rs"]
+mod recovery;
+pub(super) use recovery::{Witness, containers as owned_containers};
diff --git a/apps/rustack/tests/docker_startup/sdk/archive.rs b/apps/rustack/tests/docker_startup/sdk/archive.rs
new file mode 100644
index 00000000..00bf28a2
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/sdk/archive.rs
@@ -0,0 +1,186 @@
+//! Actual restored definitions, immutable aliases, cold computation and old history.
+
+use super::*;
+
+#[derive(Debug)]
+pub(crate) struct ArchiveCheckpoint {
+    function: String,
+    hash: String,
+    revision: String,
+    old_request: String,
+    machine: String,
+    execution: String,
+    history: String,
+    output: String,
+}
+fn states(endpoint: &str) -> States {
+    States::from_conf(
+        aws_sdk_sfn::Config::builder()
+            .behavior_version(BehaviorVersion::latest())
+            .region(Region::new("us-east-1"))
+            .endpoint_url(endpoint)
+            .credentials_provider(credentials())
+            .retry_config(RetryConfig::disabled())
+            .timeout_config(timeouts())
+            .build(),
+    )
+}
+async fn terminal(client: &States, execution: &str) -> Result<String> {
+    let at = Instant::now() + Duration::from_secs(120);
+    loop {
+        let result = client
+            .describe_execution()
+            .execution_arn(execution)
+            .send()
+            .await?;
+        if result.status().as_str() != "RUNNING" {
+            ensure!(
+                result.status().as_str() == "SUCCEEDED",
+                "saved image workflow failed"
+            );
+            let output = result.output().context("image workflow output")?.to_owned();
+            let body: Value = serde_json::from_str(&output)?;
+            ensure!(
+                body["computed"] == 49,
+                "restored image task did not compute"
+            );
+            return Ok(output);
+        }
+        ensure!(
+            Instant::now() < at,
+            "image archive workflow observer expired"
+        );
+        sleep(Duration::from_millis(25)).await;
+    }
+}
+async fn history(client: &States, execution: &str) -> Result<String> {
+    let result = client
+        .get_execution_history()
+        .execution_arn(execution)
+        .send()
+        .await?;
+    ensure!(
+        (5..=32).contains(&result.events().len()) && result.next_token().is_none(),
+        "image archive history bounds"
+    );
+    let value = format!("{:?}", result.events());
+    ensure!(value.len() <= 65_536, "image archive history byte cap");
+    Ok(value)
+}
+pub(crate) async fn checkpoint(endpoint: &str) -> Result<ArchiveCheckpoint> {
+    let client = lambda(endpoint);
+    let listed = client.list_functions().send().await?;
+    ensure!(
+        listed.functions().len() <= 8 && listed.next_marker().is_none(),
+        "archive fixture function bounds"
+    );
+    let function = listed
+        .functions()
+        .iter()
+        .filter_map(|function| function.function_name())
+        .find(|name| {
+            name.starts_with("DockerStartup")
+                && !name.ends_with("OtherArch")
+                && !name.ends_with("NoRic")
+        })
+        .context("actual primary saved image")?
+        .to_owned();
+    let config = client
+        .get_function_configuration()
+        .function_name(&function)
+        .send()
+        .await?;
+    let hash = config.code_sha256().context("saved image hash")?.to_owned();
+    let revision = config.revision_id().context("saved revision")?.to_owned();
+    let arn = config.function_arn().context("saved function ARN")?;
+    let workflows = states(endpoint);
+    let machine = workflows.create_state_machine().name(format!("ArchiveImage{}", Uuid::new_v4().simple()))
+        .role_arn("arn:aws:iam::000000000000:role/Docker")
+        .definition(json!({"StartAt":"Compute","States":{"Compute":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":format!("{arn}:live"),"Payload":{"value":42}},"OutputPath":"$.Payload","End":true}}}).to_string())
+        .send().await?.state_machine_arn().to_owned();
+    let execution = workflows
+        .start_execution()
+        .state_machine_arn(&machine)
+        .send()
+        .await?
+        .execution_arn()
+        .to_owned();
+    let output = terminal(&workflows, &execution).await?;
+    let history = history(&workflows, &execution).await?;
+    let (actual, error) = invoke(&client, &function, json!({"value":3})).await?;
+    ensure!(
+        error.is_none() && actual["computed"] == 10,
+        "pre-save computation"
+    );
+    let old_request = actual["requestId"]
+        .as_str()
+        .context("pre-save request")?
+        .to_owned();
+    Ok(ArchiveCheckpoint {
+        function,
+        hash,
+        revision,
+        old_request,
+        machine,
+        execution,
+        history,
+        output,
+    })
+}
+pub(crate) async fn verify(endpoint: &str, saved: &ArchiveCheckpoint) -> Result<()> {
+    let client = lambda(endpoint);
+    let config = client
+        .get_function_configuration()
+        .function_name(&saved.function)
+        .send()
+        .await?;
+    ensure!(
+        config.code_sha256() == Some(saved.hash.as_str())
+            && config.revision_id() == Some(saved.revision.as_str()),
+        "restored image identity/configuration changed"
+    );
+    let workflows = states(endpoint);
+    ensure!(
+        history(&workflows, &saved.execution).await? == saved.history,
+        "restored history changed or replayed"
+    );
+    ensure!(
+        terminal(&workflows, &saved.execution).await? == saved.output,
+        "saved terminal output changed"
+    );
+    let (latest, error) = invoke(&client, &saved.function, json!({"value":100})).await?;
+    ensure!(
+        error.is_none()
+            && latest["computed"] == 107
+            && latest["counter"] == 1
+            && latest["requestId"].as_str() != Some(saved.old_request.as_str()),
+        "restored latest did not execute cold without replay"
+    );
+    let alias = client
+        .invoke()
+        .function_name(&saved.function)
+        .qualifier("live")
+        .payload(Blob::new(br#"{"value":50}"#.as_slice()))
+        .send()
+        .await?;
+    let value: Value =
+        serde_json::from_slice(alias.payload().context("restored alias payload")?.as_ref())?;
+    ensure!(
+        alias.function_error().is_none()
+            && alias.executed_version() == Some("1")
+            && value["computed"] == 57
+            && value["counter"] == 1,
+        "restored immutable alias failed cold computation"
+    );
+    let next = workflows
+        .start_execution()
+        .state_machine_arn(&saved.machine)
+        .send()
+        .await?;
+    terminal(&workflows, next.execution_arn()).await?;
+    ensure!(
+        history(&workflows, &saved.execution).await? == saved.history,
+        "new work rewrote restored history"
+    );
+    Ok(())
+}
diff --git a/apps/rustack/tests/docker_startup/sdk/recovery.rs b/apps/rustack/tests/docker_startup/sdk/recovery.rs
new file mode 100644
index 00000000..2aa5a2ec
--- /dev/null
+++ b/apps/rustack/tests/docker_startup/sdk/recovery.rs
@@ -0,0 +1,101 @@
+//! Actual warm service witness across another installation's crash recovery.
+
+use std::collections::BTreeSet;
+
+use rustack_lambda_core::docker::{DockerWire, OwnerFilter};
+
+use super::*;
+use crate::process::{self, Server};
+
+#[derive(Debug)]
+pub(crate) struct Witness {
+    client: Client,
+    name: String,
+    counter: u64,
+}
+impl Witness {
+    pub(crate) async fn start(server: &Server) -> Result<Self> {
+        Self::start_image(server, &process::handler()?).await
+    }
+    pub(crate) async fn start_image(server: &Server, image: &str) -> Result<Self> {
+        let client = lambda(&server.endpoint);
+        let name = format!("Survivor{}", Uuid::new_v4().simple());
+        client
+            .create_function()
+            .function_name(&name)
+            .role("arn:aws:iam::000000000000:role/Docker")
+            .package_type(PackageType::Image)
+            .architectures(if process::architecture()? == "arm64" {
+                Architecture::Arm64
+            } else {
+                Architecture::X8664
+            })
+            .memory_size(128)
+            .timeout(30)
+            .code(FunctionCode::builder().image_uri(image).build())
+            .send()
+            .await?;
+        active(&client, &name, "Active").await?;
+        let mut witness = Self {
+            client,
+            name,
+            counter: 0,
+        };
+        witness.advance().await?;
+        Ok(witness)
+    }
+    pub(crate) async fn missing(&self) -> Result<()> {
+        let error = self
+            .client
+            .get_function_configuration()
+            .function_name(&self.name)
+            .send()
+            .await
+            .err()
+            .context("unsaved function survived failed shutdown")?;
+        ensure!(
+            error
+                .as_service_error()
+                .and_then(ProvideErrorMetadata::code)
+                == Some("ResourceNotFoundException"),
+            "wrong rejected unsaved function error"
+        );
+        Ok(())
+    }
+    pub(crate) async fn cold_revision(&mut self, expected: &str) -> Result<()> {
+        let (value, error) = invoke(&self.client, &self.name, json!({"value":35})).await?;
+        ensure!(
+            error.is_none()
+                && value["computed"] == 42
+                && value["counter"] == 1
+                && value["imageRevision"] == expected,
+            "restore substituted the changed tag"
+        );
+        self.counter = 1;
+        Ok(())
+    }
+    pub(crate) async fn advance(&mut self) -> Result<()> {
+        let (value, error) = invoke(&self.client, &self.name, json!({"value":35})).await?;
+        self.counter = self.counter.checked_add(1).context("witness counter")?;
+        ensure!(
+            error.is_none() && value["computed"] == 42 && value["counter"] == self.counter,
+            "surviving installation lost its warm environment"
+        );
+        Ok(())
+    }
+}
+pub(crate) async fn containers(server: &Server) -> Result<BTreeSet<String>> {
+    let (owner, _) = server.observation_identity().await?;
+    let deadline = Instant::now() + Duration::from_secs(10);
+    let mut wire = DockerWire::connect(process::socket()?.parse()?, deadline).await?;
+    let result = wire
+        .port()
+        .list_containers(OwnerFilter::new(owner.parse()?, None, None)?, deadline)
+        .await;
+    let stopped = wire.shutdown().await;
+    stopped?;
+    result?
+        .into_iter()
+        .map(|row| row.id.context("observed full container ID"))
+        .collect()
+}
diff --git a/apps/rustack/tests/localstack_compat.rs b/apps/rustack/tests/localstack_compat.rs
new file mode 100644
index 00000000..a2502063
--- /dev/null
+++ b/apps/rustack/tests/localstack_compat.rs
@@ -0,0 +1,471 @@
+//! Original external pytest cases against a directly owned actual Rustack process.
+#![cfg(all(unix, feature = "lambda", feature = "stepfunctions"))]
+#![forbid(unsafe_code)]
+
+#[path = "workflows_sdk/runner.rs"]
+mod runner;
+
+use std::{
+    env,
+    ffi::OsString,
+    fmt::Write as FmtWrite,
+    fs::Permissions,
+    os::unix::fs::PermissionsExt,
+    path::{Path, PathBuf},
+    process::{ExitStatus, Stdio},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, bail, ensure};
+use nix::{
+    sys::signal::{Signal, kill},
+    unistd::Pid,
+};
+use runner::{Runner, interpreter};
+use rustack_lambda_core::docker::{DirectoryLease, DockerWire, reconcile_namespace};
+use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
+use tokio::{
+    fs,
+    io::{AsyncRead, AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+    process::{Child, Command},
+    task::JoinHandle,
+    time::{Instant, sleep, timeout, timeout_at},
+};
+use uuid::Uuid;
+
+#[derive(Debug)]
+struct Server {
+    child: Child,
+    output: Vec<JoinHandle<Result<Vec<u8>>>>,
+    endpoint: String,
+    root: PathBuf,
+    docker: bool,
+}
+
+impl Server {
+    async fn spawn(root: &Path, docker: bool) -> Result<Self> {
+        let reservation = TcpListener::bind("127.0.0.1:0").await?;
+        let address = reservation.local_addr()?;
+        drop(reservation);
+        let config = root.join("config.yaml");
+        let access = format!("compat-{}", Uuid::new_v4().simple());
+        let secret = Uuid::new_v4().simple().to_string();
+        let auth = root.join("auth.json");
+        save(
+            &auth,
+            &serde_json::to_vec(&json!({"accessKey":access, "secretKey":secret}))?,
+        )
+        .await?;
+        save(
+            &config,
+            b"budgets:\n  startupSeconds: 180\n  shutdownSeconds: 60\n  workflowDrainSeconds: 0\n  \
+             workflowTransitions: 100000\n  workflowHistoryBytes: 33554432\n  \
+             workflowTotalHistoryBytes: 268435456\n  lambdaDockerIoSeconds: 60\n  \
+             lambdaDockerStartSeconds: 60\n  lambdaDockerCleanupSeconds: 60\n  \
+             lambdaDockerEnvironments: 2\n",
+        )
+        .await?;
+        let mut command = Command::new(env!("CARGO_BIN_EXE_rustack"));
+        command
+            .env_clear()
+            .env("GATEWAY_LISTEN", address.to_string())
+            .env(
+                "SERVICES",
+                if docker {
+                    "stepfunctions,lambda"
+                } else {
+                    "stepfunctions"
+                },
+            )
+            .env("RUSTACK_CONFIG", &config)
+            .env("DATA_DIR", root.join("data"))
+            .env(
+                "LAMBDA_EXECUTOR",
+                if docker { "docker" } else { "disabled" },
+            )
+            .env("STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION", "false")
+            .env("LAMBDA_SKIP_SIGNATURE_VALIDATION", "false")
+            .env("ACCESS_KEY", access)
+            .env("SECRET_KEY", secret)
+            .env("LOG_LEVEL", "error")
+            .env("NO_COLOR", "1")
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .kill_on_drop(true);
+        if docker {
+            command
+                .env(
+                    "LAMBDA_DOCKER_SOCKET",
+                    format!("unix://{}", env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")?),
+                )
+                .env(
+                    "LAMBDA_DOCKER_RELAY_IMAGE",
+                    env::var("RUSTACK_RUNTIME_IMAGE")?,
+                )
+                .env("LAMBDA_DOCKER_NETWORK", "none")
+                .env("LAMBDA_DOCKER_CROSS_ARCHITECTURE", "false")
+                .env("LAMBDA_INIT_TIMEOUT_SECS", "20");
+        }
+        let child = command
+            .spawn()
+            .context("start actual compatibility server")?;
+        let mut owned = Self {
+            child,
+            output: Vec::new(),
+            endpoint: format!("http://{address}"),
+            root: root.to_owned(),
+            docker,
+        };
+        if let Some(stream) = owned.child.stdout.take() {
+            owned.output.push(tokio::spawn(capture(stream)));
+        }
+        if let Some(stream) = owned.child.stderr.take() {
+            owned.output.push(tokio::spawn(capture(stream)));
+        }
+        Ok(owned)
+    }
+
+    async fn ready(&mut self) -> Result<()> {
+        let deadline = Instant::now() + Duration::from_secs(180);
+        while Instant::now() < deadline {
+            ensure!(
+                self.child.try_wait()?.is_none(),
+                "compatibility server exited during startup"
+            );
+            if health(&self.endpoint).await.is_ok() {
+                return Ok(());
+            }
+            sleep(Duration::from_millis(50)).await;
+        }
+        bail!("compatibility readiness deadline")
+    }
+
+    async fn stop(&mut self) -> Result<()> {
+        let deadline = Instant::now() + Duration::from_secs(90);
+        let status = self.retire(deadline).await;
+        let mut logs = Vec::new();
+        let mut errors = Vec::new();
+        for handle in self.output.drain(..) {
+            match join_capture(handle, deadline).await {
+                Ok(bytes) => logs.extend(bytes),
+                Err(error) => errors.push(error.to_string()),
+            }
+        }
+        let saved = save(&self.root.join("server.log"), &logs).await;
+        let server_joined = self.child.id().is_none();
+        let audit = if self.docker && server_joined {
+            self.audit().await
+        } else {
+            Ok(())
+        };
+        let original_bytes = timeout(
+            Duration::from_secs(5),
+            fs::read(self.root.join("server-intent.json")),
+        )
+        .await
+        .context("server intent read timeout")??;
+        let original: Value = serde_json::from_slice(&original_bytes)?;
+        let expected = original
+            .get("sha256")
+            .and_then(Value::as_str)
+            .context("server intent fingerprint")?;
+        let same_binary = binary_hash().await? == expected;
+        let cleanup = json!({"serverJoined":server_joined, "captureTasksJoined":true,
+            "ownedResourcesAbsent":server_joined && audit.is_ok(), "serverBinaryUnchanged":same_binary,
+            "dockerAuditPerformed":self.docker && server_joined,
+            "exitSuccess":status.as_ref().is_ok_and(ExitStatus::success),
+            "serverIntentSha256":hexadecimal(&Sha256::digest(&original_bytes))?});
+        save(
+            &self.root.join("server-cleanup.json"),
+            &serde_json::to_vec(&cleanup)?,
+        )
+        .await?;
+        let status = status?;
+        audit?;
+        saved?;
+        ensure!(
+            same_binary,
+            "compatibility server binary changed during execution"
+        );
+        ensure!(
+            errors.is_empty(),
+            "compatibility capture failure: {errors:?}"
+        );
+        ensure!(status.success(), "compatibility server exit: {status}");
+        Ok(())
+    }
+
+    async fn retire(&mut self, deadline: Instant) -> Result<ExitStatus> {
+        if let Some(status) = self.child.try_wait()? {
+            return Ok(status);
+        }
+        let pid = i32::try_from(self.child.id().context("owned compatibility server PID")?)?;
+        let signalled = kill(Pid::from_raw(pid), Signal::SIGTERM);
+        let status = if let Ok(status) =
+            timeout_at(deadline - Duration::from_secs(10), self.child.wait()).await
+        {
+            status?
+        } else {
+            let killed = self.child.start_kill();
+            let status = timeout_at(deadline, self.child.wait())
+                .await
+                .context("forced server reap")??;
+            killed?;
+            status
+        };
+        signalled.context("stop exact compatibility server")?;
+        Ok(status)
+    }
+
+    async fn audit(&self) -> Result<()> {
+        let deadline = Instant::now() + Duration::from_secs(60);
+        let lease = DirectoryLease::acquire(self.root.join("data"), deadline).await?;
+        let socket = format!("unix://{}", env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")?);
+        let mut wire = DockerWire::connect(socket.parse()?, deadline).await?;
+        let checked = async {
+            let port = wire.port().bind_directory(&lease, deadline).await?;
+            let report = reconcile_namespace(&lease, &port, deadline).await?;
+            ensure!(
+                report.containers.settled == 0
+                    && report.containers.remaining == 0
+                    && report.pins.settled == 0
+                    && report.pins.remaining == 0
+                    && report.code.settled == 0
+                    && report.code.remaining == 0,
+                "compatibility shutdown left owned Docker resources"
+            );
+            Ok::<(), anyhow::Error>(())
+        }
+        .await;
+        let stopped = wire.shutdown().await;
+        checked?;
+        stopped?;
+        Ok(())
+    }
+}
+
+async fn capture<R: AsyncRead + Unpin>(source: R) -> Result<Vec<u8>> {
+    let mut bytes = Vec::new();
+    source.take(1_048_577).read_to_end(&mut bytes).await?;
+    ensure!(
+        bytes.len() <= 1_048_576,
+        "compatibility server diagnostic bound"
+    );
+    Ok(bytes)
+}
+
+async fn join_capture(
+    mut handle: JoinHandle<Result<Vec<u8>>>,
+    deadline: Instant,
+) -> Result<Vec<u8>> {
+    if let Ok(result) = timeout_at(deadline, &mut handle).await {
+        result.context("compatibility capture task panicked")?
+    } else {
+        handle.abort();
+        let joined = handle.await;
+        if let Err(error) = joined {
+            ensure!(
+                error.is_cancelled(),
+                "capture task panicked during retirement: {error}"
+            );
+        }
+        bail!("compatibility capture deadline; task aborted and joined")
+    }
+}
+
+async fn save(path: &Path, bytes: &[u8]) -> Result<()> {
+    timeout(Duration::from_secs(5), async {
+        let mut file = fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .open(path)
+            .await?;
+        file.write_all(bytes).await?;
+        file.sync_all().await?;
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("compatibility evidence IO timeout")?
+}
+
+async fn binary_hash() -> Result<String> {
+    timeout(Duration::from_secs(10), async {
+        let mut source = fs::File::open(env!("CARGO_BIN_EXE_rustack")).await?;
+        let mut hash = Sha256::new();
+        let mut bytes = vec![0_u8; 65536].into_boxed_slice();
+        let mut total = 0_u64;
+        loop {
+            let count = source.read(&mut bytes).await?;
+            if count == 0 {
+                break;
+            }
+            total = total.saturating_add(u64::try_from(count)?);
+            ensure!(total <= 268_435_456, "compatibility executable size bound");
+            hash.update(bytes.get(..count).context("executable read slice")?);
+        }
+        hexadecimal(&hash.finalize())
+    })
+    .await
+    .context("compatibility executable fingerprint timeout")?
+}
+
+fn hexadecimal(bytes: &[u8]) -> Result<String> {
+    let mut text = String::with_capacity(bytes.len().saturating_mul(2));
+    for byte in bytes {
+        write!(&mut text, "{byte:02x}")?;
+    }
+    Ok(text)
+}
+
+async fn health(endpoint: &str) -> Result<()> {
+    timeout(Duration::from_secs(2), async {
+        let address = endpoint
+            .strip_prefix("http://")
+            .context("compatibility endpoint")?;
+        let mut stream = TcpStream::connect(address).await?;
+        stream
+            .write_all(
+                b"GET /_localstack/health HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n",
+            )
+            .await?;
+        let mut bytes = Vec::new();
+        stream.take(16385).read_to_end(&mut bytes).await?;
+        ensure!(
+            bytes.len() <= 16384 && bytes.starts_with(b"HTTP/1.1 200"),
+            "compatibility readiness response"
+        );
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("compatibility readiness timeout")?
+}
+
+async fn python(arguments: &[OsString]) -> Result<()> {
+    let mut child = Runner::spawn(&interpreter()?, arguments)?;
+    let entered = child.await_pid().await;
+    let report = child.wait(Instant::now() + Duration::from_mins(30)).await?;
+    ensure!(
+        entered? == report.pid,
+        "compatibility child identity changed"
+    );
+    if !report.status.success() {
+        eprintln!(
+            "compatibility child: {} {}",
+            String::from_utf8_lossy(&report.stdout),
+            String::from_utf8_lossy(&report.stderr)
+        );
+    }
+    ensure!(
+        !report.forced && report.status.success(),
+        "external compatibility failed; retained evidence"
+    );
+    Ok(())
+}
+
+async fn exercise(docker: bool) -> Result<()> {
+    let root = PathBuf::from(
+        env::var_os("RUSTACK_LOCALSTACK_EVIDENCE")
+            .context("explicit compatibility evidence directory")?,
+    );
+    ensure!(
+        root.is_absolute(),
+        "compatibility evidence must be absolute"
+    );
+    let parent = root.parent().context("compatibility evidence parent")?;
+    let canonical = timeout(Duration::from_secs(5), fs::canonicalize(parent))
+        .await
+        .context("evidence parent IO timeout")??;
+    ensure!(
+        Some(canonical.as_path()) == root.parent(),
+        "compatibility evidence parent must be canonical"
+    );
+    timeout(Duration::from_secs(5), fs::create_dir(&root))
+        .await
+        .context("create evidence timeout")??;
+    timeout(
+        Duration::from_secs(5),
+        fs::set_permissions(&root, Permissions::from_mode(0o700)),
+    )
+    .await
+    .context("private evidence timeout")??;
+    save(
+        &root.join("server-intent.json"),
+        &serde_json::to_vec(&json!({
+        "path":env!("CARGO_BIN_EXE_rustack"), "sha256":binary_hash().await?, "docker":docker}))?,
+    )
+    .await?;
+    let script =
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("../../tests/workflows/localstack_compat.py");
+    let mode = if docker { "docker" } else { "pure" };
+    let images = if docker {
+        env::var_os("RUSTACK_LOCALSTACK_IMAGES")
+            .context("explicit immutable handler image receipt")?
+    } else {
+        OsString::from("-")
+    };
+    let socket = if docker {
+        OsString::from(format!(
+            "unix://{}",
+            env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")?
+        ))
+    } else {
+        OsString::from("-")
+    };
+    python(&[
+        script.clone().into_os_string(),
+        "preflight".into(),
+        root.clone().into_os_string(),
+        mode.into(),
+        images.clone(),
+        socket,
+    ])
+    .await?;
+    let mut server = Server::spawn(&root, docker).await?;
+    let result = async {
+        server.ready().await?;
+        python(&[
+            script.into_os_string(),
+            "run".into(),
+            root.into_os_string(),
+            mode.into(),
+            OsString::from(&server.endpoint),
+            images,
+        ])
+        .await
+    }
+    .await;
+    let cleanup = server.stop().await;
+    if let Err(error) = &cleanup {
+        eprintln!("compatibility cleanup failed: {error:#}");
+    }
+    result?;
+    cleanup?;
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires pinned external Python environment; make test-workflows-localstack-pure"]
+async fn test_should_execute_original_localstack_pure_cases() -> Result<()> {
+    exercise(false).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires explicit Docker and upstream handler images; make \
+            test-workflows-localstack-docker"]
+async fn test_should_execute_original_localstack_image_cases() -> Result<()> {
+    exercise(true).await
+}
+
+#[tokio::test]
+async fn test_should_join_capture_when_a_writer_outlives_server_retirement() -> Result<()> {
+    let (reader, writer) = tokio::io::duplex(16);
+    let task = tokio::spawn(capture(reader));
+    let result = join_capture(task, Instant::now() + Duration::from_millis(10)).await;
+    ensure!(result.is_err(), "held writer escaped capture deadline");
+    drop(writer);
+    Ok(())
+}
diff --git a/apps/rustack/tests/workflows_action.rs b/apps/rustack/tests/workflows_action.rs
new file mode 100644
index 00000000..0c2b1329
--- /dev/null
+++ b/apps/rustack/tests/workflows_action.rs
@@ -0,0 +1,240 @@
+//! Actual composite-Action YAML contract and bounded control metadata export.
+#![cfg(unix)]
+#![forbid(unsafe_code)]
+#![warn(
+    clippy::pedantic,
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+use std::{
+    collections::BTreeMap,
+    ffi::OsString,
+    fs::Permissions,
+    os::unix::fs::PermissionsExt,
+    path::{Path, PathBuf},
+};
+
+use anyhow::{Context, Result, ensure};
+use base64::{Engine, engine::general_purpose::STANDARD};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use tempfile::TempDir;
+use tokio::{
+    fs,
+    io::{AsyncReadExt, AsyncWriteExt},
+    time::{Duration, Instant, timeout},
+};
+use yaml_rust2::{Yaml, YamlLoader};
+
+#[path = "workflows_sdk/runner.rs"]
+mod runner;
+use runner::{Runner, interpreter};
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ActionContract {
+    schema_version: u8,
+    defaults: BTreeMap<String, String>,
+    environment: BTreeMap<String, String>,
+    run: String,
+}
+
+fn field<'a>(value: &'a Yaml, name: &str) -> Result<&'a Yaml> {
+    value
+        .as_hash()
+        .context("Action mapping required")?
+        .get(&Yaml::String(name.to_owned()))
+        .context("Action field missing")
+}
+
+fn string(value: &Yaml, maximum: usize) -> Result<String> {
+    let value = value.as_str().context("Action string required")?;
+    ensure!(value.len() <= maximum, "Action string budget");
+    Ok(value.to_owned())
+}
+
+fn contract(source: &str) -> Result<ActionContract> {
+    ensure!(source.len() <= 131_072, "Action source byte budget");
+    let documents = YamlLoader::load_from_str(source).context("Action YAML")?;
+    let [root]: [Yaml; 1] = documents
+        .try_into()
+        .map_err(|_| anyhow::anyhow!("one Action document required"))?;
+    let inputs = field(&root, "inputs")?
+        .as_hash()
+        .context("Action inputs mapping")?;
+    ensure!(inputs.len() <= 32, "Action input count budget");
+    let mut defaults = BTreeMap::new();
+    for (name, definition) in inputs {
+        defaults.insert(
+            string(name, 64)?,
+            string(field(definition, "default")?, 512)?,
+        );
+    }
+    let runs = field(&root, "runs")?;
+    ensure!(
+        string(field(runs, "using")?, 32)? == "composite",
+        "composite Action required"
+    );
+    let steps = field(runs, "steps")?.as_vec().context("Action steps")?;
+    ensure!(steps.len() == 1, "one retained Action entrypoint required");
+    let step = steps.first().context("Action step")?;
+    ensure!(
+        string(field(step, "id")?, 64)? == "start",
+        "public output step changed"
+    );
+    ensure!(
+        string(field(step, "shell")?, 32)? == "bash",
+        "Action shell changed"
+    );
+    let run = string(field(step, "run")?, 16_384)?;
+    ensure!(
+        run.trim() == "exec python3 -B \"$RUSTACK_ACTION_ROOT/tools/github-action/runtime.py\""
+            && !run.contains("${{"),
+        "Action source must not interpolate context"
+    );
+    let env = field(step, "env")?
+        .as_hash()
+        .context("Action environment")?;
+    ensure!(env.len() <= 128, "Action environment budget");
+    let mut environment = BTreeMap::new();
+    for (name, value) in env {
+        environment.insert(string(name, 96)?, string(value, 512)?);
+    }
+    ensure!(
+        environment.get("RUSTACK_ACTION_ROOT").map(String::as_str)
+            == Some("${{ github.action_path }}"),
+        "trusted Action root binding missing"
+    );
+    ensure!(
+        environment.len() == defaults.len() + 1,
+        "Action input/environment drift"
+    );
+    for key in defaults.keys() {
+        let name = format!("RUSTACK_ACTION_{}", key.to_uppercase().replace('-', "_"));
+        let expression = format!("${{{{ inputs.{key} }}}}");
+        ensure!(
+            environment.get(&name) == Some(&expression),
+            "Action input env binding changed"
+        );
+    }
+    let outputs = field(&root, "outputs")?;
+    for (name, value) in [
+        ("endpoint", "${{ steps.start.outputs.endpoint }}"),
+        ("container-id", "${{ steps.start.outputs.container_id }}"),
+    ] {
+        ensure!(
+            string(field(field(outputs, name)?, "value")?, 256)? == value,
+            "Action output contract changed"
+        );
+    }
+    Ok(ActionContract {
+        schema_version: 1,
+        defaults,
+        environment,
+        run,
+    })
+}
+
+async fn read_contract() -> Result<ActionContract> {
+    let root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let source = timeout(Duration::from_secs(5), async {
+        let file = fs::File::open(root.join("action.yml")).await?;
+        ensure!(
+            file.metadata().await?.len() <= 131_072,
+            "Action source byte budget"
+        );
+        let mut bytes = Vec::new();
+        file.take(131_073).read_to_end(&mut bytes).await?;
+        ensure!(bytes.len() <= 131_072, "Action source grew beyond budget");
+        Ok::<_, anyhow::Error>(String::from_utf8(bytes)?)
+    })
+    .await
+    .context("Action source IO deadline")??;
+    contract(&source)
+}
+
+#[tokio::test]
+async fn test_should_validate_actual_action_entrypoint_contract() -> Result<()> {
+    let value = read_contract().await?;
+    ensure!(
+        value.defaults.contains_key("stepfunctions-skip-auth"),
+        "Step Functions Action setting missing"
+    );
+    Ok(())
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ControlReport {
+    schema_version: u8,
+    cases: u32,
+    successful: bool,
+}
+
+async fn private_write(path: &Path, body: &[u8]) -> Result<()> {
+    ensure!(body.len() <= 131_072, "Action control artifact byte budget");
+    timeout(Duration::from_secs(5), async {
+        let mut options = fs::OpenOptions::new();
+        options.write(true).create_new(true).mode(0o600);
+        let mut file = options.open(path).await?;
+        file.write_all(body).await?;
+        file.sync_all().await?;
+        Ok::<_, anyhow::Error>(())
+    })
+    .await
+    .context("Action private artifact deadline")??;
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires provisioned pinned Python; run make test-workflows-action-fixture"]
+async fn test_should_execute_actual_action_process_controls() -> Result<()> {
+    let mut root: TempDir = tempfile::tempdir()?;
+    root.disable_cleanup(true);
+    timeout(
+        Duration::from_secs(5),
+        fs::set_permissions(root.path(), Permissions::from_mode(0o700)),
+    )
+    .await
+    .context("Action control root permissions deadline")??;
+    ensure!(
+        fs::metadata(root.path()).await?.permissions().mode() & 0o777 == 0o700,
+        "Action controls require a private directory"
+    );
+    let value = read_contract().await?;
+    let metadata = root.path().join("action.json");
+    private_write(&metadata, &serde_json::to_vec(&value)?).await?;
+    let script = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../tests/workflows/test_github_action.py");
+    let arguments: Vec<OsString> = vec![script.into_os_string(), metadata.into_os_string()];
+    let cutoff = Instant::now() + Duration::from_secs(180);
+    let mut child = Runner::spawn(&interpreter()?, &arguments)?;
+    let entered = child.await_pid().await;
+    let report = child.wait(cutoff).await?;
+    private_write(&root.path().join("stdout"), &report.stdout).await?;
+    private_write(&root.path().join("stderr"), &report.stderr).await?;
+    ensure!(
+        entered.is_ok_and(|pid| pid == report.pid) && !report.forced && report.status.success(),
+        "Action controls failed; private evidence {} (stdout SHA256-base64 {}, stderr \
+         SHA256-base64 {})",
+        root.path().display(),
+        STANDARD.encode(Sha256::digest(&report.stdout)),
+        STANDARD.encode(Sha256::digest(&report.stderr))
+    );
+    let observed: ControlReport =
+        serde_json::from_slice(&report.stdout).context("Action control result schema")?;
+    ensure!(
+        observed.schema_version == 1 && observed.successful && (24..=64).contains(&observed.cases),
+        "Action control catalog incomplete"
+    );
+    println!(
+        "Actual composite Action controls: {} cases; independent Rust PID/capture/timeout owner \
+         joined",
+        observed.cases
+    );
+    root.disable_cleanup(false);
+    Ok(())
+}
diff --git a/apps/rustack/tests/workflows_sdk.rs b/apps/rustack/tests/workflows_sdk.rs
new file mode 100644
index 00000000..4a100793
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk.rs
@@ -0,0 +1,227 @@
+//! Explicit ordinary SDK qualification of the actual binary and Native runtime.
+#![cfg(all(feature = "stepfunctions", feature = "lambda", unix))]
+#![forbid(unsafe_code)]
+
+#[path = "workflows_sdk/documented.rs"]
+mod documented;
+#[path = "workflows_sdk/performance.rs"]
+mod performance;
+#[path = "workflows_sdk/persistence.rs"]
+mod persistence;
+#[path = "workflows_sdk/process.rs"]
+mod process;
+#[path = "workflows_sdk/runner.rs"]
+mod runner;
+#[path = "workflows_sdk/rust.rs"]
+mod rust;
+
+use std::{ffi::OsString, path::Path, time::Duration};
+
+use anyhow::{Context, Error as AnyError, Result, ensure};
+use process::{Server, assert_absent};
+use runner::{Runner, interpreter};
+use tokio::{
+    fs,
+    time::{Instant, timeout},
+};
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual host bootstrap; run make test-stepfunctions-sdk"]
+async fn test_should_accept_ordinary_rust_sdk_through_actual_runtime() -> Result<()> {
+    let mut server = Server::start().await?;
+    let result = match timeout(Duration::from_secs(120), rust::exercise(&server)).await {
+        Ok(result) => result,
+        Err(error) => Err(error.into()),
+    };
+    let cleanup = server
+        .shutdown(Instant::now() + Duration::from_secs(45))
+        .await;
+    if let Err(error) = &result {
+        eprintln!("Rust SDK exercise failed: {error:#}");
+    }
+    let observed = cleanup?;
+    result?;
+    ensure!(observed > 0, "no actual bootstrap process was observed");
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires uv and actual host bootstrap; run make test-stepfunctions-sdk"]
+async fn test_should_accept_ordinary_boto3_through_actual_runtime() -> Result<()> {
+    let python = interpreter()?;
+    let mut server = Server::start().await?;
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let result = async {
+        let arguments = [
+            root.join("tests/workflows/stepfunctions_sdk.py")
+                .into_os_string(),
+            OsString::from(&server.endpoint),
+            server.bootstrap()?.as_os_str().to_owned(),
+            server.markers.as_os_str().to_owned(),
+        ];
+        let report = Runner::spawn(&python, &arguments)?
+            .wait(Instant::now() + Duration::from_secs(120))
+            .await?;
+        if !report.status.success() {
+            eprintln!("boto3 stderr: {}", String::from_utf8_lossy(&report.stderr));
+        }
+        ensure!(
+            !report.forced && report.status.success(),
+            "boto3 qualification failed or exceeded deadline"
+        );
+        let result: serde_json::Value = serde_json::from_slice(&report.stdout)?;
+        ensure!(
+            result["catalogCases"] == 17
+                && result["m1Actions"] == 15
+                && result["nestedCases"] == 6
+                && result["nestedLifecycle"] == 2
+                && result["structuredCases"] == 6
+                && result["structuredLifecycle"] == 2
+                && result["actualNative"] == true,
+            "missing SDK acceptance evidence"
+        );
+        Ok(())
+    }
+    .await;
+    let cleanup = server
+        .shutdown(Instant::now() + Duration::from_secs(45))
+        .await;
+    let observed = cleanup?;
+    result?;
+    ensure!(observed > 0, "no actual bootstrap process was observed");
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires pinned Python; run make test-stepfunctions-sdk"]
+async fn test_should_reap_actual_python_after_observed_execution_timeout() -> Result<()> {
+    for valid in [true, false] {
+        let program = if valid {
+            "import os,time; print(os.getpid(), flush=True); time.sleep(60)"
+        } else {
+            "import time; print('invalid-pid', flush=True); time.sleep(60)"
+        };
+        let arguments = [OsString::from("-c"), OsString::from(program)];
+        let mut runner = Runner::spawn(&interpreter()?, &arguments)?;
+        let barrier = runner.await_pid().await;
+        let report = runner
+            .wait(Instant::now() + Duration::from_millis(25))
+            .await?;
+        ensure!(
+            report.forced && !report.status.success(),
+            "did not stop the actual Python process"
+        );
+        assert_absent(report.pid).await?;
+        if valid {
+            ensure!(barrier? == report.pid, "wrong consumed PID");
+        } else {
+            ensure!(barrier.is_err(), "malformed PID barrier accepted");
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual host bootstrap; run make test-stepfunctions-sdk"]
+async fn test_should_run_actual_nested_native_with_one_dispatch_slot() -> Result<()> {
+    let mut server = Server::start_with_dispatch(1).await?;
+    let result = match timeout(Duration::from_secs(60), rust::nested_only(&server)).await {
+        Ok(result) => result,
+        Err(error) => Err(error.into()),
+    };
+    let cleanup = server
+        .shutdown(Instant::now() + Duration::from_secs(45))
+        .await;
+    let observed = cleanup?;
+    result?;
+    ensure!(observed > 0, "no actual nested Native handler was observed");
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual handler SDK fixtures; run make test-stepfunctions-sdk"]
+async fn test_should_run_signed_rust_and_boto3_handler_callbacks_with_one_dispatch_slot()
+-> Result<()> {
+    let mut server = Server::start_with_dispatch(1).await?;
+    let result = match timeout(Duration::from_secs(180), rust::callbacks_only(&server)).await {
+        Ok(result) => result,
+        Err(error) => Err(error.into()),
+    };
+    let cleanup = server
+        .shutdown(Instant::now() + Duration::from_secs(45))
+        .await;
+    if let Err(error) = &result {
+        eprintln!("handler SDK callback qualification failed: {error:#}");
+    }
+    let observed = cleanup?;
+    result?;
+    ensure!(observed > 0, "no actual handler SDK process observed");
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual host bootstrap; run make test-stepfunctions-sdk"]
+async fn test_should_join_actual_server_and_native_children_after_fixture_gate_release_failure()
+-> Result<()> {
+    let mut server = Server::start().await?;
+    let operation = async {
+        timeout(Duration::from_secs(30), rust::native_probe_only(&server)).await??;
+        let private = server
+            .markers
+            .parent()
+            .context("owned fixture root")?
+            .to_owned();
+        let mut native = Vec::new();
+        let mut directory = fs::read_dir(&server.markers).await?;
+        while let Some(entry) = directory.next_entry().await? {
+            ensure!(
+                native.len() < 64 && entry.metadata().await?.len() <= 11,
+                "invalid PID evidence"
+            );
+            native.push(fs::read_to_string(entry.path()).await?.parse::<u32>()?);
+        }
+        fs::rename(
+            private.join("callback-gates"),
+            private.join("missing-callback-gates"),
+        )
+        .await?;
+        Ok::<_, AnyError>((private, native))
+    }
+    .await;
+    let cleanup = server
+        .shutdown(Instant::now() + Duration::from_secs(45))
+        .await;
+    assert_absent(server.pid).await?;
+    let (private, native) = operation?;
+    for pid in &native {
+        assert_absent(*pid).await?;
+    }
+    ensure!(
+        cleanup.is_err()
+            && server
+                .shutdown(Instant::now() + Duration::from_secs(1))
+                .await
+                .is_err(),
+        "fixture gate failure was not retained"
+    );
+    ensure!(
+        fs::try_exists(&private).await?,
+        "failed qualification evidence was discarded"
+    );
+    fs::remove_dir_all(&private).await?;
+    ensure!(!native.is_empty(), "no actual Native child observed");
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "actual owned pure-service smoke; run make smoke-workflows"]
+async fn test_should_execute_documented_pure_workflow_in_owned_strict_service() -> Result<()> {
+    let mut server = Server::start_pure().await?;
+    let result = timeout(Duration::from_secs(60), documented::exercise(&server)).await;
+    let cleanup = server
+        .shutdown(Instant::now() + Duration::from_secs(45))
+        .await;
+    ensure!(cleanup? == 0, "pure smoke created Native Lambda processes");
+    result??;
+    Ok(())
+}
diff --git a/apps/rustack/tests/workflows_sdk/documented.rs b/apps/rustack/tests/workflows_sdk/documented.rs
new file mode 100644
index 00000000..1044f51d
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/documented.rs
@@ -0,0 +1,171 @@
+//! Source-controlled operator example through an owned strict-auth pure service.
+#![warn(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+use anyhow::{Context, Result, ensure};
+use aws_sdk_sfn::{
+    Client,
+    types::{ExecutionStatus, HistoryEvent, StateEnteredEventDetails, StateExitedEventDetails},
+};
+use serde_json::{Value, json};
+
+use super::{
+    process::{SECRET, Server},
+    rust::{history, sequential_predecessor, sfn, terminal},
+};
+
+const DEFINITION: &str = include_str!("../../../../examples/workflows/pure.asl.json");
+
+async fn run(client: &Client, machine: &str, positive: bool) -> Result<()> {
+    let input = if positive {
+        r#"{ "n": 6 }"#
+    } else {
+        r#"{"n":0}"#
+    };
+    let started = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .name(if positive { "Positive" } else { "Rejected" })
+        .input(input)
+        .send()
+        .await?;
+    let result = terminal(client, started.execution_arn()).await?;
+    ensure!(
+        result.input() == Some(input),
+        "documented workflow lost raw input"
+    );
+    if positive {
+        ensure!(
+            result.status() == &ExecutionStatus::Succeeded,
+            "positive example failed"
+        );
+        ensure!(
+            serde_json::from_str::<Value>(result.output().context("missing output")?)?
+                == json!({"doubled":12}),
+            "wrong documented result"
+        );
+    } else {
+        ensure!(
+            result.status() == &ExecutionStatus::Failed
+                && result.error() == Some("Example.NotPositive"),
+            "Fail branch did not reject nonpositive input"
+        );
+    }
+    let events = history(client, started.execution_arn(), false, true).await?;
+    for (index, event) in events.iter().enumerate() {
+        let previous = i64::try_from(index)?;
+        ensure!(
+            event.id() == previous.checked_add(1).context("event ID overflow")?
+                && event.previous_event_id() == sequential_predecessor(index)?,
+            "invalid example causal history"
+        );
+    }
+    let kinds: Vec<&str> = events.iter().map(|event| event.r#type().as_str()).collect();
+    let expected_kinds: &[&str] = if positive {
+        &[
+            "ExecutionStarted",
+            "PassStateEntered",
+            "PassStateExited",
+            "ChoiceStateEntered",
+            "ChoiceStateExited",
+            "WaitStateEntered",
+            "WaitStateExited",
+            "SucceedStateEntered",
+            "SucceedStateExited",
+            "ExecutionSucceeded",
+        ]
+    } else {
+        &[
+            "ExecutionStarted",
+            "PassStateEntered",
+            "PassStateExited",
+            "ChoiceStateEntered",
+            "ChoiceStateExited",
+            "FailStateEntered",
+            "ExecutionFailed",
+        ]
+    };
+    ensure!(kinds == expected_kinds, "wrong documented event sequence");
+    let entered: Vec<&str> = events
+        .iter()
+        .filter_map(HistoryEvent::state_entered_event_details)
+        .map(StateEnteredEventDetails::name)
+        .collect();
+    let expected: &[&str] = if positive {
+        &["Compute", "Positive", "Pause", "Done"]
+    } else {
+        &["Compute", "Positive", "Reject"]
+    };
+    ensure!(entered == expected, "wrong example branch/state order");
+    let exited: Vec<&str> = events
+        .iter()
+        .filter_map(HistoryEvent::state_exited_event_details)
+        .map(StateExitedEventDetails::name)
+        .collect();
+    let expected_exits: &[&str] = if positive {
+        &["Compute", "Positive", "Pause", "Done"]
+    } else {
+        &["Compute", "Positive"]
+    };
+    ensure!(exited == expected_exits, "wrong example state exit names");
+    Ok(())
+}
+
+pub(super) async fn exercise(server: &Server) -> Result<()> {
+    let capabilities = server.capabilities().await?;
+    for key in [
+        "lambdaRequestResponse",
+        "callbacks",
+        "dockerQualified",
+        "snapshotResume",
+    ] {
+        ensure!(
+            capabilities.pointer(&format!("/workflows/{key}")) == Some(&Value::Bool(false)),
+            "pure service advertised unavailable integration"
+        );
+    }
+    ensure!(
+        capabilities.pointer("/workflows/snapshot") == Some(&json!("resources-and-history"))
+            && capabilities.pointer("/workflows/paginationEpoch")
+                == Some(&json!("fresh-on-restart")),
+        "wrong pure snapshot capability"
+    );
+    ensure!(
+        server.bootstrap().is_err(),
+        "pure fixture exposed a Native bootstrap"
+    );
+    let client = sfn(server, SECRET);
+    let validation = client
+        .validate_state_machine_definition()
+        .definition(DEFINITION)
+        .send()
+        .await?;
+    ensure!(
+        validation.result().as_str() == "OK",
+        "documented raw definition did not validate"
+    );
+    let created = client
+        .create_state_machine()
+        .name("Documented")
+        .role_arn("arn:aws:iam::000000000000:role/Workflows")
+        .definition(DEFINITION)
+        .send()
+        .await?;
+    let machine = created.state_machine_arn();
+    let captured = client
+        .describe_state_machine()
+        .state_machine_arn(machine)
+        .send()
+        .await?;
+    ensure!(
+        captured.definition() == DEFINITION,
+        "documented raw source was normalized or replaced"
+    );
+    run(&client, machine, true).await?;
+    run(&client, machine, false).await?;
+    server.readiness().await
+}
diff --git a/apps/rustack/tests/workflows_sdk/performance.rs b/apps/rustack/tests/workflows_sdk/performance.rs
new file mode 100644
index 00000000..cb5b3c9e
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/performance.rs
@@ -0,0 +1,245 @@
+//! Actual signed SDK workloads; measurements publish only after process cleanup.
+#![warn(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+use std::{env::consts, future::Future, thread, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use serde::{Deserialize, Serialize};
+use tokio::time::{Instant, timeout};
+
+use super::{process::Server, rust::sfn};
+
+#[path = "performance/latency.rs"]
+mod latency;
+#[path = "performance/load.rs"]
+mod load;
+#[cfg(test)]
+#[path = "performance/tests.rs"]
+mod tests;
+
+const SAMPLES: usize = 100;
+const OPERATION_BUDGET: Duration = Duration::from_secs(2);
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct Samples {
+    count: usize,
+    observed_micros: Vec<u64>,
+    p50_micros: u64,
+    p95_micros: u64,
+    max_micros: u64,
+}
+impl Samples {
+    fn new(observed_micros: Vec<u64>) -> Result<Self> {
+        ensure!(observed_micros.len() == SAMPLES, "wrong measurement count");
+        let mut ranked = observed_micros.clone();
+        ranked.sort_unstable();
+        Ok(Self {
+            count: observed_micros.len(),
+            observed_micros,
+            p50_micros: *ranked.get(49).context("missing median rank")?,
+            p95_micros: *ranked.get(94).context("missing p95 rank")?,
+            max_micros: *ranked.last().context("missing maximum")?,
+        })
+    }
+    fn check_p95(&self, budget: u64) -> Result<()> {
+        ensure!(self.p95_micros <= budget, "workflow p95 budget exceeded");
+        Ok(())
+    }
+}
+
+#[derive(Debug, Serialize)]
+#[serde(
+    tag = "kind",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase"
+)]
+enum Measurement {
+    PureLatency {
+        state_count: usize,
+        input_bytes: usize,
+        executions: usize,
+        budget_micros: u64,
+        latency: Samples,
+    },
+    LoopResponsiveness {
+        open_execution_slots: usize,
+        completed_cycles: usize,
+        input_bytes: usize,
+        history_event_high_water: i64,
+        exhaustion: load::ExhaustionProbes,
+        readiness: Samples,
+        stop: Samples,
+    },
+}
+impl Measurement {
+    fn check(&self) -> Result<()> {
+        match self {
+            Self::PureLatency {
+                latency,
+                budget_micros,
+                ..
+            } => latency.check_p95(*budget_micros),
+            Self::LoopResponsiveness {
+                readiness,
+                stop,
+                exhaustion,
+                ..
+            } => {
+                exhaustion.check()?;
+                ensure!(
+                    readiness.max_micros < 2_000_000,
+                    "readiness budget exceeded"
+                );
+                ensure!(stop.max_micros < 2_000_000, "Stop budget exceeded");
+                Ok(())
+            }
+        }
+    }
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct Host {
+    os: &'static str,
+    architecture: &'static str,
+    available_logical_cpus: usize,
+    debug_assertions: bool,
+    reference_qualification: &'static str,
+}
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct Limits {
+    open_executions: usize,
+    transitions: u32,
+    history_events: usize,
+    history_bytes: usize,
+    total_history_bytes: usize,
+}
+impl Limits {
+    async fn read(server: &Server) -> Result<Self> {
+        let capabilities = server.capabilities().await?;
+        let limits: Self = serde_json::from_value(
+            capabilities
+                .pointer("/workflows/limits")
+                .context("missing workflow limits")?
+                .clone(),
+        )?;
+        ensure!(
+            limits.open_executions == 1
+                && limits.transitions == 1_000_000
+                && limits.history_events == 25_000
+                && limits.history_bytes == 33_554_432
+                && limits.total_history_bytes == 134_217_728,
+            "actual performance limits differ from contract"
+        );
+        Ok(limits)
+    }
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct Report {
+    schema_version: u8,
+    host: Host,
+    limits: Limits,
+    native_processes_observed: usize,
+    server_joined: bool,
+    measurement: Measurement,
+}
+impl Report {
+    fn emit(
+        measurement: Measurement,
+        limits: Limits,
+        native_processes_observed: usize,
+    ) -> Result<()> {
+        ensure!(
+            native_processes_observed == 0,
+            "pure workload invoked Lambda"
+        );
+        let report = Self {
+            schema_version: 1,
+            host: Host {
+                os: consts::OS,
+                architecture: consts::ARCH,
+                available_logical_cpus: thread::available_parallelism()?.get(),
+                debug_assertions: cfg!(debug_assertions),
+                reference_qualification: "pending",
+            },
+            limits,
+            native_processes_observed,
+            server_joined: true,
+            measurement,
+        };
+        let encoded = serde_json::to_string(&report)?;
+        ensure!(encoded.len() <= 65_536, "oversized measurement report");
+        println!("WORKFLOWS_PERFORMANCE {encoded}");
+        report.measurement.check()
+    }
+}
+
+fn micros(duration: Duration) -> Result<u64> {
+    let rounded = duration
+        .as_nanos()
+        .checked_add(999)
+        .context("duration overflow")?
+        / 1000;
+    Ok(u64::try_from(rounded)?)
+}
+async fn bounded<T, E: Into<anyhow::Error>>(
+    future: impl Future<Output = std::result::Result<T, E>>,
+) -> Result<T> {
+    let began = Instant::now();
+    let result = timeout(OPERATION_BUDGET, future)
+        .await
+        .context("workload operation expired")?;
+    ensure!(began.elapsed() < OPERATION_BUDGET, "late workload result");
+    result.map_err(Into::into)
+}
+fn input() -> String {
+    format!(r#"{{"payload":"{}"}}"#, "x".repeat(1010))
+}
+
+async fn run(latency_workload: bool) -> Result<()> {
+    let mut server = Server::start_performance().await?;
+    let client = sfn(&server, super::process::SECRET);
+    let began = Instant::now();
+    let result = timeout(Duration::from_secs(120), async {
+        let limits = Limits::read(&server).await?;
+        let measurement = if latency_workload {
+            latency::measure(&client).await?
+        } else {
+            load::measure(&client, &server).await?
+        };
+        Ok::<_, anyhow::Error>((limits, measurement))
+    })
+    .await
+    .context("complete workload expired");
+    let result = if began.elapsed() >= Duration::from_secs(120) {
+        Err(anyhow::anyhow!("late complete workload result"))
+    } else {
+        result
+    };
+    let cleanup = server
+        .shutdown(Instant::now() + Duration::from_secs(45))
+        .await;
+    let observed = cleanup?;
+    let (limits, measurement) = result??;
+    Report::emit(measurement, limits, observed)
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "real measured SDK workload; run make test-workflows-performance"]
+async fn test_should_measure_one_hundred_fifty_state_signed_sdk_executions() -> Result<()> {
+    run(true).await
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "real loop/Stop workload; run make test-workflows-performance"]
+async fn test_should_keep_health_and_stop_responsive_and_reuse_one_execution_slot() -> Result<()> {
+    run(false).await
+}
diff --git a/apps/rustack/tests/workflows_sdk/performance/latency.rs b/apps/rustack/tests/workflows_sdk/performance/latency.rs
new file mode 100644
index 00000000..576bf0ae
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/performance/latency.rs
@@ -0,0 +1,153 @@
+//! Full pure workflow latency, with exact public output/history validation.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result, ensure};
+use aws_sdk_sfn::{
+    Client,
+    operation::describe_execution::DescribeExecutionOutput,
+    types::{
+        ExecutionStatus, HistoryEvent, HistoryEventType, StateEnteredEventDetails,
+        StateExitedEventDetails,
+    },
+};
+use serde_json::{Map, Value, json};
+use tokio::time::{Instant, sleep};
+
+use super::{Measurement, SAMPLES, Samples, bounded, input, micros};
+use crate::rust::create;
+
+fn definition() -> Value {
+    let mut states = Map::new();
+    for index in 0..50 {
+        let name = format!("S{index:02}");
+        let state = if index == 49 {
+            json!({"Type":"Succeed"})
+        } else if index % 2 == 0 {
+            json!({"Type":"Pass","Next":format!("S{:02}",index+1)})
+        } else {
+            json!({"Type":"Choice","Choices":[{"Variable":"$.payload","IsString":true,"Next":format!("S{:02}",index+1)}],"Default":"S49"})
+        };
+        states.insert(name, state);
+    }
+    json!({"StartAt":"S00","States":states})
+}
+pub(super) async fn terminal(client: &Client, arn: &str) -> Result<DescribeExecutionOutput> {
+    bounded(async {
+        loop {
+            let result = client
+                .describe_execution()
+                .execution_arn(arn)
+                .send()
+                .await?;
+            if result.status() != &ExecutionStatus::Running {
+                return Ok::<_, anyhow::Error>(result);
+            }
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+}
+async fn check_history(client: &Client, arn: &str) -> Result<()> {
+    let history = bounded(
+        client
+            .get_execution_history()
+            .execution_arn(arn)
+            .max_results(1000)
+            .include_execution_data(false)
+            .send(),
+    )
+    .await?;
+    ensure!(
+        history.next_token().is_none(),
+        "unexpected history pagination"
+    );
+    validate_history(history.events())
+}
+pub(super) fn validate_history(events: &[HistoryEvent]) -> Result<()> {
+    ensure!(events.len() == 102, "wrong pure history event count");
+    for (index, event) in events.iter().enumerate() {
+        let number = i64::try_from(index)?;
+        let previous = if index == 1 { 0 } else { number };
+        ensure!(
+            event.id() == number.checked_add(1).context("event ID overflow")?
+                && event.previous_event_id() == previous,
+            "invalid sequential causal history"
+        );
+        if index == 0 {
+            ensure!(
+                event.r#type() == &HistoryEventType::ExecutionStarted,
+                "missing first start"
+            );
+        } else if index == 101 {
+            ensure!(
+                event.r#type() == &HistoryEventType::ExecutionSucceeded,
+                "missing final success"
+            );
+        } else {
+            let offset = index.checked_sub(1).context("invalid state event index")?;
+            let state = offset / 2;
+            let entered = offset % 2 == 0;
+            let expected = match (state, entered) {
+                (49, true) => HistoryEventType::SucceedStateEntered,
+                (49, false) => HistoryEventType::SucceedStateExited,
+                (state, true) if state % 2 == 0 => HistoryEventType::PassStateEntered,
+                (state, false) if state % 2 == 0 => HistoryEventType::PassStateExited,
+                (_, true) => HistoryEventType::ChoiceStateEntered,
+                (_, false) => HistoryEventType::ChoiceStateExited,
+            };
+            let name = if entered {
+                event
+                    .state_entered_event_details()
+                    .map(StateEnteredEventDetails::name)
+            } else {
+                event
+                    .state_exited_event_details()
+                    .map(StateExitedEventDetails::name)
+            };
+            ensure!(
+                event.r#type() == &expected && name == Some(format!("S{state:02}").as_str()),
+                "wrong state event kind/name"
+            );
+        }
+    }
+    Ok(())
+}
+
+pub(super) async fn measure(client: &Client) -> Result<Measurement> {
+    let input = input();
+    ensure!(input.len() == 1024, "incorrect workload input size");
+    let machine = bounded(create(client, "Latency", &definition())).await?;
+    let mut samples = Vec::with_capacity(SAMPLES);
+    for index in 0..SAMPLES {
+        let began = Instant::now();
+        let arn = bounded(Box::pin(async {
+            let started = client
+                .start_execution()
+                .state_machine_arn(&machine)
+                .name(format!("Latency{index}"))
+                .input(&input)
+                .send()
+                .await?;
+            let arn = started.execution_arn().to_owned();
+            let result = terminal(client, &arn).await?;
+            ensure!(
+                result.status() == &ExecutionStatus::Succeeded
+                    && result.input() == Some(input.as_str())
+                    && result.output() == Some(input.as_str()),
+                "wrong pure workflow result"
+            );
+            Ok::<_, anyhow::Error>(arn)
+        }))
+        .await?;
+        samples.push(micros(began.elapsed())?);
+        check_history(client, &arn).await?;
+    }
+    Ok(Measurement::PureLatency {
+        state_count: 50,
+        input_bytes: input.len(),
+        executions: SAMPLES,
+        budget_micros: 100_000,
+        latency: Samples::new(samples)?,
+    })
+}
diff --git a/apps/rustack/tests/workflows_sdk/performance/load.rs b/apps/rustack/tests/workflows_sdk/performance/load.rs
new file mode 100644
index 00000000..b94a3fb4
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/performance/load.rs
@@ -0,0 +1,209 @@
+//! Real running loops, bounded history exhaustion and one-slot Stop cycles.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result, ensure};
+use aws_sdk_sfn::{
+    Client,
+    types::{ExecutionStatus, HistoryEventType},
+};
+use serde::Serialize;
+use serde_json::json;
+use tokio::time::{Instant, sleep, timeout};
+
+use super::{Measurement, SAMPLES, Samples, bounded, input, latency, micros};
+use crate::{process::Server, rust::create};
+
+#[derive(Debug, Default, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) struct ExhaustionProbes {
+    probe_count: u32,
+    live_probe_count: u32,
+    max_readiness_micros: u64,
+}
+impl ExhaustionProbes {
+    pub(super) fn record(
+        &mut self,
+        before: &ExecutionStatus,
+        after: &ExecutionStatus,
+        elapsed: u64,
+    ) -> Result<()> {
+        self.probe_count = self
+            .probe_count
+            .checked_add(1)
+            .context("probe count overflow")?;
+        ensure!(self.probe_count <= 10_000, "unbounded exhaustion probes");
+        if before == &ExecutionStatus::Running && after == &ExecutionStatus::Running {
+            self.live_probe_count = self
+                .live_probe_count
+                .checked_add(1)
+                .context("live probe count overflow")?;
+        }
+        self.max_readiness_micros = self.max_readiness_micros.max(elapsed);
+        Ok(())
+    }
+    pub(super) fn check(&self) -> Result<()> {
+        ensure!(
+            self.live_probe_count > 0,
+            "no readiness probe overlapped live exhaustion work"
+        );
+        ensure!(
+            self.max_readiness_micros < 2_000_000,
+            "exhaustion readiness budget exceeded"
+        );
+        Ok(())
+    }
+}
+
+async fn start(client: &Client, machine: &str, name: String, input: &str) -> Result<String> {
+    let result = bounded(
+        client
+            .start_execution()
+            .state_machine_arn(machine)
+            .name(name)
+            .input(input)
+            .send(),
+    )
+    .await?;
+    Ok(result.execution_arn().to_owned())
+}
+async fn live_history(client: &Client, arn: &str) -> Result<()> {
+    bounded(async {
+        loop {
+            let result = client
+                .get_execution_history()
+                .execution_arn(arn)
+                .max_results(5)
+                .include_execution_data(false)
+                .send()
+                .await?;
+            if result.events().len() >= 5 {
+                let state = client
+                    .describe_execution()
+                    .execution_arn(arn)
+                    .send()
+                    .await?;
+                ensure!(
+                    state.status() == &ExecutionStatus::Running,
+                    "loop ended before Stop"
+                );
+                return Ok::<_, anyhow::Error>(());
+            }
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+}
+async fn exhaust(
+    client: &Client,
+    server: &Server,
+    machine: &str,
+    input: &str,
+) -> Result<(i64, ExhaustionProbes)> {
+    let arn = start(client, machine, "Exhaust".to_owned(), input).await?;
+    let mut probes = ExhaustionProbes::default();
+    let began = Instant::now();
+    let result = timeout(Duration::from_secs(20), async {
+        loop {
+            let before = bounded(client.describe_execution().execution_arn(&arn).send()).await?;
+            if before.status() != &ExecutionStatus::Running {
+                return Ok::<_, anyhow::Error>(before);
+            }
+            let began = Instant::now();
+            server.readiness().await?;
+            let elapsed = micros(began.elapsed())?;
+            let state = bounded(client.describe_execution().execution_arn(&arn).send()).await?;
+            probes.record(before.status(), state.status(), elapsed)?;
+            if state.status() != &ExecutionStatus::Running {
+                return Ok::<_, anyhow::Error>(state);
+            }
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+    .context("loop did not reach its configured history limit")??;
+    ensure!(
+        began.elapsed() < Duration::from_secs(20),
+        "late exhaustion result"
+    );
+    ensure!(
+        result.status() == &ExecutionStatus::Failed
+            && result.error() == Some("States.HistoryLimitExceeded"),
+        "loop did not fail at history bound"
+    );
+    let history = bounded(
+        client
+            .get_execution_history()
+            .execution_arn(&arn)
+            .reverse_order(true)
+            .include_execution_data(false)
+            .max_results(1)
+            .send(),
+    )
+    .await?;
+    let event = history
+        .events()
+        .first()
+        .context("missing reserved terminal event")?;
+    ensure!(
+        event.r#type() == &HistoryEventType::ExecutionFailed && (5..=25_000).contains(&event.id()),
+        "invalid bounded terminal history"
+    );
+    ensure!(
+        event
+            .execution_failed_event_details()
+            .and_then(|details| details.error())
+            == Some("States.HistoryLimitExceeded"),
+        "terminal history disagrees with outcome"
+    );
+    probes.check()?;
+    Ok((event.id(), probes))
+}
+pub(super) async fn measure(client: &Client, server: &Server) -> Result<Measurement> {
+    let definition = json!({"StartAt":"Choose","States":{
+        "Choose":{"Type":"Choice","Choices":[{"Variable":"$.halt","IsPresent":true,"Next":"Done"}],"Default":"Loop"},
+        "Loop":{"Type":"Pass","Next":"Choose"},
+        "Done":{"Type":"Succeed"}
+    }});
+    let machine = bounded(create(client, "Loop", &definition)).await?;
+    let input = input();
+    let (history_event_high_water, exhaustion) = exhaust(client, server, &machine, &input).await?;
+    let mut readiness = Vec::with_capacity(SAMPLES);
+    let mut stop = Vec::with_capacity(SAMPLES);
+    for index in 0..SAMPLES {
+        let arn = start(client, &machine, format!("Stop{index}"), &input).await?;
+        live_history(client, &arn).await?;
+        let began = Instant::now();
+        server.readiness().await?;
+        readiness.push(micros(began.elapsed())?);
+        let began = Instant::now();
+        let state = bounded(Box::pin(async {
+            client
+                .stop_execution()
+                .execution_arn(&arn)
+                .error("Performance.Stop")
+                .cause("fixed synthetic workload")
+                .send()
+                .await?;
+            latency::terminal(client, &arn).await
+        }))
+        .await?;
+        stop.push(micros(began.elapsed())?);
+        ensure!(
+            state.status() == &ExecutionStatus::Aborted
+                && state.error() == Some("Performance.Stop")
+                && state.input() == Some(input.as_str()),
+            "Stop did not abort the live loop"
+        );
+    }
+    server.readiness().await?;
+    Ok(Measurement::LoopResponsiveness {
+        open_execution_slots: 1,
+        completed_cycles: SAMPLES,
+        input_bytes: input.len(),
+        history_event_high_water,
+        exhaustion,
+        readiness: Samples::new(readiness)?,
+        stop: Samples::new(stop)?,
+    })
+}
diff --git a/apps/rustack/tests/workflows_sdk/performance/tests.rs b/apps/rustack/tests/workflows_sdk/performance/tests.rs
new file mode 100644
index 00000000..88750eba
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/performance/tests.rs
@@ -0,0 +1,180 @@
+//! Independent rank and microsecond-boundary controls for measurement reports.
+
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use aws_sdk_sfn::{
+    primitives::DateTime,
+    types::{
+        ExecutionStatus, HistoryEvent, HistoryEventType,
+        HistoryEventType::{
+            ChoiceStateEntered, ChoiceStateExited, PassStateEntered, PassStateExited,
+            SucceedStateEntered, SucceedStateExited,
+        },
+        StateEnteredEventDetails, StateExitedEventDetails,
+        builders::HistoryEventBuilder,
+    },
+};
+
+use super::{SAMPLES, Samples, latency::validate_history, load::ExhaustionProbes, micros};
+
+#[test]
+fn test_should_use_exact_nearest_ranks_and_preserve_sample_order() -> Result<()> {
+    let original: Vec<u64> = (1..=100).rev().collect();
+    let samples = Samples::new(original.clone())?;
+    assert_eq!(samples.observed_micros, original);
+    assert_eq!(
+        (samples.p50_micros, samples.p95_micros, samples.max_micros),
+        (50, 95, 100)
+    );
+    assert!(Samples::new(vec![1; 99]).is_err());
+    assert!(Samples::new(vec![1; 101]).is_err());
+    Ok(())
+}
+#[test]
+fn test_should_round_up_and_enforce_exact_p95_budget() -> Result<()> {
+    assert_eq!(micros(Duration::from_nanos(1))?, 1);
+    assert_eq!(micros(Duration::from_nanos(999))?, 1);
+    assert_eq!(micros(Duration::from_nanos(1000))?, 1);
+    assert_eq!(micros(Duration::from_nanos(1001))?, 2);
+    assert!(micros(Duration::MAX).is_err());
+    let mut values = vec![100_000; SAMPLES];
+    Samples::new(values.clone())?.check_p95(100_000)?;
+    for value in values.iter_mut().take(5) {
+        *value = 100_001;
+    }
+    Samples::new(values.clone())?.check_p95(100_000)?;
+    *values
+        .get_mut(5)
+        .ok_or_else(|| anyhow::anyhow!("missing sixth sample"))? = 100_001;
+    assert!(Samples::new(values)?.check_p95(100_000).is_err());
+    Ok(())
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_ready_results_at_the_expired_observation_boundary() -> Result<()> {
+    let error = super::bounded(async {
+        tokio::time::advance(super::OPERATION_BUDGET).await;
+        Ok::<_, anyhow::Error>(())
+    })
+    .await
+    .err()
+    .ok_or_else(|| anyhow::anyhow!("accepted late ready result"))?;
+    assert!(error.to_string().contains("late workload result"));
+    super::bounded(async { Ok::<_, anyhow::Error>(()) }).await?;
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_exhaustion_readiness_at_the_two_second_boundary() -> Result<()> {
+    for worst in [1_999_999, 2_000_000, 2_000_001] {
+        let mut measured = ExhaustionProbes::default();
+        measured.record(&ExecutionStatus::Running, &ExecutionStatus::Running, worst)?;
+        assert_eq!(measured.check().is_ok(), worst < 2_000_000);
+    }
+    Ok(())
+}
+
+fn event(kind: HistoryEventType, history: &[HistoryEvent]) -> Result<HistoryEventBuilder> {
+    let previous = i64::try_from(history.len())?;
+    Ok(HistoryEvent::builder()
+        .timestamp(DateTime::from_secs(0))
+        .r#type(kind)
+        .id(previous.checked_add(1).context("event ID overflow")?)
+        .previous_event_id(if history.len() == 1 { 0 } else { previous }))
+}
+fn complete_history() -> Result<Vec<HistoryEvent>> {
+    let mut events = Vec::new();
+    events.push(event(HistoryEventType::ExecutionStarted, &events)?.build()?);
+    let alternating = [
+        (PassStateEntered, PassStateExited),
+        (ChoiceStateEntered, ChoiceStateExited),
+    ];
+    let states = alternating.into_iter().cycle().take(48).chain([
+        (PassStateEntered, PassStateExited),
+        (SucceedStateEntered, SucceedStateExited),
+    ]);
+    for (index, (entered, exited)) in states.enumerate() {
+        let name = format!("S{index:02}");
+        events.push(
+            event(entered, &events)?
+                .state_entered_event_details(
+                    StateEnteredEventDetails::builder().name(&name).build()?,
+                )
+                .build()?,
+        );
+        events.push(
+            event(exited, &events)?
+                .state_exited_event_details(StateExitedEventDetails::builder().name(name).build()?)
+                .build()?,
+        );
+    }
+    events.push(event(HistoryEventType::ExecutionSucceeded, &events)?.build()?);
+    Ok(events)
+}
+#[test]
+fn test_should_reject_broken_predecessors_and_wrong_or_missing_state_exits() -> Result<()> {
+    let complete = complete_history()?;
+    validate_history(&complete)?;
+    for mutation in [
+        "predecessor",
+        "root-predecessor",
+        "missing-exit",
+        "exit-kind",
+        "exit-name",
+        "first",
+        "last",
+    ] {
+        let mut broken = complete.clone();
+        match mutation {
+            "root-predecessor" => {
+                broken
+                    .get_mut(1)
+                    .context("missing first state entry")?
+                    .previous_event_id = 1;
+            }
+            "predecessor" => {
+                broken
+                    .get_mut(50)
+                    .context("missing causal event")?
+                    .previous_event_id = 0;
+            }
+            "missing-exit" => broken.retain(|event| event.id() != 3),
+            "exit-kind" => {
+                broken.get_mut(2).context("missing exit")?.r#type =
+                    HistoryEventType::ChoiceStateExited;
+            }
+            "exit-name" => {
+                broken
+                    .get_mut(2)
+                    .context("missing exit")?
+                    .state_exited_event_details
+                    .as_mut()
+                    .context("missing exit details")?
+                    .name = "Wrong".to_owned();
+            }
+            "first" => {
+                broken.first_mut().context("missing first")?.r#type =
+                    HistoryEventType::ExecutionFailed;
+            }
+            "last" => {
+                broken.last_mut().context("missing last")?.r#type =
+                    HistoryEventType::ExecutionFailed;
+            }
+            _ => anyhow::bail!("unknown mutation"),
+        }
+        assert!(validate_history(&broken).is_err(), "accepted {mutation}");
+    }
+    Ok(())
+}
+
+#[test]
+fn test_should_refuse_post_terminal_probes_as_live_load_evidence() -> Result<()> {
+    let mut probes = ExhaustionProbes::default();
+    probes.record(&ExecutionStatus::Failed, &ExecutionStatus::Failed, 1)?;
+    assert!(probes.check().is_err());
+    probes.record(&ExecutionStatus::Running, &ExecutionStatus::Failed, 1)?;
+    assert!(probes.check().is_err());
+    probes.record(&ExecutionStatus::Running, &ExecutionStatus::Running, 1)?;
+    probes.check()
+}
diff --git a/apps/rustack/tests/workflows_sdk/persistence.rs b/apps/rustack/tests/workflows_sdk/persistence.rs
new file mode 100644
index 00000000..9a0a7709
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/persistence.rs
@@ -0,0 +1,687 @@
+//! Real named binary generations, fresh handle epochs and zero side-effect replay.
+
+use std::{collections::BTreeMap, fmt, io::Read, path::Path, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use aws_sdk_lambda::{
+    Client as Lambda,
+    primitives::Blob,
+    types::{Architecture, Environment, FunctionCode, Runtime},
+};
+use aws_sdk_sfn::{
+    Client,
+    error::ProvideErrorMetadata,
+    types::{ExecutionStatus, HistoryEvent, Tag},
+};
+use rustack_stepfunctions_core::CallbackToken;
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::{
+    fs,
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::TcpListener,
+    task::JoinHandle,
+    time::{Instant, sleep, timeout_at},
+};
+
+use super::{
+    process::{SECRET, Server},
+    rust::{archive, create, history, lambda, sfn, terminal},
+};
+
+const ROLE: &str = "arn:aws:iam::000000000000:role/Workflows";
+const UPDATED_ROLE: &str = "arn:aws:iam::000000000000:role/Updated";
+
+#[derive(Debug)]
+struct EvidenceDirectory {
+    directory: Option<TempDir>,
+}
+impl EvidenceDirectory {
+    fn path(&self) -> Result<&Path> {
+        Ok(self
+            .directory
+            .as_ref()
+            .context("missing owned restart directory")?
+            .path())
+    }
+}
+impl Drop for EvidenceDirectory {
+    fn drop(&mut self) {
+        if let Some(directory) = self.directory.take() {
+            eprintln!(
+                "restart evidence retained at {}",
+                directory.keep().display()
+            );
+        }
+    }
+}
+#[derive(Debug)]
+struct Collector {
+    port: u16,
+    join: Option<JoinHandle<Result<CallbackToken>>>,
+}
+impl Collector {
+    async fn start() -> Result<Self> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let port = listener.local_addr()?.port();
+        let join = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await?;
+            let mut headers = Vec::new();
+            while !headers.ends_with(b"\r\n\r\n") {
+                ensure!(headers.len() < 4096, "oversized local collector header");
+                headers.push(stream.read_u8().await?);
+            }
+            let headers = String::from_utf8(headers)?;
+            let length = headers
+                .lines()
+                .filter_map(|line| line.split_once(':'))
+                .find(|(name, _)| name.eq_ignore_ascii_case("content-length"))
+                .context("collector request length")?
+                .1
+                .trim()
+                .parse::<usize>()?;
+            ensure!(length == 64, "invalid local token length");
+            let mut body = vec![0; length];
+            stream.read_exact(&mut body).await?;
+            let token = CallbackToken::try_from(String::from_utf8(body)?)?;
+            stream
+                .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n")
+                .await?;
+            stream.shutdown().await?;
+            Ok(token)
+        });
+        Ok(Self {
+            port,
+            join: Some(join),
+        })
+    }
+    async fn token(&mut self) -> Result<CallbackToken> {
+        let result = timeout_at(
+            deadline(),
+            self.join.as_mut().context("collector already consumed")?,
+        )
+        .await?;
+        self.join = None;
+        result?
+    }
+    async fn close(&mut self) -> Result<()> {
+        if let Some(join) = &mut self.join {
+            join.abort();
+            let result = timeout_at(deadline(), join).await?;
+            self.join = None;
+            if let Err(error) = result {
+                ensure!(error.is_cancelled(), "collector worker panicked");
+            }
+        }
+        Ok(())
+    }
+}
+impl Drop for Collector {
+    fn drop(&mut self) {
+        if let Some(join) = &self.join {
+            join.abort();
+        }
+    }
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(40)
+}
+async fn deploy(server: &Server, root: &Path, collector: &Collector) -> Result<()> {
+    let bytes = fs::read(server.bootstrap()?).await?;
+    let zip = tokio::task::spawn_blocking(move || archive(&bytes)).await??;
+    fs::create_dir_all(root.join("invocations")).await?;
+    let client: Lambda = lambda(server);
+    for name in ["RestartCompute", "RestartToken", "RestartRetry"] {
+        let callback = name == "RestartToken";
+        let mut environment = Environment::builder()
+            .variables("WORKFLOW_MODE", "1")
+            .variables(
+                "PROCESS_MARKER_DIR",
+                server.markers.to_str().context("PID marker path")?,
+            );
+        if callback {
+            environment = environment.variables("WORKFLOW_TOKEN_PORT", collector.port.to_string());
+        } else {
+            environment = environment.variables(
+                "WORKFLOW_INVOCATION_DIR",
+                root.join("invocations")
+                    .to_str()
+                    .context("invocation marker path")?,
+            );
+        }
+        if name == "RestartRetry" {
+            environment = environment.variables("WORKFLOW_FAIL_ONCE", "1");
+        }
+        client
+            .create_function()
+            .function_name(name)
+            .role(ROLE)
+            .runtime(Runtime::Providedal2023)
+            .handler("bootstrap")
+            .architectures(if cfg!(target_arch = "aarch64") {
+                Architecture::Arm64
+            } else {
+                Architecture::X8664
+            })
+            .timeout(10)
+            .environment(environment.build())
+            .code(
+                FunctionCode::builder()
+                    .zip_file(Blob::new(zip.clone()))
+                    .build(),
+            )
+            .send()
+            .await?;
+    }
+    Ok(())
+}
+fn pass(value: i64) -> Value {
+    json!({"StartAt":"P","States":{"P":{"Type":"Pass","Result":value,"End":true}}})
+}
+async fn start(client: &Client, machine: &str, name: &str, input: &str) -> Result<String> {
+    Ok(client
+        .start_execution()
+        .state_machine_arn(machine)
+        .name(name)
+        .input(input)
+        .send()
+        .await?
+        .execution_arn()
+        .to_owned())
+}
+struct Saved {
+    pure: String,
+    pure_run: String,
+    compute: String,
+    compute_run: String,
+    waiting: String,
+    callback: String,
+    interrupted: Vec<String>,
+    old_page: String,
+    token: CallbackToken,
+    output: String,
+    events: Vec<HistoryEvent>,
+    definition: String,
+    current_definition: String,
+}
+impl fmt::Debug for Saved {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SavedRestartEvidence(<redacted>)")
+    }
+}
+async fn seed(server: &Server, root: &Path, collector: &mut Collector) -> Result<Saved> {
+    deploy(server, root, collector).await?;
+    let client = sfn(server, SECRET);
+    let definition = pass(7).to_string();
+    let pure = create(&client, "RestartPure", &pass(7)).await?;
+    let pure_run = start(&client, &pure, "old", " {\"raw\":1}\n").await?;
+    ensure!(
+        terminal(&client, &pure_run).await?.output() == Some("7"),
+        "pure source did not execute"
+    );
+    let current_definition = pass(8).to_string();
+    client
+        .update_state_machine()
+        .state_machine_arn(&pure)
+        .definition(&current_definition)
+        .role_arn(UPDATED_ROLE)
+        .send()
+        .await?;
+    client
+        .tag_resource()
+        .resource_arn(&pure)
+        .tags(Tag::builder().key("purpose").value("snapshot").build())
+        .send()
+        .await?;
+    let compute = create(&client, "RestartCompute", &json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"RestartCompute","Payload.$":"$"},"End":true}}})).await?;
+    let compute_run = start(&client, &compute, "old", "{\"n\":21}").await?;
+    let completed = terminal(&client, &compute_run).await?;
+    let output = completed
+        .output()
+        .context("missing source Native output")?
+        .to_owned();
+    ensure!(
+        serde_json::from_str::<Value>(&output)?.pointer("/Payload/computed") == Some(&json!(42)),
+        "source Native computation missing"
+    );
+    let events = history(&client, &compute_run, false, true).await?;
+    let wait = create(
+        &client,
+        "RestartWait",
+        &json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":600,"Next":"After"},"After":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"RestartCompute","Payload":{"n":999}},"End":true}}}),
+    )
+    .await?;
+    let waiting = start(&client, &wait, "pending", "{}").await?;
+    entered(&client, &waiting, "WaitStateEntered").await?;
+    let callback_machine = create(&client, "RestartCallback", &json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","Parameters":{"FunctionName":"RestartToken","Payload":{"token.$":"$$.Task.Token","n":21}},"Next":"After"},"After":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"RestartCompute","Payload":{"n":999}},"End":true}}})).await?;
+    let callback = start(&client, &callback_machine, "pending", "{}").await?;
+    let token = collector.token().await?;
+    client
+        .send_task_heartbeat()
+        .task_token(token.expose())
+        .send()
+        .await?;
+    let interrupted = structured_pending(&client, &wait, &waiting).await?;
+    let page = client.list_state_machines().max_results(1).send().await?;
+    let old_page = page
+        .next_token()
+        .context("missing source page handle")?
+        .to_owned();
+    Ok(Saved {
+        pure,
+        pure_run,
+        compute,
+        compute_run,
+        waiting,
+        callback,
+        interrupted,
+        old_page,
+        token,
+        output,
+        events,
+        definition,
+        current_definition,
+    })
+}
+async fn structured_pending(client: &Client, wait: &str, waiting: &str) -> Result<Vec<String>> {
+    let retry = create(client, "RestartRetry", &json!({"StartAt":"T","States":{
+        "T":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke",
+             "Parameters":{"FunctionName":"RestartRetry","Payload":{"n":21}},
+             "Retry":[{"ErrorEquals":["States.ALL"],"IntervalSeconds":600,"MaxAttempts":2}],"Next":"After"},"After":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"RestartCompute","Payload":{"n":999}},"End":true}}})).await?;
+    let retry_run = start(client, &retry, "pending", "{}").await?;
+    entered(client, &retry_run, "TaskFailed").await?;
+    let map = create(client, "RestartMap", &json!({"StartAt":"M","States":{
+        "M":{"Type":"Map","ItemsPath":"$","Iterator":{"StartAt":"W","States":{
+            "W":{"Type":"Wait","Seconds":600,"Next":"After"},"After":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"RestartCompute","Payload":{"n":999}},"End":true}}},"End":true}}})).await?;
+    let map_run = start(client, &map, "pending", "[1,2]").await?;
+    entered(client, &map_run, "MapIterationStarted").await?;
+    entered(client, &map_run, "WaitStateEntered").await?;
+    let nested = create(client, "RestartSync", &json!({"StartAt":"T","States":{
+        "T":{"Type":"Task","Resource":"arn:aws:states:::states:startExecution.sync:2",
+             "Parameters":{"StateMachineArn":wait,"Input":{}},"Next":"After"},"After":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"RestartCompute","Payload":{"n":999}},"End":true}}})).await?;
+    let nested_run = start(client, &nested, "pending", "{}").await?;
+    // The child registry, not a timer, proves the owned child was created.
+    let child_run = timeout_at(deadline(), async {
+        loop {
+            let children = client
+                .list_executions()
+                .state_machine_arn(wait)
+                .send()
+                .await?;
+            if let Some(child) = children
+                .executions()
+                .iter()
+                .find(|entry| entry.execution_arn() != waiting)
+            {
+                let arn = child.execution_arn().to_owned();
+                entered(client, &arn, "WaitStateEntered").await?;
+                return Ok::<_, anyhow::Error>(arn);
+            }
+            sleep(Duration::from_millis(25)).await;
+        }
+    })
+    .await
+    .context("owned nested child did not enter")??;
+    Ok(vec![retry_run, map_run, nested_run, child_run])
+}
+async fn entered(client: &Client, arn: &str, kind: &str) -> Result<()> {
+    timeout_at(deadline(), async {
+        loop {
+            let events = history(client, arn, false, true).await?;
+            if events.iter().any(|event| event.r#type().as_str() == kind) {
+                return Ok::<(), anyhow::Error>(());
+            }
+            ensure!(
+                events.last().is_none_or(|event| !matches!(
+                    event.r#type().as_str(),
+                    "ExecutionSucceeded"
+                        | "ExecutionFailed"
+                        | "ExecutionAborted"
+                        | "ExecutionTimedOut"
+                )),
+                "execution terminated before entering {kind}"
+            );
+            sleep(Duration::from_millis(25)).await;
+        }
+    })
+    .await
+    .context("pending shutdown state did not enter")?
+}
+async fn markers(root: &Path) -> Result<BTreeMap<String, Vec<u8>>> {
+    let mut entries = fs::read_dir(root.join("invocations")).await?;
+    let mut markers = BTreeMap::new();
+    while let Some(entry) = entries.next_entry().await? {
+        ensure!(
+            markers.len() < 8
+                && entry.file_type().await?.is_file()
+                && entry.metadata().await?.len() <= 1024,
+            "invalid invocation evidence"
+        );
+        markers.insert(
+            entry.file_name().to_string_lossy().into_owned(),
+            fs::read(entry.path()).await?,
+        );
+    }
+    Ok(markers)
+}
+async fn old_state(server: &Server, saved: &Saved) -> Result<()> {
+    let client = sfn(server, SECRET);
+    let old = client
+        .describe_execution()
+        .execution_arn(&saved.compute_run)
+        .send()
+        .await?;
+    ensure!(
+        old.output() == Some(saved.output.as_str()),
+        "old Native result changed or replayed"
+    );
+    ensure!(
+        history(&client, &saved.compute_run, false, true).await? == saved.events,
+        "old full Native history changed"
+    );
+    let pure = client
+        .describe_execution()
+        .execution_arn(&saved.pure_run)
+        .send()
+        .await?;
+    ensure!(
+        pure.input() == Some(" {\"raw\":1}\n") && pure.output() == Some("7"),
+        "original pure input/output changed"
+    );
+    let captured = client
+        .describe_state_machine_for_execution()
+        .execution_arn(&saved.pure_run)
+        .send()
+        .await?;
+    ensure!(
+        captured.definition() == saved.definition && captured.role_arn() == ROLE,
+        "captured revision/role changed"
+    );
+    let current = client
+        .describe_state_machine()
+        .state_machine_arn(&saved.pure)
+        .send()
+        .await?;
+    ensure!(
+        current.definition() == saved.current_definition && current.role_arn() == UPDATED_ROLE,
+        "current revision/role not restored"
+    );
+    let tags = client
+        .list_tags_for_resource()
+        .resource_arn(&saved.pure)
+        .send()
+        .await?;
+    ensure!(
+        tags.tags()
+            .iter()
+            .any(|tag| tag.key() == Some("purpose") && tag.value() == Some("snapshot")),
+        "tags not restored"
+    );
+    for arn in [&saved.waiting, &saved.callback]
+        .into_iter()
+        .chain(saved.interrupted.iter())
+    {
+        let stopped = client
+            .describe_execution()
+            .execution_arn(arn)
+            .send()
+            .await?;
+        ensure!(
+            stopped.status() == &ExecutionStatus::Aborted
+                && stopped.error() == Some("Rustack.Shutdown"),
+            "shutdown did not persist terminal interruption"
+        );
+    }
+    stale_handles(&client, saved).await
+}
+async fn stale_handles(client: &Client, saved: &Saved) -> Result<()> {
+    let duplicate = client
+        .start_execution()
+        .state_machine_arn(&saved.compute)
+        .name("old")
+        .input("{\"n\":21}")
+        .send()
+        .await
+        .err()
+        .context("lost closed execution name")?;
+    ensure!(
+        duplicate
+            .as_service_error()
+            .and_then(ProvideErrorMetadata::code)
+            == Some("ExecutionAlreadyExists"),
+        "closed name reservation changed"
+    );
+    let page = client
+        .list_state_machines()
+        .max_results(1)
+        .next_token(&saved.old_page)
+        .send()
+        .await
+        .err()
+        .context("old pagination handle survived restart")?;
+    ensure!(
+        page.as_service_error().and_then(ProvideErrorMetadata::code) == Some("InvalidToken"),
+        "old pagination handle classification changed"
+    );
+    let callback = client
+        .send_task_heartbeat()
+        .task_token(saved.token.expose())
+        .send()
+        .await
+        .err()
+        .context("old callback token survived restart")?;
+    ensure!(
+        callback
+            .as_service_error()
+            .and_then(ProvideErrorMetadata::code)
+            == Some("InvalidToken"),
+        "old callback root epoch was restored"
+    );
+    Ok(())
+}
+async fn assert_no_token_archive(root: &Path, saved: &Saved) -> Result<()> {
+    for relative in [
+        "services/stepfunctions/meta.ss.zst",
+        "services/stepfunctions/data.ss.zst",
+        "services/lambda/meta.ss.zst",
+    ] {
+        let compressed = fs::read(root.join("snapshots/restart").join(relative)).await?;
+        let mut decoded = tokio::task::spawn_blocking(move || -> Result<Vec<u8>> {
+            let decoder = zstd::stream::read::Decoder::new(compressed.as_slice())?;
+            let mut bytes = Vec::new();
+            decoder.take(16 * 1024 * 1024 + 1).read_to_end(&mut bytes)?;
+            Ok(bytes)
+        })
+        .await??;
+        ensure!(
+            decoded.len() <= 16 * 1024 * 1024,
+            "oversized fixture archive"
+        );
+        ensure!(
+            !decoded
+                .windows(saved.token.expose().len())
+                .any(|window| window == saved.token.expose().as_bytes()),
+            "callback credential persisted"
+        );
+        decoded.fill(0);
+    }
+    Ok(())
+}
+async fn reject_corruption(root: &Path, saved: &Saved) -> Result<()> {
+    let meta = root.join("snapshots/restart/services/stepfunctions/meta.ss.zst");
+    let original = fs::read(&meta).await?;
+    let mut corrupt = original.clone();
+    let first = corrupt.first_mut().context("missing workflow archive")?;
+    *first ^= 1;
+    fs::write(&meta, &corrupt).await?;
+    let manifest = fs::read(root.join("snapshots/restart/manifest.ss.zst")).await?;
+    Server::reject_named(root).await?;
+    ensure!(
+        fs::read(&meta).await? == corrupt
+            && fs::read(root.join("snapshots/restart/manifest.ss.zst")).await? == manifest,
+        "failed startup replaced the generation"
+    );
+    fs::write(&meta, original).await?;
+    assert_no_token_archive(root, saved).await?;
+    Ok(())
+}
+
+async fn graceful_snapshot(
+    source: &mut Server,
+    root: &Path,
+    saved: &Saved,
+) -> Result<BTreeMap<String, Vec<u8>>> {
+    let client = sfn(source, SECRET);
+    for arn in [&saved.waiting, &saved.callback]
+        .into_iter()
+        .chain(saved.interrupted.iter())
+    {
+        ensure!(
+            client
+                .describe_execution()
+                .execution_arn(arn)
+                .send()
+                .await?
+                .status()
+                == &ExecutionStatus::Running,
+            "shutdown fixture advanced before cutoff"
+        );
+    }
+    source.shutdown(deadline()).await?;
+    assert_no_token_archive(root, saved).await?;
+    let before = markers(root).await?;
+    ensure!(before.len() == 2, "source invocation marker count");
+    Ok(before)
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "requires actual host bootstrap; run make test-workflows-persistence"]
+async fn test_should_restart_named_native_snapshots_without_replay_and_lose_only_unsaved_work()
+-> Result<()> {
+    let mut evidence = EvidenceDirectory {
+        directory: Some(tempfile::tempdir()?),
+    };
+    let root = evidence.path()?.to_owned();
+    let mut collector = Collector::start().await?;
+    let mut source = Server::start_named(&root).await?;
+    let mut target = None;
+    let mut crashing = None;
+    let mut final_server = None;
+    let result = async {
+        let saved = seed(&source, &root, &mut collector).await?;
+        let before = graceful_snapshot(&mut source, &root, &saved).await?;
+        target = Some(Server::start_named(&root).await?);
+        let active = target.as_mut().context("missing restored server")?;
+        old_state(active, &saved).await?;
+        ensure!(
+            markers(&root).await? == before,
+            "restore replayed a physical Lambda call"
+        );
+        let client = sfn(active, SECRET);
+        let next = start(&client, &saved.compute, "after", "{\"n\":22}").await?;
+        let outcome = terminal(&client, &next).await?;
+        ensure!(
+            serde_json::from_str::<Value>(outcome.output().context("missing new result")?)?
+                .pointer("/Payload/computed")
+                == Some(&json!(44)),
+            "new restored Lambda execution failed"
+        );
+        ensure!(
+            markers(&root).await?.len() == before.len() + 1,
+            "new Lambda invocation was not observed"
+        );
+        active.shutdown(deadline()).await?;
+        let committed = fs::read(root.join("snapshots/restart/manifest.ss.zst")).await?;
+        crashing = Some(Server::start_named(&root).await?);
+        let active = crashing.as_mut().context("missing crash server")?;
+        let client = sfn(active, SECRET);
+        let unsaved = create(&client, "Unsaved", &pass(99)).await?;
+        terminal(&client, &start(&client, &unsaved, "unsaved", "{}").await?).await?;
+        active.crash(deadline()).await?;
+        ensure!(
+            fs::read(root.join("snapshots/restart/manifest.ss.zst")).await? == committed,
+            "SIGKILL wrote a new generation"
+        );
+        final_server = Some(Server::start_named(&root).await?);
+        let active = final_server.as_mut().context("missing final server")?;
+        old_state(active, &saved).await?;
+        let missing = sfn(active, SECRET)
+            .describe_state_machine()
+            .state_machine_arn(unsaved)
+            .send()
+            .await
+            .err()
+            .context("unsaved work survived SIGKILL")?;
+        ensure!(
+            missing
+                .as_service_error()
+                .and_then(ProvideErrorMetadata::code)
+                == Some("StateMachineDoesNotExist"),
+            "wrong unsaved resource error"
+        );
+        ensure!(
+            markers(&root).await?.len() == before.len() + 1,
+            "restart replayed Lambda work"
+        );
+        active.shutdown(deadline()).await?;
+        reject_corruption(&root, &saved).await?;
+        Ok(())
+    }
+    .await;
+    let one = source.shutdown(deadline()).await;
+    let two = if let Some(server) = &mut target {
+        server.shutdown(deadline()).await.map(|_| ())
+    } else {
+        Ok(())
+    };
+    let three = if let Some(server) = &mut crashing {
+        server.shutdown(deadline()).await.map(|_| ())
+    } else {
+        Ok(())
+    };
+    let four = if let Some(server) = &mut final_server {
+        server.shutdown(deadline()).await.map(|_| ())
+    } else {
+        Ok(())
+    };
+    let collected = collector.close().await;
+    one?;
+    two?;
+    three?;
+    four?;
+    collected?;
+    result?;
+    drop(evidence.directory.take());
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_close_failed_token_collector_without_repolling_completed_task() -> Result<()> {
+    for early_eof in [false, true] {
+        let mut collector = Collector::start().await?;
+        let result = async {
+            let mut client = tokio::net::TcpStream::connect(("127.0.0.1", collector.port)).await?;
+            client
+                .write_all(b"POST /token HTTP/1.1\r\nHost: localhost\r\nContent-Length: 64\r\n\r\n")
+                .await?;
+            client
+                .write_all(if early_eof { b"early EOF" } else { &[b'z'; 64] })
+                .await?;
+            client.shutdown().await?;
+            ensure!(
+                collector.token().await.is_err(),
+                "malformed token was accepted"
+            );
+            ensure!(
+                collector.join.is_none(),
+                "completed failure join was retained"
+            );
+            Ok::<(), anyhow::Error>(())
+        }
+        .await;
+        collector.close().await?;
+        result?;
+        collector.close().await?;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/tests/workflows_sdk/process.rs b/apps/rustack/tests/workflows_sdk/process.rs
new file mode 100644
index 00000000..85bc2c39
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/process.rs
@@ -0,0 +1,485 @@
+//! Retained real server ownership; all SDK observers are separate from process life.
+#![warn(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+use std::{
+    env,
+    ffi::OsString,
+    os::unix::process::ExitStatusExt,
+    path::{Path, PathBuf},
+    process::Stdio,
+    sync::Arc,
+    time::Duration,
+};
+
+use anyhow::{Context, Result, bail, ensure};
+use tempfile::TempDir;
+use tokio::{
+    fs,
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+    process::{Child, Command},
+    sync::watch,
+    task::JoinHandle,
+    time::{Instant, sleep, timeout, timeout_at},
+};
+
+use super::runner::Runner;
+
+pub(super) const ACCESS: &str = "local-key";
+pub(super) const SECRET: &str = "local-secret";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Stop {
+    Running,
+    Graceful,
+    Kill,
+}
+
+#[derive(Debug)]
+struct Resources {
+    child: Child,
+    directory: Option<TempDir>,
+    markers: PathBuf,
+    cleanup_proven: bool,
+    expect_startup_failure: bool,
+}
+#[derive(Debug)]
+struct Owner {
+    state: Option<Resources>,
+    stop: watch::Receiver<Stop>,
+}
+#[derive(Debug, Clone, Copy)]
+enum Profile {
+    Semantic,
+    Performance,
+    Pure,
+}
+impl Profile {
+    fn settings(self, dispatch: usize) -> String {
+        let limits = match self {
+            Self::Pure => {
+                return include_str!("../../../../examples/workflows/rustack.yaml").to_owned();
+            }
+            Self::Semantic => {
+                "workflowTransitions: 80\n  workflowHistoryBytes: 1048576\n  \
+                 workflowTotalHistoryBytes: 8388608"
+            }
+            Self::Performance => {
+                "workflowOpenExecutions: 1\n  workflowTransitions: 1000000\n  \
+                 workflowHistoryBytes: 33554432\n  workflowTotalHistoryBytes: 134217728"
+            }
+        };
+        format!(
+            "budgets:\n  {limits}\n  workflowDrainSeconds: 0\n  workflowDispatches: {dispatch}\n  \
+             workflowCallbackTokens: 2\n  workflowCallbackTombstones: 64\n  \
+             workflowCallbackCommands: 8\n  workflowCallbackWorkers: 1\n"
+        )
+    }
+}
+
+#[derive(Debug)]
+enum ExecutionFixture {
+    Pure,
+    Native(PathBuf),
+}
+impl ExecutionFixture {
+    fn services(&self) -> &'static str {
+        match self {
+            Self::Pure => "stepfunctions",
+            Self::Native(_) => "lambda,stepfunctions",
+        }
+    }
+    fn executor(&self) -> &'static str {
+        match self {
+            Self::Pure => "disabled",
+            Self::Native(_) => "native",
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct Server {
+    pub pid: u32,
+    pub endpoint: String,
+    pub markers: PathBuf,
+    execution: ExecutionFixture,
+    stop: watch::Sender<Stop>,
+    root: Option<JoinHandle<Result<usize>>>,
+    joined: Option<Result<usize, Arc<anyhow::Error>>>,
+}
+impl Server {
+    pub async fn capabilities(&self) -> Result<serde_json::Value> {
+        let address = self
+            .endpoint
+            .strip_prefix("http://")
+            .context("owned server endpoint")?;
+        timeout(Duration::from_secs(2),async {
+            let mut stream=TcpStream::connect(address).await?;
+            stream.write_all(b"GET /_rustack/capabilities HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n").await?;
+            let mut response=Vec::new();stream.take(16_385).read_to_end(&mut response).await?;
+            ensure!(response.len()<=16_384,"oversized capability response");
+            let text=std::str::from_utf8(&response)?;
+            ensure!(text.starts_with("HTTP/1.1 200"),"capability response failed");
+            let (_,body)=text.split_once("\r\n\r\n").context("capability envelope")?;
+            Ok(serde_json::from_str(body)?)
+        }).await.context("capability observer expired")?
+    }
+    pub async fn start() -> Result<Self> {
+        Self::start_with_dispatch(32).await
+    }
+    pub async fn start_with_dispatch(dispatch: usize) -> Result<Self> {
+        Self::start_options(dispatch, None, false, Profile::Semantic).await
+    }
+    pub fn bootstrap(&self) -> Result<&Path> {
+        match &self.execution {
+            ExecutionFixture::Native(path) => Ok(path),
+            ExecutionFixture::Pure => bail!("pure fixture has no Lambda bootstrap"),
+        }
+    }
+    pub async fn start_pure() -> Result<Self> {
+        Self::start_options(1, None, false, Profile::Pure).await
+    }
+    pub async fn start_performance() -> Result<Self> {
+        Self::start_options(1, None, false, Profile::Performance).await
+    }
+    pub async fn readiness(&self) -> Result<()> {
+        let address = self
+            .endpoint
+            .strip_prefix("http://")
+            .context("owned server endpoint")?;
+        let began = Instant::now();
+        let result = timeout(Duration::from_secs(2), health(address))
+            .await
+            .context("readiness observation expired")?;
+        ensure!(
+            began.elapsed() < Duration::from_secs(2),
+            "late readiness result"
+        );
+        result
+    }
+    pub async fn start_named(root: &Path) -> Result<Self> {
+        Self::start_options(32, Some(root), false, Profile::Semantic).await
+    }
+    pub async fn reject_named(root: &Path) -> Result<()> {
+        let mut server = Self::start_options(32, Some(root), true, Profile::Semantic).await?;
+        server
+            .observe(Instant::now() + Duration::from_secs(40))
+            .await?;
+        let address = server
+            .endpoint
+            .strip_prefix("http://")
+            .context("owned endpoint")?;
+        ensure!(
+            TcpStream::connect(address).await.is_err(),
+            "rejected startup opened a listener"
+        );
+        Ok(())
+    }
+    async fn start_options(
+        dispatch: usize,
+        named: Option<&Path>,
+        expect_startup_failure: bool,
+        profile: Profile,
+    ) -> Result<Self> {
+        ensure!(
+            (1..=32).contains(&dispatch),
+            "invalid fixture dispatch capacity"
+        );
+        let execution = if matches!(profile, Profile::Pure | Profile::Performance) {
+            ExecutionFixture::Pure
+        } else {
+            let bootstrap = PathBuf::from(
+                env::var_os("RUSTACK_WORKFLOWS_BOOTSTRAP")
+                    .context("run make test-stepfunctions-sdk")?,
+            );
+            ensure!(
+                (1..=32 * 1024 * 1024).contains(&fs::metadata(&bootstrap).await?.len()),
+                "invalid bootstrap size"
+            );
+            ExecutionFixture::Native(bootstrap)
+        };
+        let directory = tempfile::tempdir()?;
+        let fixture_root = named.unwrap_or_else(|| directory.path());
+        let markers = fixture_root.join("processes");
+        for path in [
+            &markers,
+            &fixture_root.join("gates"),
+            &fixture_root.join("callbacks"),
+            &fixture_root.join("callback-gates"),
+        ] {
+            fs::create_dir_all(path).await?;
+        }
+        let config = directory.path().join("rustack.yaml");
+        fs::write(&config, profile.settings(dispatch)).await?;
+        let reservation = TcpListener::bind("127.0.0.1:0").await?;
+        let address = reservation.local_addr()?;
+        drop(reservation);
+        let mut command = Command::new(env!("CARGO_BIN_EXE_rustack"));
+        command.env_clear();
+        if let Some(named) = named {
+            command.args(["--snapshot", "restart"]);
+            command.env("RUSTACK_SNAPSHOT_DIR", named.join("snapshots"));
+        }
+        let child = command
+            .env("TMPDIR", directory.path())
+            .env("RUSTACK_CONFIG", &config)
+            .env("GATEWAY_LISTEN", address.to_string())
+            .env("SERVICES", execution.services())
+            .env("LAMBDA_EXECUTOR", execution.executor())
+            .env("LAMBDA_SKIP_SIGNATURE_VALIDATION", "false")
+            .env("STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION", "false")
+            .env("ACCESS_KEY", ACCESS)
+            .env("SECRET_KEY", SECRET)
+            .env("LOG_LEVEL", "error")
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(if expect_startup_failure {
+                Stdio::piped()
+            } else {
+                Stdio::null()
+            })
+            .kill_on_drop(true)
+            .spawn()
+            .context("spawn actual Rustack binary")?;
+        let pid = child.id().context("owned server PID")?;
+        let (stop, receiver) = watch::channel(Stop::Running);
+        let owner = Owner {
+            state: Some(Resources {
+                child,
+                directory: Some(directory),
+                markers: markers.clone(),
+                cleanup_proven: false,
+                expect_startup_failure,
+            }),
+            stop: receiver,
+        };
+        let mut server = Self {
+            pid,
+            endpoint: format!("http://{address}"),
+            markers,
+            execution,
+            stop,
+            root: Some(tokio::spawn(owner.run())),
+            joined: None,
+        };
+        if expect_startup_failure {
+            return Ok(server);
+        }
+        let ready = server.await_ready(&address.to_string()).await;
+        if let Err(error) = ready {
+            let cleanup = server
+                .shutdown(Instant::now() + Duration::from_secs(40))
+                .await;
+            cleanup?;
+            return Err(error);
+        }
+        Ok(server)
+    }
+    async fn await_ready(&self, address: &str) -> Result<()> {
+        timeout(Duration::from_secs(20), async {
+            loop {
+                ensure!(
+                    !self.root.as_ref().is_none_or(JoinHandle::is_finished),
+                    "server exited before readiness"
+                );
+                if let Ok(Ok(())) = timeout(Duration::from_secs(1), health(address)).await {
+                    return Ok(());
+                }
+                sleep(Duration::from_millis(25)).await;
+            }
+        })
+        .await
+        .context("server startup deadline")?
+    }
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<usize> {
+        if *self.stop.borrow() == Stop::Running {
+            self.stop.send_replace(Stop::Graceful);
+        }
+        self.observe(deadline).await
+    }
+    pub async fn crash(&mut self, deadline: Instant) -> Result<usize> {
+        self.stop.send_replace(Stop::Kill);
+        self.observe(deadline).await
+    }
+    async fn observe(&mut self, deadline: Instant) -> Result<usize> {
+        if self.joined.is_none() {
+            let root = self.root.as_mut().context("missing retained server root")?;
+            let result = timeout_at(deadline, root)
+                .await
+                .context("server shutdown observer expired; root retained")?;
+            self.root = None;
+            self.joined = Some(match result {
+                Ok(result) => result.map_err(Arc::new),
+                Err(error) => Err(Arc::new(error.into())),
+            });
+        }
+        match &self.joined {
+            Some(Ok(observed)) => Ok(*observed),
+            Some(Err(error)) => bail!("server cleanup failed: {error:#}"),
+            None => bail!("missing server outcome"),
+        }
+    }
+}
+impl Drop for Server {
+    fn drop(&mut self) {
+        if *self.stop.borrow() == Stop::Running {
+            self.stop.send_replace(Stop::Graceful);
+        }
+        // Intentional independent root: an SDK/cleanup observer does not own it.
+        // Its Drop guard preserves files if the Tokio runtime itself is lost.
+        if let Some(root) = self.root.take() {
+            drop(root);
+        }
+    }
+}
+impl Owner {
+    async fn run(mut self) -> Result<usize> {
+        let state = self.state.as_mut().context("missing owned server state")?;
+        let mut gate_failure = None;
+        let status = tokio::select! {
+            result = state.child.wait() => {
+                let status = result?;
+                ensure!(*self.stop.borrow() != Stop::Running || state.expect_startup_failure, "server exited without requested shutdown");
+                status
+            },
+            _ = self.stop.changed() => {
+                if *self.stop.borrow() == Stop::Graceful {
+                    if let Err(error)=release_fixture_gates(&state.markers).await {gate_failure=Some(error);}
+                }
+                let pid = state.child.id().context("missing owned server PID")?;
+                let signal=Runner::spawn(Path::new("/bin/kill"), &[OsString::from(if *self.stop.borrow() == Stop::Kill {"-KILL"} else {"-TERM"}), OsString::from(pid.to_string())])?
+                    .wait(Instant::now()+Duration::from_secs(5)).await?;
+                ensure!(!signal.forced && signal.status.success(), "cannot signal owned server");
+                if let Ok(status) = timeout(Duration::from_secs(35), state.child.wait()).await { status? } else {
+                        state.child.start_kill()?;
+                        let _reaped = timeout(Duration::from_secs(5), state.child.wait()).await;
+                        bail!("server required forced termination; ownership evidence retained");
+                }
+            }
+        };
+        if state.expect_startup_failure {
+            ensure!(
+                !status.success(),
+                "invalid archive startup unexpectedly succeeded"
+            );
+            let stderr = state
+                .child
+                .stderr
+                .take()
+                .context("missing startup rejection diagnostic")?;
+            let mut diagnostic = Vec::new();
+            timeout(
+                Duration::from_secs(2),
+                stderr.take(16_385).read_to_end(&mut diagnostic),
+            )
+            .await??;
+            ensure!(
+                diagnostic.len() <= 16_384
+                    && String::from_utf8_lossy(&diagnostic).contains("snapshot transaction failed"),
+                "startup did not reject the workflow snapshot"
+            );
+        } else if *self.stop.borrow() == Stop::Kill {
+            ensure!(
+                status.signal() == Some(9),
+                "SIGKILL did not interrupt the server"
+            );
+        } else {
+            ensure!(status.success(), "server coordinated shutdown failed");
+        }
+        let observed = timeout(Duration::from_secs(10), verify_absent(&state.markers))
+            .await
+            .context("PID evidence deadline")??;
+        state.cleanup_proven = true;
+        if let Some(error) = gate_failure {
+            return Err(error.context("fixture gates failed after coordinated process cleanup"));
+        }
+        self.state = None;
+        Ok(observed)
+    }
+}
+async fn release_fixture_gates(markers: &Path) -> Result<()> {
+    let root = markers.parent().context("owned fixture directory")?;
+    timeout(
+        Duration::from_secs(2),
+        fs::write(root.join("callback-gates/all.release"), b"cleanup"),
+    )
+    .await??;
+    Ok(())
+}
+impl Drop for Owner {
+    fn drop(&mut self) {
+        if let Some(state) = &mut self.state {
+            if let Some(directory) = state.directory.take() {
+                let path = directory.keep();
+                let reason = if state.cleanup_proven {
+                    "SDK qualification failed after proven process cleanup"
+                } else {
+                    "SDK cleanup was not proven"
+                };
+                eprintln!("{reason}; retained evidence at {}", path.display());
+            }
+        }
+    }
+}
+async fn verify_absent(markers: &Path) -> Result<usize> {
+    let mut entries = fs::read_dir(markers).await?;
+    let mut count = 0;
+    while let Some(entry) = entries.next_entry().await? {
+        count += 1;
+        ensure!(
+            count <= 64 && entry.file_type().await?.is_file(),
+            "invalid PID evidence collection"
+        );
+        ensure!(
+            entry.metadata().await?.len() <= 11,
+            "oversized PID evidence"
+        );
+        let raw = fs::read_to_string(entry.path()).await?;
+        let pid: u32 = raw.parse()?;
+        ensure!(
+            pid > 1 && entry.file_name() == format!("pid-{pid}").as_str(),
+            "invalid PID identity"
+        );
+        assert_absent(pid).await?;
+    }
+    Ok(count)
+}
+async fn health(address: &str) -> Result<()> {
+    let mut stream = TcpStream::connect(address).await?;
+    stream
+        .write_all(b"GET /_health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
+        .await?;
+    let mut response = Vec::new();
+    stream.take(16_385).read_to_end(&mut response).await?;
+    ensure!(response.len() <= 16_384, "oversized health response");
+    let text = std::str::from_utf8(&response)?;
+    let (_, body) = text.split_once("\r\n\r\n").context("health envelope")?;
+    let value: serde_json::Value = serde_json::from_str(body)?;
+    ensure!(
+        text.starts_with("HTTP/1.1 200")
+            && value.get("ready") == Some(&serde_json::Value::Bool(true)),
+        "server not ready"
+    );
+    Ok(())
+}
+
+pub(super) async fn assert_absent(pid: u32) -> Result<()> {
+    let probe = Runner::spawn(
+        Path::new("/bin/kill"),
+        &[OsString::from("-0"), OsString::from(pid.to_string())],
+    )?
+    .wait(Instant::now() + Duration::from_secs(3))
+    .await?;
+    ensure!(
+        !probe.forced
+            && !probe.status.success()
+            && String::from_utf8_lossy(&probe.stderr).contains("No such process"),
+        "fixture PID absence was not proven"
+    );
+    Ok(())
+}
diff --git a/apps/rustack/tests/workflows_sdk/runner.rs b/apps/rustack/tests/workflows_sdk/runner.rs
new file mode 100644
index 00000000..882cb693
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/runner.rs
@@ -0,0 +1,136 @@
+//! Direct child ownership with bounded output and joined timeout cleanup.
+
+use std::{
+    env,
+    ffi::OsString,
+    path::{Path, PathBuf},
+    process::{ExitStatus, Stdio},
+};
+
+use anyhow::{Context, Result, ensure};
+use tokio::{
+    io::{AsyncRead, AsyncReadExt},
+    process::{Child, Command},
+    time::{Duration, Instant, timeout, timeout_at},
+};
+
+#[derive(Debug)]
+pub(super) struct Runner {
+    child: Child,
+}
+#[derive(Debug)]
+pub(super) struct Report {
+    pub pid: u32,
+    pub forced: bool,
+    pub status: ExitStatus,
+    pub stdout: Vec<u8>,
+    pub stderr: Vec<u8>,
+}
+pub(super) fn interpreter() -> Result<PathBuf> {
+    let value = PathBuf::from(
+        env::var_os("RUSTACK_WORKFLOWS_PYTHON")
+            .context("run make test-stepfunctions-sdk to provision pinned Python")?,
+    );
+    ensure!(
+        value.is_absolute(),
+        "missing absolute pinned Python executable"
+    );
+    Ok(value)
+}
+impl Runner {
+    pub fn spawn(program: &Path, arguments: &[OsString]) -> Result<Self> {
+        let child = Command::new(program)
+            .args(arguments)
+            .env_clear()
+            .env("PYTHONDONTWRITEBYTECODE", "1")
+            .env("AWS_EC2_METADATA_DISABLED", "true")
+            .env("LC_ALL", "C")
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .kill_on_drop(true)
+            .spawn()
+            .context("spawn directly owned fixture process")?;
+        Ok(Self { child })
+    }
+    pub async fn await_pid(&mut self) -> Result<u32> {
+        self.await_pid_before(Instant::now() + Duration::from_secs(5))
+            .await
+    }
+    pub async fn await_pid_before(&mut self, deadline: Instant) -> Result<u32> {
+        ensure!(
+            Instant::now() < deadline,
+            "PID barrier deadline already expired"
+        );
+        let expected = self.child.id().context("owned Python PID")?;
+        let observed = timeout_at(deadline, async {
+            let output = self.child.stdout.as_mut().context("PID barrier stdout")?;
+            let mut text = Vec::new();
+            loop {
+                let byte = output.read_u8().await?;
+                if byte == b'\n' {
+                    break;
+                }
+                ensure!(text.len() < 16, "oversized PID barrier");
+                text.push(byte);
+            }
+            let observed: u32 = std::str::from_utf8(&text)?.parse()?;
+            ensure!(
+                observed == expected,
+                "Python PID differs from directly owned child"
+            );
+            Ok(observed)
+        })
+        .await
+        .context("Python execution barrier deadline")??;
+        ensure!(Instant::now() < deadline, "late PID barrier observation");
+        Ok(observed)
+    }
+    pub async fn wait(mut self, deadline: Instant) -> Result<Report> {
+        let pid = self.child.id().context("owned Python PID")?;
+        let stdout = self.child.stdout.take().context("Python stdout")?;
+        let stderr = self.child.stderr.take().context("Python stderr")?;
+        let (status, stdout, stderr) = tokio::join!(
+            wait_child(&mut self.child, deadline),
+            capture(stdout, deadline + Duration::from_secs(10)),
+            capture(stderr, deadline + Duration::from_secs(10))
+        );
+        let (status, forced) = status?;
+        Ok(Report {
+            pid,
+            forced,
+            status,
+            stdout: stdout?,
+            stderr: stderr?,
+        })
+    }
+}
+async fn wait_child(child: &mut Child, deadline: Instant) -> Result<(ExitStatus, bool)> {
+    if let Ok(status) = timeout_at(deadline, child.wait()).await {
+        return Ok((status?, false));
+    }
+    child
+        .start_kill()
+        .context("kill exact owned fixture process after deadline")?;
+    let status = timeout(Duration::from_secs(5), child.wait())
+        .await
+        .context("fixture process forced reap deadline")??;
+    Ok((status, true))
+}
+async fn capture<R: AsyncRead + Unpin>(mut input: R, deadline: Instant) -> Result<Vec<u8>> {
+    let mut output = Vec::new();
+    let mut buffer = [0_u8; 1024];
+    loop {
+        let count = timeout_at(deadline, input.read(&mut buffer))
+            .await
+            .context("fixture pipe drain deadline")??;
+        if count == 0 {
+            return Ok(output);
+        }
+        ensure!(
+            output.len().saturating_add(count) <= 32768,
+            "fixture output exceeded32KiB cap"
+        );
+        output.extend_from_slice(buffer.get(..count).context("invalid pipe read count")?);
+    }
+}
diff --git a/apps/rustack/tests/workflows_sdk/rust.rs b/apps/rustack/tests/workflows_sdk/rust.rs
new file mode 100644
index 00000000..f4b73361
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/rust.rs
@@ -0,0 +1,1055 @@
+//! Ordinary signed Rust SDK requests against the actual executable.
+
+use std::{
+    collections::BTreeSet,
+    io::{Cursor, Write},
+    time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+use anyhow::{Context, Result, ensure};
+use aws_credential_types::Credentials;
+use aws_sdk_lambda::{
+    Client as Lambda,
+    config::{BehaviorVersion, Region, retry::RetryConfig, timeout::TimeoutConfig},
+    primitives::Blob,
+    types::{Architecture, Environment, FunctionCode, Runtime},
+};
+use aws_sdk_sfn::{
+    Client,
+    error::ProvideErrorMetadata,
+    operation::{
+        describe_execution::DescribeExecutionOutput,
+        describe_state_machine::DescribeStateMachineOutput, start_execution::StartExecutionOutput,
+    },
+    types::{ExecutionStatus, HistoryEvent, Tag, ValidateStateMachineDefinitionSeverity},
+};
+use serde_json::{Value, json};
+use tokio::{
+    fs,
+    time::{sleep, timeout},
+};
+use uuid::Uuid;
+use zip::{ZipWriter, write::SimpleFileOptions};
+
+use super::process::{ACCESS, SECRET, Server};
+
+#[path = "rust/callback.rs"]
+mod callback;
+#[path = "rust/nested.rs"]
+mod nested;
+#[path = "rust/structured.rs"]
+mod structured;
+
+const ROLE: &str = "arn:aws:iam::000000000000:role/Workflows";
+const PREFIX: &str = "arn:aws:states:us-east-1:000000000000:";
+/// Initial root entry has an independent predecessor; later sequential events chain.
+pub(super) fn sequential_predecessor(offset: usize) -> Result<i64> {
+    i64::try_from(if offset == 1 { 0 } else { offset }).context("history predecessor overflow")
+}
+
+fn credentials() -> Credentials {
+    Credentials::new(ACCESS, SECRET, None, None, "workflow-local")
+}
+fn timeouts() -> TimeoutConfig {
+    TimeoutConfig::builder()
+        .connect_timeout(Duration::from_secs(2))
+        .read_timeout(Duration::from_secs(15))
+        .operation_timeout(Duration::from_secs(15))
+        .build()
+}
+pub(super) fn sfn(server: &Server, secret: &str) -> Client {
+    Client::from_conf(
+        aws_sdk_sfn::Config::builder()
+            .behavior_version(BehaviorVersion::latest())
+            .region(Region::new("us-east-1"))
+            .endpoint_url(&server.endpoint)
+            .credentials_provider(Credentials::new(
+                ACCESS,
+                secret,
+                None,
+                None,
+                "workflow-local",
+            ))
+            .retry_config(RetryConfig::disabled())
+            .timeout_config(timeouts())
+            .build(),
+    )
+}
+pub(super) fn lambda(server: &Server) -> Lambda {
+    Lambda::from_conf(
+        aws_sdk_lambda::Config::builder()
+            .behavior_version(BehaviorVersion::latest())
+            .region(Region::new("us-east-1"))
+            .endpoint_url(&server.endpoint)
+            .credentials_provider(credentials())
+            .retry_config(RetryConfig::disabled())
+            .timeout_config(timeouts())
+            .build(),
+    )
+}
+pub(super) fn archive(bytes: &[u8]) -> Result<Vec<u8>> {
+    let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+    writer.start_file(
+        "bootstrap",
+        SimpleFileOptions::default().unix_permissions(0o755),
+    )?;
+    writer.write_all(bytes)?;
+    Ok(writer.finish()?.into_inner())
+}
+async fn deploy(server: &Server, client: &Lambda) -> Result<()> {
+    let bytes = fs::read(server.bootstrap()?).await?;
+    let archive = tokio::task::spawn_blocking(move || archive(&bytes)).await??;
+    for (name, variables, seconds) in [
+        ("SdkCompute", vec![("WORKFLOW_MODE", "1")], 5),
+        (
+            "SdkRetry",
+            vec![("WORKFLOW_MODE", "1"), ("WORKFLOW_FAIL_ONCE", "1")],
+            5,
+        ),
+        ("SdkFail", vec![("FAIL_MODE", "panic")], 5),
+        ("SdkSlow", vec![("SLEEP_SECS", "5")], 5),
+        ("SdkFunctionTimeout", vec![("SLEEP_SECS", "5")], 1),
+    ] {
+        let mut environment = Environment::builder().variables(
+            "PROCESS_MARKER_DIR",
+            server.markers.to_str().context("marker path")?,
+        );
+        for (key, value) in variables {
+            environment = environment.variables(key, value);
+        }
+        client
+            .create_function()
+            .function_name(name)
+            .role(ROLE)
+            .runtime(Runtime::Providedal2023)
+            .handler("bootstrap")
+            .architectures(if cfg!(target_arch = "aarch64") {
+                Architecture::Arm64
+            } else {
+                Architecture::X8664
+            })
+            .timeout(seconds)
+            .environment(environment.build())
+            .code(
+                FunctionCode::builder()
+                    .zip_file(Blob::new(archive.clone()))
+                    .build(),
+            )
+            .send()
+            .await?;
+    }
+    let gates = server
+        .markers
+        .parent()
+        .context("private root")?
+        .join("gates");
+    client
+        .create_function()
+        .function_name("SdkGate")
+        .role(ROLE)
+        .runtime(Runtime::Providedal2023)
+        .handler("bootstrap")
+        .architectures(if cfg!(target_arch = "aarch64") {
+            Architecture::Arm64
+        } else {
+            Architecture::X8664
+        })
+        .timeout(900)
+        .environment(
+            Environment::builder()
+                .variables("WORKFLOW_MODE", "1")
+                .variables(
+                    "PROCESS_MARKER_DIR",
+                    server.markers.to_str().context("marker path")?,
+                )
+                .variables(
+                    "INVOCATION_FILE",
+                    gates.join("entered").to_str().context("gate path")?,
+                )
+                .variables(
+                    "WORKFLOW_GATE_FILE",
+                    gates.join("release").to_str().context("gate path")?,
+                )
+                .build(),
+        )
+        .code(
+            FunctionCode::builder()
+                .zip_file(Blob::new(archive.clone()))
+                .build(),
+        )
+        .send()
+        .await?;
+    check_lambda_compute(client).await
+}
+async fn check_lambda_compute(client: &Lambda) -> Result<()> {
+    let invoked = client
+        .invoke()
+        .function_name("SdkCompute")
+        .payload(Blob::new(br#"{"n":21}"#.to_vec()))
+        .send()
+        .await?;
+    ensure!(
+        invoked.status_code() == 200 && invoked.function_error().is_none(),
+        "actual Lambda SDK invoke failed"
+    );
+    let result: Value =
+        serde_json::from_slice(invoked.payload().context("Lambda output")?.as_ref())?;
+    ensure!(
+        result["computed"] == 42 && result["pid"].as_u64().is_some_and(|pid| pid > 1),
+        "real bootstrap computation missing"
+    );
+    Ok(())
+}
+
+pub(super) async fn create(client: &Client, name: &str, definition: &Value) -> Result<String> {
+    let response = client
+        .create_state_machine()
+        .name(name)
+        .role_arn(ROLE)
+        .definition(definition.to_string())
+        .send()
+        .await?;
+    ensure!(
+        response
+            .state_machine_arn()
+            .starts_with(&format!("{PREFIX}stateMachine:")),
+        "wrong machine scope"
+    );
+    let now = i64::try_from(SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs())?;
+    ensure!(
+        (response.creation_date().secs() - now).abs() < 60,
+        "incorrect native SDK timestamp unit"
+    );
+    Ok(response.state_machine_arn().to_owned())
+}
+pub(super) async fn terminal(client: &Client, arn: &str) -> Result<DescribeExecutionOutput> {
+    timeout(Duration::from_secs(20), async {
+        loop {
+            let value = client
+                .describe_execution()
+                .execution_arn(arn)
+                .send()
+                .await?;
+            if value.status() != &ExecutionStatus::Running {
+                return Ok(value);
+            }
+            sleep(Duration::from_millis(15)).await;
+        }
+    })
+    .await
+    .context("execution did not terminate")?
+}
+pub(super) async fn history(
+    client: &Client,
+    arn: &str,
+    reverse: bool,
+    data: bool,
+) -> Result<Vec<HistoryEvent>> {
+    let mut pages = client
+        .get_execution_history()
+        .execution_arn(arn)
+        .max_results(7)
+        .reverse_order(reverse)
+        .include_execution_data(data)
+        .into_paginator()
+        .send();
+    let mut events = Vec::new();
+    let mut count = 0;
+    while let Some(page) = pages.try_next().await? {
+        count += 1;
+        ensure!(count <= 200, "unbounded history page count");
+        ensure!(events.len() < 1000, "unbounded history paginator");
+        events.extend(page.events);
+    }
+    Ok(events)
+}
+fn validated_catalog() -> Result<Value> {
+    let value: Value =
+        serde_json::from_str(include_str!("../../../../tests/workflows/sdk-cases.json"))?;
+    ensure!(
+        value["schemaVersion"] == 1 && value["profile"] == "rustack-standard-jsonpath-v1",
+        "unsupported SDK catalog"
+    );
+    let cases = value["cases"].as_array().context("SDK case collection")?;
+    ensure!(cases.len() == 17, "required SDK case manifest changed");
+    let mut names = BTreeSet::new();
+    for case in cases {
+        let object = case.as_object().context("SDK case object")?;
+        for key in object.keys() {
+            ensure!(
+                [
+                    "id",
+                    "definition",
+                    "input",
+                    "expectedOutput",
+                    "uuidField",
+                    "optimizedComputed",
+                    "taskAttempts",
+                    "expectedStatus",
+                    "expectedError",
+                    "expectedCause",
+                    "largeInputBytes",
+                    "evidence"
+                ]
+                .contains(&key.as_str()),
+                "unknown SDK expectation field"
+            );
+        }
+        let id = case["id"].as_str().context("case ID")?;
+        ensure!(
+            !id.is_empty() && id.len() <= 48 && names.insert(id),
+            "missing/duplicate case ID"
+        );
+        ensure!(
+            case["definition"].is_object() && object.contains_key("input"),
+            "missing SDK definition/input"
+        );
+        let outputs = usize::from(object.contains_key("expectedOutput"))
+            + usize::from(object.contains_key("optimizedComputed"))
+            + usize::from(object.contains_key("expectedError"));
+        ensure!(
+            outputs == 1,
+            "every SDK case requires exactly one outcome oracle"
+        );
+        if object.contains_key("expectedError") {
+            ensure!(
+                ["FAILED", "TIMED_OUT"]
+                    .contains(&case["expectedStatus"].as_str().context("failure status")?),
+                "invalid failure oracle"
+            );
+        }
+        if let Some(number) = case.get("optimizedComputed") {
+            ensure!(number.as_i64().is_some(), "invalid optimized oracle");
+        }
+        if let Some(attempts) = case.get("taskAttempts") {
+            ensure!(
+                attempts.as_u64().is_some_and(|n| (1..=10).contains(&n)),
+                "invalid attempt oracle"
+            );
+        }
+        for key in ["uuidField", "expectedError", "expectedCause"] {
+            if let Some(value) = case.get(key) {
+                ensure!(
+                    value.is_string()
+                        || (key == "expectedError"
+                            && value.is_null()
+                            && case["expectedStatus"] == "TIMED_OUT"),
+                    "invalid string expectation"
+                );
+            }
+        }
+        if let Some(size) = case.get("largeInputBytes") {
+            ensure!(
+                size.as_u64().is_some_and(|size| size <= 200_000) && case["input"].is_object(),
+                "invalid large-input fixture"
+            );
+        }
+        let sources = case["evidence"]["sources"]
+            .as_array()
+            .context("case provenance")?;
+        ensure!(!sources.is_empty(), "missing independent source");
+        for source in sources {
+            ensure!(
+                value["sources"]
+                    .get(source.as_str().context("source identifier")?)
+                    .is_some(),
+                "unknown fixture source"
+            );
+        }
+    }
+    Ok(value)
+}
+#[test]
+fn test_should_require_independent_expected_outcomes_for_all_sdk_cases() -> Result<()> {
+    validated_catalog().map(|_| ())
+}
+async fn catalog(client: &Client) -> Result<()> {
+    let catalog = validated_catalog()?;
+    for case in catalog["cases"].as_array().context("SDK cases")? {
+        let id = case["id"].as_str().context("case id")?;
+        let mut input = case["input"].clone();
+        if let Some(size) = case["largeInputBytes"].as_u64() {
+            input["large"] = Value::String("x".repeat(usize::try_from(size)?));
+        }
+        let machine = create(client, &format!("SdkCase-{id}"), &case["definition"]).await?;
+        let raw = input.to_string();
+        let started = client
+            .start_execution()
+            .state_machine_arn(&machine)
+            .name("Run")
+            .input(&raw)
+            .send()
+            .await?;
+        let result = terminal(client, started.execution_arn())
+            .await
+            .with_context(|| format!("case {id}"))?;
+        ensure!(
+            result.status().as_str() == case["expectedStatus"].as_str().unwrap_or("SUCCEEDED"),
+            "case {id}: status {} error {:?}",
+            result.status().as_str(),
+            result.error()
+        );
+        ensure!(
+            result.input() == Some(raw.as_str()),
+            "case {id}: raw input changed"
+        );
+        ensure!(
+            result.start_date() == started.start_date()
+                && result
+                    .stop_date()
+                    .is_some_and(|date| date >= result.start_date()),
+            "case {id}: SDK dates inconsistent"
+        );
+        verify_output(case, &result)?;
+        let events = history(client, started.execution_arn(), false, true).await?;
+        ensure!(!events.is_empty(), "case {id}: no actual history");
+        for (offset, event) in events.iter().enumerate() {
+            ensure!(
+                event.id() == i64::try_from(offset + 1)?
+                    && event.previous_event_id() == sequential_predecessor(offset)?
+                    && event.timestamp() >= result.start_date(),
+                "case {id}: broken causal history"
+            );
+        }
+        let terminal_kind = match result.status().as_str() {
+            "SUCCEEDED" => "ExecutionSucceeded",
+            "TIMED_OUT" => "ExecutionTimedOut",
+            _ => "ExecutionFailed",
+        };
+        ensure!(
+            events
+                .last()
+                .is_some_and(|event| event.r#type().as_str() == terminal_kind),
+            "missing terminal history event"
+        );
+        if let Some(attempts) = case["taskAttempts"].as_u64() {
+            ensure!(
+                u64::try_from(
+                    events
+                        .iter()
+                        .filter(|event| event.r#type().as_str().ends_with("Scheduled"))
+                        .count()
+                )? == attempts,
+                "hidden or missing business retries"
+            );
+        }
+        if id == "optimized" {
+            pagination(client, started.execution_arn(), &events).await?;
+        }
+    }
+    Ok(())
+}
+fn verify_output(case: &Value, result: &DescribeExecutionOutput) -> Result<()> {
+    let id = case["id"].as_str().context("case id")?;
+    if let Some(expected) = case.get("expectedOutput") {
+        let mut output: Value =
+            serde_json::from_str(result.output().context("successful output")?)?;
+        if let Some(field) = case["uuidField"].as_str() {
+            let uuid = output
+                .as_object_mut()
+                .context("UUID output object")?
+                .remove(field)
+                .context("UUID output")?;
+            ensure!(
+                Uuid::parse_str(uuid.as_str().context("UUID string")?)?.get_version_num() == 4,
+                "non-v4 UUID"
+            );
+        }
+        ensure!(&output == expected, "case {id}: wrong output {output}");
+    }
+    if let Some(expected) = case["optimizedComputed"].as_i64() {
+        let output: Value = serde_json::from_str(result.output().context("optimized output")?)?;
+        ensure!(
+            output["Payload"]["computed"] == expected
+                && output["StatusCode"] == 200
+                && output["SdkHttpMetadata"]["HttpStatusCode"] == 200
+                && output["ExecutedVersion"] == "$LATEST",
+            "bad optimized envelope"
+        );
+        ensure!(
+            output["SdkResponseMetadata"]["RequestId"] == output["Payload"]["request_id"],
+            "invented invocation request ID"
+        );
+        Uuid::parse_str(
+            output["Payload"]["request_id"]
+                .as_str()
+                .context("actual request ID")?,
+        )?;
+        ensure!(
+            output["Payload"]["pid"].as_u64().is_some_and(|pid| pid > 1),
+            "no actual process"
+        );
+    }
+    if let Some(error) = case["expectedError"].as_str() {
+        ensure!(
+            result.error() == Some(error),
+            "case {id}: wrong error {:?}",
+            result.error()
+        );
+    }
+    if case.get("expectedError") == Some(&Value::Null) {
+        ensure!(
+            result.error().is_none() && result.cause().is_none() && result.output().is_none(),
+            "case {id}: overall timeout manufactured outcome fields"
+        );
+    }
+    if let Some(cause) = case["expectedCause"].as_str() {
+        ensure!(
+            result.cause() == Some(cause),
+            "case {id}: changed Unicode cause"
+        );
+    }
+    Ok(())
+}
+fn assert_omitted(events: &[HistoryEvent]) -> Result<()> {
+    for event in events {
+        let inputs = [
+            event
+                .execution_started_event_details()
+                .and_then(|d| d.input()),
+            event.state_entered_event_details().and_then(|d| d.input()),
+            event
+                .lambda_function_scheduled_event_details()
+                .and_then(|d| d.input()),
+        ];
+        let outputs = [
+            event
+                .task_submitted_event_details()
+                .and_then(|d| d.output()),
+            event
+                .execution_succeeded_event_details()
+                .and_then(|d| d.output()),
+            event.state_exited_event_details().and_then(|d| d.output()),
+            event
+                .lambda_function_succeeded_event_details()
+                .and_then(|d| d.output()),
+            event
+                .task_succeeded_event_details()
+                .and_then(|d| d.output()),
+        ];
+        let metadata_present = [
+            event
+                .task_submitted_event_details()
+                .and_then(|d| d.output_details())
+                .is_some(),
+            event
+                .execution_started_event_details()
+                .and_then(|d| d.input_details())
+                .is_some(),
+            event
+                .state_entered_event_details()
+                .and_then(|d| d.input_details())
+                .is_some(),
+            event
+                .lambda_function_scheduled_event_details()
+                .and_then(|d| d.input_details())
+                .is_some(),
+            event
+                .execution_succeeded_event_details()
+                .and_then(|d| d.output_details())
+                .is_some(),
+            event
+                .state_exited_event_details()
+                .and_then(|d| d.output_details())
+                .is_some(),
+            event
+                .lambda_function_succeeded_event_details()
+                .and_then(|d| d.output_details())
+                .is_some(),
+            event
+                .task_succeeded_event_details()
+                .and_then(|d| d.output_details())
+                .is_some(),
+        ];
+        ensure!(
+            inputs.iter().all(Option::is_none)
+                && outputs.iter().all(Option::is_none)
+                && metadata_present.iter().all(|present| !present)
+                && event.task_scheduled_event_details().is_none(),
+            "execution data was not omitted"
+        );
+    }
+    Ok(())
+}
+async fn pagination(client: &Client, arn: &str, events: &[HistoryEvent]) -> Result<()> {
+    let reverse = history(client, arn, true, false).await?;
+    ensure!(
+        reverse
+            .iter()
+            .map(HistoryEvent::id)
+            .eq(events.iter().rev().map(HistoryEvent::id)),
+        "reverse traversal changed IDs"
+    );
+    ensure!(
+        reverse
+            .iter()
+            .zip(events.iter().rev())
+            .all(|(left, right)| left.previous_event_id() == right.previous_event_id()),
+        "reverse traversal changed causal links"
+    );
+    assert_omitted(&reverse)?;
+    let first = client
+        .get_execution_history()
+        .execution_arn(arn)
+        .max_results(1)
+        .send()
+        .await?;
+    let token = first.next_token().context("history token")?;
+    let next = client
+        .get_execution_history()
+        .execution_arn(arn)
+        .max_results(1)
+        .next_token(token)
+        .send()
+        .await?;
+    let replay = client
+        .get_execution_history()
+        .execution_arn(arn)
+        .max_results(1)
+        .next_token(token)
+        .send()
+        .await?;
+    ensure!(
+        next.events().first().map(HistoryEvent::id)
+            == replay.events().first().map(HistoryEvent::id),
+        "token was destructive"
+    );
+    let error = client
+        .get_execution_history()
+        .execution_arn(arn)
+        .max_results(2)
+        .next_token(token)
+        .send()
+        .await
+        .err()
+        .context("query-bound token accepted")?;
+    ensure!(
+        error
+            .as_service_error()
+            .and_then(ProvideErrorMetadata::code)
+            == Some("InvalidToken"),
+        "wrong cursor query error"
+    );
+    let error = client
+        .get_execution_history()
+        .execution_arn(arn)
+        .next_token("0".repeat(64))
+        .send()
+        .await
+        .err()
+        .context("forged token accepted")?;
+    ensure!(
+        error
+            .as_service_error()
+            .and_then(ProvideErrorMetadata::code)
+            == Some("InvalidToken"),
+        "wrong forged token error"
+    );
+    Ok(())
+}
+fn pass(value: &str) -> Value {
+    json!({"StartAt":"Done","States":{"Done":{"Type":"Pass","Result":{"revision":value},"End":true}}})
+}
+async fn tags(client: &Client, machine: &str) -> Result<()> {
+    client
+        .tag_resource()
+        .resource_arn(machine)
+        .tags(Tag::builder().key("owner").value("sdk").build())
+        .send()
+        .await?;
+    let tags = client
+        .list_tags_for_resource()
+        .resource_arn(machine)
+        .send()
+        .await?;
+    ensure!(
+        tags.tags()
+            .iter()
+            .any(|tag| tag.key() == Some("owner") && tag.value() == Some("sdk")),
+        "tag missing"
+    );
+    client
+        .untag_resource()
+        .resource_arn(machine)
+        .tag_keys("owner")
+        .send()
+        .await?;
+    ensure!(
+        client
+            .list_tags_for_resource()
+            .resource_arn(machine)
+            .send()
+            .await?
+            .tags()
+            .is_empty(),
+        "tag removal failed"
+    );
+    Ok(())
+}
+const RAW: &str = " {\"n\":1}";
+async fn duplicate(client: &Client, machine: &str) -> Result<StartExecutionOutput> {
+    let start = || {
+        client
+            .start_execution()
+            .state_machine_arn(machine)
+            .name("Same")
+            .input(RAW)
+            .send()
+    };
+    let (left, right) = tokio::join!(start(), start());
+    let left = left?;
+    let right = right?;
+    ensure!(
+        left.execution_arn() == right.execution_arn() && left.start_date() == right.start_date(),
+        "RUNNING start not idempotent"
+    );
+    for (input, code) in [
+        ("{}", "ExecutionAlreadyExists"),
+        ("{", "InvalidExecutionInput"),
+    ] {
+        let error = client
+            .start_execution()
+            .state_machine_arn(machine)
+            .name("Same")
+            .input(input)
+            .send()
+            .await
+            .err()
+            .context("invalid duplicate accepted")?;
+        ensure!(
+            error
+                .as_service_error()
+                .and_then(ProvideErrorMetadata::code)
+                == Some(code),
+            "wrong duplicate validation error"
+        );
+    }
+    Ok(left)
+}
+async fn consumed_gate(server: &Server) -> Result<()> {
+    timeout(Duration::from_secs(15), async {
+        let path = server
+            .markers
+            .parent()
+            .context("private root")?
+            .join("gates/entered");
+        loop {
+            if let Ok(bytes) = fs::read(&path).await {
+                ensure!(bytes.len() <= 512, "oversized consumed-event marker");
+                if let Ok(value) = serde_json::from_slice::<Value>(&bytes) {
+                    ensure!(
+                        value["pid"].as_u64().is_some_and(|pid| pid > 1),
+                        "invalid consumed PID"
+                    );
+                    Uuid::parse_str(value["request_id"].as_str().context("actual request ID")?)?;
+                    return Ok(());
+                }
+            }
+            sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await
+    .context("handler consumption barrier expired")?
+}
+async fn revisions(
+    client: &Client,
+    server: &Server,
+    machine: &str,
+    original: &DescribeStateMachineOutput,
+    first: &StartExecutionOutput,
+) -> Result<()> {
+    consumed_gate(server).await?;
+    let original_id = original
+        .revision_id()
+        .context("missing original revision UUID")?;
+    Uuid::parse_str(original_id)?;
+    let update = client
+        .update_state_machine()
+        .state_machine_arn(machine)
+        .definition(pass("new").to_string())
+        .send()
+        .await?;
+    let update_id = update
+        .revision_id()
+        .context("missing update revision UUID")?;
+    Uuid::parse_str(update_id)?;
+    ensure!(update_id != original_id, "update did not advance revision");
+    let captured = client
+        .describe_state_machine_for_execution()
+        .execution_arn(first.execution_arn())
+        .send()
+        .await?;
+    let captured_id = captured
+        .revision_id()
+        .context("missing captured revision UUID")?;
+    Uuid::parse_str(captured_id)?;
+    ensure!(
+        captured.definition() == original.definition()
+            && captured_id == original_id
+            && captured.update_date() == original.creation_date(),
+        "captured revision/date drifted"
+    );
+    let new = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .name("New")
+        .send()
+        .await?;
+    ensure!(
+        terminal(client, new.execution_arn()).await?.output() == Some("{\"revision\":\"new\"}"),
+        "new definition not used"
+    );
+    fs::write(
+        server
+            .markers
+            .parent()
+            .context("private root")?
+            .join("gates/release"),
+        b"release",
+    )
+    .await?;
+    ensure!(
+        terminal(client, first.execution_arn()).await?.output() == Some("{\"revision\":\"old\"}"),
+        "running definition changed"
+    );
+    let error = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .name("Same")
+        .input(RAW)
+        .send()
+        .await
+        .err()
+        .context("closed name reused")?;
+    ensure!(
+        error
+            .as_service_error()
+            .and_then(ProvideErrorMetadata::code)
+            == Some("ExecutionAlreadyExists"),
+        "wrong closed-name error"
+    );
+    Ok(())
+}
+async fn stop(client: &Client, machine: &str) -> Result<()> {
+    let wait =
+        json!({"StartAt":"Wait","States":{"Wait":{"Type":"Wait","Seconds":3600,"End":true}}});
+    client
+        .update_state_machine()
+        .state_machine_arn(machine)
+        .definition(wait.to_string())
+        .send()
+        .await?;
+    let started = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .name("Stop")
+        .send()
+        .await?;
+    client
+        .stop_execution()
+        .execution_arn(started.execution_arn())
+        .error("")
+        .cause("quoted \"stop\" 🙂")
+        .send()
+        .await?;
+    let result = terminal(client, started.execution_arn()).await?;
+    ensure!(
+        result.status() == &ExecutionStatus::Aborted
+            && result.error() == Some("")
+            && result.cause() == Some("quoted \"stop\" 🙂"),
+        "Stop fields changed"
+    );
+    Ok(())
+}
+async fn retained_lists(client: &Client, machine: &str, first: &str) -> Result<()> {
+    let page = client
+        .list_executions()
+        .state_machine_arn(machine)
+        .max_results(1)
+        .send()
+        .await?;
+    let mut arns: BTreeSet<String> = page
+        .executions()
+        .iter()
+        .map(|item| item.execution_arn().to_owned())
+        .collect();
+    let mut token = page.next_token().map(str::to_owned);
+    let mut seen = BTreeSet::new();
+    client
+        .update_state_machine()
+        .state_machine_arn(machine)
+        .definition(pass("late").to_string())
+        .send()
+        .await?;
+    let late = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .name("Late")
+        .send()
+        .await?;
+    terminal(client, late.execution_arn()).await?;
+    let first_history = client
+        .get_execution_history()
+        .execution_arn(first)
+        .max_results(1)
+        .send()
+        .await?;
+    client
+        .delete_state_machine()
+        .state_machine_arn(machine)
+        .send()
+        .await?;
+    while let Some(next) = token {
+        ensure!(
+            seen.len() < 10 && seen.insert(next.clone()),
+            "unbounded execution cursor"
+        );
+        let page = client
+            .list_executions()
+            .state_machine_arn(machine)
+            .max_results(1)
+            .next_token(next)
+            .send()
+            .await?;
+        arns.extend(
+            page.executions()
+                .iter()
+                .map(|item| item.execution_arn().to_owned()),
+        );
+        token = page.next_token().map(str::to_owned);
+    }
+    ensure!(
+        arns.len() == 3 && !arns.contains(late.execution_arn()),
+        "execution-list capture drifted after delete"
+    );
+    client
+        .get_execution_history()
+        .execution_arn(first)
+        .max_results(1)
+        .next_token(
+            first_history
+                .next_token()
+                .context("retained history cursor")?,
+        )
+        .send()
+        .await?;
+    ensure!(
+        client
+            .describe_execution()
+            .execution_arn(first)
+            .send()
+            .await?
+            .input()
+            == Some(RAW),
+        "execution lost after deletion"
+    );
+    Ok(())
+}
+async fn list_and_validate(client: &Client) -> Result<()> {
+    let mut pages = client
+        .list_state_machines()
+        .max_results(2)
+        .into_paginator()
+        .send();
+    let mut count = 0;
+    let mut names = BTreeSet::new();
+    while let Some(page) = pages.try_next().await? {
+        count += 1;
+        ensure!(count <= 64, "unbounded machine pages");
+        names.extend(
+            page.state_machines()
+                .iter()
+                .map(|item| item.name().to_owned()),
+        );
+    }
+    ensure!(
+        names.contains("SdkCase-optimized") && !names.contains("SdkControl"),
+        "resource list/delete projection failed"
+    );
+    let valid = client
+        .validate_state_machine_definition()
+        .definition(pass("valid").to_string())
+        .severity(ValidateStateMachineDefinitionSeverity::Warning)
+        .send()
+        .await?;
+    ensure!(valid.result().as_str() == "OK", "valid definition rejected");
+    for definition in [
+        json!({"StartAt":"Missing","States":{}}),
+        json!({"StartAt":"Run","States":{"Run":{"Type":"Pass","InputPath":"$[","End":true}}}),
+        json!({"StartAt":"Run","States":{"Run":{"Type":"Pass","Parameters":{"duplicate":1,"duplicate.$":"$.n"},"End":true}}}),
+    ] {
+        let invalid = client
+            .validate_state_machine_definition()
+            .definition(definition.to_string())
+            .send()
+            .await?;
+        ensure!(
+            invalid.result().as_str() == "FAIL" && !invalid.diagnostics().is_empty(),
+            "invalid definition accepted"
+        );
+    }
+    let unsupported = client
+        .create_activity()
+        .name("unsupported")
+        .send()
+        .await
+        .err()
+        .context("unsupported operation accepted")?;
+    ensure!(
+        unsupported
+            .as_service_error()
+            .and_then(ProvideErrorMetadata::code)
+            == Some("UnsupportedOperation"),
+        "unsupported operation disguised"
+    );
+    Ok(())
+}
+async fn controls(client: &Client, server: &Server) -> Result<()> {
+    let old = json!({"StartAt":"Gate","States":{"Gate":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:SdkGate","Parameters":{"n":21},"ResultSelector":{"revision":"old"},"End":true}}});
+    let machine = create(client, "SdkControl", &old).await?;
+    let described = client
+        .describe_state_machine()
+        .state_machine_arn(&machine)
+        .send()
+        .await?;
+    let original = old.to_string();
+    ensure!(described.definition() == original, "definition changed");
+    tags(client, &machine).await?;
+    let first = duplicate(client, &machine).await?;
+    revisions(client, server, &machine, &described, &first).await?;
+    stop(client, &machine).await?;
+    retained_lists(client, &machine, first.execution_arn()).await?;
+    list_and_validate(client).await
+}
+pub(super) async fn exercise(server: &Server) -> Result<()> {
+    let client = sfn(server, SECRET);
+    let bad = sfn(server, "wrong-local-secret")
+        .list_state_machines()
+        .send()
+        .await
+        .err()
+        .context("strict signing not enforced")?;
+    ensure!(
+        bad.as_service_error().and_then(ProvideErrorMetadata::code)
+            == Some("AccessDeniedException"),
+        "wrong auth error"
+    );
+    deploy(server, &lambda(server)).await?;
+    catalog(&client).await?;
+    controls(&client, server).await?;
+    nested::exercise(&client, server).await?;
+    structured::exercise(&client, server).await?;
+    Ok(())
+}
+
+pub(super) async fn nested_only(server: &Server) -> Result<()> {
+    nested::exercise(&sfn(server, SECRET), server).await
+}
+
+pub(super) async fn callbacks_only(server: &Server) -> Result<()> {
+    callback::exercise(server).await
+}
+
+pub(super) async fn native_probe_only(server: &Server) -> Result<()> {
+    deploy(server, &lambda(server)).await
+}
diff --git a/apps/rustack/tests/workflows_sdk/rust/callback.rs b/apps/rustack/tests/workflows_sdk/rust/callback.rs
new file mode 100644
index 00000000..bf45ed6a
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/rust/callback.rs
@@ -0,0 +1,486 @@
+//! Actual strict-auth service and both handler-side SDKs, using one dispatch slot.
+
+use std::{collections::BTreeSet, env, path::PathBuf};
+
+use serde::Deserialize;
+
+use super::*;
+use crate::{process::assert_absent, runner::interpreter};
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Case {
+    id: String,
+    mode: String,
+    status: String,
+    #[serde(default)]
+    error: Option<String>,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Catalog {
+    source: String,
+    cases: Vec<Case>,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Evidence {
+    request_id: String,
+    pid: u32,
+    sdk: String,
+    stage: String,
+    retry: u32,
+    heartbeats: u32,
+    history_safe: bool,
+    closed_token: bool,
+}
+
+fn root(server: &Server) -> Result<PathBuf> {
+    Ok(server
+        .markers
+        .parent()
+        .context("private fixture root")?
+        .to_owned())
+}
+async fn markers(server: &Server) -> Result<Vec<Evidence>> {
+    let mut directory = fs::read_dir(root(server)?.join("callbacks")).await?;
+    let mut events = Vec::new();
+    let mut files = 0;
+    while let Some(entry) = directory.next_entry().await? {
+        files += 1;
+        ensure!(
+            files <= 64 && entry.file_type().await?.is_file(),
+            "invalid callback evidence collection"
+        );
+        if entry
+            .path()
+            .extension()
+            .is_none_or(|extension| extension != "json")
+        {
+            continue;
+        }
+        ensure!(
+            entry.metadata().await?.len() <= 1024,
+            "oversized callback evidence"
+        );
+        let event: Evidence = serde_json::from_slice(&fs::read(entry.path()).await?)?;
+        ensure!(
+            event.request_id.len() == 36
+                && Uuid::parse_str(&event.request_id)?.to_string() == event.request_id
+                && entry.file_name() == format!("{}.json", event.request_id).as_str()
+                && event.pid > 1
+                && event.retry <= 1
+                && ["rust", "boto3"].contains(&event.sdk.as_str())
+                && ["consumed", "returned", "heartbeat", "callback"]
+                    .contains(&event.stage.as_str()),
+            "invalid callback evidence"
+        );
+        events.push(event);
+    }
+    Ok(events)
+}
+async fn next(server: &Server, seen: &BTreeSet<String>, sdk: &str) -> Result<Evidence> {
+    timeout(Duration::from_secs(10), async {
+        loop {
+            if let Some(event) = markers(server)
+                .await?
+                .into_iter()
+                .find(|v| !seen.contains(&v.request_id) && v.sdk == sdk)
+            {
+                return Ok(event);
+            }
+            sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .context("handler did not consume an actual event")?
+}
+async fn stage(server: &Server, id: &str, expected: &str) -> Result<Evidence> {
+    timeout(Duration::from_secs(10), async {
+        loop {
+            if let Some(event) = markers(server)
+                .await?
+                .into_iter()
+                .find(|v| v.request_id == id && v.stage == expected)
+            {
+                return Ok(event);
+            }
+            sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .context("handler SDK stage did not complete")?
+}
+async fn release(server: &Server, id: &str) -> Result<()> {
+    fs::write(
+        root(server)?
+            .join("callback-gates")
+            .join(format!("{id}.release")),
+        b"release",
+    )
+    .await?;
+    Ok(())
+}
+async fn submitted(client: &Client, arn: &str) -> Result<()> {
+    timeout(Duration::from_secs(10), async {
+        loop {
+            let events = history(client, arn, false, true).await?;
+            if events
+                .iter()
+                .any(|event| event.r#type().as_str() == "TaskSubmitted")
+            {
+                return Ok(());
+            }
+            sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .context("actual Lambda invocation was not submitted")?
+}
+async fn running(client: &Client, arn: &str) -> Result<()> {
+    ensure!(
+        client
+            .describe_execution()
+            .execution_arn(arn)
+            .send()
+            .await?
+            .status()
+            == &ExecutionStatus::Running,
+        "callback task terminated before its gate"
+    );
+    Ok(())
+}
+async fn deploy_callbacks(server: &Server) -> Result<()> {
+    let rust = PathBuf::from(
+        env::var_os("RUSTACK_CALLBACK_BOOTSTRAP")
+            .context("build actual callback bootstrap with make")?,
+    );
+    ensure!(
+        (1..=64 * 1024 * 1024).contains(&fs::metadata(&rust).await?.len()),
+        "invalid callback bootstrap size"
+    );
+    let python = interpreter()?;
+    let python = python.to_str().context("interpreter path")?;
+    let client = lambda(server);
+    let private = root(server)?;
+    let native = fs::read(rust).await?;
+    for (name, python_handler) in [("CallbackRust", false), ("CallbackPython", true)] {
+        let bytes = native.clone();
+        let archive =
+            tokio::task::spawn_blocking(move || callback_archive(&bytes, python_handler)).await??;
+        let mut variables = Environment::builder()
+            .variables("CALLBACK_ENDPOINT", &server.endpoint)
+            .variables("CALLBACK_ACCESS_KEY", ACCESS)
+            .variables("CALLBACK_SECRET_KEY", SECRET)
+            .variables(
+                "PROCESS_MARKER_DIR",
+                server.markers.to_str().context("process path")?,
+            )
+            .variables(
+                "CALLBACK_MARKER_DIR",
+                private
+                    .join("callbacks")
+                    .to_str()
+                    .context("callback path")?,
+            )
+            .variables(
+                "CALLBACK_GATE_DIR",
+                private
+                    .join("callback-gates")
+                    .to_str()
+                    .context("gate path")?,
+            );
+        if python_handler {
+            variables = variables.variables("CALLBACK_PYTHON", python);
+        }
+        client
+            .create_function()
+            .function_name(name)
+            .role(ROLE)
+            .runtime(Runtime::Providedal2023)
+            .handler("bootstrap")
+            .architectures(if cfg!(target_arch = "aarch64") {
+                Architecture::Arm64
+            } else {
+                Architecture::X8664
+            })
+            .timeout(30)
+            .environment(variables.build())
+            .code(FunctionCode::builder().zip_file(Blob::new(archive)).build())
+            .send()
+            .await?;
+    }
+    Ok(())
+}
+fn callback_archive(native: &[u8], python: bool) -> Result<Vec<u8>> {
+    let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+    writer.start_file(
+        "bootstrap",
+        SimpleFileOptions::default().unix_permissions(0o755),
+    )?;
+    writer.write_all(native)?;
+    if python {
+        writer.start_file(
+            "callback.py",
+            SimpleFileOptions::default().unix_permissions(0o600),
+        )?;
+        writer.write_all(include_bytes!(
+            "../../../../../tests/lambda-fixtures/callback_bootstrap.py"
+        ))?;
+    }
+    Ok(writer.finish()?.into_inner())
+}
+
+fn definition(function: &str, case: &Case) -> Value {
+    let mut task = json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","TimeoutSeconds":60,
+        "Parameters":{"FunctionName":function,"Payload":{"token.$":"$$.Task.Token","executionArn.$":"$$.Execution.Id","mode":case.mode,"n":21,"retry.$":"$$.State.RetryCount"}},"End":true});
+    if ["heartbeat", "absoluteTimeout", "heartbeatTimeout"].contains(&case.mode.as_str()) {
+        task["HeartbeatSeconds"] = json!(1);
+    }
+    if case.mode == "absoluteTimeout" {
+        task["TimeoutSeconds"] = json!(2);
+    }
+    if case.mode == "retry" {
+        task["Retry"] =
+            json!([{"ErrorEquals":["CallbackRetry"],"IntervalSeconds":1,"MaxAttempts":1}]);
+    }
+    json!({"StartAt":"Call","States":{"Call":task}})
+}
+async fn unrelated(client: &Client) -> Result<()> {
+    let definition = json!({"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:SdkCompute","End":true}}});
+    let machine = create(client, &format!("Probe{}", Uuid::new_v4()), &definition).await?;
+    let execution = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .input("{\"n\":21}")
+        .send()
+        .await?;
+    let result = terminal(client, execution.execution_arn()).await?;
+    ensure!(
+        result.status() == &ExecutionStatus::Succeeded,
+        "unrelated workflow could not acquire dispatch capacity"
+    );
+    let output: Value = serde_json::from_str(result.output().context("probe output")?)?;
+    ensure!(
+        output["computed"] == 42,
+        "unrelated actual Lambda computation missing"
+    );
+    Ok(())
+}
+async fn retired(pid: u32) -> Result<()> {
+    timeout(Duration::from_secs(5), async {
+        loop {
+            if assert_absent(pid).await.is_ok() {
+                return Ok(());
+            }
+            sleep(Duration::from_millis(15)).await;
+        }
+    })
+    .await
+    .context("consumed handler PID survived cancellation")?
+}
+async fn verify(client: &Client, execution: &str, case: &Case, events: &[Evidence]) -> Result<()> {
+    let result = terminal(client, execution).await?;
+    ensure!(
+        result.status().as_str() == case.status,
+        "callback case {}: status {:?}, error {:?}",
+        case.id,
+        result.status(),
+        result.error()
+    );
+    ensure!(
+        result.error() == case.error.as_deref(),
+        "callback case {}: incorrect error",
+        case.id
+    );
+    if case.status == "SUCCEEDED" {
+        let output: Value = serde_json::from_str(result.output().context("callback output")?)?;
+        let last = events.last().context("consumed callback")?;
+        ensure!(
+            output
+                == json!({"value":42,"sdk":last.sdk,"requestId":last.request_id,"retry":last.retry}),
+            "actual handler result lost or double encoded"
+        );
+    }
+    let history = history(client, execution, false, true).await?;
+    let mut submitted_count = 0;
+    for (offset, event) in history.iter().enumerate() {
+        ensure!(
+            event.id() == i64::try_from(offset + 1)?
+                && event.previous_event_id() == sequential_predecessor(offset)?,
+            "broken callback causal history"
+        );
+        if let Some(details) = event.task_scheduled_event_details() {
+            let parameters: Value = serde_json::from_str(details.parameters())?;
+            ensure!(
+                parameters["Payload"]["token"].is_null(),
+                "injected token exposed in Scheduled history"
+            );
+        }
+        if let Some(details) = event.task_submitted_event_details() {
+            submitted_count += 1;
+            let value: Value =
+                serde_json::from_str(details.output().context("submitted metadata")?)?;
+            let request = value["SdkResponseMetadata"]["RequestId"]
+                .as_str()
+                .context("actual request metadata")?;
+            ensure!(
+                events.iter().any(|e| e.request_id == request)
+                    && value["ExecutedVersion"] == "$LATEST"
+                    && value["SdkHttpMetadata"]["HttpStatusCode"] == 200,
+                "invented callback invocation metadata"
+            );
+            ensure!(
+                details.output_details().is_some_and(|d| d.truncated),
+                "missing callback body omission marker"
+            );
+        }
+    }
+    let expected = if case.mode == "stop" || case.mode == "invocationFailure" {
+        0
+    } else if case.mode == "retry" {
+        2
+    } else {
+        1
+    };
+    ensure!(
+        submitted_count == expected,
+        "missing or duplicate callback submission"
+    );
+    Ok(())
+}
+async fn exercise_case(
+    client: &Client,
+    server: &Server,
+    case: &Case,
+    function: &str,
+    sdk: &str,
+    seen: &mut BTreeSet<String>,
+) -> Result<()> {
+    let machine = create(
+        client,
+        &format!("{function}-{}", case.id),
+        &definition(function, case),
+    )
+    .await?;
+    let execution = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .send()
+        .await?;
+    let arn = execution.execution_arn();
+    let first = next(server, seen, sdk).await?;
+    seen.insert(first.request_id.clone());
+    let mut events = vec![first];
+    let first = events.first().context("first consumed callback")?;
+    if case.mode == "stop" {
+        running(client, arn).await?;
+        client
+            .stop_execution()
+            .execution_arn(arn)
+            .error("Stopped")
+            .send()
+            .await?;
+        retired(first.pid).await?;
+    } else if ["late", "heartbeat", "absoluteTimeout", "heartbeatTimeout"]
+        .contains(&case.mode.as_str())
+    {
+        submitted(client, arn).await?;
+        running(client, arn).await?;
+        if case.mode == "late" {
+            unrelated(client).await?;
+            running(client, arn).await?;
+        }
+        if case.mode == "heartbeat" {
+            sleep(Duration::from_millis(1400)).await;
+            running(client, arn).await?;
+            ensure!(
+                stage(server, &first.request_id, "heartbeat")
+                    .await?
+                    .heartbeats
+                    >= 3,
+                "actual SDK heartbeats missing"
+            );
+        }
+        if ["absoluteTimeout", "heartbeatTimeout"].contains(&case.mode.as_str()) {
+            terminal(client, arn).await?;
+        }
+        release(server, &first.request_id).await?;
+        let complete = stage(server, &first.request_id, "callback").await?;
+        ensure!(
+            complete.history_safe && complete.closed_token,
+            "handler token/history checks failed"
+        );
+    } else {
+        let complete = stage(server, &first.request_id, "callback").await?;
+        ensure!(
+            complete.history_safe && complete.closed_token,
+            "handler SDK evidence missing"
+        );
+        running(client, arn).await?;
+        release(server, &first.request_id).await?;
+        if case.mode == "retry" {
+            let next = next(server, seen, sdk).await?;
+            seen.insert(next.request_id.clone());
+            ensure!(
+                next.retry == 1 && next.pid == first.pid,
+                "fresh retry context or retained old-token proof missing"
+            );
+            let complete = stage(server, &next.request_id, "callback").await?;
+            ensure!(
+                complete.history_safe && complete.closed_token,
+                "retry SDK checks failed"
+            );
+            running(client, arn).await?;
+            release(server, &next.request_id).await?;
+            events.push(next);
+        }
+    }
+    verify(client, arn, case, &events).await?;
+    if case.mode == "invocationFailure" {
+        retired(events.first().context("invocation")?.pid).await?;
+    }
+    Ok(())
+}
+pub(super) async fn exercise(server: &Server) -> Result<()> {
+    let capabilities = server.capabilities().await?;
+    let profile = &capabilities["workflows"];
+    ensure!(
+        capabilities["ready"] == true
+            && profile["callbacks"] == true
+            && profile["dockerQualified"] == false
+            && profile["limits"]["dispatches"] == 1
+            && profile["limits"]["callbackTokens"] == 2
+            && profile["limits"]["callbackTombstones"] == 64
+            && profile["limits"]["callbackCommands"] == 8
+            && profile["limits"]["callbackWorkers"] == 1
+            && profile["limits"]["callbackRetentionSeconds"] == 86_400,
+        "actual service callback capability mismatch"
+    );
+    let catalog: Catalog = serde_json::from_str(include_str!(
+        "../../../../../tests/workflows/callback-cases.json"
+    ))?;
+    ensure!(
+        catalog.cases.len() == 9
+            && catalog.source
+                == "https://docs.aws.amazon.com/step-functions/latest/dg/connect-lambda.html",
+        "invalid callback catalog"
+    );
+    let client = sfn(server, SECRET);
+    deploy(server, &lambda(server)).await?;
+    deploy_callbacks(server).await?;
+    let mut seen = BTreeSet::new();
+    for (function, sdk) in [("CallbackRust", "rust"), ("CallbackPython", "boto3")] {
+        for case in &catalog.cases {
+            exercise_case(&client, server, case, function, sdk, &mut seen)
+                .await
+                .with_context(|| format!("{sdk} handler callback case {}", case.id))?;
+            eprintln!("{sdk} handler callback case {} passed", case.id);
+        }
+    }
+    ensure!(
+        seen.len() == 20,
+        "missing actual consumed callback attempts"
+    );
+    Ok(())
+}
diff --git a/apps/rustack/tests/workflows_sdk/rust/nested.rs b/apps/rustack/tests/workflows_sdk/rust/nested.rs
new file mode 100644
index 00000000..3a5b91da
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/rust/nested.rs
@@ -0,0 +1,241 @@
+//! Independent optimized nested envelopes and actual child Native cleanup.
+
+use super::*;
+use crate::process::assert_absent;
+
+fn catalog() -> Result<Value> {
+    let value: Value = serde_json::from_str(include_str!(
+        "../../../../../tests/workflows/nested-cases.json"
+    ))?;
+    ensure!(
+        value["schemaVersion"] == 1 && value["profile"] == "rustack-standard-jsonpath-nested-v1",
+        "invalid nested profile"
+    );
+    let cases = value["cases"].as_array().context("cases")?;
+    ensure!(cases.len() == 6, "missing nested cases");
+    let mut names = BTreeSet::new();
+    for case in cases {
+        ensure!(
+            names.insert(case["id"].as_str().context("ID")?)
+                && case["suffix"].is_string()
+                && case.get("input").is_some()
+                && case.get("expected").is_some(),
+            "invalid nested case"
+        );
+    }
+    Ok(value)
+}
+#[test]
+fn test_should_validate_independent_nested_catalog() -> Result<()> {
+    catalog().map(|_| ())
+}
+fn definition(child: &str, suffix: &str, input: &Value) -> Value {
+    json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":format!("arn:aws:states:::states:startExecution{suffix}"),"Parameters":{"StateMachineArn":child,"Input":input},"End":true}}})
+}
+async fn check_history(client: &Client, arn: &str, suffix: &str, child: &str) -> Result<()> {
+    let events = history(client, arn, false, true).await?;
+    let mut expected = vec![
+        "ExecutionStarted",
+        "TaskStateEntered",
+        "TaskScheduled",
+        "TaskStarted",
+    ];
+    if !suffix.is_empty() {
+        expected.push("TaskSubmitted");
+    }
+    expected.extend(["TaskSucceeded", "TaskStateExited", "ExecutionSucceeded"]);
+    ensure!(
+        events.iter().map(|e| e.r#type().as_str()).eq(expected),
+        "wrong nested history"
+    );
+    for (index, event) in events.iter().enumerate() {
+        ensure!(
+            event.id() == i64::try_from(index + 1)?
+                && event.previous_event_id() == sequential_predecessor(index)?,
+            "invalid nested predecessor"
+        );
+        if let Some(details) = event.task_submitted_event_details() {
+            ensure!(
+                details.resource_type() == "states"
+                    && details.resource() == format!("startExecution{suffix}"),
+                "wrong submitted resource"
+            );
+            let accepted: Value =
+                serde_json::from_str(details.output().context("submitted output")?)?;
+            ensure!(accepted["ExecutionArn"] == child, "invented child identity");
+        }
+    }
+    let reverse = history(client, arn, true, false).await?;
+    assert_omitted(&reverse)?;
+    ensure!(
+        events
+            .iter()
+            .rev()
+            .map(|e| (e.id(), e.previous_event_id()))
+            .eq(reverse.iter().map(|e| (e.id(), e.previous_event_id()))),
+        "changed nested pagination identity"
+    );
+    Ok(())
+}
+async fn cases(client: &Client) -> Result<()> {
+    let child = create(
+        client,
+        "SdkNestedEcho",
+        &json!({"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}}),
+    )
+    .await?;
+    for case in catalog()?["cases"].as_array().context("cases")? {
+        let suffix = case["suffix"].as_str().context("suffix")?;
+        let id = case["id"].as_str().context("id")?;
+        let machine = create(
+            client,
+            &format!("SdkNested-{id}"),
+            &definition(&child, suffix, &case["input"]),
+        )
+        .await?;
+        let start = client
+            .start_execution()
+            .state_machine_arn(machine)
+            .name("Run")
+            .input("{}")
+            .send()
+            .await?;
+        let result = terminal(client, start.execution_arn()).await?;
+        ensure!(
+            result.status() == &ExecutionStatus::Succeeded,
+            "nested {id}: {result:?}"
+        );
+        let output: Value = serde_json::from_str(result.output().context("output")?)?;
+        let child_arn = output["ExecutionArn"].as_str().context("child ARN")?;
+        let nested = terminal(client, child_arn).await?;
+        ensure!(
+            serde_json::from_str::<Value>(nested.output().context("child output")?)?
+                == case["expected"],
+            "wrong child result"
+        );
+        ensure!(
+            output["StartDate"].as_i64().is_some_and(|millis| nested
+                .start_date()
+                .to_millis()
+                .is_ok_and(|observed| millis.abs_diff(observed) <= 1)),
+            "wrong nested millisecond date"
+        );
+        if !suffix.is_empty() {
+            ensure!(
+                output["Status"] == "SUCCEEDED"
+                    && output["StateMachineArn"] == child
+                    && output["InputDetails"] == json!({"Included":true})
+                    && output["OutputDetails"] == json!({"Included":true}),
+                "wrong optimized envelope"
+            );
+            if suffix == ".sync" {
+                ensure!(
+                    serde_json::from_str::<Value>(
+                        output["Input"].as_str().context("string input")?
+                    )? == case["expected"]
+                        && serde_json::from_str::<Value>(
+                            output["Output"].as_str().context("string output")?
+                        )? == case["expected"],
+                    "wrong sync string data"
+                );
+                if case["input"].is_string() {
+                    ensure!(
+                        output["Input"] == case["input"],
+                        "changed serialized input bytes"
+                    );
+                }
+            } else {
+                ensure!(
+                    output["Input"] == case["expected"] && output["Output"] == case["expected"],
+                    "wrong sync2 JSON data"
+                );
+            }
+        }
+        check_history(client, start.execution_arn(), suffix, child_arn).await?;
+    }
+    Ok(())
+}
+async fn gated(client: &Client, server: &Server, stop: bool) -> Result<()> {
+    let name = if stop {
+        "SdkNestedStop"
+    } else {
+        "SdkNestedCompute"
+    };
+    let directory = structured::deploy_named(server, &lambda(server), name).await?;
+    let child = create(client, &format!("{name}Child"), &json!({"StartAt":"L","States":{"L":{"Type":"Task","Resource":format!("arn:aws:lambda:us-east-1:000000000000:function:{name}"),"End":true}}})).await?;
+    let machine = create(
+        client,
+        &format!("{name}Parent"),
+        &definition(&child, ".sync:2", &json!({"n":21})),
+    )
+    .await?;
+    let start = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .input("{}")
+        .send()
+        .await?;
+    let markers = structured::consumed(&directory, 1).await?;
+    let (pid, request) = markers.first().context("consumed handler")?;
+    let events = history(client, start.execution_arn(), false, true).await?;
+    let submitted: Vec<_> = events
+        .iter()
+        .filter_map(HistoryEvent::task_submitted_event_details)
+        .collect();
+    ensure!(submitted.len() == 1, "missing unique nested submission");
+    let accepted: Value = serde_json::from_str(
+        submitted
+            .first()
+            .context("submitted")?
+            .output()
+            .context("accepted output")?,
+    )?;
+    let child_arn = accepted["ExecutionArn"].as_str().context("child ARN")?;
+    if stop {
+        client
+            .stop_execution()
+            .execution_arn(start.execution_arn())
+            .error("NestedStopped")
+            .send()
+            .await?;
+        ensure!(
+            terminal(client, start.execution_arn()).await?.status() == &ExecutionStatus::Aborted,
+            "parent not stopped"
+        );
+        ensure!(
+            terminal(client, child_arn).await?.status() == &ExecutionStatus::Aborted,
+            "child not stopped"
+        );
+        timeout(Duration::from_secs(5), async {
+            while assert_absent(*pid).await.is_err() {
+                sleep(Duration::from_millis(20)).await;
+            }
+        })
+        .await
+        .context("nested handler PID survived")?;
+    } else {
+        fs::write(directory.join("release"), b"release").await?;
+        let result = terminal(client, start.execution_arn()).await?;
+        ensure!(
+            result.status() == &ExecutionStatus::Succeeded,
+            "nested compute failed: {result:?}"
+        );
+        let output: Value = serde_json::from_str(result.output().context("nested output")?)?;
+        ensure!(
+            output["ExecutionArn"] == child_arn
+                && output["Output"]["computed"] == 42
+                && output["Output"]["pid"].as_u64() == Some(u64::from(*pid))
+                && output["Output"]["request_id"] == *request,
+            "returned identity differs from actual consumed child"
+        );
+        check_history(client, start.execution_arn(), ".sync:2", child_arn).await?;
+    }
+    Ok(())
+}
+pub(super) async fn exercise(client: &Client, server: &Server) -> Result<()> {
+    cases(client).await?;
+    for stop in [false, true] {
+        gated(client, server, stop).await?;
+    }
+    Ok(())
+}
diff --git a/apps/rustack/tests/workflows_sdk/rust/structured.rs b/apps/rustack/tests/workflows_sdk/rust/structured.rs
new file mode 100644
index 00000000..92e6a84e
--- /dev/null
+++ b/apps/rustack/tests/workflows_sdk/rust/structured.rs
@@ -0,0 +1,375 @@
+//! Independent structured SDK expectations and consumed-event lifecycle barriers.
+
+use std::{
+    collections::BTreeSet,
+    path::{Path, PathBuf},
+};
+
+use aws_sdk_sfn::types::MapIterationEventDetails;
+
+use super::*;
+use crate::process::assert_absent;
+
+fn catalog() -> Result<Value> {
+    let catalog: Value = serde_json::from_str(include_str!(
+        "../../../../../tests/workflows/structured-cases.json"
+    ))?;
+    ensure!(
+        catalog["schemaVersion"] == 1
+            && catalog["profile"] == "rustack-standard-jsonpath-structured-v1",
+        "invalid structured catalog profile"
+    );
+    let cases = catalog["cases"].as_array().context("structured cases")?;
+    ensure!(cases.len() == 6, "missing structured cases");
+    let mut names = BTreeSet::new();
+    for case in cases {
+        let id = case["id"].as_str().context("case ID")?;
+        ensure!(names.insert(id), "duplicate structured case");
+        ensure!(
+            case.get("expectedOutput").is_some()
+                && case["definition"].is_object()
+                && case.get("input").is_some(),
+            "incomplete structured expectation"
+        );
+    }
+    Ok(catalog)
+}
+#[test]
+fn test_should_validate_independent_structured_catalog() -> Result<()> {
+    catalog().map(|_| ())
+}
+async fn check_history(client: &Client, arn: &str, round: &str) -> Result<Vec<HistoryEvent>> {
+    let events = history(client, arn, false, true).await?;
+    ensure!(!events.is_empty(), "missing structured history");
+    for (offset, event) in events.iter().enumerate() {
+        ensure!(
+            event.id() == i64::try_from(offset + 1)?
+                && event.previous_event_id() >= 0
+                && event.previous_event_id() < event.id(),
+            "invalid structured causal predecessor"
+        );
+    }
+    ensure!(
+        events.iter().any(|event| event.r#type().as_str() == round),
+        "missing {round}"
+    );
+    let reverse = history(client, arn, true, false).await?;
+    ensure!(
+        events
+            .iter()
+            .rev()
+            .map(|e| (e.id(), e.previous_event_id()))
+            .eq(reverse.iter().map(|e| (e.id(), e.previous_event_id()))),
+        "causal links changed under reverse/data-disabled pagination"
+    );
+    assert_omitted(&reverse)?;
+    for event in &events {
+        if event.r#type().as_str() == "MapIterationStarted" {
+            ensure!(
+                events
+                    .iter()
+                    .find(|parent| parent.id() == event.previous_event_id())
+                    .is_some_and(|parent| matches!(
+                        parent.r#type().as_str(),
+                        "MapStateStarted"
+                            | "PassStateExited"
+                            | "WaitStateExited"
+                            | "TaskStateExited"
+                            | "ParallelStateExited"
+                            | "MapStateExited"
+                            | "SucceedStateExited"
+                    )),
+                "Map iteration did not link to its round or completed processor"
+            );
+        }
+    }
+    Ok(events)
+}
+async fn cases(client: &Client) -> Result<()> {
+    for case in catalog()?["cases"].as_array().context("cases")? {
+        let id = case["id"].as_str().context("case ID")?;
+        let machine = create(client, &format!("SdkStructured-{id}"), &case["definition"]).await?;
+        let started = client
+            .start_execution()
+            .state_machine_arn(machine)
+            .name("Run")
+            .input(case["input"].to_string())
+            .send()
+            .await?;
+        let result = terminal(client, started.execution_arn()).await?;
+        ensure!(
+            result.status() == &ExecutionStatus::Succeeded,
+            "structured {id}: {result:?}"
+        );
+        let output: Value = serde_json::from_str(result.output().context("structured output")?)?;
+        ensure!(
+            output == case["expectedOutput"],
+            "structured {id}: {output}"
+        );
+        let events = check_history(
+            client,
+            started.execution_arn(),
+            case["round"].as_str().context("round")?,
+        )
+        .await?;
+        if let Some(count) = case["taskAttempts"].as_u64() {
+            ensure!(
+                events
+                    .iter()
+                    .filter(|e| e.r#type().as_str().ends_with("Scheduled"))
+                    .count()
+                    == usize::try_from(count)?,
+                "wrong fanout invocation count"
+            );
+        }
+    }
+    Ok(())
+}
+async fn deploy_gate(server: &Server, client: &Lambda, stop: bool) -> Result<PathBuf> {
+    deploy_named(
+        server,
+        client,
+        if stop {
+            "SdkFanoutStop"
+        } else {
+            "SdkFanoutGate"
+        },
+    )
+    .await
+}
+pub(super) async fn deploy_named(server: &Server, client: &Lambda, name: &str) -> Result<PathBuf> {
+    let directory = server.markers.parent().context("root")?.join(name);
+    fs::create_dir(&directory).await?;
+    fs::create_dir(directory.join("consumed")).await?;
+    let bytes = fs::read(server.bootstrap()?).await?;
+    let archive = tokio::task::spawn_blocking(move || archive(&bytes)).await??;
+    client
+        .create_function()
+        .function_name(name)
+        .role(ROLE)
+        .runtime(Runtime::Providedal2023)
+        .handler("bootstrap")
+        .architectures(if cfg!(target_arch = "aarch64") {
+            Architecture::Arm64
+        } else {
+            Architecture::X8664
+        })
+        .timeout(900)
+        .environment(
+            Environment::builder()
+                .variables("WORKFLOW_MODE", "1")
+                .variables(
+                    "PROCESS_MARKER_DIR",
+                    server.markers.to_str().context("marker path")?,
+                )
+                .variables(
+                    "WORKFLOW_INVOCATION_DIR",
+                    directory
+                        .join("consumed")
+                        .to_str()
+                        .context("consumed path")?,
+                )
+                .variables(
+                    "WORKFLOW_GATE_FILE",
+                    directory.join("release").to_str().context("release path")?,
+                )
+                .build(),
+        )
+        .code(FunctionCode::builder().zip_file(Blob::new(archive)).build())
+        .send()
+        .await?;
+    Ok(directory)
+}
+pub(super) async fn consumed(directory: &Path, count: usize) -> Result<BTreeSet<(u32, String)>> {
+    timeout(Duration::from_secs(10), async {
+        loop {
+            let mut entries = fs::read_dir(directory.join("consumed")).await?;
+            let mut markers = BTreeSet::new();
+            while let Some(entry) = entries.next_entry().await? {
+                if entry.path().extension().is_none_or(|v| v != "json") {
+                    continue;
+                }
+                ensure!(
+                    markers.len() < count && entry.metadata().await?.len() <= 1024,
+                    "unexpected marker count/size"
+                );
+                let marker: Value = serde_json::from_slice(&fs::read(entry.path()).await?)?;
+                let pid = u32::try_from(marker["pid"].as_u64().context("PID")?)?;
+                let request = marker["request_id"].as_str().context("request ID")?;
+                ensure!(
+                    pid > 1 && Uuid::parse_str(request)?.get_version_num() == 4,
+                    "invalid consumed identity"
+                );
+                markers.insert((pid, request.to_owned()));
+            }
+            if markers.len() == count {
+                ensure!(
+                    markers
+                        .iter()
+                        .map(|(pid, _)| pid)
+                        .collect::<BTreeSet<_>>()
+                        .len()
+                        == count
+                        && markers
+                            .iter()
+                            .map(|(_, id)| id)
+                            .collect::<BTreeSet<_>>()
+                            .len()
+                            == count,
+                    "handlers did not consume independent invocations"
+                );
+                return Ok(markers);
+            }
+            sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await
+    .context("two handlers did not consume before release")?
+}
+async fn gated(client: &Client, server: &Server, stop: bool) -> Result<()> {
+    let directory = deploy_gate(server, &lambda(server), stop).await?;
+    let function = if stop {
+        "SdkFanoutStop"
+    } else {
+        "SdkFanoutGate"
+    };
+    let task = json!({"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":format!("arn:aws:lambda:us-east-1:000000000000:function:{function}"),"End":true}}});
+    let definition = if stop {
+        json!({"StartAt":"P","States":{"P":{"Type":"Parallel","Branches":[{"StartAt":"M","States":{"M":{"Type":"Map","MaxConcurrency":2,"ItemProcessor":task,"End":true}}}],"End":true}}})
+    } else {
+        json!({"StartAt":"P","States":{"P":{"Type":"Parallel","Branches":[task.clone(),task],"End":true}}})
+    };
+    let machine = create(
+        client,
+        if stop {
+            "SdkStructuredStop"
+        } else {
+            "SdkStructuredOverlap"
+        },
+        &definition,
+    )
+    .await?;
+    let started = client
+        .start_execution()
+        .state_machine_arn(machine)
+        .name("Run")
+        .input(if stop {
+            r#"[{"n":21},{"n":7}]"#
+        } else {
+            r#"{"n":21}"#
+        })
+        .send()
+        .await?;
+    let markers = consumed(&directory, 2).await?;
+    if stop {
+        finish_stopped(client, started.execution_arn(), markers).await
+    } else {
+        fs::write(directory.join("release"), b"release").await?;
+        finish_parallel(client, started.execution_arn(), markers).await
+    }
+}
+async fn finish_stopped(
+    client: &Client,
+    arn: &str,
+    markers: BTreeSet<(u32, String)>,
+) -> Result<()> {
+    client
+        .stop_execution()
+        .execution_arn(arn)
+        .error("SdkStructuredStop")
+        .cause("consumed nested tasks")
+        .send()
+        .await?;
+    let result = terminal(client, arn).await?;
+    ensure!(
+        result.status() == &ExecutionStatus::Aborted && result.error() == Some("SdkStructuredStop"),
+        "nested stop did not settle"
+    );
+    for (pid, _) in markers {
+        timeout(Duration::from_secs(5), async {
+            loop {
+                if assert_absent(pid).await.is_ok() {
+                    return;
+                }
+                sleep(Duration::from_millis(20)).await;
+            }
+        })
+        .await
+        .context("stopped handler PID survived")?;
+    }
+    let events = check_history(client, arn, "MapIterationAborted").await?;
+    let aborted: Vec<_> = events
+        .iter()
+        .filter(|e| e.r#type().as_str() == "MapIterationAborted")
+        .collect();
+    ensure!(
+        aborted.len() == 2
+            && aborted
+                .iter()
+                .filter_map(|e| e
+                    .map_iteration_aborted_event_details()
+                    .map(MapIterationEventDetails::index))
+                .collect::<BTreeSet<_>>()
+                == BTreeSet::from([0, 1]),
+        "missing stopped iteration identities"
+    );
+    ensure!(
+        events
+            .last()
+            .is_some_and(|e| e.r#type().as_str() == "ExecutionAborted"),
+        "iteration aborts were not committed before root termination"
+    );
+    Ok(())
+}
+async fn finish_parallel(
+    client: &Client,
+    arn: &str,
+    markers: BTreeSet<(u32, String)>,
+) -> Result<()> {
+    let result = terminal(client, arn).await?;
+    ensure!(
+        result.status() == &ExecutionStatus::Succeeded,
+        "parallel gate failed"
+    );
+    let output: Value = serde_json::from_str(result.output().context("parallel output")?)?;
+    let values = output.as_array().context("parallel array")?;
+    ensure!(values.len() == 2, "wrong parallel result length");
+    let mut returned = BTreeSet::new();
+    for value in values {
+        ensure!(
+            value["computed"] == 42,
+            "actual handler computation changed"
+        );
+        returned.insert((
+            u32::try_from(value["pid"].as_u64().context("PID")?)?,
+            value["request_id"]
+                .as_str()
+                .context("request ID")?
+                .to_owned(),
+        ));
+    }
+    ensure!(
+        returned == markers,
+        "returned invocations differ from consumed handlers"
+    );
+    let events = check_history(client, arn, "ParallelStateSucceeded").await?;
+    let fork = events
+        .iter()
+        .find(|e| e.r#type().as_str() == "ParallelStateStarted")
+        .context("missing fork")?
+        .id();
+    let entries: Vec<_> = events
+        .iter()
+        .filter(|e| e.r#type().as_str() == "TaskStateEntered")
+        .collect();
+    ensure!(
+        entries.len() == 2 && entries.iter().all(|e| e.previous_event_id() == fork),
+        "concurrent branches do not share their actual fork predecessor"
+    );
+    Ok(())
+}
+pub(super) async fn exercise(client: &Client, server: &Server) -> Result<()> {
+    cases(client).await?;
+    gated(client, server, false).await?;
+    gated(client, server, true).await
+}
diff --git a/assets/lambda/runtime/Dockerfile b/assets/lambda/runtime/Dockerfile
new file mode 100644
index 00000000..4fa08b2a
--- /dev/null
+++ b/assets/lambda/runtime/Dockerfile
@@ -0,0 +1,5 @@
+FROM public.ecr.aws/lambda/provided:al2023@sha256:612c98f126c2a95e77a016d56fed50a83055e11d636132ee6ebdd461f01b9617
+COPY bootstrap /rustack-lambda-runtime
+USER 1000:1000
+ENTRYPOINT ["/rustack-lambda-runtime"]
+CMD []
diff --git a/codegen/Cargo.lock b/codegen/Cargo.lock
index b8f117e6..cf9526a7 100644
--- a/codegen/Cargo.lock
+++ b/codegen/Cargo.lock
@@ -8,6 +8,12 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -48,6 +54,12 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -74,6 +86,7 @@ dependencies = [
  "heck",
  "serde",
  "serde_json",
+ "tokio",
  "toml",
 ]
 
@@ -104,7 +117,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -140,6 +153,39 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tokio"
+version = "1.54.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
+dependencies = [
+ "bytes",
+ "pin-project-lite",
+ "tokio-macros",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
 [[package]]
 name = "toml"
 version = "0.9.12+spec-1.1.0"
diff --git a/codegen/Cargo.toml b/codegen/Cargo.toml
index 018d838c..5da65e54 100644
--- a/codegen/Cargo.toml
+++ b/codegen/Cargo.toml
@@ -2,6 +2,7 @@
 name = "rustack-codegen"
 version = "0.1.1"
 edition = "2024"
+license = "MIT"
 
 [dependencies]
 serde = { version = "1.0", features = ["derive"] }
@@ -9,3 +10,5 @@ serde_json = "1.0"
 toml = "0.9"
 heck = "0.5"
 anyhow = "1.0"
+
+tokio = { version = "~1.54.1", features = ["rt", "macros", "fs", "time", "io-util"] }
diff --git a/codegen/services/stepfunctions.toml b/codegen/services/stepfunctions.toml
new file mode 100644
index 00000000..60ce94ec
--- /dev/null
+++ b/codegen/services/stepfunctions.toml
@@ -0,0 +1,67 @@
+[service]
+name = "stepfunctions"
+display_name = "Step Functions"
+rust_prefix = "StepFunctions"
+namespace = "com.amazonaws.sfn"
+protocol = "awsJson1_0"
+
+[protocol]
+serde_rename = "camelCase"
+target_prefix = "AWSStepFunctions"
+emit_serde_derives = true
+
+[operations]
+all = [
+    "CreateActivity",
+    "CreateStateMachine",
+    "CreateStateMachineAlias",
+    "DeleteActivity",
+    "DeleteStateMachine",
+    "DeleteStateMachineAlias",
+    "DeleteStateMachineVersion",
+    "DescribeActivity",
+    "DescribeExecution",
+    "DescribeMapRun",
+    "DescribeStateMachine",
+    "DescribeStateMachineAlias",
+    "DescribeStateMachineForExecution",
+    "GetActivityTask",
+    "GetExecutionHistory",
+    "ListActivities",
+    "ListExecutions",
+    "ListMapRuns",
+    "ListStateMachineAliases",
+    "ListStateMachines",
+    "ListStateMachineVersions",
+    "ListTagsForResource",
+    "PublishStateMachineVersion",
+    "RedriveExecution",
+    "SendTaskFailure",
+    "SendTaskHeartbeat",
+    "SendTaskSuccess",
+    "StartExecution",
+    "StartSyncExecution",
+    "StopExecution",
+    "TagResource",
+    "TestState",
+    "UntagResource",
+    "UpdateMapRun",
+    "UpdateStateMachine",
+    "UpdateStateMachineAlias",
+    "ValidateStateMachineDefinition",
+]
+
+[errors.custom]
+AccessDeniedException = { status = 403, message = "Request scope is not authorized" }
+InternalFailure = { status = 500, message = "Request processing failed" }
+RequestTimeoutException = { status = 408, message = "Request deadline exceeded" }
+ServiceUnavailable = { status = 503, message = "Workflow API unavailable" }
+ThrottlingException = { status = 400, message = "Workflow API admission exhausted" }
+UnknownOperationException = { status = 404, message = "Unknown Step Functions operation" }
+UnsupportedOperation = { status = 400, message = "Operation is outside the supported Step Functions profile" }
+
+[output]
+file_layout = "flat"
+always_serialize_arrays = true
+
+strict_model = true
diff --git a/codegen/smithy-model/stepfunctions.json b/codegen/smithy-model/stepfunctions.json
new file mode 100644
index 00000000..7fba49cf
--- /dev/null
+++ b/codegen/smithy-model/stepfunctions.json
@@ -0,0 +1,8218 @@
+{
+  "smithy": "2.0",
+  "metadata": {
+    "suppressions": [
+      {
+        "id": "HttpMethodSemantics",
+        "namespace": "*"
+      },
+      {
+        "id": "HttpResponseCodeSemantics",
+        "namespace": "*"
+      },
+      {
+        "id": "PaginatedTrait",
+        "namespace": "*"
+      },
+      {
+        "id": "HttpHeaderTrait",
+        "namespace": "*"
+      },
+      {
+        "id": "HttpUriConflict",
+        "namespace": "*"
+      },
+      {
+        "id": "Service",
+        "namespace": "*"
+      }
+    ]
+  },
+  "shapes": {
+    "com.amazonaws.sfn#AWSStepFunctions": {
+      "type": "service",
+      "version": "2016-11-23",
+      "operations": [
+        {
+          "target": "com.amazonaws.sfn#CreateActivity"
+        },
+        {
+          "target": "com.amazonaws.sfn#CreateStateMachine"
+        },
+        {
+          "target": "com.amazonaws.sfn#CreateStateMachineAlias"
+        },
+        {
+          "target": "com.amazonaws.sfn#DeleteActivity"
+        },
+        {
+          "target": "com.amazonaws.sfn#DeleteStateMachine"
+        },
+        {
+          "target": "com.amazonaws.sfn#DeleteStateMachineAlias"
+        },
+        {
+          "target": "com.amazonaws.sfn#DeleteStateMachineVersion"
+        },
+        {
+          "target": "com.amazonaws.sfn#DescribeActivity"
+        },
+        {
+          "target": "com.amazonaws.sfn#DescribeExecution"
+        },
+        {
+          "target": "com.amazonaws.sfn#DescribeMapRun"
+        },
+        {
+          "target": "com.amazonaws.sfn#DescribeStateMachine"
+        },
+        {
+          "target": "com.amazonaws.sfn#DescribeStateMachineAlias"
+        },
+        {
+          "target": "com.amazonaws.sfn#DescribeStateMachineForExecution"
+        },
+        {
+          "target": "com.amazonaws.sfn#GetActivityTask"
+        },
+        {
+          "target": "com.amazonaws.sfn#GetExecutionHistory"
+        },
+        {
+          "target": "com.amazonaws.sfn#ListActivities"
+        },
+        {
+          "target": "com.amazonaws.sfn#ListExecutions"
+        },
+        {
+          "target": "com.amazonaws.sfn#ListMapRuns"
+        },
+        {
+          "target": "com.amazonaws.sfn#ListStateMachineAliases"
+        },
+        {
+          "target": "com.amazonaws.sfn#ListStateMachines"
+        },
+        {
+          "target": "com.amazonaws.sfn#ListStateMachineVersions"
+        },
+        {
+          "target": "com.amazonaws.sfn#ListTagsForResource"
+        },
+        {
+          "target": "com.amazonaws.sfn#PublishStateMachineVersion"
+        },
+        {
+          "target": "com.amazonaws.sfn#RedriveExecution"
+        },
+        {
+          "target": "com.amazonaws.sfn#SendTaskFailure"
+        },
+        {
+          "target": "com.amazonaws.sfn#SendTaskHeartbeat"
+        },
+        {
+          "target": "com.amazonaws.sfn#SendTaskSuccess"
+        },
+        {
+          "target": "com.amazonaws.sfn#StartExecution"
+        },
+        {
+          "target": "com.amazonaws.sfn#StartSyncExecution"
+        },
+        {
+          "target": "com.amazonaws.sfn#StopExecution"
+        },
+        {
+          "target": "com.amazonaws.sfn#TagResource"
+        },
+        {
+          "target": "com.amazonaws.sfn#TestState"
+        },
+        {
+          "target": "com.amazonaws.sfn#UntagResource"
+        },
+        {
+          "target": "com.amazonaws.sfn#UpdateMapRun"
+        },
+        {
+          "target": "com.amazonaws.sfn#UpdateStateMachine"
+        },
+        {
+          "target": "com.amazonaws.sfn#UpdateStateMachineAlias"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinition"
+        }
+      ],
+      "traits": {
+        "aws.api#service": {
+          "sdkId": "SFN",
+          "arnNamespace": "states",
+          "cloudFormationName": "StepFunctions",
+          "cloudTrailEventSource": "states.amazonaws.com",
+          "docId": "states-2016-11-23",
+          "endpointPrefix": "states"
+        },
+        "aws.auth#sigv4": {
+          "name": "states"
+        },
+        "aws.protocols#awsJson1_0": {},
+        "smithy.api#documentation": "<fullname>Step Functions</fullname>\n         <p>With Step Functions, you can create workflows, also called <i>state machines</i>, to build distributed applications, automate processes, orchestrate microservices, and create data and machine learning pipelines.</p>\n         <p>Through the Step Functions API, you can create, list, update, and delete state machines, activities, and other data types. You can start, stop, and redrive your state machines. Your activity workers can send task success, heartbeat, and failure responses.</p>\n         <p>With API calls, you can also manage other aspects of your workflow, such as tags, versions, and aliases.</p>\n         <p>For more information about developing solutions with Step Functions, see the <i>\n               <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html\">Step Functions Developer Guide</a>\n            </i>.</p>\n         <important>\n            <p>If you use the Step Functions API actions using Amazon Web Services SDK integrations, make sure the API actions are in camel case and parameter names are in Pascal case. For example, you might use Step Functions API action <code>startSyncExecution</code> and specify its parameter as <code>StateMachineArn</code>.</p>\n         </important>",
+        "smithy.api#title": "AWS Step Functions",
+        "smithy.api#xmlNamespace": {
+          "uri": "http://swf.amazonaws.com/doc/2015-07-20/"
+        },
+        "smithy.rules#endpointBdd": {
+          "version": "1.1",
+          "parameters": {
+            "UseDualStack": {
+              "builtIn": "AWS::UseDualStack",
+              "required": true,
+              "default": false,
+              "documentation": "When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.",
+              "type": "boolean"
+            },
+            "UseFIPS": {
+              "builtIn": "AWS::UseFIPS",
+              "required": true,
+              "default": false,
+              "documentation": "When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.",
+              "type": "boolean"
+            },
+            "Endpoint": {
+              "builtIn": "SDK::Endpoint",
+              "required": false,
+              "documentation": "Override the endpoint used to send this request",
+              "type": "string"
+            },
+            "Region": {
+              "builtIn": "AWS::Region",
+              "required": false,
+              "documentation": "The AWS region used to dispatch the request.",
+              "type": "string"
+            }
+          },
+          "conditions": [
+            {
+              "fn": "isSet",
+              "argv": [
+                {
+                  "ref": "Endpoint"
+                }
+              ]
+            },
+            {
+              "fn": "isSet",
+              "argv": [
+                {
+                  "ref": "Region"
+                }
+              ]
+            },
+            {
+              "fn": "aws.partition",
+              "argv": [
+                {
+                  "ref": "Region"
+                }
+              ],
+              "assign": "PartitionResult"
+            },
+            {
+              "fn": "booleanEquals",
+              "argv": [
+                {
+                  "ref": "UseFIPS"
+                },
+                true
+              ]
+            },
+            {
+              "fn": "booleanEquals",
+              "argv": [
+                {
+                  "ref": "UseDualStack"
+                },
+                true
+              ]
+            },
+            {
+              "fn": "stringEquals",
+              "argv": [
+                {
+                  "ref": "Region"
+                },
+                "us-gov-west-1"
+              ]
+            },
+            {
+              "fn": "booleanEquals",
+              "argv": [
+                {
+                  "fn": "getAttr",
+                  "argv": [
+                    {
+                      "ref": "PartitionResult"
+                    },
+                    "supportsFIPS"
+                  ]
+                },
+                true
+              ]
+            },
+            {
+              "fn": "stringEquals",
+              "argv": [
+                {
+                  "fn": "getAttr",
+                  "argv": [
+                    {
+                      "ref": "PartitionResult"
+                    },
+                    "name"
+                  ]
+                },
+                "aws-us-gov"
+              ]
+            },
+            {
+              "fn": "booleanEquals",
+              "argv": [
+                {
+                  "fn": "getAttr",
+                  "argv": [
+                    {
+                      "ref": "PartitionResult"
+                    },
+                    "supportsDualStack"
+                  ]
+                },
+                true
+              ]
+            }
+          ],
+          "results": [
+            {
+              "conditions": [],
+              "error": "Invalid Configuration: FIPS and custom endpoint are not supported",
+              "type": "error"
+            },
+            {
+              "conditions": [],
+              "error": "Invalid Configuration: Dualstack and custom endpoint are not supported",
+              "type": "error"
+            },
+            {
+              "conditions": [],
+              "endpoint": {
+                "url": {
+                  "ref": "Endpoint"
+                },
+                "properties": {},
+                "headers": {}
+              },
+              "type": "endpoint"
+            },
+            {
+              "conditions": [],
+              "endpoint": {
+                "url": "https://states.{Region}.{PartitionResult#dnsSuffix}",
+                "properties": {},
+                "headers": {}
+              },
+              "type": "endpoint"
+            },
+            {
+              "conditions": [],
+              "endpoint": {
+                "url": "https://states-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",
+                "properties": {},
+                "headers": {}
+              },
+              "type": "endpoint"
+            },
+            {
+              "conditions": [],
+              "error": "FIPS and DualStack are enabled, but this partition does not support one or both",
+              "type": "error"
+            },
+            {
+              "conditions": [],
+              "endpoint": {
+                "url": "https://states-fips.{Region}.{PartitionResult#dnsSuffix}",
+                "properties": {},
+                "headers": {}
+              },
+              "type": "endpoint"
+            },
+            {
+              "conditions": [],
+              "error": "FIPS is enabled but this partition does not support FIPS",
+              "type": "error"
+            },
+            {
+              "conditions": [],
+              "endpoint": {
+                "url": "https://states.{Region}.{PartitionResult#dualStackDnsSuffix}",
+                "properties": {},
+                "headers": {}
+              },
+              "type": "endpoint"
+            },
+            {
+              "conditions": [],
+              "error": "DualStack is enabled but this partition does not support DualStack",
+              "type": "error"
+            },
+            {
+              "conditions": [],
+              "error": "Invalid Configuration: Missing Region",
+              "type": "error"
+            }
+          ],
+          "root": 2,
+          "nodeCount": 15,
+          "nodes": "/////wAAAAH/////AAAAAAAAAA4AAAADAAAAAQAAAAQF9eELAAAAAgAAAAUF9eELAAAAAwAAAAkAAAAGAAAABAAAAAcF9eEEAAAABwX14QUAAAAIAAAACAX14QkF9eEKAAAABAAAAAwAAAAKAAAABQX14QQAAAALAAAABgX14QcF9eEIAAAABgAAAA0F9eEGAAAACAX14QUF9eEGAAAAAwX14QEAAAAPAAAABAX14QIF9eED"
+        },
+        "smithy.rules#endpointRuleSet": {
+          "version": "1.0",
+          "parameters": {
+            "UseDualStack": {
+              "builtIn": "AWS::UseDualStack",
+              "required": true,
+              "default": false,
+              "documentation": "When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.",
+              "type": "boolean"
+            },
+            "UseFIPS": {
+              "builtIn": "AWS::UseFIPS",
+              "required": true,
+              "default": false,
+              "documentation": "When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.",
+              "type": "boolean"
+            },
+            "Endpoint": {
+              "builtIn": "SDK::Endpoint",
+              "required": false,
+              "documentation": "Override the endpoint used to send this request",
+              "type": "string"
+            },
+            "Region": {
+              "builtIn": "AWS::Region",
+              "required": false,
+              "documentation": "The AWS region used to dispatch the request.",
+              "type": "string"
+            }
+          },
+          "rules": [
+            {
+              "conditions": [
+                {
+                  "fn": "isSet",
+                  "argv": [
+                    {
+                      "ref": "Endpoint"
+                    }
+                  ]
+                }
+              ],
+              "rules": [
+                {
+                  "conditions": [
+                    {
+                      "fn": "booleanEquals",
+                      "argv": [
+                        {
+                          "ref": "UseFIPS"
+                        },
+                        true
+                      ]
+                    }
+                  ],
+                  "error": "Invalid Configuration: FIPS and custom endpoint are not supported",
+                  "type": "error"
+                },
+                {
+                  "conditions": [],
+                  "rules": [
+                    {
+                      "conditions": [
+                        {
+                          "fn": "booleanEquals",
+                          "argv": [
+                            {
+                              "ref": "UseDualStack"
+                            },
+                            true
+                          ]
+                        }
+                      ],
+                      "error": "Invalid Configuration: Dualstack and custom endpoint are not supported",
+                      "type": "error"
+                    },
+                    {
+                      "conditions": [],
+                      "endpoint": {
+                        "url": {
+                          "ref": "Endpoint"
+                        },
+                        "properties": {},
+                        "headers": {}
+                      },
+                      "type": "endpoint"
+                    }
+                  ],
+                  "type": "tree"
+                }
+              ],
+              "type": "tree"
+            },
+            {
+              "conditions": [],
+              "rules": [
+                {
+                  "conditions": [
+                    {
+                      "fn": "isSet",
+                      "argv": [
+                        {
+                          "ref": "Region"
+                        }
+                      ]
+                    }
+                  ],
+                  "rules": [
+                    {
+                      "conditions": [
+                        {
+                          "fn": "aws.partition",
+                          "argv": [
+                            {
+                              "ref": "Region"
+                            }
+                          ],
+                          "assign": "PartitionResult"
+                        }
+                      ],
+                      "rules": [
+                        {
+                          "conditions": [
+                            {
+                              "fn": "stringEquals",
+                              "argv": [
+                                {
+                                  "ref": "Region"
+                                },
+                                "us-gov-west-1"
+                              ]
+                            },
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseFIPS"
+                                },
+                                true
+                              ]
+                            },
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseDualStack"
+                                },
+                                false
+                              ]
+                            }
+                          ],
+                          "endpoint": {
+                            "url": "https://states.{Region}.{PartitionResult#dnsSuffix}",
+                            "properties": {},
+                            "headers": {}
+                          },
+                          "type": "endpoint"
+                        },
+                        {
+                          "conditions": [
+                            {
+                              "fn": "stringEquals",
+                              "argv": [
+                                {
+                                  "fn": "getAttr",
+                                  "argv": [
+                                    {
+                                      "ref": "PartitionResult"
+                                    },
+                                    "name"
+                                  ]
+                                },
+                                "aws-us-gov"
+                              ]
+                            },
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseFIPS"
+                                },
+                                false
+                              ]
+                            },
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseDualStack"
+                                },
+                                true
+                              ]
+                            }
+                          ],
+                          "endpoint": {
+                            "url": "https://states-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",
+                            "properties": {},
+                            "headers": {}
+                          },
+                          "type": "endpoint"
+                        },
+                        {
+                          "conditions": [
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseFIPS"
+                                },
+                                true
+                              ]
+                            },
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseDualStack"
+                                },
+                                true
+                              ]
+                            }
+                          ],
+                          "rules": [
+                            {
+                              "conditions": [
+                                {
+                                  "fn": "booleanEquals",
+                                  "argv": [
+                                    true,
+                                    {
+                                      "fn": "getAttr",
+                                      "argv": [
+                                        {
+                                          "ref": "PartitionResult"
+                                        },
+                                        "supportsFIPS"
+                                      ]
+                                    }
+                                  ]
+                                },
+                                {
+                                  "fn": "booleanEquals",
+                                  "argv": [
+                                    true,
+                                    {
+                                      "fn": "getAttr",
+                                      "argv": [
+                                        {
+                                          "ref": "PartitionResult"
+                                        },
+                                        "supportsDualStack"
+                                      ]
+                                    }
+                                  ]
+                                }
+                              ],
+                              "rules": [
+                                {
+                                  "conditions": [],
+                                  "endpoint": {
+                                    "url": "https://states-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",
+                                    "properties": {},
+                                    "headers": {}
+                                  },
+                                  "type": "endpoint"
+                                }
+                              ],
+                              "type": "tree"
+                            },
+                            {
+                              "conditions": [],
+                              "error": "FIPS and DualStack are enabled, but this partition does not support one or both",
+                              "type": "error"
+                            }
+                          ],
+                          "type": "tree"
+                        },
+                        {
+                          "conditions": [
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseFIPS"
+                                },
+                                true
+                              ]
+                            },
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseDualStack"
+                                },
+                                false
+                              ]
+                            }
+                          ],
+                          "rules": [
+                            {
+                              "conditions": [
+                                {
+                                  "fn": "booleanEquals",
+                                  "argv": [
+                                    {
+                                      "fn": "getAttr",
+                                      "argv": [
+                                        {
+                                          "ref": "PartitionResult"
+                                        },
+                                        "supportsFIPS"
+                                      ]
+                                    },
+                                    true
+                                  ]
+                                }
+                              ],
+                              "rules": [
+                                {
+                                  "conditions": [],
+                                  "endpoint": {
+                                    "url": "https://states-fips.{Region}.{PartitionResult#dnsSuffix}",
+                                    "properties": {},
+                                    "headers": {}
+                                  },
+                                  "type": "endpoint"
+                                }
+                              ],
+                              "type": "tree"
+                            },
+                            {
+                              "conditions": [],
+                              "error": "FIPS is enabled but this partition does not support FIPS",
+                              "type": "error"
+                            }
+                          ],
+                          "type": "tree"
+                        },
+                        {
+                          "conditions": [
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseFIPS"
+                                },
+                                false
+                              ]
+                            },
+                            {
+                              "fn": "booleanEquals",
+                              "argv": [
+                                {
+                                  "ref": "UseDualStack"
+                                },
+                                true
+                              ]
+                            }
+                          ],
+                          "rules": [
+                            {
+                              "conditions": [
+                                {
+                                  "fn": "booleanEquals",
+                                  "argv": [
+                                    true,
+                                    {
+                                      "fn": "getAttr",
+                                      "argv": [
+                                        {
+                                          "ref": "PartitionResult"
+                                        },
+                                        "supportsDualStack"
+                                      ]
+                                    }
+                                  ]
+                                }
+                              ],
+                              "rules": [
+                                {
+                                  "conditions": [],
+                                  "endpoint": {
+                                    "url": "https://states.{Region}.{PartitionResult#dualStackDnsSuffix}",
+                                    "properties": {},
+                                    "headers": {}
+                                  },
+                                  "type": "endpoint"
+                                }
+                              ],
+                              "type": "tree"
+                            },
+                            {
+                              "conditions": [],
+                              "error": "DualStack is enabled but this partition does not support DualStack",
+                              "type": "error"
+                            }
+                          ],
+                          "type": "tree"
+                        },
+                        {
+                          "conditions": [],
+                          "endpoint": {
+                            "url": "https://states.{Region}.{PartitionResult#dnsSuffix}",
+                            "properties": {},
+                            "headers": {}
+                          },
+                          "type": "endpoint"
+                        }
+                      ],
+                      "type": "tree"
+                    }
+                  ],
+                  "type": "tree"
+                },
+                {
+                  "conditions": [],
+                  "error": "Invalid Configuration: Missing Region",
+                  "type": "error"
+                }
+              ],
+              "type": "tree"
+            }
+          ]
+        },
+        "smithy.rules#endpointTests": {
+          "testCases": [
+            {
+              "documentation": "For custom endpoint with region not set and fips disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://example.com"
+                }
+              },
+              "params": {
+                "Endpoint": "https://example.com",
+                "UseFIPS": false
+              }
+            },
+            {
+              "documentation": "For custom endpoint with fips enabled",
+              "expect": {
+                "error": "Invalid Configuration: FIPS and custom endpoint are not supported"
+              },
+              "params": {
+                "Endpoint": "https://example.com",
+                "UseFIPS": true
+              }
+            },
+            {
+              "documentation": "For custom endpoint with fips disabled and dualstack enabled",
+              "expect": {
+                "error": "Invalid Configuration: Dualstack and custom endpoint are not supported"
+              },
+              "params": {
+                "Endpoint": "https://example.com",
+                "UseFIPS": false,
+                "UseDualStack": true
+              }
+            },
+            {
+              "documentation": "For region us-gov-west-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.us-gov-west-1.amazonaws.com"
+                }
+              },
+              "params": {
+                "Region": "us-gov-west-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-east-1 with FIPS enabled and DualStack enabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.us-east-1.api.aws"
+                }
+              },
+              "params": {
+                "Region": "us-east-1",
+                "UseFIPS": true,
+                "UseDualStack": true
+              }
+            },
+            {
+              "documentation": "For region us-east-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.us-east-1.amazonaws.com"
+                }
+              },
+              "params": {
+                "Region": "us-east-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-east-1 with FIPS disabled and DualStack enabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.us-east-1.api.aws"
+                }
+              },
+              "params": {
+                "Region": "us-east-1",
+                "UseFIPS": false,
+                "UseDualStack": true
+              }
+            },
+            {
+              "documentation": "For region us-east-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.us-east-1.amazonaws.com"
+                }
+              },
+              "params": {
+                "Region": "us-east-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region cn-northwest-1 with FIPS enabled and DualStack enabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.cn-northwest-1.api.amazonwebservices.com.cn"
+                }
+              },
+              "params": {
+                "Region": "cn-northwest-1",
+                "UseFIPS": true,
+                "UseDualStack": true
+              }
+            },
+            {
+              "documentation": "For region cn-northwest-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.cn-northwest-1.amazonaws.com.cn"
+                }
+              },
+              "params": {
+                "Region": "cn-northwest-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region cn-northwest-1 with FIPS disabled and DualStack enabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.cn-northwest-1.api.amazonwebservices.com.cn"
+                }
+              },
+              "params": {
+                "Region": "cn-northwest-1",
+                "UseFIPS": false,
+                "UseDualStack": true
+              }
+            },
+            {
+              "documentation": "For region cn-northwest-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.cn-northwest-1.amazonaws.com.cn"
+                }
+              },
+              "params": {
+                "Region": "cn-northwest-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region eusc-de-east-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.eusc-de-east-1.amazonaws.eu"
+                }
+              },
+              "params": {
+                "Region": "eusc-de-east-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region eusc-de-east-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.eusc-de-east-1.amazonaws.eu"
+                }
+              },
+              "params": {
+                "Region": "eusc-de-east-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-iso-east-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.us-iso-east-1.c2s.ic.gov"
+                }
+              },
+              "params": {
+                "Region": "us-iso-east-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-iso-east-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.us-iso-east-1.c2s.ic.gov"
+                }
+              },
+              "params": {
+                "Region": "us-iso-east-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-isob-east-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.us-isob-east-1.sc2s.sgov.gov"
+                }
+              },
+              "params": {
+                "Region": "us-isob-east-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-isob-east-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.us-isob-east-1.sc2s.sgov.gov"
+                }
+              },
+              "params": {
+                "Region": "us-isob-east-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region eu-isoe-west-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.eu-isoe-west-1.cloud.adc-e.uk"
+                }
+              },
+              "params": {
+                "Region": "eu-isoe-west-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region eu-isoe-west-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.eu-isoe-west-1.cloud.adc-e.uk"
+                }
+              },
+              "params": {
+                "Region": "eu-isoe-west-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-isof-south-1 with FIPS enabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.us-isof-south-1.csp.hci.ic.gov"
+                }
+              },
+              "params": {
+                "Region": "us-isof-south-1",
+                "UseFIPS": true,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-isof-south-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.us-isof-south-1.csp.hci.ic.gov"
+                }
+              },
+              "params": {
+                "Region": "us-isof-south-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "For region us-gov-west-1 with FIPS enabled and DualStack enabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.us-gov-west-1.api.aws"
+                }
+              },
+              "params": {
+                "Region": "us-gov-west-1",
+                "UseFIPS": true,
+                "UseDualStack": true
+              }
+            },
+            {
+              "documentation": "For region us-gov-west-1 with FIPS disabled and DualStack enabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states-fips.us-gov-west-1.api.aws"
+                }
+              },
+              "params": {
+                "Region": "us-gov-west-1",
+                "UseFIPS": false,
+                "UseDualStack": true
+              }
+            },
+            {
+              "documentation": "For region us-gov-west-1 with FIPS disabled and DualStack disabled",
+              "expect": {
+                "endpoint": {
+                  "url": "https://states.us-gov-west-1.amazonaws.com"
+                }
+              },
+              "params": {
+                "Region": "us-gov-west-1",
+                "UseFIPS": false,
+                "UseDualStack": false
+              }
+            },
+            {
+              "documentation": "Missing region",
+              "expect": {
+                "error": "Invalid Configuration: Missing Region"
+              }
+            }
+          ],
+          "version": "1.0"
+        }
+      }
+    },
+    "com.amazonaws.sfn#ActivityAlreadyExists": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Activity already exists. <code>EncryptionConfiguration</code> may not be updated.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#ActivityDoesNotExist": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The specified activity does not exist.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#ActivityFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an activity that failed during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ActivityLimitExceeded": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The maximum number of activities has been reached. Existing activities must be deleted\n      before a new activity can be created.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#ActivityList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#ActivityListItem"
+      }
+    },
+    "com.amazonaws.sfn#ActivityListItem": {
+      "type": "structure",
+      "members": {
+        "activityArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the activity.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the activity.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the activity is created.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an activity.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ActivityScheduleFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an activity schedule failure that occurred during an\n      execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ActivityScheduledEventDetails": {
+      "type": "structure",
+      "members": {
+        "resource": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the scheduled activity.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON data input to the activity task. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "inputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the input for an execution history event.</p>"
+          }
+        },
+        "timeoutInSeconds": {
+          "target": "com.amazonaws.sfn#TimeoutInSeconds",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum allowed duration of the activity task.</p>"
+          }
+        },
+        "heartbeatInSeconds": {
+          "target": "com.amazonaws.sfn#TimeoutInSeconds",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum allowed duration between two heartbeats for the activity task.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an activity scheduled during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ActivityStartedEventDetails": {
+      "type": "structure",
+      "members": {
+        "workerName": {
+          "target": "com.amazonaws.sfn#Identity",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the worker that the task is assigned to. These names are provided by the\n      workers when calling <a>GetActivityTask</a>.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the start of an activity during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ActivitySucceededEventDetails": {
+      "type": "structure",
+      "members": {
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON data output by the activity task. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the output of an execution history event.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an activity that successfully terminated during an\n      execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ActivityTimedOutEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the timeout.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an activity timeout that occurred during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ActivityWorkerLimitExceeded": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The maximum number of workers concurrently polling for activity tasks has been\n      reached.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#AliasDescription": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 256
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#Arn": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 256
+        }
+      }
+    },
+    "com.amazonaws.sfn#AssignedVariables": {
+      "type": "map",
+      "key": {
+        "target": "com.amazonaws.sfn#VariableName"
+      },
+      "value": {
+        "target": "com.amazonaws.sfn#VariableValue"
+      }
+    },
+    "com.amazonaws.sfn#AssignedVariablesDetails": {
+      "type": "structure",
+      "members": {
+        "truncated": {
+          "target": "com.amazonaws.sfn#truncated",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Indicates whether assigned variables were truncated in the response. Always <code>false</code>\n    for API calls. In CloudWatch logs, the value will be true if the data is truncated due to size limits.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Provides details about assigned variables in an execution history event.</p>"
+      }
+    },
+    "com.amazonaws.sfn#BilledDuration": {
+      "type": "long",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#BilledMemoryUsed": {
+      "type": "long",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#BillingDetails": {
+      "type": "structure",
+      "members": {
+        "billedMemoryUsedInMB": {
+          "target": "com.amazonaws.sfn#BilledMemoryUsed",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>Billed memory consumption of your workflow, in MB.</p>"
+          }
+        },
+        "billedDurationInMilliseconds": {
+          "target": "com.amazonaws.sfn#BilledDuration",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>Billed duration of your workflow, in milliseconds.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>An object that describes workflow billing details.</p>"
+      }
+    },
+    "com.amazonaws.sfn#CharacterRestrictedName": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 80
+        },
+        "smithy.api#pattern": "^(?=.*[a-zA-Z_\\-\\.])[a-zA-Z0-9_\\-\\.]+$"
+      }
+    },
+    "com.amazonaws.sfn#ClientToken": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 64
+        },
+        "smithy.api#pattern": "^[!-~]+$"
+      }
+    },
+    "com.amazonaws.sfn#CloudWatchEventsExecutionDataDetails": {
+      "type": "structure",
+      "members": {
+        "included": {
+          "target": "com.amazonaws.sfn#includedDetails",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Indicates whether input or output was included in the response. Always <code>true</code>\n      for API calls. </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Provides details about execution input or output.</p>"
+      }
+    },
+    "com.amazonaws.sfn#CloudWatchLogsLogGroup": {
+      "type": "structure",
+      "members": {
+        "logGroupArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The ARN of the the CloudWatch log group to which you want your logs emitted to. The ARN\n      must end with <code>:*</code>\n         </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p></p>"
+      }
+    },
+    "com.amazonaws.sfn#ConflictException": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Updating or deleting a resource can cause an inconsistent state. This error occurs when there're concurrent requests for <a>DeleteStateMachineVersion</a>, <a>PublishStateMachineVersion</a>, or <a>UpdateStateMachine</a> with the <code>publish</code> parameter set to <code>true</code>.</p>\n         <p>HTTP Status Code: 409</p>",
+        "smithy.api#error": "client",
+        "smithy.api#httpError": 409
+      }
+    },
+    "com.amazonaws.sfn#ConnectorParameters": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 262144
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateActivity": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#CreateActivityInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#CreateActivityOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ActivityAlreadyExists"
+        },
+        {
+          "target": "com.amazonaws.sfn#ActivityLimitExceeded"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidEncryptionConfiguration"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidName"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#TooManyTags"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Creates an activity. An activity is a task that you write in any programming language and\n      host on any machine that has access to Step Functions. Activities must poll Step Functions using the\n        <code>GetActivityTask</code> API action and respond using <code>SendTask*</code> API\n      actions. This function lets Step Functions know the existence of your activity and returns an\n      identifier for use in a state machine and when polling from the activity.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>\n         <note>\n            <p>\n               <code>CreateActivity</code> is an idempotent API. Subsequent requests won\u2019t create a\n        duplicate resource if it was already created. <code>CreateActivity</code>'s idempotency\n        check is based on the activity <code>name</code>. If a following request has different\n          <code>tags</code> values, Step Functions will ignore these differences and treat it as an\n        idempotent request of the previous. In this case, <code>tags</code> will not be updated,\n        even if they are different.</p>\n         </note>",
+        "smithy.api#idempotent": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateActivityInput": {
+      "type": "structure",
+      "members": {
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the activity to create. This name must be unique for your Amazon Web Services account and region.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "tags": {
+          "target": "com.amazonaws.sfn#TagList",
+          "traits": {
+            "smithy.api#documentation": "<p>The list of tags to add to a resource.</p>\n         <p>An array of key-value pairs. For more information, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html\">Using\n      Cost Allocation Tags</a> in the <i>Amazon Web Services Billing and Cost Management User\n        Guide</i>, and <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html\">Controlling Access Using IAM\n          Tags</a>.</p>\n         <p>Tags may only contain Unicode letters, digits, white space, or these symbols: <code>_ . : / = + - @</code>.</p>"
+          }
+        },
+        "encryptionConfiguration": {
+          "target": "com.amazonaws.sfn#EncryptionConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Settings to configure server-side encryption.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateActivityOutput": {
+      "type": "structure",
+      "members": {
+        "activityArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the created activity.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the activity is created.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateStateMachine": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#CreateStateMachineInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#CreateStateMachineOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ConflictException"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidDefinition"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidEncryptionConfiguration"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidLoggingConfiguration"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidName"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidTracingConfiguration"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineAlreadyExists"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineLimitExceeded"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineTypeNotSupported"
+        },
+        {
+          "target": "com.amazonaws.sfn#TooManyTags"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Creates a state machine. A state machine consists of a collection of states that can do\n      work (<code>Task</code> states), determine to which states to transition next\n        (<code>Choice</code> states), stop an execution with an error (<code>Fail</code> states),\n      and so on. State machines are specified using a JSON-based, structured language. For more\n      information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States\n        Language</a> in the Step Functions User Guide.</p>\n         <p>If you set the <code>publish</code> parameter of this API action to <code>true</code>, it\n      publishes version <code>1</code> as the first revision of the state machine.</p>\n         <p>\n        For additional control over security, you can encrypt your data using a <b>customer-managed key</b> for Step Functions state machines. You can configure a symmetric KMS key and data key reuse period when creating or updating a <b>State Machine</b>. The execution history and state machine definition will be encrypted with the key applied to the State Machine.\n    </p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>\n         <note>\n            <p>\n               <code>CreateStateMachine</code> is an idempotent API. Subsequent requests won\u2019t create a\n        duplicate resource if it was already created. <code>CreateStateMachine</code>'s idempotency\n        check is based on the state machine <code>name</code>, <code>definition</code>,\n          <code>type</code>, <code>LoggingConfiguration</code>,\n        <code>TracingConfiguration</code>, and <code>EncryptionConfiguration</code> The check is also based on the <code>publish</code> and <code>versionDescription</code> parameters. If a following request has a different\n          <code>roleArn</code> or <code>tags</code>, Step Functions will ignore these differences and treat\n        it as an idempotent request of the previous. In this case, <code>roleArn</code> and\n          <code>tags</code> will not be updated, even if they are different.</p>\n         </note>",
+        "smithy.api#idempotent": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateStateMachineAlias": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#CreateStateMachineAliasInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#CreateStateMachineAliasOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ConflictException"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidName"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#ServiceQuotaExceededException"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Creates an <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a> for a state machine that points to one or two <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">versions</a> of the same state machine. You can set your application to call <a>StartExecution</a> with an alias and update the version the alias uses without changing the client's code.</p>\n         <p>You can also map an alias to split <a>StartExecution</a> requests between two\n      versions of a state machine. To do this, add a second <code>RoutingConfig</code> object in the\n        <code>routingConfiguration</code> parameter. You must also specify the percentage of\n      execution run requests each version should receive in both <code>RoutingConfig</code> objects.\n        Step Functions randomly chooses which version runs a given execution based on the\n      percentage you specify.</p>\n         <p>To create an alias that points to a single version, specify a single\n        <code>RoutingConfig</code> object with a <code>weight</code> set to 100.</p>\n         <p>You can create up to 100 aliases for each state machine. You must delete unused aliases using the <a>DeleteStateMachineAlias</a> API action.</p>\n         <p>\n            <code>CreateStateMachineAlias</code> is an idempotent API. Step Functions bases the\n      idempotency check on the <code>stateMachineArn</code>, <code>description</code>,\n        <code>name</code>, and <code>routingConfiguration</code> parameters. Requests that contain\n      the same values for these parameters return a successful idempotent response without creating\n      a duplicate resource.</p>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>DescribeStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>ListStateMachineAliases</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>UpdateStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DeleteStateMachineAlias</a>\n               </p>\n            </li>\n         </ul>"
+      }
+    },
+    "com.amazonaws.sfn#CreateStateMachineAliasInput": {
+      "type": "structure",
+      "members": {
+        "description": {
+          "target": "com.amazonaws.sfn#AliasDescription",
+          "traits": {
+            "smithy.api#documentation": "<p>A description for the state machine alias.</p>"
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#CharacterRestrictedName",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state machine alias.</p>\n         <p>To avoid conflict with version ARNs, don't use an integer in the name of the alias.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "routingConfiguration": {
+          "target": "com.amazonaws.sfn#RoutingConfigurationList",
+          "traits": {
+            "smithy.api#documentation": "<p>The routing configuration of a state machine alias. The routing configuration shifts\n      execution traffic between two state machine versions. <code>routingConfiguration</code>\n      contains an array of <code>RoutingConfig</code> objects that specify up to two state machine\n      versions. Step Functions then randomly choses which version to run an execution with based\n      on the weight assigned to each <code>RoutingConfig</code>.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateStateMachineAliasOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the created state machine alias.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the state machine alias was created.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateStateMachineInput": {
+      "type": "structure",
+      "members": {
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state machine. </p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "definition": {
+          "target": "com.amazonaws.sfn#Definition",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon States Language definition of the state machine. See <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States Language</a>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "roleArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the IAM role to use for this state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "type": {
+          "target": "com.amazonaws.sfn#StateMachineType",
+          "traits": {
+            "smithy.api#documentation": "<p>Determines whether a Standard or Express state machine is created. The default is\n        <code>STANDARD</code>. You cannot update the <code>type</code> of a state machine once it\n      has been created.</p>"
+          }
+        },
+        "loggingConfiguration": {
+          "target": "com.amazonaws.sfn#LoggingConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Defines what execution history events are logged and where they are logged.</p>\n         <note>\n            <p>By default, the <code>level</code> is set to <code>OFF</code>. For more information see\n          <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/cloudwatch-log-level.html\">Log\n          Levels</a> in the Step Functions User Guide.</p>\n         </note>"
+          }
+        },
+        "tags": {
+          "target": "com.amazonaws.sfn#TagList",
+          "traits": {
+            "smithy.api#documentation": "<p>Tags to be added when creating a state machine.</p>\n         <p>An array of key-value pairs. For more information, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html\">Using\n      Cost Allocation Tags</a> in the <i>Amazon Web Services Billing and Cost Management User\n        Guide</i>, and <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html\">Controlling Access Using IAM\n          Tags</a>.</p>\n         <p>Tags may only contain Unicode letters, digits, white space, or these symbols: <code>_ . : / = + - @</code>.</p>"
+          }
+        },
+        "tracingConfiguration": {
+          "target": "com.amazonaws.sfn#TracingConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Selects whether X-Ray tracing is enabled.</p>"
+          }
+        },
+        "publish": {
+          "target": "com.amazonaws.sfn#Publish",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Set to <code>true</code> to publish the first version of the state machine during creation. The default is <code>false</code>.</p>"
+          }
+        },
+        "versionDescription": {
+          "target": "com.amazonaws.sfn#VersionDescription",
+          "traits": {
+            "smithy.api#documentation": "<p>Sets description about the state machine version. You can only set the description if the <code>publish</code> parameter is set to <code>true</code>. Otherwise, if you set <code>versionDescription</code>, but <code>publish</code> to <code>false</code>, this API action throws <code>ValidationException</code>.</p>"
+          }
+        },
+        "encryptionConfiguration": {
+          "target": "com.amazonaws.sfn#EncryptionConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Settings to configure server-side encryption.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#CreateStateMachineOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the created state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the state machine is created.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the created state machine version. If you do not set the <code>publish</code> parameter to <code>true</code>, this field returns null value.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#Definition": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 1048576
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteActivity": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DeleteActivityInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DeleteActivityOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Deletes an activity.</p>"
+      }
+    },
+    "com.amazonaws.sfn#DeleteActivityInput": {
+      "type": "structure",
+      "members": {
+        "activityArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the activity to delete.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteActivityOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachine": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DeleteStateMachineInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DeleteStateMachineOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Deletes a state machine. This is an asynchronous operation. It sets the state machine's\n      status to <code>DELETING</code> and begins the deletion process. A state machine is deleted only when all its executions are completed. On the next state transition, the state machine's executions are terminated.</p>\n         <p>A qualified state machine ARN can either refer to a <i>Distributed Map state</i> defined within a state machine, a version ARN, or an alias ARN.</p>\n         <p>The following are some examples of qualified and unqualified state machine ARNs:</p>\n         <ul>\n            <li>\n               <p>The following qualified state machine ARN refers to a <i>Distributed Map state</i> with a label <code>mapStateLabel</code> in a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:partition:states:region:account-id:stateMachine:myStateMachine/mapStateLabel</code>\n               </p>\n               <note>\n                  <p>If you provide a qualified state machine ARN that refers to a <i>Distributed Map state</i>, the request fails with <code>ValidationException</code>.</p>\n               </note>\n            </li>\n            <li>\n               <p>The following unqualified state machine ARN refers to a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:partition:states:region:account-id:stateMachine:myStateMachine</code>\n               </p>\n            </li>\n         </ul>\n         <p>This API action also deletes all <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">versions</a> and <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">aliases</a> associated with a state machine.</p>\n         <note>\n            <p>For <code>EXPRESS</code> state machines, the deletion happens eventually (usually in\n        less than a minute). Running executions may emit logs after <code>DeleteStateMachine</code>\n        API is called.</p>\n         </note>"
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineAlias": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DeleteStateMachineAliasInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DeleteStateMachineAliasOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ConflictException"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Deletes a state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a>.</p>\n         <p>After you delete a state machine alias, you can't use it to start executions. When you\n      delete a state machine alias, Step Functions doesn't delete the state machine versions\n      that alias references.</p>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>CreateStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DescribeStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>ListStateMachineAliases</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>UpdateStateMachineAlias</a>\n               </p>\n            </li>\n         </ul>"
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineAliasInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine alias to delete.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineAliasOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine to delete.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineVersion": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DeleteStateMachineVersionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DeleteStateMachineVersionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ConflictException"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Deletes a state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">version</a>. After\n      you delete a version, you can't call <a>StartExecution</a> using that version's ARN\n      or use the version with a state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a>.</p>\n         <note>\n            <p>Deleting a state machine version won't terminate its in-progress executions.</p>\n         </note>\n         <note>\n            <p>You can't delete a state machine version currently referenced by one or more aliases. Before you delete a version, you must either delete the aliases or update them to point to another state machine version.</p>\n         </note>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>PublishStateMachineVersion</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>ListStateMachineVersions</a>\n               </p>\n            </li>\n         </ul>"
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineVersionInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine version to delete.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DeleteStateMachineVersionOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeActivity": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DescribeActivityInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DescribeActivityOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ActivityDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Describes an activity.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>"
+      }
+    },
+    "com.amazonaws.sfn#DescribeActivityInput": {
+      "type": "structure",
+      "members": {
+        "activityArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the activity to describe.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeActivityOutput": {
+      "type": "structure",
+      "members": {
+        "activityArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the activity.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the activity.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the activity is created.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "encryptionConfiguration": {
+          "target": "com.amazonaws.sfn#EncryptionConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Settings for configured server-side encryption.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeExecution": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DescribeExecutionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DescribeExecutionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ExecutionDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Provides information about a state machine execution, such as the state machine associated with the execution, the execution input and output, and relevant execution metadata. If you've <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/redrive-executions.html\">redriven</a> an execution, you can use this API action to return information about the redrives of that execution. In addition, you can use this API action to return the Map Run Amazon Resource Name (ARN) if the execution was dispatched by a Map Run.</p>\n         <p>If you specify a version or alias ARN when you call the <a>StartExecution</a>\n      API action, <code>DescribeExecution</code> returns that ARN.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>\n         <p>Executions of an <code>EXPRESS</code> state machine aren't supported by <code>DescribeExecution</code> unless a Map Run dispatched them.</p>"
+      }
+    },
+    "com.amazonaws.sfn#DescribeExecutionInput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the execution to describe.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "includedData": {
+          "target": "com.amazonaws.sfn#IncludedData",
+          "traits": {
+            "smithy.api#documentation": "<p>If your state machine definition is encrypted with a KMS key, callers must have <code>kms:Decrypt</code> permission to decrypt the definition. Alternatively, you can call DescribeStateMachine API with <code>includedData = METADATA_ONLY</code> to get a successful response without the encrypted definition.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeExecutionOutput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the executed stated machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the execution.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>"
+          }
+        },
+        "status": {
+          "target": "com.amazonaws.sfn#ExecutionStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>The current status of the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "startDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution is started.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stopDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>If the execution ended, the date the execution stopped.</p>"
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The string that contains the JSON input data of the execution. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "inputDetails": {
+          "target": "com.amazonaws.sfn#CloudWatchEventsExecutionDataDetails"
+        },
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON output data of the execution. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>\n         <note>\n            <p>This field is set only if the execution succeeds. If the execution fails, this field is\n        null.</p>\n         </note>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#CloudWatchEventsExecutionDataDetails"
+        },
+        "traceHeader": {
+          "target": "com.amazonaws.sfn#TraceHeader",
+          "traits": {
+            "smithy.api#documentation": "<p>The X-Ray trace header that was passed to the execution.</p>\n         <note>\n            <p>\n                For X-Ray traces, all Amazon Web Services services use the <code>X-Amzn-Trace-Id</code> header from the HTTP request. Using the header is the preferred mechanism to identify a trace. <code>StartExecution</code> and <code>StartSyncExecution</code> API operations can also use <code>traceHeader</code> from the body of the request payload. If <b>both</b> sources are provided, Step Functions will use the <b>header value</b> (preferred) over the value in the request body.\n            </p>\n         </note>"
+          }
+        },
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies a Map Run, which dispatched this execution.</p>"
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error string if the state machine execution failed.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>The cause string if the state machine execution failed.</p>"
+          }
+        },
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine version associated with the execution. The version ARN is a combination of state machine ARN and the version number separated by a colon (:). For example, <code>stateMachineARN:1</code>.</p>\n         <p>If you start an execution from a <code>StartExecution</code> request without specifying a\n      state machine version or alias ARN, Step Functions returns a null value.</p>"
+          }
+        },
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine alias associated with the execution. The alias ARN is a combination of state machine ARN and the alias name separated by a colon (:). For example, <code>stateMachineARN:PROD</code>.</p>\n         <p>If you start an execution from a <code>StartExecution</code> request with a\n      state machine version ARN, this field will be null.</p>"
+          }
+        },
+        "redriveCount": {
+          "target": "com.amazonaws.sfn#RedriveCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of times you've redriven an execution. If you have not yet redriven an execution, the <code>redriveCount</code> is 0. This count is only updated if you successfully redrive an execution.</p>"
+          }
+        },
+        "redriveDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution was last redriven. If you have not yet redriven an execution, the <code>redriveDate</code> is null.</p>\n         <p>The <code>redriveDate</code> is unavailable if you redrive a Map Run that starts child workflow executions of type <code>EXPRESS</code>.</p>"
+          }
+        },
+        "redriveStatus": {
+          "target": "com.amazonaws.sfn#ExecutionRedriveStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>Indicates whether or not an execution can be redriven at a given point in time.</p>\n         <ul>\n            <li>\n               <p>For executions of type <code>STANDARD</code>, <code>redriveStatus</code> is <code>NOT_REDRIVABLE</code> if calling the <a>RedriveExecution</a> API action would return the <code>ExecutionNotRedrivable</code> error.</p>\n            </li>\n            <li>\n               <p>For a Distributed Map that includes child workflows of type <code>STANDARD</code>, <code>redriveStatus</code> indicates whether or not the Map Run can redrive child workflow executions.</p>\n            </li>\n            <li>\n               <p>For a Distributed Map that includes child workflows of type <code>EXPRESS</code>, <code>redriveStatus</code> indicates whether or not the Map Run can redrive child workflow executions.</p>\n               <p>You can redrive failed or timed out <code>EXPRESS</code> workflows <i>only if</i> they're a part of a Map Run. When you <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/redrive-map-run.html\">redrive</a> the Map Run, these workflows are restarted using the <a>StartExecution</a> API action.</p>\n            </li>\n         </ul>"
+          }
+        },
+        "redriveStatusReason": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>When <code>redriveStatus</code> is <code>NOT_REDRIVABLE</code>, <code>redriveStatusReason</code> specifies the reason why an execution cannot be redriven.</p>\n         <ul>\n            <li>\n               <p>For executions of type <code>STANDARD</code>, or for a Distributed Map that includes child workflows of type <code>STANDARD</code>, <code>redriveStatusReason</code> can include one of the following reasons:</p>\n               <ul>\n                  <li>\n                     <p>\n                        <code>State machine is in DELETING status</code>.</p>\n                  </li>\n                  <li>\n                     <p>\n                        <code>Execution is RUNNING and cannot be redriven</code>.</p>\n                  </li>\n                  <li>\n                     <p>\n                        <code>Execution is SUCCEEDED and cannot be redriven</code>.</p>\n                  </li>\n                  <li>\n                     <p>\n                        <code>Execution was started before the launch of RedriveExecution</code>.</p>\n                  </li>\n                  <li>\n                     <p>\n                        <code>Execution history event limit exceeded</code>.</p>\n                  </li>\n                  <li>\n                     <p>\n                        <code>Execution has exceeded the max execution time</code>.</p>\n                  </li>\n                  <li>\n                     <p>\n                        <code>Execution redrivable period exceeded</code>.</p>\n                  </li>\n               </ul>\n            </li>\n            <li>\n               <p>For a Distributed Map that includes child workflows of type <code>EXPRESS</code>, <code>redriveStatusReason</code> is only returned if the child workflows are not redrivable. This happens when the child workflow executions have completed successfully.</p>\n            </li>\n         </ul>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeMapRun": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DescribeMapRunInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DescribeMapRunOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Provides information about a Map Run's configuration, progress, and results. If you've <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/redrive-map-run.html\">redriven</a> a Map Run, this API action also returns information about the redrives of that Map Run. For more information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-examine-map-run.html\">Examining Map Run</a> in the <i>Step Functions Developer Guide</i>.</p>"
+      }
+    },
+    "com.amazonaws.sfn#DescribeMapRunInput": {
+      "type": "structure",
+      "members": {
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies a Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeMapRunOutput": {
+      "type": "structure",
+      "members": {
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies a Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the execution in which the Map Run was started.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "status": {
+          "target": "com.amazonaws.sfn#MapRunStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>The current status of the Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "startDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date when the Map Run was started.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stopDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date when the Map Run was stopped.</p>"
+          }
+        },
+        "maxConcurrency": {
+          "target": "com.amazonaws.sfn#MaxConcurrency",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of child workflow executions configured to run in parallel for the Map Run at the same time.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "toleratedFailurePercentage": {
+          "target": "com.amazonaws.sfn#ToleratedFailurePercentage",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum percentage of failed child workflow executions before the Map Run fails.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "toleratedFailureCount": {
+          "target": "com.amazonaws.sfn#ToleratedFailureCount",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of failed child workflow executions before the Map Run fails.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "itemCounts": {
+          "target": "com.amazonaws.sfn#MapRunItemCounts",
+          "traits": {
+            "smithy.api#documentation": "<p>A JSON object that contains information about the total number of items, and the item count for each processing status, such as <code>pending</code> and <code>failed</code>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "executionCounts": {
+          "target": "com.amazonaws.sfn#MapRunExecutionCounts",
+          "traits": {
+            "smithy.api#documentation": "<p>A JSON object that contains information about the total number of child workflow executions for the Map Run, and the count of child workflow executions for each status, such as <code>failed</code> and <code>succeeded</code>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "redriveCount": {
+          "target": "com.amazonaws.sfn#RedriveCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of times you've redriven a Map Run. If you have not yet redriven a Map Run, the <code>redriveCount</code> is 0. This count is only updated if you successfully redrive a Map Run.</p>"
+          }
+        },
+        "redriveDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date a Map Run was last redriven. If you have not yet redriven a Map Run, the <code>redriveDate</code> is null.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachine": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DescribeStateMachineInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DescribeStateMachineOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDoesNotExist"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Provides information about a state machine's definition, its IAM role Amazon Resource Name (ARN), and configuration.</p>\n         <p>A qualified state machine ARN can either refer to a <i>Distributed Map state</i> defined within a state machine, a version ARN, or an alias ARN.</p>\n         <p>The following are some examples of qualified and unqualified state machine ARNs:</p>\n         <ul>\n            <li>\n               <p>The following qualified state machine ARN refers to a <i>Distributed Map state</i> with a label <code>mapStateLabel</code> in a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:partition:states:region:account-id:stateMachine:myStateMachine/mapStateLabel</code>\n               </p>\n               <note>\n                  <p>If you provide a qualified state machine ARN that refers to a <i>Distributed Map state</i>, the request fails with <code>ValidationException</code>.</p>\n               </note>\n            </li>\n            <li>\n               <p>The following qualified state machine ARN refers to an alias named <code>PROD</code>.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine:PROD></code>\n               </p>\n               <note>\n                  <p>If you provide a qualified state machine ARN that refers to a version ARN or an alias ARN, the request starts execution for that version or alias.</p>\n               </note>\n            </li>\n            <li>\n               <p>The following unqualified state machine ARN refers to a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine></code>\n               </p>\n            </li>\n         </ul>\n         <p>This API action returns the details for a state machine version if the\n        <code>stateMachineArn</code> you specify is a state machine version ARN.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>"
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineAlias": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DescribeStateMachineAliasInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DescribeStateMachineAliasOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Returns details about a state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a>.</p>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>CreateStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>ListStateMachineAliases</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>UpdateStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DeleteStateMachineAlias</a>\n               </p>\n            </li>\n         </ul>"
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineAliasInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine alias.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineAliasOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine alias.</p>"
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state machine alias.</p>"
+          }
+        },
+        "description": {
+          "target": "com.amazonaws.sfn#AliasDescription",
+          "traits": {
+            "smithy.api#documentation": "<p>A description of the alias.</p>"
+          }
+        },
+        "routingConfiguration": {
+          "target": "com.amazonaws.sfn#RoutingConfigurationList",
+          "traits": {
+            "smithy.api#documentation": "<p>The routing configuration of the alias.</p>"
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the state machine alias was created.</p>"
+          }
+        },
+        "updateDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the state machine alias was last updated.</p>\n         <p>For a newly created state machine, this is the same as the creation date.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineForExecution": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#DescribeStateMachineForExecutionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#DescribeStateMachineForExecutionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ExecutionDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Provides information about a state machine's definition, its execution role ARN, and\n      configuration. If a Map Run dispatched the execution, this action returns the Map Run\n      Amazon Resource Name (ARN) in the response. The state machine returned is the state machine associated with the\n      Map Run.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>\n         <p>This API action is not supported by <code>EXPRESS</code> state machines.</p>"
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineForExecutionInput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the execution you want state machine information for.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "includedData": {
+          "target": "com.amazonaws.sfn#IncludedData",
+          "traits": {
+            "smithy.api#documentation": "<p>If your state machine definition is encrypted with a KMS key, callers must have <code>kms:Decrypt</code> permission to decrypt the definition. Alternatively, you can call the API with <code>includedData = METADATA_ONLY</code> to get a successful response without the encrypted definition.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineForExecutionOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine associated with the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state machine associated with the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "definition": {
+          "target": "com.amazonaws.sfn#Definition",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon States Language definition of the state machine. See <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States Language</a>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "roleArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the IAM role of the State Machine for the execution. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "updateDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date and time the state machine associated with an execution was updated. For a newly\n      created state machine, this is the creation date.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "loggingConfiguration": {
+          "target": "com.amazonaws.sfn#LoggingConfiguration"
+        },
+        "tracingConfiguration": {
+          "target": "com.amazonaws.sfn#TracingConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Selects whether X-Ray tracing is enabled.</p>"
+          }
+        },
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the Map Run that started the child workflow execution. This field is returned only if the <code>executionArn</code> is a child workflow execution that was started by a Distributed Map state.</p>"
+          }
+        },
+        "label": {
+          "target": "com.amazonaws.sfn#MapRunLabel",
+          "traits": {
+            "smithy.api#documentation": "<p>A user-defined or an auto-generated string that identifies a <code>Map</code> state. This field is returned only if the <code>executionArn</code> is a child workflow execution that was started by a Distributed Map state.</p>"
+          }
+        },
+        "revisionId": {
+          "target": "com.amazonaws.sfn#RevisionId",
+          "traits": {
+            "smithy.api#documentation": "<p>The revision identifier for the state machine. The first revision ID when you create the state machine is null.</p>\n         <p>Use the state machine <code>revisionId</code> parameter to compare the revision of a state machine with the configuration of the state machine used for executions without performing a diff of the properties, such as <code>definition</code> and <code>roleArn</code>.</p>"
+          }
+        },
+        "encryptionConfiguration": {
+          "target": "com.amazonaws.sfn#EncryptionConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Settings to configure server-side encryption. </p>"
+          }
+        },
+        "variableReferences": {
+          "target": "com.amazonaws.sfn#VariableReferences",
+          "traits": {
+            "smithy.api#documentation": "<p>A map of <b>state name</b> to a list of variables referenced by that state. States that do not use variable references will not be shown in the response.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine for which you want the information.</p>\n         <p>If you specify a state machine version ARN, this API returns details about that version. The version ARN is a combination of state machine ARN and the version number separated by a colon (:). For example, <code>stateMachineARN:1</code>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "includedData": {
+          "target": "com.amazonaws.sfn#IncludedData",
+          "traits": {
+            "smithy.api#documentation": "<p>If your state machine definition is encrypted with a KMS key, callers must have <code>kms:Decrypt</code> permission to decrypt the definition. Alternatively, you can call the API with <code>includedData = METADATA_ONLY</code> to get a successful response without the encrypted definition.</p>\n         <note>\n            <p>\n            When calling a labelled ARN for an encrypted state machine, the <code>includedData = METADATA_ONLY</code> parameter will not apply because Step Functions needs to decrypt the entire state machine definition to get the Distributed Map state\u2019s definition. In this case, the API caller needs to have <code>kms:Decrypt</code> permission.\n        </p>\n         </note>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#DescribeStateMachineOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the state machine.</p>\n         <p>If you specified a state machine version ARN in your request, the API returns the version ARN. The version ARN is a combination of state machine ARN and the version number separated by a colon (:). For example, <code>stateMachineARN:1</code>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state machine.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "status": {
+          "target": "com.amazonaws.sfn#StateMachineStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>The current status of the state machine.</p>"
+          }
+        },
+        "definition": {
+          "target": "com.amazonaws.sfn#Definition",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon States Language definition of the state machine. See <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States Language</a>.</p>\n         <p>If called with <code>includedData = METADATA_ONLY</code>, the returned definition will be <code>{}</code>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "roleArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the IAM role used when creating this state machine. (The IAM role\n      maintains security by granting Step Functions access to Amazon Web Services resources.)</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "type": {
+          "target": "com.amazonaws.sfn#StateMachineType",
+          "traits": {
+            "smithy.api#documentation": "<p>The <code>type</code> of the state machine (<code>STANDARD</code> or\n      <code>EXPRESS</code>).</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the state machine is created.</p>\n         <p>For a state machine version, <code>creationDate</code> is the date the version was created.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "loggingConfiguration": {
+          "target": "com.amazonaws.sfn#LoggingConfiguration"
+        },
+        "tracingConfiguration": {
+          "target": "com.amazonaws.sfn#TracingConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Selects whether X-Ray tracing is enabled.</p>"
+          }
+        },
+        "label": {
+          "target": "com.amazonaws.sfn#MapRunLabel",
+          "traits": {
+            "smithy.api#documentation": "<p>A user-defined or an auto-generated string that identifies a <code>Map</code> state. This parameter is present only if the <code>stateMachineArn</code> specified in input is a qualified state machine ARN.</p>"
+          }
+        },
+        "revisionId": {
+          "target": "com.amazonaws.sfn#RevisionId",
+          "traits": {
+            "smithy.api#documentation": "<p>The revision identifier for the state machine.</p>\n         <p>Use the <code>revisionId</code> parameter to compare between versions of a state machine\n      configuration used for executions without performing a diff of the properties, such as\n        <code>definition</code> and <code>roleArn</code>.</p>"
+          }
+        },
+        "description": {
+          "target": "com.amazonaws.sfn#VersionDescription",
+          "traits": {
+            "smithy.api#documentation": "<p>The description of the state machine version.</p>"
+          }
+        },
+        "encryptionConfiguration": {
+          "target": "com.amazonaws.sfn#EncryptionConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Settings to configure server-side encryption. </p>"
+          }
+        },
+        "variableReferences": {
+          "target": "com.amazonaws.sfn#VariableReferences",
+          "traits": {
+            "smithy.api#documentation": "<p>A map of <b>state name</b> to a list of variables referenced by that state. States that do not use variable references will not be shown in the response.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#Enabled": {
+      "type": "boolean",
+      "traits": {
+        "smithy.api#default": false
+      }
+    },
+    "com.amazonaws.sfn#EncryptionConfiguration": {
+      "type": "structure",
+      "members": {
+        "kmsKeyId": {
+          "target": "com.amazonaws.sfn#KmsKeyId",
+          "traits": {
+            "smithy.api#documentation": "<p>An alias, alias ARN, key ID, or key ARN of a symmetric encryption KMS key to encrypt data. To specify a KMS key in a different Amazon Web Services  account, you must use the key ARN or alias ARN.</p>"
+          }
+        },
+        "kmsDataKeyReusePeriodSeconds": {
+          "target": "com.amazonaws.sfn#KmsDataKeyReusePeriodSeconds",
+          "traits": {
+            "smithy.api#documentation": "<p>Maximum duration that Step Functions will reuse data keys. When the period expires, Step Functions will call <code>GenerateDataKey</code>. Only applies to customer managed keys.</p>"
+          }
+        },
+        "type": {
+          "target": "com.amazonaws.sfn#EncryptionType",
+          "traits": {
+            "smithy.api#documentation": "<p>Encryption type</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Settings to configure server-side encryption. </p>\n         <p>\n        For additional control over security, you can encrypt your data using a <b>customer-managed key</b> for  Step Functions state machines and activities. You can configure a symmetric KMS key and data key reuse period when creating or updating a <b>State Machine</b>, and when creating an <b>Activity</b>. The execution history and state machine definition will be encrypted with the key applied to the State Machine. Activity inputs will be encrypted with the key applied to the Activity.\n    </p>\n         <note>\n            <p> Step Functions automatically enables encryption at rest using  Amazon Web Services owned keys at no charge. However, KMS charges apply when using a customer managed key. For more information about pricing, see <a href=\"https://aws.amazon.com/kms/pricing/\">Key Management Service pricing</a>.</p>\n         </note>\n         <p>For more information on KMS, see <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/overview.html\">What is  Key Management Service?</a>\n         </p>"
+      }
+    },
+    "com.amazonaws.sfn#EncryptionType": {
+      "type": "enum",
+      "members": {
+        "AWS_OWNED_KEY": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "AWS_OWNED_KEY"
+          }
+        },
+        "CUSTOMER_MANAGED_KMS_KEY": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "CUSTOMER_MANAGED_KMS_KEY"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#ErrorMessage": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#EvaluationFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        },
+        "location": {
+          "target": "com.amazonaws.sfn#EvaluationFailureLocation",
+          "traits": {
+            "smithy.api#documentation": "<p>The location of the field in the state in which the evaluation error occurred.</p>"
+          }
+        },
+        "state": {
+          "target": "com.amazonaws.sfn#StateName",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state in which the evaluation error occurred.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an evaluation failure that occurred while processing a state, for example, when a JSONata expression throws an error. This event will only be present in state machines that have <b> QueryLanguage</b> set to JSONata, or individual states set to JSONata.</p>"
+      }
+    },
+    "com.amazonaws.sfn#EvaluationFailureLocation": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 256
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#EventId": {
+      "type": "long",
+      "traits": {
+        "smithy.api#default": 0
+      }
+    },
+    "com.amazonaws.sfn#ExceptionHandlerIndex": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#range": {
+          "min": 0
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#ExecutionAbortedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an abort of an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionAlreadyExists": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The execution has the same <code>name</code> as another execution (but a different\n        <code>input</code>).</p>\n         <note>\n            <p>Executions with the same <code>name</code> and <code>input</code> are considered\n        idempotent.</p>\n         </note>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionDoesNotExist": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The specified execution does not exist.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an execution failure event.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionLimitExceeded": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The maximum number of running executions has been reached. Running executions must end or\n      be stopped before a new execution can be started.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#ExecutionListItem"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionListItem": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine that ran the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the execution.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "status": {
+          "target": "com.amazonaws.sfn#ExecutionStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>The current status of the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "startDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution started.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stopDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>If the execution already ended, the date the execution stopped.</p>"
+          }
+        },
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of a Map Run. This field is returned only if <code>mapRunArn</code> was specified in the <code>ListExecutions</code> API action. If <code>stateMachineArn</code> was specified in <code>ListExecutions</code>, the <code>mapRunArn</code> isn't returned.</p>"
+          }
+        },
+        "itemCount": {
+          "target": "com.amazonaws.sfn#UnsignedInteger",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The total number of items processed in a child workflow execution. This field is returned only if <code>mapRunArn</code> was specified in the <code>ListExecutions</code> API action. If <code>stateMachineArn</code> was specified in <code>ListExecutions</code>, the <code>itemCount</code> field isn't returned.</p>"
+          }
+        },
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine version associated with the execution.</p>\n         <p>If the state machine execution was started with an unqualified ARN, it returns null.</p>\n         <p>If the execution was started using a <code>stateMachineAliasArn</code>, both the <code>stateMachineAliasArn</code> and <code>stateMachineVersionArn</code> parameters contain the respective values.</p>"
+          }
+        },
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine alias used to start an execution.</p>\n         <p>If the state machine execution was started with an unqualified ARN or a version ARN, it returns null.</p>"
+          }
+        },
+        "redriveCount": {
+          "target": "com.amazonaws.sfn#RedriveCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of times you've redriven an execution. If you have not yet redriven an execution, the <code>redriveCount</code> is 0. This count is only updated when you successfully redrive an execution.</p>"
+          }
+        },
+        "redriveDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution was last redriven.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionNotRedrivable": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The execution Amazon Resource Name (ARN) that you specified for <code>executionArn</code> cannot be redriven.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionRedriveFilter": {
+      "type": "enum",
+      "members": {
+        "REDRIVEN": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "REDRIVEN"
+          }
+        },
+        "NOT_REDRIVEN": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "NOT_REDRIVEN"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#ExecutionRedriveStatus": {
+      "type": "enum",
+      "members": {
+        "REDRIVABLE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "REDRIVABLE"
+          }
+        },
+        "NOT_REDRIVABLE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "NOT_REDRIVABLE"
+          }
+        },
+        "REDRIVABLE_BY_MAP_RUN": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "REDRIVABLE_BY_MAP_RUN"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#ExecutionRedrivenEventDetails": {
+      "type": "structure",
+      "members": {
+        "redriveCount": {
+          "target": "com.amazonaws.sfn#RedriveCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of times you've redriven an execution. If you have not yet redriven an execution, the <code>redriveCount</code> is 0. This count is not updated for redrives that failed to start or are pending to be redriven.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a redriven execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionStartedEventDetails": {
+      "type": "structure",
+      "members": {
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON data input to the execution. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "inputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the input for an execution history event.</p>"
+          }
+        },
+        "roleArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the IAM role used for executing Lambda tasks.</p>"
+          }
+        },
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies a state machine alias used for starting the state machine execution.</p>"
+          }
+        },
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies a state machine version used for starting the state machine execution.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the start of the execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionStatus": {
+      "type": "enum",
+      "members": {
+        "RUNNING": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "RUNNING"
+          }
+        },
+        "SUCCEEDED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "SUCCEEDED"
+          }
+        },
+        "FAILED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "FAILED"
+          }
+        },
+        "TIMED_OUT": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TIMED_OUT"
+          }
+        },
+        "ABORTED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ABORTED"
+          }
+        },
+        "PENDING_REDRIVE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "PENDING_REDRIVE"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#ExecutionSucceededEventDetails": {
+      "type": "structure",
+      "members": {
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON data output by the execution. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the output of an execution history event.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the successful termination of the execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ExecutionTimedOutEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the timeout.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the execution timeout that occurred during the execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#GetActivityTask": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#GetActivityTaskInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#GetActivityTaskOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ActivityDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#ActivityWorkerLimitExceeded"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Used by workers to retrieve a task (with the specified activity ARN) which has been\n      scheduled for execution by a running state machine. This initiates a long poll, where the\n      service holds the HTTP connection open and responds as soon as a task becomes available (i.e.\n      an execution of a task of this type is needed.) The maximum time the service holds on to the\n      request before responding is 60 seconds. If no task is available within 60 seconds, the poll\n      returns a <code>taskToken</code> with a null string.</p>\n         <important>\n            <p>Workers should set their client side socket timeout to at least 65 seconds (5 seconds\n        higher than the maximum time the service may hold the poll request).</p>\n            <p>Polling with <code>GetActivityTask</code> can cause latency in some implementations. See\n          <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/bp-activity-pollers.html\">Avoid\n          Latency When Polling for Activity Tasks</a> in the Step Functions Developer Guide.</p>\n         </important>"
+      }
+    },
+    "com.amazonaws.sfn#GetActivityTaskInput": {
+      "type": "structure",
+      "members": {
+        "activityArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the activity to retrieve tasks from (assigned when you create the task\n      using <a>CreateActivity</a>.)</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "workerName": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>You can provide an arbitrary name in order to identify the worker that the task is\n      assigned to. This name is used when it is logged in the execution history.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#GetActivityTaskOutput": {
+      "type": "structure",
+      "members": {
+        "taskToken": {
+          "target": "com.amazonaws.sfn#TaskToken",
+          "traits": {
+            "smithy.api#documentation": "<p>A token that identifies the scheduled task. This token must be copied and included in\n      subsequent calls to <a>SendTaskHeartbeat</a>, <a>SendTaskSuccess</a> or\n        <a>SendTaskFailure</a> in order to report the progress or completion of the\n      task.</p>"
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveDataJobInput",
+          "traits": {
+            "smithy.api#documentation": "<p>The string that contains the JSON input data for the task. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#GetExecutionHistory": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#GetExecutionHistoryInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#GetExecutionHistoryOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ExecutionDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Returns the history of the specified execution as a list of events. By default, the\n      results are returned in ascending order of the <code>timeStamp</code> of the events. Use the\n        <code>reverseOrder</code> parameter to get the latest events first.</p>\n         <p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>\n         <p>This API action is not supported by <code>EXPRESS</code> state machines.</p>",
+        "smithy.api#paginated": {
+          "inputToken": "nextToken",
+          "outputToken": "nextToken",
+          "items": "events",
+          "pageSize": "maxResults"
+        }
+      }
+    },
+    "com.amazonaws.sfn#GetExecutionHistoryInput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "maxResults": {
+          "target": "com.amazonaws.sfn#PageSize",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of results that are returned per call. You can use <code>nextToken</code> to obtain further pages of results.\n    The default is 100 and the maximum allowed page size is 1000. A value of 0 uses the default.</p>\n         <p>This is only an upper limit. The actual number of results returned per call might be fewer than the specified maximum.</p>"
+          }
+        },
+        "reverseOrder": {
+          "target": "com.amazonaws.sfn#ReverseOrder",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Lists events in descending order of their <code>timeStamp</code>.</p>"
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        },
+        "includeExecutionData": {
+          "target": "com.amazonaws.sfn#IncludeExecutionDataGetExecutionHistory",
+          "traits": {
+            "smithy.api#documentation": "<p>You can select whether execution data (input or output of a history event) is returned.\n      The default is <code>true</code>.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#GetExecutionHistoryOutput": {
+      "type": "structure",
+      "members": {
+        "events": {
+          "target": "com.amazonaws.sfn#HistoryEventList",
+          "traits": {
+            "smithy.api#documentation": "<p>The list of events that occurred in the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#HTTPBody": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#HTTPHeaders": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#HTTPMethod": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#HTTPProtocol": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#HTTPStatusCode": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#HTTPStatusMessage": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#HistoryEvent": {
+      "type": "structure",
+      "members": {
+        "timestamp": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date and time the event occurred, expressed in seconds and fractional milliseconds since the Unix epoch, which is defined as January 1, 1970, at 00:00:00 Coordinated Universal Time (UTC).</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "type": {
+          "target": "com.amazonaws.sfn#HistoryEventType",
+          "traits": {
+            "smithy.api#documentation": "<p>The type of the event.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "id": {
+          "target": "com.amazonaws.sfn#EventId",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The id of the event. Events are numbered sequentially, starting at one.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "previousEventId": {
+          "target": "com.amazonaws.sfn#EventId",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The id of the previous event.</p>"
+          }
+        },
+        "activityFailedEventDetails": {
+          "target": "com.amazonaws.sfn#ActivityFailedEventDetails"
+        },
+        "activityScheduleFailedEventDetails": {
+          "target": "com.amazonaws.sfn#ActivityScheduleFailedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about an activity schedule event that failed during an execution.</p>"
+          }
+        },
+        "activityScheduledEventDetails": {
+          "target": "com.amazonaws.sfn#ActivityScheduledEventDetails"
+        },
+        "activityStartedEventDetails": {
+          "target": "com.amazonaws.sfn#ActivityStartedEventDetails"
+        },
+        "activitySucceededEventDetails": {
+          "target": "com.amazonaws.sfn#ActivitySucceededEventDetails"
+        },
+        "activityTimedOutEventDetails": {
+          "target": "com.amazonaws.sfn#ActivityTimedOutEventDetails"
+        },
+        "taskFailedEventDetails": {
+          "target": "com.amazonaws.sfn#TaskFailedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the failure of a task.</p>"
+          }
+        },
+        "taskScheduledEventDetails": {
+          "target": "com.amazonaws.sfn#TaskScheduledEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a task that was scheduled.</p>"
+          }
+        },
+        "taskStartFailedEventDetails": {
+          "target": "com.amazonaws.sfn#TaskStartFailedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a task that failed to start.</p>"
+          }
+        },
+        "taskStartedEventDetails": {
+          "target": "com.amazonaws.sfn#TaskStartedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a task that was started.</p>"
+          }
+        },
+        "taskSubmitFailedEventDetails": {
+          "target": "com.amazonaws.sfn#TaskSubmitFailedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a task that where the submit failed.</p>"
+          }
+        },
+        "taskSubmittedEventDetails": {
+          "target": "com.amazonaws.sfn#TaskSubmittedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a submitted task.</p>"
+          }
+        },
+        "taskSucceededEventDetails": {
+          "target": "com.amazonaws.sfn#TaskSucceededEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a task that succeeded.</p>"
+          }
+        },
+        "taskTimedOutEventDetails": {
+          "target": "com.amazonaws.sfn#TaskTimedOutEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a task that timed out.</p>"
+          }
+        },
+        "executionFailedEventDetails": {
+          "target": "com.amazonaws.sfn#ExecutionFailedEventDetails"
+        },
+        "executionStartedEventDetails": {
+          "target": "com.amazonaws.sfn#ExecutionStartedEventDetails"
+        },
+        "executionSucceededEventDetails": {
+          "target": "com.amazonaws.sfn#ExecutionSucceededEventDetails"
+        },
+        "executionAbortedEventDetails": {
+          "target": "com.amazonaws.sfn#ExecutionAbortedEventDetails"
+        },
+        "executionTimedOutEventDetails": {
+          "target": "com.amazonaws.sfn#ExecutionTimedOutEventDetails"
+        },
+        "executionRedrivenEventDetails": {
+          "target": "com.amazonaws.sfn#ExecutionRedrivenEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the redrive attempt of an execution.</p>"
+          }
+        },
+        "mapStateStartedEventDetails": {
+          "target": "com.amazonaws.sfn#MapStateStartedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about Map state that was started.</p>"
+          }
+        },
+        "mapIterationStartedEventDetails": {
+          "target": "com.amazonaws.sfn#MapIterationEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about an iteration of a Map state that was started.</p>"
+          }
+        },
+        "mapIterationSucceededEventDetails": {
+          "target": "com.amazonaws.sfn#MapIterationEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about an iteration of a Map state that succeeded.</p>"
+          }
+        },
+        "mapIterationFailedEventDetails": {
+          "target": "com.amazonaws.sfn#MapIterationEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about an iteration of a Map state that failed.</p>"
+          }
+        },
+        "mapIterationAbortedEventDetails": {
+          "target": "com.amazonaws.sfn#MapIterationEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about an iteration of a Map state that was aborted.</p>"
+          }
+        },
+        "lambdaFunctionFailedEventDetails": {
+          "target": "com.amazonaws.sfn#LambdaFunctionFailedEventDetails"
+        },
+        "lambdaFunctionScheduleFailedEventDetails": {
+          "target": "com.amazonaws.sfn#LambdaFunctionScheduleFailedEventDetails"
+        },
+        "lambdaFunctionScheduledEventDetails": {
+          "target": "com.amazonaws.sfn#LambdaFunctionScheduledEventDetails"
+        },
+        "lambdaFunctionStartFailedEventDetails": {
+          "target": "com.amazonaws.sfn#LambdaFunctionStartFailedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a lambda function that failed to start during an execution.</p>"
+          }
+        },
+        "lambdaFunctionSucceededEventDetails": {
+          "target": "com.amazonaws.sfn#LambdaFunctionSucceededEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about a Lambda function that terminated successfully during an\n      execution.</p>"
+          }
+        },
+        "lambdaFunctionTimedOutEventDetails": {
+          "target": "com.amazonaws.sfn#LambdaFunctionTimedOutEventDetails"
+        },
+        "stateEnteredEventDetails": {
+          "target": "com.amazonaws.sfn#StateEnteredEventDetails"
+        },
+        "stateExitedEventDetails": {
+          "target": "com.amazonaws.sfn#StateExitedEventDetails"
+        },
+        "mapRunStartedEventDetails": {
+          "target": "com.amazonaws.sfn#MapRunStartedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details, such as <code>mapRunArn</code>, and the start date and time of a Map Run. <code>mapRunArn</code> is the Amazon Resource Name (ARN) of the Map Run that was started.</p>"
+          }
+        },
+        "mapRunFailedEventDetails": {
+          "target": "com.amazonaws.sfn#MapRunFailedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains error and cause details about a Map Run that failed.</p>"
+          }
+        },
+        "mapRunRedrivenEventDetails": {
+          "target": "com.amazonaws.sfn#MapRunRedrivenEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the redrive attempt of a Map Run.</p>"
+          }
+        },
+        "evaluationFailedEventDetails": {
+          "target": "com.amazonaws.sfn#EvaluationFailedEventDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about an evaluation failure that occurred while processing a state.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the events of an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#HistoryEventExecutionDataDetails": {
+      "type": "structure",
+      "members": {
+        "truncated": {
+          "target": "com.amazonaws.sfn#truncated",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Indicates whether input or output was truncated in the response. Always <code>false</code>\n      for API calls. In CloudWatch logs, the value will be true if the data is truncated due to size limits.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Provides details about input or output in an execution history event.</p>"
+      }
+    },
+    "com.amazonaws.sfn#HistoryEventList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#HistoryEvent"
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the events that occurred during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#HistoryEventType": {
+      "type": "enum",
+      "members": {
+        "ActivityFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ActivityFailed"
+          }
+        },
+        "ActivityScheduled": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ActivityScheduled"
+          }
+        },
+        "ActivityScheduleFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ActivityScheduleFailed"
+          }
+        },
+        "ActivityStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ActivityStarted"
+          }
+        },
+        "ActivitySucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ActivitySucceeded"
+          }
+        },
+        "ActivityTimedOut": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ActivityTimedOut"
+          }
+        },
+        "ChoiceStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ChoiceStateEntered"
+          }
+        },
+        "ChoiceStateExited": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ChoiceStateExited"
+          }
+        },
+        "ExecutionAborted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ExecutionAborted"
+          }
+        },
+        "ExecutionFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ExecutionFailed"
+          }
+        },
+        "ExecutionStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ExecutionStarted"
+          }
+        },
+        "ExecutionSucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ExecutionSucceeded"
+          }
+        },
+        "ExecutionTimedOut": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ExecutionTimedOut"
+          }
+        },
+        "FailStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "FailStateEntered"
+          }
+        },
+        "LambdaFunctionFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LambdaFunctionFailed"
+          }
+        },
+        "LambdaFunctionScheduled": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LambdaFunctionScheduled"
+          }
+        },
+        "LambdaFunctionScheduleFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LambdaFunctionScheduleFailed"
+          }
+        },
+        "LambdaFunctionStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LambdaFunctionStarted"
+          }
+        },
+        "LambdaFunctionStartFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LambdaFunctionStartFailed"
+          }
+        },
+        "LambdaFunctionSucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LambdaFunctionSucceeded"
+          }
+        },
+        "LambdaFunctionTimedOut": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LambdaFunctionTimedOut"
+          }
+        },
+        "MapIterationAborted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapIterationAborted"
+          }
+        },
+        "MapIterationFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapIterationFailed"
+          }
+        },
+        "MapIterationStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapIterationStarted"
+          }
+        },
+        "MapIterationSucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapIterationSucceeded"
+          }
+        },
+        "MapStateAborted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapStateAborted"
+          }
+        },
+        "MapStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapStateEntered"
+          }
+        },
+        "MapStateExited": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapStateExited"
+          }
+        },
+        "MapStateFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapStateFailed"
+          }
+        },
+        "MapStateStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapStateStarted"
+          }
+        },
+        "MapStateSucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapStateSucceeded"
+          }
+        },
+        "ParallelStateAborted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ParallelStateAborted"
+          }
+        },
+        "ParallelStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ParallelStateEntered"
+          }
+        },
+        "ParallelStateExited": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ParallelStateExited"
+          }
+        },
+        "ParallelStateFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ParallelStateFailed"
+          }
+        },
+        "ParallelStateStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ParallelStateStarted"
+          }
+        },
+        "ParallelStateSucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ParallelStateSucceeded"
+          }
+        },
+        "PassStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "PassStateEntered"
+          }
+        },
+        "PassStateExited": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "PassStateExited"
+          }
+        },
+        "SucceedStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "SucceedStateEntered"
+          }
+        },
+        "SucceedStateExited": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "SucceedStateExited"
+          }
+        },
+        "TaskFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskFailed"
+          }
+        },
+        "TaskScheduled": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskScheduled"
+          }
+        },
+        "TaskStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskStarted"
+          }
+        },
+        "TaskStartFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskStartFailed"
+          }
+        },
+        "TaskStateAborted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskStateAborted"
+          }
+        },
+        "TaskStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskStateEntered"
+          }
+        },
+        "TaskStateExited": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskStateExited"
+          }
+        },
+        "TaskSubmitFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskSubmitFailed"
+          }
+        },
+        "TaskSubmitted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskSubmitted"
+          }
+        },
+        "TaskSucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskSucceeded"
+          }
+        },
+        "TaskTimedOut": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TaskTimedOut"
+          }
+        },
+        "WaitStateAborted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "WaitStateAborted"
+          }
+        },
+        "WaitStateEntered": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "WaitStateEntered"
+          }
+        },
+        "WaitStateExited": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "WaitStateExited"
+          }
+        },
+        "MapRunAborted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapRunAborted"
+          }
+        },
+        "MapRunFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapRunFailed"
+          }
+        },
+        "MapRunStarted": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapRunStarted"
+          }
+        },
+        "MapRunSucceeded": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapRunSucceeded"
+          }
+        },
+        "ExecutionRedriven": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ExecutionRedriven"
+          }
+        },
+        "MapRunRedriven": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MapRunRedriven"
+          }
+        },
+        "EvaluationFailed": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "EvaluationFailed"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#Identity": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 256
+        }
+      }
+    },
+    "com.amazonaws.sfn#IncludeExecutionData": {
+      "type": "boolean",
+      "traits": {
+        "smithy.api#default": false
+      }
+    },
+    "com.amazonaws.sfn#IncludeExecutionDataGetExecutionHistory": {
+      "type": "boolean"
+    },
+    "com.amazonaws.sfn#IncludedData": {
+      "type": "enum",
+      "members": {
+        "ALL_DATA": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ALL_DATA"
+          }
+        },
+        "METADATA_ONLY": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "METADATA_ONLY"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#InspectionData": {
+      "type": "structure",
+      "members": {
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The raw state input.</p>"
+          }
+        },
+        "afterArguments": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The input after Step Functions applies an Arguments filter. This event will only be present when QueryLanguage for the state machine or individual states is set to JSONata. For more info, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/data-transform.html\">Transforming data with Step Functions</a>.</p>"
+          }
+        },
+        "afterInputPath": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The input after Step Functions applies the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html#input-output-inputpath\">InputPath</a> filter. Not populated when QueryLanguage is JSONata.</p>"
+          }
+        },
+        "afterParameters": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The effective input after Step Functions applies the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html#input-output-parameters\">Parameters</a> filter. Not populated when QueryLanguage is JSONata.</p>"
+          }
+        },
+        "result": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The state's raw result.</p>"
+          }
+        },
+        "afterResultSelector": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The effective result after Step Functions applies the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html#input-output-resultselector\">ResultSelector</a> filter. Not populated when QueryLanguage is JSONata.</p>"
+          }
+        },
+        "afterResultPath": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The effective result combined with the raw state input after Step Functions applies the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-resultpath.html\">ResultPath</a> filter. Not populated when QueryLanguage is JSONata.</p>"
+          }
+        },
+        "request": {
+          "target": "com.amazonaws.sfn#InspectionDataRequest",
+          "traits": {
+            "smithy.api#documentation": "<p>The raw HTTP request that is sent when you test an HTTP Task.</p>"
+          }
+        },
+        "response": {
+          "target": "com.amazonaws.sfn#InspectionDataResponse",
+          "traits": {
+            "smithy.api#documentation": "<p>The raw HTTP response that is returned when you test an HTTP Task.</p>"
+          }
+        },
+        "variables": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>JSON string that contains the set of workflow variables after execution of the state. The set will include variables assigned in the state and variables set up as test state input.</p>"
+          }
+        },
+        "errorDetails": {
+          "target": "com.amazonaws.sfn#InspectionErrorDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>An object containing data about a handled exception in the tested state.</p>"
+          }
+        },
+        "afterItemsPath": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The effective input after the ItemsPath filter is applied. Not populated when the QueryLanguage is JSONata.</p>"
+          }
+        },
+        "afterItemSelector": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>An array containing the inputs for each Map iteration, transformed by the ItemSelector specified in a Map state.</p>"
+          }
+        },
+        "afterItemBatcher": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The effective input after the ItemBatcher filter is applied in a Map state.</p>"
+          }
+        },
+        "afterItemsPointer": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The effective input after the ItemsPointer filter is applied in a Map state.</p>"
+          }
+        },
+        "toleratedFailureCount": {
+          "target": "com.amazonaws.sfn#InspectionToleratedFailureCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The tolerated failure threshold for a Map state as defined in number of Map state iterations.</p>"
+          }
+        },
+        "toleratedFailurePercentage": {
+          "target": "com.amazonaws.sfn#InspectionToleratedFailurePercentage",
+          "traits": {
+            "smithy.api#documentation": "<p>The tolerated failure threshold for a Map state as defined in percentage of Map state iterations.</p>"
+          }
+        },
+        "maxConcurrency": {
+          "target": "com.amazonaws.sfn#InspectionMaxConcurrency",
+          "traits": {
+            "smithy.api#documentation": "<p>The max concurrency of the Map state.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains additional details about the state's execution, including its input and output data processing flow, and HTTP request and response information.</p>",
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#InspectionDataRequest": {
+      "type": "structure",
+      "members": {
+        "protocol": {
+          "target": "com.amazonaws.sfn#HTTPProtocol",
+          "traits": {
+            "smithy.api#documentation": "<p>The protocol used to make the HTTP request.</p>"
+          }
+        },
+        "method": {
+          "target": "com.amazonaws.sfn#HTTPMethod",
+          "traits": {
+            "smithy.api#documentation": "<p>The HTTP method used for the HTTP request.</p>"
+          }
+        },
+        "url": {
+          "target": "com.amazonaws.sfn#URL",
+          "traits": {
+            "smithy.api#documentation": "<p>The API endpoint used for the HTTP request.</p>"
+          }
+        },
+        "headers": {
+          "target": "com.amazonaws.sfn#HTTPHeaders",
+          "traits": {
+            "smithy.api#documentation": "<p>The request headers associated with the HTTP request.</p>"
+          }
+        },
+        "body": {
+          "target": "com.amazonaws.sfn#HTTPBody",
+          "traits": {
+            "smithy.api#documentation": "<p>The request body for the HTTP request.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains additional details about the state's execution, including its input and output data processing flow, and HTTP request information.</p>"
+      }
+    },
+    "com.amazonaws.sfn#InspectionDataResponse": {
+      "type": "structure",
+      "members": {
+        "protocol": {
+          "target": "com.amazonaws.sfn#HTTPProtocol",
+          "traits": {
+            "smithy.api#documentation": "<p>The protocol used to return the HTTP response.</p>"
+          }
+        },
+        "statusCode": {
+          "target": "com.amazonaws.sfn#HTTPStatusCode",
+          "traits": {
+            "smithy.api#documentation": "<p>The HTTP response status code for the HTTP response.</p>"
+          }
+        },
+        "statusMessage": {
+          "target": "com.amazonaws.sfn#HTTPStatusMessage",
+          "traits": {
+            "smithy.api#documentation": "<p>The message associated with the HTTP status code.</p>"
+          }
+        },
+        "headers": {
+          "target": "com.amazonaws.sfn#HTTPHeaders",
+          "traits": {
+            "smithy.api#documentation": "<p>The response headers associated with the HTTP response.</p>"
+          }
+        },
+        "body": {
+          "target": "com.amazonaws.sfn#HTTPBody",
+          "traits": {
+            "smithy.api#documentation": "<p>The HTTP response returned.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains additional details about the state's execution, including its input and output data processing flow, and HTTP response information. The <code>inspectionLevel</code> request parameter specifies which details are returned.</p>"
+      }
+    },
+    "com.amazonaws.sfn#InspectionErrorDetails": {
+      "type": "structure",
+      "members": {
+        "catchIndex": {
+          "target": "com.amazonaws.sfn#ExceptionHandlerIndex",
+          "traits": {
+            "smithy.api#documentation": "<p>The array index of the Catch which handled the exception.</p>"
+          }
+        },
+        "retryIndex": {
+          "target": "com.amazonaws.sfn#ExceptionHandlerIndex",
+          "traits": {
+            "smithy.api#documentation": "<p>The array index of the Retry which handled the exception.</p>"
+          }
+        },
+        "retryBackoffIntervalSeconds": {
+          "target": "com.amazonaws.sfn#RetryBackoffIntervalSeconds",
+          "traits": {
+            "smithy.api#documentation": "<p>The duration in seconds of the backoff for a retry on a failed state invocation.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>An object containing data about a handled exception in the tested state.</p>"
+      }
+    },
+    "com.amazonaws.sfn#InspectionLevel": {
+      "type": "enum",
+      "members": {
+        "INFO": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "INFO"
+          }
+        },
+        "DEBUG": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "DEBUG"
+          }
+        },
+        "TRACE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TRACE"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#InspectionMaxConcurrency": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#range": {
+          "min": 0
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#InspectionToleratedFailureCount": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#range": {
+          "min": 0
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#InspectionToleratedFailurePercentage": {
+      "type": "float",
+      "traits": {
+        "smithy.api#range": {
+          "min": 0,
+          "max": 100
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#InvalidArn": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The provided Amazon Resource Name (ARN) is not valid.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidDefinition": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The provided Amazon States Language definition is not valid.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidEncryptionConfiguration": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Received when <code>encryptionConfiguration</code> is specified but various conditions exist which make the configuration invalid. For example, if <code>type</code> is set to <code>CUSTOMER_MANAGED_KMS_KEY</code>, but <code>kmsKeyId</code> is null, or <code>kmsDataKeyReusePeriodSeconds</code> is not between 60 and 900, or the KMS key is not symmetric or inactive.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidExecutionInput": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The provided JSON input data is not valid.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidLoggingConfiguration": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Configuration is not valid.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidName": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The provided name is not valid.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidOutput": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The provided JSON output data is not valid.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidToken": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The provided token is not valid.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#InvalidTracingConfiguration": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Your <code>tracingConfiguration</code> key does not match, or <code>enabled</code> has not\n      been set to <code>true</code> or <code>false</code>.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#KmsAccessDeniedException": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Either your KMS key policy or API caller does not have the required permissions.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#KmsDataKeyReusePeriodSeconds": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#range": {
+          "min": 60,
+          "max": 900
+        }
+      }
+    },
+    "com.amazonaws.sfn#KmsInvalidStateException": {
+      "type": "structure",
+      "members": {
+        "kmsKeyState": {
+          "target": "com.amazonaws.sfn#KmsKeyState",
+          "traits": {
+            "smithy.api#documentation": "<p>Current status of the KMS; key. For example: <code>DISABLED</code>, <code>PENDING_DELETION</code>, <code>PENDING_IMPORT</code>, <code>UNAVAILABLE</code>, <code>CREATING</code>.</p>"
+          }
+        },
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The KMS key is not in valid state, for example: Disabled or Deleted.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#KmsKeyId": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 2048
+        }
+      }
+    },
+    "com.amazonaws.sfn#KmsKeyState": {
+      "type": "enum",
+      "members": {
+        "DISABLED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "DISABLED"
+          }
+        },
+        "PENDING_DELETION": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "PENDING_DELETION"
+          }
+        },
+        "PENDING_IMPORT": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "PENDING_IMPORT"
+          }
+        },
+        "UNAVAILABLE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "UNAVAILABLE"
+          }
+        },
+        "CREATING": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "CREATING"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#KmsThrottlingException": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Received when KMS returns <code>ThrottlingException</code> for a KMS call that Step Functions makes on behalf of the caller.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#LambdaFunctionFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a Lambda function that failed during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#LambdaFunctionScheduleFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a failed Lambda function schedule event that occurred during an\n      execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#LambdaFunctionScheduledEventDetails": {
+      "type": "structure",
+      "members": {
+        "resource": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the scheduled Lambda function.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON data input to the Lambda function. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "inputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about input for an execution history event.</p>"
+          }
+        },
+        "timeoutInSeconds": {
+          "target": "com.amazonaws.sfn#TimeoutInSeconds",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum allowed duration of the Lambda function.</p>"
+          }
+        },
+        "taskCredentials": {
+          "target": "com.amazonaws.sfn#TaskCredentials",
+          "traits": {
+            "smithy.api#documentation": "<p>The credentials that Step Functions uses for the task.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a Lambda function scheduled during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#LambdaFunctionStartFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a lambda function that failed to start during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#LambdaFunctionSucceededEventDetails": {
+      "type": "structure",
+      "members": {
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON data output by the Lambda function. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the output of an execution history event.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a Lambda function that successfully terminated during an\n      execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#LambdaFunctionTimedOutEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the timeout.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a Lambda function timeout that occurred during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ListActivities": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ListActivitiesInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ListActivitiesOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Lists the existing activities.</p>\n         <p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>",
+        "smithy.api#paginated": {
+          "inputToken": "nextToken",
+          "outputToken": "nextToken",
+          "items": "activities",
+          "pageSize": "maxResults"
+        },
+        "smithy.test#smokeTests": [
+          {
+            "id": "ListActivitiesSuccess",
+            "params": {},
+            "vendorParams": {
+              "region": "us-west-2"
+            },
+            "vendorParamsShape": "aws.test#AwsVendorParams",
+            "expect": {
+              "success": {}
+            }
+          }
+        ]
+      }
+    },
+    "com.amazonaws.sfn#ListActivitiesInput": {
+      "type": "structure",
+      "members": {
+        "maxResults": {
+          "target": "com.amazonaws.sfn#PageSize",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of results that are returned per call. You can use <code>nextToken</code> to obtain further pages of results.\n    The default is 100 and the maximum allowed page size is 1000. A value of 0 uses the default.</p>\n         <p>This is only an upper limit. The actual number of results returned per call might be fewer than the specified maximum.</p>"
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ListActivitiesOutput": {
+      "type": "structure",
+      "members": {
+        "activities": {
+          "target": "com.amazonaws.sfn#ActivityList",
+          "traits": {
+            "smithy.api#documentation": "<p>The list of activities.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ListExecutions": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ListExecutionsInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ListExecutionsOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineTypeNotSupported"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Lists all executions of a state machine or a Map Run. You can list all executions related to a state machine by specifying a state machine Amazon Resource Name (ARN), or those related to a Map Run by specifying a Map Run ARN. Using this API action, you can also list all <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/redrive-executions.html\">redriven</a> executions.</p>\n         <p>You can also provide a state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a> ARN or <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">version</a> ARN to list the executions associated with a specific alias or version.</p>\n         <p>Results are sorted by time, with the most recent execution first. Running executions are sorted by their <code>startDate</code> or <code>redriveDate</code>, and other executions are sorted by their <code>stopDate</code>.</p>\n         <p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>\n         <p>This API action is not supported by <code>EXPRESS</code> state machines. However, you may list <code>EXPRESS</code> children started by a map run using the <code>mapRunArn</code> parameter.</p>",
+        "smithy.api#paginated": {
+          "inputToken": "nextToken",
+          "outputToken": "nextToken",
+          "items": "executions",
+          "pageSize": "maxResults"
+        }
+      }
+    },
+    "com.amazonaws.sfn#ListExecutionsInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine whose executions is listed.</p>\n         <p>You can specify either a <code>mapRunArn</code> or a <code>stateMachineArn</code>, but not both.</p>\n         <p>You can also return a list of executions associated with a specific <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a> or <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">version</a>, by specifying an alias ARN or a version ARN in the <code>stateMachineArn</code> parameter.</p>"
+          }
+        },
+        "statusFilter": {
+          "target": "com.amazonaws.sfn#ExecutionStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>If specified, only list the executions whose current execution status matches the given\n      filter.</p>\n         <p>If you provide a <code>PENDING_REDRIVE</code> statusFilter, you must specify <code>mapRunArn</code>. \n      For more information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/redrive-map-run.html#redrive-child-workflow-behavior\">Child workflow execution redrive behaviour</a>\n      in the <i>Step Functions Developer Guide</i>.\n    </p>\n         <p>If you provide a stateMachineArn and a <code>PENDING_REDRIVE</code> statusFilter, the API returns a validation exception.</p>"
+          }
+        },
+        "maxResults": {
+          "target": "com.amazonaws.sfn#PageSize",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of results that are returned per call. You can use <code>nextToken</code> to obtain further pages of results.\n    The default is 100 and the maximum allowed page size is 1000. A value of 0 uses the default.</p>\n         <p>This is only an upper limit. The actual number of results returned per call might be fewer than the specified maximum.</p>"
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#ListExecutionsPageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        },
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the Map Run that started the child workflow executions. If the <code>mapRunArn</code> field is specified, a list of all of the child workflow executions started by a Map Run is returned. For more information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-examine-map-run.html\">Examining Map Run</a> in the <i>Step Functions Developer Guide</i>.</p>\n         <p>You can specify either a <code>mapRunArn</code> or a <code>stateMachineArn</code>, but not both.</p>"
+          }
+        },
+        "redriveFilter": {
+          "target": "com.amazonaws.sfn#ExecutionRedriveFilter",
+          "traits": {
+            "smithy.api#documentation": "<p>Sets a filter to list executions based on whether or not they have been redriven.</p>\n         <p>For a Distributed Map, <code>redriveFilter</code> sets a filter to list child workflow executions based on whether or not they have been redriven.</p>\n         <p>If you do not provide a <code>redriveFilter</code>, Step Functions returns a list of both redriven and non-redriven executions.</p>\n         <p>If you provide a state machine ARN in <code>redriveFilter</code>, the API returns a validation exception.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ListExecutionsOutput": {
+      "type": "structure",
+      "members": {
+        "executions": {
+          "target": "com.amazonaws.sfn#ExecutionList",
+          "traits": {
+            "smithy.api#documentation": "<p>The list of matching executions.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#ListExecutionsPageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ListExecutionsPageToken": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 3096
+        }
+      }
+    },
+    "com.amazonaws.sfn#ListMapRuns": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ListMapRunsInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ListMapRunsOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ExecutionDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Lists all Map Runs that were started by a given state machine execution. Use this API action to obtain Map Run ARNs, and then call <code>DescribeMapRun</code> to obtain more information, if needed.</p>",
+        "smithy.api#paginated": {
+          "inputToken": "nextToken",
+          "outputToken": "nextToken",
+          "items": "mapRuns",
+          "pageSize": "maxResults"
+        }
+      }
+    },
+    "com.amazonaws.sfn#ListMapRunsInput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the execution for which the Map Runs must be listed.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "maxResults": {
+          "target": "com.amazonaws.sfn#PageSize",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of results that are returned per call. You can use <code>nextToken</code> to obtain further pages of results.\n    The default is 100 and the maximum allowed page size is 1000. A value of 0 uses the default.</p>\n         <p>This is only an upper limit. The actual number of results returned per call might be fewer than the specified maximum.</p>"
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ListMapRunsOutput": {
+      "type": "structure",
+      "members": {
+        "mapRuns": {
+          "target": "com.amazonaws.sfn#MapRunList",
+          "traits": {
+            "smithy.api#documentation": "<p>An array that lists information related to a Map Run, such as the Amazon Resource Name (ARN) of the Map Run and the ARN of the state machine that started the Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachineAliases": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ListStateMachineAliasesInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ListStateMachineAliasesOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDoesNotExist"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Lists <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">aliases</a> for a specified state machine ARN. Results are sorted by time, with the most recently created aliases listed first. </p>\n         <p>To list aliases that reference a state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">version</a>, you can specify the version ARN in the <code>stateMachineArn</code> parameter.</p>\n         <p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>CreateStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DescribeStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>UpdateStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DeleteStateMachineAlias</a>\n               </p>\n            </li>\n         </ul>"
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachineAliasesInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine for which you want to list aliases.</p>\n         <p>If you specify a state machine version ARN, this API returns a list of aliases for that version.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        },
+        "maxResults": {
+          "target": "com.amazonaws.sfn#PageSize",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of results that are returned per call. You can use <code>nextToken</code> to obtain further pages of results.\n    The default is 100 and the maximum allowed page size is 1000. A value of 0 uses the default.</p>\n         <p>This is only an upper limit. The actual number of results returned per call might be fewer than the specified maximum.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachineAliasesOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachineAliases": {
+          "target": "com.amazonaws.sfn#StateMachineAliasList",
+          "traits": {
+            "smithy.api#documentation": "<p>Aliases for the state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachineVersions": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ListStateMachineVersionsInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ListStateMachineVersionsOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Lists <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">versions</a> for the specified state machine Amazon Resource Name (ARN).</p>\n         <p>The results are sorted in descending order of the version creation time.</p>\n         <p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>PublishStateMachineVersion</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DeleteStateMachineVersion</a>\n               </p>\n            </li>\n         </ul>"
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachineVersionsInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        },
+        "maxResults": {
+          "target": "com.amazonaws.sfn#PageSize",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of results that are returned per call. You can use <code>nextToken</code> to obtain further pages of results.\n    The default is 100 and the maximum allowed page size is 1000. A value of 0 uses the default.</p>\n         <p>This is only an upper limit. The actual number of results returned per call might be fewer than the specified maximum.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachineVersionsOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachineVersions": {
+          "target": "com.amazonaws.sfn#StateMachineVersionList",
+          "traits": {
+            "smithy.api#documentation": "<p>Versions for the state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachines": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ListStateMachinesInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ListStateMachinesOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Lists the existing state machines.</p>\n         <p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>\n         <note>\n            <p>This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.</p>\n         </note>",
+        "smithy.api#paginated": {
+          "inputToken": "nextToken",
+          "outputToken": "nextToken",
+          "items": "stateMachines",
+          "pageSize": "maxResults"
+        }
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachinesInput": {
+      "type": "structure",
+      "members": {
+        "maxResults": {
+          "target": "com.amazonaws.sfn#PageSize",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of results that are returned per call. You can use <code>nextToken</code> to obtain further pages of results.\n    The default is 100 and the maximum allowed page size is 1000. A value of 0 uses the default.</p>\n         <p>This is only an upper limit. The actual number of results returned per call might be fewer than the specified maximum.</p>"
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ListStateMachinesOutput": {
+      "type": "structure",
+      "members": {
+        "stateMachines": {
+          "target": "com.amazonaws.sfn#StateMachineList",
+          "traits": {
+            "smithy.api#required": {}
+          }
+        },
+        "nextToken": {
+          "target": "com.amazonaws.sfn#PageToken",
+          "traits": {
+            "smithy.api#documentation": "<p>If <code>nextToken</code> is returned, there are more results available. The value of <code>nextToken</code> is a unique pagination token for each page.\n    Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an <i>HTTP 400 InvalidToken</i> error.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ListTagsForResource": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ListTagsForResourceInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ListTagsForResourceOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>List tags for a given resource.</p>\n         <p>Tags may only contain Unicode letters, digits, white space, or these symbols: <code>_ . : / = + - @</code>.</p>"
+      }
+    },
+    "com.amazonaws.sfn#ListTagsForResourceInput": {
+      "type": "structure",
+      "members": {
+        "resourceArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) for the Step Functions state machine or activity.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ListTagsForResourceOutput": {
+      "type": "structure",
+      "members": {
+        "tags": {
+          "target": "com.amazonaws.sfn#TagList",
+          "traits": {
+            "smithy.api#documentation": "<p>An array of tags associated with the resource.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#LogDestination": {
+      "type": "structure",
+      "members": {
+        "cloudWatchLogsLogGroup": {
+          "target": "com.amazonaws.sfn#CloudWatchLogsLogGroup",
+          "traits": {
+            "smithy.api#documentation": "<p>An object describing a CloudWatch log group. For more information, see <a href=\"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-loggroup.html\">AWS::Logs::LogGroup</a> in the CloudFormation User Guide.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p></p>"
+      }
+    },
+    "com.amazonaws.sfn#LogDestinationList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#LogDestination"
+      }
+    },
+    "com.amazonaws.sfn#LogLevel": {
+      "type": "enum",
+      "members": {
+        "ALL": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ALL"
+          }
+        },
+        "ERROR": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ERROR"
+          }
+        },
+        "FATAL": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "FATAL"
+          }
+        },
+        "OFF": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "OFF"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#LoggingConfiguration": {
+      "type": "structure",
+      "members": {
+        "level": {
+          "target": "com.amazonaws.sfn#LogLevel",
+          "traits": {
+            "smithy.api#documentation": "<p>Defines which category of execution history events are logged.</p>"
+          }
+        },
+        "includeExecutionData": {
+          "target": "com.amazonaws.sfn#IncludeExecutionData",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Determines whether execution data is included in your log. When set to <code>false</code>,\n      data is excluded.</p>"
+          }
+        },
+        "destinations": {
+          "target": "com.amazonaws.sfn#LogDestinationList",
+          "traits": {
+            "smithy.api#documentation": "<p>An array of objects that describes where your execution history events will be logged.\n      Limited to size 1. Required, if your log level is not set to <code>OFF</code>.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The <code>LoggingConfiguration</code> data type is used to set CloudWatch Logs\n      options.</p>"
+      }
+    },
+    "com.amazonaws.sfn#LongArn": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 2000
+        }
+      }
+    },
+    "com.amazonaws.sfn#LongObject": {
+      "type": "long"
+    },
+    "com.amazonaws.sfn#MapIterationEventDetails": {
+      "type": "structure",
+      "members": {
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the iteration\u2019s parent Map state.</p>"
+          }
+        },
+        "index": {
+          "target": "com.amazonaws.sfn#UnsignedInteger",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The index of the array belonging to the Map state iteration.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an iteration of a Map state.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MapIterationFailureCount": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#MapRunExecutionCounts": {
+      "type": "structure",
+      "members": {
+        "pending": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of child workflow executions that were started by a Map Run, but haven't started executing yet. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "running": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of child workflow executions that were started by a Map Run and are currently in-progress.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "succeeded": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of child workflow executions that were started by a Map Run and have completed successfully.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "failed": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of child workflow executions that were started by a Map Run, but have failed.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "timedOut": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of child workflow executions that were started by a Map Run and have timed out.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "aborted": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of child workflow executions that were started by a Map Run and were running, but were either stopped by the user or by Step Functions because the Map Run failed. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "total": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of child workflow executions that were started by a Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resultsWritten": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>Returns the count of child workflow executions whose results were written by <code>ResultWriter</code>. For more information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-resultwriter.html\">ResultWriter</a> in the <i>Step Functions Developer Guide</i>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "failuresNotRedrivable": {
+          "target": "com.amazonaws.sfn#LongObject",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of <code>FAILED</code>, <code>ABORTED</code>, or <code>TIMED_OUT</code> child workflow executions that cannot be redriven because their execution status is terminal. For example, child workflows with an execution status of <code>FAILED</code>, <code>ABORTED</code>, or <code>TIMED_OUT</code> and a <code>redriveStatus</code> of <code>NOT_REDRIVABLE</code>.</p>"
+          }
+        },
+        "pendingRedrive": {
+          "target": "com.amazonaws.sfn#LongObject",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of unsuccessful child workflow executions currently waiting to be redriven. The status of these child workflow executions could be <code>FAILED</code>, <code>ABORTED</code>, or <code>TIMED_OUT</code> in the original execution attempt or a previous redrive attempt.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about all of the child workflow executions started by a Map Run.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MapRunFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the Map Run failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a Map Run failure event that occurred during a state machine execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MapRunItemCounts": {
+      "type": "structure",
+      "members": {
+        "pending": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of items to process in child workflow executions that haven't started running yet.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "running": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of items being processed in child workflow executions that are currently in-progress.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "succeeded": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of items processed in child workflow executions that have completed successfully.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "failed": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of items processed in child workflow executions that have failed.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "timedOut": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of items processed in child workflow executions that have timed out.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "aborted": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of items processed in child workflow executions that were either stopped by the user or by Step Functions, because the Map Run failed.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "total": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The total number of items processed in all the child workflow executions started by a Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resultsWritten": {
+          "target": "com.amazonaws.sfn#UnsignedLong",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>Returns the count of items whose results were written by <code>ResultWriter</code>. For more information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-resultwriter.html\">ResultWriter</a> in the <i>Step Functions Developer Guide</i>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "failuresNotRedrivable": {
+          "target": "com.amazonaws.sfn#LongObject",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of <code>FAILED</code>, <code>ABORTED</code>, or <code>TIMED_OUT</code> items in child workflow executions that cannot be redriven because the execution status of those child workflows is terminal. For example, child workflows with an execution status of <code>FAILED</code>, <code>ABORTED</code>, or <code>TIMED_OUT</code> and a <code>redriveStatus</code> of <code>NOT_REDRIVABLE</code>.</p>"
+          }
+        },
+        "pendingRedrive": {
+          "target": "com.amazonaws.sfn#LongObject",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of unsuccessful items in child workflow executions currently waiting to be redriven.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about items that were processed in all of the child workflow executions that were started by a Map Run.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MapRunLabel": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#MapRunList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#MapRunListItem"
+      }
+    },
+    "com.amazonaws.sfn#MapRunListItem": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The <code>executionArn</code> of the execution from which the Map Run was started.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the executed state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "startDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date on which the Map Run started.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stopDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date on which the Map Run stopped.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a specific Map Run.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MapRunRedrivenEventDetails": {
+      "type": "structure",
+      "members": {
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of a Map Run that was redriven.</p>"
+          }
+        },
+        "redriveCount": {
+          "target": "com.amazonaws.sfn#RedriveCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of times the Map Run has been redriven at this point in the execution's history including this event. The redrive count for a redriven Map Run is always greater than 0.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a Map Run that was redriven.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MapRunStartedEventDetails": {
+      "type": "structure",
+      "members": {
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of a Map Run that was started.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a Map Run that was started during a state machine execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MapRunStatus": {
+      "type": "enum",
+      "members": {
+        "RUNNING": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "RUNNING"
+          }
+        },
+        "SUCCEEDED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "SUCCEEDED"
+          }
+        },
+        "FAILED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "FAILED"
+          }
+        },
+        "ABORTED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ABORTED"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#MapStateStartedEventDetails": {
+      "type": "structure",
+      "members": {
+        "length": {
+          "target": "com.amazonaws.sfn#UnsignedInteger",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The size of the array for Map state iterations.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Details about a Map state that was started.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MaxConcurrency": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#MissingRequiredParameter": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Request is missing a required parameter. This error occurs if both <code>definition</code>\n      and <code>roleArn</code> are not specified.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#MockErrorOutput": {
+      "type": "structure",
+      "members": {
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>A string denoting the error code of the exception thrown when invoking the tested state. This field is required if <code>mock.errorOutput</code> is specified.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A string containing the cause of the exception thrown when executing the state's logic.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>A JSON object that contains a mocked error.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MockInput": {
+      "type": "structure",
+      "members": {
+        "result": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>A JSON string containing the mocked result of the state invocation.</p>"
+          }
+        },
+        "errorOutput": {
+          "target": "com.amazonaws.sfn#MockErrorOutput",
+          "traits": {
+            "smithy.api#documentation": "<p>The mocked error output when calling TestState. When specified, the mocked response is returned as a JSON object that contains an <code>error</code> and <code>cause</code> field.</p>"
+          }
+        },
+        "fieldValidationMode": {
+          "target": "com.amazonaws.sfn#MockResponseValidationMode",
+          "traits": {
+            "smithy.api#documentation": "<p>Determines the level of strictness when validating mocked results against their respective API models. Values include:</p>\n         <ul>\n            <li>\n               <p>\n                  <code>STRICT</code>: All required fields must be present, and all present fields must conform to the API's schema.</p>\n            </li>\n            <li>\n               <p>\n                  <code>PRESENT</code>: All present fields must conform to the API's schema.</p>\n            </li>\n            <li>\n               <p>\n                  <code>NONE</code>: No validation is performed.</p>\n            </li>\n         </ul>\n         <p>If no value is specified, the default value is <code>STRICT</code>.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>A JSON object that contains a mocked <code>result</code> or <code>errorOutput</code>.</p>"
+      }
+    },
+    "com.amazonaws.sfn#MockResponseValidationMode": {
+      "type": "enum",
+      "members": {
+        "STRICT": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "STRICT"
+          }
+        },
+        "PRESENT": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "PRESENT"
+          }
+        },
+        "NONE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "NONE"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#Name": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 80
+        }
+      }
+    },
+    "com.amazonaws.sfn#PageSize": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0,
+          "max": 1000
+        }
+      }
+    },
+    "com.amazonaws.sfn#PageToken": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 1024
+        }
+      }
+    },
+    "com.amazonaws.sfn#Publish": {
+      "type": "boolean",
+      "traits": {
+        "smithy.api#default": false
+      }
+    },
+    "com.amazonaws.sfn#PublishStateMachineVersion": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#PublishStateMachineVersionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#PublishStateMachineVersionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ConflictException"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ServiceQuotaExceededException"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Creates a <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">version</a> from the\n      current revision of a state machine. Use versions to create immutable snapshots of your state\n      machine. You can start executions from versions either directly or with an alias. To create an\n      alias, use <a>CreateStateMachineAlias</a>.</p>\n         <p>You can publish up to 1000 versions for each state machine. You must manually delete unused versions using the <a>DeleteStateMachineVersion</a> API action.</p>\n         <p>\n            <code>PublishStateMachineVersion</code> is an idempotent API. It doesn't create a\n      duplicate state machine version if it already exists for the current revision. Step Functions bases <code>PublishStateMachineVersion</code>'s idempotency check on the\n        <code>stateMachineArn</code>, <code>name</code>, and <code>revisionId</code> parameters.\n      Requests with the same parameters return a successful idempotent response. If you don't\n      specify a <code>revisionId</code>, Step Functions checks for a previously published\n      version of the state machine's current revision.</p>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>DeleteStateMachineVersion</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>ListStateMachineVersions</a>\n               </p>\n            </li>\n         </ul>",
+        "smithy.api#idempotent": {}
+      }
+    },
+    "com.amazonaws.sfn#PublishStateMachineVersionInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "revisionId": {
+          "target": "com.amazonaws.sfn#RevisionId",
+          "traits": {
+            "smithy.api#documentation": "<p>Only publish the state machine version if the current state machine's revision ID matches the specified ID.</p>\n         <p>Use this option to avoid publishing a version if the state machine changed since you last\n      updated it. If the specified revision ID doesn't match the state machine's current revision\n      ID, the API returns <code>ConflictException</code>.</p>\n         <note>\n            <p>To specify an initial revision ID for a state machine with no revision ID assigned,\n        specify the string <code>INITIAL</code> for the <code>revisionId</code> parameter. For\n        example, you can specify a <code>revisionID</code> of <code>INITIAL</code> when you create a\n        state machine using the <a>CreateStateMachine</a> API action.</p>\n         </note>"
+          }
+        },
+        "description": {
+          "target": "com.amazonaws.sfn#VersionDescription",
+          "traits": {
+            "smithy.api#documentation": "<p>An optional description of the state machine version.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#PublishStateMachineVersionOutput": {
+      "type": "structure",
+      "members": {
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the version was created.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) (ARN) that identifies the state machine version.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#RedriveCount": {
+      "type": "integer"
+    },
+    "com.amazonaws.sfn#RedriveExecution": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#RedriveExecutionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#RedriveExecutionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ExecutionDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#ExecutionLimitExceeded"
+        },
+        {
+          "target": "com.amazonaws.sfn#ExecutionNotRedrivable"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Restarts unsuccessful executions of Standard workflows that didn't complete successfully in the last 14 days. These include failed, aborted, or timed out executions. When you <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/redrive-executions.html\">redrive</a> an execution, it continues the failed execution from the unsuccessful step and uses the same input. Step Functions preserves the results and execution history of the successful steps, and doesn't rerun these steps when you redrive an execution. Redriven executions use the same state machine definition and execution ARN as the original execution attempt.</p>\n         <p>For workflows that include an <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-map-state.html\">Inline Map</a> or <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-parallel-state.html\">Parallel</a> state, <code>RedriveExecution</code> API action reschedules and redrives only the iterations and branches that failed or aborted.</p>\n         <p>To redrive a workflow that includes a Distributed Map state whose Map Run failed, you must redrive the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/use-dist-map-orchestrate-large-scale-parallel-workloads.html#dist-map-orchestrate-parallel-workloads-key-terms\">parent workflow</a>. The parent workflow redrives all the unsuccessful states, including a failed Map Run. If a Map Run was not started in the original execution attempt, the redriven parent workflow starts the Map Run.</p>\n         <note>\n            <p>This API action is not supported by <code>EXPRESS</code> state machines.</p>\n            <p>However, you can restart the unsuccessful executions of Express child workflows in a Distributed Map by redriving its Map Run. When you redrive a Map Run, the Express child workflows are rerun using the <a>StartExecution</a> API action. For more information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/redrive-map-run.html\">Redriving Map Runs</a>.</p>\n         </note>\n         <p>You can redrive executions if your original execution meets the following conditions:</p>\n         <ul>\n            <li>\n               <p>The execution status isn't <code>SUCCEEDED</code>.</p>\n            </li>\n            <li>\n               <p>Your workflow execution has not exceeded the redrivable period of 14 days. Redrivable period refers to the time during which you can redrive a given execution. This period starts from the day a state machine completes its execution.</p>\n            </li>\n            <li>\n               <p>The workflow execution has not exceeded the maximum open time of one year. For more information about state machine quotas, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/limits-overview.html#service-limits-state-machine-executions\">Quotas related to state machine executions</a>.</p>\n            </li>\n            <li>\n               <p>The execution event history count is less than 24,999. Redriven executions append their event history to the existing event history. Make sure your workflow execution contains less than 24,999 events to accommodate the <code>ExecutionRedriven</code> history event and at least one other history event.</p>\n            </li>\n         </ul>",
+        "smithy.api#idempotent": {}
+      }
+    },
+    "com.amazonaws.sfn#RedriveExecutionInput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the execution to be redriven.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "clientToken": {
+          "target": "com.amazonaws.sfn#ClientToken",
+          "traits": {
+            "smithy.api#documentation": "<p>A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you don\u2019t specify a client token, the Amazon Web Services SDK automatically generates a client token and uses it for the request to ensure idempotency. The API will return idempotent responses for the last 10 client tokens used to successfully redrive the execution. These client tokens are valid for up to 15 minutes after they are first used.</p>",
+            "smithy.api#idempotencyToken": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#RedriveExecutionOutput": {
+      "type": "structure",
+      "members": {
+        "redriveDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution was last redriven.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ResourceNotFound": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        },
+        "resourceName": {
+          "target": "com.amazonaws.sfn#Arn"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Could not find the referenced resource.</p>",
+        "smithy.api#error": "client",
+        "smithy.api#httpError": 404
+      }
+    },
+    "com.amazonaws.sfn#RetrierRetryCount": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#RetryBackoffIntervalSeconds": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#range": {
+          "min": 0
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#RevealSecrets": {
+      "type": "boolean",
+      "traits": {
+        "smithy.api#default": false
+      }
+    },
+    "com.amazonaws.sfn#ReverseOrder": {
+      "type": "boolean",
+      "traits": {
+        "smithy.api#default": false
+      }
+    },
+    "com.amazonaws.sfn#RevisionId": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#RoutingConfigurationList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#RoutingConfigurationListItem"
+      },
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 2
+        }
+      }
+    },
+    "com.amazonaws.sfn#RoutingConfigurationListItem": {
+      "type": "structure",
+      "members": {
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies one or two state machine versions defined in the routing configuration.</p>\n         <p>If you specify the ARN of a second version, it must belong to the same state machine as the first version.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "weight": {
+          "target": "com.amazonaws.sfn#VersionWeight",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The percentage of traffic you want to route to a state machine version. The sum of the\n      weights in the routing configuration must be equal to 100.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the routing configuration of a state machine alias. In a routing\n      configuration, you define an array of objects that specify up to two state machine versions.\n      You also specify the percentage of traffic to be routed to each version.</p>"
+      }
+    },
+    "com.amazonaws.sfn#SendTaskFailure": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#SendTaskFailureInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#SendTaskFailureOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#TaskDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#TaskTimedOut"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Used by activity workers, Task states using the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token\">callback</a>\n      pattern, and optionally Task states using the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-sync\">job run</a> pattern to report that the task identified by the <code>taskToken</code> failed.</p>\n         <p>For an execution with encryption enabled, Step Functions will encrypt the error and cause fields using the KMS key for the execution role.</p>\n         <p>A caller can mark a task as fail without using any KMS permissions in the execution role if the caller provides a null value for both <code>error</code> and <code>cause</code> fields because no data needs to be encrypted.</p>"
+      }
+    },
+    "com.amazonaws.sfn#SendTaskFailureInput": {
+      "type": "structure",
+      "members": {
+        "taskToken": {
+          "target": "com.amazonaws.sfn#TaskToken",
+          "traits": {
+            "smithy.api#documentation": "<p>The token that represents this task. Task tokens are generated by Step Functions when\n      tasks are assigned to a worker, or in the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-contextobject.html\">context object</a> when a\n      workflow enters a task state. See <a>GetActivityTaskOutput$taskToken</a>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#SendTaskFailureOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#SendTaskHeartbeat": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#SendTaskHeartbeatInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#SendTaskHeartbeatOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        },
+        {
+          "target": "com.amazonaws.sfn#TaskDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#TaskTimedOut"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Used by activity workers and Task states using the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token\">callback</a>\n      pattern, and optionally Task states using the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-sync\">job run</a> pattern to report to Step Functions that the task represented by the specified\n        <code>taskToken</code> is still making progress. This action resets the\n        <code>Heartbeat</code> clock. The <code>Heartbeat</code> threshold is specified in the state\n      machine's Amazon States Language definition (<code>HeartbeatSeconds</code>). This action does not in itself\n      create an event in the execution history. However, if the task times out, the execution\n      history contains an <code>ActivityTimedOut</code> entry for activities, or a\n        <code>TaskTimedOut</code> entry for tasks using the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-sync\">job run</a> or\n        <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token\">callback</a>\n      pattern.</p>\n         <note>\n            <p>The <code>Timeout</code> of a task, defined in the state machine's Amazon States Language definition, is\n        its maximum allowed duration, regardless of the number of <a>SendTaskHeartbeat</a> requests received. Use <code>HeartbeatSeconds</code> to configure the timeout interval\n        for heartbeats.</p>\n         </note>"
+      }
+    },
+    "com.amazonaws.sfn#SendTaskHeartbeatInput": {
+      "type": "structure",
+      "members": {
+        "taskToken": {
+          "target": "com.amazonaws.sfn#TaskToken",
+          "traits": {
+            "smithy.api#documentation": "<p>The token that represents this task. Task tokens are generated by Step Functions when\n      tasks are assigned to a worker, or in the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-contextobject.html\">context object</a> when a\n      workflow enters a task state. See <a>GetActivityTaskOutput$taskToken</a>.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#SendTaskHeartbeatOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#SendTaskSuccess": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#SendTaskSuccessInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#SendTaskSuccessOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidOutput"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidToken"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#TaskDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#TaskTimedOut"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Used by activity workers, Task states using the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-wait-token\">callback</a>\n      pattern, and optionally Task states using the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html#connect-sync\">job run</a> pattern to report that the task identified by the <code>taskToken</code> completed\n      successfully.</p>"
+      }
+    },
+    "com.amazonaws.sfn#SendTaskSuccessInput": {
+      "type": "structure",
+      "members": {
+        "taskToken": {
+          "target": "com.amazonaws.sfn#TaskToken",
+          "traits": {
+            "smithy.api#documentation": "<p>The token that represents this task. Task tokens are generated by Step Functions when\n      tasks are assigned to a worker, or in the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/input-output-contextobject.html\">context object</a> when a\n      workflow enters a task state. See <a>GetActivityTaskOutput$taskToken</a>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON output of the task. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#SendTaskSuccessOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#SensitiveCause": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 32768
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#SensitiveData": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 262144
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#SensitiveDataJobInput": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 1048576
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#SensitiveError": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 256
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#ServiceQuotaExceededException": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The request would cause a service quota to be exceeded.</p>\n         <p>HTTP Status Code: 402</p>",
+        "smithy.api#error": "client",
+        "smithy.api#httpError": 402
+      }
+    },
+    "com.amazonaws.sfn#StartExecution": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#StartExecutionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#StartExecutionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ExecutionAlreadyExists"
+        },
+        {
+          "target": "com.amazonaws.sfn#ExecutionLimitExceeded"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidExecutionInput"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidName"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Starts a state machine execution.</p>\n         <p>A qualified state machine ARN can either refer to a <i>Distributed Map state</i> defined within a state machine, a version ARN, or an alias ARN.</p>\n         <p>The following are some examples of qualified and unqualified state machine ARNs:</p>\n         <ul>\n            <li>\n               <p>The following qualified state machine ARN refers to a <i>Distributed Map state</i> with a label <code>mapStateLabel</code> in a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:partition:states:region:account-id:stateMachine:myStateMachine/mapStateLabel</code>\n               </p>\n               <note>\n                  <p>If you provide a qualified state machine ARN that refers to a <i>Distributed Map state</i>, the request fails with <code>ValidationException</code>.</p>\n               </note>\n            </li>\n            <li>\n               <p>The following qualified state machine ARN refers to an alias named <code>PROD</code>.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine:PROD></code>\n               </p>\n               <note>\n                  <p>If you provide a qualified state machine ARN that refers to a version ARN or an alias ARN, the request starts execution for that version or alias.</p>\n               </note>\n            </li>\n            <li>\n               <p>The following unqualified state machine ARN refers to a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine></code>\n               </p>\n            </li>\n         </ul>\n         <p>If you start an execution with an unqualified state machine ARN, Step Functions uses the latest revision of the state machine for the execution.</p>\n         <p>To start executions of a state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">version</a>, call\n        <code>StartExecution</code> and provide the version ARN or the ARN of an <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a> that points to the version.</p>\n         <note>\n            <p>\n               <code>StartExecution</code> is idempotent for <code>STANDARD</code> workflows. For a\n          <code>STANDARD</code> workflow, if you call <code>StartExecution</code> with the same name\n        and input as a running execution, the call succeeds and return the same response as the\n        original request. If the execution is closed or if the input is different, it returns a\n          <code>400 ExecutionAlreadyExists</code> error. You can reuse the name 90 days after it closes. </p>\n            <p>\n               <code>StartExecution</code> isn't idempotent for <code>EXPRESS</code> workflows. </p>\n         </note>",
+        "smithy.api#idempotent": {}
+      }
+    },
+    "com.amazonaws.sfn#StartExecutionInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine to execute.</p>\n         <p>The <code>stateMachineArn</code> parameter accepts one of the following inputs:</p>\n         <ul>\n            <li>\n               <p>\n                  <b>An unqualified state machine ARN</b> \u2013 Refers to a state machine ARN that isn't qualified with a version or alias ARN. The following is an example of an unqualified state machine ARN.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine></code>\n               </p>\n               <p>Step Functions doesn't associate state machine executions that you start with an unqualified ARN with a version. This is true even if that version uses the same revision that the execution used.</p>\n            </li>\n            <li>\n               <p>\n                  <b>A state machine version ARN</b> \u2013 Refers to a version ARN, which is a combination of state machine ARN and the version number separated by a colon (:). The following is an example of the ARN for version 10. </p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine>:10</code>\n               </p>\n               <p>Step Functions doesn't associate executions that you start with a version ARN with any aliases that point to that version.</p>\n            </li>\n            <li>\n               <p>\n                  <b>A state machine alias ARN</b> \u2013 Refers to an alias ARN, which is a combination of state machine ARN and the alias name separated by a colon (:). The following is an example of the ARN for an alias named <code>PROD</code>.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine:PROD></code>\n               </p>\n               <p>Step Functions associates executions\n          that you start with an alias ARN with that alias and the state machine version used for\n          that execution.</p>\n            </li>\n         </ul>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>Optional name of the execution. For STANDARD workflows, this name must be unique for your Amazon Web Services account, region, and state machine.\n    If a previous execution with the same name exists, you can reuse the name 90 days after it closes.  For EXPRESS workflows, execution names\n    can be reused immediately.\n    For more information, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/limits.html#service-limits-state-machine-executions\">\n    Limits Related to State Machine Executions</a> in the <i>Step Functions Developer Guide</i>.</p>\n         <p>If you don't provide a name for the execution, Step Functions automatically generates a universally unique identifier (UUID) as the execution name.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>"
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The string that contains the JSON input data for the execution, for example:</p>\n         <p>\n            <code>\"{\\\"first_name\\\" : \\\"Alejandro\\\"}\"</code>\n         </p>\n         <note>\n            <p>If you don't include any JSON input data, you still must include the two braces, for\n        example: <code>\"{}\"</code>\n            </p>\n         </note>\n         <p>Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "traceHeader": {
+          "target": "com.amazonaws.sfn#TraceHeader",
+          "traits": {
+            "smithy.api#documentation": "<p>Passes the X-Ray trace header. The trace header can also be passed in the request\n      payload.</p>\n         <note>\n            <p>\n                For X-Ray traces, all Amazon Web Services services use the <code>X-Amzn-Trace-Id</code> header from the HTTP request. Using the header is the preferred mechanism to identify a trace. <code>StartExecution</code> and <code>StartSyncExecution</code> API operations can also use <code>traceHeader</code> from the body of the request payload. If <b>both</b> sources are provided, Step Functions will use the <b>header value</b> (preferred) over the value in the request body.\n            </p>\n         </note>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#StartExecutionOutput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "startDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution is started.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#StartSyncExecution": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#StartSyncExecutionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#StartSyncExecutionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidExecutionInput"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidName"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineTypeNotSupported"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Starts a Synchronous Express state machine execution. <code>StartSyncExecution</code> \n\t\t\t  is not available for <code>STANDARD</code> workflows.</p>\n         <note>\n            <p>\n               <code>StartSyncExecution</code> will return a <code>200 OK</code> response, even if your\n        execution fails, because the status code in the API response doesn't reflect function\n        errors. Error codes are reserved for errors that prevent your execution from running, such\n        as permissions errors, limit errors, or issues with your state machine code and\n        configuration. </p>\n         </note>",
+        "smithy.api#endpoint": {
+          "hostPrefix": "sync-"
+        }
+      }
+    },
+    "com.amazonaws.sfn#StartSyncExecutionInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine to execute.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the execution.</p>"
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The string that contains the JSON input data for the execution, for example:</p>\n         <p>\n            <code>\"{\\\"first_name\\\" : \\\"Alejandro\\\"}\"</code>\n         </p>\n         <note>\n            <p>If you don't include any JSON input data, you still must include the two braces, for\n        example: <code>\"{}\"</code>\n            </p>\n         </note>\n         <p>Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "traceHeader": {
+          "target": "com.amazonaws.sfn#TraceHeader",
+          "traits": {
+            "smithy.api#documentation": "<p>Passes the X-Ray trace header. The trace header can also be passed in the request\n      payload.</p>\n         <note>\n            <p>\n                For X-Ray traces, all Amazon Web Services services use the <code>X-Amzn-Trace-Id</code> header from the HTTP request. Using the header is the preferred mechanism to identify a trace. <code>StartExecution</code> and <code>StartSyncExecution</code> API operations can also use <code>traceHeader</code> from the body of the request payload. If <b>both</b> sources are provided, Step Functions will use the <b>header value</b> (preferred) over the value in the request body.\n            </p>\n         </note>"
+          }
+        },
+        "includedData": {
+          "target": "com.amazonaws.sfn#IncludedData",
+          "traits": {
+            "smithy.api#documentation": "<p>If your state machine definition is encrypted with a KMS key, callers must have <code>kms:Decrypt</code> permission to decrypt the definition. Alternatively, you can call the API with <code>includedData = METADATA_ONLY</code> to get a successful response without the encrypted definition.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#StartSyncExecutionOutput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the state machine.</p>"
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the execution.</p>"
+          }
+        },
+        "startDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution is started.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "stopDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>If the execution has already ended, the date the execution stopped.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "status": {
+          "target": "com.amazonaws.sfn#SyncExecutionStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>The current status of the execution.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The string that contains the JSON input data of the execution. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "inputDetails": {
+          "target": "com.amazonaws.sfn#CloudWatchEventsExecutionDataDetails"
+        },
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON output data of the execution. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>\n         <note>\n            <p>This field is set only if the execution succeeds. If the execution fails, this field is\n        null.</p>\n         </note>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#CloudWatchEventsExecutionDataDetails"
+        },
+        "traceHeader": {
+          "target": "com.amazonaws.sfn#TraceHeader",
+          "traits": {
+            "smithy.api#documentation": "<p>The X-Ray trace header that was passed to the execution.</p>\n         <note>\n            <p>\n                For X-Ray traces, all Amazon Web Services services use the <code>X-Amzn-Trace-Id</code> header from the HTTP request. Using the header is the preferred mechanism to identify a trace. <code>StartExecution</code> and <code>StartSyncExecution</code> API operations can also use <code>traceHeader</code> from the body of the request payload. If <b>both</b> sources are provided, Step Functions will use the <b>header value</b> (preferred) over the value in the request body.\n            </p>\n         </note>"
+          }
+        },
+        "billingDetails": {
+          "target": "com.amazonaws.sfn#BillingDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>An object that describes workflow billing details, including billed duration and memory\n      use.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#StateEnteredEventDetails": {
+      "type": "structure",
+      "members": {
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The string that contains the JSON input data for the state. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "inputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the input for an execution history event.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a state entered during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#StateExitedEventDetails": {
+      "type": "structure",
+      "members": {
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON output data of the state. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the output of an execution history event.</p>"
+          }
+        },
+        "assignedVariables": {
+          "target": "com.amazonaws.sfn#AssignedVariables",
+          "traits": {
+            "smithy.api#documentation": "<p>Map of variable name and value as a serialized JSON representation.</p>"
+          }
+        },
+        "assignedVariablesDetails": {
+          "target": "com.amazonaws.sfn#AssignedVariablesDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Provides details about input or output in an execution history event.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about an exit from a state during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineAliasList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#StateMachineAliasListItem"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineAliasListItem": {
+      "type": "structure",
+      "members": {
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies a state machine alias. The alias ARN is a combination of state machine ARN and the alias name separated by a colon (:). For example, <code>stateMachineARN:PROD</code>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The creation date of a state machine alias.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a specific state machine alias.</p>"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineAlreadyExists": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>A state machine with the same name but a different definition or role ARN already\n      exists.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineDeleting": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The specified state machine is being deleted.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineDoesNotExist": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The specified state machine does not exist.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineLimitExceeded": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The maximum number of state machines has been reached. Existing state machines must be\n      deleted before a new state machine can be created.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#StateMachineListItem"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineListItem": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies the state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "name": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state machine.</p>\n         <p>A name must <i>not</i> contain:</p>\n         <ul>\n            <li>\n               <p>white space</p>\n            </li>\n            <li>\n               <p>brackets <code>< > { } [ ]</code>\n               </p>\n            </li>\n            <li>\n               <p>wildcard characters <code>? *</code>\n               </p>\n            </li>\n            <li>\n               <p>special characters <code>\" # % \\ ^ | ~ ` $ & , ; : /</code>\n               </p>\n            </li>\n            <li>\n               <p>control characters (<code>U+0000-001F</code>, <code>U+007F-009F</code>, <code>U+FFFE-FFFF</code>)</p>\n            </li>\n            <li>\n               <p>surrogates (<code>U+D800-DFFF</code>)</p>\n            </li>\n            <li>\n               <p>invalid characters (<code> U+10FFFF</code>)</p>\n            </li>\n         </ul>\n         <p>To enable logging with CloudWatch Logs, the name should only contain  0-9, A-Z, a-z, - and _.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "type": {
+          "target": "com.amazonaws.sfn#StateMachineType",
+          "traits": {
+            "smithy.api#documentation": "<p></p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the state machine is created.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the state machine.</p>"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineStatus": {
+      "type": "enum",
+      "members": {
+        "ACTIVE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ACTIVE"
+          }
+        },
+        "DELETING": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "DELETING"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#StateMachineType": {
+      "type": "enum",
+      "members": {
+        "STANDARD": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "STANDARD"
+          }
+        },
+        "EXPRESS": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "EXPRESS"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#StateMachineTypeNotSupported": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>State machine type is not supported.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineVersionList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#StateMachineVersionListItem"
+      }
+    },
+    "com.amazonaws.sfn#StateMachineVersionListItem": {
+      "type": "structure",
+      "members": {
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that identifies a state machine version. The version ARN is a combination of state machine ARN and the version number separated by a colon (:). For example, <code>stateMachineARN:1</code>.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "creationDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The creation date of a state machine version.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a specific state machine version.</p>"
+      }
+    },
+    "com.amazonaws.sfn#StateName": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 80
+        }
+      }
+    },
+    "com.amazonaws.sfn#StopExecution": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#StopExecutionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#StopExecutionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ExecutionDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsInvalidStateException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Stops an execution.</p>\n         <p>This API action is not supported by <code>EXPRESS</code> state machines.</p>\n         <p>For an execution with encryption enabled, Step Functions will encrypt the error and cause fields using the KMS key for the execution role.</p>\n         <p>A caller can stop an execution without using any KMS permissions in the execution role if the caller provides a null value for both <code>error</code> and <code>cause</code> fields because no data needs to be encrypted.</p>"
+      }
+    },
+    "com.amazonaws.sfn#StopExecutionInput": {
+      "type": "structure",
+      "members": {
+        "executionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the execution to stop.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#StopExecutionOutput": {
+      "type": "structure",
+      "members": {
+        "stopDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date the execution is stopped.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#SyncExecutionStatus": {
+      "type": "enum",
+      "members": {
+        "SUCCEEDED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "SUCCEEDED"
+          }
+        },
+        "FAILED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "FAILED"
+          }
+        },
+        "TIMED_OUT": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "TIMED_OUT"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#Tag": {
+      "type": "structure",
+      "members": {
+        "key": {
+          "target": "com.amazonaws.sfn#TagKey",
+          "traits": {
+            "smithy.api#documentation": "<p>The key of a tag.</p>"
+          }
+        },
+        "value": {
+          "target": "com.amazonaws.sfn#TagValue",
+          "traits": {
+            "smithy.api#documentation": "<p>The value of a tag.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Tags are key-value pairs that can be associated with Step Functions state machines and\n      activities.</p>\n         <p>An array of key-value pairs. For more information, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html\">Using\n      Cost Allocation Tags</a> in the <i>Amazon Web Services Billing and Cost Management User\n        Guide</i>, and <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html\">Controlling Access Using IAM\n          Tags</a>.</p>\n         <p>Tags may only contain Unicode letters, digits, white space, or these symbols: <code>_ . : / = + - @</code>.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TagKey": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 128
+        }
+      }
+    },
+    "com.amazonaws.sfn#TagKeyList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#TagKey"
+      }
+    },
+    "com.amazonaws.sfn#TagList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#Tag"
+      }
+    },
+    "com.amazonaws.sfn#TagResource": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#TagResourceInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#TagResourceOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#TooManyTags"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Add a tag to a Step Functions resource.</p>\n         <p>An array of key-value pairs. For more information, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html\">Using\n      Cost Allocation Tags</a> in the <i>Amazon Web Services Billing and Cost Management User\n        Guide</i>, and <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html\">Controlling Access Using IAM\n          Tags</a>.</p>\n         <p>Tags may only contain Unicode letters, digits, white space, or these symbols: <code>_ . : / = + - @</code>.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TagResourceInput": {
+      "type": "structure",
+      "members": {
+        "resourceArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) for the Step Functions state machine or activity.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "tags": {
+          "target": "com.amazonaws.sfn#TagList",
+          "traits": {
+            "smithy.api#documentation": "<p>The list of tags to add to a resource.</p>\n         <p>Tags may only contain Unicode letters, digits, white space, or these symbols: <code>_ . : / = + - @</code>.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#TagResourceOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#TagValue": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 256
+        }
+      }
+    },
+    "com.amazonaws.sfn#TaskCredentials": {
+      "type": "structure",
+      "members": {
+        "roleArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The ARN of an IAM role that Step Functions assumes for the task. The role can allow cross-account access to resources.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the credentials that Step Functions uses for a task.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskDoesNotExist": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The activity does not exist.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#TaskFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a task failure event.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskScheduledEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "region": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The region of the scheduled task</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "parameters": {
+          "target": "com.amazonaws.sfn#ConnectorParameters",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON data passed to the resource referenced in a task state.\n      Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "timeoutInSeconds": {
+          "target": "com.amazonaws.sfn#TimeoutInSeconds",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum allowed duration of the task.</p>"
+          }
+        },
+        "heartbeatInSeconds": {
+          "target": "com.amazonaws.sfn#TimeoutInSeconds",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum allowed duration between two heartbeats for the task.</p>"
+          }
+        },
+        "taskCredentials": {
+          "target": "com.amazonaws.sfn#TaskCredentials",
+          "traits": {
+            "smithy.api#documentation": "<p>The credentials that Step Functions uses for the task.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a task scheduled during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskStartFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a task that failed to start during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskStartedEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the start of a task during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskSubmitFailedEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a task that failed to submit during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskSubmittedEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The response from a resource when a task has started. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the output of an execution history event.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a task submitted to a resource .</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskSucceededEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The full JSON response from a resource when a task has succeeded. This response becomes\n      the output of the related task. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "outputDetails": {
+          "target": "com.amazonaws.sfn#HistoryEventExecutionDataDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains details about the output of an execution history event.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about the successful completion of a task state.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskTimedOut": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The task token has either expired or the task associated with the token has already been closed.</p>",
+        "smithy.api#error": "client"
+      }
+    },
+    "com.amazonaws.sfn#TaskTimedOutEventDetails": {
+      "type": "structure",
+      "members": {
+        "resourceType": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The service name of the resource in a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "resource": {
+          "target": "com.amazonaws.sfn#Name",
+          "traits": {
+            "smithy.api#documentation": "<p>The action of the resource called by a task state.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code of the failure.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A more detailed explanation of the cause of the failure.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains details about a resource timeout that occurred during an execution.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TaskToken": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 2048
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#TestExecutionStatus": {
+      "type": "enum",
+      "members": {
+        "SUCCEEDED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "SUCCEEDED"
+          }
+        },
+        "FAILED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "FAILED"
+          }
+        },
+        "RETRIABLE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "RETRIABLE"
+          }
+        },
+        "CAUGHT_ERROR": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "CAUGHT_ERROR"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#TestState": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#TestStateInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#TestStateOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidDefinition"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidExecutionInput"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Accepts the definition of a single state and executes it. You can test a state without creating a state machine or updating an existing state machine. Using this API, you can test the following:</p>\n         <ul>\n            <li>\n               <p>A state's <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/test-state-isolation.html#test-state-input-output-dataflow\">input and output processing</a> data flow</p>\n            </li>\n            <li>\n               <p>An <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-services.html\">Amazon Web Services service integration</a> request and response</p>\n            </li>\n            <li>\n               <p>An <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/call-https-apis.html\">HTTP Task</a> request and response</p>\n            </li>\n         </ul>\n         <p>You can call this API on only one state at a time. The states that you can test include the following:</p>\n         <ul>\n            <li>\n               <p>\n                  <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-task-state.html#task-types\">All Task types</a> except <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-activities.html\">Activity</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-pass-state.html\">Pass</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-wait-state.html\">Wait</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-choice-state.html\">Choice</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-succeed-state.html\">Succeed</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-fail-state.html\">Fail</a>\n               </p>\n            </li>\n         </ul>\n         <p>The <code>TestState</code> API assumes an IAM role which must contain the required IAM permissions for the resources your state is accessing. For information about the permissions a state might need, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/test-state-isolation.html#test-state-permissions\">IAM permissions to test a state</a>.</p>\n         <p>The <code>TestState</code> API can run for up to five minutes. If the execution of a state exceeds this duration, it fails with the <code>States.Timeout</code> error.</p>\n         <p>\n            <code>TestState</code> only supports the following when a mock is specified: <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-activities.html\">Activity tasks</a>, <code>.sync</code> or <code>.waitForTaskToken</code>\n            <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/connect-to-resource.html\">service integration patterns</a>, <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-parallel-state.html\">Parallel</a>, or <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-map-state.html\">Map</a> states.</p>",
+        "smithy.api#endpoint": {
+          "hostPrefix": "sync-"
+        }
+      }
+    },
+    "com.amazonaws.sfn#TestStateConfiguration": {
+      "type": "structure",
+      "members": {
+        "retrierRetryCount": {
+          "target": "com.amazonaws.sfn#RetrierRetryCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of retry attempts that have occurred for the state's Retry that applies to the mocked error.</p>"
+          }
+        },
+        "errorCausedByState": {
+          "target": "com.amazonaws.sfn#TestStateStateName",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the state from which an error originates when an error is mocked for a Map or Parallel state.</p>"
+          }
+        },
+        "mapIterationFailureCount": {
+          "target": "com.amazonaws.sfn#MapIterationFailureCount",
+          "traits": {
+            "smithy.api#documentation": "<p>The number of Map state iterations that failed during the Map state invocation.</p>"
+          }
+        },
+        "mapItemReaderData": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The data read by ItemReader in Distributed Map states as found in its original source.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Contains configurations for the tested state.</p>"
+      }
+    },
+    "com.amazonaws.sfn#TestStateInput": {
+      "type": "structure",
+      "members": {
+        "definition": {
+          "target": "com.amazonaws.sfn#Definition",
+          "traits": {
+            "smithy.api#documentation": "<p>The <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States Language</a> (ASL) definition of the state or state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "roleArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the execution role with the required IAM permissions for the state.</p>"
+          }
+        },
+        "input": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>A string that contains the JSON input data for the state.</p>"
+          }
+        },
+        "inspectionLevel": {
+          "target": "com.amazonaws.sfn#InspectionLevel",
+          "traits": {
+            "smithy.api#documentation": "<p>Determines the values to return when a state is tested. You can specify one of the following types:</p>\n         <ul>\n            <li>\n               <p>\n                  <code>INFO</code>: Shows the final state output. By default, Step Functions sets <code>inspectionLevel</code> to <code>INFO</code> if you don't specify a level.</p>\n            </li>\n            <li>\n               <p>\n                  <code>DEBUG</code>: Shows the final state output along with the input and output data processing result.</p>\n            </li>\n            <li>\n               <p>\n                  <code>TRACE</code>: Shows the HTTP request and response for an HTTP Task. This level also shows the final state output along with the input and output data processing result.</p>\n            </li>\n         </ul>\n         <p>Each of these levels also provide information about the status of the state execution and the next state to transition to.</p>"
+          }
+        },
+        "revealSecrets": {
+          "target": "com.amazonaws.sfn#RevealSecrets",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Specifies whether or not to include secret information in the test result. For HTTP Tasks, a secret includes the data that an EventBridge connection adds to modify the HTTP request headers, query parameters, and body. Step Functions doesn't omit any information included in the state definition or the HTTP response.</p>\n         <p>If you set <code>revealSecrets</code> to <code>true</code>, you must make sure that the IAM user that calls the <code>TestState</code> API has permission for the <code>states:RevealSecrets</code> action. For an example of IAM policy that sets the <code>states:RevealSecrets</code> permission, see <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/test-state-isolation.html#test-state-permissions\">IAM permissions to test a state</a>. Without this permission, Step Functions throws an access denied error.</p>\n         <p>By default, <code>revealSecrets</code> is set to <code>false</code>.</p>"
+          }
+        },
+        "variables": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>JSON object literal that sets variables used in the state under test. Object keys are the variable names and values are the variable values.</p>"
+          }
+        },
+        "stateName": {
+          "target": "com.amazonaws.sfn#TestStateStateName",
+          "traits": {
+            "smithy.api#documentation": "<p>Denotes the particular state within a state machine definition to be tested. If this field is specified, the <code>definition</code> must contain a fully-formed state machine definition.</p>"
+          }
+        },
+        "mock": {
+          "target": "com.amazonaws.sfn#MockInput",
+          "traits": {
+            "smithy.api#documentation": "<p>Defines a mocked result or error for the state under test.</p>\n         <p>A mock can only be specified for Task, Map, or Parallel states. If it is specified for another state type, an exception will be thrown.</p>"
+          }
+        },
+        "context": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>A JSON string representing a valid Context object for the state under test. This field may only be specified if a mock is specified in the same request.</p>"
+          }
+        },
+        "stateConfiguration": {
+          "target": "com.amazonaws.sfn#TestStateConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Contains configurations for the state under test.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#TestStateOutput": {
+      "type": "structure",
+      "members": {
+        "output": {
+          "target": "com.amazonaws.sfn#SensitiveData",
+          "traits": {
+            "smithy.api#documentation": "<p>The JSON output data of the state. Length constraints apply to the payload size, and are expressed as bytes in UTF-8 encoding.</p>"
+          }
+        },
+        "error": {
+          "target": "com.amazonaws.sfn#SensitiveError",
+          "traits": {
+            "smithy.api#documentation": "<p>The error returned when the execution of a state fails.</p>"
+          }
+        },
+        "cause": {
+          "target": "com.amazonaws.sfn#SensitiveCause",
+          "traits": {
+            "smithy.api#documentation": "<p>A detailed explanation of the cause for the error when the execution of a state fails.</p>"
+          }
+        },
+        "inspectionData": {
+          "target": "com.amazonaws.sfn#InspectionData",
+          "traits": {
+            "smithy.api#documentation": "<p>Returns additional details about the state's execution, including its input and output data processing flow, and HTTP request and response information. The <code>inspectionLevel</code> request parameter specifies which details are returned.</p>"
+          }
+        },
+        "nextState": {
+          "target": "com.amazonaws.sfn#StateName",
+          "traits": {
+            "smithy.api#documentation": "<p>The name of the next state to transition to. If you haven't defined a next state in your definition or if the execution of the state fails, this field doesn't contain a value.</p>"
+          }
+        },
+        "status": {
+          "target": "com.amazonaws.sfn#TestExecutionStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>The execution status of the state.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#TestStateStateName": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 1,
+          "max": 80
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#TimeoutInSeconds": {
+      "type": "long",
+      "traits": {
+        "smithy.api#default": 0
+      }
+    },
+    "com.amazonaws.sfn#Timestamp": {
+      "type": "timestamp"
+    },
+    "com.amazonaws.sfn#ToleratedFailureCount": {
+      "type": "long",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#ToleratedFailurePercentage": {
+      "type": "float",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0,
+          "max": 100
+        }
+      }
+    },
+    "com.amazonaws.sfn#TooManyTags": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        },
+        "resourceName": {
+          "target": "com.amazonaws.sfn#Arn"
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>You've exceeded the number of tags allowed for a resource. See the <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/limits.html\"> Limits Topic</a> in the\n      Step Functions Developer Guide.</p>",
+        "smithy.api#error": "client",
+        "smithy.api#httpError": 400
+      }
+    },
+    "com.amazonaws.sfn#TraceHeader": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 256
+        },
+        "smithy.api#pattern": "^\\p{ASCII}*$"
+      }
+    },
+    "com.amazonaws.sfn#TracingConfiguration": {
+      "type": "structure",
+      "members": {
+        "enabled": {
+          "target": "com.amazonaws.sfn#Enabled",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>When set to <code>true</code>, X-Ray tracing is enabled.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Selects whether or not the state machine's X-Ray tracing is enabled. Default is\n        <code>false</code>\n         </p>"
+      }
+    },
+    "com.amazonaws.sfn#URL": {
+      "type": "string"
+    },
+    "com.amazonaws.sfn#UnsignedInteger": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#UnsignedLong": {
+      "type": "long",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0
+        }
+      }
+    },
+    "com.amazonaws.sfn#UntagResource": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#UntagResourceInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#UntagResourceOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Remove a tag from a Step Functions resource</p>"
+      }
+    },
+    "com.amazonaws.sfn#UntagResourceInput": {
+      "type": "structure",
+      "members": {
+        "resourceArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) for the Step Functions state machine or activity.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "tagKeys": {
+          "target": "com.amazonaws.sfn#TagKeyList",
+          "traits": {
+            "smithy.api#documentation": "<p>The list of tags to remove from the resource.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#UntagResourceOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#UpdateMapRun": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#UpdateMapRunInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#UpdateMapRunOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Updates an in-progress Map Run's configuration to include changes to the settings that control maximum concurrency and Map Run failure.</p>"
+      }
+    },
+    "com.amazonaws.sfn#UpdateMapRunInput": {
+      "type": "structure",
+      "members": {
+        "mapRunArn": {
+          "target": "com.amazonaws.sfn#LongArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of a Map Run.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "maxConcurrency": {
+          "target": "com.amazonaws.sfn#MaxConcurrency",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum number of child workflow executions that can be specified to run in parallel for the Map Run at the same time.</p>"
+          }
+        },
+        "toleratedFailurePercentage": {
+          "target": "com.amazonaws.sfn#ToleratedFailurePercentage",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum percentage of failed items before the Map Run fails.</p>"
+          }
+        },
+        "toleratedFailureCount": {
+          "target": "com.amazonaws.sfn#ToleratedFailureCount",
+          "traits": {
+            "smithy.api#default": null,
+            "smithy.api#documentation": "<p>The maximum number of failed items before the Map Run fails.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#UpdateMapRunOutput": {
+      "type": "structure",
+      "members": {},
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#UpdateStateMachine": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#UpdateStateMachineInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#UpdateStateMachineOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ConflictException"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidDefinition"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidEncryptionConfiguration"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidLoggingConfiguration"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidTracingConfiguration"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsAccessDeniedException"
+        },
+        {
+          "target": "com.amazonaws.sfn#KmsThrottlingException"
+        },
+        {
+          "target": "com.amazonaws.sfn#MissingRequiredParameter"
+        },
+        {
+          "target": "com.amazonaws.sfn#ServiceQuotaExceededException"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDoesNotExist"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Updates an existing state machine by modifying its <code>definition</code>,\n        <code>roleArn</code>, <code>loggingConfiguration</code>, or <code>EncryptionConfiguration</code>. Running executions will continue\n      to use the previous <code>definition</code> and <code>roleArn</code>. You must include at\n      least one of <code>definition</code> or <code>roleArn</code> or you will receive a\n        <code>MissingRequiredParameter</code> error.</p>\n         <p>A qualified state machine ARN refers to a <i>Distributed Map state</i> defined within a state machine. For example, the qualified state machine ARN <code>arn:partition:states:region:account-id:stateMachine:stateMachineName/mapStateLabel</code> refers to a <i>Distributed Map state</i> with a label <code>mapStateLabel</code> in the state machine named <code>stateMachineName</code>.</p>\n         <p>A qualified state machine ARN can either refer to a <i>Distributed Map state</i> defined within a state machine, a version ARN, or an alias ARN.</p>\n         <p>The following are some examples of qualified and unqualified state machine ARNs:</p>\n         <ul>\n            <li>\n               <p>The following qualified state machine ARN refers to a <i>Distributed Map state</i> with a label <code>mapStateLabel</code> in a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:partition:states:region:account-id:stateMachine:myStateMachine/mapStateLabel</code>\n               </p>\n               <note>\n                  <p>If you provide a qualified state machine ARN that refers to a <i>Distributed Map state</i>, the request fails with <code>ValidationException</code>.</p>\n               </note>\n            </li>\n            <li>\n               <p>The following qualified state machine ARN refers to an alias named <code>PROD</code>.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine:PROD></code>\n               </p>\n               <note>\n                  <p>If you provide a qualified state machine ARN that refers to a version ARN or an alias ARN, the request starts execution for that version or alias.</p>\n               </note>\n            </li>\n            <li>\n               <p>The following unqualified state machine ARN refers to a state machine named <code>myStateMachine</code>.</p>\n               <p>\n                  <code>arn:<partition>:states:<region>:<account-id>:stateMachine:<myStateMachine></code>\n               </p>\n            </li>\n         </ul>\n         <p>After you update your state machine, you can set the <code>publish</code> parameter to\n        <code>true</code> in the same action to publish a new <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html\">version</a>. This\n      way, you can opt-in to strict versioning of your state machine.</p>\n         <note>\n            <p>Step Functions assigns monotonically increasing integers for state machine versions, starting at version number 1.</p>\n         </note>\n         <note>\n            <p>All <code>StartExecution</code> calls within a few seconds use the updated\n          <code>definition</code> and <code>roleArn</code>. Executions started immediately after you\n        call <code>UpdateStateMachine</code> may use the previous state machine\n          <code>definition</code> and <code>roleArn</code>. </p>\n         </note>",
+        "smithy.api#idempotent": {}
+      }
+    },
+    "com.amazonaws.sfn#UpdateStateMachineAlias": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#UpdateStateMachineAliasInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#UpdateStateMachineAliasOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ConflictException"
+        },
+        {
+          "target": "com.amazonaws.sfn#InvalidArn"
+        },
+        {
+          "target": "com.amazonaws.sfn#ResourceNotFound"
+        },
+        {
+          "target": "com.amazonaws.sfn#StateMachineDeleting"
+        },
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Updates the configuration of an existing state machine <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-alias.html\">alias</a> by modifying its <code>description</code> or <code>routingConfiguration</code>.</p>\n         <p>You must specify at least one of the <code>description</code> or <code>routingConfiguration</code> parameters to update a state machine alias.</p>\n         <note>\n            <p>\n               <code>UpdateStateMachineAlias</code> is an idempotent API. Step Functions bases the\n        idempotency check on the <code>stateMachineAliasArn</code>, <code>description</code>, and\n          <code>routingConfiguration</code> parameters. Requests with the same parameters return an\n        idempotent response.</p>\n         </note>\n         <note>\n            <p>This operation is eventually consistent. All <a>StartExecution</a> requests\n        made within a few seconds use the latest alias configuration. Executions started immediately\n        after calling <code>UpdateStateMachineAlias</code> may use the previous routing\n        configuration.</p>\n         </note>\n         <p>\n            <b>Related operations:</b>\n         </p>\n         <ul>\n            <li>\n               <p>\n                  <a>CreateStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DescribeStateMachineAlias</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>ListStateMachineAliases</a>\n               </p>\n            </li>\n            <li>\n               <p>\n                  <a>DeleteStateMachineAlias</a>\n               </p>\n            </li>\n         </ul>"
+      }
+    },
+    "com.amazonaws.sfn#UpdateStateMachineAliasInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineAliasArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine alias.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "description": {
+          "target": "com.amazonaws.sfn#AliasDescription",
+          "traits": {
+            "smithy.api#documentation": "<p>A description of the state machine alias.</p>"
+          }
+        },
+        "routingConfiguration": {
+          "target": "com.amazonaws.sfn#RoutingConfigurationList",
+          "traits": {
+            "smithy.api#documentation": "<p>The routing configuration of the state machine alias.</p>\n         <p>An array of <code>RoutingConfig</code> objects that specifies up to two state machine versions that the alias starts executions for.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#UpdateStateMachineAliasOutput": {
+      "type": "structure",
+      "members": {
+        "updateDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date and time the state machine alias was updated.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#UpdateStateMachineInput": {
+      "type": "structure",
+      "members": {
+        "stateMachineArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "definition": {
+          "target": "com.amazonaws.sfn#Definition",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon States Language definition of the state machine. See <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States Language</a>.</p>"
+          }
+        },
+        "roleArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the IAM role of the state machine.</p>"
+          }
+        },
+        "loggingConfiguration": {
+          "target": "com.amazonaws.sfn#LoggingConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Use the <code>LoggingConfiguration</code> data type to set CloudWatch Logs\n      options.</p>"
+          }
+        },
+        "tracingConfiguration": {
+          "target": "com.amazonaws.sfn#TracingConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Selects whether X-Ray tracing is enabled.</p>"
+          }
+        },
+        "publish": {
+          "target": "com.amazonaws.sfn#Publish",
+          "traits": {
+            "smithy.api#default": false,
+            "smithy.api#documentation": "<p>Specifies whether the state machine version is published. The default is\n        <code>false</code>. To publish a version after updating the state machine, set\n        <code>publish</code> to <code>true</code>.</p>"
+          }
+        },
+        "versionDescription": {
+          "target": "com.amazonaws.sfn#VersionDescription",
+          "traits": {
+            "smithy.api#documentation": "<p>An optional description of the state machine version to publish.</p>\n         <p>You can only specify the <code>versionDescription</code> parameter if you've set <code>publish</code> to <code>true</code>.</p>"
+          }
+        },
+        "encryptionConfiguration": {
+          "target": "com.amazonaws.sfn#EncryptionConfiguration",
+          "traits": {
+            "smithy.api#documentation": "<p>Settings to configure server-side encryption. </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#UpdateStateMachineOutput": {
+      "type": "structure",
+      "members": {
+        "updateDate": {
+          "target": "com.amazonaws.sfn#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>The date and time the state machine was updated.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "revisionId": {
+          "target": "com.amazonaws.sfn#RevisionId",
+          "traits": {
+            "smithy.api#documentation": "<p>The revision identifier for the updated state machine.</p>"
+          }
+        },
+        "stateMachineVersionArn": {
+          "target": "com.amazonaws.sfn#Arn",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the published state machine version.</p>\n         <p>If the <code>publish</code> parameter isn't set to <code>true</code>, this field returns null.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinition": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionInput"
+      },
+      "output": {
+        "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionOutput"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.sfn#ValidationException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Validates the syntax of a state machine definition specified in <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States Language</a> (ASL), a\n            JSON-based, structured language.</p>\n         <p>You can validate that a state machine definition is correct without creating a state\n            machine resource.</p>\n         <p>Suggested uses for <code>ValidateStateMachineDefinition</code>:</p>\n         <ul>\n            <li>\n               <p>Integrate automated checks into your code review or Continuous Integration\n                    (CI) process to check state machine definitions before starting\n                    deployments.</p>\n            </li>\n            <li>\n               <p>Run validation from a Git pre-commit hook to verify the definition before\n                    committing to your source repository.</p>\n            </li>\n         </ul>\n         <p>Validation will look for problems in your state machine definition and return a\n            <b>result</b> and a list of <b>diagnostic\n            elements</b>.</p>\n         <p>The <b>result</b>  value will be <code>OK</code> when your\n            workflow definition can be successfully created or updated. Note the result can be\n            <code>OK</code> even when diagnostic warnings are present in the response. The\n            <b>result</b> value will be <code>FAIL</code> when the\n            workflow definition contains errors that would prevent you from creating or updating\n            your state machine. </p>\n         <p>The list of <a href=\"https://docs.aws.amazon.com/step-functions/latest/apireference/API_ValidateStateMachineDefinitionDiagnostic.html\">ValidateStateMachineDefinitionDiagnostic</a> data elements can contain zero or more <b>WARNING</b> and/or <b>ERROR</b> elements.</p>\n         <note>\n            <p>The <b>ValidateStateMachineDefinition API</b> might add\n                new diagnostics in the future, adjust diagnostic codes, or change the message\n                wording. Your automated processes should only rely on the value of the <b>result</b> field value (OK, FAIL). Do <b>not</b> rely on the exact order, count, or\n                wording of diagnostic messages.</p>\n         </note>"
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionCode": {
+      "type": "string",
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionDiagnostic": {
+      "type": "structure",
+      "members": {
+        "severity": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionSeverity",
+          "traits": {
+            "smithy.api#documentation": "<p>A value of <code>ERROR</code> means that you cannot create or update a state machine with this definition.</p>\n         <p>\n            <code>WARNING</code> level diagnostics alert you to potential issues, but they will not prevent you from creating or updating your state machine.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "code": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionCode",
+          "traits": {
+            "smithy.api#documentation": "<p>Identifying code for the diagnostic.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "message": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionMessage",
+          "traits": {
+            "smithy.api#documentation": "<p>Message describing the diagnostic condition.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "location": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionLocation",
+          "traits": {
+            "smithy.api#documentation": "<p>Location of the issue in the state machine, if available.</p>\n         <p>For errors specific to a field, the location could be in the format: <code>/States/<StateName>/<FieldName></code>, for example: <code>/States/FailState/ErrorPath</code>.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Describes potential issues found during state machine validation. Rather than raise an\n            exception, validation will return a list of <b>diagnostic\n            elements</b> containing diagnostic information. </p>\n         <note>\n            <p>The <a href=\"https://docs.aws.amazon.com/step-functions/latest/apireference/API_ValidateStateMachineDefinition.html\">ValidateStateMachineDefinitionlAPI</a> might add\n                new diagnostics in the future, adjust diagnostic codes, or change the message\n                wording. Your automated processes should only rely on the value of the <b>result</b> field value (OK, FAIL). Do <b>not</b> rely on the exact order, count, or\n                wording of diagnostic messages.</p>\n         </note>\n         <p>\n            <b>List of warning codes</b>\n         </p>\n         <dl>\n            <dt>NO_DOLLAR</dt>\n            <dd>\n               <p>No <code>.$</code> on a field that appears to be a JSONPath or Intrinsic Function.</p>\n            </dd>\n            <dt>NO_PATH</dt>\n            <dd>\n               <p>Field value looks like a path, but field name does not end with 'Path'.</p>\n            </dd>\n            <dt>PASS_RESULT_IS_STATIC</dt>\n            <dd>\n               <p>Attempt to use a path in the result of a pass state.</p>\n            </dd>\n         </dl>\n         <p>\n            <b>List of error codes</b>\n         </p>\n         <dl>\n            <dt>INVALID_JSON_DESCRIPTION</dt>\n            <dd>\n               <p>JSON syntax problem found.</p>\n            </dd>\n            <dt>MISSING_DESCRIPTION</dt>\n            <dd>\n               <p>Received a null or empty workflow input.</p>\n            </dd>\n            <dt>SCHEMA_VALIDATION_FAILED</dt>\n            <dd>\n               <p>Schema validation reported errors.</p>\n            </dd>\n            <dt>INVALID_RESOURCE</dt>\n            <dd>\n               <p>The value of a Task-state resource field is invalid.</p>\n            </dd>\n            <dt>MISSING_END_STATE</dt>\n            <dd>\n               <p>The workflow does not have a terminal state.</p>\n            </dd>\n            <dt>DUPLICATE_STATE_NAME</dt>\n            <dd>\n               <p>The same state name appears more than once.</p>\n            </dd>\n            <dt>INVALID_STATE_NAME</dt>\n            <dd>\n               <p>The state name does not follow the naming convention.</p>\n            </dd>\n            <dt>STATE_MACHINE_NAME_EMPTY</dt>\n            <dd>\n               <p>The state machine name has not been specified.</p>\n            </dd>\n            <dt>STATE_MACHINE_NAME_INVALID</dt>\n            <dd>\n               <p>The state machine name does not follow the naming convention.</p>\n            </dd>\n            <dt>STATE_MACHINE_NAME_TOO_LONG</dt>\n            <dd>\n               <p>The state name exceeds the allowed length.</p>\n            </dd>\n            <dt>STATE_MACHINE_NAME_ALREADY_EXISTS</dt>\n            <dd>\n               <p>The state name already exists.</p>\n            </dd>\n            <dt>DUPLICATE_LABEL_NAME</dt>\n            <dd>\n               <p>A label name appears more than once.</p>\n            </dd>\n            <dt>INVALID_LABEL_NAME</dt>\n            <dd>\n               <p>You have provided an invalid label name.</p>\n            </dd>\n            <dt>MISSING_TRANSITION_TARGET</dt>\n            <dd>\n               <p>The value of \"Next\" field doesn't match a known state name.</p>\n            </dd>\n            <dt>TOO_DEEPLY_NESTED</dt>\n            <dd>\n               <p>The states are too deeply nested.</p>\n            </dd>\n         </dl>"
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionDiagnosticList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionDiagnostic"
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionInput": {
+      "type": "structure",
+      "members": {
+        "definition": {
+          "target": "com.amazonaws.sfn#Definition",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon States Language definition of the state machine. For more information, see\n            <a href=\"https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html\">Amazon States Language</a> (ASL).</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "type": {
+          "target": "com.amazonaws.sfn#StateMachineType",
+          "traits": {
+            "smithy.api#documentation": "<p>The target type of state machine for this definition. The default is <code>STANDARD</code>.</p>"
+          }
+        },
+        "severity": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionSeverity",
+          "traits": {
+            "smithy.api#documentation": "<p>Minimum level of diagnostics to return. <code>ERROR</code> returns only <code>ERROR</code> diagnostics, whereas <code>WARNING</code> returns both <code>WARNING</code> and <code>ERROR</code> diagnostics. The default is <code>ERROR</code>. </p>"
+          }
+        },
+        "maxResults": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionMaxResult",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p>The maximum number of diagnostics that are returned per call. The default and maximum value is 100. Setting the value to 0 will also use the default of 100.</p>\n         <p>If the number of diagnostics returned in the response exceeds <code>maxResults</code>, the value of the <code>truncated</code> field in the response will be set to <code>true</code>.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionLocation": {
+      "type": "string",
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionMaxResult": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0,
+          "max": 100
+        }
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionMessage": {
+      "type": "string",
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionOutput": {
+      "type": "structure",
+      "members": {
+        "result": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionResultCode",
+          "traits": {
+            "smithy.api#documentation": "<p>The result value will be <code>OK</code> when no syntax errors are found, or\n                <code>FAIL</code> if the workflow definition does not pass verification.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "diagnostics": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionDiagnosticList",
+          "traits": {
+            "smithy.api#documentation": "<p>An array of diagnostic errors and warnings found during validation of the state machine definition. Since <b>warnings</b> do not prevent deploying your workflow definition, the <b>result</b> value could be <code>OK</code> even when warning diagnostics are present in the response.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "truncated": {
+          "target": "com.amazonaws.sfn#ValidateStateMachineDefinitionTruncated",
+          "traits": {
+            "smithy.api#documentation": "<p>The result value will be <code>true</code> if the number of diagnostics found in the workflow definition exceeds <code>maxResults</code>. When all diagnostics results are returned, the value will be <code>false</code>.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionResultCode": {
+      "type": "enum",
+      "members": {
+        "OK": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "OK"
+          }
+        },
+        "FAIL": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "FAIL"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionSeverity": {
+      "type": "enum",
+      "members": {
+        "ERROR": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ERROR"
+          }
+        },
+        "WARNING": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "WARNING"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#ValidateStateMachineDefinitionTruncated": {
+      "type": "boolean"
+    },
+    "com.amazonaws.sfn#ValidationException": {
+      "type": "structure",
+      "members": {
+        "message": {
+          "target": "com.amazonaws.sfn#ErrorMessage"
+        },
+        "reason": {
+          "target": "com.amazonaws.sfn#ValidationExceptionReason",
+          "traits": {
+            "smithy.api#documentation": "<p>The input does not satisfy the constraints specified by an Amazon Web Services service.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>The input does not satisfy the constraints specified by an Amazon Web Services service.</p>",
+        "smithy.api#error": "client",
+        "smithy.api#httpError": 400
+      }
+    },
+    "com.amazonaws.sfn#ValidationExceptionReason": {
+      "type": "enum",
+      "members": {
+        "API_DOES_NOT_SUPPORT_LABELED_ARNS": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "API_DOES_NOT_SUPPORT_LABELED_ARNS"
+          }
+        },
+        "MISSING_REQUIRED_PARAMETER": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "MISSING_REQUIRED_PARAMETER"
+          }
+        },
+        "CANNOT_UPDATE_COMPLETED_MAP_RUN": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "CANNOT_UPDATE_COMPLETED_MAP_RUN"
+          }
+        },
+        "INVALID_ROUTING_CONFIGURATION": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "INVALID_ROUTING_CONFIGURATION"
+          }
+        }
+      }
+    },
+    "com.amazonaws.sfn#VariableName": {
+      "type": "string",
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#VariableNameList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.sfn#VariableName"
+      }
+    },
+    "com.amazonaws.sfn#VariableReferences": {
+      "type": "map",
+      "key": {
+        "target": "com.amazonaws.sfn#StateName"
+      },
+      "value": {
+        "target": "com.amazonaws.sfn#VariableNameList"
+      },
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#VariableValue": {
+      "type": "string",
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#VersionDescription": {
+      "type": "string",
+      "traits": {
+        "smithy.api#length": {
+          "min": 0,
+          "max": 256
+        },
+        "smithy.api#sensitive": {}
+      }
+    },
+    "com.amazonaws.sfn#VersionWeight": {
+      "type": "integer",
+      "traits": {
+        "smithy.api#default": 0,
+        "smithy.api#range": {
+          "min": 0,
+          "max": 100
+        }
+      }
+    },
+    "com.amazonaws.sfn#includedDetails": {
+      "type": "boolean",
+      "traits": {
+        "smithy.api#default": false
+      }
+    },
+    "com.amazonaws.sfn#truncated": {
+      "type": "boolean",
+      "traits": {
+        "smithy.api#default": false
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/codegen/smithy-model/stepfunctions.provenance.json b/codegen/smithy-model/stepfunctions.provenance.json
new file mode 100644
index 00000000..e677fca5
--- /dev/null
+++ b/codegen/smithy-model/stepfunctions.provenance.json
@@ -0,0 +1,10 @@
+{
+  "repository": "https://github.com/aws/api-models-aws",
+  "commit": "18e485ce1c8dbf29d47e5ce00d9b8513da95912c",
+  "path": "models/sfn/service/2016-11-23/sfn-2016-11-23.json",
+  "sha256": "38dd64c074f5c05320978970dafa6e0f199ab2e33b6065232002e8a603c5f6ed",
+  "service": "com.amazonaws.sfn#AWSStepFunctions",
+  "serviceVersion": "2016-11-23",
+  "retrievedAt": "2026-10-25",
+  "bytes": 370185
+}
diff --git a/codegen/src/codegen.rs b/codegen/src/codegen.rs
index 0331563c..824df942 100644
--- a/codegen/src/codegen.rs
+++ b/codegen/src/codegen.rs
@@ -3,15 +3,15 @@
 //! This module takes a `ResolvedModel` and produces Rust source code strings
 //! for types, input/output structs, operations, errors, and request types.
 
-use std::collections::BTreeMap;
-use std::fmt::Write;
-
-use anyhow::Result;
+use std::{collections::BTreeMap, fmt::Write};
 
+use anyhow::{Result, bail};
 use heck::{ToLowerCamelCase, ToPascalCase};
 
-use crate::config::ServiceConfig;
-use crate::shapes::{EnumVariantInfo, FieldInfo, HttpBinding, OperationCategories, ResolvedModel};
+use crate::{
+    config::{Protocol, ServiceConfig},
+    shapes::{EnumVariantInfo, FieldInfo, HttpBinding, OperationCategories, ResolvedModel},
+};
 
 /// Header comment placed at the top of every generated file.
 fn file_header(config: &ServiceConfig) -> String {
@@ -21,12 +21,39 @@ fn file_header(config: &ServiceConfig) -> String {
     )
 }
 
+fn json_epoch_protocol(config: &ServiceConfig) -> bool {
+    matches!(config.protocol, Protocol::AwsJson1_0 | Protocol::AwsJson1_1)
+}
+fn epoch_field(field: &FieldInfo, config: &ServiceConfig) -> bool {
+    json_epoch_protocol(config)
+        && field
+            .timestamp_format
+            .as_deref()
+            .is_some_and(|format| matches!(format, "" | "epoch-seconds"))
+}
+fn needs_epoch_module(resolved: &ResolvedModel, config: &ServiceConfig) -> bool {
+    config.uses_serde()
+        && resolved
+            .input_structs
+            .values()
+            .chain(resolved.output_structs.values())
+            .chain(resolved.shared_structs.values())
+            .flatten()
+            .any(|field| epoch_field(field, config))
+}
+
 /// Generate all source files and return them as a map of path -> content.
 pub fn generate_all(
     resolved: &ResolvedModel,
     config: &ServiceConfig,
 ) -> Result<BTreeMap<String, String>> {
     let mut files = BTreeMap::new();
+    if needs_epoch_module(resolved, config) {
+        files.insert(
+            "epoch_seconds.rs".to_owned(),
+            include_str!("../templates/epoch_seconds.rs").to_owned(),
+        );
+    }
 
     files.insert("types.rs".to_owned(), generate_types(resolved, config)?);
     files.insert("operations.rs".to_owned(), generate_operations(config)?);
@@ -113,7 +140,7 @@ fn generate_types(resolved: &ResolvedModel, config: &ServiceConfig) -> Result<St
 
     // Generate enums
     for (name, variants) in &resolved.enums {
-        write_enum(&mut out, name, variants, display_name)?;
+        write_enum(&mut out, name, variants, display_name, config)?;
     }
 
     // Generate shared structs
@@ -130,8 +157,9 @@ fn write_enum(
     name: &str,
     variants: &[EnumVariantInfo],
     display_name: &str,
+    config: &ServiceConfig,
 ) -> Result<()> {
-    writeln!(out, "/// {display_name} {name} enum.")?;
+    writeln!(out, "/// {display_name} `{name}` enum.")?;
     writeln!(
         out,
         "#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]"
@@ -139,8 +167,12 @@ fn write_enum(
     writeln!(out, "pub enum {name} {{")?;
 
     for (i, variant) in variants.iter().enumerate() {
-        if i == 0 {
+        if config.strict_model {
+            writeln!(out, "    /// The `{}` wire variant.", variant.string_value)?;
+        } else if i == 0 {
             writeln!(out, "    /// Default variant.")?;
+        }
+        if i == 0 {
             writeln!(out, "    #[default]")?;
         }
         if variant.rust_name != variant.string_value {
@@ -229,23 +261,41 @@ fn write_struct(
     display_name: &str,
     config: &ServiceConfig,
 ) -> Result<()> {
-    writeln!(out, "/// {display_name} {name}.")?;
+    writeln!(out, "/// {display_name} `{name}`.")?;
 
     if config.uses_serde() {
-        writeln!(
-            out,
-            "#[derive(Debug, Clone, Default, Serialize, Deserialize)]"
-        )?;
+        if config.strict_model {
+            writeln!(out, "#[derive(Clone, Default, Serialize, Deserialize)]")?;
+        } else {
+            writeln!(
+                out,
+                "#[derive(Debug, Clone, Default, Serialize, Deserialize)]"
+            )?;
+        }
         if let Some(ref rename) = config.serde_rename {
             writeln!(out, "#[serde(rename_all = \"{rename}\")]")?;
         }
+    } else if config.strict_model {
+        writeln!(out, "#[derive(Clone, Default)]")?;
     } else {
         writeln!(out, "#[derive(Debug, Clone, Default)]")?;
     }
 
+    if config.strict_model {
+        writeln!(out, "#[non_exhaustive]")?;
+        if config.uses_serde() {
+            writeln!(out, "#[serde(deny_unknown_fields)]")?;
+        }
+        if fields.len() > 5 {
+            writeln!(out, "#[derive(typed_builder::TypedBuilder)]")?;
+        }
+    }
     writeln!(out, "pub struct {name} {{")?;
 
     for field in fields {
+        if config.strict_model {
+            writeln!(out, "    /// The `{}` wire member.", field.smithy_name)?;
+        }
         // Write HTTP binding comment if requested
         if include_http_comments && let Some(ref binding) = field.http_binding {
             let comment = match binding {
@@ -260,8 +310,35 @@ fn write_struct(
             writeln!(out, "{comment}")?;
         }
 
+        if config.strict_model && fields.len() > 5 && !field.required {
+            writeln!(out, "    #[builder(default)]")?;
+        }
         // Write serde field attributes when serde is enabled
         if config.uses_serde() {
+            if json_epoch_protocol(config) {
+                match field.timestamp_format.as_deref() {
+                    Some("" | "epoch-seconds") => {
+                        if field.rust_type.starts_with("Option<") {
+                            writeln!(
+                                out,
+                                "    #[serde(default, with = \"crate::epoch_seconds::option\")]"
+                            )?;
+                        } else {
+                            writeln!(out, "    #[serde(with = \"crate::epoch_seconds\")]")?;
+                        }
+                    }
+                    Some("date-time") => {}
+                    Some(_) => bail!(
+                        "unsupported JSON timestamp format for {}",
+                        field.smithy_name
+                    ),
+                    None if field.rust_type.contains("chrono::DateTime") => bail!(
+                        "timestamp collection requires an explicit adapter: {}",
+                        field.smithy_name
+                    ),
+                    None => {}
+                }
+            }
             // Explicit rename if rename_all would not produce the correct Smithy name
             if let Some(ref strategy) = config.serde_rename
                 && needs_explicit_rename(&field.rust_name, &field.smithy_name, strategy)
@@ -274,6 +351,11 @@ fn write_struct(
                     out,
                     "    #[serde(skip_serializing_if = \"Option::is_none\")]"
                 )?;
+            } else if config.strict_model
+                && field.required
+                && (field.rust_type.starts_with("Vec<") || field.rust_type.starts_with("HashMap<"))
+            {
+                // Required collections must be present, including when empty.
             } else if field.rust_type.starts_with("Vec<") {
                 if config.always_serialize_arrays {
                     writeln!(out, "    #[serde(default)]")?;
@@ -296,6 +378,18 @@ fn write_struct(
 
     writeln!(out, "}}")?;
     writeln!(out)?;
+    if config.strict_model {
+        writeln!(out, "impl std::fmt::Debug for {name} {{")?;
+        writeln!(
+            out,
+            "    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {{"
+        )?;
+        writeln!(
+            out,
+            "        f.debug_struct(\"{name}\").finish_non_exhaustive()"
+        )?;
+        writeln!(out, "    }}\n}}")?;
+    }
     Ok(())
 }
 
@@ -549,12 +643,12 @@ fn generate_operations(config: &ServiceConfig) -> Result<String> {
     writeln!(out, "{header}")?;
     writeln!(out)?;
 
-    writeln!(out, "/// All supported {prefix} operations.")?;
+    writeln!(out, "/// All supported `{prefix}Operation` values.")?;
     writeln!(out, "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]")?;
     writeln!(out, "pub enum {prefix}Operation {{")?;
 
     for op in all_operations {
-        writeln!(out, "    /// The {op} operation.")?;
+        writeln!(out, "    /// The `{op}` operation.")?;
         writeln!(out, "    {op},")?;
     }
 
@@ -577,7 +671,7 @@ fn generate_operations(config: &ServiceConfig) -> Result<String> {
     // Generate from_str
     writeln!(
         out,
-        "    /// Parse an operation name string into an {prefix}Operation."
+        "    /// Parse an operation name string into a `{prefix}Operation`."
     )?;
     writeln!(out, "    #[must_use]")?;
     writeln!(out, "    pub fn from_name(name: &str) -> Option<Self> {{")?;
@@ -668,7 +762,7 @@ fn generate_error_json(resolved: &ResolvedModel, config: &ServiceConfig) -> Resu
     }
 
     for err in errors {
-        writeln!(out, "    /// {} error.", err.name)?;
+        writeln!(out, "    /// `{}` error.", err.name)?;
         if err.name == default_name {
             writeln!(out, "    #[default]")?;
         }
@@ -746,9 +840,35 @@ fn generate_error_json(resolved: &ResolvedModel, config: &ServiceConfig) -> Resu
     writeln!(out, "}}")?;
     writeln!(out)?;
 
+    if config.strict_model {
+        writeln!(out, "impl {prefix}ErrorCode {{")?;
+        writeln!(out, "    /// Default bounded protocol message.")?;
+        writeln!(out, "    #[must_use]")?;
+        writeln!(out, "    pub fn default_message(&self) -> &'static str {{")?;
+        writeln!(out, "        match self {{")?;
+        for error in errors {
+            let message = config
+                .custom_errors
+                .get(&error.name)
+                .map_or(error.wire_name.as_str(), |custom| custom.message.as_str());
+            writeln!(out, "            Self::{} => {message:?},", error.name)?;
+        }
+        if errors.is_empty() {
+            writeln!(
+                out,
+                "            Self::InternalException => \"InternalException\","
+            )?;
+        }
+        writeln!(out, "        }}\n    }}\n}}")?;
+    }
+
     // Error struct (no resource/request_id for JSON services)
     writeln!(out, "/// An {display_name} error response.")?;
-    writeln!(out, "#[derive(Debug)]")?;
+    if config.strict_model {
+        writeln!(out, "#[non_exhaustive]")?;
+    } else {
+        writeln!(out, "#[derive(Debug)]")?;
+    }
     writeln!(out, "pub struct {prefix}Error {{")?;
     writeln!(out, "    /// The error code.")?;
     writeln!(out, "    pub code: {prefix}ErrorCode,")?;
@@ -764,16 +884,29 @@ fn generate_error_json(resolved: &ResolvedModel, config: &ServiceConfig) -> Resu
     writeln!(out, "}}")?;
     writeln!(out)?;
 
+    if config.strict_model {
+        writeln!(out, "impl fmt::Debug for {prefix}Error {{")?;
+        writeln!(
+            out,
+            "    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {{"
+        )?;
+        writeln!(out, "        f.write_str(\"{prefix}Error(<redacted>)\")")?;
+        writeln!(out, "    }}\n}}")?;
+    }
     // Display impl
     writeln!(out, "impl fmt::Display for {prefix}Error {{")?;
     writeln!(
         out,
         "    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {{"
     )?;
-    writeln!(
-        out,
-        "        write!(f, \"{prefix}Error({{}}): {{}}\", self.code, self.message)"
-    )?;
+    if config.strict_model {
+        writeln!(out, "        f.write_str(\"{prefix}Error(<redacted>)\")")?;
+    } else {
+        writeln!(
+            out,
+            "        write!(f, \"{prefix}Error({{}}): {{}}\", self.code, self.message)"
+        )?;
+    }
     writeln!(out, "    }}")?;
     writeln!(out, "}}")?;
     writeln!(out)?;
@@ -802,7 +935,14 @@ fn generate_error_json(resolved: &ResolvedModel, config: &ServiceConfig) -> Resu
     writeln!(out, "    pub fn new(code: {prefix}ErrorCode) -> Self {{")?;
     writeln!(out, "        Self {{")?;
     writeln!(out, "            status_code: code.default_status_code(),")?;
-    writeln!(out, "            message: code.as_str().to_owned(),")?;
+    if config.strict_model {
+        writeln!(
+            out,
+            "            message: code.default_message().to_owned(),"
+        )?;
+    } else {
+        writeln!(out, "            message: code.as_str().to_owned(),")?;
+    }
     writeln!(out, "            code,")?;
     writeln!(out, "            source: None,")?;
     writeln!(out, "        }}")?;
@@ -838,8 +978,8 @@ fn generate_error_json(resolved: &ResolvedModel, config: &ServiceConfig) -> Resu
     writeln!(out)?;
 
     // Convenience constructors for common errors
-    // Generate validation(), internal_error(), missing_action(), unknown_operation(), not_implemented()
-    // based on which errors are present
+    // Generate validation(), internal_error(), missing_action(), unknown_operation(),
+    // not_implemented() based on which errors are present
 
     let has_error = |name: &str| errors.iter().any(|e| e.name == name);
 
@@ -936,7 +1076,15 @@ fn generate_error_json(resolved: &ResolvedModel, config: &ServiceConfig) -> Resu
     writeln!(out, "///")?;
     writeln!(out, "/// # Examples")?;
     writeln!(out, "///")?;
-    writeln!(out, "/// ```ignore")?;
+    if config.strict_model {
+        writeln!(out, "/// ```")?;
+        writeln!(
+            out,
+            "/// use rustack_{name}_model::{{{name}_error, {prefix}ErrorCode}};"
+        )?;
+    } else {
+        writeln!(out, "/// ```ignore")?;
+    }
     writeln!(out, "/// let err = {name}_error!({default_name});")?;
     writeln!(
         out,
@@ -966,6 +1114,8 @@ fn generate_error_json(resolved: &ResolvedModel, config: &ServiceConfig) -> Resu
 fn status_code_const(status: u16) -> &'static str {
     match status {
         400 => "http::StatusCode::BAD_REQUEST",
+        402 => "http::StatusCode::PAYMENT_REQUIRED",
+        408 => "http::StatusCode::REQUEST_TIMEOUT",
         401 => "http::StatusCode::UNAUTHORIZED",
         403 => "http::StatusCode::FORBIDDEN",
         404 => "http::StatusCode::NOT_FOUND",
@@ -1385,7 +1535,8 @@ fn generate_error_s3(config: &ServiceConfig) -> Result<String> {
     writeln!(out, "    #[must_use]")?;
     writeln!(
         out,
-        "    pub fn with_source(mut self, source: impl std::error::Error + Send + Sync + 'static) -> Self {{"
+        "    pub fn with_source(mut self, source: impl std::error::Error + Send + Sync + 'static) \
+         -> Self {{"
     )?;
     writeln!(out, "        self.source = Some(Box::new(source));")?;
     writeln!(out, "        self")?;
@@ -1601,7 +1752,8 @@ fn generate_request(config: &ServiceConfig) -> Result<String> {
     )?;
     writeln!(
         out,
-        "            .field(\"session_token\", &self.session_token.as_ref().map(|_| \"[REDACTED]\"))"
+        "            .field(\"session_token\", &self.session_token.as_ref().map(|_| \
+         \"[REDACTED]\"))"
     )?;
     writeln!(out, "            .finish()")?;
     writeln!(out, "    }}")?;
@@ -1684,9 +1836,16 @@ fn generate_lib(resolved: &ResolvedModel, config: &ServiceConfig) -> Result<Stri
 
     let mut out = String::with_capacity(2048);
     writeln!(out, "{header}")?;
-    writeln!(out, "#![allow(clippy::too_many_lines)]")?;
-    writeln!(out, "#![allow(clippy::struct_excessive_bools)]")?;
-    writeln!(out, "#![allow(missing_docs)]")?;
+    if config.strict_model {
+        writeln!(out, "#![forbid(unsafe_code)]")?;
+    } else {
+        writeln!(out, "#![allow(clippy::too_many_lines)]")?;
+        writeln!(out, "#![allow(clippy::struct_excessive_bools)]")?;
+        writeln!(out, "#![allow(missing_docs)]")?;
+    }
+    if needs_epoch_module(resolved, config) {
+        writeln!(out, "pub(crate) mod epoch_seconds;")?;
+    }
     writeln!(out)?;
 
     writeln!(out, "pub mod error;")?;
@@ -1697,6 +1856,30 @@ fn generate_lib(resolved: &ResolvedModel, config: &ServiceConfig) -> Result<Stri
         writeln!(out, "pub mod request;")?;
     }
     writeln!(out, "pub mod types;")?;
+    for module in &config.overlay_extra_modules {
+        if module.is_empty()
+            || !module
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'_')
+        {
+            bail!("invalid extra module identifier");
+        }
+        writeln!(out, "pub mod {module};")?;
+    }
+    if let Some(prefix) = &config.target_prefix {
+        writeln!(out, "/// JSON protocol target prefix.")?;
+        writeln!(out, "pub const TARGET_PREFIX: &str = {prefix:?};")?;
+    }
+    writeln!(
+        out,
+        "/// Whether the service config requests AWS Query-compatible errors."
+    )?;
+    writeln!(
+        out,
+        "pub const AWS_QUERY_COMPATIBLE: bool = {};",
+        config.aws_query_compatible
+    )?;
+
     writeln!(out)?;
 
     // Re-exports
@@ -1719,7 +1902,8 @@ fn generate_lib(resolved: &ResolvedModel, config: &ServiceConfig) -> Result<Stri
 
     writeln!(
         out,
-        "// Generated: {n_ops} operations, {n_enums} enums, {n_shared} shared structs, {n_inputs} input structs, {n_outputs} output structs"
+        "// Generated: {n_ops} operations, {n_enums} enums, {n_shared} shared structs, {n_inputs} \
+         input structs, {n_outputs} output structs"
     )?;
 
     Ok(out)
diff --git a/codegen/src/config.rs b/codegen/src/config.rs
index 458f877b..9403d7a2 100644
--- a/codegen/src/config.rs
+++ b/codegen/src/config.rs
@@ -126,6 +126,9 @@ pub struct OutputSection {
     /// Whether to always serialize arrays (even when empty).
     #[serde(default)]
     pub always_serialize_arrays: bool,
+    /// Opt-in strict public model generation without blanket lint suppressions.
+    #[serde(default)]
+    pub strict_model: bool,
 }
 
 /// Overlay settings for preserving manual code.
@@ -164,6 +167,10 @@ pub struct ServiceConfig {
     pub namespace: String,
     /// Protocol variant.
     pub protocol: Protocol,
+    /// JSON target prefix copied from protocol configuration.
+    pub target_prefix: Option<String>,
+    /// Whether AWS Query-compatible errors are configured.
+    pub aws_query_compatible: bool,
     /// Serde rename strategy (None means no rename).
     pub serde_rename: Option<String>,
     /// Whether to emit HTTP binding comments.
@@ -174,8 +181,6 @@ pub struct ServiceConfig {
     pub emit_request_wrapper: bool,
     /// Ordered list of all operations to generate.
     pub all_operations: Vec<String>,
-    /// Map from operation name to phase number.
-    pub operation_phases: BTreeMap<String, usize>,
     /// Operation categories for file organization (if categorized layout).
     pub categories: Option<BTreeMap<String, Vec<String>>>,
     /// File layout strategy.
@@ -188,6 +193,8 @@ pub struct ServiceConfig {
     pub overlay_extra_modules: Vec<String>,
     /// Whether to always serialize arrays.
     pub always_serialize_arrays: bool,
+    /// Opt-in strict public model generation.
+    pub strict_model: bool,
 }
 
 /// Supported protocol variants.
@@ -217,6 +224,9 @@ impl ServiceConfig {
             other => bail!("Unknown protocol: {other}"),
         };
 
+        if config.protocol.error_type_format.is_some() || config.output.dir.is_some() {
+            bail!("custom error formats and output.dir are unsupported; use --output");
+        }
         let serde_rename = match config.protocol.serde_rename.as_str() {
             "none" | "" => None,
             s => Some(s.to_owned()),
@@ -225,22 +235,20 @@ impl ServiceConfig {
         // Build all_operations list.
         // Priority: explicit `all` list > phases > categories
         let mut all_operations = Vec::new();
-        let mut operation_phases = BTreeMap::new();
 
         if !config.operations.all.is_empty() {
             // Use the explicit ordered list
             all_operations = config.operations.all.clone();
         } else {
             // Build from phases
-            for (phase_num, phase_ops) in [
-                (0, &config.operations.phase0),
-                (1, &config.operations.phase1),
-                (2, &config.operations.phase2),
-                (3, &config.operations.phase3),
+            for phase_ops in [
+                &config.operations.phase0,
+                &config.operations.phase1,
+                &config.operations.phase2,
+                &config.operations.phase3,
             ] {
                 for op in phase_ops {
                     all_operations.push(op.clone());
-                    operation_phases.insert(op.clone(), phase_num);
                 }
             }
 
@@ -269,18 +277,20 @@ impl ServiceConfig {
             rust_prefix: config.service.rust_prefix,
             namespace: config.service.namespace,
             protocol,
+            target_prefix: config.protocol.target_prefix,
+            aws_query_compatible: config.protocol.aws_query_compatible,
             serde_rename,
             emit_http_bindings: config.protocol.emit_http_bindings,
             emit_serde_derives: config.protocol.emit_serde_derives,
             emit_request_wrapper: config.protocol.emit_request_wrapper,
             all_operations,
-            operation_phases,
             categories,
             file_layout: config.output.file_layout,
             custom_errors: config.errors.custom,
             overlay_preserve: config.overlay.preserve,
             overlay_extra_modules: config.overlay.extra_modules,
             always_serialize_arrays: config.output.always_serialize_arrays,
+            strict_model: config.output.strict_model,
         })
     }
 
diff --git a/codegen/src/main.rs b/codegen/src/main.rs
index 61bbf7b2..6d28bece 100644
--- a/codegen/src/main.rs
+++ b/codegen/src/main.rs
@@ -3,20 +3,43 @@
 //! Reads an AWS Smithy JSON AST model and generates Rust source files
 //! based on a TOML service configuration.
 
+#![forbid(unsafe_code)]
+
 mod codegen;
 mod config;
 mod model;
 mod shapes;
+#[cfg(test)]
+mod tests;
 
-use std::fs;
-use std::path::{Path, PathBuf};
+use std::{
+    path::{Path, PathBuf},
+    time::Duration,
+};
 
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, ensure};
+use tokio::{fs, io::AsyncReadExt, time::timeout};
 
 use crate::config::{ServiceConfig, ServiceConfigFile};
 
-fn main() -> Result<()> {
-    let args: Vec<String> = std::env::args().collect();
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> Result<()> {
+    timeout(Duration::from_secs(60), generate())
+        .await
+        .context("Code generation deadline exceeded")?
+}
+
+async fn generate() -> Result<()> {
+    let args: Vec<String> = std::env::args_os()
+        .map(|arg| {
+            arg.into_string()
+                .map_err(|_| anyhow::anyhow!("Arguments must be UTF-8"))
+        })
+        .collect::<Result<_>>()?;
+    ensure!(
+        args.len() <= 16 && args.iter().all(|arg| arg.len() <= 4096),
+        "Argument budget exceeded"
+    );
 
     // Parse named arguments: --config, --model, --output
     let config_path = find_arg(&args, "--config");
@@ -34,7 +57,8 @@ fn main() -> Result<()> {
     );
 
     // Read and parse the TOML config
-    let config_toml = fs::read_to_string(&config_path)
+    let config_toml = read_utf8(&config_path, 1024 * 1024)
+        .await
         .with_context(|| format!("Failed to read config file: {}", config_path.display()))?;
     let config_file: ServiceConfigFile =
         toml::from_str(&config_toml).context("Failed to parse TOML config")?;
@@ -65,7 +89,8 @@ fn main() -> Result<()> {
     eprintln!("Writing output to: {}", output_dir.display());
 
     // Read and parse the Smithy JSON model.
-    let model_json = fs::read_to_string(&model_path)
+    let model_json = read_utf8(&model_path, 16 * 1024 * 1024)
+        .await
         .with_context(|| format!("Failed to read model file: {}", model_path.display()))?;
 
     let smithy_model: model::SmithyModel =
@@ -73,6 +98,8 @@ fn main() -> Result<()> {
 
     eprintln!("Parsed model: {} shapes", smithy_model.shapes.len());
 
+    ensure!(smithy_model.smithy == "2.0", "Unsupported Smithy version");
+
     // Resolve shapes and types.
     let resolved = shapes::resolve_model(&smithy_model, &service_config)
         .context("Failed to resolve model shapes")?;
@@ -93,8 +120,12 @@ fn main() -> Result<()> {
     // Write output files.
     for (rel_path, content) in &files {
         let full_path = output_dir.join(rel_path);
-        ensure_parent_dir(&full_path)?;
+        if service_config.overlay_preserve.contains(rel_path) && fs::try_exists(&full_path).await? {
+            continue;
+        }
+        ensure_parent_dir(&full_path).await?;
         fs::write(&full_path, content)
+            .await
             .with_context(|| format!("Failed to write {}", full_path.display()))?;
         eprintln!("  Wrote: {}", full_path.display());
     }
@@ -113,10 +144,27 @@ fn find_arg(args: &[String], flag: &str) -> Option<String> {
 }
 
 /// Ensure the parent directory of a path exists.
-fn ensure_parent_dir(path: &Path) -> Result<()> {
+async fn ensure_parent_dir(path: &Path) -> Result<()> {
     if let Some(parent) = path.parent() {
         fs::create_dir_all(parent)
+            .await
             .with_context(|| format!("Failed to create directory: {}", parent.display()))?;
     }
     Ok(())
 }
+
+/// Read ordinary developer-owned input files under an explicit byte ceiling.
+async fn read_utf8(path: &Path, maximum: u64) -> Result<String> {
+    ensure!(
+        fs::metadata(path).await?.is_file(),
+        "Codegen input must be an ordinary file"
+    );
+    let file = fs::File::open(path).await?;
+    let mut bytes = Vec::new();
+    file.take(maximum + 1).read_to_end(&mut bytes).await?;
+    ensure!(
+        u64::try_from(bytes.len())? <= maximum,
+        "Codegen input byte limit exceeded"
+    );
+    String::from_utf8(bytes).context("Invalid UTF-8 codegen input")
+}
diff --git a/codegen/src/model.rs b/codegen/src/model.rs
index a43aab65..f0267256 100644
--- a/codegen/src/model.rs
+++ b/codegen/src/model.rs
@@ -5,7 +5,7 @@
 
 use std::collections::HashMap;
 
-use serde::Deserialize;
+use serde::{Deserialize, de::IgnoredAny};
 
 /// Top-level Smithy model document.
 #[derive(Debug, Deserialize)]
@@ -31,13 +31,13 @@ pub enum Shape {
     String(SimpleShape),
     /// A boolean shape.
     #[serde(rename = "boolean")]
-    Boolean(SimpleShape),
+    Boolean(IgnoredAny),
     /// A 32-bit integer shape.
     #[serde(rename = "integer")]
-    Integer(SimpleShape),
+    Integer(IgnoredAny),
     /// A 64-bit integer shape.
     #[serde(rename = "long")]
-    Long(SimpleShape),
+    Long(IgnoredAny),
     /// A timestamp shape.
     #[serde(rename = "timestamp")]
     Timestamp(SimpleShape),
@@ -58,19 +58,19 @@ pub enum Shape {
     Union(UnionShape),
     /// A service shape (ignored).
     #[serde(rename = "service")]
-    Service(SimpleShape),
+    Service(IgnoredAny),
     /// A resource shape (ignored).
     #[serde(rename = "resource")]
-    Resource(SimpleShape),
+    Resource(IgnoredAny),
     /// An integer enum shape (ignored).
     #[serde(rename = "intEnum")]
-    IntEnum(SimpleShape),
+    IntEnum(IgnoredAny),
     /// A double shape.
     #[serde(rename = "double")]
-    Double(SimpleShape),
+    Double(IgnoredAny),
     /// A float shape.
     #[serde(rename = "float")]
-    Float(SimpleShape),
+    Float(IgnoredAny),
 }
 
 /// A simple shape with optional traits.
@@ -112,9 +112,6 @@ pub struct OperationShape {
     /// Error shape references.
     #[serde(default)]
     pub errors: Vec<ShapeRef>,
-    /// Traits applied to this shape.
-    #[serde(default)]
-    pub traits: HashMap<String, serde_json::Value>,
 }
 
 /// A reference to another shape.
@@ -130,9 +127,6 @@ pub struct EnumShape {
     /// Enum variants (member name -> member shape).
     #[serde(default)]
     pub members: HashMap<String, MemberShape>,
-    /// Traits applied to this shape.
-    #[serde(default)]
-    pub traits: HashMap<String, serde_json::Value>,
 }
 
 /// A list shape.
@@ -140,9 +134,6 @@ pub struct EnumShape {
 pub struct ListShape {
     /// The shape of the list's elements.
     pub member: ShapeRef,
-    /// Traits applied to this shape.
-    #[serde(default)]
-    pub traits: HashMap<String, serde_json::Value>,
 }
 
 /// A map shape.
@@ -152,9 +143,6 @@ pub struct MapShape {
     pub key: ShapeRef,
     /// The shape of the map's values.
     pub value: ShapeRef,
-    /// Traits applied to this shape.
-    #[serde(default)]
-    pub traits: HashMap<String, serde_json::Value>,
 }
 
 /// A union shape.
@@ -163,9 +151,6 @@ pub struct UnionShape {
     /// Union variants.
     #[serde(default)]
     pub members: HashMap<String, MemberShape>,
-    /// Traits applied to this shape.
-    #[serde(default)]
-    pub traits: HashMap<String, serde_json::Value>,
 }
 
 impl SmithyModel {
diff --git a/codegen/src/shapes.rs b/codegen/src/shapes.rs
index 478895dd..dce3f9c7 100644
--- a/codegen/src/shapes.rs
+++ b/codegen/src/shapes.rs
@@ -7,8 +7,10 @@ use std::collections::{BTreeMap, BTreeSet};
 
 use anyhow::{Context, Result};
 
-use crate::config::ServiceConfig;
-use crate::model::{MemberShape, Shape, SmithyModel, StructureShape};
+use crate::{
+    config::ServiceConfig,
+    model::{MemberShape, Shape, SmithyModel, StructureShape},
+};
 
 /// Maximum recursion depth when resolving shape references.
 const MAX_RESOLVE_DEPTH: usize = 15;
@@ -38,6 +40,8 @@ pub struct FieldInfo {
     pub rust_type: String,
     /// Whether this field is required.
     pub required: bool,
+    /// Timestamp format; empty means protocol default, None means not a timestamp.
+    pub timestamp_format: Option<String>,
     /// HTTP binding annotation if any.
     pub http_binding: Option<HttpBinding>,
 }
@@ -75,8 +79,6 @@ pub struct ErrorInfo {
     pub wire_name: String,
     /// Default HTTP status code (from `smithy.api#httpError`, or 400/500 based on fault).
     pub status_code: u16,
-    /// Default human-readable message.
-    pub message: String,
     /// Fault type: `"client"` or `"server"`.
     pub fault: String,
 }
@@ -331,12 +333,33 @@ fn resolve_struct_fields(
                 rust_name: to_snake_case(name),
                 rust_type,
                 required,
+                timestamp_format: timestamp_format(model, member),
                 http_binding,
             }
         })
         .collect()
 }
 
+/// Resolve a timestamp member override before its target-shape override.
+fn timestamp_format(model: &SmithyModel, member: &MemberShape) -> Option<String> {
+    let shape = model.shapes.get(&member.target);
+    let target_traits = match shape {
+        Some(Shape::Timestamp(shape)) => Some(&shape.traits),
+        _ if member.target == "smithy.api#Timestamp" => None,
+        _ => return None,
+    };
+    Some(
+        member
+            .traits
+            .get("smithy.api#timestampFormat")
+            .or_else(|| target_traits.and_then(|traits| traits.get("smithy.api#timestampFormat")))
+            .map_or("", |value| {
+                value.as_str().unwrap_or("<invalid timestampFormat>")
+            })
+            .to_owned(),
+    )
+}
+
 /// Check if a type is a collection type that should not be wrapped in Option.
 fn is_collection_type(ty: &str) -> bool {
     ty.starts_with("Vec<") || ty.starts_with("HashMap<")
@@ -506,6 +529,7 @@ pub fn resolve_model(model: &SmithyModel, config: &ServiceConfig) -> Result<Reso
                         rust_name: to_snake_case(name),
                         rust_type: format!("Option<{base_type}>"),
                         required: false,
+                        timestamp_format: timestamp_format(model, member),
                         http_binding: None,
                     }
                 })
@@ -565,14 +589,11 @@ fn collect_errors(
         // for a cleaner Rust API, but keep the wire name for serialization)
         let name = wire_name.clone();
 
-        let message = name.clone();
-
         seen_names.insert(name.clone());
         errors.push(ErrorInfo {
             name,
             wire_name,
             status_code,
-            message,
             fault,
         });
     }
@@ -585,7 +606,6 @@ fn collect_errors(
                 name: name.clone(),
                 wire_name: name.clone(),
                 status_code: custom.status,
-                message: custom.message.clone(),
                 fault: if custom.status >= 500 {
                     "server".to_owned()
                 } else {
diff --git a/codegen/src/tests.rs b/codegen/src/tests.rs
new file mode 100644
index 00000000..14e90432
--- /dev/null
+++ b/codegen/src/tests.rs
@@ -0,0 +1,171 @@
+//! Generator protocol-policy tests independent of generated runtime fixtures.
+
+use serde_json::json;
+
+use crate::{
+    codegen::generate_all,
+    config::{CustomError, ServiceConfig, ServiceConfigFile},
+    model::SmithyModel,
+    shapes::resolve_model,
+};
+
+fn config(protocol: &str, strict: bool) -> ServiceConfig {
+    let text = format!(
+        r#"
+[service]
+name="fixture"
+display_name="Fixture"
+rust_prefix="Fixture"
+namespace="fixture"
+protocol="{protocol}"
+[protocol]
+serde_rename="camelCase"
+emit_serde_derives=true
+[operations]
+all=["Run"]
+[output]
+file_layout="flat"
+strict_model={strict}
+"#
+    );
+    let file: ServiceConfigFile = toml::from_str(&text).unwrap();
+    ServiceConfig::from_file(file).unwrap()
+}
+fn model(target: Option<&str>, member: Option<&str>, collection: bool) -> SmithyModel {
+    let mut value = json!({"smithy":"2.0","shapes":{
+        "fixture#Run":{"type":"operation","input":{"target":"fixture#RunRequest"}},
+        "fixture#RunRequest":{"type":"structure","members":{
+            "required":{"target":"fixture#Time","traits":{"smithy.api#required":{}}},
+            "optional":{"target":"fixture#Time"},
+            "plain":{"target":"smithy.api#String"}}},
+        "fixture#Time":{"type":"timestamp","traits":{}}
+    }});
+    if let Some(format) = target {
+        value["shapes"]["fixture#Time"]["traits"]["smithy.api#timestampFormat"] = json!(format);
+    }
+    if let Some(format) = member {
+        value["shapes"]["fixture#RunRequest"]["members"]["required"]["traits"]
+            ["smithy.api#timestampFormat"] = json!(format);
+    }
+    if collection {
+        value["shapes"]["fixture#Times"] =
+            json!({"type":"list","member":{"target":"fixture#Time"}});
+        value["shapes"]["fixture#RunRequest"]["members"]["times"] =
+            json!({"target":"fixture#Times"});
+    }
+    serde_json::from_value(value).unwrap()
+}
+#[test]
+fn test_should_emit_numeric_codecs_only_for_json_protocol_defaults() {
+    for protocol in [
+        "awsJson1_0",
+        "awsJson1_1",
+        "restJson1",
+        "awsQuery",
+        "restXml",
+    ] {
+        let config = config(protocol, true);
+        let resolved = resolve_model(&model(None, None, false), &config).unwrap();
+        let files = generate_all(&resolved, &config).unwrap();
+        let numeric = protocol.starts_with("awsJson");
+        assert_eq!(files.contains_key("epoch_seconds.rs"), numeric);
+        assert_eq!(
+            files["input.rs"].contains("with = \"crate::epoch_seconds"),
+            numeric
+        );
+        if numeric {
+            assert!(files["input.rs"].contains("default, with = \"crate::epoch_seconds::option\""));
+        }
+    }
+}
+#[test]
+fn test_should_resolve_member_override_before_shape_before_protocol_default() {
+    let config = config("awsJson1_0", true);
+    for (target, member, expected) in [
+        (Some("date-time"), Some("epoch-seconds"), "epoch-seconds"),
+        (Some("epoch-seconds"), Some("date-time"), "date-time"),
+        (Some("date-time"), None, "date-time"),
+        (None, None, ""),
+    ] {
+        let resolved = resolve_model(&model(target, member, false), &config).unwrap();
+        let field = resolved.input_structs["RunInput"]
+            .iter()
+            .find(|field| field.smithy_name == "required")
+            .unwrap();
+        assert_eq!(field.timestamp_format.as_deref(), Some(expected));
+        let files = generate_all(&resolved, &config).unwrap();
+        let required = files["input.rs"].split("pub required:").next().unwrap();
+        assert_eq!(
+            required
+                .lines()
+                .rev()
+                .find(|line| !line.trim().is_empty())
+                .unwrap()
+                .contains("with = \"crate::epoch_seconds\""),
+            expected != "date-time"
+        );
+    }
+}
+#[test]
+fn test_should_reject_unsupported_explicit_formats_and_unadapted_collections() {
+    let config = config("awsJson1_0", true);
+    for model in [
+        model(None, Some("http-date"), false),
+        model(None, None, true),
+    ] {
+        let resolved = resolve_model(&model, &config).unwrap();
+        assert!(generate_all(&resolved, &config).is_err());
+    }
+}
+#[test]
+fn test_should_keep_strict_models_redacted_documented_and_without_blanket_ignores() {
+    let config = config("awsJson1_0", true);
+    let resolved = resolve_model(&model(None, None, false), &config).unwrap();
+    let files = generate_all(&resolved, &config).unwrap();
+    assert!(files["input.rs"].contains("#[serde(deny_unknown_fields)]"));
+    assert!(files["input.rs"].contains("#[non_exhaustive]"));
+    assert!(files["input.rs"].contains("impl std::fmt::Debug for RunInput"));
+    assert!(files["input.rs"].contains("/// The `required` wire member."));
+    assert!(files.values().all(|file| !file.contains("#[allow(")
+        && !file.contains("#![allow(")
+        && !file.contains("```ignore")));
+    assert_eq!(files, generate_all(&resolved, &config).unwrap());
+}
+
+#[test]
+fn test_should_emit_one_redacted_debug_without_serde_derives() {
+    for protocol in ["restXml", "awsJson1_0", "awsJson1_1"] {
+        let mut config = config(protocol, true);
+        config.emit_serde_derives = false;
+        let resolved = resolve_model(&model(None, None, false), &config).unwrap();
+        let files = generate_all(&resolved, &config).unwrap();
+        assert!(files["input.rs"].contains("#[derive(Clone, Default)]"));
+        assert!(!files["input.rs"].contains("derive(Debug"));
+        assert_eq!(
+            files["input.rs"]
+                .matches("impl std::fmt::Debug for RunInput")
+                .count(),
+            1
+        );
+        assert!(!files.contains_key("epoch_seconds.rs"));
+        assert!(!files["lib.rs"].contains("mod epoch_seconds"));
+    }
+}
+
+#[test]
+fn test_should_preserve_payment_required_and_request_timeout_error_statuses() {
+    let mut config = config("awsJson1_0", true);
+    for (name, status) in [("Quota", 402), ("Timeout", 408)] {
+        config.custom_errors.insert(
+            name.into(),
+            CustomError {
+                status,
+                message: "static".into(),
+            },
+        );
+    }
+    let resolved = resolve_model(&model(None, None, false), &config).unwrap();
+    let files = generate_all(&resolved, &config).unwrap();
+    assert!(files["error.rs"].contains("Self::Quota => http::StatusCode::PAYMENT_REQUIRED"));
+    assert!(files["error.rs"].contains("Self::Timeout => http::StatusCode::REQUEST_TIMEOUT"));
+}
diff --git a/codegen/templates/epoch_seconds.rs b/codegen/templates/epoch_seconds.rs
new file mode 100644
index 00000000..36ab79c9
--- /dev/null
+++ b/codegen/templates/epoch_seconds.rs
@@ -0,0 +1,90 @@
+//! Generated JSON epoch-second adapters with exact decimal millisecond precision.
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error as DeError, ser::Error as SerError};
+use serde_json::value::RawValue;
+
+const INVALID: &str = "invalid epoch-second timestamp";
+
+/// Serialize a required timestamp as a numeric JSON epoch value.
+///
+/// # Errors
+/// Rejects leap seconds, invalid numeric representation or serializer failures.
+pub fn serialize<S: Serializer>(value: &DateTime<Utc>, serializer: S) -> Result<S::Ok, S::Error> {
+    if value.timestamp_subsec_nanos() >= 1_000_000_000 { return Err(S::Error::custom(INVALID)); }
+    let nanos = i128::from(value.timestamp()).checked_mul(1_000_000_000)
+        .and_then(|seconds| seconds.checked_add(i128::from(value.timestamp_subsec_nanos())))
+        .ok_or_else(|| S::Error::custom(INVALID))?;
+    let millis = nanos / 1_000_000;
+    let sign = if millis < 0 { "-" } else { "" };
+    let magnitude = millis.unsigned_abs();
+    let seconds = magnitude / 1000;
+    let fraction = magnitude % 1000;
+    let number = if fraction == 0 { format!("{sign}{seconds}") } else { format!("{sign}{seconds}.{fraction:03}") };
+    RawValue::from_string(number).map_err(|_| S::Error::custom(INVALID))?.serialize(serializer)
+}
+
+/// Deserialize a required JSON number, truncating submillisecond precision.
+///
+/// # Errors
+/// Rejects nonnumeric, oversized, out-of-range or invalid epoch values.
+pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<DateTime<Utc>, D::Error> {
+    let value = Box::<RawValue>::deserialize(deserializer)?;
+    parse(value.get()).ok_or_else(|| D::Error::custom(INVALID))
+}
+
+fn parse(raw: &str) -> Option<DateTime<Utc>> {
+    if raw.len() > 128 { return None; }
+    let (negative, raw) = raw.strip_prefix('-').map_or((false, raw), |rest| (true, rest));
+    let (mantissa, exponent) = match raw.split_once(['e', 'E']) {
+        Some((value, exponent)) => {
+            let (negative, digits) = exponent.strip_prefix('-').map_or_else(
+                || (false, exponent.strip_prefix('+').unwrap_or(exponent)), |digits| (true, digits));
+            if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) { return None; }
+            let magnitude = digits.bytes().fold(0_i32, |value, digit|
+                value.saturating_mul(10).saturating_add(i32::from(digit - b'0')).min(1024));
+            (value, if negative { -magnitude } else { magnitude })
+        },
+        None => (raw, 0),
+    };
+    let (whole, fraction) = mantissa.split_once('.').unwrap_or((mantissa, ""));
+    if whole.is_empty() || !whole.bytes().chain(fraction.bytes()).all(|byte| byte.is_ascii_digit()) { return None; }
+    let digits: Vec<_> = whole.bytes().chain(fraction.bytes()).collect();
+    if digits.iter().all(|digit| *digit == b'0') { return DateTime::from_timestamp_millis(0); }
+    let keep = i32::try_from(whole.len()).ok()?.checked_add(exponent)?.checked_add(3)?;
+    if keep <= 0 { return DateTime::from_timestamp_millis(0); }
+    // Leading zeroes must not make a small representable exponent look huge.
+    let leading = digits.iter().take_while(|digit| **digit == b'0').count();
+    let significant = keep.checked_sub(i32::try_from(leading).ok()?)?;
+    if significant <= 0 { return DateTime::from_timestamp_millis(0); }
+    if significant > 19 { return None; }
+    let mut millis = 0_i128;
+    let count = usize::try_from(significant).ok()?;
+    for offset in 0..count {
+        let digit = digits.get(leading.checked_add(offset)?).copied().unwrap_or(b'0');
+        millis = millis.checked_mul(10)?.checked_add(i128::from(digit.checked_sub(b'0')?))?;
+    }
+    let signed = if negative { millis.checked_neg()? } else { millis };
+    DateTime::from_timestamp_millis(i64::try_from(signed).ok()?)
+}
+
+/// Optional JSON timestamp adapter; missing members also need serde default.
+pub mod option {
+    use std::borrow::Borrow;
+    use super::{DateTime, Deserialize, Deserializer, DeError, RawValue, Serializer, Utc, INVALID};
+
+    /// Serialize a timestamp or JSON null.
+    ///
+    /// # Errors
+    /// Returns the required adapter's validation/serialization errors.
+    pub fn serialize<S: Serializer, V: Borrow<Option<DateTime<Utc>>>>(value: V, serializer: S) -> Result<S::Ok, S::Error> {
+        match value.borrow() { Some(value) => super::serialize(value, serializer), None => serializer.serialize_none() }
+    }
+    /// Deserialize a timestamp or JSON null.
+    ///
+    /// # Errors
+    /// Rejects invalid nonnull values with the required adapter's rules.
+    pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Option<DateTime<Utc>>, D::Error> {
+        Option::<Box<RawValue>>::deserialize(deserializer)?.map(|value| super::parse(value.get()).ok_or_else(|| D::Error::custom(INVALID))).transpose()
+    }
+}
diff --git a/crates/rustack-auth/src/canonical.rs b/crates/rustack-auth/src/canonical.rs
index 7c72b632..a819e04f 100644
--- a/crates/rustack-auth/src/canonical.rs
+++ b/crates/rustack-auth/src/canonical.rs
@@ -22,7 +22,7 @@ use crate::error::AuthError;
 
 /// The set of characters that must be percent-encoded in URI path segments.
 ///
-/// Per AWS SigV4 spec, all characters except unreserved characters
+/// Per AWS `SigV4` spec, all characters except unreserved characters
 /// (A-Z, a-z, 0-9, `-`, `_`, `.`, `~`) must be encoded.
 /// Forward slashes in the path are preserved (not encoded).
 const URI_ENCODE_SET: &AsciiSet = &NON_ALPHANUMERIC
@@ -116,7 +116,7 @@ pub fn build_canonical_uri(path: &str) -> String {
 /// Parameters are sorted by key name first, then by value for duplicate keys.
 /// The raw query string values are preserved as-is (no decode/re-encode) because
 /// different clients use different encoding rules when signing. For example,
-/// AWS SDKs percent-encode `:` and `*` but minio-java (via OkHttp) leaves them
+/// AWS SDKs percent-encode `:` and `*` but minio-java (via `OkHttp`) leaves them
 /// raw. The server must use the exact same encoding the client used for signing,
 /// which is whatever appears in the HTTP request.
 ///
@@ -187,10 +187,10 @@ pub(crate) fn validate_unique_query_names(query: &str) -> Result<(), AuthError>
     Ok(())
 }
 
-/// Build the canonical query string following the AWS SigV4 specification.
+/// Build the canonical query string following the AWS `SigV4` specification.
 ///
 /// Each parameter name and value is first percent-decoded (so already-encoded
-/// input is not double-encoded) and then re-encoded using the SigV4 encoding
+/// input is not double-encoded) and then re-encoded using the `SigV4` encoding
 /// rules: every character except the unreserved set (`A-Z`, `a-z`, `0-9`, `-`,
 /// `_`, `.`, `~`) is percent-encoded with uppercase hex. Parameters are then
 /// sorted by encoded name. Duplicate decoded names are rejected because S3
@@ -209,7 +209,7 @@ pub(crate) fn validate_unique_query_names(query: &str) -> Result<(), AuthError>
 /// signature collisions where tampered parameters still verify.
 ///
 /// A literal `+` is treated as a literal plus (re-encoded as `%2B`), per the
-/// SigV4 encoding rules. Note that downstream decoders disagree on the
+/// `SigV4` encoding rules. Note that downstream decoders disagree on the
 /// meaning of a raw `+` (S3 decodes a literal plus, API Gateway and Lambda
 /// decode a space), so verification callers must NOT attempt the normalized
 /// fallback when the wire query contains a raw `+`: no single normalized
@@ -275,7 +275,7 @@ pub fn build_canonical_query_string_normalized(query: &str) -> Result<String, Au
 }
 
 /// Percent-decode one query parameter name or value for normalization, then
-/// re-encode it per the SigV4 rules.
+/// re-encode it per the `SigV4` rules.
 ///
 /// A literal `+` is treated as a literal plus (re-encoded as `%2B`). This is
 /// only unambiguous because verification callers skip the normalized fallback
@@ -366,7 +366,7 @@ pub fn build_signed_headers_string(signed_headers: &[&str]) -> String {
     sorted.join(";")
 }
 
-/// Percent-encode a string using the AWS SigV4 encoding rules.
+/// Percent-encode a string using the AWS `SigV4` encoding rules.
 ///
 /// Every character except the unreserved set (`A-Z`, `a-z`, `0-9`, `-`, `_`,
 /// `.`, `~`) is percent-encoded with uppercase hexadecimal digits.
@@ -374,7 +374,7 @@ fn sigv4_encode(input: &str) -> String {
     utf8_percent_encode(input, URI_ENCODE_SET).to_string()
 }
 
-/// URI-encode a single path segment using the AWS SigV4 encoding rules.
+/// URI-encode a single path segment using the AWS `SigV4` encoding rules.
 fn uri_encode(input: &str) -> String {
     sigv4_encode(input)
 }
diff --git a/crates/rustack-auth/src/credentials.rs b/crates/rustack-auth/src/credentials.rs
index b7095120..1a0736ef 100644
--- a/crates/rustack-auth/src/credentials.rs
+++ b/crates/rustack-auth/src/credentials.rs
@@ -44,7 +44,7 @@ pub struct StaticCredentialProvider {
 }
 
 impl StaticCredentialProvider {
-    /// Create a new `StaticCredentialProvider` from an iterable of (access_key_id, secret_key)
+    /// Create a new `StaticCredentialProvider` from an iterable of (`access_key_id`, `secret_key`)
     /// pairs.
     pub fn new(credentials: impl IntoIterator<Item = (String, String)>) -> Self {
         Self {
diff --git a/crates/rustack-auth/src/error.rs b/crates/rustack-auth/src/error.rs
index 31218dae..e4449807 100644
--- a/crates/rustack-auth/src/error.rs
+++ b/crates/rustack-auth/src/error.rs
@@ -1,11 +1,21 @@
-//! Error types for SigV4 authentication.
+//! Error types for `SigV4` authentication.
 //!
 //! All authentication failures are represented by [`AuthError`], which provides
 //! specific variants for each failure mode encountered during signature verification.
 
+use digest::InvalidLength;
+
 /// Errors that can occur during AWS Signature Version 4 authentication.
 #[derive(Debug, thiserror::Error)]
 pub enum AuthError {
+    /// The cryptographic provider rejected MAC initialization.
+    #[error("Cryptographic initialization failed")]
+    CryptoInitialization {
+        /// Original provider error, without key or request contents.
+        #[source]
+        source: InvalidLength,
+    },
+
     /// Strict authentication requires a credential provider.
     #[error("Strict authentication requires a credential provider")]
     MissingCredentialProvider,
diff --git a/crates/rustack-auth/src/lib.rs b/crates/rustack-auth/src/lib.rs
index 435bd06b..89c8c968 100644
--- a/crates/rustack-auth/src/lib.rs
+++ b/crates/rustack-auth/src/lib.rs
@@ -1,9 +1,9 @@
 //! AWS Signature Version 2 and 4 request authentication for Rustack.
 //!
-//! This crate provides SigV4 and SigV2 signature verification for incoming HTTP
+//! This crate provides `SigV4` and `SigV2` signature verification for incoming HTTP
 //! requests to AWS-compatible services. It supports header-based authentication
 //! (via the `Authorization` header), presigned URL authentication (via query
-//! parameters), and legacy SigV2 authentication (HMAC-SHA1).
+//! parameters), and legacy `SigV2` authentication (HMAC-SHA1).
 //!
 //! # Overview
 //!
@@ -29,12 +29,12 @@
 //!
 //! # Modules
 //!
-//! - [`canonical`] - Canonical request construction per the SigV4 specification
+//! - [`canonical`] - Canonical request construction per the `SigV4` specification
 //! - [`credentials`] - Credential provider trait and in-memory implementation
 //! - [`error`] - Authentication error types
 //! - [`presigned`] - Presigned URL verification
-//! - [`sigv2`] - Legacy SigV2 signature verification (HMAC-SHA1)
-//! - [`sigv4`] - Main SigV4 signature verification logic
+//! - [`sigv2`] - Legacy `SigV2` signature verification (HMAC-SHA1)
+//! - [`sigv4`] - Main `SigV4` signature verification logic
 
 pub mod canonical;
 pub mod credentials;
diff --git a/crates/rustack-auth/src/presigned.rs b/crates/rustack-auth/src/presigned.rs
index b28175bb..053403c1 100644
--- a/crates/rustack-auth/src/presigned.rs
+++ b/crates/rustack-auth/src/presigned.rs
@@ -116,9 +116,9 @@ pub fn parse_presigned_params(query: &str) -> Result<ParsedPresignedParams, Auth
 
     // Parse credential: AKID/date/region/service/aws4_request
     let cred_parts: Vec<&str> = credential.splitn(5, '/').collect();
-    if cred_parts.len() != 5 || cred_parts[4] != "aws4_request" {
+    let [access_key_id, date, region, service, "aws4_request"] = cred_parts.as_slice() else {
         return Err(AuthError::InvalidCredential);
-    }
+    };
 
     let expires: u64 = expires_str
         .parse()
@@ -131,10 +131,10 @@ pub fn parse_presigned_params(query: &str) -> Result<ParsedPresignedParams, Auth
 
     Ok(ParsedPresignedParams {
         algorithm,
-        access_key_id: cred_parts[0].to_owned(),
-        date: cred_parts[1].to_owned(),
-        region: cred_parts[2].to_owned(),
-        service: cred_parts[3].to_owned(),
+        access_key_id: (*access_key_id).to_owned(),
+        date: (*date).to_owned(),
+        region: (*region).to_owned(),
+        service: (*service).to_owned(),
         timestamp,
         expires,
         signed_headers,
@@ -145,7 +145,7 @@ pub fn parse_presigned_params(query: &str) -> Result<ParsedPresignedParams, Auth
 /// Verify a presigned URL request.
 ///
 /// This is the S3 presigned entry point: S3 percent-decodes every query
-/// parameter before acting on it, so the SigV4-normalized fallback's
+/// parameter before acting on it, so the `SigV4`-normalized fallback's
 /// encoding-equivalence assertion holds here. Other endpoints must not use
 /// this function unless their query decoding has been audited the same way.
 ///
@@ -168,6 +168,7 @@ pub fn parse_presigned_params(query: &str) -> Result<ParsedPresignedParams, Auth
 /// - The access key is not found
 /// - Required signed headers are missing
 /// - The signature does not match
+/// - The MAC provider rejects initialization
 pub fn verify_presigned(
     parts: &http::request::Parts,
     credential_provider: &dyn CredentialProvider,
@@ -211,22 +212,22 @@ pub fn verify_presigned(
         parsed.date, parsed.region, parsed.service
     );
     let signing_key =
-        derive_signing_key(&secret_key, &parsed.date, &parsed.region, &parsed.service);
+        derive_signing_key(&secret_key, &parsed.date, &parsed.region, &parsed.service)?;
     let provided_bytes = parsed.signature.as_bytes();
 
     // Check the provided signature against the canonical request built from
     // `canonical_query`. Returns true on a constant-time match.
     // For presigned URLs, the payload hash is always UNSIGNED-PAYLOAD.
     #[rustfmt::skip]
-    let signature_matches = |canonical_query: &str| -> bool {
+    let signature_matches = |canonical_query: &str| -> Result<bool, AuthError> {
         let canonical_request = format!(
             "{method}\n{canonical_uri}\n{canonical_query}\n{canonical_headers}\n\n{signed_headers_str}\n{UNSIGNED_PAYLOAD}"
         );
         let canonical_hash = hex::encode(Sha256::digest(canonical_request.as_bytes()));
         let string_to_sign =
             build_string_to_sign(&parsed.timestamp, &credential_scope, &canonical_hash);
-        let expected_signature = compute_signature(&signing_key, &string_to_sign);
-        bool::from(provided_bytes.ct_eq(expected_signature.as_bytes()))
+        let expected_signature = compute_signature(&signing_key, &string_to_sign)?;
+        Ok(bool::from(provided_bytes.ct_eq(expected_signature.as_bytes())))
     };
 
     debug!("Built presigned canonical request");
@@ -235,7 +236,7 @@ pub fn verify_presigned(
     // `X-Amz-Signature`). This matches clients that sign whatever encoding
     // appears in the URL.
     let canonical_query = build_canonical_query_string_without_signature(query);
-    if signature_matches(&canonical_query) {
+    if signature_matches(&canonical_query)? {
         debug!(access_key_id = %parsed.access_key_id, "Presigned URL verification succeeded");
         return Ok(AuthResult {
             access_key_id: parsed.access_key_id,
@@ -262,9 +263,10 @@ pub fn verify_presigned(
     // is impossible; the raw attempt above already failed, so fall through to
     // the signature mismatch below.
     let normalized_matches = !query.contains('+')
-        && build_canonical_query_string_without_signature_normalized(query).is_ok_and(
-            |normalized| normalized != canonical_query && signature_matches(&normalized),
-        );
+        && match build_canonical_query_string_without_signature_normalized(query) {
+            Ok(normalized) if normalized != canonical_query => signature_matches(&normalized)?,
+            _ => false,
+        };
     if normalized_matches {
         debug!(access_key_id = %parsed.access_key_id, "Presigned URL verification succeeded (normalized query string)");
         return Ok(AuthResult {
@@ -287,9 +289,9 @@ fn build_canonical_query_string_without_signature(query: &str) -> String {
     build_canonical_query_string(&filter_signature_param(query))
 }
 
-/// Build the SigV4-normalized canonical query string excluding `X-Amz-Signature`.
+/// Build the `SigV4`-normalized canonical query string excluding `X-Amz-Signature`.
 ///
-/// The remaining parameters are percent-decoded, re-encoded per the SigV4 spec,
+/// The remaining parameters are percent-decoded, re-encoded per the `SigV4` spec,
 /// and sorted. See [`build_canonical_query_string_normalized`].
 ///
 /// # Errors
@@ -484,8 +486,8 @@ mod tests {
         let credential_scope = format!("{date}/us-east-1/s3/aws4_request");
         let string_to_sign = build_string_to_sign(&timestamp, &credential_scope, &canonical_hash);
 
-        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3");
-        let signature = compute_signature(&signing_key, &string_to_sign);
+        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3").unwrap();
+        let signature = compute_signature(&signing_key, &string_to_sign).unwrap();
 
         // Attacker's rewrite: the same values attached to the opposite raw
         // names. The normalized canonical query (and signature) is unchanged.
@@ -571,9 +573,10 @@ mod tests {
             &hex::encode(Sha256::digest(canonical.as_bytes())),
         );
         let signature = compute_signature(
-            &derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3"),
+            &derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3").unwrap(),
             &to_sign,
-        );
+        )
+        .unwrap();
         for wire_names in [
             "list-type=1&list-type=2",
             "%6cist-type=1&list-type=2",
@@ -641,7 +644,8 @@ mod tests {
 
         // Verify the signature computation is correct by manually
         // replicating the presigned URL flow.
-        let signing_key = derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3");
+        let signing_key =
+            derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3").unwrap();
 
         // Build canonical request for the presigned URL test vector.
         let canonical_request = "GET\n/test.txt\nX-Amz-Algorithm=AWS4-HMAC-SHA256&\
@@ -662,7 +666,7 @@ mod tests {
             &canonical_hash,
         );
 
-        let signature = compute_signature(&signing_key, &string_to_sign);
+        let signature = compute_signature(&signing_key, &string_to_sign).unwrap();
         assert_eq!(
             signature,
             "aeeed9bbccd4d02ee5c0109b86d86835f995330da4c265957d157751f604d404"
@@ -698,8 +702,8 @@ mod tests {
         let credential_scope = format!("{date}/us-east-1/s3/aws4_request");
         let string_to_sign = build_string_to_sign(&timestamp, &credential_scope, &canonical_hash);
 
-        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3");
-        let signature = compute_signature(&signing_key, &string_to_sign);
+        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3").unwrap();
+        let signature = compute_signature(&signing_key, &string_to_sign).unwrap();
 
         // Build the full query with signature.
         let full_query = format!("{query_without_sig}&X-Amz-Signature={signature}");
@@ -755,8 +759,8 @@ mod tests {
         let credential_scope = format!("{date}/us-east-1/s3/aws4_request");
         let string_to_sign = build_string_to_sign(&timestamp, &credential_scope, &canonical_hash);
 
-        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3");
-        let signature = compute_signature(&signing_key, &string_to_sign);
+        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3").unwrap();
+        let signature = compute_signature(&signing_key, &string_to_sign).unwrap();
 
         let full_query = format!("{query_without_sig}&X-Amz-Signature={signature}");
         let uri = format!("http://examplebucket.s3.amazonaws.com/test.txt?{full_query}");
@@ -805,8 +809,8 @@ mod tests {
         let credential_scope = format!("{date}/us-east-1/s3/aws4_request");
         let string_to_sign = build_string_to_sign(&timestamp, &credential_scope, &canonical_hash);
 
-        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3");
-        let signature = compute_signature(&signing_key, &string_to_sign);
+        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3").unwrap();
+        let signature = compute_signature(&signing_key, &string_to_sign).unwrap();
 
         // Tamper: `%2B` becomes a raw `+` on the wire.
         let tampered_query = query_without_sig.replace("x=%2B", "x=+");
@@ -859,8 +863,8 @@ mod tests {
         let credential_scope = format!("{date}/us-east-1/s3/aws4_request");
         let string_to_sign = build_string_to_sign(&timestamp, &credential_scope, &canonical_hash);
 
-        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3");
-        let signature = compute_signature(&signing_key, &string_to_sign);
+        let signing_key = derive_signing_key(TEST_SECRET_KEY, &date, "us-east-1", "s3").unwrap();
+        let signature = compute_signature(&signing_key, &string_to_sign).unwrap();
 
         // Tamper: `%20` becomes a raw `+` on the wire.
         let tampered_query = query_without_sig.replace("x=%20", "x=+");
diff --git a/crates/rustack-auth/src/sigv2.rs b/crates/rustack-auth/src/sigv2.rs
index 7ca9eb5f..26b44988 100644
--- a/crates/rustack-auth/src/sigv2.rs
+++ b/crates/rustack-auth/src/sigv2.rs
@@ -1,6 +1,6 @@
 //! AWS Signature Version 2 verification.
 //!
-//! SigV2 is an older signing mechanism that uses HMAC-SHA1. The `Authorization`
+//! `SigV2` is an older signing mechanism that uses HMAC-SHA1. The `Authorization`
 //! header has the format:
 //!
 //! ```text
@@ -30,18 +30,18 @@ use crate::{credentials::CredentialProvider, error::AuthError, sigv4::AuthResult
 
 type HmacSha1 = Hmac<Sha1>;
 
-/// Check whether the `Authorization` header uses SigV2 format (`AWS AKID:sig`).
+/// Check whether the `Authorization` header uses `SigV2` format (`AWS AKID:sig`).
 #[must_use]
 pub fn is_sigv2(auth_header: &str) -> bool {
     auth_header.starts_with("AWS ") && !auth_header.starts_with("AWS4-")
 }
 
-/// Verify an AWS SigV2-signed HTTP request.
+/// Verify an AWS `SigV2`-signed HTTP request.
 ///
 /// # Errors
 ///
 /// Returns an [`AuthError`] if the header is malformed, the access key is not
-/// found, or the signature does not match.
+/// found, the MAC provider rejects initialization, or the signature does not match.
 pub fn verify_sigv2(
     parts: &http::request::Parts,
     credential_provider: &dyn CredentialProvider,
@@ -63,7 +63,7 @@ pub fn verify_sigv2(
 
     debug!("Built SigV2 string to sign");
 
-    let expected_signature = compute_sigv2_signature(&secret_key, &string_to_sign);
+    let expected_signature = compute_sigv2_signature(&secret_key, &string_to_sign)?;
 
     if provided_signature
         .as_bytes()
@@ -83,7 +83,7 @@ pub fn verify_sigv2(
     }
 }
 
-/// Parse a SigV2 `Authorization` header: `AWS AKID:Signature`.
+/// Parse a `SigV2` `Authorization` header: `AWS AKID:Signature`.
 fn parse_sigv2_header(header: &str) -> Result<(String, String), AuthError> {
     let rest = header
         .strip_prefix("AWS ")
@@ -98,7 +98,7 @@ fn parse_sigv2_header(header: &str) -> Result<(String, String), AuthError> {
     Ok((access_key_id.to_owned(), signature.to_owned()))
 }
 
-/// Build the SigV2 string to sign from the request parts.
+/// Build the `SigV2` string to sign from the request parts.
 ///
 /// ```text
 /// HTTP-Verb + "\n" +
@@ -126,7 +126,7 @@ fn build_string_to_sign(parts: &http::request::Parts) -> String {
     format!("{method}\n{content_md5}\n{content_type}\n{date}\n{amz_headers}{resource}")
 }
 
-/// Build the CanonicalizedAmzHeaders string.
+/// Build the `CanonicalizedAmzHeaders` string.
 ///
 /// All x-amz-* headers are lowercased, sorted, and joined with newlines.
 /// Each header is formatted as `name:value\n`.
@@ -155,7 +155,7 @@ fn build_canonicalized_amz_headers(parts: &http::request::Parts) -> String {
     result
 }
 
-/// Build the CanonicalizedResource string.
+/// Build the `CanonicalizedResource` string.
 ///
 /// This is the URI path plus any sub-resource query parameters (sorted).
 fn build_canonicalized_resource(parts: &http::request::Parts) -> String {
@@ -228,13 +228,13 @@ fn build_canonicalized_resource(parts: &http::request::Parts) -> String {
     }
 }
 
-/// Compute the SigV2 signature: Base64(HMAC-SHA1(secret, string_to_sign)).
-fn compute_sigv2_signature(secret_key: &str, string_to_sign: &str) -> String {
-    let mut mac =
-        HmacSha1::new_from_slice(secret_key.as_bytes()).expect("HMAC can accept any key length");
+/// Compute the `SigV2` signature: Base64(HMAC-SHA1(secret, `string_to_sign`)).
+fn compute_sigv2_signature(secret_key: &str, string_to_sign: &str) -> Result<String, AuthError> {
+    let mut mac = HmacSha1::new_from_slice(secret_key.as_bytes())
+        .map_err(|source| AuthError::CryptoInitialization { source })?;
     mac.update(string_to_sign.as_bytes());
     let result = mac.finalize().into_bytes();
-    BASE64.encode(result)
+    Ok(BASE64.encode(result))
 }
 
 /// Extract a header value as a string, returning empty string if missing.
@@ -284,12 +284,27 @@ mod tests {
         assert!(parse_sigv2_header("NOTAWS key:sig").is_err());
     }
 
+    #[test]
+    fn test_should_match_rfc2202_sha1_vectors() {
+        // https://www.rfc-editor.org/rfc/rfc2202.html section 3, cases 1 and 2.
+        let first = compute_sigv2_signature(&"\u{b}".repeat(20), "Hi There").unwrap();
+        assert_eq!(
+            hex::encode(BASE64.decode(first).unwrap()),
+            "b617318655057264e28bc0b6fb378c8ef146be00"
+        );
+        let second = compute_sigv2_signature("Jefe", "what do ya want for nothing?").unwrap();
+        assert_eq!(
+            hex::encode(BASE64.decode(second).unwrap()),
+            "effcdf6ae5eb2fa2d27416d5f184df9c259a7c79"
+        );
+    }
+
     #[test]
     fn test_should_compute_sigv2_signature() {
-        let sig = compute_sigv2_signature("secret", "data");
+        let sig = compute_sigv2_signature("secret", "data").unwrap();
         assert_ne!(sig, "");
         // Base64(HMAC-SHA1) produces a deterministic output.
-        let sig2 = compute_sigv2_signature("secret", "data");
+        let sig2 = compute_sigv2_signature("secret", "data").unwrap();
         assert_eq!(sig, sig2);
     }
 
@@ -300,7 +315,7 @@ mod tests {
         // Build a simple GET request.
         let date = "Sat, 28 Feb 2026 12:00:00 GMT";
         let string_to_sign = format!("GET\n\n\n{date}\n/test-bucket/");
-        let signature = compute_sigv2_signature(TEST_SECRET_KEY, &string_to_sign);
+        let signature = compute_sigv2_signature(TEST_SECRET_KEY, &string_to_sign).unwrap();
 
         let auth_header = format!("AWS {TEST_ACCESS_KEY}:{signature}");
 
diff --git a/crates/rustack-auth/src/sigv4.rs b/crates/rustack-auth/src/sigv4.rs
index 1adb156c..ced54d58 100644
--- a/crates/rustack-auth/src/sigv4.rs
+++ b/crates/rustack-auth/src/sigv4.rs
@@ -1,6 +1,6 @@
 //! AWS Signature Version 4 verification.
 //!
-//! This module implements the core SigV4 signature verification flow:
+//! This module implements the core `SigV4` signature verification flow:
 //!
 //! 1. Parse the `Authorization` header to extract the algorithm, credential scope, signed headers,
 //!    and provided signature.
@@ -32,7 +32,7 @@ const SUPPORTED_ALGORITHM: &str = "AWS4-HMAC-SHA256";
 
 type HmacSha256 = Hmac<Sha256>;
 
-/// The result of a successful SigV4 verification.
+/// The result of a successful `SigV4` verification.
 #[derive(Debug, Clone)]
 pub struct AuthResult {
     /// The access key ID that signed the request.
@@ -45,7 +45,7 @@ pub struct AuthResult {
     pub signed_headers: Vec<String>,
 }
 
-/// Parsed components of an AWS SigV4 `Authorization` header.
+/// Parsed components of an AWS `SigV4` `Authorization` header.
 ///
 /// Format:
 /// ```text
@@ -71,7 +71,7 @@ pub struct ParsedAuth {
     pub signature: String,
 }
 
-/// Parse an AWS SigV4 `Authorization` header value into its components.
+/// Parse an AWS `SigV4` `Authorization` header value into its components.
 ///
 /// # Errors
 ///
@@ -108,25 +108,25 @@ pub fn parse_authorization_header(header: &str) -> Result<ParsedAuth, AuthError>
 
     // Parse credential: AKID/date/region/service/aws4_request
     let cred_parts: Vec<&str> = credential.splitn(5, '/').collect();
-    if cred_parts.len() != 5 || cred_parts[4] != "aws4_request" {
+    let [access_key_id, date, region, service, "aws4_request"] = cred_parts.as_slice() else {
         return Err(AuthError::InvalidCredential);
-    }
+    };
 
     let parsed_signed_headers: Vec<String> =
         signed_headers.split(';').map(ToOwned::to_owned).collect();
 
     Ok(ParsedAuth {
         algorithm: algorithm.to_owned(),
-        access_key_id: cred_parts[0].to_owned(),
-        date: cred_parts[1].to_owned(),
-        region: cred_parts[2].to_owned(),
-        service: cred_parts[3].to_owned(),
+        access_key_id: (*access_key_id).to_owned(),
+        date: (*date).to_owned(),
+        region: (*region).to_owned(),
+        service: (*service).to_owned(),
         signed_headers: parsed_signed_headers,
         signature: signature.to_owned(),
     })
 }
 
-/// Build the SigV4 string to sign.
+/// Build the `SigV4` string to sign.
 ///
 /// Format:
 /// ```text
@@ -157,7 +157,7 @@ pub fn build_string_to_sign(
     format!("{SUPPORTED_ALGORITHM}\n{timestamp}\n{credential_scope}\n{canonical_request_hash}")
 }
 
-/// Derive the SigV4 signing key using HMAC-SHA256 chain.
+/// Derive the `SigV4` signing key using HMAC-SHA256 chain.
 ///
 /// ```text
 /// DateKey              = HMAC-SHA256("AWS4" + secret_key, date)
@@ -170,33 +170,51 @@ pub fn build_string_to_sign(
 ///
 /// ```
 /// use rustack_auth::sigv4::derive_signing_key;
+/// # fn example() -> Result<(), rustack_auth::AuthError> {
 ///
 /// let key = derive_signing_key(
 ///     "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
 ///     "20130524",
 ///     "us-east-1",
 ///     "s3",
-/// );
+/// )?;
 /// assert!(!key.is_empty());
+/// # Ok(()) }
 /// ```
-#[must_use]
-pub fn derive_signing_key(secret_key: &str, date: &str, region: &str, service: &str) -> Vec<u8> {
-    let date_key = hmac_sha256(format!("AWS4{secret_key}").as_bytes(), date.as_bytes());
-    let date_region_key = hmac_sha256(&date_key, region.as_bytes());
-    let date_region_service_key = hmac_sha256(&date_region_key, service.as_bytes());
+///
+/// # Errors
+/// Returns [`AuthError::CryptoInitialization`] if the MAC provider rejects a key.
+pub fn derive_signing_key(
+    secret_key: &str,
+    date: &str,
+    region: &str,
+    service: &str,
+) -> Result<Vec<u8>, AuthError> {
+    let date_key = hmac_sha256(format!("AWS4{secret_key}").as_bytes(), date.as_bytes())?;
+    let date_region_key = hmac_sha256(&date_key, region.as_bytes())?;
+    let date_region_service_key = hmac_sha256(&date_region_key, service.as_bytes())?;
     hmac_sha256(&date_region_service_key, b"aws4_request")
 }
 
 /// Compute the HMAC-SHA256 signature of `data` using the given `signing_key`.
 ///
 /// Returns the hex-encoded signature.
-#[must_use]
-pub fn compute_signature(signing_key: &[u8], data: &str) -> String {
-    let sig = hmac_sha256(signing_key, data.as_bytes());
-    hex::encode(sig)
+///
+/// # Errors
+/// Returns [`AuthError::CryptoInitialization`] if the MAC provider rejects the key.
+///
+/// ```
+/// # fn example() -> Result<(), rustack_auth::AuthError> {
+/// let signature = rustack_auth::sigv4::compute_signature(b"secret", "message")?;
+/// assert_eq!(signature.len(), 64);
+/// # Ok(()) }
+/// ```
+pub fn compute_signature(signing_key: &[u8], data: &str) -> Result<String, AuthError> {
+    let sig = hmac_sha256(signing_key, data.as_bytes())?;
+    Ok(hex::encode(sig))
 }
 
-/// Verify an AWS SigV4-signed HTTP request.
+/// Verify an AWS `SigV4`-signed HTTP request.
 ///
 /// This function:
 /// 1. Parses the `Authorization` header
@@ -207,7 +225,7 @@ pub fn compute_signature(signing_key: &[u8], data: &str) -> String {
 ///
 /// The query string is verified exactly as it appears on the wire
 /// (raw-preserving). Unlike [`verify_s3_sigv4`], this does NOT attempt the
-/// SigV4-normalized fallback: the normalized form asserts that alternate
+/// `SigV4`-normalized fallback: the normalized form asserts that alternate
 /// wire encodings are equivalent, which is only true when the serving
 /// endpoint percent-decodes query parameters before acting on them. Whether
 /// the fallback is safe is a property of the serving endpoint, never of the
@@ -222,6 +240,7 @@ pub fn compute_signature(signing_key: &[u8], data: &str) -> String {
 /// - The access key is not found
 /// - Required signed headers are missing
 /// - The signature does not match
+/// - The MAC provider rejects initialization
 pub fn verify_sigv4(
     parts: &http::request::Parts,
     body_hash: &str,
@@ -230,13 +249,13 @@ pub fn verify_sigv4(
     verify_sigv4_with_policy(parts, body_hash, credential_provider, false, false)
 }
 
-/// Verify S3 SigV4, allowing the explicit unsigned-payload protocol exception.
+/// Verify S3 `SigV4`, allowing the explicit unsigned-payload protocol exception.
 ///
 /// This verifies the seed signature only for streaming markers. Callers MUST additionally
 /// verify every chunk and signed trailer with [`StreamingVerifier`] before publishing data.
 ///
 /// In addition to the raw-preserving attempt, this accepts the
-/// SigV4-normalized canonical query string as a fallback (see
+/// `SigV4`-normalized canonical query string as a fallback (see
 /// [`build_canonical_query_string_normalized`]): spec-compliant S3 clients
 /// such as Transmit 5 sign the encoded form even when the wire carries the
 /// raw value. This endpoint entry point is the opt-in — S3 percent-decodes
@@ -244,12 +263,13 @@ pub fn verify_sigv4(
 /// (`rustack-s3-http/src/router.rs::parse_query_params`), so the normalized
 /// equivalence holds. Do NOT use this entry point for an endpoint that reads
 /// query parameters from the raw query string without decoding (e.g.
-/// CloudFront's `DeleteRealtimeLogConfig` reading `Name`): a verified
+/// `CloudFront`'s `DeleteRealtimeLogConfig` reading `Name`): a verified
 /// signature could then authorize a different effective value than the one
 /// acted upon. Such endpoints must use [`verify_sigv4`].
 ///
 /// # Errors
-/// Returns an authentication error for invalid signatures or payload declarations.
+/// Returns an authentication error for invalid signatures, payload declarations,
+/// credential/header failures or MAC provider initialization failures.
 pub fn verify_s3_sigv4(
     parts: &http::request::Parts,
     body_hash: &str,
@@ -324,26 +344,26 @@ fn verify_sigv4_with_policy(
         parsed.date, parsed.region, parsed.service
     );
     let signing_key =
-        derive_signing_key(&secret_key, &parsed.date, &parsed.region, &parsed.service);
+        derive_signing_key(&secret_key, &parsed.date, &parsed.region, &parsed.service)?;
     let provided_bytes = parsed.signature.as_bytes();
 
     // Check the provided signature against the canonical request built from
     // `query_string`. Returns true on a constant-time match.
     #[rustfmt::skip]
-    let signature_matches = |query_string: &str| -> bool {
+    let signature_matches = |query_string: &str| -> Result<bool, AuthError> {
         let canonical_request = format!(
             "{method}\n{canonical_uri}\n{query_string}\n{canonical_headers}\n\n{signed_headers_str}\n{payload_hash}"
         );
         let canonical_hash = hex::encode(Sha256::digest(canonical_request.as_bytes()));
         let string_to_sign = build_string_to_sign(&timestamp, &credential_scope, &canonical_hash);
-        let expected_signature = compute_signature(&signing_key, &string_to_sign);
-        bool::from(provided_bytes.ct_eq(expected_signature.as_bytes()))
+        let expected_signature = compute_signature(&signing_key, &string_to_sign)?;
+        Ok(bool::from(provided_bytes.ct_eq(expected_signature.as_bytes())))
     };
 
     // First attempt: raw query string values preserved as-is. This matches
     // clients that sign whatever encoding appears on the wire (e.g. AWS SDKs
     // with pre-encoded values, minio-java via OkHttp with raw values).
-    if signature_matches(&canonical_query) {
+    if signature_matches(&canonical_query)? {
         debug!(access_key_id = %parsed.access_key_id, "Signature verification succeeded");
         return Ok(AuthResult {
             access_key_id: parsed.access_key_id,
@@ -377,9 +397,10 @@ fn verify_sigv4_with_policy(
     // the signature mismatch below.
     let normalized_matches = allow_normalized_fallback
         && !query.contains('+')
-        && build_canonical_query_string_normalized(query).is_ok_and(|normalized| {
-            normalized != canonical_query && signature_matches(&normalized)
-        });
+        && match build_canonical_query_string_normalized(query) {
+            Ok(normalized) if normalized != canonical_query => signature_matches(&normalized)?,
+            _ => false,
+        };
     if normalized_matches {
         debug!(access_key_id = %parsed.access_key_id, "Signature verification succeeded (normalized query string)");
         return Ok(AuthResult {
@@ -394,7 +415,7 @@ fn verify_sigv4_with_policy(
     Err(AuthError::SignatureDoesNotMatch)
 }
 
-/// SigV4 streaming HMAC chain, including terminal chunks and signed trailers.
+/// `SigV4` streaming HMAC chain, including terminal chunks and signed trailers.
 pub struct StreamingVerifier {
     key: Vec<u8>,
     timestamp: String,
@@ -411,7 +432,7 @@ impl std::fmt::Debug for StreamingVerifier {
 impl StreamingVerifier {
     /// Authenticate the seed and initialize the chunk chain.
     /// # Errors
-    /// Returns seed signature or header validation failures.
+    /// Returns seed signature/header validation or MAC provider initialization failures.
     pub fn new(
         parts: &http::request::Parts,
         provider: &dyn CredentialProvider,
@@ -421,7 +442,7 @@ impl StreamingVerifier {
         let parsed = parse_authorization_header(&header)?;
         let secret = provider.get_secret_key(&parsed.access_key_id)?;
         Ok(Self {
-            key: derive_signing_key(&secret, &parsed.date, &parsed.region, &parsed.service),
+            key: derive_signing_key(&secret, &parsed.date, &parsed.region, &parsed.service)?,
             timestamp: extract_header_value(parts, "x-amz-date")?,
             scope: format!(
                 "{}/{}/{}/aws4_request",
@@ -433,7 +454,8 @@ impl StreamingVerifier {
 
     /// Verify a data chunk, including the final zero-size chunk.
     /// # Errors
-    /// Rejects a missing, malformed or mismatching chunk signature.
+    /// Rejects a missing, malformed or mismatching chunk signature, or MAC provider
+    /// initialization failure. Failure leaves the previous signature unchanged.
     pub fn verify_chunk(&mut self, actual_sha256: &str, signature: &str) -> Result<(), AuthError> {
         let text = format!(
             "AWS4-HMAC-SHA256-PAYLOAD\n{}\n{}\n{}\n{}\n{}",
@@ -448,7 +470,8 @@ impl StreamingVerifier {
 
     /// Verify the canonical declared trailer block after the terminal chunk.
     /// # Errors
-    /// Returns an error if the trailer signature does not match.
+    /// Returns an error if the trailer signature does not match or MAC provider
+    /// initialization fails. Failure leaves the previous signature unchanged.
     pub fn verify_trailer(&mut self, canonical: &str, signature: &str) -> Result<(), AuthError> {
         let text = format!(
             "AWS4-HMAC-SHA256-TRAILER\n{}\n{}\n{}\n{}",
@@ -461,7 +484,7 @@ impl StreamingVerifier {
     }
 
     fn verify_next(&mut self, text: &str, signature: &str) -> Result<(), AuthError> {
-        let expected = compute_signature(&self.key, text);
+        let expected = compute_signature(&self.key, text)?;
         if !bool::from(expected.as_bytes().ct_eq(signature.as_bytes())) {
             return Err(AuthError::SignatureDoesNotMatch);
         }
@@ -537,10 +560,11 @@ fn collect_signed_headers<'a>(
 }
 
 /// Compute HMAC-SHA256 and return the raw bytes.
-fn hmac_sha256(key: &[u8], data: &[u8]) -> Vec<u8> {
-    let mut mac = HmacSha256::new_from_slice(key).expect("HMAC can accept keys of any length");
+fn hmac_sha256(key: &[u8], data: &[u8]) -> Result<Vec<u8>, AuthError> {
+    let mut mac = HmacSha256::new_from_slice(key)
+        .map_err(|source| AuthError::CryptoInitialization { source })?;
     mac.update(data);
-    mac.finalize().into_bytes().to_vec()
+    Ok(mac.finalize().into_bytes().to_vec())
 }
 
 /// Compute the SHA-256 hash of the given payload and return it as a hex string.
@@ -585,10 +609,26 @@ mod tests {
     }
 
     #[test]
-    fn test_should_derive_signing_key_matching_aws_test_vector() {
-        let key = derive_signing_key(TEST_SECRET_KEY, TEST_DATE, TEST_REGION, TEST_SERVICE);
-        // The signing key itself is not published as hex in the AWS docs,
-        // but we can verify it produces the correct signature when used.
+    fn test_should_match_rfc4231_sha256_vectors_with_short_and_long_keys() {
+        // https://www.rfc-editor.org/rfc/rfc4231.html sections 4.2 and 4.7.
+        assert_eq!(
+            compute_signature(&[0x0b; 20], "Hi There").unwrap(),
+            "b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7"
+        );
+        assert_eq!(
+            compute_signature(
+                &[0xaa; 131],
+                "Test Using Larger Than Block-Size Key - Hash Key First"
+            )
+            .unwrap(),
+            "60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54"
+        );
+    }
+
+    #[test]
+    fn test_should_derive_a_32_byte_signing_key() {
+        let key =
+            derive_signing_key(TEST_SECRET_KEY, TEST_DATE, TEST_REGION, TEST_SERVICE).unwrap();
         assert_eq!(key.len(), 32); // SHA-256 produces 32 bytes
     }
 
@@ -651,7 +691,8 @@ mod tests {
     #[test]
     fn test_should_compute_correct_signature_for_aws_get_object_example() {
         // Full end-to-end test using the AWS GET Object example.
-        let signing_key = derive_signing_key(TEST_SECRET_KEY, TEST_DATE, TEST_REGION, TEST_SERVICE);
+        let signing_key =
+            derive_signing_key(TEST_SECRET_KEY, TEST_DATE, TEST_REGION, TEST_SERVICE).unwrap();
 
         #[rustfmt::skip]
         let string_to_sign = "AWS4-HMAC-SHA256\n\
@@ -659,7 +700,7 @@ mod tests {
                               20130524/us-east-1/s3/aws4_request\n\
                               7344ae5b7ee6c3e7e6b0fe0640412a37625d1fbfff95c48bbb2dc43964946972";
 
-        let signature = compute_signature(&signing_key, string_to_sign);
+        let signature = compute_signature(&signing_key, string_to_sign).unwrap();
         assert_eq!(
             signature,
             "f0e8bdb87c964420e857bd35b5d6ed310bd44f0170aba48dd91039c6036bdb41"
@@ -684,9 +725,10 @@ mod tests {
             &hash_payload(canonical.as_bytes()),
         );
         let signature = compute_signature(
-            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3"),
+            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3").unwrap(),
             &text,
-        );
+        )
+        .unwrap();
         parts.headers.insert(
             "authorization",
             format!(
@@ -766,7 +808,7 @@ mod tests {
             hash_payload(b""),
             digest
         );
-        let signature = compute_signature(&verifier.key, &text);
+        let signature = compute_signature(&verifier.key, &text).unwrap();
         assert!(
             verifier
                 .verify_chunk(&hash_payload(b"wrong"), &signature)
@@ -877,9 +919,10 @@ mod tests {
             &hash_payload(canonical.as_bytes()),
         );
         let signature = compute_signature(
-            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3"),
+            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3").unwrap(),
             &string_to_sign,
-        );
+        )
+        .unwrap();
 
         let auth_value = format!(
             "AWS4-HMAC-SHA256 \
@@ -929,9 +972,10 @@ mod tests {
             &hash_payload(canonical.as_bytes()),
         );
         let signature = compute_signature(
-            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", service),
+            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", service).unwrap(),
             &string_to_sign,
-        );
+        )
+        .unwrap();
         let auth_value = format!(
             "AWS4-HMAC-SHA256 \
              Credential={TEST_ACCESS_KEY}/20130524/us-east-1/{service}/aws4_request,\
@@ -1067,9 +1111,10 @@ mod tests {
             &hash_payload(canonical.as_bytes()),
         );
         let signature = compute_signature(
-            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3"),
+            &derive_signing_key(TEST_SECRET_KEY, "20130524", "us-east-1", "s3").unwrap(),
             &string_to_sign,
-        );
+        )
+        .unwrap();
 
         let auth_value = format!(
             "AWS4-HMAC-SHA256 \
diff --git a/crates/rustack-core/Cargo.toml b/crates/rustack-core/Cargo.toml
index 9474e0cb..32890ce2 100644
--- a/crates/rustack-core/Cargo.toml
+++ b/crates/rustack-core/Cargo.toml
@@ -29,4 +29,6 @@ tracing = { workspace = true }
 uuid = { workspace = true }
 
 [dev-dependencies]
-tokio = { workspace = true }
+proptest = { workspace = true }
+rstest = { workspace = true }
+tokio = { workspace = true, features = ["test-util"] }
diff --git a/crates/rustack-core/src/config.rs b/crates/rustack-core/src/config.rs
index 30d7acd8..964446a2 100644
--- a/crates/rustack-core/src/config.rs
+++ b/crates/rustack-core/src/config.rs
@@ -1,6 +1,6 @@
 //! Configuration management for Rustack services.
 //!
-//! All configuration is driven by environment variables, matching LocalStack conventions.
+//! All configuration is driven by environment variables, matching `LocalStack` conventions.
 
 use crate::types::AwsRegion;
 
diff --git a/crates/rustack-core/src/http.rs b/crates/rustack-core/src/http.rs
index 6debd1f0..4223bd84 100644
--- a/crates/rustack-core/src/http.rs
+++ b/crates/rustack-core/src/http.rs
@@ -320,7 +320,7 @@ mod tests {
         }
     }
 
-    #[tokio::test]
+    #[tokio::test(start_paused = true)]
     async fn test_should_expire_pending_body_without_eof() {
         let budget = BodyBudget::new(3, Duration::from_secs(1), Duration::from_millis(5)).unwrap();
         assert!(matches!(
@@ -372,7 +372,7 @@ mod tests {
         }
     }
 
-    #[tokio::test]
+    #[tokio::test(start_paused = true)]
     async fn test_should_not_reset_total_deadline_on_progress() {
         let budget =
             BodyBudget::new(1000, Duration::from_millis(20), Duration::from_millis(10)).unwrap();
diff --git a/crates/rustack-core/src/json.rs b/crates/rustack-core/src/json.rs
new file mode 100644
index 00000000..5791623b
--- /dev/null
+++ b/crates/rustack-core/src/json.rs
@@ -0,0 +1,307 @@
+//! Bounded JSON preflight before typed deserialization.
+//!
+//! Encoded strings, decoded keys/values, aggregate members and container depth
+//! are checked without building a dynamic Value tree. Errors redact input.
+
+use std::{collections::BTreeSet, fmt, num::NonZeroUsize};
+
+use serde::{
+    Deserializer,
+    de::{DeserializeOwned, DeserializeSeed, Error, MapAccess, SeqAccess, Visitor},
+};
+
+/// Redacted JSON validation and target-schema failure classes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error)]
+#[non_exhaustive]
+pub enum JsonError {
+    /// Invalid parser limits.
+    #[error("invalid JSON limits")]
+    InvalidLimits,
+    /// Input exceeds its byte allowance.
+    #[error("JSON byte limit exceeded")]
+    Bytes,
+    /// Nested containers exceed their allowance.
+    #[error("JSON depth limit exceeded")]
+    Depth,
+    /// Aggregate object pairs/array elements exceed their allowance.
+    #[error("JSON member limit exceeded")]
+    Members,
+    /// An encoded/decoded scalar string exceeds its allowance.
+    #[error("JSON string limit exceeded")]
+    String,
+    /// A decoded object key exceeds its separate allowance.
+    #[error("JSON key limit exceeded")]
+    Key,
+    /// Two decoded keys in one object are equal.
+    #[error("duplicate JSON key")]
+    Duplicate,
+    /// Invalid JSON, including non-finite numbers.
+    #[error("invalid JSON syntax")]
+    Syntax,
+    /// Bounded JSON does not match the requested domain type.
+    #[error("invalid JSON schema")]
+    Schema,
+}
+
+/// Validated byte, container-depth, member and string/key limits.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct JsonLimits {
+    bytes: NonZeroUsize,
+    depth: NonZeroUsize,
+    members: NonZeroUsize,
+    string_bytes: NonZeroUsize,
+    key_bytes: NonZeroUsize,
+}
+
+impl JsonLimits {
+    /// Validate limits before accepting untrusted bytes.
+    ///
+    /// # Errors
+    /// Rejects zero limits, bytes over 16 MiB, depth over 64, members over 65,536,
+    /// strings over 1 MiB. Strings cannot exceed the body limit; keys cannot
+    /// exceed strings. Consumers choose their own tighter key allowance.
+    ///
+    /// ```
+    /// let limits = rustack_core::json::JsonLimits::new(1024, 8, 64, 256, 64)?;
+    /// # Ok::<(), rustack_core::json::JsonError>(())
+    /// ```
+    pub fn new(
+        bytes: usize,
+        depth: usize,
+        members: usize,
+        string_bytes: usize,
+        key_bytes: usize,
+    ) -> Result<Self, JsonError> {
+        if bytes > 16 * 1024 * 1024
+            || depth > 64
+            || members > 65_536
+            || string_bytes > 1024 * 1024
+            || string_bytes > bytes
+            || key_bytes > string_bytes
+        {
+            return Err(JsonError::InvalidLimits);
+        }
+        let nonzero = |value| NonZeroUsize::new(value).ok_or(JsonError::InvalidLimits);
+        Ok(Self {
+            bytes: nonzero(bytes)?,
+            depth: nonzero(depth)?,
+            members: nonzero(members)?,
+            string_bytes: nonzero(string_bytes)?,
+            key_bytes: nonzero(key_bytes)?,
+        })
+    }
+}
+
+/// Preflight bounded structure and decoded-key uniqueness without a value tree.
+///
+/// Depth counts containers: an object/array of scalars has depth one. Members
+/// count all object pairs and array elements across the entire input.
+///
+/// # Errors
+/// Returns a redacted syntax, duplicate or resource-limit class.
+///
+/// ```
+/// use rustack_core::json::{JsonLimits, validate};
+/// validate(br#"{"items":[1,true,null]}"#, JsonLimits::new(1024, 8, 64, 256, 64)?)?;
+/// # Ok::<(), rustack_core::json::JsonError>(())
+/// ```
+pub fn validate(input: &[u8], limits: JsonLimits) -> Result<(), JsonError> {
+    if input.len() > limits.bytes.get() {
+        return Err(JsonError::Bytes);
+    }
+    encoded_strings(input, limits.string_bytes.get())?;
+    let mut context = Scan {
+        limits,
+        remaining: limits.members.get(),
+        failure: None,
+    };
+    let mut decoder = serde_json::Deserializer::from_slice(input);
+    let result = Node {
+        context: &mut context,
+        depth: 0,
+    }
+    .deserialize(&mut decoder);
+    if result.is_err() {
+        return Err(context.failure.unwrap_or(JsonError::Syntax));
+    }
+    decoder.end().map_err(|_| JsonError::Syntax)
+}
+
+/// Preflight JSON before materializing a typed model; domain validation follows.
+///
+/// # Errors
+/// Returns preflight classes or Schema without a deserializer's input text.
+///
+/// ```
+/// use std::collections::BTreeMap;
+/// use rustack_core::json::{JsonLimits, from_slice};
+/// let model: BTreeMap<String, u64> = from_slice(br#"{"count":7}"#,
+///     JsonLimits::new(1024, 8, 64, 256, 64)?)?;
+/// assert_eq!(model.get("count"), Some(&7));
+/// # Ok::<(), rustack_core::json::JsonError>(())
+/// ```
+pub fn from_slice<T: DeserializeOwned>(input: &[u8], limits: JsonLimits) -> Result<T, JsonError> {
+    validate(input, limits)?;
+    serde_json::from_slice(input).map_err(|_| JsonError::Schema)
+}
+
+fn encoded_strings(input: &[u8], decoded_limit: usize) -> Result<(), JsonError> {
+    // A JSON escape uses at most six encoded bytes per decoded UTF-8 byte.
+    // Cap the parser's scratch space before processing escaped strings.
+    let maximum = decoded_limit
+        .checked_mul(6)
+        .ok_or(JsonError::InvalidLimits)?;
+    let mut inside = false;
+    let mut escaped = false;
+    let mut length = 0_usize;
+    for byte in input {
+        if !inside {
+            if *byte == b'"' {
+                inside = true;
+                length = 0;
+            }
+        } else if !escaped && *byte == b'"' {
+            inside = false;
+        } else {
+            length = length.checked_add(1).ok_or(JsonError::String)?;
+            if length > maximum {
+                return Err(JsonError::String);
+            }
+            escaped = !escaped && *byte == b'\\';
+        }
+    }
+    Ok(())
+}
+
+#[derive(Debug)]
+struct Scan {
+    limits: JsonLimits,
+    remaining: usize,
+    failure: Option<JsonError>,
+}
+
+impl Scan {
+    fn reject<E: Error>(&mut self, error: JsonError) -> E {
+        self.failure.get_or_insert(error);
+        E::custom("invalid bounded JSON")
+    }
+    fn member<E: Error>(&mut self) -> Result<(), E> {
+        match self.remaining.checked_sub(1) {
+            Some(remaining) => {
+                self.remaining = remaining;
+                Ok(())
+            }
+            None => Err(self.reject(JsonError::Members)),
+        }
+    }
+}
+
+#[derive(Debug)]
+struct Node<'a> {
+    context: &'a mut Scan,
+    depth: usize,
+}
+
+impl<'de> DeserializeSeed<'de> for Node<'_> {
+    type Value = ();
+    fn deserialize<D: Deserializer<'de>>(self, decoder: D) -> Result<(), D::Error> {
+        decoder.deserialize_any(self)
+    }
+}
+
+impl<'de> Visitor<'de> for Node<'_> {
+    type Value = ();
+    fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("bounded JSON")
+    }
+    fn visit_bool<E: Error>(self, _: bool) -> Result<(), E> {
+        Ok(())
+    }
+    fn visit_i64<E: Error>(self, _: i64) -> Result<(), E> {
+        Ok(())
+    }
+    fn visit_u64<E: Error>(self, _: u64) -> Result<(), E> {
+        Ok(())
+    }
+    fn visit_f64<E: Error>(self, value: f64) -> Result<(), E> {
+        if value.is_finite() {
+            Ok(())
+        } else {
+            Err(self.context.reject(JsonError::Syntax))
+        }
+    }
+    fn visit_unit<E: Error>(self) -> Result<(), E> {
+        Ok(())
+    }
+    fn visit_str<E: Error>(self, value: &str) -> Result<(), E> {
+        if value.len() > self.context.limits.string_bytes.get() {
+            return Err(self.context.reject(JsonError::String));
+        }
+        Ok(())
+    }
+    fn visit_seq<A: SeqAccess<'de>>(self, mut array: A) -> Result<(), A::Error> {
+        if self.depth >= self.context.limits.depth.get() {
+            return Err(self.context.reject(JsonError::Depth));
+        }
+        let depth = self
+            .depth
+            .checked_add(1)
+            .ok_or_else(|| self.context.reject(JsonError::Depth))?;
+        while array
+            .next_element_seed(Element {
+                context: self.context,
+                depth,
+            })?
+            .is_some()
+        {}
+        Ok(())
+    }
+    fn visit_map<A: MapAccess<'de>>(self, mut object: A) -> Result<(), A::Error> {
+        if self.depth >= self.context.limits.depth.get() {
+            return Err(self.context.reject(JsonError::Depth));
+        }
+        let depth = self
+            .depth
+            .checked_add(1)
+            .ok_or_else(|| self.context.reject(JsonError::Depth))?;
+        let mut keys = BTreeSet::new();
+        while let Some(key) = object.next_key::<String>()? {
+            self.context.member()?;
+            if key.len() > self.context.limits.key_bytes.get() {
+                return Err(self.context.reject(JsonError::Key));
+            }
+            if !keys.insert(key) {
+                return Err(self.context.reject(JsonError::Duplicate));
+            }
+            object.next_value_seed(Node {
+                context: self.context,
+                depth,
+            })?;
+        }
+        Ok(())
+    }
+}
+
+// Charge only actual elements, so an empty array remains valid after an
+// enclosing object consumes the last available member.
+#[derive(Debug)]
+struct Element<'a> {
+    context: &'a mut Scan,
+    depth: usize,
+}
+
+impl<'de> DeserializeSeed<'de> for Element<'_> {
+    type Value = ();
+    fn deserialize<D: Deserializer<'de>>(self, decoder: D) -> Result<(), D::Error> {
+        self.context.member()?;
+        Node {
+            context: self.context,
+            depth: self.depth,
+        }
+        .deserialize(decoder)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-core/src/json/tests.rs b/crates/rustack-core/src/json/tests.rs
new file mode 100644
index 00000000..ccaacfb7
--- /dev/null
+++ b/crates/rustack-core/src/json/tests.rs
@@ -0,0 +1,195 @@
+use std::collections::BTreeMap;
+
+use proptest::{
+    arbitrary::any,
+    collection::{btree_map, vec},
+    prelude::{ProptestConfig, Strategy},
+    prop_assert, prop_assert_eq, prop_oneof, proptest,
+};
+use rstest::rstest;
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+use super::*;
+
+fn limits() -> JsonLimits {
+    JsonLimits::new(16 * 1024, 16, 1024, 256, 32).unwrap()
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
+struct Model {
+    count: u32,
+}
+
+#[test]
+fn test_should_validate_before_typed_schema_and_redact_schema_errors() {
+    assert_eq!(
+        from_slice::<Model>(br#"{"count":7}"#, limits()).unwrap(),
+        Model { count: 7 }
+    );
+    let error = from_slice::<Model>(br#"{"count":"secret-schema-value"}"#, limits()).unwrap_err();
+    assert_eq!(error, JsonError::Schema);
+    assert!(!format!("{error:?} {error}").contains("secret-schema-value"));
+    assert_eq!(
+        from_slice::<Model>(br#"{"count":7,"unknown":1,"unknown":2}"#, limits()),
+        Err(JsonError::Duplicate)
+    );
+}
+
+#[rstest]
+#[case(br#"{"a":1,"a":2}"#, JsonError::Duplicate)]
+#[case(br#"{"a":1,"\u0061":2}"#, JsonError::Duplicate)]
+#[case(br#"{"x":{"a":1,"a":2}}"#, JsonError::Duplicate)]
+#[case(b"{", JsonError::Syntax)]
+#[case(b"[1,]", JsonError::Syntax)]
+#[case(b"null true", JsonError::Syntax)]
+#[case(b"", JsonError::Syntax)]
+#[case(b"01", JsonError::Syntax)]
+#[case(b"1e99999", JsonError::Syntax)]
+#[case(br#""\ud800""#, JsonError::Syntax)]
+#[case(br#""\x00""#, JsonError::Syntax)]
+#[case(&[b'"', 0xff, b'"'], JsonError::Syntax)]
+fn test_should_reject_duplicates_and_malformed_syntax(
+    #[case] input: &[u8],
+    #[case] expected: JsonError,
+) {
+    assert_eq!(validate(input, limits()), Err(expected));
+}
+
+#[test]
+fn test_should_scope_duplicate_keys_to_their_own_object() {
+    validate(br#"{"a":1,"child":{"a":2}}"#, limits()).unwrap();
+    validate(br#"[{"a":1},{"a":2}]"#, limits()).unwrap();
+    validate(br#"{"\u00e9":1,"e\u0301":2}"#, limits()).unwrap();
+}
+
+#[test]
+fn test_should_bound_container_depth_without_rejecting_scalar_children() {
+    let shallow = JsonLimits::new(1024, 1, 64, 256, 32).unwrap();
+    for input in [
+        b"{}".as_slice(),
+        b"[]",
+        b"[1,true,null]",
+        br#"{"a":1}"#,
+        b"false",
+    ] {
+        validate(input, shallow).unwrap();
+    }
+    for input in [br#"{"a":{}}"#.as_slice(), b"[[]]", br#"[{"a":1}]"#] {
+        assert_eq!(validate(input, shallow), Err(JsonError::Depth));
+    }
+    let deeply_nested = format!("{}0{}", "[".repeat(4000), "]".repeat(4000));
+    let bounded = JsonLimits::new(16 * 1024, 64, 8192, 256, 32).unwrap();
+    assert_eq!(
+        validate(deeply_nested.as_bytes(), bounded),
+        Err(JsonError::Depth)
+    );
+}
+
+#[test]
+fn test_should_count_all_object_pairs_and_array_elements_in_one_budget() {
+    let three = JsonLimits::new(1024, 8, 3, 256, 32).unwrap();
+    validate(br#"{"a":[1,2]}"#, three).unwrap();
+    assert_eq!(
+        validate(br#"{"a":[1,2,3]}"#, three),
+        Err(JsonError::Members)
+    );
+    validate(br#"{"a":{"b":1},"c":2}"#, three).unwrap();
+    assert_eq!(
+        validate(br#"{"a":{"b":1},"c":2,"d":3}"#, three),
+        Err(JsonError::Members)
+    );
+    let one = JsonLimits::new(1024, 8, 1, 256, 32).unwrap();
+    validate(br#"{"a":[]}"#, one).unwrap();
+    validate(br#"{"a":{}}"#, one).unwrap();
+    validate(b"[]", one).unwrap();
+    assert_eq!(validate(br#"{"a":[1]}"#, one), Err(JsonError::Members));
+}
+
+#[test]
+fn test_should_bound_strings_and_keys_by_decoded_utf8_bytes_and_encoded_work() {
+    let small = JsonLimits::new(1024, 8, 64, 2, 1).unwrap();
+    validate("\"é\"".as_bytes(), small).unwrap();
+    validate(br#""\u00e9""#, small).unwrap();
+    assert_eq!(validate("\"界\"".as_bytes(), small), Err(JsonError::String));
+    assert_eq!(validate(br#""\u754c""#, small), Err(JsonError::String));
+    assert_eq!(validate("{\"é\":1}".as_bytes(), small), Err(JsonError::Key));
+    assert_eq!(validate(br#"{"\u00e9":1}"#, small), Err(JsonError::Key));
+    let many_escapes = format!("\"{}\"", "\\u0061".repeat(100));
+    assert_eq!(
+        validate(many_escapes.as_bytes(), small),
+        Err(JsonError::String)
+    );
+    validate(br#""\\""#, small).unwrap();
+    validate(br#""\"""#, small).unwrap();
+    let raised_key_limit = JsonLimits::new(1024, 1, 1, 512, 512).unwrap();
+    let long_key = format!("{{\"{}\":0}}", "k".repeat(300));
+    validate(long_key.as_bytes(), raised_key_limit).unwrap();
+    assert_eq!(validate(long_key.as_bytes(), limits()), Err(JsonError::Key));
+}
+
+#[test]
+fn test_should_enforce_input_bytes_before_lexical_processing() {
+    let tiny = JsonLimits::new(4, 1, 1, 4, 4).unwrap();
+    validate(b"null", tiny).unwrap();
+    assert_eq!(validate(b"null ", tiny), Err(JsonError::Bytes));
+    assert_eq!(validate(&[0xff; 5], tiny), Err(JsonError::Bytes));
+}
+
+#[test]
+fn test_should_reject_invalid_limit_relationships_and_ranges() {
+    for args in [
+        (0, 1, 1, 1, 1),
+        (1, 0, 1, 1, 1),
+        (1, 1, 0, 1, 1),
+        (1, 1, 1, 0, 1),
+        (1, 1, 1, 1, 0),
+        (16 * 1024 * 1024 + 1, 1, 1, 1, 1),
+        (1024, 65, 1, 1, 1),
+        (1024, 1, 65_537, 1, 1),
+        (2 * 1024 * 1024, 1, 1, 1024 * 1024 + 1, 1),
+        (1024, 1, 1, 256, 257),
+        (1024, 1, 1, 1, 2),
+        (1, 1, 1, 2, 1),
+    ] {
+        assert!(matches!(
+            JsonLimits::new(args.0, args.1, args.2, args.3, args.4),
+            Err(JsonError::InvalidLimits)
+        ));
+    }
+}
+
+fn values() -> impl Strategy<Value = Value> {
+    prop_oneof![
+        any::<bool>().prop_map(Value::Bool),
+        any::<i32>().prop_map(|value| json!(value)),
+        "[a-zA-Z0-9é界\\\"\n]{0,16}".prop_map(Value::String),
+        proptest::strategy::Just(Value::Null),
+    ]
+    .prop_recursive(3, 64, 4, |inner| {
+        prop_oneof![
+            vec(inner.clone(), 0..4).prop_map(Value::Array),
+            btree_map("[a-z]{1,8}", inner, 0..4)
+                .prop_map(|map: BTreeMap<String, Value>| Value::Object(map.into_iter().collect())),
+        ]
+    })
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+
+    #[test]
+    fn test_should_never_panic_on_bounded_malformed_json(input in vec(any::<u8>(), 0..4096)) {
+        let result = validate(&input, JsonLimits::new(4096, 8, 64, 64, 32).unwrap());
+        if result.is_ok() { prop_assert!(serde_json::from_slice::<Value>(&input).is_ok()); }
+    }
+
+    #[test]
+    fn test_should_preserve_bounded_recursive_values(value in values()) {
+        let bytes = serde_json::to_vec(&value).unwrap();
+        prop_assert!(bytes.len() <= 16 * 1024);
+        let parsed: Value = from_slice(&bytes, limits()).unwrap();
+        prop_assert_eq!(parsed, value);
+    }
+}
diff --git a/crates/rustack-core/src/lib.rs b/crates/rustack-core/src/lib.rs
index 9a3f3640..6c1b8d54 100644
--- a/crates/rustack-core/src/lib.rs
+++ b/crates/rustack-core/src/lib.rs
@@ -4,9 +4,12 @@
 //! Rustack service implementations, including multi-account/multi-region
 //! state management, configuration, and common AWS type definitions.
 
+#![forbid(unsafe_code)]
+
 mod config;
 mod error;
 pub mod http;
+pub mod json;
 pub mod settings;
 mod state;
 mod types;
diff --git a/crates/rustack-core/src/settings.rs b/crates/rustack-core/src/settings.rs
index d30fb025..cad81cff 100644
--- a/crates/rustack-core/src/settings.rs
+++ b/crates/rustack-core/src/settings.rs
@@ -22,6 +22,7 @@ const SERVICE_NAMES: &[&str] = &[
     "SSM",
     "SNS",
     "LAMBDA",
+    "STEPFUNCTIONS",
     "EVENTS",
     "LOGS",
     "KMS",
@@ -56,6 +57,21 @@ const KEYS: &[&str] = &[
     "S3_DOMAIN",
     "S3_MAX_MEMORY_OBJECT_SIZE",
     "LAMBDA_DOCKER_ENABLED",
+    "LAMBDA_DOCKER_SOCKET",
+    "LAMBDA_DOCKER_RELAY_IMAGE",
+    "LAMBDA_DOCKER_NETWORK",
+    "LAMBDA_DOCKER_PULL_POLICY",
+    "LAMBDA_DOCKER_REGISTRIES",
+    "LAMBDA_DOCKER_REGISTRY_AUTH_FILE",
+    "LAMBDA_DOCKER_GATEWAY_ENDPOINT",
+    "LAMBDA_DOCKER_SDK_ACCESS_KEY_ID",
+    "LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY",
+    "LAMBDA_DOCKER_UID",
+    "LAMBDA_DOCKER_GID",
+    "LAMBDA_DOCKER_CPU",
+    "LAMBDA_DOCKER_LOG_RING_BYTES",
+    "LAMBDA_DOCKER_CROSS_ARCHITECTURE",
+    "LAMBDA_DOCKER_ZIP_IMAGE",
     "LAMBDA_EXECUTOR",
     "LAMBDA_MAX_WARM_INSTANCES",
     "LAMBDA_IDLE_TIMEOUT_SECS",
@@ -101,6 +117,85 @@ static SETTINGS: OnceLock<ValidatedSettings> = OnceLock::new();
 #[non_exhaustive]
 #[serde(default, rename_all = "camelCase", deny_unknown_fields)]
 pub struct RuntimeBudgets {
+    /// Maximum busy, idle and quarantined Docker environments.
+    pub lambda_docker_environments: usize,
+    /// Aggregate Docker environment and relay memory capacity.
+    pub lambda_docker_memory_bytes: u64,
+    /// Absolute Docker pull queue and progress deadline.
+    pub lambda_docker_pull_seconds: u64,
+    /// Accepted queued and running Docker deployments.
+    pub lambda_docker_deployment_jobs: usize,
+    /// Absolute Docker deployment preparation deadline.
+    pub lambda_docker_deployment_seconds: u64,
+    /// Retained preparing, live and quarantined private image pins.
+    pub lambda_docker_image_pins: usize,
+    /// Independent Docker management and control IO deadline.
+    pub lambda_docker_io_seconds: u64,
+    /// Code archive upload IO budget, independently bounded by cold startup.
+    pub lambda_docker_code_upload_seconds: u64,
+    /// Docker startup and probe observation deadline.
+    pub lambda_docker_start_seconds: u64,
+    /// Independent Docker cleanup observation deadline.
+    pub lambda_docker_cleanup_seconds: u64,
+
+    /// Accepted workflow API requests, including ready replies.
+    pub workflow_api_accepted: usize,
+    /// Retained workflow API preparation/response CPU workers.
+    pub workflow_api_workers: usize,
+    /// Incremental workflow pagination capture bytes.
+    pub workflow_pagination_bytes: usize,
+    /// Live immutable workflow continuation handles.
+    pub workflow_pagination_tokens: usize,
+    /// Current workflow state machines.
+    pub workflow_registry_machines: usize,
+    /// Retained workflow definition and tag versions, independently.
+    pub workflow_registry_versions: usize,
+    /// Retained workflow execution records.
+    pub workflow_registry_records: usize,
+    /// Accepted workflow registry commands.
+    pub workflow_registry_commands: usize,
+    /// Workflow execution name claims retained for ninety days.
+    pub workflow_name_tombstones: usize,
+    /// Terminal workflow record retention in seconds.
+    pub workflow_retention_seconds: u64,
+    /// Live and unsettled workflow executions.
+    pub workflow_open_executions: usize,
+    /// Retained workflow runtime CPU workers.
+    pub workflow_evaluations: usize,
+    /// Concurrent workflow Task dispatches.
+    pub workflow_dispatches: usize,
+    /// Global retained frame slots, including root and ancestor leases.
+    pub workflow_frames: usize,
+    /// Retained frame slots per execution.
+    pub workflow_frames_per_execution: usize,
+    /// Global intermediate indexed result storage bytes.
+    pub workflow_result_bytes: usize,
+    /// Intermediate indexed result storage bytes per execution.
+    pub workflow_result_bytes_per_execution: usize,
+    /// Independent workflow execution duration ceiling.
+    pub workflow_max_duration_seconds: u64,
+    /// Maximum transitions per workflow execution.
+    pub workflow_transitions: u32,
+    /// Retained history bytes per workflow execution.
+    pub workflow_history_bytes: usize,
+    /// Conservative workflow snapshot copy and per-part encoded byte ceiling.
+    pub workflow_snapshot_bytes: usize,
+    /// Global retained workflow history bytes.
+    pub workflow_total_history_bytes: usize,
+    /// Accepted and quarantined workflow Lambda bridge calls.
+    pub workflow_lambda_accepted_calls: usize,
+    /// Initial workflow Lambda cleanup observation budget.
+    pub workflow_lambda_cleanup_seconds: u64,
+    /// Grace interval before cancelling remaining workflows.
+    pub workflow_drain_seconds: u64,
+    /// Live callback token attempts, including provisional completion.
+    pub workflow_callback_tokens: usize,
+    /// Retained active and closed callback classification entries.
+    pub workflow_callback_tombstones: usize,
+    /// Accepted callback commands, including ready acknowledgments.
+    pub workflow_callback_commands: usize,
+    /// Retained callback mint entropy workers.
+    pub workflow_callback_workers: usize,
     /// Maximum live HTTP connections.
     pub connections: usize,
     /// Maximum concurrently active business requests, including response bodies.
@@ -113,6 +208,8 @@ pub struct RuntimeBudgets {
     pub lambda_invoke_seconds: u64,
     /// Total graceful shutdown deadline in seconds.
     pub shutdown_seconds: u64,
+    /// Absolute process startup budget, including Docker qualification and snapshots.
+    pub startup_seconds: u64,
     /// Maximum aggregate control-plane body bytes.
     pub control_body_bytes: u64,
     /// Maximum Lambda ZIP JSON envelope bytes.
@@ -132,12 +229,53 @@ pub struct RuntimeBudgets {
 impl Default for RuntimeBudgets {
     fn default() -> Self {
         Self {
+            lambda_docker_environments: 32,
+            lambda_docker_memory_bytes: 8_589_934_592,
+            lambda_docker_pull_seconds: 300,
+            lambda_docker_deployment_jobs: 8,
+            lambda_docker_deployment_seconds: 300,
+            lambda_docker_image_pins: 1024,
+            lambda_docker_io_seconds: 5,
+            lambda_docker_code_upload_seconds: 60,
+            lambda_docker_start_seconds: 15,
+            lambda_docker_cleanup_seconds: 10,
+
+            workflow_api_accepted: 32,
+            workflow_api_workers: 8,
+            workflow_pagination_bytes: 67_108_864,
+            workflow_pagination_tokens: 10_000,
+            workflow_registry_machines: 256,
+            workflow_registry_versions: 1024,
+            workflow_registry_records: 10_000,
+            workflow_registry_commands: 128,
+            workflow_name_tombstones: 100_000,
+            workflow_retention_seconds: 86_400,
+            workflow_open_executions: 128,
+            workflow_evaluations: 8,
+            workflow_dispatches: 32,
+            workflow_frames: 4096,
+            workflow_frames_per_execution: 512,
+            workflow_result_bytes: 268_435_456,
+            workflow_result_bytes_per_execution: 33_554_432,
+            workflow_max_duration_seconds: 3600,
+            workflow_transitions: 100_000,
+            workflow_history_bytes: 33_554_432,
+            workflow_snapshot_bytes: 536_870_912,
+            workflow_total_history_bytes: 268_435_456,
+            workflow_lambda_accepted_calls: 128,
+            workflow_lambda_cleanup_seconds: 10,
+            workflow_drain_seconds: 5,
+            workflow_callback_tokens: 4096,
+            workflow_callback_tombstones: 100_000,
+            workflow_callback_commands: 1024,
+            workflow_callback_workers: 8,
             connections: 256,
             requests: 128,
             header_seconds: 5,
             request_seconds: 30,
             lambda_invoke_seconds: 930,
             shutdown_seconds: 30,
+            startup_seconds: 600,
             control_body_bytes: 16 * 1024 * 1024,
             lambda_code_body_bytes: 96 * 1024 * 1024,
             upstream_body_bytes: 64 * 1024 * 1024,
@@ -155,6 +293,23 @@ impl RuntimeBudgets {
     /// # Errors
     /// Rejects zero, excessive, or inconsistent resource deadlines and sizes.
     pub fn validate(&self) -> Result<(), SettingsError> {
+        self.validate_docker()?;
+        self.validate_workflow_api()?;
+        self.validate_workflow_execution()?;
+        self.validate_workflow_frames()?;
+        self.validate_workflow_callbacks()?;
+        if self.workflow_api_workers > self.workflow_api_accepted {
+            return Err(invalid(
+                "budgets.workflowApiWorkers",
+                "must not exceed accepted requests",
+            ));
+        }
+        if self.workflow_history_bytes > self.workflow_total_history_bytes {
+            return Err(invalid(
+                "budgets.workflowHistoryBytes",
+                "must not exceed total history bytes",
+            ));
+        }
         for (key, value, max) in [
             ("budgets.connections", self.connections as u64, 65_536),
             ("budgets.requests", self.requests as u64, 65_536),
@@ -166,6 +321,7 @@ impl RuntimeBudgets {
                 3600,
             ),
             ("budgets.shutdownSeconds", self.shutdown_seconds, 3600),
+            ("budgets.startupSeconds", self.startup_seconds, 3600),
             (
                 "budgets.controlBodyBytes",
                 self.control_body_bytes,
@@ -208,6 +364,299 @@ impl RuntimeBudgets {
         }
         Ok(())
     }
+    fn validate_docker(&self) -> Result<(), SettingsError> {
+        for (key, value, min, max) in [
+            (
+                "lambdaDockerEnvironments",
+                self.lambda_docker_environments as u64,
+                1,
+                32,
+            ),
+            (
+                "lambdaDockerMemoryBytes",
+                self.lambda_docker_memory_bytes,
+                268_435_456,
+                1_099_511_627_776,
+            ),
+            (
+                "lambdaDockerPullSeconds",
+                self.lambda_docker_pull_seconds,
+                1,
+                600,
+            ),
+            (
+                "lambdaDockerDeploymentJobs",
+                self.lambda_docker_deployment_jobs as u64,
+                1,
+                32,
+            ),
+            (
+                "lambdaDockerDeploymentSeconds",
+                self.lambda_docker_deployment_seconds,
+                1,
+                3600,
+            ),
+            (
+                "lambdaDockerImagePins",
+                self.lambda_docker_image_pins as u64,
+                1,
+                8192,
+            ),
+            (
+                "lambdaDockerIoSeconds",
+                self.lambda_docker_io_seconds,
+                1,
+                60,
+            ),
+            (
+                "lambdaDockerCodeUploadSeconds",
+                self.lambda_docker_code_upload_seconds,
+                1,
+                600,
+            ),
+            (
+                "lambdaDockerStartSeconds",
+                self.lambda_docker_start_seconds,
+                1,
+                60,
+            ),
+            (
+                "lambdaDockerCleanupSeconds",
+                self.lambda_docker_cleanup_seconds,
+                1,
+                60,
+            ),
+        ] {
+            if !(min..=max).contains(&value) {
+                return Err(invalid(
+                    &format!("budgets.{key}"),
+                    "outside supported range",
+                ));
+            }
+        }
+        if self.lambda_docker_deployment_jobs > self.lambda_docker_image_pins {
+            return Err(invalid(
+                "budgets.lambdaDockerDeploymentJobs",
+                "must not exceed image pins",
+            ));
+        }
+        Ok(())
+    }
+    fn validate_workflow_api(&self) -> Result<(), SettingsError> {
+        for (key, value, min, max) in [
+            (
+                "budgets.workflowApiAccepted",
+                self.workflow_api_accepted as u64,
+                1,
+                128,
+            ),
+            (
+                "budgets.workflowApiWorkers",
+                self.workflow_api_workers as u64,
+                1,
+                32,
+            ),
+            (
+                "budgets.workflowPaginationBytes",
+                self.workflow_pagination_bytes as u64,
+                8_388_608,
+                1_073_741_824,
+            ),
+            (
+                "budgets.workflowPaginationTokens",
+                self.workflow_pagination_tokens as u64,
+                1,
+                100_000,
+            ),
+            (
+                "budgets.workflowRegistryMachines",
+                self.workflow_registry_machines as u64,
+                1,
+                4096,
+            ),
+            (
+                "budgets.workflowRegistryVersions",
+                self.workflow_registry_versions as u64,
+                1,
+                4096,
+            ),
+            (
+                "budgets.workflowRegistryRecords",
+                self.workflow_registry_records as u64,
+                1,
+                100_000,
+            ),
+            (
+                "budgets.workflowRegistryCommands",
+                self.workflow_registry_commands as u64,
+                1,
+                1024,
+            ),
+            (
+                "budgets.workflowNameTombstones",
+                self.workflow_name_tombstones as u64,
+                1,
+                1_000_000,
+            ),
+            (
+                "budgets.workflowRetentionSeconds",
+                self.workflow_retention_seconds,
+                60,
+                7_776_000,
+            ),
+        ] {
+            if !(min..=max).contains(&value) {
+                return Err(invalid(key, "outside supported workflow range"));
+            }
+        }
+        Ok(())
+    }
+    fn validate_workflow_frames(&self) -> Result<(), SettingsError> {
+        for (key, value, min, max) in [
+            ("budgets.workflowFrames", self.workflow_frames, 1, 4096),
+            (
+                "budgets.workflowFramesPerExecution",
+                self.workflow_frames_per_execution,
+                1,
+                512,
+            ),
+            (
+                "budgets.workflowResultBytes",
+                self.workflow_result_bytes,
+                4096,
+                1024 * 1024 * 1024,
+            ),
+            (
+                "budgets.workflowResultBytesPerExecution",
+                self.workflow_result_bytes_per_execution,
+                4096,
+                128 * 1024 * 1024,
+            ),
+        ] {
+            if !(min..=max).contains(&value) {
+                return Err(invalid(key, "outside supported workflow frame range"));
+            }
+        }
+        if self.workflow_frames_per_execution > self.workflow_frames
+            || self.workflow_result_bytes_per_execution > self.workflow_result_bytes
+        {
+            return Err(invalid(
+                "budgets.workflowFrames",
+                "per-execution frame/result limits must not exceed global limits",
+            ));
+        }
+        Ok(())
+    }
+    fn validate_workflow_callbacks(&self) -> Result<(), SettingsError> {
+        for (key, value, maximum) in [
+            (
+                "budgets.workflowCallbackTokens",
+                self.workflow_callback_tokens,
+                65_536,
+            ),
+            (
+                "budgets.workflowCallbackTombstones",
+                self.workflow_callback_tombstones,
+                1_000_000,
+            ),
+            (
+                "budgets.workflowCallbackCommands",
+                self.workflow_callback_commands,
+                100_000,
+            ),
+            (
+                "budgets.workflowCallbackWorkers",
+                self.workflow_callback_workers,
+                128,
+            ),
+        ] {
+            if !(1..=maximum).contains(&value) {
+                return Err(invalid(key, "outside supported callback range"));
+            }
+        }
+        if self.workflow_callback_tombstones < self.workflow_callback_tokens {
+            return Err(invalid(
+                "budgets.workflowCallbackTombstones",
+                "must include live token reservations",
+            ));
+        }
+        Ok(())
+    }
+    fn validate_workflow_execution(&self) -> Result<(), SettingsError> {
+        for (key, value, min, max) in [
+            (
+                "budgets.workflowOpenExecutions",
+                self.workflow_open_executions as u64,
+                1,
+                4096,
+            ),
+            (
+                "budgets.workflowEvaluations",
+                self.workflow_evaluations as u64,
+                1,
+                128,
+            ),
+            (
+                "budgets.workflowDispatches",
+                self.workflow_dispatches as u64,
+                1,
+                1024,
+            ),
+            (
+                "budgets.workflowMaxDurationSeconds",
+                self.workflow_max_duration_seconds,
+                1,
+                31_536_000,
+            ),
+            (
+                "budgets.workflowTransitions",
+                u64::from(self.workflow_transitions),
+                1,
+                1_000_000,
+            ),
+            (
+                "budgets.workflowHistoryBytes",
+                self.workflow_history_bytes as u64,
+                1_048_576,
+                268_435_456,
+            ),
+            (
+                "budgets.workflowSnapshotBytes",
+                self.workflow_snapshot_bytes as u64,
+                1_048_576,
+                1_073_741_824,
+            ),
+            (
+                "budgets.workflowTotalHistoryBytes",
+                self.workflow_total_history_bytes as u64,
+                8_388_608,
+                4_294_967_296,
+            ),
+            (
+                "budgets.workflowLambdaAcceptedCalls",
+                self.workflow_lambda_accepted_calls as u64,
+                1,
+                1024,
+            ),
+            (
+                "budgets.workflowLambdaCleanupSeconds",
+                self.workflow_lambda_cleanup_seconds,
+                1,
+                60,
+            ),
+            (
+                "budgets.workflowDrainSeconds",
+                self.workflow_drain_seconds,
+                0,
+                60,
+            ),
+        ] {
+            if !(min..=max).contains(&value) {
+                return Err(invalid(key, "outside supported workflow range"));
+            }
+        }
+        Ok(())
+    }
 }
 
 #[derive(Deserialize, Default)]
@@ -436,7 +885,12 @@ fn validate_value(key: &str, value: &mut String) -> Result<(), SettingsError> {
     if value.is_empty() && key != "SERVICES" {
         return Err(invalid(key, "must not be empty"));
     }
-    if value.len() > 4096 || value.chars().any(char::is_control) {
+    let maximum = if key == "LAMBDA_DOCKER_REGISTRIES" {
+        8127
+    } else {
+        4096
+    };
+    if value.len() > maximum || value.chars().any(char::is_control) {
         return Err(invalid(
             key,
             "exceeds byte limit or contains control characters",
@@ -448,6 +902,7 @@ fn validate_value(key: &str, value: &mut String) -> Result<(), SettingsError> {
             "PERSISTENCE"
                 | "S3_VIRTUAL_HOSTING"
                 | "LAMBDA_DOCKER_ENABLED"
+                | "LAMBDA_DOCKER_CROSS_ARCHITECTURE"
                 | "CLOUDFRONT_DETERMINISTIC_IDS"
                 | "CLOUDFRONT_FAIL_ON_FUNCTION"
                 | "CLOUDFRONT_FORWARD_USER_METADATA"
@@ -657,6 +1112,136 @@ pub fn advertised_endpoint() -> Option<&'static str> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_should_validate_workflow_budgets_and_strict_credentials() -> Result<(), SettingsError> {
+        let config = ValidatedSettings::parse(
+            "environment:\n  STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION: false\nbudgets:\n  \
+             workflowDrainSeconds: 0\n  workflowApiAccepted: 2\n  workflowApiWorkers: 1",
+            &BTreeMap::new(),
+        )?;
+        assert!(
+            config
+                .validate_credentials(&["stepfunctions".to_owned()])
+                .is_err()
+        );
+        assert_eq!(config.budgets().workflow_drain_seconds, 0);
+        for setting in [
+            "workflowApiAccepted: 0",
+            "workflowApiWorkers: 33",
+            "workflowPaginationBytes: 8388607",
+            "workflowPaginationTokens: 100001",
+            "workflowRegistryMachines: 4097",
+            "workflowRegistryVersions: 0",
+            "workflowRegistryRecords: 100001",
+            "workflowRegistryCommands: 1025",
+            "workflowNameTombstones: 0",
+            "workflowRetentionSeconds: 59",
+            "workflowOpenExecutions: 0",
+            "workflowEvaluations: 129",
+            "workflowDispatches: 1025",
+            "workflowFrames: 0",
+            "workflowFrames: 4097",
+            "workflowFramesPerExecution: 513",
+            "workflowResultBytes: 4095",
+            "workflowResultBytes: 1073741825",
+            "workflowResultBytesPerExecution: 134217729",
+            "workflowFrames: 1\n  workflowFramesPerExecution: 2",
+            "workflowResultBytes: 4096\n  workflowResultBytesPerExecution: 4097",
+            "workflowMaxDurationSeconds: 0",
+            "workflowTransitions: 1000001",
+            "workflowHistoryBytes: 1048575",
+            "workflowSnapshotBytes: 1048575",
+            "workflowSnapshotBytes: 1073741825",
+            "workflowTotalHistoryBytes: 4294967297",
+            "workflowLambdaAcceptedCalls: 0",
+            "workflowLambdaCleanupSeconds: 61",
+            "workflowDrainSeconds: 61",
+            "workflowCallbackTokens: 0",
+            "workflowCallbackTokens: 65537",
+            "workflowCallbackTombstones: 1000001",
+            "workflowCallbackTombstones: 1\n  workflowCallbackTokens: 2",
+            "workflowCallbackCommands: 0",
+            "workflowCallbackCommands: 100001",
+            "workflowCallbackWorkers: 0",
+            "workflowCallbackWorkers: 129",
+            "workflowApiAccepted: 1\n  workflowApiWorkers: 2",
+            "workflowHistoryBytes: 33554432\n  workflowTotalHistoryBytes: 8388608",
+        ] {
+            assert!(
+                ValidatedSettings::parse(&format!("budgets:\n  {setting}"), &BTreeMap::new())
+                    .is_err(),
+                "{setting}"
+            );
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_enforce_exact_frame_and_result_configuration_bounds() -> Result<(), SettingsError>
+    {
+        for (frames, local_frames, results, local_results) in [
+            (1, 1, 4096, 4096),
+            (4096, 512, 1024 * 1024 * 1024, 128 * 1024 * 1024),
+        ] {
+            let config = ValidatedSettings::parse(
+                &format!(
+                    "budgets:\n  workflowFrames: {frames}\n  workflowFramesPerExecution: \
+                     {local_frames}\n  workflowResultBytes: {results}\n  \
+                     workflowResultBytesPerExecution: {local_results}\n"
+                ),
+                &BTreeMap::new(),
+            )?;
+            assert_eq!(config.budgets().workflow_frames, frames);
+            assert_eq!(config.budgets().workflow_frames_per_execution, local_frames);
+            assert_eq!(config.budgets().workflow_result_bytes, results);
+            assert_eq!(
+                config.budgets().workflow_result_bytes_per_execution,
+                local_results
+            );
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_enforce_exact_callback_configuration_bounds_and_defaults()
+    -> Result<(), SettingsError> {
+        let defaults = RuntimeBudgets::default();
+        assert_eq!(
+            (
+                defaults.workflow_callback_tokens,
+                defaults.workflow_callback_tombstones,
+                defaults.workflow_callback_commands,
+                defaults.workflow_callback_workers
+            ),
+            (4096, 100_000, 1024, 8)
+        );
+        for (tokens, retained, commands, workers, seconds) in [
+            (1, 1, 1, 1, 60),
+            (65_536, 1_000_000, 100_000, 128, 7_776_000),
+        ] {
+            let config = ValidatedSettings::parse(
+                &format!(
+                    "budgets:\n  workflowCallbackTokens: {tokens}\n  workflowCallbackTombstones: \
+                     {retained}\n  workflowCallbackCommands: {commands}\n  \
+                     workflowCallbackWorkers: {workers}\n  workflowRetentionSeconds: {seconds}\n"
+                ),
+                &BTreeMap::new(),
+            )?;
+            let budgets = config.budgets();
+            assert_eq!(
+                (
+                    budgets.workflow_callback_tokens,
+                    budgets.workflow_callback_tombstones,
+                    budgets.workflow_callback_commands,
+                    budgets.workflow_callback_workers,
+                    budgets.workflow_retention_seconds
+                ),
+                (tokens, retained, commands, workers, seconds)
+            );
+        }
+        Ok(())
+    }
+
     #[test]
     fn test_should_apply_environment_over_yaml_and_derive_ipv6_endpoint()
     -> Result<(), SettingsError> {
@@ -701,3 +1286,104 @@ mod tests {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod docker_tests {
+    use std::collections::BTreeMap;
+
+    use super::{RuntimeBudgets, ValidatedSettings};
+    #[test]
+    fn test_should_accept_docker_yaml_keys_budgets_and_process_precedence() {
+        let yaml = "environment:\n  LAMBDA_DOCKER_RELAY_IMAGE: local:v1\n  LAMBDA_DOCKER_NETWORK: \
+                    none\n  LAMBDA_DOCKER_PULL_POLICY: never\n  LAMBDA_DOCKER_CROSS_ARCHITECTURE: \
+                    yes\nbudgets:\n  lambdaDockerPullSeconds: 1\n  lambdaDockerImagePins: 32\n  \
+                    lambdaDockerDeploymentJobs: 32\n";
+        let settings = ValidatedSettings::parse(
+            yaml,
+            &BTreeMap::from([("LAMBDA_DOCKER_RELAY_IMAGE".into(), "override:v2".into())]),
+        )
+        .unwrap();
+        assert_eq!(
+            settings.get("LAMBDA_DOCKER_RELAY_IMAGE"),
+            Some("override:v2")
+        );
+        assert_eq!(
+            settings.get("LAMBDA_DOCKER_CROSS_ARCHITECTURE"),
+            Some("true")
+        );
+        assert_eq!(settings.budgets().lambda_docker_pull_seconds, 1);
+        assert_eq!(RuntimeBudgets::default().lambda_docker_pull_seconds, 300);
+    }
+    #[test]
+    fn test_should_reject_every_docker_budget_outside_its_supported_range() {
+        for (key, min, max) in [
+            ("lambdaDockerEnvironments", 1_u64, 32_u64),
+            ("lambdaDockerMemoryBytes", 268_435_456, 1_099_511_627_776),
+            ("lambdaDockerPullSeconds", 1, 600),
+            ("lambdaDockerDeploymentJobs", 1, 32),
+            ("lambdaDockerDeploymentSeconds", 1, 3600),
+            ("lambdaDockerImagePins", 1, 8192),
+            ("lambdaDockerIoSeconds", 1, 60),
+            ("lambdaDockerCodeUploadSeconds", 1, 600),
+            ("lambdaDockerStartSeconds", 1, 60),
+            ("lambdaDockerCleanupSeconds", 1, 60),
+        ] {
+            for value in [min - 1, max + 1] {
+                let raw = format!("budgets:\n  {key}: {value}\n");
+                assert!(
+                    ValidatedSettings::parse(&raw, &BTreeMap::new()).is_err(),
+                    "{key}"
+                );
+            }
+            for value in [min, max] {
+                let raw = format!("budgets:\n  lambdaDockerDeploymentJobs: 1\n  {key}: {value}\n");
+                // Avoid duplicate keys when the row itself is deployment jobs.
+                let raw = if key == "lambdaDockerDeploymentJobs" {
+                    format!("budgets:\n  {key}: {value}\n")
+                } else {
+                    raw
+                };
+                assert!(
+                    ValidatedSettings::parse(&raw, &BTreeMap::new()).is_ok(),
+                    "{key}"
+                );
+            }
+        }
+        assert!(
+            ValidatedSettings::parse(
+                "budgets:\n  lambdaDockerImagePins: 1\n  lambdaDockerDeploymentJobs: 2",
+                &BTreeMap::new()
+            )
+            .is_err()
+        );
+    }
+}
+
+#[cfg(test)]
+mod startup_tests {
+    use std::collections::BTreeMap;
+
+    use super::{RuntimeBudgets, ValidatedSettings};
+    #[test]
+    fn test_should_bound_one_process_startup_budget_independently_of_shutdown() {
+        assert_eq!(RuntimeBudgets::default().startup_seconds, 600);
+        for seconds in [0, 3601] {
+            assert!(
+                ValidatedSettings::parse(
+                    &format!("budgets:\n  startupSeconds: {seconds}\n"),
+                    &BTreeMap::new()
+                )
+                .is_err()
+            );
+        }
+        for seconds in [1, 3600] {
+            let settings = ValidatedSettings::parse(
+                &format!("budgets:\n  startupSeconds: {seconds}\n  shutdownSeconds: 10\n"),
+                &BTreeMap::new(),
+            )
+            .unwrap();
+            assert_eq!(settings.budgets().startup_seconds, seconds);
+            assert_eq!(settings.budgets().shutdown_seconds, 10);
+        }
+    }
+}
diff --git a/crates/rustack-core/src/state.rs b/crates/rustack-core/src/state.rs
index 16ef0774..d53f8d4d 100644
--- a/crates/rustack-core/src/state.rs
+++ b/crates/rustack-core/src/state.rs
@@ -1,7 +1,7 @@
 //! Multi-account, multi-region state management.
 //!
 //! Provides [`AccountRegionStore`], a thread-safe concurrent store that
-//! partitions state by AWS account ID and region, matching LocalStack's
+//! partitions state by AWS account ID and region, matching `LocalStack`'s
 //! `AccountRegionBundle` pattern.
 
 use std::sync::Arc;
diff --git a/crates/rustack-core/src/types.rs b/crates/rustack-core/src/types.rs
index 76ee8100..aeb9f3a1 100644
--- a/crates/rustack-core/src/types.rs
+++ b/crates/rustack-core/src/types.rs
@@ -7,7 +7,7 @@ use std::fmt;
 pub struct AccountId(String);
 
 impl AccountId {
-    /// Default account ID used by LocalStack.
+    /// Default account ID used by `LocalStack`.
     pub const DEFAULT: &str = "000000000000";
 
     /// Create a new account ID from a string.
@@ -46,7 +46,7 @@ impl fmt::Display for AccountId {
 pub struct AwsRegion(String);
 
 impl AwsRegion {
-    /// Default region used by LocalStack.
+    /// Default region used by `LocalStack`.
     pub const DEFAULT: &str = "us-east-1";
 
     /// Create a new region.
diff --git a/crates/rustack-lambda-core/Cargo.toml b/crates/rustack-lambda-core/Cargo.toml
index 9e932cf7..f16c5259 100644
--- a/crates/rustack-lambda-core/Cargo.toml
+++ b/crates/rustack-lambda-core/Cargo.toml
@@ -14,25 +14,42 @@ workspace = true
 rustack-core = { workspace = true }
 rustack-lambda-model = { workspace = true }
 rustack-lambda-http = { workspace = true }
+rustack-lambda-runtime = { workspace = true }
 rustack-auth = { workspace = true }
 squib = { workspace = true }
 http = { workspace = true }
 bytes = { workspace = true }
+bollard-stubs = { workspace = true }
+percent-encoding = { workspace = true }
+form_urlencoded = { workspace = true }
+typed-builder = { workspace = true }
+winnow = { workspace = true }
 dashmap = { workspace = true }
 serde = { workspace = true }
-serde_json = { workspace = true }
+serde_json = { workspace = true, features = ["raw_value"] }
 chrono = { workspace = true }
 uuid = { workspace = true }
 tracing = { workspace = true }
 thiserror = { workspace = true }
+nix = { workspace = true }
 anyhow = { workspace = true }
 tokio = { workspace = true }
 sha2 = { workspace = true }
+hex = { workspace = true }
 base64 = { workspace = true }
+secrecy = { workspace = true }
+yaml-rust2 = { workspace = true }
 async-trait = { workspace = true }
 tempfile = { workspace = true }
 zip = { workspace = true }
+tar = { workspace = true }
 hyper = { workspace = true }
 hyper-util = { workspace = true }
 http-body-util = { workspace = true }
 parking_lot = { workspace = true }
+
+[dev-dependencies]
+proptest = { workspace = true }
+rstest = { workspace = true }
+tracing-subscriber = { workspace = true }
+tokio = { workspace = true, features = ["test-util"] }
diff --git a/crates/rustack-lambda-core/src/artifact.rs b/crates/rustack-lambda-core/src/artifact.rs
new file mode 100644
index 00000000..fa4a3e4a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/artifact.rs
@@ -0,0 +1,205 @@
+//! Owned, validated deployment artifacts shared by captured execution requests.
+//!
+//! ZIP leases keep successfully staged code alive through invocation cleanup.
+//! Images carry immutable daemon identity rather than an unresolved mutable tag.
+
+mod execution;
+mod image;
+mod pinned;
+
+use std::{
+    fmt::{Debug, Formatter, Result as FmtResult},
+    fs::{canonicalize, remove_dir_all, symlink_metadata},
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+
+use bytes::Bytes;
+pub use execution::{ImageExecutionDefaults, ImageExecutionMetadata, ImageExecutionPlan};
+pub use image::{
+    Architecture, ArtifactError, ImageMetadata, ImageReference, ResolvedImage, Sha256Digest,
+};
+pub(crate) use pinned::{
+    ImageLeaseContext, ImageLiveness, PreparationAdmission, PreparationReceipt,
+};
+pub use pinned::{PinnedImage, UnpackedImageSize};
+use tempfile::TempDir;
+
+use crate::storage::compute_sha256;
+
+pub(crate) const MAX_ZIP_BYTES: usize = 50 * 1024 * 1024;
+pub(crate) const MAX_ZIP_BASE64_BYTES: usize = MAX_ZIP_BYTES.div_ceil(3) * 4;
+
+pub(crate) const MAX_IMAGE_BYTES: u64 = 10 * 1024 * 1024 * 1024;
+#[cfg(test)]
+use crate::{storage::stage_zip, test_zip::minimal_zip};
+
+/// One unambiguous deployment artifact for an invocation.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub enum DeploymentArtifact {
+    /// Successfully staged ZIP, with shared lifetime ownership.
+    Zip(ValidatedArtifact),
+    /// Live Linux image lease, retained through backend cleanup.
+    Image(PinnedImage),
+}
+
+/// Image deployment availability; snapshot metadata never grants a live lease.
+#[derive(Debug, Clone, Default)]
+#[non_exhaustive]
+pub enum ImageArtifact {
+    /// No image has been prepared.
+    #[default]
+    Unresolved,
+    /// Immutable restored metadata requiring availability reacquisition.
+    Restored(ResolvedImage),
+    /// Prepared image with shared availability ownership.
+    Pinned(PinnedImage),
+}
+impl ImageArtifact {
+    /// Captured metadata, whether or not runtime availability has been acquired.
+    ///
+    /// ```
+    /// assert!(rustack_lambda_core::artifact::ImageArtifact::Unresolved.resolved().is_none());
+    /// ```
+    #[must_use]
+    pub fn resolved(&self) -> Option<&ResolvedImage> {
+        match self {
+            Self::Unresolved => None,
+            Self::Restored(image) => Some(image),
+            Self::Pinned(image) => Some(image.resolved()),
+        }
+    }
+
+    /// Live artifact ownership, absent for restored metadata alone.
+    ///
+    /// ```
+    /// assert!(rustack_lambda_core::artifact::ImageArtifact::Unresolved.pinned().is_none());
+    /// ```
+    #[must_use]
+    pub fn pinned(&self) -> Option<&PinnedImage> {
+        match self {
+            Self::Pinned(image) => Some(image),
+            Self::Unresolved | Self::Restored(_) => None,
+        }
+    }
+}
+
+/// Shared ownership of a ZIP archive and the extracted code it produced.
+///
+/// Only the function store can issue a lease after successful staging.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ValidatedArtifact(Arc<ZipStorage>);
+
+struct ZipStorage {
+    directory: Option<TempDir>,
+    root: PathBuf,
+    extracted: PathBuf,
+    bytes: Bytes,
+    sha256: String,
+}
+
+impl Debug for ZipStorage {
+    fn fmt(&self, f: &mut Formatter<'_>) -> FmtResult {
+        f.debug_struct("ZipStorage")
+            .field("sha256", &self.sha256)
+            .field("archive_bytes", &self.bytes.len())
+            .finish_non_exhaustive()
+    }
+}
+
+impl Debug for ValidatedArtifact {
+    fn fmt(&self, f: &mut Formatter<'_>) -> FmtResult {
+        f.debug_struct("ValidatedArtifact")
+            .field("sha256", &self.0.sha256)
+            .field("archive_bytes", &self.0.bytes.len())
+            .finish_non_exhaustive()
+    }
+}
+
+impl ValidatedArtifact {
+    #[cfg(test)]
+    pub(crate) fn fixture() -> Self {
+        stage_zip(&std::env::temp_dir(), Bytes::from(minimal_zip(b"fixture")))
+            .expect("trusted ZIP unit fixture must stage successfully")
+    }
+    pub(crate) fn from_staged(
+        directory: TempDir,
+        root: PathBuf,
+        extracted: PathBuf,
+        bytes: Bytes,
+    ) -> Self {
+        let sha256 = compute_sha256(&bytes);
+        Self(Arc::new(ZipStorage {
+            directory: Some(directory),
+            root,
+            extracted,
+            bytes,
+            sha256,
+        }))
+    }
+
+    /// Absolute root of the extracted code, not a user-controlled logical name.
+    ///
+    /// ```
+    /// # fn inspect(artifact: &rustack_lambda_core::artifact::ValidatedArtifact) {
+    /// assert!(artifact.code_root().is_absolute());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn code_root(&self) -> &Path {
+        &self.0.extracted
+    }
+
+    /// Original bytes from the same successfully staged ZIP.
+    ///
+    /// ```
+    /// # fn inspect(artifact: &rustack_lambda_core::artifact::ValidatedArtifact) {
+    /// let shared_bytes = artifact.zip_bytes().clone();
+    /// assert_eq!(shared_bytes, *artifact.zip_bytes());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn zip_bytes(&self) -> &Bytes {
+        &self.0.bytes
+    }
+
+    /// Base64-encoded SHA-256 of the original archive.
+    ///
+    /// ```
+    /// # fn inspect(artifact: &rustack_lambda_core::artifact::ValidatedArtifact) {
+    /// assert_eq!(artifact.sha256().len(), 44);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn sha256(&self) -> &str {
+        &self.0.sha256
+    }
+
+    pub(crate) fn storage_root(&self) -> &Path {
+        &self.0.root
+    }
+}
+
+impl Drop for ZipStorage {
+    #[allow(clippy::disallowed_methods)] // Last-lease Drop owns bounded directory cleanup; async IO is unavailable here.
+    fn drop(&mut self) {
+        let Some(directory) = self.directory.take() else {
+            return;
+        };
+        let path = directory.keep();
+        let safe = canonicalize(&self.root).is_ok_and(|root| root == self.root)
+            && symlink_metadata(&self.root)
+                .is_ok_and(|meta| meta.is_dir() && !meta.file_type().is_symlink())
+            && symlink_metadata(&path)
+                .is_ok_and(|meta| meta.is_dir() && !meta.file_type().is_symlink());
+        if !safe {
+            tracing::error!("Refusing cleanup of replaced Lambda artifact root");
+            return;
+        }
+        if let Err(error) = remove_dir_all(path) {
+            tracing::error!(%error, "Lambda artifact cleanup failed");
+        }
+    }
+}
diff --git a/crates/rustack-lambda-core/src/artifact/execution.rs b/crates/rustack-lambda-core/src/artifact/execution.rs
new file mode 100644
index 00000000..f5c230e5
--- /dev/null
+++ b/crates/rustack-lambda-core/src/artifact/execution.rs
@@ -0,0 +1,384 @@
+//! Validated image defaults retained through capture and snapshot restoration.
+
+use std::{fmt, sync::Arc};
+
+use rustack_lambda_model::types::ImageConfig;
+use serde::{Deserialize, Serialize};
+use typed_builder::TypedBuilder;
+
+use super::ArtifactError;
+use crate::function_config::validate_image_config;
+
+/// Primitive image execution metadata; validate with `ImageExecutionDefaults`.
+#[derive(Clone, Serialize, Deserialize, TypedBuilder)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct ImageExecutionMetadata {
+    /// Inherited entrypoint, before function overrides.
+    pub entrypoint: Vec<String>,
+    /// Inherited command, before function overrides.
+    pub command: Vec<String>,
+    /// Image-internal working directory; empty normalizes to root.
+    pub working_directory: String,
+    /// Ordered inherited environment, including Docker deletion markers.
+    pub environment: Vec<String>,
+    /// Image user declaration; container security policy is applied separately.
+    pub user: String,
+}
+impl fmt::Debug for ImageExecutionMetadata {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("ImageExecutionMetadata(<redacted>)")
+    }
+}
+
+/// Immutable normalized image defaults, revalidated on deserialization.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(try_from = "ImageExecutionMetadata", into = "ImageExecutionMetadata")]
+#[non_exhaustive]
+pub struct ImageExecutionDefaults(Arc<ImageExecutionMetadata>);
+
+impl TryFrom<ImageExecutionMetadata> for ImageExecutionDefaults {
+    type Error = ArtifactError;
+    fn try_from(mut metadata: ImageExecutionMetadata) -> Result<Self, Self::Error> {
+        if metadata.entrypoint.len() == 1
+            && metadata.entrypoint.first().is_some_and(String::is_empty)
+        {
+            metadata.entrypoint.clear();
+        }
+        if metadata.working_directory.is_empty() {
+            metadata.working_directory = "/".into();
+        }
+        validate_image_config(&ImageConfig {
+            entry_point: Some(metadata.entrypoint.clone()),
+            command: Some(metadata.command.clone()),
+            working_directory: Some(metadata.working_directory.clone()),
+        })
+        .map_err(|_| ArtifactError::Inspection)?;
+        validate_environment(&metadata.environment)?;
+        if metadata.user.len() > 256
+            || !metadata.user.bytes().all(|byte| (32..=126).contains(&byte))
+        {
+            return Err(ArtifactError::Inspection);
+        }
+        Ok(Self(Arc::new(metadata)))
+    }
+}
+impl From<ImageExecutionDefaults> for ImageExecutionMetadata {
+    fn from(defaults: ImageExecutionDefaults) -> Self {
+        Arc::unwrap_or_clone(defaults.0)
+    }
+}
+
+impl ImageExecutionDefaults {
+    /// Borrow normalized defaults; diagnostics must not print their values.
+    ///
+    /// ```no_run
+    /// # fn defaults(defaults: &rustack_lambda_core::artifact::ImageExecutionDefaults) {
+    /// let environment = &defaults.metadata().environment;
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn metadata(&self) -> &ImageExecutionMetadata {
+        &self.0
+    }
+
+    /// Materialize the exact Docker argv/workdir, preserving empty overrides.
+    ///
+    /// # Errors
+    /// Rejects invalid overrides, an empty executable or composed argv bounds.
+    ///
+    /// ```no_run
+    /// # fn plan(defaults: &rustack_lambda_core::artifact::ImageExecutionDefaults) -> Result<(), rustack_lambda_core::artifact::ArtifactError> {
+    /// let plan = defaults.plan(None)?;
+    /// assert!(!plan.entrypoint().is_empty()); // Includes Docker's reset sentinel.
+    /// # Ok(()) }
+    /// ```
+    pub fn plan(
+        &self,
+        overrides: Option<&ImageConfig>,
+    ) -> Result<ImageExecutionPlan, ArtifactError> {
+        if let Some(config) = overrides {
+            validate_image_config(config).map_err(|_| ArtifactError::Inspection)?;
+        }
+        let mut entrypoint = overrides
+            .and_then(|config| config.entry_point.as_ref())
+            .unwrap_or(&self.0.entrypoint)
+            .clone();
+        let command = overrides
+            .and_then(|config| config.command.as_ref())
+            .unwrap_or(&self.0.command)
+            .clone();
+        let workdir = overrides
+            .and_then(|config| config.working_directory.as_ref())
+            .unwrap_or(&self.0.working_directory)
+            .clone();
+        if entrypoint.len() == 1 && entrypoint.first().is_some_and(String::is_empty) {
+            entrypoint.clear();
+        }
+        validate_image_config(&ImageConfig {
+            entry_point: Some(entrypoint.clone()),
+            command: Some(command.clone()),
+            working_directory: Some(workdir.clone()),
+        })
+        .map_err(|_| ArtifactError::Inspection)?;
+        if entrypoint
+            .iter()
+            .chain(&command)
+            .next()
+            .is_none_or(String::is_empty)
+        {
+            return Err(ArtifactError::Inspection);
+        }
+        if entrypoint.is_empty() {
+            entrypoint.push(String::new());
+        }
+        Ok(ImageExecutionPlan {
+            entrypoint,
+            command,
+            workdir,
+        })
+    }
+}
+
+/// Validated Docker-create fields; no daemon inheritance is needed.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ImageExecutionPlan {
+    entrypoint: Vec<String>,
+    command: Vec<String>,
+    workdir: String,
+}
+impl fmt::Debug for ImageExecutionPlan {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("ImageExecutionPlan(<redacted>)")
+    }
+}
+impl ImageExecutionPlan {
+    /// Exact create entrypoint; semantic emptiness uses the `[""]` reset sentinel.
+    ///
+    /// ```no_run
+    /// # fn entry(plan: &rustack_lambda_core::artifact::ImageExecutionPlan) {
+    /// let entrypoint = plan.entrypoint().to_vec();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn entrypoint(&self) -> &[String] {
+        &self.entrypoint
+    }
+    /// Exact create command, including an explicitly empty array.
+    ///
+    /// ```no_run
+    /// # fn command(plan: &rustack_lambda_core::artifact::ImageExecutionPlan) {
+    /// let command = plan.command().to_vec();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn command(&self) -> &[String] {
+        &self.command
+    }
+    /// Exact absolute working directory inside the image.
+    ///
+    /// ```no_run
+    /// # fn workdir(plan: &rustack_lambda_core::artifact::ImageExecutionPlan) {
+    /// let workdir = plan.working_directory();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn working_directory(&self) -> &str {
+        &self.workdir
+    }
+}
+
+fn validate_environment(environment: &[String]) -> Result<(), ArtifactError> {
+    if environment.len() > 128 {
+        return Err(ArtifactError::Inspection);
+    }
+    let mut total = 0_usize;
+    for entry in environment {
+        let key = entry.split_once('=').map_or(entry.as_str(), |(key, _)| key);
+        if entry.len() > 4096
+            || entry.contains('\0')
+            || key.len() > 256
+            || !key
+                .as_bytes()
+                .first()
+                .is_some_and(|byte| byte.is_ascii_alphabetic() || *byte == b'_')
+            || !key
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'_')
+        {
+            return Err(ArtifactError::Inspection);
+        }
+        total = total
+            .checked_add(entry.len())
+            .filter(|total| *total <= 64 * 1024)
+            .ok_or(ArtifactError::Inspection)?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn metadata() -> ImageExecutionMetadata {
+        ImageExecutionMetadata::builder()
+            .entrypoint(vec!["/entry".into()])
+            .command(vec!["handler".into()])
+            .working_directory("/task".into())
+            .environment(vec!["PATH=/bin".into(), "REMOVED".into()])
+            .user("1000:1000".into())
+            .build()
+    }
+
+    #[test]
+    fn test_should_materialize_inherited_and_explicit_empty_docker_argv() {
+        let defaults = ImageExecutionDefaults::try_from(metadata()).unwrap();
+        let inherited = defaults.plan(None).unwrap();
+        assert_eq!(inherited.entrypoint(), ["/entry"]);
+        assert_eq!(inherited.command(), ["handler"]);
+        assert_eq!(inherited.working_directory(), "/task");
+        let clear_command = defaults
+            .plan(Some(&ImageConfig {
+                command: Some(vec![]),
+                ..Default::default()
+            }))
+            .unwrap();
+        assert_eq!(clear_command.command(), [] as [String; 0]);
+        assert_eq!(clear_command.entrypoint(), ["/entry"]);
+        for reset in [vec![], vec![String::new()]] {
+            let override_config = ImageConfig {
+                entry_point: Some(reset),
+                command: Some(vec!["/other".into()]),
+                working_directory: Some("/tmp".into()),
+            };
+            let plan = defaults.plan(Some(&override_config)).unwrap();
+            assert_eq!(plan.entrypoint(), [""]);
+            assert_eq!(plan.command(), ["/other"]);
+            assert_eq!(plan.working_directory(), "/tmp");
+        }
+        assert!(
+            defaults
+                .plan(Some(&ImageConfig {
+                    entry_point: Some(vec![]),
+                    command: Some(vec![]),
+                    ..Default::default()
+                }))
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn test_should_allow_empty_defaults_with_an_executable_override_and_normalize_root() {
+        let mut input = metadata();
+        input.entrypoint = vec![String::new()];
+        input.command.clear();
+        input.working_directory.clear();
+        let defaults = ImageExecutionDefaults::try_from(input).unwrap();
+        assert_eq!(defaults.metadata().entrypoint, [] as [String; 0]);
+        assert_eq!(defaults.metadata().working_directory, "/");
+        assert!(defaults.plan(None).is_err());
+        let plan = defaults
+            .plan(Some(&ImageConfig {
+                command: Some(vec!["/start".into()]),
+                ..Default::default()
+            }))
+            .unwrap();
+        assert_eq!(plan.entrypoint(), [""]);
+        assert_eq!(plan.command(), ["/start"]);
+        let mut invalid = metadata();
+        invalid.entrypoint.clear();
+        invalid.command.clear();
+        invalid.working_directory = "relative".into();
+        assert!(ImageExecutionDefaults::try_from(invalid).is_err());
+    }
+
+    #[rstest::rstest]
+    #[case("argv_count")]
+    #[case("argv_item")]
+    #[case("argv_total")]
+    #[case("argv_nul")]
+    #[case("directory")]
+    #[case("directory_size")]
+    #[case("env_count")]
+    #[case("env_item")]
+    #[case("env_total")]
+    #[case("env_key")]
+    #[case("env_key_size")]
+    #[case("env_nul")]
+    #[case("user_size")]
+    #[case("user_control")]
+    fn test_should_reject_invalid_defaults_before_capture(#[case] field: &str) {
+        let mut input = metadata();
+        match field {
+            "argv_count" => input.command = vec!["x".into(); 1501],
+            "argv_item" => input.command = vec!["x".repeat(4097)],
+            "argv_total" => input.command = vec!["x".repeat(4096); 17],
+            "argv_nul" => input.entrypoint = vec!["/bin/x\0".into()],
+            "directory" => input.working_directory = "relative".into(),
+            "directory_size" => input.working_directory = format!("/{}", "x".repeat(1000)),
+            "env_count" => input.environment = vec!["X=1".into(); 129],
+            "env_item" => input.environment = vec![format!("X={}", "x".repeat(4095))],
+            "env_total" => input.environment = vec![format!("X={}", "x".repeat(4094)); 17],
+            "env_key" => input.environment = vec!["1KEY=value".into()],
+            "env_key_size" => input.environment = vec![format!("{}=x", "K".repeat(257))],
+            "env_nul" => input.environment = vec!["KEY=\0".into()],
+            "user_size" => input.user = "x".repeat(257),
+            "user_control" => input.user = "1000\n".into(),
+            _ => panic!("unknown test field"),
+        }
+        assert!(matches!(
+            ImageExecutionDefaults::try_from(input),
+            Err(ArtifactError::Inspection)
+        ));
+    }
+
+    #[test]
+    fn test_should_check_composed_argv_and_environment_exact_byte_boundaries() {
+        let mut input = metadata();
+        input.entrypoint = vec!["e".repeat(4096); 16];
+        input.command.clear();
+        input.environment = vec![format!("X={}", "x".repeat(4094)); 16];
+        let defaults = ImageExecutionDefaults::try_from(input).unwrap();
+        defaults.plan(None).unwrap();
+        assert!(
+            defaults
+                .plan(Some(&ImageConfig {
+                    command: Some(vec!["x".into()]),
+                    ..Default::default()
+                }))
+                .is_err()
+        );
+        assert!(
+            defaults
+                .plan(Some(&ImageConfig {
+                    working_directory: Some(String::new()),
+                    ..Default::default()
+                }))
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn test_should_revalidate_saved_defaults_and_redact_all_debug_surfaces() {
+        let mut input = metadata();
+        input.entrypoint = vec!["secret_argv".into()];
+        input.environment = vec!["SECRET=secret_value".into()];
+        input.working_directory = "/secret_path".into();
+        input.user = "secret_user".into();
+        let defaults = ImageExecutionDefaults::try_from(input.clone()).unwrap();
+        let saved = serde_json::to_value(&defaults).unwrap();
+        let restored: ImageExecutionDefaults = serde_json::from_value(saved.clone()).unwrap();
+        assert_eq!(restored.plan(None).unwrap().entrypoint(), ["secret_argv"]);
+        for shown in [
+            format!("{input:?}"),
+            format!("{defaults:?}"),
+            format!("{:?}", defaults.plan(None).unwrap()),
+        ] {
+            assert!(!shown.contains("secret_"));
+        }
+        let mut invalid = saved;
+        invalid["environment"] = serde_json::json!(["BAD-KEY=value"]);
+        assert!(serde_json::from_value::<ImageExecutionDefaults>(invalid).is_err());
+    }
+}
diff --git a/crates/rustack-lambda-core/src/artifact/image.rs b/crates/rustack-lambda-core/src/artifact/image.rs
new file mode 100644
index 00000000..692a3e25
--- /dev/null
+++ b/crates/rustack-lambda-core/src/artifact/image.rs
@@ -0,0 +1,773 @@
+//! Bounded Docker image reference grammar and immutable inspection metadata.
+
+use std::{fmt, net::Ipv6Addr, str::FromStr};
+
+use base64::{Engine, engine::general_purpose::STANDARD};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use typed_builder::TypedBuilder;
+use winnow::{
+    ModalResult, Parser,
+    combinator::{alt, repeat, separated},
+    token::take_while,
+};
+
+use super::{ImageExecutionDefaults, MAX_IMAGE_BYTES};
+
+/// Closed Lambda architecture, also used to select a Docker platform.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum Architecture {
+    /// Linux amd64 image or `x86_64` function.
+    #[serde(rename = "x86_64")]
+    X86_64,
+    /// Linux aarch64 image or arm64 function.
+    #[serde(rename = "arm64")]
+    Arm64,
+}
+
+impl Architecture {
+    /// Lambda wire spelling of this architecture.
+    ///
+    /// ```
+    /// use rustack_lambda_core::artifact::Architecture;
+    /// assert_eq!(Architecture::Arm64.as_str(), "arm64");
+    /// ```
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::X86_64 => "x86_64",
+            Self::Arm64 => "arm64",
+        }
+    }
+
+    /// Linux platform selector for Docker.
+    ///
+    /// ```
+    /// use rustack_lambda_core::artifact::Architecture;
+    /// assert_eq!(Architecture::X86_64.docker_platform(), "linux/amd64");
+    /// ```
+    #[must_use]
+    pub const fn docker_platform(self) -> &'static str {
+        match self {
+            Self::X86_64 => "linux/amd64",
+            Self::Arm64 => "linux/arm64",
+        }
+    }
+}
+
+impl FromStr for Architecture {
+    type Err = ArtifactError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "x86_64" => Ok(Self::X86_64),
+            "arm64" => Ok(Self::Arm64),
+            _ => Err(ArtifactError::Architecture),
+        }
+    }
+}
+
+/// Invalid artifact metadata; errors never include the untrusted input.
+#[derive(Debug, Clone, Copy, thiserror::Error)]
+#[non_exhaustive]
+pub enum ArtifactError {
+    /// Reference does not match the bounded Docker grammar.
+    #[error("invalid Docker image reference")]
+    Reference,
+    /// Digest must be SHA-256 with 64 lowercase hexadecimal digits.
+    #[error("invalid SHA-256 image digest")]
+    Digest,
+    /// Only the two Lambda architectures are supported.
+    #[error("unsupported Lambda architecture")]
+    Architecture,
+    /// Inspection did not describe a supported Linux image.
+    #[error("invalid Linux image inspection metadata")]
+    Inspection,
+}
+
+/// A validated Docker repository, optional tag, and optional SHA-256 digest.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+#[non_exhaustive]
+pub struct ImageReference(String);
+
+impl ImageReference {
+    /// Original validated spelling, passed directly to the daemon without a shell.
+    ///
+    /// ```
+    /// use rustack_lambda_core::artifact::ImageReference;
+    /// let image: ImageReference = "localhost:5000/team/worker:v1".parse()?;
+    /// assert_eq!(image.as_str(), "localhost:5000/team/worker:v1");
+    /// # Ok::<(), rustack_lambda_core::artifact::ArtifactError>(())
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    /// Repository spelling, including an explicit registry, without tag/digest.
+    ///
+    /// ```
+    /// let image: rustack_lambda_core::artifact::ImageReference = "localhost:5000/team/worker:v1".parse()?;
+    /// assert_eq!(image.repository(), "localhost:5000/team/worker");
+    /// # Ok::<(), rustack_lambda_core::artifact::ArtifactError>(())
+    /// ```
+    #[must_use]
+    pub fn repository(&self) -> &str {
+        let name = self
+            .0
+            .split_once('@')
+            .map_or(self.0.as_str(), |(name, _)| name);
+        if name
+            .rsplit('/')
+            .next()
+            .is_some_and(|part| part.contains(':'))
+        {
+            name.rsplit_once(':').map_or(name, |(name, _)| name)
+        } else {
+            name
+        }
+    }
+
+    /// Explicit registry component; short local names do not invent provenance.
+    ///
+    /// ```
+    /// let image: rustack_lambda_core::artifact::ImageReference = "worker:v1".parse()?;
+    /// assert_eq!(image.registry(), None);
+    /// # Ok::<(), rustack_lambda_core::artifact::ArtifactError>(())
+    /// ```
+    #[must_use]
+    pub fn registry(&self) -> Option<&str> {
+        self.repository()
+            .split_once('/')
+            .and_then(|(first, _)| is_registry_component(first).then_some(first))
+    }
+
+    /// Requested digest suffix, if present, already checked by the constructor.
+    ///
+    /// ```
+    /// let image: rustack_lambda_core::artifact::ImageReference = "worker:v1".parse()?;
+    /// assert_eq!(image.digest(), None);
+    /// # Ok::<(), rustack_lambda_core::artifact::ArtifactError>(())
+    /// ```
+    #[must_use]
+    pub fn digest(&self) -> Option<&str> {
+        self.0.split_once('@').map(|(_, digest)| digest)
+    }
+}
+
+fn is_registry_component(first: &str) -> bool {
+    first.contains('.')
+        || first.contains(':')
+        || first == "localhost"
+        || first.starts_with('[')
+        || first.bytes().any(|byte| byte.is_ascii_uppercase())
+}
+
+impl FromStr for ImageReference {
+    type Err = ArtifactError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.is_empty() || value.len() > 1024 || !value.is_ascii() {
+            return Err(ArtifactError::Reference);
+        }
+        let (name_tag, digest) = match value.split_once('@') {
+            Some((name, digest)) => (name, Some(digest)),
+            None => (value, None),
+        };
+        if let Some(digest) = digest {
+            digest.parse::<Sha256Digest>()?;
+        }
+        let last_component = name_tag
+            .rsplit('/')
+            .next()
+            .ok_or(ArtifactError::Reference)?;
+        let (name, tag) = match last_component.split_once(':') {
+            Some((_, tag)) => {
+                let (name, _) = name_tag.rsplit_once(':').ok_or(ArtifactError::Reference)?;
+                (name, Some(tag))
+            }
+            None => (name_tag, None),
+        };
+        if let Some(tag) = tag {
+            tag_parser
+                .parse(tag)
+                .map_err(|_| ArtifactError::Reference)?;
+        }
+        if name.len() > 255 {
+            return Err(ArtifactError::Reference);
+        }
+        let repository = if let Some((first, remaining)) = name.split_once('/') {
+            if is_registry_component(first) {
+                validate_registry(first)?;
+                remaining
+            } else {
+                name
+            }
+        } else {
+            name
+        };
+        repository_parser
+            .parse(repository)
+            .map_err(|_| ArtifactError::Reference)?;
+        Ok(Self(value.to_owned()))
+    }
+}
+
+impl TryFrom<String> for ImageReference {
+    type Error = ArtifactError;
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+impl From<ImageReference> for String {
+    fn from(value: ImageReference) -> Self {
+        value.0
+    }
+}
+impl fmt::Display for ImageReference {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+fn component(input: &mut &str) -> ModalResult<()> {
+    (
+        take_while(1.., |c: char| c.is_ascii_lowercase() || c.is_ascii_digit()),
+        repeat::<_, _, (), _, _>(
+            0..,
+            (
+                alt(("__", "_", ".", take_while(1.., '-'))),
+                take_while(1.., |c: char| c.is_ascii_lowercase() || c.is_ascii_digit()),
+            ),
+        ),
+    )
+        .void()
+        .parse_next(input)
+}
+fn repository_parser(input: &mut &str) -> ModalResult<()> {
+    separated(1.., component, '/').parse_next(input)
+}
+
+fn tag_parser(input: &mut &str) -> ModalResult<()> {
+    (
+        take_while(1, |c: char| c.is_ascii_alphanumeric() || c == '_'),
+        take_while(0..=127, |c: char| {
+            c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-')
+        }),
+    )
+        .void()
+        .parse_next(input)
+}
+
+fn digest_parser(input: &mut &str) -> ModalResult<()> {
+    (
+        "sha256:",
+        take_while(64, |c: char| c.is_ascii_digit() || matches!(c, 'a'..='f')),
+    )
+        .void()
+        .parse_next(input)
+}
+
+fn validate_registry(registry: &str) -> Result<(), ArtifactError> {
+    let (host, port) = if let Some(bracketed) = registry.strip_prefix('[') {
+        let (host, tail) = bracketed.split_once(']').ok_or(ArtifactError::Reference)?;
+        if !host
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() || byte == b':')
+        {
+            return Err(ArtifactError::Reference);
+        }
+        host.parse::<Ipv6Addr>()
+            .map_err(|_| ArtifactError::Reference)?;
+        let port = if tail.is_empty() {
+            None
+        } else {
+            Some(tail.strip_prefix(':').ok_or(ArtifactError::Reference)?)
+        };
+        (None, port)
+    } else {
+        let (host, port) = registry
+            .split_once(':')
+            .map_or((registry, None), |(host, port)| (host, Some(port)));
+        (Some(host), port)
+    };
+    if let Some(host) = host {
+        if host.is_empty()
+            || host.len() > 253
+            || host.split('.').any(|label| {
+                label.is_empty()
+                    || label.len() > 63
+                    || !label
+                        .bytes()
+                        .all(|b| b.is_ascii_alphanumeric() || b == b'-')
+                    || label.starts_with('-')
+                    || label.ends_with('-')
+            })
+        {
+            return Err(ArtifactError::Reference);
+        }
+    }
+    if let Some(port) = port {
+        if port.is_empty()
+            || port.len() > 5
+            || !port.bytes().all(|b| b.is_ascii_digit())
+            || port.parse::<u16>().map_or(true, |port| port == 0)
+        {
+            return Err(ArtifactError::Reference);
+        }
+    }
+    Ok(())
+}
+
+/// Immutable SHA-256 digest, including its algorithm prefix.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+#[non_exhaustive]
+pub struct Sha256Digest(String);
+
+impl Sha256Digest {
+    /// The validated `sha256:<hex>` value.
+    ///
+    /// ```
+    /// use rustack_lambda_core::artifact::Sha256Digest;
+    /// let digest: Sha256Digest = format!("sha256:{}", "a".repeat(64)).parse()?;
+    /// assert_eq!(digest.as_str().len(), 71);
+    /// # Ok::<(), rustack_lambda_core::artifact::ArtifactError>(())
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+impl FromStr for Sha256Digest {
+    type Err = ArtifactError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.len() != 71 {
+            return Err(ArtifactError::Digest);
+        }
+        digest_parser
+            .parse(value)
+            .map_err(|_| ArtifactError::Digest)?;
+        Ok(Self(value.to_owned()))
+    }
+}
+impl TryFrom<String> for Sha256Digest {
+    type Error = ArtifactError;
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+impl From<Sha256Digest> for String {
+    fn from(value: Sha256Digest) -> Self {
+        value.0
+    }
+}
+
+/// Validated primitive fields returned by image inspection.
+#[derive(Debug, Clone, TypedBuilder, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct ImageMetadata {
+    /// Caller-supplied deployment reference.
+    pub requested_reference: ImageReference,
+    /// Immutable daemon image content ID.
+    pub image_id: Sha256Digest,
+    /// Selected platform manifest, separate from an addressable parent image ID.
+    pub selected_manifest: Option<Sha256Digest>,
+    /// Registry repository and selected manifest digest, when available.
+    pub registry_manifest: Option<ImageReference>,
+    /// Inspected operating system, required to equal linux.
+    pub os: String,
+    /// Selected Lambda architecture.
+    pub architecture: Architecture,
+    /// SHA-256 of the normalized inspected execution metadata.
+    pub inspection_hash: Sha256Digest,
+    /// Selected image size reported by the daemon, bounded to 10 GiB locally.
+    pub size_bytes: u64,
+    /// Validated inherited execution defaults, retained without re-inspection.
+    pub execution: ImageExecutionDefaults,
+}
+
+impl ImageMetadata {
+    /// Compute the canonical fingerprint also verified during snapshot restore.
+    ///
+    /// # Errors
+    /// Rejects an invalid inspected size or bounded metadata serialization.
+    ///
+    /// ```no_run
+    /// # fn hash(metadata: &rustack_lambda_core::artifact::ImageMetadata) -> Result<(), rustack_lambda_core::artifact::ArtifactError> {
+    /// let hash = rustack_lambda_core::artifact::ImageMetadata::execution_fingerprint(
+    ///     &metadata.image_id, metadata.selected_manifest.as_ref(),
+    ///     metadata.architecture, metadata.size_bytes, &metadata.execution)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn execution_fingerprint(
+        image_id: &Sha256Digest,
+        selected_manifest: Option<&Sha256Digest>,
+        architecture: Architecture,
+        size: u64,
+        defaults: &ImageExecutionDefaults,
+    ) -> Result<Sha256Digest, ArtifactError> {
+        #[derive(Serialize)]
+        #[serde(rename_all = "camelCase")]
+        struct Fingerprint<'a> {
+            version: u8,
+            image_id: &'a Sha256Digest,
+            descriptor_digest: Option<&'a Sha256Digest>,
+            architecture: Architecture,
+            size: u64,
+            defaults: &'a ImageExecutionDefaults,
+        }
+        if !(1..=MAX_IMAGE_BYTES).contains(&size) {
+            return Err(ArtifactError::Inspection);
+        }
+        // Validated defaults contain <=128KiB of argv/environment, whose worst
+        // JSON escape expansion is sixfold; fixed-size identities keep this <1MiB.
+        let bytes = serde_json::to_vec(&Fingerprint {
+            version: 1,
+            image_id,
+            descriptor_digest: selected_manifest,
+            architecture,
+            size,
+            defaults,
+        })
+        .map_err(|_| ArtifactError::Inspection)?;
+        format!("sha256:{}", hex::encode(Sha256::digest(bytes))).parse()
+    }
+}
+
+/// Immutable Linux image metadata that passed all inspection invariants.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(try_from = "ImageMetadata", into = "ImageMetadata")]
+#[non_exhaustive]
+pub struct ResolvedImage(ImageMetadata);
+
+impl TryFrom<ImageMetadata> for ResolvedImage {
+    type Error = ArtifactError;
+    fn try_from(metadata: ImageMetadata) -> Result<Self, Self::Error> {
+        if metadata.os != "linux"
+            || metadata.size_bytes == 0
+            || metadata.size_bytes > MAX_IMAGE_BYTES
+            || metadata
+                .registry_manifest
+                .as_ref()
+                .is_some_and(|image| !image.as_str().contains('@'))
+        {
+            return Err(ArtifactError::Inspection);
+        }
+        if metadata.inspection_hash
+            != ImageMetadata::execution_fingerprint(
+                &metadata.image_id,
+                metadata.selected_manifest.as_ref(),
+                metadata.architecture,
+                metadata.size_bytes,
+                &metadata.execution,
+            )?
+        {
+            return Err(ArtifactError::Inspection);
+        }
+        if let (Some(selected), Some(registry)) =
+            (&metadata.selected_manifest, &metadata.registry_manifest)
+        {
+            if registry.digest() != Some(selected.as_str()) {
+                return Err(ArtifactError::Inspection);
+            }
+        }
+        Ok(Self(metadata))
+    }
+}
+impl From<ResolvedImage> for ImageMetadata {
+    fn from(image: ResolvedImage) -> Self {
+        image.0
+    }
+}
+
+impl ResolvedImage {
+    #[cfg(test)]
+    pub(crate) fn fixture(architecture: Architecture) -> Self {
+        let image_id = format!("sha256:{}", "a".repeat(64))
+            .parse()
+            .expect("valid unit digest");
+        let execution = super::ImageExecutionMetadata::builder()
+            .entrypoint(vec!["/bootstrap".into()])
+            .command(Vec::new())
+            .working_directory("/".into())
+            .environment(Vec::new())
+            .user("1000".into())
+            .build()
+            .try_into()
+            .expect("valid execution defaults");
+        let hash =
+            ImageMetadata::execution_fingerprint(&image_id, None, architecture, 1024, &execution)
+                .expect("unit fingerprint");
+        ImageMetadata::builder()
+            .requested_reference(
+                "rustack-fixture:unit"
+                    .parse()
+                    .expect("valid unit reference"),
+            )
+            .image_id(image_id)
+            .selected_manifest(None)
+            .registry_manifest(None)
+            .os("linux".into())
+            .architecture(architecture)
+            .inspection_hash(hash)
+            .size_bytes(1024)
+            .execution(execution)
+            .build()
+            .try_into()
+            .expect("valid unit image metadata")
+    }
+    /// Base64 SHA-256 of canonical inspected execution metadata, independent of a tag.
+    ///
+    /// # Errors
+    /// Rejects a malformed canonical fingerprint before decoding it.
+    ///
+    /// ```no_run
+    /// # fn hash(image: &rustack_lambda_core::artifact::ResolvedImage) -> Result<(), rustack_lambda_core::artifact::ArtifactError> {
+    /// let code_hash = image.code_sha256()?;
+    /// assert_eq!(code_hash.len(), 44);
+    /// # Ok(()) }
+    /// ```
+    pub fn code_sha256(&self) -> Result<String, ArtifactError> {
+        let digest = self
+            .0
+            .inspection_hash
+            .as_str()
+            .strip_prefix("sha256:")
+            .ok_or(ArtifactError::Inspection)?;
+        let bytes = hex::decode(digest).map_err(|_| ArtifactError::Inspection)?;
+        Ok(STANDARD.encode(bytes))
+    }
+
+    /// Immutable inspected metadata; Invoke must use `image_id` rather than a tag.
+    ///
+    /// ```
+    /// # fn inspect(image: &rustack_lambda_core::artifact::ResolvedImage) {
+    /// assert_eq!(image.metadata().os, "linux");
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn metadata(&self) -> &ImageMetadata {
+        &self.0
+    }
+
+    /// Registry manifest reference, or Rustack's explicit local-content extension.
+    ///
+    /// ```
+    /// # fn inspect(image: &rustack_lambda_core::artifact::ResolvedImage) {
+    /// assert!(!image.resolved_uri().is_empty());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn resolved_uri(&self) -> String {
+        self.0.registry_manifest.as_ref().map_or_else(
+            || format!("local://{}", self.0.image_id.as_str()),
+            ToString::to_string,
+        )
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use rstest::rstest;
+
+    use super::*;
+
+    #[rstest]
+    #[case("worker")]
+    #[case("team/worker:v1")]
+    #[case("team/foo__bar:Tag_1.2-3")]
+    #[case("team/foo---bar:_")]
+    #[case("localhost:5000/worker:latest")]
+    #[case("registry.example.com/team/worker:V2")]
+    #[case("Registry/worker:v1")]
+    #[case("127.0.0.1:65535/worker")]
+    #[case("[::1]:5000/team/worker:v1")]
+    #[case("[2001:db8::1]/worker")]
+    fn test_should_parse_docker_references_and_round_trip_saved_values(
+        #[case] reference: &str,
+    ) -> Result<(), Box<dyn std::error::Error>> {
+        let parsed: ImageReference = reference.parse()?;
+        assert_eq!(parsed.as_str(), reference);
+        let saved = serde_json::to_string(&parsed)?;
+        assert_eq!(serde_json::from_str::<ImageReference>(&saved)?, parsed);
+        Ok(())
+    }
+
+    #[rstest]
+    #[case("")]
+    #[case("https://registry.example.com/worker")]
+    #[case("user@registry.example.com/worker")]
+    #[case("worker:$(id)")]
+    #[case("worker;id")]
+    #[case("worker\n")]
+    #[case("worker\0")]
+    #[case("team/UPPER")]
+    #[case("team//worker")]
+    #[case("team/../worker")]
+    #[case("team/foo___bar")]
+    #[case("team/foo..bar")]
+    #[case("worker:")]
+    #[case("worker:.tag")]
+    #[case("worker:tag:extra")]
+    #[case("registry.example.com:0/worker")]
+    #[case("registry.example.com:65536/worker")]
+    #[case("registry..example.com/worker")]
+    #[case("registry.example.com:/worker")]
+    #[case("[::1]extra/worker")]
+    #[case("[not-ipv6]:5000/worker")]
+    #[case("[::ffff:192.0.2.1]/worker")]
+    #[case("[fe80::1%eth0]/worker")]
+    #[case("worker@sha256:abc")]
+    fn test_should_reject_invalid_references_at_parse_and_deserialization(#[case] reference: &str) {
+        assert!(reference.parse::<ImageReference>().is_err());
+        assert!(
+            serde_json::from_value::<ImageReference>(serde_json::Value::String(reference.into()))
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn test_should_enforce_reference_tag_and_repository_byte_limits() -> Result<(), ArtifactError> {
+        let longest_tag = format!("worker:{}", "t".repeat(128));
+        longest_tag.parse::<ImageReference>()?;
+        assert!(format!("{longest_tag}t").parse::<ImageReference>().is_err());
+        "a".repeat(255).parse::<ImageReference>()?;
+        assert!("a".repeat(256).parse::<ImageReference>().is_err());
+        assert!("a".repeat(1025).parse::<ImageReference>().is_err());
+        assert!("wörker".parse::<ImageReference>().is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_parse_digest_references_without_confusing_registry_ports_and_tags()
+    -> Result<(), ArtifactError> {
+        let digest = format!("sha256:{}", "a".repeat(64));
+        for reference in [
+            format!("worker@{digest}"),
+            format!("localhost:5000/team/worker:v1@{digest}"),
+            format!("[::1]:5000/worker@{digest}"),
+        ] {
+            reference.parse::<ImageReference>()?;
+        }
+        assert!(
+            format!("worker@{digest}@{digest}")
+                .parse::<ImageReference>()
+                .is_err()
+        );
+        assert!(
+            format!("sha256:{}", "A".repeat(64))
+                .parse::<Sha256Digest>()
+                .is_err()
+        );
+        assert!(
+            format!("sha256:{}", "a".repeat(63))
+                .parse::<Sha256Digest>()
+                .is_err()
+        );
+        assert!(
+            format!("sha512:{}", "a".repeat(64))
+                .parse::<Sha256Digest>()
+                .is_err()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_preserve_local_and_registry_image_identity_through_snapshot_round_trips()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let local = ResolvedImage::fixture(Architecture::Arm64);
+        assert_eq!(
+            local.resolved_uri(),
+            format!("local://sha256:{}", "a".repeat(64))
+        );
+        let mut metadata = local.metadata().clone();
+        let manifest = format!("registry.example.com/worker@sha256:{}", "c".repeat(64));
+        metadata.registry_manifest = Some(manifest.parse()?);
+        let image = ResolvedImage::try_from(metadata)?;
+        assert_eq!(image.resolved_uri(), manifest);
+        let saved = serde_json::to_vec(&image)?;
+        let restored: ResolvedImage = serde_json::from_slice(&saved)?;
+        assert_eq!(restored.metadata().image_id, image.metadata().image_id);
+        assert_eq!(restored.metadata().architecture, Architecture::Arm64);
+        assert_eq!(restored.resolved_uri(), manifest);
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_revalidate_image_inspection_on_deserialization()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let image = ResolvedImage::fixture(Architecture::X86_64);
+        let saved = serde_json::to_value(&image)?;
+        for (field, invalid) in [
+            ("os", serde_json::json!("windows")),
+            ("architecture", serde_json::json!("riscv64")),
+            ("imageId", serde_json::json!("worker:latest")),
+            ("registryManifest", serde_json::json!("worker:latest")),
+            ("sizeBytes", serde_json::json!(0)),
+            (
+                "sizeBytes",
+                serde_json::json!(10_u64 * 1024 * 1024 * 1024 + 1),
+            ),
+        ] {
+            let mut invalid_image = saved.clone();
+            invalid_image
+                .as_object_mut()
+                .ok_or("image must be an object")?
+                .insert(field.into(), invalid);
+            assert!(
+                serde_json::from_value::<ResolvedImage>(invalid_image).is_err(),
+                "{field}"
+            );
+        }
+        Ok(())
+    }
+    #[rstest::rstest]
+    #[case("/imageId", serde_json::json!(format!("sha256:{}", "d".repeat(64))))]
+    #[case("/selectedManifest", serde_json::json!(format!("sha256:{}", "d".repeat(64))))]
+    #[case("/sizeBytes", serde_json::json!(1025))]
+    #[case("/architecture", serde_json::json!("arm64"))]
+    #[case("/execution/command", serde_json::json!(["changed-valid-argv"]))]
+    #[case("/execution/environment", serde_json::json!(["KEY=changed-valid-value"]))]
+    #[case("/execution/user", serde_json::json!("1001"))]
+    #[case("/execution/entrypoint", serde_json::json!(["/other"]))]
+    #[case("/execution/workingDirectory", serde_json::json!("/other"))]
+    #[case("/inspectionHash", serde_json::json!(format!("sha256:{}", "f".repeat(64))))]
+    fn test_should_reject_valid_saved_metadata_mutations_with_a_stale_fingerprint(
+        #[case] pointer: &str,
+        #[case] replacement: serde_json::Value,
+    ) {
+        let image = ResolvedImage::fixture(Architecture::X86_64);
+        let mut saved = serde_json::to_value(image).unwrap();
+        *saved.pointer_mut(pointer).unwrap() = replacement;
+        assert!(serde_json::from_value::<ResolvedImage>(saved).is_err());
+    }
+
+    #[test]
+    fn test_should_extract_registry_repository_and_digest_without_confusing_ports() {
+        for (reference, repository, registry) in [
+            (
+                "localhost:5000/team/worker:v1",
+                "localhost:5000/team/worker",
+                Some("localhost:5000"),
+            ),
+            (
+                "[::1]:5000/team/worker:v1",
+                "[::1]:5000/team/worker",
+                Some("[::1]:5000"),
+            ),
+            ("Registry/worker:v1", "Registry/worker", Some("Registry")),
+            ("team/worker:v1", "team/worker", None),
+            ("worker:v1", "worker", None),
+        ] {
+            let with_digest = format!("{reference}@sha256:{}", "e".repeat(64));
+            let image: ImageReference = with_digest.parse().unwrap();
+            assert_eq!(image.repository(), repository);
+            assert_eq!(image.registry(), registry);
+            assert_eq!(
+                image.digest(),
+                Some(format!("sha256:{}", "e".repeat(64)).as_str())
+            );
+        }
+    }
+}
diff --git a/crates/rustack-lambda-core/src/artifact/pinned.rs b/crates/rustack-lambda-core/src/artifact/pinned.rs
new file mode 100644
index 00000000..8831b749
--- /dev/null
+++ b/crates/rustack-lambda-core/src/artifact/pinned.rs
@@ -0,0 +1,297 @@
+//! Live image artifacts cannot be reconstructed from snapshot metadata alone.
+
+use std::{
+    fmt,
+    num::NonZeroU64,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+};
+
+use serde::{Deserialize, Serialize};
+use tokio::sync::{OwnedSemaphorePermit, watch};
+use typed_builder::TypedBuilder;
+
+use super::{ArtifactError, MAX_IMAGE_BYTES, ResolvedImage};
+use crate::docker::DirectoryLease;
+
+/// Positive daemon-reported unpacked image storage, within the local10GiB quota.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "u64", into = "u64")]
+#[non_exhaustive]
+pub struct UnpackedImageSize(NonZeroU64);
+impl TryFrom<u64> for UnpackedImageSize {
+    type Error = ArtifactError;
+    fn try_from(value: u64) -> Result<Self, Self::Error> {
+        let value = NonZeroU64::new(value)
+            .filter(|value| value.get() <= MAX_IMAGE_BYTES)
+            .ok_or(ArtifactError::Inspection)?;
+        Ok(Self(value))
+    }
+}
+impl From<UnpackedImageSize> for u64 {
+    fn from(size: UnpackedImageSize) -> Self {
+        size.0.get()
+    }
+}
+impl UnpackedImageSize {
+    /// Number of validated unpacked bytes, independent of compressed size.
+    ///
+    /// ```
+    /// let size = rustack_lambda_core::artifact::UnpackedImageSize::try_from(4096)?;
+    /// assert_eq!(size.get(),4096);
+    /// # Ok::<(),rustack_lambda_core::artifact::ArtifactError>(())
+    /// ```
+    #[must_use]
+    pub const fn get(self) -> u64 {
+        self.0.get()
+    }
+}
+
+/// Shared live pin lease; cloning retains availability until joined retirement.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct PinnedImage(Arc<Lease>);
+
+/// Admission retained by the image actor until a consumed handoff or physical retirement.
+#[derive(Debug)]
+pub(crate) struct PreparationAdmission {
+    _image: OwnedSemaphorePermit,
+    _deployment: Option<Arc<OwnedSemaphorePermit>>,
+}
+impl PreparationAdmission {
+    pub(crate) fn new(
+        image: OwnedSemaphorePermit,
+        deployment: Option<Arc<OwnedSemaphorePermit>>,
+    ) -> Self {
+        Self {
+            _image: image,
+            _deployment: deployment,
+        }
+    }
+}
+/// Shared acceptance receipt; clearing it releases guards retained above workers.
+pub(crate) type PreparationReceipt = watch::Sender<Option<PreparationAdmission>>;
+
+/// Availability view with no pin-release sender or directory/resource ownership.
+#[derive(Debug, Clone)]
+pub(crate) struct ImageLiveness {
+    active: Arc<AtomicBool>,
+    stop: watch::Receiver<bool>,
+}
+impl ImageLiveness {
+    pub(crate) fn is_live(&self) -> bool {
+        self.active.load(Ordering::Acquire)
+            && !*self.stop.borrow()
+            && self.stop.has_changed().is_ok()
+    }
+    pub(crate) async fn revoked(&self) {
+        let mut stop = self.stop.clone();
+        while self.is_live() {
+            if stop.changed().await.is_err() {
+                return;
+            }
+        }
+    }
+}
+
+/// Runtime-owned pins carry the exact acquired directory; fixtures cannot grant it.
+#[derive(Debug)]
+pub(crate) enum ImageLeaseContext {
+    #[cfg(test)]
+    Fixture,
+    Owned {
+        directory: DirectoryLease,
+        preparation: Option<PreparationReceipt>,
+    },
+}
+
+#[derive(TypedBuilder)]
+struct Lease {
+    resolved: ResolvedImage,
+    size: UnpackedImageSize,
+    release: watch::Sender<()>,
+    active: Arc<AtomicBool>,
+    stop: watch::Receiver<bool>,
+    context: ImageLeaseContext,
+}
+impl Drop for Lease {
+    fn drop(&mut self) {
+        self.release.send_replace(());
+    }
+}
+impl fmt::Debug for PinnedImage {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("PinnedImage")
+            .field("image_id", &self.0.resolved.metadata().image_id)
+            .field("unpacked_bytes", &self.0.size)
+            .field("live", &self.is_live())
+            .finish_non_exhaustive()
+    }
+}
+impl PinnedImage {
+    #[cfg(test)]
+    pub(crate) fn fixture(resolved: ResolvedImage) -> Self {
+        let (release, _) = watch::channel(());
+        let (_, stop) = watch::channel(false);
+        let size = UnpackedImageSize::try_from(resolved.metadata().size_bytes)
+            .expect("validated unit image size");
+        Self::new(
+            resolved,
+            size,
+            release,
+            Arc::new(AtomicBool::new(true)),
+            stop,
+        )
+    }
+
+    #[cfg(test)]
+    pub(crate) fn new(
+        resolved: ResolvedImage,
+        size: UnpackedImageSize,
+        release: watch::Sender<()>,
+        active: Arc<AtomicBool>,
+        stop: watch::Receiver<bool>,
+    ) -> Self {
+        Self::with_context(
+            resolved,
+            size,
+            release,
+            active,
+            stop,
+            ImageLeaseContext::Fixture,
+        )
+    }
+
+    pub(crate) fn with_context(
+        resolved: ResolvedImage,
+        size: UnpackedImageSize,
+        release: watch::Sender<()>,
+        active: Arc<AtomicBool>,
+        stop: watch::Receiver<bool>,
+        context: ImageLeaseContext,
+    ) -> Self {
+        Self(Arc::new(
+            Lease::builder()
+                .resolved(resolved)
+                .size(size)
+                .release(release)
+                .active(active)
+                .stop(stop)
+                .context(context)
+                .build(),
+        ))
+    }
+
+    /// Confirm a validated consumed artifact or a committed deployment CAS.
+    pub(crate) fn accept_preparation(&self) {
+        if let ImageLeaseContext::Owned {
+            preparation: Some(receipt),
+            ..
+        } = &self.0.context
+        {
+            receipt.send_replace(None);
+        }
+    }
+
+    pub(crate) fn liveness(&self) -> ImageLiveness {
+        ImageLiveness {
+            active: self.0.active.clone(),
+            stop: self.0.stop.clone(),
+        }
+    }
+
+    pub(crate) fn belongs_to(&self, directory: &DirectoryLease) -> bool {
+        match &self.0.context {
+            ImageLeaseContext::Owned {
+                directory: origin, ..
+            } => origin.same_instance(directory),
+            #[cfg(test)]
+            ImageLeaseContext::Fixture => false,
+        }
+    }
+
+    /// Immutable metadata captured by preparation; never resolve a mutable tag.
+    ///
+    /// ```no_run
+    /// # fn inspect(image:&rustack_lambda_core::artifact::PinnedImage) {
+    /// let id = &image.resolved().metadata().image_id;
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn resolved(&self) -> &ResolvedImage {
+        &self.0.resolved
+    }
+
+    /// Proven unpacked size used by deployment quota enforcement.
+    ///
+    /// ```no_run
+    /// # fn inspect(image:&rustack_lambda_core::artifact::PinnedImage) {
+    /// let bytes = image.unpacked_size().get();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn unpacked_size(&self) -> UnpackedImageSize {
+        self.0.size
+    }
+
+    /// Whether the owning manager still permits consumers to use this lease.
+    ///
+    /// Shutdown revokes leases after the runtime has joined their consumers.
+    ///
+    /// ```no_run
+    /// # fn inspect(image:&rustack_lambda_core::artifact::PinnedImage) {
+    /// let available = image.is_live();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn is_live(&self) -> bool {
+        self.0.active.load(Ordering::Acquire) && !*self.0.stop.borrow()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::artifact::Architecture;
+
+    #[test]
+    fn test_should_validate_unpacked_storage_limits_including_deserialization() {
+        assert!(UnpackedImageSize::try_from(0).is_err());
+        assert!(UnpackedImageSize::try_from(MAX_IMAGE_BYTES + 1).is_err());
+        assert_eq!(
+            UnpackedImageSize::try_from(MAX_IMAGE_BYTES).unwrap().get(),
+            MAX_IMAGE_BYTES
+        );
+        assert!(serde_json::from_str::<UnpackedImageSize>("0").is_err());
+        let size: UnpackedImageSize = serde_json::from_str("4096").unwrap();
+        assert_eq!(size.get(), 4096);
+    }
+
+    #[tokio::test]
+    async fn test_should_keep_release_channel_until_last_clone_and_revoke_on_stop() {
+        let (release, mut released) = watch::channel(());
+        let (stop, stopping) = watch::channel(false);
+        let active = Arc::new(AtomicBool::new(true));
+        let image = PinnedImage::new(
+            ResolvedImage::fixture(Architecture::Arm64),
+            4096.try_into().unwrap(),
+            release,
+            active.clone(),
+            stopping,
+        );
+        let captured = image.clone();
+        drop(image);
+        assert!(!released.has_changed().unwrap());
+        assert!(captured.is_live());
+        assert_eq!(captured.unpacked_size().get(), 4096);
+        assert!(!format!("{captured:?}").contains("entrypoint"));
+        stop.send_replace(true);
+        assert!(!captured.is_live());
+        drop(captured);
+        let _ = released.changed().await;
+        assert!(released.has_changed().is_err());
+    }
+}
diff --git a/crates/rustack-lambda-core/src/config.rs b/crates/rustack-lambda-core/src/config.rs
index ed8fbf39..939ba6ba 100644
--- a/crates/rustack-lambda-core/src/config.rs
+++ b/crates/rustack-lambda-core/src/config.rs
@@ -42,7 +42,7 @@ impl LambdaConfig {
     /// - `GATEWAY_HOST` (default: `localhost`)
     /// - `GATEWAY_PORT` (default: `4566`)
     /// - `LAMBDA_DOCKER_ENABLED` (default: `false` — legacy alias for `LAMBDA_EXECUTOR=docker`).
-    /// - `LAMBDA_EXECUTOR` (default: `disabled`; unsupported Docker settings fail explicitly).
+    /// - `LAMBDA_EXECUTOR` (default: `disabled`; Docker requires qualified runtime installation).
     ///   Accepts `disabled`, `auto`, `native`, `docker`, `squib`. Auto uses Squib for Zip functions
     ///   on macOS and native execution otherwise. The native backend runs `provided.*` bootstraps
     ///   (Rust / Go / C++) directly on the host with no Docker requirement.
@@ -50,6 +50,11 @@ impl LambdaConfig {
     /// - `LAMBDA_IDLE_TIMEOUT_SECS` (default: `600`)
     /// - `LAMBDA_INIT_TIMEOUT_SECS` (default: `5`)
     /// - `LAMBDA_SQUIB_*` variables documented by [`SquibExecutorConfig`].
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed environment values, invalid budgets,
+    /// conflicting executor settings or invalid Squib configuration.
     pub fn from_env() -> Result<Self, crate::error::LambdaServiceError> {
         Self::from_lookup(|key| match rustack_core::settings::var(key) {
             Ok(value) => Some(value),
@@ -59,6 +64,11 @@ impl LambdaConfig {
     }
 
     /// Parse an explicit environment lookup without changing process globals.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed scalar values, invalid budgets/identifiers, conflicting executor
+    /// settings or invalid Squib configuration.
     pub fn from_lookup(
         lookup: impl Fn(&str) -> Option<String>,
     ) -> Result<Self, crate::error::LambdaServiceError> {
@@ -94,9 +104,6 @@ impl LambdaConfig {
         if docker_enabled && executor != ExecutorBackend::Docker {
             return Err(error("conflicting Docker/executor settings"));
         }
-        if executor == ExecutorBackend::Docker {
-            return Err(error("Docker execution is not supported by this build"));
-        }
         let mut config = Self {
             executor,
             docker_enabled,
@@ -196,6 +203,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_should_parse_explicit_docker_without_granting_unqualified_execution() {
+        for (key, value) in [
+            ("LAMBDA_EXECUTOR", "docker"),
+            ("LAMBDA_DOCKER_ENABLED", "true"),
+        ] {
+            let config =
+                LambdaConfig::from_lookup(|name| (name == key).then(|| value.into())).unwrap();
+            assert_eq!(config.executor, ExecutorBackend::Docker);
+            let provider = crate::provider::RustackLambda::new(config);
+            assert!(!provider.is_ready());
+            assert!(provider.executor().image_available().is_err());
+        }
+    }
+
     #[test]
     fn test_should_create_default_config() {
         let config = LambdaConfig::default();
diff --git a/crates/rustack-lambda-core/src/deployment.rs b/crates/rustack-lambda-core/src/deployment.rs
new file mode 100644
index 00000000..7cefbee7
--- /dev/null
+++ b/crates/rustack-lambda-core/src/deployment.rs
@@ -0,0 +1,555 @@
+//! Typed deployment transitions and stale-result protection at the store boundary.
+//!
+//! A retained worker owns each candidate until settlement. Store keys bind resource
+//! lifetime, original revision and deployment generation; metadata is never a live lease.
+
+#[cfg(unix)]
+mod manager;
+use std::fmt;
+
+#[cfg(unix)]
+pub use manager::{ImageDeploymentConfig, ImageDeploymentManager, ImageDeploymentStatus};
+use rustack_lambda_model::types::ImageConfig;
+use serde::{Deserialize, Serialize};
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use crate::{
+    artifact::{Architecture, ImageArtifact, ImageReference, PinnedImage},
+    error::LambdaServiceError,
+    identity::FunctionResourceId,
+    storage::{FunctionRecord, FunctionStore, VersionRecord},
+};
+
+/// A nonnil identity for one accepted deployment attempt.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+#[non_exhaustive]
+pub struct DeploymentGeneration(Uuid);
+
+impl TryFrom<Uuid> for DeploymentGeneration {
+    type Error = LambdaServiceError;
+    fn try_from(value: Uuid) -> Result<Self, Self::Error> {
+        if value.is_nil() {
+            return Err(invalid("Deployment generation cannot be nil"));
+        }
+        Ok(Self(value))
+    }
+}
+impl TryFrom<String> for DeploymentGeneration {
+    type Error = LambdaServiceError;
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        if value.len() != 36 {
+            return Err(invalid("Invalid deployment generation"));
+        }
+        let id = Uuid::parse_str(&value).map_err(|_| invalid("Invalid deployment generation"))?;
+        Self::try_from(id)
+    }
+}
+impl From<DeploymentGeneration> for String {
+    fn from(value: DeploymentGeneration) -> Self {
+        value.0.to_string()
+    }
+}
+
+/// Bounded public failure vocabulary; no backend response or secret is retained.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub enum ImageDeploymentFailure {
+    /// The requested content is unavailable.
+    ImageNotFound,
+    /// Image metadata or its effective entry configuration is invalid.
+    InvalidImage,
+    /// The selected architecture cannot run under the configured policy.
+    UnsupportedPlatform,
+    /// Docker is unavailable or its ownership health is degraded.
+    RuntimeUnavailable,
+    /// Deployment exceeded its absolute deadline.
+    DeadlineExceeded,
+    /// Deployment was cancelled before settlement.
+    Cancelled,
+    /// Its retained supervisor failed.
+    SupervisorFailed,
+}
+impl ImageDeploymentFailure {
+    /// Static, bounded API reason with no untrusted backend text.
+    ///
+    /// ```
+    /// use rustack_lambda_core::deployment::ImageDeploymentFailure;
+    /// assert!(ImageDeploymentFailure::InvalidImage.reason().len() < 256);
+    /// ```
+    #[must_use]
+    pub const fn reason(self) -> &'static str {
+        match self {
+            Self::ImageNotFound => "Requested image content is unavailable",
+            Self::InvalidImage => "Image metadata or entry configuration is invalid",
+            Self::UnsupportedPlatform => "Image platform is unsupported by this runtime",
+            Self::RuntimeUnavailable => "Image runtime is unavailable",
+            Self::DeadlineExceeded => "Image deployment deadline exceeded",
+            Self::Cancelled => "Image deployment was cancelled",
+            Self::SupervisorFailed => "Image deployment supervisor failed",
+        }
+    }
+
+    /// AWS-compatible reason category for the local failure.
+    ///
+    /// ```
+    /// use rustack_lambda_core::deployment::ImageDeploymentFailure;
+    /// assert_eq!(ImageDeploymentFailure::InvalidImage.code(), "InvalidImage");
+    /// ```
+    #[must_use]
+    pub const fn code(self) -> &'static str {
+        match self {
+            Self::ImageNotFound => "ImageDeleted",
+            Self::InvalidImage | Self::UnsupportedPlatform => "InvalidImage",
+            Self::RuntimeUnavailable
+            | Self::DeadlineExceeded
+            | Self::Cancelled
+            | Self::SupervisorFailed => "InternalError",
+        }
+    }
+}
+
+/// One authoritative state for both function readiness and update progress.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(
+    tag = "kind",
+    content = "detail",
+    rename_all = "camelCase",
+    deny_unknown_fields
+)]
+#[non_exhaustive]
+pub enum DeploymentState {
+    /// Usable revision with no failed or pending update.
+    #[default]
+    Ready,
+    /// Initial deployment; no previous executable revision exists.
+    Creating(DeploymentGeneration),
+    /// Initial deployment failed.
+    CreateFailed(ImageDeploymentFailure),
+    /// Previous revision remains usable while a candidate prepares.
+    Updating(DeploymentGeneration),
+    /// Previous revision remains usable after a failed update.
+    UpdateFailed(ImageDeploymentFailure),
+}
+impl DeploymentState {
+    /// Public Lambda function state.
+    ///
+    /// ```
+    /// assert_eq!(rustack_lambda_core::deployment::DeploymentState::Ready.state(), "Active");
+    /// ```
+    #[must_use]
+    pub const fn state(self) -> &'static str {
+        match self {
+            Self::Ready | Self::Updating(_) | Self::UpdateFailed(_) => "Active",
+            Self::Creating(_) => "Pending",
+            Self::CreateFailed(_) => "Failed",
+        }
+    }
+
+    /// Public Lambda update status.
+    ///
+    /// ```
+    /// assert_eq!(rustack_lambda_core::deployment::DeploymentState::Ready.update_status(), "Successful");
+    /// ```
+    #[must_use]
+    pub const fn update_status(self) -> &'static str {
+        match self {
+            Self::Ready => "Successful",
+            Self::Creating(_) | Self::Updating(_) => "InProgress",
+            Self::CreateFailed(_) | Self::UpdateFailed(_) => "Failed",
+        }
+    }
+
+    /// Public failure reason, if a deployment failed.
+    ///
+    /// ```
+    /// assert!(rustack_lambda_core::deployment::DeploymentState::Ready.failure().is_none());
+    /// ```
+    #[must_use]
+    pub const fn failure(self) -> Option<ImageDeploymentFailure> {
+        match self {
+            Self::CreateFailed(reason) | Self::UpdateFailed(reason) => Some(reason),
+            _ => None,
+        }
+    }
+
+    /// `StateReason` describes initial readiness failure, not a failed update.
+    pub(crate) const fn creation_failure(self) -> Option<ImageDeploymentFailure> {
+        match self {
+            Self::CreateFailed(failure) => Some(failure),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn ensure_mutable(self) -> Result<(), LambdaServiceError> {
+        if matches!(self, Self::Creating(_) | Self::Updating(_)) {
+            return Err(conflict("A function deployment is already in progress"));
+        }
+        Ok(())
+    }
+
+    pub(crate) fn restore(legacy: &str, saved: Option<Self>) -> Result<Self, LambdaServiceError> {
+        let state = match saved {
+            Some(state) if state.state() == legacy => state,
+            Some(_) => return Err(invalid("Snapshot deployment states contradict each other")),
+            None => match legacy {
+                "Active" => Self::Ready,
+                "Pending" => Self::CreateFailed(ImageDeploymentFailure::Cancelled),
+                "Failed" => Self::CreateFailed(ImageDeploymentFailure::InvalidImage),
+                _ => return Err(invalid("Unsupported snapshot function state")),
+            },
+        };
+        Ok(match state {
+            Self::Creating(_) => Self::CreateFailed(ImageDeploymentFailure::Cancelled),
+            Self::Updating(_) => Self::UpdateFailed(ImageDeploymentFailure::Cancelled),
+            state => state,
+        })
+    }
+}
+
+/// Closed candidate issued by a store transaction, owned by a deployment worker.
+///
+/// Debug omits its image reference, entry configuration and environment.
+///
+/// Construction is restricted to validated store transactions:
+///
+/// ```compile_fail
+/// use rustack_lambda_core::deployment::ImageDeployment;
+/// let forged = ImageDeployment::builder();
+/// ```
+#[derive(Clone, TypedBuilder)]
+#[builder(
+    builder_method(vis = ""),
+    build_method(vis = ""),
+    builder_type(vis = "")
+)]
+#[non_exhaustive]
+pub struct ImageDeployment {
+    name: String,
+    resource: FunctionResourceId,
+    original_revision: String,
+    generation: DeploymentGeneration,
+    initial: bool,
+    candidate: VersionRecord,
+    architecture: Architecture,
+    reference: ImageReference,
+}
+impl fmt::Debug for ImageDeployment {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ImageDeployment")
+            .field("resource", &self.resource)
+            .field("generation", &self.generation)
+            .field("initial", &self.initial)
+            .finish_non_exhaustive()
+    }
+}
+impl ImageDeployment {
+    fn new(
+        record: &FunctionRecord,
+        candidate: VersionRecord,
+        initial: bool,
+    ) -> Result<Self, LambdaServiceError> {
+        crate::resolver::FunctionName::parse(&record.name)?;
+        if record.latest.revision_id.len() != 36
+            || Uuid::parse_str(&record.latest.revision_id).is_err()
+        {
+            return Err(invalid("Invalid deployment revision identity"));
+        }
+        let architecture = crate::function_config::validate_execution_settings(&candidate)?;
+        let reference = candidate
+            .image_uri
+            .as_deref()
+            .ok_or_else(|| invalid("Image reference is required"))?
+            .parse()
+            .map_err(|_| invalid("Invalid image reference"))?;
+        Ok(Self::builder()
+            .name(record.name.clone())
+            .resource(record.resource_id)
+            .original_revision(record.latest.revision_id.clone())
+            .generation(DeploymentGeneration(Uuid::new_v4()))
+            .initial(initial)
+            .candidate(candidate)
+            .architecture(architecture)
+            .reference(reference)
+            .build())
+    }
+
+    /// Reference captured at acceptance for bounded image preparation.
+    ///
+    /// ```no_run
+    /// # fn inspect(job: &rustack_lambda_core::deployment::ImageDeployment) {
+    /// let reference = job.reference();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn reference(&self) -> &ImageReference {
+        &self.reference
+    }
+
+    /// Validated requested architecture for this candidate.
+    ///
+    /// ```no_run
+    /// # fn inspect(job: &rustack_lambda_core::deployment::ImageDeployment) {
+    /// let architecture = job.architecture();
+    /// # }
+    /// ```
+    #[must_use]
+    pub const fn architecture(&self) -> Architecture {
+        self.architecture
+    }
+
+    /// Complete entry overrides; omitted and empty arrays remain distinct.
+    ///
+    /// ```no_run
+    /// # fn inspect(job: &rustack_lambda_core::deployment::ImageDeployment) {
+    /// let overrides = job.image_config();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn image_config(&self) -> Option<&ImageConfig> {
+        self.candidate.image_config.as_ref()
+    }
+
+    #[cfg(unix)]
+    pub(crate) fn is_current(&self, store: &FunctionStore) -> Result<bool, LambdaServiceError> {
+        Ok(store
+            .get(&self.name)?
+            .as_ref()
+            .is_some_and(|record| self.matches(record)))
+    }
+
+    fn matches(&self, record: &FunctionRecord) -> bool {
+        let state = if self.initial {
+            DeploymentState::Creating(self.generation)
+        } else {
+            DeploymentState::Updating(self.generation)
+        };
+        record.resource_id == self.resource
+            && record.latest.revision_id == self.original_revision
+            && record.latest.deployment == state
+    }
+}
+
+impl FunctionStore {
+    /// Insert an initial Pending image deployment after the caller reserves work.
+    ///
+    /// # Errors
+    /// Rejects duplicate/invalid records and non-image or already resolved candidates.
+    ///
+    /// ```no_run
+    /// # fn accept(store: &rustack_lambda_core::storage::FunctionStore, record: rustack_lambda_core::storage::FunctionRecord) -> Result<(), rustack_lambda_core::error::LambdaServiceError> {
+    /// let candidate = store.insert_image_deployment(record)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn insert_image_deployment(
+        &self,
+        record: FunctionRecord,
+    ) -> Result<ImageDeployment, LambdaServiceError> {
+        self.reserve_image_create(record).map(|(job, _)| job)
+    }
+
+    pub(crate) fn reserve_image_create(
+        &self,
+        mut record: FunctionRecord,
+    ) -> Result<(ImageDeployment, FunctionRecord), LambdaServiceError> {
+        if record.latest.package_type != "Image"
+            || !matches!(record.latest.image, ImageArtifact::Unresolved)
+            || record.latest.deployment != DeploymentState::Ready
+            || !record.versions.is_empty()
+        {
+            return Err(invalid(
+                "Initial image candidate must be unresolved and unpublished",
+            ));
+        }
+        record.latest.code_sha256.clear();
+        record.latest.code_size = 0;
+        let job = ImageDeployment::new(&record, record.latest.clone(), true)?;
+        record.latest.deployment = DeploymentState::Creating(job.generation);
+        self.insert(record.clone())?;
+        Ok((job, record))
+    }
+
+    /// Reserve an image update while preserving the previous usable revision.
+    ///
+    /// # Errors
+    /// Rejects stale resource/revision keys, pending work, package changes or invalid settings.
+    ///
+    /// ```no_run
+    /// # fn accept(store: &rustack_lambda_core::storage::FunctionStore, record: &rustack_lambda_core::storage::FunctionRecord) -> Result<(), rustack_lambda_core::error::LambdaServiceError> {
+    /// let job = store.begin_image_update(&record.name, record.resource_id,
+    ///     &record.latest.revision_id, "worker:v2".parse().map_err(|_| rustack_lambda_core::error::LambdaServiceError::DockerNotAvailable)?,
+    ///     rustack_lambda_core::artifact::Architecture::Arm64)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn begin_image_update(
+        &self,
+        name: &str,
+        resource: FunctionResourceId,
+        expected: &str,
+        reference: ImageReference,
+        architecture: Architecture,
+    ) -> Result<ImageDeployment, LambdaServiceError> {
+        self.reserve_image_update(name, resource, expected, reference, architecture, None)
+            .map(|(job, _)| job)
+    }
+
+    pub(crate) fn reserve_image_update(
+        &self,
+        name: &str,
+        resource: FunctionResourceId,
+        expected: &str,
+        reference: ImageReference,
+        architecture: Architecture,
+        requested: Option<&str>,
+    ) -> Result<(ImageDeployment, FunctionRecord), LambdaServiceError> {
+        self.try_update_if_revision(name, None, |record| {
+            check_revision(requested, &record.latest.revision_id)?;
+            if record.resource_id != resource || record.latest.revision_id != expected {
+                return Err(conflict("Function resource changed"));
+            }
+            record.latest.deployment.ensure_mutable()?;
+            if record.latest.package_type != "Image" {
+                return Err(invalid("Deployment package type cannot change"));
+            }
+            let mut candidate = record.latest.clone();
+            candidate.image_uri = Some(reference.into());
+            candidate.architectures = vec![architecture.as_str().into()];
+            candidate.image = ImageArtifact::Unresolved;
+            candidate.code_sha256.clear();
+            candidate.code_size = 0;
+            candidate.deployment = DeploymentState::Ready;
+            let initial = matches!(record.latest.deployment, DeploymentState::CreateFailed(_));
+            let job = ImageDeployment::new(record, candidate.clone(), initial)?;
+            if initial {
+                record.latest = candidate;
+            }
+            record.latest.deployment = if initial {
+                DeploymentState::Creating(job.generation)
+            } else {
+                DeploymentState::Updating(job.generation)
+            };
+            Ok((job, record.clone()))
+        })
+    }
+
+    /// Atomically settle a candidate only while all accepted identity keys match.
+    ///
+    /// Stale/duplicate/deleted results return false and cannot mutate live metadata.
+    /// The caller must retain and join the worker independently of this transaction.
+    ///
+    /// # Errors
+    /// Rejects a revoked/mismatching lease or an invalid candidate without committing it.
+    ///
+    /// ```no_run
+    /// # fn finish(store: &rustack_lambda_core::storage::FunctionStore, job: &rustack_lambda_core::deployment::ImageDeployment) -> Result<(), rustack_lambda_core::error::LambdaServiceError> {
+    /// store.settle_image_deployment(job, Err(rustack_lambda_core::deployment::ImageDeploymentFailure::Cancelled))?;
+    /// # Ok(()) }
+    /// ```
+    pub fn settle_image_deployment(
+        &self,
+        job: &ImageDeployment,
+        outcome: Result<PinnedImage, ImageDeploymentFailure>,
+    ) -> Result<bool, LambdaServiceError> {
+        let Some(before) = self.get(&job.name)? else {
+            return Ok(false);
+        };
+        if !job.matches(&before) {
+            return Ok(false);
+        }
+        let receipt = outcome.as_ref().ok().cloned();
+        let prepared = match outcome {
+            Ok(image) => {
+                if !image.is_live()
+                    || image.resolved().metadata().requested_reference != job.reference
+                    || image.resolved().metadata().architecture != job.architecture
+                {
+                    return Err(invalid(
+                        "Prepared image does not match deployment candidate",
+                    ));
+                }
+                image
+                    .resolved()
+                    .metadata()
+                    .execution
+                    .plan(job.image_config())
+                    .map_err(|_| invalid("Invalid effective image entry configuration"))?;
+                let mut candidate = job.candidate.clone();
+                candidate.code_sha256 = image
+                    .resolved()
+                    .code_sha256()
+                    .map_err(|_| invalid("Invalid image fingerprint"))?;
+                candidate.code_size = image.unpacked_size().get();
+                candidate.image = ImageArtifact::Pinned(image);
+                candidate.deployment = DeploymentState::Ready;
+                candidate.revision_id = Uuid::new_v4().to_string();
+                candidate.last_modified = crate::provider::now_iso8601();
+                Ok(candidate)
+            }
+            Err(failure) => Err(failure),
+        };
+        let committed = match self.update(&job.name, |record| {
+            if !job.matches(record) {
+                return false;
+            }
+            match prepared {
+                Ok(candidate) => record.latest = candidate,
+                Err(failure) => {
+                    record.latest.deployment = if job.initial {
+                        DeploymentState::CreateFailed(failure)
+                    } else {
+                        DeploymentState::UpdateFailed(failure)
+                    }
+                }
+            }
+            true
+        }) {
+            Err(LambdaServiceError::FunctionNotFound { .. }) => Ok(false),
+            result => result,
+        }?;
+        if committed {
+            if let Some(image) = receipt {
+                image.accept_preparation();
+            }
+        }
+        Ok(committed)
+    }
+}
+
+pub(crate) fn check_revision(
+    requested: Option<&str>,
+    actual: &str,
+) -> Result<(), LambdaServiceError> {
+    if let Some(requested) = requested {
+        if requested.is_empty()
+            || requested.len() > 100
+            || !requested
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || b"-_.".contains(&byte))
+        {
+            return Err(invalid("Invalid RevisionId"));
+        }
+        if requested != actual {
+            return Err(LambdaServiceError::PreconditionFailed);
+        }
+    }
+    Ok(())
+}
+
+fn invalid(message: &str) -> LambdaServiceError {
+    LambdaServiceError::InvalidParameter {
+        message: message.into(),
+    }
+}
+fn conflict(message: &str) -> LambdaServiceError {
+    LambdaServiceError::ResourceConflict {
+        message: message.into(),
+    }
+}
+
+#[cfg(test)]
+#[path = "deployment_tests.rs"]
+mod tests;
+#[cfg(test)]
+pub(crate) use tests::record as image_record_fixture;
diff --git a/crates/rustack-lambda-core/src/deployment/manager.rs b/crates/rustack-lambda-core/src/deployment/manager.rs
new file mode 100644
index 00000000..a250ff8f
--- /dev/null
+++ b/crates/rustack-lambda-core/src/deployment/manager.rs
@@ -0,0 +1,709 @@
+//! Bounded deployment admission, retained child joins and keyed failure recovery.
+//!
+//! Owner Drop intentionally leaves its signalled root running on the captured
+//! runtime to drain. The root owns child joins; abnormal root Drop transfers
+//! them and their reservations to retained emergency cleanup. Joined shutdown,
+//! not diagnostic counts, proves this owner's settlement. The separate image
+//! owner still owns critical mutations after a preparation future is cancelled.
+
+use std::{
+    collections::HashMap,
+    future::Future,
+    mem,
+    pin::Pin,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use http::StatusCode;
+use tokio::{
+    runtime::Handle,
+    sync::{OwnedSemaphorePermit, Semaphore, mpsc, watch},
+    task::{Id, JoinError, JoinSet},
+    time::{Instant, sleep_until, timeout_at},
+};
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use super::{ImageDeployment, ImageDeploymentFailure};
+use crate::{
+    artifact::{Architecture, ImageReference, PinnedImage},
+    docker::{DockerError, ImageLeasePort},
+    error::LambdaServiceError,
+    executor::ExecutorError,
+    invocation::CleanupTask,
+    provider::DockerArchiveProfile,
+    storage::{FunctionRecord, FunctionStore, FunctionStoreSnapshot, PreparedImport, image_error},
+};
+
+/// Validated accepted-deployment capacity and absolute preparation budget.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct ImageDeploymentConfig {
+    jobs: u8,
+    budget: Duration,
+}
+impl Default for ImageDeploymentConfig {
+    fn default() -> Self {
+        Self {
+            jobs: 8,
+            budget: Duration::from_secs(300),
+        }
+    }
+}
+impl ImageDeploymentConfig {
+    /// Validate one bounded deployment owner; capacity includes queued and running jobs.
+    ///
+    /// # Errors
+    /// Rejects capacity outside1..32 or a budget outside1..3,600 seconds.
+    ///
+    /// ```
+    /// let config = rustack_lambda_core::deployment::ImageDeploymentConfig::new(
+    ///     8, std::time::Duration::from_secs(300))?;
+    /// # Ok::<(),rustack_lambda_core::error::LambdaServiceError>(())
+    /// ```
+    pub fn new(jobs: u8, budget: Duration) -> Result<Self, LambdaServiceError> {
+        if !(1..=32).contains(&jobs)
+            || budget < Duration::from_secs(1)
+            || budget > Duration::from_secs(3600)
+        {
+            return Err(invalid("Invalid deployment capacity or deadline"));
+        }
+        Ok(Self { jobs, budget })
+    }
+}
+
+/// Diagnostic counts; use joined quiescence/shutdown for settlement evidence.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct ImageDeploymentStatus {
+    /// Queued/running jobs whose capacity has not yet been reaped.
+    pub accepted: usize,
+    /// Whether both owners currently permit new preparation.
+    pub accepting: bool,
+    /// A deployment supervisor failure permanently closed this owner.
+    pub failed: bool,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+enum Mode {
+    Running,
+    Drain,
+    Cancel,
+}
+#[derive(Debug, Default)]
+struct Health {
+    failed: AtomicBool,
+    #[cfg(test)]
+    crash_root: AtomicBool,
+    #[cfg(test)]
+    crash_worker: AtomicBool,
+}
+fn signal(control: &watch::Sender<Mode>, mode: Mode) {
+    control.send_if_modified(|current| {
+        if *current < mode {
+            *current = mode;
+            true
+        } else {
+            false
+        }
+    });
+}
+fn unavailable() -> LambdaServiceError {
+    LambdaServiceError::ResourceNotReady {
+        message: "Image deployment owner is unavailable".into(),
+    }
+}
+fn invalid(message: &str) -> LambdaServiceError {
+    LambdaServiceError::InvalidParameter {
+        message: message.into(),
+    }
+}
+fn failed() -> ExecutorError {
+    ExecutorError::CleanupFailed("Image deployment supervisor failed".into())
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Pending {
+    job: ImageDeployment,
+    store: Arc<FunctionStore>,
+    health: Arc<Health>,
+    control: watch::Sender<Mode>,
+    #[builder(default)]
+    settled: AtomicBool,
+}
+impl Pending {
+    fn finish(
+        &self,
+        outcome: Result<PinnedImage, ImageDeploymentFailure>,
+    ) -> Result<(), LambdaServiceError> {
+        if !self.settled.load(Ordering::Acquire) {
+            self.store.settle_image_deployment(&self.job, outcome)?;
+            self.settled.store(true, Ordering::Release);
+        }
+        Ok(())
+    }
+    fn fail_owner(&self) {
+        self.health.failed.store(true, Ordering::Release);
+        signal(&self.control, Mode::Cancel);
+    }
+}
+impl Drop for Pending {
+    fn drop(&mut self) {
+        if self.settled.load(Ordering::Acquire) {
+            return;
+        }
+        let reason = if self.health.failed.load(Ordering::Acquire)
+            || *self.control.borrow() != Mode::Cancel
+        {
+            self.fail_owner();
+            ImageDeploymentFailure::SupervisorFailed
+        } else {
+            ImageDeploymentFailure::Cancelled
+        };
+        if self.finish(Err(reason)).is_err() {
+            self.fail_owner();
+            tracing::error!("Abandoned image deployment could not be settled");
+        }
+    }
+}
+
+#[derive(Debug)]
+struct Envelope {
+    id: Uuid,
+    pending: Arc<Pending>,
+    slot: OwnedSemaphorePermit,
+    deadline: Instant,
+}
+#[derive(Debug)]
+struct Row {
+    pending: Arc<Pending>,
+    _slot: Arc<OwnedSemaphorePermit>,
+}
+#[derive(Debug)]
+struct Reservation {
+    queue: mpsc::OwnedPermit<Envelope>,
+    slot: OwnedSemaphorePermit,
+    deadline: Instant,
+}
+
+/// Own accepted image deployments through actual worker joins and keyed settlement.
+#[derive(Debug, TypedBuilder)]
+#[builder(
+    builder_method(vis = ""),
+    builder_type(vis = ""),
+    build_method(vis = "")
+)]
+#[non_exhaustive]
+pub struct ImageDeploymentManager {
+    store: Arc<FunctionStore>,
+    preparation: ImageLeasePort,
+    config: ImageDeploymentConfig,
+    capacity: Arc<Semaphore>,
+    sender: mpsc::Sender<Envelope>,
+    control: watch::Sender<Mode>,
+    health: Arc<Health>,
+    task: CleanupTask,
+    emergency: Arc<CleanupTask>,
+}
+impl ImageDeploymentManager {
+    /// Start a retained owner using an already qualified image preparation port.
+    ///
+    /// # Errors
+    /// Rejects unavailable preparation, excess capacity or lack of an entered runtime.
+    /// This does not probe or authorize the Docker execution backend.
+    ///
+    /// ```no_run
+    /// # fn start(store:std::sync::Arc<rustack_lambda_core::storage::FunctionStore>, port:rustack_lambda_core::docker::ImageLeasePort) -> Result<(),rustack_lambda_core::error::LambdaServiceError> {
+    /// let owner = rustack_lambda_core::deployment::ImageDeploymentManager::start(store, port,
+    ///     rustack_lambda_core::deployment::ImageDeploymentConfig::default())?;
+    /// # Ok(()) }
+    /// ```
+    pub fn start(
+        store: Arc<FunctionStore>,
+        preparation: ImageLeasePort,
+        config: ImageDeploymentConfig,
+    ) -> Result<Self, LambdaServiceError> {
+        preparation
+            .available()
+            .map_err(|_| LambdaServiceError::DockerNotAvailable)?;
+        if config.jobs > preparation.preparation_jobs() {
+            return Err(invalid("Deployment jobs exceed image preparation capacity"));
+        }
+        let runtime = Handle::try_current().map_err(|_| unavailable())?;
+        let (sender, inbox) = mpsc::channel(usize::from(config.jobs));
+        let (control, _) = watch::channel(Mode::Running);
+        let health = Arc::new(Health::default());
+        let emergency = Arc::new(CleanupTask::default());
+        let actor = Actor::builder()
+            .inbox(inbox)
+            .control(control.clone())
+            .preparation(preparation.clone())
+            .health(health.clone())
+            .runtime(runtime.clone())
+            .emergency(emergency.clone())
+            .build();
+        let task = CleanupTask::default();
+        task.start_on(&runtime, move || actor.run());
+        Ok(Self::builder()
+            .store(store)
+            .preparation(preparation)
+            .config(config)
+            .capacity(Arc::new(Semaphore::new(usize::from(config.jobs))))
+            .sender(sender)
+            .control(control)
+            .health(health)
+            .task(task)
+            .emergency(emergency)
+            .build())
+    }
+
+    fn available(&self) -> Result<(), LambdaServiceError> {
+        if *self.control.borrow() != Mode::Running || self.health.failed.load(Ordering::Acquire) {
+            return Err(unavailable());
+        }
+        self.preparation
+            .available()
+            .map_err(|_| LambdaServiceError::DockerNotAvailable)
+    }
+    fn reserve(&self) -> Result<Reservation, LambdaServiceError> {
+        self.available()?;
+        let deadline = Instant::now()
+            .checked_add(self.config.budget)
+            .ok_or_else(unavailable)?;
+        let slot = self
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| LambdaServiceError::TooManyRequests)?;
+        let queue = self
+            .sender
+            .clone()
+            .try_reserve_owned()
+            .map_err(|_| unavailable())?;
+        self.available()?;
+        Ok(Reservation {
+            queue,
+            slot,
+            deadline,
+        })
+    }
+    fn accept(
+        &self,
+        reservation: Reservation,
+        job: ImageDeployment,
+        accepted: FunctionRecord,
+    ) -> FunctionRecord {
+        let pending = Arc::new(
+            Pending::builder()
+                .job(job)
+                .store(self.store.clone())
+                .health(self.health.clone())
+                .control(self.control.clone())
+                .build(),
+        );
+        reservation.queue.send(Envelope {
+            id: Uuid::new_v4(),
+            pending,
+            slot: reservation.slot,
+            deadline: reservation.deadline,
+        });
+        accepted
+    }
+
+    /// Reserve work before inserting an initial Pending image function.
+    ///
+    /// # Errors
+    /// Rejects invalid/duplicate resources, unavailable owners or exhausted capacity.
+    /// The returned snapshot is captured before enqueue; dropping it does not cancel accepted work.
+    ///
+    /// ```no_run
+    /// # fn create(owner:&rustack_lambda_core::deployment::ImageDeploymentManager, record:rustack_lambda_core::storage::FunctionRecord) -> Result<(),rustack_lambda_core::error::LambdaServiceError> {
+    /// let pending = owner.create(record)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn create(&self, record: FunctionRecord) -> Result<FunctionRecord, LambdaServiceError> {
+        let reservation = self.reserve()?;
+        let (job, accepted) = self.store.reserve_image_create(record)?;
+        Ok(self.accept(reservation, job, accepted))
+    }
+
+    /// Reserve an update while preserving previous code and configuration.
+    ///
+    /// # Errors
+    /// Rejects stale resources/revisions, invalid settings, pending work or unavailable capacity.
+    ///
+    /// ```no_run
+    /// # fn update(owner:&rustack_lambda_core::deployment::ImageDeploymentManager, before:&rustack_lambda_core::storage::FunctionRecord) -> Result<(),rustack_lambda_core::error::LambdaServiceError> {
+    /// let reference = "worker:v2".parse().map_err(|_| rustack_lambda_core::error::LambdaServiceError::DockerNotAvailable)?;
+    /// owner.update(before, reference, rustack_lambda_core::artifact::Architecture::Arm64)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn update(
+        &self,
+        before: &FunctionRecord,
+        reference: ImageReference,
+        architecture: Architecture,
+    ) -> Result<FunctionRecord, LambdaServiceError> {
+        self.update_with_revision(before, reference, architecture, None)
+    }
+
+    pub(crate) fn update_with_revision(
+        &self,
+        before: &FunctionRecord,
+        reference: ImageReference,
+        architecture: Architecture,
+        requested: Option<&str>,
+    ) -> Result<FunctionRecord, LambdaServiceError> {
+        super::check_revision(requested, &before.latest.revision_id)?;
+        let reservation = self.reserve()?;
+        let (job, accepted) = self.store.reserve_image_update(
+            &before.name,
+            before.resource_id,
+            &before.latest.revision_id,
+            reference,
+            architecture,
+            requested,
+        )?;
+        Ok(self.accept(reservation, job, accepted))
+    }
+
+    /// Observe bounded admission; counts alone never prove clean settlement.
+    ///
+    /// ```no_run
+    /// # fn inspect(owner:&rustack_lambda_core::deployment::ImageDeploymentManager) {
+    /// let count = owner.status().accepted;
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> ImageDeploymentStatus {
+        ImageDeploymentStatus {
+            accepted: usize::from(self.config.jobs)
+                .saturating_sub(self.capacity.available_permits()),
+            accepting: self.available().is_ok(),
+            failed: self.health.failed.load(Ordering::Acquire),
+        }
+    }
+
+    pub(crate) fn cancel(&self) {
+        signal(&self.control, Mode::Cancel);
+    }
+
+    async fn join(&self, deadline: Instant) -> Result<(), ExecutorError> {
+        if Instant::now() >= deadline {
+            return Err(ExecutorError::DeadlineExceeded);
+        }
+        let result = timeout_at(deadline, async {
+            let primary = self.task.wait().await;
+            let emergency = self.emergency.wait().await;
+            primary.and(emergency)
+        })
+        .await
+        .map_err(|_| ExecutorError::DeadlineExceeded)?;
+        if Instant::now() >= deadline {
+            return Err(ExecutorError::DeadlineExceeded);
+        }
+        result
+    }
+    pub(crate) async fn prepare_restore(
+        &self,
+        snapshot: FunctionStoreSnapshot,
+        deadline: Instant,
+        profile: DockerArchiveProfile,
+    ) -> Result<PreparedImport<'_>, LambdaServiceError> {
+        self.restore_available()?;
+        self.store
+            .prepare_docker_snapshot(snapshot, &self.preparation, deadline, profile)
+            .await
+    }
+
+    pub(crate) fn restore_available(&self) -> Result<(), LambdaServiceError> {
+        let status = self.status();
+        if !status.accepting || status.failed || status.accepted != 0 {
+            return Err(invalid(
+                "Image restore requires an idle healthy deployment owner",
+            ));
+        }
+        self.preparation.available().map_err(image_error)
+    }
+
+    /// Close admission and drain accepted workers without cancelling preparation.
+    ///
+    /// # Errors
+    /// Returns deadline or cached supervision failure while retaining joins.
+    /// The separate image owner must also join its critical mutations and cleanup.
+    ///
+    /// ```no_run
+    /// # async fn stop(owner:&rustack_lambda_core::deployment::ImageDeploymentManager) {
+    /// let result = owner.quiesce(tokio::time::Instant::now()+std::time::Duration::from_secs(10)).await;
+    /// # }
+    /// ```
+    pub async fn quiesce(&self, deadline: Instant) -> Result<(), ExecutorError> {
+        signal(&self.control, Mode::Drain);
+        self.join(deadline).await
+    }
+
+    /// Cancel accepted preparations, settle records and join this owner's workers.
+    ///
+    /// # Errors
+    /// Returns deadline or cached supervision failure; cancelled waiters retain joins.
+    ///
+    /// ```no_run
+    /// # async fn stop(owner:&rustack_lambda_core::deployment::ImageDeploymentManager) {
+    /// let result = owner.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(10)).await;
+    /// # }
+    /// ```
+    pub async fn shutdown(&self, deadline: Instant) -> Result<(), ExecutorError> {
+        signal(&self.control, Mode::Cancel);
+        self.join(deadline).await
+    }
+}
+impl Drop for ImageDeploymentManager {
+    fn drop(&mut self) {
+        signal(&self.control, Mode::Cancel);
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Actor {
+    inbox: mpsc::Receiver<Envelope>,
+    preparation: ImageLeasePort,
+    control: watch::Sender<Mode>,
+    health: Arc<Health>,
+    runtime: Handle,
+    emergency: Arc<CleanupTask>,
+    #[builder(default)]
+    jobs: JoinSet<Result<Uuid, ExecutorError>>,
+    #[builder(default)]
+    rows: HashMap<Uuid, Row>,
+    #[builder(default)]
+    index: HashMap<Id, Uuid>,
+    #[builder(default)]
+    settled: bool,
+}
+impl Actor {
+    fn fail(&self) {
+        self.health.failed.store(true, Ordering::Release);
+        signal(&self.control, Mode::Cancel);
+    }
+    async fn run(mut self) -> Result<(), ExecutorError> {
+        let mut control = self.control.subscribe();
+        let mut closed = false;
+        loop {
+            if *control.borrow() != Mode::Running {
+                self.inbox.close();
+            }
+            if closed && self.jobs.is_empty() {
+                break;
+            }
+            tokio::select! {
+                biased;
+                _ = control.changed() => {},
+                joined = self.jobs.join_next_with_id(), if !self.jobs.is_empty() => if let Some(joined) = joined { self.reap(&joined); },
+                envelope = self.inbox.recv(), if !closed => if let Some(envelope) = envelope {
+                    if *control.borrow() == Mode::Cancel {
+                        if envelope.pending.finish(Err(ImageDeploymentFailure::Cancelled)).is_err() { self.fail(); }
+                    } else { self.start(envelope); }
+                } else {
+                    closed = true;
+                    if *control.borrow() == Mode::Running { signal(&self.control, Mode::Cancel); }
+                },
+            }
+        }
+        self.settled = true;
+        if self.health.failed.load(Ordering::Acquire) {
+            Err(failed())
+        } else {
+            Ok(())
+        }
+    }
+    fn start(&mut self, envelope: Envelope) {
+        #[cfg(test)]
+        assert!(
+            !self.health.crash_root.swap(false, Ordering::AcqRel),
+            "injected deployment root failure"
+        );
+        let Envelope {
+            id,
+            pending,
+            slot,
+            deadline,
+        } = envelope;
+        let slot = Arc::new(slot);
+        self.rows.insert(
+            id,
+            Row {
+                pending: pending.clone(),
+                _slot: slot.clone(),
+            },
+        );
+        let preparation = self.preparation.clone();
+        let control = self.control.subscribe();
+        #[cfg(test)]
+        let health = self.health.clone();
+        let worker = self.jobs.spawn(async move {
+            #[cfg(test)]
+            assert!(
+                !health.crash_worker.swap(false, Ordering::AcqRel),
+                "injected deployment worker failure"
+            );
+            let outcome = prepare(&pending, preparation, control, deadline, slot).await;
+            let outcome = if pending.health.failed.load(Ordering::Acquire) {
+                Err(ImageDeploymentFailure::SupervisorFailed)
+            } else {
+                outcome
+            };
+            if pending.finish(outcome).is_err()
+                && pending
+                    .finish(Err(ImageDeploymentFailure::InvalidImage))
+                    .is_err()
+            {
+                return Err(failed());
+            }
+            Ok(id)
+        });
+        self.index.insert(worker.id(), id);
+    }
+    fn reap(&mut self, joined: &Result<(Id, Result<Uuid, ExecutorError>), JoinError>) {
+        let task = match joined {
+            Ok((id, _)) => *id,
+            Err(error) => error.id(),
+        };
+        let Some(id) = self.index.remove(&task) else {
+            self.fail();
+            return;
+        };
+        let Some(row) = self.rows.remove(&id) else {
+            self.fail();
+            return;
+        };
+        if !matches!(joined, Ok((_, Ok(returned))) if *returned == id)
+            || !row.pending.settled.load(Ordering::Acquire)
+        {
+            self.fail();
+            if row
+                .pending
+                .finish(Err(ImageDeploymentFailure::SupervisorFailed))
+                .is_err()
+            {
+                tracing::error!("Failed image worker could not be settled");
+            }
+        }
+    }
+}
+impl Drop for Actor {
+    fn drop(&mut self) {
+        if !self.settled {
+            self.fail();
+        }
+        if self.rows.is_empty() {
+            return;
+        }
+        self.fail();
+        let rows = mem::take(&mut self.rows);
+        let mut jobs = mem::take(&mut self.jobs);
+        jobs.abort_all();
+        self.emergency.start_on(&self.runtime, move || async move {
+            while jobs.join_next().await.is_some() {}
+            let mut clean = true;
+            for row in rows.into_values() {
+                clean &= row
+                    .pending
+                    .finish(Err(ImageDeploymentFailure::SupervisorFailed))
+                    .is_ok();
+            }
+            if clean { Ok(()) } else { Err(failed()) }
+        });
+    }
+}
+
+async fn prepare(
+    pending: &Pending,
+    preparation: ImageLeasePort,
+    mut control: watch::Receiver<Mode>,
+    deadline: Instant,
+    admission: Arc<OwnedSemaphorePermit>,
+) -> Result<PinnedImage, ImageDeploymentFailure> {
+    let mut changes = pending.store.changes();
+    let preparation = preparation.prepare_deployment(
+        pending.job.reference(),
+        pending.job.architecture(),
+        pending.job.image_config(),
+        deadline,
+        admission,
+    );
+    tokio::pin!(preparation);
+    let result = loop {
+        check(pending, &control, deadline)?;
+        match next(preparation.as_mut(), &mut control, &mut changes, deadline).await? {
+            Progress::Prepared(result) => break result.map_err(|error| map_failure(&error)),
+            Progress::Changed => {}
+        }
+    };
+    check(pending, &control, deadline)?;
+    result
+}
+#[derive(Debug)]
+enum Progress {
+    Prepared(Result<PinnedImage, DockerError>),
+    Changed,
+}
+async fn next(
+    preparation: Pin<&mut impl Future<Output = Result<PinnedImage, DockerError>>>,
+    control: &mut watch::Receiver<Mode>,
+    changes: &mut watch::Receiver<()>,
+    deadline: Instant,
+) -> Result<Progress, ImageDeploymentFailure> {
+    tokio::select! {
+        biased;
+        () = sleep_until(deadline) => Err(ImageDeploymentFailure::DeadlineExceeded),
+        _ = control.wait_for(|mode| *mode == Mode::Cancel) => Err(ImageDeploymentFailure::Cancelled),
+        result = preparation => Ok(Progress::Prepared(result)),
+        notice = changes.changed() => notice.map(|()| Progress::Changed).map_err(|_| ImageDeploymentFailure::SupervisorFailed),
+    }
+}
+
+fn check(
+    pending: &Pending,
+    control: &watch::Receiver<Mode>,
+    deadline: Instant,
+) -> Result<(), ImageDeploymentFailure> {
+    if Instant::now() >= deadline {
+        return Err(ImageDeploymentFailure::DeadlineExceeded);
+    }
+    if *control.borrow() == Mode::Cancel {
+        return Err(ImageDeploymentFailure::Cancelled);
+    }
+    if !pending
+        .job
+        .is_current(&pending.store)
+        .map_err(|_| ImageDeploymentFailure::SupervisorFailed)?
+    {
+        return Err(ImageDeploymentFailure::Cancelled);
+    }
+    Ok(())
+}
+fn map_failure(error: &DockerError) -> ImageDeploymentFailure {
+    match error {
+        DockerError::Status(StatusCode::NOT_FOUND) => ImageDeploymentFailure::ImageNotFound,
+        DockerError::Deadline => ImageDeploymentFailure::DeadlineExceeded,
+        DockerError::Cancelled => ImageDeploymentFailure::Cancelled,
+        DockerError::Worker => ImageDeploymentFailure::SupervisorFailed,
+        DockerError::Configuration
+        | DockerError::Schema
+        | DockerError::Image(_)
+        | DockerError::Json(_)
+        | DockerError::Protocol
+        | DockerError::PullDenied
+        | DockerError::PullFailed
+        | DockerError::TooLarge => ImageDeploymentFailure::InvalidImage,
+        _ => ImageDeploymentFailure::RuntimeUnavailable,
+    }
+}
+
+#[cfg(test)]
+#[path = "manager_tests.rs"]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/deployment/manager_tests.rs b/crates/rustack-lambda-core/src/deployment/manager_tests.rs
new file mode 100644
index 00000000..a6dbb3be
--- /dev/null
+++ b/crates/rustack-lambda-core/src/deployment/manager_tests.rs
@@ -0,0 +1,817 @@
+use std::{
+    future::Future,
+    task::{Context, Poll, Waker},
+};
+
+use async_trait::async_trait;
+use rstest::rstest;
+use rustack_lambda_model::{
+    input::{
+        CreateFunctionInput, PublishVersionInput, UpdateFunctionCodeInput,
+        UpdateFunctionConfigurationInput,
+    },
+    types::FunctionCode,
+};
+use tokio::time::timeout;
+
+use super::*;
+use crate::{
+    artifact::ArtifactError,
+    config::LambdaConfig,
+    deployment::{DeploymentState, tests::record},
+    docker::{
+        ImageLeaseManager,
+        image_fixture::{Command, FakePins, Mode as DaemonMode},
+    },
+    executor::{Executor, ExecutorBackend, InvokeRequest, InvokeResponse, NoopExecutor},
+    invocation::InvocationContext,
+    provider::RustackLambda,
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+async fn until(condition: impl Fn() -> bool) {
+    timeout(Duration::from_secs(10), async {
+        while !condition() {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+fn latest(store: &FunctionStore) -> crate::storage::VersionRecord {
+    store.get("worker").unwrap().unwrap().latest
+}
+fn named(name: &str) -> FunctionRecord {
+    let mut record = record();
+    record.name = name.into();
+    record.arn = format!("arn:aws:lambda:us-east-1:000000000000:function:{name}");
+    record
+}
+struct Fixture {
+    root: tempfile::TempDir,
+    store: Arc<FunctionStore>,
+    fake: FakePins,
+    images: ImageLeaseManager,
+    manager: ImageDeploymentManager,
+}
+impl Fixture {
+    async fn new(mode: DaemonMode, jobs: u8, budget: Duration) -> Self {
+        let fake = FakePins::new(mode).await;
+        let images = fake.owner(8, jobs);
+        let root = tempfile::tempdir().unwrap();
+        let store = Arc::new(FunctionStore::new(root.path()));
+        let manager = ImageDeploymentManager::start(
+            store.clone(),
+            images.port(),
+            ImageDeploymentConfig::new(jobs, budget).unwrap(),
+        )
+        .unwrap();
+        Self {
+            root,
+            store,
+            fake,
+            images,
+            manager,
+        }
+    }
+    async fn idle(&self) {
+        until(|| self.manager.status().accepted == 0).await;
+    }
+    async fn failed_preparation(&self, reason: ImageDeploymentFailure) {
+        until(|| latest(&self.store).deployment == DeploymentState::CreateFailed(reason)).await;
+        assert_eq!(self.manager.status().accepted, 1);
+    }
+    async fn ready(&self) {
+        let pending = self.manager.create(record()).unwrap();
+        assert_eq!(pending.latest.deployment.state(), "Pending");
+        self.idle().await;
+        assert_eq!(latest(&self.store).deployment, DeploymentState::Ready);
+    }
+    async fn close(self, failed: bool) {
+        let Self {
+            root,
+            store,
+            fake,
+            mut images,
+            manager,
+        } = self;
+        assert_eq!(manager.shutdown(deadline()).await.is_err(), failed);
+        drop(manager);
+        drop(store);
+        images.shutdown(deadline()).await.unwrap();
+        fake.close().await;
+        drop(root);
+    }
+}
+
+#[tokio::test]
+async fn test_should_keep_accepted_preparation_owned_after_response_is_discarded() {
+    let fixture = Fixture::new(DaemonMode::Normal, 2, Duration::from_secs(10)).await;
+    drop(fixture.manager.create(record()).unwrap());
+    fixture.idle().await;
+    let active = latest(&fixture.store);
+    assert_eq!(active.deployment, DeploymentState::Ready);
+    assert_eq!(active.code_size, 4096);
+    assert!(active.image.pinned().unwrap().is_live());
+    assert!(!format!("{:?}", fixture.manager.status()).contains("private"));
+    drop(active);
+    fixture.close(false).await;
+}
+
+#[tokio::test]
+async fn test_should_reject_capacity_before_resource_insertion_and_drain_after_cancellation() {
+    let fixture = Fixture::new(DaemonMode::Never, 1, Duration::from_secs(10)).await;
+    fixture.manager.create(record()).unwrap();
+    fixture
+        .fake
+        .stats
+        .until(|| fixture.fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    assert!(matches!(
+        fixture.manager.create(named("other")),
+        Err(LambdaServiceError::TooManyRequests)
+    ));
+    assert!(!fixture.store.contains("other").unwrap());
+    assert!(fixture.manager.shutdown(Instant::now()).await.is_err());
+    fixture
+        .failed_preparation(ImageDeploymentFailure::Cancelled)
+        .await;
+    assert_eq!(
+        latest(&fixture.store).deployment,
+        DeploymentState::CreateFailed(ImageDeploymentFailure::Cancelled)
+    );
+    assert!(fixture.images.port().status().pins > 0);
+    fixture.fake.commands.send(Command::Commit).await.unwrap();
+    fixture.idle().await;
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 1);
+    fixture.close(false).await;
+}
+
+#[tokio::test]
+async fn test_should_preserve_old_revision_during_update_and_after_preparation_failure() {
+    let fixture = Fixture::new(DaemonMode::Normal, 2, Duration::from_secs(10)).await;
+    fixture.ready().await;
+    let before = fixture.store.get("worker").unwrap().unwrap();
+    let accepted = fixture
+        .manager
+        .update(&before, "missing:v2".parse().unwrap(), Architecture::Arm64)
+        .unwrap();
+    assert_eq!(accepted.latest.deployment.update_status(), "InProgress");
+    assert_eq!(accepted.latest.code_sha256, before.latest.code_sha256);
+    fixture.idle().await;
+    let failed = latest(&fixture.store);
+    assert_eq!(
+        failed.deployment,
+        DeploymentState::UpdateFailed(ImageDeploymentFailure::ImageNotFound)
+    );
+    assert_eq!(failed.revision_id, before.latest.revision_id);
+    assert_eq!(failed.code_sha256, before.latest.code_sha256);
+    drop(failed);
+    drop(accepted);
+    drop(before);
+    let before = fixture.store.get("worker").unwrap().unwrap();
+    fixture.fake.commands.send(Command::Retarget).await.unwrap();
+    fixture
+        .manager
+        .update(&before, "worker:v1".parse().unwrap(), Architecture::Arm64)
+        .unwrap();
+    fixture.idle().await;
+    assert_eq!(latest(&fixture.store).deployment, DeploymentState::Ready);
+    assert_ne!(
+        latest(&fixture.store).code_sha256,
+        before.latest.code_sha256
+    );
+    drop(before);
+    fixture.close(false).await;
+}
+
+#[tokio::test]
+async fn test_should_keep_deployment_deadline_absolute_and_leave_critical_tag_cleanup_owned() {
+    let fixture = Fixture::new(DaemonMode::Never, 1, Duration::from_secs(1)).await;
+    fixture.manager.create(record()).unwrap();
+    fixture
+        .fake
+        .stats
+        .until(|| fixture.fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    // Notifications must recheck identity without restarting the preparation future.
+    for _ in 0..4 {
+        fixture
+            .store
+            .update("worker", |record| {
+                record.tags.insert("progress".into(), "value".into());
+            })
+            .unwrap();
+    }
+    fixture
+        .failed_preparation(ImageDeploymentFailure::DeadlineExceeded)
+        .await;
+    assert_eq!(
+        latest(&fixture.store).deployment,
+        DeploymentState::CreateFailed(ImageDeploymentFailure::DeadlineExceeded)
+    );
+    assert!(fixture.images.port().status().pins > 0);
+    fixture.fake.commands.send(Command::Commit).await.unwrap();
+    fixture.idle().await;
+    fixture.close(false).await;
+}
+
+#[tokio::test]
+async fn test_should_cancel_deleted_generation_without_waiting_for_its_deployment_deadline() {
+    let fixture = Fixture::new(DaemonMode::Never, 1, Duration::from_secs(300)).await;
+    fixture.manager.create(record()).unwrap();
+    fixture
+        .fake
+        .stats
+        .until(|| fixture.fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    fixture.store.remove("worker").unwrap();
+    let mut replacement = record();
+    replacement.latest.description = "replacement".into();
+    let resource = replacement.resource_id;
+    fixture.store.insert(replacement).unwrap();
+    fixture.manager.quiesce(deadline()).await.unwrap();
+    assert_eq!(fixture.manager.status().accepted, 1);
+    assert_eq!(
+        fixture.store.get("worker").unwrap().unwrap().resource_id,
+        resource
+    );
+    assert_eq!(latest(&fixture.store).description, "replacement");
+    assert!(latest(&fixture.store).image.pinned().is_none());
+    fixture.fake.commands.send(Command::Commit).await.unwrap();
+    fixture.idle().await;
+    fixture.close(false).await;
+}
+
+#[tokio::test]
+async fn test_should_return_the_atomic_acceptance_receipt_after_immediate_deletion() {
+    let fixture = Fixture::new(DaemonMode::Normal, 1, Duration::from_secs(10)).await;
+    let reservation = fixture.manager.reserve().unwrap();
+    let (job, receipt) = fixture.store.reserve_image_create(record()).unwrap();
+    fixture.store.remove("worker").unwrap();
+    let accepted = fixture.manager.accept(reservation, job, receipt);
+    assert_eq!(accepted.latest.deployment.state(), "Pending");
+    fixture.idle().await;
+    assert!(!fixture.manager.status().failed);
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 0);
+    fixture.close(false).await;
+}
+
+#[tokio::test]
+async fn test_should_retain_join_when_drain_or_shutdown_waiter_is_abandoned() {
+    let fixture = Fixture::new(DaemonMode::Never, 1, Duration::from_secs(10)).await;
+    fixture.manager.create(record()).unwrap();
+    fixture
+        .fake
+        .stats
+        .until(|| fixture.fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    let mut waiter = Box::pin(fixture.manager.quiesce(deadline()));
+    assert!(matches!(
+        waiter
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop())),
+        Poll::Pending
+    ));
+    drop(waiter);
+    assert!(!fixture.manager.status().accepting);
+    assert_eq!(fixture.manager.status().accepted, 1);
+    let mut waiter = Box::pin(fixture.manager.shutdown(deadline()));
+    let _ = waiter
+        .as_mut()
+        .poll(&mut Context::from_waker(Waker::noop()));
+    drop(waiter);
+    fixture
+        .failed_preparation(ImageDeploymentFailure::Cancelled)
+        .await;
+    assert_eq!(
+        latest(&fixture.store).deployment,
+        DeploymentState::CreateFailed(ImageDeploymentFailure::Cancelled)
+    );
+    fixture.fake.commands.send(Command::Commit).await.unwrap();
+    fixture.idle().await;
+    fixture.close(false).await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_settle_failed_workers_or_queued_root_work_and_cache_failure(
+    #[case] root: bool,
+) {
+    let fixture = Fixture::new(DaemonMode::Normal, 2, Duration::from_secs(10)).await;
+    if root {
+        fixture
+            .manager
+            .health
+            .crash_root
+            .store(true, Ordering::Release);
+    } else {
+        fixture
+            .manager
+            .health
+            .crash_worker
+            .store(true, Ordering::Release);
+    }
+    fixture.manager.create(record()).unwrap();
+    fixture.idle().await;
+    assert!(fixture.manager.status().failed);
+    assert_eq!(
+        latest(&fixture.store).deployment,
+        DeploymentState::CreateFailed(ImageDeploymentFailure::SupervisorFailed)
+    );
+    assert!(fixture.manager.shutdown(deadline()).await.is_err());
+    assert!(fixture.manager.shutdown(deadline()).await.is_err());
+    assert!(fixture.manager.create(named("other")).is_err());
+    fixture.close(true).await;
+}
+
+#[tokio::test]
+async fn test_should_recover_joined_rows_after_root_drop_outside_an_entered_runtime() {
+    let fake = FakePins::new(DaemonMode::Never).await;
+    let mut images = fake.owner(4, 1);
+    let root = tempfile::tempdir().unwrap();
+    let store = Arc::new(FunctionStore::new(root.path()));
+    let job = store.insert_image_deployment(record()).unwrap();
+    let health = Arc::new(Health::default());
+    let (control, _) = watch::channel(Mode::Running);
+    let emergency = Arc::new(CleanupTask::default());
+    let (_sender, inbox) = mpsc::channel(1);
+    let mut actor = Actor::builder()
+        .inbox(inbox)
+        .preparation(images.port())
+        .control(control.clone())
+        .health(health.clone())
+        .runtime(Handle::current())
+        .emergency(emergency.clone())
+        .build();
+    let capacity = Arc::new(Semaphore::new(1));
+    actor.start(Envelope {
+        id: Uuid::new_v4(),
+        pending: Arc::new(
+            Pending::builder()
+                .job(job)
+                .store(store.clone())
+                .health(health.clone())
+                .control(control)
+                .build(),
+        ),
+        slot: capacity.clone().acquire_owned().await.unwrap(),
+        deadline: deadline(),
+    });
+    fake.stats
+        .until(|| fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    let thread = std::thread::spawn(move || drop(actor));
+    tokio::task::spawn_blocking(move || thread.join().unwrap())
+        .await
+        .unwrap();
+    emergency.wait().await.unwrap();
+    assert!(health.failed.load(Ordering::Acquire));
+    assert_eq!(capacity.available_permits(), 0);
+    assert_eq!(
+        latest(&store).deployment,
+        DeploymentState::CreateFailed(ImageDeploymentFailure::SupervisorFailed)
+    );
+    fake.commands.send(Command::Commit).await.unwrap();
+    drop(store);
+    images.shutdown(deadline()).await.unwrap();
+    assert_eq!(capacity.available_permits(), 1);
+    fake.close().await;
+}
+
+#[test]
+fn test_should_validate_deployment_budgets_and_map_bounded_failure_classes() {
+    assert!(ImageDeploymentConfig::new(0, Duration::from_secs(1)).is_err());
+    assert!(ImageDeploymentConfig::new(33, Duration::from_secs(1)).is_err());
+    assert!(ImageDeploymentConfig::new(1, Duration::from_nanos(1)).is_err());
+    assert!(ImageDeploymentConfig::new(1, Duration::from_secs(3601)).is_err());
+    assert_eq!(
+        map_failure(&DockerError::Status(StatusCode::NOT_FOUND)),
+        ImageDeploymentFailure::ImageNotFound
+    );
+    assert_eq!(
+        map_failure(&DockerError::Quarantined),
+        ImageDeploymentFailure::RuntimeUnavailable
+    );
+    assert_eq!(
+        map_failure(&DockerError::Protocol),
+        ImageDeploymentFailure::InvalidImage
+    );
+    for error in [
+        DockerError::PullDenied,
+        DockerError::PullFailed,
+        DockerError::Image(ArtifactError::Inspection),
+    ] {
+        assert_eq!(map_failure(&error), ImageDeploymentFailure::InvalidImage);
+    }
+    assert_eq!(
+        map_failure(&DockerError::Worker),
+        ImageDeploymentFailure::SupervisorFailed
+    );
+}
+
+#[derive(Debug)]
+struct ControlPlaneExecutor;
+#[async_trait]
+impl Executor for ControlPlaneExecutor {
+    fn image_available(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+    fn available(&self, _: &InvokeRequest) -> Result<(), ExecutorError> {
+        Err(ExecutorError::Unsupported(
+            "Control-plane fixture does not execute code".into(),
+        ))
+    }
+    async fn invoke(
+        &self,
+        _: InvokeRequest,
+        _: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        Err(ExecutorError::Unsupported(
+            "Control-plane fixture does not execute code".into(),
+        ))
+    }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+}
+fn input(name: &str) -> CreateFunctionInput {
+    CreateFunctionInput {
+        function_name: name.into(),
+        role: "arn:aws:iam::000000000000:role/test".into(),
+        package_type: Some("Image".into()),
+        architectures: Some(vec!["arm64".into()]),
+        code: FunctionCode {
+            image_uri: Some("worker:v1".into()),
+            ..Default::default()
+        },
+        ..Default::default()
+    }
+}
+async fn wait_provider(provider: &RustackLambda) {
+    until(|| {
+        let config = provider.get_function_configuration("worker", None).unwrap();
+        config.last_update_status.as_deref() != Some("InProgress")
+    })
+    .await;
+    // Give the joined root a chance to reap the completed worker before another admission.
+    tokio::task::yield_now().await;
+}
+
+#[tokio::test]
+async fn test_should_route_provider_image_create_update_status_and_explicit_revision_preconditions()
+{
+    let fake = FakePins::new(DaemonMode::Normal).await;
+    let mut images = fake.owner(8, 2);
+    let root = tempfile::tempdir().unwrap();
+    let config = LambdaConfig {
+        executor: ExecutorBackend::Docker,
+        ..Default::default()
+    };
+    let provider = RustackLambda::with_executor(
+        FunctionStore::new(root.path()),
+        config,
+        Arc::new(ControlPlaneExecutor),
+    )
+    .with_image_preparation(
+        images.port(),
+        ImageDeploymentConfig::new(2, Duration::from_secs(10)).unwrap(),
+    )
+    .unwrap();
+    let pending = provider.create_function(input("worker")).await.unwrap();
+    assert_eq!(pending.state.as_deref(), Some("Pending"));
+    assert!(pending.code_sha256.is_none());
+    wait_provider(&provider).await;
+    let before = provider.get_function_configuration("worker", None).unwrap();
+    assert_eq!(before.state.as_deref(), Some("Active"));
+    assert!(before.code_sha256.is_some());
+    assert!(matches!(
+        provider
+            .update_function_code(
+                "worker",
+                UpdateFunctionCodeInput {
+                    image_uri: Some("worker:v1".into()),
+                    revision_id: Some("stale".into()),
+                    ..Default::default()
+                }
+            )
+            .await,
+        Err(LambdaServiceError::PreconditionFailed)
+    ));
+    assert!(matches!(
+        provider.update_function_configuration(
+            "worker",
+            &UpdateFunctionConfigurationInput {
+                revision_id: Some("stale".into()),
+                ..Default::default()
+            }
+        ),
+        Err(LambdaServiceError::PreconditionFailed)
+    ));
+    fake.commands.send(Command::Retarget).await.unwrap();
+    let updating = provider
+        .update_function_code(
+            "worker",
+            UpdateFunctionCodeInput {
+                image_uri: Some("worker:v1".into()),
+                revision_id: before.revision_id.clone(),
+                ..Default::default()
+            },
+        )
+        .await
+        .unwrap();
+    assert_eq!(updating.state.as_deref(), Some("Active"));
+    assert_eq!(updating.last_update_status.as_deref(), Some("InProgress"));
+    assert_eq!(updating.code_sha256, before.code_sha256);
+    wait_provider(&provider).await;
+    let after = provider.get_function_configuration("worker", None).unwrap();
+    assert_ne!(after.code_sha256, before.code_sha256);
+    assert!(matches!(
+        provider.publish_version(
+            "worker",
+            &PublishVersionInput {
+                revision_id: before.revision_id,
+                ..Default::default()
+            }
+        ),
+        Err(LambdaServiceError::PreconditionFailed)
+    ));
+    let published = provider
+        .publish_version("worker", &PublishVersionInput::default())
+        .unwrap();
+    assert_eq!(published.version.as_deref(), Some("1"));
+    provider.shutdown().await;
+    drop(provider);
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_unqualified_image_deployment_before_resource_mutation() {
+    let provider = RustackLambda::new(LambdaConfig::default());
+    assert!(matches!(
+        provider.create_function(input("worker")).await,
+        Err(LambdaServiceError::DockerNotAvailable)
+    ));
+    assert!(!provider.store().contains("worker").unwrap());
+    assert!(NoopExecutor::new().image_available().is_err());
+    let fake = FakePins::new(DaemonMode::Normal).await;
+    let mut images = fake.owner(2, 1);
+    assert!(
+        RustackLambda::new(LambdaConfig {
+            executor: ExecutorBackend::Docker,
+            ..Default::default()
+        })
+        .with_image_preparation(
+            images.port(),
+            ImageDeploymentConfig::new(1, Duration::from_secs(1)).unwrap()
+        )
+        .is_err()
+    );
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_poll_ready_preparation_ahead_of_continuously_ready_unrelated_changes() {
+    let (_stop, mut control) = watch::channel(Mode::Running);
+    let (publisher, mut changes) = watch::channel(());
+    for _ in 0..16 {
+        publisher.send_replace(());
+        let image =
+            PinnedImage::fixture(crate::artifact::ResolvedImage::fixture(Architecture::Arm64));
+        let prepared = std::future::ready(Ok(image));
+        tokio::pin!(prepared);
+        assert!(matches!(
+            next(prepared.as_mut(), &mut control, &mut changes, deadline()).await,
+            Ok(Progress::Prepared(Ok(_)))
+        ));
+    }
+}
+
+#[tokio::test]
+async fn test_should_accept_a_long_overall_budget_while_bounding_each_docker_read() {
+    let fixture = Fixture::new(DaemonMode::Normal, 1, Duration::from_secs(3600)).await;
+    fixture.ready().await;
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 1);
+    fixture.close(false).await;
+}
+
+#[tokio::test]
+async fn test_should_keep_signalled_cleanup_running_when_owner_is_dropped_off_runtime() {
+    let fixture = Fixture::new(DaemonMode::Never, 1, Duration::from_secs(300)).await;
+    fixture.manager.create(record()).unwrap();
+    fixture
+        .fake
+        .stats
+        .until(|| fixture.fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    let Fixture {
+        root,
+        store,
+        fake,
+        mut images,
+        manager,
+    } = fixture;
+    let thread = std::thread::spawn(move || drop(manager));
+    tokio::task::spawn_blocking(move || thread.join().unwrap())
+        .await
+        .unwrap();
+    until(|| {
+        latest(&store).deployment
+            == DeploymentState::CreateFailed(ImageDeploymentFailure::Cancelled)
+    })
+    .await;
+    fake.commands.send(Command::Commit).await.unwrap();
+    drop(store);
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+    drop(root);
+}
+
+#[tokio::test]
+async fn test_should_mark_an_empty_abnormally_dropped_root_as_failed() {
+    let fake = FakePins::new(DaemonMode::Normal).await;
+    let mut images = fake.owner(2, 1);
+    let health = Arc::new(Health::default());
+    let (control, _) = watch::channel(Mode::Running);
+    let (_sender, inbox) = mpsc::channel(1);
+    let actor = Actor::builder()
+        .inbox(inbox)
+        .preparation(images.port())
+        .control(control.clone())
+        .health(health.clone())
+        .runtime(Handle::current())
+        .emergency(Arc::new(CleanupTask::default()))
+        .build();
+    drop(actor);
+    assert!(health.failed.load(Ordering::Acquire));
+    assert_eq!(*control.borrow(), Mode::Cancel);
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_fail_quiescence_at_one_deadline_then_cancel_without_losing_ownership() {
+    let fake = FakePins::new(DaemonMode::Never).await;
+    let mut images = fake.owner(2, 1);
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_executor(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Docker,
+            ..Default::default()
+        },
+        Arc::new(ControlPlaneExecutor),
+    )
+    .with_image_preparation(
+        images.port(),
+        ImageDeploymentConfig::new(1, Duration::from_secs(300)).unwrap(),
+    )
+    .unwrap();
+    provider.create_function(input("worker")).await.unwrap();
+    fake.stats
+        .until(|| fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    assert!(provider.quiesce(Duration::from_millis(10)).await.is_err());
+    until(|| {
+        latest(provider.store()).deployment
+            == DeploymentState::CreateFailed(ImageDeploymentFailure::Cancelled)
+    })
+    .await;
+    fake.commands.send(Command::Commit).await.unwrap();
+    provider.shutdown().await;
+    drop(provider);
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_deployment_capacity_larger_than_the_preparation_owner() {
+    let fake = FakePins::new(DaemonMode::Normal).await;
+    let mut images = fake.owner(2, 1);
+    let root = tempfile::tempdir().unwrap();
+    assert!(
+        ImageDeploymentManager::start(
+            Arc::new(FunctionStore::new(root.path())),
+            images.port(),
+            ImageDeploymentConfig::new(2, Duration::from_secs(1)).unwrap()
+        )
+        .is_err()
+    );
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_validate_image_code_dry_run_without_preparation_or_state_changes() {
+    let fake = FakePins::new(DaemonMode::Normal).await;
+    let mut images = fake.owner(2, 1);
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_executor(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Docker,
+            ..Default::default()
+        },
+        Arc::new(ControlPlaneExecutor),
+    )
+    .with_image_preparation(
+        images.port(),
+        ImageDeploymentConfig::new(1, Duration::from_secs(10)).unwrap(),
+    )
+    .unwrap();
+    provider.create_function(input("worker")).await.unwrap();
+    wait_provider(&provider).await;
+    let before = serde_json::to_value(provider.export_snapshot()).unwrap();
+    let response = provider
+        .update_function_code(
+            "worker",
+            UpdateFunctionCodeInput {
+                image_uri: Some("missing:new-image".into()),
+                dry_run: Some(true),
+                ..Default::default()
+            },
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.last_update_status.as_deref(), Some("Successful"));
+    assert_eq!(
+        serde_json::to_value(provider.export_snapshot()).unwrap(),
+        before
+    );
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.absent.load(Ordering::Acquire), 0);
+    provider.shutdown().await;
+    drop(provider);
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_cancelled_deployment_admission_after_outer_worker_join_until_image_io_retires()
+ {
+    let fake = FakePins::new(DaemonMode::Never).await;
+    let mut images = fake.owner(4, 1);
+    let root = tempfile::tempdir().unwrap();
+    let store = Arc::new(FunctionStore::new(root.path()));
+    let job = store.insert_image_deployment(record()).unwrap();
+    let health = Arc::new(Health::default());
+    let (control, _) = watch::channel(Mode::Running);
+    let (sender, inbox) = mpsc::channel(1);
+    let mut actor = Actor::builder()
+        .inbox(inbox)
+        .preparation(images.port())
+        .control(control.clone())
+        .health(health.clone())
+        .runtime(Handle::current())
+        .emergency(Arc::new(CleanupTask::default()))
+        .build();
+    let capacity = Arc::new(Semaphore::new(1));
+    let pending = Arc::new(
+        Pending::builder()
+            .job(job)
+            .store(store.clone())
+            .health(health)
+            .control(control)
+            .build(),
+    );
+    actor.start(Envelope {
+        id: Uuid::new_v4(),
+        pending: pending.clone(),
+        slot: capacity.clone().acquire_owned().await.unwrap(),
+        deadline: deadline(),
+    });
+    fake.stats
+        .until(|| fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    store.remove("worker").unwrap();
+    until(|| pending.settled.load(Ordering::Acquire)).await;
+    let joined = timeout(Duration::from_secs(2), actor.jobs.join_next_with_id())
+        .await
+        .unwrap()
+        .unwrap();
+    actor.reap(&joined);
+    assert!(actor.rows.is_empty());
+    assert_eq!(capacity.available_permits(), 0);
+    assert!(capacity.clone().try_acquire_owned().is_err());
+    assert_eq!(images.port().status().preparing, 1);
+    fake.commands.send(Command::Commit).await.unwrap();
+    until(|| images.port().status().pins == 0).await;
+    assert_eq!(capacity.available_permits(), 1);
+    assert!(!store.contains("worker").unwrap());
+    drop(sender);
+    timeout(Duration::from_secs(2), actor.run())
+        .await
+        .unwrap()
+        .unwrap();
+    images.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[path = "manager_tests/restore.rs"]
+mod restore;
diff --git a/crates/rustack-lambda-core/src/deployment/manager_tests/restore.rs b/crates/rustack-lambda-core/src/deployment/manager_tests/restore.rs
new file mode 100644
index 00000000..7731d055
--- /dev/null
+++ b/crates/rustack-lambda-core/src/deployment/manager_tests/restore.rs
@@ -0,0 +1,637 @@
+//! Complete-candidate restore must not publish partial resources or live placeholders.
+
+use std::{
+    collections::BTreeMap,
+    io::{Cursor, Read, Write},
+    sync::atomic::AtomicBool,
+};
+
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rustack_lambda_model::error::{LambdaError, LambdaErrorCode};
+use serde_json::{Value, json};
+use zip::{ZipArchive, ZipWriter, write::SimpleFileOptions};
+
+use super::*;
+use crate::{
+    artifact::{ImageArtifact, ImageMetadata, ResolvedImage},
+    docker::{DockerExecutorError, ImageResolver},
+    provider::{
+        DockerArchiveProfile, LambdaSnapshot,
+        provided_zip_tests::{input as zip_input, package as zip_package},
+    },
+    storage::{
+        AliasRecord, EventSourceMappingRecord, LayerRecord, LayerStoreSnapshot, compute_sha256,
+    },
+};
+
+struct ImportFixture {
+    fake: FakePins,
+    images: ImageLeaseManager,
+    provider: Arc<RustackLambda>,
+    _root: tempfile::TempDir,
+}
+impl ImportFixture {
+    async fn new(mode: DaemonMode, old_pin: bool) -> Self {
+        Self::with_executor(mode, old_pin, Arc::new(ControlPlaneExecutor)).await
+    }
+    async fn with_executor(mode: DaemonMode, old_pin: bool, executor: Arc<dyn Executor>) -> Self {
+        let fake = FakePins::new(mode).await;
+        let images = fake.owner(8, 2);
+        let root = tempfile::tempdir().unwrap();
+        let store = FunctionStore::new(root.path());
+        let mut old = named("old");
+        if old_pin {
+            let image = images
+                .port()
+                .prepare(
+                    &"worker:v1".parse().unwrap(),
+                    Architecture::Arm64,
+                    None,
+                    deadline(),
+                )
+                .await
+                .unwrap();
+            old.latest.code_sha256 = image.resolved().code_sha256().unwrap();
+            old.latest.code_size = image.unpacked_size().get();
+            old.latest.image = ImageArtifact::Pinned(image);
+        } else {
+            old.latest.deployment =
+                DeploymentState::CreateFailed(ImageDeploymentFailure::Cancelled);
+        }
+        store.insert(old).unwrap();
+        let provider = Arc::new(
+            RustackLambda::with_executor(
+                store,
+                LambdaConfig {
+                    executor: ExecutorBackend::Docker,
+                    ..LambdaConfig::default()
+                },
+                executor,
+            )
+            .with_image_preparation(
+                images.port(),
+                ImageDeploymentConfig::new(2, Duration::from_secs(10)).unwrap(),
+            )
+            .unwrap(),
+        );
+        provider.layer_store().import_snapshot(LayerStoreSnapshot {
+            layers: vec![LayerRecord {
+                name: "old-layer".into(),
+                layer_arn: "arn:aws:lambda:us-east-1:000000000000:layer:old-layer".into(),
+                versions: BTreeMap::new(),
+                next_version: 1,
+            }],
+        });
+        let mapping: EventSourceMappingRecord = serde_json::from_value(json!({
+            "uuid":"old-mapping","eventSourceArn":"arn:aws:sqs:us-east-1:000000000000:old",
+            "functionArn":"arn:aws:lambda:us-east-1:000000000000:function:old","enabled":false,
+            "batchSize":1,"maximumBatchingWindowInSeconds":0,"functionResponseTypes":[],
+            "state":"Disabled","stateTransitionReason":"fixture","lastModified":0,"lastProcessingResult":"None"
+        })).unwrap();
+        provider.esm_store().create(mapping);
+        Self {
+            fake,
+            images,
+            provider,
+            _root: root,
+        }
+    }
+    async fn saved(&self) -> ResolvedImage {
+        ImageResolver::new(self.fake.wire.port())
+            .resolve_local(
+                &"worker:v1".parse().unwrap(),
+                Architecture::Arm64,
+                None,
+                deadline(),
+            )
+            .await
+            .unwrap()
+    }
+    fn state(&self) -> Value {
+        serde_json::to_value(self.provider.export_snapshot()).unwrap()
+    }
+    async fn close(mut self) {
+        self.provider.shutdown_before(deadline()).await.unwrap();
+        drop(self.provider);
+        self.images.shutdown(deadline()).await.unwrap();
+        self.fake.close().await;
+    }
+}
+fn saved_record(name: &str, saved: &ResolvedImage) -> FunctionRecord {
+    let mut value = named(name);
+    value.latest.code_sha256 = saved.code_sha256().unwrap();
+    value.latest.code_size = 4096;
+    value.latest.image = ImageArtifact::Restored(saved.clone());
+    value
+}
+fn snapshot(records: Vec<FunctionRecord>) -> LambdaSnapshot {
+    let store = FunctionStore::new("unused-image-snapshot-source");
+    for record in records {
+        store.insert(record).unwrap();
+    }
+    LambdaSnapshot {
+        functions: store.export_snapshot(),
+        ..LambdaSnapshot::default()
+    }
+}
+
+#[tokio::test]
+async fn test_should_restore_latest_published_and_alias_with_one_shared_exact_lease() {
+    let fixture = ImportFixture::new(DaemonMode::Normal, true).await;
+    let saved = fixture.saved().await;
+    let mut record = saved_record("restored", &saved);
+    record.tags.insert("retained".into(), "yes".into());
+    let mut published = record.latest.clone();
+    published.version = "1".into();
+    record.versions.insert(1, published);
+    record.next_version = 2;
+    record.aliases.insert(
+        "prod".into(),
+        AliasRecord {
+            name: "prod".into(),
+            function_version: "1".into(),
+            description: "saved".into(),
+            routing_config: None,
+            revision_id: Uuid::new_v4().to_string(),
+        },
+    );
+    let source = snapshot(vec![record]);
+    let expected = serde_json::to_value(&source).unwrap();
+    fixture.fake.commands.send(Command::Retarget).await.unwrap();
+    fixture
+        .provider
+        .import_snapshot_before(source, deadline())
+        .await
+        .unwrap();
+    until(|| fixture.images.port().status().pins == 1).await;
+    assert_eq!(fixture.state(), expected);
+    fixture.provider.validate_runtime_restore().unwrap();
+    let restored = fixture.provider.store().get("restored").unwrap().unwrap();
+    assert!(restored.latest.image.pinned().unwrap().is_live());
+    assert!(
+        restored
+            .versions
+            .get(&1)
+            .unwrap()
+            .image
+            .pinned()
+            .unwrap()
+            .is_live()
+    );
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 2);
+    drop(restored);
+    fixture.close().await;
+}
+
+#[rstest]
+#[case("duplicate")]
+#[case("memory")]
+#[case("hash")]
+#[case("missing-metadata")]
+#[case("empty-plan")]
+#[case("alias")]
+#[case("region")]
+#[case("account")]
+#[tokio::test]
+async fn test_should_validate_all_records_scope_and_plans_before_any_pin(#[case] corruption: &str) {
+    let fixture = ImportFixture::new(DaemonMode::Normal, true).await;
+    let saved = fixture.saved().await;
+    let mut source = snapshot(vec![saved_record("a", &saved), saved_record("z", &saved)]);
+    let before = fixture.state();
+    let last = source.functions.functions.last_mut().unwrap();
+    match corruption {
+        "memory" => last.latest.memory_size = 0,
+        "hash" => last.latest.code_sha256 = "mismatch".into(),
+        "missing-metadata" => last.latest.resolved_image = None,
+        "empty-plan" => {
+            last.latest.image_config = Some(rustack_lambda_model::types::ImageConfig {
+                entry_point: Some(vec![]),
+                command: Some(vec![]),
+                ..Default::default()
+            });
+        }
+        "alias" => {
+            last.aliases.insert(
+                "prod".into(),
+                AliasRecord {
+                    name: "prod".into(),
+                    function_version: "7".into(),
+                    description: String::new(),
+                    routing_config: None,
+                    revision_id: Uuid::new_v4().to_string(),
+                },
+            );
+        }
+        "region" => last.arn = last.arn.replace("us-east-1", "us-west-2"),
+        "account" => last.arn = last.arn.replace("000000000000", "111111111111"),
+        "duplicate" => source
+            .functions
+            .functions
+            .push(source.functions.functions.first().unwrap().clone()),
+        _ => panic!("fixed corruption table"),
+    }
+    assert!(
+        fixture
+            .provider
+            .import_snapshot_before(source, deadline())
+            .await
+            .is_err()
+    );
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(fixture.state(), before);
+    assert!(
+        fixture
+            .provider
+            .store()
+            .get("old")
+            .unwrap()
+            .unwrap()
+            .latest
+            .image
+            .pinned()
+            .unwrap()
+            .is_live()
+    );
+    fixture.close().await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_drop_prepared_candidates_on_later_size_or_missing_content_failure(
+    #[case] missing: bool,
+) {
+    let fixture = ImportFixture::new(DaemonMode::Normal, true).await;
+    let saved = fixture.saved().await;
+    let mut source = snapshot(vec![saved_record("a", &saved), saved_record("z", &saved)]);
+    let last = source.functions.functions.last_mut().unwrap();
+    if missing {
+        let mut metadata: ImageMetadata = saved.into();
+        metadata.image_id = format!("sha256:{}", "e".repeat(64)).parse().unwrap();
+        metadata.inspection_hash = ImageMetadata::execution_fingerprint(
+            &metadata.image_id,
+            metadata.selected_manifest.as_ref(),
+            metadata.architecture,
+            metadata.size_bytes,
+            &metadata.execution,
+        )
+        .unwrap();
+        let absent: ResolvedImage = metadata.try_into().unwrap();
+        last.latest.code_sha256 = absent.code_sha256().unwrap();
+        last.latest.resolved_image = Some(absent);
+    } else {
+        last.latest.code_size = 4097;
+    }
+    let before = fixture.state();
+    let result = fixture
+        .provider
+        .import_snapshot_before(source, deadline())
+        .await;
+    if missing {
+        assert!(
+            matches!(result, Err(LambdaServiceError::ImageRestore { source }) if matches!(*source, DockerError::Status(StatusCode::NOT_FOUND)))
+        );
+    } else {
+        assert!(matches!(
+            result,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+    }
+    until(|| fixture.images.port().status().pins == 1).await;
+    assert_eq!(fixture.state(), before);
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 2);
+    assert_eq!(fixture.fake.stats.deletes.load(Ordering::Acquire), 1);
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_expired_commit_after_complete_pin_preparation_without_old_resource_changes()
+ {
+    let fixture = ImportFixture::new(DaemonMode::Normal, true).await;
+    let saved = fixture.saved().await;
+    let before = fixture.state();
+    let source = snapshot(vec![saved_record("new", &saved)]);
+    let candidate = fixture
+        .provider
+        .store()
+        .prepare_docker_snapshot(
+            source.functions,
+            &fixture.images.port(),
+            deadline(),
+            DockerArchiveProfile::ImageOnly,
+        )
+        .await
+        .unwrap();
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 2);
+    assert!(
+        matches!(candidate.commit_before(Instant::now()), Err(LambdaServiceError::ImageRestore { source }) if matches!(*source, DockerError::Deadline))
+    );
+    until(|| fixture.images.port().status().pins == 1).await;
+    assert_eq!(fixture.state(), before);
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_uncertain_restore_mutation_after_caller_cancellation_without_publication()
+ {
+    let fixture = ImportFixture::new(DaemonMode::Never, false).await;
+    let saved = fixture.saved().await;
+    let before = fixture.state();
+    let source = snapshot(vec![saved_record("new", &saved)]);
+    let provider = fixture.provider.clone();
+    let caller =
+        tokio::spawn(async move { provider.import_snapshot_before(source, deadline()).await });
+    fixture
+        .fake
+        .stats
+        .until(|| fixture.fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    caller.abort();
+    assert!(caller.await.unwrap_err().is_cancelled());
+    assert_eq!(fixture.images.port().status().pins, 1);
+    assert_eq!(fixture.state(), before);
+    fixture.fake.commands.send(Command::Commit).await.unwrap();
+    fixture.images.port().wait_empty(deadline()).await.unwrap();
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(fixture.fake.stats.deletes.load(Ordering::Acquire), 1);
+    assert_eq!(fixture.state(), before);
+    fixture.close().await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_restore_failed_and_interrupted_creation_without_an_executable_pin(
+    #[case] interrupted: bool,
+) {
+    let fixture = ImportFixture::new(DaemonMode::Normal, true).await;
+    let mut value = named("failed");
+    value.latest.deployment = if interrupted {
+        DeploymentState::Creating(Uuid::new_v4().to_string().try_into().unwrap())
+    } else {
+        DeploymentState::CreateFailed(ImageDeploymentFailure::ImageNotFound)
+    };
+    fixture
+        .provider
+        .import_snapshot_before(snapshot(vec![value]), deadline())
+        .await
+        .unwrap();
+    fixture.images.port().wait_empty(deadline()).await.unwrap();
+    fixture.provider.validate_runtime_restore().unwrap();
+    let restored = fixture.provider.store().get("failed").unwrap().unwrap();
+    assert!(matches!(
+        restored.latest.deployment,
+        DeploymentState::CreateFailed(_)
+    ));
+    assert!(restored.latest.image.pinned().is_none());
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 1);
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_export_borrowed_records_with_the_existing_owned_snapshot_schema() {
+    let fixture = ImportFixture::new(DaemonMode::Normal, true).await;
+    let expected = fixture.state();
+    let actual = fixture
+        .provider
+        .export_snapshot_before(deadline())
+        .await
+        .unwrap();
+    assert_eq!(serde_json::to_value(actual).unwrap(), expected);
+    fixture.close().await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_reject_deep_live_policy_and_oversized_ancillary_export_before_clone(
+    #[case] deep: bool,
+) {
+    let fixture = ImportFixture::new(DaemonMode::Normal, true).await;
+    if deep {
+        let mut condition = Value::Null;
+        for _ in 0..50_000 {
+            condition = Value::Array(vec![condition]);
+        }
+        fixture
+            .provider
+            .store()
+            .update("old", |record| {
+                record
+                    .policy
+                    .statements
+                    .push(crate::storage::PolicyStatement {
+                        sid: "deep".into(),
+                        effect: "Allow".into(),
+                        principal: "*".into(),
+                        action: "lambda:InvokeFunction".into(),
+                        resource: "*".into(),
+                        condition: Some(condition),
+                    });
+            })
+            .unwrap();
+    } else {
+        let mut layer: LayerRecord = serde_json::from_value(json!({"name":"oversized","layerArn":"arn:aws:lambda:us-east-1:000000000000:layer:oversized","nextVersion":2,
+            "versions":{"1":{"version":1,"description":"","compatibleRuntimes":[],"compatibleArchitectures":[],"licenseInfo":null,"codeSha256":"unused","codeSize":0,"createdDate":"2026-10-27T00:00:00Z","layerArn":"arn:aws:lambda:us-east-1:000000000000:layer:oversized","layerVersionArn":"arn:aws:lambda:us-east-1:000000000000:layer:oversized:1","policy":{"statements":[]}}}})).unwrap();
+        layer.versions.get_mut(&1).unwrap().description = "x".repeat(20 * 1024 * 1024);
+        fixture
+            .provider
+            .layer_store()
+            .import_snapshot(LayerStoreSnapshot {
+                layers: vec![layer],
+            });
+    }
+    let error = fixture
+        .provider
+        .export_snapshot_before(deadline())
+        .await
+        .unwrap_err();
+    assert!(matches!(error, LambdaServiceError::InvalidParameter { .. }));
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(fixture.provider.store().len(), 1);
+    fixture.close().await;
+}
+
+#[derive(Debug)]
+struct ManagedZipExecutor(Arc<AtomicBool>);
+#[async_trait]
+impl Executor for ManagedZipExecutor {
+    fn image_available(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+    fn docker_zip_architecture(&self) -> Option<Architecture> {
+        Some(Architecture::Arm64)
+    }
+    fn zip_available(&self, architecture: Architecture) -> Result<(), ExecutorError> {
+        if !self.0.load(Ordering::Acquire) || architecture != Architecture::Arm64 {
+            return Err(DockerExecutorError::Unavailable.into());
+        }
+        Ok(())
+    }
+    async fn invoke(
+        &self,
+        _: InvokeRequest,
+        _: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        Err(ExecutorError::Unsupported(
+            "archive metadata fixture".into(),
+        ))
+    }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+}
+async fn managed_fixture(mode: DaemonMode) -> (ImportFixture, Arc<AtomicBool>, LambdaSnapshot) {
+    let live = Arc::new(AtomicBool::new(true));
+    let fixture =
+        ImportFixture::with_executor(mode, false, Arc::new(ManagedZipExecutor(live.clone()))).await;
+    let mut input = zip_input();
+    input.publish = Some(true);
+    fixture.provider.create_function(input).await.unwrap();
+    let source = fixture
+        .provider
+        .export_snapshot_before(deadline())
+        .await
+        .unwrap();
+    (fixture, live, source)
+}
+#[tokio::test]
+async fn test_should_restore_original_zip_with_valid_long_budget_and_fresh_private_artifacts() {
+    let (fixture, _live, source) = managed_fixture(DaemonMode::Normal).await;
+    let old = fixture
+        .provider
+        .store()
+        .get("provided-control")
+        .unwrap()
+        .unwrap();
+    let expected = fixture.state();
+    fixture
+        .provider
+        .import_snapshot_before(source, Instant::now() + Duration::from_secs(3600))
+        .await
+        .unwrap();
+    let loaded = fixture
+        .provider
+        .store()
+        .get("provided-control")
+        .unwrap()
+        .unwrap();
+    assert_eq!(loaded.latest.code_sha256, old.latest.code_sha256);
+    assert_eq!(loaded.latest.revision_id, old.latest.revision_id);
+    assert_ne!(loaded.latest.code_path, old.latest.code_path);
+    assert_eq!(fixture.state(), expected);
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 0);
+    drop(loaded);
+    drop(old);
+    fixture.close().await;
+}
+#[rstest]
+#[case::non_elf(false)]
+#[case::wrong_elf_target(true)]
+#[tokio::test]
+async fn test_should_classify_checksum_valid_bad_elf_as_input_before_any_image_pin(
+    #[case] wrong_target: bool,
+) {
+    let (fixture, _live, mut source) = managed_fixture(DaemonMode::Normal).await;
+    let image = snapshot(vec![saved_record("a-image", &fixture.saved().await)]);
+    source.functions.functions.extend(image.functions.functions);
+    let mut bad = zip_package(false);
+    if wrong_target {
+        let bytes = STANDARD.decode(zip_package(true)).unwrap();
+        let mut zip = ZipArchive::new(Cursor::new(bytes)).unwrap();
+        let mut body = Vec::new();
+        zip.by_name("bootstrap")
+            .unwrap()
+            .read_to_end(&mut body)
+            .unwrap();
+        body.get_mut(18..20)
+            .unwrap()
+            .copy_from_slice(&62_u16.to_le_bytes());
+        let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+        writer
+            .start_file(
+                "bootstrap",
+                SimpleFileOptions::default().unix_permissions(0o755),
+            )
+            .unwrap();
+        writer.write_all(&body).unwrap();
+        bad = STANDARD.encode(writer.finish().unwrap().into_inner());
+    }
+    let bytes = STANDARD.decode(&bad).unwrap();
+    let row = &mut source
+        .functions
+        .functions
+        .iter_mut()
+        .find(|row| row.name == "provided-control")
+        .unwrap()
+        .latest;
+    row.code_size = u64::try_from(bytes.len()).unwrap();
+    row.code_sha256 = compute_sha256(&bytes);
+    row.zip_bytes_base64 = Some(bad);
+    let before = fixture.state();
+    let error = fixture
+        .provider
+        .import_snapshot_before(source, deadline())
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        &error,
+        LambdaServiceError::InvalidParameter { .. }
+    ));
+    let public: LambdaError = error.into();
+    assert_eq!(public.code, LambdaErrorCode::InvalidParameterValueException);
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 0);
+    assert_eq!(fixture.state(), before);
+    fixture.close().await;
+}
+#[tokio::test]
+async fn test_should_preserve_complete_old_zip_store_when_later_image_size_proof_fails() {
+    let (fixture, _live, mut source) = managed_fixture(DaemonMode::Normal).await;
+    let mut image = saved_record("z-image", &fixture.saved().await);
+    image.latest.code_size = 4097;
+    source
+        .functions
+        .functions
+        .extend(snapshot(vec![image]).functions.functions);
+    let before = fixture.state();
+    assert!(matches!(
+        fixture
+            .provider
+            .import_snapshot_before(source, deadline())
+            .await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    fixture.images.port().wait_empty(deadline()).await.unwrap();
+    assert_eq!(fixture.fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(fixture.fake.stats.deletes.load(Ordering::Acquire), 1);
+    assert_eq!(fixture.state(), before);
+    fixture.close().await;
+}
+#[tokio::test]
+async fn test_should_fence_zip_capability_revocation_after_mixed_pin_preparation() {
+    let (fixture, live, mut source) = managed_fixture(DaemonMode::Never).await;
+    source.functions.functions.extend(
+        snapshot(vec![saved_record("z-image", &fixture.saved().await)])
+            .functions
+            .functions,
+    );
+    let before = fixture.state();
+    let provider = fixture.provider.clone();
+    let caller =
+        tokio::spawn(async move { provider.import_snapshot_before(source, deadline()).await });
+    fixture
+        .fake
+        .stats
+        .until(|| fixture.fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    live.store(false, Ordering::Release);
+    fixture.fake.commands.send(Command::Commit).await.unwrap();
+    assert!(caller.await.unwrap().is_err());
+    fixture.images.port().wait_empty(deadline()).await.unwrap();
+    assert_eq!(fixture.state(), before);
+    assert_eq!(fixture.fake.stats.deletes.load(Ordering::Acquire), 1);
+    fixture.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/deployment_input.rs b/crates/rustack-lambda-core/src/deployment_input.rs
new file mode 100644
index 00000000..fc11439d
--- /dev/null
+++ b/crates/rustack-lambda-core/src/deployment_input.rs
@@ -0,0 +1,253 @@
+//! Bounded deployment DTO parsing with one borrowed inline-code exception.
+//!
+//! Pure blocking parse tasks, completed results and active dispatch retain one
+//! of four permits until their bounded input work is released. An
+//! abandoned caller intentionally leaves only bounded CPU/memory work running;
+//! parsing cannot commit metadata, filesystem or Docker effects.
+
+use std::collections::BTreeMap;
+
+use bytes::Bytes;
+use rustack_core::{
+    http::append_bounded,
+    json::{JsonLimits, validate},
+};
+use rustack_lambda_model::error::{LambdaError, LambdaErrorCode};
+use serde::de::DeserializeOwned;
+use serde_json::value::RawValue;
+use tokio::{
+    sync::{Semaphore, SemaphorePermit},
+    task::spawn_blocking,
+};
+
+use crate::{artifact::MAX_ZIP_BASE64_BYTES, error::LambdaServiceError};
+
+const BODY_BYTES: usize = 96 * 1024 * 1024;
+const META_BYTES: usize = 1024 * 1024;
+const STRING_BYTES: usize = 16 * 1024;
+const KEY_BYTES: usize = 256;
+const DEPTH: usize = 8;
+const MEMBERS: usize = 4096;
+// A fixed aggregate safety ceiling for large deployment parsing. Request
+// admission remains separately operator-configurable at the HTTP boundary.
+static PARSERS: Semaphore = Semaphore::const_new(4);
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum Profile {
+    Create,
+    Code,
+    Configuration,
+}
+
+fn invalid() -> LambdaError {
+    LambdaError::invalid_parameter("Invalid or unsupported deployment request")
+}
+
+pub(crate) async fn decode<T: DeserializeOwned + Send + 'static>(
+    body: &Bytes,
+    profile: Profile,
+) -> Result<(T, SemaphorePermit<'static>), LambdaError> {
+    let body = body.clone();
+    run(&PARSERS, move || parse(&body, profile)).await
+}
+
+async fn run<T: Send + 'static>(
+    pool: &'static Semaphore,
+    work: impl FnOnce() -> Result<T, LambdaError> + Send + 'static,
+) -> Result<(T, SemaphorePermit<'static>), LambdaError> {
+    let permit = pool.try_acquire().map_err(|_| {
+        LambdaError::new(
+            LambdaErrorCode::TooManyRequestsException,
+            "Deployment parser capacity exhausted",
+        )
+    })?;
+    run_admitted(permit, work).await
+}
+
+async fn run_admitted<T: Send + 'static>(
+    permit: SemaphorePermit<'static>,
+    work: impl FnOnce() -> Result<T, LambdaError> + Send + 'static,
+) -> Result<(T, SemaphorePermit<'static>), LambdaError> {
+    spawn_blocking(move || {
+        let value = work()?;
+        Ok((value, permit))
+    })
+    .await
+    .map_err(|_| LambdaError::service_error("Deployment parser failed"))?
+}
+
+fn parse<T: DeserializeOwned>(body: &[u8], profile: Profile) -> Result<T, LambdaError> {
+    lexical(body)?;
+    // Borrow raw values, so large strings are not allocated before identifying
+    // the only field allowed to exceed the ordinary metadata allowance.
+    let fields: BTreeMap<String, &RawValue> =
+        serde_json::from_slice(body).map_err(|_| invalid())?;
+    let blob = match profile {
+        Profile::Code => fields.get("ZipFile").copied(),
+        Profile::Create => match fields.get("Code") {
+            Some(code) => {
+                let code: BTreeMap<String, &RawValue> =
+                    serde_json::from_str(code.get()).map_err(|_| invalid())?;
+                code.get("ZipFile").copied()
+            }
+            None => None,
+        },
+        Profile::Configuration => None,
+    }
+    .filter(|value| value.get().as_bytes().first() == Some(&b'"'));
+    let mut metadata = Vec::new();
+    if let Some(blob) = blob {
+        let raw = blob.get().as_bytes();
+        if raw
+            .len()
+            .checked_sub(2)
+            .is_none_or(|size| size > MAX_ZIP_BASE64_BYTES)
+        {
+            return Err(invalid());
+        }
+        // Borrowed RawValue is a span in this very input (serde_json's slice
+        // deserializer contract). Checked integer offsets never dereference a
+        // raw pointer; bounded slice access re-establishes the range.
+        let start = raw
+            .as_ptr()
+            .addr()
+            .checked_sub(body.as_ptr().addr())
+            .ok_or_else(invalid)?;
+        let end = start.checked_add(raw.len()).ok_or_else(invalid)?;
+        append(&mut metadata, body.get(..start).ok_or_else(invalid)?)?;
+        append(&mut metadata, b"\"\"")?;
+        append(&mut metadata, body.get(end..).ok_or_else(invalid)?)?;
+    } else {
+        append(&mut metadata, body)?;
+    }
+    let limits = JsonLimits::new(META_BYTES, DEPTH, MEMBERS, STRING_BYTES, KEY_BYTES)
+        .map_err(|_| invalid())?;
+    validate(&metadata, limits).map_err(|_| invalid())?;
+    serde_json::from_slice(body).map_err(|_| invalid())
+}
+fn append(metadata: &mut Vec<u8>, bytes: &[u8]) -> Result<(), LambdaError> {
+    append_bounded(metadata, bytes, 1024 * 1024).map_err(|_| invalid())
+}
+
+/// Bound structure and encoded keys before borrowed-map key materialization.
+fn lexical(body: &[u8]) -> Result<(), LambdaError> {
+    if body.len() > BODY_BYTES {
+        return Err(invalid());
+    }
+    let mut cursor = 0usize;
+    let mut depth = 0usize;
+    let mut delimiters = 0usize;
+    while let Some(byte) = body.get(cursor) {
+        match byte {
+            b'"' => {
+                let start = cursor;
+                cursor = quoted_end(body, cursor)?;
+                let following = body
+                    .get(cursor..)
+                    .ok_or_else(invalid)?
+                    .iter()
+                    .find(|byte| !byte.is_ascii_whitespace());
+                if following == Some(&b':') && cursor.saturating_sub(start) > KEY_BYTES * 6 + 2 {
+                    return Err(invalid());
+                }
+                continue;
+            }
+            b'{' | b'[' => {
+                depth = depth
+                    .checked_add(1)
+                    .filter(|depth| *depth <= DEPTH)
+                    .ok_or_else(invalid)?;
+            }
+            b'}' | b']' => {
+                depth = depth.checked_sub(1).ok_or_else(invalid)?;
+            }
+            b',' | b':' => {
+                delimiters = delimiters
+                    .checked_add(1)
+                    .filter(|count| *count <= MEMBERS * 2)
+                    .ok_or_else(invalid)?;
+            }
+            _ => {}
+        }
+        cursor = cursor.checked_add(1).ok_or_else(invalid)?;
+    }
+    Ok(())
+}
+fn quoted_end(body: &[u8], start: usize) -> Result<usize, LambdaError> {
+    let mut cursor = start.checked_add(1).ok_or_else(invalid)?;
+    loop {
+        match body.get(cursor) {
+            Some(b'"') => return cursor.checked_add(1).ok_or_else(invalid),
+            Some(b'\\') => cursor = cursor.checked_add(2).ok_or_else(invalid)?,
+            Some(_) => cursor = cursor.checked_add(1).ok_or_else(invalid)?,
+            None => return Err(invalid()),
+        }
+    }
+}
+
+/// Check standard canonical base64 without allocating decoded archive contents.
+pub(crate) async fn validate_inline(
+    encoded: String,
+    admitted: Option<SemaphorePermit<'static>>,
+) -> Result<SemaphorePermit<'static>, LambdaServiceError> {
+    let result = if let Some(permit) = admitted {
+        run_admitted(permit, move || inline(&encoded)).await
+    } else {
+        run(&PARSERS, move || inline(&encoded)).await
+    };
+    result
+        .map(|((), permit)| permit)
+        .map_err(|error| match error.code {
+            LambdaErrorCode::TooManyRequestsException => LambdaServiceError::TooManyRequests,
+            LambdaErrorCode::ServiceException => LambdaServiceError::Internal {
+                message: "Deployment parser failed".into(),
+            },
+            _ => LambdaServiceError::InvalidParameter {
+                message: "Invalid inline code encoding".into(),
+            },
+        })
+}
+
+fn inline(encoded: &str) -> Result<(), LambdaError> {
+    if encoded.len() > MAX_ZIP_BASE64_BYTES || !encoded.len().is_multiple_of(4) {
+        return Err(invalid());
+    }
+    let data = encoded.trim_end_matches('=');
+    let padding = encoded.len().checked_sub(data.len()).ok_or_else(invalid)?;
+    if padding > 2 {
+        return Err(invalid());
+    }
+    let mut last = 0;
+    for byte in data.bytes() {
+        last = match byte {
+            b'A'..=b'Z' => byte.checked_sub(b'A'),
+            b'a'..=b'z' => byte
+                .checked_sub(b'a')
+                .and_then(|value| value.checked_add(26)),
+            b'0'..=b'9' => byte
+                .checked_sub(b'0')
+                .and_then(|value| value.checked_add(52)),
+            b'+' => Some(62),
+            b'/' => Some(63),
+            _ => None,
+        }
+        .ok_or_else(invalid)?;
+    }
+    if (padding == 2 && last & 15 != 0) || (padding == 1 && last & 3 != 0) {
+        return Err(invalid());
+    }
+    let decoded = encoded
+        .len()
+        .checked_div(4)
+        .and_then(|groups| groups.checked_mul(3))
+        .and_then(|bytes| bytes.checked_sub(padding))
+        .ok_or_else(invalid)?;
+    if decoded > crate::artifact::MAX_ZIP_BYTES {
+        return Err(invalid());
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+#[path = "deployment_input_tests.rs"]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/deployment_input_tests.rs b/crates/rustack-lambda-core/src/deployment_input_tests.rs
new file mode 100644
index 00000000..d72704c9
--- /dev/null
+++ b/crates/rustack-lambda-core/src/deployment_input_tests.rs
@@ -0,0 +1,185 @@
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rstest::rstest;
+use rustack_lambda_model::input::{
+    CreateFunctionInput, UpdateFunctionCodeInput, UpdateFunctionConfigurationInput,
+};
+use serde_json::json;
+use tokio::sync::oneshot;
+
+use super::*;
+
+#[test]
+fn test_should_allow_large_zip_only_at_the_selected_deployment_path() {
+    let zip = "A".repeat(2 * 1024 * 1024);
+    let code = serde_json::to_vec(&json!({"ZipFile":zip,"DryRun":true})).unwrap();
+    let parsed: UpdateFunctionCodeInput = parse(&code, Profile::Code).unwrap();
+    assert_eq!(parsed.zip_file.as_deref(), Some(zip.as_str()));
+    let create =
+        serde_json::to_vec(&json!({"FunctionName":"worker","Role":"role","Code":{"ZipFile":zip}}))
+            .unwrap();
+    let parsed: CreateFunctionInput = parse(&create, Profile::Create).unwrap();
+    assert_eq!(parsed.code.zip_file.as_deref(), Some(zip.as_str()));
+    assert!(parse::<UpdateFunctionCodeInput>(&code, Profile::Configuration).is_err());
+    let wrong = serde_json::to_vec(&json!({"Environment":{"Variables":{"ZipFile":zip}}})).unwrap();
+    assert!(parse::<UpdateFunctionConfigurationInput>(&wrong, Profile::Configuration).is_err());
+}
+
+#[rstest]
+#[case(br#"{"ZipFile":"AA==","ZipFile":"AA=="}"#)]
+#[case(br#"{"ZipFile":"AA==","\u005aipFile":"AA=="}"#)]
+#[case(br#"{"DryRun":false,"DryRun":true}"#)]
+#[case(br#"{"Architectures":[],"DryRun":"true"}"#)]
+#[case(br#"{"DryRun":true,"SourceKMSKeyArn":"private-marker"}"#)]
+#[case(br#"{"ZipFile":true}"#)]
+#[case(br#"{"ZipFile":"unfinished}"#)]
+fn test_should_reject_ambiguous_unknown_or_malformed_code_bodies(#[case] bytes: &[u8]) {
+    let error = parse::<UpdateFunctionCodeInput>(bytes, Profile::Code).unwrap_err();
+    assert_eq!(error.message, "Invalid or unsupported deployment request");
+    assert!(!format!("{error:?}").contains("private-marker"));
+}
+
+#[test]
+fn test_should_recognize_escaped_code_keys_and_reject_nested_duplicate_environment_keys() {
+    let input = br#"{"FunctionName":"worker","Role":"role","\u0043ode":{"\u005aipFile":"AA=="}}"#;
+    assert_eq!(
+        parse::<CreateFunctionInput>(input, Profile::Create)
+            .unwrap()
+            .code
+            .zip_file
+            .as_deref(),
+        Some("AA==")
+    );
+    let duplicate = br#"{"Environment":{"Variables":{"TOKEN":"first","\u0054OKEN":"second"}}}"#;
+    assert!(parse::<UpdateFunctionConfigurationInput>(duplicate, Profile::Configuration).is_err());
+}
+
+#[test]
+fn test_should_reject_oversized_keys_strings_depth_and_metadata_before_dispatch() {
+    let body = serde_json::to_vec(&json!({"Description":"x".repeat(STRING_BYTES+1)})).unwrap();
+    assert!(parse::<UpdateFunctionConfigurationInput>(&body, Profile::Configuration).is_err());
+    let key = format!("{{\"{}\":0}}", "x".repeat(KEY_BYTES * 6 + 1));
+    assert!(lexical(key.as_bytes()).is_err());
+    let nested = format!("{}0{}", "[".repeat(DEPTH + 1), "]".repeat(DEPTH + 1));
+    assert!(lexical(nested.as_bytes()).is_err());
+    let members = format!("[{}0]", "0,".repeat(MEMBERS * 2 + 1));
+    assert!(lexical(members.as_bytes()).is_err());
+    let metadata = format!("{{{}\"DryRun\":true}}", " ".repeat(META_BYTES));
+    assert!(parse::<UpdateFunctionCodeInput>(metadata.as_bytes(), Profile::Code).is_err());
+}
+
+#[rstest]
+#[case("", true)]
+#[case("AA==", true)]
+#[case("AAA=", true)]
+#[case("AAAA", true)]
+#[case("AB==", false)]
+#[case("AAB=", false)]
+#[case("A===", false)]
+#[case("AA=A", false)]
+#[case("A", false)]
+#[case("AAAA\n", false)]
+fn test_should_validate_canonical_base64_without_decoding(#[case] data: &str, #[case] valid: bool) {
+    assert_eq!(inline(data).is_ok(), valid);
+}
+
+#[test]
+fn test_should_accept_exact_zip_size_and_reject_the_first_extra_decoded_byte() {
+    let bytes = vec![0u8; crate::artifact::MAX_ZIP_BYTES];
+    let encoded = STANDARD.encode(bytes);
+    assert!(inline(&encoded).is_ok());
+    let excess = "A".repeat(MAX_ZIP_BASE64_BYTES);
+    assert!(inline(&excess).is_err());
+}
+
+#[tokio::test]
+async fn test_should_retain_a_parser_permit_after_its_response_waiter_is_dropped() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let (begun, started) = oneshot::channel();
+    let (release, blocked) = std::sync::mpsc::channel();
+    let waiter = tokio::spawn(run(&POOL, move || {
+        begun.send(()).unwrap();
+        blocked.recv().unwrap();
+        Ok(())
+    }));
+    started.await.unwrap();
+    waiter.abort();
+    let _ = waiter.await;
+    assert!(matches!(
+        run(&POOL, || Ok(())).await.unwrap_err().code,
+        LambdaErrorCode::TooManyRequestsException
+    ));
+    release.send(()).unwrap();
+    tokio::time::timeout(std::time::Duration::from_secs(3), async {
+        while POOL.available_permits() != 1 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(run(&POOL, || Ok(())).await.is_ok());
+}
+
+#[tokio::test]
+async fn test_should_surface_a_pure_parser_worker_panic_without_losing_capacity() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let error = run::<()>(&POOL, || panic!("injected pure parser panic"))
+        .await
+        .unwrap_err();
+    assert_eq!(error.code, LambdaErrorCode::ServiceException);
+    assert_eq!(POOL.available_permits(), 1);
+}
+
+#[tokio::test]
+async fn test_should_apply_strict_nested_deployment_dtos() {
+    for body in [
+        json!({"ImageConfig":{"Unsupported":true}}),
+        json!({"Environment":{"Unknown":"private-marker"}}),
+        json!({"VpcConfig":{"Unsupported":true}}),
+        json!({"LoggingConfig":{"Unsupported":true}}),
+    ] {
+        assert!(
+            parse::<UpdateFunctionConfigurationInput>(
+                &serde_json::to_vec(&body).unwrap(),
+                Profile::Configuration
+            )
+            .is_err()
+        );
+    }
+    let invalid =
+        json!({"FunctionName":"worker","Role":"role","Code":{"Unknown":"private-marker"}});
+    assert!(
+        parse::<CreateFunctionInput>(&serde_json::to_vec(&invalid).unwrap(), Profile::Create)
+            .is_err()
+    );
+}
+
+#[tokio::test]
+async fn test_should_keep_capacity_with_a_completed_parse_result_until_it_is_consumed() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let completed = run(&POOL, || Ok(7)).await.unwrap();
+    assert_eq!(completed.0, 7);
+    assert_eq!(POOL.available_permits(), 0);
+    assert_eq!(
+        run(&POOL, || Ok(())).await.unwrap_err().code,
+        LambdaErrorCode::TooManyRequestsException
+    );
+    drop(completed);
+    assert_eq!(POOL.available_permits(), 1);
+}
+
+#[tokio::test]
+async fn test_should_reuse_admission_for_all_concurrent_inline_validators() {
+    static POOL: Semaphore = Semaphore::const_new(4);
+    let mut tasks = tokio::task::JoinSet::new();
+    for _ in 0..4 {
+        let permit = POOL.try_acquire().unwrap();
+        tasks.spawn(validate_inline("AA==".into(), Some(permit)));
+    }
+    let mut results = Vec::new();
+    while let Some(result) = tasks.join_next().await {
+        results.push(result.unwrap().unwrap());
+    }
+    assert_eq!(POOL.available_permits(), 0);
+    drop(results);
+    assert_eq!(POOL.available_permits(), 4);
+}
diff --git a/crates/rustack-lambda-core/src/deployment_tests.rs b/crates/rustack-lambda-core/src/deployment_tests.rs
new file mode 100644
index 00000000..53ca96fa
--- /dev/null
+++ b/crates/rustack-lambda-core/src/deployment_tests.rs
@@ -0,0 +1,689 @@
+use std::{
+    collections::{BTreeMap, HashMap},
+    sync::{Arc, atomic::AtomicBool},
+};
+
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rstest::rstest;
+use rustack_lambda_model::{
+    input::{PublishVersionInput, UpdateFunctionCodeInput, UpdateFunctionConfigurationInput},
+    types::ImageConfig,
+};
+use tokio::sync::watch;
+
+use super::*;
+use crate::{
+    artifact::{ImageMetadata, ResolvedImage},
+    config::LambdaConfig,
+    provider::RustackLambda,
+    storage::{FunctionStoreSnapshot, PolicyDocument},
+};
+
+fn image(
+    reference: &str,
+    letter: char,
+    architecture: Architecture,
+) -> (PinnedImage, watch::Receiver<()>, watch::Sender<bool>) {
+    let mut metadata: ImageMetadata = ResolvedImage::fixture(architecture).into();
+    metadata.requested_reference = reference.parse().unwrap();
+    metadata.image_id = format!("sha256:{}", letter.to_string().repeat(64))
+        .parse()
+        .unwrap();
+    metadata.inspection_hash = ImageMetadata::execution_fingerprint(
+        &metadata.image_id,
+        None,
+        architecture,
+        metadata.size_bytes,
+        &metadata.execution,
+    )
+    .unwrap();
+    let (release, released) = watch::channel(());
+    let (stop, stopped) = watch::channel(false);
+    let image = PinnedImage::new(
+        metadata.try_into().unwrap(),
+        4096.try_into().unwrap(),
+        release,
+        Arc::new(AtomicBool::new(true)),
+        stopped,
+    );
+    (image, released, stop)
+}
+pub(crate) fn record() -> FunctionRecord {
+    FunctionRecord {
+        resource_id: FunctionResourceId::new(),
+        name: "worker".into(),
+        arn: "arn:aws:lambda:us-east-1:000000000000:function:worker".into(),
+        latest: VersionRecord {
+            version: "$LATEST".into(),
+            runtime: None,
+            handler: None,
+            role: "arn:aws:iam::000000000000:role/test".into(),
+            description: "old description".into(),
+            timeout: 3,
+            memory_size: 128,
+            environment: HashMap::from([("SECRET".into(), "private value".into())]),
+            package_type: "Image".into(),
+            code_path: None,
+            image_uri: Some("worker:v1".into()),
+            image: ImageArtifact::Unresolved,
+            zip_bytes: None,
+            deployment: DeploymentState::Ready,
+            last_modified: "2026-10-25T00:00:00.000+0000".into(),
+            architectures: vec!["arm64".into()],
+            ephemeral_storage_size: 512,
+            code_sha256: String::new(),
+            code_size: 0,
+            revision_id: Uuid::new_v4().to_string(),
+            layers: Vec::new(),
+            vpc_config: None,
+            dead_letter_config: None,
+            tracing_config: None,
+            image_config: None,
+            logging_config: None,
+            snap_start: None,
+        },
+        versions: BTreeMap::new(),
+        next_version: 1,
+        aliases: HashMap::new(),
+        policy: PolicyDocument::default(),
+        tags: HashMap::new(),
+        code_signing_config_arn: None,
+        url_config: None,
+        reserved_concurrent_executions: None,
+        event_invoke_configs: HashMap::new(),
+        created_at: "2026-10-25T00:00:00.000+0000".into(),
+    }
+}
+fn store() -> (tempfile::TempDir, FunctionStore) {
+    let root = tempfile::tempdir().unwrap();
+    let store = FunctionStore::new(root.path());
+    (root, store)
+}
+fn ready(store: &FunctionStore) -> FunctionRecord {
+    let job = store.insert_image_deployment(record()).unwrap();
+    store
+        .settle_image_deployment(&job, Ok(image("worker:v1", 'a', Architecture::Arm64).0))
+        .unwrap();
+    store.get("worker").unwrap().unwrap()
+}
+fn update(store: &FunctionStore, reference: &str) -> ImageDeployment {
+    let before = store.get("worker").unwrap().unwrap();
+    store
+        .begin_image_update(
+            "worker",
+            before.resource_id,
+            &before.latest.revision_id,
+            reference.parse().unwrap(),
+            Architecture::Arm64,
+        )
+        .unwrap()
+}
+fn current(store: &FunctionStore) -> VersionRecord {
+    store.get("worker").unwrap().unwrap().latest
+}
+
+#[test]
+fn test_should_reserve_pending_and_settle_with_content_hash_and_unpacked_size() {
+    let (_root, store) = store();
+    let mut before = record();
+    before.latest.code_sha256 = "unverified tag hash".into();
+    before.latest.code_size = 999;
+    let old_revision = before.latest.revision_id.clone();
+    let resource = before.resource_id;
+    let job = store.insert_image_deployment(before).unwrap();
+    assert_eq!(current(&store).deployment.state(), "Pending");
+    assert_eq!(current(&store).code_sha256, "");
+    assert_eq!(current(&store).code_size, 0);
+    assert_eq!(current(&store).deployment.update_status(), "InProgress");
+    let (image, _, _) = image("worker:v1", 'a', Architecture::Arm64);
+    let hash = image
+        .resolved()
+        .metadata()
+        .inspection_hash
+        .as_str()
+        .strip_prefix("sha256:")
+        .unwrap();
+    let expected = STANDARD.encode(hex::decode(hash).unwrap());
+    assert!(!format!("{job:?}").contains("private value"));
+    assert!(!format!("{job:?}").contains("worker:v1"));
+    assert!(store.settle_image_deployment(&job, Ok(image)).unwrap());
+    let after = store.get("worker").unwrap().unwrap();
+    assert_eq!(after.resource_id, resource);
+    assert_eq!(after.latest.deployment, DeploymentState::Ready);
+    assert_ne!(after.latest.revision_id, old_revision);
+    assert_eq!(after.latest.code_sha256, expected);
+    assert_eq!(after.latest.code_size, 4096); // Metadata Size is only1024.
+    assert!(after.latest.image.pinned().unwrap().is_live());
+    assert!(
+        !store
+            .settle_image_deployment(&job, Err(ImageDeploymentFailure::SupervisorFailed))
+            .unwrap()
+    );
+}
+
+#[test]
+fn test_should_preserve_previous_revision_while_updating_and_after_failure() {
+    let (_root, store) = store();
+    let before = ready(&store).latest;
+    let job = update(&store, "worker:v2");
+    let pending = current(&store);
+    assert_eq!(pending.deployment.state(), "Active");
+    assert_eq!(pending.deployment.update_status(), "InProgress");
+    assert_eq!(pending.revision_id, before.revision_id);
+    assert_eq!(pending.image_uri, before.image_uri);
+    assert_eq!(pending.code_sha256, before.code_sha256);
+    assert_eq!(
+        pending.image.resolved().unwrap().metadata().image_id,
+        before.image.resolved().unwrap().metadata().image_id
+    );
+    assert!(
+        store
+            .settle_image_deployment(&job, Err(ImageDeploymentFailure::InvalidImage))
+            .unwrap()
+    );
+    let failed = current(&store);
+    assert_eq!(
+        failed.deployment,
+        DeploymentState::UpdateFailed(ImageDeploymentFailure::InvalidImage)
+    );
+    assert_eq!(failed.revision_id, before.revision_id);
+    assert_eq!(failed.image_uri, before.image_uri);
+    assert_eq!(failed.code_sha256, before.code_sha256);
+    assert_eq!(failed.environment, before.environment);
+    let retry = update(&store, "worker:v2");
+    assert!(
+        !store
+            .settle_image_deployment(&job, Err(ImageDeploymentFailure::Cancelled))
+            .unwrap()
+    );
+    assert!(
+        store
+            .settle_image_deployment(&retry, Ok(image("worker:v2", 'b', Architecture::Arm64).0))
+            .unwrap()
+    );
+    assert_eq!(current(&store).image_uri.as_deref(), Some("worker:v2"));
+    assert_ne!(current(&store).code_sha256, before.code_sha256);
+}
+
+#[test]
+fn test_should_retry_failed_creation_without_claiming_a_previous_active_revision() {
+    let (_root, store) = store();
+    let initial = store.insert_image_deployment(record()).unwrap();
+    assert!(
+        store
+            .settle_image_deployment(&initial, Err(ImageDeploymentFailure::ImageNotFound))
+            .unwrap()
+    );
+    assert_eq!(current(&store).deployment.state(), "Failed");
+    let retry = update(&store, "worker:fixed");
+    assert_eq!(current(&store).deployment.state(), "Pending");
+    assert_eq!(current(&store).image_uri.as_deref(), Some("worker:fixed"));
+    assert!(
+        store
+            .settle_image_deployment(
+                &retry,
+                Ok(image("worker:fixed", 'b', Architecture::Arm64).0)
+            )
+            .unwrap()
+    );
+    assert_eq!(current(&store).deployment, DeploymentState::Ready);
+}
+
+#[test]
+fn test_should_reject_stale_resource_revision_and_generation_independently() {
+    let (_root, store) = store();
+    let before = ready(&store);
+    assert!(
+        store
+            .begin_image_update(
+                "worker",
+                FunctionResourceId::new(),
+                &before.latest.revision_id,
+                "worker:v2".parse().unwrap(),
+                Architecture::Arm64
+            )
+            .is_err()
+    );
+    assert!(
+        store
+            .begin_image_update(
+                "worker",
+                before.resource_id,
+                "stale",
+                "worker:v2".parse().unwrap(),
+                Architecture::Arm64
+            )
+            .is_err()
+    );
+    let job = update(&store, "worker:v2");
+    assert!(
+        store
+            .begin_image_update(
+                "worker",
+                before.resource_id,
+                &before.latest.revision_id,
+                "worker:v3".parse().unwrap(),
+                Architecture::Arm64
+            )
+            .is_err()
+    );
+    store
+        .update("worker", |record| {
+            record.latest.revision_id = Uuid::new_v4().to_string();
+        })
+        .unwrap();
+    assert!(
+        !store
+            .settle_image_deployment(&job, Err(ImageDeploymentFailure::Cancelled))
+            .unwrap()
+    );
+    store.remove("worker").unwrap();
+    let mut recreated = before;
+    recreated.resource_id = FunctionResourceId::new();
+    recreated.latest.deployment = DeploymentState::Updating(job.generation);
+    store.insert(recreated).unwrap();
+    assert!(
+        !store
+            .settle_image_deployment(&job, Ok(image("worker:v2", 'b', Architecture::Arm64).0))
+            .unwrap()
+    );
+    store.remove("worker").unwrap();
+    assert!(
+        !store
+            .settle_image_deployment(&job, Err(ImageDeploymentFailure::Cancelled))
+            .unwrap()
+    );
+}
+
+#[rstest]
+#[case("other:v1", Architecture::Arm64, false)]
+#[case("worker:v1", Architecture::X86_64, false)]
+#[case("worker:v1", Architecture::Arm64, true)]
+fn test_should_reject_mismatching_or_revoked_preparation_without_partial_commit(
+    #[case] reference: &str,
+    #[case] architecture: Architecture,
+    #[case] revoke: bool,
+) {
+    let (_root, store) = store();
+    let job = store.insert_image_deployment(record()).unwrap();
+    let pending = current(&store).deployment;
+    let (image, _, stop) = image(reference, 'a', architecture);
+    if revoke {
+        stop.send_replace(true);
+    }
+    assert!(store.settle_image_deployment(&job, Ok(image)).is_err());
+    assert_eq!(current(&store).deployment, pending);
+    assert!(current(&store).image.pinned().is_none());
+    assert!(
+        store
+            .settle_image_deployment(&job, Err(ImageDeploymentFailure::InvalidImage))
+            .unwrap()
+    );
+}
+
+#[test]
+fn test_should_drop_stale_result_lease_without_modifying_a_new_generation() {
+    let (_root, store) = store();
+    ready(&store);
+    let job = update(&store, "worker:v2");
+    store
+        .settle_image_deployment(&job, Err(ImageDeploymentFailure::Cancelled))
+        .unwrap();
+    let replacement = update(&store, "worker:v3");
+    let (image, released, _) = image("worker:v2", 'b', Architecture::Arm64);
+    assert!(!store.settle_image_deployment(&job, Ok(image)).unwrap());
+    assert!(released.has_changed().is_err());
+    assert_eq!(
+        current(&store).deployment,
+        DeploymentState::Updating(replacement.generation)
+    );
+}
+
+#[test]
+fn test_should_rollback_every_change_when_a_fallible_store_mutation_fails() {
+    let (_root, store) = store();
+    let before = ready(&store);
+    let result: Result<(), _> =
+        store.try_update_if_revision("worker", Some(&before.latest.revision_id), |record| {
+            record.latest.environment.clear();
+            record.latest.description = "must not commit".into();
+            record.latest.revision_id = "changed".into();
+            Err(invalid("injected validation failure"))
+        });
+    assert!(result.is_err());
+    let after = current(&store);
+    assert_eq!(after.environment, before.latest.environment);
+    assert_eq!(after.description, before.latest.description);
+    assert_eq!(after.revision_id, before.latest.revision_id);
+}
+
+#[tokio::test]
+async fn test_should_derive_public_status_and_guard_mutations_and_publication() {
+    let (root, store) = store();
+    let job = store.insert_image_deployment(record()).unwrap();
+    let provider = RustackLambda::with_store(store, LambdaConfig::default());
+    let pending = provider.get_function_configuration("worker", None).unwrap();
+    assert_eq!(pending.state.as_deref(), Some("Pending"));
+    assert!(pending.code_sha256.is_none());
+    assert_eq!(pending.last_update_status.as_deref(), Some("InProgress"));
+    assert!(
+        provider
+            .publish_version("worker", &PublishVersionInput::default())
+            .is_err()
+    );
+    assert!(
+        provider
+            .update_function_configuration(
+                "worker",
+                &UpdateFunctionConfigurationInput {
+                    description: Some("no".into()),
+                    ..Default::default()
+                }
+            )
+            .is_err()
+    );
+    assert!(
+        provider
+            .update_function_code(
+                "worker",
+                UpdateFunctionCodeInput {
+                    image_uri: Some("worker:v2".into()),
+                    ..Default::default()
+                }
+            )
+            .await
+            .is_err()
+    );
+    assert!(
+        provider
+            .store()
+            .settle_image_deployment(&job, Err(ImageDeploymentFailure::ImageNotFound))
+            .unwrap()
+    );
+    let failed = provider.get_function_configuration("worker", None).unwrap();
+    assert_eq!(failed.state.as_deref(), Some("Failed"));
+    assert_eq!(
+        failed.state_reason.as_deref(),
+        Some(ImageDeploymentFailure::ImageNotFound.reason())
+    );
+    assert_eq!(failed.state_reason_code.as_deref(), Some("ImageDeleted"));
+    assert_eq!(failed.last_update_status.as_deref(), Some("Failed"));
+    assert!(
+        provider
+            .publish_version("worker", &PublishVersionInput::default())
+            .is_err()
+    );
+    drop(provider);
+    drop(root);
+}
+
+#[tokio::test]
+async fn test_should_keep_published_leases_and_report_resolved_uri() {
+    let (_root, store) = store();
+    let job = store.insert_image_deployment(record()).unwrap();
+    let (image, released, _) = image("worker:v1", 'a', Architecture::Arm64);
+    store.settle_image_deployment(&job, Ok(image)).unwrap();
+    let provider = RustackLambda::with_store(store, LambdaConfig::default());
+    let published = provider
+        .publish_version("worker", &PublishVersionInput::default())
+        .unwrap();
+    assert_eq!(published.version.as_deref(), Some("1"));
+    let code = provider
+        .get_function("worker", Some("1"))
+        .unwrap()
+        .code
+        .unwrap();
+    assert_eq!(code.image_uri.as_deref(), Some("worker:v1"));
+    assert!(
+        code.resolved_image_uri
+            .unwrap()
+            .starts_with("local://sha256:")
+    );
+    let update = update(provider.store(), "worker:v2");
+    provider
+        .store()
+        .settle_image_deployment(&update, Ok(image_fixture("worker:v2", 'b')))
+        .unwrap();
+    assert!(!released.has_changed().unwrap());
+    provider.delete_function("worker", Some("1")).await.unwrap();
+    assert!(released.has_changed().is_err());
+}
+fn image_fixture(reference: &str, letter: char) -> PinnedImage {
+    image(reference, letter, Architecture::Arm64).0
+}
+
+#[tokio::test]
+async fn test_should_rollback_invalid_effective_configuration_and_guard_publish_keys() {
+    let (_root, store) = store();
+    let before = ready(&store).latest;
+    let provider = RustackLambda::with_store(store, LambdaConfig::default());
+    assert!(
+        provider
+            .update_function_configuration(
+                "worker",
+                &UpdateFunctionConfigurationInput {
+                    description: Some("must not commit".into()),
+                    image_config: Some(ImageConfig {
+                        entry_point: Some(Vec::new()),
+                        command: Some(Vec::new()),
+                        working_directory: None
+                    }),
+                    ..Default::default()
+                }
+            )
+            .is_err()
+    );
+    assert_eq!(current(provider.store()).description, before.description);
+    assert_eq!(current(provider.store()).revision_id, before.revision_id);
+    for input in [
+        PublishVersionInput {
+            revision_id: Some("stale".into()),
+            ..Default::default()
+        },
+        PublishVersionInput {
+            code_sha256: Some("wrong".into()),
+            ..Default::default()
+        },
+    ] {
+        assert!(provider.publish_version("worker", &input).is_err());
+    }
+    assert!(
+        provider
+            .store()
+            .get("worker")
+            .unwrap()
+            .unwrap()
+            .versions
+            .is_empty()
+    );
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_restore_in_progress_snapshots_as_failed_without_inventing_a_lease(
+    #[case] updating: bool,
+) {
+    let (_root, store) = store();
+    if updating {
+        ready(&store);
+        update(&store, "worker:v2");
+    } else {
+        store.insert_image_deployment(record()).unwrap();
+    }
+    let json = serde_json::to_vec(&store.export_snapshot()).unwrap();
+    let restore_root = tempfile::tempdir().unwrap();
+    let restored = FunctionStore::new(restore_root.path());
+    restored
+        .import_snapshot(serde_json::from_slice(&json).unwrap())
+        .await
+        .unwrap();
+    let after = current(&restored);
+    assert_eq!(
+        after.deployment,
+        if updating {
+            DeploymentState::UpdateFailed(ImageDeploymentFailure::Cancelled)
+        } else {
+            DeploymentState::CreateFailed(ImageDeploymentFailure::Cancelled)
+        }
+    );
+    assert!(after.image.pinned().is_none());
+    assert_eq!(after.image.resolved().is_some(), updating);
+}
+
+#[tokio::test]
+async fn test_should_reject_contradictory_snapshot_states_and_accept_legacy_active_metadata() {
+    let (_root, store) = store();
+    ready(&store);
+    let baseline = current(&store).revision_id;
+    let mut snapshot = store.export_snapshot();
+    snapshot.functions.first_mut().unwrap().latest.state = "Failed".into();
+    assert!(store.import_snapshot(snapshot).await.is_err());
+    assert_eq!(current(&store).revision_id, baseline);
+    let mut legacy = serde_json::to_value(store.export_snapshot()).unwrap();
+    legacy["functions"][0]["latest"]
+        .as_object_mut()
+        .unwrap()
+        .remove("deployment");
+    let restore_root = tempfile::tempdir().unwrap();
+    let restored = FunctionStore::new(restore_root.path());
+    restored
+        .import_snapshot(serde_json::from_value::<FunctionStoreSnapshot>(legacy).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(current(&restored).deployment, DeploymentState::Ready);
+    assert!(matches!(
+        current(&restored).image,
+        ImageArtifact::Restored(_)
+    ));
+}
+
+#[test]
+fn test_should_reject_nil_invalid_and_unknown_deployment_state_values() {
+    assert!(DeploymentGeneration::try_from(Uuid::nil()).is_err());
+    for value in [Uuid::nil().to_string(), "x".repeat(2048), "invalid".into()] {
+        assert!(
+            serde_json::from_value::<DeploymentGeneration>(serde_json::Value::String(value))
+                .is_err()
+        );
+    }
+    assert!(serde_json::from_str::<DeploymentState>(r#"{"kind":"ready","extra":true}"#).is_err());
+    let state = DeploymentState::Creating(DeploymentGeneration(Uuid::new_v4()));
+    assert_eq!(
+        serde_json::from_slice::<DeploymentState>(&serde_json::to_vec(&state).unwrap()).unwrap(),
+        state
+    );
+}
+
+#[rstest]
+#[case("hash")]
+#[case("zero")]
+#[case("oversize")]
+#[tokio::test]
+async fn test_should_reject_tampered_resolved_snapshot_metadata_atomically(
+    #[case] corruption: &str,
+) {
+    let (_root, store) = store();
+    let before = ready(&store).latest;
+    let mut snapshot = store.export_snapshot();
+    let version = &mut snapshot.functions.first_mut().unwrap().latest;
+    match corruption {
+        "hash" => version.code_sha256 = "forged".into(),
+        "zero" => version.code_size = 0,
+        "oversize" => version.code_size = crate::artifact::MAX_IMAGE_BYTES + 1,
+        _ => unreachable!("trusted case"),
+    }
+    assert!(store.import_snapshot(snapshot).await.is_err());
+    let after = current(&store);
+    assert_eq!(after.revision_id, before.revision_id);
+    assert_eq!(after.code_sha256, before.code_sha256);
+    assert!(after.image.pinned().unwrap().is_live());
+}
+
+#[test]
+fn test_should_reject_a_live_image_size_that_disagrees_with_its_proof() {
+    let (_root, store) = store();
+    let before = ready(&store).latest;
+    assert!(
+        store
+            .update("worker", |record| record.latest.code_size += 1)
+            .is_err()
+    );
+    assert_eq!(current(&store).code_size, before.code_size);
+}
+
+#[test]
+fn test_should_commit_only_one_of_two_concurrent_completion_results() {
+    let (_root, store) = store();
+    ready(&store);
+    let job = update(&store, "worker:v2");
+    let barrier = std::sync::Barrier::new(2);
+    let wins = std::thread::scope(|threads| {
+        let handles: Vec<_> = ['b', 'c']
+            .into_iter()
+            .map(|letter| {
+                let store = &store;
+                let job = &job;
+                let barrier = &barrier;
+                threads.spawn(move || {
+                    let prepared = image("worker:v2", letter, Architecture::Arm64).0;
+                    barrier.wait();
+                    store.settle_image_deployment(job, Ok(prepared)).unwrap()
+                })
+            })
+            .collect();
+        handles
+            .into_iter()
+            .map(|handle| handle.join().unwrap())
+            .filter(|won| *won)
+            .count()
+    });
+    assert_eq!(wins, 1);
+    assert_eq!(current(&store).deployment, DeploymentState::Ready);
+}
+
+#[tokio::test]
+async fn test_should_preserve_failed_readiness_when_restoring_legacy_zip_progress() {
+    let (_root, store) = store();
+    let mut source = record();
+    source.latest.package_type = "Zip".into();
+    source.latest.runtime = Some("provided.al2023".into());
+    source.latest.handler = Some("bootstrap".into());
+    source.latest.image_uri = None;
+    store.insert(source).unwrap();
+    let mut snapshot = store.export_snapshot();
+    let version = &mut snapshot.functions.first_mut().unwrap().latest;
+    version.state = "Pending".into();
+    version.deployment = None;
+    store.import_snapshot(snapshot).await.unwrap();
+    assert_eq!(
+        current(&store).deployment,
+        DeploymentState::CreateFailed(ImageDeploymentFailure::Cancelled)
+    );
+}
+
+#[tokio::test]
+async fn test_should_reject_image_update_publication_before_mutating_the_previous_revision() {
+    let (_root, store) = store();
+    let before = ready(&store).latest;
+    let provider = RustackLambda::with_store(store, LambdaConfig::default());
+    let outcome = provider
+        .update_function_code(
+            "worker",
+            UpdateFunctionCodeInput {
+                image_uri: Some("worker:v2".into()),
+                publish: Some(true),
+                ..Default::default()
+            },
+        )
+        .await;
+    assert!(matches!(
+        outcome,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    let after = current(provider.store());
+    assert_eq!(after.revision_id, before.revision_id);
+    assert_eq!(after.code_sha256, before.code_sha256);
+    assert_eq!(after.deployment, DeploymentState::Ready);
+}
diff --git a/crates/rustack-lambda-core/src/diagnostics.rs b/crates/rustack-lambda-core/src/diagnostics.rs
new file mode 100644
index 00000000..235635be
--- /dev/null
+++ b/crates/rustack-lambda-core/src/diagnostics.rs
@@ -0,0 +1,38 @@
+//! Bounded actual invocation ownership, sampled without business admission.
+//!
+//! Counters are independently sampled; they are not a transaction spanning two
+//! semaphores. They contain no function identity, request data or credentials.
+
+use serde::Serialize;
+
+pub(crate) const ACCEPTED_LIMIT: usize = 128;
+pub(crate) const EXECUTION_LIMIT: usize = 32;
+pub(crate) const DEFAULT_FUNCTION_LIMIT: usize = 8;
+
+/// Limits used by the real invocation supervisor and its admission semaphores.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct InvocationWorkLimits {
+    /// Maximum accepted calls, including asynchronous waiting and cleanup.
+    pub accepted_invocations: usize,
+    /// Maximum owned global execution permits, including backend pool waiting.
+    pub active_executions: usize,
+    /// Per-function execution limit when no reserved override is installed.
+    pub default_function_executions: usize,
+}
+
+/// Actual independently sampled ownership counters from one Lambda provider.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct InvocationWorkStatus {
+    /// Accepted-work permits retained until execution/cleanup settles.
+    pub accepted_invocations: usize,
+    /// Global execution permits retained through backend waiting and cleanup.
+    pub active_executions: usize,
+    /// Whether the supervisor still accepts ordinary invocation submissions.
+    pub accepting: bool,
+    /// The same limits used to construct/acquire actual admission capacity.
+    pub limits: InvocationWorkLimits,
+}
diff --git a/crates/rustack-lambda-core/src/docker/binding.rs b/crates/rustack-lambda-core/src/docker/binding.rs
new file mode 100644
index 00000000..e397ea85
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/binding.rs
@@ -0,0 +1,159 @@
+//! Persist installation identity and retain exact directory ownership on IO.
+
+use std::{fmt, sync::Arc, time::Duration};
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use serde::Deserialize;
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{
+    DirectoryLease, DockerError, DockerPort, Operation, RawReply, RawRequest, check_deadline,
+    decode,
+};
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(super) struct DaemonIdentity(Uuid);
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct IdentityResponse {
+    #[serde(rename = "ID")]
+    id: String,
+}
+
+impl fmt::Debug for IdentityResponse {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("IdentityResponse(<redacted>)")
+    }
+}
+
+impl fmt::Debug for DaemonIdentity {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DaemonIdentity(<redacted>)")
+    }
+}
+
+impl TryFrom<&str> for DaemonIdentity {
+    type Error = DockerError;
+
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        if value.len() != 36 {
+            return Err(DockerError::Protocol);
+        }
+        let id = Uuid::try_parse(value).map_err(|_| DockerError::Protocol)?;
+        if id.is_nil() || id.hyphenated().to_string() != value {
+            return Err(DockerError::Protocol);
+        }
+        Ok(Self(id))
+    }
+}
+
+impl DaemonIdentity {
+    pub(super) fn from_uuid(id: Uuid) -> Result<Self, DockerError> {
+        if id.is_nil() {
+            return Err(DockerError::Protocol);
+        }
+        Ok(Self(id))
+    }
+
+    pub(super) fn uuid(self) -> Uuid {
+        self.0
+    }
+
+    pub(super) fn decode(reply: RawReply, deadline: Instant) -> Result<Self, DockerError> {
+        let response: IdentityResponse = decode(reply, deadline)?;
+        Self::try_from(response.id.as_str())
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct DaemonBinding {
+    pub(super) identity: DaemonIdentity,
+    pub(super) directory: DirectoryLease,
+}
+
+impl DockerPort {
+    /// Persist this daemon's installation identity and retain the exact lease.
+    ///
+    /// The returned port checks identity on every actual operation connection.
+    /// First binding requires empty container/image journals; existing bindings
+    /// never silently move to another daemon. This does not grant readiness.
+    ///
+    /// # Errors
+    /// Rejects invalid budgets/identity, mismatched or unsafe durable state,
+    /// unprovable historical effects, IO deadlines and wire failures.
+    ///
+    /// ```no_run
+    /// # async fn bind(port: &rustack_lambda_core::docker::DockerPort, directory: &rustack_lambda_core::docker::DirectoryLease) -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// let bound = port.bind_directory(directory,
+    ///     tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await?;
+    /// let scope = rustack_lambda_core::docker::ImagePinScope::new(directory.clone());
+    /// let mut images = rustack_lambda_core::docker::ImageLeaseManager::start(bound, scope, Default::default())?;
+    /// images.shutdown(tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn bind_directory(
+        &self,
+        directory: &DirectoryLease,
+        deadline: Instant,
+    ) -> Result<Self, DockerError> {
+        check_deadline(deadline)?;
+        let remaining = deadline
+            .checked_duration_since(Instant::now())
+            .ok_or(DockerError::Deadline)?;
+        if remaining > Duration::from_secs(60) {
+            return Err(DockerError::Configuration);
+        }
+        let identity = async {
+            let reply = self
+                .raw
+                .request(
+                    RawRequest {
+                        archive: None,
+                        pull: None,
+                        binding: None,
+                        mutation: None,
+                        operation: Operation::Info,
+                        method: Method::GET,
+                        target: "/info".into(),
+                        body: Bytes::new(),
+                        expected: StatusCode::OK,
+                    },
+                    deadline,
+                )
+                .await?;
+            DaemonIdentity::decode(reply, deadline)
+        }
+        .await
+        .map_err(|source| DockerError::IdentityCheck(Arc::new(source)))?;
+        directory.bind_daemon(identity, deadline).await?;
+        check_deadline(deadline)?;
+        let mut bound = self.clone();
+        bound.raw.binding = Some(Arc::new(DaemonBinding {
+            identity,
+            directory: directory.clone(),
+        }));
+        Ok(bound)
+    }
+
+    pub(super) fn require_directory(&self, directory: &DirectoryLease) -> Result<(), DockerError> {
+        if self
+            .raw
+            .binding
+            .as_ref()
+            .is_some_and(|binding| binding.directory.same_instance(directory))
+        {
+            return Ok(());
+        }
+        #[cfg(test)]
+        if self.raw.binding.is_none() && directory.synthetic() {
+            return Ok(());
+        }
+        Err(DockerError::DaemonBinding)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/binding/tests.rs b/crates/rustack-lambda-core/src/docker/binding/tests.rs
new file mode 100644
index 00000000..2189a8d1
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/binding/tests.rs
@@ -0,0 +1,283 @@
+use std::time::Duration;
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use rstest::rstest;
+use tokio::{
+    fs::read,
+    spawn,
+    time::{Instant, timeout},
+};
+
+use super::DaemonIdentity;
+use crate::docker::{
+    DirectoryLease, DirectoryLeaseError, DockerError, EnvironmentConfig, EnvironmentManager,
+    ImageLeaseConfig, ImageLeaseManager, ImagePinScope, Operation, RawRequest,
+    mutation::MutationGuard,
+    reconcile_containers, reconcile_image_pins,
+    tests::{DAEMON_ID, Daemon},
+};
+
+mod connection;
+mod real;
+mod recovery;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+
+#[rstest]
+#[case("")]
+#[case("00000000-0000-0000-0000-000000000000")]
+#[case("44CA5378-c28c-4bac-b6ed-2b298f02ecb5")]
+#[case("44ca5378c28c4bacb6ed2b298f02ecb5")]
+#[case("{44ca5378-c28c-4bac-b6ed-2b298f02ecb5}")]
+#[case("44ca5378-c28c-4bac-b6ed-2b298f02ecb5\n")]
+#[case("33Z5:BE33:KSMC:S4GY:GRDO:EH5E")]
+#[case("éééééééééééééééééé")]
+fn test_should_reject_noncanonical_or_unproven_identity(#[case] value: &str) {
+    assert!(matches!(
+        DaemonIdentity::try_from(value),
+        Err(DockerError::Protocol)
+    ));
+}
+
+#[test]
+fn test_should_accept_and_redact_canonical_installation_identity() {
+    let identity = DaemonIdentity::try_from(DAEMON_ID).unwrap();
+    assert_eq!(identity.uuid().to_string(), DAEMON_ID);
+    assert!(!format!("{identity:?}").contains(DAEMON_ID));
+    assert_eq!(
+        format!("{:?}", DockerError::DaemonBinding),
+        "Docker daemon binding failed"
+    );
+}
+
+#[tokio::test]
+async fn test_should_require_exact_bound_lease_for_runtime_and_recovery() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let other_root = tempfile::tempdir().unwrap();
+    let other = DirectoryLease::acquire(other_root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let raw = wire.port();
+    assert!(matches!(
+        ImageLeaseManager::start(
+            raw.clone(),
+            ImagePinScope::new(directory.clone()),
+            ImageLeaseConfig::default()
+        ),
+        Err(DockerError::DaemonBinding)
+    ));
+    assert!(
+        EnvironmentManager::start(raw.clone(), directory.clone(), EnvironmentConfig::default())
+            .is_err()
+    );
+    assert!(
+        reconcile_containers(&directory, &raw, deadline())
+            .await
+            .is_err()
+    );
+    assert!(matches!(
+        reconcile_image_pins(&directory, &raw, deadline()).await,
+        Err(DockerError::DaemonBinding)
+    ));
+    let bound = raw.bind_directory(&directory, deadline()).await.unwrap();
+    assert!(bound.require_directory(&other).is_err());
+    assert!(
+        reconcile_containers(&other, &bound, deadline())
+            .await
+            .is_err()
+    );
+    assert!(
+        reconcile_image_pins(&other, &bound, deadline())
+            .await
+            .is_err()
+    );
+    assert_eq!(
+        reconcile_containers(&directory, &bound, deadline())
+            .await
+            .unwrap()
+            .remaining,
+        0
+    );
+    assert_eq!(
+        reconcile_image_pins(&directory, &bound, deadline())
+            .await
+            .unwrap()
+            .remaining,
+        0
+    );
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    let mut images = ImageLeaseManager::start(
+        bound.clone(),
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+    )
+    .unwrap();
+    images.shutdown(deadline()).await.unwrap();
+    drop(images);
+    let mut environments = EnvironmentManager::start(
+        bound.clone(),
+        directory.clone(),
+        EnvironmentConfig::default(),
+    )
+    .unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    drop(environments);
+    drop(directory);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    drop(bound);
+    let next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let bound = raw.bind_directory(&next, deadline()).await.unwrap();
+    bound.require_directory(&next).unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case("44ca5378-c28c-4bac-b6ed-2b298f02ecb6", false)]
+#[case("invalid", true)]
+#[tokio::test]
+async fn test_should_refuse_changed_peer_before_mutation_issuance(
+    #[case] id: &str,
+    #[case] malformed: bool,
+) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let bound = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let before = read(root.path().join(".rustack-lambda-docker/daemon.v1"))
+        .await
+        .unwrap();
+    daemon.identity.send_replace(id.to_owned());
+    let guard = MutationGuard::new();
+    let receipt = guard.receipt();
+    let result = bound
+        .raw
+        .request(
+            RawRequest {
+                archive: None,
+                pull: None,
+                binding: None,
+                mutation: Some(guard),
+                operation: Operation::TagPin,
+                method: Method::POST,
+                target: "/v1.53/images/test/tag".into(),
+                body: Bytes::new(),
+                expected: StatusCode::CREATED,
+            },
+            deadline(),
+        )
+        .await;
+    assert!(matches!(result, Err(DockerError::IdentityCheck(source)) if
+        if malformed { matches!(source.as_ref(), DockerError::Protocol) }
+        else { matches!(source.as_ref(), DockerError::DaemonBinding) }));
+    assert!(receipt.definitely_unissued());
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    assert_eq!(
+        read(root.path().join(".rustack-lambda-docker/daemon.v1"))
+            .await
+            .unwrap(),
+        before
+    );
+    daemon.identity.send_replace(DAEMON_ID.into());
+    let key = "a".repeat(64).parse().unwrap();
+    let (result, ()) = tokio::join!(bound.inspect_container(&key, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert!(matches!(
+        result,
+        Err(DockerError::Status(StatusCode::NOT_FOUND))
+    ));
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_refuse_changed_installation_before_rebinding_directory() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    drop(
+        wire.port()
+            .bind_directory(&directory, deadline())
+            .await
+            .unwrap(),
+    );
+    drop(directory);
+    let next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    daemon
+        .identity
+        .send_replace("44ca5378-c28c-4bac-b6ed-2b298f02ecb6".into());
+    assert!(matches!(
+        wire.port().bind_directory(&next, deadline()).await,
+        Err(DockerError::Ownership(_))
+    ));
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_exact_directory_through_abandoned_inflight_request() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let bound = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let task = spawn(async move {
+        bound
+            .inspect_container(&"a".repeat(64).parse().unwrap(), deadline())
+            .await
+    });
+    let held = daemon.next().await;
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    drop(directory);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    held.reply(404, b"{}").await;
+    wire.shutdown().await.unwrap();
+    let _next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/binding/tests/connection.rs b/crates/rustack-lambda-core/src/docker/binding/tests/connection.rs
new file mode 100644
index 00000000..7edb0e7f
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/binding/tests/connection.rs
@@ -0,0 +1,125 @@
+use std::{sync::Arc, time::Duration};
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use rstest::rstest;
+use serde_json::{json, to_vec};
+use tokio::{
+    io::AsyncWriteExt,
+    net::UnixListener,
+    spawn,
+    time::{advance, pause, timeout},
+};
+
+use super::deadline;
+use crate::docker::{
+    DirectoryLease, DockerError, Operation, Owner, RawRequest,
+    binding::{DaemonBinding, DaemonIdentity},
+    mutation::MutationGuard,
+    tests::{DAEMON_ID, read_request},
+};
+
+#[rstest]
+#[case::same_connection(0)]
+#[case::checked_peer_closed(1)]
+#[case::invalid_json(2)]
+#[case::unavailable(3)]
+#[case::expired_before_issue(4)]
+#[case::missing_identity(5)]
+#[case::null_identity(6)]
+#[tokio::test]
+async fn test_should_fence_issue_on_the_checked_connection(#[case] mode: u8) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let identity = DaemonIdentity::try_from(DAEMON_ID).unwrap();
+    directory.bind_daemon(identity, deadline()).await.unwrap();
+    let path = root.path().join("fixture.sock");
+    let listener = UnixListener::bind(&path).unwrap();
+    let (mut owner, mut raw) = Owner::start(path);
+    raw.binding = Some(Arc::new(DaemonBinding {
+        identity,
+        directory,
+    }));
+    let guard = MutationGuard::new();
+    let receipt = guard.receipt();
+    let request_port = raw.clone();
+    let task = spawn(async move {
+        request_port
+            .request(
+                RawRequest {
+                    archive: None,
+                    pull: None,
+                    binding: None,
+                    mutation: Some(guard),
+                    operation: Operation::TagPin,
+                    method: Method::POST,
+                    target: "/v1.53/images/proof/tag".into(),
+                    body: Bytes::new(),
+                    expected: StatusCode::CREATED,
+                },
+                deadline(),
+            )
+            .await
+    });
+    let (stream, _) = timeout(Duration::from_secs(5), listener.accept())
+        .await
+        .unwrap()
+        .unwrap();
+    let mut incoming = read_request(stream).await.unwrap();
+    assert!(incoming.head.starts_with("GET /info "));
+    assert!(
+        incoming
+            .head
+            .to_ascii_lowercase()
+            .contains("connection: keep-alive")
+    );
+    let body = match mode {
+        2 => b"{".to_vec(),
+        5 => b"{}".to_vec(),
+        6 => br#"{"ID":null}"#.to_vec(),
+        _ => to_vec(&json!({"ID": DAEMON_ID})).unwrap(),
+    };
+    if mode == 4 {
+        pause();
+        advance(Duration::from_secs(20)).await;
+    }
+    if mode == 1 {
+        incoming.reply(200, &body).await;
+    } else {
+        let status = if mode == 3 { 500 } else { 200 };
+        let head = format!(
+            "HTTP/1.1 {status} OK\r\nContent-Length: {}\r\nConnection: keep-alive\r\n\r\n",
+            body.len()
+        );
+        // Expiry can close the checked connection before the fixture writes.
+        let _ = incoming.stream.write_all(head.as_bytes()).await;
+        let _ = incoming.stream.write_all(&body).await;
+        if mode == 0 {
+            let actual = read_request(incoming.stream).await.unwrap();
+            assert!(actual.head.starts_with("POST /v1.53/images/proof/tag "));
+            actual.reply(201, b"").await;
+        } else {
+            assert!(read_request(incoming.stream).await.is_err());
+        }
+    }
+    let result = task.await.unwrap();
+    if mode == 0 {
+        assert!(result.is_ok());
+        assert!(!receipt.definitely_unissued());
+    } else {
+        assert!(result.is_err());
+        assert!(receipt.definitely_unissued());
+        if mode == 4 {
+            assert!(matches!(result, Err(DockerError::Deadline)));
+        }
+    }
+    assert!(
+        timeout(Duration::from_millis(20), listener.accept())
+            .await
+            .is_err(),
+        "checked connection was replayed on another socket"
+    );
+    owner.shutdown().await.unwrap();
+}
diff --git a/crates/rustack-lambda-core/src/docker/binding/tests/real.rs b/crates/rustack-lambda-core/src/docker/binding/tests/real.rs
new file mode 100644
index 00000000..526fb56e
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/binding/tests/real.rs
@@ -0,0 +1,77 @@
+use std::{env, time::Duration};
+
+use anyhow::{Context, Ok as anyhow_ok, Result, ensure};
+use tokio::{fs::read, time::Instant};
+
+use crate::docker::{DirectoryLease, DockerError, DockerWire};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+
+#[tokio::test]
+#[ignore = "requires two explicit distinct Docker daemons"]
+async fn test_should_bind_real_installation_across_reacquisition_and_reject_other_daemon()
+-> Result<()> {
+    let socket =
+        env::var("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit primary Docker socket")?;
+    let other = env::var("RUSTACK_OTHER_DOCKER_SOCKET").context("explicit other Docker socket")?;
+    let root = tempfile::tempdir()?;
+    let mut wire = DockerWire::connect(format!("unix://{socket}").parse()?, deadline()).await?;
+    let mut second = None;
+    let exercise = async {
+        let directory = DirectoryLease::acquire(root.path().into(), deadline()).await?;
+        let bound = wire.port().bind_directory(&directory, deadline()).await?;
+        let first_id = bound
+            .info(deadline())
+            .await?
+            .id
+            .context("engine identity")?;
+        let previous_owner = directory.owner_id();
+        let previous_run = directory.run_id();
+        drop(bound);
+        drop(directory);
+        wire.shutdown().await?;
+        wire = DockerWire::connect(format!("unix://{socket}").parse()?, deadline()).await?;
+        let next = DirectoryLease::acquire(root.path().into(), deadline()).await?;
+        ensure!(
+            next.owner_id() == previous_owner && next.run_id() != previous_run,
+            "directory identities did not follow restart contract"
+        );
+        let bound = wire.port().bind_directory(&next, deadline()).await?;
+        ensure!(
+            bound.info(deadline()).await?.id.as_deref() == Some(first_id.as_str()),
+            "installation identity changed"
+        );
+        let path = root.path().join(".rustack-lambda-docker/daemon.v1");
+        let before = read(&path).await?;
+        second = Some(DockerWire::connect(format!("unix://{other}").parse()?, deadline()).await?);
+        let port = second.as_ref().context("second wire")?.port();
+        ensure!(
+            port.info(deadline()).await?.id.as_deref() != Some(first_id.as_str()),
+            "explicit daemons are not distinct installations"
+        );
+        ensure!(
+            matches!(
+                port.bind_directory(&next, deadline()).await,
+                Err(DockerError::Ownership(_))
+            ),
+            "different daemon was accepted"
+        );
+        ensure!(
+            read(path).await? == before,
+            "failed binding changed authoritative state"
+        );
+        anyhow_ok(())
+    }
+    .await;
+    let second_cleanup = match second.as_mut() {
+        Some(owner) => owner.shutdown().await,
+        None => Ok(()),
+    };
+    let first_cleanup = wire.shutdown().await;
+    exercise?;
+    second_cleanup?;
+    first_cleanup?;
+    Ok(())
+}
diff --git a/crates/rustack-lambda-core/src/docker/binding/tests/recovery.rs b/crates/rustack-lambda-core/src/docker/binding/tests/recovery.rs
new file mode 100644
index 00000000..c2c33203
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/binding/tests/recovery.rs
@@ -0,0 +1,168 @@
+use std::{
+    sync::{Arc, atomic::Ordering},
+    time::Duration,
+};
+
+use http::StatusCode;
+use rstest::rstest;
+use tokio::{
+    fs::read,
+    time::{Instant, sleep, timeout},
+};
+
+use super::deadline;
+use crate::{
+    artifact::Architecture,
+    docker::{
+        DirectoryLease, DockerError, EnvironmentError, EnvironmentPlan, ImageLeaseConfig,
+        ImageLeaseManager, ImagePinScope,
+        lease::tests::{FakePins, Mode},
+        ownership::{ContainerRecord, ImageRecord},
+        plan::{
+            ContainerRole,
+            tests::{image_with, policy, revision},
+        },
+        reconcile_containers, reconcile_image_pins,
+        tests::Daemon,
+    },
+};
+
+#[rstest]
+#[case::known_container(true)]
+#[case::committed_alias(false)]
+#[tokio::test]
+async fn test_should_never_treat_identity_404_as_resource_absence(#[case] container: bool) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let bound = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    if container {
+        let plan = EnvironmentPlan::new(
+            directory.clone(),
+            image_with("1000", vec![]),
+            Arc::new(revision()),
+            policy(),
+        )
+        .unwrap();
+        let record = ContainerRecord::from_plan(&plan, ContainerRole::Relay).unwrap();
+        directory
+            .prepare_container(record.clone(), deadline())
+            .await
+            .unwrap();
+        directory
+            .know_container(record, "a".repeat(64).parse().unwrap(), deadline())
+            .await
+            .unwrap();
+    } else {
+        let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+        let record =
+            ImageRecord::new(&pin, &format!("sha256:{}", "a".repeat(64)).parse().unwrap()).unwrap();
+        directory
+            .prepare_image(record.clone(), deadline())
+            .await
+            .unwrap();
+        directory.commit_image(record, deadline()).await.unwrap();
+    }
+    let path = root
+        .path()
+        .join(".rustack-lambda-docker")
+        .join(if container {
+            "containers.v1"
+        } else {
+            "pins.v1"
+        });
+    let before = read(&path).await.unwrap();
+    drop(bound);
+    drop(directory);
+    let next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let bound = wire.port().bind_directory(&next, deadline()).await.unwrap();
+    daemon.identity_status.send_replace(404);
+    if container {
+        assert!(
+            matches!(reconcile_containers(&next, &bound, deadline()).await,
+            Err(EnvironmentError::Docker(DockerError::IdentityCheck(source)))
+                if matches!(source.as_ref(), DockerError::Status(StatusCode::NOT_FOUND)))
+        );
+        assert_eq!(next.container_records(deadline()).await.unwrap().len(), 1);
+    } else {
+        assert!(
+            matches!(reconcile_image_pins(&next, &bound, deadline()).await,
+            Err(DockerError::IdentityCheck(source))
+                if matches!(source.as_ref(), DockerError::Status(StatusCode::NOT_FOUND)))
+        );
+        assert_eq!(next.image_records(deadline()).await.unwrap().len(), 1);
+    }
+    assert_eq!(read(path).await.unwrap(), before);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_live_pin_capacity_when_cleanup_identity_returns_404() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let fake = FakePins::new(Mode::Normal).await;
+    let bound = fake
+        .wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let mut owner = ImageLeaseManager::start(
+        bound,
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::new(1, 1, Duration::from_secs(1)).unwrap(),
+    )
+    .unwrap();
+    let port = owner.port();
+    let image = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(directory.image_records(deadline()).await.unwrap().len(), 1);
+    fake.identity_status.send_replace(404);
+    drop(image);
+    timeout(Duration::from_secs(5), async {
+        while port.status().quarantined == 0 {
+            assert_eq!(port.status().pins, 1);
+            sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(
+        port.wait_empty(Instant::now() + Duration::from_millis(100))
+            .await
+            .is_err()
+    );
+    assert_eq!(port.status().pins, 1);
+    assert!(port.status().quarantined > 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap().len(), 1);
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 0);
+    fake.identity_status.send_replace(200);
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(port.status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    fake.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/code.rs b/crates/rustack-lambda-core/src/docker/code.rs
new file mode 100644
index 00000000..5eba5318
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code.rs
@@ -0,0 +1,364 @@
+//! Immutable ZIP-to-TAR conversion with retained transfer-buffer admission.
+//!
+//! A canceled observer leaves only a bounded, read-only blocking computation.
+//! Its owned source and reservation survive until the computation/output drops;
+//! conversion performs no filesystem reads or daemon operations. Source-lease
+//! retirement retains its normal last-owner cleanup.
+
+use std::{
+    fmt,
+    io::{self, Cursor, Read, Write},
+    path::Path,
+    sync::{Arc, LazyLock},
+};
+
+use bytes::Bytes;
+use tar::{Builder, EntryType, Header};
+use tokio::{
+    sync::{OwnedSemaphorePermit, Semaphore},
+    task::spawn_blocking,
+    time::{Instant, timeout_at},
+};
+use zip::ZipArchive;
+
+use super::{DockerError, check_deadline};
+use crate::{
+    artifact::{Architecture, MAX_ZIP_BYTES, ValidatedArtifact},
+    storage::{MAX_EXTRACTED_SIZE, ZipLayout, validate_zip_directory, validated_zip_path},
+};
+
+pub(super) const MAX_CODE_ARCHIVE_BYTES: usize = 282 * 1024 * 1024;
+static CONVERSIONS: LazyLock<Arc<Semaphore>> = LazyLock::new(|| Arc::new(Semaphore::new(2)));
+
+struct Storage {
+    bytes: Bytes,
+    architecture: Architecture,
+    source: ValidatedArtifact,
+    _reservation: OwnedSemaphorePermit,
+}
+
+/// Validated provided-runtime code, ready for the fixed Docker upload endpoint.
+///
+/// Clones share bytes, original code ownership and one global buffer reservation.
+/// There is no unchecked byte constructor, host-path bind or TAR extraction.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct DockerCodeArchive(Arc<Storage>);
+
+impl fmt::Debug for DockerCodeArchive {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("DockerCodeArchive")
+            .field("bytes", &self.len())
+            .field("architecture", &self.architecture())
+            .finish_non_exhaustive()
+    }
+}
+
+impl DockerCodeArchive {
+    /// Convert original staged ZIP bytes, checking the captured Linux ELF target.
+    ///
+    /// # Errors
+    /// Returns invalid code, byte/allocation limits, expired deadline, closed
+    /// admission or worker failure. No partial artifact or daemon effect is
+    /// produced. Two global slots remain held until the last transfer owner drops.
+    ///
+    /// ```no_run
+    /// # async fn prepare(source: rustack_lambda_core::artifact::ValidatedArtifact) -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// use rustack_lambda_core::{artifact::Architecture, docker::DockerCodeArchive};
+    /// let code = DockerCodeArchive::prepare(source, Architecture::Arm64,
+    ///     tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await?;
+    /// assert!(!code.is_empty());
+    /// # Ok(()) }
+    /// ```
+    pub async fn prepare(
+        source: ValidatedArtifact,
+        architecture: Architecture,
+        deadline: Instant,
+    ) -> Result<Self, DockerError> {
+        with_reservation(CONVERSIONS.clone(), deadline, move |reservation| {
+            convert(source, architecture, reservation, deadline)
+        })
+        .await
+    }
+
+    /// Encoded TAR bytes, including headers, padding and terminal blocks.
+    ///
+    /// ```no_run
+    /// # fn inspect(code: &rustack_lambda_core::docker::DockerCodeArchive) {
+    /// assert!(code.len() <= 282 * 1024 * 1024);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.0.bytes.len()
+    }
+
+    /// Whether this transfer is empty; successful code archives are never empty.
+    ///
+    /// ```no_run
+    /// # fn inspect(code: &rustack_lambda_core::docker::DockerCodeArchive) {
+    /// assert!(!code.is_empty());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.0.bytes.is_empty()
+    }
+
+    /// The architecture positively checked in the root bootstrap ELF header.
+    ///
+    /// ```no_run
+    /// # fn inspect(code: &rustack_lambda_core::docker::DockerCodeArchive) {
+    /// assert!(matches!(code.architecture(),
+    ///     rustack_lambda_core::artifact::Architecture::Arm64 |
+    ///     rustack_lambda_core::artifact::Architecture::X86_64));
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn architecture(&self) -> Architecture {
+        self.0.architecture
+    }
+
+    /// Base64 SHA-256 of the original ZIP, independent of transfer normalization.
+    ///
+    /// ```no_run
+    /// # fn inspect(code: &rustack_lambda_core::docker::DockerCodeArchive) {
+    /// assert_eq!(code.code_sha256().len(), 44);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn code_sha256(&self) -> &str {
+        self.0.source.sha256()
+    }
+
+    pub(super) fn bytes(&self) -> &Bytes {
+        &self.0.bytes
+    }
+}
+
+async fn with_reservation<T: Send + 'static>(
+    admission: Arc<Semaphore>,
+    deadline: Instant,
+    work: impl FnOnce(OwnedSemaphorePermit) -> Result<T, DockerError> + Send + 'static,
+) -> Result<T, DockerError> {
+    check_deadline(deadline)?;
+    let reservation = timeout_at(deadline, admission.acquire_owned())
+        .await
+        .map_err(|_| DockerError::Deadline)?
+        .map_err(|_| DockerError::Stopped)?;
+    check_deadline(deadline)?;
+    let result = timeout_at(deadline, spawn_blocking(move || work(reservation)))
+        .await
+        .map_err(|_| DockerError::Deadline)?
+        .map_err(|_| DockerError::Worker)??;
+    check_deadline(deadline)?;
+    Ok(result)
+}
+
+fn convert(
+    source: ValidatedArtifact,
+    architecture: Architecture,
+    reservation: OwnedSemaphorePermit,
+    deadline: Instant,
+) -> Result<DockerCodeArchive, DockerError> {
+    check_deadline(deadline)?;
+    if source.zip_bytes().len() > MAX_ZIP_BYTES {
+        return Err(DockerError::TooLarge);
+    }
+    let mut zip = ZipArchive::new(Cursor::new(source.zip_bytes().as_ref()))
+        .map_err(|_| DockerError::InvalidCode)?;
+    if zip.len() > 10_000 || zip.has_duplicate_names() {
+        return Err(DockerError::InvalidCode);
+    }
+    let mut output = Builder::new(BoundedWriter {
+        bytes: Vec::new(),
+        deadline,
+        limit: MAX_CODE_ARCHIVE_BYTES,
+    });
+    let mut layout = ZipLayout::default();
+    let mut extracted = 0u64;
+    let mut bootstrap = false;
+    for index in 0..zip.len() {
+        check_deadline(deadline)?;
+        let mut entry = zip.by_index(index).map_err(|_| DockerError::InvalidCode)?;
+        let path = validated_zip_path(&entry).map_err(|_| DockerError::InvalidCode)?;
+        if entry.is_dir() {
+            validate_zip_directory(&mut entry).map_err(|_| DockerError::InvalidCode)?;
+        }
+        let directories = layout
+            .admit(&path, entry.is_dir())
+            .map_err(|_| DockerError::InvalidCode)?;
+        for directory in directories {
+            let mut header = Header::new_gnu();
+            header.set_uid(0);
+            header.set_gid(0);
+            header.set_mtime(0);
+            header.set_size(0);
+            header.set_entry_type(EntryType::Directory);
+            header.set_mode(0o555);
+            output
+                .append_data(&mut header, directory, io::empty())
+                .map_err(|error| archive_io(error.kind()))?;
+        }
+        if entry.is_dir() {
+            continue;
+        }
+        let remaining = MAX_EXTRACTED_SIZE.saturating_sub(extracted);
+        if entry.size() > remaining {
+            return Err(DockerError::TooLarge);
+        }
+        let executable = entry.unix_mode().is_some_and(|mode| mode & 0o111 != 0);
+        let mut prefix = Vec::new();
+        if path == Path::new("bootstrap") {
+            if !executable {
+                return Err(DockerError::InvalidCode);
+            }
+            prefix.resize(64, 0);
+            entry
+                .read_exact(&mut prefix)
+                .map_err(|_| DockerError::InvalidCode)?;
+            validate_elf(&prefix, architecture)?;
+            bootstrap = true;
+        }
+        let declared = entry.size();
+        let mut reader = CheckedReader {
+            inner: Cursor::new(prefix).chain(&mut entry),
+            actual: 0,
+            remaining: remaining.saturating_add(1),
+            deadline,
+        };
+        let mut header = Header::new_gnu();
+        header.set_uid(0);
+        header.set_gid(0);
+        header.set_mtime(0);
+        header.set_size(declared);
+        header.set_entry_type(EntryType::Regular);
+        header.set_mode(if executable { 0o555 } else { 0o444 });
+        output
+            .append_data(&mut header, path, &mut reader)
+            .map_err(|error| archive_io(error.kind()))?;
+        if reader.actual != declared {
+            return Err(DockerError::InvalidCode);
+        }
+        extracted = extracted
+            .checked_add(reader.actual)
+            .filter(|total| *total <= MAX_EXTRACTED_SIZE)
+            .ok_or(DockerError::TooLarge)?;
+    }
+    if !bootstrap {
+        return Err(DockerError::InvalidCode);
+    }
+    let writer = output
+        .into_inner()
+        .map_err(|error| archive_io(error.kind()))?;
+    check_deadline(deadline)?;
+    drop(zip);
+    Ok(DockerCodeArchive(Arc::new(Storage {
+        bytes: Bytes::from(writer.bytes),
+        architecture,
+        source,
+        _reservation: reservation,
+    })))
+}
+
+fn validate_elf(header: &[u8], architecture: Architecture) -> Result<(), DockerError> {
+    let machine: u16 = match architecture {
+        Architecture::X86_64 => 62,
+        Architecture::Arm64 => 183,
+    };
+    if header.len() != 64
+        || header.get(..7) != Some(b"\x7fELF\x02\x01\x01")
+        || !matches!(header.get(16..18), Some([2 | 3, 0]))
+        || header.get(18..20) != Some(machine.to_le_bytes().as_slice())
+        || header.get(20..24) != Some(1u32.to_le_bytes().as_slice())
+        || header.get(52..54) != Some(64u16.to_le_bytes().as_slice())
+    {
+        return Err(DockerError::InvalidCode);
+    }
+    Ok(())
+}
+
+struct CheckedReader<R> {
+    inner: R,
+    actual: u64,
+    remaining: u64,
+    deadline: Instant,
+}
+impl<R: Read> Read for CheckedReader<R> {
+    fn read(&mut self, buffer: &mut [u8]) -> io::Result<usize> {
+        check_io(self.deadline)?;
+        let maximum = usize::try_from(self.remaining.min(8192))
+            .map_err(|_| io::Error::from(io::ErrorKind::InvalidData))?
+            .min(buffer.len());
+        if maximum == 0 && !buffer.is_empty() {
+            return Err(io::Error::from(io::ErrorKind::FileTooLarge));
+        }
+        let count = self.inner.read(
+            buffer
+                .get_mut(..maximum)
+                .ok_or(io::ErrorKind::InvalidInput)?,
+        )?;
+        let count64 = u64::try_from(count).map_err(|_| io::ErrorKind::InvalidData)?;
+        self.remaining = self.remaining.saturating_sub(count64);
+        self.actual = self
+            .actual
+            .checked_add(count64)
+            .ok_or(io::ErrorKind::InvalidData)?;
+        check_io(self.deadline)?;
+        Ok(count)
+    }
+}
+
+struct BoundedWriter {
+    bytes: Vec<u8>,
+    deadline: Instant,
+    limit: usize,
+}
+impl Write for BoundedWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        check_io(self.deadline)?;
+        let needed = self
+            .bytes
+            .len()
+            .checked_add(bytes.len())
+            .filter(|total| *total <= self.limit)
+            .ok_or(io::ErrorKind::FileTooLarge)?;
+        if needed > self.bytes.capacity() {
+            let capacity = self
+                .bytes
+                .capacity()
+                .saturating_mul(2)
+                .max(needed)
+                .min(self.limit);
+            self.bytes
+                .try_reserve_exact(capacity.saturating_sub(self.bytes.len()))
+                .map_err(|_| io::ErrorKind::OutOfMemory)?;
+        }
+        self.bytes.extend_from_slice(bytes);
+        check_io(self.deadline)?;
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        check_io(self.deadline)
+    }
+}
+
+fn check_io(deadline: Instant) -> io::Result<()> {
+    if Instant::now() >= deadline {
+        Err(io::ErrorKind::TimedOut.into())
+    } else {
+        Ok(())
+    }
+}
+
+fn archive_io(kind: io::ErrorKind) -> DockerError {
+    match kind {
+        io::ErrorKind::TimedOut => DockerError::Deadline,
+        io::ErrorKind::FileTooLarge => DockerError::TooLarge,
+        io::ErrorKind::OutOfMemory => DockerError::Allocation,
+        _ => DockerError::InvalidCode,
+    }
+}
+
+#[cfg(test)]
+pub(in crate::docker) mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/code/tests.rs b/crates/rustack-lambda-core/src/docker/code/tests.rs
new file mode 100644
index 00000000..7357271f
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code/tests.rs
@@ -0,0 +1,544 @@
+use std::{
+    io::{Cursor, Read, Write},
+    path::Path,
+    sync::{Arc, mpsc as blocking},
+    time::Duration,
+};
+
+use bytes::Bytes;
+use rstest::rstest;
+use tar::Archive;
+use tempfile::TempDir;
+use tokio::{
+    fs,
+    sync::{Semaphore, oneshot},
+    time::{Instant, timeout},
+};
+use zip::{CompressionMethod, ZipWriter, write::SimpleFileOptions};
+
+use super::{
+    BoundedWriter, CheckedReader, DockerCodeArchive, convert, validate_elf, with_reservation,
+};
+use crate::{
+    artifact::{Architecture, ValidatedArtifact},
+    docker::DockerError,
+    error::LambdaServiceError,
+    storage::FunctionStore,
+};
+
+pub(in crate::docker) fn elf(architecture: Architecture) -> Vec<u8> {
+    let mut bytes = vec![0; 64];
+    bytes
+        .get_mut(..7)
+        .unwrap()
+        .copy_from_slice(b"\x7fELF\x02\x01\x01");
+    bytes
+        .get_mut(16..18)
+        .unwrap()
+        .copy_from_slice(&2u16.to_le_bytes());
+    let machine: u16 = match architecture {
+        Architecture::Arm64 => 183,
+        Architecture::X86_64 => 62,
+    };
+    bytes
+        .get_mut(18..20)
+        .unwrap()
+        .copy_from_slice(&machine.to_le_bytes());
+    bytes
+        .get_mut(20..24)
+        .unwrap()
+        .copy_from_slice(&1u32.to_le_bytes());
+    bytes
+        .get_mut(52..54)
+        .unwrap()
+        .copy_from_slice(&64u16.to_le_bytes());
+    bytes
+}
+
+pub(in crate::docker) fn zip(entries: &[(&str, &[u8], u32)]) -> Vec<u8> {
+    let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+    for (name, bytes, mode) in entries {
+        writer
+            .start_file(
+                *name,
+                SimpleFileOptions::default()
+                    .unix_permissions(*mode)
+                    .compression_method(CompressionMethod::Stored),
+            )
+            .unwrap();
+        writer.write_all(bytes).unwrap();
+    }
+    writer.finish().unwrap().into_inner()
+}
+
+// Deliberately bypass staging only for converter defense-in-depth controls.
+pub(in crate::docker) async fn source(bytes: Vec<u8>) -> (TempDir, ValidatedArtifact) {
+    let root = tempfile::tempdir().unwrap();
+    let owned = tempfile::tempdir_in(root.path()).unwrap();
+    let extracted = owned.path().join("extracted");
+    fs::create_dir(&extracted).await.unwrap();
+    let artifact = ValidatedArtifact::from_staged(
+        owned,
+        root.path().to_owned(),
+        extracted,
+        Bytes::from(bytes),
+    );
+    (root, artifact)
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+
+pub(in crate::docker) async fn prepare(source: ValidatedArtifact) -> DockerCodeArchive {
+    prepare_with(source, Arc::new(Semaphore::new(2))).await
+}
+
+pub(in crate::docker) async fn prepare_with(
+    source: ValidatedArtifact,
+    admission: Arc<Semaphore>,
+) -> DockerCodeArchive {
+    let deadline = deadline();
+    with_reservation(admission, deadline, move |permit| {
+        convert(source, Architecture::Arm64, permit, deadline)
+    })
+    .await
+    .unwrap()
+}
+
+#[rstest]
+#[case(Architecture::Arm64)]
+#[case(Architecture::X86_64)]
+#[tokio::test]
+async fn test_should_transfer_original_bytes_with_deterministic_headers_and_long_paths(
+    #[case] architecture: Architecture,
+) {
+    let bootstrap = elf(architecture);
+    let path = format!("{}{}", "long/".repeat(203), "v".repeat(9));
+    assert_eq!(path.len(), 1024);
+    let (_root, artifact) = source(zip(&[
+        ("bootstrap", &bootstrap, 0o755),
+        (&path, b"original", 0o644),
+    ]))
+    .await;
+    fs::write(artifact.code_root().join("bootstrap"), b"mutated host tree")
+        .await
+        .unwrap();
+    let hash = artifact.sha256().to_owned();
+    let first = {
+        let artifact = artifact.clone();
+        with_reservation(Arc::new(Semaphore::new(1)), deadline(), move |permit| {
+            convert(artifact, architecture, permit, deadline())
+        })
+        .await
+        .unwrap()
+    };
+    let second = with_reservation(Arc::new(Semaphore::new(1)), deadline(), move |permit| {
+        convert(artifact, architecture, permit, deadline())
+    })
+    .await
+    .unwrap();
+    assert_eq!(first.bytes(), second.bytes());
+    assert_eq!(first.code_sha256(), hash);
+    assert_eq!(first.architecture(), architecture);
+    assert!(!format!("{first:?}").contains("original"));
+    let mut archive = Archive::new(Cursor::new(first.bytes()));
+    let mut count = 0;
+    let mut directories = 0;
+    for entry in archive.entries().unwrap() {
+        let mut entry = entry.unwrap();
+        let name = entry.path().unwrap().to_string_lossy().into_owned();
+        let mut bytes = Vec::new();
+        entry.read_to_end(&mut bytes).unwrap();
+        assert_eq!(entry.header().uid().unwrap(), 0);
+        assert_eq!(entry.header().gid().unwrap(), 0);
+        assert_eq!(entry.header().mtime().unwrap(), 0);
+        if entry.header().entry_type().is_dir() {
+            assert!(Path::new(&path).starts_with(Path::new(&name)));
+            assert_eq!(entry.header().mode().unwrap(), 0o555);
+            assert_eq!(bytes, [] as [u8; 0]);
+            directories += 1;
+            continue;
+        }
+        match name.as_str() {
+            "bootstrap" => {
+                assert_eq!(bytes, bootstrap);
+                assert_eq!(entry.header().mode().unwrap(), 0o555);
+            }
+            name if name == path => {
+                assert_eq!(bytes, b"original");
+                assert_eq!(entry.header().mode().unwrap(), 0o444);
+            }
+            _ => panic!("unexpected transfer member"),
+        }
+        count += 1;
+    }
+    assert_eq!(count, 2);
+    assert_eq!(directories, 203);
+}
+
+#[rstest]
+#[case::magic(0, 0)]
+#[case::class(4, 1)]
+#[case::endian(5, 2)]
+#[case::ident_version(6, 2)]
+#[case::object_type(16, 1)]
+#[case::object_type_high(17, 1)]
+#[case::machine(18, 62)]
+#[case::machine_high(19, 1)]
+#[case::version(20, 2)]
+#[case::version_high(23, 1)]
+#[case::header_size(52, 0)]
+#[tokio::test]
+async fn test_should_reject_invalid_elf_before_returning_a_transfer(
+    #[case] offset: usize,
+    #[case] value: u8,
+) {
+    let mut bytes = elf(Architecture::Arm64);
+    *bytes.get_mut(offset).unwrap() = value;
+    let (_root, artifact) = source(zip(&[("bootstrap", &bytes, 0o755)])).await;
+    assert!(matches!(
+        DockerCodeArchive::prepare(artifact, Architecture::Arm64, deadline()).await,
+        Err(DockerError::InvalidCode)
+    ));
+}
+
+#[rstest]
+#[case::script(b"#!/bin/sh\nexit 0", 0o755)]
+#[case::truncated(b"\x7fELF", 0o755)]
+#[case::mach_o(b"\xcf\xfa\xed\xfe", 0o755)]
+#[case::not_executable(b"unused", 0o644)]
+#[tokio::test]
+async fn test_should_reject_non_executable_bootstrap_forms(
+    #[case] bytes: &[u8],
+    #[case] mode: u32,
+) {
+    let (_root, artifact) = source(zip(&[("bootstrap", bytes, mode)])).await;
+    assert!(matches!(
+        DockerCodeArchive::prepare(artifact, Architecture::Arm64, deadline()).await,
+        Err(DockerError::InvalidCode)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_accept_pie_but_require_the_complete_current_header() {
+    let mut bytes = elf(Architecture::Arm64);
+    *bytes.get_mut(16).unwrap() = 3;
+    validate_elf(&bytes, Architecture::Arm64).unwrap();
+    assert!(validate_elf(bytes.get(..63).unwrap(), Architecture::Arm64).is_err());
+    let (_root, artifact) = source(zip(&[("data", b"no bootstrap", 0o644)])).await;
+    assert!(matches!(
+        DockerCodeArchive::prepare(artifact, Architecture::Arm64, deadline()).await,
+        Err(DockerError::InvalidCode)
+    ));
+}
+
+#[rstest]
+#[case::traversal("../outside")]
+#[case::absolute("/outside")]
+#[case::backslash("folder\\outside")]
+#[tokio::test]
+async fn test_should_revalidate_hostile_zip_paths(#[case] name: &str) {
+    let bootstrap = elf(Architecture::Arm64);
+    let (_root, artifact) = source(zip(&[
+        ("bootstrap", &bootstrap, 0o755),
+        (name, b"hostile", 0o644),
+    ]))
+    .await;
+    assert!(matches!(
+        DockerCodeArchive::prepare(artifact, Architecture::Arm64, deadline()).await,
+        Err(DockerError::InvalidCode)
+    ));
+}
+
+#[rstest]
+#[case::symlink(0o120_777)]
+#[case::fifo(0o010_644)]
+#[case::character_device(0o020_644)]
+#[case::block_device(0o060_644)]
+#[case::socket(0o140_644)]
+#[case::setuid(0o104_755)]
+#[tokio::test]
+async fn test_should_revalidate_zip_special_file_declarations(#[case] mode: u32) {
+    let bootstrap = elf(Architecture::Arm64);
+    let mut bytes = zip(&[("bootstrap", &bootstrap, 0o755)]);
+    let central = bytes
+        .windows(4)
+        .position(|part| part == b"PK\x01\x02")
+        .unwrap();
+    bytes
+        .get_mut(central + 4..central + 6)
+        .unwrap()
+        .copy_from_slice(&((3u16 << 8) | 0x14).to_le_bytes());
+    bytes
+        .get_mut(central + 38..central + 42)
+        .unwrap()
+        .copy_from_slice(&(mode << 16).to_le_bytes());
+    let original = bytes.clone();
+    let (_root, artifact) = source(bytes).await;
+    assert!(matches!(
+        DockerCodeArchive::prepare(artifact, Architecture::Arm64, deadline()).await,
+        Err(DockerError::InvalidCode)
+    ));
+    let root = tempfile::tempdir().unwrap();
+    let store = FunctionStore::new(root.path());
+    assert!(matches!(
+        store
+            .store_zip_code("special-file", "$LATEST", &Bytes::from(original))
+            .await,
+        Err(LambdaServiceError::InvalidZipFile { .. })
+    ));
+}
+
+#[test]
+fn test_should_bound_retained_buffer_capacity_and_reject_without_partial_append() {
+    let mut writer = BoundedWriter {
+        bytes: Vec::new(),
+        deadline: deadline(),
+        limit: 16,
+    };
+    writer.write_all(b"123456789").unwrap();
+    assert!(writer.bytes.capacity() <= 16);
+    writer.write_all(b"abcdefg").unwrap();
+    assert!(writer.bytes.capacity() <= 16);
+    assert_eq!(
+        writer.write(b"x").unwrap_err().kind(),
+        std::io::ErrorKind::FileTooLarge
+    );
+    assert_eq!(writer.bytes, b"123456789abcdefg");
+    writer.deadline = Instant::now();
+    assert_eq!(
+        writer.write(b"").unwrap_err().kind(),
+        std::io::ErrorKind::TimedOut
+    );
+}
+
+#[tokio::test]
+async fn test_should_bind_exactly_two_global_transfer_reservations() {
+    let bootstrap = elf(Architecture::Arm64);
+    let (_root, source) = source(zip(&[("bootstrap", &bootstrap, 0o755)])).await;
+    let first = DockerCodeArchive::prepare(source.clone(), Architecture::Arm64, deadline())
+        .await
+        .unwrap();
+    let second = DockerCodeArchive::prepare(source.clone(), Architecture::Arm64, deadline())
+        .await
+        .unwrap();
+    let error = DockerCodeArchive::prepare(
+        source,
+        Architecture::Arm64,
+        Instant::now() + Duration::from_millis(50),
+    )
+    .await
+    .unwrap_err();
+    assert!(matches!(error, DockerError::Deadline));
+    drop(first);
+    drop(second);
+}
+
+#[tokio::test]
+async fn test_should_hold_buffer_admission_until_the_last_archive_clone_drops() {
+    let bootstrap = elf(Architecture::Arm64);
+    let (_root, artifact) = source(zip(&[("bootstrap", &bootstrap, 0o755)])).await;
+    let admission = Arc::new(Semaphore::new(1));
+    let first = with_reservation(admission.clone(), deadline(), move |permit| {
+        convert(artifact, Architecture::Arm64, permit, deadline())
+    })
+    .await
+    .unwrap();
+    let clone = first.clone();
+    drop(first);
+    assert_eq!(admission.available_permits(), 0);
+    let error = with_reservation(
+        admission.clone(),
+        Instant::now() + Duration::from_millis(10),
+        Ok,
+    )
+    .await
+    .unwrap_err();
+    assert!(matches!(error, DockerError::Deadline));
+    drop(clone);
+    assert_eq!(admission.available_permits(), 1);
+}
+
+#[tokio::test]
+async fn test_should_retain_canceled_blocking_work_and_classify_panics() {
+    let admission = Arc::new(Semaphore::new(1));
+    let (entered, observed) = oneshot::channel();
+    let (release, held) = blocking::channel();
+    let task = tokio::spawn(with_reservation(
+        admission.clone(),
+        deadline(),
+        move |permit| {
+            entered.send(()).unwrap();
+            held.recv().unwrap();
+            Ok(permit)
+        },
+    ));
+    observed.await.unwrap();
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    assert_eq!(admission.available_permits(), 0);
+    release.send(()).unwrap();
+    timeout(Duration::from_secs(3), async {
+        while admission.available_permits() == 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    let result = with_reservation::<()>(admission.clone(), deadline(), |_| {
+        panic!("controlled code worker panic")
+    })
+    .await;
+    assert!(matches!(result, Err(DockerError::Worker)));
+    assert_eq!(admission.available_permits(), 1);
+}
+
+#[test]
+fn test_should_bound_actual_reader_progress_and_expiry() {
+    let mut reader = CheckedReader {
+        inner: Cursor::new(vec![0; 8193]),
+        actual: 0,
+        remaining: 8193,
+        deadline: deadline(),
+    };
+    let mut first = vec![0; 16_384];
+    assert_eq!(reader.read(&mut first).unwrap(), 8192);
+    assert_eq!(reader.read(&mut first).unwrap(), 1);
+    assert!(reader.read(&mut first).is_err());
+    reader.deadline = Instant::now();
+    assert_eq!(
+        reader.read(&mut first).unwrap_err().kind(),
+        std::io::ErrorKind::TimedOut
+    );
+}
+
+#[tokio::test]
+async fn test_should_read_empty_directory_streams_before_accepting_their_metadata() {
+    let bootstrap = elf(Architecture::Arm64);
+    let mut bytes = zip(&[
+        ("bootstrap", &bootstrap, 0o755),
+        ("directory/", b"\x07", 0o755),
+    ]);
+    let local = bytes
+        .windows(4)
+        .rposition(|part| part == b"PK\x03\x04")
+        .unwrap();
+    let central = bytes
+        .windows(4)
+        .rposition(|part| part == b"PK\x01\x02")
+        .unwrap();
+    bytes
+        .get_mut(local + 8..local + 10)
+        .unwrap()
+        .copy_from_slice(&8u16.to_le_bytes());
+    bytes.get_mut(local + 14..local + 18).unwrap().fill(0);
+    bytes.get_mut(local + 22..local + 26).unwrap().fill(0);
+    bytes
+        .get_mut(central + 10..central + 12)
+        .unwrap()
+        .copy_from_slice(&8u16.to_le_bytes());
+    bytes.get_mut(central + 16..central + 20).unwrap().fill(0);
+    bytes.get_mut(central + 24..central + 28).unwrap().fill(0);
+    bytes
+        .get_mut(central + 38..central + 42)
+        .unwrap()
+        .copy_from_slice(&(0o040_755u32 << 16).to_le_bytes());
+    let original = bytes.clone();
+    let (_root, artifact) = source(bytes).await;
+    assert!(matches!(
+        DockerCodeArchive::prepare(artifact, Architecture::Arm64, deadline()).await,
+        Err(DockerError::InvalidCode)
+    ));
+    let root = tempfile::tempdir().unwrap();
+    let store = FunctionStore::new(root.path());
+    assert!(matches!(
+        store
+            .store_zip_code("directory", "$LATEST", &Bytes::from(original))
+            .await,
+        Err(LambdaServiceError::InvalidZipFile { .. })
+    ));
+}
+
+#[rstest]
+#[case::crc(false)]
+#[case::declared_expansion(true)]
+#[tokio::test]
+async fn test_should_reject_regular_crc_or_declared_expansion_before_exposing_code(
+    #[case] oversized: bool,
+) {
+    let bootstrap = elf(Architecture::Arm64);
+    let mut bytes = zip(&[("bootstrap", &bootstrap, 0o755)]);
+    let central = bytes
+        .windows(4)
+        .position(|part| part == b"PK\x01\x02")
+        .unwrap();
+    if oversized {
+        let size = 250u32 * 1024 * 1024 + 1;
+        bytes
+            .get_mut(22..26)
+            .unwrap()
+            .copy_from_slice(&size.to_le_bytes());
+        bytes
+            .get_mut(central + 24..central + 28)
+            .unwrap()
+            .copy_from_slice(&size.to_le_bytes());
+    } else {
+        // Leave the complete checked ELF identity intact and corrupt only CRC.
+        bytes.get_mut(14..18).unwrap().fill(0);
+        bytes.get_mut(central + 16..central + 20).unwrap().fill(0);
+    }
+    let (_root, artifact) = source(bytes).await;
+    let error = DockerCodeArchive::prepare(artifact, Architecture::Arm64, deadline())
+        .await
+        .unwrap_err();
+    assert!(matches!(
+        (oversized, error),
+        (true, DockerError::TooLarge) | (false, DockerError::InvalidCode)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_consume_valid_compressed_empty_directory_and_emit_each_parent_once() {
+    let bootstrap = elf(Architecture::Arm64);
+    let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+    for (name, data) in [
+        ("bootstrap", bootstrap.as_slice()),
+        ("parent/file", b"data".as_slice()),
+        ("parent/", b"".as_slice()),
+    ] {
+        writer
+            .start_file(
+                name,
+                SimpleFileOptions::default()
+                    .unix_permissions(0o755)
+                    .compression_method(CompressionMethod::Deflated),
+            )
+            .unwrap();
+        writer.write_all(data).unwrap();
+    }
+    let mut bytes = writer.finish().unwrap().into_inner();
+    let central = bytes
+        .windows(4)
+        .rposition(|part| part == b"PK\x01\x02")
+        .unwrap();
+    bytes
+        .get_mut(central + 38..central + 42)
+        .unwrap()
+        .copy_from_slice(&(0o040_755u32 << 16).to_le_bytes());
+    let (_root, source) = source(bytes).await;
+    let code = prepare(source).await;
+    let mut archive = Archive::new(Cursor::new(code.bytes()));
+    let names: Vec<_> = archive
+        .entries()
+        .unwrap()
+        .map(|entry| entry.unwrap().path().unwrap().into_owned())
+        .collect();
+    assert_eq!(
+        names,
+        vec![
+            Path::new("bootstrap"),
+            Path::new("parent"),
+            Path::new("parent/file")
+        ]
+    );
+}
diff --git a/crates/rustack-lambda-core/src/docker/code_volume.rs b/crates/rustack-lambda-core/src/docker/code_volume.rs
new file mode 100644
index 00000000..0b5c2a73
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code_volume.rs
@@ -0,0 +1,17 @@
+//! Retained code-volume staging and physical retirement, separate from readiness.
+
+mod base;
+mod entry;
+mod owner;
+mod stage;
+mod types;
+
+pub(in crate::docker) use base::validate_base;
+pub use owner::{CodeVolumeManager, CodeVolumePort};
+pub use types::{
+    CodePreparation, CodeRetirement, CodeVolumeConfig, CodeVolumeIdentity, CodeVolumeStatus,
+    PinnedCode,
+};
+
+#[cfg(test)]
+pub(in crate::docker) mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/code_volume/base.rs b/crates/rustack-lambda-core/src/docker/code_volume/base.rs
new file mode 100644
index 00000000..3382f6f6
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code_volume/base.rs
@@ -0,0 +1,48 @@
+//! Shared immutable base policy for startup and retained staging.
+
+use tokio::time::Instant;
+
+use crate::{
+    artifact::{Architecture, PinnedImage},
+    docker::{DockerError, DockerPort},
+};
+
+pub(in crate::docker) async fn validate_base(
+    base: &PinnedImage,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<(), DockerError> {
+    let metadata = base.resolved().metadata();
+    let reference = metadata.image_id.as_str().parse()?;
+    let inspected = docker.inspect_image(&reference, deadline).await?;
+    let config = inspected.config.as_ref().ok_or(DockerError::Protocol)?;
+    let labels = config.labels.as_ref();
+    if inspected.id.as_deref() != Some(metadata.image_id.as_str())
+        || inspected.os.as_deref() != Some("linux")
+        || inspected.architecture.as_deref()
+            != Some(match metadata.architecture {
+                Architecture::Arm64 => "arm64",
+                Architecture::X86_64 => "amd64",
+            })
+        || config
+            .volumes
+            .as_ref()
+            .is_some_and(|volumes| !volumes.is_empty())
+        || labels.is_some_and(|labels| {
+            labels.len() > 56
+                || labels.iter().any(|(key, value)| {
+                    key.is_empty()
+                        || key.len() > 128
+                        || value.len() > 256
+                        || key.starts_with("rustack.lambda.")
+                        || !key
+                            .bytes()
+                            .all(|b| b.is_ascii_alphanumeric() || b"_.-".contains(&b))
+                        || value.chars().any(char::is_control)
+                })
+        })
+    {
+        return Err(DockerError::Quarantined);
+    }
+    Ok(())
+}
diff --git a/crates/rustack-lambda-core/src/docker/code_volume/entry.rs b/crates/rustack-lambda-core/src/docker/code_volume/entry.rs
new file mode 100644
index 00000000..e0b1fb82
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code_volume/entry.rs
@@ -0,0 +1,265 @@
+//! Above-worker guards, durable-state reconciliation and independent reaping.
+
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use tokio::{
+    runtime::Handle,
+    sync::{OwnedSemaphorePermit, Semaphore, watch},
+    time::{Instant, sleep},
+};
+use typed_builder::TypedBuilder;
+
+use super::{CodeVolumeConfig, CodeVolumeIdentity, types::Acceptance};
+use crate::{
+    artifact::PinnedImage,
+    docker::{
+        DirectoryLease, DockerCodeArchive, DockerError, DockerPort,
+        mutation::MutationReceipt,
+        ownership::{
+            CodeProducerGuard,
+            codes::{CodeEffect, CodeRecord, LoaderState, VolumeState},
+        },
+        recovery::code::retire_effects,
+    },
+    invocation::CleanupTask,
+};
+
+#[derive(Debug, Default)]
+pub(super) struct Health {
+    pub(super) physical: AtomicBool,
+    pub(super) failed: AtomicBool,
+    pub(super) quarantined: AtomicUsize,
+    #[cfg(test)]
+    pub(super) ready: AtomicUsize,
+    #[cfg(test)]
+    pub(super) fault: std::sync::atomic::AtomicU8,
+}
+impl Health {
+    pub(super) fn check(&self) -> Result<(), DockerError> {
+        if self.failed.load(Ordering::Acquire) {
+            Err(DockerError::Worker)
+        } else if self.quarantined.load(Ordering::Acquire) > 0 {
+            Err(DockerError::Quarantined)
+        } else {
+            Ok(())
+        }
+    }
+}
+#[derive(Debug, TypedBuilder)]
+pub(super) struct Context {
+    pub(super) docker: DockerPort,
+    pub(super) directory: DirectoryLease,
+    pub(super) config: CodeVolumeConfig,
+    pub(super) stop: watch::Sender<bool>,
+    pub(super) health: Arc<Health>,
+    pub(super) runtime: Handle,
+    pub(super) cleanup: Semaphore,
+    pub(super) producer: CodeProducerGuard,
+}
+impl Context {
+    #[cfg(test)]
+    pub(super) fn fault(&self, point: u8) {
+        if self
+            .health
+            .fault
+            .compare_exchange(point, 0, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+        {
+            panic!("deliberate code-volume owner fault");
+        }
+    }
+    pub(super) fn fail(&self) {
+        self.health.failed.store(true, Ordering::Release);
+        self.stop.send_replace(true);
+    }
+}
+#[derive(Debug, Clone, Default)]
+pub(super) struct Receipts {
+    pub(super) volume: Option<MutationReceipt>,
+    pub(super) loader: Option<MutationReceipt>,
+}
+impl Receipts {
+    fn unissued(&self) -> bool {
+        self.volume
+            .as_ref()
+            .is_none_or(MutationReceipt::definitely_unissued)
+            && self
+                .loader
+                .as_ref()
+                .is_none_or(MutationReceipt::definitely_unissued)
+    }
+}
+#[derive(Debug)]
+pub(super) struct Progress {
+    pub(super) receipts: watch::Sender<Receipts>,
+    pub(super) active: Arc<AtomicBool>,
+    pub(super) clean: watch::Sender<bool>,
+    pub(super) retired: AtomicBool,
+    pub(super) running: AtomicBool,
+}
+impl Progress {
+    pub(super) fn new(clean: watch::Sender<bool>) -> Self {
+        let (receipts, _) = watch::channel(Receipts::default());
+        Self {
+            receipts,
+            active: Arc::new(AtomicBool::new(false)),
+            clean,
+            retired: AtomicBool::new(false),
+            running: AtomicBool::new(false),
+        }
+    }
+}
+#[derive(Debug, TypedBuilder)]
+pub(super) struct Plan {
+    pub(super) identity: Arc<CodeVolumeIdentity>,
+    pub(super) base: PinnedImage,
+    pub(super) archive: watch::Sender<Option<DockerCodeArchive>>,
+    pub(super) record: CodeRecord,
+    pub(super) deadline: Instant,
+    pub(super) cancel: watch::Receiver<()>,
+}
+#[derive(Debug, TypedBuilder)]
+pub(super) struct Entry {
+    pub(super) plan: Plan,
+    pub(super) progress: Progress,
+    pub(super) stage: CleanupTask,
+    pub(super) outcome: watch::Sender<Option<Result<(), DockerError>>>,
+    pub(super) handoff: Acceptance,
+    pub(super) released: watch::Receiver<()>,
+    pub(super) _volume: OwnedSemaphorePermit,
+}
+impl Entry {
+    pub(super) fn check(&self, context: &Context) -> Result<(), DockerError> {
+        if Instant::now() >= self.plan.deadline {
+            return Err(DockerError::Deadline);
+        }
+        if *context.stop.borrow() || !self.plan.base.liveness().is_live() {
+            return Err(DockerError::Stopped);
+        }
+        if self.plan.cancel.has_changed().is_err() {
+            return Err(DockerError::Cancelled);
+        }
+        Ok(())
+    }
+    pub(super) async fn retire(&self, context: &Context) {
+        self.progress.active.store(false, Ordering::Release);
+        if self.stage.wait().await.is_err() {
+            context.fail();
+        }
+        self.plan.archive.send_replace(None);
+        let mut dirty = None;
+        let mut delay = Duration::from_secs(1);
+        loop {
+            if self.cleanup_step(context).await {
+                self.progress.clean.send_replace(true);
+                self.handoff.send_modify(|handoff| {
+                    handoff.slot.take();
+                });
+                return;
+            }
+            if dirty.is_none() {
+                dirty = Some(Dirty::new(context.health.clone()));
+            }
+            sleep(delay).await;
+            delay = delay.saturating_mul(2).min(Duration::from_secs(30));
+        }
+    }
+    async fn cleanup_step(&self, context: &Context) -> bool {
+        let Ok(_permit) = context.cleanup.acquire().await else {
+            return false;
+        };
+        let deadline = context.config.deadline();
+        let Ok(records) = context.directory.code_records(deadline).await else {
+            return false;
+        };
+        let receipts = self.progress.receipts.borrow().clone();
+        let Some(mut record) = records
+            .into_iter()
+            .find(|r| r.environment == self.plan.record.environment)
+        else {
+            return self.progress.retired.load(Ordering::Acquire) || receipts.unissued();
+        };
+        if !record.same_identity(&self.plan.record) {
+            return receipts.unissued();
+        }
+        let proof = match (record.volume, record.loader) {
+            (VolumeState::Uncertain, LoaderState::Planned) => {
+                receipts.volume.as_ref().map(|r| (CodeEffect::Volume, r))
+            }
+            (VolumeState::Known, LoaderState::Uncertain) => {
+                receipts.loader.as_ref().map(|r| (CodeEffect::Loader, r))
+            }
+            _ => None,
+        };
+        if let Some((effect, receipt)) = proof.filter(|(_, r)| r.definitely_unissued()) {
+            if context
+                .directory
+                .abandon_code(record.clone(), effect, receipt, deadline)
+                .await
+                .is_err()
+            {
+                return false;
+            }
+            match effect {
+                CodeEffect::Volume => {
+                    record.volume = VolumeState::Retired;
+                    record.loader = LoaderState::Retired;
+                }
+                CodeEffect::Loader => {
+                    record.loader = LoaderState::Retired;
+                }
+            }
+        }
+        if !matches!(
+            Box::pin(retire_effects(
+                &context.directory,
+                &context.docker,
+                &mut record,
+                deadline
+            ))
+            .await,
+            Ok(true)
+        ) {
+            return false;
+        }
+        // This witness outlives a worker and is published before erase can commit.
+        self.progress.retired.store(true, Ordering::Release);
+        #[cfg(test)]
+        context.fault(6);
+        let erased = context
+            .directory
+            .settle_code(record, deadline)
+            .await
+            .is_ok();
+        #[cfg(test)]
+        if erased
+            && context
+                .health
+                .fault
+                .compare_exchange(7, 0, Ordering::AcqRel, Ordering::Acquire)
+                .is_ok()
+        {
+            return false;
+        }
+        erased
+    }
+}
+#[derive(Debug)]
+struct Dirty(Arc<Health>);
+impl Dirty {
+    fn new(health: Arc<Health>) -> Self {
+        health.quarantined.fetch_add(1, Ordering::AcqRel);
+        Self(health)
+    }
+}
+impl Drop for Dirty {
+    fn drop(&mut self) {
+        self.0.quarantined.fetch_sub(1, Ordering::AcqRel);
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/code_volume/owner.rs b/crates/rustack-lambda-core/src/docker/code_volume/owner.rs
new file mode 100644
index 00000000..59daa8ee
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code_volume/owner.rs
@@ -0,0 +1,770 @@
+//! Bounded producer actor and a transferred, non-aborting cleanup ledger.
+
+use std::{
+    collections::HashMap,
+    fmt, mem,
+    sync::{Arc, atomic::Ordering},
+    time::Duration,
+};
+
+use base64::{Engine, engine::general_purpose::STANDARD};
+use tokio::{
+    runtime::Handle,
+    sync::{OwnedSemaphorePermit, Semaphore, mpsc, oneshot, watch},
+    task::{Id, JoinError, JoinHandle, JoinSet},
+    time::{Instant, sleep_until, timeout_at},
+};
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use super::{
+    CodePreparation, CodeRetirement, CodeVolumeConfig, CodeVolumeIdentity, CodeVolumeStatus,
+    PinnedCode,
+    entry::{Context, Entry, Health, Plan, Progress},
+    stage,
+    types::{CodeLease, Consumption, Handoff},
+};
+use crate::{
+    artifact::PinnedImage,
+    docker::{
+        DirectoryLease, DockerCodeArchive, DockerError, DockerPort, check_deadline,
+        connection::stopped,
+        ownership::codes::{CodeRecord, LoaderState, VolumeState},
+    },
+    invocation::CleanupTask,
+};
+
+#[derive(Debug)]
+struct NoEffectRetirement(Option<watch::Sender<bool>>);
+impl Drop for NoEffectRetirement {
+    fn drop(&mut self) {
+        if let Some(retired) = &self.0 {
+            retired.send_replace(true);
+        }
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Envelope {
+    retirement: NoEffectRetirement,
+    identity: CodeVolumeIdentity,
+    archive: DockerCodeArchive,
+    base: PinnedImage,
+    deadline: Instant,
+    cancel: watch::Receiver<()>,
+    reply: oneshot::Sender<Result<PinnedCode, DockerError>>,
+    volume: OwnedSemaphorePermit,
+    handoff: watch::Sender<Handoff>,
+}
+/// Cloneable bounded code preparation port; retain the manager through cleanup.
+#[derive(Debug, Clone, TypedBuilder)]
+#[non_exhaustive]
+pub struct CodeVolumePort {
+    sender: mpsc::Sender<Envelope>,
+    slots: Arc<Semaphore>,
+    volumes: Arc<Semaphore>,
+    stop: watch::Sender<bool>,
+    health: Arc<Health>,
+    directory: DirectoryLease,
+    config: CodeVolumeConfig,
+}
+impl CodeVolumePort {
+    #[cfg(test)]
+    pub(super) fn set_fault(&self, point: u8) {
+        self.health.fault.store(point, Ordering::Release);
+    }
+    #[cfg(test)]
+    pub(super) fn ready_handoffs(&self) -> usize {
+        self.health.ready.load(Ordering::Acquire)
+    }
+
+    /// Observe retained reservations without Docker IO or mailbox admission.
+    ///
+    /// ```no_run
+    /// # fn inspect(port:&rustack_lambda_core::docker::CodeVolumePort) {let status=port.status();}
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> CodeVolumeStatus {
+        let worker_failed = self.health.failed.load(Ordering::Acquire);
+        let quarantined = self.health.quarantined.load(Ordering::Acquire);
+        CodeVolumeStatus {
+            volumes: usize::from(self.config.volumes)
+                .saturating_sub(self.volumes.available_permits()),
+            preparing: usize::from(self.config.jobs).saturating_sub(self.slots.available_permits()),
+            quarantined,
+            worker_failed,
+            accepting: !worker_failed && quarantined == 0 && !*self.stop.borrow(),
+        }
+    }
+    /// Prepare typed code under the exact source-pin acquisition and deadline.
+    ///
+    /// Dropping or expiring the observer leaves accepted work and cleanup owned.
+    /// The returned lease must outlive every known/uncertain mount consumer.
+    ///
+    /// # Errors
+    /// Returns invalid identity/source/budgets, bounded admission, IO or staging
+    /// failures. An error does not establish physical retirement.
+    ///
+    /// ```no_run
+    /// # async fn prepare(port:&rustack_lambda_core::docker::CodeVolumePort,code:rustack_lambda_core::docker::DockerCodeArchive,base:rustack_lambda_core::artifact::PinnedImage)->Result<(),rustack_lambda_core::docker::DockerError> {
+    /// let id=rustack_lambda_core::docker::CodeVolumeIdentity::new(uuid::Uuid::new_v4(),uuid::Uuid::new_v4())?;
+    /// let lease=port.prepare(id,code,base,tokio::time::Instant::now()+std::time::Duration::from_secs(120)).await?;
+    /// assert_eq!(lease.mount()?.read_only,Some(true));
+    /// # Ok(()) }
+    /// ```
+    #[tracing::instrument(skip_all)]
+    pub async fn prepare(
+        &self,
+        identity: CodeVolumeIdentity,
+        archive: DockerCodeArchive,
+        base: PinnedImage,
+        deadline: Instant,
+    ) -> Result<PinnedCode, DockerError> {
+        self.start_preparation(identity, archive, base, deadline)?
+            .wait()
+            .await
+    }
+    /// Accept preparation and expose retirement before its fallible result.
+    ///
+    /// Parent environments retain their own admission until the retirement
+    /// receipt succeeds, including when result observation fails or expires.
+    ///
+    /// # Errors
+    /// Returns source, budget, stopped or bounded admission failures before any
+    /// code effect can be issued; a returned handle owns accepted observation.
+    ///
+    /// ```no_run
+    /// # async fn start(port:&rustack_lambda_core::docker::CodeVolumePort,id:rustack_lambda_core::docker::CodeVolumeIdentity,code:rustack_lambda_core::docker::DockerCodeArchive,base:rustack_lambda_core::artifact::PinnedImage)->Result<(),rustack_lambda_core::docker::DockerError> {
+    /// let preparation=port.start_preparation(id,code,base,tokio::time::Instant::now()+std::time::Duration::from_secs(120))?;
+    /// let mut retired=preparation.retirement();
+    /// let result=preparation.wait().await;
+    /// drop(result);
+    /// retired.wait(tokio::time::Instant::now()+std::time::Duration::from_secs(30)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub fn start_preparation(
+        &self,
+        identity: CodeVolumeIdentity,
+        archive: DockerCodeArchive,
+        base: PinnedImage,
+        deadline: Instant,
+    ) -> Result<CodePreparation, DockerError> {
+        self.start_with_receipt(identity, archive, base, deadline, |_| {})
+    }
+    pub(in crate::docker) fn same_scope(&self, directory: &DirectoryLease) -> bool {
+        self.directory.same_instance(directory)
+    }
+    pub(in crate::docker) fn live(&self) -> bool {
+        !*self.stop.borrow()
+            && !self.health.failed.load(Ordering::Acquire)
+            && !self.sender.is_closed()
+    }
+    pub(in crate::docker) fn start_with_receipt<F>(
+        &self,
+        identity: CodeVolumeIdentity,
+        archive: DockerCodeArchive,
+        base: PinnedImage,
+        deadline: Instant,
+        publish: F,
+    ) -> Result<CodePreparation, DockerError>
+    where
+        F: FnOnce(CodeRetirement),
+    {
+        self.health.check()?;
+        if *self.stop.borrow() {
+            return Err(DockerError::Stopped);
+        }
+        let remaining = deadline
+            .checked_duration_since(Instant::now())
+            .filter(|v| !v.is_zero())
+            .ok_or(DockerError::Deadline)?;
+        if remaining > Duration::from_secs(3600)
+            || !base.belongs_to(&self.directory)
+            || !base.is_live()
+            || !base.liveness().is_live()
+            || archive.architecture() != base.resolved().metadata().architecture
+        {
+            return Err(DockerError::Configuration);
+        }
+        let slot = self
+            .slots
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| DockerError::Busy)?;
+        let volume = self
+            .volumes
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| DockerError::Busy)?;
+        let (handoff, _) = watch::channel(Handoff {
+            state: Consumption::Pending,
+            slot: Some(slot),
+        });
+        let (cancel, cancelled) = watch::channel(());
+        let (reply, response) = oneshot::channel();
+        let (retirement, settled) = watch::channel(false);
+        let retired = CodeRetirement::new(settled);
+        let request = Envelope::builder()
+            .retirement(NoEffectRetirement(Some(retirement)))
+            .identity(identity)
+            .archive(archive)
+            .base(base)
+            .deadline(deadline)
+            .cancel(cancelled)
+            .reply(reply)
+            .volume(volume)
+            .handoff(handoff)
+            .build();
+        // Publication cannot race accepted work: the envelope is still local.
+        publish(retired.clone());
+        self.sender.try_send(request).map_err(|error| match error {
+            mpsc::error::TrySendError::Full(_) => DockerError::Busy,
+            mpsc::error::TrySendError::Closed(_) => DockerError::Stopped,
+        })?;
+        Ok(CodePreparation {
+            result: response,
+            _cancel: cancel,
+            retired,
+            deadline,
+        })
+    }
+}
+/// Retained producer ownership; stop after all code mount consumers have joined.
+#[non_exhaustive]
+pub struct CodeVolumeManager {
+    port: CodeVolumePort,
+    task: Option<JoinHandle<Result<(), DockerError>>>,
+    primary: Option<Result<(), DockerError>>,
+    emergency: Arc<CleanupTask>,
+    settlement: Option<Result<(), DockerError>>,
+}
+impl fmt::Debug for CodeVolumeManager {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("CodeVolumeManager")
+            .field("status", &self.port.status())
+            .finish_non_exhaustive()
+    }
+}
+impl CodeVolumeManager {
+    pub(in crate::docker) fn physically_settled(&self) -> bool {
+        self.settlement.is_some() && self.port.health.physical.load(Ordering::Acquire)
+    }
+
+    /// Start one producing owner for this acquired code-generation directory.
+    ///
+    /// Historical namespace recovery must precede production. No readiness or
+    /// ordinary ZIP capability is granted by this library constructor.
+    ///
+    /// # Errors
+    /// Rejects missing runtime, foreign/unbound ports, wrong provenance or a
+    /// previous producer still retaining this acquisition.
+    ///
+    /// ```no_run
+    /// # fn start(port:rustack_lambda_core::docker::DockerPort,directory:rustack_lambda_core::docker::DirectoryLease)->Result<(),rustack_lambda_core::docker::DockerError> {
+    /// let manager=rustack_lambda_core::docker::CodeVolumeManager::start(port,directory,Default::default())?;
+    /// # Ok(()) }
+    /// ```
+    pub fn start(
+        docker: DockerPort,
+        directory: DirectoryLease,
+        config: CodeVolumeConfig,
+    ) -> Result<Self, DockerError> {
+        docker.require_directory(&directory)?;
+        let runtime = Handle::try_current().map_err(|_| DockerError::Worker)?;
+        let producer = directory.code_producer()?;
+        let (sender, inbox) = mpsc::channel(32);
+        let (stop, _) = watch::channel(false);
+        let health = Arc::new(Health::default());
+        let emergency = Arc::new(CleanupTask::default());
+        let port = CodeVolumePort::builder()
+            .sender(sender)
+            .slots(Arc::new(Semaphore::new(usize::from(config.jobs))))
+            .volumes(Arc::new(Semaphore::new(usize::from(config.volumes))))
+            .stop(stop.clone())
+            .health(health.clone())
+            .directory(directory.clone())
+            .config(config)
+            .build();
+        let context = Arc::new(
+            Context::builder()
+                .docker(docker.owned())
+                .directory(directory)
+                .config(config)
+                .stop(stop)
+                .health(health)
+                .runtime(runtime.clone())
+                .cleanup(Semaphore::new(2))
+                .producer(producer)
+                .build(),
+        );
+        let actor = Actor {
+            ledger: Ledger::new(context),
+            inbox,
+            emergency: emergency.clone(),
+            settled: false,
+        };
+        let task = runtime.spawn(actor.run());
+        Ok(Self {
+            port,
+            task: Some(task),
+            primary: None,
+            emergency,
+            settlement: None,
+        })
+    }
+    #[cfg(test)]
+    pub(super) fn abort_root(&self) {
+        if let Some(task) = &self.task {
+            task.abort();
+        }
+    }
+
+    /// Clone a preparation port without transferring manager shutdown ownership.
+    ///
+    /// ```no_run
+    /// # fn inspect(manager:&rustack_lambda_core::docker::CodeVolumeManager) {let port=manager.port();}
+    /// ```
+    #[must_use]
+    pub fn port(&self) -> CodeVolumePort {
+        self.port.clone()
+    }
+    /// Revoke admission/leases and join original stages and all physical cleanup.
+    ///
+    /// First join every known/uncertain function and its IO, then stop this
+    /// manager, then image ownership and the Docker wire. An expired observer
+    /// retains the same join task and all outstanding resource reservations.
+    ///
+    /// # Errors
+    /// Returns deadline while retaining work, or cached supervision failure.
+    ///
+    /// ```no_run
+    /// # async fn stop(manager:&mut rustack_lambda_core::docker::CodeVolumeManager) {let result=manager.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(30)).await;}
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), DockerError> {
+        self.port.stop.send_replace(true);
+        if let Some(result) = &self.settlement {
+            return result.clone();
+        }
+        check_deadline(deadline)?;
+        if self.primary.is_none() {
+            let result = match self.task.as_mut() {
+                Some(task) => timeout_at(deadline, task)
+                    .await
+                    .map_err(|_| DockerError::Deadline)?
+                    .map_err(|_| DockerError::Worker)
+                    .and_then(|result| result),
+                None => Err(DockerError::Worker),
+            };
+            self.primary = Some(result);
+            self.task.take();
+        }
+        let emergency = timeout_at(deadline, self.emergency.wait())
+            .await
+            .map_err(|_| DockerError::Deadline)?
+            .map_err(|_| DockerError::Worker);
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        let result = self
+            .primary
+            .clone()
+            .ok_or(DockerError::Worker)?
+            .and(emergency);
+        self.settlement = Some(result.clone());
+        result
+    }
+}
+impl Drop for CodeVolumeManager {
+    fn drop(&mut self) {
+        self.port.stop.send_replace(true);
+    }
+}
+
+type Request = (
+    watch::Sender<()>,
+    oneshot::Sender<Result<PinnedCode, DockerError>>,
+);
+
+type Job = (Uuid, Result<(), DockerError>);
+type Joined = Result<(Id, Job), JoinError>;
+#[derive(Debug)]
+struct Ledger {
+    context: Arc<Context>,
+    entries: HashMap<Uuid, Arc<Entry>>,
+    jobs: JoinSet<Job>,
+    index: HashMap<Id, Uuid>,
+}
+impl Ledger {
+    fn new(context: Arc<Context>) -> Self {
+        Self {
+            context,
+            entries: HashMap::new(),
+            jobs: JoinSet::new(),
+            index: HashMap::new(),
+        }
+    }
+    fn spawn(&mut self, entry: Arc<Entry>, request: Option<Request>) {
+        let id = entry.plan.identity.environment;
+        let context = self.context.clone();
+        let guard = WorkerGuard::new(entry.clone(), context.clone());
+        let job = self.jobs.spawn(async move {
+            let mut guard = guard;
+            if let Some((release, reply)) = request {
+                run(entry, context, release, reply).await;
+            } else {
+                tokio::time::sleep(Duration::from_secs(1)).await;
+                entry.retire(&context).await;
+            }
+            guard.complete = true;
+            (id, Ok(()))
+        });
+        self.index.insert(job.id(), id);
+    }
+    fn finished(&mut self, result: &Joined) {
+        let task = match &result {
+            Ok((id, _)) => *id,
+            Err(error) => error.id(),
+        };
+        let indexed = self.index.remove(&task);
+        let returned = match &result {
+            Ok((_, (id, _))) => Some(*id),
+            Err(_) => None,
+        };
+        let Some(id) = indexed.or(returned) else {
+            self.context.fail();
+            return;
+        };
+        let Some(entry) = self.entries.get(&id).cloned() else {
+            self.context.fail();
+            return;
+        };
+        if matches!(result,Ok((_,(returned,Ok(())))) if *returned==id)
+            && *entry.progress.clean.borrow()
+        {
+            self.entries.remove(&id);
+        } else {
+            self.context.fail();
+            self.spawn(entry, None);
+        }
+    }
+    fn schedule_missing(&mut self) {
+        let missing = self
+            .entries
+            .iter()
+            .filter(|(id, entry)| {
+                !entry.progress.running.load(Ordering::Acquire)
+                    && !self.index.values().any(|mapped| mapped == *id)
+            })
+            .map(|(_, entry)| entry.clone())
+            .collect::<Vec<_>>();
+        for entry in missing {
+            self.spawn(entry, None);
+        }
+    }
+    async fn drain(&mut self) {
+        loop {
+            if self.jobs.is_empty() {
+                self.index.clear();
+            }
+            self.schedule_missing();
+            if self.jobs.is_empty() {
+                self.index.clear();
+                if self.entries.is_empty() {
+                    self.context.producer.settle();
+                    self.context.health.physical.store(true, Ordering::Release);
+                    return;
+                }
+                for entry in self.entries.values().cloned().collect::<Vec<_>>() {
+                    self.spawn(entry, None);
+                }
+            }
+            if let Some(result) = self.jobs.join_next_with_id().await {
+                self.finished(&result);
+            }
+        }
+    }
+}
+#[derive(Debug)]
+struct Actor {
+    ledger: Ledger,
+    inbox: mpsc::Receiver<Envelope>,
+    emergency: Arc<CleanupTask>,
+    settled: bool,
+}
+impl Actor {
+    async fn run(mut self) -> Result<(), DockerError> {
+        let mut stop = self.ledger.context.stop.subscribe();
+        let mut wire_stop = self.ledger.context.docker.raw.stop.subscribe();
+        loop {
+            if *stop.borrow() {
+                self.inbox.close();
+                while let Ok(request) = self.inbox.try_recv() {
+                    let _ = request.reply.send(Err(DockerError::Stopped));
+                }
+                self.ledger.drain().await;
+                self.settled = true;
+                return if self.ledger.context.health.failed.load(Ordering::Acquire) {
+                    Err(DockerError::Worker)
+                } else {
+                    Ok(())
+                };
+            }
+            tokio::select! {biased;
+                ()=stopped(&mut wire_stop)=>self.ledger.context.fail(),
+                ()=stopped(&mut stop)=>{},
+                result=self.ledger.jobs.join_next_with_id(),if !self.ledger.jobs.is_empty()=>if let Some(result)=result {self.ledger.finished(&result);},
+                request=self.inbox.recv()=>match request {Some(request)=>self.start(request),None=>{self.ledger.context.stop.send_replace(true);}},
+            }
+        }
+    }
+    fn start(&mut self, mut request: Envelope) {
+        let id = request.identity.environment;
+        if self.ledger.context.health.check().is_err()
+            || *self.ledger.context.stop.borrow()
+            || request.reply.is_closed()
+            || request.cancel.has_changed().is_err()
+            || Instant::now() >= request.deadline
+            || self.ledger.entries.contains_key(&id)
+        {
+            let _ = request.reply.send(Err(DockerError::Stopped));
+            return;
+        }
+        let record = match record(&request, &self.ledger.context.directory) {
+            Ok(record) => record,
+            Err(error) => {
+                let _ = request.reply.send(Err(error));
+                return;
+            }
+        };
+        let Some(retirement) = request.retirement.0.take() else {
+            self.ledger.context.fail();
+            let _ = request.reply.send(Err(DockerError::Worker));
+            return;
+        };
+        let (archive, _) = watch::channel(Some(request.archive));
+        let (outcome, _) = watch::channel(None);
+        let (release, released) = watch::channel(());
+        let entry = Arc::new(
+            Entry::builder()
+                .plan(
+                    Plan::builder()
+                        .identity(Arc::new(request.identity))
+                        .base(request.base)
+                        .archive(archive)
+                        .record(record)
+                        .deadline(request.deadline)
+                        .cancel(request.cancel)
+                        .build(),
+                )
+                .progress(Progress::new(retirement))
+                .stage(CleanupTask::default())
+                .outcome(outcome)
+                .handoff(request.handoff)
+                .released(released)
+                ._volume(request.volume)
+                .build(),
+        );
+        self.ledger.entries.insert(id, entry.clone());
+        self.ledger.spawn(entry, Some((release, request.reply)));
+        #[cfg(test)]
+        self.ledger.context.fault(5);
+    }
+}
+impl Drop for Actor {
+    fn drop(&mut self) {
+        if self.settled {
+            return;
+        }
+        self.ledger.context.fail();
+        if self.ledger.entries.is_empty() && self.ledger.jobs.is_empty() {
+            self.ledger.context.producer.settle();
+            self.ledger
+                .context
+                .health
+                .physical
+                .store(true, Ordering::Release);
+            return;
+        }
+        // Move every original worker; never abort IO in order to replace its observer.
+        let context = self.ledger.context.clone();
+        let mut ledger = mem::replace(&mut self.ledger, Ledger::new(context));
+        self.emergency
+            .start_on(&ledger.context.runtime.clone(), move || async move {
+                ledger.drain().await;
+                Ok(())
+            });
+    }
+}
+#[derive(Debug)]
+struct WorkerGuard {
+    entry: Arc<Entry>,
+    context: Arc<Context>,
+    complete: bool,
+}
+impl WorkerGuard {
+    fn new(entry: Arc<Entry>, context: Arc<Context>) -> Self {
+        entry.progress.running.store(true, Ordering::Release);
+        Self {
+            entry,
+            context,
+            complete: false,
+        }
+    }
+}
+impl Drop for WorkerGuard {
+    fn drop(&mut self) {
+        self.entry.progress.running.store(false, Ordering::Release);
+        if !self.complete {
+            self.context.fail();
+        }
+    }
+}
+
+fn record(request: &Envelope, directory: &DirectoryLease) -> Result<CodeRecord, DockerError> {
+    let digest = |text: &str| -> Result<[u8; 32], DockerError> {
+        let mut result = [0; 32];
+        hex::decode_to_slice(
+            text.strip_prefix("sha256:")
+                .ok_or(DockerError::Configuration)?,
+            &mut result,
+        )
+        .map_err(|_| DockerError::Configuration)?;
+        Ok(result)
+    };
+    let zip = STANDARD
+        .decode(request.archive.code_sha256())
+        .map_err(|_| DockerError::InvalidCode)?
+        .try_into()
+        .map_err(|_| DockerError::InvalidCode)?;
+    Ok(CodeRecord::builder()
+        .run(directory.run_id())
+        .environment(request.identity.environment)
+        .resource(request.identity.resource)
+        .revision(request.identity.revision)
+        .zip(zip)
+        .base(digest(
+            request.base.resolved().metadata().image_id.as_str(),
+        )?)
+        .fingerprint(digest(
+            request.base.resolved().metadata().inspection_hash.as_str(),
+        )?)
+        .volume(VolumeState::Planned)
+        .loader(LoaderState::Planned)
+        .build())
+}
+async fn run(
+    entry: Arc<Entry>,
+    context: Arc<Context>,
+    release: watch::Sender<()>,
+    reply: oneshot::Sender<Result<PinnedCode, DockerError>>,
+) {
+    #[cfg(test)]
+    context.fault(1);
+    stage::start(&entry, context.clone());
+    let joined = entry.stage.wait().await;
+    let staged = if joined.is_err() {
+        context.fail();
+        Err(DockerError::Worker)
+    } else {
+        entry
+            .outcome
+            .borrow()
+            .clone()
+            .unwrap_or(Err(DockerError::Worker))
+    };
+    #[cfg(test)]
+    context.fault(2);
+    let staged = staged.and_then(|()| entry.check(&context));
+    match staged {
+        Ok(()) => {
+            entry.progress.active.store(true, Ordering::Release);
+            let ready = CodeLease::builder()
+                .identity(entry.plan.identity.clone())
+                .volume(match entry.plan.record.volume_key() {
+                    Ok(key) => key,
+                    Err(error) => {
+                        let _ = reply.send(Err(error));
+                        entry.retire(&context).await;
+                        return;
+                    }
+                })
+                .image(entry.plan.base.resolved().metadata().image_id.clone())
+                .source(entry.plan.base.liveness())
+                .release(release)
+                .active(entry.progress.active.clone())
+                .stop(context.stop.subscribe())
+                .handoff(entry.handoff.clone())
+                .deadline(entry.plan.deadline)
+                .retired(entry.progress.clean.subscribe())
+                .build();
+            if reply.send(Ok(PinnedCode::from_lease(ready))).is_ok()
+                && consumed(&entry, &context).await
+            {
+                let mut released = entry.released.clone();
+                let mut stop = context.stop.subscribe();
+                let source = entry.plan.base.liveness();
+                tokio::select! {biased;()=stopped(&mut stop)=>{},()=source.revoked()=>{},_ = released.changed()=>{}}
+            }
+        }
+        Err(error) => {
+            let _ = reply.send(Err(error));
+        }
+    }
+    entry.retire(&context).await;
+}
+#[cfg(test)]
+#[derive(Debug)]
+struct ReadyProbe(Arc<Health>);
+#[cfg(test)]
+impl Drop for ReadyProbe {
+    fn drop(&mut self) {
+        self.0.ready.fetch_sub(1, Ordering::AcqRel);
+    }
+}
+
+async fn consumed(entry: &Entry, context: &Context) -> bool {
+    #[cfg(test)]
+    let _probe = {
+        context.health.ready.fetch_add(1, Ordering::AcqRel);
+        ReadyProbe(context.health.clone())
+    };
+    let mut changed = entry.handoff.subscribe();
+    let mut released = entry.released.clone();
+    let mut cancelled = entry.plan.cancel.clone();
+    let mut stop = context.stop.subscribe();
+    let source = entry.plan.base.liveness();
+    let mut abandoned = false;
+    loop {
+        let mut decision = None;
+        entry
+            .handoff
+            .send_if_modified(|handoff| match handoff.state {
+                Consumption::Consumed(at) if at < entry.plan.deadline => {
+                    decision = Some(true);
+                    false
+                }
+                Consumption::Expired => {
+                    decision = Some(false);
+                    false
+                }
+                _ if abandoned
+                    || Instant::now() >= entry.plan.deadline
+                    || *stop.borrow()
+                    || !source.is_live()
+                    || cancelled.has_changed().is_err() =>
+                {
+                    handoff.state = Consumption::Expired;
+                    decision = Some(false);
+                    true
+                }
+                _ => false,
+            });
+        if let Some(decision) = decision {
+            return decision;
+        }
+        tokio::select! {biased;
+            ()=stopped(&mut stop)=>{},()=source.revoked()=>{},_ = cancelled.changed()=>{},
+            _ = released.changed()=>{abandoned=true;},_ = changed.changed()=>{},()=sleep_until(entry.plan.deadline)=>{},
+        }
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/code_volume/stage.rs b/crates/rustack-lambda-core/src/docker/code_volume/stage.rs
new file mode 100644
index 00000000..b13e0747
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code_volume/stage.rs
@@ -0,0 +1,203 @@
+//! One independently retained stage; no observer can abort accepted Docker IO.
+
+use std::{collections::HashMap, sync::Arc};
+
+use tokio::time::Instant;
+
+use super::entry::{Context, Entry};
+use crate::docker::{
+    DockerError,
+    models::{ContainerCreateBody, HostConfig, Mount, MountType, MountVolumeOptions},
+    mutation::MutationGuard,
+    ownership::codes::{CodeRecord, LoaderState, VolumeState},
+    recovery::code::retire_loader,
+};
+
+pub(super) fn start(entry: &Arc<Entry>, context: Arc<Context>) {
+    let retained = entry.clone();
+    let runtime = context.runtime.clone();
+    entry.stage.start_on(&runtime, move || async move {
+        let result = prepare(&retained, &context).await;
+        retained.outcome.send_replace(Some(result));
+        Ok(())
+    });
+}
+fn io(entry: &Entry, context: &Context) -> Instant {
+    entry.plan.deadline.min(context.config.deadline())
+}
+
+#[tracing::instrument(skip_all)]
+async fn prepare(entry: &Entry, context: &Context) -> Result<(), DockerError> {
+    entry.check(context)?;
+    super::validate_base(&entry.plan.base, &context.docker, io(entry, context)).await?;
+    entry.check(context)?;
+    let mut record = prepare_volume(entry, context).await?;
+    let mutation = MutationGuard::new();
+    entry
+        .progress
+        .receipts
+        .send_modify(|receipts| receipts.loader = Some(mutation.receipt()));
+    let mut next = record.clone();
+    next.loader = LoaderState::Uncertain;
+    save(entry, context, &mut record, next).await?;
+    entry.check(context)?;
+    #[cfg(test)]
+    context.fault(9);
+    let body = loader_body(entry, &record, context)?;
+    let created = context
+        .docker
+        .create_container_inner(
+            &record.loader_key()?,
+            &body,
+            Some(entry.plan.base.resolved().metadata().architecture),
+            io(entry, context),
+            Some(mutation),
+        )
+        .await?;
+    let inspected = context
+        .docker
+        .inspect_container(&created.id.parse()?, io(entry, context))
+        .await?;
+    let id = record.owned_loader(context.directory.owner_id(), &inspected)?;
+    let mut next = record.clone();
+    next.loader = LoaderState::Known(id);
+    save(entry, context, &mut record, next).await?;
+    entry.check(context)?;
+    #[cfg(test)]
+    context.fault(4);
+    let archive = entry
+        .plan
+        .archive
+        .borrow()
+        .clone()
+        .ok_or(DockerError::Worker)?;
+    let uploaded = context
+        .docker
+        .upload_code(
+            &record.loader_key()?,
+            &archive,
+            entry
+                .plan
+                .deadline
+                .min(Instant::now() + context.config.upload),
+        )
+        .await;
+    drop(archive);
+    // The stage awaits the original call through its wire/driver join.
+    entry.plan.archive.send_replace(None);
+    uploaded?;
+    entry.check(context)?;
+    if !Box::pin(retire_loader(
+        &context.directory,
+        &context.docker,
+        &mut record,
+        io(entry, context),
+    ))
+    .await?
+    {
+        return Err(DockerError::Quarantined);
+    }
+    entry.check(context)?;
+    tracing::debug!(environment_id=%record.environment,"code volume prepared; loader retired");
+    Ok(())
+}
+async fn prepare_volume(entry: &Entry, context: &Context) -> Result<CodeRecord, DockerError> {
+    let mut record = entry.plan.record.clone();
+    context
+        .directory
+        .prepare_code(record.clone(), io(entry, context))
+        .await?;
+    entry.check(context)?;
+    let mutation = MutationGuard::new();
+    entry
+        .progress
+        .receipts
+        .send_modify(|receipts| receipts.volume = Some(mutation.receipt()));
+    let mut next = record.clone();
+    next.volume = VolumeState::Uncertain;
+    save(entry, context, &mut record, next).await?;
+    entry.check(context)?;
+    #[cfg(test)]
+    context.fault(8);
+    let volume = context
+        .docker
+        .create_volume_tracked(
+            &record.volume_key()?,
+            &record.labels(context.directory.owner_id(), false),
+            io(entry, context),
+            Some(mutation),
+        )
+        .await?;
+    record.owned_volume(context.directory.owner_id(), &volume)?;
+    let mut next = record.clone();
+    next.volume = VolumeState::Known;
+    save(entry, context, &mut record, next).await?;
+    entry.check(context)?;
+    #[cfg(test)]
+    context.fault(3);
+    Ok(record)
+}
+async fn save(
+    entry: &Entry,
+    context: &Context,
+    record: &mut CodeRecord,
+    next: CodeRecord,
+) -> Result<(), DockerError> {
+    context
+        .directory
+        .advance_code(record.clone(), next.clone(), io(entry, context))
+        .await?;
+    *record = next;
+    Ok(())
+}
+
+fn loader_body(
+    entry: &Entry,
+    record: &CodeRecord,
+    context: &Context,
+) -> Result<ContainerCreateBody, DockerError> {
+    Ok(ContainerCreateBody {
+        image: Some(
+            entry
+                .plan
+                .base
+                .resolved()
+                .metadata()
+                .image_id
+                .as_str()
+                .into(),
+        ),
+        user: Some("65534:65534".into()),
+        entrypoint: Some(vec!["/never-start-this-loader".into()]),
+        cmd: Some(Vec::new()),
+        working_dir: Some("/var/task".into()),
+        labels: Some(
+            record
+                .labels(context.directory.owner_id(), true)
+                .into_iter()
+                .collect::<HashMap<_, _>>(),
+        ),
+        host_config: Some(HostConfig {
+            network_mode: Some("none".into()),
+            readonly_rootfs: Some(true),
+            memory: Some(128 * 1024 * 1024),
+            nano_cpus: Some(1_000_000_000),
+            pids_limit: Some(64),
+            cap_drop: Some(vec!["ALL".into()]),
+            security_opt: Some(vec!["no-new-privileges:true".into()]),
+            mounts: Some(vec![Mount {
+                typ: Some(MountType::VOLUME),
+                source: Some(record.volume_key()?.as_str().into()),
+                target: Some("/var/task".into()),
+                read_only: Some(false),
+                volume_options: Some(MountVolumeOptions {
+                    no_copy: Some(true),
+                    ..MountVolumeOptions::default()
+                }),
+                ..Mount::default()
+            }]),
+            ..HostConfig::default()
+        }),
+        ..ContainerCreateBody::default()
+    })
+}
diff --git a/crates/rustack-lambda-core/src/docker/code_volume/tests.rs b/crates/rustack-lambda-core/src/docker/code_volume/tests.rs
new file mode 100644
index 00000000..334d5f4c
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code_volume/tests.rs
@@ -0,0 +1,1168 @@
+use std::{
+    sync::{Arc, atomic::AtomicBool},
+    time::Duration,
+};
+
+use rstest::rstest;
+use serde_json::{Value, from_slice, json, to_vec};
+use tempfile::TempDir;
+use tokio::{
+    sync::watch,
+    time::{Instant, timeout},
+};
+use uuid::Uuid;
+
+use super::*;
+use crate::{
+    artifact::{Architecture, ImageLeaseContext, PinnedImage, ResolvedImage},
+    docker::{
+        DirectoryLease, DockerError, DockerWire,
+        code::tests::{elf, prepare, source, zip},
+        tests::{Daemon, IncomingRequest},
+    },
+};
+
+pub(in crate::docker) fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn config() -> CodeVolumeConfig {
+    CodeVolumeConfig::new(2, 2, Duration::from_secs(1), Duration::from_secs(2)).unwrap()
+}
+pub(in crate::docker) async fn fixture() -> (
+    TempDir,
+    DirectoryLease,
+    Daemon,
+    DockerWire,
+    crate::docker::DockerPort,
+) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    (root, directory, daemon, wire, port)
+}
+pub(in crate::docker) fn base(
+    directory: &DirectoryLease,
+) -> (PinnedImage, watch::Sender<bool>, watch::Receiver<()>) {
+    let (release, released) = watch::channel(());
+    let (stop, stopping) = watch::channel(false);
+    let base = PinnedImage::with_context(
+        ResolvedImage::fixture(Architecture::Arm64),
+        1024.try_into().unwrap(),
+        release,
+        Arc::new(AtomicBool::new(true)),
+        stopping,
+        ImageLeaseContext::Owned {
+            directory: directory.clone(),
+            preparation: None,
+        },
+    );
+    (base, stop, released)
+}
+pub(in crate::docker) async fn code() -> (TempDir, crate::docker::DockerCodeArchive) {
+    let (root, artifact) = source(zip(&[("bootstrap", &elf(Architecture::Arm64), 0o755)])).await;
+    (root, prepare(artifact).await)
+}
+pub(in crate::docker) fn target(request: &IncomingRequest) -> String {
+    request
+        .head
+        .lines()
+        .next()
+        .unwrap()
+        .split_whitespace()
+        .nth(1)
+        .unwrap()
+        .into()
+}
+pub(in crate::docker) async fn reply(request: IncomingRequest, value: &Value) {
+    request.reply(200, &to_vec(value).unwrap()).await;
+}
+fn image() -> Value {
+    json!({"Id":format!("sha256:{}","a".repeat(64)),"Os":"linux","Architecture":"arm64","Size":1024,"Config":{"Labels":{"com.amazonaws.lambda.platform.kernel":"k510ga"}}})
+}
+pub(in crate::docker) async fn begin_volume(
+    daemon: &mut Daemon,
+    directory: &DirectoryLease,
+) -> (IncomingRequest, Value) {
+    let request = daemon.next().await;
+    assert!(target(&request).contains("/images/sha256%3A"));
+    reply(request, &image()).await;
+    let request = daemon.next().await;
+    assert!(target(&request).ends_with("/volumes/create"));
+    let body: Value = from_slice(&request.body).unwrap();
+    let saved = directory
+        .code_records(deadline())
+        .await
+        .unwrap()
+        .into_iter()
+        .find(|row| row.volume_key().unwrap().as_str() == body["Name"].as_str().unwrap())
+        .unwrap();
+    assert_eq!(
+        saved.volume,
+        crate::docker::ownership::codes::VolumeState::Uncertain
+    );
+    let volume = json!({"Name":body["Name"],"Labels":body["Labels"],"Driver":"local","Scope":"local","Options":{},"Mountpoint":"/not-a-host-path"});
+    (request, volume)
+}
+async fn begin_loader(
+    daemon: &mut Daemon,
+    directory: &DirectoryLease,
+    volume: &Value,
+) -> (IncomingRequest, Value) {
+    let request = daemon.next().await;
+    assert!(target(&request).contains("/containers/create?"));
+    let mut body: Value = from_slice(&request.body).unwrap();
+    assert_eq!(body["HostConfig"]["NetworkMode"], "none");
+    assert_eq!(body["HostConfig"]["ReadonlyRootfs"], true);
+    assert_eq!(
+        body["HostConfig"]["Mounts"][0]["VolumeOptions"]["NoCopy"],
+        true
+    );
+    let name = form_urlencoded::parse(target(&request).split_once('?').unwrap().1.as_bytes())
+        .find(|(k, _)| k == "name")
+        .unwrap()
+        .1
+        .into_owned();
+    let saved = directory
+        .code_records(deadline())
+        .await
+        .unwrap()
+        .into_iter()
+        .find(|row| row.volume_key().unwrap().as_str() == volume["Name"].as_str().unwrap())
+        .unwrap();
+    assert_eq!(
+        saved.loader,
+        crate::docker::ownership::codes::LoaderState::Uncertain
+    );
+    body["Labels"]["com.amazonaws.lambda.platform.kernel"] = json!("k510ga");
+    let inspected = json!({"Id":"c".repeat(64),"Name":format!("/{name}"),"Image":body["Image"],"Config":{"Image":body["Image"],"Labels":body["Labels"]},"State":{"Status":"created","Running":false,"StartedAt":"0001-01-01T00:00:00Z"},"Mounts":[{"Type":"volume","Name":volume["Name"],"Driver":"local","Destination":"/var/task","RW":true}]});
+    (request, inspected)
+}
+pub(in crate::docker) async fn allocated(
+    daemon: &mut Daemon,
+    directory: &DirectoryLease,
+) -> (Value, Value) {
+    let (request, volume) = begin_volume(daemon, directory).await;
+    request.reply(201, &to_vec(&volume).unwrap()).await;
+    let (request, inspected) = begin_loader(daemon, directory, &volume).await;
+    request
+        .reply(
+            201,
+            &to_vec(&json!({"Id":"c".repeat(64),"Warnings":[]})).unwrap(),
+        )
+        .await;
+    reply(daemon.next().await, &inspected).await;
+    (volume, inspected)
+}
+pub(in crate::docker) async fn finish_loader(daemon: &mut Daemon, inspected: &Value) {
+    reply(daemon.next().await, inspected).await;
+    reply(daemon.next().await, inspected).await;
+    let request = daemon.next().await;
+    assert!(request.head.starts_with("DELETE "));
+    assert!(target(&request).ends_with("?force=false"));
+    request.reply(204, b"").await;
+    daemon.next().await.reply(404, b"{}").await;
+}
+pub(in crate::docker) async fn stage(daemon: &mut Daemon, directory: &DirectoryLease) -> Value {
+    let (volume, inspected) = allocated(daemon, directory).await;
+    let request = daemon.next().await;
+    assert!(request.head.starts_with("PUT "));
+    assert!(
+        request
+            .head
+            .to_ascii_lowercase()
+            .contains("content-type: application/x-tar")
+    );
+    assert!(target(&request).contains("copyUIDGID=false"));
+    request.reply(200, b"").await;
+    finish_loader(daemon, &inspected).await;
+    volume
+}
+pub(in crate::docker) async fn retire(daemon: &mut Daemon, volume: &Value) {
+    let request = daemon.next().await;
+    assert!(target(&request).contains("/volumes/"));
+    reply(request, volume).await;
+    let request = daemon.next().await;
+    assert!(request.head.starts_with("DELETE "));
+    assert!(target(&request).ends_with("?force=false"));
+    request.reply(204, b"").await;
+    daemon.next().await.reply(404, b"{}").await;
+}
+pub(in crate::docker) async fn empty(port: &CodeVolumePort) {
+    timeout(Duration::from_secs(5), async {
+        while port.status().volumes != 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+
+#[rstest]
+#[case(0, 1, 1, 1)]
+#[case(33, 1, 1, 1)]
+#[case(1, 2, 1, 1)]
+#[case(2, 0, 1, 1)]
+#[case(3, 3, 1, 1)]
+#[case(2, 2, 0, 1)]
+#[case(2, 2, 61, 1)]
+#[case(2, 2, 1, 0)]
+#[case(2, 2, 1, 601)]
+fn test_should_reject_invalid_admission_and_io_settings(
+    #[case] volumes: u8,
+    #[case] jobs: u8,
+    #[case] io: u64,
+    #[case] upload: u64,
+) {
+    assert!(
+        CodeVolumeConfig::new(
+            volumes,
+            jobs,
+            Duration::from_secs(io),
+            Duration::from_secs(upload)
+        )
+        .is_err()
+    );
+}
+#[test]
+fn test_should_require_nonnil_resource_revision_and_generate_fresh_environments() {
+    assert!(CodeVolumeIdentity::new(Uuid::nil(), Uuid::new_v4()).is_err());
+    assert!(CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::nil()).is_err());
+    let a = CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap();
+    let b = CodeVolumeIdentity::new(a.resource, a.revision).unwrap();
+    assert_ne!(a.environment_id(), b.environment_id());
+}
+#[tokio::test]
+async fn test_should_exclude_replacement_producers_until_original_owner_joins() {
+    let (_root, directory, daemon, mut wire, port) = fixture().await;
+    let mut owner = CodeVolumeManager::start(port.clone(), directory.clone(), config()).unwrap();
+    assert!(CodeVolumeManager::start(port.clone(), directory.clone(), config()).is_err());
+    let stale = owner.port();
+    owner.shutdown(deadline()).await.unwrap();
+    assert!(!stale.status().accepting);
+    let mut next = CodeVolumeManager::start(port, directory, config()).unwrap();
+    next.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_prepare_clone_and_retire_code_only_after_last_ready_release() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, mut released) = base(&directory);
+    let id = CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap();
+    let env = id.environment_id();
+    let (ready, volume) = tokio::join!(
+        port.prepare(id, archive, base, deadline()),
+        stage(&mut daemon, &directory)
+    );
+    let ready = ready.unwrap();
+    assert_eq!(ready.identity().environment_id(), env);
+    assert_eq!(ready.mount().unwrap().read_only, Some(true));
+    assert!(ready.is_live());
+    assert_eq!(port.status().volumes, 1);
+    assert_eq!(port.status().preparing, 0);
+    assert_eq!(port.status().quarantined, 0);
+    let clone = ready.clone();
+    drop(ready);
+    assert!(!released.has_changed().unwrap());
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    drop(clone);
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    let _ = released.changed().await;
+    assert!(released.has_changed().is_err());
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    owner.shutdown(deadline()).await.unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+async fn queued(port: &CodeVolumePort) {
+    timeout(Duration::from_secs(3), async {
+        while port.ready_handoffs() != 1 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+fn poll_once<F: std::future::Future>(future: std::pin::Pin<&mut F>) -> std::task::Poll<F::Output> {
+    let waker = std::task::Waker::noop();
+    let mut context = std::task::Context::from_waker(waker);
+    future.poll(&mut context)
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_expire_or_abandon_ready_without_repolling_its_live_observer(
+    #[case] abandon: bool,
+) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, mut released) = base(&directory);
+    let at = Instant::now() + Duration::from_secs(30);
+    let mut waiting = Box::pin(port.prepare(
+        CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+        archive,
+        base,
+        at,
+    ));
+    assert!(poll_once(waiting.as_mut()).is_pending());
+    let volume = stage(&mut daemon, &directory).await;
+    queued(&port).await;
+    assert_eq!(port.status().preparing, 1);
+    assert!(!released.has_changed().unwrap());
+    if abandon {
+        drop(waiting);
+    } else {
+        // Advance only after physical staging and Ready publication are observed.
+        tokio::time::pause();
+        tokio::time::advance(Duration::from_secs(31)).await;
+        tokio::time::resume();
+        // This future stays alive, with a queued Ready value, throughout physical cleanup.
+        let ((), ()) = tokio::join!(retire(&mut daemon, &volume), empty(&port));
+        assert_eq!(port.status().preparing, 0);
+        let _ = released.changed().await;
+        assert!(released.has_changed().is_err());
+        assert!(matches!(waiting.await, Err(DockerError::Deadline)));
+        owner.shutdown(deadline()).await.unwrap();
+        wire.shutdown().await.unwrap();
+        daemon.close().await;
+        return;
+    }
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    let _ = released.changed().await;
+    assert!(released.has_changed().is_err());
+    assert_eq!(port.status().preparing, 0);
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_honor_consumption_before_deadline_even_when_owner_processes_it_later() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, _released) = base(&directory);
+    let mut waiting = Box::pin(port.prepare(
+        CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+        archive,
+        base,
+        deadline(),
+    ));
+    assert!(poll_once(waiting.as_mut()).is_pending());
+    let volume = stage(&mut daemon, &directory).await;
+    queued(&port).await;
+    let std::task::Poll::Ready(Ok(ready)) = poll_once(waiting.as_mut()) else {
+        panic!("queued on-time handoff not consumed");
+    };
+    tokio::time::pause();
+    tokio::time::advance(Duration::from_secs(11)).await;
+    tokio::time::resume();
+    timeout(Duration::from_secs(3), async {
+        while port.ready_handoffs() != 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(ready.is_live());
+    assert_eq!(port.status().volumes, 1);
+    assert_eq!(port.status().preparing, 0);
+    drop(ready);
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_equal_uuid_foreign_acquisition_and_bad_deadlines_before_io() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let foreign = DirectoryLease::testing(directory.owner_id(), directory.run_id());
+    let (foreign_base, _foreign_stop, _) = base(&foreign);
+    assert!(matches!(
+        port.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive.clone(),
+            foreign_base,
+            deadline()
+        )
+        .await,
+        Err(DockerError::Configuration)
+    ));
+    let (base, _stop, _) = base(&directory);
+    for at in [Instant::now(), Instant::now() + Duration::from_secs(3601)] {
+        assert!(matches!(
+            port.prepare(
+                CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+                archive.clone(),
+                base.clone(),
+                at
+            )
+            .await,
+            Err(DockerError::Configuration | DockerError::Deadline)
+        ));
+    }
+    assert_eq!(port.status().volumes, 0);
+    assert_eq!(port.status().preparing, 0);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_revoke_ready_and_retire_when_the_source_owner_revokes_its_pin() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, stop, mut released) = base(&directory);
+    let (ready, volume) = tokio::join!(
+        port.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline()
+        ),
+        stage(&mut daemon, &directory)
+    );
+    let ready = ready.unwrap();
+    stop.send_replace(true);
+    assert!(!ready.is_live());
+    assert!(ready.mount().is_err());
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    let _ = released.changed().await;
+    assert!(released.has_changed().is_err());
+    drop(ready);
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_join_original_accepted_upload_before_cleanup_after_expired_shutdown_or_root_loss(
+    #[case] root_loss: bool,
+) {
+    let (_root, directory, mut daemon, mut wire, mut docker) = fixture().await;
+    let (entered, mut observed) = watch::channel(false);
+    let (release, released) = watch::channel(false);
+    docker.raw.upload_completion = Some(crate::docker::CompletionGate {
+        entered,
+        release: released,
+    });
+    let mut owner = CodeVolumeManager::start(
+        docker.clone(),
+        directory.clone(),
+        CodeVolumeConfig::new(2, 2, Duration::from_secs(1), Duration::from_secs(1)).unwrap(),
+    )
+    .unwrap();
+    let port = owner.port();
+    let reservation = Arc::new(tokio::sync::Semaphore::new(2));
+    let (_source, artifact) = source(zip(&[("bootstrap", &elf(Architecture::Arm64), 0o755)])).await;
+    let archive = crate::docker::code::tests::prepare_with(artifact, reservation.clone()).await;
+    let (base, _stop, mut source_released) = base(&directory);
+    let call = port.clone();
+    let waiting = tokio::spawn(async move {
+        call.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .await
+    });
+    let (volume, inspected) = allocated(&mut daemon, &directory).await;
+    let upload = daemon.next().await;
+    assert!(upload.head.starts_with("PUT "));
+    timeout(Duration::from_secs(3), observed.wait_for(|v| *v))
+        .await
+        .unwrap()
+        .unwrap();
+    // The original envelope is retained after its IO deadline and driver join,
+    // before response delivery; a timed observer must not replace that ownership.
+    assert_eq!(reservation.available_permits(), 1);
+    assert_eq!(port.status().volumes, 1);
+    assert_eq!(port.status().preparing, 1);
+    assert!(!source_released.has_changed().unwrap());
+    if root_loss {
+        owner.abort_root();
+    } else {
+        waiting.abort();
+    }
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_millis(30))
+            .await,
+        Err(DockerError::Deadline)
+    ));
+    assert!(CodeVolumeManager::start(docker, directory.clone(), config()).is_err());
+    assert!(
+        timeout(Duration::from_millis(30), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    assert_eq!(reservation.available_permits(), 1);
+    assert_eq!(port.status().preparing, 1);
+    release.send_replace(true);
+    drop(upload);
+    finish_loader(&mut daemon, &inspected).await;
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    assert_eq!(reservation.available_permits(), 2);
+    assert_eq!(port.status().preparing, 0);
+    let _ = source_released.changed().await;
+    assert!(source_released.has_changed().is_err());
+    if root_loss {
+        assert!(matches!(
+            waiting.await.unwrap(),
+            Err(DockerError::Deadline | DockerError::Stopped | DockerError::Worker)
+        ));
+        assert!(matches!(
+            owner.shutdown(deadline()).await,
+            Err(DockerError::Worker)
+        ));
+        assert!(matches!(
+            owner.shutdown(deadline()).await,
+            Err(DockerError::Worker)
+        ));
+    } else {
+        assert!(waiting.await.unwrap_err().is_cancelled());
+        owner.shutdown(deadline()).await.unwrap();
+    }
+    assert!(owner.physically_settled());
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_retain_issued_unknown_create_until_late_matching_observation(
+    #[case] loader: bool,
+) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker.clone(), directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, mut source_released) = base(&directory);
+    let call = port.clone();
+    let waiting = tokio::spawn(async move {
+        call.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .await
+    });
+    let (volume_request, volume) = begin_volume(&mut daemon, &directory).await;
+    let (held, inspected) = if loader {
+        volume_request.reply(201, &to_vec(&volume).unwrap()).await;
+        let (held, inspected) = begin_loader(&mut daemon, &directory, &volume).await;
+        (held, Some(inspected))
+    } else {
+        (volume_request, None)
+    };
+    assert!(matches!(waiting.await.unwrap(), Err(DockerError::Deadline)));
+    drop(held);
+    daemon.next().await.reply(404, b"{}").await;
+    timeout(Duration::from_secs(3), async {
+        while port.status().quarantined == 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(port.status().volumes, 1);
+    assert_eq!(port.status().preparing, 1);
+    assert!(!source_released.has_changed().unwrap());
+    assert!(CodeVolumeManager::start(docker, directory.clone(), config()).is_err());
+    if let Some(inspected) = inspected {
+        reply(daemon.next().await, &inspected).await;
+        // Unknown name is now persisted as a known full ID before the recheck/delete.
+        reply(daemon.next().await, &inspected).await;
+        let request = daemon.next().await;
+        assert!(request.head.starts_with("DELETE "));
+        assert!(target(&request).contains(&"c".repeat(64)));
+        request.reply(204, b"").await;
+        daemon.next().await.reply(404, b"{}").await;
+    } else {
+        reply(daemon.next().await, &volume).await;
+    }
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    assert_eq!(port.status().preparing, 0);
+    assert_eq!(port.status().quarantined, 0);
+    assert!(!port.status().worker_failed);
+    let _ = source_released.changed().await;
+    assert!(source_released.has_changed().is_err());
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_create_owned_after_cancel_then_retire_positive_ack_without_loader_creation()
+ {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, mut source_released) = base(&directory);
+    let call = port.clone();
+    let waiting = tokio::spawn(async move {
+        call.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .await
+    });
+    let (request, volume) = begin_volume(&mut daemon, &directory).await;
+    waiting.abort();
+    assert!(waiting.await.unwrap_err().is_cancelled());
+    assert_eq!(port.status().preparing, 1);
+    assert!(!source_released.has_changed().unwrap());
+    request.reply(201, &to_vec(&volume).unwrap()).await;
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    let _ = source_released.changed().await;
+    assert!(source_released.has_changed().is_err());
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(1)]
+#[case(5)]
+#[case(8)]
+#[tokio::test]
+async fn test_should_reap_worker_root_and_unissued_stage_panics_without_creating_resources(
+    #[case] point: u8,
+) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    port.set_fault(point);
+    let (_source, archive) = code().await;
+    let (base, _stop, mut source_released) = base(&directory);
+    let call = port.clone();
+    let waiting = tokio::spawn(async move {
+        call.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .await
+    });
+    if point == 8 {
+        reply(daemon.next().await, &image()).await;
+    }
+    assert!(matches!(
+        waiting.await.unwrap(),
+        Err(DockerError::Worker | DockerError::Stopped)
+    ));
+    empty(&port).await;
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    assert_eq!(port.status().preparing, 0);
+    assert!(port.status().worker_failed);
+    let _ = source_released.changed().await;
+    assert!(source_released.has_changed().is_err());
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(3)]
+#[case(9)]
+#[tokio::test]
+async fn test_should_reap_stage_panics_after_volume_commit_or_unissued_loader(#[case] point: u8) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    port.set_fault(point);
+    let (_source, archive) = code().await;
+    let (base, _stop, _released) = base(&directory);
+    let call = port.clone();
+    let waiting = tokio::spawn(async move {
+        call.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .await
+    });
+    let (request, volume) = begin_volume(&mut daemon, &directory).await;
+    request.reply(201, &to_vec(&volume).unwrap()).await;
+    assert!(matches!(waiting.await.unwrap(), Err(DockerError::Worker)));
+    retire(&mut daemon, &volume).await;
+    empty(&port).await;
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(6)]
+#[case(7)]
+#[tokio::test]
+async fn test_should_retain_retirement_witness_across_cleanup_panic_or_lost_erase_ack(
+    #[case] point: u8,
+) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, mut source_released) = base(&directory);
+    let (ready, volume) = tokio::join!(
+        port.prepare(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline()
+        ),
+        stage(&mut daemon, &directory)
+    );
+    let ready = ready.unwrap();
+    port.set_fault(point);
+    drop(ready);
+    retire(&mut daemon, &volume).await;
+    // The reaper must retain quota/source after physical absence until the
+    // original erased/retired journal state is positively reconciled.
+    timeout(Duration::from_secs(3), async {
+        while if point == 6 {
+            !port.status().worker_failed
+        } else {
+            port.status().quarantined == 0
+        } {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(port.status().volumes, 1);
+    assert!(!source_released.has_changed().unwrap());
+    empty(&port).await;
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    let _ = source_released.changed().await;
+    assert!(source_released.has_changed().is_err());
+    let result = owner.shutdown(deadline()).await;
+    if point == 6 {
+        assert!(matches!(result, Err(DockerError::Worker)));
+    } else {
+        result.unwrap();
+    }
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(true)]
+#[case(false)]
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_retirement_completion_observed_after_deadline_and_allow_reobserve(
+    #[case] positive: bool,
+) {
+    let (settled, received) = watch::channel(false);
+    let mut receipt = CodeRetirement::new(received);
+    let mut waiting = Box::pin(receipt.wait(Instant::now() + Duration::from_secs(1)));
+    assert!(poll_once(waiting.as_mut()).is_pending());
+    if positive {
+        settled.send_replace(true);
+    }
+    drop(settled);
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert!(matches!(
+        poll_once(waiting.as_mut()),
+        std::task::Poll::Ready(Err(DockerError::Deadline))
+    ));
+    drop(waiting);
+    let result = receipt.wait(deadline()).await;
+    if positive {
+        result.unwrap();
+    } else {
+        assert!(matches!(result, Err(DockerError::Worker)));
+    }
+}
+
+#[tokio::test]
+async fn test_should_publish_no_effect_retirement_when_stopping_queued_preparation() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, _released) = base(&directory);
+    let preparation = port
+        .start_preparation(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .unwrap();
+    let mut retired = preparation.retirement();
+    // No await between enqueue and stop: biased stop discards this unissued envelope.
+    owner.shutdown(deadline()).await.unwrap();
+    retired.wait(deadline()).await.unwrap();
+    assert!(preparation.wait().await.is_err());
+    assert_eq!(port.status().volumes, 0);
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.next())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_observe_same_physical_retirement_after_failed_prepare_and_expired_receipt() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, _released) = base(&directory);
+    let preparation = port
+        .start_preparation(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .unwrap();
+    let mut retired = preparation.retirement();
+    let (request, volume) = begin_volume(&mut daemon, &directory).await;
+    drop(preparation);
+    request.reply(201, &to_vec(&volume).unwrap()).await;
+    let inspect = daemon.next().await;
+    assert!(matches!(
+        retired
+            .wait(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(DockerError::Deadline)
+    ));
+    assert_eq!(port.status().volumes, 1);
+    reply(inspect, &volume).await;
+    let delete = daemon.next().await;
+    assert!(delete.head.starts_with("DELETE "));
+    delete.reply(204, b"").await;
+    daemon.next().await.reply(404, b"{}").await;
+    retired.wait(deadline()).await.unwrap();
+    empty(&port).await;
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(2)]
+#[case(4)]
+#[tokio::test]
+async fn test_should_reap_panics_with_known_loader_without_starting_it(#[case] point: u8) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    port.set_fault(point);
+    let (_source, archive) = code().await;
+    let (base, _stop, _released) = base(&directory);
+    let preparation = port
+        .start_preparation(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .unwrap();
+    let mut retired = preparation.retirement();
+    let waiting = tokio::spawn(preparation.wait());
+    let volume = if point == 2 {
+        stage(&mut daemon, &directory).await
+    } else {
+        let (volume, inspected) = allocated(&mut daemon, &directory).await;
+        finish_loader(&mut daemon, &inspected).await;
+        volume
+    };
+    assert!(matches!(waiting.await.unwrap(), Err(DockerError::Worker)));
+    retire(&mut daemon, &volume).await;
+    retired.wait(deadline()).await.unwrap();
+    empty(&port).await;
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(2)]
+#[case(3)]
+#[case(4)]
+#[case(5)]
+#[case(6)]
+#[case(7)]
+#[case(8)]
+#[tokio::test]
+async fn test_should_reject_unsafe_or_changed_base_before_durable_or_daemon_effects(
+    #[case] invalid: u8,
+) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, _released) = base(&directory);
+    let preparation = port
+        .start_preparation(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            base,
+            deadline(),
+        )
+        .unwrap();
+    let mut retired = preparation.retirement();
+    let waiting = tokio::spawn(preparation.wait());
+    let mut value = image();
+    match invalid {
+        0 => value["Id"] = json!(format!("sha256:{}", "b".repeat(64))),
+        1 => value["Os"] = json!("windows"),
+        2 => value["Architecture"] = json!("amd64"),
+        3 => value["Config"]["Volumes"] = json!({"/inherited":{}}),
+        4 => value["Config"]["Labels"] = json!({"rustack.lambda.ownerId":"foreign"}),
+        5 => value["Config"]["Labels"] = json!({"bad/key":"value"}),
+        6 => value["Config"]["Labels"] = json!({"key":"x".repeat(257)}),
+        7 => value["Config"]["Labels"] = json!({"key":"line\nbreak"}),
+        _ => {
+            value["Config"]["Labels"] =
+                Value::Object((0..57).map(|i| (format!("label{i}"), json!("v"))).collect());
+        }
+    }
+    reply(daemon.next().await, &value).await;
+    assert!(matches!(
+        waiting.await.unwrap(),
+        Err(DockerError::Quarantined)
+    ));
+    retired.wait(deadline()).await.unwrap();
+    empty(&port).await;
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.next())
+            .await
+            .is_err()
+    );
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_bound_queued_admission_and_reject_architecture_before_io() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+    let port = owner.port();
+    let (_source, archive) = code().await;
+    let (base, _stop, _released) = base(&directory);
+    let (_other, artifact) = source(zip(&[("bootstrap", &elf(Architecture::X86_64), 0o755)])).await;
+    let foreign =
+        crate::docker::DockerCodeArchive::prepare(artifact, Architecture::X86_64, deadline())
+            .await
+            .unwrap();
+    let identity = || CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap();
+    assert!(matches!(
+        port.start_preparation(identity(), foreign, base.clone(), deadline()),
+        Err(DockerError::Configuration)
+    ));
+    let first = port
+        .start_preparation(identity(), archive.clone(), base.clone(), deadline())
+        .unwrap();
+    let second = port
+        .start_preparation(identity(), archive.clone(), base.clone(), deadline())
+        .unwrap();
+    assert!(matches!(
+        port.start_preparation(identity(), archive, base, deadline()),
+        Err(DockerError::Busy)
+    ));
+    assert_eq!(port.status().volumes, 2);
+    assert_eq!(port.status().preparing, 2);
+    let mut one = first.retirement();
+    let mut two = second.retirement();
+    owner.shutdown(deadline()).await.unwrap();
+    one.wait(deadline()).await.unwrap();
+    two.wait(deadline()).await.unwrap();
+    assert_eq!(port.status().volumes, 0);
+    assert_eq!(port.status().preparing, 0);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.next())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[test]
+fn test_should_poison_same_acquisition_after_runtime_loss_with_an_issued_uncertain_create() {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    let (
+        root,
+        directory,
+        old_daemon,
+        mut old_wire,
+        mut owner,
+        preparation,
+        held,
+        source,
+        stop,
+        saved,
+    ) = runtime.block_on(async {
+        let (root, directory, mut daemon, wire, docker) = fixture().await;
+        let owner = CodeVolumeManager::start(docker, directory.clone(), config()).unwrap();
+        let (source, archive) = code().await;
+        let (base, stop, _released) = base(&directory);
+        let preparation = owner
+            .port()
+            .start_preparation(
+                CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+                archive,
+                base,
+                deadline(),
+            )
+            .unwrap();
+        let (held, _) = begin_volume(&mut daemon, &directory).await;
+        let saved = directory.code_records(deadline()).await.unwrap();
+        assert_eq!(saved.len(), 1);
+        assert_eq!(
+            saved.first().unwrap().volume,
+            crate::docker::ownership::codes::VolumeState::Uncertain
+        );
+        (
+            root,
+            directory,
+            daemon,
+            wire,
+            owner,
+            preparation,
+            held,
+            source,
+            stop,
+            saved,
+        )
+    });
+    let journal = runtime
+        .block_on(tokio::fs::read(
+            root.path().join(".rustack-lambda-docker").join("code.v1"),
+        ))
+        .unwrap();
+    drop(runtime);
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    runtime.block_on(async {
+        assert!(matches!(
+            directory.code_producer(),
+            Err(crate::docker::DirectoryLeaseError::InvalidState)
+        ));
+        let mut daemon = Daemon::new();
+        let mut wire = daemon.wire().await;
+        let docker = wire
+            .port()
+            .bind_directory(&directory, deadline())
+            .await
+            .unwrap();
+        assert!(CodeVolumeManager::start(docker, directory.clone(), config()).is_err());
+        assert_eq!(directory.code_records(deadline()).await.unwrap(), saved);
+        assert_eq!(
+            tokio::fs::read(root.path().join(".rustack-lambda-docker").join("code.v1"))
+                .await
+                .unwrap(),
+            journal
+        );
+        let mut receipt = preparation.retirement();
+        assert!(matches!(preparation.wait().await, Err(DockerError::Worker)));
+        assert!(matches!(
+            receipt.wait(deadline()).await,
+            Err(DockerError::Worker)
+        ));
+        assert!(matches!(
+            owner.shutdown(deadline()).await,
+            Err(DockerError::Worker)
+        ));
+        assert!(!owner.physically_settled());
+        assert!(old_wire.shutdown().await.is_err());
+        assert!(
+            timeout(Duration::from_millis(20), daemon.next())
+                .await
+                .is_err()
+        );
+        wire.shutdown().await.unwrap();
+        daemon.close().await;
+    });
+    drop((held, old_daemon, source, stop));
+}
diff --git a/crates/rustack-lambda-core/src/docker/code_volume/types.rs b/crates/rustack-lambda-core/src/docker/code_volume/types.rs
new file mode 100644
index 00000000..340029b6
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/code_volume/types.rs
@@ -0,0 +1,349 @@
+//! Validated code ownership inputs and revocable metadata-only Ready leases.
+
+use std::{
+    fmt,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use tokio::{
+    sync::{OwnedSemaphorePermit, oneshot, watch},
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use crate::{
+    artifact::{ImageLiveness, Sha256Digest},
+    docker::{
+        DockerError, DockerKey, check_deadline,
+        models::{Mount, MountType, MountVolumeOptions},
+    },
+};
+
+/// Immutable identities shared by the code volume and its eventual environment.
+#[derive(Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct CodeVolumeIdentity {
+    pub(super) environment: Uuid,
+    pub(super) resource: Uuid,
+    pub(super) revision: Uuid,
+}
+impl CodeVolumeIdentity {
+    /// Validate resource/revision UUIDs and allocate a fresh environment identity.
+    ///
+    /// # Errors
+    /// Returns Configuration for a nil identity.
+    ///
+    /// ```
+    /// let id = rustack_lambda_core::docker::CodeVolumeIdentity::new(uuid::Uuid::new_v4(),uuid::Uuid::new_v4())?;
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn new(resource: Uuid, revision: Uuid) -> Result<Self, DockerError> {
+        if [resource, revision].iter().any(Uuid::is_nil) {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self {
+            environment: Uuid::new_v4(),
+            resource,
+            revision,
+        })
+    }
+    /// Environment UUID used in volume/loader names.
+    ///
+    /// ```no_run
+    /// # fn inspect(id:rustack_lambda_core::docker::CodeVolumeIdentity) { assert!(!id.environment_id().is_nil()); }
+    /// ```
+    #[must_use]
+    pub fn environment_id(&self) -> Uuid {
+        self.environment
+    }
+}
+
+/// Independent bounded resource, preparation and wire budgets.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct CodeVolumeConfig {
+    pub(super) volumes: u8,
+    pub(super) jobs: u8,
+    pub(super) io: Duration,
+    pub(super) upload: Duration,
+}
+impl Default for CodeVolumeConfig {
+    fn default() -> Self {
+        Self {
+            volumes: 32,
+            jobs: 2,
+            io: Duration::from_secs(5),
+            upload: Duration::from_secs(60),
+        }
+    }
+}
+impl CodeVolumeConfig {
+    /// Validate volume1..32/job1..2 admission and IO1..60s/upload1..600s.
+    ///
+    /// # Errors
+    /// Returns Configuration for out-of-range or jobs-exceed-volumes settings.
+    ///
+    /// ```
+    /// let config=rustack_lambda_core::docker::CodeVolumeConfig::new(32,2,std::time::Duration::from_secs(5),std::time::Duration::from_secs(60))?;
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn new(volumes: u8, jobs: u8, io: Duration, upload: Duration) -> Result<Self, DockerError> {
+        if !(1..=32).contains(&volumes)
+            || !(1..=2).contains(&jobs)
+            || jobs > volumes
+            || !(Duration::from_secs(1)..=Duration::from_secs(60)).contains(&io)
+            || !(Duration::from_secs(1)..=Duration::from_secs(600)).contains(&upload)
+        {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self {
+            volumes,
+            jobs,
+            io,
+            upload,
+        })
+    }
+    pub(super) fn deadline(self) -> Instant {
+        Instant::now() + self.io
+    }
+}
+
+/// Retained ownership counts, independent of Docker observation/admission.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct CodeVolumeStatus {
+    /// Queued, preparing, live or quarantined volume reservations.
+    pub volumes: usize,
+    /// Preparation reservations retained until consumption or physical cleanup.
+    pub preparing: usize,
+    /// Reapers retaining unresolved physical/durable effects.
+    pub quarantined: usize,
+    /// Whether the owner permits new preparations (capacity may still be full).
+    pub accepting: bool,
+    /// A permanent supervision failure closed this owner.
+    pub worker_failed: bool,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(super) enum Consumption {
+    Pending,
+    Consumed(Instant),
+    Expired,
+}
+#[derive(Debug)]
+pub(super) struct Handoff {
+    pub(super) state: Consumption,
+    pub(super) slot: Option<OwnedSemaphorePermit>,
+}
+pub(super) type Acceptance = watch::Sender<Handoff>;
+
+/// Metadata-only physical/journal retirement observation; it owns no resources.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct CodeRetirement {
+    settled: watch::Receiver<bool>,
+}
+impl CodeRetirement {
+    pub(super) fn new(settled: watch::Receiver<bool>) -> Self {
+        Self { settled }
+    }
+    /// Observe the same cleanup without cancelling or restarting it.
+    ///
+    /// # Errors
+    /// Returns Deadline on observer expiry, or Worker if ownership vanished
+    /// without a positive retirement proof.
+    ///
+    /// ```no_run
+    /// # async fn observe(mut receipt:rustack_lambda_core::docker::CodeRetirement)->Result<(),rustack_lambda_core::docker::DockerError> {receipt.wait(tokio::time::Instant::now()+std::time::Duration::from_secs(30)).await?;Ok(())}
+    /// ```
+    pub async fn wait(&mut self, deadline: Instant) -> Result<(), DockerError> {
+        check_deadline(deadline)?;
+        let result = timeout_at(deadline, async {
+            loop {
+                if *self.settled.borrow() {
+                    return Ok(());
+                }
+                if self.settled.changed().await.is_err() {
+                    return if *self.settled.borrow() {
+                        Ok(())
+                    } else {
+                        Err(DockerError::Worker)
+                    };
+                }
+            }
+        })
+        .await
+        .map_err(|_| DockerError::Deadline)?;
+        check_deadline(deadline)?;
+        result
+    }
+}
+
+/// Accepted result/cancellation observation with a separate physical receipt.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct CodePreparation {
+    pub(super) result: oneshot::Receiver<Result<PinnedCode, DockerError>>,
+    pub(super) _cancel: watch::Sender<()>,
+    pub(super) retired: CodeRetirement,
+    pub(super) deadline: Instant,
+}
+impl CodePreparation {
+    /// Retain cleanup evidence before observing a result which may fail/expire.
+    ///
+    /// ```no_run
+    /// # fn inspect(preparation:&rustack_lambda_core::docker::CodePreparation) {let retired=preparation.retirement();}
+    /// ```
+    #[must_use]
+    pub fn retirement(&self) -> CodeRetirement {
+        self.retired.clone()
+    }
+    /// Consume an on-time Ready result; dropping this observer requests cancel.
+    ///
+    /// # Errors
+    /// Returns the preparation failure, expiry, cancellation or supervisor error.
+    /// None proves physical retirement; observe the separate receipt for that.
+    ///
+    /// ```no_run
+    /// # async fn ready(preparation:rustack_lambda_core::docker::CodePreparation)->Result<(),rustack_lambda_core::docker::DockerError> {let code=preparation.wait().await?;assert!(code.is_live());Ok(())}
+    /// ```
+    pub async fn wait(mut self) -> Result<PinnedCode, DockerError> {
+        let ready = timeout_at(self.deadline, &mut self.result)
+            .await
+            .map_err(|_| DockerError::Deadline)?
+            .map_err(|_| DockerError::Worker)??;
+        ready.accept()?;
+        Ok(ready)
+    }
+}
+
+/// Revocable code metadata; source and physical admission live in the actor.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct PinnedCode(Arc<CodeLease>);
+#[derive(Debug, TypedBuilder)]
+pub(super) struct CodeLease {
+    identity: Arc<CodeVolumeIdentity>,
+    volume: DockerKey,
+    image: Sha256Digest,
+    source: ImageLiveness,
+    release: watch::Sender<()>,
+    active: Arc<AtomicBool>,
+    stop: watch::Receiver<bool>,
+    handoff: Acceptance,
+    deadline: Instant,
+    retired: watch::Receiver<bool>,
+}
+impl Drop for CodeLease {
+    fn drop(&mut self) {
+        self.release.send_replace(());
+    }
+}
+impl fmt::Debug for PinnedCode {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("PinnedCode")
+            .field("live", &self.is_live())
+            .finish_non_exhaustive()
+    }
+}
+impl PinnedCode {
+    pub(super) fn from_lease(lease: CodeLease) -> Self {
+        Self(Arc::new(lease))
+    }
+    pub(super) fn accept(&self) -> Result<(), DockerError> {
+        let mut accepted = false;
+        self.0.handoff.send_modify(|handoff| {
+            let at = Instant::now();
+            if matches!(handoff.state, Consumption::Pending)
+                && at < self.0.deadline
+                && self.is_live()
+            {
+                handoff.state = Consumption::Consumed(at);
+                handoff.slot.take();
+                accepted = true;
+            }
+        });
+        if accepted {
+            Ok(())
+        } else if Instant::now() >= self.0.deadline {
+            Err(DockerError::Deadline)
+        } else {
+            Err(DockerError::Stopped)
+        }
+    }
+    /// Whether this code and its source/manager still permit consumption.
+    ///
+    /// ```no_run
+    /// # fn inspect(code:&rustack_lambda_core::docker::PinnedCode) { let live=code.is_live(); }
+    /// ```
+    #[must_use]
+    pub fn is_live(&self) -> bool {
+        self.0.active.load(Ordering::Acquire) && !*self.0.stop.borrow() && self.0.source.is_live()
+    }
+    /// Exact immutable environment/resource/revision identity.
+    ///
+    /// ```no_run
+    /// # fn inspect(code:&rustack_lambda_core::docker::PinnedCode) { let id=code.identity(); }
+    /// ```
+    #[must_use]
+    pub fn identity(&self) -> &CodeVolumeIdentity {
+        &self.0.identity
+    }
+    /// Immutable parent image ID whose pin the actor retains through retirement.
+    ///
+    /// ```no_run
+    /// # fn inspect(code:&rustack_lambda_core::docker::PinnedCode) { let id=code.base_image_id(); }
+    /// ```
+    #[must_use]
+    pub fn base_image_id(&self) -> &Sha256Digest {
+        &self.0.image
+    }
+    /// Named volume for diagnostics; observation does not confer ownership.
+    ///
+    /// ```no_run
+    /// # fn inspect(code:&rustack_lambda_core::docker::PinnedCode) { let name=code.volume_name(); }
+    /// ```
+    #[must_use]
+    pub fn volume_name(&self) -> &DockerKey {
+        &self.0.volume
+    }
+    /// Observe retirement after releasing all Ready clones and their consumers.
+    ///
+    /// ```no_run
+    /// # async fn release(code:rustack_lambda_core::docker::PinnedCode)->Result<(),rustack_lambda_core::docker::DockerError> {let mut retired=code.retirement();drop(code);retired.wait(tokio::time::Instant::now()+std::time::Duration::from_secs(30)).await?;Ok(())}
+    /// ```
+    #[must_use]
+    pub fn retirement(&self) -> CodeRetirement {
+        CodeRetirement::new(self.0.retired.clone())
+    }
+
+    /// Return only the checked RO code mount, retaining this lease in its consumer.
+    ///
+    /// # Errors
+    /// Returns Stopped if this lease, manager or source has been revoked.
+    ///
+    /// ```no_run
+    /// # fn inspect(code:&rustack_lambda_core::docker::PinnedCode)->Result<(),rustack_lambda_core::docker::DockerError> { let mount=code.mount()?;assert_eq!(mount.read_only,Some(true));Ok(()) }
+    /// ```
+    pub fn mount(&self) -> Result<Mount, DockerError> {
+        if !self.is_live() {
+            return Err(DockerError::Stopped);
+        }
+        Ok(Mount {
+            typ: Some(MountType::VOLUME),
+            source: Some(self.0.volume.as_str().into()),
+            target: Some("/var/task".into()),
+            read_only: Some(true),
+            volume_options: Some(MountVolumeOptions {
+                no_copy: Some(true),
+                ..MountVolumeOptions::default()
+            }),
+            ..Mount::default()
+        })
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/config.rs b/crates/rustack-lambda-core/src/docker/config.rs
new file mode 100644
index 00000000..433a1bdd
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/config.rs
@@ -0,0 +1,420 @@
+//! Pure operator settings; private credential IO has separate retained ownership.
+
+mod auth;
+
+use std::{
+    fmt,
+    path::{Component, Path, PathBuf},
+    str::FromStr,
+    time::Duration,
+};
+
+pub use auth::RegistryAuthError;
+use rustack_core::settings::RuntimeBudgets;
+use rustack_lambda_runtime::probe::GatewayEndpoint;
+use tokio::time::Instant;
+use typed_builder::TypedBuilder;
+
+use super::{
+    ContainerPolicy, DockerError, DockerSocket, ImagePullPolicy, NetworkSelection,
+    RegistryCredentials, RegistryHost, RelayBudgets, sdk::LocalSdkCredentials,
+};
+use crate::artifact::ImageReference;
+
+/// Operator-selected function endpoint, independent of request Host and readiness.
+#[derive(Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct DockerGatewayEndpoint(GatewayEndpoint);
+impl fmt::Debug for DockerGatewayEndpoint {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DockerGatewayEndpoint(<redacted>)")
+    }
+}
+impl FromStr for DockerGatewayEndpoint {
+    type Err = DockerError;
+    fn from_str(raw: &str) -> Result<Self, Self::Err> {
+        raw.parse()
+            .map(Self)
+            .map_err(|_| DockerError::Configuration)
+    }
+}
+impl DockerGatewayEndpoint {
+    /// Canonical operator endpoint; this does not establish network reachability.
+    /// ```
+    /// let endpoint:rustack_lambda_core::docker::DockerGatewayEndpoint="http://localhost:4566".parse()?;
+    /// assert_eq!(endpoint.as_str(),"http://localhost:4566/");
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        self.0.as_str()
+    }
+}
+
+impl From<DockerGatewayEndpoint> for GatewayEndpoint {
+    fn from(endpoint: DockerGatewayEndpoint) -> Self {
+        endpoint.0
+    }
+}
+
+/// Explicit absolute private-file path; never searched or expanded.
+///
+/// Requires a controlled local filesystem and ACLs granting no untrusted
+/// credential read/write or ancestor replacement; POSIX checks do not prove ACL privacy.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct RegistryAuthFile(PathBuf);
+impl fmt::Debug for RegistryAuthFile {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryAuthFile(<redacted>)")
+    }
+}
+impl FromStr for RegistryAuthFile {
+    type Err = DockerError;
+    fn from_str(raw: &str) -> Result<Self, Self::Err> {
+        let path = Path::new(raw);
+        if raw.is_empty()
+            || raw.len() > 4096
+            || raw.ends_with('/')
+            || raw.chars().any(char::is_control)
+            || !path.is_absolute()
+            || path
+                .components()
+                .any(|part| matches!(part, Component::ParentDir))
+            || path.file_name().is_none()
+        {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self(path.into()))
+    }
+}
+impl RegistryAuthFile {
+    /// Read an explicitly approved private credential document under a total budget.
+    /// # Errors
+    /// Rejects expiry, unsafe files, IO/worker failure or invalid bounded YAML/policy.
+    /// ```no_run
+    /// # async fn example()->Result<(),rustack_lambda_core::docker::RegistryAuthError>{
+    /// let path:rustack_lambda_core::docker::RegistryAuthFile="/private/registry.yaml".parse().map_err(|_|rustack_lambda_core::docker::RegistryAuthError::Configuration)?;
+    /// let credentials=path.load(vec!["registry.example".parse().map_err(|_|rustack_lambda_core::docker::RegistryAuthError::Configuration)?],tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn load(
+        &self,
+        approved: Vec<RegistryHost>,
+        deadline: Instant,
+    ) -> Result<RegistryCredentials, RegistryAuthError> {
+        auth::load(self.0.clone(), approved, deadline).await
+    }
+}
+
+#[derive(Clone)]
+struct PullSettings {
+    hosts: Vec<RegistryHost>,
+    file: Option<RegistryAuthFile>,
+}
+impl fmt::Debug for PullSettings {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("PullSettings(<redacted>)")
+    }
+}
+/// Immutable operator configuration; constructing it performs no IO or activation.
+///
+/// Only the validated constructor is public:
+/// ```compile_fail
+/// rustack_lambda_core::docker::DockerRuntimeSettings::builder();
+/// ```
+#[derive(Clone, TypedBuilder)]
+#[builder(builder_method(vis = ""))]
+#[non_exhaustive]
+pub struct DockerRuntimeSettings {
+    socket: DockerSocket,
+    relay: ImageReference,
+    zip: Option<ImageReference>,
+    endpoint: Option<DockerGatewayEndpoint>,
+    sdk_credentials: Option<LocalSdkCredentials>,
+    policy: ContainerPolicy,
+    budgets: RuntimeBudgets,
+    log_ring_bytes: usize,
+    cross_architecture: bool,
+    pull: Option<PullSettings>,
+}
+impl fmt::Debug for DockerRuntimeSettings {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DockerRuntimeSettings(<redacted>)")
+    }
+}
+impl DockerRuntimeSettings {
+    pub(super) fn sdk_credentials(&self) -> Option<&LocalSdkCredentials> {
+        self.sdk_credentials.as_ref()
+    }
+    /// Validate explicit settings and shared budgets without reading files or Docker.
+    /// # Errors
+    /// Rejects missing required settings, malformed domain values or inconsistent budgets.
+    /// ```
+    /// let settings=rustack_lambda_core::docker::DockerRuntimeSettings::from_lookup(|key|match key{
+    /// "LAMBDA_DOCKER_RELAY_IMAGE"=>Some("relay:v1".into()),"LAMBDA_DOCKER_NETWORK"=>Some("none".into()),_=>None},&Default::default(),std::time::Duration::from_secs(600))?;
+    /// assert!(!settings.cross_architecture());
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn from_lookup(
+        lookup: impl Fn(&str) -> Option<String>,
+        budgets: &RuntimeBudgets,
+        idle: Duration,
+    ) -> Result<Self, DockerError> {
+        budgets.validate().map_err(|_| DockerError::Configuration)?;
+        let socket = lookup("LAMBDA_DOCKER_SOCKET")
+            .unwrap_or_else(|| "unix:///var/run/docker.sock".into())
+            .parse()?;
+        let relay = lookup("LAMBDA_DOCKER_RELAY_IMAGE")
+            .ok_or(DockerError::Configuration)?
+            .parse()?;
+        let network: NetworkSelection = lookup("LAMBDA_DOCKER_NETWORK")
+            .ok_or(DockerError::Configuration)?
+            .parse()?;
+        let io = Duration::from_secs(budgets.lambda_docker_io_seconds);
+        let cleanup = Duration::from_secs(budgets.lambda_docker_cleanup_seconds);
+        let policy = ContainerPolicy::new(
+            network,
+            number(&lookup, "UID", 1000, 1, 2_147_483_647)?
+                .try_into()
+                .map_err(|_| DockerError::Configuration)?,
+            number(&lookup, "GID", 1000, 1, 2_147_483_647)?
+                .try_into()
+                .map_err(|_| DockerError::Configuration)?,
+            cpu(&lookup("LAMBDA_DOCKER_CPU").unwrap_or_else(|| "1".into()))?,
+            RelayBudgets::new(io, idle, cleanup)?,
+        )?;
+        let cross_architecture = match lookup("LAMBDA_DOCKER_CROSS_ARCHITECTURE").as_deref() {
+            None | Some("false") => false,
+            Some("true") => true,
+            _ => return Err(DockerError::Configuration),
+        };
+        let endpoint = lookup("LAMBDA_DOCKER_GATEWAY_ENDPOINT")
+            .map(|raw| raw.parse::<DockerGatewayEndpoint>())
+            .transpose()?;
+        let sdk_credentials = LocalSdkCredentials::parse(
+            lookup("LAMBDA_DOCKER_SDK_ACCESS_KEY_ID"),
+            lookup("LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY"),
+        )?;
+        if sdk_credentials.is_some() && (endpoint.is_none() || policy.network.value() == "none") {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self::builder()
+            .socket(socket)
+            .relay(relay)
+            .zip(
+                lookup("LAMBDA_DOCKER_ZIP_IMAGE")
+                    .map(|raw| {
+                        let reference: ImageReference = raw.parse()?;
+                        if reference.digest().is_none() {
+                            return Err(DockerError::Configuration);
+                        }
+                        Ok(reference)
+                    })
+                    .transpose()?,
+            )
+            .endpoint(endpoint)
+            .sdk_credentials(sdk_credentials)
+            .policy(policy)
+            .budgets(budgets.clone())
+            .log_ring_bytes(
+                number(&lookup, "LOG_RING_BYTES", 262_144, 4096, 1_048_576)?
+                    .try_into()
+                    .map_err(|_| DockerError::Configuration)?,
+            )
+            .cross_architecture(cross_architecture)
+            .pull(parse_pull(&lookup)?)
+            .build())
+    }
+    /// Load only explicit credentials and construct the existing pull policy.
+    /// # Errors
+    /// Returns bounded file/schema/worker/deadline or policy errors; never falls back.
+    /// ```no_run
+    /// # async fn load(settings:&rustack_lambda_core::docker::DockerRuntimeSettings)->Result<(),rustack_lambda_core::docker::RegistryAuthError>{
+    /// let policy=settings.load_pull_policy(tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn load_pull_policy(
+        &self,
+        deadline: Instant,
+    ) -> Result<ImagePullPolicy, RegistryAuthError> {
+        auth::valid_deadline(deadline)?;
+        let Some(pull) = &self.pull else {
+            return Ok(ImagePullPolicy::default());
+        };
+        let credentials = match &pull.file {
+            Some(file) => file.load(pull.hosts.clone(), deadline).await?,
+            None => RegistryCredentials::default(),
+        };
+        let policy = ImagePullPolicy::if_missing(
+            pull.hosts.clone(),
+            credentials,
+            Duration::from_secs(self.budgets.lambda_docker_pull_seconds),
+        )
+        .map_err(|_| RegistryAuthError::Configuration)?;
+        auth::valid_deadline(deadline)?;
+        Ok(policy)
+    }
+    /// Validated local socket.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let socket=s.socket(); }
+    /// ```
+    #[must_use]
+    pub fn socket(&self) -> &DockerSocket {
+        &self.socket
+    }
+    /// Relay source selected by the operator; not yet resolved or pinned.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let source=s.relay_image(); }
+    /// ```
+    #[must_use]
+    pub fn relay_image(&self) -> &ImageReference {
+        &self.relay
+    }
+    /// Optional ZIP runtime source; no implicit catalog.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let source=s.zip_image(); }
+    /// ```
+    #[must_use]
+    pub fn zip_image(&self) -> Option<&ImageReference> {
+        self.zip.as_ref()
+    }
+    /// Optional endpoint; parsing is not reachability evidence.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let endpoint=s.gateway_endpoint(); }
+    /// ```
+    #[must_use]
+    pub fn gateway_endpoint(&self) -> Option<&DockerGatewayEndpoint> {
+        self.endpoint.as_ref()
+    }
+    /// Validated immutable container policy.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let policy=s.container_policy(); }
+    /// ```
+    #[must_use]
+    pub fn container_policy(&self) -> &ContainerPolicy {
+        &self.policy
+    }
+    /// Validated shared runtime budgets captured for startup.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let limits=s.budgets(); }
+    /// ```
+    #[must_use]
+    pub fn budgets(&self) -> &RuntimeBudgets {
+        &self.budgets
+    }
+    /// Per-channel bounded function log storage.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let bytes=s.log_ring_bytes(); }
+    /// ```
+    #[must_use]
+    pub fn log_ring_bytes(&self) -> usize {
+        self.log_ring_bytes
+    }
+    /// Explicit permission to qualify an emulated architecture path.
+    /// ```no_run
+    /// # fn inspect(s:&rustack_lambda_core::docker::DockerRuntimeSettings){ let emulation=s.cross_architecture(); }
+    /// ```
+    #[must_use]
+    pub fn cross_architecture(&self) -> bool {
+        self.cross_architecture
+    }
+}
+fn parse_pull(
+    lookup: &impl Fn(&str) -> Option<String>,
+) -> Result<Option<PullSettings>, DockerError> {
+    let hosts = lookup("LAMBDA_DOCKER_REGISTRIES");
+    let file = lookup("LAMBDA_DOCKER_REGISTRY_AUTH_FILE");
+    match lookup("LAMBDA_DOCKER_PULL_POLICY").as_deref() {
+        None | Some("never") => {
+            if hosts.is_some() || file.is_some() {
+                return Err(DockerError::Configuration);
+            }
+            Ok(None)
+        }
+        Some("ifMissing") => {
+            let raw = hosts.ok_or(DockerError::Configuration)?;
+            if raw.len() > 8127 || raw.split(',').count() > 32 {
+                return Err(DockerError::Configuration);
+            }
+            let hosts: Vec<RegistryHost> =
+                raw.split(',').map(str::parse).collect::<Result<_, _>>()?;
+            ImagePullPolicy::if_missing(
+                hosts.clone(),
+                RegistryCredentials::default(),
+                Duration::from_secs(300),
+            )?;
+            Ok(Some(PullSettings {
+                hosts,
+                file: file.map(|raw| raw.parse()).transpose()?,
+            }))
+        }
+        _ => Err(DockerError::Configuration),
+    }
+}
+fn number(
+    lookup: &impl Fn(&str) -> Option<String>,
+    suffix: &str,
+    default: u64,
+    min: u64,
+    max: u64,
+) -> Result<u64, DockerError> {
+    let value = match lookup(&format!("LAMBDA_DOCKER_{suffix}")) {
+        None => default,
+        Some(raw) => {
+            if raw.len() > 20 || !raw.bytes().all(|byte| byte.is_ascii_digit()) {
+                return Err(DockerError::Configuration);
+            }
+            raw.parse().map_err(|_| DockerError::Configuration)?
+        }
+    };
+    if !(min..=max).contains(&value) {
+        return Err(DockerError::Configuration);
+    }
+    Ok(value)
+}
+fn cpu(raw: &str) -> Result<u64, DockerError> {
+    if raw.is_empty() || raw.len() > 12 {
+        return Err(DockerError::Configuration);
+    }
+    let (whole, fraction) = raw
+        .split_once('.')
+        .map_or((raw, ""), |(whole, fraction)| (whole, fraction));
+    if whole.is_empty()
+        || !whole.bytes().all(|byte| byte.is_ascii_digit())
+        || fraction.len() > 9
+        || !fraction.bytes().all(|byte| byte.is_ascii_digit())
+        || (raw.contains('.') && fraction.is_empty())
+    {
+        return Err(DockerError::Configuration);
+    }
+    let whole: u64 = whole.parse().map_err(|_| DockerError::Configuration)?;
+    let fraction_value = if fraction.is_empty() {
+        0
+    } else {
+        fraction
+            .parse::<u64>()
+            .map_err(|_| DockerError::Configuration)?
+    };
+    let scale = 10_u64
+        .checked_pow(
+            u32::try_from(9_usize.saturating_sub(fraction.len()))
+                .map_err(|_| DockerError::Configuration)?,
+        )
+        .ok_or(DockerError::Configuration)?;
+    let nano = whole
+        .checked_mul(1_000_000_000)
+        .and_then(|value| {
+            fraction_value
+                .checked_mul(scale)
+                .and_then(|fraction| value.checked_add(fraction))
+        })
+        .ok_or(DockerError::Configuration)?;
+    if !(100_000_000..=16_000_000_000).contains(&nano) {
+        return Err(DockerError::Configuration);
+    }
+    Ok(nano)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/config/auth.rs b/crates/rustack-lambda-core/src/docker/config/auth.rs
new file mode 100644
index 00000000..84d2340a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/config/auth.rs
@@ -0,0 +1,441 @@
+//! Bounded retained read-only workers; no ambient credentials or parser trees.
+//!
+//! A timed-out/dropped observer cannot stop a local filesystem syscall. Its
+//! read-only blocking job retains the permit, descriptor and zeroizing buffer
+//! until it exits. No late result can publish runtime readiness. POSIX checks
+//! require operator-controlled ACLs; they do not prove extended-ACL privacy.
+
+use std::{
+    collections::BTreeSet,
+    fmt, io,
+    os::fd::OwnedFd,
+    path::{Component, Path, PathBuf},
+    str::{Chars, from_utf8},
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use nix::{
+    errno::Errno,
+    fcntl::{OFlag, open, openat},
+    sys::stat::{FileStat, Mode, SFlag, fstat},
+    unistd::{geteuid, read},
+};
+use secrecy::{
+    ExposeSecret, SecretString,
+    zeroize::{Zeroize, Zeroizing},
+};
+use tokio::{
+    runtime::Handle,
+    sync::{Semaphore, SemaphorePermit},
+    task::{JoinHandle, spawn_blocking},
+    time::{Instant, timeout_at},
+};
+use yaml_rust2::{
+    parser::{Event, Parser},
+    scanner::TScalarStyle,
+};
+
+use crate::docker::{RegistryCredential, RegistryCredentials, RegistryHost};
+
+static WORKERS: Semaphore = Semaphore::const_new(4);
+const MAX_BYTES: usize = 65_536;
+
+/// Fixed credential-source failure classes; paths, YAML and secrets are redacted.
+#[derive(thiserror::Error)]
+#[non_exhaustive]
+pub enum RegistryAuthError {
+    /// Invalid path, approved-host set or budget.
+    #[error("invalid registry credential configuration")]
+    Configuration,
+    /// Unsafe file kind, owner, links, modes or changed observed metadata.
+    #[error("unsafe registry credential file")]
+    UnsafeFile,
+    /// Malformed or unsupported bounded credential YAML/schema.
+    #[error("invalid registry credential document")]
+    Document,
+    /// Source or parsed collection exceeds its hard ceiling.
+    #[error("registry credential byte budget exceeded")]
+    TooLarge,
+    /// Absolute queue/read/parse observation deadline expired.
+    #[error("registry credential deadline exceeded")]
+    Deadline,
+    /// The requesting observer was abandoned.
+    #[error("registry credential read cancelled")]
+    Cancelled,
+    /// No runtime or retained blocking worker failed.
+    #[error("registry credential worker failed")]
+    Worker,
+    /// Local descriptor IO failed without displaying source/path text.
+    #[error("registry credential IO failed")]
+    Io(#[source] io::Error),
+}
+impl fmt::Debug for RegistryAuthError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl From<Errno> for RegistryAuthError {
+    fn from(error: Errno) -> Self {
+        match error {
+            Errno::ELOOP | Errno::ENOTDIR => Self::UnsafeFile,
+            _ => Self::Io(error.into()),
+        }
+    }
+}
+struct Control {
+    deadline: Instant,
+    cancelled: Arc<AtomicBool>,
+}
+impl fmt::Debug for Control {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryReadControl")
+    }
+}
+impl Control {
+    fn check(&self) -> Result<(), RegistryAuthError> {
+        if Instant::now() >= self.deadline {
+            return Err(RegistryAuthError::Deadline);
+        }
+        if self.cancelled.load(Ordering::Acquire) {
+            return Err(RegistryAuthError::Cancelled);
+        }
+        Ok(())
+    }
+}
+struct Cancel(Arc<AtomicBool>);
+impl Drop for Cancel {
+    fn drop(&mut self) {
+        self.0.store(true, Ordering::Release);
+    }
+}
+pub(super) fn valid_deadline(deadline: Instant) -> Result<(), RegistryAuthError> {
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .filter(|remaining| !remaining.is_zero())
+        .ok_or(RegistryAuthError::Deadline)?;
+    if remaining > Duration::from_secs(60) {
+        return Err(RegistryAuthError::Configuration);
+    }
+    Ok(())
+}
+pub(super) async fn load(
+    path: PathBuf,
+    approved: Vec<RegistryHost>,
+    deadline: Instant,
+) -> Result<RegistryCredentials, RegistryAuthError> {
+    read_owned(path, approved, deadline, &WORKERS, |_| Ok(())).await
+}
+async fn read_owned(
+    path: PathBuf,
+    approved: Vec<RegistryHost>,
+    deadline: Instant,
+    pool: &'static Semaphore,
+    before: impl FnOnce(&Control) -> Result<(), RegistryAuthError> + Send + 'static,
+) -> Result<RegistryCredentials, RegistryAuthError> {
+    valid_deadline(deadline)?;
+    Handle::try_current().map_err(|_| RegistryAuthError::Worker)?;
+    let count = approved.len();
+    if count == 0 || count > 32 {
+        return Err(RegistryAuthError::Configuration);
+    }
+    let approved: BTreeSet<_> = approved.into_iter().collect();
+    if approved.len() != count {
+        return Err(RegistryAuthError::Configuration);
+    }
+    let permit = timeout_at(deadline, pool.acquire())
+        .await
+        .map_err(|_| RegistryAuthError::Deadline)?
+        .map_err(|_| RegistryAuthError::Worker)?;
+    let cancelled = Arc::new(AtomicBool::new(false));
+    let _cancel = Cancel(cancelled.clone());
+    let task = spawn_read(
+        path,
+        approved,
+        Control {
+            deadline,
+            cancelled,
+        },
+        permit,
+        before,
+    );
+    let (credentials, _permit) = timeout_at(deadline, task)
+        .await
+        .map_err(|_| RegistryAuthError::Deadline)?
+        .map_err(|_| RegistryAuthError::Worker)??;
+    if Instant::now() >= deadline {
+        return Err(RegistryAuthError::Deadline);
+    }
+    Ok(credentials)
+}
+fn spawn_read(
+    path: PathBuf,
+    approved: BTreeSet<RegistryHost>,
+    control: Control,
+    permit: SemaphorePermit<'static>,
+    before: impl FnOnce(&Control) -> Result<(), RegistryAuthError> + Send + 'static,
+) -> JoinHandle<Result<(RegistryCredentials, SemaphorePermit<'static>), RegistryAuthError>> {
+    spawn_blocking(move || {
+        control.check()?;
+        before(&control)?;
+        control.check()?;
+        let value = read_document(&path, &approved, &control)?;
+        control.check()?;
+        // Ready results remain charged until observed or discarded.
+        Ok::<(RegistryCredentials, SemaphorePermit<'static>), RegistryAuthError>((value, permit))
+    })
+}
+
+fn flags() -> OFlag {
+    OFlag::O_RDONLY | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC | OFlag::O_NONBLOCK | OFlag::O_NOCTTY
+}
+fn trusted_directory(file: &OwnedFd) -> Result<(), RegistryAuthError> {
+    let stat = fstat(file)?;
+    let owner = stat.st_uid;
+    let mode = stat.st_mode;
+    if SFlag::from_bits_truncate(mode) != SFlag::S_IFDIR
+        || (owner != 0 && owner != geteuid().as_raw())
+        || (mode & 0o022 != 0 && !(owner == 0 && mode & 0o1000 != 0))
+    {
+        return Err(RegistryAuthError::UnsafeFile);
+    }
+    Ok(())
+}
+fn private_file(file: &OwnedFd) -> Result<FileStat, RegistryAuthError> {
+    let stat = fstat(file)?;
+    if SFlag::from_bits_truncate(stat.st_mode) != SFlag::S_IFREG
+        || stat.st_uid != geteuid().as_raw()
+        || stat.st_nlink != 1
+        || stat.st_mode & 0o7177 != 0
+    {
+        return Err(RegistryAuthError::UnsafeFile);
+    }
+    if stat.st_size <= 0
+        || stat.st_size > i64::try_from(MAX_BYTES).map_err(|_| RegistryAuthError::Configuration)?
+    {
+        return Err(RegistryAuthError::TooLarge);
+    }
+    Ok(stat)
+}
+fn open_private(path: &Path, control: &Control) -> Result<OwnedFd, RegistryAuthError> {
+    control.check()?;
+    let mut directory = open(Path::new("/"), flags() | OFlag::O_DIRECTORY, Mode::empty())?;
+    trusted_directory(&directory)?;
+    let mut parts = path.components().peekable();
+    while let Some(part) = parts.next() {
+        control.check()?;
+        match part {
+            Component::RootDir | Component::CurDir => {}
+            Component::Normal(name) => {
+                if parts.peek().is_none() {
+                    return Ok(openat(&directory, name, flags(), Mode::empty())?);
+                }
+                let child = openat(
+                    &directory,
+                    name,
+                    flags() | OFlag::O_DIRECTORY,
+                    Mode::empty(),
+                )?;
+                trusted_directory(&child)?;
+                directory = child;
+            }
+            _ => return Err(RegistryAuthError::Configuration),
+        }
+    }
+    Err(RegistryAuthError::Configuration)
+}
+fn same(before: &FileStat, after: &FileStat) -> bool {
+    before.st_dev == after.st_dev
+        && before.st_ino == after.st_ino
+        && before.st_uid == after.st_uid
+        && before.st_mode == after.st_mode
+        && before.st_nlink == after.st_nlink
+        && before.st_size == after.st_size
+        && before.st_mtime == after.st_mtime
+        && before.st_mtime_nsec == after.st_mtime_nsec
+        && before.st_ctime == after.st_ctime
+        && before.st_ctime_nsec == after.st_ctime_nsec
+}
+fn read_document(
+    path: &Path,
+    approved: &BTreeSet<RegistryHost>,
+    control: &Control,
+) -> Result<RegistryCredentials, RegistryAuthError> {
+    let file = open_private(path, control)?;
+    let initial = private_file(&file)?;
+    let mut bytes = Zeroizing::new(Vec::new());
+    bytes
+        .try_reserve_exact(MAX_BYTES + 1)
+        .map_err(|_| RegistryAuthError::TooLarge)?;
+    bytes.resize(MAX_BYTES + 1, 0);
+    let mut used = 0_usize;
+    loop {
+        control.check()?;
+        let end = used.saturating_add(1024).min(MAX_BYTES + 1);
+        let buffer = bytes
+            .get_mut(used..end)
+            .ok_or(RegistryAuthError::TooLarge)?;
+        if buffer.is_empty() {
+            return Err(RegistryAuthError::TooLarge);
+        }
+        let count = read(&file, buffer)?;
+        if count == 0 {
+            break;
+        }
+        used = used.checked_add(count).ok_or(RegistryAuthError::TooLarge)?;
+        if used > MAX_BYTES {
+            return Err(RegistryAuthError::TooLarge);
+        }
+    }
+    control.check()?;
+    validate_observation(&file, &initial, used)?;
+    let text = from_utf8(bytes.get(..used).ok_or(RegistryAuthError::TooLarge)?)
+        .map_err(|_| RegistryAuthError::Document)?;
+    parse(text, approved, control)
+}
+
+fn validate_observation(
+    file: &OwnedFd,
+    initial: &FileStat,
+    used: usize,
+) -> Result<(), RegistryAuthError> {
+    let after = private_file(file)?;
+    if !same(initial, &after) || usize::try_from(initial.st_size).ok() != Some(used) {
+        return Err(RegistryAuthError::UnsafeFile);
+    }
+    Ok(())
+}
+
+struct Events<'a> {
+    parser: Parser<Chars<'a>>,
+    count: usize,
+    control: &'a Control,
+}
+impl fmt::Debug for Events<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryYamlEvents(<redacted>)")
+    }
+}
+impl Events<'_> {
+    fn next(&mut self) -> Result<Event, RegistryAuthError> {
+        self.control.check()?;
+        self.count = self
+            .count
+            .checked_add(1)
+            .ok_or(RegistryAuthError::TooLarge)?;
+        if self.count > 512 {
+            return Err(RegistryAuthError::TooLarge);
+        }
+        self.parser
+            .next_token()
+            .map(|(event, _)| event)
+            .map_err(|_| RegistryAuthError::Document)
+    }
+    fn expect(&mut self, event: &Event) -> Result<(), RegistryAuthError> {
+        let actual = self.next()?;
+        if &actual != event {
+            if let Event::Scalar(mut value, _, _, _) = actual {
+                value.zeroize();
+            }
+            return Err(RegistryAuthError::Document);
+        }
+        Ok(())
+    }
+}
+fn scalar(event: Event, quoted: bool, max: usize) -> Result<SecretString, RegistryAuthError> {
+    match event {
+        Event::Scalar(value, style, anchor, tag) => {
+            let value: SecretString = value.into();
+            if anchor != 0
+                || tag.is_some()
+                || (quoted
+                    && !matches!(
+                        style,
+                        TScalarStyle::SingleQuoted | TScalarStyle::DoubleQuoted
+                    ))
+                || value.expose_secret().is_empty()
+                || value.expose_secret().len() > max
+            {
+                return Err(RegistryAuthError::Document);
+            }
+            Ok(value)
+        }
+        _ => Err(RegistryAuthError::Document),
+    }
+}
+fn credential(events: &mut Events<'_>) -> Result<RegistryCredential, RegistryAuthError> {
+    events.expect(&Event::MappingStart(0, None))?;
+    let mut user = None;
+    let mut password = None;
+    let mut token = None;
+    loop {
+        let event = events.next()?;
+        if event == Event::MappingEnd {
+            break;
+        }
+        let key = scalar(event, false, 32)?;
+        let target = match key.expose_secret() {
+            "username" => (&mut user, 256),
+            "password" => (&mut password, 4096),
+            "identityToken" => (&mut token, 8192),
+            _ => return Err(RegistryAuthError::Document),
+        };
+        if target.0.is_some() {
+            return Err(RegistryAuthError::Document);
+        }
+        *target.0 = Some(scalar(events.next()?, true, target.1)?);
+    }
+    match (user, password, token) {
+        (Some(user), Some(password), None) => RegistryCredential::basic(user, password),
+        (None, None, Some(token)) => RegistryCredential::identity_token(token),
+        _ => return Err(RegistryAuthError::Document),
+    }
+    .map_err(|_| RegistryAuthError::Document)
+}
+fn parse(
+    text: &str,
+    approved: &BTreeSet<RegistryHost>,
+    control: &Control,
+) -> Result<RegistryCredentials, RegistryAuthError> {
+    if text.len() > MAX_BYTES {
+        return Err(RegistryAuthError::TooLarge);
+    }
+    let mut events = Events {
+        parser: Parser::new_from_str(text),
+        count: 0,
+        control,
+    };
+    events.expect(&Event::StreamStart)?;
+    events.expect(&Event::DocumentStart)?;
+    events.expect(&Event::MappingStart(0, None))?;
+    let mut records = Vec::new();
+    let mut seen = BTreeSet::new();
+    loop {
+        let event = events.next()?;
+        if event == Event::MappingEnd {
+            break;
+        }
+        if records.len() >= 32 {
+            return Err(RegistryAuthError::TooLarge);
+        }
+        let raw = scalar(event, false, 253)?;
+        let host: RegistryHost = raw
+            .expose_secret()
+            .parse()
+            .map_err(|_| RegistryAuthError::Document)?;
+        if !approved.contains(&host) || !seen.insert(host.clone()) {
+            return Err(RegistryAuthError::Document);
+        }
+        records.push((host, credential(&mut events)?));
+    }
+    events.expect(&Event::DocumentEnd)?;
+    events.expect(&Event::StreamEnd)?;
+    control.check()?;
+    RegistryCredentials::try_from(records).map_err(|_| RegistryAuthError::Document)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/config/auth/tests.rs b/crates/rustack-lambda-core/src/docker/config/auth/tests.rs
new file mode 100644
index 00000000..009ed6ab
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/config/auth/tests.rs
@@ -0,0 +1,560 @@
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fmt::Write,
+    os::unix::fs::PermissionsExt,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+        mpsc,
+    },
+    time::Duration,
+};
+
+use base64::{Engine, engine::general_purpose::URL_SAFE};
+use nix::{sys::stat::Mode, unistd::mkfifo};
+use proptest::prelude::*;
+use rstest::rstest;
+use rustack_core::settings::RuntimeBudgets;
+use serde_json::{Value, from_slice};
+use tempfile::{TempDir, tempdir};
+use tokio::{
+    fs, spawn,
+    sync::{Semaphore, oneshot},
+    task::yield_now,
+    time::{Instant, sleep, timeout},
+};
+
+use super::{
+    Control, RegistryAuthError, open_private, parse, private_file, read_owned, spawn_read,
+    validate_observation,
+};
+use crate::{
+    artifact::Architecture,
+    docker::{
+        DirectoryLease, DockerRuntimeSettings, ImageLeaseConfig, ImageLeaseManager, ImagePinScope,
+        RegistryAuthFile, RegistryHost, tests::Daemon,
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn approved() -> BTreeSet<RegistryHost> {
+    BTreeSet::from(["registry.example".parse().unwrap()])
+}
+fn control() -> Control {
+    Control {
+        deadline: deadline(),
+        cancelled: Arc::new(AtomicBool::new(false)),
+    }
+}
+async fn fixture(text: &str) -> (TempDir, RegistryAuthFile) {
+    let root = tempdir().unwrap();
+    let canonical = fs::canonicalize(root.path()).await.unwrap();
+    let path = canonical.join("credentials.yaml");
+    fs::write(&path, text).await.unwrap();
+    fs::set_permissions(&path, PermissionsExt::from_mode(0o600))
+        .await
+        .unwrap();
+    (root, path.to_str().unwrap().parse().unwrap())
+}
+#[rstest]
+#[case("{}")]
+#[case("registry.example: {username: 'user', password: \"password\"}")]
+#[case("---\nregistry.example:\n  identityToken: \"token\\u2603\"\n...")]
+#[case("'registry.example':\n  username: 'user'\n  password: 'pas''sword'")]
+fn test_should_parse_exact_shallow_quoted_credential_schema(#[case] text: &str) {
+    assert!(parse(text, &approved(), &control()).is_ok());
+}
+#[rstest]
+#[case("")]
+#[case("[]")]
+#[case("secret")]
+#[case("registry.example: {}")]
+#[case("registry.example: {username: 'user'}")]
+#[case("registry.example: {password: 'p'}")]
+#[case("registry.example: {identityToken: ''}")]
+#[case("registry.example: {identityToken: token}")]
+#[case("registry.example: {identityToken: true}")]
+#[case("registry.example: {identityToken: 123}")]
+#[case("registry.example: {identityToken: null}")]
+#[case("registry.example: {identityToken: 'a', identityToken: 'b'}")]
+#[case("registry.example: {username: 'u', password: 'p', identityToken: 't'}")]
+#[case("registry.example: {username: 'u', password: 'p', extra: 'x'}")]
+#[case("registry.example: {identityToken: \"a\\nb\"}")]
+#[case("registry.example: {identityToken: !secret 'token'}")]
+#[case("registry.example: &secret {identityToken: 'token'}")]
+#[case("registry.example: {identityToken: &secret 'token'}")]
+#[case("registry.example: {identityToken: *secret}")]
+#[case("registry.example: {identityToken: {nested: 'token'}}")]
+#[case("registry.example: {identityToken: ['token']}")]
+#[case("registry.example: {<<: {identityToken: 'token'}}")]
+#[case("registry.example: {identityToken: 'a'}\nregistry.example: {identityToken: 'b'}")]
+#[case("REGISTRY.EXAMPLE: {identityToken: 'a'}\nregistry.example: {identityToken: 'b'}")]
+#[case("other.example: {identityToken: 'token'}")]
+#[case("{}\n---\n{}")]
+#[case("{}\ntrailing: [")]
+fn test_should_reject_unsafe_ambiguous_or_typed_yaml(#[case] text: &str) {
+    let error = parse(text, &approved(), &control()).unwrap_err();
+    assert!(!format!("{error:?}: {error}").contains("token"));
+}
+#[test]
+fn test_should_bound_decoded_secrets_collections_and_input() {
+    for (field, max) in [
+        ("username", 256),
+        ("password", 4096),
+        ("identityToken", 8192),
+    ] {
+        let text = if field == "identityToken" {
+            format!(
+                "registry.example: {{identityToken: '{}' }}",
+                "t".repeat(max)
+            )
+        } else {
+            format!(
+                "registry.example: {{username: '{}', password: '{}'}}",
+                if field == "username" {
+                    "u".repeat(max)
+                } else {
+                    "u".into()
+                },
+                if field == "password" {
+                    "p".repeat(max)
+                } else {
+                    "p".into()
+                }
+            )
+        };
+        assert!(parse(&text, &approved(), &control()).is_ok());
+        let too_big = text.replacen(&"t".repeat(max), &"t".repeat(max + 1), 1);
+        if field == "identityToken" {
+            assert!(parse(&too_big, &approved(), &control()).is_err());
+        } else {
+            let big = format!(
+                "registry.example: {{username: '{}', password: '{}'}}",
+                if field == "username" {
+                    "u".repeat(max + 1)
+                } else {
+                    "u".into()
+                },
+                if field == "password" {
+                    "p".repeat(max + 1)
+                } else {
+                    "p".into()
+                }
+            );
+            assert!(parse(&big, &approved(), &control()).is_err());
+        }
+    }
+    let text = format!("{{}}\n#{}", "x".repeat(65_532));
+    assert_eq!(text.len(), 65_536);
+    assert!(parse(&text, &approved(), &control()).is_ok());
+    assert!(parse(&(text + "x"), &approved(), &control()).is_err());
+    let hosts: BTreeSet<_> = (0..33)
+        .map(|i| format!("r{i}.example").parse().unwrap())
+        .collect();
+    let mut raw = String::new();
+    for i in 0..33 {
+        writeln!(&mut raw, "r{i}.example: {{identityToken: 't'}}").unwrap();
+    }
+    assert!(parse(&raw, &hosts, &control()).is_err());
+    let hosts: BTreeSet<_> = (0..8)
+        .map(|i| format!("r{i}.example").parse().unwrap())
+        .collect();
+    let mut raw = String::new();
+    for i in 0..8 {
+        writeln!(
+            &mut raw,
+            "r{i}.example: {{identityToken: \"{}xx\"}}",
+            "\\L".repeat(2730)
+        )
+        .unwrap();
+    }
+    assert!(raw.len() < 65_536);
+    assert!(parse(&raw, &hosts, &control()).is_err());
+}
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(96))]
+    #[test]
+    fn test_should_never_panic_or_expose_arbitrary_yaml(text in ".{0,2048}"){
+        if let Err(error)=parse(&text,&approved(),&control()){let shown=format!("{error}");prop_assert!(shown.len()<128);}
+    }
+}
+#[tokio::test]
+async fn test_should_load_real_private_file_and_reject_modes_links_and_replacements() {
+    let (root, file) = fixture("registry.example: {identityToken: 'PRIVATE-TOKEN'}").await;
+    let credentials = file
+        .load(approved().into_iter().collect(), deadline())
+        .await
+        .unwrap();
+    assert!(!format!("{credentials:?}").contains("PRIVATE"));
+    for mode in [0o644, 0o640, 0o660, 0o700, 0o1600, 0o4600] {
+        fs::set_permissions(&file.0, PermissionsExt::from_mode(mode))
+            .await
+            .unwrap();
+        assert!(matches!(
+            file.load(approved().into_iter().collect(), deadline())
+                .await,
+            Err(RegistryAuthError::UnsafeFile)
+        ));
+    }
+    fs::set_permissions(&file.0, PermissionsExt::from_mode(0o600))
+        .await
+        .unwrap();
+    let link = root.path().join("hardlink");
+    fs::hard_link(&file.0, &link).await.unwrap();
+    assert!(matches!(
+        file.load(approved().into_iter().collect(), deadline())
+            .await,
+        Err(RegistryAuthError::UnsafeFile)
+    ));
+    fs::remove_file(link).await.unwrap();
+    let descriptor = open_private(&file.0, &control()).unwrap();
+    let original = private_file(&descriptor).unwrap();
+    fs::write(&file.0, "{}\n#changed").await.unwrap();
+    assert!(matches!(
+        validate_observation(
+            &descriptor,
+            &original,
+            usize::try_from(original.st_size).unwrap()
+        ),
+        Err(RegistryAuthError::UnsafeFile)
+    ));
+    fs::remove_file(&file.0).await.unwrap();
+    fs::write(&file.0, "{}").await.unwrap();
+    fs::set_permissions(&file.0, PermissionsExt::from_mode(0o600))
+        .await
+        .unwrap();
+    assert!(matches!(
+        private_file(&descriptor),
+        Err(RegistryAuthError::UnsafeFile)
+    ));
+    file.load(approved().into_iter().collect(), deadline())
+        .await
+        .unwrap();
+}
+#[tokio::test]
+async fn test_should_reject_leaf_ancestor_symlinks_and_nonregular_files_without_hanging() {
+    let (root, file) = fixture("{}").await;
+    let canonical = fs::canonicalize(root.path()).await.unwrap();
+    let symlink = canonical.join("link");
+    fs::symlink(&file.0, &symlink).await.unwrap();
+    let source: RegistryAuthFile = symlink.to_str().unwrap().parse().unwrap();
+    assert!(
+        source
+            .load(approved().into_iter().collect(), deadline())
+            .await
+            .is_err()
+    );
+    let dir = canonical.join("dir");
+    fs::create_dir(&dir).await.unwrap();
+    let source: RegistryAuthFile = dir.to_str().unwrap().parse().unwrap();
+    assert!(
+        source
+            .load(approved().into_iter().collect(), deadline())
+            .await
+            .is_err()
+    );
+    let ancestor = canonical.join("ancestor");
+    fs::symlink(&canonical, &ancestor).await.unwrap();
+    let source: RegistryAuthFile = ancestor
+        .join("credentials.yaml")
+        .to_str()
+        .unwrap()
+        .parse()
+        .unwrap();
+    assert!(
+        source
+            .load(approved().into_iter().collect(), deadline())
+            .await
+            .is_err()
+    );
+    let fifo = canonical.join("fifo");
+    mkfifo(&fifo, Mode::from_bits_truncate(0o600)).unwrap();
+    let source: RegistryAuthFile = fifo.to_str().unwrap().parse().unwrap();
+    assert!(
+        timeout(
+            Duration::from_secs(1),
+            source.load(approved().into_iter().collect(), deadline())
+        )
+        .await
+        .unwrap()
+        .is_err()
+    );
+    fs::set_permissions(&canonical, PermissionsExt::from_mode(0o777))
+        .await
+        .unwrap();
+    assert!(
+        file.load(approved().into_iter().collect(), deadline())
+            .await
+            .is_err()
+    );
+    fs::set_permissions(&canonical, PermissionsExt::from_mode(0o700))
+        .await
+        .unwrap();
+}
+#[tokio::test]
+async fn test_should_enforce_real_file_size_utf8_and_approved_set_without_fallback() {
+    for text in [
+        String::new(),
+        "x".repeat(65_537),
+        "registry.example: {identityToken: token}".into(),
+    ] {
+        let (_root, file) = fixture(&text).await;
+        assert!(
+            file.load(approved().into_iter().collect(), deadline())
+                .await
+                .is_err()
+        );
+    }
+    let (_root, file) = fixture(&format!("{{}}\n#{}", "x".repeat(65_532))).await;
+    file.load(approved().into_iter().collect(), deadline())
+        .await
+        .unwrap();
+    fs::write(&file.0, [0xff]).await.unwrap();
+    assert!(
+        file.load(approved().into_iter().collect(), deadline())
+            .await
+            .is_err()
+    );
+    assert!(file.load(Vec::new(), deadline()).await.is_err());
+    assert!(
+        file.load(vec!["registry.example".parse().unwrap(); 33], deadline())
+            .await
+            .is_err()
+    );
+    assert!(
+        file.load(approved().into_iter().collect(), Instant::now())
+            .await
+            .is_err()
+    );
+    assert!(
+        file.load(
+            approved().into_iter().collect(),
+            Instant::now() + Duration::from_secs(61)
+        )
+        .await
+        .is_err()
+    );
+    fs::remove_file(&file.0).await.unwrap();
+    let error = file
+        .load(approved().into_iter().collect(), deadline())
+        .await
+        .unwrap_err();
+    assert!(!format!("{error:?}:{error}").contains("credentials.yaml"));
+}
+#[tokio::test]
+async fn test_should_retain_all_four_worker_permits_after_observers_are_abandoned() {
+    static POOL: Semaphore = Semaphore::const_new(4);
+    let (_root, file) = fixture("{}").await;
+    let mut releases = Vec::new();
+    for _ in 0..4 {
+        let (release, held) = mpsc::sync_channel(1);
+        let (entered, saw) = oneshot::channel();
+        let path = file.0.clone();
+        let task = spawn(read_owned(
+            path,
+            approved().into_iter().collect(),
+            deadline(),
+            &POOL,
+            move |_| {
+                let _ = entered.send(());
+                held.recv().map_err(|_| RegistryAuthError::Worker)
+            },
+        ));
+        saw.await.unwrap();
+        task.abort();
+        assert!(task.await.unwrap_err().is_cancelled());
+        releases.push(release);
+    }
+    assert_eq!(POOL.available_permits(), 0);
+    let started = Arc::new(AtomicBool::new(false));
+    let observed = started.clone();
+    assert!(matches!(
+        read_owned(
+            file.0.clone(),
+            approved().into_iter().collect(),
+            Instant::now() + Duration::from_millis(25),
+            &POOL,
+            move |_| {
+                started.store(true, Ordering::Release);
+                Ok(())
+            }
+        )
+        .await,
+        Err(RegistryAuthError::Deadline)
+    ));
+    assert!(!observed.load(Ordering::Acquire));
+    assert_eq!(POOL.available_permits(), 0);
+    for release in releases {
+        release.send(()).unwrap();
+    }
+    timeout(Duration::from_secs(2), async {
+        while POOL.available_permits() != 4 {
+            yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+#[tokio::test]
+async fn test_should_charge_ready_results_and_release_failed_workers() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let (_root, file) = fixture("{}").await;
+    let task = spawn_read(
+        file.0.clone(),
+        approved(),
+        control(),
+        POOL.acquire().await.unwrap(),
+        |_| Ok(()),
+    );
+    timeout(Duration::from_secs(2), async {
+        while !task.is_finished() {
+            yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(POOL.available_permits(), 0);
+    let (_credentials, permit) = task.await.unwrap().unwrap();
+    assert_eq!(POOL.available_permits(), 0);
+    drop(permit);
+    assert_eq!(POOL.available_permits(), 1);
+    assert!(matches!(
+        read_owned(
+            file.0.clone(),
+            approved().into_iter().collect(),
+            deadline(),
+            &POOL,
+            |_| panic!("controlled credential worker failure")
+        )
+        .await,
+        Err(RegistryAuthError::Worker)
+    ));
+    assert_eq!(POOL.available_permits(), 1);
+}
+#[tokio::test]
+async fn test_should_keep_timed_out_local_read_charged_until_worker_observes_cancellation() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let (_root, file) = fixture("{}").await;
+    let (release, held) = mpsc::sync_channel(1);
+    let (entered, saw) = oneshot::channel();
+    let path = file.0.clone();
+    let task = spawn(read_owned(
+        path,
+        approved().into_iter().collect(),
+        Instant::now() + Duration::from_secs(1),
+        &POOL,
+        move |_| {
+            let _ = entered.send(());
+            held.recv().map_err(|_| RegistryAuthError::Worker)
+        },
+    ));
+    saw.await.unwrap();
+    let result = task.await.unwrap();
+    assert!(matches!(result, Err(RegistryAuthError::Deadline)));
+    assert_eq!(POOL.available_permits(), 0);
+    release.send(()).unwrap();
+    timeout(Duration::from_secs(2), async {
+        while POOL.available_permits() != 1 {
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+    .unwrap();
+}
+#[tokio::test]
+async fn test_should_consume_file_loaded_policy_through_bound_image_preparation() {
+    let (root, file) =
+        fixture("registry.example: {username: 'PRIVATE-USER', password: 'PRIVATE-PASSWORD'}").await;
+    let values = BTreeMap::from([
+        ("LAMBDA_DOCKER_RELAY_IMAGE", "relay:v1".to_owned()),
+        ("LAMBDA_DOCKER_NETWORK", "none".into()),
+        ("LAMBDA_DOCKER_PULL_POLICY", "ifMissing".into()),
+        ("LAMBDA_DOCKER_REGISTRIES", "registry.example".into()),
+        (
+            "LAMBDA_DOCKER_REGISTRY_AUTH_FILE",
+            file.0.to_str().unwrap().to_owned(),
+        ),
+    ]);
+    let settings = DockerRuntimeSettings::from_lookup(
+        |key| values.get(key).cloned(),
+        &RuntimeBudgets::default(),
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    let policy = settings.load_pull_policy(deadline()).await.unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let bound = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let mut images = ImageLeaseManager::start_with_pull(
+        bound,
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+        policy,
+    )
+    .unwrap();
+    let port = images.port();
+    let reference = "registry.example/fn:v1".parse().unwrap();
+    let (result, ()) = tokio::join!(
+        port.prepare(&reference, Architecture::Arm64, None, deadline()),
+        async {
+            daemon.next().await.reply(404, b"{}").await;
+            let request = daemon.next().await;
+            assert!(request.head.starts_with("POST /v1.53/images/create?"));
+            let header = request
+                .head
+                .lines()
+                .find_map(|line| {
+                    line.split_once(':')
+                        .filter(|(name, _)| name.eq_ignore_ascii_case("X-Registry-Auth"))
+                        .map(|(_, value)| value.trim())
+                })
+                .unwrap();
+            let auth: Value = from_slice(&URL_SAFE.decode(header).unwrap()).unwrap();
+            assert_eq!(auth["username"], "PRIVATE-USER");
+            assert_eq!(auth["password"], "PRIVATE-PASSWORD");
+            assert_eq!(auth["serveraddress"], "registry.example");
+            request.reply(200, b"{\"status\":\"done\"}\n").await;
+            daemon
+                .next()
+                .await
+                .reply(200, b"{\"Id\":\"invalid\"}")
+                .await;
+        }
+    );
+    assert!(result.is_err());
+    images.shutdown(deadline()).await.unwrap();
+    assert_eq!(port.status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_oversized_approved_hosts_before_worker_admission_or_io() {
+    static POOL: Semaphore = Semaphore::const_new(0);
+    let approved = (0..33)
+        .map(|i| format!("r{i}.example").parse().unwrap())
+        .collect();
+    let result = timeout(
+        Duration::from_millis(250),
+        read_owned(
+            "/missing/unreadable.yaml".into(),
+            approved,
+            deadline(),
+            &POOL,
+            |_| panic!("must reject before worker"),
+        ),
+    )
+    .await
+    .unwrap();
+    assert!(matches!(result, Err(RegistryAuthError::Configuration)));
+}
diff --git a/crates/rustack-lambda-core/src/docker/config/tests.rs b/crates/rustack-lambda-core/src/docker/config/tests.rs
new file mode 100644
index 00000000..1d235515
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/config/tests.rs
@@ -0,0 +1,285 @@
+use std::{collections::BTreeMap, time::Duration};
+
+use rstest::rstest;
+use rustack_core::settings::{RuntimeBudgets, ValidatedSettings};
+
+use super::{DockerGatewayEndpoint, DockerRuntimeSettings, RegistryAuthFile, cpu};
+
+fn settings(extra: &[(&str, &str)]) -> Result<DockerRuntimeSettings, crate::docker::DockerError> {
+    let mut values = BTreeMap::from([
+        ("LAMBDA_DOCKER_RELAY_IMAGE", "private-relay:v1"),
+        ("LAMBDA_DOCKER_NETWORK", "none"),
+    ]);
+    values.extend(extra.iter().copied());
+    DockerRuntimeSettings::from_lookup(
+        |key| values.get(key).map(|value| (*value).into()),
+        &RuntimeBudgets::default(),
+        Duration::from_secs(600),
+    )
+}
+#[rstest]
+#[case("0.1", 100_000_000)]
+#[case("1", 1_000_000_000)]
+#[case("1.234567891", 1_234_567_891)]
+#[case("16.000000000", 16_000_000_000)]
+fn test_should_convert_cpu_decimal_without_rounding(#[case] raw: &str, #[case] expected: u64) {
+    assert_eq!(cpu(raw).unwrap(), expected);
+}
+#[rstest]
+#[case("")]
+#[case("0")]
+#[case("0.099999999")]
+#[case("16.000000001")]
+#[case("1.1234567891")]
+#[case("1e0")]
+#[case("NaN")]
+#[case("+1")]
+#[case("-1")]
+#[case("1.")]
+#[case(".5")]
+#[case(" 1")]
+#[case("1..1")]
+#[case("999999999999")]
+fn test_should_reject_invalid_or_out_of_range_cpu(#[case] raw: &str) {
+    assert!(cpu(raw).is_err());
+}
+#[rstest]
+#[case("http://localhost:4566")]
+#[case("https://gateway.example")]
+#[case("http://[::1]:4566/")]
+fn test_should_validate_operator_endpoint_without_network_io(#[case] raw: &str) {
+    let endpoint: DockerGatewayEndpoint = raw.parse().unwrap();
+    assert!(!format!("{endpoint:?}").contains("localhost"));
+}
+#[rstest]
+#[case("http://user:password@localhost:4566")]
+#[case("http://@localhost:4566")]
+#[case("http://:password@localhost:4566")]
+#[case("http://localhost:0")]
+#[case("http://localhost/path")]
+#[case("http://localhost/?")]
+#[case("http://localhost/#")]
+#[case("ftp://localhost/")]
+#[case("http:localhost")]
+#[case("http://localhost\\")]
+#[case("http://localhost\n")]
+#[case(" http://localhost")]
+#[case("http://localhost ")]
+#[case("http://localhost/a/..")]
+#[case("http://localhost/%2e")]
+fn test_should_reject_ambiguous_userinfo_or_nonroot_endpoints(#[case] raw: &str) {
+    assert!(raw.parse::<DockerGatewayEndpoint>().is_err());
+}
+#[test]
+fn test_should_bound_auth_paths_and_endpoint_bytes() {
+    for raw in [
+        "relative.yaml",
+        "~/auth.yaml",
+        "/private/../auth.yaml",
+        "/",
+        "/private/auth.yaml/",
+        "/private/secret\0.yaml",
+    ] {
+        assert!(raw.parse::<RegistryAuthFile>().is_err());
+    }
+    assert!(
+        format!("/{}", "a".repeat(4096))
+            .parse::<RegistryAuthFile>()
+            .is_err()
+    );
+    assert!(
+        format!("http://{}.example/", "a".repeat(2048))
+            .parse::<DockerGatewayEndpoint>()
+            .is_err()
+    );
+    let path: RegistryAuthFile = "/private/auth.yaml".parse().unwrap();
+    assert!(!format!("{path:?}").contains("auth.yaml"));
+}
+#[test]
+fn test_should_require_explicit_runtime_sources_and_validate_every_operator_limit() {
+    assert!(
+        DockerRuntimeSettings::from_lookup(
+            |_| None,
+            &RuntimeBudgets::default(),
+            Duration::from_secs(600)
+        )
+        .is_err()
+    );
+    for (key, value) in [
+        ("LAMBDA_DOCKER_SOCKET", "tcp://localhost:2375"),
+        ("LAMBDA_DOCKER_RELAY_IMAGE", "bad image"),
+        ("LAMBDA_DOCKER_NETWORK", "host"),
+        ("LAMBDA_DOCKER_NETWORK", "bridge"),
+        ("LAMBDA_DOCKER_UID", "0"),
+        ("LAMBDA_DOCKER_GID", "2147483648"),
+        ("LAMBDA_DOCKER_UID", "+1"),
+        ("LAMBDA_DOCKER_CPU", "17"),
+        ("LAMBDA_DOCKER_LOG_RING_BYTES", "4095"),
+        ("LAMBDA_DOCKER_LOG_RING_BYTES", "1048577"),
+        ("LAMBDA_DOCKER_CROSS_ARCHITECTURE", "yes"),
+        ("LAMBDA_DOCKER_ZIP_IMAGE", "bad image"),
+        ("LAMBDA_DOCKER_GATEWAY_ENDPOINT", "http://@localhost"),
+    ] {
+        assert!(settings(&[(key, value)]).is_err(), "{key}");
+    }
+}
+#[test]
+fn test_should_capture_settings_from_existing_shared_yaml_and_redact_runtime_values() {
+    let shared = ValidatedSettings::parse(
+        "environment:\n  LAMBDA_DOCKER_RELAY_IMAGE: private-relay:v1\n  LAMBDA_DOCKER_NETWORK: \
+         none\n  LAMBDA_DOCKER_CPU: '0.125'\n  LAMBDA_DOCKER_CROSS_ARCHITECTURE: yes\nbudgets:\n  \
+         lambdaDockerPullSeconds: 600",
+        &BTreeMap::new(),
+    )
+    .unwrap();
+    let runtime = DockerRuntimeSettings::from_lookup(
+        |key| shared.get(key).map(str::to_owned),
+        shared.budgets(),
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    assert!(runtime.cross_architecture());
+    assert_eq!(runtime.budgets().lambda_docker_pull_seconds, 600);
+    assert_eq!(runtime.log_ring_bytes(), 262_144);
+    assert_eq!(runtime.relay_image().as_str(), "private-relay:v1");
+    assert!(runtime.zip_image().is_none());
+    assert!(runtime.gateway_endpoint().is_none());
+    assert!(!format!("{runtime:?}").contains("private-relay"));
+}
+#[test]
+fn test_should_require_exact_if_missing_allowlist_without_ignored_settings() {
+    for values in [
+        vec![("LAMBDA_DOCKER_REGISTRIES", "registry.example")],
+        vec![("LAMBDA_DOCKER_REGISTRY_AUTH_FILE", "/private/auth.yaml")],
+        vec![("LAMBDA_DOCKER_PULL_POLICY", "always")],
+        vec![("LAMBDA_DOCKER_PULL_POLICY", "ifMissing")],
+        vec![
+            ("LAMBDA_DOCKER_PULL_POLICY", "ifMissing"),
+            ("LAMBDA_DOCKER_REGISTRIES", ""),
+        ],
+        vec![
+            ("LAMBDA_DOCKER_PULL_POLICY", "ifMissing"),
+            (
+                "LAMBDA_DOCKER_REGISTRIES",
+                "registry.example,registry.example",
+            ),
+        ],
+        vec![
+            ("LAMBDA_DOCKER_PULL_POLICY", "ifMissing"),
+            (
+                "LAMBDA_DOCKER_REGISTRIES",
+                "registry.example, other.example",
+            ),
+        ],
+    ] {
+        assert!(settings(&values).is_err());
+    }
+    assert!(
+        settings(&[
+            ("LAMBDA_DOCKER_PULL_POLICY", "ifMissing"),
+            (
+                "LAMBDA_DOCKER_REGISTRIES",
+                "registry.example,public.ecr.aws"
+            )
+        ])
+        .is_ok()
+    );
+}
+
+#[test]
+fn test_should_bound_registry_csv_before_collecting_and_accept_full_documented_capacity() {
+    let hosts = (0..32)
+        .map(|i| {
+            format!(
+                "{i:02}{}.{}.{}.{}",
+                "a".repeat(61),
+                "b".repeat(63),
+                "c".repeat(63),
+                "d".repeat(61)
+            )
+        })
+        .collect::<Vec<_>>();
+    assert!(hosts.iter().all(|host| host.len() == 253));
+    let csv = hosts.join(",");
+    assert_eq!(csv.len(), 8127);
+    let shared = ValidatedSettings::parse(
+        "",
+        &BTreeMap::from([("LAMBDA_DOCKER_REGISTRIES".into(), csv.clone())]),
+    )
+    .unwrap();
+    assert_eq!(shared.get("LAMBDA_DOCKER_REGISTRIES"), Some(csv.as_str()));
+    assert!(
+        settings(&[
+            ("LAMBDA_DOCKER_PULL_POLICY", "ifMissing"),
+            ("LAMBDA_DOCKER_REGISTRIES", &csv)
+        ])
+        .is_ok()
+    );
+    let csv = (0..33)
+        .map(|i| format!("r{i}.example"))
+        .collect::<Vec<_>>()
+        .join(",");
+    assert!(
+        settings(&[
+            ("LAMBDA_DOCKER_PULL_POLICY", "ifMissing"),
+            ("LAMBDA_DOCKER_REGISTRIES", &csv)
+        ])
+        .is_err()
+    );
+}
+
+#[test]
+fn test_should_require_explicit_paired_sdk_settings_and_a_connected_endpoint() {
+    let pair = [
+        ("LAMBDA_DOCKER_SDK_ACCESS_KEY_ID", "private-sdk-key"),
+        ("LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY", "private-sdk-secret"),
+    ];
+    assert!(settings(&pair).is_err());
+    assert!(settings(&[("LAMBDA_DOCKER_SDK_ACCESS_KEY_ID", "private-sdk-key")]).is_err());
+    assert!(settings(&[("LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY", "private-sdk-secret")]).is_err());
+    let mut connected = pair.to_vec();
+    connected.push(("LAMBDA_DOCKER_NETWORK", "sdk-bridge"));
+    assert!(settings(&connected).is_err());
+    connected.push(("LAMBDA_DOCKER_GATEWAY_ENDPOINT", "http://127.0.0.1:4566"));
+    let configured = settings(&connected).unwrap();
+    assert!(configured.sdk_credentials().is_some());
+    assert!(!format!("{configured:?}").contains("private-sdk"));
+    let disabled =
+        settings(&[("LAMBDA_DOCKER_GATEWAY_ENDPOINT", "http://127.0.0.1:4566")]).unwrap();
+    assert!(disabled.sdk_credentials().is_none());
+}
+#[test]
+fn test_should_never_query_ambient_or_server_credentials_for_handler_sdk_settings() {
+    let configured = DockerRuntimeSettings::from_lookup(
+        |key| {
+            assert!(!matches!(
+                key,
+                "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "ACCESS_KEY" | "SECRET_KEY"
+            ));
+            match key {
+                "LAMBDA_DOCKER_RELAY_IMAGE" => Some("relay:v1".into()),
+                "LAMBDA_DOCKER_NETWORK" => Some("none".into()),
+                _ => None,
+            }
+        },
+        &RuntimeBudgets::default(),
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    assert!(configured.sdk_credentials().is_none());
+}
+#[test]
+fn test_should_accept_explicit_sdk_pair_through_the_existing_yaml_schema() {
+    let shared = ValidatedSettings::parse(
+        "environment:\n  LAMBDA_DOCKER_RELAY_IMAGE: relay:v1\n  LAMBDA_DOCKER_NETWORK: sdk-bridge\n  LAMBDA_DOCKER_GATEWAY_ENDPOINT: http://127.0.0.1:4566\n  LAMBDA_DOCKER_SDK_ACCESS_KEY_ID: private-sdk-key\n  LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY: private-sdk-secret\n",
+        &BTreeMap::new(),
+    ).unwrap();
+    let configured = DockerRuntimeSettings::from_lookup(
+        |key| shared.get(key).map(str::to_owned),
+        shared.budgets(),
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    assert!(configured.sdk_credentials().is_some());
+    assert!(!format!("{shared:?} {configured:?}").contains("private-sdk"));
+}
diff --git a/crates/rustack-lambda-core/src/docker/connection.rs b/crates/rustack-lambda-core/src/docker/connection.rs
new file mode 100644
index 00000000..dfb913b8
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/connection.rs
@@ -0,0 +1,394 @@
+//! One owned Unix HTTP exchange; the driver is joined on every outcome.
+
+use std::{future::pending, path::Path, sync::Arc};
+
+use bytes::Bytes;
+use http::{
+    HeaderValue, Method, Request, Response, StatusCode,
+    header::{
+        CONNECTION, CONTENT_ENCODING, CONTENT_LENGTH, CONTENT_TYPE, HOST, TRANSFER_ENCODING,
+        UPGRADE,
+    },
+};
+use http_body_util::{BodyExt, Full};
+use hyper::{
+    body::Incoming,
+    client::conn::http1::{Builder, SendRequest},
+    upgrade::on,
+};
+use hyper_util::rt::TokioIo;
+use rustack_lambda_runtime::diagnostics::runtime_dispatch;
+use secrecy::ExposeSecret;
+use tokio::{
+    net::UnixStream,
+    sync::watch,
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use tracing::instrument::WithSubscriber;
+
+use super::{
+    DockerError, MAX_BODY_BYTES, Operation, RawReply, RawRequest,
+    binding::{DaemonBinding, DaemonIdentity},
+    check_deadline,
+    pull::progress::{MAX_TOTAL, Progress},
+};
+
+pub(super) async fn exchange(
+    path: &Path,
+    mut request: RawRequest,
+    deadline: Instant,
+    mut stop: watch::Receiver<bool>,
+) -> Result<RawReply, DockerError> {
+    // Keep the typed buffer reservation through HTTP-driver settlement, even
+    // after prepare_request transfers its byte view to Hyper.
+    let _archive = request.archive.take();
+    // The exchange retains directory exclusion through every driver-join outcome.
+    let binding = request.binding.take();
+    let mut pull_stop = request.pull.as_ref().map(|transfer| transfer.stop.clone());
+    let mut pull_cancel = request
+        .pull
+        .as_ref()
+        .map(|transfer| transfer.cancel.clone());
+    if Instant::now() >= deadline {
+        return Err(DockerError::Deadline);
+    }
+    let connected = async {
+        let stream = UnixStream::connect(path).await?;
+        let pair = Builder::new()
+            .max_headers(64)
+            .max_buf_size(16 * 1024)
+            .handshake::<_, Full<Bytes>>(TokioIo::new(stream))
+            .await?;
+        Ok::<_, DockerError>(pair)
+    };
+    let (mut sender, connection) = tokio::select! {
+        biased;
+        () = stopped(&mut stop) => return Err(DockerError::Stopped),
+        error = pull_cancelled(&mut pull_stop,&mut pull_cancel) => return Err(error),
+        result = timeout_at(deadline, connected) => result.map_err(|_| DockerError::Deadline)??,
+    };
+    if Instant::now() >= deadline {
+        return Err(DockerError::Deadline);
+    }
+    if *stop.borrow() {
+        return Err(DockerError::Stopped);
+    }
+    let expected = request.expected;
+    let pulling = request.pull.is_some();
+    let upgraded = request.expected == StatusCode::SWITCHING_PROTOCOLS;
+    let mut driver = tokio::spawn(
+        async move {
+            if upgraded {
+                connection.with_upgrades().await
+            } else {
+                // This fresh connection is never reused. Recover/drop its owned IO
+                // instead of half-closing an already-disconnected Unix socket.
+                connection.without_shutdown().await.map(drop)
+            }
+        }
+        .with_subscriber(runtime_dispatch()),
+    );
+    let operation_stop = stop.clone();
+    let operation = async {
+        if let Some(binding) = &binding {
+            check_identity(&mut sender, binding, deadline)
+                .await
+                .map_err(|source| DockerError::IdentityCheck(Arc::new(source)))?;
+            sender.ready().await?;
+        }
+        check_deadline(deadline)?;
+        if *operation_stop.borrow() {
+            return Err(DockerError::Stopped);
+        }
+        let mut request = request;
+        let mut mutation = request.mutation.take();
+        let request = prepare_request(request, upgraded)?;
+        if let Some(mutation) = &mut mutation {
+            mutation.issued();
+        }
+        let response = sender.send_request(request).await?;
+        if pulling {
+            read_pull(response, deadline).await
+        } else {
+            read_response(response, expected, deadline).await
+        }
+    };
+    let outcome = tokio::select! {
+        biased;
+        () = stopped(&mut stop) => Err(DockerError::Stopped),
+        error = pull_cancelled(&mut pull_stop,&mut pull_cancel) => Err(error),
+        result = timeout_at(deadline, operation) => result.map_err(|_| DockerError::Deadline).and_then(|result| result),
+    };
+    drop(sender);
+    let successful_upgrade = matches!(&outcome, Ok(RawReply::Upgrade(_)));
+    let joined = join_driver(&mut driver, deadline, successful_upgrade, &mut stop).await;
+    if matches!(&joined, Err(DockerError::Worker)) {
+        drop(outcome);
+        return Err(DockerError::Worker);
+    }
+    if Instant::now() >= deadline {
+        drop(outcome);
+        return Err(DockerError::Deadline);
+    }
+    if *stop.borrow() {
+        drop(outcome);
+        return Err(DockerError::Stopped);
+    }
+    match (outcome, joined) {
+        (Ok(reply), Ok(())) => Ok(reply),
+        (Err(error), _) | (_, Err(error)) => Err(error),
+    }
+}
+
+fn prepare_request(
+    request: RawRequest,
+    upgraded: bool,
+) -> Result<Request<Full<Bytes>>, DockerError> {
+    let mut builder = Request::builder()
+        .method(request.method)
+        .uri(request.target)
+        .header(HOST, "docker")
+        .header(CONTENT_LENGTH, request.body.len())
+        .header(CONNECTION, if upgraded { "Upgrade" } else { "close" });
+    if upgraded {
+        builder = builder.header(UPGRADE, "tcp");
+    }
+    if !request.body.is_empty() {
+        builder = builder.header(
+            CONTENT_TYPE,
+            if matches!(request.operation, Operation::UploadCode) {
+                "application/x-tar"
+            } else {
+                "application/json"
+            },
+        );
+    }
+    if let Some(auth) = request
+        .pull
+        .as_ref()
+        .and_then(|transfer| transfer.auth.as_ref())
+    {
+        let mut header =
+            HeaderValue::from_str(auth.expose_secret()).map_err(|_| DockerError::Configuration)?;
+        header.set_sensitive(true);
+        builder = builder.header("X-Registry-Auth", header);
+    }
+    builder
+        .body(Full::new(request.body))
+        .map_err(|_| DockerError::Protocol)
+}
+
+async fn pull_cancelled(
+    stop: &mut Option<watch::Receiver<bool>>,
+    cancel: &mut Option<watch::Receiver<()>>,
+) -> DockerError {
+    tokio::select! { biased;
+        () = async { match stop {Some(stop)=>stopped(stop).await,None=>pending().await} } => DockerError::Stopped,
+        () = async { match cancel {Some(cancel)=>{let _=cancel.changed().await;},None=>pending().await} } => DockerError::Cancelled,
+    }
+}
+async fn read_pull(
+    response: Response<Incoming>,
+    deadline: Instant,
+) -> Result<RawReply, DockerError> {
+    if response.status() != StatusCode::OK {
+        return read_response(response, StatusCode::OK, deadline).await;
+    }
+    check_headers_limit(&response, MAX_TOTAL)?;
+    let mut body = response.into_body();
+    let mut progress = Progress::default();
+    let mut quantum = 0_u8;
+    while let Some(frame) = body.frame().await {
+        check_deadline(deadline)?;
+        let data = frame?.into_data().map_err(|_| DockerError::Protocol)?;
+        progress.push(&data)?;
+        quantum = quantum.saturating_add(1);
+        if quantum == 64 {
+            tokio::task::yield_now().await;
+            quantum = 0;
+        }
+    }
+    progress.finish()?;
+    Ok(RawReply::Pulled)
+}
+
+async fn check_identity(
+    sender: &mut SendRequest<Full<Bytes>>,
+    binding: &DaemonBinding,
+    deadline: Instant,
+) -> Result<(), DockerError> {
+    let request = Request::builder()
+        .method(Method::GET)
+        .uri("/info")
+        .header(HOST, "docker")
+        .header(CONTENT_LENGTH, 0)
+        .header(CONNECTION, "keep-alive")
+        .body(Full::new(Bytes::new()))
+        .map_err(|_| DockerError::Protocol)?;
+    let response = sender.send_request(request).await?;
+    let reply = read_response(response, StatusCode::OK, deadline).await?;
+    if DaemonIdentity::decode(reply, deadline)? != binding.identity {
+        return Err(DockerError::DaemonBinding);
+    }
+    Ok(())
+}
+
+async fn read_response(
+    response: Response<Incoming>,
+    expected: StatusCode,
+    deadline: Instant,
+) -> Result<RawReply, DockerError> {
+    let upgraded = expected == StatusCode::SWITCHING_PROTOCOLS;
+    check_headers(&response)?;
+    let status = response.status();
+    if upgraded && status == StatusCode::SWITCHING_PROTOCOLS {
+        let headers = response.headers();
+        if !headers
+            .get(UPGRADE)
+            .is_some_and(|value| value.as_bytes().eq_ignore_ascii_case(b"tcp"))
+            || !headers
+                .get(CONNECTION)
+                .and_then(|value| value.to_str().ok())
+                .is_some_and(|value| {
+                    value
+                        .split(',')
+                        .any(|token| token.trim().eq_ignore_ascii_case("upgrade"))
+                })
+            || headers.contains_key(TRANSFER_ENCODING)
+            || headers
+                .get(CONTENT_LENGTH)
+                .is_some_and(|value| value.as_bytes() != b"0")
+        {
+            return Err(DockerError::Protocol);
+        }
+        return Ok(RawReply::Upgrade(TokioIo::new(on(response).await?)));
+    }
+    if status == StatusCode::SWITCHING_PROTOCOLS {
+        return Err(DockerError::Protocol);
+    }
+    let body = collect(response.into_body(), deadline).await?;
+    if status != expected {
+        return Err(DockerError::Status(status));
+    }
+    Ok(RawReply::Body {
+        status,
+        bytes: body,
+    })
+}
+
+async fn join_driver(
+    driver: &mut JoinHandle<Result<(), hyper::Error>>,
+    deadline: Instant,
+    upgraded: bool,
+    stop: &mut watch::Receiver<bool>,
+) -> Result<(), DockerError> {
+    if upgraded {
+        let joined = tokio::select! {
+            biased;
+            () = stopped(stop) => None,
+            result = timeout_at(deadline, &mut *driver) => result.ok(),
+        };
+        if let Some(result) = joined {
+            return result
+                .map_err(|_| DockerError::Worker)?
+                .map_err(DockerError::from);
+        }
+    }
+    // Hyper connection IO is cancel-safe. Abort is followed by an actual join;
+    // it never replaces ownership of a container or an external backend job.
+    driver.abort();
+    match driver.await {
+        Ok(result) => result.map_err(DockerError::from),
+        Err(error) if error.is_cancelled() => Ok(()),
+        Err(_) => Err(DockerError::Worker),
+    }
+}
+
+pub(super) async fn stopped(stop: &mut watch::Receiver<bool>) {
+    let _ = stop.wait_for(|stop| *stop).await;
+}
+
+fn check_headers(response: &Response<Incoming>) -> Result<(), DockerError> {
+    check_headers_limit(response, MAX_BODY_BYTES)
+}
+fn check_headers_limit(response: &Response<Incoming>, max_bytes: usize) -> Result<(), DockerError> {
+    let headers = response.headers();
+    if headers.len() > 64 {
+        return Err(DockerError::TooLarge);
+    }
+    let mut total = 0_usize;
+    for (name, value) in headers {
+        total = total
+            .checked_add(name.as_str().len())
+            .and_then(|length| length.checked_add(value.as_bytes().len()))
+            .ok_or(DockerError::TooLarge)?;
+        if name.as_str().len() > 64 || value.as_bytes().len() > 4096 || total > 16 * 1024 {
+            return Err(DockerError::TooLarge);
+        }
+        if !value
+            .as_bytes()
+            .iter()
+            .all(|byte| *byte == b'\t' || (32..=126).contains(byte))
+        {
+            return Err(DockerError::Protocol);
+        }
+    }
+    if headers.get_all(CONTENT_LENGTH).iter().count() > 1 {
+        return Err(DockerError::Protocol);
+    }
+    if let Some(value) = headers.get(CONTENT_LENGTH) {
+        let value = value.to_str().map_err(|_| DockerError::Protocol)?;
+        if value.is_empty() || value.len() > 20 || !value.bytes().all(|byte| byte.is_ascii_digit())
+        {
+            return Err(DockerError::Protocol);
+        }
+        if value.parse::<u64>().map_err(|_| DockerError::Protocol)?
+            > u64::try_from(max_bytes).map_err(|_| DockerError::TooLarge)?
+        {
+            return Err(DockerError::TooLarge);
+        }
+    }
+    if headers
+        .get(CONTENT_ENCODING)
+        .is_some_and(|value| !value.as_bytes().eq_ignore_ascii_case(b"identity"))
+    {
+        return Err(DockerError::Protocol);
+    }
+    if headers
+        .get(TRANSFER_ENCODING)
+        .is_some_and(|value| !value.as_bytes().eq_ignore_ascii_case(b"chunked"))
+    {
+        return Err(DockerError::Protocol);
+    }
+    Ok(())
+}
+
+async fn collect(mut body: Incoming, deadline: Instant) -> Result<Bytes, DockerError> {
+    let mut output = Vec::new();
+    let mut quantum = 0_u8;
+    while let Some(frame) = body.frame().await {
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        let frame = frame?;
+        let data = frame.into_data().map_err(|_| DockerError::Protocol)?;
+        let length = output
+            .len()
+            .checked_add(data.len())
+            .ok_or(DockerError::TooLarge)?;
+        if length > MAX_BODY_BYTES {
+            return Err(DockerError::TooLarge);
+        }
+        output
+            .try_reserve(data.len())
+            .map_err(|_| DockerError::Allocation)?;
+        output.extend_from_slice(&data);
+        quantum = quantum.saturating_add(1);
+        if quantum == 64 {
+            tokio::task::yield_now().await;
+            quantum = 0;
+        }
+    }
+    Ok(Bytes::from(output))
+}
diff --git a/crates/rustack-lambda-core/src/docker/environment/actor.rs b/crates/rustack-lambda-core/src/docker/environment/actor.rs
new file mode 100644
index 00000000..47f0010a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/actor.rs
@@ -0,0 +1,479 @@
+//! Root registry owns reservations above workers and their recovery jobs.
+
+use std::{
+    collections::HashMap,
+    mem,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use rustack_lambda_runtime::{diagnostics::runtime_dispatch, protocol::EnvironmentId};
+use tokio::{
+    runtime::Handle,
+    sync::{OwnedSemaphorePermit, Semaphore, mpsc, watch},
+    task::{Id, JoinError, JoinSet},
+    time::{Instant, sleep},
+};
+use tracing::instrument::WithSubscriber;
+use typed_builder::TypedBuilder;
+
+use super::{
+    Call, EnvironmentConfig, EnvironmentError, EnvironmentPhase, EnvironmentStatus,
+    cleanup::{Cleaner, Progress},
+    worker::Worker,
+};
+use crate::{
+    docker::{DockerPort, EnvironmentPlan, zip::AllocationClaim},
+    executor::ExecutorError,
+    invocation::CleanupTask,
+};
+
+pub(super) struct Health {
+    control: watch::Sender<bool>,
+    pub(super) failed: AtomicBool,
+    pub(super) quarantined: AtomicUsize,
+}
+impl Default for Health {
+    fn default() -> Self {
+        Self::new(watch::channel(false).0)
+    }
+}
+impl Health {
+    pub(super) fn new(control: watch::Sender<bool>) -> Self {
+        Self {
+            control,
+            failed: AtomicBool::new(false),
+            quarantined: AtomicUsize::new(0),
+        }
+    }
+    pub(super) fn fail(&self) {
+        self.failed.store(true, Ordering::Release);
+        self.control.send_replace(true);
+    }
+}
+pub(super) struct Budget {
+    capacity: Arc<Semaphore>,
+    maximum: usize,
+    pub(super) memory: AtomicU64,
+    limit: u64,
+}
+impl Budget {
+    pub(super) fn new(config: EnvironmentConfig) -> Self {
+        let maximum = usize::from(config.0.environments);
+        Self {
+            capacity: Arc::new(Semaphore::new(maximum)),
+            maximum,
+            memory: AtomicU64::new(0),
+            limit: config.0.memory_bytes,
+        }
+    }
+    pub(super) fn count(&self) -> usize {
+        self.maximum
+            .saturating_sub(self.capacity.available_permits())
+    }
+    pub(super) fn check_memory(&self, memory: u64) -> Result<(), EnvironmentError> {
+        if memory > self.limit {
+            Err(EnvironmentError::MemoryLimit)
+        } else {
+            Ok(())
+        }
+    }
+    pub(super) fn reserve(self: &Arc<Self>, memory: u64) -> Result<Reservation, EnvironmentError> {
+        self.check_memory(memory)?;
+        let permit = self
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| EnvironmentError::Busy)?;
+        self.memory
+            .try_update(Ordering::AcqRel, Ordering::Acquire, |current| {
+                current
+                    .checked_add(memory)
+                    .filter(|total| *total <= self.limit)
+            })
+            .map_err(|_| EnvironmentError::Busy)?;
+        Ok(Reservation {
+            _permit: permit,
+            memory,
+            budget: self.clone(),
+        })
+    }
+}
+pub(super) struct Reservation {
+    _permit: OwnedSemaphorePermit,
+    memory: u64,
+    budget: Arc<Budget>,
+}
+impl Drop for Reservation {
+    fn drop(&mut self) {
+        self.budget.memory.fetch_sub(self.memory, Ordering::AcqRel);
+    }
+}
+#[derive(Clone)]
+pub(super) struct Signals {
+    pub(super) status: watch::Sender<EnvironmentStatus>,
+    pub(super) stop: watch::Sender<bool>,
+}
+impl Signals {
+    pub(super) fn new() -> Self {
+        Self {
+            status: watch::channel(EnvironmentStatus {
+                phase: EnvironmentPhase::Allocating,
+                error: None,
+            })
+            .0,
+            stop: watch::channel(false).0,
+        }
+    }
+    pub(super) fn phase(&self, phase: EnvironmentPhase) {
+        self.status.send_modify(|status| status.phase = phase);
+    }
+    pub(super) fn error(&self, error: EnvironmentError) {
+        self.status.send_modify(|status| {
+            if status.error.is_none() {
+                status.error = Some(error);
+            }
+        });
+    }
+    fn worker_failed(&self) {
+        self.stop.send_replace(true);
+        self.status.send_modify(|status| {
+            status.phase = EnvironmentPhase::Retiring;
+            status.error = Some(EnvironmentError::Worker);
+        });
+    }
+}
+#[derive(TypedBuilder)]
+pub(super) struct Envelope {
+    #[builder(default)]
+    pub(super) code_claim: Option<AllocationClaim>,
+    pub(super) plan: Arc<EnvironmentPlan>,
+    pub(super) mailbox: mpsc::Receiver<Call>,
+    pub(super) signals: Signals,
+    pub(super) reservation: Reservation,
+    pub(super) done: watch::Sender<Option<Result<(), EnvironmentError>>>,
+    pub(super) deadline: Instant,
+}
+pub(super) struct Record {
+    pub(super) plan: Arc<EnvironmentPlan>,
+    pub(super) progress: Arc<Progress>,
+    pub(super) io: Arc<CleanupTask>,
+    pub(super) signals: Signals,
+    pub(super) done: watch::Sender<Option<Result<(), EnvironmentError>>>,
+    _reservation: Reservation,
+}
+impl Record {
+    fn recovery(&self) -> Recovery {
+        Recovery {
+            plan: self.plan.clone(),
+            progress: self.progress.clone(),
+            io: self.io.clone(),
+            signals: self.signals.clone(),
+            done: self.done.clone(),
+        }
+    }
+}
+pub(super) struct Recovery {
+    pub(super) plan: Arc<EnvironmentPlan>,
+    pub(super) progress: Arc<Progress>,
+    pub(super) io: Arc<CleanupTask>,
+    pub(super) signals: Signals,
+    pub(super) done: watch::Sender<Option<Result<(), EnvironmentError>>>,
+}
+impl Recovery {
+    async fn run(
+        self,
+        docker: DockerPort,
+        config: EnvironmentConfig,
+        health: Arc<Health>,
+        cleanup: Arc<Semaphore>,
+    ) {
+        let cleaner = Cleaner::builder()
+            .docker(docker)
+            .config(config)
+            .plan(self.plan)
+            .progress(self.progress)
+            .health(health)
+            .cleanup(cleanup)
+            .signals(self.signals.clone())
+            .build();
+        cleaner.retire(&self.io, None).await;
+        self.signals.phase(EnvironmentPhase::Removed);
+        self.done.send_replace(Some(Err(EnvironmentError::Worker)));
+    }
+}
+
+type Job = (EnvironmentId, Result<(), EnvironmentError>);
+type Joined = Result<(Id, Job), JoinError>;
+#[derive(TypedBuilder)]
+pub(super) struct Actor {
+    docker: DockerPort,
+    config: EnvironmentConfig,
+    inbox: mpsc::Receiver<Envelope>,
+    control: watch::Sender<bool>,
+    health: Arc<Health>,
+    runtime: Handle,
+    emergency: Arc<CleanupTask>,
+    #[builder(default = Arc::new(Semaphore::new(2)))]
+    cleanup: Arc<Semaphore>,
+    #[builder(default)]
+    jobs: JoinSet<Job>,
+    #[builder(default)]
+    records: HashMap<EnvironmentId, Record>,
+    #[builder(default)]
+    index: HashMap<Id, (EnvironmentId, bool)>,
+    #[builder(default)]
+    settled: bool,
+}
+impl Actor {
+    pub(super) async fn run(mut self) -> Result<(), EnvironmentError> {
+        let mut stopped = self.control.subscribe();
+        let mut wire = self.docker.raw.stop.subscribe();
+        loop {
+            if *stopped.borrow() {
+                self.inbox.close();
+                while let Ok(envelope) = self.inbox.try_recv() {
+                    let failed = self.health.failed.load(Ordering::Acquire);
+                    envelope.signals.error(if failed {
+                        EnvironmentError::Worker
+                    } else {
+                        EnvironmentError::Stopped
+                    });
+                    envelope.signals.phase(EnvironmentPhase::Removed);
+                    envelope.done.send_replace(Some(if failed {
+                        Err(EnvironmentError::Worker)
+                    } else {
+                        Ok(())
+                    }));
+                }
+                for record in self.records.values() {
+                    if self.health.failed.load(Ordering::Acquire) {
+                        record.signals.worker_failed();
+                    } else {
+                        record.signals.stop.send_replace(true);
+                    }
+                }
+                if self.jobs.is_empty() {
+                    break;
+                }
+                if let Some(result) = self.jobs.join_next_with_id().await {
+                    self.finished(&result);
+                }
+                continue;
+            }
+            tokio::select! {biased;
+                _=wire.wait_for(|stop|*stop)=>{self.fail();},
+                _=stopped.wait_for(|stop|*stop)=>{},
+                result=self.jobs.join_next_with_id(),if !self.jobs.is_empty()=>if let Some(result)=result{self.finished(&result);},
+                envelope=self.inbox.recv()=>match envelope{Some(envelope)=>self.start(envelope),None=>{self.control.send_replace(true);}},
+            }
+        }
+        self.settled = true;
+        if self.health.failed.load(Ordering::Acquire) {
+            Err(EnvironmentError::Worker)
+        } else {
+            Ok(())
+        }
+    }
+    fn start(&mut self, mut envelope: Envelope) {
+        if *self.control.borrow()
+            || *envelope.signals.stop.borrow()
+            || Instant::now() >= envelope.deadline
+        {
+            envelope.signals.error(EnvironmentError::Stopped);
+            envelope.signals.phase(EnvironmentPhase::Removed);
+            envelope.done.send_replace(Some(Ok(())));
+            return;
+        }
+        let id = envelope.plan.environment_id();
+        if self.records.contains_key(&id) {
+            self.fail();
+            envelope.signals.error(EnvironmentError::Worker);
+            envelope
+                .done
+                .send_replace(Some(Err(EnvironmentError::Worker)));
+            return;
+        }
+        if let Err(error) = envelope.plan.commit_code_claim(&mut envelope.code_claim) {
+            envelope.signals.error(error.into());
+            envelope.signals.phase(EnvironmentPhase::Removed);
+            envelope.done.send_replace(Some(Ok(())));
+            return;
+        }
+        let progress = Arc::new(Progress::new());
+        let io = Arc::new(CleanupTask::default());
+        let worker = Worker::builder()
+            .docker(self.docker.clone())
+            .config(self.config)
+            .plan(envelope.plan.clone())
+            .progress(progress.clone())
+            .cleanup(self.cleanup.clone())
+            .health(self.health.clone())
+            .signals(envelope.signals.clone())
+            .global(self.control.clone())
+            .io(io.clone())
+            .runtime(self.runtime.clone())
+            .build();
+        self.records.insert(
+            id,
+            Record {
+                plan: envelope.plan,
+                progress,
+                io,
+                signals: envelope.signals,
+                done: envelope.done,
+                _reservation: envelope.reservation,
+            },
+        );
+        let job = self.jobs.spawn(
+            async move { (id, worker.run(envelope.mailbox, envelope.deadline).await) }
+                .with_subscriber(runtime_dispatch()),
+        );
+        self.index.insert(job.id(), (id, false));
+    }
+    fn finished(&mut self, result: &Joined) {
+        let task = match &result {
+            Ok((task, _)) => *task,
+            Err(error) => error.id(),
+        };
+        let Some((id, recovering)) = self.index.remove(&task) else {
+            self.fail();
+            return;
+        };
+        let clean = self
+            .records
+            .get(&id)
+            .is_some_and(|record| record.progress.clean() && record.plan.code_clean());
+        if matches!(&result,Ok((_,(returned,Ok(())))) if *returned==id) && clean {
+            if let Some(record) = self.records.remove(&id) {
+                let failed = recovering || self.health.failed.load(Ordering::Acquire);
+                if failed {
+                    record.signals.worker_failed();
+                }
+                record.signals.phase(EnvironmentPhase::Removed);
+                record.done.send_replace(Some(if failed {
+                    Err(EnvironmentError::Worker)
+                } else {
+                    Ok(())
+                }));
+            }
+            return;
+        }
+        self.fail();
+        let Some(record) = self.records.get(&id) else {
+            return;
+        };
+        record.signals.worker_failed();
+        let recovery = record.recovery();
+        let docker = self.docker.clone();
+        let config = self.config;
+        let health = self.health.clone();
+        let cleanup = self.cleanup.clone();
+        let job = self.jobs.spawn(async move {
+            if recovering {
+                sleep(Duration::from_secs(1)).await;
+            }
+            recovery.run(docker, config, health, cleanup).await;
+            (id, Ok(()))
+        });
+        self.index.insert(job.id(), (id, true));
+    }
+    fn fail(&self) {
+        self.health.fail();
+        self.control.send_replace(true);
+    }
+}
+impl Drop for Actor {
+    fn drop(&mut self) {
+        if !self.settled {
+            self.fail();
+        }
+        while let Ok(envelope) = self.inbox.try_recv() {
+            envelope.signals.worker_failed();
+            envelope.signals.phase(EnvironmentPhase::Removed);
+            envelope
+                .done
+                .send_replace(Some(Err(EnvironmentError::Worker)));
+        }
+        if self.records.is_empty() {
+            return;
+        }
+        self.fail();
+        for record in self.records.values() {
+            record.signals.worker_failed();
+        }
+        let records = mem::take(&mut self.records);
+        let mut jobs = mem::take(&mut self.jobs);
+        jobs.abort_all();
+        let docker = self.docker.clone();
+        let config = self.config;
+        let health = self.health.clone();
+        let cleanup = self.cleanup.clone();
+        self.emergency.start_on(&self.runtime, move || async move {
+            while jobs.join_next().await.is_some() {}
+            recover_all(records, docker, config, health, cleanup).await
+        });
+    }
+}
+async fn recover_all(
+    mut records: HashMap<EnvironmentId, Record>,
+    docker: DockerPort,
+    config: EnvironmentConfig,
+    health: Arc<Health>,
+    cleanup: Arc<Semaphore>,
+) -> Result<(), ExecutorError> {
+    let mut jobs = JoinSet::new();
+    let mut index = HashMap::new();
+    for (id, record) in &records {
+        let id = *id;
+        let recovery = record.recovery();
+        let docker = docker.clone();
+        let health = health.clone();
+        let cleanup = cleanup.clone();
+        let job = jobs.spawn(async move {
+            recovery.run(docker, config, health, cleanup).await;
+            id
+        });
+        index.insert(job.id(), id);
+    }
+    while let Some(result) = jobs.join_next_with_id().await {
+        let task = match &result {
+            Ok((task, _)) => *task,
+            Err(error) => error.id(),
+        };
+        let Some(id) = index.remove(&task) else {
+            continue;
+        };
+        if matches!(result,Ok((_,returned)) if returned==id)
+            && records
+                .get(&id)
+                .is_some_and(|record| record.progress.clean() && record.plan.code_clean())
+        {
+            records.remove(&id);
+            continue;
+        }
+        let Some(record) = records.get(&id) else {
+            continue;
+        };
+        let recovery = record.recovery();
+        let docker = docker.clone();
+        let health = health.clone();
+        let cleanup = cleanup.clone();
+        let job = jobs.spawn(async move {
+            sleep(Duration::from_secs(1)).await;
+            recovery.run(docker, config, health, cleanup).await;
+            id
+        });
+        index.insert(job.id(), id);
+    }
+    if records.is_empty() {
+        Ok(())
+    } else {
+        Err(ExecutorError::CleanupFailed(
+            "Environment recovery lost ownership".into(),
+        ))
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/environment/cleanup.rs b/crates/rustack-lambda-core/src/docker/environment/cleanup.rs
new file mode 100644
index 00000000..f4b6e714
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/cleanup.rs
@@ -0,0 +1,266 @@
+//! Phase-aware ID-only cleanup; uncertain create absence never grants settlement.
+
+use std::{
+    sync::{Arc, atomic::Ordering},
+    time::Duration,
+};
+
+use http::StatusCode;
+use tokio::{
+    sync::{Semaphore, watch},
+    time::sleep,
+};
+use typed_builder::TypedBuilder;
+
+use super::{
+    EnvironmentConfig, EnvironmentError, EnvironmentPhase,
+    actor::{Health, Signals},
+    io::IoGuard,
+};
+use crate::{
+    docker::{
+        DockerError, DockerKey, DockerPort, EnvironmentPlan, models::ContainerInspectResponse,
+        mutation::MutationReceipt, ownership::ContainerRecord, plan::ContainerRole,
+    },
+    invocation::CleanupTask,
+};
+
+#[derive(Debug, Clone)]
+pub(super) enum Phase {
+    Unissued,
+    Uncertain(MutationReceipt),
+    Known(DockerKey),
+    Clean,
+}
+#[derive(Debug)]
+pub(super) struct Progress {
+    pub(super) relay: watch::Sender<Phase>,
+    pub(super) function: watch::Sender<Phase>,
+}
+impl Progress {
+    pub(super) fn new() -> Self {
+        Self {
+            relay: watch::channel(Phase::Unissued).0,
+            function: watch::channel(Phase::Unissued).0,
+        }
+    }
+    pub(super) fn phase(&self, role: ContainerRole) -> &watch::Sender<Phase> {
+        match role {
+            ContainerRole::Relay => &self.relay,
+            ContainerRole::Function => &self.function,
+        }
+    }
+    pub(super) fn clean(&self) -> bool {
+        [&self.relay, &self.function]
+            .iter()
+            .all(|phase| matches!(*phase.borrow(), Phase::Unissued | Phase::Clean))
+    }
+}
+
+#[derive(TypedBuilder)]
+pub(super) struct Cleaner {
+    pub(super) docker: DockerPort,
+    pub(super) config: EnvironmentConfig,
+    pub(super) plan: Arc<EnvironmentPlan>,
+    pub(super) progress: Arc<Progress>,
+    pub(super) health: Arc<Health>,
+    pub(super) cleanup: Arc<Semaphore>,
+    pub(super) signals: Signals,
+}
+impl Cleaner {
+    async fn settled(&self, role: ContainerRole) -> bool {
+        let Ok(record) = ContainerRecord::from_plan(&self.plan, role) else {
+            return false;
+        };
+        if self
+            .plan
+            .directory
+            .settle_container(record, self.config.deadline())
+            .await
+            .is_err()
+        {
+            return false;
+        }
+        self.progress.phase(role).send_replace(Phase::Clean);
+        true
+    }
+    pub(super) async fn container(&self, role: ContainerRole) -> bool {
+        let phase = self.progress.phase(role).borrow().clone();
+        let id = match phase {
+            Phase::Unissued | Phase::Clean => return self.settled(role).await,
+            Phase::Known(id) => id,
+            Phase::Uncertain(receipt) => {
+                if receipt.definitely_unissued() {
+                    return self.settled(role).await;
+                }
+
+                let Ok(inspected) = self
+                    .docker
+                    .inspect_container(self.plan.key(role), self.config.deadline())
+                    .await
+                else {
+                    return false;
+                };
+                let Ok(id) = self.plan.owned(role, &inspected) else {
+                    return false;
+                };
+                let Ok(record) = ContainerRecord::from_plan(&self.plan, role) else {
+                    return false;
+                };
+                if self
+                    .plan
+                    .directory
+                    .know_container(record, id.clone(), self.config.deadline())
+                    .await
+                    .is_err()
+                {
+                    return false;
+                }
+                self.progress
+                    .phase(role)
+                    .send_replace(Phase::Known(id.clone()));
+                id
+            }
+        };
+        let Ok(_permit) = self.cleanup.acquire().await else {
+            return false;
+        };
+        let inspected = match self
+            .docker
+            .inspect_container(&id, self.config.deadline())
+            .await
+        {
+            Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+                return self.settled(role).await;
+            }
+            Ok(inspected) => inspected,
+            Err(_) => return false,
+        };
+        if self.plan.owned(role, &inspected).is_err()
+            || inspected.id.as_deref() != Some(id.as_str())
+        {
+            return false;
+        }
+        let Some(state) = inspected.state else {
+            return false;
+        };
+        match state.running {
+            Some(true) => {
+                let _ = self
+                    .docker
+                    .kill_container(&id, self.config.deadline())
+                    .await;
+                let waited = self
+                    .docker
+                    .wait_container(&id, self.config.deadline())
+                    .await;
+                if !matches!(waited,Ok(ref exit) if exit.error.is_none()) {
+                    return false;
+                }
+            }
+            Some(false) => {}
+            None => return false,
+        }
+        let _ = self
+            .docker
+            .remove_container(&id, self.config.deadline())
+            .await;
+        if matches!(
+            self.docker
+                .inspect_container(&id, self.config.deadline())
+                .await,
+            Err(DockerError::Status(StatusCode::NOT_FOUND))
+        ) {
+            self.settled(role).await
+        } else {
+            false
+        }
+    }
+    pub(super) async fn retire(&self, io: &CleanupTask, mut streams: Option<&mut IoGuard>) {
+        let mut dirty = None;
+        let mut delay = Duration::from_secs(1);
+        loop {
+            let function = self.container(ContainerRole::Function).await;
+            if function {
+                if let Some(streams) = streams.take() {
+                    streams.begin_cleanup();
+                }
+            }
+            let joined = if function { io.wait().await } else { Ok(()) };
+            let code = if let Some(zip) = &self.plan.zip {
+                if function && joined.is_ok() {
+                    match zip.retire(self.config.deadline()).await {
+                        Ok(failed) => {
+                            if failed {
+                                self.health.fail();
+                            }
+                            true
+                        }
+                        Err(_) => false,
+                    }
+                } else {
+                    false
+                }
+            } else {
+                true
+            };
+            let relay = if function && code {
+                self.container(ContainerRole::Relay).await
+            } else {
+                false
+            };
+            if function && relay && code && joined.is_ok() {
+                return;
+            }
+            if joined.is_err() {
+                self.health.fail();
+            }
+            if dirty.is_none() {
+                dirty = Some(Dirty::new(self.health.clone()));
+            }
+            self.signals.phase(EnvironmentPhase::Quarantined);
+            sleep(delay).await;
+            delay = delay.saturating_mul(2).min(Duration::from_secs(30));
+        }
+    }
+    pub(super) async fn inspect_health(&self) -> Result<(), EnvironmentError> {
+        self.plan.live()?;
+        let phase = self.progress.function.borrow().clone();
+        let Phase::Known(id) = phase else {
+            return Err(EnvironmentError::Stopped);
+        };
+        let inspected = self
+            .docker
+            .inspect_container(&id, self.config.deadline())
+            .await?;
+        if self.plan.owned(ContainerRole::Function, &inspected)? != id {
+            return Err(DockerError::Quarantined.into());
+        }
+        function_health(&inspected)
+    }
+}
+pub(super) fn function_health(
+    inspected: &ContainerInspectResponse,
+) -> Result<(), EnvironmentError> {
+    let state = inspected.state.as_ref().ok_or(DockerError::Protocol)?;
+    match state.running {
+        Some(true) => Ok(()),
+        Some(false) => Err(EnvironmentError::Exited {
+            exit_code: state.exit_code.ok_or(DockerError::Protocol)?,
+            oom: state.oom_killed.ok_or(DockerError::Protocol)?,
+        }),
+        None => Err(DockerError::Protocol.into()),
+    }
+}
+struct Dirty(Arc<Health>);
+impl Dirty {
+    fn new(health: Arc<Health>) -> Self {
+        health.quarantined.fetch_add(1, Ordering::AcqRel);
+        Self(health)
+    }
+}
+impl Drop for Dirty {
+    fn drop(&mut self) {
+        self.0.quarantined.fetch_sub(1, Ordering::AcqRel);
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/environment/io.rs b/crates/rustack-lambda-core/src/docker/environment/io.rs
new file mode 100644
index 00000000..0704e531
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/io.rs
@@ -0,0 +1,234 @@
+//! Worker-owned streams transfer to retained cleanup before their guard drops.
+
+use std::{collections::VecDeque, mem::take, sync::Arc, time::Duration};
+
+use bytes::Bytes;
+use rustack_lambda_runtime::{
+    client::{ClientConfig, ControlClient},
+    diagnostics::runtime_dispatch,
+    protocol::{Architecture, AttemptId, EnvironmentId},
+    relay::RelayError,
+};
+use tokio::{
+    io::{AsyncWriteExt, duplex},
+    runtime::Handle,
+    sync::watch,
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use tracing::instrument::WithSubscriber;
+
+use super::{EnvironmentConfig, EnvironmentError, actor::Signals};
+use crate::{
+    docker::{
+        DockerAttachment, DockerError, FunctionLogs, LogSnapshot, LogWindow, OutputChannel,
+        connection::stopped as wait_for_stop,
+    },
+    executor::ExecutorError,
+    invocation::CleanupTask,
+};
+
+struct Bridge {
+    stop: watch::Sender<bool>,
+    task: JoinHandle<Result<(), DockerError>>,
+    status: watch::Receiver<Option<Result<(), DockerError>>>,
+}
+#[derive(Default)]
+struct Streams {
+    client: Option<ControlClient>,
+    logs: Option<FunctionLogs>,
+    bridge: Option<Bridge>,
+}
+pub(super) struct IoGuard {
+    streams: Streams,
+    runtime: Handle,
+    cleanup: Arc<CleanupTask>,
+    config: EnvironmentConfig,
+    signals: Signals,
+    closing: bool,
+    logs_closed: bool,
+}
+impl IoGuard {
+    #[cfg(test)]
+    pub(super) fn test_streams(&mut self, client: ControlClient, logs: FunctionLogs) {
+        self.streams.client = Some(client);
+        self.streams.logs = Some(logs);
+    }
+
+    pub(super) fn new(
+        runtime: Handle,
+        cleanup: Arc<CleanupTask>,
+        config: EnvironmentConfig,
+        signals: Signals,
+    ) -> Self {
+        Self {
+            streams: Streams::default(),
+            runtime,
+            cleanup,
+            config,
+            signals,
+            closing: false,
+            logs_closed: false,
+        }
+    }
+    pub(super) fn control(
+        &mut self,
+        attachment: DockerAttachment,
+        environment: EnvironmentId,
+        architecture: Architecture,
+    ) -> Result<(), EnvironmentError> {
+        let (mut output, input) = attachment.split(self.config.0.io)?;
+        let (mut bridge, reader) = duplex(64 * 1024);
+        self.streams.client = Some(ControlClient::start(
+            ClientConfig::new(environment, architecture, self.config.0.io)?,
+            reader,
+            input,
+        )?);
+        let (stop, mut stopped) = watch::channel(false);
+        let (status, observed) = watch::channel(None);
+        let budget = self.config.0.io;
+        let mut diagnostics = VecDeque::new();
+        diagnostics
+            .try_reserve_exact(65536)
+            .map_err(|_| DockerError::Allocation)?;
+        let task=self.runtime.spawn(async move{
+            let result=async{
+                loop{
+                    let chunk=tokio::select!{biased;()=wait_for_stop(&mut stopped)=>return Ok(()),chunk=output.next(Instant::now()+Duration::from_secs(3600))=>chunk?,};
+                    match chunk{
+                        None=>return Ok(()),
+                        Some(chunk) if chunk.channel==OutputChannel::Stdout=>{timeout_at(Instant::now()+budget,bridge.write_all(&chunk.bytes)).await.map_err(|_|DockerError::Deadline)??;},
+                        Some(chunk)=>{let remove=diagnostics.len().saturating_add(chunk.bytes.len()).saturating_sub(65536);diagnostics.drain(..remove.min(diagnostics.len()));diagnostics.extend(chunk.bytes.iter().copied());},
+                    }
+                }
+            }.await;status.send_replace(Some(result.clone()));result
+        }.with_subscriber(runtime_dispatch()));
+        self.streams.bridge = Some(Bridge {
+            stop,
+            task,
+            status: observed,
+        });
+        Ok(())
+    }
+    pub(super) fn client(&mut self) -> Result<&mut ControlClient, EnvironmentError> {
+        self.streams.client.as_mut().ok_or(EnvironmentError::Worker)
+    }
+    pub(super) fn logs(&mut self, attachment: DockerAttachment) -> Result<(), EnvironmentError> {
+        self.streams.logs = Some(FunctionLogs::start(
+            attachment,
+            self.config.0.io,
+            self.config.0.log_ring_bytes,
+        )?);
+        Ok(())
+    }
+    pub(super) async fn tail(&mut self) -> Result<Bytes, EnvironmentError> {
+        let logs = self.streams.logs.as_ref().ok_or(EnvironmentError::Worker)?;
+        let snapshot = logs.snapshot(self.config.deadline()).await?;
+        self.observe(snapshot)
+    }
+    pub(super) async fn begin_logs(
+        &mut self,
+        attempt: AttemptId,
+    ) -> Result<LogWindow, EnvironmentError> {
+        let logs = self.streams.logs.as_mut().ok_or(EnvironmentError::Worker)?;
+        Ok(logs.begin(attempt, self.config.deadline()).await?)
+    }
+    pub(super) async fn finish_logs(
+        &mut self,
+        window: LogWindow,
+    ) -> Result<Bytes, EnvironmentError> {
+        let logs = self.streams.logs.as_mut().ok_or(EnvironmentError::Worker)?;
+        let snapshot = logs.finish(window, self.config.deadline()).await?;
+        self.observe(snapshot)
+    }
+    fn observe(&mut self, snapshot: LogSnapshot) -> Result<Bytes, EnvironmentError> {
+        if let Some(error) = snapshot.failure {
+            return Err(error.into());
+        }
+        self.logs_closed = snapshot.closed;
+        Ok(snapshot.tail)
+    }
+    pub(super) async fn healthy(&mut self) -> Result<(), EnvironmentError> {
+        if let Some(bridge) = &self.streams.bridge {
+            if let Some(result) = bridge.status.borrow().as_ref() {
+                return match result {
+                    Ok(()) => Err(DockerError::Protocol.into()),
+                    Err(error) => Err(error.clone().into()),
+                };
+            }
+            if bridge.task.is_finished() && bridge.status.borrow().is_none() {
+                return Err(EnvironmentError::Worker);
+            }
+        }
+        self.tail().await?;
+        if self.logs_closed {
+            Err(DockerError::Protocol.into())
+        } else {
+            Ok(())
+        }
+    }
+    pub(super) fn reusable(&self) -> bool {
+        !self.logs_closed
+            && self
+                .streams
+                .bridge
+                .as_ref()
+                .is_none_or(|bridge| bridge.status.borrow().is_none())
+    }
+    pub(super) fn begin_cleanup(&mut self) {
+        if self.closing {
+            return;
+        }
+        self.closing = true;
+        let streams = take(&mut self.streams);
+        let config = self.config;
+        let signals = self.signals.clone();
+        self.cleanup.start_on(&self.runtime, move || async move {
+            close(streams, config, signals).await
+        });
+    }
+}
+impl Drop for IoGuard {
+    fn drop(&mut self) {
+        self.begin_cleanup();
+    }
+}
+async fn close(
+    mut streams: Streams,
+    config: EnvironmentConfig,
+    signals: Signals,
+) -> Result<(), ExecutorError> {
+    let mut failed = false;
+    if let Some(client) = &mut streams.client {
+        if let Err(error) = client.shutdown(config.deadline()).await {
+            failed |= matches!(error, RelayError::Worker);
+            signals.error(error.into());
+        }
+    }
+    if let Some(bridge) = &streams.bridge {
+        bridge.stop.send_replace(true);
+    }
+    if let Some(logs) = &mut streams.logs {
+        if let Err(error) = logs.shutdown().await {
+            failed |= matches!(error, DockerError::Worker);
+            signals.error(error.into());
+        }
+    }
+    if let Some(bridge) = streams.bridge {
+        match bridge.task.await {
+            Ok(Ok(())) => {}
+            Ok(Err(error)) => {
+                signals.error(error.into());
+            }
+            Err(_) => failed = true,
+        }
+    }
+    if failed {
+        signals.error(EnvironmentError::Worker);
+        Err(ExecutorError::CleanupFailed(
+            "Environment IO supervision failed".into(),
+        ))
+    } else {
+        Ok(())
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/environment/mod.rs b/crates/rustack-lambda-core/src/docker/environment/mod.rs
new file mode 100644
index 00000000..6f5d42a0
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/mod.rs
@@ -0,0 +1,677 @@
+//! Retained two-container environments; executor pooling and startup readiness are separate.
+
+mod actor;
+mod cleanup;
+mod io;
+mod worker;
+
+use std::{
+    fmt,
+    sync::{Arc, atomic::Ordering},
+    time::Duration,
+};
+
+use actor::{Actor, Budget, Envelope, Health, Signals};
+use bytes::Bytes;
+use rustack_lambda_runtime::{
+    protocol::{EnvironmentId, Payload},
+    relay::RelayError,
+    session::{Invocation, RuntimeResult},
+};
+use serde::Serialize;
+use tokio::{
+    runtime::Handle,
+    sync::{mpsc, oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+
+use super::{DirectoryLease, DockerError, DockerPort, EnvironmentPlan, check_deadline};
+use crate::invocation::CleanupTask;
+
+/// Raw operator budgets; convert to `EnvironmentConfig` before starting ownership.
+#[derive(Debug, Clone, Copy, TypedBuilder)]
+#[non_exhaustive]
+pub struct EnvironmentSettings {
+    /// Count of allocated environments, including quarantine, in1..32.
+    #[builder(default = 32)]
+    pub environments: u8,
+    /// Aggregate function+relay memory,256MiB..1TiB.
+    #[builder(default = 8 * 1024 * 1024 * 1024)]
+    pub memory_bytes: u64,
+    /// Independent Docker/control IO budget,1..60s.
+    #[builder(default = Duration::from_secs(5))]
+    pub io: Duration,
+    /// Cold startup budget,1..60s, also bounded by caller admission deadline.
+    #[builder(default = Duration::from_secs(15))]
+    pub start: Duration,
+    /// Independent function `BootstrapReady` wait,1..900s, also bounded by total start.
+    #[builder(default = Duration::from_secs(60))]
+    pub init: Duration,
+    /// Idle lifetime,1..86400s.
+    #[builder(default = Duration::from_secs(600))]
+    pub idle: Duration,
+    /// Retained bytes per function-output channel,4KiB..1MiB.
+    #[builder(default = 262_144)]
+    pub log_ring_bytes: usize,
+}
+impl Default for EnvironmentSettings {
+    fn default() -> Self {
+        Self::builder().build()
+    }
+}
+
+/// Closed, validated environment ownership budgets.
+#[derive(Debug, Clone, Copy, Default)]
+#[non_exhaustive]
+pub struct EnvironmentConfig(EnvironmentSettings);
+impl TryFrom<EnvironmentSettings> for EnvironmentConfig {
+    type Error = EnvironmentError;
+    fn try_from(settings: EnvironmentSettings) -> Result<Self, Self::Error> {
+        if !(1..=32).contains(&settings.environments)
+            || !(256 * 1024 * 1024..=1024 * 1024 * 1024 * 1024).contains(&settings.memory_bytes)
+            || !(4096..=1024 * 1024).contains(&settings.log_ring_bytes)
+        {
+            return Err(EnvironmentError::Configuration);
+        }
+        for (duration, maximum) in [
+            (settings.io, 60),
+            (settings.start, 60),
+            (settings.init, 900),
+            (settings.idle, 86400),
+        ] {
+            if duration.subsec_nanos() != 0 || !(1..=maximum).contains(&duration.as_secs()) {
+                return Err(EnvironmentError::Configuration);
+            }
+        }
+        Ok(Self(settings))
+    }
+}
+impl EnvironmentConfig {
+    fn deadline(self) -> Instant {
+        Instant::now() + self.0.io
+    }
+}
+
+/// Environment errors retain typed sources and never display peer payload bytes.
+#[derive(Debug, Clone, thiserror::Error)]
+#[non_exhaustive]
+pub enum EnvironmentError {
+    /// Invalid settings, scope, captured invocation or lifecycle operation.
+    #[error("invalid environment configuration")]
+    Configuration,
+    /// Allocation or command capacity is exhausted.
+    #[error("environment capacity exhausted")]
+    Busy,
+    /// Function plus relay cannot fit the configured total memory, even when idle.
+    #[error("function and relay memory exceed the configured environment memory limit")]
+    MemoryLimit,
+    /// Explicit cancellation or abandoned owner/caller.
+    #[error("environment cancelled")]
+    Cancelled,
+    /// Startup, call or waiting deadline expired.
+    #[error("environment deadline exceeded")]
+    Deadline,
+    /// Function bootstrap did not poll before its independent initialization window.
+    #[error("function bootstrap initialization deadline exceeded")]
+    InitializationTimeout,
+    /// The captured function timeout expired after Runtime API delivery.
+    #[error("function timed out after {0:?}")]
+    Timeout(Duration),
+    /// This owner no longer accepts work.
+    #[error("environment is stopped")]
+    Stopped,
+    /// A worker/root/cleanup supervisor failed.
+    #[error("environment supervision failed")]
+    Worker,
+    /// Persistent container ownership could not be read or durably settled.
+    #[error("persistent container ownership failed")]
+    Ownership(#[source] Arc<super::DirectoryLeaseError>),
+    /// Function reported a bounded initialization error.
+    #[error("function initialization failed")]
+    Initialization(Payload),
+    /// Function exited before its expected result/readiness.
+    #[error("function exited with status {exit_code}; oom={oom}")]
+    Exited {
+        /// Daemon exit status, without peer text.
+        exit_code: i64,
+        /// Daemon-reported OOM kill flag.
+        oom: bool,
+    },
+    /// Validated local Docker transport failure.
+    #[error(transparent)]
+    Docker(#[from] DockerError),
+    /// Ordered relay session failure.
+    #[error(transparent)]
+    Relay(#[from] RelayError),
+}
+impl From<super::DirectoryLeaseError> for EnvironmentError {
+    fn from(error: super::DirectoryLeaseError) -> Self {
+        Self::Ownership(Arc::new(error))
+    }
+}
+
+/// Current ownership/lifecycle state, independent of external API readiness.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum EnvironmentPhase {
+    /// An allocation is registered and creating its relay.
+    Allocating,
+    /// Relay/function initialization is in progress.
+    Initializing,
+    /// Ready for one invocation.
+    Idle,
+    /// An admitted invocation is active.
+    Busy,
+    /// All owned resources are being retired.
+    Retiring,
+    /// Failed/uncertain cleanup retains its allocation reservation.
+    Quarantined,
+    /// Containers and retained IO are confirmed settled.
+    Removed,
+}
+/// Redacted lifecycle projection; a business failure does not imply unowned cleanup.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct EnvironmentStatus {
+    /// Current owner state.
+    pub phase: EnvironmentPhase,
+    /// Primary failure, retained across cleanup retries.
+    pub error: Option<EnvironmentError>,
+}
+/// Allocation accounting includes every queued, live and quarantined reservation.
+#[derive(Debug, Clone, Copy, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct EnvironmentCapacity {
+    /// Number of retained allocation slots.
+    pub allocated: usize,
+    /// Aggregate reserved memory bytes, including relay overhead.
+    pub memory_bytes: u64,
+    /// Environments retaining failed cleanup.
+    pub quarantined: usize,
+    /// Whether admission is open and healthy.
+    pub accepting: bool,
+    /// A supervision failure permanently closed admission.
+    pub worker_failed: bool,
+}
+/// Actual handler result and bounded optional log output; Debug redacts user bytes.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct EnvironmentResponse {
+    /// Unmodified handler success or `FunctionError` payload.
+    pub result: RuntimeResult,
+    /// Combined observed invocation-window tail when requested, at most 4 KiB.
+    pub logs: Bytes,
+}
+impl fmt::Debug for EnvironmentResponse {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EnvironmentResponse")
+            .field("result", &self.result)
+            .field("log_bytes", &self.logs.len())
+            .finish()
+    }
+}
+struct Call {
+    invocation: Invocation,
+    capture_logs: bool,
+    cancellation: watch::Receiver<bool>,
+    reply: oneshot::Sender<Result<EnvironmentResponse, EnvironmentError>>,
+}
+struct CancelOnDrop {
+    call: watch::Sender<bool>,
+    environment: watch::Sender<bool>,
+    complete: bool,
+}
+impl Drop for CancelOnDrop {
+    fn drop(&mut self) {
+        if !self.complete {
+            self.call.send_replace(true);
+            self.environment.send_replace(true);
+        }
+    }
+}
+
+/// Exclusive owner-facing environment handle; Drop requests retained retirement.
+#[non_exhaustive]
+pub struct EnvironmentHandle {
+    id: EnvironmentId,
+    calls: mpsc::Sender<Call>,
+    signals: Signals,
+    settlement: watch::Receiver<Option<Result<(), EnvironmentError>>>,
+}
+impl fmt::Debug for EnvironmentHandle {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EnvironmentHandle")
+            .field("id", &self.id)
+            .field("status", &*self.signals.status.borrow())
+            .finish_non_exhaustive()
+    }
+}
+impl EnvironmentHandle {
+    pub(super) fn retirement(&self) -> Retirement {
+        Retirement {
+            stop: self.signals.stop.clone(),
+            status: self.signals.status.subscribe(),
+            settlement: self.settlement.clone(),
+        }
+    }
+    /// Read the fresh immutable environment identity.
+    ///
+    /// ```no_run
+    /// # fn id(environment: &rustack_lambda_core::docker::EnvironmentHandle) { let id = environment.id(); }
+    /// ```
+    #[must_use]
+    pub fn id(&self) -> EnvironmentId {
+        self.id
+    }
+    /// Read lifecycle status without waiting for a business mailbox.
+    ///
+    /// ```no_run
+    /// # fn status(environment: &rustack_lambda_core::docker::EnvironmentHandle) { let status = environment.status(); }
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> EnvironmentStatus {
+        self.signals.status.borrow().clone()
+    }
+    /// Request retirement through its priority stop signal.
+    ///
+    /// ```no_run
+    /// # fn stop(environment: &rustack_lambda_core::docker::EnvironmentHandle) { environment.cancel(); }
+    /// ```
+    pub fn cancel(&self) {
+        self.signals.stop.send_replace(true);
+    }
+    /// Await readiness without cancelling an accepted allocation when dropped.
+    ///
+    /// # Errors
+    /// Returns invalid/expired budget, startup failure or owner failure. The owner
+    /// remains responsible for shutdown/Drop and retained cleanup.
+    ///
+    /// ```no_run
+    /// # async fn ready(environment: &rustack_lambda_core::docker::EnvironmentHandle) { let ready = environment.wait_ready(tokio::time::Instant::now()+std::time::Duration::from_secs(15)).await; }
+    /// ```
+    pub async fn wait_ready(&self, deadline: Instant) -> Result<(), EnvironmentError> {
+        check_deadline(deadline)?;
+        let mut status = self.signals.status.subscribe();
+        let observed = timeout_at(
+            deadline,
+            status.wait_for(|status| {
+                !matches!(
+                    status.phase,
+                    EnvironmentPhase::Allocating | EnvironmentPhase::Initializing
+                )
+            }),
+        )
+        .await
+        .map_err(|_| EnvironmentError::Deadline)?
+        .map_err(|_| EnvironmentError::Worker)?
+        .clone();
+        if Instant::now() >= deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        if matches!(
+            observed.phase,
+            EnvironmentPhase::Idle | EnvironmentPhase::Busy
+        ) {
+            Ok(())
+        } else {
+            Err(observed.error.unwrap_or(EnvironmentError::Stopped))
+        }
+    }
+    /// Submit one runtime invocation to a ready environment, without replay.
+    ///
+    /// # Errors
+    /// Returns bounded admission, deadline/cancellation, protocol or function-exit
+    /// errors. Dropping this future retires the environment; shutdown separately
+    /// awaits cleanup. The supplied absolute invocation deadline is authoritative.
+    ///
+    /// ```no_run
+    /// # async fn invoke(environment: &mut rustack_lambda_core::docker::EnvironmentHandle, invocation: rustack_lambda_runtime::session::Invocation) { let result = environment.invoke(invocation, true).await; }
+    /// ```
+    pub async fn invoke(
+        &mut self,
+        invocation: Invocation,
+        capture_logs: bool,
+    ) -> Result<EnvironmentResponse, EnvironmentError> {
+        let deadline = invocation.parts().1;
+        if Instant::now() >= deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        if self.status().phase != EnvironmentPhase::Idle {
+            return Err(EnvironmentError::Stopped);
+        }
+        let (stop, cancellation) = watch::channel(false);
+        let mut cancel = CancelOnDrop {
+            call: stop,
+            environment: self.signals.stop.clone(),
+            complete: false,
+        };
+        let (reply, response) = oneshot::channel();
+        self.calls
+            .try_send(Call {
+                invocation,
+                capture_logs,
+                cancellation,
+                reply,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => EnvironmentError::Busy,
+                mpsc::error::TrySendError::Closed(_) => EnvironmentError::Stopped,
+            })?;
+        let result = timeout_at(deadline, response)
+            .await
+            .map_err(|_| EnvironmentError::Deadline)?
+            .map_err(|_| EnvironmentError::Worker)?;
+        if Instant::now() >= deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        cancel.complete = result.is_ok();
+        result
+    }
+    /// Request stop and await retained container/IO settlement under one deadline.
+    ///
+    /// # Errors
+    /// Returns timeout while ownership remains retained, or cached supervision
+    /// failure. Business failure remains in status, independent of clean retirement.
+    ///
+    /// ```no_run
+    /// # async fn stop(environment: &mut rustack_lambda_core::docker::EnvironmentHandle) { let clean = environment.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(10)).await; }
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), EnvironmentError> {
+        self.cancel();
+        check_deadline(deadline)?;
+        let settled = timeout_at(deadline, self.settlement.wait_for(Option::is_some))
+            .await
+            .map_err(|_| EnvironmentError::Deadline)?
+            .map_err(|_| EnvironmentError::Worker)?
+            .clone()
+            .ok_or(EnvironmentError::Worker)?;
+        if Instant::now() >= deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        settled
+    }
+}
+impl Drop for EnvironmentHandle {
+    fn drop(&mut self) {
+        self.cancel();
+    }
+}
+
+/// Cloneable bounded allocation port; retain its manager through shutdown.
+#[derive(Clone, TypedBuilder)]
+#[builder(
+    builder_method(vis = ""),
+    build_method(vis = ""),
+    builder_type(vis = "")
+)]
+#[non_exhaustive]
+pub struct EnvironmentPort {
+    sender: mpsc::Sender<Envelope>,
+    directory: DirectoryLease,
+    config: EnvironmentConfig,
+    control: watch::Sender<bool>,
+    budget: Arc<Budget>,
+    health: Arc<Health>,
+}
+impl fmt::Debug for EnvironmentPort {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EnvironmentPort")
+            .field("capacity", &self.status())
+            .finish_non_exhaustive()
+    }
+}
+impl EnvironmentPort {
+    pub(super) fn same_service(&self, other: &Self) -> bool {
+        self.sender.same_channel(&other.sender)
+    }
+    pub(super) fn same_scope(&self, directory: &DirectoryLease) -> bool {
+        self.directory.owner_id() == directory.owner_id()
+            && self.directory.run_id() == directory.run_id()
+    }
+    /// Reserve count/memory and register a plan before any container operation.
+    ///
+    /// # Errors
+    /// Returns invalid scope/deadline, closed/unhealthy owner or bounded capacity.
+    /// Startup runs under the earlier of admission deadline and configured budget.
+    ///
+    /// ```no_run
+    /// # fn allocate(port: &rustack_lambda_core::docker::EnvironmentPort, plan: rustack_lambda_core::docker::EnvironmentPlan) { let environment = port.spawn(plan,tokio::time::Instant::now()+std::time::Duration::from_secs(15)); }
+    /// ```
+    pub fn spawn(
+        &self,
+        plan: EnvironmentPlan,
+        deadline: Instant,
+    ) -> Result<EnvironmentHandle, EnvironmentError> {
+        self.spawn_shared(Arc::new(plan), deadline)
+    }
+    pub(super) fn check_memory(&self, memory: u64) -> Result<(), EnvironmentError> {
+        self.budget.check_memory(memory)
+    }
+    pub(super) fn spawn_shared(
+        &self,
+        plan: Arc<EnvironmentPlan>,
+        deadline: Instant,
+    ) -> Result<EnvironmentHandle, EnvironmentError> {
+        let deadline = deadline.min(Instant::now() + self.config.0.start);
+        check_deadline(deadline)?;
+        if !plan.same_scope(&self.directory) {
+            return Err(EnvironmentError::Configuration);
+        }
+        if *self.control.borrow() || self.health.failed.load(Ordering::Acquire) {
+            return Err(EnvironmentError::Stopped);
+        }
+        if self.health.quarantined.load(Ordering::Acquire) > 0 {
+            return Err(DockerError::Quarantined.into());
+        }
+        let reservation = self.budget.reserve(plan.memory_bytes())?;
+        let code_claim = plan.claim_code()?;
+        let (calls, mailbox) = mpsc::channel(4);
+        let signals = Signals::new();
+        let (done, settlement) = watch::channel(None);
+        let handle = EnvironmentHandle {
+            id: plan.environment_id(),
+            calls,
+            signals: signals.clone(),
+            settlement,
+        };
+        self.sender
+            .try_send(Envelope {
+                code_claim,
+                plan,
+                mailbox,
+                signals,
+                reservation,
+                done,
+                deadline: deadline.min(Instant::now() + self.config.0.start),
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => EnvironmentError::Busy,
+                mpsc::error::TrySendError::Closed(_) => EnvironmentError::Stopped,
+            })?;
+        Ok(handle)
+    }
+    /// Read bounded resource accounting, including quarantine reservations.
+    ///
+    /// ```no_run
+    /// # fn status(port: &rustack_lambda_core::docker::EnvironmentPort) { let capacity = port.status(); }
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> EnvironmentCapacity {
+        EnvironmentCapacity {
+            allocated: self.budget.count(),
+            memory_bytes: self.budget.memory.load(Ordering::Acquire),
+            quarantined: self.health.quarantined.load(Ordering::Acquire),
+            accepting: !*self.control.borrow()
+                && !self.health.failed.load(Ordering::Acquire)
+                && self.health.quarantined.load(Ordering::Acquire) == 0,
+            worker_failed: self.health.failed.load(Ordering::Acquire),
+        }
+    }
+}
+
+/// A pool keeps this receipt above workers which own exclusive handles.
+#[derive(Debug, Clone)]
+pub(super) struct Retirement {
+    stop: watch::Sender<bool>,
+    status: watch::Receiver<EnvironmentStatus>,
+    settlement: watch::Receiver<Option<Result<(), EnvironmentError>>>,
+}
+impl Retirement {
+    pub(super) fn cancel(&self) {
+        self.stop.send_replace(true);
+    }
+    pub(super) async fn settle(mut self) -> Result<(), EnvironmentError> {
+        self.cancel();
+        self.settlement
+            .wait_for(Option::is_some)
+            .await
+            .map_err(|_| EnvironmentError::Worker)?
+            .clone()
+            .ok_or(EnvironmentError::Worker)?
+    }
+    pub(super) fn removed(&self) -> bool {
+        self.status.borrow().phase == EnvironmentPhase::Removed
+    }
+}
+
+/// Retained root owner; startup reconciliation/probes and executor pooling are separate.
+#[non_exhaustive]
+pub struct EnvironmentManager {
+    port: EnvironmentPort,
+    task: Option<JoinHandle<Result<(), EnvironmentError>>>,
+    primary: Option<Result<(), EnvironmentError>>,
+    settled: Option<Result<(), EnvironmentError>>,
+    emergency: Arc<CleanupTask>,
+}
+impl fmt::Debug for EnvironmentManager {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EnvironmentManager")
+            .field("port", &self.port)
+            .field("settled", &self.settled)
+            .finish_non_exhaustive()
+    }
+}
+impl EnvironmentManager {
+    #[cfg(test)]
+    pub(super) fn abort_test_worker(&self) {
+        if let Some(task) = &self.task {
+            task.abort();
+        }
+    }
+
+    pub(super) fn physically_settled(&self) -> bool {
+        self.primary.is_some()
+            && self.task.is_none()
+            && self.emergency.is_finished()
+            && self.port.status().allocated == 0
+    }
+
+    /// Start ownership on the current runtime under a real directory capability.
+    ///
+    /// # Errors
+    /// Rejects a port not bound to this exact directory, or returns Worker when
+    /// a Tokio runtime is unavailable. This alone does not establish historical
+    /// reconciliation or production Docker readiness.
+    ///
+    /// ```no_run
+    /// # fn start(docker: rustack_lambda_core::docker::DockerPort, lease: rustack_lambda_core::docker::DirectoryLease) { let manager = rustack_lambda_core::docker::EnvironmentManager::start(docker,lease,Default::default()); }
+    /// ```
+    pub fn start(
+        docker: DockerPort,
+        directory: DirectoryLease,
+        config: EnvironmentConfig,
+    ) -> Result<Self, EnvironmentError> {
+        docker.require_directory(&directory)?;
+        let runtime = Handle::try_current().map_err(|_| EnvironmentError::Worker)?;
+        let (sender, inbox) = mpsc::channel(32);
+        let (control, _) = watch::channel(false);
+        let health = Arc::new(Health::new(control.clone()));
+        let budget = Arc::new(Budget::new(config));
+        let emergency = Arc::new(CleanupTask::default());
+        let port = EnvironmentPort {
+            sender,
+            directory,
+            config,
+            control: control.clone(),
+            budget,
+            health: health.clone(),
+        };
+        let actor = Actor::builder()
+            .docker(docker)
+            .config(config)
+            .inbox(inbox)
+            .control(control)
+            .health(health)
+            .runtime(runtime.clone())
+            .emergency(emergency.clone())
+            .build();
+        Ok(Self {
+            port,
+            task: Some(runtime.spawn(actor.run())),
+            primary: None,
+            settled: None,
+            emergency,
+        })
+    }
+    /// Clone the allocation port without transferring root shutdown ownership.
+    ///
+    /// ```no_run
+    /// # fn port(manager: &rustack_lambda_core::docker::EnvironmentManager) { let port = manager.port(); }
+    /// ```
+    #[must_use]
+    pub fn port(&self) -> EnvironmentPort {
+        self.port.clone()
+    }
+    /// Stop admission and join normal/emergency cleanup without dropping records.
+    ///
+    /// # Errors
+    /// Returns timeout while cleanup stays owned, or cached worker/root failure.
+    /// Must finish before image owner or `DockerWire` shutdown.
+    ///
+    /// ```no_run
+    /// # async fn stop(manager: &mut rustack_lambda_core::docker::EnvironmentManager) { let result = manager.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(10)).await; }
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), EnvironmentError> {
+        self.port.control.send_replace(true);
+        check_deadline(deadline)?;
+        if let Some(settled) = &self.settled {
+            return settled.clone();
+        }
+        if self.primary.is_none() {
+            let result = match self.task.as_mut() {
+                Some(task) => timeout_at(deadline, task)
+                    .await
+                    .map_err(|_| EnvironmentError::Deadline)?
+                    .map_err(|_| EnvironmentError::Worker)
+                    .and_then(|result| result),
+                None => Err(EnvironmentError::Worker),
+            };
+            self.task.take();
+            self.primary = Some(result);
+        }
+        timeout_at(deadline, self.emergency.wait())
+            .await
+            .map_err(|_| EnvironmentError::Deadline)?
+            .map_err(|_| EnvironmentError::Worker)?;
+        if Instant::now() >= deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        let result = self.primary.clone().ok_or(EnvironmentError::Worker)?;
+        self.settled = Some(result.clone());
+        result
+    }
+}
+impl Drop for EnvironmentManager {
+    fn drop(&mut self) {
+        self.port.control.send_replace(true);
+    }
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+pub(in crate::docker) mod test_peer;
diff --git a/crates/rustack-lambda-core/src/docker/environment/test_peer.rs b/crates/rustack-lambda-core/src/docker/environment/test_peer.rs
new file mode 100644
index 00000000..b88a9254
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/test_peer.rs
@@ -0,0 +1,89 @@
+//! Test-only peer for exercising public handle ownership without external processes.
+use std::sync::{
+    Arc,
+    atomic::{AtomicUsize, Ordering},
+};
+
+use rustack_lambda_runtime::session::RuntimeResult;
+
+use super::*;
+
+pub(in crate::docker) struct Peer {
+    calls: mpsc::Receiver<Call>,
+    signals: Signals,
+    done: watch::Sender<Option<Result<(), EnvironmentError>>>,
+}
+pub(in crate::docker) fn pair() -> (EnvironmentHandle, Peer) {
+    let (calls, mailbox) = mpsc::channel(4);
+    let signals = Signals::new();
+    signals.phase(EnvironmentPhase::Idle);
+    let (done, settlement) = watch::channel(None);
+    (
+        EnvironmentHandle {
+            id: EnvironmentId::default(),
+            calls,
+            signals: signals.clone(),
+            settlement,
+        },
+        Peer {
+            calls: mailbox,
+            signals,
+            done,
+        },
+    )
+}
+impl Peer {
+    pub(in crate::docker) async fn serve_pending(
+        mut self,
+        entered: oneshot::Sender<Invocation>,
+        release: oneshot::Receiver<()>,
+        stopping: oneshot::Sender<()>,
+    ) {
+        let call = self.calls.recv().await.unwrap();
+        entered.send(call.invocation.clone()).unwrap();
+        let mut stop = self.signals.stop.subscribe();
+        let _ = stop.wait_for(|stop| *stop).await;
+        let _ = stopping.send(());
+        let _ = release.await;
+        self.signals.phase(EnvironmentPhase::Removed);
+        self.done.send_replace(Some(Ok(())));
+        drop(call);
+    }
+    pub(in crate::docker) async fn serve(self, count: Arc<AtomicUsize>) {
+        self.serve_inner(count, None, None).await;
+    }
+    pub(in crate::docker) async fn serve_gated(
+        self,
+        count: Arc<AtomicUsize>,
+        release: oneshot::Receiver<()>,
+        stopping: oneshot::Sender<()>,
+    ) {
+        self.serve_inner(count, Some(release), Some(stopping)).await;
+    }
+    async fn serve_inner(
+        mut self,
+        count: Arc<AtomicUsize>,
+        release: Option<oneshot::Receiver<()>>,
+        stopping: Option<oneshot::Sender<()>>,
+    ) {
+        let mut stop = self.signals.stop.subscribe();
+        loop {
+            tokio::select! { biased;
+                _ = stop.wait_for(|stop| *stop) => break,
+                call = self.calls.recv() => {
+                    let Some(call) = call else { break; };
+                    count.fetch_add(1, Ordering::AcqRel);
+                    let _ = call.reply.send(Ok(EnvironmentResponse { result: RuntimeResult::Success(Payload::try_from(Bytes::from_static(b"{}" )).unwrap()), logs: Bytes::new() }));
+                }
+            }
+        }
+        if let Some(stopping) = stopping {
+            let _ = stopping.send(());
+        }
+        if let Some(release) = release {
+            let _ = release.await;
+        }
+        self.signals.phase(EnvironmentPhase::Removed);
+        self.done.send_replace(Some(Ok(())));
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/environment/tests.rs b/crates/rustack-lambda-core/src/docker/environment/tests.rs
new file mode 100644
index 00000000..d1caf6c2
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/tests.rs
@@ -0,0 +1,744 @@
+use serde_json::{Value, json};
+use tokio::time::timeout;
+
+use super::*;
+use crate::docker::{
+    plan::tests::{image_with, policy, revision},
+    tests::Daemon,
+};
+
+mod initialization;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn directory() -> DirectoryLease {
+    DirectoryLease::testing(uuid::Uuid::new_v4(), uuid::Uuid::new_v4())
+}
+fn plan(directory: &DirectoryLease) -> EnvironmentPlan {
+    EnvironmentPlan::new(
+        directory.clone(),
+        image_with("1000", vec![]),
+        Arc::new(revision()),
+        policy(),
+    )
+    .unwrap()
+}
+fn inspected(plan: &EnvironmentPlan) -> Value {
+    let revision = plan.revision();
+    let image = match &revision.artifact {
+        crate::artifact::DeploymentArtifact::Image(image) => {
+            image.resolved().metadata().image_id.as_str()
+        }
+        _ => panic!("image fixture"),
+    };
+    json!({"Id":"a".repeat(64),"Name":format!("/{}",plan.relay_key().as_str()),"Config":{"Image":image,"Labels":{
+        "rustack.lambda.ownerId":plan.directory.owner_id().to_string(),"rustack.lambda.runId":plan.directory.run_id().to_string(),"rustack.lambda.environmentId":plan.environment_id().to_string(),"rustack.lambda.functionResourceId":revision.resource_id.to_string(),"rustack.lambda.role":"relay"}},"State":{"Running":false,"OOMKilled":false,"ExitCode":0}})
+}
+async fn quarantined(handle: &EnvironmentHandle) {
+    timeout(Duration::from_secs(3), async {
+        while handle.status().phase != EnvironmentPhase::Quarantined {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+async fn finish_relay(daemon: &mut Daemon, owned: &Value) {
+    let observed = daemon.next().await;
+    assert!(observed.head.starts_with("GET "));
+    observed
+        .reply(200, &serde_json::to_vec(owned).unwrap())
+        .await;
+    let checked = daemon.next().await;
+    assert!(checked.head.contains(&"a".repeat(64)));
+    checked
+        .reply(200, &serde_json::to_vec(owned).unwrap())
+        .await;
+    let removed = daemon.next().await;
+    assert!(removed.head.starts_with("DELETE "));
+    removed.reply(204, b"").await;
+    daemon.next().await.reply(404, b"{}").await;
+}
+
+#[test]
+fn test_should_validate_environment_budgets_and_reserve_count_and_memory_transactionally() {
+    for settings in [
+        EnvironmentSettings::builder().environments(0).build(),
+        EnvironmentSettings::builder().environments(33).build(),
+        EnvironmentSettings::builder().memory_bytes(1).build(),
+        EnvironmentSettings::builder().io(Duration::ZERO).build(),
+        EnvironmentSettings::builder()
+            .start(Duration::from_secs(61))
+            .build(),
+        EnvironmentSettings::builder()
+            .idle(Duration::from_millis(1500))
+            .build(),
+        EnvironmentSettings::builder().log_ring_bytes(4095).build(),
+        EnvironmentSettings::builder().init(Duration::ZERO).build(),
+        EnvironmentSettings::builder()
+            .init(Duration::from_secs(901))
+            .build(),
+    ] {
+        assert!(EnvironmentConfig::try_from(settings).is_err());
+    }
+    let config = EnvironmentConfig::try_from(
+        EnvironmentSettings::builder()
+            .environments(2)
+            .memory_bytes(256 * 1024 * 1024)
+            .build(),
+    )
+    .unwrap();
+    let budget = Arc::new(Budget::new(config));
+    let first = budget.reserve(256 * 1024 * 1024).unwrap();
+    assert!(budget.reserve(1).is_err());
+    assert_eq!(budget.count(), 1);
+    drop(first);
+    assert_eq!(budget.count(), 0);
+    assert_eq!(budget.memory.load(Ordering::Acquire), 0);
+}
+#[tokio::test]
+async fn test_should_reject_foreign_scope_without_admitting_or_mutating() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease, EnvironmentConfig::default()).unwrap();
+    assert!(matches!(
+        manager.port().spawn(plan(&directory()), deadline()),
+        Err(EnvironmentError::Configuration)
+    ));
+    assert_eq!(manager.port().status().allocated, 0);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    manager.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_settle_definitive_create_rejection_without_containers() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let mut handle = manager.port().spawn(plan(&lease), deadline()).unwrap();
+    daemon.next().await.reply(400, b"{}").await;
+    assert!(handle.wait_ready(deadline()).await.is_err());
+    handle.shutdown(deadline()).await.unwrap();
+    manager.shutdown(deadline()).await.unwrap();
+    assert_eq!(manager.port().status().allocated, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_retain_quota_after_500_and_initial_absence_until_late_create_is_removed() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let planned = plan(&lease);
+    let owned = inspected(&planned);
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease, EnvironmentConfig::default()).unwrap();
+    let mut handle = manager.port().spawn(planned, deadline()).unwrap();
+    daemon.next().await.reply(500, b"{}").await;
+    daemon.next().await.reply(404, b"{}").await;
+    quarantined(&handle).await;
+    assert_eq!(manager.port().status().allocated, 1);
+    assert_eq!(manager.port().status().memory_bytes, 256 * 1024 * 1024);
+    let capacity = manager.port().status();
+    assert_eq!(
+        serde_json::to_value(capacity).unwrap(),
+        serde_json::json!({"allocated":1,
+        "memoryBytes":256 * 1024 * 1024,"quarantined":capacity.quarantined,
+        "accepting":capacity.accepting,"workerFailed":capacity.worker_failed})
+    );
+    assert!(matches!(
+        handle
+            .shutdown(Instant::now() + Duration::from_millis(20))
+            .await,
+        Err(EnvironmentError::Deadline)
+    ));
+    finish_relay(&mut daemon, &owned).await;
+    handle.shutdown(deadline()).await.unwrap();
+    manager.shutdown(deadline()).await.unwrap();
+    assert_eq!(manager.port().status().allocated, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest::rstest]
+#[case("labels")]
+#[case("image")]
+#[case("name")]
+#[case("id")]
+#[tokio::test]
+async fn test_should_quarantine_foreign_or_malformed_objects_without_deleting_them(
+    #[case] conflict: &str,
+) {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let planned = plan(&lease);
+    let owned = inspected(&planned);
+    let mut foreign = owned.clone();
+    match conflict {
+        "labels" => {
+            foreign["Config"]["Labels"]["rustack.lambda.ownerId"] =
+                json!(uuid::Uuid::new_v4().to_string());
+        }
+        "image" => foreign["Config"]["Image"] = json!("sha256:foreign"),
+        "name" => foreign["Name"] = json!("/foreign"),
+        "id" => foreign["Id"] = json!("not-an-id"),
+        _ => panic!("case"),
+    }
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease, EnvironmentConfig::default()).unwrap();
+    let mut handle = manager.port().spawn(planned, deadline()).unwrap();
+    daemon.next().await.reply(500, b"{}").await;
+    daemon
+        .next()
+        .await
+        .reply(200, &serde_json::to_vec(&foreign).unwrap())
+        .await;
+    quarantined(&handle).await;
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    assert_eq!(manager.port().status().allocated, 1);
+    finish_relay(&mut daemon, &owned).await;
+    handle.shutdown(deadline()).await.unwrap();
+    manager.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_finish_critical_create_after_caller_cancel_before_cleanup() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let planned = plan(&lease);
+    let owned = inspected(&planned);
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease, EnvironmentConfig::default()).unwrap();
+    let mut handle = manager.port().spawn(planned, deadline()).unwrap();
+    let create = daemon.next().await;
+    handle.cancel();
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    assert_eq!(manager.port().status().allocated, 1);
+    create
+        .reply(
+            201,
+            format!("{{\"Id\":\"{}\",\"Warnings\":[]}}", "a".repeat(64)).as_bytes(),
+        )
+        .await;
+    daemon
+        .next()
+        .await
+        .reply(200, &serde_json::to_vec(&owned).unwrap())
+        .await;
+    daemon
+        .next()
+        .await
+        .reply(200, &serde_json::to_vec(&owned).unwrap())
+        .await;
+    daemon.next().await.reply(204, b"").await;
+    daemon.next().await.reply(404, b"{}").await;
+    handle.shutdown(deadline()).await.unwrap();
+    manager.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_recover_retained_record_after_root_abort_with_create_in_flight() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let planned = plan(&lease);
+    let owned = inspected(&planned);
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease, EnvironmentConfig::default()).unwrap();
+    let mut handle = manager.port().spawn(planned, deadline()).unwrap();
+    let create = daemon.next().await;
+    manager.task.as_ref().unwrap().abort();
+    daemon.next().await.reply(404, b"{}").await;
+    assert_eq!(manager.port().status().allocated, 1);
+    create
+        .reply(
+            201,
+            format!("{{\"Id\":\"{}\",\"Warnings\":[]}}", "a".repeat(64)).as_bytes(),
+        )
+        .await;
+    finish_relay(&mut daemon, &owned).await;
+    assert!(matches!(
+        handle.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(matches!(
+        manager.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(matches!(
+        manager.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert_eq!(manager.port().status().allocated, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_settle_revoked_before_issue_without_any_daemon_mutation() {
+    use std::sync::atomic::AtomicBool;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let (release, _) = watch::channel(());
+    let (stop, stopped) = watch::channel(false);
+    let relay = crate::artifact::PinnedImage::new(
+        image_with("1000", vec![]).resolved().clone(),
+        4096.try_into().unwrap(),
+        release,
+        Arc::new(AtomicBool::new(true)),
+        stopped,
+    );
+    let planned =
+        EnvironmentPlan::new(lease.clone(), relay, Arc::new(revision()), policy()).unwrap();
+    stop.send_replace(true);
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease, EnvironmentConfig::default()).unwrap();
+    let mut handle = manager.port().spawn(planned, deadline()).unwrap();
+    assert!(handle.wait_ready(deadline()).await.is_err());
+    handle.shutdown(deadline()).await.unwrap();
+    manager.shutdown(deadline()).await.unwrap();
+    assert_eq!(manager.port().status().allocated, 0);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_release_unissued_allocation_when_socket_connection_fails() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    daemon.close().await;
+    let lease = directory();
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let mut handle = manager.port().spawn(plan(&lease), deadline()).unwrap();
+    assert!(handle.wait_ready(deadline()).await.is_err());
+    handle.shutdown(deadline()).await.unwrap();
+    manager.shutdown(deadline()).await.unwrap();
+    assert_eq!(manager.port().status().allocated, 0);
+    wire.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_admit_a_queued_call_after_health_io_takes_longer_than_its_cadence() {
+    use tokio::io::duplex;
+
+    use crate::docker::{DockerOutputReader, FunctionLogs, plan::ContainerRole};
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let planned = Arc::new(plan(&lease));
+    let environment: EnvironmentId = planned.environment_id();
+    let mut owned = inspected(&planned);
+    owned["Name"] = json!(format!("/{}", planned.function_key().as_str()));
+    owned["Config"]["Labels"]["rustack.lambda.role"] = json!("function");
+    owned["State"]["Running"] = json!(true);
+    let (client, peer) = ready_client(environment).await;
+    let (_quiet, reader) = duplex(8);
+    let logs = FunctionLogs::start_reader(
+        DockerOutputReader::new(reader, Duration::from_secs(1)).unwrap(),
+        4096,
+    )
+    .unwrap();
+    let io_task = Arc::new(CleanupTask::default());
+    let signals = Signals::new();
+    let health = Arc::new(Health::default());
+    let config = EnvironmentConfig::default();
+    let progress = Arc::new(cleanup::Progress::new());
+    progress
+        .phase(ContainerRole::Function)
+        .send_replace(cleanup::Phase::Known("a".repeat(64).parse().unwrap()));
+    let cleanup = Arc::new(tokio::sync::Semaphore::new(2));
+    let (global, _) = watch::channel(false);
+    let cleaner = cleanup::Cleaner::builder()
+        .docker(wire.port())
+        .config(config)
+        .plan(planned.clone())
+        .progress(progress.clone())
+        .health(health.clone())
+        .cleanup(cleanup.clone())
+        .signals(signals.clone())
+        .build();
+    let worker = worker::Worker::builder()
+        .docker(wire.port())
+        .config(config)
+        .plan(planned)
+        .progress(progress)
+        .cleanup(cleanup)
+        .health(health)
+        .signals(signals.clone())
+        .global(global)
+        .io(io_task.clone())
+        .runtime(Handle::current())
+        .build();
+    let mut io = io::IoGuard::new(Handle::current(), io_task.clone(), config, signals);
+    io.test_streams(client, logs);
+    let (calls, mut mailbox) = mpsc::channel(4);
+    let task = tokio::spawn(async move {
+        if let Some((reply, result)) = worker.serve_test(&mut io, &cleaner, &mut mailbox).await {
+            let _ = reply.send(result);
+        }
+        io.begin_cleanup();
+    });
+    let inspection = daemon.next().await;
+    let (stop, cancellation) = watch::channel(false);
+    let (reply, response) = oneshot::channel();
+    calls
+        .send(Call {
+            invocation: foreign_invocation(),
+            capture_logs: false,
+            cancellation,
+            reply,
+        })
+        .await
+        .unwrap();
+    tokio::time::sleep(Duration::from_millis(1100)).await;
+    inspection
+        .reply(200, &serde_json::to_vec(&owned).unwrap())
+        .await;
+    assert!(matches!(
+        timeout(Duration::from_millis(500), response)
+            .await
+            .unwrap()
+            .unwrap(),
+        Err(EnvironmentError::Configuration)
+    ));
+    task.await.unwrap();
+    io_task.wait().await.unwrap();
+    peer.await.unwrap();
+    drop(stop);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest::rstest]
+#[case::normal(false, false)]
+#[case::root_abort(true, false)]
+#[case::wire_failure(true, true)]
+#[tokio::test]
+async fn test_should_keep_queued_handle_failure_distinct_from_clean_shutdown(
+    #[case] failed: bool,
+    #[case] wire_failure: bool,
+) {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let mut handle = manager.port().spawn(plan(&lease), deadline()).unwrap();
+    if wire_failure {
+        wire.port().raw.stop.send_replace(true);
+    } else if failed {
+        manager.task.as_ref().unwrap().abort();
+    } else {
+        manager.port.control.send_replace(true);
+    }
+    let result = handle.shutdown(deadline()).await;
+    let joined = manager.shutdown(deadline()).await;
+    if failed {
+        assert!(matches!(result, Err(EnvironmentError::Worker)));
+        assert!(matches!(joined, Err(EnvironmentError::Worker)));
+    } else {
+        result.unwrap();
+        joined.unwrap();
+    }
+    assert_eq!(manager.port().status().allocated, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_allow_final_log_tail_at_eof_but_never_reuse_the_closed_environment() {
+    use rustack_lambda_runtime::{
+        client::{ClientConfig, ControlClient},
+        protocol::{Architecture, EnvironmentId},
+    };
+
+    use crate::docker::{DockerOutputReader, FunctionLogs};
+    let (reader, peer) = tokio::io::duplex(8);
+    drop(peer);
+    let client = ControlClient::start(
+        ClientConfig::new(
+            EnvironmentId::default(),
+            Architecture::Arm64,
+            Duration::from_secs(1),
+        )
+        .unwrap(),
+        reader,
+        tokio::io::sink(),
+    )
+    .unwrap();
+    let logs = FunctionLogs::start_reader(
+        DockerOutputReader::new(b"".as_slice(), Duration::from_secs(1)).unwrap(),
+        4096,
+    )
+    .unwrap();
+    let cleanup = Arc::new(CleanupTask::default());
+    let mut io = io::IoGuard::new(
+        Handle::current(),
+        cleanup.clone(),
+        EnvironmentConfig::default(),
+        Signals::new(),
+    );
+    io.test_streams(client, logs);
+    timeout(Duration::from_secs(1), async {
+        loop {
+            assert!(io.tail().await.unwrap().is_empty());
+            if !io.reusable() {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(io.healthy().await.is_err());
+    io.begin_cleanup();
+    cleanup.wait().await.unwrap();
+}
+
+async fn ready_client(
+    environment: EnvironmentId,
+) -> (
+    rustack_lambda_runtime::client::ControlClient,
+    tokio::task::JoinHandle<()>,
+) {
+    use rustack_lambda_runtime::{
+        client::{ClientConfig, ClientEvent, ControlClient},
+        protocol::{Acknowledgement, Architecture, Frame, Message, read_frame, write_frame},
+    };
+    use tokio::io::{duplex, split};
+    let (stream, mut peer) = duplex(65536);
+    let (reader, writer) = split(stream);
+    let peer = tokio::spawn(async move {
+        for message in [
+            Message::Hello {
+                architecture: Architecture::Arm64,
+            },
+            Message::Ready,
+            Message::BootstrapReady,
+        ] {
+            write_frame(&mut peer, &Frame::new(environment, message), deadline())
+                .await
+                .unwrap();
+        }
+        let close = read_frame(&mut peer, deadline()).await.unwrap().unwrap();
+        assert!(matches!(close.message(), Message::Close));
+        write_frame(
+            &mut peer,
+            &Frame::new(environment, Message::Ack(Acknowledgement::Close)),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    });
+    let mut client = ControlClient::start(
+        ClientConfig::new(environment, Architecture::Arm64, Duration::from_secs(1)).unwrap(),
+        reader,
+        writer,
+    )
+    .unwrap();
+    assert_eq!(
+        client.next(deadline()).await.unwrap(),
+        ClientEvent::RelayReady
+    );
+    assert_eq!(
+        client.next(deadline()).await.unwrap(),
+        ClientEvent::BootstrapReady
+    );
+    (client, peer)
+}
+
+fn foreign_invocation() -> rustack_lambda_runtime::session::Invocation {
+    use rustack_lambda_runtime::{
+        metadata::local_trace_id,
+        protocol::{AttemptId, Payload},
+        session::Invocation,
+    };
+    Invocation::new(
+        AttemptId::default(),
+        deadline(),
+        "arn:aws:lambda:us-east-1:000000000000:function:other"
+            .parse()
+            .unwrap(),
+        local_trace_id().unwrap(),
+        Payload::try_from(Bytes::from_static(b"{}")).unwrap(),
+    )
+    .unwrap()
+}
+
+#[tokio::test]
+async fn test_should_bound_long_caller_deadline_by_start_budget_before_admission_validation() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut manager =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let mut handle = manager
+        .port()
+        .spawn(plan(&lease), Instant::now() + Duration::from_mins(15))
+        .unwrap();
+    handle.cancel();
+    handle.shutdown(deadline()).await.unwrap();
+    manager.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest::rstest]
+#[case::abandoned(false)]
+#[case::consumed(true)]
+#[tokio::test]
+async fn test_should_retire_ready_reply_only_when_its_waiter_is_abandoned(#[case] consumed: bool) {
+    use std::{
+        future::Future,
+        task::{Context, Waker},
+    };
+
+    use rustack_lambda_runtime::protocol::Payload;
+    let signals = Signals::new();
+    signals.phase(EnvironmentPhase::Idle);
+    let (calls, mut mailbox) = mpsc::channel(4);
+    let (_done, settlement) = watch::channel(None);
+    let mut handle = EnvironmentHandle {
+        id: EnvironmentId::default(),
+        calls,
+        signals: signals.clone(),
+        settlement,
+    };
+    {
+        let invoke = handle.invoke(foreign_invocation(), false);
+        tokio::pin!(invoke);
+        assert!(
+            invoke
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+        let call = mailbox.recv().await.unwrap();
+        call.reply
+            .send(Ok(EnvironmentResponse {
+                result: rustack_lambda_runtime::session::RuntimeResult::Success(
+                    Payload::try_from(Bytes::from_static(b"{}")).unwrap(),
+                ),
+                logs: Bytes::new(),
+            }))
+            .unwrap();
+        if consumed {
+            assert!(matches!(
+                invoke
+                    .as_mut()
+                    .poll(&mut Context::from_waker(Waker::noop())),
+                std::task::Poll::Ready(Ok(_))
+            ));
+        }
+    }
+    assert_eq!(
+        *signals.stop.borrow(),
+        !consumed,
+        "only abandoned replies retire the environment"
+    );
+}
+
+#[tokio::test]
+async fn test_should_publish_intent_before_create_and_retain_reservation_until_durable_erase() {
+    use std::os::unix::fs::symlink;
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let mut manager = EnvironmentManager::start(
+        wire.port()
+            .bind_directory(&directory, deadline())
+            .await
+            .unwrap(),
+        directory.clone(),
+        EnvironmentConfig::default(),
+    )
+    .unwrap();
+    let mut handle = manager.port().spawn(plan(&directory), deadline()).unwrap();
+    let create = daemon.next().await;
+    assert!(create.head.starts_with("POST "));
+    assert_eq!(
+        directory.container_records(deadline()).await.unwrap().len(),
+        1
+    );
+    let staging = root
+        .path()
+        .join(".rustack-lambda-docker/containers.pending");
+    let outside = root.path().join("outside");
+    tokio::fs::write(&outside, b"keep").await.unwrap();
+    symlink(&outside, &staging).unwrap();
+    create.reply(400, b"{}").await;
+    quarantined(&handle).await;
+    assert_eq!(manager.port().status().allocated, 1);
+    tokio::fs::remove_file(staging).await.unwrap();
+    assert_eq!(
+        directory.container_records(deadline()).await.unwrap().len(),
+        1
+    );
+    handle.shutdown(deadline()).await.unwrap();
+    assert_eq!(manager.port().status().allocated, 0);
+    assert_eq!(directory.container_records(deadline()).await.unwrap(), []);
+    assert_eq!(tokio::fs::read(outside).await.unwrap(), b"keep");
+    manager.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[test]
+fn test_should_distinguish_impossible_memory_from_temporary_contention_without_spending_capacity() {
+    let config = EnvironmentSettings::builder()
+        .environments(1)
+        .memory_bytes(256 * 1024 * 1024)
+        .build()
+        .try_into()
+        .unwrap();
+    let budget = Arc::new(Budget::new(config));
+    assert!(matches!(
+        budget.reserve(256 * 1024 * 1024 + 1),
+        Err(EnvironmentError::MemoryLimit)
+    ));
+    assert_eq!(budget.count(), 0);
+    assert_eq!(budget.memory.load(Ordering::Acquire), 0);
+    let exact = budget.reserve(256 * 1024 * 1024).unwrap();
+    assert!(matches!(budget.reserve(1), Err(EnvironmentError::Busy)));
+    assert!(matches!(
+        budget.reserve(256 * 1024 * 1024 + 1),
+        Err(EnvironmentError::MemoryLimit)
+    ));
+    assert_eq!(budget.count(), 1);
+    drop(exact);
+    assert_eq!(budget.count(), 0);
+    assert_eq!(budget.memory.load(Ordering::Acquire), 0);
+}
diff --git a/crates/rustack-lambda-core/src/docker/environment/tests/initialization.rs b/crates/rustack-lambda-core/src/docker/environment/tests/initialization.rs
new file mode 100644
index 00000000..7a4a3d69
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/tests/initialization.rs
@@ -0,0 +1,290 @@
+//! Post-bootstrap initialization failures through the actual runtime stack.
+
+use std::{
+    future::Future,
+    net::SocketAddr,
+    task::{Context, Wake, Waker},
+};
+
+use rustack_lambda_runtime::{
+    client::{ClientConfig, ClientEvent, ControlClient},
+    http,
+    metadata::local_trace_id,
+    protocol::{Architecture, AttemptId},
+    relay::{self, RelayConfig},
+};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt, duplex, split},
+    net::TcpStream,
+    sync::{Notify, Semaphore},
+};
+
+use super::*;
+use crate::docker::{DockerOutputReader, FunctionLogs, plan::ContainerRole};
+
+struct Offered(Notify);
+impl Wake for Offered {
+    fn wake(self: Arc<Self>) {
+        self.0.notify_one();
+    }
+    fn wake_by_ref(self: &Arc<Self>) {
+        self.0.notify_one();
+    }
+}
+
+#[rstest::rstest]
+#[case::idle_bounded(false, 32768)]
+#[case::idle_oversized(false, 32769)]
+#[case::busy_bounded(true, 32768)]
+#[case::busy_oversized(true, 32769)]
+#[tokio::test]
+async fn test_should_preserve_init_error_after_abandoned_bootstrap_poll_and_join_retirement(
+    #[case] busy: bool,
+    #[case] bytes: usize,
+) {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let planned = Arc::new(plan(&directory()));
+    let RuntimeFixture {
+        address,
+        session,
+        mut relay,
+        client,
+    } = runtime(planned.environment_id()).await;
+
+    let offered = Arc::new(Offered(Notify::new()));
+    let waker = Waker::from(offered.clone());
+    let mut observer = Box::pin(session.next(deadline()));
+    if busy {
+        assert!(
+            observer
+                .as_mut()
+                .poll(&mut Context::from_waker(&waker))
+                .is_pending()
+        );
+    }
+    let signals = Signals::new();
+    signals.phase(EnvironmentPhase::Idle);
+    let (mut task, io_task, calls, mut quiet) =
+        start_worker(wire.port(), planned.clone(), client, signals.clone());
+    let inspected = function_inspection(&planned);
+    let daemon_signals = signals.clone();
+    let (retiring, observed) = oneshot::channel();
+    let (release, released) = oneshot::channel();
+    let container_cleanup = tokio::spawn(async move {
+        loop {
+            let request = daemon.next().await;
+            assert!(request.head.starts_with("GET "));
+            assert!(request.head.contains(&"a".repeat(64)));
+            if daemon_signals.status.borrow().phase == EnvironmentPhase::Retiring {
+                retiring.send(()).unwrap();
+                timeout_at(deadline(), released).await.unwrap().unwrap();
+                request.reply(404, b"{}").await;
+                break;
+            }
+            request.reply(200, &inspected).await;
+        }
+        daemon.close().await;
+    });
+    let (stop, cancellation) = watch::channel(false);
+    let (reply, mut response) = oneshot::channel();
+    if busy {
+        calls
+            .send(Call {
+                invocation: Invocation::new(
+                    AttemptId::default(),
+                    deadline(),
+                    "arn:aws:lambda:us-east-1:000000000000:function:policy-fixture"
+                        .parse()
+                        .unwrap(),
+                    local_trace_id().unwrap(),
+                    Payload::try_from(Bytes::from_static(b"{}")).unwrap(),
+                )
+                .unwrap(),
+                capture_logs: false,
+                cancellation,
+                reply,
+            })
+            .await
+            .unwrap();
+        timeout_at(deadline(), offered.0.notified()).await.unwrap();
+        assert_eq!(signals.status.borrow().phase, EnvironmentPhase::Busy);
+    } else {
+        drop(reply);
+    }
+    // A wake proves an offer exists. Never repoll: that would acknowledge delivery.
+    drop(observer);
+    let marker = b"private initialization cause";
+    let mut payload = vec![b'x'; bytes];
+    payload
+        .get_mut(..marker.len())
+        .unwrap()
+        .copy_from_slice(marker);
+    post_init_error(address, &payload).await;
+    timeout_at(deadline(), observed).await.unwrap().unwrap();
+    assert!(!task.is_finished());
+    if busy {
+        assert!(matches!(
+            response.try_recv(),
+            Err(oneshot::error::TryRecvError::Empty)
+        ));
+    }
+    release.send(()).unwrap();
+    timeout_at(deadline(), &mut task).await.unwrap().unwrap();
+    io_task.wait().await.unwrap();
+    timeout_at(deadline(), relay.wait()).await.unwrap().unwrap();
+    container_cleanup.await.unwrap();
+    let error = signals.status.borrow().error.clone().unwrap();
+    assert_class(&error, &payload);
+    if busy {
+        assert_class(&response.await.unwrap().unwrap_err(), &payload);
+    }
+    assert!(!format!("{error:?} {error}").contains(std::str::from_utf8(marker).unwrap()));
+    assert_eq!(quiet.read(&mut [0; 1]).await.unwrap(), 0);
+    assert!(TcpStream::connect(address).await.is_err());
+    drop(stop);
+    drop(calls);
+    wire.shutdown().await.unwrap();
+}
+
+fn start_worker(
+    docker: DockerPort,
+    planned: Arc<EnvironmentPlan>,
+    client: ControlClient,
+    signals: Signals,
+) -> (
+    tokio::task::JoinHandle<()>,
+    Arc<CleanupTask>,
+    mpsc::Sender<Call>,
+    tokio::io::DuplexStream,
+) {
+    let (quiet, reader) = duplex(8);
+    let logs = FunctionLogs::start_reader(
+        DockerOutputReader::new(reader, Duration::from_secs(1)).unwrap(),
+        4096,
+    )
+    .unwrap();
+    let config = EnvironmentConfig::default();
+    let io_task = Arc::new(CleanupTask::default());
+    let progress = Arc::new(cleanup::Progress::new());
+    progress
+        .phase(ContainerRole::Function)
+        .send_replace(cleanup::Phase::Known("a".repeat(64).parse().unwrap()));
+    let worker = worker::Worker::builder()
+        .docker(docker)
+        .config(config)
+        .plan(planned)
+        .progress(progress)
+        .cleanup(Arc::new(Semaphore::new(2)))
+        .health(Arc::new(Health::default()))
+        .signals(signals.clone())
+        .global(watch::channel(false).0)
+        .io(io_task.clone())
+        .runtime(Handle::current())
+        .build();
+    let mut io = io::IoGuard::new(Handle::current(), io_task.clone(), config, signals);
+    io.test_streams(client, logs);
+    let (calls, mut mailbox) = mpsc::channel(4);
+    let task = tokio::spawn(async move {
+        worker.serve_and_retire_test(&mut io, &mut mailbox).await;
+    });
+    (task, io_task, calls, quiet)
+}
+
+fn function_inspection(plan: &EnvironmentPlan) -> Vec<u8> {
+    let mut owned = inspected(plan);
+    owned["Name"] = json!(format!("/{}", plan.function_key().as_str()));
+    owned["Config"]["Labels"]["rustack.lambda.role"] = json!("function");
+    owned["State"]["Running"] = json!(true);
+    serde_json::to_vec(&owned).unwrap()
+}
+
+async fn post_init_error(address: SocketAddr, payload: &[u8]) {
+    timeout_at(deadline(), async {
+        let mut stream = TcpStream::connect(address).await.unwrap();
+        let head = format!(
+            "POST /2018-06-01/runtime/init/error HTTP/1.1\r\nHost: localhost\r\nContent-Length: \
+             {}\r\nConnection: close\r\n\r\n",
+            payload.len()
+        );
+        stream.write_all(head.as_bytes()).await.unwrap();
+        stream.write_all(payload).await.unwrap();
+        let mut response = Vec::new();
+        stream.take(16384).read_to_end(&mut response).await.unwrap();
+        assert!(response.starts_with(b"HTTP/1.1 202 "), "{response:?}");
+    })
+    .await
+    .unwrap();
+}
+
+fn assert_class(error: &EnvironmentError, payload: &[u8]) {
+    if payload.len() <= 32768 {
+        let EnvironmentError::Initialization(received) = error else {
+            panic!("{error:?}");
+        };
+        assert_eq!(received.as_ref(), payload);
+    } else {
+        assert!(
+            matches!(error, EnvironmentError::Docker(DockerError::Protocol)),
+            "{error:?}"
+        );
+    }
+}
+
+struct RuntimeFixture {
+    address: SocketAddr,
+    session: rustack_lambda_runtime::session::SessionHandle,
+    relay: relay::RelayHandle,
+    client: ControlClient,
+}
+async fn runtime(environment: EnvironmentId) -> RuntimeFixture {
+    let api = http::start().await.unwrap();
+    let address = api.addr();
+    let session = api.session().clone();
+    let (host, peer) = duplex(65536);
+    let (reader, writer) = split(peer);
+    let relay = relay::start(
+        api,
+        RelayConfig::new(
+            environment,
+            Architecture::Arm64,
+            Duration::from_secs(600),
+            Duration::from_secs(1),
+            Duration::from_secs(10),
+        )
+        .unwrap(),
+        reader,
+        writer,
+    )
+    .unwrap();
+    let (reader, writer) = split(host);
+    let mut client = ControlClient::start(
+        ClientConfig::new(environment, Architecture::Arm64, Duration::from_secs(1)).unwrap(),
+        reader,
+        writer,
+    )
+    .unwrap();
+    assert_eq!(
+        client.next(deadline()).await.unwrap(),
+        ClientEvent::RelayReady
+    );
+    let mut first_poll = Box::pin(session.next(deadline()));
+    assert!(
+        first_poll
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    assert_eq!(
+        client.next(deadline()).await.unwrap(),
+        ClientEvent::BootstrapReady
+    );
+    drop(first_poll);
+
+    RuntimeFixture {
+        address,
+        session,
+        relay,
+        client,
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/environment/worker.rs b/crates/rustack-lambda-core/src/docker/environment/worker.rs
new file mode 100644
index 00000000..fba8b9fa
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/environment/worker.rs
@@ -0,0 +1,535 @@
+//! One ordered environment worker; all resources remain registered above its task.
+
+use std::{future::pending, sync::Arc, time::Duration};
+
+use bytes::Bytes;
+use http::StatusCode;
+use rustack_lambda_runtime::{
+    client::ClientEvent,
+    protocol::{Architecture as RuntimeArchitecture, EnvironmentId, HandlerTimeout},
+    session::RuntimeResult,
+};
+use tokio::{
+    runtime::Handle,
+    sync::{Semaphore, mpsc, oneshot, watch},
+    time::{Instant, interval, sleep_until},
+};
+use typed_builder::TypedBuilder;
+
+use super::{
+    Call, EnvironmentConfig, EnvironmentError, EnvironmentPhase, EnvironmentResponse,
+    actor::{Health, Signals},
+    cleanup::{Cleaner, Phase, Progress},
+    io::IoGuard,
+};
+use crate::{
+    artifact::{Architecture, DeploymentArtifact},
+    docker::{
+        DockerError, DockerKey, DockerPort, EnvironmentPlan,
+        connection::stopped as wait_for_stop,
+        mutation::MutationGuard,
+        ownership::ContainerRecord,
+        plan::ContainerRole,
+        zip::{CodeStageError, StageInput},
+    },
+    invocation::CleanupTask,
+};
+
+#[derive(TypedBuilder)]
+pub(super) struct Worker {
+    docker: DockerPort,
+    config: EnvironmentConfig,
+    plan: Arc<EnvironmentPlan>,
+    progress: Arc<Progress>,
+    cleanup: Arc<Semaphore>,
+    health: Arc<Health>,
+    signals: Signals,
+    global: watch::Sender<bool>,
+    io: Arc<CleanupTask>,
+    runtime: Handle,
+}
+pub(super) type FinalReply = (
+    oneshot::Sender<Result<EnvironmentResponse, EnvironmentError>>,
+    Result<EnvironmentResponse, EnvironmentError>,
+);
+impl Worker {
+    #[cfg(test)]
+    pub(super) async fn serve_and_retire_test(
+        &self,
+        io: &mut IoGuard,
+        mailbox: &mut mpsc::Receiver<Call>,
+    ) {
+        let cleaner = self.cleaner();
+        let pending = self.serve(io, &cleaner, mailbox).await;
+        self.finish(io, &cleaner, mailbox, pending).await;
+    }
+    #[cfg(test)]
+    pub(super) async fn serve_test(
+        &self,
+        io: &mut IoGuard,
+        cleaner: &Cleaner,
+        mailbox: &mut mpsc::Receiver<Call>,
+    ) -> Option<FinalReply> {
+        self.serve(io, cleaner, mailbox).await
+    }
+
+    pub(super) async fn run(
+        self,
+        mut mailbox: mpsc::Receiver<Call>,
+        deadline: Instant,
+    ) -> Result<(), EnvironmentError> {
+        let mut io = IoGuard::new(
+            self.runtime.clone(),
+            self.io.clone(),
+            self.config,
+            self.signals.clone(),
+        );
+        let cleaner = self.cleaner();
+        let pending = match self.initialize(&mut io, deadline).await {
+            Ok(()) => {
+                self.signals.phase(EnvironmentPhase::Idle);
+                self.serve(&mut io, &cleaner, &mut mailbox).await
+            }
+            Err(error) => {
+                self.signals.error(error);
+                None
+            }
+        };
+        self.finish(&mut io, &cleaner, &mut mailbox, pending).await;
+        Ok(())
+    }
+    async fn finish(
+        &self,
+        io: &mut IoGuard,
+        cleaner: &Cleaner,
+        mailbox: &mut mpsc::Receiver<Call>,
+        pending: Option<FinalReply>,
+    ) {
+        self.signals.phase(EnvironmentPhase::Retiring);
+        mailbox.close();
+        while let Ok(call) = mailbox.try_recv() {
+            let _ = call.reply.send(Err(EnvironmentError::Stopped));
+        }
+        cleaner.retire(&self.io, Some(io)).await;
+        if let Some((reply, result)) = pending {
+            let _ = reply.send(result);
+        }
+    }
+    fn cleaner(&self) -> Cleaner {
+        Cleaner::builder()
+            .docker(self.docker.clone())
+            .config(self.config)
+            .plan(self.plan.clone())
+            .progress(self.progress.clone())
+            .health(self.health.clone())
+            .cleanup(self.cleanup.clone())
+            .signals(self.signals.clone())
+            .build()
+    }
+    fn check(&self, deadline: Instant) -> Result<(), EnvironmentError> {
+        if *self.global.borrow() || *self.signals.stop.borrow() {
+            Err(EnvironmentError::Cancelled)
+        } else if Instant::now() >= deadline {
+            Err(EnvironmentError::Deadline)
+        } else {
+            Ok(())
+        }
+    }
+    async fn create(
+        &self,
+        role: ContainerRole,
+        deadline: Instant,
+    ) -> Result<DockerKey, EnvironmentError> {
+        self.check(deadline)?;
+        let mutation = MutationGuard::new();
+        self.progress
+            .phase(role)
+            .send_replace(Phase::Uncertain(mutation.receipt()));
+        let record = ContainerRecord::from_plan(&self.plan, role)?;
+        self.plan
+            .directory
+            .prepare_container(record.clone(), self.config.deadline())
+            .await?;
+        let created = self
+            .plan
+            .create_tracked(role, &self.docker, self.config.deadline(), mutation)
+            .await;
+        if matches!(
+            &created,
+            Err(DockerError::Busy
+                | DockerError::Status(StatusCode::BAD_REQUEST | StatusCode::NOT_FOUND))
+        ) {
+            self.progress.phase(role).send_replace(Phase::Clean);
+        }
+        let created = created?;
+        let inspected = self
+            .docker
+            .inspect_container(self.plan.key(role), self.config.deadline())
+            .await?;
+        let id = self.plan.owned(role, &inspected)?;
+        if id.as_str() != created.id {
+            return Err(DockerError::Protocol.into());
+        }
+        self.plan
+            .directory
+            .know_container(record, id.clone(), self.config.deadline())
+            .await?;
+        self.progress
+            .phase(role)
+            .send_replace(Phase::Known(id.clone()));
+        self.check(deadline)?;
+        Ok(id)
+    }
+    async fn initialize(
+        &self,
+        io: &mut IoGuard,
+        deadline: Instant,
+    ) -> Result<(), EnvironmentError> {
+        let initialization_started = Instant::now();
+        if let Some(zip) = &self.plan.zip {
+            let DeploymentArtifact::Zip(artifact) = &self.plan.revision().artifact else {
+                return Err(EnvironmentError::Configuration);
+            };
+            zip.start(
+                StageInput::builder()
+                    .artifact(artifact.clone())
+                    .deadline(deadline)
+                    .global(self.global.subscribe())
+                    .stop(self.signals.stop.subscribe())
+                    .build(),
+                &self.runtime,
+            )?;
+            if let Err(error) = zip.wait_ready(deadline).await {
+                return Err(match error {
+                    CodeStageError::AdmissionBusy => EnvironmentError::Busy,
+                    CodeStageError::Docker(DockerError::Worker) => {
+                        self.health.fail();
+                        EnvironmentError::Worker
+                    }
+                    CodeStageError::Docker(other) => other.into(),
+                });
+            }
+            self.check(deadline)?;
+        }
+        let relay = self.create(ContainerRole::Relay, deadline).await?;
+        self.signals.phase(EnvironmentPhase::Initializing);
+        let attached = self.docker.attach(&relay, self.config.deadline()).await?;
+        let architecture = match self.plan.revision().architecture {
+            Architecture::Arm64 => RuntimeArchitecture::Arm64,
+            Architecture::X86_64 => RuntimeArchitecture::X86_64,
+        };
+        io.control(attached, self.plan.environment_id(), architecture)?;
+        self.check(deadline)?;
+        self.docker
+            .start_container(&relay, self.config.deadline())
+            .await?;
+        self.check(deadline)?;
+        match self.next(io, deadline, None, None).await? {
+            ClientEvent::RelayReady => {}
+            _ => return Err(DockerError::Protocol.into()),
+        }
+        let relay_ready = Instant::now();
+        let function = self.create(ContainerRole::Function, deadline).await?;
+        io.logs(
+            self.docker
+                .attach_logs(&function, self.config.deadline())
+                .await?,
+        )?;
+        self.check(deadline)?;
+        self.docker
+            .start_container(&function, self.config.deadline())
+            .await?;
+        let bootstrap_deadline = deadline.min(Instant::now() + self.config.0.init);
+        let ready = self
+            .next(io, bootstrap_deadline, Some(&self.cleaner()), None)
+            .await
+            .map_err(|error| {
+                if matches!(error, EnvironmentError::Deadline) && bootstrap_deadline < deadline {
+                    EnvironmentError::InitializationTimeout
+                } else {
+                    error
+                }
+            })?;
+        finish_initialization(
+            ready,
+            self.plan.zip.is_none().then(|| self.plan.environment_id()),
+            initialization_started,
+            relay_ready,
+        )
+    }
+    async fn next(
+        &self,
+        io: &mut IoGuard,
+        deadline: Instant,
+        health: Option<&Cleaner>,
+        mut cancellation: Option<&mut watch::Receiver<bool>>,
+    ) -> Result<ClientEvent, EnvironmentError> {
+        let mut global = self.global.subscribe();
+        let mut stopped = self.signals.stop.subscribe();
+        let mut tick = interval(Duration::from_secs(1));
+        tick.tick().await;
+        loop {
+            self.check(deadline)?;
+            if cancellation
+                .as_ref()
+                .is_some_and(|cancel| *cancel.borrow() || cancel.has_changed().is_err())
+            {
+                return Err(EnvironmentError::Cancelled);
+            }
+            tokio::select! {biased;
+                ()=wait_for_stop(&mut global)=>return Err(EnvironmentError::Cancelled),
+                ()=wait_for_stop(&mut stopped)=>return Err(EnvironmentError::Cancelled),
+                ()=sleep_until(deadline)=>return Err(EnvironmentError::Deadline),
+                ()=async{match &mut cancellation{Some(cancel)=>{let _=cancel.wait_for(|stop|*stop).await;},None=>pending().await,}}=>return Err(EnvironmentError::Cancelled),
+                result=io.client()?.next(deadline)=>return result.map_err(EnvironmentError::from),
+                _=tick.tick(),if health.is_some()=>{if let Some(health)=health{health.inspect_health().await?;io.healthy().await?;tick.reset();}},
+            }
+        }
+    }
+    async fn serve(
+        &self,
+        io: &mut IoGuard,
+        cleaner: &Cleaner,
+        mailbox: &mut mpsc::Receiver<Call>,
+    ) -> Option<FinalReply> {
+        let mut global = self.global.subscribe();
+        let mut stopped = self.signals.stop.subscribe();
+        let mut tick = interval(Duration::from_secs(1));
+        tick.tick().await;
+        let mut idle = Instant::now() + self.config.0.idle;
+        loop {
+            let action = tokio::select! {biased;
+                ()=wait_for_stop(&mut global)=>return None,
+                ()=wait_for_stop(&mut stopped)=>return None,
+                ()=sleep_until(idle)=>return None,
+                _=tick.tick()=>{let result=async{cleaner.inspect_health().await?;io.healthy().await}.await;tick.reset();if let Err(error)=result{self.signals.error(error);return None;}continue;},
+                result=io.client().ok()?.next(idle)=>{self.signals.error(match result {Ok(event)=>Self::event_failure(event),Err(error)=>error.into()});return None;},
+                call=mailbox.recv()=>call,
+            };
+            let mut call = action?;
+            self.signals.phase(EnvironmentPhase::Busy);
+            let result = self.call(io, cleaner, &mut call).await;
+            let reusable = matches!(
+                &result,
+                Ok(EnvironmentResponse {
+                    result: RuntimeResult::Success(_),
+                    ..
+                })
+            ) && !call.reply.is_closed()
+                && io.reusable();
+            if reusable {
+                self.signals.phase(EnvironmentPhase::Idle);
+                let _ = call.reply.send(result);
+                idle = Instant::now() + self.config.0.idle;
+            } else {
+                if let Err(error) = &result {
+                    self.signals.error(error.clone());
+                }
+                return Some((call.reply, result));
+            }
+        }
+    }
+    async fn call(
+        &self,
+        io: &mut IoGuard,
+        cleaner: &Cleaner,
+        call: &mut Call,
+    ) -> Result<EnvironmentResponse, EnvironmentError> {
+        let (attempt, deadline, arn, _, _) = call.invocation.parts();
+        let name = arn
+            .as_ref()
+            .split_once(":function:")
+            .and_then(|(_, name)| name.split(':').next());
+        if name != Some(self.plan.revision().function_name.as_str()) {
+            return Err(EnvironmentError::Configuration);
+        }
+        self.check(deadline)?;
+        if *call.cancellation.borrow() || call.reply.is_closed() {
+            return Err(EnvironmentError::Cancelled);
+        }
+        let log_window = io.begin_logs(attempt).await?;
+        self.check(deadline)?;
+        if *call.cancellation.borrow() || call.reply.is_closed() {
+            return Err(EnvironmentError::Cancelled);
+        }
+        io.client()?
+            .invoke(
+                call.invocation.clone().with_handler_timeout(
+                    HandlerTimeout::try_from(self.plan.revision().timeout)
+                        .map_err(|_| EnvironmentError::Configuration)?,
+                ),
+                deadline.min(self.config.deadline()),
+            )
+            .await?;
+        let result = self
+            .next(io, deadline, Some(cleaner), Some(&mut call.cancellation))
+            .await;
+        match result {
+            Ok(ClientEvent::InvocationTimedOut(returned)) if returned == attempt => {
+                Err(EnvironmentError::Timeout(self.plan.revision().timeout))
+            }
+            Ok(ClientEvent::InvocationResult {
+                attempt: returned,
+                result,
+            }) if returned == attempt => {
+                let tail = io.finish_logs(log_window).await?;
+                let logs = if call.capture_logs {
+                    tail
+                } else {
+                    Bytes::new()
+                };
+                self.check(deadline)?;
+                if *call.cancellation.borrow() || call.reply.is_closed() {
+                    return Err(EnvironmentError::Cancelled);
+                }
+                Ok(EnvironmentResponse { result, logs })
+            }
+            Ok(event) => Err(Self::event_failure(event)),
+            Err(error) => {
+                if io
+                    .client()?
+                    .cancel(attempt, self.config.deadline())
+                    .await
+                    .is_ok()
+                {
+                    let _ = io.client()?.next(self.config.deadline()).await;
+                }
+                Err(error)
+            }
+        }
+    }
+    fn event_failure(event: ClientEvent) -> EnvironmentError {
+        match event {
+            ClientEvent::InitError(payload) if payload.as_ref().len() <= 32768 => {
+                EnvironmentError::Initialization(payload)
+            }
+            _ => DockerError::Protocol.into(),
+        }
+    }
+}
+
+fn micros(duration: Duration) -> u64 {
+    u64::try_from(duration.as_nanos().saturating_add(999) / 1000).unwrap_or(u64::MAX)
+}
+
+fn finish_initialization(
+    event: ClientEvent,
+    image: Option<EnvironmentId>,
+    started: Instant,
+    relay: Instant,
+) -> Result<(), EnvironmentError> {
+    match event {
+        ClientEvent::BootstrapReady => {
+            if let Some(environment) = image {
+                tracing::info!(
+                    target: "rustack_lambda_core::docker::initialization",
+                    environment_id = %environment,
+                    relay_micros = micros(relay.duration_since(started)),
+                    ric_micros = micros(relay.elapsed()),
+                    "Image environment ready"
+                );
+            }
+            Ok(())
+        }
+        event => Err(Worker::event_failure(event)),
+    }
+}
+
+#[cfg(test)]
+mod timing_tests {
+    use std::{
+        error::Error,
+        io::{self, Write},
+        mem,
+        sync::mpsc::{SyncSender, sync_channel},
+        time::Duration,
+    };
+
+    use bytes::Bytes;
+    use rustack_lambda_runtime::{
+        client::ClientEvent,
+        protocol::{EnvironmentId, Payload},
+    };
+    use tokio::time::{Instant, advance};
+
+    use super::{finish_initialization, micros};
+
+    #[derive(Debug)]
+    struct Line {
+        bytes: Vec<u8>,
+        sender: SyncSender<Vec<u8>>,
+    }
+    impl Write for Line {
+        fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+            if self.bytes.len().saturating_add(bytes.len()) > 1024 {
+                return Err(io::Error::other("bounded initialization diagnostic"));
+            }
+            self.bytes.extend_from_slice(bytes);
+            Ok(bytes.len())
+        }
+        fn flush(&mut self) -> io::Result<()> {
+            Ok(())
+        }
+    }
+    impl Drop for Line {
+        fn drop(&mut self) {
+            let _ = self.sender.try_send(mem::take(&mut self.bytes));
+        }
+    }
+
+    #[test]
+    fn test_should_round_initialization_durations_up_without_overflow() {
+        assert_eq!(micros(Duration::ZERO), 0);
+        assert_eq!(micros(Duration::from_nanos(1)), 1);
+        assert_eq!(micros(Duration::from_nanos(1000)), 1);
+        assert_eq!(micros(Duration::from_nanos(1001)), 2);
+        assert_eq!(micros(Duration::MAX), u64::MAX);
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn test_should_report_only_successful_image_initialization_without_payloads()
+    -> Result<(), Box<dyn Error>> {
+        let (sender, received) = sync_channel(4);
+        let subscriber = tracing_subscriber::fmt()
+            .without_time()
+            .with_ansi(false)
+            .with_writer(move || Line {
+                bytes: Vec::new(),
+                sender: sender.clone(),
+            })
+            .finish();
+        let _guard = tracing::subscriber::set_default(subscriber);
+        let started = Instant::now();
+        advance(Duration::from_millis(1)).await;
+        let relay = Instant::now();
+        advance(Duration::from_millis(2)).await;
+        let environment = EnvironmentId::default();
+        finish_initialization(
+            ClientEvent::BootstrapReady,
+            Some(environment),
+            started,
+            relay,
+        )?;
+        let line = String::from_utf8(received.try_recv()?)?;
+        assert!(line.contains("relay_micros=1000") && line.contains("ric_micros=2000"));
+        assert!(line.contains(&environment.to_string()));
+        let secret = Payload::try_from(Bytes::from_static(b"runtime-boundary-secret"))?;
+        assert!(
+            finish_initialization(
+                ClientEvent::InitError(secret),
+                Some(environment),
+                started,
+                relay
+            )
+            .is_err()
+        );
+        assert!(
+            finish_initialization(ClientEvent::RelayReady, Some(environment), started, relay)
+                .is_err()
+        );
+        finish_initialization(ClientEvent::BootstrapReady, None, started, relay)?;
+        assert!(received.try_recv().is_err());
+        assert!(!line.contains("runtime-boundary-secret"));
+        Ok(())
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/executor.rs b/crates/rustack-lambda-core/src/docker/executor.rs
new file mode 100644
index 00000000..e555e8f3
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/executor.rs
@@ -0,0 +1,460 @@
+//! Trusted runtime composition; startup qualification remains coordinator-owned.
+//!
+//! The synchronous readiness trait is object-safe for trusted in-process startup
+//! injection. Executor uses async-trait for the existing dynamic backend boundary.
+
+use std::{
+    fmt,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use async_trait::async_trait;
+use base64::{Engine, engine::general_purpose::STANDARD};
+use parking_lot::Mutex;
+use rustack_lambda_runtime::{
+    metadata::{MetadataError, local_trace_id},
+    protocol::{FunctionArn, Payload, ProtocolError},
+    session::{Invocation, RuntimeResult, SessionError},
+};
+use thiserror::Error;
+use tokio::{
+    runtime::Handle,
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+
+use super::{
+    ContainerPolicy, DirectoryLease, DockerError, DockerSdkEnvironment, DockerZipRuntime,
+    EnvironmentError, EnvironmentPlan, EnvironmentPool, EnvironmentPort, EnvironmentResponse,
+    PoolConfig, PoolPort,
+};
+use crate::{
+    artifact::{Architecture, DeploymentArtifact, PinnedImage},
+    executor::{Executor, ExecutorError, InvokeRequest, InvokeResponse},
+    invocation::{CleanupTask, InvocationContext},
+};
+
+/// Redacted typed failures at the Docker Executor composition boundary.
+#[derive(Clone, Error)]
+#[non_exhaustive]
+pub enum DockerExecutorError {
+    /// Startup/shutdown owner preserves its first diagnostic after physical retirement.
+    #[error("Docker runtime owner failed")]
+    Owner(#[source] Arc<super::DockerStartupError>),
+    /// Invalid trusted settings, runtime scope or captured invocation metadata.
+    #[error("invalid Docker executor configuration")]
+    Configuration,
+    /// Startup qualification was not granted or admission has been revoked.
+    #[error("Docker execution is not ready")]
+    Unavailable,
+    /// Invalid bounded invocation payload, ARN or attempt identity.
+    #[error("invalid Docker invocation metadata")]
+    Request(#[source] Arc<ProtocolError>),
+    /// Wall-clock tracing metadata could not be generated.
+    #[error("Docker invocation clock failed")]
+    Clock(#[from] MetadataError),
+    /// Runtime session rejected construction before pool admission.
+    #[error("Docker invocation session failed")]
+    Session(#[from] SessionError),
+    /// Retained environment preserves initialization, exit/OOM and wire classes.
+    #[error("Docker environment failed: {0}")]
+    Environment(#[from] EnvironmentError),
+}
+impl fmt::Debug for DockerExecutorError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl From<ProtocolError> for DockerExecutorError {
+    fn from(error: ProtocolError) -> Self {
+        Self::Request(Arc::new(error))
+    }
+}
+
+/// Trusted startup evidence port for the exact runtime inputs injected below.
+///
+/// Implementations must make bounded, nonblocking checks without IO. The startup
+/// coordinator owns actual reconciliation and probe evidence; this trait alone
+/// cannot establish it. Revocation rejects new calls; shutdown retires active work.
+pub trait DockerReadiness: fmt::Debug + Send + Sync + 'static {
+    /// Check coordinator-owned qualification for this runtime.
+    ///
+    /// # Errors
+    /// Returns Unavailable or a typed qualification failure after revocation.
+    ///
+    /// ```no_run
+    /// # fn ready(evidence: &dyn rustack_lambda_core::executor::DockerReadiness) {
+    /// let qualified = evidence.check().is_ok();
+    /// # }
+    /// ```
+    fn check(&self) -> Result<(), DockerExecutorError>;
+}
+
+/// Validated pool and independent public cleanup-wait budgets.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct DockerExecutorSettings {
+    pool: PoolConfig,
+    cleanup: Duration,
+}
+impl Default for DockerExecutorSettings {
+    fn default() -> Self {
+        Self {
+            pool: PoolConfig::default(),
+            cleanup: Duration::from_secs(10),
+        }
+    }
+}
+impl DockerExecutorSettings {
+    /// Validate a whole-second cleanup budget in1..60s.
+    ///
+    /// # Errors
+    /// Rejects zero, fractional or excessive cleanup duration.
+    ///
+    /// ```
+    /// let settings = rustack_lambda_core::executor::DockerExecutorSettings::new(
+    ///     Default::default(), std::time::Duration::from_secs(10))?;
+    /// # Ok::<(), rustack_lambda_core::executor::DockerExecutorError>(())
+    /// ```
+    pub fn new(pool: PoolConfig, cleanup: Duration) -> Result<Self, DockerExecutorError> {
+        if cleanup.subsec_nanos() != 0 || !(1..=60).contains(&cleanup.as_secs()) {
+            return Err(DockerExecutorError::Configuration);
+        }
+        Ok(Self { pool, cleanup })
+    }
+}
+
+/// Trusted startup inputs; readiness must qualify this exact scope/relay/policy.
+#[derive(Debug, Clone, TypedBuilder)]
+#[non_exhaustive]
+pub struct DockerExecutorConfig {
+    /// Persistent namespace capability retained through cleanup.
+    pub directory: DirectoryLease,
+    /// Immutable live startup relay image.
+    pub relay: PinnedImage,
+    /// Validated operator allocation policy.
+    pub policy: ContainerPolicy,
+    /// Retained environment service for the same directory owner and run.
+    pub environments: EnvironmentPort,
+    /// Trusted startup evidence, never supplied by an AWS request.
+    pub readiness: Arc<dyn DockerReadiness>,
+    /// Validated dispatch/cleanup budgets.
+    #[builder(default)]
+    pub settings: DockerExecutorSettings,
+    /// Optional affiliated provided.al2023 source, qualified by production startup.
+    #[builder(default)]
+    pub zip: Option<DockerZipRuntime>,
+    /// Optional opaque handler SDK context issued by the same private startup proof.
+    #[builder(default)]
+    pub sdk: Option<DockerSdkEnvironment>,
+}
+
+#[derive(Debug)]
+struct PoolOwner {
+    root: Mutex<Option<EnvironmentPool>>,
+    port: PoolPort,
+    cleanup: CleanupTask,
+    runtime: Handle,
+    stopping: AtomicBool,
+}
+
+/// Actual image Lambda Executor over retained pool/environment ownership.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct DockerExecutor {
+    config: DockerExecutorConfig,
+    pool: PoolOwner,
+}
+impl DockerExecutor {
+    pub(super) fn physically_settled(&self) -> bool {
+        self.pool.stopping.load(Ordering::Acquire) && self.pool.cleanup.is_finished()
+    }
+
+    /// Construct dispatch over matching live runtime inputs without daemon IO.
+    ///
+    /// This does not qualify production startup. Retain the environment/image
+    /// managers until shutdown has joined this executor's pool.
+    ///
+    /// # Errors
+    /// Rejects scope mismatch, revoked relay or missing Tokio supervision.
+    ///
+    /// ```no_run
+    /// # async fn compose(config: rustack_lambda_core::executor::DockerExecutorConfig) -> Result<(), rustack_lambda_core::executor::ExecutorError> {
+    /// use rustack_lambda_core::executor::{DockerExecutor, Executor};
+    /// let executor = DockerExecutor::new(config)?;
+    /// executor.shutdown().await?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(config: DockerExecutorConfig) -> Result<Self, DockerExecutorError> {
+        if !config.environments.same_scope(&config.directory) || !config.relay.is_live() {
+            return Err(DockerExecutorError::Configuration);
+        }
+        if let Some(zip) = &config.zip {
+            if !zip.same_scope(&config.directory)
+                || zip.base.resolved().metadata().architecture
+                    != config.relay.resolved().metadata().architecture
+            {
+                return Err(DockerExecutorError::Configuration);
+            }
+            zip.available().map_err(EnvironmentError::from)?;
+        }
+        if config.sdk.as_ref().is_some_and(|sdk| !sdk.matches(&config)) {
+            return Err(DockerExecutorError::Configuration);
+        }
+        let runtime = Handle::try_current().map_err(|_| DockerExecutorError::Unavailable)?;
+        let root = EnvironmentPool::start(config.environments.clone(), config.settings.pool)?;
+        let port = root.port();
+        Ok(Self::with_pool(config, root, port, runtime))
+    }
+    fn with_pool(
+        config: DockerExecutorConfig,
+        root: EnvironmentPool,
+        port: PoolPort,
+        runtime: Handle,
+    ) -> Self {
+        Self {
+            config,
+            pool: PoolOwner {
+                root: Mutex::new(Some(root)),
+                port,
+                cleanup: CleanupTask::default(),
+                runtime,
+                stopping: AtomicBool::new(false),
+            },
+        }
+    }
+    fn plan(&self, request: &InvokeRequest) -> Result<EnvironmentPlan, DockerExecutorError> {
+        if self
+            .config
+            .sdk
+            .as_ref()
+            .is_some_and(|sdk| !sdk.matches(&self.config))
+        {
+            return Err(DockerExecutorError::Unavailable);
+        }
+        let plan = match &request.revision.artifact {
+            DeploymentArtifact::Image(_) => EnvironmentPlan::new(
+                self.config.directory.clone(),
+                self.config.relay.clone(),
+                request.revision.clone(),
+                self.config.policy.clone(),
+            ),
+            DeploymentArtifact::Zip(_) => EnvironmentPlan::new_zip(
+                self.config.directory.clone(),
+                self.config.relay.clone(),
+                request.revision.clone(),
+                self.config.policy.clone(),
+                self.config
+                    .zip
+                    .clone()
+                    .ok_or(DockerExecutorError::Unavailable)?,
+            ),
+        }
+        .map_err(EnvironmentError::from)?;
+        let plan = match &self.config.sdk {
+            Some(sdk) => plan
+                .with_sdk_environment(sdk)
+                .map_err(EnvironmentError::from)?,
+            None => plan,
+        };
+        let _: FunctionArn = request.function_arn.parse()?;
+        let (_, function) = request
+            .function_arn
+            .split_once(":function:")
+            .ok_or(DockerExecutorError::Configuration)?;
+        let (name, qualifier) = function
+            .split_once(':')
+            .map_or((function, None), |(name, q)| (name, Some(q)));
+        let version = request.revision.qualifier.as_str();
+        let matches = match qualifier {
+            None | Some("$LATEST") => version == "$LATEST",
+            Some(value) if value.bytes().all(|b| b.is_ascii_digit()) => value == version,
+            Some(_) => version != "$LATEST",
+        };
+        let region = request.function_arn.split(':').nth(3);
+        if name != request.revision.function_name
+            || !matches
+            || region
+                != request
+                    .revision
+                    .environment
+                    .get("AWS_REGION")
+                    .map(String::as_str)
+        {
+            return Err(DockerExecutorError::Configuration);
+        }
+        Payload::try_from(request.payload.clone())?;
+        self.config.environments.check_memory(plan.memory_bytes())?;
+        Ok(plan)
+    }
+    fn start_cleanup(&self) {
+        self.pool.stopping.store(true, Ordering::Release);
+        self.pool.cleanup.start_on(&self.pool.runtime, || {
+            let root = self.pool.root.lock().take();
+            async move {
+                let Some(mut root) = root else {
+                    return Err(cleanup_error());
+                };
+                loop {
+                    match root
+                        .shutdown(Instant::now() + Duration::from_secs(60))
+                        .await
+                    {
+                        Ok(()) => return Ok(()),
+                        Err(
+                            EnvironmentError::Deadline
+                            | EnvironmentError::Docker(DockerError::Deadline),
+                        ) => {}
+                        Err(_) => return Err(cleanup_error()),
+                    }
+                }
+            }
+        });
+    }
+}
+impl Drop for DockerExecutor {
+    fn drop(&mut self) {
+        self.start_cleanup();
+    }
+}
+
+#[async_trait]
+impl Executor for DockerExecutor {
+    fn image_available(&self) -> Result<(), ExecutorError> {
+        self.config.readiness.check()?;
+        let environment = self.config.environments.status();
+        let pool = self.pool.port.status();
+        if environment.worker_failed || pool.worker_failed {
+            return Err(DockerExecutorError::Environment(EnvironmentError::Worker).into());
+        }
+        if self.pool.stopping.load(Ordering::Acquire)
+            || !self.config.relay.is_live()
+            || !environment.accepting
+            || !pool.accepting
+        {
+            return Err(DockerExecutorError::Unavailable.into());
+        }
+        Ok(())
+    }
+    fn docker_zip_architecture(&self) -> Option<Architecture> {
+        self.config
+            .zip
+            .as_ref()
+            .map(|source| source.base.resolved().metadata().architecture)
+    }
+
+    fn zip_available(&self, architecture: Architecture) -> Result<(), ExecutorError> {
+        self.image_available()?;
+        let source = self.config.zip.as_ref().ok_or_else(|| {
+            ExecutorError::Unsupported("Docker ZIP runtime is not configured".into())
+        })?;
+        source
+            .available()
+            .map_err(EnvironmentError::from)
+            .map_err(DockerExecutorError::from)?;
+        if source.base.resolved().metadata().architecture != architecture {
+            return Err(ExecutorError::Unsupported(
+                "Docker ZIP architecture does not match the selected base".into(),
+            ));
+        }
+        Ok(())
+    }
+    fn available(&self, request: &InvokeRequest) -> Result<(), ExecutorError> {
+        self.image_available()?;
+        self.plan(request)?;
+        Ok(())
+    }
+    async fn invoke(
+        &self,
+        request: InvokeRequest,
+        context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        self.image_available()?;
+        context.check()?;
+        let plan = self.plan(&request)?;
+        let invocation = Invocation::new(
+            context
+                .id()
+                .to_string()
+                .parse()
+                .map_err(DockerExecutorError::from)?,
+            context.deadline(),
+            request
+                .function_arn
+                .parse()
+                .map_err(DockerExecutorError::from)?,
+            local_trace_id().map_err(DockerExecutorError::from)?,
+            Payload::try_from(request.payload.clone()).map_err(DockerExecutorError::from)?,
+        )
+        .map_err(|error| match error {
+            SessionError::Deadline => ExecutorError::DeadlineExceeded,
+            error => DockerExecutorError::Session(error).into(),
+        })?;
+        context.check()?;
+        let mut call = self
+            .pool
+            .port
+            .start(plan, invocation, request.capture_logs)
+            .map_err(environment_error)?;
+        let result = tokio::select! { biased;
+            reason = context.cancelled() => Err(reason.error()),
+            result = call.wait() => result.map_err(environment_error),
+        };
+        call.cancel_and_wait(Instant::now() + self.config.settings.cleanup)
+            .await
+            .map_err(|_| cleanup_error())?;
+        context.check()?;
+        response(result?, &request)
+    }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        self.start_cleanup();
+        timeout_at(
+            Instant::now() + self.config.settings.cleanup,
+            self.pool.cleanup.wait(),
+        )
+        .await
+        .map_err(|_| cleanup_error())?
+    }
+}
+
+fn cleanup_error() -> ExecutorError {
+    ExecutorError::CleanupFailed("Docker resource settlement is not confirmed".into())
+}
+fn environment_error(error: EnvironmentError) -> ExecutorError {
+    match error {
+        EnvironmentError::Cancelled => ExecutorError::Cancelled,
+        EnvironmentError::Deadline => ExecutorError::DeadlineExceeded,
+        EnvironmentError::Timeout(timeout) => ExecutorError::Timeout(timeout),
+        error => DockerExecutorError::Environment(error).into(),
+    }
+}
+fn response(
+    result: EnvironmentResponse,
+    request: &InvokeRequest,
+) -> Result<InvokeResponse, ExecutorError> {
+    if result.logs.len() > 4096 {
+        return Err(DockerExecutorError::Environment(DockerError::Protocol.into()).into());
+    }
+    let (payload, function_error) = match result.result {
+        RuntimeResult::Success(payload) => (payload, None),
+        RuntimeResult::FunctionError(payload) => (payload, Some("Unhandled".into())),
+        RuntimeResult::InitError(payload) if payload.as_ref().len() <= 32768 => {
+            return Err(environment_error(EnvironmentError::Initialization(payload)));
+        }
+        _ => return Err(environment_error(DockerError::Protocol.into())),
+    };
+    Ok(InvokeResponse {
+        status: 200,
+        payload: payload.into(),
+        function_error,
+        log_tail: request.capture_logs.then(|| STANDARD.encode(result.logs)),
+        executed_version: request.revision.qualifier.clone(),
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/executor/tests.rs b/crates/rustack-lambda-core/src/docker/executor/tests.rs
new file mode 100644
index 00000000..d7c1dfc4
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/executor/tests.rs
@@ -0,0 +1,711 @@
+use std::{
+    collections::HashMap,
+    error::Error as _,
+    future::Future,
+    task::{Context, Poll, Waker},
+};
+
+use bytes::Bytes;
+use serde_json::{to_string, to_value};
+use tokio::sync::{mpsc::error::TryRecvError, oneshot, watch};
+use uuid::Uuid;
+
+use super::*;
+use crate::{
+    artifact::ImageArtifact,
+    config::LambdaConfig,
+    deployment::ImageDeploymentConfig,
+    docker::{
+        DockerWire, EnvironmentConfig, EnvironmentManager, ImageLeaseConfig, ImageLeaseManager,
+        ImagePinScope, RelayBudgets,
+        environment::test_peer,
+        plan::tests::{function_body, image_with, policy, relay_body, revision},
+        sdk::{LocalSdkCredentials, SdkAffiliation},
+        tests::Daemon,
+    },
+    error::LambdaServiceError,
+    executor::ExecutorBackend,
+    provider::RustackLambda,
+    storage::{FunctionStore, tests::sample_record},
+    work::WorkManager,
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+#[derive(Debug)]
+struct Readiness(AtomicBool);
+impl DockerReadiness for Readiness {
+    fn check(&self) -> Result<(), DockerExecutorError> {
+        if self.0.load(Ordering::Acquire) {
+            Ok(())
+        } else {
+            Err(DockerExecutorError::Unavailable)
+        }
+    }
+}
+struct Fixture {
+    daemon: Daemon,
+    wire: DockerWire,
+    environments: EnvironmentManager,
+    directory: DirectoryLease,
+    ready: Arc<Readiness>,
+}
+impl Fixture {
+    async fn new() -> Self {
+        let daemon = Daemon::new();
+        let wire = daemon.wire().await;
+        let directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+        let environments =
+            EnvironmentManager::start(wire.port(), directory.clone(), EnvironmentConfig::default())
+                .unwrap();
+        Self {
+            daemon,
+            wire,
+            environments,
+            directory,
+            ready: Arc::new(Readiness(AtomicBool::new(true))),
+        }
+    }
+    fn config(&self) -> DockerExecutorConfig {
+        DockerExecutorConfig::builder()
+            .directory(self.directory.clone())
+            .relay(image_with("1000", vec![]))
+            .policy(policy())
+            .environments(self.environments.port())
+            .readiness(self.ready.clone())
+            .settings(
+                DockerExecutorSettings::new(PoolConfig::default(), Duration::from_secs(1)).unwrap(),
+            )
+            .build()
+    }
+    async fn close(mut self) {
+        self.environments.shutdown(deadline()).await.unwrap();
+        self.wire.shutdown().await.unwrap();
+        self.daemon.close().await;
+    }
+}
+fn request() -> InvokeRequest {
+    InvokeRequest::new(
+        Arc::new(revision()),
+        "arn:aws:lambda:us-east-1:000000000000:function:policy-fixture".into(),
+        Bytes::from_static(b"\x00\xffraw-event"),
+    )
+}
+
+#[test]
+fn test_should_bound_executor_cleanup_settings() {
+    for invalid in [
+        Duration::ZERO,
+        Duration::from_millis(1500),
+        Duration::from_secs(61),
+    ] {
+        assert!(matches!(
+            DockerExecutorSettings::new(PoolConfig::default(), invalid),
+            Err(DockerExecutorError::Configuration)
+        ));
+    }
+}
+
+#[rstest::rstest]
+#[case::name("arn:aws:lambda:us-east-1:000000000000:function:other")]
+#[case::region("arn:aws:lambda:us-west-2:000000000000:function:policy-fixture")]
+#[case::alias_latest("arn:aws:lambda:us-east-1:000000000000:function:policy-fixture:prod")]
+#[case::version_latest("arn:aws:lambda:us-east-1:000000000000:function:policy-fixture:2")]
+#[case::malformed("private-invalid-metadata")]
+#[tokio::test]
+async fn test_should_reject_invalid_request_metadata_before_daemon_allocation(#[case] arn: &str) {
+    let fixture = Fixture::new().await;
+    let executor = DockerExecutor::new(fixture.config()).unwrap();
+    let mut request = request();
+    request.function_arn = arn.into();
+    assert!(executor.available(&request).is_err());
+    assert_eq!(fixture.environments.port().status().allocated, 0);
+    executor.shutdown().await.unwrap();
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_validate_scope_readiness_and_payload_without_allocating() {
+    let fixture = Fixture::new().await;
+    let mut wrong = fixture.config();
+    wrong.directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+    assert!(matches!(
+        DockerExecutor::new(wrong),
+        Err(DockerExecutorError::Configuration)
+    ));
+    let mut revoked = fixture.config();
+    revoked.relay = PinnedImage::new(
+        revoked.relay.resolved().clone(),
+        revoked.relay.unpacked_size(),
+        watch::channel(()).0,
+        Arc::new(AtomicBool::new(false)),
+        watch::channel(false).1,
+    );
+    assert!(matches!(
+        DockerExecutor::new(revoked),
+        Err(DockerExecutorError::Configuration)
+    ));
+    let executor = DockerExecutor::new(fixture.config()).unwrap();
+    executor.available(&request()).unwrap();
+    fixture.ready.0.store(false, Ordering::Release);
+    assert!(matches!(
+        executor.image_available(),
+        Err(ExecutorError::Docker(DockerExecutorError::Unavailable))
+    ));
+    fixture.ready.0.store(true, Ordering::Release);
+    let mut invalid = request();
+    invalid.payload = Bytes::from(vec![0; 6 * 1024 * 1024 + 1]);
+    assert!(executor.available(&invalid).is_err());
+    let mut invalid = request();
+    Arc::make_mut(&mut invalid.revision).backend = crate::executor::ExecutorBackend::Native;
+    assert!(executor.available(&invalid).is_err());
+    let mut published = request();
+    Arc::make_mut(&mut published.revision).qualifier = "1".into();
+    assert!(executor.available(&published).is_err());
+    published.function_arn.push_str(":prod");
+    executor.available(&published).unwrap();
+    published.function_arn = published.function_arn.replace(":prod", ":1");
+    executor.available(&published).unwrap();
+    assert_eq!(fixture.environments.port().status().allocated, 0);
+    executor.shutdown().await.unwrap();
+    assert!(executor.image_available().is_err());
+    fixture.close().await;
+}
+
+#[rstest::rstest]
+#[case::success(false, false)]
+#[case::error(false, true)]
+#[case::tail(true, false)]
+#[case::tail_error(true, true)]
+#[test]
+fn test_should_preserve_binary_outcomes_and_encode_requested_window_once(
+    #[case] tail: bool,
+    #[case] failed: bool,
+) {
+    let mut request = request();
+    request.capture_logs = tail;
+    Arc::make_mut(&mut request.revision).qualifier = "17".into();
+    request.function_arn.push_str(":prod");
+    let raw = Bytes::from_static(b"\x00\xffprivate-handler-data");
+    let payload = Payload::try_from(raw.clone()).unwrap();
+    let logs = Bytes::from_static(b"\xff\x00private-log-data");
+    let result = if failed {
+        RuntimeResult::FunctionError(payload)
+    } else {
+        RuntimeResult::Success(payload)
+    };
+    let response = response(
+        EnvironmentResponse {
+            result,
+            logs: logs.clone(),
+        },
+        &request,
+    )
+    .unwrap();
+    assert_eq!(response.payload, raw);
+    assert_eq!(response.status, 200);
+    assert_eq!(
+        response.function_error.as_deref(),
+        if failed { Some("Unhandled") } else { None }
+    );
+    assert_eq!(response.log_tail, tail.then(|| STANDARD.encode(&logs)));
+    assert_eq!(response.executed_version, "17");
+    assert!(!format!("{response:?}").contains("private"));
+}
+#[test]
+fn test_should_preserve_empty_tail_and_reject_oversized_logs_or_init_success() {
+    let mut request = request();
+    request.capture_logs = true;
+    let value = || RuntimeResult::Success(Payload::try_from(Bytes::new()).unwrap());
+    assert_eq!(
+        response(
+            EnvironmentResponse {
+                result: value(),
+                logs: Bytes::new()
+            },
+            &request
+        )
+        .unwrap()
+        .log_tail
+        .as_deref(),
+        Some("")
+    );
+    assert!(
+        response(
+            EnvironmentResponse {
+                result: value(),
+                logs: Bytes::from(vec![0; 4097])
+            },
+            &request
+        )
+        .is_err()
+    );
+    for size in [32768, 32769] {
+        let result =
+            RuntimeResult::InitError(Payload::try_from(Bytes::from(vec![0; size])).unwrap());
+        let error = response(
+            EnvironmentResponse {
+                result,
+                logs: Bytes::new(),
+            },
+            &request,
+        )
+        .unwrap_err();
+        if size == 32768 {
+            assert!(matches!(
+                error,
+                ExecutorError::Docker(DockerExecutorError::Environment(
+                    EnvironmentError::Initialization(_)
+                ))
+            ));
+        } else {
+            assert!(matches!(
+                error,
+                ExecutorError::Docker(DockerExecutorError::Environment(EnvironmentError::Docker(
+                    DockerError::Protocol
+                )))
+            ));
+        }
+    }
+}
+
+#[test]
+fn test_should_preserve_typed_environment_failures_and_static_service_mapping() {
+    let source = DockerExecutorError::from(ProtocolError::Io(std::io::Error::other(
+        "private-transport-data",
+    )));
+    assert!(source.source().is_some());
+    assert!(!format!("{source:?} {source}").contains("private-transport-data"));
+    assert!(matches!(
+        environment_error(EnvironmentError::Timeout(Duration::from_secs(3))),
+        ExecutorError::Timeout(_)
+    ));
+    assert!(matches!(
+        environment_error(EnvironmentError::Deadline),
+        ExecutorError::DeadlineExceeded
+    ));
+    assert!(matches!(
+        environment_error(EnvironmentError::Cancelled),
+        ExecutorError::Cancelled
+    ));
+    assert!(matches!(
+        LambdaServiceError::from(environment_error(EnvironmentError::Busy)),
+        LambdaServiceError::TooManyRequests
+    ));
+    let nested = environment_error(EnvironmentError::Docker(DockerError::Busy));
+    assert!(matches!(
+        &nested,
+        ExecutorError::Docker(DockerExecutorError::Environment(EnvironmentError::Docker(
+            DockerError::Busy
+        )))
+    ));
+    assert!(matches!(
+        LambdaServiceError::from(nested),
+        LambdaServiceError::Internal { .. }
+    ));
+    assert!(matches!(
+        LambdaServiceError::from(ExecutorError::from(DockerExecutorError::Unavailable)),
+        LambdaServiceError::DockerNotAvailable
+    ));
+    for error in [
+        EnvironmentError::Initialization(
+            Payload::try_from(Bytes::from_static(b"private-error")).unwrap(),
+        ),
+        EnvironmentError::Exited {
+            exit_code: 137,
+            oom: true,
+        },
+        EnvironmentError::Docker(DockerError::Protocol),
+    ] {
+        let error = environment_error(error);
+        assert!(error.source().is_some());
+        assert!(!format!("{error:?} {error}").contains("private-error"));
+    }
+}
+
+#[rstest::rstest]
+#[case::released(false)]
+#[case::cleanup_expired(true)]
+#[tokio::test]
+async fn test_should_hold_work_supervisor_concurrency_through_docker_cancellation_settlement(
+    #[case] expired: bool,
+) {
+    let fixture = Fixture::new().await;
+    let config = fixture.config();
+    let request = request();
+    let plan = EnvironmentPlan::new(
+        config.directory.clone(),
+        config.relay.clone(),
+        request.revision.clone(),
+        config.policy.clone(),
+    )
+    .unwrap();
+    let (environment, peer) = test_peer::pair();
+    let (entered, observed) = oneshot::channel();
+    let (stopping, stopped) = oneshot::channel();
+    let (release, gate) = oneshot::channel();
+    let peer = tokio::spawn(peer.serve_pending(entered, gate, stopping));
+    let pool = super::super::pool::testing_start(
+        fixture.environments.port(),
+        PoolConfig::default(),
+        vec![(plan.warm_key().into(), environment)],
+    );
+    let port = pool.port();
+    let executor = Arc::new(DockerExecutor::with_pool(
+        config,
+        pool,
+        port,
+        Handle::current(),
+    ));
+    let work = WorkManager::new();
+    let handle = work
+        .submit(executor.clone(), request.clone(), Some(1), false, None)
+        .await
+        .unwrap();
+    let id = handle.id();
+    let actual = observed.await.unwrap();
+    assert_eq!(actual.parts().0.to_string(), id.to_string());
+    assert_eq!(actual.parts().2.as_ref(), request.function_arn.as_str());
+    assert_eq!(actual.parts().4.as_ref(), request.payload.as_ref());
+    let mut waiting = Box::pin(handle.cancel_and_wait(deadline()));
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    stopped.await.unwrap();
+    let rejected = work
+        .submit(executor.clone(), request, Some(1), false, None)
+        .await;
+    assert!(
+        matches!(rejected, Err(LambdaServiceError::TooManyRequests)),
+        "{rejected:?}"
+    );
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    let mut shutdown = Box::pin(executor.shutdown());
+    assert!(
+        shutdown
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(shutdown);
+    assert!(executor.image_available().is_err());
+    if expired {
+        assert!(matches!(
+            executor.shutdown().await,
+            Err(ExecutorError::CleanupFailed(_))
+        ));
+        assert!(matches!(
+            waiting.await,
+            Err(ExecutorError::CleanupFailed(_))
+        ));
+        assert!(work.quiesce(Duration::from_secs(1)).await.is_err());
+        release.send(()).unwrap();
+    } else {
+        release.send(()).unwrap();
+        waiting.await.unwrap();
+        work.quiesce(Duration::from_secs(10)).await.unwrap();
+    }
+    peer.await.unwrap();
+    executor.shutdown().await.unwrap();
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_impossible_memory_before_provider_admission_as_a_throttle() {
+    let fixture = Fixture::new().await;
+    let executor = Arc::new(DockerExecutor::new(fixture.config()).unwrap());
+    let mut oversized = request();
+    Arc::make_mut(&mut oversized.revision).memory_mb = 10240;
+    assert!(matches!(
+        executor.available(&oversized),
+        Err(ExecutorError::Docker(DockerExecutorError::Environment(
+            EnvironmentError::MemoryLimit
+        )))
+    ));
+    let work = WorkManager::new();
+    assert!(matches!(
+        work.submit(executor.clone(), oversized, Some(1), false, None)
+            .await,
+        Err(LambdaServiceError::TooManyRequests)
+    ));
+    assert_eq!(fixture.environments.port().status().allocated, 0);
+    assert_eq!(fixture.environments.port().status().memory_bytes, 0);
+    assert!(executor.available(&request()).is_ok());
+    work.quiesce(Duration::from_secs(1)).await.unwrap();
+    executor.shutdown().await.unwrap();
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_distinguish_unconfigured_zip_from_revoked_backend_without_allocating() {
+    let fixture = Fixture::new().await;
+    let executor = DockerExecutor::new(fixture.config()).unwrap();
+    assert!(matches!(
+        executor.zip_available(Architecture::Arm64),
+        Err(ExecutorError::Unsupported(_))
+    ));
+    fixture.ready.0.store(false, Ordering::Release);
+    assert!(matches!(
+        executor.zip_available(Architecture::Arm64),
+        Err(ExecutorError::Docker(DockerExecutorError::Unavailable))
+    ));
+    assert_eq!(fixture.environments.port().status().allocated, 0);
+    executor.shutdown().await.unwrap();
+    fixture.close().await;
+}
+
+fn sdk_context(config: &DockerExecutorConfig) -> DockerSdkEnvironment {
+    let credentials: LocalSdkCredentials = ("private-sdk-key".into(), "private-sdk-secret".into())
+        .try_into()
+        .unwrap();
+    DockerSdkEnvironment::new(
+        credentials,
+        "http://127.0.0.1:4566".parse().unwrap(),
+        SdkAffiliation::new(
+            config.directory.clone(),
+            config.relay.clone(),
+            config.policy.clone(),
+            config.environments.clone(),
+            config.readiness.clone(),
+        ),
+    )
+    .unwrap()
+}
+#[rstest::rstest]
+#[case::qualification("qualification")]
+#[case::acquisition("acquisition")]
+#[case::manager("manager")]
+#[case::network("network")]
+#[case::relay("relay")]
+#[tokio::test]
+async fn test_should_refuse_foreign_sdk_affiliation_before_pool_or_container_allocation(
+    #[case] changed: &str,
+) {
+    let fixture = Fixture::new().await;
+    let original = fixture.config();
+    let sdk = sdk_context(&original);
+    let mut other_manager = EnvironmentManager::start(
+        fixture.wire.port(),
+        original.directory.clone(),
+        EnvironmentConfig::default(),
+    )
+    .unwrap();
+    let mut foreign = original.clone();
+    match changed {
+        "qualification" => foreign.readiness = Arc::new(Readiness(AtomicBool::new(true))),
+        "acquisition" => {
+            foreign.directory =
+                DirectoryLease::testing(original.directory.owner_id(), original.directory.run_id());
+        }
+        "manager" => foreign.environments = other_manager.port(),
+        "network" => {
+            foreign.policy = ContainerPolicy::new(
+                "other-bridge".parse().unwrap(),
+                1000,
+                1000,
+                1_000_000_000,
+                RelayBudgets::default(),
+            )
+            .unwrap();
+        }
+        "relay" => foreign.relay = image_with("1000", vec!["CHANGED=value".into()]),
+        _ => unreachable!("fixed affiliation cases"),
+    }
+    assert!(!sdk.matches(&foreign));
+    foreign.sdk = Some(sdk.clone());
+    assert!(matches!(
+        DockerExecutor::new(foreign),
+        Err(DockerExecutorError::Configuration)
+    ));
+    assert_eq!(fixture.environments.port().status().allocated, 0);
+    assert_eq!(other_manager.port().status().allocated, 0);
+    other_manager.shutdown(deadline()).await.unwrap();
+    fixture.close().await;
+}
+#[tokio::test]
+async fn test_should_isolate_sdk_warm_identity_without_mutating_revision_or_relay_environment() {
+    let fixture = Fixture::new().await;
+    let mut config = fixture.config();
+    let first = sdk_context(&config);
+    let second = sdk_context(&config);
+    assert_eq!(first.identity(), first.clone().identity());
+    assert_ne!(first.identity(), second.identity());
+    assert_eq!(format!("{first:?}"), "DockerSdkEnvironment(<redacted>)");
+    let mut call = request();
+    Arc::make_mut(&mut call.revision).environment.insert(
+        "AWS_ENDPOINT_URL".into(),
+        "http://user-selected:4566".into(),
+    );
+    let original_env = call.revision.environment.clone();
+    let plain = DockerExecutor::new(config.clone()).unwrap();
+    let without_sdk = plain.plan(&call).unwrap();
+    assert!(
+        function_body(&without_sdk)
+            .env
+            .as_ref()
+            .unwrap()
+            .contains(&"AWS_ENDPOINT_URL=http://user-selected:4566".to_owned())
+    );
+    config.sdk = Some(first.clone());
+    let enabled = DockerExecutor::new(config.clone()).unwrap();
+    let first_plan = enabled.plan(&call).unwrap();
+    let cloned_plan = enabled.plan(&call).unwrap();
+    assert_ne!(without_sdk.warm_key(), first_plan.warm_key());
+    assert_eq!(first_plan.warm_key(), cloned_plan.warm_key());
+    assert!(
+        function_body(&first_plan)
+            .env
+            .as_ref()
+            .unwrap()
+            .contains(&"AWS_ENDPOINT_URL=http://127.0.0.1:4566/".to_owned())
+    );
+    assert!(
+        relay_body(&first_plan)
+            .env
+            .as_ref()
+            .unwrap()
+            .iter()
+            .all(|entry| !entry.starts_with("AWS_") && !entry.contains("private-sdk"))
+    );
+    assert_eq!(call.revision.environment, original_env);
+    config.sdk = Some(second);
+    let other = DockerExecutor::new(config).unwrap();
+    assert_ne!(first_plan.warm_key(), other.plan(&call).unwrap().warm_key());
+    fixture.ready.0.store(false, Ordering::Release);
+    assert!(matches!(
+        enabled.plan(&call),
+        Err(DockerExecutorError::Unavailable)
+    ));
+    assert_eq!(fixture.environments.port().status().allocated, 0);
+    drop((without_sdk, first_plan, cloned_plan));
+    plain.shutdown().await.unwrap();
+    enabled.shutdown().await.unwrap();
+    other.shutdown().await.unwrap();
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_sdk_revocation_guard_in_a_prepared_plan_and_refuse_create_without_rpc()
+{
+    let mut fixture = Fixture::new().await;
+    let mut config = fixture.config();
+    config.sdk = Some(sdk_context(&config));
+    let executor = DockerExecutor::new(config).unwrap();
+    let plan = executor.plan(&request()).unwrap();
+    plan.live().unwrap();
+    fixture.ready.0.store(false, Ordering::Release);
+    assert!(matches!(plan.live(), Err(DockerError::Stopped)));
+    let port = fixture.wire.port();
+    let mut relay = Box::pin(plan.create_relay(&port, deadline()));
+    assert!(matches!(
+        relay.as_mut().poll(&mut Context::from_waker(Waker::noop())),
+        Poll::Ready(Err(DockerError::Stopped))
+    ));
+    drop(relay);
+    let mut function = Box::pin(plan.create_function(&port, deadline()));
+    assert!(matches!(
+        function
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop())),
+        Poll::Ready(Err(DockerError::Stopped))
+    ));
+    drop(function);
+    assert!(matches!(
+        fixture.daemon.requests.try_recv(),
+        Err(TryRecvError::Empty)
+    ));
+    assert_eq!(fixture.environments.port().status().allocated, 0);
+    drop(plan);
+    executor.shutdown().await.unwrap();
+    fixture.close().await;
+}
+
+#[tokio::test]
+async fn test_should_export_real_sdk_provider_snapshot_without_injected_keys_or_credentials() {
+    let fixture = Fixture::new().await;
+    let mut config = fixture.config();
+    config.sdk = Some(sdk_context(&config));
+    let executor = Arc::new(DockerExecutor::new(config).unwrap());
+    let mut call = request();
+    let user_env = HashMap::from([
+        ("BUSINESS".to_owned(), "retained".to_owned()),
+        (
+            "AWS_ENDPOINT_URL".to_owned(),
+            "http://user-selected:4566".to_owned(),
+        ),
+    ]);
+    Arc::make_mut(&mut call.revision)
+        .environment
+        .extend(user_env.clone());
+    let plan = executor.plan(&call).unwrap();
+    assert!(
+        function_body(&plan)
+            .env
+            .as_ref()
+            .unwrap()
+            .iter()
+            .any(|entry| entry == "AWS_SECRET_ACCESS_KEY=private-sdk-secret")
+    );
+    let DeploymentArtifact::Image(image) = &call.revision.artifact else {
+        panic!("fixed image fixture");
+    };
+    let root = tempfile::tempdir().unwrap();
+    let store = FunctionStore::new(root.path());
+    let mut record = sample_record(&call.revision.function_name);
+    record.resource_id = call.revision.resource_id;
+    record.arn = call.function_arn.clone();
+    record.latest.package_type = "Image".into();
+    record.latest.runtime = None;
+    record.latest.handler = None;
+    record.latest.image_uri = Some(image.resolved().metadata().requested_reference.to_string());
+    record.latest.image = ImageArtifact::Pinned(image.clone());
+    record.latest.architectures = vec!["arm64".into()];
+    record.latest.environment = user_env.clone();
+    record.latest.code_sha256 = image.resolved().code_sha256().unwrap();
+    record.latest.code_size = image.unpacked_size().get();
+    store.insert(record).unwrap();
+    let mut images = ImageLeaseManager::start(
+        fixture.wire.port(),
+        ImagePinScope::new(fixture.directory.clone()),
+        ImageLeaseConfig::default(),
+    )
+    .unwrap();
+    let provider = RustackLambda::with_executor(
+        store,
+        LambdaConfig {
+            executor: ExecutorBackend::Docker,
+            ..Default::default()
+        },
+        executor,
+    )
+    .with_image_preparation(images.port(), ImageDeploymentConfig::default())
+    .unwrap();
+    let snapshot = provider.export_snapshot_before(deadline()).await.unwrap();
+    let encoded = to_string(&snapshot).unwrap();
+    for private in [
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "private-sdk-key",
+        "private-sdk-secret",
+    ] {
+        assert!(!encoded.contains(private));
+    }
+    let projected = to_value(&snapshot).unwrap();
+    assert_eq!(
+        projected["functions"]["functions"][0]["latest"]["environment"],
+        to_value(user_env).unwrap()
+    );
+    drop(plan);
+    provider.shutdown_before(deadline()).await.unwrap();
+    images.shutdown(deadline()).await.unwrap();
+    fixture.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/framing.rs b/crates/rustack-lambda-core/src/docker/framing.rs
new file mode 100644
index 00000000..b95e2e5a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/framing.rs
@@ -0,0 +1,221 @@
+//! Strict streaming non-TTY Docker output records; no full-record allocation.
+
+use std::{fmt, time::Duration};
+
+use bytes::Bytes;
+use tokio::{
+    io::{AsyncRead, AsyncReadExt},
+    time::{Instant, timeout_at},
+};
+
+use super::DockerError;
+
+/// Maximum outer Docker record, distinct from the inner CBOR frame allowance.
+pub const MAX_DOCKER_RECORD: usize = 8 * 1024 * 1024;
+const CHUNK_BYTES: usize = 16 * 1024;
+
+/// Docker's validated non-TTY output channel.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum OutputChannel {
+    /// Standard output; relay output is binary control data.
+    Stdout,
+    /// Standard error; function logs are kept separately from relay control.
+    Stderr,
+}
+
+/// At most16 KiB from one validated Docker record; Debug redacts content.
+#[derive(Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct OutputChunk {
+    /// Output channel advertised by the validated record header.
+    pub channel: OutputChannel,
+    /// Raw bytes; no implicit UTF-8 conversion or line splitting.
+    pub bytes: Bytes,
+}
+impl fmt::Debug for OutputChunk {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("OutputChunk")
+            .field("channel", &self.channel)
+            .field("bytes", &self.bytes.len())
+            .finish()
+    }
+}
+
+#[derive(Debug)]
+struct Record {
+    channel: OutputChannel,
+    remaining: usize,
+    deadline: Instant,
+}
+
+/// One retained parser with a fixed deadline for each partial record.
+#[non_exhaustive]
+pub struct DockerOutputReader<R> {
+    reader: R,
+    record: Option<Record>,
+    io_budget: Duration,
+    poisoned: bool,
+    closed: bool,
+}
+impl<R> fmt::Debug for DockerOutputReader<R> {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("DockerOutputReader")
+            .field("record", &self.record)
+            .field("poisoned", &self.poisoned)
+            .field("closed", &self.closed)
+            .finish_non_exhaustive()
+    }
+}
+
+impl<R: AsyncRead + Unpin> DockerOutputReader<R> {
+    /// Own the reader with a nonzero partial-record budget≤60s.
+    ///
+    /// # Errors
+    /// Rejects a zero/excessive IO budget.
+    ///
+    /// ```
+    /// let reader = rustack_lambda_core::docker::DockerOutputReader::new(
+    ///     b"".as_slice(), std::time::Duration::from_secs(5))?;
+    /// # Ok::<(), rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn new(reader: R, io_budget: Duration) -> Result<Self, DockerError> {
+        if io_budget.is_zero() || io_budget > Duration::from_secs(60) {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self {
+            reader,
+            record: None,
+            io_budget,
+            poisoned: false,
+            closed: false,
+        })
+    }
+
+    /// Read one bounded chunk. Cancelling this future invalidates the reader.
+    ///
+    /// Boundary EOF returns None; a partial header/payload fails. The caller's
+    /// absolute deadline may tighten, but never extend, a partial record lease.
+    ///
+    /// # Errors
+    /// Returns framing, size, deadline, IO or interrupted-reader errors.
+    ///
+    /// ```no_run
+    /// # async fn example<R: tokio::io::AsyncRead + Unpin>(reader: &mut rustack_lambda_core::docker::DockerOutputReader<R>) {
+    /// let chunk = reader.next(tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await;
+    /// # }
+    /// ```
+    pub async fn next(&mut self, deadline: Instant) -> Result<Option<OutputChunk>, DockerError> {
+        if self.poisoned {
+            return Err(DockerError::Poisoned);
+        }
+        if self.closed {
+            return Ok(None);
+        }
+        self.poisoned = true;
+        let result = self.read(deadline).await;
+        if result.is_ok() {
+            self.poisoned = false;
+        }
+        result
+    }
+
+    async fn read(&mut self, deadline: Instant) -> Result<Option<OutputChunk>, DockerError> {
+        let mut empty = 0_u8;
+        loop {
+            if Instant::now() >= deadline {
+                return Err(DockerError::Deadline);
+            }
+            if self.record.is_none() {
+                let mut header = [0_u8; 8];
+                let first = header.get_mut(..1).ok_or(DockerError::Protocol)?;
+                let count = timeout_at(deadline, self.reader.read(first))
+                    .await
+                    .map_err(|_| DockerError::Deadline)??;
+                if Instant::now() >= deadline {
+                    return Err(DockerError::Deadline);
+                }
+                if count == 0 {
+                    self.closed = true;
+                    return Ok(None);
+                }
+                let record_deadline = Instant::now()
+                    .checked_add(self.io_budget)
+                    .ok_or(DockerError::Configuration)?
+                    .min(deadline);
+                timeout_at(
+                    record_deadline,
+                    self.reader
+                        .read_exact(header.get_mut(1..).ok_or(DockerError::Protocol)?),
+                )
+                .await
+                .map_err(|_| DockerError::Deadline)??;
+                if Instant::now() >= record_deadline {
+                    return Err(DockerError::Deadline);
+                }
+                let channel = match header.first() {
+                    Some(1) => OutputChannel::Stdout,
+                    Some(2) => OutputChannel::Stderr,
+                    _ => return Err(DockerError::Protocol),
+                };
+                if header.get(1..4) != Some([0_u8; 3].as_slice()) {
+                    return Err(DockerError::Protocol);
+                }
+                let length: [u8; 4] = header
+                    .get(4..)
+                    .ok_or(DockerError::Protocol)?
+                    .try_into()
+                    .map_err(|_| DockerError::Protocol)?;
+                let remaining = usize::try_from(u32::from_be_bytes(length))
+                    .map_err(|_| DockerError::TooLarge)?;
+                if remaining > MAX_DOCKER_RECORD {
+                    return Err(DockerError::TooLarge);
+                }
+                if remaining == 0 {
+                    empty = empty.saturating_add(1);
+                    if empty == 64 {
+                        tokio::task::yield_now().await;
+                        empty = 0;
+                    }
+                    continue;
+                }
+                self.record = Some(Record {
+                    channel,
+                    remaining,
+                    deadline: record_deadline,
+                });
+            }
+            let record = self.record.as_mut().ok_or(DockerError::Protocol)?;
+            let until = record.deadline.min(deadline);
+            if Instant::now() >= until {
+                return Err(DockerError::Deadline);
+            }
+            let size = record.remaining.min(CHUNK_BYTES);
+            let mut output = Vec::new();
+            output
+                .try_reserve_exact(size)
+                .map_err(|_| DockerError::Allocation)?;
+            output.resize(size, 0);
+            timeout_at(until, self.reader.read_exact(&mut output))
+                .await
+                .map_err(|_| DockerError::Deadline)??;
+            if Instant::now() >= until {
+                return Err(DockerError::Deadline);
+            }
+            record.remaining = record
+                .remaining
+                .checked_sub(size)
+                .ok_or(DockerError::Protocol)?;
+            let channel = record.channel;
+            if record.remaining == 0 {
+                self.record = None;
+            }
+            return Ok(Some(OutputChunk {
+                channel,
+                bytes: Bytes::from(output),
+            }));
+        }
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/image.rs b/crates/rustack-lambda-core/src/docker/image.rs
new file mode 100644
index 00000000..8fdcfc72
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/image.rs
@@ -0,0 +1,782 @@
+//! Read-only platform selection and executable-image validation before deployment.
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use rustack_lambda_model::types::ImageConfig;
+use tokio::time::Instant;
+
+use super::{
+    DockerError, DockerPort, Operation, decode, escaped,
+    models::{ImageInspect, ImageManifestSummaryKindEnum, OciDescriptor, SystemInfo},
+};
+use crate::{
+    artifact::{
+        Architecture, ArtifactError, ImageExecutionDefaults, ImageExecutionMetadata, ImageMetadata,
+        ImageReference, ResolvedImage, Sha256Digest, UnpackedImageSize,
+    },
+    function_config::validate_image_config,
+};
+
+/// Read-only local resolution; deployment publication remains with its actor.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct ImageResolver {
+    port: DockerPort,
+}
+
+impl ImageResolver {
+    /// Use an already negotiated bounded Docker port; never discover a daemon.
+    ///
+    /// ```no_run
+    /// # fn resolver(port: rustack_lambda_core::docker::DockerPort) {
+    /// let resolver = rustack_lambda_core::docker::ImageResolver::new(port);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn new(port: DockerPort) -> Self {
+        Self { port }
+    }
+
+    /// Resolve a preloaded image and validate effective entry configuration.
+    ///
+    /// This never pulls, builds or reads registry credentials. Function settings
+    /// and deployment status/CAS are validated and owned by the provider.
+    ///
+    /// # Errors
+    /// Returns wire failure, invalid overrides or invalid/ambiguous inspection
+    /// metadata. No error includes image argv, environment or daemon text.
+    ///
+    /// ```no_run
+    /// # async fn example(port: rustack_lambda_core::docker::DockerPort) -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// use rustack_lambda_core::{artifact::Architecture, docker::ImageResolver};
+    /// let image = ImageResolver::new(port).resolve_local(&"worker:v1".parse()?,
+    ///     Architecture::Arm64, None,
+    ///     tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn resolve_local(
+        &self,
+        reference: &ImageReference,
+        architecture: Architecture,
+        overrides: Option<&ImageConfig>,
+        deadline: Instant,
+    ) -> Result<ResolvedImage, DockerError> {
+        super::check_deadline(deadline)?;
+        if let Some(overrides) = overrides {
+            validate_image_config(overrides).map_err(|_| DockerError::Configuration)?;
+        }
+        let root = self.port.inspect_image(reference, deadline).await?;
+        self.resolve_captured(reference, architecture, overrides, root, deadline)
+            .await
+    }
+
+    /// Resolve the one already captured initial/post-pull root without another tag lookup.
+    pub(super) async fn resolve_captured(
+        &self,
+        reference: &ImageReference,
+        architecture: Architecture,
+        overrides: Option<&ImageConfig>,
+        root: ImageInspect,
+        deadline: Instant,
+    ) -> Result<ResolvedImage, DockerError> {
+        super::check_deadline(deadline)?;
+        if let Some(overrides) = overrides {
+            validate_image_config(overrides).map_err(|_| DockerError::Configuration)?;
+        }
+        let launch_id: Sha256Digest = root.id.as_deref().ok_or_else(invalid)?.parse()?;
+        let inspected = if self.port.api_version().minor() >= 49 {
+            drop(root);
+            let platform = match architecture {
+                Architecture::X86_64 => r#"{"os":"linux","architecture":"amd64"}"#,
+                Architecture::Arm64 => r#"{"os":"linux","architecture":"arm64"}"#,
+            };
+            let query = form_urlencoded::Serializer::new(String::new())
+                .append_pair("platform", platform)
+                .finish();
+            let path = format!("/images/{}/json?{query}", escaped(launch_id.as_str()));
+            let selected = self
+                .port
+                .call(
+                    Operation::Image,
+                    Method::GET,
+                    path,
+                    Bytes::new(),
+                    StatusCode::OK,
+                    deadline,
+                )
+                .await
+                .map_err(|error| match error {
+                    // The reference already resolved to this captured ID. This
+                    // operation asks whether it supplies the requested platform.
+                    DockerError::Status(StatusCode::NOT_FOUND) => invalid(),
+                    other => other,
+                })?;
+            decode(selected, deadline)?
+        } else {
+            root
+        };
+        if inspected.descriptor.is_none() {
+            let info = self.port.info(deadline).await?;
+            verify_classic_store(&inspected, &info)?;
+        }
+        let result = resolve(reference, architecture, overrides, inspected, &launch_id);
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        result
+    }
+
+    /// Prove the selected image's unpacked-storage quota without running code.
+    ///
+    /// # Errors
+    /// Rejects missing, ambiguous, incompatible or out-of-quota unpacked proof,
+    /// classic-store ambiguity, expiry or bounded Docker metadata/IO failure.
+    ///
+    /// ```no_run
+    /// # async fn size(port:rustack_lambda_core::docker::DockerPort,image:&rustack_lambda_core::artifact::ResolvedImage) {
+    /// let bytes = rustack_lambda_core::docker::ImageResolver::new(port).unpacked_size(image,
+    ///     tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn unpacked_size(
+        &self,
+        image: &ResolvedImage,
+        deadline: Instant,
+    ) -> Result<UnpackedImageSize, DockerError> {
+        super::check_deadline(deadline)?;
+        let root = self
+            .port
+            .image_manifests(&image.metadata().image_id, deadline)
+            .await?;
+        if image.metadata().selected_manifest.is_none() {
+            verify_classic_store(&root, &self.port.info(deadline).await?)?;
+        }
+        let size = unpacked_proof(image, &root)?;
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        Ok(size)
+    }
+}
+
+fn unpacked_proof(
+    image: &ResolvedImage,
+    root: &ImageInspect,
+) -> Result<UnpackedImageSize, DockerError> {
+    let metadata = image.metadata();
+    if root.id.as_deref() != Some(metadata.image_id.as_str()) {
+        return Err(invalid());
+    }
+    let Some(manifest) = &metadata.selected_manifest else {
+        if root.os.as_deref() != Some("linux")
+            || root.architecture.as_deref() != Some(docker_arch(metadata.architecture))
+        {
+            return Err(invalid());
+        }
+        let size = root
+            .size
+            .and_then(|size| u64::try_from(size).ok())
+            .ok_or_else(invalid)?;
+        return size.try_into().map_err(DockerError::from);
+    };
+    let summaries = root.manifests.as_deref().ok_or_else(invalid)?;
+    if summaries.len() > 128 {
+        return Err(invalid());
+    }
+    let mut matching = summaries
+        .iter()
+        .filter(|summary| summary.id == manifest.as_str());
+    let summary = matching.next().ok_or_else(invalid)?;
+    if matching.next().is_some()
+        || !summary.available
+        || summary.kind != Some(ImageManifestSummaryKindEnum::IMAGE)
+        || image_descriptor(&summary.descriptor, docker_arch(metadata.architecture))? != *manifest
+    {
+        return Err(invalid());
+    }
+    let data = summary.image_data.as_ref().ok_or_else(invalid)?;
+    if data.platform.os.as_deref() != Some("linux")
+        || data.platform.architecture.as_deref() != Some(docker_arch(metadata.architecture))
+    {
+        return Err(invalid());
+    }
+    let bytes = u64::try_from(data.size.unpacked).map_err(|_| invalid())?;
+    bytes.try_into().map_err(DockerError::from)
+}
+
+fn docker_arch(architecture: Architecture) -> &'static str {
+    match architecture {
+        Architecture::X86_64 => "amd64",
+        Architecture::Arm64 => "arm64",
+    }
+}
+
+fn verify_classic_store(inspected: &ImageInspect, info: &SystemInfo) -> Result<(), DockerError> {
+    let driver = inspected.graph_driver.as_ref().ok_or_else(invalid)?;
+    if inspected.descriptor.is_some()
+        || !matches!(
+            driver.name.as_str(),
+            "overlay2" | "aufs" | "btrfs" | "devicemapper" | "vfs" | "zfs" | "fuse-overlayfs"
+        )
+        || info.driver.as_deref() != Some(driver.name.as_str())
+        || inspected
+            .manifests
+            .as_ref()
+            .is_some_and(|manifests| !manifests.is_empty())
+    {
+        return Err(invalid());
+    }
+    let statuses = info.driver_status.as_deref().unwrap_or_default();
+    if statuses.len() > 128 {
+        return Err(invalid());
+    }
+    for status in statuses {
+        let [key, value] = status.as_slice() else {
+            return Err(invalid());
+        };
+        if key.len() > 256
+            || value.len() > 16 * 1024
+            || (key.eq_ignore_ascii_case("driver-type") && value == "io.containerd.snapshotter.v1")
+        {
+            return Err(invalid());
+        }
+    }
+    Ok(())
+}
+
+fn invalid() -> DockerError {
+    ArtifactError::Inspection.into()
+}
+
+fn resolve(
+    reference: &ImageReference,
+    architecture: Architecture,
+    overrides: Option<&ImageConfig>,
+    inspected: ImageInspect,
+    launch_id: &Sha256Digest,
+) -> Result<ResolvedImage, DockerError> {
+    let docker_arch = match architecture {
+        Architecture::X86_64 => "amd64",
+        Architecture::Arm64 => "arm64",
+    };
+    if inspected.os.as_deref() != Some("linux")
+        || inspected.architecture.as_deref() != Some(docker_arch)
+    {
+        return Err(invalid());
+    }
+    let _: Sha256Digest = inspected.id.as_deref().ok_or_else(invalid)?.parse()?;
+    let size = inspected
+        .size
+        .and_then(|value| u64::try_from(value).ok())
+        .filter(|size| (1..=10 * 1024 * 1024 * 1024).contains(size))
+        .ok_or_else(invalid)?;
+    let descriptor = selected_descriptor(&inspected, docker_arch)?;
+    let registry = registry_manifest(reference, &inspected, descriptor.as_ref())?;
+    let config = inspected.config.ok_or_else(invalid)?;
+    if config
+        .volumes
+        .as_ref()
+        .is_some_and(|volumes| !volumes.is_empty())
+    {
+        return Err(invalid());
+    }
+    let defaults: ImageExecutionDefaults = ImageExecutionMetadata::builder()
+        .entrypoint(config.entrypoint.unwrap_or_default())
+        .command(config.cmd.unwrap_or_default())
+        .working_directory(config.working_dir.unwrap_or_default())
+        .environment(config.env.unwrap_or_default())
+        .user(config.user.unwrap_or_default())
+        .build()
+        .try_into()?;
+    defaults.plan(overrides)?;
+    let inspection_hash = ImageMetadata::execution_fingerprint(
+        launch_id,
+        descriptor.as_ref(),
+        architecture,
+        size,
+        &defaults,
+    )?;
+    ImageMetadata::builder()
+        .requested_reference(reference.clone())
+        .image_id(launch_id.clone())
+        .selected_manifest(descriptor)
+        .registry_manifest(registry)
+        .os("linux".into())
+        .architecture(architecture)
+        .inspection_hash(inspection_hash)
+        .size_bytes(size)
+        .execution(defaults)
+        .build()
+        .try_into()
+        .map_err(DockerError::from)
+}
+
+fn selected_descriptor(
+    inspected: &ImageInspect,
+    architecture: &str,
+) -> Result<Option<Sha256Digest>, DockerError> {
+    if inspected
+        .manifests
+        .as_ref()
+        .is_some_and(|manifests| !manifests.is_empty())
+    {
+        return Err(invalid());
+    }
+    inspected
+        .descriptor
+        .as_ref()
+        .map(|descriptor| image_descriptor(descriptor, architecture))
+        .transpose()
+}
+
+fn image_descriptor(
+    descriptor: &OciDescriptor,
+    architecture: &str,
+) -> Result<Sha256Digest, DockerError> {
+    if !matches!(
+        descriptor.media_type.as_deref(),
+        Some(
+            "application/vnd.oci.image.manifest.v1+json"
+                | "application/vnd.docker.distribution.manifest.v2+json"
+        )
+    ) || descriptor.artifact_type.is_some()
+        || descriptor.platform.as_ref().is_some_and(|platform| {
+            platform.os.as_deref().is_some_and(|os| os != "linux")
+                || platform
+                    .architecture
+                    .as_deref()
+                    .is_some_and(|arch| arch != architecture)
+        })
+        || descriptor.annotations.as_ref().is_some_and(|annotations| {
+            annotations
+                .get("vnd.docker.reference.type")
+                .is_some_and(|kind| kind == "attestation-manifest")
+        })
+    {
+        return Err(invalid());
+    }
+    descriptor
+        .digest
+        .as_deref()
+        .ok_or_else(invalid)?
+        .parse()
+        .map_err(DockerError::from)
+}
+
+fn repository_identity(reference: &ImageReference) -> String {
+    let (registry, repository) =
+        reference
+            .registry()
+            .map_or(("docker.io", reference.repository()), |registry| {
+                (
+                    registry,
+                    reference
+                        .repository()
+                        .split_once('/')
+                        .map_or("", |(_, repository)| repository),
+                )
+            });
+    let registry = registry.to_ascii_lowercase();
+    let registry = match registry.as_str() {
+        "index.docker.io" => "docker.io",
+        value => value,
+    };
+    if registry == "docker.io" && !repository.contains('/') {
+        format!("{registry}/library/{repository}")
+    } else {
+        format!("{registry}/{repository}")
+    }
+}
+
+fn registry_manifest(
+    reference: &ImageReference,
+    inspected: &ImageInspect,
+    descriptor: Option<&Sha256Digest>,
+) -> Result<Option<ImageReference>, DockerError> {
+    let digests = inspected.repo_digests.as_deref().unwrap_or_default();
+    if digests.len() > 128 {
+        return Err(invalid());
+    }
+    let repository = repository_identity(reference);
+    let mut matches = Vec::new();
+    for candidate in digests {
+        let candidate: ImageReference = candidate.parse()?;
+        let digest: Sha256Digest = candidate.digest().ok_or_else(invalid)?.parse()?;
+        if repository_identity(&candidate) == repository {
+            matches.push(digest);
+        }
+    }
+    if let Some(requested) = reference.digest() {
+        if descriptor.is_none_or(|digest| digest.as_str() != requested)
+            && !matches.iter().any(|digest| digest.as_str() == requested)
+        {
+            return Err(invalid());
+        }
+    }
+    if reference.registry().is_none() || matches.is_empty() {
+        return Ok(None);
+    }
+    let selected = if let Some(descriptor) = descriptor {
+        descriptor
+    } else if let Some(requested) = reference.digest() {
+        matches
+            .iter()
+            .find(|digest| digest.as_str() == requested)
+            .ok_or_else(invalid)?
+    } else {
+        matches
+            .iter()
+            .min_by(|left, right| left.as_str().cmp(right.as_str()))
+            .ok_or_else(invalid)?
+    };
+    Ok(Some(
+        format!("{}@{}", reference.repository(), selected.as_str()).parse()?,
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::{Value, json};
+
+    use super::*;
+
+    fn digest(letter: char) -> String {
+        format!("sha256:{}", letter.to_string().repeat(64))
+    }
+    fn inspection() -> Value {
+        json!({"Id":digest('a'),"Os":"linux","Architecture":"arm64","Size":1024,
+            "Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json", "digest":digest('b'),
+                "platform":{"os":"linux","architecture":"arm64"}},
+            "RepoDigests":[format!("registry.test/team/worker@{}",digest('c'))],
+            "Config":{"Entrypoint":["/entry"],"Cmd":["handler"],"WorkingDir":"/task","Env":["SECRET=secret_value"],"User":"1000"}})
+    }
+    fn selected(reference: &str, value: Value) -> Result<ResolvedImage, DockerError> {
+        resolve(
+            &reference.parse()?,
+            Architecture::Arm64,
+            None,
+            serde_json::from_value(value).unwrap(),
+            &digest('a').parse()?,
+        )
+    }
+
+    #[test]
+    fn test_should_pin_selected_child_and_preserve_validated_defaults() {
+        for suffix in [
+            ":v1".to_owned(),
+            format!("@{}", digest('c')),
+            format!("@{}", digest('b')),
+        ] {
+            let image =
+                selected(&format!("registry.test/team/worker{suffix}"), inspection()).unwrap();
+            assert_eq!(image.metadata().image_id.as_str(), digest('a'));
+            assert_eq!(
+                image.resolved_uri(),
+                format!("registry.test/team/worker@{}", digest('b'))
+            );
+            assert_eq!(
+                image.metadata().execution.plan(None).unwrap().entrypoint(),
+                ["/entry"]
+            );
+            assert_eq!(
+                image.metadata().execution.metadata().environment,
+                ["SECRET=secret_value"]
+            );
+            assert!(!format!("{image:?}").contains("secret_value"));
+            let restored: ResolvedImage =
+                serde_json::from_slice(&serde_json::to_vec(&image).unwrap()).unwrap();
+            assert_eq!(
+                restored.metadata().execution.plan(None).unwrap().command(),
+                ["handler"]
+            );
+        }
+        assert!(
+            selected(
+                &format!("registry.test/team/worker@{}", digest('d')),
+                inspection()
+            )
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn test_should_keep_short_local_provenance_and_ignore_unrelated_repository_digests() {
+        let mut value = inspection();
+        value["RepoDigests"] = json!([format!("team/worker@{}", digest('c'))]);
+        let image = selected("team/worker:v1", value).unwrap();
+        assert_eq!(image.resolved_uri(), format!("local://{}", digest('a')));
+        let mut value = inspection();
+        value["RepoDigests"] = json!([format!("other.test/team/worker@{}", digest('c'))]);
+        assert!(
+            selected("registry.test/team/worker:v1", value)
+                .unwrap()
+                .metadata()
+                .registry_manifest
+                .is_none()
+        );
+    }
+
+    #[rstest::rstest]
+    #[case("docker.io/library/python:v1", "python")]
+    #[case("index.docker.io/python:v1", "docker.io/library/python")]
+    #[case("Registry.test/team/worker:v1", "registry.test/team/worker")]
+    fn test_should_normalize_familiar_repository_evidence(
+        #[case] requested: &str,
+        #[case] repository: &str,
+    ) {
+        let mut value = inspection();
+        value["RepoDigests"] = json!([format!("{repository}@{}", digest('c'))]);
+        let image = selected(requested, value).unwrap();
+        assert_eq!(
+            image
+                .metadata()
+                .registry_manifest
+                .as_ref()
+                .unwrap()
+                .digest(),
+            Some(digest('b').as_str())
+        );
+    }
+
+    #[test]
+    fn test_should_select_legacy_manifest_evidence_deterministically() {
+        let mut value = inspection();
+        value.as_object_mut().unwrap().remove("Descriptor");
+        value["RepoDigests"] = json!([
+            format!("registry.test/team/worker@{}", digest('d')),
+            format!("registry.test/team/worker@{}", digest('c'))
+        ]);
+        let image = selected("registry.test/team/worker:v1", value.clone()).unwrap();
+        assert_eq!(
+            image.resolved_uri(),
+            format!("registry.test/team/worker@{}", digest('c'))
+        );
+        let image = selected(&format!("registry.test/team/worker@{}", digest('d')), value).unwrap();
+        assert_eq!(
+            image.resolved_uri(),
+            format!("registry.test/team/worker@{}", digest('d'))
+        );
+    }
+
+    #[rstest::rstest]
+    #[case("os")]
+    #[case("architecture")]
+    #[case("id")]
+    #[case("size_zero")]
+    #[case("size_negative")]
+    #[case("size_large")]
+    #[case("descriptor_index")]
+    #[case("descriptor_unknown")]
+    #[case("descriptor_digest")]
+    #[case("descriptor_arch")]
+    #[case("descriptor_os")]
+    #[case("descriptor_artifact")]
+    #[case("descriptor_attestation")]
+    #[case("digests_count")]
+    #[case("digests_invalid")]
+    #[case("digests_tag_only")]
+    #[case("config_missing")]
+    #[case("config_volumes")]
+    #[case("config_nul")]
+    #[case("config_empty_executable")]
+    fn test_should_reject_incompatible_or_ambiguous_image_metadata(#[case] field: &str) {
+        let mut value = inspection();
+        match field {
+            "os" => value["Os"] = json!("windows"),
+            "architecture" => value["Architecture"] = json!("amd64"),
+            "id" => value["Id"] = json!("worker:v1"),
+            "size_zero" => value["Size"] = json!(0),
+            "size_negative" => value["Size"] = json!(-1),
+            "size_large" => value["Size"] = json!(10_u64 * 1024 * 1024 * 1024 + 1),
+            "descriptor_index" => {
+                value["Descriptor"]["mediaType"] = json!("application/vnd.oci.image.index.v1+json");
+            }
+            "descriptor_unknown" => value["Descriptor"]["mediaType"] = json!("application/unknown"),
+            "descriptor_digest" => value["Descriptor"]["digest"] = json!("bad"),
+            "descriptor_arch" => value["Descriptor"]["platform"]["architecture"] = json!("amd64"),
+            "descriptor_os" => value["Descriptor"]["platform"]["os"] = json!("windows"),
+            "descriptor_artifact" => {
+                value["Descriptor"]["artifactType"] = json!("application/attestation");
+            }
+            "descriptor_attestation" => {
+                value["Descriptor"]["annotations"] =
+                    json!({"vnd.docker.reference.type":"attestation-manifest"});
+            }
+            "digests_count" => {
+                value["RepoDigests"] =
+                    json!(vec![
+                        format!("registry.test/team/worker@{}", digest('c'));
+                        129
+                    ]);
+            }
+            "digests_invalid" => value["RepoDigests"] = json!(["garbage@digest"]),
+            "digests_tag_only" => value["RepoDigests"] = json!(["registry.test/team/worker:v1"]),
+            "config_missing" => value["Config"] = Value::Null,
+            "config_volumes" => value["Config"]["Volumes"] = json!({"/data":{}}),
+            "config_nul" => value["Config"]["Cmd"] = json!(["bad\0"]),
+            "config_empty_executable" => {
+                value["Config"]["Entrypoint"] = json!([]);
+                value["Config"]["Cmd"] = json!([]);
+            }
+            _ => panic!("unknown test case"),
+        }
+        assert!(selected("registry.test/team/worker:v1", value).is_err());
+    }
+
+    #[test]
+    fn test_should_hash_only_normalized_base_execution_identity() {
+        let base = selected("registry.test/team/worker:v1", inspection()).unwrap();
+        let mut value = inspection();
+        value["Config"]["Labels"] = json!({"ignored":"changed"});
+        value["Created"] = json!("2025-01-01T00:00:00Z");
+        value["RepoDigests"] = json!([
+            format!("unrelated.test/other@{}", digest('e')),
+            format!("registry.test/team/worker@{}", digest('c'))
+        ]);
+        let same = selected("registry.test/team/worker:v2", value).unwrap();
+        assert_eq!(
+            base.metadata().inspection_hash,
+            same.metadata().inspection_hash
+        );
+        for field in ["Entrypoint", "Cmd", "Env", "User", "WorkingDir"] {
+            let mut value = inspection();
+            value["Config"][field] = match field {
+                "Entrypoint" | "Cmd" => json!(["changed"]),
+                "Env" => json!(["SECRET=changed"]),
+                "User" => json!("1001"),
+                _ => json!("/changed"),
+            };
+            let changed = selected("registry.test/team/worker:v1", value).unwrap();
+            assert_ne!(
+                base.metadata().inspection_hash,
+                changed.metadata().inspection_hash
+            );
+        }
+        let mut value = inspection();
+        value["Config"]["Entrypoint"] = json!([]);
+        value["Config"]["Cmd"] = json!([]);
+        let overrides = ImageConfig {
+            command: Some(vec!["/provided".into()]),
+            ..Default::default()
+        };
+        let image = resolve(
+            &"registry.test/team/worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            Some(&overrides),
+            serde_json::from_value(value).unwrap(),
+            &digest('a').parse().unwrap(),
+        )
+        .unwrap();
+        assert!(image.metadata().execution.plan(None).is_err());
+        assert_eq!(
+            image
+                .metadata()
+                .execution
+                .plan(Some(&overrides))
+                .unwrap()
+                .command(),
+            ["/provided"]
+        );
+    }
+    #[test]
+    fn test_should_require_consistent_classic_evidence_and_reject_manifest_summaries() {
+        let mut value = inspection();
+        value.as_object_mut().unwrap().remove("Descriptor");
+        value["GraphDriver"] = json!({"Name":"overlay2","Data":{}});
+        let inspected: ImageInspect = serde_json::from_value(value.clone()).unwrap();
+        let classic: SystemInfo = serde_json::from_value(
+            json!({"Driver":"overlay2","DriverStatus":[["Backing Filesystem","extfs"]]}),
+        )
+        .unwrap();
+        verify_classic_store(&inspected, &classic).unwrap();
+        for statuses in [
+            json!({"Driver":"vfs"}),
+            json!({"Driver":"vfs","DriverStatus":null}),
+        ] {
+            let mut vfs = inspected.clone();
+            vfs.graph_driver.as_mut().unwrap().name = "vfs".into();
+            verify_classic_store(&vfs, &serde_json::from_value(statuses).unwrap()).unwrap();
+        }
+        for name in ["btrfs", "zfs"] {
+            let mut containerd = inspected.clone();
+            containerd.graph_driver.as_mut().unwrap().name = name.into();
+            let info:SystemInfo = serde_json::from_value(json!({"Driver":name,"DriverStatus":[["driver-type","io.containerd.snapshotter.v1"]]})).unwrap();
+            assert!(verify_classic_store(&containerd, &info).is_err());
+        }
+        for info in [
+            json!({"Driver":"overlayfs","DriverStatus":[["driver-type","io.containerd.snapshotter.v1"]]}),
+            json!({"Driver":"overlay2","DriverStatus":[["driver-type","io.containerd.snapshotter.v1"]]}),
+            json!({"Driver":"overlay2","DriverStatus":[["malformed"]]}),
+        ] {
+            assert!(
+                verify_classic_store(&inspected, &serde_json::from_value(info).unwrap()).is_err()
+            );
+        }
+        value["Manifests"] = json!([{"ID":digest('b'),"Descriptor":{},"Available":true,"Kind":"image","ImageData":null,"AttestationData":null,"Size":{"Content":1,"Total":1}}]);
+        let inspected: ImageInspect = serde_json::from_value(value).unwrap();
+        assert!(verify_classic_store(&inspected, &classic).is_err());
+        assert!(selected_descriptor(&inspected, "arm64").is_err());
+    }
+
+    fn storage_proof() -> Value {
+        json!({"Id":digest('a'),"Manifests":[{"ID":digest('b'),
+            "Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":digest('b'),"platform":{"os":"linux","architecture":"arm64"}},
+            "Available":true,"Kind":"image","Size":{"Content":64,"Total":99999},
+            "ImageData":{"Containers":[],"Platform":{"os":"linux","architecture":"arm64"},"Size":{"Unpacked":4096}}}]})
+    }
+
+    #[test]
+    fn test_should_measure_selected_unpacked_storage_instead_of_compressed_or_total_size() {
+        let image = selected("registry.test/team/worker:v1", inspection()).unwrap();
+        let proof: ImageInspect = serde_json::from_value(storage_proof()).unwrap();
+        assert_eq!(unpacked_proof(&image, &proof).unwrap().get(), 4096);
+        let legacy = ResolvedImage::fixture(Architecture::Arm64);
+        let proof: ImageInspect = serde_json::from_value(
+            json!({"Id":digest('a'),"Size":8192,"Os":"linux","Architecture":"arm64"}),
+        )
+        .unwrap();
+        assert_eq!(unpacked_proof(&legacy, &proof).unwrap().get(), 8192);
+    }
+
+    #[rstest::rstest]
+    #[case("parent")]
+    #[case("missing")]
+    #[case("duplicate")]
+    #[case("unavailable")]
+    #[case("attestation")]
+    #[case("id")]
+    #[case("descriptor")]
+    #[case("platform")]
+    #[case("data")]
+    #[case("zero")]
+    #[case("negative")]
+    #[case("large")]
+    fn test_should_reject_missing_or_incompatible_unpacked_storage_evidence(#[case] fault: &str) {
+        let image = selected("registry.test/team/worker:v1", inspection()).unwrap();
+        let mut proof = storage_proof();
+        match fault {
+            "parent" => proof["Id"] = json!(digest('e')),
+            "missing" => proof["Manifests"] = json!([]),
+            "duplicate" => {
+                let duplicate = proof["Manifests"][0].clone();
+                proof["Manifests"].as_array_mut().unwrap().push(duplicate);
+            }
+            "unavailable" => proof["Manifests"][0]["Available"] = json!(false),
+            "attestation" => proof["Manifests"][0]["Kind"] = json!("attestation"),
+            "id" => proof["Manifests"][0]["ID"] = json!(digest('e')),
+            "descriptor" => proof["Manifests"][0]["Descriptor"]["digest"] = json!(digest('e')),
+            "platform" => {
+                proof["Manifests"][0]["ImageData"]["Platform"]["architecture"] = json!("amd64");
+            }
+            "data" => proof["Manifests"][0]["ImageData"] = Value::Null,
+            "zero" => proof["Manifests"][0]["ImageData"]["Size"]["Unpacked"] = json!(0),
+            "negative" => proof["Manifests"][0]["ImageData"]["Size"]["Unpacked"] = json!(-1),
+            "large" => {
+                proof["Manifests"][0]["ImageData"]["Size"]["Unpacked"] =
+                    json!(10_u64 * 1024 * 1024 * 1024 + 1);
+            }
+            _ => panic!("unknown test fault"),
+        }
+        assert!(unpacked_proof(&image, &serde_json::from_value(proof).unwrap()).is_err());
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/lease.rs b/crates/rustack-lambda-core/src/docker/lease.rs
new file mode 100644
index 00000000..ee73d4c5
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/lease.rs
@@ -0,0 +1,1214 @@
+//! Retained pin preparation, shared live leases and phase-aware cleanup recovery.
+
+use std::{
+    collections::HashMap,
+    fmt, mem,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use http::StatusCode;
+use rustack_lambda_model::types::ImageConfig;
+use tokio::{
+    runtime::Handle,
+    sync::{OwnedSemaphorePermit, Semaphore, mpsc, oneshot, watch},
+    task::{Id, JoinError, JoinHandle, JoinSet},
+    time::{Instant, sleep, timeout_at},
+};
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use super::{
+    DockerError, DockerPort, ImagePin, ImagePinScope, ImagePullPolicy, ImageResolver,
+    check_deadline,
+    connection::stopped,
+    mutation::{MutationGuard, MutationReceipt},
+    ownership::ImageRecord,
+};
+use crate::{
+    artifact::{
+        Architecture, ArtifactError, ImageLeaseContext, ImageReference, PinnedImage,
+        PreparationAdmission, PreparationReceipt, ResolvedImage, Sha256Digest, UnpackedImageSize,
+    },
+    executor::ExecutorError,
+    function_config::validate_image_config,
+    invocation::CleanupTask,
+};
+
+fn check_preparation_deadline(deadline: Instant) -> Result<(), DockerError> {
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .filter(|value| !value.is_zero())
+        .ok_or(DockerError::Deadline)?;
+    if remaining > Duration::from_secs(3600) {
+        return Err(DockerError::Configuration);
+    }
+    Ok(())
+}
+
+/// Validated image-preparation and live-pin admission/IO budgets.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct ImageLeaseConfig {
+    pins: u16,
+    jobs: u8,
+    io: Duration,
+}
+impl Default for ImageLeaseConfig {
+    fn default() -> Self {
+        Self {
+            pins: 1024,
+            jobs: 8,
+            io: Duration::from_secs(5),
+        }
+    }
+}
+impl ImageLeaseConfig {
+    /// Validate bounded pin/job counts and the independent mutation IO budget.
+    ///
+    /// # Errors
+    /// Rejects pins outside1..8192, jobs outside1..32 or exceeding pins, and
+    /// zero/over60s IO budgets.
+    ///
+    /// ```
+    /// let config = rustack_lambda_core::docker::ImageLeaseConfig::new(1024,8,std::time::Duration::from_secs(5))?;
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn new(pins: u16, jobs: u8, io: Duration) -> Result<Self, DockerError> {
+        if !(1..=8192).contains(&pins)
+            || !(1..=32).contains(&jobs)
+            || u16::from(jobs) > pins
+            || io < Duration::from_secs(1)
+            || io > Duration::from_secs(60)
+        {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self { pins, jobs, io })
+    }
+    fn deadline(self) -> Instant {
+        Instant::now() + self.io
+    }
+}
+
+/// Diagnostic counts; successful cleanup is established by joined ownership.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct ImageLeaseStatus {
+    /// Slots retained by queued, preparing, live or quarantined pins.
+    pub pins: usize,
+    /// Accepted preparations, including their failed-preparation cleanup.
+    pub preparing: usize,
+    /// Workers retaining uncertain/mismatching or failed cleanup.
+    pub quarantined: usize,
+    /// Whether new preparations can be accepted.
+    pub accepting: bool,
+    /// A worker/root supervision failure permanently closes admission.
+    pub worker_failed: bool,
+}
+#[derive(Debug, Default)]
+struct Health {
+    failed: AtomicBool,
+    quarantined: AtomicUsize,
+}
+
+#[derive(Debug)]
+struct PinBudget {
+    capacity: Arc<Semaphore>,
+    count: AtomicUsize,
+    changed: watch::Sender<()>,
+}
+impl PinBudget {
+    fn new(max: u16) -> Self {
+        let (changed, _) = watch::channel(());
+        Self {
+            capacity: Arc::new(Semaphore::new(usize::from(max))),
+            count: AtomicUsize::new(0),
+            changed,
+        }
+    }
+    fn acquire(self: &Arc<Self>) -> Result<PinPermit, DockerError> {
+        let permit = self
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| DockerError::Busy)?;
+        self.count.fetch_add(permit.num_permits(), Ordering::AcqRel);
+        self.changed.send_replace(());
+        Ok(PinPermit {
+            permit,
+            budget: self.clone(),
+        })
+    }
+}
+#[derive(Debug)]
+struct PinPermit {
+    permit: OwnedSemaphorePermit,
+    budget: Arc<PinBudget>,
+}
+impl Drop for PinPermit {
+    fn drop(&mut self) {
+        self.budget
+            .count
+            .fetch_sub(self.permit.num_permits(), Ordering::AcqRel);
+        self.budget.changed.send_replace(());
+    }
+}
+impl Health {
+    fn check(&self) -> Result<(), DockerError> {
+        if self.failed.load(Ordering::Acquire) {
+            return Err(DockerError::Worker);
+        }
+        if self.quarantined.load(Ordering::Acquire) > 0 {
+            return Err(DockerError::Quarantined);
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug)]
+enum PreparationSource {
+    Reference {
+        reference: ImageReference,
+        architecture: Architecture,
+    },
+    Restore(Box<ResolvedImage>),
+}
+impl PreparationSource {
+    fn architecture(&self) -> Architecture {
+        match self {
+            Self::Reference { architecture, .. } => *architecture,
+            Self::Restore(saved) => saved.metadata().architecture,
+        }
+    }
+}
+
+#[derive(TypedBuilder)]
+struct Request {
+    source: PreparationSource,
+    overrides: Option<ImageConfig>,
+    deadline: Instant,
+    cancelled: watch::Receiver<()>,
+    reply: oneshot::Sender<Result<PinnedImage, DockerError>>,
+    slot: Option<OwnedSemaphorePermit>,
+    #[builder(default)]
+    retained_admission: Option<Arc<OwnedSemaphorePermit>>,
+}
+impl fmt::Debug for Request {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ImagePreparation")
+            .field("deadline", &self.deadline)
+            .finish_non_exhaustive()
+    }
+}
+#[derive(Debug)]
+struct Envelope {
+    request: Request,
+    pin: ImagePin,
+    permit: PinPermit,
+}
+
+/// Cloneable bounded preparation port; it does not own manager shutdown.
+#[derive(Debug, Clone, TypedBuilder)]
+#[non_exhaustive]
+pub struct ImageLeasePort {
+    #[builder(default)]
+    platform: Option<Architecture>,
+    sender: mpsc::Sender<Envelope>,
+    slots: Arc<Semaphore>,
+    pins: Arc<PinBudget>,
+    stop: watch::Sender<bool>,
+    health: Arc<Health>,
+    scope: ImagePinScope,
+    config: ImageLeaseConfig,
+}
+impl ImageLeasePort {
+    pub(crate) fn available(&self) -> Result<(), DockerError> {
+        self.health.check()?;
+        if *self.stop.borrow() {
+            return Err(DockerError::Stopped);
+        }
+        Ok(())
+    }
+    pub(crate) fn preparation_jobs(&self) -> u8 {
+        self.config.jobs
+    }
+
+    /// Prepare a live pinned artifact; dropping this future signals cancellation.
+    ///
+    /// # Errors
+    /// Returns invalid settings, bounded admission, deadline, metadata, mutation
+    /// or cleanup failure. In-flight mutations and cleanup remain supervised.
+    ///
+    /// ```no_run
+    /// # async fn prepare(port:&rustack_lambda_core::docker::ImageLeasePort) -> Result<(),rustack_lambda_core::docker::DockerError> {
+    /// let image = port.prepare(&"worker:v1".parse()?,rustack_lambda_core::artifact::Architecture::Arm64,None,
+    ///     tokio::time::Instant::now()+std::time::Duration::from_secs(30)).await?;
+    /// assert!(image.is_live());
+    /// # Ok(()) }
+    /// ```
+    pub async fn prepare(
+        &self,
+        reference: &ImageReference,
+        architecture: Architecture,
+        overrides: Option<&ImageConfig>,
+        deadline: Instant,
+    ) -> Result<PinnedImage, DockerError> {
+        self.prepare_guarded(
+            PreparationSource::Reference {
+                reference: reference.clone(),
+                architecture,
+            },
+            overrides,
+            deadline,
+            None,
+        )
+        .await
+    }
+
+    /// Reacquire local immutable content without following source tags or pulling.
+    ///
+    /// The saved ID, selected platform and execution fingerprint must match fresh
+    /// inspection before a new durable private pin can be created. Saved metadata
+    /// alone never grants availability. This does not publish an archive store.
+    ///
+    /// # Errors
+    /// Returns unavailable/exhausted admission, deadline, missing immutable content,
+    /// changed inspection metadata or retained mutation/cleanup failure. Cancellation
+    /// never discards an uncertain mutation or its ownership.
+    ///
+    /// ```no_run
+    /// # async fn restore(port: &rustack_lambda_core::docker::ImageLeasePort, saved: &rustack_lambda_core::artifact::ResolvedImage) -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// let image = port.restore(saved, None, tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await?;
+    /// assert!(image.is_live());
+    /// # Ok(()) }
+    /// ```
+    pub async fn restore(
+        &self,
+        saved: &ResolvedImage,
+        overrides: Option<&ImageConfig>,
+        deadline: Instant,
+    ) -> Result<PinnedImage, DockerError> {
+        self.prepare_guarded(
+            PreparationSource::Restore(Box::new(saved.clone())),
+            overrides,
+            deadline,
+            None,
+        )
+        .await
+    }
+
+    pub(crate) async fn prepare_deployment(
+        &self,
+        reference: &ImageReference,
+        architecture: Architecture,
+        overrides: Option<&ImageConfig>,
+        deadline: Instant,
+        admission: Arc<OwnedSemaphorePermit>,
+    ) -> Result<PinnedImage, DockerError> {
+        self.prepare_guarded(
+            PreparationSource::Reference {
+                reference: reference.clone(),
+                architecture,
+            },
+            overrides,
+            deadline,
+            Some(admission),
+        )
+        .await
+    }
+
+    async fn prepare_guarded(
+        &self,
+        source: PreparationSource,
+        overrides: Option<&ImageConfig>,
+        deadline: Instant,
+        retained_admission: Option<Arc<OwnedSemaphorePermit>>,
+    ) -> Result<PinnedImage, DockerError> {
+        let deployment = retained_admission.is_some();
+        self.available()?;
+        if self
+            .platform
+            .is_some_and(|platform| platform != source.architecture())
+        {
+            return Err(DockerError::Configuration);
+        }
+        check_preparation_deadline(deadline)?;
+        if let Some(config) = overrides {
+            validate_image_config(config).map_err(|_| DockerError::Configuration)?;
+        }
+        let slot = self
+            .slots
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| DockerError::Busy)?;
+        let permit = self.pins.acquire()?;
+        let pin = self.scope.allocate()?;
+        let (cancel, cancelled) = watch::channel(());
+        let (reply, response) = oneshot::channel();
+        let request = Request::builder()
+            .source(source)
+            .overrides(overrides.cloned())
+            .deadline(deadline)
+            .cancelled(cancelled)
+            .reply(reply)
+            .slot(Some(slot))
+            .retained_admission(retained_admission)
+            .build();
+        self.sender
+            .try_send(Envelope {
+                request,
+                pin,
+                permit,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => DockerError::Busy,
+                mpsc::error::TrySendError::Closed(_) => DockerError::Stopped,
+            })?;
+        let result = timeout_at(deadline, response)
+            .await
+            .map_err(|_| DockerError::Deadline)?
+            .map_err(|_| DockerError::Worker)?;
+        drop(cancel);
+        self.available()?;
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        let image = result?;
+        if !deployment {
+            image.accept_preparation();
+        }
+        Ok(image)
+    }
+    /// Observe release of every pin reservation without stopping admission.
+    ///
+    /// # Errors
+    /// Returns expiry or supervision failure. A timeout never drops cleanup.
+    /// Concurrent new preparations can delay this observation.
+    ///
+    /// ```no_run
+    /// # async fn empty(port:&rustack_lambda_core::docker::ImageLeasePort) {
+    /// let clean=port.wait_empty(tokio::time::Instant::now()+std::time::Duration::from_secs(10)).await;
+    /// # }
+    /// ```
+    pub async fn wait_empty(&self, deadline: Instant) -> Result<(), DockerError> {
+        check_deadline(deadline)?;
+        let mut changed = self.pins.changed.subscribe();
+        while self.pins.count.load(Ordering::Acquire) > 0 {
+            timeout_at(deadline, changed.changed())
+                .await
+                .map_err(|_| DockerError::Deadline)?
+                .map_err(|_| DockerError::Worker)?;
+        }
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        self.health.check()
+    }
+    /// Inspect bounded resource counts without logging source image defaults.
+    ///
+    /// ```no_run
+    /// # fn status(port:&rustack_lambda_core::docker::ImageLeasePort) {
+    /// let status=port.status();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> ImageLeaseStatus {
+        let worker_failed = self.health.failed.load(Ordering::Acquire);
+        let quarantined = self.health.quarantined.load(Ordering::Acquire);
+        ImageLeaseStatus {
+            pins: self.pins.count.load(Ordering::Acquire),
+            preparing: usize::from(self.config.jobs).saturating_sub(self.slots.available_permits()),
+            quarantined,
+            accepting: !worker_failed && quarantined == 0 && !*self.stop.borrow(),
+            worker_failed,
+        }
+    }
+}
+
+/// Owner of every preparation, live alias and retained cleanup worker.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct ImageLeaseManager {
+    port: ImageLeasePort,
+    task: Option<JoinHandle<Result<(), DockerError>>>,
+    primary: Option<Result<(), DockerError>>,
+    settlement: Option<Result<(), DockerError>>,
+    emergency: Arc<CleanupTask>,
+}
+impl ImageLeaseManager {
+    pub(super) fn physically_settled(&self) -> bool {
+        self.primary.is_some()
+            && self.task.is_none()
+            && self.emergency.is_finished()
+            && self.port.status().pins == 0
+            && self.port.status().preparing == 0
+    }
+
+    /// Start under the current Tokio runtime with an explicit scoped Docker port.
+    ///
+    /// # Errors
+    /// Rejects absence of a Tokio runtime or a port not bound to this exact
+    /// directory lease. The scope is never taken from a function request.
+    ///
+    /// ```no_run
+    /// # fn start(port:rustack_lambda_core::docker::DockerPort,scope:rustack_lambda_core::docker::ImagePinScope) -> Result<(),rustack_lambda_core::docker::DockerError> {
+    /// let owner=rustack_lambda_core::docker::ImageLeaseManager::start(port,scope,Default::default())?;
+    /// # Ok(()) }
+    /// ```
+    pub fn start(
+        docker: DockerPort,
+        scope: ImagePinScope,
+        config: ImageLeaseConfig,
+    ) -> Result<Self, DockerError> {
+        Self::start_with_pull(docker, scope, config, ImagePullPolicy::default())
+    }
+
+    /// Start with an explicit validated operator pull policy.
+    ///
+    /// # Errors
+    /// Rejects absent runtime or a port not bound to this exact directory.
+    /// No startup readiness is granted by this constructor.
+    ///
+    /// ```no_run
+    /// # fn start(port:rustack_lambda_core::docker::DockerPort,scope:rustack_lambda_core::docker::ImagePinScope)->Result<(),rustack_lambda_core::docker::DockerError> {
+    /// let policy=rustack_lambda_core::docker::ImagePullPolicy::if_missing(vec!["registry.example".parse()?],Default::default(),std::time::Duration::from_secs(300))?;
+    /// let images=rustack_lambda_core::docker::ImageLeaseManager::start_with_pull(port,scope,Default::default(),policy)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn start_with_pull(
+        docker: DockerPort,
+        scope: ImagePinScope,
+        config: ImageLeaseConfig,
+        policy: ImagePullPolicy,
+    ) -> Result<Self, DockerError> {
+        Self::start_platform(docker, scope, config, policy, None)
+    }
+    pub(super) fn start_qualified(
+        docker: DockerPort,
+        scope: ImagePinScope,
+        config: ImageLeaseConfig,
+        policy: ImagePullPolicy,
+        platform: Architecture,
+    ) -> Result<Self, DockerError> {
+        Self::start_platform(docker, scope, config, policy, Some(platform))
+    }
+    fn start_platform(
+        docker: DockerPort,
+        scope: ImagePinScope,
+        config: ImageLeaseConfig,
+        policy: ImagePullPolicy,
+        platform: Option<Architecture>,
+    ) -> Result<Self, DockerError> {
+        docker.require_directory(scope.directory())?;
+        let runtime = Handle::try_current().map_err(|_| DockerError::Worker)?;
+        let (sender, requests) = mpsc::channel(32);
+        let (stop, _) = watch::channel(false);
+        let health = Arc::new(Health::default());
+        let emergency = Arc::new(CleanupTask::default());
+        let port = ImageLeasePort::builder()
+            .platform(platform)
+            .sender(sender)
+            .slots(Arc::new(Semaphore::new(usize::from(config.jobs))))
+            .pins(Arc::new(PinBudget::new(config.pins)))
+            .stop(stop.clone())
+            .health(health.clone())
+            .scope(scope)
+            .config(config)
+            .build();
+        let actor = Actor::builder()
+            .docker(docker)
+            .policy(policy)
+            .config(config)
+            .inbox(requests)
+            .control(stop)
+            .health(health)
+            .runtime(runtime.clone())
+            .emergency(emergency.clone())
+            .build();
+        let task = runtime.spawn(actor.run());
+        Ok(Self {
+            port,
+            task: Some(task),
+            primary: None,
+            settlement: None,
+            emergency,
+        })
+    }
+    /// Clone a preparation port; retain this owner through consumer shutdown.
+    ///
+    /// ```no_run
+    /// # fn port(owner:&rustack_lambda_core::docker::ImageLeaseManager) {
+    /// let port=owner.port();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn port(&self) -> ImageLeasePort {
+        self.port.clone()
+    }
+
+    /// Revoke leases, stop admission and join pin cleanup before `DockerWire` stops.
+    ///
+    /// # Errors
+    /// Returns timeout while retaining cleanup, or cached supervision failure.
+    /// The runtime must first join invocation/environment consumers of the leases.
+    ///
+    /// ```no_run
+    /// # async fn stop(owner:&mut rustack_lambda_core::docker::ImageLeaseManager) {
+    /// let result=owner.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(10)).await;
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), DockerError> {
+        self.port.stop.send_replace(true);
+        if let Some(result) = &self.settlement {
+            return result.clone();
+        }
+        check_deadline(deadline)?;
+        if self.primary.is_none() {
+            let result = match self.task.as_mut() {
+                Some(task) => timeout_at(deadline, task)
+                    .await
+                    .map_err(|_| DockerError::Deadline)?
+                    .map_err(|_| DockerError::Worker)
+                    .and_then(|result| result),
+                None => Err(DockerError::Worker),
+            };
+            self.primary = Some(result);
+            self.task.take();
+        }
+        let emergency = timeout_at(deadline, self.emergency.wait())
+            .await
+            .map_err(|_| DockerError::Deadline)?
+            .map_err(|_| DockerError::Worker);
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        let result = self
+            .primary
+            .clone()
+            .ok_or(DockerError::Worker)?
+            .and(emergency);
+        self.settlement = Some(result.clone());
+        result
+    }
+}
+impl Drop for ImageLeaseManager {
+    fn drop(&mut self) {
+        self.port.stop.send_replace(true);
+    }
+}
+
+#[derive(Debug, Clone)]
+enum Phase {
+    Unissued,
+    Preparing(Sha256Digest),
+    Uncertain(Sha256Digest, MutationReceipt),
+    Committing(Sha256Digest),
+    Known(Sha256Digest),
+    NoEffect(Sha256Digest),
+    Clean,
+}
+#[derive(Debug)]
+struct Progress {
+    phase: watch::Sender<Phase>,
+    released: watch::Receiver<()>,
+    active: Arc<AtomicBool>,
+}
+#[derive(Debug)]
+struct Record {
+    pin: ImagePin,
+    progress: Arc<Progress>,
+    permit: PinPermit,
+    _admission: PreparationReceipt,
+}
+
+type PinJob = (Uuid, Result<(), DockerError>);
+type PinJoin = Result<(Id, PinJob), JoinError>;
+
+#[derive(Debug, TypedBuilder)]
+struct Actor {
+    docker: DockerPort,
+    #[builder(default)]
+    policy: ImagePullPolicy,
+    config: ImageLeaseConfig,
+    inbox: mpsc::Receiver<Envelope>,
+    control: watch::Sender<bool>,
+    health: Arc<Health>,
+    runtime: Handle,
+    emergency: Arc<CleanupTask>,
+    #[builder(default = Arc::new(Semaphore::new(2)))]
+    cleanup: Arc<Semaphore>,
+    #[builder(default)]
+    jobs: JoinSet<PinJob>,
+    #[builder(default)]
+    records: HashMap<Uuid, Record>,
+    #[builder(default)]
+    index: HashMap<Id, Uuid>,
+    #[builder(default)]
+    settled: bool,
+}
+impl Actor {
+    async fn run(mut self) -> Result<(), DockerError> {
+        let mut stop = self.control.subscribe();
+        let mut wire_stop = self.docker.raw.stop.subscribe();
+        loop {
+            if *stop.borrow() {
+                self.inbox.close();
+                while let Ok(envelope) = self.inbox.try_recv() {
+                    let _ = envelope.request.reply.send(Err(DockerError::Stopped));
+                }
+                for record in self.records.values() {
+                    record.progress.active.store(false, Ordering::Release);
+                }
+                if self.jobs.is_empty() {
+                    break;
+                }
+                if let Some(result) = self.jobs.join_next_with_id().await {
+                    self.finished(&result);
+                }
+                continue;
+            }
+            tokio::select! {
+                biased;
+                ()=stopped(&mut wire_stop)=>{ self.health.failed.store(true,Ordering::Release);self.control.send_replace(true); },
+                ()=stopped(&mut stop)=>{},
+                result=self.jobs.join_next_with_id(),if !self.jobs.is_empty()=>if let Some(result)=result {self.finished(&result);},
+                envelope=self.inbox.recv()=>match envelope {Some(envelope)=>self.start(envelope),None=>{self.control.send_replace(true);}},
+            }
+        }
+        self.settled = true;
+        if self.health.failed.load(Ordering::Acquire) {
+            Err(DockerError::Worker)
+        } else {
+            Ok(())
+        }
+    }
+    fn start(&mut self, mut envelope: Envelope) {
+        if self.health.check().is_err()
+            || *self.control.borrow()
+            || envelope.request.reply.is_closed()
+            || envelope.request.cancelled.has_changed().is_err()
+            || Instant::now() >= envelope.request.deadline
+        {
+            let _ = envelope.request.reply.send(Err(DockerError::Stopped));
+            return;
+        }
+        let Some(slot) = envelope.request.slot.take() else {
+            self.health.failed.store(true, Ordering::Release);
+            self.control.send_replace(true);
+            let _ = envelope.request.reply.send(Err(DockerError::Worker));
+            return;
+        };
+        let (admission, _) = watch::channel(Some(PreparationAdmission::new(
+            slot,
+            envelope.request.retained_admission.take(),
+        )));
+        let (phase, _) = watch::channel(Phase::Unissued);
+        let (release, released) = watch::channel(());
+        let progress = Arc::new(Progress {
+            phase,
+            released,
+            active: Arc::new(AtomicBool::new(false)),
+        });
+        let id = envelope.pin.id;
+        let worker = Worker::builder()
+            .docker(self.docker.clone())
+            .policy(self.policy.clone())
+            .config(self.config)
+            .pin(envelope.pin.clone())
+            .progress(progress.clone())
+            .control(self.control.clone())
+            .health(self.health.clone())
+            .cleanup(self.cleanup.clone())
+            .build();
+        self.records.insert(
+            id,
+            Record {
+                pin: envelope.pin,
+                progress,
+                permit: envelope.permit,
+                _admission: admission.clone(),
+            },
+        );
+        let health = self.health.clone();
+        let control = self.control.clone();
+        let job = self.jobs.spawn(async move {
+            let mut guard = WorkerGuard {
+                health,
+                control,
+                finished: false,
+            };
+            let result = worker.run(envelope.request, release, admission).await;
+            guard.finished = true;
+            (id, result)
+        });
+        self.index.insert(job.id(), id);
+    }
+    fn finished(&mut self, result: &PinJoin) {
+        let task = match result {
+            Ok((id, _)) => *id,
+            Err(error) => error.id(),
+        };
+        let Some(id) = self.index.remove(&task) else {
+            self.fail();
+            return;
+        };
+        let clean = self.records.get(&id).is_some_and(|record| {
+            matches!(
+                *record.progress.phase.borrow(),
+                Phase::Unissued | Phase::Clean
+            )
+        });
+        if matches!(result, Ok((_, (returned, Ok(())))) if *returned==id) && clean {
+            if let Some(record) = self.records.remove(&id) {
+                drop(record.permit);
+            }
+            return;
+        }
+        self.fail();
+        let Some(record) = self.records.get(&id) else {
+            return;
+        };
+        record.progress.active.store(false, Ordering::Release);
+        let worker = Worker::builder()
+            .docker(self.docker.clone())
+            .config(self.config)
+            .pin(record.pin.clone())
+            .progress(record.progress.clone())
+            .control(self.control.clone())
+            .health(self.health.clone())
+            .cleanup(self.cleanup.clone())
+            .build();
+        let job = self.jobs.spawn(async move {
+            worker.retire().await;
+            (id, Ok(()))
+        });
+        self.index.insert(job.id(), id);
+    }
+    fn fail(&self) {
+        self.health.failed.store(true, Ordering::Release);
+        self.control.send_replace(true);
+    }
+}
+impl Drop for Actor {
+    fn drop(&mut self) {
+        if !self.settled {
+            self.fail();
+        }
+        if self.records.is_empty() {
+            return;
+        }
+        self.fail();
+        for record in self.records.values() {
+            record.progress.active.store(false, Ordering::Release);
+        }
+        let records = mem::take(&mut self.records);
+        let mut jobs = mem::take(&mut self.jobs);
+        jobs.abort_all();
+        let docker = self.docker.clone();
+        let config = self.config;
+        let control = self.control.clone();
+        let health = self.health.clone();
+        let cleanup = self.cleanup.clone();
+        self.emergency.start_on(&self.runtime, move || async move {
+            while jobs.join_next().await.is_some() {}
+            recover_all(records, docker, config, control, health, cleanup).await
+        });
+    }
+}
+
+async fn recover_all(
+    mut records: HashMap<Uuid, Record>,
+    docker: DockerPort,
+    config: ImageLeaseConfig,
+    control: watch::Sender<bool>,
+    health: Arc<Health>,
+    cleanup: Arc<Semaphore>,
+) -> Result<(), ExecutorError> {
+    let mut jobs = JoinSet::new();
+    let mut index = HashMap::new();
+    for (id, record) in &records {
+        let worker = Worker::builder()
+            .docker(docker.clone())
+            .config(config)
+            .pin(record.pin.clone())
+            .progress(record.progress.clone())
+            .control(control.clone())
+            .health(health.clone())
+            .cleanup(cleanup.clone())
+            .build();
+        let id = *id;
+        let job = jobs.spawn(async move {
+            worker.retire().await;
+            id
+        });
+        index.insert(job.id(), id);
+    }
+    while let Some(result) = jobs.join_next_with_id().await {
+        let task = match &result {
+            Ok((task, _)) => *task,
+            Err(error) => error.id(),
+        };
+        let Some(id) = index.remove(&task) else {
+            continue;
+        };
+        let Some(record) = records.get(&id) else {
+            continue;
+        };
+        if matches!(
+            *record.progress.phase.borrow(),
+            Phase::Unissued | Phase::Clean
+        ) {
+            if let Some(record) = records.remove(&id) {
+                drop(record.permit);
+            }
+        } else {
+            let worker = Worker::builder()
+                .docker(docker.clone())
+                .config(config)
+                .pin(record.pin.clone())
+                .progress(record.progress.clone())
+                .control(control.clone())
+                .health(health.clone())
+                .cleanup(cleanup.clone())
+                .build();
+            let job = jobs.spawn(async move {
+                worker.retire().await;
+                id
+            });
+            index.insert(job.id(), id);
+        }
+    }
+    if records.is_empty() {
+        Ok(())
+    } else {
+        Err(ExecutorError::CleanupFailed(
+            "Image pin recovery lost supervision".into(),
+        ))
+    }
+}
+
+struct WorkerGuard {
+    health: Arc<Health>,
+    control: watch::Sender<bool>,
+    finished: bool,
+}
+impl Drop for WorkerGuard {
+    fn drop(&mut self) {
+        if !self.finished {
+            self.health.failed.store(true, Ordering::Release);
+            self.control.send_replace(true);
+        }
+    }
+}
+struct Dirty(Arc<Health>);
+impl Dirty {
+    fn new(health: Arc<Health>) -> Self {
+        health.quarantined.fetch_add(1, Ordering::AcqRel);
+        Self(health)
+    }
+}
+impl Drop for Dirty {
+    fn drop(&mut self) {
+        self.0.quarantined.fetch_sub(1, Ordering::AcqRel);
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Worker {
+    docker: DockerPort,
+    #[builder(default)]
+    policy: ImagePullPolicy,
+    config: ImageLeaseConfig,
+    pin: ImagePin,
+    progress: Arc<Progress>,
+    control: watch::Sender<bool>,
+    health: Arc<Health>,
+    cleanup: Arc<Semaphore>,
+}
+impl Worker {
+    fn check(&self, deadline: Instant, cancel: &watch::Receiver<()>) -> Result<(), DockerError> {
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        if *self.control.borrow() {
+            return Err(DockerError::Stopped);
+        }
+        if cancel.has_changed().is_err() {
+            return Err(DockerError::Cancelled);
+        }
+        Ok(())
+    }
+    async fn run(
+        mut self,
+        request: Request,
+        release: watch::Sender<()>,
+        admission: PreparationReceipt,
+    ) -> Result<(), DockerError> {
+        let Request {
+            source,
+            overrides,
+            deadline,
+            mut cancelled,
+            reply,
+            slot: _,
+            retained_admission: _,
+        } = request;
+        let staged = self
+            .stage(&source, overrides.as_ref(), deadline, &mut cancelled)
+            .await;
+        drop(source);
+        drop(overrides);
+        match staged {
+            Ok((resolved, size)) => {
+                self.progress.active.store(true, Ordering::Release);
+                let image = PinnedImage::with_context(
+                    resolved,
+                    size,
+                    release,
+                    self.progress.active.clone(),
+                    self.control.subscribe(),
+                    ImageLeaseContext::Owned {
+                        directory: self.pin.directory().clone(),
+                        preparation: Some(admission),
+                    },
+                );
+                let delivered = match self.check(deadline, &cancelled) {
+                    Ok(()) => reply.send(Ok(image)).is_ok(),
+                    Err(error) => {
+                        self.progress.active.store(false, Ordering::Release);
+                        drop(image);
+                        let _ = reply.send(Err(error));
+                        false
+                    }
+                };
+                drop(cancelled);
+                if !delivered {
+                    self.progress.active.store(false, Ordering::Release);
+                    self.retire().await;
+                    return Ok(());
+                }
+                let mut released = self.progress.released.clone();
+                let mut stop = self.control.subscribe();
+                tokio::select! {biased;()=stopped(&mut stop)=>{},_ = released.changed()=>{}}
+                self.retire().await;
+            }
+            Err(error) => {
+                let _ = reply.send(Err(error));
+                self.retire().await;
+            }
+        }
+        Ok(())
+    }
+    async fn resolve_source(
+        &self,
+        source: &PreparationSource,
+        overrides: Option<&ImageConfig>,
+        deadline: Instant,
+        cancel: &mut watch::Receiver<()>,
+    ) -> Result<ResolvedImage, DockerError> {
+        self.check(deadline, cancel)?;
+        let architecture = source.architecture();
+        let (reference, lookup) = match source {
+            PreparationSource::Reference { reference, .. } => (reference, reference.clone()),
+            PreparationSource::Restore(saved) => (
+                &saved.metadata().requested_reference,
+                saved.metadata().image_id.as_str().parse()?,
+            ),
+        };
+        let resolver = ImageResolver::new(self.docker.clone());
+        let mut stop = self.control.subscribe();
+        let root = tokio::select! {biased;()=stopped(&mut stop)=>return Err(DockerError::Stopped),_ = cancel.changed()=>return Err(DockerError::Cancelled),result=self.docker.inspect_image(&lookup,deadline.min(self.config.deadline()))=>result,};
+        let root = match root {
+            Err(DockerError::Status(StatusCode::NOT_FOUND))
+                if matches!(source, PreparationSource::Reference { .. }) =>
+            {
+                self.policy
+                    .pull(
+                        &self.docker,
+                        reference,
+                        architecture,
+                        cancel.clone(),
+                        self.control.subscribe(),
+                    )
+                    .await?;
+                self.check(deadline, cancel)?;
+                tokio::select! {biased;()=stopped(&mut stop)=>return Err(DockerError::Stopped),_ = cancel.changed()=>return Err(DockerError::Cancelled),result=self.docker.inspect_image(reference,deadline.min(self.config.deadline()))=>result?,}
+            }
+            result => result?,
+        };
+        if let PreparationSource::Restore(saved) = source {
+            if root.id.as_deref() != Some(saved.metadata().image_id.as_str()) {
+                return Err(ArtifactError::Inspection.into());
+            }
+        }
+        let actual = tokio::select! {biased;()=stopped(&mut stop)=>return Err(DockerError::Stopped),_ = cancel.changed()=>return Err(DockerError::Cancelled),result=resolver.resolve_captured(reference,architecture,overrides,root,deadline.min(self.config.deadline()))=>result?,};
+        self.check(deadline, cancel)?;
+        match source {
+            PreparationSource::Restore(saved) => {
+                if actual.metadata().inspection_hash != saved.metadata().inspection_hash {
+                    return Err(ArtifactError::Inspection.into());
+                }
+                Ok(saved.as_ref().clone())
+            }
+            PreparationSource::Reference { .. } => Ok(actual),
+        }
+    }
+
+    async fn stage(
+        &mut self,
+        source: &PreparationSource,
+        overrides: Option<&ImageConfig>,
+        deadline: Instant,
+        cancel: &mut watch::Receiver<()>,
+    ) -> Result<(ResolvedImage, UnpackedImageSize), DockerError> {
+        let image = self
+            .resolve_source(source, overrides, deadline, cancel)
+            .await?;
+        let resolver = ImageResolver::new(self.docker.clone());
+        let mut stop = self.control.subscribe();
+        self.check(deadline, cancel)?;
+        let expected = image.metadata().image_id.clone();
+        self.progress
+            .phase
+            .send_replace(Phase::Preparing(expected.clone()));
+        self.pin
+            .directory()
+            .prepare_image(
+                ImageRecord::new(&self.pin, &expected)?,
+                self.config.deadline(),
+            )
+            .await?;
+        self.check(deadline, cancel)?;
+        let mutation = MutationGuard::new();
+        self.progress
+            .phase
+            .send_replace(Phase::Uncertain(expected.clone(), mutation.receipt()));
+        let tagged = self
+            .docker
+            .tag_image_pin_tracked(&expected, &self.pin, self.config.deadline(), mutation)
+            .await;
+        if matches!(
+            &tagged,
+            Err(DockerError::Busy
+                | DockerError::Status(StatusCode::BAD_REQUEST | StatusCode::NOT_FOUND))
+        ) {
+            self.progress
+                .phase
+                .send_replace(Phase::NoEffect(expected.clone()));
+        }
+        tagged?;
+        self.persist_commit(&expected).await?;
+        self.check(deadline, cancel)?;
+        let actual = tokio::select! {biased;()=stopped(&mut stop)=>return Err(DockerError::Stopped),_ = cancel.changed()=>return Err(DockerError::Cancelled),result=self.docker.inspect_image(self.pin.reference(),deadline.min(self.config.deadline()))=>result?,};
+        if actual.id.as_deref() != Some(expected.as_str()) {
+            return Err(DockerError::Quarantined);
+        }
+        let size = tokio::select! {biased;()=stopped(&mut stop)=>return Err(DockerError::Stopped),_ = cancel.changed()=>return Err(DockerError::Cancelled),result=resolver.unpacked_size(&image,deadline.min(self.config.deadline()))=>result?,};
+        self.check(deadline, cancel)?;
+        Ok((image, size))
+    }
+    async fn retire(self) {
+        self.progress.active.store(false, Ordering::Release);
+        let mut dirty = matches!(
+            *self.progress.phase.borrow(),
+            Phase::Uncertain(..) | Phase::Committing(_)
+        )
+        .then(|| Dirty::new(self.health.clone()));
+        let mut delay = Duration::from_secs(1);
+        loop {
+            if self.cleanup_step().await {
+                self.progress.phase.send_replace(Phase::Clean);
+                return;
+            }
+            if dirty.is_none() {
+                dirty = Some(Dirty::new(self.health.clone()));
+            }
+            sleep(delay).await;
+            delay = delay.saturating_mul(2).min(Duration::from_secs(30));
+        }
+    }
+    async fn cleanup_step(&self) -> bool {
+        let phase = self.progress.phase.borrow().clone();
+        let (expected, known) = match phase {
+            Phase::Unissued | Phase::Clean => return true,
+            Phase::Preparing(id) | Phase::NoEffect(id) => return self.erase(&id).await,
+            Phase::Committing(id) => {
+                if self.persist_commit(&id).await.is_err() {
+                    return false;
+                }
+                (id, true)
+            }
+            Phase::Known(id) => (id, true),
+            Phase::Uncertain(id, receipt) => {
+                if receipt.definitely_unissued() {
+                    return self.erase(&id).await;
+                }
+                (id, false)
+            }
+        };
+        let Ok(_cleanup) = self.cleanup.acquire().await else {
+            return false;
+        };
+        let inspected = self
+            .docker
+            .inspect_image_pin(&self.pin, self.config.deadline())
+            .await;
+        match inspected {
+            Err(DockerError::Status(StatusCode::NOT_FOUND)) => known && self.erase(&expected).await,
+            Ok(image) if image.id.as_deref() == Some(expected.as_str()) => {
+                if self.persist_commit(&expected).await.is_err() {
+                    return false;
+                }
+                if !matches!(self.docker.inspect_image_pin(&self.pin, self.config.deadline()).await,
+                    Ok(image) if image.id.as_deref() == Some(expected.as_str()))
+                {
+                    return false;
+                }
+                let _ = self
+                    .docker
+                    .remove_image_pin(&self.pin, self.config.deadline())
+                    .await;
+                matches!(
+                    self.docker
+                        .inspect_image_pin(&self.pin, self.config.deadline())
+                        .await,
+                    Err(DockerError::Status(StatusCode::NOT_FOUND))
+                ) && self.erase(&expected).await
+            }
+            _ => false,
+        }
+    }
+    async fn persist_commit(&self, expected: &Sha256Digest) -> Result<(), DockerError> {
+        self.progress
+            .phase
+            .send_replace(Phase::Committing(expected.clone()));
+        self.pin
+            .directory()
+            .commit_image(
+                ImageRecord::new(&self.pin, expected)?,
+                self.config.deadline(),
+            )
+            .await?;
+        self.progress
+            .phase
+            .send_replace(Phase::Known(expected.clone()));
+        Ok(())
+    }
+    async fn erase(&self, expected: &Sha256Digest) -> bool {
+        let Ok(record) = ImageRecord::new(&self.pin, expected) else {
+            return false;
+        };
+        self.pin
+            .directory()
+            .settle_image(record, self.config.deadline())
+            .await
+            .is_ok()
+    }
+}
+
+#[cfg(test)]
+#[path = "lease_tests.rs"]
+pub(crate) mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/lease_tests.rs b/crates/rustack-lambda-core/src/docker/lease_tests.rs
new file mode 100644
index 00000000..d892c05f
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/lease_tests.rs
@@ -0,0 +1,1012 @@
+use std::{
+    future::Future,
+    task::{Context, Waker},
+};
+
+use serde_json::{Value, json};
+use tokio::{
+    sync::Notify,
+    time::{sleep_until, timeout},
+};
+
+use super::*;
+use crate::docker::{
+    DirectoryLease, DirectoryLeaseError, DockerWire,
+    tests::{Daemon, IncomingRequest},
+};
+
+fn digest(letter: char) -> String {
+    format!("sha256:{}", letter.to_string().repeat(64))
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn scope() -> ImagePinScope {
+    ImagePinScope::testing(Uuid::new_v4(), Uuid::new_v4()).unwrap()
+}
+fn config(pins: u16, jobs: u8) -> ImageLeaseConfig {
+    ImageLeaseConfig::new(pins, jobs, Duration::from_secs(1)).unwrap()
+}
+fn metadata(parent: &str, platform: bool) -> Value {
+    let child = if parent == digest('a') {
+        digest('c')
+    } else {
+        digest('d')
+    };
+    json!({"Id":if platform {&child} else {parent},"Os":"linux","Architecture":"arm64","Size":64,
+        "Descriptor":{"mediaType":if platform {"application/vnd.oci.image.manifest.v1+json"} else {"application/vnd.oci.image.index.v1+json"},
+            "digest":if platform {&child} else {parent},"platform":{"os":"linux","architecture":"arm64"}},
+        "Config":{"Entrypoint":["/entry"],"Cmd":[if parent==digest('a') {"old_handler"} else {"new_handler"}],"Env":["SECRET=private_value"],"WorkingDir":"/task","User":"1000"}})
+}
+fn manifests(parent: &str, zero: bool) -> Value {
+    let mut value = metadata(parent, false);
+    let child = if parent == digest('a') {
+        digest('c')
+    } else {
+        digest('d')
+    };
+    value["Manifests"] = json!([{"ID":child,"Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":child,"platform":{"os":"linux","architecture":"arm64"}},
+        "Available":true,"Kind":"image","Size":{"Content":64,"Total":99999},
+        "ImageData":{"Containers":[],"Platform":{"os":"linux","architecture":"arm64"},"Size":{"Unpacked":if zero {0} else {4096}}}}]);
+    value
+}
+
+#[derive(Debug, Default)]
+pub(crate) struct Stats {
+    pub(crate) source_lookups: AtomicUsize,
+    pub(crate) immutable_lookups: AtomicUsize,
+    pub(crate) platform_lookups: AtomicUsize,
+    pub(crate) tags: AtomicUsize,
+    pub(crate) deletes: AtomicUsize,
+    pub(crate) absent: AtomicUsize,
+    pub(crate) aliases: AtomicUsize,
+    changed: Notify,
+}
+impl Stats {
+    pub(crate) async fn until(&self, condition: impl Fn() -> bool) {
+        timeout(Duration::from_secs(10), async {
+            loop {
+                let changed = self.changed.notified();
+                if condition() {
+                    break;
+                }
+                changed.await;
+            }
+        })
+        .await
+        .unwrap();
+    }
+    fn notify(&self) {
+        self.changed.notify_waiters();
+    }
+}
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum Mode {
+    Normal,
+    Reject400,
+    Reject404,
+    Lost,
+    PostCommit500,
+    Late,
+    Late500,
+    Never,
+    Wrong,
+    WrongRoot,
+    ZeroSize,
+    LostDelete,
+    HoldDelete,
+}
+pub(crate) enum Command {
+    Retarget,
+    Repair,
+    Commit,
+    AllowDeletes,
+}
+struct Pending {
+    alias: String,
+    parent: String,
+    at: Option<Instant>,
+    request: Option<IncomingRequest>,
+}
+
+#[derive(TypedBuilder)]
+struct Script {
+    daemon: Daemon,
+    mode: Mode,
+    stats: Arc<Stats>,
+    commands: mpsc::Receiver<Command>,
+    stop: watch::Receiver<bool>,
+    #[builder(default)]
+    aliases: HashMap<String, String>,
+    #[builder(default)]
+    expected: HashMap<String, String>,
+    #[builder(default)]
+    pending: Option<Pending>,
+    #[builder(default)]
+    retargeted: bool,
+    #[builder(default)]
+    allow_deletes: bool,
+}
+impl Script {
+    async fn run(mut self) {
+        loop {
+            let at = self.pending.as_ref().and_then(|pending| pending.at);
+            tokio::select! {
+                biased;
+                _ = self.stop.changed()=>break,
+                () = sleep_until(at.unwrap_or_else(Instant::now)),if at.is_some()=>self.commit(),
+                command=self.commands.recv()=>match command {Some(Command::Retarget)=>self.retargeted=true,Some(Command::Repair)=>self.aliases=self.expected.clone(),Some(Command::Commit)=>self.commit(),Some(Command::AllowDeletes)=>self.allow_deletes=true,None=>break},
+                request=self.daemon.requests.recv()=>match request {Some(request)=>self.request(request).await,None=>break},
+            }
+            self.stats
+                .aliases
+                .store(self.aliases.len(), Ordering::Release);
+            self.stats.notify();
+        }
+        assert_eq!(self.aliases.len(), 0, "fake daemon retains image aliases");
+        assert!(self.pending.is_none());
+        self.daemon.close().await;
+    }
+    fn commit(&mut self) {
+        if let Some(pending) = self.pending.take() {
+            self.aliases.insert(pending.alias, pending.parent);
+            drop(pending.request);
+        }
+    }
+    async fn tag(&mut self, request: IncomingRequest, image: &str, query: &str) {
+        assert!(image.ends_with("/tag"));
+        let parent = image.strip_suffix("/tag").unwrap().to_owned();
+        let fields: HashMap<_, _> = form_urlencoded::parse(query.as_bytes())
+            .into_owned()
+            .collect();
+        let alias = format!(
+            "{}:{}",
+            fields.get("repo").unwrap(),
+            fields.get("tag").unwrap()
+        );
+        assert!(alias.starts_with("rustack-internal/lambda-"));
+        self.stats.tags.fetch_add(1, Ordering::AcqRel);
+        self.expected.insert(alias.clone(), parent.clone());
+        match self.mode {
+            Mode::Reject400 => request.reply(400, b"{}").await,
+            Mode::Reject404 => request.reply(404, b"{}").await,
+            Mode::Late | Mode::Never => {
+                assert!(self.pending.is_none());
+                self.pending = Some(Pending {
+                    alias,
+                    parent,
+                    at: matches!(self.mode, Mode::Late)
+                        .then(|| Instant::now() + Duration::from_secs(2)),
+                    request: Some(request),
+                });
+            }
+            Mode::Late500 => {
+                assert!(self.pending.is_none());
+                self.pending = Some(Pending {
+                    alias,
+                    parent,
+                    at: Some(Instant::now() + Duration::from_secs(2)),
+                    request: None,
+                });
+                request.reply(500, b"{}").await;
+            }
+            _ => {
+                self.aliases.insert(
+                    alias,
+                    if matches!(self.mode, Mode::Wrong) {
+                        digest('b')
+                    } else {
+                        parent
+                    },
+                );
+                match self.mode {
+                    Mode::Lost => drop(request),
+                    Mode::PostCommit500 => request.reply(500, b"{}").await,
+                    _ => request.reply(201, b"").await,
+                }
+            }
+        }
+    }
+
+    async fn request(&mut self, request: IncomingRequest) {
+        let line = request.head.lines().next().unwrap().to_owned();
+        let fields: Vec<_> = line.split_whitespace().collect();
+        let method = fields.first().unwrap();
+        let target = fields.get(1).unwrap();
+        let (path, query) = target.split_once('?').unwrap_or((target, ""));
+        let path = percent_encoding::percent_decode_str(path)
+            .decode_utf8()
+            .unwrap()
+            .into_owned();
+        let image = path.strip_prefix("/v1.53/images/").unwrap();
+        if *method == "POST" {
+            self.tag(request, image, query).await;
+        } else if *method == "DELETE" {
+            assert_eq!(query, "force=false&noprune=true");
+            assert!(image.starts_with("rustack-internal/lambda-"));
+            self.stats.deletes.fetch_add(1, Ordering::AcqRel);
+            if matches!(self.mode, Mode::HoldDelete) && !self.allow_deletes {
+                request.reply(500, b"{}").await;
+                return;
+            }
+            let removed = self.aliases.remove(image);
+            assert!(removed.is_some());
+            if matches!(self.mode, Mode::LostDelete) {
+                drop(request);
+                return;
+            }
+            request
+                .reply(
+                    200,
+                    &serde_json::to_vec(&json!([{"Untagged":image}])).unwrap(),
+                )
+                .await;
+        } else {
+            assert_eq!(*method, "GET");
+            let reference = image.strip_suffix("/json").unwrap();
+            if reference == "worker:v1" {
+                self.stats.source_lookups.fetch_add(1, Ordering::AcqRel);
+            } else if (reference == digest('a') || reference == digest('b')) && query.is_empty() {
+                self.stats.immutable_lookups.fetch_add(1, Ordering::AcqRel);
+            }
+            if !query.is_empty() && query != "manifests=true" {
+                self.stats.platform_lookups.fetch_add(1, Ordering::AcqRel);
+            }
+            let parent = if reference == "worker:v1" {
+                Some(if self.retargeted {
+                    digest('b')
+                } else {
+                    digest('a')
+                })
+            } else if let Some(id) = self.aliases.get(reference) {
+                Some(id.clone())
+            } else if reference == digest('a') || reference == digest('b') {
+                let current = if self.retargeted {
+                    digest('b')
+                } else {
+                    digest('a')
+                };
+                (current == reference || self.aliases.values().any(|id| id == reference))
+                    .then(|| reference.to_owned())
+            } else {
+                None
+            };
+            if let Some(parent) = parent {
+                let parent = if matches!(self.mode, Mode::WrongRoot)
+                    && reference == digest('a')
+                    && query.is_empty()
+                {
+                    digest('b')
+                } else {
+                    parent
+                };
+                let value = if query == "manifests=true" {
+                    manifests(&parent, matches!(self.mode, Mode::ZeroSize))
+                } else {
+                    metadata(&parent, !query.is_empty())
+                };
+                request
+                    .reply(200, &serde_json::to_vec(&value).unwrap())
+                    .await;
+            } else {
+                self.stats.absent.fetch_add(1, Ordering::AcqRel);
+                request.reply(404, b"{}").await;
+            }
+        }
+    }
+}
+
+pub(crate) struct FakePins {
+    pub(crate) wire: DockerWire,
+    stop: watch::Sender<bool>,
+    pub(crate) commands: mpsc::Sender<Command>,
+    task: Option<JoinHandle<()>>,
+    pub(crate) stats: Arc<Stats>,
+    pub(crate) identity_status: watch::Sender<u16>,
+}
+impl FakePins {
+    pub(crate) async fn new(mode: Mode) -> Self {
+        let daemon = Daemon::new();
+        let identity_status = daemon.identity_status.clone();
+        let wire = daemon.wire().await;
+        let (stop, stopping) = watch::channel(false);
+        let (commands, receiver) = mpsc::channel(8);
+        let stats = Arc::new(Stats::default());
+        let script = Script::builder()
+            .daemon(daemon)
+            .mode(mode)
+            .stats(stats.clone())
+            .commands(receiver)
+            .stop(stopping)
+            .build();
+        Self {
+            wire,
+            identity_status,
+            stop,
+            commands,
+            task: Some(tokio::spawn(script.run())),
+            stats,
+        }
+    }
+    async fn saved(&self) -> ResolvedImage {
+        ImageResolver::new(self.wire.port())
+            .resolve_local(
+                &"worker:v1".parse().unwrap(),
+                Architecture::Arm64,
+                None,
+                deadline(),
+            )
+            .await
+            .unwrap()
+    }
+    pub(crate) fn owner(&self, pins: u16, jobs: u8) -> ImageLeaseManager {
+        ImageLeaseManager::start(self.wire.port(), scope(), config(pins, jobs)).unwrap()
+    }
+    pub(crate) async fn close(mut self) {
+        self.wire.shutdown().await.unwrap();
+        self.stop.send_replace(true);
+        self.task.take().unwrap().await.unwrap();
+    }
+}
+impl Drop for FakePins {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+
+#[tokio::test]
+async fn test_should_retain_the_directory_lock_through_abandoned_image_owner_cleanup() {
+    let fake = FakePins::new(Mode::HoldDelete).await;
+    let directory = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire(directory.path().into(), deadline())
+        .await
+        .unwrap();
+    let identity = lease.owner_id();
+    let owner = ImageLeaseManager::start(
+        fake.wire
+            .port()
+            .bind_directory(&lease, deadline())
+            .await
+            .unwrap(),
+        ImagePinScope::new(lease),
+        config(2, 1),
+    )
+    .unwrap();
+    let image = owner
+        .port()
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    drop(image);
+    fake.stats
+        .until(|| owner.port().status().quarantined > 0)
+        .await;
+    drop(owner);
+    assert!(matches!(
+        DirectoryLease::acquire(directory.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    fake.commands.send(Command::AllowDeletes).await.unwrap();
+    timeout(Duration::from_secs(10), async {
+        loop {
+            match DirectoryLease::acquire(directory.path().into(), deadline()).await {
+                Ok(lease) => {
+                    assert_eq!(lease.owner_id(), identity);
+                    break;
+                }
+                Err(DirectoryLeaseError::InUse) => {
+                    tokio::time::sleep(Duration::from_millis(5)).await;
+                }
+                other => panic!("unexpected lease result: {other:?}"),
+            }
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(fake.stats.aliases.load(Ordering::Acquire), 0);
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_pin_old_code_across_tag_retargeting_and_keep_cloned_artifacts_live() {
+    let fake = FakePins::new(Mode::Normal).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    let image = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    assert!(image.is_live());
+    assert_eq!(image.unpacked_size().get(), 4096);
+    assert_eq!(port.status().pins, 1);
+    assert!(!format!("{image:?}").contains("private_value"));
+    let mut observer = Box::pin(port.wait_empty(deadline()));
+    let mut context = Context::from_waker(Waker::noop());
+    assert!(observer.as_mut().poll(&mut context).is_pending());
+    assert_eq!(port.status().pins, 1);
+    fake.commands.send(Command::Retarget).await.unwrap();
+    let newer = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    drop(observer);
+    assert_eq!(image.resolved().metadata().image_id.as_str(), digest('a'));
+    assert_eq!(newer.resolved().metadata().image_id.as_str(), digest('b'));
+    assert_eq!(
+        image
+            .resolved()
+            .metadata()
+            .execution
+            .plan(None)
+            .unwrap()
+            .command(),
+        ["old_handler"]
+    );
+    let captured = image.clone();
+    drop(image);
+    drop(newer);
+    assert!(matches!(
+        port.wait_empty(Instant::now() + Duration::from_millis(50))
+            .await,
+        Err(DockerError::Deadline)
+    ));
+    assert!(captured.is_live());
+    drop(captured);
+    port.wait_empty(deadline()).await.unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 2);
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 2);
+    fake.close().await;
+}
+
+#[rstest::rstest]
+#[case(Mode::Reject400)]
+#[case(Mode::Reject404)]
+#[case(Mode::Lost)]
+#[case(Mode::PostCommit500)]
+#[case(Mode::ZeroSize)]
+#[tokio::test]
+async fn test_should_reconcile_rejected_and_lost_preparation_outcomes(#[case] mode: Mode) {
+    let fake = FakePins::new(mode).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    assert!(
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline()
+        )
+        .await
+        .is_err()
+    );
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(port.status().quarantined, 0);
+    assert!(port.status().accepting);
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(
+        fake.stats.deletes.load(Ordering::Acquire),
+        usize::from(!matches!(mode, Mode::Reject400 | Mode::Reject404))
+    );
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_retain_uncertain_tag_through_cancelled_waiter_and_initial_absence(
+    #[case] restoring: bool,
+) {
+    let fake = FakePins::new(Mode::Late).await;
+    let expected = fake.saved().await;
+    let mut owner = fake.owner(1, 1);
+    let port = owner.port();
+    let call = port.clone();
+    let caller = tokio::spawn(async move {
+        if restoring {
+            call.restore(&expected, None, deadline()).await
+        } else {
+            call.prepare(
+                &"worker:v1".parse().unwrap(),
+                Architecture::Arm64,
+                None,
+                deadline(),
+            )
+            .await
+        }
+    });
+    fake.stats
+        .until(|| fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    caller.abort();
+    assert!(caller.await.unwrap_err().is_cancelled());
+    fake.stats
+        .until(|| fake.stats.absent.load(Ordering::Acquire) > 0)
+        .await;
+    assert_eq!(port.status().pins, 1);
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 0);
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 1);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_bound_preparation_and_pin_admission_and_retain_shutdown_on_timeout(
+    #[case] restoring: bool,
+) {
+    let fake = FakePins::new(Mode::Never).await;
+    let saved = fake.saved().await;
+    let expected = saved.clone();
+    let mut owner = fake.owner(1, 1);
+    let port = owner.port();
+    let call = port.clone();
+    let caller = tokio::spawn(async move {
+        if restoring {
+            call.restore(&expected, None, deadline()).await
+        } else {
+            call.prepare(
+                &"worker:v1".parse().unwrap(),
+                Architecture::Arm64,
+                None,
+                deadline(),
+            )
+            .await
+        }
+    });
+    fake.stats
+        .until(|| fake.stats.tags.load(Ordering::Acquire) == 1)
+        .await;
+    assert!(matches!(
+        port.restore(&saved, None, deadline()).await,
+        Err(DockerError::Busy)
+    ));
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_millis(50))
+            .await,
+        Err(DockerError::Deadline)
+    ));
+    assert!(owner.task.is_some());
+    assert_eq!(port.status().pins, 1);
+    fake.commands.send(Command::Commit).await.unwrap();
+    assert!(caller.await.unwrap().is_err());
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(port.status().pins, 0);
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_quarantine_observed_alias_conflicts_until_exclusive_owner_repairs_them() {
+    let fake = FakePins::new(Mode::Wrong).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    assert!(
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline()
+        )
+        .await
+        .is_err()
+    );
+    fake.stats.until(|| port.status().quarantined > 0).await;
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 0);
+    assert!(matches!(
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline()
+        )
+        .await,
+        Err(DockerError::Quarantined)
+    ));
+    fake.commands.send(Command::Repair).await.unwrap();
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(port.status().quarantined, 0);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_join_after_a_shutdown_waiter_is_dropped_and_cache_root_failure() {
+    let fake = FakePins::new(Mode::Normal).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    let image = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    let mut shutdown = Box::pin(owner.shutdown(deadline()));
+    let mut context = Context::from_waker(Waker::noop());
+    assert!(shutdown.as_mut().poll(&mut context).is_pending());
+    drop(shutdown);
+    owner.shutdown(deadline()).await.unwrap();
+    assert!(!image.is_live());
+    drop(image);
+    fake.close().await;
+
+    let fake = FakePins::new(Mode::Normal).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    let image = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    owner.task.as_ref().unwrap().abort();
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    assert!(!image.is_live());
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    assert_eq!(port.status().pins, 0);
+    drop(image);
+    fake.close().await;
+}
+
+#[test]
+fn test_should_reject_invalid_pin_scope_and_preparation_configuration() {
+    assert!(ImagePinScope::testing(Uuid::nil(), Uuid::new_v4()).is_err());
+    let pin = scope().allocate().unwrap();
+    assert!(
+        pin.reference()
+            .as_str()
+            .starts_with("rustack-internal/lambda-")
+    );
+    for (pins, jobs, io) in [
+        (0, 1, Duration::from_secs(1)),
+        (8193, 1, Duration::from_secs(1)),
+        (1, 2, Duration::from_secs(1)),
+        (1, 1, Duration::from_nanos(1)),
+        (1, 1, Duration::from_secs(61)),
+    ] {
+        assert!(ImageLeaseConfig::new(pins, jobs, io).is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_retain_an_unaccepted_prepared_artifact_until_physical_retirement() {
+    let fake = FakePins::new(Mode::HoldDelete).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    let reference = "worker:v1".parse().unwrap();
+    let capacity = Arc::new(Semaphore::new(1));
+    let admission = Arc::new(capacity.clone().acquire_owned().await.unwrap());
+    let image = port
+        .prepare_deployment(&reference, Architecture::Arm64, None, deadline(), admission)
+        .await
+        .unwrap();
+    assert_eq!(capacity.available_permits(), 0);
+    assert_eq!(port.status().preparing, 1);
+    drop(image);
+    fake.stats
+        .until(|| fake.stats.deletes.load(Ordering::Acquire) > 0)
+        .await;
+    assert_eq!(capacity.available_permits(), 0);
+    assert_eq!(port.status().preparing, 1);
+    fake.commands.send(Command::AllowDeletes).await.unwrap();
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(capacity.available_permits(), 1);
+    assert_eq!(port.status().preparing, 0);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_report_root_failure_even_when_no_pin_has_started() {
+    let fake = FakePins::new(Mode::Normal).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    owner.task.as_ref().unwrap().abort();
+    timeout_at(deadline(), async {
+        while !owner.task.as_ref().unwrap().is_finished() {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(matches!(
+        port.wait_empty(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 0);
+    fake.close().await;
+}
+
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_recover_owned_aliases_after_worker_or_off_runtime_root_failure(
+    #[case] off_runtime: bool,
+) {
+    let fake = FakePins::new(Mode::HoldDelete).await;
+    let config = config(1, 1);
+    let pin = scope().allocate().unwrap();
+    let resolved = ImageResolver::new(fake.wire.port())
+        .resolve_local(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    let intent = ImageRecord::new(&pin, &resolved.metadata().image_id).unwrap();
+    pin.directory()
+        .prepare_image(intent.clone(), deadline())
+        .await
+        .unwrap();
+    fake.wire
+        .port()
+        .tag_image_pin(&resolved.metadata().image_id, &pin, deadline())
+        .await
+        .unwrap();
+    pin.directory()
+        .commit_image(intent, deadline())
+        .await
+        .unwrap();
+    let budget = Arc::new(PinBudget::new(1));
+    let permit = budget.acquire().unwrap();
+    let (control, stop) = watch::channel(false);
+    let (release, released) = watch::channel(());
+    let (phase, _) = watch::channel(Phase::Known(resolved.metadata().image_id.clone()));
+    let active = Arc::new(AtomicBool::new(true));
+    let progress = Arc::new(Progress {
+        phase,
+        released,
+        active: active.clone(),
+    });
+    let image = PinnedImage::new(resolved, 4096.try_into().unwrap(), release, active, stop);
+    let (sender, inbox) = mpsc::channel(32);
+    let health = Arc::new(Health::default());
+    let emergency = Arc::new(CleanupTask::default());
+    let id = pin.id;
+    let capacity = Arc::new(Semaphore::new(1));
+    let preparation = Arc::new(Semaphore::new(1));
+    let admission = PreparationAdmission::new(
+        preparation.clone().acquire_owned().await.unwrap(),
+        Some(Arc::new(capacity.clone().acquire_owned().await.unwrap())),
+    );
+    let mut jobs: JoinSet<PinJob> = JoinSet::new();
+    let job = jobs.spawn(async { panic!("controlled image worker failure") });
+    let actor = Actor::builder()
+        .docker(fake.wire.port())
+        .config(config)
+        .inbox(inbox)
+        .control(control)
+        .health(health.clone())
+        .runtime(Handle::current())
+        .emergency(emergency.clone())
+        .jobs(jobs)
+        .records(HashMap::from([(
+            id,
+            Record {
+                pin,
+                progress,
+                permit,
+                _admission: watch::channel(Some(admission)).0,
+            },
+        )]))
+        .index(HashMap::from([(job.id(), id)]))
+        .build();
+    let joined = if off_runtime {
+        let thread = std::thread::spawn(move || drop(actor));
+        timeout_at(
+            deadline(),
+            tokio::task::spawn_blocking(move || thread.join()),
+        )
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+        let emergency = emergency.clone();
+        tokio::spawn(async move { emergency.wait().await.map_err(|_| DockerError::Worker) })
+    } else {
+        tokio::spawn(actor.run())
+    };
+    fake.stats
+        .until(|| fake.stats.deletes.load(Ordering::Acquire) > 0)
+        .await;
+    assert_eq!(capacity.available_permits(), 0);
+    assert_eq!(preparation.available_permits(), 0);
+    fake.commands.send(Command::AllowDeletes).await.unwrap();
+    let result = timeout_at(deadline(), joined).await.unwrap().unwrap();
+    if off_runtime {
+        assert!(result.is_ok());
+    } else {
+        assert!(matches!(result, Err(DockerError::Worker)));
+    }
+    assert_eq!(capacity.available_permits(), 1);
+    assert_eq!(preparation.available_permits(), 1);
+    assert!(health.failed.load(Ordering::Acquire));
+    assert!(!image.is_live());
+    assert_eq!(budget.count.load(Ordering::Acquire), 0);
+    assert!(fake.stats.deletes.load(Ordering::Acquire) >= 2);
+    assert_eq!(fake.stats.aliases.load(Ordering::Acquire), 0);
+    emergency.wait().await.unwrap();
+    drop(sender);
+    drop(image);
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_a_late_nested_mutation_after_a_complete_http_500() {
+    let fake = FakePins::new(Mode::Late500).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    assert!(
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline()
+        )
+        .await
+        .is_err()
+    );
+    fake.stats
+        .until(|| fake.stats.absent.load(Ordering::Acquire) > 0)
+        .await;
+    assert_eq!(port.status().pins, 1);
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 0);
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 1);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_confirm_absence_after_an_acknowledged_tag_and_lost_delete_response() {
+    let fake = FakePins::new(Mode::LostDelete).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    let image = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    drop(image);
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 1);
+    assert_eq!(port.status().quarantined, 0);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_cleanup_capacity_and_shutdown_join_until_delete_recovers() {
+    let fake = FakePins::new(Mode::HoldDelete).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    let image = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    drop(image);
+    fake.stats.until(|| port.status().quarantined > 0).await;
+    assert_eq!(port.status().pins, 1);
+    assert!(matches!(
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline()
+        )
+        .await,
+        Err(DockerError::Quarantined)
+    ));
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_millis(50))
+            .await,
+        Err(DockerError::Deadline)
+    ));
+    assert!(owner.task.is_some());
+    fake.commands.send(Command::AllowDeletes).await.unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(port.status().pins, 0);
+    assert_eq!(port.status().quarantined, 0);
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 1);
+    assert!(fake.stats.deletes.load(Ordering::Acquire) >= 2);
+    fake.close().await;
+}
+
+#[path = "lease_tests/durable.rs"]
+mod durable;
+
+#[tokio::test]
+async fn test_should_reject_unqualified_platform_before_pin_or_wire_admission() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let mut images = ImageLeaseManager::start_qualified(
+        wire.port(),
+        scope(),
+        config(2, 1),
+        ImagePullPolicy::default(),
+        Architecture::Arm64,
+    )
+    .unwrap();
+    assert!(matches!(
+        images
+            .port()
+            .prepare(
+                &"worker:v1".parse().unwrap(),
+                Architecture::X86_64,
+                None,
+                deadline()
+            )
+            .await,
+        Err(DockerError::Configuration)
+    ));
+    assert!(matches!(
+        images
+            .port()
+            .restore(
+                &ResolvedImage::fixture(Architecture::X86_64),
+                None,
+                deadline()
+            )
+            .await,
+        Err(DockerError::Configuration)
+    ));
+    assert_eq!(images.port().status().pins, 0);
+    assert_eq!(images.port().status().preparing, 0);
+    images.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[path = "lease_tests/restore.rs"]
+mod restore;
diff --git a/crates/rustack-lambda-core/src/docker/lease_tests/durable.rs b/crates/rustack-lambda-core/src/docker/lease_tests/durable.rs
new file mode 100644
index 00000000..b0241fdc
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/lease_tests/durable.rs
@@ -0,0 +1,373 @@
+use std::os::unix::fs::symlink;
+
+use super::*;
+
+async fn resolve(daemon: &mut Daemon) {
+    daemon
+        .next()
+        .await
+        .reply(
+            200,
+            &serde_json::to_vec(&metadata(&digest('a'), false)).unwrap(),
+        )
+        .await;
+    daemon
+        .next()
+        .await
+        .reply(
+            200,
+            &serde_json::to_vec(&metadata(&digest('a'), true)).unwrap(),
+        )
+        .await;
+}
+async fn matching(daemon: &mut Daemon) {
+    daemon
+        .next()
+        .await
+        .reply(
+            200,
+            &serde_json::to_vec(&metadata(&digest('a'), false)).unwrap(),
+        )
+        .await;
+}
+
+#[tokio::test]
+async fn test_should_publish_intent_before_tag_and_commit_before_live_lease_or_delete() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let mut owner = ImageLeaseManager::start(
+        wire.port()
+            .bind_directory(&directory, deadline())
+            .await
+            .unwrap(),
+        ImagePinScope::new(directory.clone()),
+        config(1, 1),
+    )
+    .unwrap();
+    let port = owner.port();
+    let task = tokio::spawn(async move {
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+    });
+    resolve(&mut daemon).await;
+    let tag = daemon.next().await;
+    assert!(tag.head.starts_with("POST "));
+    let records = directory.image_records(deadline()).await.unwrap();
+    assert_eq!(records.len(), 1);
+    assert!(!records[0].committed);
+    tag.reply(201, b"").await;
+    let inspected = daemon.next().await;
+    assert!(directory.image_records(deadline()).await.unwrap()[0].committed);
+    inspected
+        .reply(
+            200,
+            &serde_json::to_vec(&metadata(&digest('a'), false)).unwrap(),
+        )
+        .await;
+    daemon
+        .next()
+        .await
+        .reply(
+            200,
+            &serde_json::to_vec(&manifests(&digest('a'), false)).unwrap(),
+        )
+        .await;
+    let image = task.await.unwrap().unwrap();
+    assert!(image.is_live());
+    drop(image);
+    matching(&mut daemon).await;
+    matching(&mut daemon).await;
+    let remove = daemon.next().await;
+    assert!(remove.head.starts_with("DELETE "));
+    assert!(directory.image_records(deadline()).await.unwrap()[0].committed);
+    remove.reply(200, b"[]").await;
+    daemon.next().await.reply(404, b"{}").await;
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(owner.port().status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_retain_pin_capacity_when_no_effect_record_cannot_be_erased() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let mut owner = ImageLeaseManager::start(
+        wire.port()
+            .bind_directory(&directory, deadline())
+            .await
+            .unwrap(),
+        ImagePinScope::new(directory.clone()),
+        config(1, 1),
+    )
+    .unwrap();
+    let port = owner.port();
+    let task = tokio::spawn(async move {
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+    });
+    resolve(&mut daemon).await;
+    let tag = daemon.next().await;
+    assert_eq!(directory.image_records(deadline()).await.unwrap().len(), 1);
+    let staging = root.path().join(".rustack-lambda-docker/pins.pending");
+    symlink(root.path().join("outside"), &staging).unwrap();
+    tag.reply(400, b"{}").await;
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(DockerError::Status(StatusCode::BAD_REQUEST))
+    ));
+    timeout(Duration::from_secs(2), async {
+        while owner.port().status().quarantined == 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(owner.port().status().pins, 1);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    tokio::fs::remove_file(staging).await.unwrap();
+    assert_eq!(directory.image_records(deadline()).await.unwrap().len(), 1);
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(owner.port().status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_acknowledgement_through_failed_commit_then_settle_absent_alias() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let mut owner = ImageLeaseManager::start(
+        wire.port()
+            .bind_directory(&directory, deadline())
+            .await
+            .unwrap(),
+        ImagePinScope::new(directory.clone()),
+        config(1, 1),
+    )
+    .unwrap();
+    let port = owner.port();
+    let task = tokio::spawn(async move {
+        port.prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+    });
+    resolve(&mut daemon).await;
+    let tag = daemon.next().await;
+    let staging = root.path().join(".rustack-lambda-docker/pins.pending");
+    symlink(root.path().join("outside"), &staging).unwrap();
+    tag.reply(201, b"").await;
+    assert!(matches!(
+        task.await.unwrap(),
+        Err(DockerError::Ownership(_) | DockerError::Quarantined)
+    ));
+    timeout(Duration::from_secs(2), async {
+        while owner.port().status().quarantined == 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(owner.port().status().pins, 1);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    tokio::fs::remove_file(&staging).await.unwrap();
+    let absent = timeout(Duration::from_secs(3), daemon.next())
+        .await
+        .unwrap();
+    assert!(
+        absent.head.starts_with("GET "),
+        "acknowledged tag was replayed"
+    );
+    assert!(
+        directory
+            .image_records(deadline())
+            .await
+            .unwrap()
+            .first()
+            .unwrap()
+            .committed
+    );
+    absent.reply(404, b"{}").await;
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(owner.port().status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_positive_inspection_through_failed_commit_and_retire_without_retagging()
+{
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+    let expected: Sha256Digest = digest('a').parse().unwrap();
+    directory
+        .prepare_image(ImageRecord::new(&pin, &expected).unwrap(), deadline())
+        .await
+        .unwrap();
+    let mut mutation = MutationGuard::new();
+    let receipt = mutation.receipt();
+    mutation.issued();
+    drop(mutation);
+    let (_release, released) = watch::channel(());
+    let progress = Arc::new(Progress {
+        phase: watch::channel(Phase::Uncertain(expected, receipt)).0,
+        released,
+        active: Arc::new(AtomicBool::new(false)),
+    });
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let worker = Worker::builder()
+        .docker(
+            wire.port()
+                .bind_directory(&directory, deadline())
+                .await
+                .unwrap(),
+        )
+        .config(config(1, 1))
+        .pin(pin)
+        .progress(progress.clone())
+        .control(watch::channel(false).0)
+        .health(Arc::new(Health::default()))
+        .cleanup(Arc::new(Semaphore::new(2)))
+        .build();
+    let staging = root.path().join(".rustack-lambda-docker/pins.pending");
+    symlink(root.path().join("outside"), &staging).unwrap();
+    let (clean, ()) = tokio::join!(worker.cleanup_step(), matching(&mut daemon));
+    assert!(!clean, "unsafe storage did not block durable commitment");
+    assert!(matches!(*progress.phase.borrow(), Phase::Committing(_)));
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    tokio::fs::remove_file(staging).await.unwrap();
+    tokio::join!(worker.retire(), async {
+        let absent = daemon.next().await;
+        assert!(
+            absent.head.starts_with("GET "),
+            "matching proof was replaced with a repeated mutation"
+        );
+        assert!(
+            directory
+                .image_records(deadline())
+                .await
+                .unwrap()
+                .first()
+                .unwrap()
+                .committed
+        );
+        absent.reply(404, b"{}").await;
+    });
+    assert!(matches!(*progress.phase.borrow(), Phase::Clean));
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_erase_preparing_or_definitely_unissued_intent_without_daemon_mutation(
+    #[case] receipt: bool,
+) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+    let expected: Sha256Digest = digest('a').parse().unwrap();
+    directory
+        .prepare_image(ImageRecord::new(&pin, &expected).unwrap(), deadline())
+        .await
+        .unwrap();
+    let mutation = MutationGuard::new();
+    let unissued = mutation.receipt();
+    drop(mutation);
+    let phase = if receipt {
+        Phase::Uncertain(expected, unissued)
+    } else {
+        Phase::Preparing(expected)
+    };
+    let (_release, released) = watch::channel(());
+    let progress = Arc::new(Progress {
+        phase: watch::channel(phase).0,
+        released,
+        active: Arc::new(AtomicBool::new(false)),
+    });
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    Worker::builder()
+        .docker(
+            wire.port()
+                .bind_directory(&directory, deadline())
+                .await
+                .unwrap(),
+        )
+        .config(config(1, 1))
+        .pin(pin)
+        .progress(progress.clone())
+        .control(watch::channel(false).0)
+        .health(Arc::new(Health::default()))
+        .cleanup(Arc::new(Semaphore::new(2)))
+        .build()
+        .retire()
+        .await;
+    assert!(matches!(*progress.phase.borrow(), Phase::Clean));
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/lease_tests/restore.rs b/crates/rustack-lambda-core/src/docker/lease_tests/restore.rs
new file mode 100644
index 00000000..9f752d72
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/lease_tests/restore.rs
@@ -0,0 +1,142 @@
+//! Immutable-content restoration must never become ordinary tag preparation.
+
+use super::*;
+use crate::artifact::{ImageExecutionMetadata, ImageMetadata};
+
+#[tokio::test]
+async fn test_should_restore_saved_metadata_without_following_a_retargeted_source() {
+    let fake = FakePins::new(Mode::Normal).await;
+    let mut owner = fake.owner(2, 1);
+    let port = owner.port();
+    let original = port
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    let serialized = serde_json::to_vec(original.resolved()).unwrap();
+    let saved: ResolvedImage = serde_json::from_slice(&serialized).unwrap();
+    fake.commands.send(Command::Retarget).await.unwrap();
+    let restored = port.restore(&saved, None, deadline()).await.unwrap();
+    drop(original);
+    assert_eq!(serde_json::to_vec(restored.resolved()).unwrap(), serialized);
+    assert_eq!(
+        restored.resolved().metadata().image_id.as_str(),
+        digest('a')
+    );
+    assert_eq!(
+        restored.resolved().code_sha256().unwrap(),
+        saved.code_sha256().unwrap()
+    );
+    assert_eq!(restored.unpacked_size().get(), 4096);
+    assert!(restored.is_live());
+    assert_eq!(fake.stats.source_lookups.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 2);
+    assert!(fake.stats.immutable_lookups.load(Ordering::Acquire) > 0);
+    drop(restored);
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 2);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_missing_saved_content_without_source_fallback_or_mutation() {
+    let fake = FakePins::new(Mode::Normal).await;
+    let saved = fake.saved().await;
+    let mut owner = fake.owner(1, 1);
+    let port = owner.port();
+    fake.commands.send(Command::Retarget).await.unwrap();
+    assert!(matches!(
+        port.restore(&saved, None, deadline()).await,
+        Err(DockerError::Status(StatusCode::NOT_FOUND))
+    ));
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(fake.stats.source_lookups.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.immutable_lookups.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 0);
+    assert_eq!(fake.stats.deletes.load(Ordering::Acquire), 0);
+    // A newer source is positively available, but cannot replace saved A.
+    let newer = fake.saved().await;
+    assert_eq!(newer.metadata().image_id.as_str(), digest('b'));
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[rstest::rstest]
+#[case::size(0)]
+#[case::defaults(1)]
+#[case::manifest(2)]
+#[case::architecture(3)]
+#[tokio::test]
+async fn test_should_compare_valid_saved_fingerprints_with_actual_metadata_before_tag(
+    #[case] field: u8,
+) {
+    let fake = FakePins::new(Mode::Normal).await;
+    let saved = fake.saved().await;
+    let mut changed: ImageMetadata = saved.clone().into();
+    match field {
+        0 => changed.size_bytes = 65,
+        1 => {
+            changed.execution = ImageExecutionMetadata::builder()
+                .entrypoint(vec!["/entry".into()])
+                .command(vec!["old_handler".into()])
+                .working_directory("/task".into())
+                .environment(vec!["SECRET=private_value".into()])
+                .user("1001".into())
+                .build()
+                .try_into()
+                .unwrap();
+        }
+        2 => changed.selected_manifest = Some(digest('e').parse().unwrap()),
+        3 => changed.architecture = Architecture::X86_64,
+        _ => unreachable!("fixed case table"),
+    }
+    changed.inspection_hash = ImageMetadata::execution_fingerprint(
+        &changed.image_id,
+        changed.selected_manifest.as_ref(),
+        changed.architecture,
+        changed.size_bytes,
+        &changed.execution,
+    )
+    .unwrap();
+    let changed: ResolvedImage = changed.try_into().unwrap();
+    let mut owner = fake.owner(1, 1);
+    let port = owner.port();
+    assert!(matches!(
+        port.restore(&changed, None, deadline()).await,
+        Err(DockerError::Image(ArtifactError::Inspection))
+    ));
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 0);
+    assert_eq!(fake.stats.source_lookups.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.immutable_lookups.load(Ordering::Acquire), 1);
+    let image = port.restore(&saved, None, deadline()).await.unwrap();
+    assert!(image.is_live());
+    drop(image);
+    port.wait_empty(deadline()).await.unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_a_different_root_id_before_platform_lookup_or_tag() {
+    let fake = FakePins::new(Mode::WrongRoot).await;
+    let saved = fake.saved().await;
+    let mut owner = fake.owner(1, 1);
+    let port = owner.port();
+    assert!(matches!(
+        port.restore(&saved, None, deadline()).await,
+        Err(DockerError::Image(ArtifactError::Inspection))
+    ));
+    port.wait_empty(deadline()).await.unwrap();
+    assert_eq!(fake.stats.source_lookups.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.immutable_lookups.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.platform_lookups.load(Ordering::Acquire), 1);
+    assert_eq!(fake.stats.tags.load(Ordering::Acquire), 0);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/logs.rs b/crates/rustack-lambda-core/src/docker/logs.rs
new file mode 100644
index 00000000..231f53b2
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/logs.rs
@@ -0,0 +1,530 @@
+//! Independent function output capture; socket reads never wait for a consumer.
+
+mod window;
+
+use std::{collections::VecDeque, fmt, time::Duration};
+
+use bytes::Bytes;
+use rustack_lambda_runtime::{diagnostics::runtime_dispatch, protocol::AttemptId};
+use tokio::{
+    io::AsyncRead,
+    runtime::Handle,
+    sync::{mpsc, oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use tracing::instrument::WithSubscriber;
+pub use window::LogWindow;
+use window::{ActiveWindow, PendingReceipt, ReceiptGuard, WindowKey, changed};
+
+use super::{
+    DockerAttachment, DockerError, DockerOutputReader, OutputChannel, OutputChunk, check_deadline,
+};
+
+const TAIL: usize = 4096;
+const SILENCE: Duration = Duration::from_secs(3600);
+
+/// Bounded binary API output and capture status; Debug never prints user bytes.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct LogSnapshot {
+    /// The final 4 KiB in observed stdout/stderr chunk order, without UTF-8 conversion.
+    pub tail: Bytes,
+    /// Old stdout bytes overwritten in its independent ring.
+    pub stdout_discarded: u64,
+    /// Old stderr bytes overwritten in its independent ring.
+    pub stderr_discarded: u64,
+    /// The attachment reached EOF; container exit remains independently owned.
+    pub closed: bool,
+    /// A retained framing/IO/deadline failure; joined shutdown preserves it.
+    pub failure: Option<DockerError>,
+}
+impl fmt::Debug for LogSnapshot {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("LogSnapshot")
+            .field("bytes", &self.tail.len())
+            .field("stdout_discarded", &self.stdout_discarded)
+            .field("stderr_discarded", &self.stderr_discarded)
+            .field("closed", &self.closed)
+            .field("failure", &self.failure)
+            .finish()
+    }
+}
+
+enum Action {
+    Snapshot,
+    Begin(ActiveWindow, PendingReceipt),
+    Finish(WindowKey, PendingReceipt),
+}
+struct Request {
+    action: Action,
+    deadline: Instant,
+    reply: oneshot::Sender<Result<LogSnapshot, DockerError>>,
+}
+
+/// Retained log actor; its environment owns the independent container lifetime.
+#[non_exhaustive]
+pub struct FunctionLogs {
+    requests: mpsc::Sender<Request>,
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<LogSnapshot, DockerError>>>,
+    settled: Option<Result<LogSnapshot, DockerError>>,
+    window_mutating: bool,
+}
+impl fmt::Debug for FunctionLogs {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("FunctionLogs")
+            .field("stopping", &*self.stop.borrow())
+            .field("settled", &self.settled)
+            .field("window_mutation_uncertain", &self.window_mutating)
+            .finish_non_exhaustive()
+    }
+}
+impl FunctionLogs {
+    /// Start output capture with a4KiB..1MiB ring for each channel.
+    ///
+    /// # Errors
+    /// Rejects invalid ring/record budgets, unavailable runtime or allocation.
+    ///
+    /// ```no_run
+    /// # fn start(attachment: rustack_lambda_core::docker::DockerAttachment) -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// let logs = rustack_lambda_core::docker::FunctionLogs::start(
+    ///     attachment, std::time::Duration::from_secs(5), 262_144)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn start(
+        attachment: DockerAttachment,
+        io_budget: Duration,
+        ring_bytes: usize,
+    ) -> Result<Self, DockerError> {
+        let reader = DockerOutputReader::new(attachment.0, io_budget)?;
+        Self::start_reader(reader, ring_bytes)
+    }
+
+    pub(super) fn start_reader<R: AsyncRead + Unpin + Send + 'static>(
+        reader: DockerOutputReader<R>,
+        ring_bytes: usize,
+    ) -> Result<Self, DockerError> {
+        let runtime = Handle::try_current().map_err(|_| DockerError::Worker)?;
+        if !(TAIL..=1024 * 1024).contains(&ring_bytes) {
+            return Err(DockerError::Configuration);
+        }
+        let state = Capture::new(ring_bytes)?;
+        let (requests, received) = mpsc::channel(8);
+        let (stop, stopped) = watch::channel(false);
+        let task = runtime
+            .spawn(capture(reader, state, received, stopped).with_subscriber(runtime_dispatch()));
+        Ok(Self {
+            requests,
+            stop,
+            task: Some(task),
+            settled: None,
+            window_mutating: false,
+        })
+    }
+
+    /// Read a bounded tail/status without interrupting a partial record.
+    ///
+    /// # Errors
+    /// Returns expired/invalid budget, full mailbox, stopped actor or worker failure.
+    ///
+    /// ```no_run
+    /// # async fn snapshot(logs: &rustack_lambda_core::docker::FunctionLogs) {
+    /// let snapshot = logs.snapshot(tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn snapshot(&self, deadline: Instant) -> Result<LogSnapshot, DockerError> {
+        check_deadline(deadline)?;
+        if let Some(result) = &self.settled {
+            return result.clone();
+        }
+        self.request(Action::Snapshot, deadline).await
+    }
+
+    /// Open an empty invocation window before sending its runtime event.
+    ///
+    /// # Errors
+    /// Returns expired/invalid budget, overload, overlapping/uncertain mutation,
+    /// stopped/closed capture or retained IO failure. An accepted mutation's
+    /// failure or cancellation forbids further window mutations; retire the owner.
+    ///
+    /// ```no_run
+    /// # async fn begin(logs: &mut rustack_lambda_core::docker::FunctionLogs) {
+    /// let window = logs.begin(Default::default(), tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn begin(
+        &mut self,
+        attempt: AttemptId,
+        deadline: Instant,
+    ) -> Result<LogWindow, DockerError> {
+        check_deadline(deadline)?;
+        if self.window_mutating {
+            return Err(DockerError::Stopped);
+        }
+        self.window_mutating = true;
+        let (window, active) = LogWindow::new(attempt);
+        let (mut receipt, pending) = ReceiptGuard::new(deadline);
+        self.request(Action::Begin(active, pending), deadline)
+            .await?;
+        receipt.consume(deadline)?;
+        self.window_mutating = false;
+        Ok(window)
+    }
+
+    /// Close exactly that window and return its bounded observed tail/status.
+    ///
+    /// # Errors
+    /// Returns budget/admission failure, foreign/stale capability, uncertain
+    /// mutation or retained capture failure. Caller cancellation requires owner
+    /// retirement. Environment diagnostic discard counters remain cumulative.
+    ///
+    /// ```no_run
+    /// # async fn finish(logs: &mut rustack_lambda_core::docker::FunctionLogs, window: rustack_lambda_core::docker::LogWindow) {
+    /// let tail = logs.finish(window, tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn finish(
+        &mut self,
+        mut window: LogWindow,
+        deadline: Instant,
+    ) -> Result<LogSnapshot, DockerError> {
+        check_deadline(deadline)?;
+        if self.window_mutating {
+            return Err(DockerError::Stopped);
+        }
+        self.window_mutating = true;
+        let (mut receipt, pending) = ReceiptGuard::new(deadline);
+        let snapshot = self
+            .request(Action::Finish(window.key, pending), deadline)
+            .await?;
+        receipt.consume(deadline)?;
+        window.complete();
+        self.window_mutating = false;
+        Ok(snapshot)
+    }
+
+    async fn request(&self, action: Action, deadline: Instant) -> Result<LogSnapshot, DockerError> {
+        check_deadline(deadline)?;
+        if *self.stop.borrow() {
+            return Err(DockerError::Stopped);
+        }
+        let (reply, response) = oneshot::channel();
+        self.requests
+            .try_send(Request {
+                action,
+                deadline,
+                reply,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => DockerError::Busy,
+                mpsc::error::TrySendError::Closed(_) => DockerError::Worker,
+            })?;
+        let result = timeout_at(deadline, response)
+            .await
+            .map_err(|_| DockerError::Deadline)?
+            .map_err(|_| DockerError::Worker)?;
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        result
+    }
+
+    /// Stop and join socket ownership, preserving failure across cancelled waiters.
+    ///
+    /// # Errors
+    /// Returns a retained parser/IO/deadline failure or failed actor join.
+    /// Container cleanup must be awaited separately by the environment owner.
+    ///
+    /// ```no_run
+    /// # async fn stop(logs: &mut rustack_lambda_core::docker::FunctionLogs) {
+    /// let final_tail = logs.shutdown().await;
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self) -> Result<LogSnapshot, DockerError> {
+        self.stop.send_replace(true);
+        if let Some(result) = &self.settled {
+            return result.clone();
+        }
+        let result = match &mut self.task {
+            Some(task) => task
+                .await
+                .map_err(|_| DockerError::Worker)
+                .and_then(|result| result),
+            None => Err(DockerError::Worker),
+        };
+        self.task.take();
+        self.settled = Some(result.clone());
+        result
+    }
+}
+impl Drop for FunctionLogs {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+
+struct Ring {
+    bytes: VecDeque<u8>,
+    capacity: usize,
+    discarded: u64,
+}
+impl Ring {
+    fn new(capacity: usize) -> Result<Self, DockerError> {
+        let mut bytes = VecDeque::new();
+        bytes
+            .try_reserve_exact(capacity)
+            .map_err(|_| DockerError::Allocation)?;
+        Ok(Self {
+            bytes,
+            capacity,
+            discarded: 0,
+        })
+    }
+    fn push(&mut self, bytes: &[u8]) -> Result<(), DockerError> {
+        let skipped = self
+            .bytes
+            .len()
+            .saturating_add(bytes.len())
+            .saturating_sub(self.capacity);
+        self.discarded = self
+            .discarded
+            .saturating_add(u64::try_from(skipped).map_err(|_| DockerError::TooLarge)?);
+        let remove = skipped.min(self.bytes.len());
+        self.bytes.drain(..remove);
+        let offset = bytes.len().saturating_sub(self.capacity);
+        self.bytes
+            .extend(bytes.get(offset..).ok_or(DockerError::Protocol)?);
+        Ok(())
+    }
+}
+struct Capture {
+    stdout: Ring,
+    stderr: Ring,
+    tail: Ring,
+    window_tail: Ring,
+    active: Option<ActiveWindow>,
+    receipt: Option<PendingReceipt>,
+    closed: bool,
+    failure: Option<DockerError>,
+}
+impl Capture {
+    fn new(capacity: usize) -> Result<Self, DockerError> {
+        Ok(Self {
+            stdout: Ring::new(capacity)?,
+            stderr: Ring::new(capacity)?,
+            tail: Ring::new(TAIL)?,
+            window_tail: Ring::new(TAIL)?,
+            active: None,
+            receipt: None,
+            closed: false,
+            failure: None,
+        })
+    }
+    fn push(&mut self, chunk: &OutputChunk) -> Result<(), DockerError> {
+        match chunk.channel {
+            OutputChannel::Stdout => self.stdout.push(&chunk.bytes)?,
+            OutputChannel::Stderr => self.stderr.push(&chunk.bytes)?,
+        }
+        self.tail.push(&chunk.bytes)?;
+        if self.active.is_some() {
+            self.window_tail.push(&chunk.bytes)?;
+        }
+        Ok(())
+    }
+    fn snapshot(&self) -> LogSnapshot {
+        self.snapshot_of(&self.tail)
+    }
+    fn window_snapshot(&self) -> LogSnapshot {
+        self.snapshot_of(&self.window_tail)
+    }
+    fn snapshot_of(&self, ring: &Ring) -> LogSnapshot {
+        LogSnapshot {
+            tail: Bytes::from(ring.bytes.iter().copied().collect::<Vec<_>>()),
+            stdout_discarded: self.stdout.discarded,
+            stderr_discarded: self.stderr.discarded,
+            closed: self.closed,
+            failure: self.failure.clone(),
+        }
+    }
+    fn fail_window(&mut self, error: DockerError) {
+        self.active = None;
+        self.receipt = None;
+        if self.failure.is_none() {
+            self.failure = Some(error);
+        }
+    }
+    fn reconcile(&mut self) -> bool {
+        if let Some(receipt) = &self.receipt {
+            match receipt.consumed() {
+                Ok(true) => {
+                    self.receipt = None;
+                }
+                Ok(false) => {}
+                Err(error) => {
+                    self.fail_window(error);
+                    return true;
+                }
+            }
+        }
+        if self
+            .active
+            .as_ref()
+            .is_some_and(|window| *window.revoked.borrow() || window.revoked.has_changed().is_err())
+        {
+            self.fail_window(DockerError::Protocol);
+            true
+        } else {
+            false
+        }
+    }
+    fn revocation(&self) -> Option<watch::Receiver<bool>> {
+        self.active.as_ref().map(|window| window.revoked.clone())
+    }
+    fn reply(&mut self, request: Request) {
+        self.reconcile();
+        if request.reply.is_closed() {
+            return;
+        }
+        let mut committed = false;
+        let result = if Instant::now() >= request.deadline {
+            Err(DockerError::Deadline)
+        } else {
+            match request.action {
+                Action::Snapshot => Ok(self.snapshot()),
+                _ if self.failure.is_some() => {
+                    Err(self.failure.clone().unwrap_or(DockerError::Worker))
+                }
+                _ if self.receipt.is_some() => Err(DockerError::Busy),
+                Action::Begin(_, _) if self.closed => Err(DockerError::Stopped),
+                Action::Begin(_, _) if self.active.is_some() => Err(DockerError::Busy),
+                Action::Begin(window, receipt) => {
+                    self.window_tail.bytes.clear();
+                    self.window_tail.discarded = 0;
+                    self.active = Some(window);
+                    self.receipt = Some(receipt);
+                    committed = true;
+                    Ok(self.window_snapshot())
+                }
+                Action::Finish(key, receipt)
+                    if self.active.as_ref().map(|window| window.key) == Some(key) =>
+                {
+                    self.active = None;
+                    self.receipt = Some(receipt);
+                    committed = true;
+                    Ok(self.window_snapshot())
+                }
+                Action::Finish(_, _) => Err(DockerError::Protocol),
+            }
+        };
+        if request.reply.send(result).is_err() && committed {
+            self.fail_window(DockerError::Protocol);
+        }
+    }
+}
+
+async fn capture<R: AsyncRead + Unpin>(
+    reader: DockerOutputReader<R>,
+    mut state: Capture,
+    mut requests: mpsc::Receiver<Request>,
+    mut stop: watch::Receiver<bool>,
+) -> Result<LogSnapshot, DockerError> {
+    let mut reader = Some(reader);
+    let mut quantum = 0_u8;
+    loop {
+        if *stop.borrow() {
+            break;
+        }
+        if state.reconcile() {
+            reader.take();
+        }
+        if state.closed || state.failure.is_some() {
+            let receipt = state.receipt.clone();
+            let revocation = state.revocation();
+            tokio::select! {
+                biased;
+                () = super::connection::stopped(&mut stop) => break,
+                () = changed(receipt, revocation) => { state.reconcile(); },
+                request = requests.recv() => match request { Some(request) => state.reply(request), None => break },
+            }
+            continue;
+        }
+        let result = match &mut reader {
+            Some(reader) => read_next(reader, &mut state, &mut requests, &mut stop).await,
+            None => return Err(DockerError::Worker),
+        };
+        match result {
+            None => break,
+            Some(Ok(None)) => state.closed = true,
+            Some(Err(error)) => state.failure = Some(error),
+            Some(Ok(Some(chunk))) => {
+                if let Err(error) = state.push(&chunk) {
+                    state.failure = Some(error);
+                }
+                quantum = quantum.saturating_add(1);
+                if quantum == 64 {
+                    tokio::task::yield_now().await;
+                    quantum = 0;
+                }
+            }
+        }
+        if state.closed || state.failure.is_some() {
+            reader.take();
+        }
+    }
+    drop(reader);
+    requests.close();
+    while let Ok(request) = requests.try_recv() {
+        if matches!(request.action, Action::Snapshot) {
+            state.reply(request);
+        } else {
+            let _ = request.reply.send(Err(DockerError::Stopped));
+        }
+    }
+    state.reconcile();
+    match state.failure.clone() {
+        Some(error) => Err(error),
+        None => Ok(state.snapshot()),
+    }
+}
+
+async fn read_next<R: AsyncRead + Unpin>(
+    reader: &mut DockerOutputReader<R>,
+    state: &mut Capture,
+    requests: &mut mpsc::Receiver<Request>,
+    stop: &mut watch::Receiver<bool>,
+) -> Option<Result<Option<OutputChunk>, DockerError>> {
+    // Requests retain this read; only stop or terminal capture failure drops it.
+    let next = reader.next(Instant::now() + SILENCE);
+    tokio::pin!(next);
+    loop {
+        if *stop.borrow() {
+            return None;
+        }
+        state.reconcile();
+        if let Some(error) = &state.failure {
+            return Some(Err(error.clone()));
+        }
+        if let Ok(request) = requests.try_recv() {
+            state.reply(request);
+        }
+        if let Some(error) = &state.failure {
+            return Some(Err(error.clone()));
+        }
+        let receipt = state.receipt.clone();
+        let revocation = state.revocation();
+        tokio::select! {
+            biased;
+            () = super::connection::stopped(stop) => return None,
+            () = changed(receipt, revocation) => { state.reconcile(); },
+            result = &mut next => return Some(result),
+            request = requests.recv() => match request { Some(request) => state.reply(request), None => return None },
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "logs_tests.rs"]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/logs/window.rs b/crates/rustack-lambda-core/src/docker/logs/window.rs
new file mode 100644
index 00000000..856336a5
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/logs/window.rs
@@ -0,0 +1,130 @@
+//! Window revocation and mutation consumption receipts; neither Drop claims IO joins.
+
+use std::future::pending;
+
+use rustack_lambda_runtime::protocol::AttemptId;
+use tokio::{
+    sync::watch,
+    time::{Instant, sleep_until},
+};
+use uuid::Uuid;
+
+use super::DockerError;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) struct WindowKey {
+    id: Uuid,
+    attempt: AttemptId,
+}
+impl WindowKey {
+    pub(super) fn new(attempt: AttemptId) -> Self {
+        Self {
+            id: Uuid::new_v4(),
+            attempt,
+        }
+    }
+}
+
+/// Opaque ownership of one invocation's observed log window; consume with finish.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct LogWindow {
+    pub(super) key: WindowKey,
+    revoke: watch::Sender<bool>,
+    complete: bool,
+}
+impl LogWindow {
+    pub(super) fn new(attempt: AttemptId) -> (Self, ActiveWindow) {
+        let key = WindowKey::new(attempt);
+        let (revoke, revoked) = watch::channel(false);
+        (
+            Self {
+                key,
+                revoke,
+                complete: false,
+            },
+            ActiveWindow { key, revoked },
+        )
+    }
+    pub(super) fn complete(&mut self) {
+        self.complete = true;
+    }
+}
+impl Drop for LogWindow {
+    fn drop(&mut self) {
+        if !self.complete {
+            self.revoke.send_replace(true);
+        }
+    }
+}
+pub(super) struct ActiveWindow {
+    pub(super) key: WindowKey,
+    pub(super) revoked: watch::Receiver<bool>,
+}
+
+#[derive(Clone, Copy)]
+enum ReceiptState {
+    Pending,
+    Consumed(Instant),
+    Revoked,
+}
+pub(super) struct ReceiptGuard {
+    sender: watch::Sender<ReceiptState>,
+    complete: bool,
+}
+#[derive(Clone)]
+pub(super) struct PendingReceipt {
+    receiver: watch::Receiver<ReceiptState>,
+    deadline: Instant,
+}
+impl ReceiptGuard {
+    pub(super) fn new(deadline: Instant) -> (Self, PendingReceipt) {
+        let (sender, receiver) = watch::channel(ReceiptState::Pending);
+        (
+            Self {
+                sender,
+                complete: false,
+            },
+            PendingReceipt { receiver, deadline },
+        )
+    }
+    pub(super) fn consume(&mut self, deadline: Instant) -> Result<(), DockerError> {
+        let consumed = Instant::now();
+        if consumed >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        self.sender.send_replace(ReceiptState::Consumed(consumed));
+        self.complete = true;
+        Ok(())
+    }
+}
+impl Drop for ReceiptGuard {
+    fn drop(&mut self) {
+        if !self.complete {
+            self.sender.send_replace(ReceiptState::Revoked);
+        }
+    }
+}
+impl PendingReceipt {
+    pub(super) fn consumed(&self) -> Result<bool, DockerError> {
+        match *self.receiver.borrow() {
+            ReceiptState::Consumed(at) if at < self.deadline => Ok(true),
+            ReceiptState::Consumed(_) => Err(DockerError::Deadline),
+            ReceiptState::Revoked => Err(DockerError::Protocol),
+            ReceiptState::Pending if Instant::now() >= self.deadline => Err(DockerError::Deadline),
+            ReceiptState::Pending if self.receiver.has_changed().is_err() => {
+                Err(DockerError::Protocol)
+            }
+            ReceiptState::Pending => Ok(false),
+        }
+    }
+}
+pub(super) async fn changed(
+    mut receipt: Option<PendingReceipt>,
+    mut revocation: Option<watch::Receiver<bool>>,
+) {
+    tokio::select! { biased;
+        ()=async {match &mut revocation { Some(receiver)=>{let _=receiver.wait_for(|revoked|*revoked).await;},None=>pending().await,}}=>{},
+        ()=async {match &mut receipt {Some(receipt)=>tokio::select! {biased;_=receipt.receiver.changed()=>{},()=sleep_until(receipt.deadline)=>{}},None=>pending().await,}}=>{},
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/logs_tests.rs b/crates/rustack-lambda-core/src/docker/logs_tests.rs
new file mode 100644
index 00000000..e33568e9
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/logs_tests.rs
@@ -0,0 +1,802 @@
+use std::{
+    future::Future,
+    pin::Pin,
+    task::{Context, Poll, Waker},
+};
+
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt, DuplexStream, ReadBuf, duplex},
+    time::{advance, timeout},
+};
+
+use super::*;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+fn logs(reader: DuplexStream) -> FunctionLogs {
+    FunctionLogs::start_reader(
+        DockerOutputReader::new(reader, Duration::from_secs(1)).unwrap(),
+        TAIL,
+    )
+    .unwrap()
+}
+fn record(channel: u8, bytes: &[u8]) -> Vec<u8> {
+    let mut frame = vec![channel, 0, 0, 0];
+    frame.extend_from_slice(&u32::try_from(bytes.len()).unwrap().to_be_bytes());
+    frame.extend_from_slice(bytes);
+    frame
+}
+async fn closed(logs: &FunctionLogs) -> LogSnapshot {
+    timeout(Duration::from_secs(5), async {
+        loop {
+            let snapshot = logs.snapshot(deadline()).await.unwrap();
+            if snapshot.closed || snapshot.failure.is_some() {
+                break snapshot;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap()
+}
+
+#[tokio::test]
+async fn test_should_capture_binary_channels_in_observed_order_and_retain_tail_after_eof() {
+    let (mut writer, reader) = duplex(1024);
+    let mut logs = logs(reader);
+    writer.write_all(&record(1, b"stdout\0\xff")).await.unwrap();
+    writer.write_all(&record(2, b"stderr\n")).await.unwrap();
+    writer.shutdown().await.unwrap();
+    let snapshot = closed(&logs).await;
+    assert_eq!(snapshot.tail.as_ref(), b"stdout\0\xffstderr\n");
+    assert_eq!(snapshot.stdout_discarded, 0);
+    assert_eq!(snapshot.stderr_discarded, 0);
+    assert!(snapshot.failure.is_none());
+    assert!(!format!("{snapshot:?} {logs:?}").contains("stdout\\0"));
+    assert!(!format!("{snapshot:?}").contains("stderr\\n"));
+    assert_eq!(logs.snapshot(deadline()).await.unwrap().tail, snapshot.tail);
+    assert_eq!(logs.shutdown().await.unwrap().tail, snapshot.tail);
+    assert_eq!(logs.shutdown().await.unwrap().tail, snapshot.tail);
+}
+
+#[tokio::test]
+async fn test_should_bound_independent_rings_and_saturate_discard_counts() {
+    let mut capture = Capture::new(TAIL).unwrap();
+    capture
+        .push(&OutputChunk {
+            channel: OutputChannel::Stdout,
+            bytes: Bytes::from(vec![1; TAIL + 17]),
+        })
+        .unwrap();
+    capture
+        .push(&OutputChunk {
+            channel: OutputChannel::Stderr,
+            bytes: Bytes::from(vec![2; TAIL + 9]),
+        })
+        .unwrap();
+    capture
+        .push(&OutputChunk {
+            channel: OutputChannel::Stdout,
+            bytes: Bytes::from_static(b"final"),
+        })
+        .unwrap();
+    assert_eq!(capture.stdout.bytes.len(), TAIL);
+    assert_eq!(capture.stderr.bytes.len(), TAIL);
+    assert_eq!(capture.stdout.discarded, 22);
+    assert_eq!(capture.stderr.discarded, 9);
+    let snapshot = capture.snapshot();
+    assert_eq!(snapshot.tail.len(), TAIL);
+    assert!(
+        snapshot
+            .tail
+            .get(..TAIL - 5)
+            .unwrap()
+            .iter()
+            .all(|byte| *byte == 2)
+    );
+    assert_eq!(snapshot.tail.get(TAIL - 5..), Some(b"final".as_slice()));
+    capture.stdout.discarded = u64::MAX - 1;
+    capture.stdout.push(b"more").unwrap();
+    assert_eq!(capture.stdout.discarded, u64::MAX);
+}
+
+#[rstest::rstest]
+#[case(0)]
+#[case(TAIL - 1)]
+#[case(1024 * 1024 + 1)]
+#[tokio::test]
+async fn test_should_reject_invalid_log_capacity(#[case] capacity: usize) {
+    let (_, reader) = duplex(1);
+    assert!(matches!(
+        FunctionLogs::start_reader(
+            DockerOutputReader::new(reader, Duration::from_secs(1)).unwrap(),
+            capacity
+        ),
+        Err(DockerError::Configuration)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_keep_a_fragmented_record_alive_through_cancelled_and_completed_snapshots() {
+    let (mut writer, reader) = duplex(1);
+    let mut logs = logs(reader);
+    let frame = record(1, b"secret-frame");
+    writer.write_all(frame.get(..4).unwrap()).await.unwrap();
+    for _ in 0..16 {
+        assert!(logs.snapshot(deadline()).await.unwrap().tail.is_empty());
+    }
+    {
+        let snapshot = logs.snapshot(deadline());
+        tokio::pin!(snapshot);
+        assert!(
+            snapshot
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+    }
+    writer.write_all(frame.get(4..).unwrap()).await.unwrap();
+    writer.shutdown().await.unwrap();
+    assert_eq!(closed(&logs).await.tail.as_ref(), b"secret-frame");
+    assert!(logs.shutdown().await.is_ok());
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_not_extend_the_partial_record_deadline_with_snapshot_traffic() {
+    let (mut writer, reader) = duplex(1);
+    let mut logs = logs(reader);
+    writer.write_all(&[1, 0, 0, 0]).await.unwrap();
+    for _ in 0..12 {
+        let _ = logs.snapshot(deadline()).await.unwrap();
+        advance(Duration::from_millis(100)).await;
+    }
+    let failed = logs.snapshot(deadline()).await.unwrap();
+    assert!(matches!(failed.failure, Some(DockerError::Deadline)));
+    assert!(matches!(logs.shutdown().await, Err(DockerError::Deadline)));
+    assert!(matches!(logs.shutdown().await, Err(DockerError::Deadline)));
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_bound_first_byte_silence_independently_of_snapshot_requests() {
+    let (_writer, reader) = duplex(1);
+    let mut logs = logs(reader);
+    logs.snapshot(deadline()).await.unwrap();
+    advance(SILENCE + Duration::from_secs(1)).await;
+    assert!(matches!(
+        logs.snapshot(deadline()).await.unwrap().failure,
+        Some(DockerError::Deadline)
+    ));
+    assert!(matches!(logs.shutdown().await, Err(DockerError::Deadline)));
+}
+
+#[tokio::test]
+async fn test_should_retain_shutdown_ownership_after_its_waiter_is_cancelled() {
+    let (mut writer, reader) = duplex(1);
+    let mut logs = logs(reader);
+    {
+        let shutdown = logs.shutdown();
+        tokio::pin!(shutdown);
+        assert!(
+            shutdown
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+    }
+    assert!(
+        timeout(Duration::from_secs(1), logs.shutdown())
+            .await
+            .unwrap()
+            .is_ok()
+    );
+    assert!(writer.write_all(b"x").await.is_err());
+}
+
+#[tokio::test]
+async fn test_should_signal_quiet_socket_cleanup_on_drop_outside_an_entered_runtime() {
+    let (mut writer, reader) = duplex(1);
+    let logs = logs(reader);
+    let thread = std::thread::spawn(move || {
+        assert!(Handle::try_current().is_err());
+        drop(logs);
+    });
+    let task = tokio::task::spawn_blocking(move || thread.join().unwrap());
+    timeout(Duration::from_secs(1), task)
+        .await
+        .unwrap()
+        .unwrap();
+    let mut byte = [0];
+    assert_eq!(
+        timeout(Duration::from_secs(1), writer.read(&mut byte))
+            .await
+            .unwrap()
+            .unwrap(),
+        0
+    );
+}
+
+#[tokio::test]
+async fn test_should_serve_snapshots_and_stop_while_output_floods() {
+    let (mut writer, reader) = duplex(64 * 1024);
+    let mut logs = logs(reader);
+    let producer = tokio::spawn(async move {
+        let frame = record(1, &vec![b'x'; 16 * 1024]);
+        while writer.write_all(&frame).await.is_ok() {
+            tokio::task::yield_now().await;
+        }
+    });
+    timeout(Duration::from_secs(5), async {
+        loop {
+            let snapshot = logs.snapshot(deadline()).await.unwrap();
+            assert!(snapshot.tail.len() <= TAIL);
+            if snapshot.stdout_discarded > 64 * 1024 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(
+        timeout(Duration::from_secs(1), logs.shutdown())
+            .await
+            .unwrap()
+            .is_ok()
+    );
+    timeout(Duration::from_secs(1), producer)
+        .await
+        .unwrap()
+        .unwrap();
+}
+
+#[rstest::rstest]
+#[case::bad_channel(vec![3, 0, 0, 0, 0, 0, 0, 0])]
+#[case::reserved(vec![1, 1, 0, 0, 0, 0, 0, 0])]
+#[case::truncated_header(vec![1, 0])]
+#[case::truncated_payload(vec![1, 0, 0, 0, 0, 0, 0, 2, 1])]
+#[tokio::test]
+async fn test_should_preserve_malformed_stream_failure_through_shutdown(#[case] frame: Vec<u8>) {
+    let (mut writer, reader) = duplex(64);
+    let mut logs = logs(reader);
+    writer.write_all(&frame).await.unwrap();
+    writer.shutdown().await.unwrap();
+    assert!(closed(&logs).await.failure.is_some());
+    let mut byte = [0];
+    assert_eq!(
+        timeout(Duration::from_secs(1), writer.read(&mut byte))
+            .await
+            .unwrap()
+            .unwrap(),
+        0
+    );
+    assert!(logs.shutdown().await.is_err());
+    assert!(logs.shutdown().await.is_err());
+}
+
+struct Panics;
+impl AsyncRead for Panics {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        _: &mut Context<'_>,
+        _: &mut ReadBuf<'_>,
+    ) -> Poll<std::io::Result<()>> {
+        panic!("log worker failure")
+    }
+}
+#[tokio::test]
+async fn test_should_cache_log_actor_join_failure() {
+    let mut logs = FunctionLogs::start_reader(
+        DockerOutputReader::new(Panics, Duration::from_secs(1)).unwrap(),
+        TAIL,
+    )
+    .unwrap();
+    while !logs.task.as_ref().unwrap().is_finished() {
+        tokio::task::yield_now().await;
+    }
+    assert!(matches!(
+        logs.snapshot(deadline()).await,
+        Err(DockerError::Worker)
+    ));
+    assert!(matches!(logs.shutdown().await, Err(DockerError::Worker)));
+    assert!(matches!(logs.shutdown().await, Err(DockerError::Worker)));
+}
+
+#[tokio::test]
+async fn test_should_bound_snapshot_admission_and_discard_abandoned_requests() {
+    let (_writer, reader) = duplex(1);
+    let mut logs = logs(reader);
+    {
+        let mut requests = Vec::new();
+        for _ in 0..8 {
+            let mut request = Box::pin(logs.snapshot(deadline()));
+            assert!(
+                request
+                    .as_mut()
+                    .poll(&mut Context::from_waker(Waker::noop()))
+                    .is_pending()
+            );
+            requests.push(request);
+        }
+        assert!(matches!(
+            logs.snapshot(deadline()).await,
+            Err(DockerError::Busy)
+        ));
+        drop(requests);
+    }
+    assert!(
+        timeout(Duration::from_secs(1), logs.shutdown())
+            .await
+            .unwrap()
+            .is_ok()
+    );
+}
+
+#[tokio::test]
+async fn test_should_use_output_only_attach_without_replay_and_transfer_driver_ownership() {
+    let mut daemon = super::super::tests::Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let attach = tokio::spawn(async move {
+        port.attach_logs(&"function".parse().unwrap(), deadline())
+            .await
+    });
+    let request = daemon.next().await;
+    assert!(request.head.starts_with(
+        "POST /v1.53/containers/function/attach?stdin=false&stdout=true&stderr=true&stream=true&\
+         logs=false HTTP/1.1\r\n"
+    ));
+    let mut reply =
+        b"HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: tcp\r\n\r\n".to_vec();
+    reply.extend_from_slice(&record(2, b"wire-secret-output"));
+    request.raw(&reply).await;
+    let mut logs =
+        FunctionLogs::start(attach.await.unwrap().unwrap(), Duration::from_secs(1), TAIL).unwrap();
+    wire.shutdown().await.unwrap();
+    assert_eq!(closed(&logs).await.tail.as_ref(), b"wire-secret-output");
+    assert!(logs.shutdown().await.is_ok());
+    daemon.close().await;
+}
+
+async fn observed(logs: &FunctionLogs, suffix: &[u8]) {
+    timeout(Duration::from_secs(3), async {
+        while !logs
+            .snapshot(deadline())
+            .await
+            .unwrap()
+            .tail
+            .ends_with(suffix)
+        {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+async fn probe(sender: &mpsc::Sender<Request>) -> LogSnapshot {
+    let (reply, response) = oneshot::channel();
+    sender
+        .try_send(Request {
+            action: Action::Snapshot,
+            deadline: deadline(),
+            reply,
+        })
+        .unwrap_or_else(|_| panic!("test probe admission"));
+    timeout(Duration::from_secs(3), response)
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap()
+}
+#[tokio::test]
+async fn test_should_keep_diagnostics_separate_and_never_seed_a_silent_invocation_with_prior_logs()
+{
+    let (mut writer, reader) = duplex(8192);
+    let mut logs = logs(reader);
+    writer.write_all(&record(1, b"idle-before")).await.unwrap();
+    observed(&logs, b"idle-before").await;
+    let first = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    writer.write_all(&record(1, b"first\0\xff")).await.unwrap();
+    writer.write_all(&record(2, b"stderr")).await.unwrap();
+    observed(&logs, b"stderr").await;
+    let first = logs.finish(first, deadline()).await.unwrap();
+    assert_eq!(first.tail.as_ref(), b"first\0\xffstderr");
+    writer.write_all(&record(2, b"idle-after")).await.unwrap();
+    observed(&logs, b"idle-after").await;
+    let silent = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    assert!(
+        logs.finish(silent, deadline())
+            .await
+            .unwrap()
+            .tail
+            .is_empty()
+    );
+    let third = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    writer.write_all(&record(1, b"third")).await.unwrap();
+    observed(&logs, b"third").await;
+    assert_eq!(
+        logs.finish(third, deadline()).await.unwrap().tail.as_ref(),
+        b"third"
+    );
+    assert!(
+        logs.snapshot(deadline())
+            .await
+            .unwrap()
+            .tail
+            .starts_with(b"idle-before")
+    );
+    logs.shutdown().await.unwrap();
+}
+#[tokio::test]
+async fn test_should_bound_binary_window_tail_and_allow_matching_finish_after_clean_eof() {
+    let (mut writer, reader) = duplex(16384);
+    let mut logs = logs(reader);
+    let window = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    writer
+        .write_all(&record(1, &vec![0xff; TAIL + 17]))
+        .await
+        .unwrap();
+    writer.write_all(&record(2, b"end\0")).await.unwrap();
+    writer.shutdown().await.unwrap();
+    let diagnostic = closed(&logs).await;
+    let finished = logs.finish(window, deadline()).await.unwrap();
+    assert_eq!(finished.tail.len(), TAIL);
+    assert_eq!(finished.tail, diagnostic.tail);
+    assert!(finished.tail.ends_with(b"end\0"));
+    assert_eq!(finished.stdout_discarded, 17);
+    assert!(finished.closed);
+    assert!(!format!("{finished:?}").contains("end\\0"));
+    assert!(matches!(
+        logs.begin(AttemptId::default(), deadline()).await,
+        Err(DockerError::Stopped)
+    ));
+    logs.shutdown().await.unwrap();
+}
+#[tokio::test]
+async fn test_should_revoke_capture_and_close_its_quiet_socket_when_an_open_capability_is_dropped()
+{
+    let (mut writer, reader) = duplex(8);
+    let mut logs = logs(reader);
+    let window = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    drop(window);
+    assert_eq!(
+        timeout(Duration::from_secs(1), writer.read(&mut [0]))
+            .await
+            .unwrap()
+            .unwrap(),
+        0
+    );
+    assert!(matches!(
+        closed(&logs).await.failure,
+        Some(DockerError::Protocol)
+    ));
+    assert!(logs.begin(AttemptId::default(), deadline()).await.is_err());
+    assert!(logs.shutdown().await.is_err());
+    assert!(logs.shutdown().await.is_err());
+}
+#[tokio::test]
+async fn test_should_reject_cross_owner_capabilities_and_revoke_the_originating_window() {
+    let (_first_writer, first_reader) = duplex(8);
+    let (_second_writer, second_reader) = duplex(8);
+    let mut first = logs(first_reader);
+    let mut second = logs(second_reader);
+    let attempt = AttemptId::default();
+    let foreign = first.begin(attempt, deadline()).await.unwrap();
+    let own = second.begin(attempt, deadline()).await.unwrap();
+    assert!(matches!(
+        second.finish(foreign, deadline()).await,
+        Err(DockerError::Protocol)
+    ));
+    assert!(matches!(
+        closed(&first).await.failure,
+        Some(DockerError::Protocol)
+    ));
+    assert!(matches!(
+        second.begin(AttemptId::default(), deadline()).await,
+        Err(DockerError::Stopped)
+    ));
+    drop(own);
+    assert!(closed(&second).await.failure.is_some());
+    assert!(first.shutdown().await.is_err());
+    assert!(second.shutdown().await.is_err());
+}
+#[tokio::test]
+async fn test_should_reject_a_stale_finish_without_closing_the_current_window() {
+    let (_writer, reader) = duplex(8);
+    let mut logs = logs(reader);
+    let old = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    let key = old.key;
+    logs.finish(old, deadline()).await.unwrap();
+    let current = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    let (_guard, receipt) = ReceiptGuard::new(deadline());
+    assert!(matches!(
+        logs.request(Action::Finish(key, receipt), deadline()).await,
+        Err(DockerError::Protocol)
+    ));
+    assert!(
+        logs.finish(current, deadline())
+            .await
+            .unwrap()
+            .tail
+            .is_empty()
+    );
+    logs.shutdown().await.unwrap();
+}
+#[tokio::test]
+async fn test_should_poison_window_mutation_after_an_overlapping_begin() {
+    let (_writer, reader) = duplex(8);
+    let mut logs = logs(reader);
+    let first = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    assert!(matches!(
+        logs.begin(AttemptId::default(), deadline()).await,
+        Err(DockerError::Busy)
+    ));
+    assert!(matches!(
+        logs.finish(first, deadline()).await,
+        Err(DockerError::Stopped)
+    ));
+    assert!(closed(&logs).await.failure.is_some());
+    assert!(logs.shutdown().await.is_err());
+}
+#[tokio::test]
+async fn test_should_preserve_partial_record_io_across_begin_and_finish_commands() {
+    let (mut writer, reader) = duplex(1);
+    let mut logs = logs(reader);
+    let frame = record(1, b"fragmented");
+    writer.write_all(frame.get(..4).unwrap()).await.unwrap();
+    let first = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    assert!(
+        logs.finish(first, deadline())
+            .await
+            .unwrap()
+            .tail
+            .is_empty()
+    );
+    let second = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    writer.write_all(frame.get(4..).unwrap()).await.unwrap();
+    writer.shutdown().await.unwrap();
+    closed(&logs).await;
+    assert_eq!(
+        logs.finish(second, deadline()).await.unwrap().tail.as_ref(),
+        b"fragmented"
+    );
+    logs.shutdown().await.unwrap();
+}
+#[rstest::rstest]
+#[case::begin(false)]
+#[case::finish(true)]
+#[tokio::test]
+async fn test_should_retire_a_mutation_whose_ready_reply_is_abandoned(#[case] finishing: bool) {
+    let (mut writer, reader) = duplex(8);
+    let mut logs = logs(reader);
+    let sender = logs.requests.clone();
+    let window = if finishing {
+        Some(logs.begin(AttemptId::default(), deadline()).await.unwrap())
+    } else {
+        None
+    };
+    if let Some(window) = window {
+        let mut finish = Box::pin(logs.finish(window, deadline()));
+        assert!(
+            finish
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+        probe(&sender).await;
+        drop(finish);
+    } else {
+        let mut begin = Box::pin(logs.begin(AttemptId::default(), deadline()));
+        assert!(
+            begin
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+        probe(&sender).await;
+        drop(begin);
+    }
+    assert_eq!(
+        timeout(Duration::from_secs(1), writer.read(&mut [0]))
+            .await
+            .unwrap()
+            .unwrap(),
+        0
+    );
+    assert!(closed(&logs).await.failure.is_some());
+    assert!(matches!(
+        logs.begin(AttemptId::default(), deadline()).await,
+        Err(DockerError::Stopped)
+    ));
+    assert!(logs.shutdown().await.is_err());
+}
+#[rstest::rstest]
+#[case::begin(false)]
+#[case::finish(true)]
+#[tokio::test(start_paused = true)]
+async fn test_should_expire_a_ready_mutation_receipt_while_its_public_future_remains_unpolled(
+    #[case] finishing: bool,
+) {
+    let (mut writer, reader) = duplex(8);
+    let mut logs = logs(reader);
+    let sender = logs.requests.clone();
+    let until = Instant::now() + Duration::from_secs(1);
+    let window = if finishing {
+        Some(logs.begin(AttemptId::default(), deadline()).await.unwrap())
+    } else {
+        None
+    };
+    if let Some(window) = window {
+        let mut finish = Box::pin(logs.finish(window, until));
+        assert!(
+            finish
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+        probe(&sender).await;
+        advance(Duration::from_secs(1)).await;
+        assert_eq!(
+            timeout(Duration::from_secs(1), writer.read(&mut [0]))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+        assert!(probe(&sender).await.failure.is_some());
+        assert!(matches!(finish.await, Err(DockerError::Deadline)));
+    } else {
+        let mut begin = Box::pin(logs.begin(AttemptId::default(), until));
+        assert!(
+            begin
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+        probe(&sender).await;
+        advance(Duration::from_secs(1)).await;
+        assert_eq!(
+            timeout(Duration::from_secs(1), writer.read(&mut [0]))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+        assert!(probe(&sender).await.failure.is_some());
+        assert!(matches!(begin.await, Err(DockerError::Deadline)));
+    }
+    assert!(matches!(
+        logs.begin(AttemptId::default(), deadline()).await,
+        Err(DockerError::Stopped)
+    ));
+    assert!(logs.shutdown().await.is_err());
+}
+#[tokio::test]
+async fn test_should_retain_capture_failure_when_finishing_an_active_window() {
+    let (mut writer, reader) = duplex(8);
+    let mut logs = logs(reader);
+    let window = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+    writer.write_all(&[3, 0, 0, 0, 0, 0, 0, 0]).await.unwrap();
+    assert!(closed(&logs).await.failure.is_some());
+    assert!(matches!(
+        logs.finish(window, deadline()).await,
+        Err(DockerError::Protocol)
+    ));
+    assert!(logs.shutdown().await.is_err());
+    assert!(logs.shutdown().await.is_err());
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_preserve_an_on_time_consumption_receipt_processed_after_its_deadline() {
+    let mut state = Capture::new(TAIL).unwrap();
+    let (window, active) = LogWindow::new(AttemptId::default());
+    let until = Instant::now() + Duration::from_secs(1);
+    let (mut guard, receipt) = ReceiptGuard::new(until);
+    let (reply, response) = oneshot::channel();
+    state.reply(Request {
+        action: Action::Begin(active, receipt),
+        deadline: until,
+        reply,
+    });
+    response.await.unwrap().unwrap();
+    guard.consume(until).unwrap();
+    advance(Duration::from_secs(2)).await;
+    assert!(!state.reconcile());
+    assert!(state.failure.is_none());
+    assert!(state.active.is_some());
+    drop(window);
+    assert!(state.reconcile());
+}
+#[rstest::rstest]
+#[case::expired(false)]
+#[case::abandoned(true)]
+#[tokio::test]
+async fn test_should_reject_unissued_window_requests_without_mutating_capture(
+    #[case] abandoned: bool,
+) {
+    let mut state = Capture::new(TAIL).unwrap();
+    let (window, active) = LogWindow::new(AttemptId::default());
+    let until = if abandoned {
+        deadline()
+    } else {
+        Instant::now()
+    };
+    let (_guard, receipt) = ReceiptGuard::new(until);
+    let (reply, response) = oneshot::channel();
+    let response = if abandoned {
+        drop(response);
+        None
+    } else {
+        Some(response)
+    };
+    state.reply(Request {
+        action: Action::Begin(active, receipt),
+        deadline: until,
+        reply,
+    });
+    if let Some(response) = response {
+        assert!(matches!(
+            response.await.unwrap(),
+            Err(DockerError::Deadline)
+        ));
+    }
+    assert!(state.active.is_none());
+    assert!(state.receipt.is_none());
+    assert!(state.failure.is_none());
+    drop(window);
+}
+#[rstest::rstest]
+#[case::begin(false)]
+#[case::finish(true)]
+#[tokio::test]
+async fn test_should_reject_queued_mutations_when_priority_shutdown_wins(#[case] finishing: bool) {
+    let (_writer, reader) = duplex(8);
+    let mut logs = logs(reader);
+    let (window, active) = LogWindow::new(AttemptId::default());
+    let own = if finishing {
+        Some(logs.begin(AttemptId::default(), deadline()).await.unwrap())
+    } else {
+        None
+    };
+    let (_guard, receipt) = ReceiptGuard::new(deadline());
+    let action = if let Some(own) = &own {
+        Action::Finish(own.key, receipt)
+    } else {
+        Action::Begin(active, receipt)
+    };
+    let (reply, response) = oneshot::channel();
+    logs.requests
+        .try_send(Request {
+            action,
+            deadline: deadline(),
+            reply,
+        })
+        .unwrap_or_else(|_| panic!("test mutation admission"));
+    logs.shutdown().await.unwrap();
+    assert!(matches!(response.await.unwrap(), Err(DockerError::Stopped)));
+    drop((window, own));
+}
+#[tokio::test]
+async fn test_should_serve_bounded_window_commands_without_starving_flooded_output_or_shutdown() {
+    let (mut writer, reader) = duplex(64 * 1024);
+    let mut logs = logs(reader);
+    let producer = tokio::spawn(async move {
+        let frame = record(1, &vec![b'x'; 16384]);
+        while writer.write_all(&frame).await.is_ok() {
+            tokio::task::yield_now().await;
+        }
+    });
+    for _ in 0..16 {
+        let window = logs.begin(AttemptId::default(), deadline()).await.unwrap();
+        let tail = logs.finish(window, deadline()).await.unwrap();
+        assert!(tail.tail.len() <= TAIL);
+    }
+    timeout(Duration::from_secs(1), logs.shutdown())
+        .await
+        .unwrap()
+        .unwrap();
+    timeout(Duration::from_secs(1), producer)
+        .await
+        .unwrap()
+        .unwrap();
+}
diff --git a/crates/rustack-lambda-core/src/docker/mod.rs b/crates/rustack-lambda-core/src/docker/mod.rs
new file mode 100644
index 00000000..ed1450b5
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/mod.rs
@@ -0,0 +1,1173 @@
+//! Bounded local Docker wire service and strict attach framing.
+//!
+//! This layer owns HTTP connections, not container policy or lifetime. Callers
+//! retain preallocated identities and reservations through reconciliation.
+
+mod binding;
+mod code;
+mod code_volume;
+mod config;
+mod connection;
+mod environment;
+mod executor;
+mod framing;
+mod image;
+mod lease;
+mod logs;
+mod mutation;
+mod network;
+mod ownership;
+mod pin;
+mod plan;
+mod pool;
+mod probe;
+mod pull;
+mod recovery;
+mod sdk;
+mod startup;
+mod types;
+mod volumes;
+mod zip;
+
+use std::{
+    collections::BTreeMap,
+    fmt,
+    io::{self, Write},
+    mem,
+    path::PathBuf,
+    sync::Arc,
+    time::Duration,
+};
+
+/// Generated Docker model contracts, without the upstream network client.
+pub use bollard_stubs::models;
+use bytes::Bytes;
+pub use code::DockerCodeArchive;
+pub use code_volume::{
+    CodePreparation, CodeRetirement, CodeVolumeConfig, CodeVolumeIdentity, CodeVolumeManager,
+    CodeVolumePort, CodeVolumeStatus, PinnedCode,
+};
+pub use config::{
+    DockerGatewayEndpoint, DockerRuntimeSettings, RegistryAuthError, RegistryAuthFile,
+};
+use connection::exchange;
+pub use environment::{
+    EnvironmentCapacity, EnvironmentConfig, EnvironmentError, EnvironmentHandle,
+    EnvironmentManager, EnvironmentPhase, EnvironmentPort, EnvironmentResponse,
+    EnvironmentSettings, EnvironmentStatus,
+};
+pub use executor::{
+    DockerExecutor, DockerExecutorConfig, DockerExecutorError, DockerExecutorSettings,
+    DockerReadiness,
+};
+pub use framing::{DockerOutputReader, MAX_DOCKER_RECORD, OutputChannel, OutputChunk};
+use http::{Method, StatusCode};
+use hyper::upgrade::Upgraded;
+use hyper_util::rt::TokioIo;
+pub use image::ImageResolver;
+pub use lease::{ImageLeaseConfig, ImageLeaseManager, ImageLeasePort, ImageLeaseStatus};
+pub use logs::{FunctionLogs, LogSnapshot, LogWindow};
+use models::{
+    ContainerCreateBody, ContainerCreateResponse, ContainerInspectResponse, ContainerSummary,
+    ContainerWaitResponse, ImageInspect, SystemInfo, SystemVersion,
+};
+pub use network::QualifiedNetwork;
+pub use ownership::{DirectoryLease, DirectoryLeaseError};
+use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode};
+pub use pin::{ImagePin, ImagePinScope};
+pub use plan::{
+    ContainerPolicy, DockerCpuAllocation, EnvironmentPlan, NetworkSelection, RelayBudgets,
+};
+pub use pool::{EnvironmentPool, PoolConfig, PoolInvocation, PoolPort, PoolSettings, PoolStatus};
+pub use probe::{
+    EndpointProbe, EndpointProbeConfig, EnvironmentProbe, EnvironmentProbeConfig,
+    EnvironmentProbeError, ProbeFailure, ProbeSettings, probe_endpoint, probe_environment,
+};
+pub use pull::{ImagePullPolicy, RegistryCredential, RegistryCredentials, RegistryHost};
+pub use recovery::{
+    CodeRecovery, ContainerRecovery, ImagePinRecovery, NamespaceRecovery, reconcile_containers,
+    reconcile_image_pins, reconcile_namespace,
+};
+use rustack_core::json::{JsonLimits, from_slice};
+use rustack_lambda_runtime::diagnostics::runtime_dispatch;
+pub use rustack_lambda_runtime::probe::{GatewayInstanceId, GatewayReply};
+pub use sdk::DockerSdkEnvironment;
+use serde::{Serialize, de::DeserializeOwned};
+pub use startup::{
+    DockerCapabilities, DockerInstallation, DockerRuntime, DockerRuntimeStatus,
+    DockerStartupConfig, DockerStartupError,
+};
+use tokio::{
+    io::{ReadHalf, WriteHalf, split},
+    runtime::Handle,
+    sync::{mpsc, oneshot, watch},
+    task::{JoinHandle, JoinSet},
+    time::{Instant, timeout_at},
+};
+use tracing::instrument::WithSubscriber;
+use typed_builder::TypedBuilder;
+pub use types::{ApiVersion, DockerError, DockerKey, DockerSocket};
+use uuid::Uuid;
+pub use zip::DockerZipRuntime;
+
+use self::binding::DaemonBinding;
+use crate::{
+    artifact::{Architecture, ImageReference},
+    executor::ExecutorError,
+    invocation::CleanupTask,
+};
+
+const MAX_BODY_BYTES: usize = 1024 * 1024;
+
+#[derive(Debug, Clone, Copy)]
+enum Operation {
+    Version,
+    Info,
+    Network,
+    Image,
+    TagPin,
+    InspectPin,
+    RemovePin,
+    Create,
+    Start,
+    Inspect,
+    Kill,
+    Wait,
+    Remove,
+    List,
+    ListImages,
+    Pull,
+    Attach,
+    UploadCode,
+    CreateVolume,
+    InspectVolume,
+    ListVolumes,
+    RemoveVolume,
+}
+impl Operation {
+    fn cleanup(self) -> bool {
+        matches!(
+            self,
+            Self::Inspect
+                | Self::Kill
+                | Self::Remove
+                | Self::List
+                | Self::ListImages
+                | Self::InspectPin
+                | Self::RemovePin
+                | Self::InspectVolume
+                | Self::ListVolumes
+                | Self::RemoveVolume
+        )
+    }
+}
+
+struct RawRequest {
+    archive: Option<DockerCodeArchive>,
+    pull: Option<pull::Transfer>,
+    binding: Option<Arc<DaemonBinding>>,
+    mutation: Option<mutation::MutationGuard>,
+    operation: Operation,
+    method: Method,
+    target: String,
+    body: Bytes,
+    expected: StatusCode,
+}
+impl fmt::Debug for RawRequest {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("DockerRequest")
+            .field("operation", &self.operation)
+            .field("bytes", &self.body.len())
+            .finish_non_exhaustive()
+    }
+}
+enum RawReply {
+    Pulled,
+    Body { status: StatusCode, bytes: Bytes },
+    Upgrade(TokioIo<Upgraded>),
+}
+impl fmt::Debug for RawReply {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Pulled => formatter.write_str("DockerPull(<complete>)"),
+            Self::Body { status, bytes } => formatter
+                .debug_struct("DockerReply")
+                .field("status", status)
+                .field("bytes", &bytes.len())
+                .finish(),
+            Self::Upgrade(_) => formatter.write_str("DockerUpgrade(<owned>)"),
+        }
+    }
+}
+#[cfg(test)]
+#[derive(Debug, Clone)]
+struct CompletionGate {
+    entered: watch::Sender<bool>,
+    release: watch::Receiver<bool>,
+}
+
+#[derive(Debug)]
+struct Envelope {
+    #[cfg(test)]
+    upload_completion: Option<CompletionGate>,
+    request: RawRequest,
+    deadline: Instant,
+    reply: oneshot::Sender<Result<RawReply, DockerError>>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum ResponseOwner {
+    Observer,
+    Owner,
+}
+
+#[derive(Debug, Clone, TypedBuilder)]
+struct RawPort {
+    #[cfg(test)]
+    #[builder(default)]
+    upload_completion: Option<CompletionGate>,
+    response_owner: ResponseOwner,
+    binding: Option<Arc<DaemonBinding>>,
+    business: mpsc::Sender<Envelope>,
+    cleanup: mpsc::Sender<Envelope>,
+    waits: mpsc::Sender<Envelope>,
+    pulls: mpsc::Sender<Envelope>,
+    stop: watch::Sender<bool>,
+}
+impl RawPort {
+    async fn request(
+        &self,
+        request: RawRequest,
+        deadline: Instant,
+    ) -> Result<RawReply, DockerError> {
+        if self.response_owner == ResponseOwner::Owner {
+            return self.request_owned(request, deadline).await;
+        }
+        let response = self.enqueue(request, deadline)?;
+        let result = timeout_at(deadline, response)
+            .await
+            .map_err(|_| DockerError::Deadline)?
+            .map_err(|_| DockerError::Worker)?;
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        result
+    }
+    async fn request_owned(
+        &self,
+        request: RawRequest,
+        deadline: Instant,
+    ) -> Result<RawReply, DockerError> {
+        let response = self.enqueue(request, deadline)?;
+        let result = response.await.map_err(|_| DockerError::Worker)?;
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        result
+    }
+    fn enqueue(
+        &self,
+        mut request: RawRequest,
+        deadline: Instant,
+    ) -> Result<oneshot::Receiver<Result<RawReply, DockerError>>, DockerError> {
+        request.binding.clone_from(&self.binding);
+        if *self.stop.borrow() {
+            return Err(DockerError::Stopped);
+        }
+        check_deadline(deadline)?;
+        let maximum = match (&request.archive, request.operation) {
+            (Some(archive), Operation::UploadCode)
+                if archive.bytes().as_ptr() == request.body.as_ptr()
+                    && archive.len() == request.body.len() =>
+            {
+                code::MAX_CODE_ARCHIVE_BYTES
+            }
+            (None, Operation::UploadCode) | (Some(_), _) => {
+                return Err(DockerError::Configuration);
+            }
+            (None, _) => MAX_BODY_BYTES,
+        };
+        if request.target.len() > 4096 || request.body.len() > maximum {
+            return Err(DockerError::TooLarge);
+        }
+        let sender = if matches!(request.operation, Operation::Pull) {
+            &self.pulls
+        } else if matches!(request.operation, Operation::Wait) {
+            &self.waits
+        } else if request.operation.cleanup() {
+            &self.cleanup
+        } else {
+            &self.business
+        };
+        let (reply, response) = oneshot::channel();
+        #[cfg(test)]
+        let upload_completion = if matches!(request.operation, Operation::UploadCode) {
+            self.upload_completion.clone()
+        } else {
+            None
+        };
+        sender
+            .try_send(Envelope {
+                #[cfg(test)]
+                upload_completion,
+                request,
+                deadline,
+                reply,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => DockerError::Busy,
+                mpsc::error::TrySendError::Closed(_) => DockerError::Stopped,
+            })?;
+        Ok(response)
+    }
+}
+
+/// A strict upgraded attach stream whose HTTP driver has already joined.
+#[non_exhaustive]
+pub struct DockerAttachment(TokioIo<Upgraded>);
+impl fmt::Debug for DockerAttachment {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("DockerAttachment(<owned>)")
+    }
+}
+
+/// Strict stdout/stderr reader for a split upgraded Docker socket.
+pub type AttachmentReader = DockerOutputReader<ReadHalf<TokioIo<Upgraded>>>;
+/// Raw container stdin; the owning relay writer supplies framing/IO deadlines.
+pub type AttachmentWriter = WriteHalf<TokioIo<Upgraded>>;
+
+impl DockerAttachment {
+    /// Transfer both socket halves into retained environment IO pumps.
+    ///
+    /// # Errors
+    /// Rejects a zero/over60s record budget. Dropping either returned owner does
+    /// not prove the external container has exited.
+    ///
+    /// ```no_run
+    /// # fn split(attach: rustack_lambda_core::docker::DockerAttachment) -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// let (reader, writer) = attach.split(std::time::Duration::from_secs(5))?;
+    /// # Ok(()) }
+    /// ```
+    pub fn split(
+        self,
+        budget: Duration,
+    ) -> Result<(AttachmentReader, AttachmentWriter), DockerError> {
+        let (reader, writer) = split(self.0);
+        Ok((DockerOutputReader::new(reader, budget)?, writer))
+    }
+}
+
+/// Fixed ownership-label filter; authorization to reclaim remains above wire IO.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct OwnerFilter {
+    owner: Uuid,
+    run: Option<Uuid>,
+    environment: Option<Uuid>,
+}
+impl OwnerFilter {
+    /// Validate nonnil UUID scope before issuing a label-filtered list.
+    ///
+    /// # Errors
+    /// Rejects nil identities or an environment without a run scope.
+    ///
+    /// ```
+    /// let filter = rustack_lambda_core::docker::OwnerFilter::new(uuid::Uuid::new_v4(), None, None)?;
+    /// # Ok::<(), rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn new(
+        owner: Uuid,
+        run: Option<Uuid>,
+        environment: Option<Uuid>,
+    ) -> Result<Self, DockerError> {
+        if owner.is_nil()
+            || run.is_some_and(|id| id.is_nil())
+            || environment.is_some_and(|id| id.is_nil())
+            || (environment.is_some() && run.is_none())
+        {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self {
+            owner,
+            run,
+            environment,
+        })
+    }
+    fn encoded(self) -> Result<String, DockerError> {
+        self.query(Some(64))
+    }
+    fn query(self, limit: Option<usize>) -> Result<String, DockerError> {
+        let filters = self.encoded_labels()?;
+        let mut query = form_urlencoded::Serializer::new(String::new());
+        query.append_pair("all", "true");
+        if let Some(limit) = limit {
+            query.append_pair("limit", &limit.to_string());
+        }
+        Ok(query.append_pair("filters", &filters).finish())
+    }
+    fn encoded_labels(self) -> Result<String, DockerError> {
+        let mut labels = vec![format!("rustack.lambda.ownerId={}", self.owner)];
+        if let Some(run) = self.run {
+            labels.push(format!("rustack.lambda.runId={run}"));
+        }
+        if let Some(environment) = self.environment {
+            labels.push(format!("rustack.lambda.environmentId={environment}"));
+        }
+        let filters = BTreeMap::from([("label", labels)]);
+        serde_json::to_string(&filters).map_err(|_| DockerError::Schema)
+    }
+}
+
+/// Cloneable typed request port; it does not own service shutdown.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct DockerPort {
+    raw: RawPort,
+    version: ApiVersion,
+}
+
+macro_rules! container_method {
+    ($name:ident, $method:expr, $suffix:literal, $status:expr, $operation:ident, $result:ty, $decode:ident) => {
+        #[doc = concat!("Issue the scoped container ", stringify!($operation), " operation.")]
+        ///
+        /// # Errors
+        /// Returns bounded admission, deadline, transport, status or schema failure.
+        ///
+        #[doc = concat!("```no_run\n# async fn example(port: &rustack_lambda_core::docker::DockerPort, key: &rustack_lambda_core::docker::DockerKey) {\nlet result = port.", stringify!($name), "(key, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;\n# }\n```")]
+        pub async fn $name(&self, key: &DockerKey, deadline: Instant) -> Result<$result, DockerError> {
+            let path = format!("/containers/{}{}", escaped(key.as_str()), $suffix);
+            let reply = self.call(Operation::$operation, $method, path, Bytes::new(), $status, deadline).await?;
+            $decode(reply, deadline)
+        }
+    };
+}
+
+impl DockerPort {
+    /// Only retained internal owners may await accepted IO past observation expiry.
+    fn owned(mut self) -> Self {
+        self.raw.response_owner = ResponseOwner::Owner;
+        self
+    }
+
+    /// Negotiated API version, immutable after successful connection startup.
+    ///
+    /// ```no_run
+    /// # fn inspect(port: &rustack_lambda_core::docker::DockerPort) {
+    /// let version = port.api_version();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn api_version(&self) -> ApiVersion {
+        self.version
+    }
+
+    /// Inspect bounded daemon capabilities; validate execution policy above IO.
+    ///
+    /// # Errors
+    /// Returns admission, deadline, transport or bounded metadata/schema failure.
+    ///
+    /// ```no_run
+    /// # async fn example(port: &rustack_lambda_core::docker::DockerPort) {
+    /// let info = port.info(tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn info(&self, deadline: Instant) -> Result<SystemInfo, DockerError> {
+        decode(
+            self.call(
+                Operation::Info,
+                Method::GET,
+                "/info".into(),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+
+    /// Inspect an already validated image reference without pulling it.
+    ///
+    /// # Errors
+    /// Returns missing-image status, deadline, transport or metadata failure.
+    ///
+    /// ```no_run
+    /// # async fn example(port: &rustack_lambda_core::docker::DockerPort, image: &rustack_lambda_core::artifact::ImageReference) {
+    /// let info = port.inspect_image(image, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn inspect_image(
+        &self,
+        image: &ImageReference,
+        deadline: Instant,
+    ) -> Result<ImageInspect, DockerError> {
+        decode(
+            self.call(
+                Operation::Image,
+                Method::GET,
+                format!("/images/{}/json", escaped(image.as_str())),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+
+    /// Create under a preallocated name retained by the environment owner.
+    ///
+    /// # Errors
+    /// Returns bounded request/schema, status, deadline or transport failure.
+    /// A failed/dropped response still requires name/label reconciliation.
+    ///
+    /// ```no_run
+    /// # async fn example(port: &rustack_lambda_core::docker::DockerPort, name: &rustack_lambda_core::docker::DockerKey, body: &rustack_lambda_core::docker::models::ContainerCreateBody) {
+    /// let created = port.create_container(name, body, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn create_container(
+        &self,
+        name: &DockerKey,
+        body: &ContainerCreateBody,
+        deadline: Instant,
+    ) -> Result<ContainerCreateResponse, DockerError> {
+        self.create_container_inner(name, body, None, deadline, None)
+            .await
+    }
+
+    /// Create from an immutable image ID using an explicit captured platform.
+    ///
+    /// # Errors
+    /// Returns bounded request, status, deadline or transport failure; the owner
+    /// must reconcile uncertain creation under the preallocated name/labels.
+    ///
+    /// ```no_run
+    /// # async fn example(port: &rustack_lambda_core::docker::DockerPort, key: &rustack_lambda_core::docker::DockerKey, body: &rustack_lambda_core::docker::models::ContainerCreateBody) {
+    /// let result = port.create_container_on_platform(key,body,
+    ///     rustack_lambda_core::artifact::Architecture::Arm64,
+    ///     tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn create_container_on_platform(
+        &self,
+        name: &DockerKey,
+        body: &ContainerCreateBody,
+        architecture: Architecture,
+        deadline: Instant,
+    ) -> Result<ContainerCreateResponse, DockerError> {
+        self.create_container_inner(name, body, Some(architecture), deadline, None)
+            .await
+    }
+
+    async fn create_container_inner(
+        &self,
+        name: &DockerKey,
+        body: &ContainerCreateBody,
+        architecture: Option<Architecture>,
+        deadline: Instant,
+        mutation: Option<mutation::MutationGuard>,
+    ) -> Result<ContainerCreateResponse, DockerError> {
+        let query = {
+            let mut query = form_urlencoded::Serializer::new(String::new());
+            query.append_pair("name", name.as_str());
+            if let Some(architecture) = architecture {
+                query.append_pair("platform", architecture.docker_platform());
+            }
+            query.finish()
+        };
+        decode(
+            self.raw
+                .request(
+                    RawRequest {
+                        archive: None,
+                        pull: None,
+                        binding: None,
+                        mutation,
+                        operation: Operation::Create,
+                        method: Method::POST,
+                        target: format!("/v{}/containers/create?{query}", self.version),
+                        body: encode(body)?,
+                        expected: StatusCode::CREATED,
+                    },
+                    deadline,
+                )
+                .await?,
+            deadline,
+        )
+    }
+
+    container_method!(
+        start_container,
+        Method::POST,
+        "/start",
+        StatusCode::NO_CONTENT,
+        Start,
+        (),
+        unit
+    );
+    container_method!(
+        inspect_container,
+        Method::GET,
+        "/json",
+        StatusCode::OK,
+        Inspect,
+        ContainerInspectResponse,
+        decode
+    );
+    container_method!(
+        kill_container,
+        Method::POST,
+        "/kill?signal=SIGKILL",
+        StatusCode::NO_CONTENT,
+        Kill,
+        (),
+        unit
+    );
+    container_method!(
+        wait_container,
+        Method::POST,
+        "/wait?condition=not-running",
+        StatusCode::OK,
+        Wait,
+        ContainerWaitResponse,
+        decode
+    );
+    container_method!(
+        remove_container,
+        Method::DELETE,
+        "?force=true&v=false",
+        StatusCode::NO_CONTENT,
+        Remove,
+        (),
+        unit
+    );
+
+    /// List only a fixed ownership-label scope for reconciliation.
+    ///
+    /// # Errors
+    /// Returns admission, deadline, status, transport or metadata-budget failure.
+    ///
+    /// ```no_run
+    /// # async fn example(port: &rustack_lambda_core::docker::DockerPort, filter: rustack_lambda_core::docker::OwnerFilter) {
+    /// let found = port.list_containers(filter, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn list_containers(
+        &self,
+        filter: OwnerFilter,
+        deadline: Instant,
+    ) -> Result<Vec<ContainerSummary>, DockerError> {
+        decode(
+            self.call(
+                Operation::List,
+                Method::GET,
+                format!("/containers/json?{}", filter.encoded()?),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+
+    /// Establish binary attach before starting the relay; no log replay.
+    ///
+    /// # Errors
+    /// Returns invalid upgrade, status, deadline or joined transport failure.
+    ///
+    /// ```no_run
+    /// # async fn example(port: &rustack_lambda_core::docker::DockerPort, relay: &rustack_lambda_core::docker::DockerKey) {
+    /// let attached = port.attach(relay, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn attach(
+        &self,
+        relay: &DockerKey,
+        deadline: Instant,
+    ) -> Result<DockerAttachment, DockerError> {
+        self.attach_inner(relay, true, deadline).await
+    }
+
+    /// Attach only live function output before start, without stdin or replay.
+    ///
+    /// # Errors
+    /// Returns admission, upgrade, status, deadline or joined transport failure.
+    ///
+    /// ```no_run
+    /// # async fn logs(port: &rustack_lambda_core::docker::DockerPort, function: &rustack_lambda_core::docker::DockerKey) {
+    /// let attached = port.attach_logs(function, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn attach_logs(
+        &self,
+        function: &DockerKey,
+        deadline: Instant,
+    ) -> Result<DockerAttachment, DockerError> {
+        self.attach_inner(function, false, deadline).await
+    }
+
+    async fn attach_inner(
+        &self,
+        key: &DockerKey,
+        stdin: bool,
+        deadline: Instant,
+    ) -> Result<DockerAttachment, DockerError> {
+        let reply = self
+            .call(
+                Operation::Attach,
+                Method::POST,
+                format!(
+                    "/containers/{}/attach?stdin={stdin}&stdout=true&stderr=true&stream=true&\
+                     logs=false",
+                    escaped(key.as_str())
+                ),
+                Bytes::new(),
+                StatusCode::SWITCHING_PROTOCOLS,
+                deadline,
+            )
+            .await?;
+        match reply {
+            RawReply::Upgrade(io) => Ok(DockerAttachment(io)),
+            RawReply::Body { .. } | RawReply::Pulled => Err(DockerError::Protocol),
+        }
+    }
+
+    async fn call(
+        &self,
+        operation: Operation,
+        method: Method,
+        path: String,
+        body: Bytes,
+        expected: StatusCode,
+        deadline: Instant,
+    ) -> Result<RawReply, DockerError> {
+        let target = format!("/v{}{path}", self.version);
+        self.raw
+            .request(
+                RawRequest {
+                    archive: None,
+                    pull: None,
+                    binding: None,
+                    mutation: None,
+                    operation,
+                    method,
+                    target,
+                    body,
+                    expected,
+                },
+                deadline,
+            )
+            .await
+    }
+}
+
+/// Owner of bounded request scheduling and all in-flight management drivers.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct DockerWire {
+    port: DockerPort,
+    owner: Owner,
+}
+
+impl DockerWire {
+    pub(super) fn physically_settled(&self) -> bool {
+        self.owner.primary.is_some()
+            && self.owner.task.is_none()
+            && self.owner.emergency.is_finished()
+    }
+
+    /// Verify the explicit socket and negotiate a bounded API response.
+    ///
+    /// # Errors
+    /// Returns unavailable socket, malformed/incompatible API, IO or supervision
+    /// failure. Dropped startup waiters retain cleanup through the owner task.
+    ///
+    /// ```no_run
+    /// # async fn example() -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// let socket = "unix:///var/run/docker.sock".parse()?;
+    /// let mut wire = rustack_lambda_core::docker::DockerWire::connect(socket,
+    ///     tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await?;
+    /// wire.shutdown().await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn connect(socket: DockerSocket, deadline: Instant) -> Result<Self, DockerError> {
+        tokio::runtime::Handle::try_current().map_err(|_| DockerError::Worker)?;
+        let path = socket.verified(deadline).await?;
+        let (mut owner, raw) = Owner::start(path);
+        let result = async {
+            let response = raw
+                .request(
+                    RawRequest {
+                        archive: None,
+                        pull: None,
+                        binding: None,
+                        mutation: None,
+                        operation: Operation::Version,
+                        method: Method::GET,
+                        target: "/version".into(),
+                        body: Bytes::new(),
+                        expected: StatusCode::OK,
+                    },
+                    deadline,
+                )
+                .await?;
+            let version: SystemVersion = decode(response, deadline)?;
+            ApiVersion::negotiate(
+                version.api_version.as_deref().ok_or(DockerError::Version)?,
+                version
+                    .min_api_version
+                    .as_deref()
+                    .ok_or(DockerError::Version)?,
+            )
+        }
+        .await;
+        match result {
+            Ok(version) => Ok(Self {
+                port: DockerPort { raw, version },
+                owner,
+            }),
+            Err(error) => {
+                owner.shutdown().await?;
+                Err(error)
+            }
+        }
+    }
+
+    /// Clone a typed port; the original wire keeps shutdown responsibility.
+    ///
+    /// ```no_run
+    /// # fn port(wire: &rustack_lambda_core::docker::DockerWire) {
+    /// let port = wire.port();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn port(&self) -> DockerPort {
+        self.port.clone()
+    }
+
+    /// Stop admission and join every retained management request/driver.
+    ///
+    /// # Errors
+    /// Caches task supervision failures. Exported stream owners and external
+    /// containers must be joined/removed by their environment owner separately.
+    ///
+    /// ```no_run
+    /// # async fn shutdown(wire: &mut rustack_lambda_core::docker::DockerWire) {
+    /// let settled = wire.shutdown().await;
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self) -> Result<(), DockerError> {
+        self.owner.shutdown().await
+    }
+}
+
+#[derive(Debug)]
+struct Owner {
+    emergency: Arc<CleanupTask>,
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<(), DockerError>>>,
+    primary: Option<Result<(), DockerError>>,
+    settlement: Option<Result<(), DockerError>>,
+}
+impl Owner {
+    fn start(socket: PathBuf) -> (Self, RawPort) {
+        let (business, requests) = mpsc::channel(32);
+        let (cleanup, priority) = mpsc::channel(8);
+        let (waits, pending_waits) = mpsc::channel(8);
+        let (pulls, pending_pulls) = mpsc::channel(8);
+        let (stop, _) = watch::channel(false);
+        let emergency = Arc::new(CleanupTask::default());
+        let actor = Actor::builder()
+            .runtime(Handle::current())
+            .emergency(emergency.clone())
+            .socket(socket)
+            .business(requests)
+            .cleanup(priority)
+            .waits(pending_waits)
+            .pulls(pending_pulls)
+            .control(stop.clone())
+            .build();
+        let task = tokio::spawn(actor.run().with_subscriber(runtime_dispatch()));
+        (
+            Self {
+                emergency,
+                stop: stop.clone(),
+                task: Some(task),
+                primary: None,
+                settlement: None,
+            },
+            RawPort::builder()
+                .response_owner(ResponseOwner::Observer)
+                .binding(None)
+                .business(business)
+                .cleanup(cleanup)
+                .waits(waits)
+                .pulls(pulls)
+                .stop(stop)
+                .build(),
+        )
+    }
+    async fn shutdown(&mut self) -> Result<(), DockerError> {
+        self.stop.send_replace(true);
+        if let Some(result) = &self.settlement {
+            return result.clone();
+        }
+        let result = if let Some(result) = &self.primary {
+            result.clone()
+        } else {
+            let result = match self.task.as_mut() {
+                Some(task) => task
+                    .await
+                    .map_err(|_| DockerError::Worker)
+                    .and_then(|result| result),
+                None => Ok(()),
+            };
+            self.task.take();
+            self.primary = Some(result.clone());
+            result
+        };
+        let emergency = self.emergency.wait().await.map_err(|_| DockerError::Worker);
+        let result = result.and(emergency);
+        self.settlement = Some(result.clone());
+        result
+    }
+}
+impl Drop for Owner {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Actor {
+    runtime: Handle,
+    emergency: Arc<CleanupTask>,
+    socket: PathBuf,
+    business: mpsc::Receiver<Envelope>,
+    cleanup: mpsc::Receiver<Envelope>,
+    waits: mpsc::Receiver<Envelope>,
+    pulls: mpsc::Receiver<Envelope>,
+    control: watch::Sender<bool>,
+    #[builder(default)]
+    jobs: JoinSet<(Lane, bool)>,
+    #[builder(default)]
+    counts: Counts,
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Lane {
+    Business,
+    Cleanup,
+    Wait,
+    Pull,
+}
+#[derive(Debug, Default)]
+struct Counts {
+    business: usize,
+    cleanup: usize,
+    waits: usize,
+    pulls: usize,
+}
+impl Counts {
+    fn get_mut(&mut self, lane: Lane) -> &mut usize {
+        match lane {
+            Lane::Business => &mut self.business,
+            Lane::Cleanup => &mut self.cleanup,
+            Lane::Wait => &mut self.waits,
+            Lane::Pull => &mut self.pulls,
+        }
+    }
+}
+impl Actor {
+    async fn run(mut self) -> Result<(), DockerError> {
+        let mut stop = self.control.subscribe();
+        let mut outcome = loop {
+            tokio::select! {
+                biased;
+                () = connection::stopped(&mut stop) => break Ok(()),
+                job = self.jobs.join_next(), if !self.jobs.is_empty() => match job {
+                    Some(Ok((lane, false))) => {
+                        let count = self.counts.get_mut(lane);
+                        if let Some(value) = count.checked_sub(1) { *count = value; } else { break Err(DockerError::Worker); }
+                    }
+                    _ => break Err(DockerError::Worker),
+                },
+                envelope = self.cleanup.recv(), if self.counts.cleanup < 2 => match envelope { Some(envelope) => self.start(envelope, Lane::Cleanup), None => break Err(DockerError::Stopped) },
+                envelope = self.waits.recv(), if self.counts.waits < 32 => match envelope { Some(envelope) => self.start(envelope, Lane::Wait), None => break Err(DockerError::Stopped) },
+                envelope = self.pulls.recv(), if self.counts.pulls < 4 => match envelope { Some(envelope) => self.start(envelope, Lane::Pull), None => break Err(DockerError::Stopped) },
+                envelope = self.business.recv(), if self.counts.business < 6 => match envelope { Some(envelope) => self.start(envelope, Lane::Business), None => break Err(DockerError::Stopped) },
+            }
+        };
+        self.control.send_replace(true);
+        self.business.close();
+        self.cleanup.close();
+        self.waits.close();
+        self.pulls.close();
+        while let Ok(envelope) = self.business.try_recv() {
+            let _ = envelope.reply.send(Err(DockerError::Stopped));
+        }
+        while let Ok(envelope) = self.cleanup.try_recv() {
+            let _ = envelope.reply.send(Err(DockerError::Stopped));
+        }
+        while let Ok(envelope) = self.waits.try_recv() {
+            let _ = envelope.reply.send(Err(DockerError::Stopped));
+        }
+        while let Ok(envelope) = self.pulls.try_recv() {
+            let _ = envelope.reply.send(Err(DockerError::Stopped));
+        }
+        while let Some(result) = self.jobs.join_next().await {
+            if !matches!(result, Ok((_, false))) {
+                outcome = Err(DockerError::Worker);
+            }
+        }
+        outcome
+    }
+    fn start(&mut self, envelope: Envelope, lane: Lane) {
+        if *self.control.borrow() {
+            let _ = envelope.reply.send(Err(DockerError::Stopped));
+            return;
+        }
+        if envelope.reply.is_closed() {
+            return;
+        }
+        if Instant::now() >= envelope.deadline {
+            let _ = envelope.reply.send(Err(DockerError::Deadline));
+            return;
+        }
+        let socket = self.socket.clone();
+        let stopped = self.control.subscribe();
+        *self.counts.get_mut(lane) += 1;
+        self.jobs.spawn(
+            async move {
+                let result = exchange(&socket, envelope.request, envelope.deadline, stopped).await;
+                #[cfg(test)]
+                if let Some(mut gate) = envelope.upload_completion {
+                    gate.entered.send_replace(true);
+                    let _ = gate.release.wait_for(|released| *released).await;
+                }
+                let failed = matches!(&result, Err(DockerError::Worker));
+                let _ = envelope.reply.send(result);
+                (lane, failed)
+            }
+            .with_subscriber(runtime_dispatch()),
+        );
+    }
+}
+
+impl Drop for Actor {
+    fn drop(&mut self) {
+        self.control.send_replace(true);
+        if self.jobs.is_empty() {
+            return;
+        }
+        let mut jobs = mem::take(&mut self.jobs);
+        self.emergency.start_on(&self.runtime, move || async move {
+            let mut failed = false;
+            while let Some(result) = jobs.join_next().await {
+                if !matches!(result, Ok((_, false))) {
+                    failed = true;
+                }
+            }
+            if failed {
+                Err(ExecutorError::CleanupFailed(
+                    "Docker wire cleanup failed".into(),
+                ))
+            } else {
+                Ok(())
+            }
+        });
+    }
+}
+
+fn escaped(value: &str) -> String {
+    utf8_percent_encode(value, NON_ALPHANUMERIC).to_string()
+}
+fn check_deadline(deadline: Instant) -> Result<(), DockerError> {
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .filter(|remaining| !remaining.is_zero())
+        .ok_or(DockerError::Deadline)?;
+    if remaining > Duration::from_secs(600) {
+        return Err(DockerError::Configuration);
+    }
+    Ok(())
+}
+fn decode<T: DeserializeOwned>(reply: RawReply, deadline: Instant) -> Result<T, DockerError> {
+    if Instant::now() >= deadline {
+        return Err(DockerError::Deadline);
+    }
+    let result = match reply {
+        RawReply::Body { bytes, .. } => from_slice(
+            &bytes,
+            JsonLimits::new(MAX_BODY_BYTES, 32, 4096, 16 * 1024, 256)?,
+        )
+        .map_err(DockerError::from),
+        RawReply::Upgrade(_) | RawReply::Pulled => Err(DockerError::Protocol),
+    };
+    if Instant::now() >= deadline {
+        return Err(DockerError::Deadline);
+    }
+    result
+}
+fn unit(reply: RawReply, deadline: Instant) -> Result<(), DockerError> {
+    if Instant::now() >= deadline {
+        return Err(DockerError::Deadline);
+    }
+    match reply {
+        RawReply::Body { bytes, .. } if bytes.is_empty() => Ok(()),
+        _ => Err(DockerError::Protocol),
+    }
+}
+
+#[derive(Default)]
+struct Encoded {
+    bytes: Vec<u8>,
+    failure: Option<DockerError>,
+}
+impl fmt::Debug for Encoded {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("Encoded")
+            .field("bytes", &self.bytes.len())
+            .field("failure", &self.failure)
+            .finish()
+    }
+}
+impl Write for Encoded {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let length = self
+            .bytes
+            .len()
+            .checked_add(bytes.len())
+            .filter(|length| *length <= MAX_BODY_BYTES);
+        if length.is_none() {
+            self.failure = Some(DockerError::TooLarge);
+            return Err(io::Error::other("Docker byte budget exceeded"));
+        }
+        if self.bytes.try_reserve(bytes.len()).is_err() {
+            self.failure = Some(DockerError::Allocation);
+            return Err(io::Error::other("Docker allocation failed"));
+        }
+        self.bytes.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+fn encode(value: &impl Serialize) -> Result<Bytes, DockerError> {
+    let mut output = Encoded::default();
+    if serde_json::to_writer(&mut output, value).is_err() {
+        return Err(output.failure.unwrap_or(DockerError::Schema));
+    }
+    Ok(Bytes::from(output.bytes))
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+pub(crate) use lease::tests as image_fixture;
diff --git a/crates/rustack-lambda-core/src/docker/mutation.rs b/crates/rustack-lambda-core/src/docker/mutation.rs
new file mode 100644
index 00000000..bece8280
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/mutation.rs
@@ -0,0 +1,31 @@
+//! A retained receipt distinguishes definitely unissued from uncertain mutation IO.
+
+use std::sync::{
+    Arc,
+    atomic::{AtomicU8, Ordering},
+};
+
+#[derive(Debug, Clone)]
+pub(super) struct MutationReceipt(Arc<AtomicU8>);
+pub(super) struct MutationGuard(MutationReceipt);
+impl MutationGuard {
+    pub(super) fn new() -> Self {
+        Self(MutationReceipt(Arc::new(AtomicU8::new(0))))
+    }
+    pub(super) fn receipt(&self) -> MutationReceipt {
+        self.0.clone()
+    }
+    pub(super) fn issued(&mut self) {
+        self.0.0.store(1, Ordering::Release);
+    }
+}
+impl Drop for MutationGuard {
+    fn drop(&mut self) {
+        self.0.0.fetch_or(2, Ordering::Release);
+    }
+}
+impl MutationReceipt {
+    pub(super) fn definitely_unissued(&self) -> bool {
+        self.0.load(Ordering::Acquire) == 2
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/network.rs b/crates/rustack-lambda-core/src/docker/network.rs
new file mode 100644
index 00000000..90185e61
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/network.rs
@@ -0,0 +1,146 @@
+//! Read-only network qualification pins a bridge ID before allocation.
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use tokio::time::Instant;
+
+use super::{
+    ContainerPolicy, DockerError, DockerKey, DockerPort, NetworkSelection, Operation,
+    check_deadline, decode, escaped, models::NetworkInspect,
+};
+
+/// Validated disconnected or full-ID local bridge selection; not startup readiness.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct QualifiedNetwork {
+    requested: NetworkSelection,
+    selected: NetworkSelection,
+}
+impl QualifiedNetwork {
+    /// Bind the inspected network ID into a matching operator policy.
+    ///
+    /// # Errors
+    /// Rejects a policy for a different originally requested/qualified network.
+    ///
+    /// ```no_run
+    /// # fn bind(network:&rustack_lambda_core::docker::QualifiedNetwork, policy:&rustack_lambda_core::docker::ContainerPolicy) {
+    /// let fixed=network.apply(policy);
+    /// # }
+    /// ```
+    pub fn apply(&self, policy: &ContainerPolicy) -> Result<ContainerPolicy, DockerError> {
+        if policy.network != self.requested && policy.network != self.selected {
+            return Err(DockerError::Configuration);
+        }
+        let mut policy = policy.clone();
+        policy.network = self.selected.clone();
+        Ok(policy)
+    }
+    /// Whether the selected namespace deliberately has no external network.
+    ///
+    /// ```no_run
+    /// # fn check(network:&rustack_lambda_core::docker::QualifiedNetwork) {
+    /// let disconnected=network.disconnected();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn disconnected(&self) -> bool {
+        self.selected.value() == "none"
+    }
+}
+impl NetworkSelection {
+    /// Inspect and pin an exact operator-owned local user bridge, or select none.
+    ///
+    /// No create/delete or host/default-network fallback occurs. A qualified
+    /// bridge can still be deleted by the operator; allocation then fails.
+    ///
+    /// # Errors
+    /// Rejects expired budgets, wire failure, incomplete/builtin/nonlocal network
+    /// metadata, partial IDs or conflicting returned identity.
+    ///
+    /// ```no_run
+    /// # async fn qualify(port:&rustack_lambda_core::docker::DockerPort)->Result<(),rustack_lambda_core::docker::DockerError>{
+    /// let selection:rustack_lambda_core::docker::NetworkSelection="worker-network".parse()?;
+    /// let network=selection.qualify(port,tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn qualify(
+        &self,
+        port: &DockerPort,
+        deadline: Instant,
+    ) -> Result<QualifiedNetwork, DockerError> {
+        check_deadline(deadline)?;
+        let selected = if self.value() == "none" {
+            self.clone()
+        } else {
+            let inspected = port
+                .inspect_network(&self.value().parse()?, deadline)
+                .await?;
+            validate(self, &inspected)?
+        };
+        check_deadline(deadline)?;
+        Ok(QualifiedNetwork {
+            requested: self.clone(),
+            selected,
+        })
+    }
+}
+impl DockerPort {
+    /// Inspect bounded network metadata without mutating its lifetime.
+    ///
+    /// # Errors
+    /// Returns wire admission, status, deadline or bounded metadata failure.
+    ///
+    /// ```no_run
+    /// # async fn inspect(port:&rustack_lambda_core::docker::DockerPort,key:&rustack_lambda_core::docker::DockerKey){
+    /// let network=port.inspect_network(key,tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn inspect_network(
+        &self,
+        key: &DockerKey,
+        deadline: Instant,
+    ) -> Result<NetworkInspect, DockerError> {
+        decode(
+            self.call(
+                Operation::Network,
+                Method::GET,
+                format!("/networks/{}", escaped(key.as_str())),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+}
+fn validate(
+    requested: &NetworkSelection,
+    network: &NetworkInspect,
+) -> Result<NetworkSelection, DockerError> {
+    let name = network.name.as_deref().ok_or(DockerError::Configuration)?;
+    name.parse::<DockerKey>()?;
+    let id = network.id.as_deref().ok_or(DockerError::Configuration)?;
+    let default = network
+        .options
+        .as_ref()
+        .and_then(|options| options.get("com.docker.network.bridge.default_bridge"));
+    if id.len() != 64
+        || !id
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+        || !matches!(requested.value(),value if value==name||value==id)
+        || matches!(name, "host" | "bridge" | "none" | "default")
+        || network.driver.as_deref() != Some("bridge")
+        || network.scope.as_deref() != Some("local")
+        || network.ingress != Some(false)
+        || network.config_only != Some(false)
+        || default.is_some_and(|value| value != "false")
+    {
+        return Err(DockerError::Configuration);
+    }
+    id.parse()
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/network/tests.rs b/crates/rustack-lambda-core/src/docker/network/tests.rs
new file mode 100644
index 00000000..57c2c80b
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/network/tests.rs
@@ -0,0 +1,86 @@
+use serde_json::{Value, json};
+use tokio::time::{Duration, Instant};
+
+use super::*;
+use crate::docker::{plan::tests::policy, tests::Daemon};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(3)
+}
+fn fixture() -> Value {
+    json!({"Name":"probe-network","Id":"a".repeat(64),"Driver":"bridge","Scope":"local","Ingress":false,"ConfigOnly":false,"Options":{}})
+}
+#[rstest::rstest]
+#[case::driver("Driver",json!("host"))]
+#[case::scope("Scope",json!("swarm"))]
+#[case::ingress("Ingress",json!(true))]
+#[case::config_only("ConfigOnly",json!(true))]
+#[case::missing_ingress("Ingress", Value::Null)]
+#[case::missing_scope("Scope", Value::Null)]
+#[case::wrong_name("Name",json!("another-network"))]
+#[case::builtin("Name",json!("bridge"))]
+#[case::bad_id("Id",json!("a".repeat(63)))]
+#[case::uppercase_id("Id",json!("A".repeat(64)))]
+#[case::default_bridge("Options",json!({"com.docker.network.bridge.default_bridge":"true"}))]
+#[case::unknown_default("Options",json!({"com.docker.network.bridge.default_bridge":"unknown"}))]
+#[test]
+fn test_should_reject_unqualified_network_metadata(#[case] field: &str, #[case] value: Value) {
+    let mut network = fixture();
+    network[field] = value;
+    let network = serde_json::from_value(network).unwrap();
+    assert!(validate(&"probe-network".parse().unwrap(), &network).is_err());
+}
+#[test]
+fn test_should_pin_only_exact_names_or_full_ids_and_bind_matching_policy() {
+    let network = serde_json::from_value(fixture()).unwrap();
+    let requested: NetworkSelection = "probe-network".parse().unwrap();
+    let selected = validate(&requested, &network).unwrap();
+    assert_eq!(selected.value(), "a".repeat(64));
+    assert!(validate(&"aaaa".parse().unwrap(), &network).is_err());
+    assert!(validate(&"a".repeat(64).parse().unwrap(), &network).is_ok());
+    let qualified = QualifiedNetwork {
+        requested,
+        selected,
+    };
+    let mut configured = policy();
+    assert!(qualified.apply(&configured).is_err());
+    configured.network = "probe-network".parse().unwrap();
+    let fixed = qualified.apply(&configured).unwrap();
+    assert_eq!(fixed.network.value(), "a".repeat(64));
+    assert!(qualified.apply(&fixed).is_ok());
+    assert!(!qualified.disconnected());
+}
+#[tokio::test]
+async fn test_should_issue_only_bounded_network_inspect_and_no_request_for_none() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let task = tokio::spawn(async move {
+        "probe-network"
+            .parse::<NetworkSelection>()
+            .unwrap()
+            .qualify(&port, deadline())
+            .await
+    });
+    let request = daemon.next().await;
+    assert!(
+        request
+            .head
+            .starts_with("GET /v1.53/networks/probe%2Dnetwork ")
+    );
+    request
+        .reply(200, &serde_json::to_vec(&fixture()).unwrap())
+        .await;
+    assert!(!task.await.unwrap().unwrap().disconnected());
+    let none = "none"
+        .parse::<NetworkSelection>()
+        .unwrap()
+        .qualify(&wire.port(), deadline())
+        .await
+        .unwrap();
+    assert!(none.disconnected());
+    assert!(none.apply(&policy()).is_ok());
+    assert!(daemon.requests.try_recv().is_err());
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership.rs b/crates/rustack-lambda-core/src/docker/ownership.rs
new file mode 100644
index 00000000..ac44be41
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership.rs
@@ -0,0 +1,843 @@
+//! Persistent, descriptor-relative ownership of a Docker resource namespace.
+//!
+//! Standard files are required for OS advisory locks. All synchronous IO runs
+//! on bounded blocking workers; lease clones perform no IO and retain the lock.
+#![allow(clippy::disallowed_types, clippy::disallowed_methods)]
+
+use std::{
+    ffi::OsString,
+    fmt,
+    fs::{File, Metadata, TryLockError, canonicalize, symlink_metadata},
+    future::Future,
+    io::{self, Read, Write},
+    os::unix::fs::MetadataExt,
+    path::{Component, Path, PathBuf},
+    pin::Pin,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use nix::{
+    dir::Dir,
+    errno::Errno,
+    fcntl::{OFlag, open, openat, renameat},
+    sys::stat::{Mode, mkdirat},
+    unistd::geteuid,
+};
+use sha2::{Digest, Sha256};
+use tokio::{
+    runtime::Handle,
+    sync::{AcquireError, OwnedSemaphorePermit, Semaphore, SemaphorePermit},
+    task::{JoinHandle, spawn_blocking},
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+pub(super) use self::{images::ImageRecord, journal::ContainerRecord};
+
+pub(super) mod codes;
+mod daemon;
+mod images;
+mod journal;
+mod snapshot;
+
+const NAMESPACE: &str = ".rustack-lambda-docker";
+const LOCK: &str = "lease.lock";
+const OWNER: &str = "owner.v1";
+const PENDING: &str = "owner.pending";
+const MAGIC: &[u8; 8] = b"RSDKOWN2";
+const CODE_MAGIC: &[u8; 8] = b"RSDKOWN3";
+const LEGACY_MAGIC: &[u8; 8] = b"RSDKOWN1";
+const OWNER_BYTES: usize = 56;
+static WORKERS: Semaphore = Semaphore::const_new(4);
+
+/// Directory acquisition failures; diagnostics never include operator paths.
+#[derive(thiserror::Error)]
+#[non_exhaustive]
+pub enum DirectoryLeaseError {
+    /// Invalid operator directory or acquisition budget.
+    #[error("invalid Docker ownership configuration")]
+    Configuration,
+    /// Another descriptor/process owns this data directory.
+    #[error("Docker data directory is already owned")]
+    InUse,
+    /// This immutable identity predates journal-before-effect provenance.
+    #[error("Docker ownership predates journal provenance; choose a new controlled data directory")]
+    Legacy,
+    /// Unsafe file kind/permissions/links or damaged authoritative identity.
+    #[error("invalid Docker ownership state")]
+    InvalidState,
+    /// The absolute acquisition deadline elapsed.
+    #[error("Docker ownership deadline exceeded")]
+    Deadline,
+    /// The requesting acquisition was abandoned.
+    #[error("Docker ownership acquisition cancelled")]
+    Cancelled,
+    /// No runtime or the blocking worker failed.
+    #[error("Docker ownership worker failed")]
+    Worker,
+    /// A filesystem operation failed, preserving its source without displaying it.
+    #[error("Docker ownership IO failed")]
+    Io(#[source] io::Error),
+}
+#[derive(Debug)]
+struct CodeProducerState {
+    gate: Arc<Semaphore>,
+    poisoned: AtomicBool,
+}
+impl CodeProducerState {
+    fn new() -> Self {
+        Self {
+            gate: Arc::new(Semaphore::new(1)),
+            poisoned: AtomicBool::new(false),
+        }
+    }
+}
+/// Exclusive producing lifetime; cancellation without an empty joined ledger poisons acquisition.
+#[derive(Debug)]
+pub(in crate::docker) struct CodeProducerGuard {
+    state: Arc<CodeProducerState>,
+    _permit: OwnedSemaphorePermit,
+    clean: AtomicBool,
+}
+impl CodeProducerGuard {
+    pub(in crate::docker) fn settle(&self) {
+        self.clean.store(true, Ordering::Release);
+    }
+}
+impl Drop for CodeProducerGuard {
+    fn drop(&mut self) {
+        if !self.clean.load(Ordering::Acquire) {
+            self.state.poisoned.store(true, Ordering::Release);
+        }
+    }
+}
+
+impl fmt::Debug for DirectoryLeaseError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, formatter)
+    }
+}
+impl From<io::Error> for DirectoryLeaseError {
+    fn from(source: io::Error) -> Self {
+        Self::Io(source)
+    }
+}
+impl From<Errno> for DirectoryLeaseError {
+    fn from(source: Errno) -> Self {
+        match source {
+            Errno::ELOOP | Errno::ENOTDIR => Self::InvalidState,
+            _ => Self::Io(source.into()),
+        }
+    }
+}
+
+/// Shared proof of an exclusive, durably identified Docker data directory.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct DirectoryLease(Arc<Lease>);
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Provenance {
+    Legacy,
+    Journaled,
+    CodeJournaled,
+}
+
+#[derive(TypedBuilder)]
+struct Lease {
+    owner: Uuid,
+    run: Uuid,
+    transaction: Arc<Semaphore>,
+    code_producer: Arc<CodeProducerState>,
+    provenance: Provenance,
+    guard: LeaseGuard,
+}
+enum LeaseGuard {
+    Held {
+        directory: File,
+        _lock: File,
+    },
+    #[cfg(test)]
+    Testing {
+        directory: File,
+        _root: tempfile::TempDir,
+    },
+}
+impl fmt::Debug for DirectoryLease {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("DirectoryLease(<held>)")
+    }
+}
+impl DirectoryLease {
+    pub(super) fn require_journaled(&self) -> Result<(), DirectoryLeaseError> {
+        match self.0.provenance {
+            Provenance::Journaled | Provenance::CodeJournaled => Ok(()),
+            Provenance::Legacy => Err(DirectoryLeaseError::Legacy),
+        }
+    }
+
+    pub(super) fn code_producer(&self) -> Result<CodeProducerGuard, DirectoryLeaseError> {
+        let state = &self.0.code_producer;
+        if self.0.provenance != Provenance::CodeJournaled || state.poisoned.load(Ordering::Acquire)
+        {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        let permit = state
+            .gate
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| DirectoryLeaseError::InUse)?;
+        if state.poisoned.load(Ordering::Acquire) {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        Ok(CodeProducerGuard {
+            state: state.clone(),
+            _permit: permit,
+            clean: AtomicBool::new(false),
+        })
+    }
+
+    pub(super) fn code_journaled(&self) -> bool {
+        self.0.provenance == Provenance::CodeJournaled
+    }
+
+    /// Acquire a fresh code-capable namespace; existing Image roots are refused.
+    ///
+    /// Never upgrades or rewrites an existing owner. General acquisition can
+    /// reopen this generation to recover its recorded effects.
+    ///
+    /// # Errors
+    /// Returns acquisition errors, including `InvalidState` for older provenance.
+    ///
+    /// ```no_run
+    /// # async fn example() -> Result<(), rustack_lambda_core::docker::DirectoryLeaseError> {
+    /// let lease = rustack_lambda_core::docker::DirectoryLease::acquire_code(
+    ///     "/tmp/rustack-code-data".into(),
+    ///     tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn acquire_code(
+        directory: PathBuf,
+        deadline: Instant,
+    ) -> Result<Self, DirectoryLeaseError> {
+        let directory = DataDirectory::try_from(directory)?;
+        run(&WORKERS, deadline, move |control| {
+            acquire_profile(&directory, control, Provenance::CodeJournaled)
+        })
+        .await
+    }
+
+    pub(crate) fn same_instance(&self, other: &Self) -> bool {
+        Arc::ptr_eq(&self.0, &other.0)
+    }
+
+    #[cfg(test)]
+    pub(super) fn synthetic(&self) -> bool {
+        matches!(self.0.guard, LeaseGuard::Testing { .. })
+    }
+    /// Acquire a private namespace, retaining exclusion until the last clone drops.
+    ///
+    /// # Errors
+    /// Rejects invalid paths/budgets, competing owners, unsafe/corrupt state,
+    /// cancellation/deadline, filesystem failures and unavailable/failed workers.
+    /// Acquisition does not establish previous-run reconciliation or readiness.
+    ///
+    /// ```no_run
+    /// # async fn acquire() -> Result<(), rustack_lambda_core::docker::DirectoryLeaseError> {
+    /// use rustack_lambda_core::docker::DirectoryLease;
+    /// let lease = DirectoryLease::acquire(
+    ///     "/tmp/rustack-data".into(),
+    ///     tokio::time::Instant::now() + std::time::Duration::from_secs(5),
+    /// ).await?;
+    /// let scope = rustack_lambda_core::docker::ImagePinScope::new(lease);
+    /// # Ok(()) }
+    /// ```
+    pub async fn acquire(
+        directory: PathBuf,
+        deadline: Instant,
+    ) -> Result<Self, DirectoryLeaseError> {
+        let directory = DataDirectory::try_from(directory)?;
+        run(&WORKERS, deadline, move |control| {
+            acquire(&directory, control)
+        })
+        .await
+    }
+
+    /// Persistent UUID used for resource labels and private image aliases.
+    ///
+    /// ```no_run
+    /// # fn owner(lease: &rustack_lambda_core::docker::DirectoryLease) {
+    /// let owner = lease.owner_id();
+    /// assert!(!owner.is_nil());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn owner_id(&self) -> Uuid {
+        self.0.owner
+    }
+
+    /// Fresh UUID distinguishing this acquisition from prior runs.
+    ///
+    /// ```no_run
+    /// # fn run(lease: &rustack_lambda_core::docker::DirectoryLease) {
+    /// let run = lease.run_id();
+    /// assert!(!run.is_nil());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn run_id(&self) -> Uuid {
+        self.0.run
+    }
+
+    #[cfg(test)]
+    pub(super) fn testing(owner: Uuid, run: Uuid) -> Self {
+        let root = tempfile::tempdir().unwrap();
+        let directory = File::open(root.path()).unwrap();
+        Self(Arc::new(
+            Lease::builder()
+                .owner(owner)
+                .run(run)
+                .transaction(Arc::new(Semaphore::new(1)))
+                .code_producer(Arc::new(CodeProducerState::new()))
+                .provenance(Provenance::Journaled)
+                .guard(LeaseGuard::Testing {
+                    directory,
+                    _root: root,
+                })
+                .build(),
+        ))
+    }
+}
+
+pub(super) struct DataDirectory(PathBuf);
+impl TryFrom<PathBuf> for DataDirectory {
+    type Error = DirectoryLeaseError;
+
+    fn try_from(value: PathBuf) -> Result<Self, Self::Error> {
+        let encoded = value.as_os_str().as_encoded_bytes();
+        if encoded.len() > 4096
+            || encoded.contains(&0)
+            || value.components().count() > 128
+            || !value.is_absolute()
+            || value
+                .components()
+                .any(|part| matches!(part, Component::ParentDir))
+        {
+            return Err(DirectoryLeaseError::Configuration);
+        }
+        Ok(Self(value.components().collect()))
+    }
+}
+
+struct Control {
+    deadline: Instant,
+    cancelled: Arc<AtomicBool>,
+}
+impl Control {
+    fn check(&self) -> Result<(), DirectoryLeaseError> {
+        if self.cancelled.load(Ordering::Acquire) {
+            Err(DirectoryLeaseError::Cancelled)
+        } else if Instant::now() >= self.deadline {
+            Err(DirectoryLeaseError::Deadline)
+        } else {
+            Ok(())
+        }
+    }
+}
+struct CancelOnDrop(Arc<AtomicBool>);
+impl Drop for CancelOnDrop {
+    fn drop(&mut self) {
+        self.0.store(true, Ordering::Release);
+    }
+}
+
+async fn run<T: Send + 'static>(
+    pool: &'static Semaphore,
+    deadline: Instant,
+    work: impl FnOnce(&Control) -> Result<T, DirectoryLeaseError> + Send + 'static,
+) -> Result<T, DirectoryLeaseError> {
+    Handle::try_current().map_err(|_| DirectoryLeaseError::Worker)?;
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .filter(|duration| !duration.is_zero())
+        .ok_or(DirectoryLeaseError::Deadline)?;
+    if remaining > Duration::from_secs(60) {
+        return Err(DirectoryLeaseError::Configuration);
+    }
+    let permit = timeout_at(deadline, pool.acquire())
+        .await
+        .map_err(|_| DirectoryLeaseError::Deadline)?
+        .map_err(|_| DirectoryLeaseError::Worker)?;
+    let cancelled = Arc::new(AtomicBool::new(false));
+    let _cancel = CancelOnDrop(cancelled.clone());
+    let task = spawn_work(
+        permit,
+        Control {
+            deadline,
+            cancelled,
+        },
+        work,
+    );
+    let (value, _permit) = timeout_at(deadline, task)
+        .await
+        .map_err(|_| DirectoryLeaseError::Deadline)?
+        .map_err(|_| DirectoryLeaseError::Worker)?;
+    if Instant::now() >= deadline {
+        return Err(DirectoryLeaseError::Deadline);
+    }
+    value
+}
+
+fn spawn_work<T: Send + 'static>(
+    permit: SemaphorePermit<'static>,
+    control: Control,
+    work: impl FnOnce(&Control) -> Result<T, DirectoryLeaseError> + Send + 'static,
+) -> JoinHandle<(Result<T, DirectoryLeaseError>, SemaphorePermit<'static>)> {
+    spawn_blocking(move || {
+        let result = (|| {
+            control.check()?;
+            let value = work(&control)?;
+            control.check()?;
+            Ok(value)
+        })();
+        (result, permit)
+    })
+}
+
+fn acquire(
+    directory: &DataDirectory,
+    control: &Control,
+) -> Result<DirectoryLease, DirectoryLeaseError> {
+    acquire_profile(directory, control, Provenance::Journaled)
+}
+
+fn acquire_profile(
+    directory: &DataDirectory,
+    control: &Control,
+    requested: Provenance,
+) -> Result<DirectoryLease, DirectoryLeaseError> {
+    control.check()?;
+    let root = open_root(&directory.0, control)?;
+    match mkdirat(&root, NAMESPACE, Mode::from_bits_truncate(0o700)) {
+        Ok(()) | Err(Errno::EEXIST) => {}
+        Err(error) => return Err(error.into()),
+    }
+    control.check()?;
+    let namespace = File::from(openat(
+        &root,
+        NAMESPACE,
+        OFlag::O_RDONLY | OFlag::O_DIRECTORY | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC,
+        Mode::empty(),
+    )?);
+    let metadata = namespace.metadata()?;
+    if !metadata.is_dir() || !private(&metadata) {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    let lock = managed_file(&namespace, LOCK, OFlag::O_RDWR | OFlag::O_CREAT, 0)?;
+    match lock.try_lock() {
+        Ok(()) => {}
+        Err(TryLockError::WouldBlock) => return Err(DirectoryLeaseError::InUse),
+        Err(TryLockError::Error(error)) => return Err(error.into()),
+    }
+    control.check()?;
+    let (owner, provenance) = if let Some(owner) = read_owner(&namespace)? {
+        owner
+    } else {
+        pristine_namespace(&namespace, control)?;
+        (publish_owner(&namespace, control, requested)?, requested)
+    };
+    if requested == Provenance::CodeJournaled && provenance != requested {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    codes::check_profile(&namespace, owner, provenance)?;
+    namespace.sync_all()?;
+    root.sync_all()?;
+    control.check()?;
+    Ok(DirectoryLease(Arc::new(
+        Lease::builder()
+            .owner(owner)
+            .run(Uuid::new_v4())
+            .transaction(Arc::new(Semaphore::new(1)))
+            .code_producer(Arc::new(CodeProducerState::new()))
+            .provenance(provenance)
+            .guard(LeaseGuard::Held {
+                directory: namespace,
+                _lock: lock,
+            })
+            .build(),
+    )))
+}
+
+fn open_root(path: &Path, control: &Control) -> Result<File, DirectoryLeaseError> {
+    open_root_with_sync(path, control, File::sync_all)
+}
+
+fn open_root_with_sync(
+    path: &Path,
+    control: &Control,
+    sync: impl FnMut(&File) -> io::Result<()>,
+) -> Result<File, DirectoryLeaseError> {
+    let (anchor, missing) = root_anchor(path, control)?;
+    let mut root = File::from(open(&anchor, directory_flags(), Mode::empty())?);
+    trusted_directory(&root.metadata()?)?;
+    for component in missing.into_iter().rev() {
+        control.check()?;
+        match mkdirat(
+            &root,
+            component.as_os_str(),
+            Mode::from_bits_truncate(0o700),
+        ) {
+            Ok(()) | Err(Errno::EEXIST) => {}
+            Err(error) => return Err(error.into()),
+        }
+        let child = File::from(openat(
+            &root,
+            component.as_os_str(),
+            directory_flags(),
+            Mode::empty(),
+        )?);
+        trusted_directory(&child.metadata()?)?;
+        root = child;
+    }
+    let resolved = DataDirectory::try_from(canonicalize(path)?)?;
+    trusted_chain(&resolved.0, control)?;
+    let observed = File::from(open(&resolved.0, directory_flags(), Mode::empty())?);
+    let original = root.metadata()?;
+    let current = observed.metadata()?;
+    if original.dev() != current.dev() || original.ino() != current.ino() {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    sync_ancestors(&resolved.0, control, sync)?;
+    Ok(root)
+}
+
+fn root_anchor(
+    path: &Path,
+    control: &Control,
+) -> Result<(PathBuf, Vec<OsString>), DirectoryLeaseError> {
+    let mut missing = Vec::new();
+    let mut ancestor = path;
+    loop {
+        control.check()?;
+        match symlink_metadata(ancestor) {
+            Ok(metadata) => {
+                if ancestor == path && metadata.file_type().is_symlink() {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+                break;
+            }
+            Err(error) if error.kind() == io::ErrorKind::NotFound => {
+                missing.push(
+                    ancestor
+                        .file_name()
+                        .ok_or(DirectoryLeaseError::Configuration)?
+                        .to_owned(),
+                );
+                ancestor = ancestor
+                    .parent()
+                    .ok_or(DirectoryLeaseError::Configuration)?;
+            }
+            Err(error) => return Err(error.into()),
+        }
+    }
+    trusted_chain(ancestor, control)?;
+    let resolved = DataDirectory::try_from(canonicalize(ancestor)?)?;
+    trusted_chain(&resolved.0, control)?;
+    Ok((resolved.0, missing))
+}
+
+fn directory_flags() -> OFlag {
+    OFlag::O_RDONLY | OFlag::O_DIRECTORY | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC
+}
+
+fn trusted_directory(metadata: &Metadata) -> Result<(), DirectoryLeaseError> {
+    if !metadata.is_dir()
+        || !trusted_uid(metadata)
+        || (metadata.mode() & 0o022 != 0 && metadata.mode() & 0o1000 == 0)
+    {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    Ok(())
+}
+
+fn trusted_uid(metadata: &Metadata) -> bool {
+    metadata.uid() == geteuid().as_raw() || metadata.uid() == 0
+}
+
+fn trusted_chain(path: &Path, control: &Control) -> Result<(), DirectoryLeaseError> {
+    for ancestor in path.ancestors() {
+        control.check()?;
+        let metadata = symlink_metadata(ancestor)?;
+        if metadata.file_type().is_symlink() {
+            if !trusted_uid(&metadata) {
+                return Err(DirectoryLeaseError::InvalidState);
+            }
+        } else {
+            trusted_directory(&metadata)?;
+        }
+    }
+    Ok(())
+}
+
+fn sync_ancestors(
+    path: &Path,
+    control: &Control,
+    mut sync: impl FnMut(&File) -> io::Result<()>,
+) -> Result<(), DirectoryLeaseError> {
+    let mut device = None;
+    for ancestor in path.ancestors() {
+        control.check()?;
+        let directory = File::from(open(ancestor, directory_flags(), Mode::empty())?);
+        let metadata = directory.metadata()?;
+        trusted_directory(&metadata)?;
+        if device.is_some_and(|expected| expected != metadata.dev()) {
+            break;
+        }
+        device = Some(metadata.dev());
+        sync(&directory)?;
+    }
+    Ok(())
+}
+
+fn private(metadata: &Metadata) -> bool {
+    metadata.uid() == geteuid().as_raw() && metadata.mode() & 0o7077 == 0
+}
+
+fn managed_file(
+    directory: &File,
+    name: &str,
+    flags: OFlag,
+    maximum: u64,
+) -> Result<File, DirectoryLeaseError> {
+    let file = File::from(openat(
+        directory,
+        name,
+        flags | OFlag::O_NOFOLLOW | OFlag::O_CLOEXEC | OFlag::O_NONBLOCK | OFlag::O_NOCTTY,
+        Mode::from_bits_truncate(0o600),
+    )?);
+    let metadata = file.metadata()?;
+    if !metadata.is_file()
+        || !private(&metadata)
+        || metadata.nlink() != 1
+        || metadata.len() > maximum
+    {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    Ok(file)
+}
+
+fn read_owner(directory: &File) -> Result<Option<(Uuid, Provenance)>, DirectoryLeaseError> {
+    let mut file = match managed_file(directory, OWNER, OFlag::O_RDONLY, OWNER_BYTES as u64) {
+        Ok(file) => file,
+        Err(DirectoryLeaseError::Io(error)) if error.kind() == io::ErrorKind::NotFound => {
+            return Ok(None);
+        }
+        Err(error) => return Err(error),
+    };
+    if file.metadata()?.len() != OWNER_BYTES as u64 {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    let mut bytes = [0; OWNER_BYTES];
+    file.read_exact(&mut bytes)?;
+    let payload = bytes.get(..24).ok_or(DirectoryLeaseError::InvalidState)?;
+    let checksum = Sha256::digest(payload);
+    let expected: &[u8] = checksum.as_ref();
+    let provenance = match bytes.get(..8) {
+        Some(magic) if magic == MAGIC => Provenance::Journaled,
+        Some(magic) if magic == CODE_MAGIC => Provenance::CodeJournaled,
+        Some(magic) if magic == LEGACY_MAGIC => Provenance::Legacy,
+        _ => return Err(DirectoryLeaseError::InvalidState),
+    };
+    if bytes.get(24..) != Some(expected) {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    let owner = Uuid::from_slice(bytes.get(8..24).ok_or(DirectoryLeaseError::InvalidState)?)
+        .map_err(|_| DirectoryLeaseError::InvalidState)?;
+    if owner.is_nil() {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    Ok(Some((owner, provenance)))
+}
+
+fn pristine_namespace(directory: &File, control: &Control) -> Result<(), DirectoryLeaseError> {
+    let descriptor = openat(directory, ".", directory_flags(), Mode::empty())?;
+    let mut entries = Dir::from_fd(descriptor)?;
+    for (count, entry) in entries.iter().enumerate() {
+        control.check()?;
+        if count >= 4 {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        let entry = entry?;
+        match entry.file_name().to_bytes() {
+            b"." | b".." | b"lease.lock" => {}
+            b"owner.pending" => {
+                managed_file(directory, PENDING, OFlag::O_RDONLY, OWNER_BYTES as u64)?;
+            }
+            _ => return Err(DirectoryLeaseError::InvalidState),
+        }
+    }
+    Ok(())
+}
+
+fn publish_owner(
+    directory: &File,
+    control: &Control,
+    provenance: Provenance,
+) -> Result<Uuid, DirectoryLeaseError> {
+    control.check()?;
+    let owner = Uuid::new_v4();
+    let mut bytes = [0; OWNER_BYTES];
+    bytes
+        .get_mut(..8)
+        .ok_or(DirectoryLeaseError::InvalidState)?
+        .copy_from_slice(if provenance == Provenance::CodeJournaled {
+            CODE_MAGIC
+        } else {
+            MAGIC
+        });
+    bytes
+        .get_mut(8..24)
+        .ok_or(DirectoryLeaseError::InvalidState)?
+        .copy_from_slice(owner.as_bytes());
+    let checksum = Sha256::digest(bytes.get(..24).ok_or(DirectoryLeaseError::InvalidState)?);
+    bytes
+        .get_mut(24..)
+        .ok_or(DirectoryLeaseError::InvalidState)?
+        .copy_from_slice(checksum.as_ref());
+    let mut pending = managed_file(
+        directory,
+        PENDING,
+        OFlag::O_RDWR | OFlag::O_CREAT,
+        OWNER_BYTES as u64,
+    )?;
+    control.check()?;
+    pending.set_len(0)?;
+    pending.write_all(&bytes)?;
+    pending.sync_all()?;
+    control.check()?;
+    renameat(directory, PENDING, directory, OWNER)?;
+    directory.sync_all()?;
+    Ok(owner)
+}
+
+#[cfg(test)]
+#[path = "ownership_tests.rs"]
+mod tests;
+
+/// Exact acquisition job retained by production startup through observer loss.
+pub(super) struct DirectoryAcquisition {
+    code: bool,
+    cancelled: Arc<AtomicBool>,
+    deadline: Instant,
+    state: AcquisitionState,
+}
+enum AcquisitionState {
+    Queued {
+        directory: DataDirectory,
+        permit:
+            Pin<Box<dyn Future<Output = Result<SemaphorePermit<'static>, AcquireError>> + Send>>,
+    },
+    Running(
+        JoinHandle<(
+            Result<DirectoryLease, DirectoryLeaseError>,
+            SemaphorePermit<'static>,
+        )>,
+    ),
+    Consumed,
+}
+impl fmt::Debug for DirectoryAcquisition {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DirectoryAcquisition(<retained>)")
+    }
+}
+impl DirectoryAcquisition {
+    pub(super) fn begin(
+        directory: PathBuf,
+        deadline: Instant,
+    ) -> Result<Self, DirectoryLeaseError> {
+        Self::begin_profile(directory, deadline, false)
+    }
+    pub(super) fn begin_code(
+        directory: PathBuf,
+        deadline: Instant,
+    ) -> Result<Self, DirectoryLeaseError> {
+        Self::begin_profile(directory, deadline, true)
+    }
+    fn begin_profile(
+        directory: PathBuf,
+        deadline: Instant,
+        code: bool,
+    ) -> Result<Self, DirectoryLeaseError> {
+        let directory = DataDirectory::try_from(directory)?;
+        Handle::try_current().map_err(|_| DirectoryLeaseError::Worker)?;
+        let remaining = deadline
+            .checked_duration_since(Instant::now())
+            .ok_or(DirectoryLeaseError::Deadline)?;
+        if remaining.is_zero() || remaining > Duration::from_secs(60) {
+            return Err(DirectoryLeaseError::Configuration);
+        }
+        Ok(Self {
+            code,
+            cancelled: Arc::new(AtomicBool::new(false)),
+            deadline,
+            state: AcquisitionState::Queued {
+                directory,
+                permit: Box::pin(WORKERS.acquire()),
+            },
+        })
+    }
+    pub(super) fn cancel(&self) {
+        self.cancelled.store(true, Ordering::Release);
+    }
+    pub(super) async fn wait(
+        &mut self,
+        deadline: Instant,
+    ) -> Result<Result<DirectoryLease, DirectoryLeaseError>, DirectoryLeaseError> {
+        if matches!(self.state, AcquisitionState::Queued { .. })
+            && self.cancelled.load(Ordering::Acquire)
+        {
+            self.state = AcquisitionState::Consumed;
+            return Ok(Err(DirectoryLeaseError::Cancelled));
+        }
+        if let AcquisitionState::Queued { directory, permit } = &mut self.state {
+            let permit = timeout_at(deadline.min(self.deadline), permit)
+                .await
+                .map_err(|_| DirectoryLeaseError::Deadline)?
+                .map_err(|_| DirectoryLeaseError::Worker)?;
+            let directory = DataDirectory(directory.0.clone());
+            let control = Control {
+                deadline: self.deadline,
+                cancelled: self.cancelled.clone(),
+            };
+            let code = self.code;
+            self.state = AcquisitionState::Running(spawn_work(permit, control, move |control| {
+                if code {
+                    acquire_profile(&directory, control, Provenance::CodeJournaled)
+                } else {
+                    acquire(&directory, control)
+                }
+            }));
+        }
+        let result = match &mut self.state {
+            AcquisitionState::Running(task) => timeout_at(deadline, task)
+                .await
+                .map_err(|_| DirectoryLeaseError::Deadline)?,
+            _ => return Ok(Err(DirectoryLeaseError::Worker)),
+        };
+        // The exact blocking task is terminal, even on JoinError. Never poll it twice.
+        self.state = AcquisitionState::Consumed;
+        Ok(match result {
+            Ok((result, _permit)) => result,
+            Err(_) => Err(DirectoryLeaseError::Worker),
+        })
+    }
+}
+impl Drop for DirectoryAcquisition {
+    fn drop(&mut self) {
+        self.cancel();
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership/codes.rs b/crates/rustack-lambda-core/src/docker/ownership/codes.rs
new file mode 100644
index 00000000..258e14cd
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/codes.rs
@@ -0,0 +1,383 @@
+//! Bounded code journal, checked producer transitions and monotonic retirement.
+
+use std::{collections::BTreeSet, fs::File, io};
+
+use nix::fcntl::OFlag;
+use sha2::{Digest, Sha256};
+use tokio::time::Instant;
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use super::{
+    DirectoryLease, DirectoryLeaseError, Provenance, managed_file,
+    snapshot::{Codec, read},
+};
+use crate::docker::{DockerError, DockerKey, mutation::MutationReceipt};
+
+mod identity;
+
+const MAGIC: &[u8; 8] = b"RSDKCOD1";
+const RECORD_BYTES: usize = 194;
+const MAX_RECORDS: usize = 32;
+const MAX_BYTES: usize = 25 + MAX_RECORDS * RECORD_BYTES + 32;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(in crate::docker) enum VolumeState {
+    Planned,
+    Uncertain,
+    Known,
+    Retired,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(in crate::docker) enum LoaderState {
+    Planned,
+    Uncertain,
+    Known([u8; 32]),
+    Retired,
+}
+#[derive(Debug, Clone, Copy)]
+pub(in crate::docker) enum CodeEffect {
+    Volume,
+    Loader,
+}
+
+#[derive(Clone, PartialEq, Eq, TypedBuilder)]
+pub(in crate::docker) struct CodeRecord {
+    pub(in crate::docker) run: Uuid,
+    pub(in crate::docker) environment: Uuid,
+    resource: Uuid,
+    revision: Uuid,
+    zip: [u8; 32],
+    base: [u8; 32],
+    fingerprint: [u8; 32],
+    pub(in crate::docker) volume: VolumeState,
+    pub(in crate::docker) loader: LoaderState,
+}
+impl std::fmt::Debug for CodeRecord {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("CodeRecord(<redacted>)")
+    }
+}
+pub(in crate::docker) fn volume_key(environment: Uuid) -> Result<DockerKey, DockerError> {
+    format!("rustack-code-{environment}").parse()
+}
+
+impl CodeRecord {
+    fn valid(&self) -> bool {
+        ![self.run, self.environment, self.resource, self.revision]
+            .iter()
+            .any(Uuid::is_nil)
+            && match self.volume {
+                VolumeState::Planned | VolumeState::Uncertain => {
+                    self.loader == LoaderState::Planned
+                }
+                VolumeState::Known => true,
+                VolumeState::Retired => self.loader == LoaderState::Retired,
+            }
+    }
+    pub(in crate::docker) fn same_identity(&self, next: &Self) -> bool {
+        let mut identity = self.clone();
+        identity.volume = next.volume;
+        identity.loader = next.loader;
+        identity == *next
+    }
+    fn advances(&self, next: &Self) -> bool {
+        self.same_identity(next)
+            && next.valid()
+            && ((self.volume == next.volume
+                && matches!(
+                    (self.loader, next.loader),
+                    (
+                        LoaderState::Planned | LoaderState::Known(_),
+                        LoaderState::Retired
+                    ) | (LoaderState::Planned, LoaderState::Uncertain)
+                        | (LoaderState::Uncertain, LoaderState::Known(_))
+                ))
+                || (self.loader == next.loader
+                    && matches!(
+                        (self.volume, next.volume),
+                        (VolumeState::Planned, VolumeState::Uncertain)
+                            | (VolumeState::Uncertain, VolumeState::Known)
+                            | (VolumeState::Known, VolumeState::Retired)
+                    ))
+                || (self.volume == VolumeState::Planned
+                    && self.loader == LoaderState::Planned
+                    && next.volume == VolumeState::Retired
+                    && next.loader == LoaderState::Retired))
+    }
+}
+
+pub(super) fn check_profile(
+    directory: &File,
+    owner: Uuid,
+    provenance: Provenance,
+) -> Result<(), DirectoryLeaseError> {
+    if provenance == Provenance::CodeJournaled {
+        read::<CodeCodec>(directory, owner)?;
+    } else {
+        for name in [CodeCodec::PUBLISHED, CodeCodec::STAGING] {
+            match managed_file(directory, name, OFlag::O_RDONLY, MAX_BYTES as u64) {
+                Err(DirectoryLeaseError::Io(error)) if error.kind() == io::ErrorKind::NotFound => {}
+                _ => return Err(DirectoryLeaseError::InvalidState),
+            }
+        }
+    }
+    Ok(())
+}
+impl DirectoryLease {
+    pub(in crate::docker) async fn code_records(
+        &self,
+        deadline: Instant,
+    ) -> Result<Vec<CodeRecord>, DirectoryLeaseError> {
+        let provenance = self.0.provenance;
+        self.transaction(deadline, move |directory, owner, _control| {
+            if provenance == Provenance::CodeJournaled {
+                read::<CodeCodec>(directory, owner)
+            } else {
+                check_profile(directory, owner, provenance)?;
+                Ok(Vec::new())
+            }
+        })
+        .await
+    }
+    pub(in crate::docker) async fn prepare_code(
+        &self,
+        record: CodeRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        if !self.code_journaled()
+            || record.run != self.run_id()
+            || record.volume != VolumeState::Planned
+            || record.loader != LoaderState::Planned
+            || !record.valid()
+        {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        let run = self.run_id();
+        self.snapshot::<CodeCodec, _>(deadline, move |records| {
+            if records.iter().any(|old| old.run != run) {
+                return Err(DirectoryLeaseError::InvalidState);
+            }
+            if let Some(old) = records
+                .iter()
+                .find(|old| old.environment == record.environment)
+            {
+                return if *old == record {
+                    Ok(())
+                } else {
+                    Err(DirectoryLeaseError::InvalidState)
+                };
+            }
+            if records.len() >= MAX_RECORDS {
+                return Err(DirectoryLeaseError::InvalidState);
+            }
+            records.push(record);
+            Ok(())
+        })
+        .await
+    }
+    pub(in crate::docker) async fn abandon_code(
+        &self,
+        record: CodeRecord,
+        effect: CodeEffect,
+        receipt: &MutationReceipt,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        if !self.code_journaled() || record.run != self.run_id() || !receipt.definitely_unissued() {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        let mut next = record.clone();
+        match (effect, record.volume, record.loader) {
+            (CodeEffect::Volume, VolumeState::Uncertain, LoaderState::Planned) => {
+                next.volume = VolumeState::Retired;
+                next.loader = LoaderState::Retired;
+            }
+            (CodeEffect::Loader, VolumeState::Known, LoaderState::Uncertain) => {
+                next.loader = LoaderState::Retired;
+            }
+            _ => return Err(DirectoryLeaseError::InvalidState),
+        }
+        self.replace_code(record, next, deadline).await
+    }
+    pub(in crate::docker) async fn advance_code(
+        &self,
+        old: CodeRecord,
+        next: CodeRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        let arming = (old.volume == VolumeState::Planned && next.volume == VolumeState::Uncertain)
+            || (old.loader == LoaderState::Planned && next.loader == LoaderState::Uncertain);
+        if !self.code_journaled() || !old.advances(&next) || (arming && old.run != self.run_id()) {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        self.replace_code(old, next, deadline).await
+    }
+    async fn replace_code(
+        &self,
+        old: CodeRecord,
+        next: CodeRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        self.snapshot::<CodeCodec, _>(deadline, move |records| {
+            let saved = records
+                .iter_mut()
+                .find(|record| record.environment == old.environment)
+                .ok_or(DirectoryLeaseError::InvalidState)?;
+            if *saved == next {
+                return Ok(());
+            }
+            if *saved != old {
+                return Err(DirectoryLeaseError::InvalidState);
+            }
+            *saved = next;
+            Ok(())
+        })
+        .await
+    }
+    pub(in crate::docker) async fn settle_code(
+        &self,
+        record: CodeRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        if !self.code_journaled()
+            || record.volume != VolumeState::Retired
+            || record.loader != LoaderState::Retired
+        {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        self.snapshot::<CodeCodec, _>(deadline, move |records| {
+            if let Some(position) = records
+                .iter()
+                .position(|saved| saved.environment == record.environment)
+            {
+                if records.get(position) != Some(&record) {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+                records.remove(position);
+            }
+            Ok(())
+        })
+        .await
+    }
+}
+
+pub(super) struct CodeCodec;
+impl Codec for CodeCodec {
+    type Record = CodeRecord;
+    const PUBLISHED: &'static str = "code.v1";
+    const STAGING: &'static str = "code.pending";
+    const MAX_BYTES: usize = MAX_BYTES;
+    fn encode(owner: Uuid, records: &[CodeRecord]) -> Result<Vec<u8>, DirectoryLeaseError> {
+        if owner.is_nil() || records.len() > MAX_RECORDS {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        let mut bytes = Vec::with_capacity(MAX_BYTES);
+        bytes.extend_from_slice(MAGIC);
+        bytes.extend_from_slice(owner.as_bytes());
+        bytes.push(u8::try_from(records.len()).map_err(|_| DirectoryLeaseError::InvalidState)?);
+        for record in records {
+            for id in [
+                record.run,
+                record.environment,
+                record.resource,
+                record.revision,
+            ] {
+                bytes.extend_from_slice(id.as_bytes());
+            }
+            for digest in [record.zip, record.base, record.fingerprint] {
+                bytes.extend_from_slice(&digest);
+            }
+            bytes.push(match record.volume {
+                VolumeState::Planned => 0,
+                VolumeState::Uncertain => 1,
+                VolumeState::Known => 2,
+                VolumeState::Retired => 3,
+            });
+            bytes.push(match record.loader {
+                LoaderState::Planned => 0,
+                LoaderState::Uncertain => 1,
+                LoaderState::Known(_) => 2,
+                LoaderState::Retired => 3,
+            });
+            bytes.extend_from_slice(&match record.loader {
+                LoaderState::Known(id) => id,
+                _ => [0; 32],
+            });
+        }
+        bytes.extend_from_slice(&Sha256::digest(&bytes));
+        Self::decode(&bytes, owner)?;
+        Ok(bytes)
+    }
+    fn decode(bytes: &[u8], owner: Uuid) -> Result<Vec<CodeRecord>, DirectoryLeaseError> {
+        let invalid = || DirectoryLeaseError::InvalidState;
+        let count = usize::from(*bytes.get(24).ok_or_else(invalid)?);
+        let body_len = count
+            .checked_mul(RECORD_BYTES)
+            .and_then(|n| n.checked_add(25))
+            .ok_or_else(invalid)?;
+        let expected_len = body_len.checked_add(32).ok_or_else(invalid)?;
+        if owner.is_nil()
+            || count > MAX_RECORDS
+            || bytes.len() != expected_len
+            || bytes.get(..8) != Some(MAGIC.as_slice())
+            || bytes.get(8..24) != Some(owner.as_bytes().as_slice())
+            || bytes.get(body_len..)
+                != Some(Sha256::digest(bytes.get(..body_len).ok_or_else(invalid)?).as_slice())
+        {
+            return Err(invalid());
+        }
+        let mut records = Vec::with_capacity(count);
+        let mut identities = BTreeSet::new();
+        for row in bytes
+            .get(25..body_len)
+            .ok_or_else(invalid)?
+            .as_chunks::<RECORD_BYTES>()
+            .0
+        {
+            let uuid = |start| {
+                Uuid::from_slice(row.get(start..start + 16).ok_or_else(invalid)?)
+                    .map_err(|_| invalid())
+            };
+            let digest = |start| -> Result<[u8; 32], DirectoryLeaseError> {
+                row.get(start..start + 32)
+                    .ok_or_else(invalid)?
+                    .try_into()
+                    .map_err(|_| invalid())
+            };
+            let volume = match row.get(160) {
+                Some(0) => VolumeState::Planned,
+                Some(1) => VolumeState::Uncertain,
+                Some(2) => VolumeState::Known,
+                Some(3) => VolumeState::Retired,
+                _ => return Err(invalid()),
+            };
+            let id = digest(162)?;
+            let loader = match row.get(161) {
+                Some(0) if id == [0; 32] => LoaderState::Planned,
+                Some(1) if id == [0; 32] => LoaderState::Uncertain,
+                Some(2) => LoaderState::Known(id),
+                Some(3) if id == [0; 32] => LoaderState::Retired,
+                _ => return Err(invalid()),
+            };
+            let record = CodeRecord::builder()
+                .run(uuid(0)?)
+                .environment(uuid(16)?)
+                .resource(uuid(32)?)
+                .revision(uuid(48)?)
+                .zip(digest(64)?)
+                .base(digest(96)?)
+                .fingerprint(digest(128)?)
+                .volume(volume)
+                .loader(loader)
+                .build();
+            if !record.valid() || !identities.insert(record.environment) {
+                return Err(invalid());
+            }
+            records.push(record);
+        }
+        Ok(records)
+    }
+}
+
+#[cfg(test)]
+pub(in crate::docker) mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/ownership/codes/identity.rs b/crates/rustack-lambda-core/src/docker/ownership/codes/identity.rs
new file mode 100644
index 00000000..bd8be09a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/codes/identity.rs
@@ -0,0 +1,119 @@
+//! Exact recorded identity checks before any code-resource deletion.
+
+use std::collections::BTreeMap;
+
+use uuid::Uuid;
+
+use super::{CodeRecord, LoaderState};
+use crate::docker::{
+    DockerError, DockerKey,
+    models::{ContainerInspectResponse, ContainerStateStatusEnum, Volume, VolumeScopeEnum},
+};
+
+impl CodeRecord {
+    pub(in crate::docker) fn volume_key(&self) -> Result<DockerKey, DockerError> {
+        super::volume_key(self.environment)
+    }
+    pub(in crate::docker) fn loader_key(&self) -> Result<DockerKey, DockerError> {
+        match self.loader {
+            LoaderState::Known(id) => hex::encode(id).parse(),
+            _ => format!("rustack-code-loader-{}", self.environment).parse(),
+        }
+    }
+    pub(in crate::docker) fn labels(&self, owner: Uuid, loader: bool) -> BTreeMap<String, String> {
+        [
+            ("ownerId", owner.to_string()),
+            ("runId", self.run.to_string()),
+            ("environmentId", self.environment.to_string()),
+            ("functionResourceId", self.resource.to_string()),
+            ("revisionId", self.revision.to_string()),
+            ("codeSha256", hex::encode(self.zip)),
+            ("baseFingerprint", hex::encode(self.fingerprint)),
+            ("role", if loader { "code-loader" } else { "code" }.into()),
+        ]
+        .into_iter()
+        .map(|(key, value)| (format!("rustack.lambda.{key}"), value))
+        .collect()
+    }
+    pub(in crate::docker) fn owned_volume(
+        &self,
+        owner: Uuid,
+        volume: &Volume,
+    ) -> Result<(), DockerError> {
+        let labels = self.labels(owner, false);
+        if volume.name != self.volume_key()?.as_str()
+            || volume.driver != "local"
+            || volume.scope != Some(VolumeScopeEnum::LOCAL)
+            || !volume.options.is_empty()
+            || volume.labels.len() != labels.len()
+            || !labels
+                .iter()
+                .all(|(key, value)| volume.labels.get(key) == Some(value))
+        {
+            return Err(DockerError::Quarantined);
+        }
+        Ok(())
+    }
+    pub(in crate::docker) fn owned_loader(
+        &self,
+        owner: Uuid,
+        inspected: &ContainerInspectResponse,
+    ) -> Result<[u8; 32], DockerError> {
+        let config = inspected.config.as_ref().ok_or(DockerError::Protocol)?;
+        let labels = config.labels.as_ref().ok_or(DockerError::Quarantined)?;
+        let expected = self.labels(owner, true);
+        let image = format!("sha256:{}", hex::encode(self.base));
+        let id = inspected.id.as_deref().ok_or(DockerError::Protocol)?;
+        let mut decoded = [0; 32];
+        if id.len() != 64
+            || !id
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+        {
+            return Err(DockerError::Quarantined);
+        }
+        hex::decode_to_slice(id, &mut decoded).map_err(|_| DockerError::Quarantined)?;
+        let state = inspected.state.as_ref().ok_or(DockerError::Protocol)?;
+        let mounts = inspected
+            .mounts
+            .as_deref()
+            .ok_or(DockerError::Quarantined)?;
+        let [mount] = mounts else {
+            return Err(DockerError::Quarantined);
+        };
+        if matches!(self.loader, LoaderState::Known(known) if known != decoded)
+            || inspected.name.as_deref()
+                != Some(format!("/rustack-code-loader-{}", self.environment).as_str())
+            || config.image.as_deref() != Some(image.as_str())
+            || inspected.image.as_deref() != Some(image.as_str())
+            || labels.len() > 64
+            || labels.iter().any(|(key, value)| {
+                key.is_empty()
+                    || key.len() > 128
+                    || value.len() > 256
+                    || !key
+                        .bytes()
+                        .all(|byte| byte.is_ascii_alphanumeric() || b"_.-".contains(&byte))
+                    || value.chars().any(char::is_control)
+                    || (key.starts_with("rustack.lambda.") && expected.get(key) != Some(value))
+            })
+            || !expected
+                .iter()
+                .all(|(key, value)| labels.get(key) == Some(value))
+            || state.running != Some(false)
+            || state.status != Some(ContainerStateStatusEnum::CREATED)
+            || !matches!(
+                state.started_at.as_deref(),
+                None | Some("" | "0001-01-01T00:00:00Z" | "0001-01-01T00:00:00.000000000Z")
+            )
+            || mount.typ.as_deref() != Some("volume")
+            || mount.driver.as_deref() != Some("local")
+            || mount.name.as_deref() != Some(self.volume_key()?.as_str())
+            || mount.destination.as_deref() != Some("/var/task")
+            || mount.rw != Some(true)
+        {
+            return Err(DockerError::Quarantined);
+        }
+        Ok(decoded)
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership/codes/tests.rs b/crates/rustack-lambda-core/src/docker/ownership/codes/tests.rs
new file mode 100644
index 00000000..38d141d7
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/codes/tests.rs
@@ -0,0 +1,334 @@
+use std::{
+    fs::Permissions,
+    os::unix::fs::{PermissionsExt, symlink},
+    time::Duration,
+};
+
+use rstest::rstest;
+use tokio::{
+    fs::{read, set_permissions, write},
+    time::Instant,
+};
+use uuid::Uuid;
+
+use super::*;
+use crate::docker::{
+    binding::DaemonIdentity,
+    ownership::{LEGACY_MAGIC, MAGIC, NAMESPACE, OWNER},
+    tests::DAEMON_ID,
+};
+
+pub(in crate::docker) fn record(run: Uuid, volume: VolumeState, loader: LoaderState) -> CodeRecord {
+    CodeRecord::builder()
+        .run(run)
+        .environment(Uuid::new_v4())
+        .resource(Uuid::new_v4())
+        .revision(Uuid::new_v4())
+        .zip([0x11; 32])
+        .base([0xaa; 32])
+        .fingerprint([0xbb; 32])
+        .volume(volume)
+        .loader(loader)
+        .build()
+}
+pub(in crate::docker) async fn publish(directory: &DirectoryLease, records: Vec<CodeRecord>) {
+    assert!(directory.code_journaled());
+    directory
+        .snapshot::<CodeCodec, _>(deadline(), move |saved| {
+            *saved = records;
+            Ok(())
+        })
+        .await
+        .unwrap();
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn signed(bytes: &mut [u8]) {
+    let end = bytes.len() - 32;
+    let sum = Sha256::digest(&bytes[..end]);
+    bytes[end..].copy_from_slice(&sum);
+}
+
+#[rstest]
+#[case(0)]
+#[case(8)]
+#[case(24)]
+#[case(25)]
+#[case(41)]
+#[case(57)]
+#[case(73)]
+#[case(185)]
+#[case(186)]
+#[case(187)]
+fn test_should_reject_corrupt_canonical_fields_even_with_recomputed_checksum(
+    #[case] offset: usize,
+) {
+    // Make the former 0xff owner-byte no-op a deterministic regression case.
+    let owner = Uuid::from_u128(u128::MAX);
+    let row = record(Uuid::new_v4(), VolumeState::Known, LoaderState::Planned);
+    let mut bytes = CodeCodec::encode(owner, &[row]).unwrap();
+    if matches!(offset, 25 | 41 | 57 | 73) {
+        bytes[offset..offset + 16].fill(0);
+    } else if offset == 8 {
+        bytes[offset] ^= 0xff;
+    } else {
+        bytes[offset] = 0xff;
+    }
+    signed(&mut bytes);
+    assert!(matches!(
+        CodeCodec::decode(&bytes, owner),
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+}
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(10)]
+#[case(24)]
+#[case(25)]
+#[case(218)]
+#[case(250)]
+fn test_should_reject_truncation_and_appended_data(#[case] length: usize) {
+    let owner = Uuid::new_v4();
+    let row = record(
+        Uuid::new_v4(),
+        VolumeState::Known,
+        LoaderState::Known([0xcc; 32]),
+    );
+    let bytes = CodeCodec::encode(owner, &[row]).unwrap();
+    assert_eq!(bytes.len(), 251);
+    assert!(CodeCodec::decode(&bytes[..length], owner).is_err());
+    let mut extra = bytes.clone();
+    extra.push(0);
+    assert!(CodeCodec::decode(&extra, owner).is_err());
+}
+#[test]
+fn test_should_bound_records_and_reject_duplicate_environments_and_wrong_owner() {
+    let owner = Uuid::new_v4();
+    let rows = (0..32)
+        .map(|_| record(Uuid::new_v4(), VolumeState::Known, LoaderState::Uncertain))
+        .collect::<Vec<_>>();
+    let bytes = CodeCodec::encode(owner, &rows).unwrap();
+    assert_eq!(bytes.len(), 6265);
+    assert_eq!(CodeCodec::decode(&bytes, owner).unwrap(), rows);
+    assert!(CodeCodec::decode(&bytes, Uuid::new_v4()).is_err());
+    let mut too_many = rows.clone();
+    too_many.push(rows[0].clone());
+    assert!(CodeCodec::encode(owner, &too_many).is_err());
+    let mut duplicate = rows[0].clone();
+    duplicate.run = Uuid::new_v4();
+    assert!(CodeCodec::encode(owner, &[rows[0].clone(), duplicate]).is_err());
+    assert!(CodeCodec::encode(Uuid::nil(), &[]).is_err());
+    let mut damaged = bytes;
+    damaged[100] ^= 1;
+    assert!(CodeCodec::decode(&damaged, owner).is_err());
+}
+#[rstest]
+#[case(VolumeState::Planned, LoaderState::Uncertain)]
+#[case(VolumeState::Planned, LoaderState::Retired)]
+#[case(VolumeState::Uncertain, LoaderState::Known([1;32]))]
+#[case(VolumeState::Retired, LoaderState::Planned)]
+#[case(VolumeState::Retired, LoaderState::Known([1;32]))]
+fn test_should_reject_impossible_effect_states(
+    #[case] volume: VolumeState,
+    #[case] loader: LoaderState,
+) {
+    assert!(CodeCodec::encode(Uuid::new_v4(), &[record(Uuid::new_v4(), volume, loader)]).is_err());
+}
+#[tokio::test]
+async fn test_should_create_explicit_code_provenance_and_reopen_without_rewriting_owner() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    lease.require_journaled().unwrap();
+    assert!(lease.code_journaled());
+    let owner = lease.owner_id();
+    let run = lease.run_id();
+    let path = root.path().join(NAMESPACE);
+    let before = read(path.join(OWNER)).await.unwrap();
+    assert_eq!(&before[..8], b"RSDKOWN3");
+    let row = record(run, VolumeState::Known, LoaderState::Known([0xcc; 32]));
+    publish(&lease, vec![row.clone()]).await;
+    drop(lease);
+    let lease = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    assert_eq!(owner, lease.owner_id());
+    assert_ne!(run, lease.run_id());
+    assert_eq!(lease.code_records(deadline()).await.unwrap(), [row]);
+    assert_eq!(read(path.join(OWNER)).await.unwrap(), before);
+}
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_refuse_old_roots_without_automatic_upgrade(#[case] legacy: bool) {
+    let root = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    drop(lease);
+    let path = root.path().join(NAMESPACE).join(OWNER);
+    let mut bytes = read(&path).await.unwrap();
+    if legacy {
+        bytes[..8].copy_from_slice(LEGACY_MAGIC);
+        signed(&mut bytes);
+        write(&path, &bytes).await.unwrap();
+    }
+    assert!(matches!(
+        DirectoryLease::acquire_code(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert_eq!(read(path).await.unwrap(), bytes);
+    assert_eq!(&bytes[..8], if legacy { LEGACY_MAGIC } else { MAGIC });
+}
+#[rstest]
+#[case("code.v1")]
+#[case("code.pending")]
+#[tokio::test]
+async fn test_should_refuse_any_code_file_in_image_namespace_on_acquire_and_binding(
+    #[case] name: &str,
+) {
+    let root = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let identity = DaemonIdentity::try_from(DAEMON_ID).unwrap();
+    lease.bind_daemon(identity, deadline()).await.unwrap();
+    let path = root.path().join(NAMESPACE).join(name);
+    write(&path, []).await.unwrap();
+    set_permissions(&path, Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    assert!(lease.bind_daemon(identity, deadline()).await.is_err());
+    assert!(lease.code_records(deadline()).await.is_err());
+    drop(lease);
+    assert!(
+        DirectoryLease::acquire(root.path().into(), deadline())
+            .await
+            .is_err()
+    );
+}
+#[rstest]
+#[case("code.v1")]
+#[case("code.pending")]
+#[tokio::test]
+async fn test_should_refuse_unsafe_code_files_and_preserve_outside_content(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let outside = root.path().join("outside");
+    write(&outside, b"preserve").await.unwrap();
+    let path = root.path().join(NAMESPACE).join(name);
+    symlink(&outside, &path).unwrap();
+    assert!(lease.code_records(deadline()).await.is_err());
+    tokio::fs::remove_file(&path).await.unwrap();
+    write(&path, vec![0; MAX_BYTES + 1]).await.unwrap();
+    set_permissions(&path, Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    assert!(lease.code_records(deadline()).await.is_err());
+    assert_eq!(read(outside).await.unwrap(), b"preserve");
+}
+#[tokio::test]
+async fn test_should_tolerate_private_torn_staging_but_refuse_missing_daemon_binding_over_code() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let row = record(lease.run_id(), VolumeState::Known, LoaderState::Planned);
+    publish(&lease, vec![row.clone()]).await;
+    let path = root.path().join(NAMESPACE).join("code.pending");
+    write(&path, b"torn").await.unwrap();
+    set_permissions(&path, Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    assert_eq!(lease.code_records(deadline()).await.unwrap(), [row]);
+    assert!(
+        lease
+            .bind_daemon(DaemonIdentity::try_from(DAEMON_ID).unwrap(), deadline())
+            .await
+            .is_err()
+    );
+    assert!(!root.path().join(NAMESPACE).join("daemon.v1").exists());
+}
+#[tokio::test]
+async fn test_should_compare_and_swap_monotonic_recovery_state_and_reject_early_erasure() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let row = record(lease.run_id(), VolumeState::Known, LoaderState::Uncertain);
+    publish(&lease, vec![row.clone()]).await;
+    assert!(lease.settle_code(row.clone(), deadline()).await.is_err());
+    let mut next = row.clone();
+    next.loader = LoaderState::Known([0xcc; 32]);
+    lease
+        .advance_code(row.clone(), next.clone(), deadline())
+        .await
+        .unwrap();
+    lease
+        .advance_code(row.clone(), next.clone(), deadline())
+        .await
+        .unwrap();
+    let mut conflict = next.clone();
+    conflict.loader = LoaderState::Known([0xdd; 32]);
+    assert!(lease.advance_code(row, conflict, deadline()).await.is_err());
+    let mut retired = next.clone();
+    retired.loader = LoaderState::Retired;
+    lease
+        .advance_code(next, retired.clone(), deadline())
+        .await
+        .unwrap();
+    let mut done = retired.clone();
+    done.volume = VolumeState::Retired;
+    lease
+        .advance_code(retired, done.clone(), deadline())
+        .await
+        .unwrap();
+    lease.settle_code(done.clone(), deadline()).await.unwrap();
+    lease.settle_code(done, deadline()).await.unwrap();
+    assert_eq!(lease.code_records(deadline()).await.unwrap(), []);
+}
+
+#[rstest]
+#[case("code.v1", false)]
+#[case("code.pending", false)]
+#[case("code.v1", true)]
+#[case("code.pending", true)]
+#[tokio::test]
+async fn test_should_reject_public_mode_and_hardlinked_code_files(
+    #[case] name: &str,
+    #[case] hardlink: bool,
+) {
+    let root = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let path = root.path().join(NAMESPACE).join(name);
+    if hardlink {
+        let outside = root.path().join("outside");
+        write(&outside, []).await.unwrap();
+        set_permissions(&outside, Permissions::from_mode(0o600))
+            .await
+            .unwrap();
+        tokio::fs::hard_link(&outside, &path).await.unwrap();
+    } else {
+        write(&path, []).await.unwrap();
+        set_permissions(&path, Permissions::from_mode(0o644))
+            .await
+            .unwrap();
+    }
+    assert!(matches!(
+        lease.code_records(deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    drop(lease);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership/daemon.rs b/crates/rustack-lambda-core/src/docker/ownership/daemon.rs
new file mode 100644
index 00000000..d6ef9cc3
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/daemon.rs
@@ -0,0 +1,91 @@
+//! Immutable owner/engine association, published before any journaled effect.
+
+use sha2::{Digest, Sha256};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{
+    DirectoryLease, DirectoryLeaseError,
+    codes::{CodeCodec, check_profile},
+    images::ImageCodec,
+    journal::ContainerCodec,
+    snapshot::{Codec, read, write},
+};
+use crate::docker::binding::DaemonIdentity;
+
+const MAGIC: &[u8; 8] = b"RSDKDMD1";
+const BYTES: usize = 72;
+
+impl DirectoryLease {
+    pub(in crate::docker) async fn bind_daemon(
+        &self,
+        identity: DaemonIdentity,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        let provenance = self.0.provenance;
+        self.transaction(deadline, move |directory, owner, control| {
+            check_profile(directory, owner, provenance)?;
+            let existing = read::<DaemonCodec>(directory, owner)?;
+            control.check()?;
+            match existing.as_slice() {
+                [saved] if *saved == identity => Ok(()),
+                [] => {
+                    if !read::<ContainerCodec>(directory, owner)?.is_empty()
+                        || !read::<ImageCodec>(directory, owner)?.is_empty()
+                        || !read::<CodeCodec>(directory, owner)?.is_empty()
+                    {
+                        return Err(DirectoryLeaseError::InvalidState);
+                    }
+                    write::<DaemonCodec>(directory, owner, &[identity], control)
+                }
+                _ => Err(DirectoryLeaseError::InvalidState),
+            }
+        })
+        .await
+    }
+}
+
+#[derive(Debug)]
+struct DaemonCodec;
+impl Codec for DaemonCodec {
+    type Record = DaemonIdentity;
+    const PUBLISHED: &'static str = "daemon.v1";
+    const STAGING: &'static str = "daemon.pending";
+    const MAX_BYTES: usize = BYTES;
+
+    fn encode(owner: Uuid, records: &[DaemonIdentity]) -> Result<Vec<u8>, DirectoryLeaseError> {
+        let [identity] = records else {
+            return Err(DirectoryLeaseError::InvalidState);
+        };
+        if owner.is_nil() {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        let mut bytes = Vec::with_capacity(BYTES);
+        bytes.extend_from_slice(MAGIC);
+        bytes.extend_from_slice(owner.as_bytes());
+        bytes.extend_from_slice(identity.uuid().as_bytes());
+        bytes.extend_from_slice(&Sha256::digest(&bytes));
+        Ok(bytes)
+    }
+
+    fn decode(bytes: &[u8], owner: Uuid) -> Result<Vec<DaemonIdentity>, DirectoryLeaseError> {
+        let invalid = || DirectoryLeaseError::InvalidState;
+        if owner.is_nil()
+            || bytes.len() != BYTES
+            || bytes.get(..8) != Some(MAGIC.as_slice())
+            || bytes.get(8..24) != Some(owner.as_bytes().as_slice())
+            || bytes.get(40..)
+                != Some(Sha256::digest(bytes.get(..40).ok_or_else(invalid)?).as_slice())
+        {
+            return Err(invalid());
+        }
+        let uuid =
+            Uuid::from_slice(bytes.get(24..40).ok_or_else(invalid)?).map_err(|_| invalid())?;
+        Ok(vec![
+            DaemonIdentity::from_uuid(uuid).map_err(|_| invalid())?,
+        ])
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/ownership/daemon/tests.rs b/crates/rustack-lambda-core/src/docker/ownership/daemon/tests.rs
new file mode 100644
index 00000000..5d033d65
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/daemon/tests.rs
@@ -0,0 +1,207 @@
+use std::{
+    fs::Permissions,
+    os::unix::fs::{PermissionsExt, symlink},
+    sync::{Arc, mpsc::channel as blocking_channel},
+    time::Duration,
+};
+
+use rstest::rstest;
+use sha2::{Digest, Sha256};
+use tokio::{
+    fs::{read, remove_file, set_permissions, write},
+    spawn,
+    sync::oneshot::channel as oneshot_channel,
+    time::{Instant, timeout},
+};
+use uuid::Uuid;
+
+use super::{BYTES, DaemonCodec};
+use crate::docker::{
+    DirectoryLease, DirectoryLeaseError, EnvironmentPlan, ImagePinScope,
+    binding::DaemonIdentity,
+    ownership::{
+        ContainerRecord, ImageRecord, NAMESPACE,
+        snapshot::{Codec, write as write_snapshot},
+    },
+    plan::{
+        ContainerRole,
+        tests::{image_with, policy, revision},
+    },
+    tests::DAEMON_ID,
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn identity() -> DaemonIdentity {
+    DaemonIdentity::try_from(DAEMON_ID).unwrap()
+}
+
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(2)]
+#[case(3)]
+#[case(4)]
+#[case(5)]
+#[case(6)]
+fn test_should_reject_damaged_daemon_binding(#[case] corruption: u8) {
+    let owner = Uuid::new_v4();
+    let mut bytes = DaemonCodec::encode(owner, &[identity()]).unwrap();
+    assert_eq!(bytes.len(), BYTES);
+    assert_eq!(DaemonCodec::decode(&bytes, owner).unwrap(), [identity()]);
+    match corruption {
+        0 => bytes[0] ^= 1,
+        1 => bytes[8] ^= 1,
+        2 => bytes[24..40].fill(0),
+        3 => {
+            bytes.pop();
+        }
+        4 => bytes.push(0),
+        5 => bytes[40] ^= 1,
+        _ => bytes[8..24].fill(0),
+    }
+    if matches!(corruption, 0 | 1 | 2 | 6) {
+        let sum = Sha256::digest(&bytes[..40]);
+        bytes[40..].copy_from_slice(&sum);
+    }
+    assert!(matches!(
+        DaemonCodec::decode(&bytes, owner),
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_persist_immutable_identity_across_reacquisition_and_torn_staging() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let owner = directory.owner_id();
+    directory.bind_daemon(identity(), deadline()).await.unwrap();
+    let path = root.path().join(NAMESPACE);
+    let before = read(path.join("daemon.v1")).await.unwrap();
+    write(path.join("daemon.pending"), b"torn").await.unwrap();
+    set_permissions(path.join("daemon.pending"), Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    directory.bind_daemon(identity(), deadline()).await.unwrap();
+    drop(directory);
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    assert_eq!(directory.owner_id(), owner);
+    directory.bind_daemon(identity(), deadline()).await.unwrap();
+    let other = DaemonIdentity::from_uuid(Uuid::new_v4()).unwrap();
+    assert!(matches!(
+        directory.bind_daemon(other, deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert_eq!(read(path.join("daemon.v1")).await.unwrap(), before);
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_reject_missing_binding_over_any_journal(#[case] container: bool) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    if container {
+        let plan = EnvironmentPlan::new(
+            directory.clone(),
+            image_with("1000", vec![]),
+            Arc::new(revision()),
+            policy(),
+        )
+        .unwrap();
+        directory
+            .prepare_container(
+                ContainerRecord::from_plan(&plan, ContainerRole::Relay).unwrap(),
+                deadline(),
+            )
+            .await
+            .unwrap();
+    } else {
+        let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+        let record =
+            ImageRecord::new(&pin, &format!("sha256:{}", "a".repeat(64)).parse().unwrap()).unwrap();
+        directory.prepare_image(record, deadline()).await.unwrap();
+    }
+    assert!(matches!(
+        directory.bind_daemon(identity(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert!(!root.path().join(NAMESPACE).join("daemon.v1").exists());
+}
+
+#[rstest]
+#[case("daemon.v1")]
+#[case("daemon.pending")]
+#[tokio::test]
+async fn test_should_refuse_unsafe_or_oversized_binding_files(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let outside = root.path().join("outside");
+    write(&outside, b"preserve").await.unwrap();
+    let path = root.path().join(NAMESPACE).join(name);
+    symlink(&outside, &path).unwrap();
+    assert!(directory.bind_daemon(identity(), deadline()).await.is_err());
+    remove_file(&path).await.unwrap();
+    write(&path, vec![0; BYTES + 1]).await.unwrap();
+    set_permissions(&path, Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    assert!(directory.bind_daemon(identity(), deadline()).await.is_err());
+    assert_eq!(read(outside).await.unwrap(), b"preserve");
+}
+
+#[tokio::test]
+async fn test_should_retain_published_binding_and_serial_lease_after_observer_loss() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let retained = directory.clone();
+    let (entered, observed) = oneshot_channel();
+    let (release, barrier) = blocking_channel();
+    let task = spawn(async move {
+        retained
+            .transaction(deadline(), move |directory, owner, control| {
+                write_snapshot::<DaemonCodec>(directory, owner, &[identity()], control)?;
+                entered.send(()).unwrap();
+                barrier.recv().unwrap();
+                Ok(())
+            })
+            .await
+    });
+    observed.await.unwrap();
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    let copy = directory.clone();
+    let other = DaemonIdentity::from_uuid(Uuid::new_v4()).unwrap();
+    let mut retry = spawn(async move { copy.bind_daemon(other, deadline()).await });
+    assert!(
+        timeout(Duration::from_millis(30), &mut retry)
+            .await
+            .is_err()
+    );
+    drop(directory);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    release.send(()).unwrap();
+    assert!(matches!(
+        retry.await.unwrap(),
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    let next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    next.bind_daemon(identity(), deadline()).await.unwrap();
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership/images.rs b/crates/rustack-lambda-core/src/docker/ownership/images.rs
new file mode 100644
index 00000000..611dcf85
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/images.rs
@@ -0,0 +1,240 @@
+//! Persistent private image-tag intent; unknown absence never proves settlement.
+
+use std::{collections::BTreeSet, fmt};
+
+use sha2::{Digest, Sha256};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{DirectoryLease, DirectoryLeaseError, snapshot::Codec};
+use crate::{
+    artifact::Sha256Digest,
+    docker::{DockerError, ImagePin},
+};
+
+const PUBLISHED: &str = "pins.v1";
+const STAGING: &str = "pins.pending";
+const MAGIC: &[u8; 8] = b"RSDKPIN1";
+const RECORD_BYTES: usize = 65;
+const MAX_RECORDS: usize = 8192;
+const MAX_BYTES: usize = 26 + MAX_RECORDS * RECORD_BYTES + 32;
+
+#[derive(Clone, PartialEq, Eq)]
+pub(in crate::docker) struct ImageRecord {
+    pub(in crate::docker) run: Uuid,
+    pin: Uuid,
+    image: [u8; 32],
+    pub(in crate::docker) committed: bool,
+}
+impl fmt::Debug for ImageRecord {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ImageRecord(<redacted>)")
+    }
+}
+impl ImageRecord {
+    pub(in crate::docker) fn new(
+        pin: &ImagePin,
+        image: &Sha256Digest,
+    ) -> Result<Self, DockerError> {
+        let mut digest = [0; 32];
+        hex::decode_to_slice(
+            image
+                .as_str()
+                .strip_prefix("sha256:")
+                .ok_or(DockerError::Configuration)?,
+            &mut digest,
+        )
+        .map_err(|_| DockerError::Configuration)?;
+        Ok(Self {
+            run: pin.run,
+            pin: pin.id,
+            image: digest,
+            committed: false,
+        })
+    }
+    pub(in crate::docker) fn pin(
+        &self,
+        directory: &DirectoryLease,
+    ) -> Result<ImagePin, DockerError> {
+        ImagePin::historical(directory.clone(), self.run, self.pin)
+    }
+    pub(in crate::docker) fn expected(&self) -> Result<Sha256Digest, DockerError> {
+        format!("sha256:{}", hex::encode(self.image))
+            .parse()
+            .map_err(DockerError::from)
+    }
+    fn same_key(&self, other: &Self) -> bool {
+        self.run == other.run && self.pin == other.pin
+    }
+    fn identity(&self, other: &Self) -> bool {
+        self.same_key(other) && self.image == other.image
+    }
+}
+impl DirectoryLease {
+    pub(in crate::docker) async fn image_records(
+        &self,
+        deadline: Instant,
+    ) -> Result<Vec<ImageRecord>, DirectoryLeaseError> {
+        self.snapshot::<ImageCodec, _>(deadline, |records| Ok(records.clone()))
+            .await
+    }
+    pub(in crate::docker) async fn prepare_image(
+        &self,
+        record: ImageRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        if record.run != self.run_id() {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        self.snapshot::<ImageCodec, _>(deadline, move |records| {
+            if let Some(old) = records.iter().find(|old| old.same_key(&record)) {
+                if !old.identity(&record) {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+            } else {
+                if records.len() >= MAX_RECORDS {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+                records.push(record);
+            }
+            Ok(())
+        })
+        .await
+    }
+    pub(in crate::docker) async fn commit_image(
+        &self,
+        record: ImageRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        self.snapshot::<ImageCodec, _>(deadline, move |records| {
+            let old = records
+                .iter_mut()
+                .find(|old| old.same_key(&record))
+                .ok_or(DirectoryLeaseError::InvalidState)?;
+            if !old.identity(&record) {
+                return Err(DirectoryLeaseError::InvalidState);
+            }
+            old.committed = true;
+            Ok(())
+        })
+        .await
+    }
+    pub(in crate::docker) async fn settle_image(
+        &self,
+        record: ImageRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        self.snapshot::<ImageCodec, _>(deadline, move |records| {
+            if let Some(position) = records.iter().position(|old| old.same_key(&record)) {
+                if !records
+                    .get(position)
+                    .is_some_and(|old| old.identity(&record))
+                {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+                records.remove(position);
+            }
+            Ok(())
+        })
+        .await
+    }
+}
+pub(super) struct ImageCodec;
+impl Codec for ImageCodec {
+    type Record = ImageRecord;
+    const PUBLISHED: &'static str = PUBLISHED;
+    const STAGING: &'static str = STAGING;
+    const MAX_BYTES: usize = MAX_BYTES;
+    fn encode(owner: Uuid, records: &[ImageRecord]) -> Result<Vec<u8>, DirectoryLeaseError> {
+        encode(owner, records)
+    }
+    fn decode(bytes: &[u8], owner: Uuid) -> Result<Vec<ImageRecord>, DirectoryLeaseError> {
+        decode(bytes, owner)
+    }
+}
+fn encode(owner: Uuid, records: &[ImageRecord]) -> Result<Vec<u8>, DirectoryLeaseError> {
+    if owner.is_nil() || records.len() > MAX_RECORDS {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    let capacity = records
+        .len()
+        .checked_mul(RECORD_BYTES)
+        .and_then(|bytes| bytes.checked_add(58))
+        .ok_or(DirectoryLeaseError::InvalidState)?;
+    let mut bytes = Vec::with_capacity(capacity);
+    bytes.extend_from_slice(MAGIC);
+    bytes.extend_from_slice(owner.as_bytes());
+    bytes.extend_from_slice(
+        &u16::try_from(records.len())
+            .map_err(|_| DirectoryLeaseError::InvalidState)?
+            .to_be_bytes(),
+    );
+    for record in records {
+        bytes.extend_from_slice(record.run.as_bytes());
+        bytes.extend_from_slice(record.pin.as_bytes());
+        bytes.extend_from_slice(&record.image);
+        bytes.push(u8::from(record.committed));
+    }
+    bytes.extend_from_slice(&Sha256::digest(&bytes));
+    decode(&bytes, owner)?;
+    Ok(bytes)
+}
+fn decode(bytes: &[u8], owner: Uuid) -> Result<Vec<ImageRecord>, DirectoryLeaseError> {
+    let invalid = || DirectoryLeaseError::InvalidState;
+    let count = usize::from(u16::from_be_bytes(
+        bytes
+            .get(24..26)
+            .ok_or_else(invalid)?
+            .try_into()
+            .map_err(|_| invalid())?,
+    ));
+    if owner.is_nil() || count > MAX_RECORDS {
+        return Err(invalid());
+    }
+    let body_len = count
+        .checked_mul(RECORD_BYTES)
+        .and_then(|bytes| bytes.checked_add(26))
+        .ok_or_else(invalid)?;
+    let expected_len = body_len.checked_add(32).ok_or_else(invalid)?;
+    if bytes.len() != expected_len
+        || bytes.get(..8) != Some(MAGIC.as_slice())
+        || bytes.get(8..24) != Some(owner.as_bytes().as_slice())
+        || bytes.get(body_len..)
+            != Some(Sha256::digest(bytes.get(..body_len).ok_or_else(invalid)?).as_slice())
+    {
+        return Err(invalid());
+    }
+    let mut records = Vec::with_capacity(count);
+    let mut identities = BTreeSet::new();
+    for row in bytes
+        .get(26..body_len)
+        .ok_or_else(invalid)?
+        .as_chunks::<RECORD_BYTES>()
+        .0
+    {
+        let run = Uuid::from_slice(row.get(..16).ok_or_else(invalid)?).map_err(|_| invalid())?;
+        let pin = Uuid::from_slice(row.get(16..32).ok_or_else(invalid)?).map_err(|_| invalid())?;
+        if run.is_nil() || pin.is_nil() || !identities.insert((run, pin)) {
+            return Err(invalid());
+        }
+        let committed = match row.get(64) {
+            Some(0) => false,
+            Some(1) => true,
+            _ => return Err(invalid()),
+        };
+        records.push(ImageRecord {
+            run,
+            pin,
+            image: row
+                .get(32..64)
+                .ok_or_else(invalid)?
+                .try_into()
+                .map_err(|_| invalid())?,
+            committed,
+        });
+    }
+    Ok(records)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/ownership/images/tests.rs b/crates/rustack-lambda-core/src/docker/ownership/images/tests.rs
new file mode 100644
index 00000000..4247061b
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/images/tests.rs
@@ -0,0 +1,267 @@
+use std::{
+    os::unix::fs::{PermissionsExt, symlink},
+    sync::Arc,
+    time::Duration,
+};
+
+use sha2::{Digest, Sha256};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{ImageRecord, MAX_BYTES, PUBLISHED, STAGING, decode, encode};
+use crate::docker::{
+    DirectoryLease, DirectoryLeaseError, EnvironmentPlan, ImagePinScope,
+    ownership::{ContainerRecord, NAMESPACE},
+    plan::{
+        ContainerRole,
+        tests::{image_with, policy, revision},
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn record(run: Uuid) -> ImageRecord {
+    ImageRecord {
+        run,
+        pin: Uuid::new_v4(),
+        image: [0xab; 32],
+        committed: false,
+    }
+}
+async fn lease(root: &tempfile::TempDir) -> DirectoryLease {
+    DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap()
+}
+fn resign(bytes: &mut [u8]) {
+    let length = bytes.len() - 32;
+    let checksum = Sha256::digest(&bytes[..length]);
+    bytes[length..].copy_from_slice(&checksum);
+}
+#[test]
+fn test_should_roundtrip_full_capacity_and_reject_semantic_corruption() {
+    let owner = Uuid::new_v4();
+    let run = Uuid::new_v4();
+    let records: Vec<_> = (1..=8192)
+        .map(|id| ImageRecord {
+            run,
+            pin: Uuid::from_u128(id),
+            image: [1; 32],
+            committed: id % 2 == 0,
+        })
+        .collect();
+    let bytes = encode(owner, &records).unwrap();
+    assert_eq!(bytes.len(), MAX_BYTES);
+    assert_eq!(decode(&bytes, owner).unwrap(), records);
+    assert!(encode(owner, &[records.clone(), vec![record(run)]].concat()).is_err());
+    assert!(decode(&bytes, Uuid::new_v4()).is_err());
+    let single = encode(owner, &[record(run)]).unwrap();
+    for length in 0..single.len() {
+        assert!(decode(&single[..length], owner).is_err());
+    }
+    for position in 0..single.len() {
+        let mut bad = single.clone();
+        bad[position] ^= 1;
+        assert!(decode(&bad, owner).is_err());
+    }
+    for position in [26, 42] {
+        let mut bad = single.clone();
+        bad[position..position + 16].fill(0);
+        resign(&mut bad);
+        assert!(decode(&bad, owner).is_err());
+    }
+    let mut nil_owner = encode(owner, &[]).unwrap();
+    nil_owner.get_mut(8..24).unwrap().fill(0);
+    resign(&mut nil_owner);
+    assert!(decode(&nil_owner, Uuid::nil()).is_err());
+    let mut bad = single;
+    bad[90] = 2;
+    resign(&mut bad);
+    assert!(decode(&bad, owner).is_err());
+    let entry = record(run);
+    assert!(encode(owner, &[entry.clone(), entry]).is_err());
+}
+#[tokio::test]
+async fn test_should_persist_unknown_commitment_and_erasure_under_new_run() {
+    let root = tempfile::tempdir().unwrap();
+    let first = lease(&root).await;
+    let entry = record(first.run_id());
+    first
+        .prepare_image(entry.clone(), deadline())
+        .await
+        .unwrap();
+    drop(first);
+    let second = lease(&root).await;
+    assert_ne!(entry.run, second.run_id());
+    assert_eq!(
+        second.image_records(deadline()).await.unwrap(),
+        vec![entry.clone()]
+    );
+    let pin = entry.pin(&second).unwrap();
+    assert_eq!(
+        pin.reference().as_str(),
+        format!(
+            "rustack-internal/lambda-{}/{}:{}",
+            second.owner_id().simple(),
+            entry.run.simple(),
+            entry.pin.simple()
+        )
+    );
+    assert_eq!(
+        entry.expected().unwrap().as_str(),
+        format!("sha256:{}", "ab".repeat(32))
+    );
+    second
+        .commit_image(entry.clone(), deadline())
+        .await
+        .unwrap();
+    assert!(second.image_records(deadline()).await.unwrap()[0].committed);
+    drop(pin);
+    drop(second);
+    let third = lease(&root).await;
+    assert!(third.image_records(deadline()).await.unwrap()[0].committed);
+    third.settle_image(entry.clone(), deadline()).await.unwrap();
+    third.settle_image(entry, deadline()).await.unwrap();
+    assert_eq!(third.image_records(deadline()).await.unwrap(), []);
+}
+#[tokio::test]
+async fn test_should_reject_cross_run_and_changed_target_without_erasing_authority() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let entry = record(lease.run_id());
+    lease
+        .prepare_image(entry.clone(), deadline())
+        .await
+        .unwrap();
+    let mut changed = entry.clone();
+    changed.image = [7; 32];
+    assert!(
+        lease
+            .prepare_image(changed.clone(), deadline())
+            .await
+            .is_err()
+    );
+    assert!(
+        lease
+            .commit_image(changed.clone(), deadline())
+            .await
+            .is_err()
+    );
+    assert!(lease.settle_image(changed, deadline()).await.is_err());
+    assert!(
+        lease
+            .prepare_image(record(Uuid::new_v4()), deadline())
+            .await
+            .is_err()
+    );
+    assert_eq!(lease.image_records(deadline()).await.unwrap(), vec![entry]);
+}
+#[rstest::rstest]
+#[case(PUBLISHED)]
+#[case(STAGING)]
+#[tokio::test]
+async fn test_should_reject_unsafe_oversized_or_corrupt_pin_files(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let target = root.path().join(NAMESPACE).join(name);
+    let outside = root.path().join("outside");
+    tokio::fs::write(&outside, b"keep").await.unwrap();
+    symlink(&outside, &target).unwrap();
+    assert!(lease.image_records(deadline()).await.is_err());
+    tokio::fs::remove_file(&target).await.unwrap();
+    tokio::fs::hard_link(&outside, &target).await.unwrap();
+    assert!(lease.image_records(deadline()).await.is_err());
+    tokio::fs::remove_file(&target).await.unwrap();
+    tokio::fs::write(&target, b"partial").await.unwrap();
+    tokio::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o644))
+        .await
+        .unwrap();
+    assert!(lease.image_records(deadline()).await.is_err());
+    tokio::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    if name == PUBLISHED {
+        assert!(lease.image_records(deadline()).await.is_err());
+    } else {
+        assert_eq!(lease.image_records(deadline()).await.unwrap(), []);
+    }
+    tokio::fs::write(&target, vec![0; MAX_BYTES + 1])
+        .await
+        .unwrap();
+    assert!(lease.image_records(deadline()).await.is_err());
+    assert_eq!(tokio::fs::read(outside).await.unwrap(), b"keep");
+}
+#[tokio::test]
+async fn test_should_share_transaction_exclusion_and_reject_overlong_budget_before_waiting() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let held = lease.0.transaction.acquire().await.unwrap();
+    assert!(matches!(
+        tokio::time::timeout(
+            Duration::from_millis(50),
+            lease.image_records(Instant::now() + Duration::from_secs(61))
+        )
+        .await,
+        Ok(Err(DirectoryLeaseError::Configuration))
+    ));
+    let copy = lease.clone();
+    let mut task =
+        tokio::spawn(async move { copy.prepare_image(record(copy.run_id()), deadline()).await });
+    assert!(
+        tokio::time::timeout(Duration::from_millis(30), &mut task)
+            .await
+            .is_err()
+    );
+    drop(held);
+    task.await.unwrap().unwrap();
+    assert_eq!(lease.image_records(deadline()).await.unwrap().len(), 1);
+}
+#[tokio::test]
+async fn test_should_retain_record_when_erasure_cannot_publish() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let entry = record(lease.run_id());
+    lease
+        .prepare_image(entry.clone(), deadline())
+        .await
+        .unwrap();
+    let staging = root.path().join(NAMESPACE).join(STAGING);
+    symlink(root.path().join("outside"), &staging).unwrap();
+    assert!(lease.settle_image(entry.clone(), deadline()).await.is_err());
+    let published = tokio::fs::read(root.path().join(NAMESPACE).join(PUBLISHED))
+        .await
+        .unwrap();
+    assert_eq!(
+        decode(&published, lease.owner_id()).unwrap(),
+        vec![entry.clone()]
+    );
+    tokio::fs::remove_file(staging).await.unwrap();
+    lease.settle_image(entry, deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_keep_container_encoding_unchanged_and_allow_independent_records() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let plan = EnvironmentPlan::new(
+        lease.clone(),
+        image_with("1000", vec![]),
+        Arc::new(revision()),
+        policy(),
+    )
+    .unwrap();
+    let container = ContainerRecord::from_plan(&plan, ContainerRole::Relay).unwrap();
+    lease
+        .prepare_container(container, deadline())
+        .await
+        .unwrap();
+    let path = root.path().join(NAMESPACE).join("containers.v1");
+    let before = tokio::fs::read(&path).await.unwrap();
+    let pin = ImagePinScope::new(lease.clone()).allocate().unwrap();
+    let entry =
+        ImageRecord::new(&pin, &format!("sha256:{}", "a".repeat(64)).parse().unwrap()).unwrap();
+    lease.prepare_image(entry, deadline()).await.unwrap();
+    assert_eq!(tokio::fs::read(path).await.unwrap(), before);
+    assert_eq!(lease.container_records(deadline()).await.unwrap().len(), 1);
+    assert_eq!(lease.image_records(deadline()).await.unwrap().len(), 1);
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership/journal.rs b/crates/rustack-lambda-core/src/docker/ownership/journal.rs
new file mode 100644
index 00000000..3436b254
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/journal.rs
@@ -0,0 +1,317 @@
+//! Bounded, atomically replaced container identities; no deployment secrets.
+
+use std::fmt;
+
+use sha2::{Digest, Sha256};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{DirectoryLease, DirectoryLeaseError, snapshot::Codec};
+use crate::docker::{
+    DockerError, DockerKey, EnvironmentPlan, models::ContainerInspectResponse, plan::ContainerRole,
+};
+
+const PUBLISHED: &str = "containers.v1";
+const STAGING: &str = "containers.pending";
+const HEADER: &[u8; 8] = b"RSDKCTR1";
+const RECORD_BYTES: usize = 114;
+const MAX_RECORDS: usize = 64;
+const MAX_BYTES: usize = 25 + MAX_RECORDS * RECORD_BYTES + 32;
+
+#[derive(Clone, PartialEq, Eq)]
+pub(in crate::docker) struct ContainerRecord {
+    pub(in crate::docker) run: Uuid,
+    pub(in crate::docker) environment: Uuid,
+    resource: Uuid,
+    function: bool,
+    image: [u8; 32],
+    pub(in crate::docker) known: Option<[u8; 32]>,
+}
+impl fmt::Debug for ContainerRecord {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ContainerRecord(<redacted>)")
+    }
+}
+impl ContainerRecord {
+    pub(in crate::docker) fn from_plan(
+        plan: &EnvironmentPlan,
+        role: ContainerRole,
+    ) -> Result<Self, DockerError> {
+        let image = plan
+            .image_id(role)
+            .strip_prefix("sha256:")
+            .ok_or(DockerError::Configuration)?;
+        let mut digest = [0; 32];
+        hex::decode_to_slice(image, &mut digest).map_err(|_| DockerError::Configuration)?;
+        Ok(Self {
+            run: plan.directory.run_id(),
+            environment: plan
+                .environment_id()
+                .to_string()
+                .parse()
+                .map_err(|_| DockerError::Configuration)?,
+            resource: plan
+                .revision()
+                .resource_id
+                .to_string()
+                .parse()
+                .map_err(|_| DockerError::Configuration)?,
+            function: matches!(role, ContainerRole::Function),
+            image: digest,
+            known: None,
+        })
+    }
+    pub(in crate::docker) fn function(&self) -> bool {
+        self.function
+    }
+    fn role(&self) -> &'static str {
+        if self.function { "function" } else { "relay" }
+    }
+    pub(in crate::docker) fn key(&self) -> Result<DockerKey, DockerError> {
+        format!("rustack-{}-{}", self.role(), self.environment).parse()
+    }
+    pub(in crate::docker) fn known_key(&self) -> Result<Option<DockerKey>, DockerError> {
+        self.known.map(|id| hex::encode(id).parse()).transpose()
+    }
+    pub(in crate::docker) fn owned(
+        &self,
+        owner: Uuid,
+        inspected: &ContainerInspectResponse,
+    ) -> Result<DockerKey, DockerError> {
+        let config = inspected.config.as_ref().ok_or(DockerError::Protocol)?;
+        let labels = config.labels.as_ref().ok_or(DockerError::Quarantined)?;
+        let id = inspected.id.as_deref().ok_or(DockerError::Protocol)?;
+        let mut decoded = [0; 32];
+        if id.len() != 64
+            || !id
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+        {
+            return Err(DockerError::Quarantined);
+        }
+        hex::decode_to_slice(id, &mut decoded).map_err(|_| DockerError::Quarantined)?;
+        if self.known.is_some_and(|expected| expected != decoded)
+            || inspected.name.as_deref() != Some(format!("/{}", self.key()?.as_str()).as_str())
+            || config.image.as_deref()
+                != Some(format!("sha256:{}", hex::encode(self.image)).as_str())
+            || ![
+                ("rustack.lambda.ownerId", owner.to_string()),
+                ("rustack.lambda.runId", self.run.to_string()),
+                ("rustack.lambda.environmentId", self.environment.to_string()),
+                (
+                    "rustack.lambda.functionResourceId",
+                    self.resource.to_string(),
+                ),
+                ("rustack.lambda.role", self.role().to_owned()),
+            ]
+            .iter()
+            .all(|(key, value)| labels.get(*key) == Some(value))
+        {
+            return Err(DockerError::Quarantined);
+        }
+        id.parse()
+    }
+    fn same_key(&self, other: &Self) -> bool {
+        self.environment == other.environment && self.function == other.function
+    }
+    fn identity(&self, other: &Self) -> bool {
+        self.run == other.run
+            && self.environment == other.environment
+            && self.resource == other.resource
+            && self.function == other.function
+            && self.image == other.image
+    }
+}
+impl DirectoryLease {
+    async fn journal<T: Send + 'static>(
+        &self,
+        deadline: Instant,
+        work: impl FnOnce(&mut Vec<ContainerRecord>) -> Result<T, DirectoryLeaseError> + Send + 'static,
+    ) -> Result<T, DirectoryLeaseError> {
+        self.snapshot::<ContainerCodec, T>(deadline, work).await
+    }
+    pub(in crate::docker) async fn container_records(
+        &self,
+        deadline: Instant,
+    ) -> Result<Vec<ContainerRecord>, DirectoryLeaseError> {
+        self.journal(deadline, |records| Ok(records.clone())).await
+    }
+    pub(in crate::docker) async fn prepare_container(
+        &self,
+        record: ContainerRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        if record.run != self.run_id() {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        self.journal(deadline, move |records| {
+            if let Some(previous) = records.iter().find(|old| old.same_key(&record)) {
+                if !previous.identity(&record) {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+            } else {
+                if records.len() >= MAX_RECORDS {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+                records.push(record);
+            }
+            Ok(())
+        })
+        .await
+    }
+    pub(in crate::docker) async fn know_container(
+        &self,
+        record: ContainerRecord,
+        id: DockerKey,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        let mut decoded = [0; 32];
+        if id.as_str().len() != 64
+            || !id
+                .as_str()
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+        {
+            return Err(DirectoryLeaseError::InvalidState);
+        }
+        hex::decode_to_slice(id.as_str(), &mut decoded)
+            .map_err(|_| DirectoryLeaseError::InvalidState)?;
+        self.journal(deadline, move |records| {
+            let previous = records
+                .iter_mut()
+                .find(|old| old.same_key(&record))
+                .ok_or(DirectoryLeaseError::InvalidState)?;
+            if !previous.identity(&record) || previous.known.is_some_and(|old| old != decoded) {
+                return Err(DirectoryLeaseError::InvalidState);
+            }
+            previous.known = Some(decoded);
+            Ok(())
+        })
+        .await
+    }
+    pub(in crate::docker) async fn settle_container(
+        &self,
+        record: ContainerRecord,
+        deadline: Instant,
+    ) -> Result<(), DirectoryLeaseError> {
+        self.journal(deadline, move |records| {
+            if let Some(position) = records.iter().position(|old| old.same_key(&record)) {
+                if !records
+                    .get(position)
+                    .is_some_and(|old| old.identity(&record))
+                {
+                    return Err(DirectoryLeaseError::InvalidState);
+                }
+                records.remove(position);
+            }
+            Ok(())
+        })
+        .await
+    }
+}
+
+fn encode(owner: Uuid, records: &[ContainerRecord]) -> Result<Vec<u8>, DirectoryLeaseError> {
+    if records.len() > MAX_RECORDS || owner.is_nil() {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    let mut bytes = Vec::with_capacity(MAX_BYTES);
+    bytes.extend_from_slice(HEADER);
+    bytes.extend_from_slice(owner.as_bytes());
+    bytes.push(u8::try_from(records.len()).map_err(|_| DirectoryLeaseError::InvalidState)?);
+    for record in records {
+        bytes.extend_from_slice(record.run.as_bytes());
+        bytes.extend_from_slice(record.environment.as_bytes());
+        bytes.extend_from_slice(record.resource.as_bytes());
+        bytes.push(u8::from(!record.function));
+        bytes.extend_from_slice(&record.image);
+        bytes.push(u8::from(record.known.is_some()));
+        bytes.extend_from_slice(&record.known.unwrap_or([0; 32]));
+    }
+    let checksum = Sha256::digest(&bytes);
+    bytes.extend_from_slice(&checksum);
+    decode(&bytes, owner)?;
+    Ok(bytes)
+}
+fn decode(bytes: &[u8], owner: Uuid) -> Result<Vec<ContainerRecord>, DirectoryLeaseError> {
+    let invalid = || DirectoryLeaseError::InvalidState;
+    let count = usize::from(*bytes.get(24).ok_or_else(invalid)?);
+    let body_len = 25 + count * RECORD_BYTES;
+    if count > MAX_RECORDS
+        || bytes.len() != body_len + 32
+        || bytes.get(..8) != Some(HEADER.as_slice())
+        || bytes.get(8..24) != Some(owner.as_bytes().as_slice())
+        || bytes.get(body_len..)
+            != Some(Sha256::digest(bytes.get(..body_len).ok_or_else(invalid)?).as_slice())
+    {
+        return Err(invalid());
+    }
+    let mut records: Vec<ContainerRecord> = Vec::with_capacity(count);
+    for row in bytes
+        .get(25..body_len)
+        .ok_or_else(invalid)?
+        .as_chunks::<RECORD_BYTES>()
+        .0
+    {
+        let uuid = |start| -> Result<Uuid, DirectoryLeaseError> {
+            let value = Uuid::from_slice(row.get(start..start + 16).ok_or_else(invalid)?)
+                .map_err(|_| invalid())?;
+            if value.is_nil() {
+                Err(invalid())
+            } else {
+                Ok(value)
+            }
+        };
+        let function = match row.get(48) {
+            Some(0) => true,
+            Some(1) => false,
+            _ => return Err(invalid()),
+        };
+        let id: [u8; 32] = row
+            .get(82..114)
+            .ok_or_else(invalid)?
+            .try_into()
+            .map_err(|_| invalid())?;
+        let known = match row.get(81) {
+            Some(0) if id == [0; 32] => None,
+            Some(1) => Some(id),
+            _ => return Err(invalid()),
+        };
+        let record = ContainerRecord {
+            run: uuid(0)?,
+            environment: uuid(16)?,
+            resource: uuid(32)?,
+            function,
+            image: row
+                .get(49..81)
+                .ok_or_else(invalid)?
+                .try_into()
+                .map_err(|_| invalid())?,
+            known,
+        };
+        if records.iter().any(|old| {
+            old.same_key(&record)
+                || (old.environment == record.environment
+                    && (old.run != record.run || old.resource != record.resource))
+        }) {
+            return Err(invalid());
+        }
+        records.push(record);
+    }
+    Ok(records)
+}
+pub(super) struct ContainerCodec;
+impl Codec for ContainerCodec {
+    type Record = ContainerRecord;
+    const PUBLISHED: &'static str = PUBLISHED;
+    const STAGING: &'static str = STAGING;
+    const MAX_BYTES: usize = MAX_BYTES;
+    fn encode(owner: Uuid, records: &[ContainerRecord]) -> Result<Vec<u8>, DirectoryLeaseError> {
+        encode(owner, records)
+    }
+    fn decode(bytes: &[u8], owner: Uuid) -> Result<Vec<ContainerRecord>, DirectoryLeaseError> {
+        decode(bytes, owner)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/ownership/journal/tests.rs b/crates/rustack-lambda-core/src/docker/ownership/journal/tests.rs
new file mode 100644
index 00000000..c5d1bffc
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/journal/tests.rs
@@ -0,0 +1,328 @@
+use std::{
+    os::unix::fs::{MetadataExt, PermissionsExt, symlink},
+    path::PathBuf,
+    time::Duration,
+};
+
+use super::*;
+use crate::docker::ownership::NAMESPACE;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn record(run: Uuid) -> ContainerRecord {
+    ContainerRecord {
+        run,
+        environment: Uuid::new_v4(),
+        resource: Uuid::new_v4(),
+        function: true,
+        image: [2; 32],
+        known: None,
+    }
+}
+async fn lease(root: &tempfile::TempDir) -> DirectoryLease {
+    DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap()
+}
+fn path(root: &tempfile::TempDir, file: &str) -> PathBuf {
+    root.path().join(NAMESPACE).join(file)
+}
+
+#[tokio::test]
+async fn test_should_persist_unknown_known_and_settled_across_reacquisition() {
+    let root = tempfile::tempdir().unwrap();
+    let first = lease(&root).await;
+    let entry = record(first.run_id());
+    first
+        .prepare_container(entry.clone(), deadline())
+        .await
+        .unwrap();
+    let bytes = tokio::fs::read(path(&root, PUBLISHED)).await.unwrap();
+    assert_eq!(bytes.len(), 171);
+    assert_eq!(
+        decode(&bytes, first.owner_id()).unwrap(),
+        vec![entry.clone()]
+    );
+    drop(first);
+    let second = lease(&root).await;
+    assert_ne!(second.run_id(), entry.run);
+    assert_eq!(
+        second.container_records(deadline()).await.unwrap(),
+        vec![entry.clone()]
+    );
+    second
+        .know_container(entry.clone(), "a".repeat(64).parse().unwrap(), deadline())
+        .await
+        .unwrap();
+    drop(second);
+    let third = lease(&root).await;
+    assert_eq!(
+        third.container_records(deadline()).await.unwrap()[0].known,
+        Some([0xaa; 32])
+    );
+    third
+        .settle_container(entry.clone(), deadline())
+        .await
+        .unwrap();
+    third.settle_container(entry, deadline()).await.unwrap();
+    drop(third);
+    assert_eq!(
+        lease(&root)
+            .await
+            .container_records(deadline())
+            .await
+            .unwrap(),
+        []
+    );
+}
+#[tokio::test]
+async fn test_should_serialize_concurrent_snapshots_without_losing_records() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let mut jobs = tokio::task::JoinSet::new();
+    for _ in 0..32 {
+        let lease = lease.clone();
+        jobs.spawn(async move {
+            lease
+                .prepare_container(record(lease.run_id()), deadline())
+                .await
+        });
+    }
+    while let Some(result) = jobs.join_next().await {
+        result.unwrap().unwrap();
+    }
+    assert_eq!(lease.container_records(deadline()).await.unwrap().len(), 32);
+    let metadata = tokio::fs::metadata(path(&root, PUBLISHED)).await.unwrap();
+    assert_eq!(metadata.permissions().mode() & 0o777, 0o600);
+    assert_eq!(metadata.nlink(), 1);
+}
+#[tokio::test]
+async fn test_should_bound_records_and_reject_cross_run_or_changed_identity() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let first = record(lease.run_id());
+    lease
+        .prepare_container(first.clone(), deadline())
+        .await
+        .unwrap();
+    let mut changed = first.clone();
+    changed.image = [9; 32];
+    assert!(
+        lease
+            .prepare_container(changed.clone(), deadline())
+            .await
+            .is_err()
+    );
+    assert!(lease.settle_container(changed, deadline()).await.is_err());
+    assert!(
+        lease
+            .prepare_container(record(Uuid::new_v4()), deadline())
+            .await
+            .is_err()
+    );
+    lease
+        .know_container(first.clone(), "a".repeat(64).parse().unwrap(), deadline())
+        .await
+        .unwrap();
+    assert!(
+        lease
+            .know_container(first, "b".repeat(64).parse().unwrap(), deadline())
+            .await
+            .is_err()
+    );
+    for _ in 1..64 {
+        lease
+            .prepare_container(record(lease.run_id()), deadline())
+            .await
+            .unwrap();
+    }
+    assert_eq!(lease.container_records(deadline()).await.unwrap().len(), 64);
+    assert!(
+        lease
+            .prepare_container(record(lease.run_id()), deadline())
+            .await
+            .is_err()
+    );
+}
+#[test]
+fn test_should_reject_truncated_corrupted_foreign_duplicate_and_invalid_encoding() {
+    let owner = Uuid::new_v4();
+    let entry = record(Uuid::new_v4());
+    let bytes = encode(owner, std::slice::from_ref(&entry)).unwrap();
+    for length in 0..bytes.len() {
+        assert!(decode(&bytes[..length], owner).is_err());
+    }
+    for position in 0..bytes.len() {
+        let mut bad = bytes.clone();
+        bad[position] ^= 1;
+        assert!(decode(&bad, owner).is_err());
+    }
+    assert!(decode(&bytes, Uuid::new_v4()).is_err());
+    assert!(encode(owner, &[entry.clone(), entry.clone()]).is_err());
+    let mut bad = entry.clone();
+    bad.run = Uuid::nil();
+    assert!(encode(owner, &[bad]).is_err());
+    let mut relay = entry.clone();
+    relay.function = false;
+    relay.resource = Uuid::new_v4();
+    assert!(encode(owner, &[entry, relay]).is_err());
+    assert!(encode(owner, &vec![record(Uuid::new_v4()); 65]).is_err());
+}
+#[rstest::rstest]
+#[case(PUBLISHED)]
+#[case(STAGING)]
+#[tokio::test]
+async fn test_should_reject_unsafe_snapshot_inodes(#[case] file: &str) {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let target = path(&root, file);
+    let outside = root.path().join("outside");
+    tokio::fs::write(&outside, b"keep").await.unwrap();
+    symlink(&outside, &target).unwrap();
+    assert!(lease.container_records(deadline()).await.is_err());
+    tokio::fs::remove_file(&target).await.unwrap();
+    tokio::fs::hard_link(&outside, &target).await.unwrap();
+    assert!(lease.container_records(deadline()).await.is_err());
+    tokio::fs::remove_file(&target).await.unwrap();
+    tokio::fs::write(&target, b"").await.unwrap();
+    tokio::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o644))
+        .await
+        .unwrap();
+    assert!(lease.container_records(deadline()).await.is_err());
+    tokio::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    tokio::fs::write(&target, vec![0; MAX_BYTES + 1])
+        .await
+        .unwrap();
+    assert!(lease.container_records(deadline()).await.is_err());
+    assert_eq!(tokio::fs::read(outside).await.unwrap(), b"keep");
+}
+#[tokio::test]
+async fn test_should_ignore_only_bounded_safe_interrupted_staging() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let entry = record(lease.run_id());
+    lease
+        .prepare_container(entry.clone(), deadline())
+        .await
+        .unwrap();
+    tokio::fs::write(path(&root, STAGING), b"partial")
+        .await
+        .unwrap();
+    tokio::fs::set_permissions(path(&root, STAGING), std::fs::Permissions::from_mode(0o600))
+        .await
+        .unwrap();
+    assert_eq!(
+        lease.container_records(deadline()).await.unwrap(),
+        vec![entry]
+    );
+    tokio::fs::write(path(&root, PUBLISHED), b"partial")
+        .await
+        .unwrap();
+    assert!(lease.container_records(deadline()).await.is_err());
+}
+#[tokio::test]
+async fn test_should_fail_before_publication_with_expired_budget() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    assert!(matches!(
+        lease
+            .prepare_container(record(lease.run_id()), Instant::now())
+            .await,
+        Err(DirectoryLeaseError::Deadline)
+    ));
+    assert!(!tokio::fs::try_exists(path(&root, PUBLISHED)).await.unwrap());
+    assert!(
+        lease
+            .container_records(Instant::now() + Duration::from_secs(61))
+            .await
+            .is_err()
+    );
+}
+
+#[tokio::test]
+async fn test_should_keep_transaction_and_lease_owned_after_waiter_abandonment() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let (entered, observed) = tokio::sync::oneshot::channel();
+    let (release, barrier) = std::sync::mpsc::channel();
+    let entry = record(lease.run_id());
+    let worker_lease = lease.clone();
+    let task = tokio::spawn(async move {
+        worker_lease
+            .journal(deadline(), move |records| {
+                records.push(entry);
+                entered.send(()).unwrap();
+                barrier.recv().unwrap();
+                Ok(())
+            })
+            .await
+    });
+    observed.await.unwrap();
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    let check = lease.clone();
+    let mut read = tokio::spawn(async move { check.container_records(deadline()).await });
+    assert!(
+        tokio::time::timeout(Duration::from_millis(30), &mut read)
+            .await
+            .is_err()
+    );
+    drop(lease);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    release.send(()).unwrap();
+    // The cancelled worker must finish/dispose its transaction before this read.
+    assert_eq!(read.await.unwrap().unwrap(), []);
+    let _next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+}
+
+#[tokio::test]
+async fn test_should_keep_authoritative_record_when_erase_cannot_publish() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let entry = record(lease.run_id());
+    lease
+        .prepare_container(entry.clone(), deadline())
+        .await
+        .unwrap();
+    let outside = root.path().join("outside");
+    tokio::fs::write(&outside, b"keep").await.unwrap();
+    symlink(&outside, path(&root, STAGING)).unwrap();
+    assert!(
+        lease
+            .settle_container(entry.clone(), deadline())
+            .await
+            .is_err()
+    );
+    let bytes = tokio::fs::read(path(&root, PUBLISHED)).await.unwrap();
+    assert_eq!(
+        decode(&bytes, lease.owner_id()).unwrap(),
+        vec![entry.clone()]
+    );
+    tokio::fs::remove_file(path(&root, STAGING)).await.unwrap();
+    lease.settle_container(entry, deadline()).await.unwrap();
+    assert_eq!(lease.container_records(deadline()).await.unwrap(), []);
+}
+
+#[tokio::test]
+async fn test_should_reject_overlong_budget_before_waiting_for_transaction() {
+    let root = tempfile::tempdir().unwrap();
+    let lease = lease(&root).await;
+    let _held = lease.0.transaction.acquire().await.unwrap();
+    let result = tokio::time::timeout(
+        Duration::from_millis(50),
+        lease.container_records(Instant::now() + Duration::from_secs(61)),
+    )
+    .await;
+    assert!(matches!(
+        result,
+        Ok(Err(DirectoryLeaseError::Configuration))
+    ));
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership/snapshot.rs b/crates/rustack-lambda-core/src/docker/ownership/snapshot.rs
new file mode 100644
index 00000000..0295eea2
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership/snapshot.rs
@@ -0,0 +1,121 @@
+//! Shared bounded file transactions; individual codecs own their wire formats.
+
+use std::{
+    fs::File,
+    io::{self, Read, Write},
+    time::Duration,
+};
+
+use nix::fcntl::{OFlag, renameat};
+use tokio::time::{Instant, timeout_at};
+use uuid::Uuid;
+
+use super::{Control, DirectoryLease, DirectoryLeaseError, LeaseGuard, WORKERS, managed_file, run};
+
+pub(super) trait Codec {
+    type Record: Clone + PartialEq + Send + 'static;
+    const PUBLISHED: &'static str;
+    const STAGING: &'static str;
+    const MAX_BYTES: usize;
+    fn encode(owner: Uuid, records: &[Self::Record]) -> Result<Vec<u8>, DirectoryLeaseError>;
+    fn decode(bytes: &[u8], owner: Uuid) -> Result<Vec<Self::Record>, DirectoryLeaseError>;
+}
+impl DirectoryLease {
+    fn namespace(&self) -> &File {
+        match &self.0.guard {
+            LeaseGuard::Held { directory, .. } => directory,
+            #[cfg(test)]
+            LeaseGuard::Testing { directory, .. } => directory,
+        }
+    }
+    pub(super) async fn snapshot<C: Codec, T: Send + 'static>(
+        &self,
+        deadline: Instant,
+        work: impl FnOnce(&mut Vec<C::Record>) -> Result<T, DirectoryLeaseError> + Send + 'static,
+    ) -> Result<T, DirectoryLeaseError> {
+        self.transaction(deadline, move |directory, owner, control| {
+            let mut records = read::<C>(directory, owner)?;
+            control.check()?;
+            let original = records.clone();
+            let result = work(&mut records)?;
+            if records != original {
+                write::<C>(directory, owner, &records, control)?;
+            }
+            Ok(result)
+        })
+        .await
+    }
+    pub(super) async fn transaction<T: Send + 'static>(
+        &self,
+        deadline: Instant,
+        work: impl FnOnce(&File, Uuid, &Control) -> Result<T, DirectoryLeaseError> + Send + 'static,
+    ) -> Result<T, DirectoryLeaseError> {
+        let remaining = deadline
+            .checked_duration_since(Instant::now())
+            .filter(|duration| !duration.is_zero())
+            .ok_or(DirectoryLeaseError::Deadline)?;
+        if remaining > Duration::from_secs(60) {
+            return Err(DirectoryLeaseError::Configuration);
+        }
+        let permit = timeout_at(deadline, self.0.transaction.clone().acquire_owned())
+            .await
+            .map_err(|_| DirectoryLeaseError::Deadline)?
+            .map_err(|_| DirectoryLeaseError::Worker)?;
+        let lease = self.clone();
+        run(&WORKERS, deadline, move |control| {
+            let _transaction = permit;
+            work(lease.namespace(), lease.owner_id(), control)
+        })
+        .await
+    }
+}
+pub(super) fn read<C: Codec>(
+    directory: &File,
+    owner: Uuid,
+) -> Result<Vec<C::Record>, DirectoryLeaseError> {
+    optional::<C>(directory, C::STAGING)?;
+    let Some(mut file) = optional::<C>(directory, C::PUBLISHED)? else {
+        directory.sync_all()?;
+        return Ok(Vec::new());
+    };
+    let mut bytes = Vec::with_capacity(C::MAX_BYTES);
+    Read::by_ref(&mut file)
+        .take((C::MAX_BYTES + 1) as u64)
+        .read_to_end(&mut bytes)?;
+    let records = C::decode(&bytes, owner)?;
+    file.sync_all()?;
+    directory.sync_all()?;
+    Ok(records)
+}
+fn optional<C: Codec>(directory: &File, name: &str) -> Result<Option<File>, DirectoryLeaseError> {
+    match managed_file(directory, name, OFlag::O_RDONLY, C::MAX_BYTES as u64) {
+        Ok(file) => Ok(Some(file)),
+        Err(DirectoryLeaseError::Io(error)) if error.kind() == io::ErrorKind::NotFound => Ok(None),
+        Err(error) => Err(error),
+    }
+}
+pub(super) fn write<C: Codec>(
+    directory: &File,
+    owner: Uuid,
+    records: &[C::Record],
+    control: &Control,
+) -> Result<(), DirectoryLeaseError> {
+    let bytes = C::encode(owner, records)?;
+    if bytes.len() > C::MAX_BYTES {
+        return Err(DirectoryLeaseError::InvalidState);
+    }
+    let mut file = managed_file(
+        directory,
+        C::STAGING,
+        OFlag::O_RDWR | OFlag::O_CREAT,
+        C::MAX_BYTES as u64,
+    )?;
+    control.check()?;
+    file.set_len(0)?;
+    file.write_all(&bytes)?;
+    file.sync_all()?;
+    control.check()?;
+    renameat(directory, C::STAGING, directory, C::PUBLISHED)?;
+    directory.sync_all()?;
+    Ok(())
+}
diff --git a/crates/rustack-lambda-core/src/docker/ownership_tests.rs b/crates/rustack-lambda-core/src/docker/ownership_tests.rs
new file mode 100644
index 00000000..8550a35e
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/ownership_tests.rs
@@ -0,0 +1,768 @@
+use std::{
+    error::Error,
+    os::unix::fs::{PermissionsExt, symlink},
+    process::Stdio,
+    sync::mpsc,
+};
+
+use nix::unistd::mkfifo;
+use tempfile::TempDir;
+use tokio::{
+    fs,
+    process::Command,
+    sync::oneshot,
+    time::{sleep, timeout},
+};
+
+use super::*;
+use crate::docker::ImagePinScope;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+async fn lease(root: &TempDir) -> DirectoryLease {
+    DirectoryLease::acquire(root.path().to_path_buf(), deadline())
+        .await
+        .unwrap()
+}
+fn managed(root: &TempDir, name: &str) -> PathBuf {
+    root.path().join(NAMESPACE).join(name)
+}
+
+#[tokio::test]
+async fn test_should_persist_owner_and_refresh_run_after_last_clone_closes() {
+    let root = tempfile::tempdir().unwrap();
+    let first = lease(&root).await;
+    let (owner, run) = (first.owner_id(), first.run_id());
+    assert!(!owner.is_nil() && !run.is_nil());
+    let clone = first.clone();
+    drop(first);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    drop(clone);
+    let second = lease(&root).await;
+    assert_eq!(second.owner_id(), owner);
+    assert_ne!(second.run_id(), run);
+    let bytes = tokio::fs::read(managed(&root, OWNER)).await.unwrap();
+    assert_eq!(bytes.len(), OWNER_BYTES);
+    assert_eq!(bytes.get(..8), Some(MAGIC.as_slice()));
+    assert!(
+        tokio::fs::try_exists(managed(&root, PENDING))
+            .await
+            .is_ok_and(|exists| !exists)
+    );
+}
+
+#[tokio::test]
+async fn test_should_hold_the_directory_through_allocated_pins() {
+    let root = tempfile::tempdir().unwrap();
+    let owner = lease(&root).await;
+    let id = owner.owner_id();
+    let scope = ImagePinScope::new(owner);
+    let pin = scope.allocate().unwrap();
+    let copy = pin.clone();
+    drop(scope);
+    drop(pin);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    drop(copy);
+    assert_eq!(lease(&root).await.owner_id(), id);
+}
+
+#[rstest::rstest]
+#[case(PathBuf::new())]
+#[case(PathBuf::from("relative"))]
+#[case(PathBuf::from("/tmp/../outside"))]
+#[case(PathBuf::from("/tmp/\0bad"))]
+#[case(PathBuf::from(format!("/{}", "a".repeat(4096))))]
+#[tokio::test]
+async fn test_should_reject_invalid_directories_without_io(#[case] path: PathBuf) {
+    assert!(matches!(
+        DirectoryLease::acquire(path, deadline()).await,
+        Err(DirectoryLeaseError::Configuration)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_create_missing_roots_and_keep_descriptor_files_private() {
+    let parent = tempfile::tempdir().unwrap();
+    let root = parent.path().join("new/data");
+    let owner = DirectoryLease::acquire(root.clone(), deadline())
+        .await
+        .unwrap();
+    for (path, expected) in [
+        (root.join(NAMESPACE), 0o700),
+        (root.join(NAMESPACE).join(LOCK), 0o600),
+        (root.join(NAMESPACE).join(OWNER), 0o600),
+    ] {
+        let metadata = tokio::fs::metadata(path).await.unwrap();
+        assert_eq!(metadata.permissions().mode() & 0o777, expected);
+        assert_eq!(metadata.uid(), geteuid().as_raw());
+    }
+    assert_eq!(format!("{owner:?}"), "DirectoryLease(<held>)");
+}
+
+#[rstest::rstest]
+#[case("")]
+#[case("/")]
+#[case("/.")]
+#[case("//./")]
+#[tokio::test]
+async fn test_should_reject_a_symlink_root_without_touching_the_destination(#[case] suffix: &str) {
+    let root = tempfile::tempdir().unwrap();
+    let outside = tempfile::tempdir().unwrap();
+    let link = root.path().join("link");
+    symlink(outside.path(), &link).unwrap();
+    let spelling = PathBuf::from(format!("{}{suffix}", link.display()));
+    assert!(matches!(
+        DirectoryLease::acquire(spelling, deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert!(
+        !tokio::fs::try_exists(outside.path().join(NAMESPACE))
+            .await
+            .unwrap()
+    );
+}
+
+#[tokio::test]
+async fn test_should_reject_untrusted_rename_permissions_and_accept_a_sticky_ancestor() {
+    let root = tempfile::tempdir().unwrap();
+    let parent = root.path().join("shared");
+    tokio::fs::create_dir(&parent).await.unwrap();
+    tokio::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o777))
+        .await
+        .unwrap();
+    let path = parent.join("new/data");
+    assert!(matches!(
+        DirectoryLease::acquire(path.clone(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert!(!tokio::fs::try_exists(parent.join("new")).await.unwrap());
+    tokio::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o1777))
+        .await
+        .unwrap();
+    let owner = DirectoryLease::acquire(path.clone(), deadline())
+        .await
+        .unwrap();
+    let id = owner.owner_id();
+    drop(owner);
+    assert_eq!(
+        DirectoryLease::acquire(path, deadline())
+            .await
+            .unwrap()
+            .owner_id(),
+        id
+    );
+}
+
+#[tokio::test]
+async fn test_should_repeat_the_ancestor_sync_barrier_after_interrupted_root_creation() {
+    let root = tempfile::tempdir().unwrap();
+    let path = root.path().join("new/parent/data");
+    let test = tokio::task::spawn_blocking(move || {
+        let control = Control {
+            deadline: deadline(),
+            cancelled: Arc::new(AtomicBool::new(false)),
+        };
+        let mut attempts = 0;
+        let first = open_root_with_sync(&path, &control, |directory| {
+            attempts += 1;
+            if attempts == 2 {
+                return Err(io::Error::other("interrupted parent sync"));
+            }
+            directory.sync_all()
+        });
+        assert!(matches!(first, Err(DirectoryLeaseError::Io(_))));
+        assert!(path.is_dir());
+        let parent = symlink_metadata(path.parent().unwrap()).unwrap();
+        let mut observed = Vec::new();
+        let reopened = open_root_with_sync(&path, &control, |directory| {
+            let metadata = directory.metadata()?;
+            observed.push((metadata.dev(), metadata.ino()));
+            directory.sync_all()
+        })
+        .unwrap();
+        assert!(
+            observed.contains(&(parent.dev(), parent.ino())),
+            "retry must not skip the already-existing parent"
+        );
+        drop(reopened);
+        let owner = acquire(&DataDirectory::try_from(path).unwrap(), &control).unwrap();
+        assert!(!owner.owner_id().is_nil());
+    });
+    timeout(Duration::from_secs(10), test)
+        .await
+        .unwrap()
+        .unwrap();
+}
+
+#[rstest::rstest]
+#[case::namespace(NAMESPACE)]
+#[case::lock(LOCK)]
+#[case::identity(OWNER)]
+#[tokio::test]
+async fn test_should_reject_managed_symlinks_without_modifying_their_targets(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    let outside = tempfile::tempdir().unwrap();
+    let sentinel = outside.path().join("sentinel");
+    tokio::fs::write(&sentinel, b"sentinel").await.unwrap();
+    if name == NAMESPACE {
+        symlink(outside.path(), root.path().join(NAMESPACE)).unwrap();
+    } else {
+        drop(lease(&root).await);
+        tokio::fs::remove_file(managed(&root, name)).await.unwrap();
+        symlink(&sentinel, managed(&root, name)).unwrap();
+    }
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert_eq!(tokio::fs::read(&sentinel).await.unwrap(), b"sentinel");
+}
+
+#[rstest::rstest]
+#[case::lock(LOCK)]
+#[case::identity(OWNER)]
+#[tokio::test]
+async fn test_should_reject_hardlinked_managed_files(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    drop(lease(&root).await);
+    let before = tokio::fs::read(managed(&root, name)).await.unwrap();
+    let link = root.path().join("hardlink");
+    tokio::fs::hard_link(managed(&root, name), &link)
+        .await
+        .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert_eq!(tokio::fs::read(link).await.unwrap(), before);
+}
+
+#[rstest::rstest]
+#[case::namespace(NAMESPACE)]
+#[case::lock(LOCK)]
+#[case::identity(OWNER)]
+#[tokio::test]
+async fn test_should_reject_group_or_other_access(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    drop(lease(&root).await);
+    let path = if name == NAMESPACE {
+        root.path().join(name)
+    } else {
+        managed(&root, name)
+    };
+    tokio::fs::set_permissions(
+        &path,
+        std::fs::Permissions::from_mode(if name == NAMESPACE { 0o755 } else { 0o644 }),
+    )
+    .await
+    .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+}
+
+#[rstest::rstest]
+#[case::lock(LOCK)]
+#[case::identity(OWNER)]
+#[tokio::test]
+async fn test_should_reject_fifos_without_waiting_for_a_peer(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    drop(lease(&root).await);
+    tokio::fs::remove_file(managed(&root, name)).await.unwrap();
+    mkfifo(&managed(&root, name), Mode::from_bits_truncate(0o600)).unwrap();
+    let result = timeout(
+        Duration::from_secs(2),
+        DirectoryLease::acquire(root.path().into(), deadline()),
+    )
+    .await
+    .unwrap();
+    assert!(matches!(result, Err(DirectoryLeaseError::InvalidState)));
+}
+
+#[rstest::rstest]
+#[case::empty(Vec::new())]
+#[case::partial(vec![0; 24])]
+#[case::oversized(vec![0; OWNER_BYTES + 1])]
+#[case::magic(vec![0; OWNER_BYTES])]
+#[tokio::test]
+async fn test_should_reject_damaged_published_identity_without_regenerating_it(
+    #[case] damaged: Vec<u8>,
+) {
+    let root = tempfile::tempdir().unwrap();
+    drop(lease(&root).await);
+    tokio::fs::write(managed(&root, OWNER), &damaged)
+        .await
+        .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert_eq!(
+        tokio::fs::read(managed(&root, OWNER)).await.unwrap(),
+        damaged
+    );
+}
+
+#[tokio::test]
+async fn test_should_reject_a_nonnil_identity_bit_flip_and_a_checksummed_nil_identity() {
+    let root = tempfile::tempdir().unwrap();
+    drop(lease(&root).await);
+    let mut bytes = tokio::fs::read(managed(&root, OWNER)).await.unwrap();
+    *bytes.get_mut(8).unwrap() ^= 1;
+    tokio::fs::write(managed(&root, OWNER), &bytes)
+        .await
+        .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    bytes.get_mut(8..24).unwrap().fill(0);
+    let checksum = Sha256::digest(bytes.get(..24).unwrap());
+    bytes
+        .get_mut(24..)
+        .unwrap()
+        .copy_from_slice(checksum.as_ref());
+    tokio::fs::write(managed(&root, OWNER), &bytes)
+        .await
+        .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_recover_only_a_bounded_pending_initialization() {
+    let root = tempfile::tempdir().unwrap();
+    drop(lease(&root).await);
+    tokio::fs::remove_file(managed(&root, OWNER)).await.unwrap();
+    tokio::fs::write(managed(&root, PENDING), b"partial")
+        .await
+        .unwrap();
+    tokio::fs::set_permissions(
+        managed(&root, PENDING),
+        std::fs::Permissions::from_mode(0o600),
+    )
+    .await
+    .unwrap();
+    let recovered = lease(&root).await;
+    assert!(!recovered.owner_id().is_nil());
+    assert!(
+        !tokio::fs::try_exists(managed(&root, PENDING))
+            .await
+            .unwrap()
+    );
+    drop(recovered);
+    tokio::fs::remove_file(managed(&root, OWNER)).await.unwrap();
+    tokio::fs::write(managed(&root, PENDING), vec![0; OWNER_BYTES + 1])
+        .await
+        .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_reject_unsafe_pending_initialization_without_touching_its_target() {
+    let root = tempfile::tempdir().unwrap();
+    drop(lease(&root).await);
+    tokio::fs::remove_file(managed(&root, OWNER)).await.unwrap();
+    let sentinel = root.path().join("sentinel");
+    tokio::fs::write(&sentinel, b"outside").await.unwrap();
+    symlink(&sentinel, managed(&root, PENDING)).unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert_eq!(tokio::fs::read(sentinel).await.unwrap(), b"outside");
+}
+
+#[tokio::test]
+async fn test_should_bound_deadlines_and_keep_diagnostics_redacted() {
+    let root = tempfile::tempdir().unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), Instant::now()).await,
+        Err(DirectoryLeaseError::Deadline)
+    ));
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), Instant::now() + Duration::from_secs(61)).await,
+        Err(DirectoryLeaseError::Configuration)
+    ));
+    let error = DirectoryLeaseError::Io(io::Error::other("secret operator path"));
+    assert!(!format!("{error:?} {error}").contains("secret"));
+    assert!(error.source().is_some());
+}
+
+#[rstest::rstest]
+#[case::aborted(false)]
+#[case::deadline(true)]
+#[tokio::test]
+async fn test_should_retain_worker_capacity_and_lock_after_the_waiter_ends(#[case] expires: bool) {
+    let root = tempfile::tempdir().unwrap();
+    let path = root.path().to_path_buf();
+    let pool = Box::leak(Box::new(Semaphore::new(1)));
+    let (ready, acquired) = oneshot::channel();
+    let (release, held) = mpsc::channel();
+    let budget = if expires {
+        Duration::from_secs(2)
+    } else {
+        Duration::from_secs(10)
+    };
+    let task = tokio::spawn(run(pool, Instant::now() + budget, move |control| {
+        let lease = acquire(&DataDirectory::try_from(path)?, control)?;
+        ready.send(()).unwrap();
+        held.recv_timeout(Duration::from_secs(10)).unwrap();
+        Ok(lease)
+    }));
+    acquired.await.unwrap();
+    if expires {
+        assert!(matches!(
+            timeout(Duration::from_secs(5), task)
+                .await
+                .unwrap()
+                .unwrap(),
+            Err(DirectoryLeaseError::Deadline)
+        ));
+    } else {
+        task.abort();
+        assert!(task.await.unwrap_err().is_cancelled());
+    }
+    assert_eq!(pool.available_permits(), 0);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    release.send(()).unwrap();
+    timeout(Duration::from_secs(5), async {
+        loop {
+            match DirectoryLease::acquire(root.path().into(), deadline()).await {
+                Ok(lease) => {
+                    drop(lease);
+                    break;
+                }
+                Err(DirectoryLeaseError::InUse) => sleep(Duration::from_millis(5)).await,
+                other => panic!("unexpected reacquisition result: {other:?}"),
+            }
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(pool.available_permits(), 1);
+}
+
+#[tokio::test]
+async fn test_should_release_worker_capacity_after_a_panicking_worker() {
+    let pool = Box::leak(Box::new(Semaphore::new(1)));
+    let result: Result<(), _> = run(pool, deadline(), |_| panic!("worker failure")).await;
+    assert!(matches!(result, Err(DirectoryLeaseError::Worker)));
+    assert_eq!(pool.available_permits(), 1);
+}
+
+#[tokio::test]
+async fn test_should_retain_capacity_with_a_completed_but_unconsumed_lease_result() {
+    let root = tempfile::tempdir().unwrap();
+    let held = lease(&root).await;
+    let pool: &'static Semaphore = Box::leak(Box::new(Semaphore::new(1)));
+    let task = spawn_work(
+        pool.try_acquire().unwrap(),
+        Control {
+            deadline: deadline(),
+            cancelled: Arc::new(AtomicBool::new(false)),
+        },
+        |_| Ok(held),
+    );
+    timeout(Duration::from_secs(5), async {
+        while !task.is_finished() {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(pool.available_permits(), 0);
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    drop(task);
+    assert_eq!(pool.available_permits(), 1);
+    drop(lease(&root).await);
+}
+
+#[tokio::test]
+async fn test_should_expire_worker_admission_without_starting_io() {
+    let pool: &'static Semaphore = Box::leak(Box::new(Semaphore::new(1)));
+    let _held = pool.acquire().await.unwrap();
+    let started = Arc::new(AtomicBool::new(false));
+    let observed = started.clone();
+    let result = run(
+        pool,
+        Instant::now() + Duration::from_millis(20),
+        move |_| {
+            started.store(true, Ordering::Release);
+            Ok(())
+        },
+    )
+    .await;
+    assert!(matches!(result, Err(DirectoryLeaseError::Deadline)));
+    assert!(!observed.load(Ordering::Acquire));
+}
+
+#[tokio::test]
+async fn test_should_enforce_exclusion_and_stable_identity_across_processes() {
+    const PATH: &str = "RUSTACK_DIRECTORY_LEASE_CHILD_PATH";
+    const MODE: &str = "RUSTACK_DIRECTORY_LEASE_CHILD_MODE";
+    if let Some(path) = std::env::var_os(PATH) {
+        let result = DirectoryLease::acquire(path.into(), deadline()).await;
+        if std::env::var(MODE).unwrap() == "busy" {
+            assert!(matches!(result, Err(DirectoryLeaseError::InUse)));
+        } else {
+            let lease = result.unwrap();
+            assert_eq!(
+                lease.owner_id().to_string(),
+                std::env::var("RUSTACK_DIRECTORY_LEASE_CHILD_OWNER").unwrap()
+            );
+            assert_ne!(
+                lease.run_id().to_string(),
+                std::env::var("RUSTACK_DIRECTORY_LEASE_CHILD_RUN").unwrap()
+            );
+        }
+        return;
+    }
+    let root = tempfile::tempdir().unwrap();
+    let first = lease(&root).await;
+    let owner = first.owner_id();
+    let run = first.run_id();
+    assert_child(&root, "busy", owner, run).await;
+    drop(first);
+    assert_child(&root, "available", owner, run).await;
+}
+
+async fn assert_child(root: &TempDir, mode: &str, owner: Uuid, run: Uuid) {
+    let mut child = Command::new(std::env::current_exe().unwrap())
+        .args(["--exact", "docker::ownership::tests::test_should_enforce_exclusion_and_stable_identity_across_processes", "--test-threads=1"])
+        .env("RUSTACK_DIRECTORY_LEASE_CHILD_PATH", root.path())
+        .env("RUSTACK_DIRECTORY_LEASE_CHILD_MODE", mode)
+        .env("RUSTACK_DIRECTORY_LEASE_CHILD_OWNER", owner.to_string())
+        .env("RUSTACK_DIRECTORY_LEASE_CHILD_RUN", run.to_string())
+        .stdout(Stdio::null()).kill_on_drop(true).spawn().unwrap();
+    let status = if let Ok(status) = timeout(Duration::from_secs(10), child.wait()).await {
+        status.unwrap()
+    } else {
+        child.start_kill().unwrap();
+        timeout(Duration::from_secs(5), child.wait())
+            .await
+            .unwrap()
+            .unwrap();
+        panic!("ownership child timed out");
+    };
+    assert!(status.success());
+}
+
+#[tokio::test]
+async fn test_should_retain_legacy_provenance_without_rewriting_or_production_admission() {
+    let root = tempfile::tempdir().unwrap();
+    let first = lease(&root).await;
+    let owner = first.owner_id();
+    first.require_journaled().unwrap();
+    drop(first);
+    let mut bytes = tokio::fs::read(managed(&root, OWNER)).await.unwrap();
+    bytes.get_mut(..8).unwrap().copy_from_slice(LEGACY_MAGIC);
+    let checksum = Sha256::digest(bytes.get(..24).unwrap());
+    bytes.get_mut(24..).unwrap().copy_from_slice(&checksum);
+    tokio::fs::write(managed(&root, OWNER), &bytes)
+        .await
+        .unwrap();
+    let legacy = lease(&root).await;
+    assert_eq!(legacy.owner_id(), owner);
+    assert!(legacy.require_journaled().is_err());
+    assert_eq!(tokio::fs::read(managed(&root, OWNER)).await.unwrap(), bytes);
+    drop(legacy);
+    let again = lease(&root).await;
+    assert_eq!(again.owner_id(), owner);
+    assert!(again.require_journaled().is_err());
+}
+
+#[rstest::rstest]
+#[case("daemon.v1")]
+#[case("daemon.pending")]
+#[case("containers.v1")]
+#[case("containers.pending")]
+#[case("pins.v1")]
+#[case("pins.pending")]
+#[case("unknown-state")]
+#[tokio::test]
+async fn test_should_refuse_new_identity_over_unexplained_owner_missing_state(#[case] name: &str) {
+    let root = tempfile::tempdir().unwrap();
+    let first = lease(&root).await;
+    drop(first);
+    tokio::fs::remove_file(managed(&root, OWNER)).await.unwrap();
+    tokio::fs::write(managed(&root, name), b"retained-evidence")
+        .await
+        .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert!(!tokio::fs::try_exists(managed(&root, OWNER)).await.unwrap());
+    assert_eq!(
+        tokio::fs::read(managed(&root, name)).await.unwrap(),
+        b"retained-evidence"
+    );
+}
+
+#[tokio::test]
+async fn test_should_publish_journal_generation_before_effect_and_keep_downgrade_barrier() {
+    let root = tempfile::tempdir().unwrap();
+    let owner = lease(&root).await;
+    owner.require_journaled().unwrap();
+    let bytes = tokio::fs::read(managed(&root, OWNER)).await.unwrap();
+    assert_eq!(bytes.get(..8), Some(MAGIC.as_slice()));
+    assert_ne!(bytes.get(..8), Some(LEGACY_MAGIC.as_slice()));
+    let id = owner.owner_id();
+    drop(owner);
+    let again = lease(&root).await;
+    again.require_journaled().unwrap();
+    assert_eq!(again.owner_id(), id);
+}
+
+#[tokio::test]
+async fn test_should_retain_exact_blocking_acquisition_through_deadline_and_abandoned_observers() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let root = tempfile::tempdir().unwrap();
+    let data = DataDirectory::try_from(root.path().join("unpublished")).unwrap();
+    let at = deadline();
+    let cancelled = Arc::new(AtomicBool::new(false));
+    let (release, held) = mpsc::sync_channel(1);
+    let (entered, saw) = oneshot::channel();
+    let task = spawn_work(
+        POOL.acquire().await.unwrap(),
+        Control {
+            deadline: at,
+            cancelled: cancelled.clone(),
+        },
+        move |control| {
+            entered.send(()).unwrap();
+            held.recv().unwrap();
+            acquire(&data, control)
+        },
+    );
+    let mut pending = DirectoryAcquisition {
+        code: false,
+        cancelled,
+        deadline: at,
+        state: AcquisitionState::Running(task),
+    };
+    saw.await.unwrap();
+    assert!(matches!(
+        pending
+            .wait(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(DirectoryLeaseError::Deadline)
+    ));
+    pending.cancel();
+    assert_eq!(POOL.available_permits(), 0);
+    assert!(matches!(
+        pending
+            .wait(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(DirectoryLeaseError::Deadline)
+    ));
+    release.send(()).unwrap();
+    assert!(matches!(
+        pending.wait(deadline()).await,
+        Ok(Err(DirectoryLeaseError::Cancelled))
+    ));
+    assert!(matches!(
+        pending.wait(deadline()).await,
+        Ok(Err(DirectoryLeaseError::Worker))
+    ));
+    assert_eq!(POOL.available_permits(), 1);
+    assert!(!root.path().join("unpublished").exists());
+}
+#[tokio::test]
+async fn test_should_cache_panicked_acquisition_completion_without_repolling_its_handle() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let cancelled = Arc::new(AtomicBool::new(false));
+    let task = spawn_work(
+        POOL.acquire().await.unwrap(),
+        Control {
+            deadline: deadline(),
+            cancelled: cancelled.clone(),
+        },
+        |_| -> Result<DirectoryLease, DirectoryLeaseError> {
+            panic!("injected filesystem worker panic")
+        },
+    );
+    let mut pending = DirectoryAcquisition {
+        code: false,
+        cancelled,
+        deadline: deadline(),
+        state: AcquisitionState::Running(task),
+    };
+    for _ in 0..2 {
+        assert!(matches!(
+            pending.wait(deadline()).await,
+            Ok(Err(DirectoryLeaseError::Worker))
+        ));
+    }
+    assert_eq!(POOL.available_permits(), 1);
+}
+
+#[tokio::test]
+async fn test_should_keep_failed_ready_filesystem_result_charged_until_disposal() {
+    static POOL: Semaphore = Semaphore::const_new(1);
+    let task = spawn_work(
+        POOL.acquire().await.unwrap(),
+        Control {
+            deadline: deadline(),
+            cancelled: Arc::new(AtomicBool::new(false)),
+        },
+        |_| -> Result<(), DirectoryLeaseError> { Err(DirectoryLeaseError::InvalidState) },
+    );
+    timeout(Duration::from_secs(2), async {
+        while !task.is_finished() {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(POOL.available_permits(), 0);
+    let (result, permit) = task.await.unwrap();
+    assert!(matches!(result, Err(DirectoryLeaseError::InvalidState)));
+    assert_eq!(POOL.available_permits(), 0);
+    drop(permit);
+    assert_eq!(POOL.available_permits(), 1);
+}
+
+#[tokio::test]
+async fn test_should_acquire_code_profile_with_retained_job_and_refuse_older_profile_without_rewrite()
+ {
+    let root = tempfile::tempdir().unwrap();
+    let at = Instant::now() + Duration::from_secs(5);
+    let mut job = DirectoryAcquisition::begin_code(root.path().into(), at).unwrap();
+    let lease = job.wait(at).await.unwrap().unwrap();
+    assert!(lease.code_journaled());
+    drop(lease);
+    let old = tempfile::tempdir().unwrap();
+    let lease = DirectoryLease::acquire(old.path().into(), at)
+        .await
+        .unwrap();
+    drop(lease);
+    let owner = old.path().join(".rustack-lambda-docker/owner.v1");
+    let before = fs::read(&owner).await.unwrap();
+    let mut job = DirectoryAcquisition::begin_code(old.path().into(), at).unwrap();
+    assert!(matches!(
+        job.wait(at).await.unwrap(),
+        Err(DirectoryLeaseError::InvalidState)
+    ));
+    assert_eq!(fs::read(owner).await.unwrap(), before);
+}
diff --git a/crates/rustack-lambda-core/src/docker/pin.rs b/crates/rustack-lambda-core/src/docker/pin.rs
new file mode 100644
index 00000000..5fa9a112
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pin.rs
@@ -0,0 +1,264 @@
+//! Only generated private alias identities can reach image mutation endpoints.
+
+use std::fmt;
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{
+    DirectoryLease, DockerError, DockerPort, Operation, RawRequest, decode, escaped,
+    models::{ImageDeleteResponseItem, ImageInspect},
+    mutation::MutationGuard,
+    unit,
+};
+use crate::artifact::{ImageReference, Sha256Digest};
+
+/// Trusted runtime owner/run identity; never populated from a Lambda request.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct ImagePinScope {
+    lease: DirectoryLease,
+}
+impl ImagePinScope {
+    pub(super) fn directory(&self) -> &DirectoryLease {
+        &self.lease
+    }
+
+    /// Retain a real directory lease for this namespace and its allocated pins.
+    ///
+    /// ```no_run
+    /// # fn scope(lease: rustack_lambda_core::docker::DirectoryLease) {
+    /// let scope = rustack_lambda_core::docker::ImagePinScope::new(lease);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn new(lease: DirectoryLease) -> Self {
+        Self { lease }
+    }
+
+    #[cfg(test)]
+    pub(super) fn testing(owner: Uuid, run: Uuid) -> Result<Self, DockerError> {
+        if owner.is_nil() || run.is_nil() {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self::new(DirectoryLease::testing(owner, run)))
+    }
+    /// Allocate a fresh private alias before issuing any Docker mutation.
+    ///
+    /// # Errors
+    /// Returns validation failure if the generated reference cannot validate.
+    pub(super) fn allocate(&self) -> Result<ImagePin, DockerError> {
+        ImagePin::historical(self.lease.clone(), self.lease.run_id(), Uuid::new_v4())
+    }
+}
+
+/// An allocated alias; arbitrary source references cannot become cleanup keys.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ImagePin {
+    pub(super) id: Uuid,
+    pub(super) run: Uuid,
+    reference: ImageReference,
+    scope: ImagePinScope,
+}
+impl ImagePin {
+    pub(super) fn historical(
+        lease: DirectoryLease,
+        run: Uuid,
+        id: Uuid,
+    ) -> Result<Self, DockerError> {
+        if run.is_nil() || id.is_nil() {
+            return Err(DockerError::Configuration);
+        }
+        let reference = format!(
+            "rustack-internal/lambda-{}/{}:{}",
+            lease.owner_id().simple(),
+            run.simple(),
+            id.simple()
+        )
+        .parse()?;
+        Ok(Self {
+            id,
+            run,
+            reference,
+            scope: ImagePinScope::new(lease),
+        })
+    }
+    pub(super) fn directory(&self) -> &DirectoryLease {
+        &self.scope.lease
+    }
+}
+impl fmt::Debug for ImagePin {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ImagePin")
+            .field("id", &self.id)
+            .finish_non_exhaustive()
+    }
+}
+impl ImagePin {
+    /// Exact private alias; its namespace is reserved for the owning runtime.
+    ///
+    /// ```no_run
+    /// # fn reference(pin:&rustack_lambda_core::docker::ImagePin) {
+    /// let reference = pin.reference();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn reference(&self) -> &ImageReference {
+        &self.reference
+    }
+}
+
+impl DockerPort {
+    /// Create only the allocated private alias, targeting a captured image ID.
+    ///
+    /// # Errors
+    /// Returns bounded wire failure. Any uncertain outcome retains pin ownership.
+    ///
+    /// ```no_run
+    /// # async fn tag(port:&rustack_lambda_core::docker::DockerPort,id:&rustack_lambda_core::artifact::Sha256Digest,pin:&rustack_lambda_core::docker::ImagePin) {
+    /// let result = port.tag_image_pin(id,pin,tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn tag_image_pin(
+        &self,
+        id: &Sha256Digest,
+        pin: &ImagePin,
+        deadline: Instant,
+    ) -> Result<(), DockerError> {
+        self.tag_image_pin_inner(id, pin, deadline, None).await
+    }
+    pub(super) async fn tag_image_pin_tracked(
+        &self,
+        id: &Sha256Digest,
+        pin: &ImagePin,
+        deadline: Instant,
+        mutation: MutationGuard,
+    ) -> Result<(), DockerError> {
+        self.tag_image_pin_inner(id, pin, deadline, Some(mutation))
+            .await
+    }
+    async fn tag_image_pin_inner(
+        &self,
+        id: &Sha256Digest,
+        pin: &ImagePin,
+        deadline: Instant,
+        mutation: Option<MutationGuard>,
+    ) -> Result<(), DockerError> {
+        let query = form_urlencoded::Serializer::new(String::new())
+            .append_pair("repo", pin.reference.repository())
+            .append_pair("tag", &pin.id.simple().to_string())
+            .finish();
+        let reply = self
+            .raw
+            .request(
+                RawRequest {
+                    archive: None,
+                    pull: None,
+                    binding: None,
+                    mutation,
+                    operation: Operation::TagPin,
+                    method: Method::POST,
+                    target: format!(
+                        "/v{}/images/{}/tag?{query}",
+                        self.version,
+                        escaped(id.as_str())
+                    ),
+                    body: Bytes::new(),
+                    expected: StatusCode::CREATED,
+                },
+                deadline,
+            )
+            .await?;
+        unit(reply, deadline)
+    }
+
+    /// Inspect a known private alias using reserved cleanup capacity.
+    ///
+    /// # Errors
+    /// Returns missing alias status, bounded metadata or transport failure.
+    ///
+    /// ```no_run
+    /// # async fn inspect(port:&rustack_lambda_core::docker::DockerPort,pin:&rustack_lambda_core::docker::ImagePin) {
+    /// let result = port.inspect_image_pin(pin,tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn inspect_image_pin(
+        &self,
+        pin: &ImagePin,
+        deadline: Instant,
+    ) -> Result<ImageInspect, DockerError> {
+        decode(
+            self.call(
+                Operation::InspectPin,
+                Method::GET,
+                format!("/images/{}/json", escaped(pin.reference.as_str())),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+
+    /// Remove only an allocated private alias, without force or ancestor pruning.
+    ///
+    /// # Errors
+    /// Returns status, bounded response or transport failure. The owner verifies
+    /// identity under its exclusive namespace before removal and confirms absence.
+    ///
+    /// ```no_run
+    /// # async fn remove(port:&rustack_lambda_core::docker::DockerPort,pin:&rustack_lambda_core::docker::ImagePin) {
+    /// let result = port.remove_image_pin(pin,tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn remove_image_pin(
+        &self,
+        pin: &ImagePin,
+        deadline: Instant,
+    ) -> Result<Vec<ImageDeleteResponseItem>, DockerError> {
+        decode(
+            self.call(
+                Operation::RemovePin,
+                Method::DELETE,
+                format!(
+                    "/images/{}?force=false&noprune=true",
+                    escaped(pin.reference.as_str())
+                ),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+
+    pub(super) async fn image_manifests(
+        &self,
+        id: &Sha256Digest,
+        deadline: Instant,
+    ) -> Result<ImageInspect, DockerError> {
+        let suffix = if self.api_version().minor() >= 48 {
+            "?manifests=true"
+        } else {
+            ""
+        };
+        decode(
+            self.call(
+                Operation::Image,
+                Method::GET,
+                format!("/images/{}/json{suffix}", escaped(id.as_str())),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/plan.rs b/crates/rustack-lambda-core/src/docker/plan.rs
new file mode 100644
index 00000000..21c77981
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/plan.rs
@@ -0,0 +1,1007 @@
+//! Immutable, bounded container creation policy; lifetime ownership remains above IO.
+
+use std::{
+    collections::{BTreeMap, HashMap},
+    fmt,
+    str::FromStr,
+    sync::Arc,
+    time::Duration,
+};
+
+use rustack_lambda_model::types::ImageConfig;
+use rustack_lambda_runtime::protocol::EnvironmentId;
+use serde::Serialize;
+use tokio::time::Instant;
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use super::{
+    CodeVolumeIdentity, DirectoryLease, DockerError, DockerKey, DockerPort, DockerSdkEnvironment,
+    DockerZipRuntime,
+    models::{
+        ContainerCreateBody, ContainerCreateResponse, ContainerInspectResponse, HealthConfig,
+        HostConfig, HostConfigCgroupnsModeEnum, HostConfigLogConfig, Mount, MountType,
+        MountVolumeOptions, RestartPolicy, RestartPolicyNameEnum,
+    },
+    mutation::MutationGuard,
+    sdk::SdkAffiliation,
+    zip::{AllocationClaim, ZipPlan},
+};
+use crate::{
+    artifact::{DeploymentArtifact, PinnedImage},
+    executor::{ExecutionRevision, ExecutorBackend},
+    function_config::{validate_environment_entries, validate_provided_settings},
+    storage::compute_sha256,
+};
+
+const MIB: u64 = 1024 * 1024;
+const RELAY_MEMORY: u64 = 64 * MIB;
+const CPU_QUANTUM: u64 = 10_000_000;
+
+#[derive(Debug, Clone, Copy)]
+pub(super) enum ContainerRole {
+    Relay,
+    Function,
+}
+
+/// Operator network selection; a bridge still requires daemon startup validation.
+#[derive(Clone, PartialEq, Eq, Serialize)]
+#[non_exhaustive]
+pub struct NetworkSelection(String);
+impl NetworkSelection {
+    pub(super) fn value(&self) -> &str {
+        &self.0
+    }
+}
+impl fmt::Debug for NetworkSelection {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("NetworkSelection(<operator>)")
+    }
+}
+impl FromStr for NetworkSelection {
+    type Err = DockerError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value == "none" {
+            return Ok(Self(value.into()));
+        }
+        if matches!(value, "host" | "bridge" | "default") {
+            return Err(DockerError::Configuration);
+        }
+        value.parse::<DockerKey>()?;
+        Ok(Self(value.into()))
+    }
+}
+
+/// Integral relay session budgets independent of handler and deployment budgets.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[non_exhaustive]
+pub struct RelayBudgets {
+    io: Duration,
+    idle: Duration,
+    retirement: Duration,
+}
+impl Default for RelayBudgets {
+    fn default() -> Self {
+        Self {
+            io: Duration::from_secs(5),
+            idle: Duration::from_secs(600),
+            retirement: Duration::from_secs(10),
+        }
+    }
+}
+impl RelayBudgets {
+    /// Validate whole-second IO/retirement1..60s and idle1..86400s budgets.
+    ///
+    /// # Errors
+    /// Rejects zero, fractional or excessive durations.
+    ///
+    /// ```
+    /// let budgets = rustack_lambda_core::docker::RelayBudgets::new(
+    ///     std::time::Duration::from_secs(5), std::time::Duration::from_secs(600),
+    ///     std::time::Duration::from_secs(10))?;
+    /// # Ok::<(), rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn new(io: Duration, idle: Duration, retirement: Duration) -> Result<Self, DockerError> {
+        for (duration, maximum) in [(io, 60), (idle, 86400), (retirement, 60)] {
+            if duration.subsec_nanos() != 0 || !(1..=maximum).contains(&duration.as_secs()) {
+                return Err(DockerError::Configuration);
+            }
+        }
+        Ok(Self {
+            io,
+            idle,
+            retirement,
+        })
+    }
+}
+
+/// Validated operator limits, independent of user function configuration.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[non_exhaustive]
+pub struct ContainerPolicy {
+    pub(super) network: NetworkSelection,
+    uid: u32,
+    gid: u32,
+    requested_nano_cpus: u64,
+    pub(super) nano_cpus: i64,
+    relay: RelayBudgets,
+}
+impl ContainerPolicy {
+    pub(super) fn idle(&self) -> Duration {
+        self.relay.idle
+    }
+    /// Return the requested maximum and its downward-normalized CPU allocation.
+    ///
+    /// ```
+    /// use rustack_lambda_core::docker::{ContainerPolicy, RelayBudgets};
+    /// let policy = ContainerPolicy::new("none".parse()?, 1000, 1000,
+    ///     333_333_333, RelayBudgets::default())?;
+    /// assert_eq!(policy.cpu_allocation().effective_nano_cpus, 330_000_000);
+    /// # Ok::<(), rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    #[must_use]
+    pub fn cpu_allocation(&self) -> DockerCpuAllocation {
+        DockerCpuAllocation {
+            requested_nano_cpus: self.requested_nano_cpus,
+            effective_nano_cpus: self.nano_cpus.unsigned_abs(),
+        }
+    }
+    /// Validate UID/GID and0.1..16 CPUs, rounding CPU down to0.01 increments.
+    ///
+    /// # Errors
+    /// Rejects invalid IDs or CPU values, preserving bounded operator policy.
+    ///
+    /// ```
+    /// let policy = rustack_lambda_core::docker::ContainerPolicy::new(
+    ///     "none".parse()?, 1000, 1000, 1_000_000_000,
+    ///     rustack_lambda_core::docker::RelayBudgets::default())?;
+    /// # Ok::<(), rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn new(
+        network: NetworkSelection,
+        uid: u32,
+        gid: u32,
+        nano_cpus: u64,
+        relay: RelayBudgets,
+    ) -> Result<Self, DockerError> {
+        if !(1..=2_147_483_647).contains(&uid)
+            || !(1..=2_147_483_647).contains(&gid)
+            || !(100_000_000..=16_000_000_000).contains(&nano_cpus)
+        {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self {
+            network,
+            uid,
+            gid,
+            requested_nano_cpus: nano_cpus,
+            nano_cpus: i64::try_from(nano_cpus - nano_cpus % CPU_QUANTUM)
+                .map_err(|_| DockerError::Configuration)?,
+            relay,
+        })
+    }
+}
+
+/// Captured CPU maximum and the portable allocation actually sent to Docker.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct DockerCpuAllocation {
+    /// Original validated operator maximum, in billionths of one CPU.
+    pub requested_nano_cpus: u64,
+    /// Maximum rounded down to one-percent CPU increments, never upward.
+    pub effective_nano_cpus: u64,
+}
+
+struct Identity {
+    environment: EnvironmentId,
+    relay: DockerKey,
+    function: DockerKey,
+}
+struct Bodies {
+    relay: ContainerCreateBody,
+    function: ContainerCreateBody,
+    memory: u64,
+}
+
+/// Fixed create requests retaining revision, image availability and namespace leases.
+#[derive(TypedBuilder)]
+#[builder(builder_method(vis = ""))]
+#[non_exhaustive]
+pub struct EnvironmentPlan {
+    pub(super) directory: DirectoryLease,
+    relay: PinnedImage,
+    revision: Arc<ExecutionRevision>,
+    identity: Identity,
+    bodies: Bodies,
+    warm_key: String,
+    #[builder(default)]
+    pub(super) zip: Option<Arc<ZipPlan>>,
+    #[builder(default)]
+    sdk: Option<SdkAffiliation>,
+}
+impl fmt::Debug for EnvironmentPlan {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EnvironmentPlan")
+            .field("environment", &self.identity.environment)
+            .field("resource", &self.revision.resource_id)
+            .field("memory_bytes", &self.bodies.memory)
+            .finish_non_exhaustive()
+    }
+}
+impl EnvironmentPlan {
+    pub(super) fn with_sdk_environment(
+        mut self,
+        sdk: &DockerSdkEnvironment,
+    ) -> Result<Self, DockerError> {
+        let guard = sdk.liveness();
+        guard.live()?;
+        let entries = self
+            .bodies
+            .function
+            .env
+            .take()
+            .ok_or(DockerError::Configuration)?;
+        self.bodies.function.env = Some(sdk.environment(entries)?);
+        self.warm_key =
+            compute_sha256(format!("sdk-v1:{}:{}", self.warm_key, sdk.identity()).as_bytes());
+        self.sdk = Some(guard);
+        Ok(self)
+    }
+    pub(super) fn image_id(&self, role: ContainerRole) -> &str {
+        match role {
+            ContainerRole::Relay => self.relay.resolved().metadata().image_id.as_str(),
+            ContainerRole::Function => self.bodies.function.image.as_deref().unwrap_or_default(),
+        }
+    }
+    pub(super) fn warm_key(&self) -> &str {
+        &self.warm_key
+    }
+    pub(super) fn same_scope(&self, directory: &DirectoryLease) -> bool {
+        if self.zip.is_some() {
+            self.directory.same_instance(directory)
+        } else {
+            self.directory.owner_id() == directory.owner_id()
+                && self.directory.run_id() == directory.run_id()
+        }
+    }
+    pub(super) fn revision(&self) -> &ExecutionRevision {
+        &self.revision
+    }
+    pub(super) fn key(&self, role: ContainerRole) -> &DockerKey {
+        match role {
+            ContainerRole::Relay => self.relay_key(),
+            ContainerRole::Function => self.function_key(),
+        }
+    }
+    pub(super) fn owned(
+        &self,
+        role: ContainerRole,
+        inspected: &ContainerInspectResponse,
+    ) -> Result<DockerKey, DockerError> {
+        let body = match role {
+            ContainerRole::Relay => &self.bodies.relay,
+            ContainerRole::Function => &self.bodies.function,
+        };
+        let config = inspected.config.as_ref().ok_or(DockerError::Protocol)?;
+        let expected = body.labels.as_ref().ok_or(DockerError::Configuration)?;
+        let actual = config.labels.as_ref().ok_or(DockerError::Quarantined)?;
+        let id = inspected.id.as_deref().ok_or(DockerError::Protocol)?;
+        if id.len() != 64
+            || !id
+                .bytes()
+                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+            || inspected.name.as_deref() != Some(format!("/{}", self.key(role).as_str()).as_str())
+            || config.image != body.image
+            || !expected
+                .iter()
+                .all(|(key, value)| actual.get(key) == Some(value))
+        {
+            return Err(DockerError::Quarantined);
+        }
+        if matches!(role, ContainerRole::Function) {
+            if let Some(zip) = &self.zip {
+                let mounts = inspected.mounts.as_ref().ok_or(DockerError::Quarantined)?;
+                if mounts.len() != 1
+                    || mounts.first().is_none_or(|mount| {
+                        mount.typ.as_deref() != Some("volume")
+                            || mount.name.as_deref() != Some(zip.volume.as_str())
+                            || mount.destination.as_deref() != Some("/var/task")
+                            || mount.rw != Some(false)
+                            || mount.driver.as_deref() != Some("local")
+                    })
+                {
+                    return Err(DockerError::Quarantined);
+                }
+            }
+        }
+        id.parse()
+    }
+    pub(super) fn claim_code(&self) -> Result<Option<AllocationClaim>, DockerError> {
+        self.zip.as_ref().map(ZipPlan::claim).transpose()
+    }
+    pub(super) fn commit_code_claim(
+        &self,
+        claim: &mut Option<AllocationClaim>,
+    ) -> Result<(), DockerError> {
+        match (&self.zip, claim) {
+            (Some(plan), Some(claim)) if claim.belongs_to(plan) => {
+                claim.commit();
+                Ok(())
+            }
+            (None, None) => Ok(()),
+            _ => Err(DockerError::Configuration),
+        }
+    }
+    pub(super) fn code_clean(&self) -> bool {
+        self.zip.as_ref().is_none_or(|zip| zip.clean())
+    }
+    fn require_code(&self, role: ContainerRole) -> Result<(), DockerError> {
+        if matches!(role, ContainerRole::Function) {
+            if let Some(zip) = &self.zip {
+                zip.ready_mount()?;
+            }
+        }
+        Ok(())
+    }
+    /// Allocate identities and validate both immutable create bodies before IO.
+    ///
+    /// # Errors
+    /// Rejects unavailable/mismatched artifacts, invalid captured settings or
+    /// effective image configuration. This does not reserve environment capacity.
+    ///
+    /// ```no_run
+    /// # fn plan(directory: rustack_lambda_core::docker::DirectoryLease, relay: rustack_lambda_core::artifact::PinnedImage, revision: std::sync::Arc<rustack_lambda_core::executor::ExecutionRevision>, policy: rustack_lambda_core::docker::ContainerPolicy) {
+    /// let plan = rustack_lambda_core::docker::EnvironmentPlan::new(directory, relay, revision, policy);
+    /// # }
+    /// ```
+    pub fn new(
+        directory: DirectoryLease,
+        relay: PinnedImage,
+        revision: Arc<ExecutionRevision>,
+        policy: ContainerPolicy,
+    ) -> Result<Self, DockerError> {
+        Self::construct(directory, relay, revision, policy, None)
+    }
+
+    /// Plan provided.al2023 execution over an affiliated immutable base and producer.
+    ///
+    /// Conversion and allocation begin only after environment admission.
+    ///
+    /// # Errors
+    /// Rejects incompatible runtime/revision, source scope, platform or policy.
+    ///
+    /// ```no_run
+    /// # fn plan(directory:rustack_lambda_core::docker::DirectoryLease,relay:rustack_lambda_core::artifact::PinnedImage,revision:std::sync::Arc<rustack_lambda_core::executor::ExecutionRevision>,policy:rustack_lambda_core::docker::ContainerPolicy,source:rustack_lambda_core::docker::DockerZipRuntime) {
+    /// let plan=rustack_lambda_core::docker::EnvironmentPlan::new_zip(directory,relay,revision,policy,source);
+    /// # }
+    /// ```
+    pub fn new_zip(
+        directory: DirectoryLease,
+        relay: PinnedImage,
+        revision: Arc<ExecutionRevision>,
+        policy: ContainerPolicy,
+        source: DockerZipRuntime,
+    ) -> Result<Self, DockerError> {
+        Self::construct(directory, relay, revision, policy, Some(source))
+    }
+
+    fn construct(
+        directory: DirectoryLease,
+        relay: PinnedImage,
+        revision: Arc<ExecutionRevision>,
+        policy: ContainerPolicy,
+        zip: Option<DockerZipRuntime>,
+    ) -> Result<Self, DockerError> {
+        validate_revision(&revision)?;
+        let function = match (&revision.artifact, &zip) {
+            (DeploymentArtifact::Image(_), None) => image(&revision)?,
+            (DeploymentArtifact::Zip(_), Some(source)) => {
+                if !source.same_scope(&directory)
+                    || source.base.resolved().metadata().architecture != revision.architecture
+                {
+                    return Err(DockerError::Configuration);
+                }
+                source.available()?;
+                &source.base
+            }
+            _ => return Err(DockerError::Configuration),
+        };
+        if !relay.is_live() || relay.resolved().metadata().architecture != revision.architecture {
+            return Err(DockerError::Configuration);
+        }
+        let code = if zip.is_some() {
+            Some(CodeVolumeIdentity::new(
+                revision
+                    .resource_id
+                    .to_string()
+                    .parse()
+                    .map_err(|_| DockerError::Configuration)?,
+                revision
+                    .revision_id
+                    .parse()
+                    .map_err(|_| DockerError::Configuration)?,
+            )?)
+        } else {
+            None
+        };
+        let environment = match &code {
+            Some(code) => code
+                .environment_id()
+                .to_string()
+                .parse()
+                .map_err(|_| DockerError::Configuration)?,
+            None => EnvironmentId::default(),
+        };
+        let identity = Identity {
+            environment,
+            relay: format!("rustack-relay-{environment}").parse()?,
+            function: format!("rustack-function-{environment}").parse()?,
+        };
+        let labels = plan_labels(&directory, environment, &revision);
+        let (mut function_body, memory) =
+            function_create_body(function, &revision, &identity, &policy, &labels)?;
+        let warm_key = warm_identity(&directory, &relay, &revision, &policy, function)?;
+        let relay_body = relay_create_body(&relay, policy, environment, &labels)?;
+        let zip = match (zip, code) {
+            (Some(source), Some(code)) => Some(ZipPlan::new(source, code)?),
+            (None, None) => None,
+            _ => return Err(DockerError::Configuration),
+        };
+        if let Some(zip) = &zip {
+            function_body
+                .host_config
+                .as_mut()
+                .ok_or(DockerError::Configuration)?
+                .mounts = Some(vec![Mount {
+                typ: Some(MountType::VOLUME),
+                source: Some(zip.volume.as_str().into()),
+                target: Some("/var/task".into()),
+                read_only: Some(true),
+                volume_options: Some(MountVolumeOptions {
+                    no_copy: Some(true),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }]);
+        }
+        let memory = memory
+            .checked_add(RELAY_MEMORY)
+            .ok_or(DockerError::Configuration)?;
+        Ok(Self::builder()
+            .directory(directory)
+            .relay(relay)
+            .revision(revision)
+            .identity(identity)
+            .bodies(Bodies {
+                relay: relay_body,
+                function: function_body,
+                memory,
+            })
+            .warm_key(warm_key)
+            .zip(zip)
+            .build())
+    }
+
+    /// Fresh environment UUID used by both labels and control protocol.
+    ///
+    /// ```no_run
+    /// # fn id(plan: &rustack_lambda_core::docker::EnvironmentPlan) {
+    /// let id = plan.environment_id();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn environment_id(&self) -> EnvironmentId {
+        self.identity.environment
+    }
+
+    /// Preallocated relay identity retained through uncertain allocation cleanup.
+    ///
+    /// ```no_run
+    /// # fn key(plan: &rustack_lambda_core::docker::EnvironmentPlan) {
+    /// let name = plan.relay_key();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn relay_key(&self) -> &DockerKey {
+        &self.identity.relay
+    }
+
+    /// Preallocated function identity; never populated from invocation input.
+    ///
+    /// ```no_run
+    /// # fn key(plan: &rustack_lambda_core::docker::EnvironmentPlan) {
+    /// let name = plan.function_key();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn function_key(&self) -> &DockerKey {
+        &self.identity.function
+    }
+
+    /// Checked function plus relay memory required before allocation admission.
+    ///
+    /// ```no_run
+    /// # fn memory(plan: &rustack_lambda_core::docker::EnvironmentPlan) {
+    /// let bytes = plan.memory_bytes();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn memory_bytes(&self) -> u64 {
+        self.bodies.memory
+    }
+
+    /// Create the relay after its owner has recorded uncertain allocation.
+    ///
+    /// # Errors
+    /// Returns revoked availability, deadline, wire/status or schema failure.
+    /// Every uncertain outcome still requires owner reconciliation.
+    ///
+    /// ```no_run
+    /// # async fn create(plan: &rustack_lambda_core::docker::EnvironmentPlan, port: &rustack_lambda_core::docker::DockerPort) {
+    /// let created = plan.create_relay(port, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn create_relay(
+        &self,
+        port: &DockerPort,
+        deadline: Instant,
+    ) -> Result<ContainerCreateResponse, DockerError> {
+        self.live()?;
+        port.create_container_on_platform(
+            &self.identity.relay,
+            &self.bodies.relay,
+            self.revision.architecture,
+            deadline,
+        )
+        .await
+    }
+
+    /// Create the function only after its own relay is verified ready.
+    ///
+    /// # Errors
+    /// Returns revoked availability, deadline, wire/status or schema failure.
+    /// Caller owns startup ordering and every uncertain allocation outcome.
+    ///
+    /// ```no_run
+    /// # async fn create(plan: &rustack_lambda_core::docker::EnvironmentPlan, port: &rustack_lambda_core::docker::DockerPort) {
+    /// let created = plan.create_function(port, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn create_function(
+        &self,
+        port: &DockerPort,
+        deadline: Instant,
+    ) -> Result<ContainerCreateResponse, DockerError> {
+        self.live()?;
+        self.require_code(ContainerRole::Function)?;
+        port.create_container_on_platform(
+            &self.identity.function,
+            &self.bodies.function,
+            self.revision.architecture,
+            deadline,
+        )
+        .await
+    }
+    pub(super) async fn create_tracked(
+        &self,
+        role: ContainerRole,
+        port: &DockerPort,
+        deadline: Instant,
+        mutation: MutationGuard,
+    ) -> Result<ContainerCreateResponse, DockerError> {
+        self.live()?;
+        self.require_code(role)?;
+        let body = match role {
+            ContainerRole::Relay => &self.bodies.relay,
+            ContainerRole::Function => &self.bodies.function,
+        };
+        port.create_container_inner(
+            self.key(role),
+            body,
+            Some(self.revision.architecture),
+            deadline,
+            Some(mutation),
+        )
+        .await
+    }
+    pub(super) fn live(&self) -> Result<(), DockerError> {
+        if let Some(sdk) = &self.sdk {
+            sdk.live()?;
+        }
+        match &self.revision.artifact {
+            DeploymentArtifact::Image(function) if self.relay.is_live() && function.is_live() => {
+                Ok(())
+            }
+            DeploymentArtifact::Zip(_) if self.relay.is_live() => {
+                self.zip.as_ref().ok_or(DockerError::Configuration)?.live()
+            }
+            DeploymentArtifact::Image(_) | DeploymentArtifact::Zip(_) => Err(DockerError::Stopped),
+        }
+    }
+}
+
+fn plan_labels(
+    directory: &DirectoryLease,
+    environment: EnvironmentId,
+    revision: &ExecutionRevision,
+) -> HashMap<String, String> {
+    HashMap::from([
+        (
+            "rustack.lambda.ownerId".into(),
+            directory.owner_id().to_string(),
+        ),
+        (
+            "rustack.lambda.runId".into(),
+            directory.run_id().to_string(),
+        ),
+        (
+            "rustack.lambda.environmentId".into(),
+            environment.to_string(),
+        ),
+        (
+            "rustack.lambda.functionResourceId".into(),
+            revision.resource_id.to_string(),
+        ),
+    ])
+}
+fn relay_create_body(
+    relay: &PinnedImage,
+    policy: ContainerPolicy,
+    environment: EnvironmentId,
+    labels: &HashMap<String, String>,
+) -> Result<ContainerCreateBody, DockerError> {
+    let user = format!("{}:{}", policy.uid, policy.gid);
+    let mut relay = body(relay, None, &user, labels, "relay")?;
+    relay.env = Some(vec![
+        format!("RUSTACK_LAMBDA_ENVIRONMENT_ID={environment}"),
+        format!(
+            "RUSTACK_LAMBDA_RELAY_IO_SECONDS={}",
+            policy.relay.io.as_secs()
+        ),
+        format!(
+            "RUSTACK_LAMBDA_RELAY_IDLE_SECONDS={}",
+            policy.relay.idle.as_secs()
+        ),
+        format!(
+            "RUSTACK_LAMBDA_RELAY_RETIRE_SECONDS={}",
+            policy.relay.retirement.as_secs()
+        ),
+    ]);
+    relay.attach_stdin = Some(true);
+    relay.open_stdin = Some(true);
+    relay.stdin_once = Some(true);
+    relay.host_config = Some(limits(
+        policy.network.0,
+        RELAY_MEMORY,
+        100_000_000,
+        64,
+        MIB,
+    )?);
+    Ok(relay)
+}
+fn function_create_body(
+    function: &PinnedImage,
+    revision: &ExecutionRevision,
+    identity: &Identity,
+    policy: &ContainerPolicy,
+    labels: &HashMap<String, String>,
+) -> Result<(ContainerCreateBody, u64), DockerError> {
+    let user = format!("{}:{}", policy.uid, policy.gid);
+    let zip = matches!(revision.artifact, DeploymentArtifact::Zip(_));
+    let selected_user = if zip {
+        user.clone()
+    } else {
+        image_user(
+            &function.resolved().metadata().execution.metadata().user,
+            &user,
+        )?
+    };
+    let provided = ImageConfig {
+        entry_point: Some(vec!["/var/task/bootstrap".into()]),
+        command: Some(Vec::new()),
+        working_directory: Some("/var/task".into()),
+    };
+    let overrides = if zip {
+        Some(&provided)
+    } else {
+        revision.image_config.as_ref()
+    };
+    let mut body = body(function, overrides, &selected_user, labels, "function")?;
+    body.env = Some(function_environment(
+        revision,
+        identity.environment,
+        function,
+    )?);
+    let memory = u64::from(revision.memory_mb)
+        .checked_mul(MIB)
+        .ok_or(DockerError::Configuration)?;
+    body.host_config = Some(limits(
+        format!("container:{}", identity.relay.as_str()),
+        memory,
+        policy.nano_cpus,
+        256,
+        u64::from(revision.ephemeral_storage_mb)
+            .checked_mul(MIB)
+            .ok_or(DockerError::Configuration)?,
+    )?);
+    Ok((body, memory))
+}
+
+fn warm_identity(
+    directory: &DirectoryLease,
+    relay: &PinnedImage,
+    revision: &ExecutionRevision,
+    policy: &ContainerPolicy,
+    function: &PinnedImage,
+) -> Result<String, DockerError> {
+    let environment: BTreeMap<_, _> = revision.environment.iter().collect();
+    let encoded = serde_json::to_vec(&(
+        (
+            directory.owner_id().to_string(),
+            directory.run_id().to_string(),
+        ),
+        (
+            revision.resource_id.to_string(),
+            &revision.revision_id,
+            &revision.function_name,
+            &revision.qualifier,
+        ),
+        (
+            revision.architecture,
+            function.resolved().metadata(),
+            relay.resolved().metadata(),
+        ),
+        (
+            &revision.image_config,
+            environment,
+            revision.timeout,
+            revision.memory_mb,
+            revision.ephemeral_storage_mb,
+        ),
+        (
+            &policy,
+            &revision.runtime,
+            &revision.handler,
+            match &revision.artifact {
+                DeploymentArtifact::Zip(code) => Some(code.sha256()),
+                DeploymentArtifact::Image(_) => None,
+            },
+        ),
+    ))
+    .map_err(|_| DockerError::Configuration)?;
+    Ok(compute_sha256(&encoded))
+}
+
+fn image(revision: &ExecutionRevision) -> Result<&PinnedImage, DockerError> {
+    match &revision.artifact {
+        DeploymentArtifact::Image(image)
+            if image.is_live()
+                && image.resolved().metadata().architecture == revision.architecture =>
+        {
+            Ok(image)
+        }
+        _ => Err(DockerError::Configuration),
+    }
+}
+fn validate_revision(revision: &ExecutionRevision) -> Result<(), DockerError> {
+    if revision.revision_id.len() != 36 {
+        return Err(DockerError::Configuration);
+    }
+    let id = Uuid::parse_str(&revision.revision_id).map_err(|_| DockerError::Configuration)?;
+    let version = &revision.qualifier;
+    let numeric_version = version.len() <= 20
+        && version
+            .parse::<u64>()
+            .is_ok_and(|number| number > 0 && number.to_string() == *version);
+    if revision.backend != ExecutorBackend::Docker
+        || id.is_nil()
+        || id.to_string() != revision.revision_id
+        || !(1..=64).contains(&revision.function_name.len())
+        || !revision
+            .function_name
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || b"_-".contains(&byte))
+        || (version != "$LATEST" && !numeric_version)
+        || !(1..=900).contains(&revision.timeout.as_secs())
+        || revision.timeout.subsec_nanos() != 0
+        || !(128..=10240).contains(&revision.memory_mb)
+        || !(512..=10240).contains(&revision.ephemeral_storage_mb)
+    {
+        return Err(DockerError::Configuration);
+    }
+    match &revision.artifact {
+        DeploymentArtifact::Image(_)
+            if revision.runtime.is_none() && revision.handler.is_none() =>
+        {
+            image(revision)?;
+        }
+        DeploymentArtifact::Zip(_) if revision.image_config.is_none() => {
+            validate_provided_settings(revision.runtime.as_deref(), revision.handler.as_deref())
+                .map_err(|_| DockerError::Configuration)?;
+        }
+        _ => return Err(DockerError::Configuration),
+    }
+    Ok(())
+}
+
+fn body(
+    image: &PinnedImage,
+    overrides: Option<&ImageConfig>,
+    user: &str,
+    labels: &HashMap<String, String>,
+    role: &str,
+) -> Result<ContainerCreateBody, DockerError> {
+    let plan = image.resolved().metadata().execution.plan(overrides)?;
+    let mut labels = labels.clone();
+    labels.insert("rustack.lambda.role".into(), role.into());
+    Ok(ContainerCreateBody {
+        image: Some(image.resolved().metadata().image_id.as_str().into()),
+        entrypoint: Some(plan.entrypoint().to_vec()),
+        cmd: Some(plan.command().to_vec()),
+        working_dir: Some(plan.working_directory().into()),
+        user: Some(user.into()),
+        labels: Some(labels),
+        tty: Some(false),
+        attach_stdin: Some(false),
+        attach_stdout: Some(true),
+        attach_stderr: Some(true),
+        open_stdin: Some(false),
+        stdin_once: Some(false),
+        healthcheck: Some(HealthConfig {
+            test: Some(vec!["NONE".into()]),
+            ..Default::default()
+        }),
+        ..Default::default()
+    })
+}
+
+fn limits(
+    network: String,
+    memory: u64,
+    cpu: i64,
+    pids: i64,
+    temporary: u64,
+) -> Result<HostConfig, DockerError> {
+    let memory = i64::try_from(memory).map_err(|_| DockerError::Configuration)?;
+    Ok(HostConfig {
+        cgroupns_mode: Some(HostConfigCgroupnsModeEnum::PRIVATE),
+        network_mode: Some(network),
+        memory: Some(memory),
+        memory_swap: Some(memory),
+        oom_kill_disable: Some(false),
+        nano_cpus: Some(cpu),
+        pids_limit: Some(pids),
+        readonly_rootfs: Some(true),
+        cap_drop: Some(vec!["ALL".into()]),
+        security_opt: Some(vec!["no-new-privileges:true".into()]),
+        privileged: Some(false),
+        publish_all_ports: Some(false),
+        auto_remove: Some(false),
+        restart_policy: Some(RestartPolicy {
+            name: Some(RestartPolicyNameEnum::NO),
+            maximum_retry_count: Some(0),
+        }),
+        log_config: Some(HostConfigLogConfig {
+            typ: Some("none".into()),
+            config: None,
+        }),
+        tmpfs: Some(HashMap::from([(
+            "/tmp".into(),
+            format!("rw,nosuid,nodev,size={temporary},mode=1777"),
+        )])),
+        ..Default::default()
+    })
+}
+
+fn image_user(value: &str, fallback: &str) -> Result<String, DockerError> {
+    if value.is_empty() {
+        return Ok(fallback.into());
+    }
+    let mut parts = value.split(':');
+    let user = parts.next().ok_or(DockerError::Configuration)?;
+    let group = parts.next();
+    if parts.next().is_some() || !account(user) || group.is_some_and(|group| !account(group)) {
+        return Err(DockerError::Configuration);
+    }
+    if user == "root" || user.parse::<u32>().is_ok_and(|uid| uid == 0) {
+        Ok(fallback.into())
+    } else {
+        Ok(value.into())
+    }
+}
+fn account(value: &str) -> bool {
+    if value.is_empty() || value.len() > 64 {
+        return false;
+    }
+    if value.bytes().all(|byte| byte.is_ascii_digit()) {
+        return value.parse::<u32>().is_ok_and(|id| id <= 2_147_483_647);
+    }
+    value
+        .as_bytes()
+        .first()
+        .is_some_and(|byte| byte.is_ascii_alphabetic() || *byte == b'_')
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || b"_.-".contains(&byte))
+}
+
+fn function_environment(
+    revision: &ExecutionRevision,
+    environment: EnvironmentId,
+    image: &PinnedImage,
+) -> Result<Vec<String>, DockerError> {
+    if revision.environment.len() > 130 {
+        return Err(DockerError::Configuration);
+    }
+    validate_environment_entries(
+        revision
+            .environment
+            .iter()
+            .filter(|(key, _)| !matches!(key.as_str(), "AWS_REGION" | "AWS_DEFAULT_REGION")),
+    )
+    .map_err(|_| DockerError::Configuration)?;
+    let region = revision
+        .environment
+        .get("AWS_REGION")
+        .ok_or(DockerError::Configuration)?;
+    if !(1..=64).contains(&region.len())
+        || !region
+            .bytes()
+            .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
+        || revision.environment.get("AWS_DEFAULT_REGION") != Some(region)
+    {
+        return Err(DockerError::Configuration);
+    }
+    let mut output: BTreeMap<String, Option<String>> = BTreeMap::new();
+    for entry in &image.resolved().metadata().execution.metadata().environment {
+        let (key, value) = entry
+            .split_once('=')
+            .map_or((entry.as_str(), None), |(key, value)| {
+                (key, Some(value.to_owned()))
+            });
+        output.insert(key.to_owned(), value);
+    }
+    for (key, value) in &revision.environment {
+        output.insert(key.clone(), Some(value.clone()));
+    }
+    let authoritative = [
+        "AWS_LAMBDA_RUNTIME_API=127.0.0.1:9001".into(),
+        format!("AWS_LAMBDA_FUNCTION_NAME={}", revision.function_name),
+        format!("AWS_LAMBDA_FUNCTION_VERSION={}", revision.qualifier),
+        format!("AWS_LAMBDA_FUNCTION_MEMORY_SIZE={}", revision.memory_mb),
+        format!("AWS_LAMBDA_FUNCTION_TIMEOUT={}", revision.timeout.as_secs()),
+        "AWS_LAMBDA_INITIALIZATION_TYPE=on-demand".into(),
+        format!(
+            "AWS_LAMBDA_LOG_GROUP_NAME=/aws/lambda/{}",
+            revision.function_name
+        ),
+        format!("AWS_LAMBDA_LOG_STREAM_NAME=rustack/{environment}"),
+        "LAMBDA_TASK_ROOT=/var/task".into(),
+    ];
+    if let DeploymentArtifact::Zip(_) = &revision.artifact {
+        output.insert(
+            "_HANDLER".into(),
+            Some(revision.handler.clone().ok_or(DockerError::Configuration)?),
+        );
+        output.insert(
+            "AWS_EXECUTION_ENV".into(),
+            Some("AWS_Lambda_provided.al2023".into()),
+        );
+    }
+    for entry in authoritative {
+        let (key, value) = entry.split_once('=').ok_or(DockerError::Configuration)?;
+        output.insert(key.to_owned(), Some(value.to_owned()));
+    }
+    Ok(output
+        .into_iter()
+        .map(|(key, value)| match value {
+            Some(value) => format!("{key}={value}"),
+            None => key,
+        })
+        .collect())
+}
+
+#[cfg(test)]
+#[path = "plan_tests.rs"]
+pub(super) mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/plan_tests.rs b/crates/rustack-lambda-core/src/docker/plan_tests.rs
new file mode 100644
index 00000000..06d1e7aa
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/plan_tests.rs
@@ -0,0 +1,643 @@
+use std::{collections::HashSet, sync::atomic::AtomicBool};
+
+use tokio::{
+    sync::watch,
+    time::{Instant, timeout},
+};
+
+use super::*;
+use crate::{
+    artifact::{
+        Architecture, ImageExecutionMetadata, ImageMetadata, ResolvedImage, ValidatedArtifact,
+    },
+    identity::FunctionResourceId,
+};
+
+fn directory() -> DirectoryLease {
+    DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4())
+}
+pub(in crate::docker) fn policy() -> ContainerPolicy {
+    ContainerPolicy::new(
+        "none".parse().unwrap(),
+        1000,
+        1000,
+        1_000_000_000,
+        RelayBudgets::default(),
+    )
+    .unwrap()
+}
+
+#[rstest::rstest]
+#[case(100_000_000, 100_000_000)]
+#[case(109_999_999, 100_000_000)]
+#[case(333_333_333, 330_000_000)]
+#[case(1_000_000_000, 1_000_000_000)]
+#[case(15_999_999_999, 15_990_000_000)]
+#[case(16_000_000_000, 16_000_000_000)]
+fn test_should_capture_requested_cpu_and_normalize_without_exceeding_it(
+    #[case] requested: u64,
+    #[case] effective: u64,
+) -> anyhow::Result<()> {
+    let policy = ContainerPolicy::new(
+        "none".parse()?,
+        1000,
+        1000,
+        requested,
+        RelayBudgets::default(),
+    )?;
+    let allocation = policy.cpu_allocation();
+    assert_eq!(allocation.requested_nano_cpus, requested);
+    assert_eq!(allocation.effective_nano_cpus, effective);
+    assert_eq!(u64::try_from(policy.nano_cpus)?, effective);
+    assert_eq!(
+        serde_json::to_value(allocation)?,
+        serde_json::json!({
+            "requestedNanoCpus": requested, "effectiveNanoCpus": effective,
+        })
+    );
+    Ok(())
+}
+
+proptest::proptest! {
+    #[test]
+    fn test_should_keep_normalization_bounded_and_idempotent(requested in 100_000_000_u64..=16_000_000_000_u64) {
+        let first = ContainerPolicy::new("none".parse()?, 1000, 1000, requested, RelayBudgets::default())?;
+        let allocation = first.cpu_allocation();
+        proptest::prop_assert!(allocation.effective_nano_cpus <= requested);
+        proptest::prop_assert!(requested - allocation.effective_nano_cpus < CPU_QUANTUM);
+        proptest::prop_assert_eq!(allocation.effective_nano_cpus % CPU_QUANTUM, 0);
+        let second = ContainerPolicy::new(first.network.clone(), 1000, 1000,
+            allocation.effective_nano_cpus, RelayBudgets::default())?;
+        proptest::prop_assert_eq!(first.nano_cpus, second.nano_cpus);
+    }
+}
+
+#[rstest::rstest]
+#[case(0)]
+#[case(99_999_999)]
+#[case(16_000_000_001)]
+fn test_should_reject_requested_cpu_outside_the_original_range(#[case] requested: u64) {
+    assert!(
+        ContainerPolicy::new(
+            "none".parse().unwrap(),
+            1000,
+            1000,
+            requested,
+            RelayBudgets::default()
+        )
+        .is_err()
+    );
+}
+pub(in crate::docker) fn image_with(user: &str, environment: Vec<String>) -> PinnedImage {
+    let mut metadata = ResolvedImage::fixture(Architecture::Arm64)
+        .metadata()
+        .clone();
+    metadata.execution = ImageExecutionMetadata::builder()
+        .entrypoint(vec!["/bootstrap".into()])
+        .command(vec!["handler".into()])
+        .working_directory("/var/task".into())
+        .environment(environment)
+        .user(user.into())
+        .build()
+        .try_into()
+        .unwrap();
+    metadata.inspection_hash = ImageMetadata::execution_fingerprint(
+        &metadata.image_id,
+        metadata.selected_manifest.as_ref(),
+        metadata.architecture,
+        metadata.size_bytes,
+        &metadata.execution,
+    )
+    .unwrap();
+    PinnedImage::fixture(metadata.try_into().unwrap())
+}
+pub(in crate::docker) fn revision() -> ExecutionRevision {
+    ExecutionRevision::builder()
+        .resource_id(FunctionResourceId::new())
+        .revision_id(Uuid::new_v4().to_string())
+        .backend(ExecutorBackend::Docker)
+        .function_name("policy-fixture".into())
+        .qualifier("$LATEST".into())
+        .runtime(None)
+        .handler(None)
+        .architecture(Architecture::Arm64)
+        .artifact(DeploymentArtifact::Image(image_with(
+            "root",
+            vec!["BASE=value".into()],
+        )))
+        .image_config(None)
+        .environment(HashMap::from([
+            ("AWS_REGION".into(), "us-east-1".into()),
+            ("AWS_DEFAULT_REGION".into(), "us-east-1".into()),
+            ("TEST_VALUE".into(), "secret-value".into()),
+        ]))
+        .timeout(Duration::from_secs(3))
+        .memory_mb(192)
+        .ephemeral_storage_mb(512)
+        .build()
+}
+fn plan(revision: ExecutionRevision) -> Result<EnvironmentPlan, DockerError> {
+    EnvironmentPlan::new(
+        directory(),
+        image_with("0", vec![]),
+        Arc::new(revision),
+        policy(),
+    )
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+
+#[test]
+fn test_should_capture_fixed_images_identities_labels_and_complete_resource_policy() {
+    let directory = directory();
+    let owner = directory.owner_id();
+    let run = directory.run_id();
+    let revision = revision();
+    let resource = revision.resource_id;
+    let image = image(&revision)
+        .unwrap()
+        .resolved()
+        .metadata()
+        .image_id
+        .clone();
+    let plan = EnvironmentPlan::new(
+        directory,
+        image_with("0", vec![]),
+        Arc::new(revision),
+        policy(),
+    )
+    .unwrap();
+    assert_ne!(plan.relay_key().as_str(), plan.function_key().as_str());
+    assert_eq!(plan.memory_bytes(), 256 * MIB);
+    for (body, role, memory, cpu, pids, tmp) in [
+        (&plan.bodies.relay, "relay", 64 * MIB, 100_000_000, 64, MIB),
+        (
+            &plan.bodies.function,
+            "function",
+            192 * MIB,
+            1_000_000_000,
+            256,
+            512 * MIB,
+        ),
+    ] {
+        assert_eq!(body.image.as_deref(), Some(image.as_str()));
+        assert_eq!(body.tty, Some(false));
+        assert_eq!(body.user.as_deref(), Some("1000:1000"));
+        assert_eq!(
+            body.healthcheck.as_ref().unwrap().test.as_ref().unwrap(),
+            &["NONE"]
+        );
+        let labels = body.labels.as_ref().unwrap();
+        assert_eq!(labels["rustack.lambda.ownerId"], owner.to_string());
+        assert_eq!(labels["rustack.lambda.runId"], run.to_string());
+        assert_eq!(
+            labels["rustack.lambda.environmentId"],
+            plan.environment_id().to_string()
+        );
+        assert_eq!(
+            labels["rustack.lambda.functionResourceId"],
+            resource.to_string()
+        );
+        assert_eq!(labels["rustack.lambda.role"], role);
+        let limits = body.host_config.as_ref().unwrap();
+        assert_eq!(
+            limits.cgroupns_mode,
+            Some(HostConfigCgroupnsModeEnum::PRIVATE)
+        );
+        assert_eq!(limits.memory, Some(i64::try_from(memory).unwrap()));
+        assert_eq!(limits.memory_swap, limits.memory);
+        assert_eq!(limits.oom_kill_disable, Some(false));
+        assert_eq!(limits.nano_cpus, Some(cpu));
+        assert_eq!(limits.pids_limit, Some(pids));
+        assert_eq!(limits.readonly_rootfs, Some(true));
+        assert_eq!(limits.cap_drop.as_ref().unwrap(), &["ALL"]);
+        assert_eq!(
+            limits.security_opt.as_ref().unwrap(),
+            &["no-new-privileges:true"]
+        );
+        assert_eq!(limits.privileged, Some(false));
+        assert_eq!(limits.auto_remove, Some(false));
+        assert_eq!(limits.publish_all_ports, Some(false));
+        assert_eq!(
+            limits.restart_policy.as_ref().unwrap().name,
+            Some(RestartPolicyNameEnum::NO)
+        );
+        assert_eq!(
+            limits.log_config.as_ref().unwrap().typ.as_deref(),
+            Some("none")
+        );
+        assert_eq!(
+            limits.tmpfs.as_ref().unwrap()["/tmp"],
+            format!("rw,nosuid,nodev,size={tmp},mode=1777")
+        );
+        assert!(
+            limits.binds.is_none() && limits.devices.is_none() && limits.port_bindings.is_none()
+        );
+    }
+    assert_eq!(plan.bodies.relay.attach_stdin, Some(true));
+    assert_eq!(plan.bodies.relay.open_stdin, Some(true));
+    assert_eq!(plan.bodies.relay.stdin_once, Some(true));
+    assert_eq!(plan.bodies.function.attach_stdin, Some(false));
+    assert_eq!(
+        plan.bodies
+            .function
+            .host_config
+            .as_ref()
+            .unwrap()
+            .network_mode
+            .as_deref(),
+        Some(format!("container:{}", plan.relay_key().as_str()).as_str())
+    );
+    assert!(!format!("{plan:?}").contains("secret-value"));
+}
+
+#[test]
+fn test_should_preserve_explicit_image_overrides_and_authoritative_environment_order() {
+    let mut captured = revision();
+    captured.qualifier = "27".into();
+    captured.artifact = DeploymentArtifact::Image(image_with(
+        "1234:4321",
+        vec![
+            "TEST_VALUE=old".into(),
+            "AWS_LAMBDA_RUNTIME_API=outside:9001".into(),
+            "DELETED".into(),
+        ],
+    ));
+    captured.image_config = Some(ImageConfig {
+        entry_point: Some(vec![]),
+        command: Some(vec!["/actual".into(), "$(not-a-shell)".into()]),
+        working_directory: Some("/app".into()),
+    });
+    let plan = plan(captured).unwrap();
+    let body = &plan.bodies.function;
+    assert_eq!(body.user.as_deref(), Some("1234:4321"));
+    assert_eq!(body.entrypoint.as_ref().unwrap(), &[""]);
+    assert_eq!(body.cmd.as_ref().unwrap(), &["/actual", "$(not-a-shell)"]);
+    assert_eq!(body.working_dir.as_deref(), Some("/app"));
+    let env = body.env.as_ref().unwrap();
+    assert!(env.iter().any(|entry| entry == "DELETED"));
+    let keys: HashSet<_> = env
+        .iter()
+        .map(|entry| entry.split('=').next().unwrap())
+        .collect();
+    assert_eq!(keys.len(), env.len());
+    assert_eq!(
+        env.iter()
+            .find(|entry| entry.starts_with("AWS_LAMBDA_RUNTIME_API="))
+            .unwrap(),
+        "AWS_LAMBDA_RUNTIME_API=127.0.0.1:9001"
+    );
+    assert!(
+        !env.iter()
+            .any(|entry| entry.contains("outside:9001") || entry == "TEST_VALUE=old")
+    );
+    assert!(env.contains(&"TEST_VALUE=secret-value".into()));
+    assert!(env.contains(&"AWS_LAMBDA_FUNCTION_VERSION=27".into()));
+    assert!(env.contains(&"AWS_LAMBDA_FUNCTION_MEMORY_SIZE=192".into()));
+    assert!(env.contains(&"AWS_LAMBDA_FUNCTION_TIMEOUT=3".into()));
+    assert!(env.contains(&"LAMBDA_TASK_ROOT=/var/task".into()));
+    let relay = plan.bodies.relay.env.as_ref().unwrap();
+    assert_eq!(relay.len(), 4);
+    assert!(!relay.iter().any(|entry| entry.contains("secret-value")));
+}
+
+#[rstest::rstest]
+#[case::absent("", "1000:1000")]
+#[case::root("root", "1000:1000")]
+#[case::numeric_root("0:4321", "1000:1000")]
+#[case::padded_root("0000", "1000:1000")]
+#[case::numeric("1234", "1234")]
+#[case::named("nobody:nogroup", "nobody:nogroup")]
+#[case::named_numeric_group("app_user:0", "app_user:0")]
+fn test_should_select_nonroot_container_users(#[case] user: &str, #[case] expected: &str) {
+    assert_eq!(image_user(user, "1000:1000").unwrap(), expected);
+}
+#[rstest::rstest]
+#[case(":1000")]
+#[case("1000:")]
+#[case("root:group:extra")]
+#[case("+0")]
+#[case("4294967295")]
+#[case("account name")]
+#[case("/root")]
+fn test_should_reject_malformed_image_users(#[case] user: &str) {
+    assert!(image_user(user, "1000:1000").is_err());
+}
+
+#[rstest::rstest]
+#[case("host")]
+#[case("bridge")]
+#[case("default")]
+#[case("container:other")]
+#[case("")]
+#[case("bad/network")]
+fn test_should_reject_unsafe_network_selections(#[case] value: &str) {
+    assert!(value.parse::<NetworkSelection>().is_err());
+}
+#[test]
+fn test_should_accept_disconnected_and_named_operator_networks_without_claiming_probe_success() {
+    for name in ["none", "rustack-test", "ab0123"] {
+        assert!(name.parse::<NetworkSelection>().is_ok());
+    }
+    for (uid, gid, cpu) in [
+        (0, 1000, 1_000_000_000),
+        (1000, 0, 1_000_000_000),
+        (u32::MAX, 1000, 1_000_000_000),
+        (1000, 1000, 0),
+        (1000, 1000, 99_999_999),
+        (1000, 1000, 16_000_000_001),
+    ] {
+        assert!(
+            ContainerPolicy::new(
+                "none".parse().unwrap(),
+                uid,
+                gid,
+                cpu,
+                RelayBudgets::default()
+            )
+            .is_err()
+        );
+    }
+    for cpu in [100_000_000, 16_000_000_000] {
+        assert!(
+            ContainerPolicy::new(
+                "none".parse().unwrap(),
+                1,
+                2_147_483_647,
+                cpu,
+                RelayBudgets::default()
+            )
+            .is_ok()
+        );
+    }
+    for durations in [
+        (
+            Duration::ZERO,
+            Duration::from_secs(600),
+            Duration::from_secs(10),
+        ),
+        (
+            Duration::from_secs(61),
+            Duration::from_secs(600),
+            Duration::from_secs(10),
+        ),
+        (
+            Duration::from_secs(5),
+            Duration::from_secs(86401),
+            Duration::from_secs(10),
+        ),
+        (
+            Duration::from_secs(5),
+            Duration::from_millis(1500),
+            Duration::from_secs(10),
+        ),
+        (
+            Duration::from_secs(5),
+            Duration::from_secs(600),
+            Duration::from_secs(61),
+        ),
+    ] {
+        assert!(RelayBudgets::new(durations.0, durations.1, durations.2).is_err());
+    }
+}
+
+#[rstest::rstest]
+#[case("backend")]
+#[case("zip")]
+#[case("runtime")]
+#[case("handler")]
+#[case("nil_revision")]
+#[case("revision_case")]
+#[case("name")]
+#[case("name_length")]
+#[case("alias")]
+#[case("zero_version")]
+#[case("padded_version")]
+#[case("overflow_version")]
+#[case("timeout_zero")]
+#[case("timeout_excess")]
+#[case("timeout_fraction")]
+#[case("memory_low")]
+#[case("memory_high")]
+#[case("tmp_low")]
+#[case("tmp_high")]
+#[case("architecture")]
+#[case("region_missing")]
+#[case("region_mismatch")]
+#[case("region_invalid")]
+#[case("reserved_env")]
+#[case("environment_bytes")]
+#[case("environment_nul")]
+#[case("empty_argv")]
+fn test_should_reject_invalid_captured_revisions_before_any_daemon_operation(
+    #[case] scenario: &str,
+) {
+    let mut revision = revision();
+    match scenario {
+        "backend" => revision.backend = ExecutorBackend::Native,
+        "zip" => revision.artifact = DeploymentArtifact::Zip(ValidatedArtifact::fixture()),
+        "runtime" => revision.runtime = Some("provided.al2023".into()),
+        "handler" => revision.handler = Some("bootstrap".into()),
+        "nil_revision" => revision.revision_id = Uuid::nil().to_string(),
+        "revision_case" => revision.revision_id = "AAAAAAAA-AAAA-4AAA-8AAA-AAAAAAAAAAAA".into(),
+        "name" => revision.function_name = "bad/name".into(),
+        "name_length" => revision.function_name = "x".repeat(65),
+        "alias" => revision.qualifier = "prod".into(),
+        "zero_version" => revision.qualifier = "0".into(),
+        "padded_version" => revision.qualifier = "01".into(),
+        "overflow_version" => revision.qualifier = "18446744073709551616".into(),
+        "timeout_zero" => revision.timeout = Duration::ZERO,
+        "timeout_excess" => revision.timeout = Duration::from_secs(901),
+        "timeout_fraction" => revision.timeout = Duration::from_millis(1500),
+        "memory_low" => revision.memory_mb = 127,
+        "memory_high" => revision.memory_mb = 10241,
+        "tmp_low" => revision.ephemeral_storage_mb = 511,
+        "tmp_high" => revision.ephemeral_storage_mb = 10241,
+        "architecture" => revision.architecture = Architecture::X86_64,
+        "region_missing" => {
+            revision.environment.remove("AWS_REGION");
+        }
+        "region_mismatch" => {
+            revision
+                .environment
+                .insert("AWS_DEFAULT_REGION".into(), "different".into());
+        }
+        "region_invalid" => {
+            revision
+                .environment
+                .insert("AWS_REGION".into(), "outside\nregion".into());
+        }
+        "reserved_env" => {
+            revision
+                .environment
+                .insert("AWS_LAMBDA_RUNTIME_API".into(), "outside:9001".into());
+        }
+        "environment_bytes" => {
+            revision
+                .environment
+                .insert("TOO_LARGE".into(), "x".repeat(4096));
+        }
+        "environment_nul" => {
+            revision.environment.insert("BAD_VALUE".into(), "\0".into());
+        }
+        "empty_argv" => {
+            revision.image_config = Some(ImageConfig {
+                entry_point: Some(vec![]),
+                command: Some(vec![]),
+                working_directory: None,
+            });
+        }
+        _ => panic!("unknown fixture scenario"),
+    }
+    assert!(plan(revision).is_err(), "{scenario}");
+}
+
+#[tokio::test]
+async fn test_should_retain_the_real_directory_until_allocation_plan_is_released() {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let plan = EnvironmentPlan::new(
+        directory,
+        image_with("", vec![]),
+        Arc::new(revision()),
+        policy(),
+    )
+    .unwrap();
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), deadline()).await,
+        Err(super::super::DirectoryLeaseError::InUse)
+    ));
+    drop(plan);
+    assert!(
+        DirectoryLease::acquire(root.path().into(), deadline())
+            .await
+            .is_ok()
+    );
+}
+
+#[tokio::test]
+async fn test_should_submit_exact_captured_platform_and_refuse_revoked_availability_before_io() {
+    let mut daemon = super::super::tests::Daemon::new();
+    let mut wire = daemon.wire().await;
+    let plan = Arc::new(plan(revision()).unwrap());
+    let worker = {
+        let plan = plan.clone();
+        let port = wire.port();
+        tokio::spawn(async move { plan.create_relay(&port, deadline()).await })
+    };
+    let request = daemon.next().await;
+    assert!(request.head.contains("platform=linux%2Farm64"));
+    request
+        .reply(201, b"{\"Id\":\"created\",\"Warnings\":[]}")
+        .await;
+    assert_eq!(worker.await.unwrap().unwrap().id, "created");
+    let (release, _) = watch::channel(());
+    let (stop, stopping) = watch::channel(false);
+    let revoked = PinnedImage::new(
+        image_with("", vec![]).resolved().clone(),
+        4096.try_into().unwrap(),
+        release,
+        Arc::new(AtomicBool::new(true)),
+        stopping,
+    );
+    let mut revision = revision();
+    revision.artifact = DeploymentArtifact::Image(revoked);
+    let plan = EnvironmentPlan::new(
+        directory(),
+        image_with("", vec![]),
+        Arc::new(revision),
+        policy(),
+    )
+    .unwrap();
+    stop.send_replace(true);
+    assert!(
+        plan.create_function(&wire.port(), deadline())
+            .await
+            .is_err()
+    );
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[test]
+fn test_should_normalize_inherited_duplicates_empty_values_and_deletion_markers_once() {
+    let mut revision = revision();
+    revision.artifact = DeploymentArtifact::Image(image_with(
+        "1000",
+        vec![
+            "INHERITED=first".into(),
+            "INHERITED=last".into(),
+            "REMOVED=old".into(),
+            "REMOVED".into(),
+            "EMPTY=".into(),
+            "TEST_VALUE=old".into(),
+            "TEST_VALUE".into(),
+        ],
+    ));
+    let plan = plan(revision).unwrap();
+    let env = plan.bodies.function.env.as_ref().unwrap();
+    for (key, expected) in [
+        ("INHERITED", "INHERITED=last"),
+        ("REMOVED", "REMOVED"),
+        ("EMPTY", "EMPTY="),
+        ("TEST_VALUE", "TEST_VALUE=secret-value"),
+    ] {
+        let matching: Vec<_> = env
+            .iter()
+            .filter(|entry| entry.split('=').next() == Some(key))
+            .collect();
+        assert_eq!(matching, vec![expected]);
+    }
+}
+
+#[tokio::test]
+async fn test_should_retain_both_live_image_leases_through_allocation_plan_lifetime() {
+    let image = image_with("", vec![]);
+    let (relay_release, mut relay_released) = watch::channel(());
+    let (function_release, mut function_released) = watch::channel(());
+    let (_, stopped) = watch::channel(false);
+    let make = |release| {
+        PinnedImage::new(
+            image.resolved().clone(),
+            4096.try_into().unwrap(),
+            release,
+            Arc::new(AtomicBool::new(true)),
+            stopped.clone(),
+        )
+    };
+    let relay = make(relay_release);
+    let function = make(function_release);
+    let mut revision = revision();
+    revision.artifact = DeploymentArtifact::Image(function.clone());
+    let plan =
+        EnvironmentPlan::new(directory(), relay.clone(), Arc::new(revision), policy()).unwrap();
+    drop(relay);
+    drop(function);
+    assert!(!relay_released.has_changed().unwrap());
+    assert!(!function_released.has_changed().unwrap());
+    drop(plan);
+    let _ = timeout(Duration::from_secs(1), relay_released.changed())
+        .await
+        .unwrap();
+    let _ = timeout(Duration::from_secs(1), function_released.changed())
+        .await
+        .unwrap();
+    assert!(relay_released.has_changed().is_err());
+    assert!(function_released.has_changed().is_err());
+}
+
+pub(in crate::docker) fn function_body(plan: &EnvironmentPlan) -> &ContainerCreateBody {
+    &plan.bodies.function
+}
+
+pub(in crate::docker) fn relay_body(plan: &EnvironmentPlan) -> &ContainerCreateBody {
+    &plan.bodies.relay
+}
diff --git a/crates/rustack-lambda-core/src/docker/pool/actor.rs b/crates/rustack-lambda-core/src/docker/pool/actor.rs
new file mode 100644
index 00000000..048c6428
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pool/actor.rs
@@ -0,0 +1,539 @@
+//! Pool registry, FIFO dispatch and retained emergency retirement.
+
+use std::{
+    collections::{HashMap, VecDeque},
+    mem,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use rustack_lambda_runtime::session::RuntimeResult;
+use tokio::{
+    runtime::Handle,
+    sync::{mpsc, oneshot, watch},
+    task::{Id, JoinSet},
+    time::{Instant, interval, sleep, sleep_until},
+};
+use typed_builder::TypedBuilder;
+
+use super::{Call, Offer, PoolConfig, PoolStatus};
+use crate::{
+    docker::{
+        EnvironmentError, EnvironmentHandle, EnvironmentPhase, EnvironmentPort,
+        connection::stopped, environment::Retirement,
+    },
+    executor::ExecutorError,
+    invocation::CleanupTask,
+};
+
+pub(super) struct Warm {
+    key: String,
+    environment: EnvironmentHandle,
+}
+pub(super) struct Completion {
+    warm: Option<Warm>,
+    failed: bool,
+}
+pub(super) struct Record {
+    retirement: Retirement,
+    settlement: Option<watch::Sender<Option<Result<(), EnvironmentError>>>>,
+    failed: bool,
+}
+impl Record {
+    fn maintenance(retirement: Retirement) -> Self {
+        Self {
+            retirement,
+            settlement: None,
+            failed: false,
+        }
+    }
+    fn publish(self, failed: bool) {
+        if let Some(settlement) = self.settlement {
+            settlement.send_replace(Some(if self.failed || failed {
+                Err(EnvironmentError::Worker)
+            } else {
+                Ok(())
+            }));
+        }
+    }
+}
+#[derive(TypedBuilder)]
+pub(super) struct Actor {
+    environments: EnvironmentPort,
+    config: PoolConfig,
+    inbox: mpsc::Receiver<Call>,
+    stop: watch::Sender<bool>,
+    failed: Arc<AtomicBool>,
+    status: watch::Sender<PoolStatus>,
+    emergency: Arc<CleanupTask>,
+    runtime: Handle,
+    #[builder(default)]
+    pending: VecDeque<Call>,
+    #[builder(default)]
+    warm: VecDeque<Warm>,
+    #[builder(default)]
+    jobs: JoinSet<Completion>,
+    #[builder(default)]
+    receipts: HashMap<Id, Record>,
+    #[builder(default)]
+    settled: bool,
+    #[builder(default)]
+    eviction: Option<Id>,
+}
+impl Actor {
+    pub(super) async fn run(mut self) -> Result<(), EnvironmentError> {
+        let mut stop = self.stop.subscribe();
+        let mut tick = interval(Duration::from_millis(100));
+        let mut stopping = false;
+        loop {
+            if *stop.borrow() || self.inbox.is_closed() {
+                stopping = true;
+            }
+            if stopping {
+                self.inbox.close();
+                while let Ok(call) = self.inbox.try_recv() {
+                    call.reject(self.closed_error());
+                }
+                while let Some(call) = self.pending.pop_front() {
+                    call.reject(self.closed_error());
+                }
+                while self.jobs.len() < 32 {
+                    let Some(warm) = self.warm.pop_front() else {
+                        break;
+                    };
+                    self.retire(warm.environment);
+                }
+            } else {
+                self.expire();
+                self.dispatch();
+            }
+            self.status.send_replace(PoolStatus {
+                active: self.jobs.len(),
+                warm: self.warm.len(),
+                ..PoolStatus::default()
+            });
+            if stopping && self.jobs.is_empty() && self.warm.is_empty() {
+                self.settled = true;
+                return if self.failed.load(Ordering::Acquire) {
+                    Err(EnvironmentError::Worker)
+                } else {
+                    Ok(())
+                };
+            }
+            tokio::select! { biased;
+                () = stopped(&mut stop), if !stopping => { stopping = true; },
+                completion = self.jobs.join_next_with_id(), if !self.jobs.is_empty() => { if let Some(completion) = completion { self.completed(completion); } },
+                call = self.inbox.recv(), if !stopping => { match call { Some(call) => self.pending.push_back(call), None => stopping = true } },
+                _ = tick.tick() => {},
+            }
+        }
+    }
+    fn fail(&self) {
+        self.failed.store(true, Ordering::Release);
+        self.stop.send_replace(true);
+    }
+    fn closed_error(&self) -> EnvironmentError {
+        if self.failed.load(Ordering::Acquire) {
+            EnvironmentError::Worker
+        } else {
+            EnvironmentError::Stopped
+        }
+    }
+    fn expire(&mut self) {
+        let mut index = 0;
+        while index < self.pending.len() {
+            let error = self.pending.get(index).and_then(Call::error);
+            if let Some(error) = error {
+                if let Some(call) = self.pending.remove(index) {
+                    call.reject(error);
+                }
+            } else {
+                index += 1;
+            }
+        }
+        let mut index = 0;
+        while index < self.warm.len() && self.jobs.len() < 32 {
+            if self
+                .warm
+                .get(index)
+                .is_some_and(|warm| warm.environment.status().phase != EnvironmentPhase::Idle)
+            {
+                if let Some(warm) = self.warm.remove(index) {
+                    self.retire(warm.environment);
+                }
+            } else {
+                index += 1;
+            }
+        }
+    }
+    fn dispatch(&mut self) {
+        if self.eviction.is_some() {
+            return;
+        }
+        while self.jobs.len() < 32 {
+            let Some(mut call) = self.pending.pop_front() else {
+                return;
+            };
+            if let Some(error) = call.error() {
+                call.reject(error);
+                continue;
+            }
+            if let Err(error) = call.plan.live() {
+                call.reject(error.into());
+                continue;
+            }
+            let key = call.plan.warm_key().to_owned();
+            let warm = self
+                .warm
+                .iter()
+                .position(|warm| warm.key == key)
+                .and_then(|index| self.warm.remove(index));
+            let environment = match warm {
+                Some(warm) => Ok(warm.environment),
+                None => self
+                    .environments
+                    .spawn_shared(call.plan.clone(), call.deadline()),
+            };
+            match environment {
+                Ok(environment) => {
+                    call.queue.take();
+                    let record = Record {
+                        retirement: environment.retirement(),
+                        settlement: Some(call.settlement.clone()),
+                        failed: false,
+                    };
+                    let stop = self.stop.subscribe();
+                    let job = self.jobs.spawn(invoke(environment, key, call, stop));
+                    self.receipts.insert(job.id(), record);
+                }
+                Err(EnvironmentError::Busy) => {
+                    self.pending.push_front(call);
+                    if let Some(warm) = self.warm.pop_front() {
+                        self.eviction = Some(self.retire(warm.environment));
+                    }
+                    return;
+                }
+                Err(error) => {
+                    call.reject(error);
+                }
+            }
+        }
+    }
+    fn retire(&mut self, environment: EnvironmentHandle) -> Id {
+        let receipt = environment.retirement();
+        receipt.cancel();
+        drop(environment);
+        self.retire_receipt(receipt)
+    }
+    fn retire_receipt(&mut self, receipt: Retirement) -> Id {
+        self.retire_record(Record::maintenance(receipt))
+    }
+    fn retire_record(&mut self, record: Record) -> Id {
+        record.retirement.cancel();
+        let job = self.jobs.spawn(retire(record.retirement.clone()));
+        self.receipts.insert(job.id(), record);
+        job.id()
+    }
+    fn completed(&mut self, result: Result<(Id, Completion), tokio::task::JoinError>) {
+        let id = match &result {
+            Ok((id, _)) => *id,
+            Err(error) => error.id(),
+        };
+        let receipt = self.receipts.remove(&id);
+        if self.eviction == Some(id) {
+            self.eviction = None;
+        }
+        if let Ok((_, completion)) = result {
+            if completion.failed {
+                self.fail();
+            }
+            if let Some(warm) = completion.warm {
+                let count = self.warm.iter().filter(|idle| idle.key == warm.key).count();
+                if !*self.stop.borrow()
+                    && warm.environment.status().phase == EnvironmentPhase::Idle
+                    && self.warm.len() < usize::from(self.config.0.warm)
+                    && count < usize::from(self.config.0.warm_per_revision)
+                {
+                    self.warm.push_back(warm);
+                } else {
+                    self.retire(warm.environment);
+                }
+            }
+            if let Some(record) = receipt {
+                record.publish(completion.failed);
+            }
+        } else {
+            self.fail();
+            if let Some(mut record) = receipt {
+                record.failed = true;
+                self.retire_record(record);
+            }
+        }
+    }
+}
+impl Drop for Actor {
+    fn drop(&mut self) {
+        if !self.settled {
+            self.fail();
+        }
+        while let Ok(call) = self.inbox.try_recv() {
+            call.reject(self.closed_error());
+        }
+        for call in self.pending.drain(..) {
+            call.reject(EnvironmentError::Worker);
+        }
+        if self.receipts.is_empty() && self.warm.is_empty() {
+            return;
+        }
+        let mut jobs = mem::take(&mut self.jobs);
+        let mut receipts: Vec<_> = mem::take(&mut self.receipts).into_values().collect();
+        for warm in self.warm.drain(..) {
+            receipts.push(Record::maintenance(warm.environment.retirement()));
+            drop(warm);
+        }
+        for record in &mut receipts {
+            record.failed = true;
+            record.retirement.cancel();
+        }
+        jobs.abort_all();
+        self.emergency.start_on(&self.runtime, move || async move {
+            while jobs.join_next().await.is_some() {}
+            recover(receipts).await
+        });
+    }
+}
+async fn recover(receipts: Vec<Record>) -> Result<(), ExecutorError> {
+    let mut cleanup = JoinSet::new();
+    let mut index = HashMap::new();
+    let mut failed = false;
+    for record in receipts {
+        let job = cleanup.spawn(retire(record.retirement.clone()));
+        index.insert(job.id(), record);
+    }
+    while let Some(result) = cleanup.join_next_with_id().await {
+        let id = match &result {
+            Ok((id, _)) => *id,
+            Err(error) => error.id(),
+        };
+        let Some(mut record) = index.remove(&id) else {
+            continue;
+        };
+        if let Ok((_, completion)) = result {
+            failed |= completion.failed;
+            if record.retirement.removed() {
+                record.publish(completion.failed);
+                continue;
+            }
+        } else {
+            failed = true;
+            record.failed = true;
+        }
+        let job = cleanup.spawn(retire(record.retirement.clone()));
+        index.insert(job.id(), record);
+    }
+    if failed {
+        Err(ExecutorError::CleanupFailed(
+            "Pool recovery supervision failed".into(),
+        ))
+    } else {
+        Ok(())
+    }
+}
+async fn retire(receipt: Retirement) -> Completion {
+    let mut failed = false;
+    loop {
+        let result = receipt.clone().settle().await;
+        failed |= result.is_err();
+        if receipt.removed() {
+            return Completion { warm: None, failed };
+        }
+        sleep(Duration::from_secs(1)).await;
+    }
+}
+async fn invoke(
+    mut environment: EnvironmentHandle,
+    key: String,
+    call: Call,
+    mut stop: watch::Receiver<bool>,
+) -> Completion {
+    let deadline = call.deadline();
+    let mut cancellation = call.cancellation.clone();
+    let operation = async {
+        if let Some(error) = call.error() {
+            return Err(error);
+        }
+        environment
+            .wait_ready(deadline.min(Instant::now() + Duration::from_secs(60)))
+            .await?;
+        environment
+            .invoke(call.invocation.clone(), call.capture_logs)
+            .await
+    };
+    let result = tokio::select! { biased;
+        () = stopped(&mut stop) => Err(EnvironmentError::Stopped),
+        () = stopped(&mut cancellation) => Err(EnvironmentError::Cancelled),
+        () = sleep_until(deadline) => Err(EnvironmentError::Deadline),
+        result = operation => result,
+    };
+    if matches!(&result, Ok(response) if matches!(response.result, RuntimeResult::Success(_)))
+        && call.error().is_none()
+        && !*stop.borrow()
+    {
+        let (receipt, consumed) = oneshot::channel();
+        let sent = call
+            .reply
+            .send(Offer {
+                result,
+                receipt: Some(receipt),
+            })
+            .is_ok();
+        if sent {
+            let accepted = tokio::select! { biased;
+                () = stopped(&mut stop) => false,
+                () = sleep_until(deadline) => false,
+                result = consumed => result.is_ok() && Instant::now() < deadline,
+                () = stopped(&mut cancellation) => false,
+            };
+            if accepted {
+                return Completion {
+                    warm: Some(Warm { key, environment }),
+                    failed: false,
+                };
+            }
+        }
+        let receipt = environment.retirement();
+        drop(environment);
+        retire(receipt).await
+    } else {
+        let receipt = environment.retirement();
+        drop(environment);
+        let completion = retire(receipt).await;
+        let _ = call.reply.send(Offer {
+            result,
+            receipt: None,
+        });
+        completion
+    }
+}
+
+#[cfg(test)]
+pub(in crate::docker) fn testing_start(
+    environments: EnvironmentPort,
+    config: PoolConfig,
+    warm: Vec<(String, EnvironmentHandle)>,
+) -> super::EnvironmentPool {
+    testing_start_inner(environments, config, warm, false, None)
+}
+#[cfg(test)]
+pub(super) fn testing_failed_worker_start(
+    environments: EnvironmentPort,
+    warm: Vec<(String, EnvironmentHandle)>,
+) -> super::EnvironmentPool {
+    testing_start_inner(environments, PoolConfig::default(), warm, true, None)
+}
+#[cfg(test)]
+pub(super) fn testing_failed_call_start(
+    environments: EnvironmentPort,
+    plan: crate::docker::EnvironmentPlan,
+    invocation: rustack_lambda_runtime::session::Invocation,
+    environment: EnvironmentHandle,
+) -> (super::EnvironmentPool, super::PoolInvocation) {
+    let deadline = invocation.parts().1;
+    let (stop, cancellation) = watch::channel(false);
+    let (reply, response) = oneshot::channel();
+    let (settlement, observed) = watch::channel(None);
+    let key = plan.warm_key().to_owned();
+    let call = Call {
+        plan: Arc::new(plan),
+        invocation,
+        capture_logs: false,
+        cancellation,
+        reply,
+        queue: None,
+        settlement,
+    };
+    let pool = testing_start_inner(
+        environments,
+        PoolConfig::default(),
+        vec![(key, environment)],
+        true,
+        Some(call),
+    );
+    let invocation = super::PoolInvocation {
+        deadline,
+        stop,
+        response: Some(response),
+        settlement: observed,
+        failed: pool.port.failed.clone(),
+        consumed: false,
+    };
+    (pool, invocation)
+}
+#[cfg(test)]
+fn testing_start_inner(
+    environments: EnvironmentPort,
+    config: PoolConfig,
+    warm: Vec<(String, EnvironmentHandle)>,
+    failed_worker: bool,
+    failed_call: Option<Call>,
+) -> super::EnvironmentPool {
+    let runtime = Handle::current();
+    let maximum = usize::from(config.0.queue);
+    let (sender, inbox) = mpsc::channel(maximum);
+    let (stop, _) = watch::channel(false);
+    let failed = Arc::new(AtomicBool::new(false));
+    let (status, observed) = watch::channel(PoolStatus::default());
+    let emergency = Arc::new(CleanupTask::default());
+    let mut actor = Actor::builder()
+        .environments(environments)
+        .config(config)
+        .inbox(inbox)
+        .stop(stop.clone())
+        .failed(failed.clone())
+        .status(status)
+        .emergency(emergency.clone())
+        .runtime(runtime.clone())
+        .warm(
+            warm.into_iter()
+                .map(|(key, environment)| Warm { key, environment })
+                .collect(),
+        )
+        .build();
+    if failed_worker {
+        let warm = actor.warm.pop_front().unwrap();
+        let receipt = warm.environment.retirement();
+        let settlement = failed_call.as_ref().map(|call| call.settlement.clone());
+        let job = actor.jobs.spawn(async move {
+            let _owned = warm;
+            let _call = failed_call;
+            std::future::pending::<Completion>().await
+        });
+        actor.receipts.insert(
+            job.id(),
+            Record {
+                retirement: receipt,
+                settlement,
+                failed: false,
+            },
+        );
+        job.abort();
+    }
+    let port = super::PoolPort {
+        sender,
+        queue: Arc::new(tokio::sync::Semaphore::new(maximum)),
+        maximum,
+        stop,
+        failed,
+        status: observed,
+    };
+    super::EnvironmentPool {
+        port,
+        task: Some(runtime.spawn(actor.run())),
+        primary: None,
+        settled: None,
+        emergency,
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/pool/mod.rs b/crates/rustack-lambda-core/src/docker/pool/mod.rs
new file mode 100644
index 00000000..9b9adc42
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pool/mod.rs
@@ -0,0 +1,469 @@
+//! Bounded warm dispatch; external resource ownership stays with `EnvironmentManager`.
+
+mod actor;
+use std::{
+    fmt,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+};
+
+#[cfg(test)]
+pub(super) use actor::testing_start;
+use rustack_lambda_runtime::session::Invocation;
+use tokio::{
+    runtime::Handle,
+    sync::{Semaphore, mpsc, oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+
+use super::{
+    DockerError, EnvironmentError, EnvironmentPlan, EnvironmentPort, EnvironmentResponse,
+    check_deadline,
+};
+use crate::invocation::CleanupTask;
+
+/// Operator limits for waiting calls and retained idle environments.
+#[derive(Debug, Clone, Copy, TypedBuilder)]
+#[non_exhaustive]
+pub struct PoolSettings {
+    /// Globally retained idle environments,0..32.
+    #[builder(default = 32)]
+    pub warm: u8,
+    /// Idle environments per immutable identity,0..32.
+    #[builder(default = 1)]
+    pub warm_per_revision: u8,
+    /// Accepted waiting calls across mailbox and actor queue,1..256.
+    #[builder(default = 256)]
+    pub queue: u16,
+}
+impl Default for PoolSettings {
+    fn default() -> Self {
+        Self::builder().build()
+    }
+}
+/// Validated warm retention and admission limits.
+#[derive(Debug, Clone, Copy, Default)]
+#[non_exhaustive]
+pub struct PoolConfig(PoolSettings);
+impl TryFrom<PoolSettings> for PoolConfig {
+    type Error = EnvironmentError;
+    fn try_from(settings: PoolSettings) -> Result<Self, Self::Error> {
+        if settings.warm > 32
+            || settings.warm_per_revision > 32
+            || !(1..=256).contains(&settings.queue)
+        {
+            return Err(EnvironmentError::Configuration);
+        }
+        Ok(Self(settings))
+    }
+}
+/// Read-only pool projection; environment accounting includes quarantine separately.
+#[derive(Debug, Clone, Copy, Default)]
+#[non_exhaustive]
+pub struct PoolStatus {
+    /// Accepted calls still waiting for dispatch.
+    pub queued: usize,
+    /// Invocation/retirement jobs; at most32.
+    pub active: usize,
+    /// Idle handles retained for reuse.
+    pub warm: usize,
+    /// Whether admission remains open and healthy.
+    pub accepting: bool,
+    /// A worker/root supervision failure closed admission.
+    pub worker_failed: bool,
+}
+struct Offer {
+    result: Result<EnvironmentResponse, EnvironmentError>,
+    receipt: Option<oneshot::Sender<()>>,
+}
+struct Call {
+    plan: Arc<EnvironmentPlan>,
+    invocation: Invocation,
+    capture_logs: bool,
+    cancellation: watch::Receiver<bool>,
+    reply: oneshot::Sender<Offer>,
+    queue: Option<tokio::sync::OwnedSemaphorePermit>,
+    settlement: watch::Sender<Option<Result<(), EnvironmentError>>>,
+}
+impl Call {
+    fn deadline(&self) -> Instant {
+        self.invocation.parts().1
+    }
+    fn error(&self) -> Option<EnvironmentError> {
+        if Instant::now() >= self.deadline() {
+            Some(EnvironmentError::Deadline)
+        } else if self.reply.is_closed()
+            || *self.cancellation.borrow()
+            || self.cancellation.has_changed().is_err()
+        {
+            Some(EnvironmentError::Cancelled)
+        } else {
+            None
+        }
+    }
+    fn reject(self, error: EnvironmentError) {
+        // No environment has been allocated for a rejected queued call.
+        self.settlement.send_replace(Some(Ok(())));
+        let _ = self.reply.send(Offer {
+            result: Err(error),
+            receipt: None,
+        });
+    }
+}
+/// Exclusive response and retained cleanup receipt for one accepted pool call.
+///
+/// Drop requests cancellation; only `cancel_and_wait` proves settlement.
+#[non_exhaustive]
+pub struct PoolInvocation {
+    deadline: Instant,
+    stop: watch::Sender<bool>,
+    response: Option<oneshot::Receiver<Offer>>,
+    settlement: watch::Receiver<Option<Result<(), EnvironmentError>>>,
+    failed: Arc<AtomicBool>,
+    consumed: bool,
+}
+impl fmt::Debug for PoolInvocation {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("PoolInvocation")
+            .field("deadline", &self.deadline)
+            .field("consumed", &self.consumed)
+            .field("settled", &self.settlement.borrow().is_some())
+            .finish_non_exhaustive()
+    }
+}
+impl PoolInvocation {
+    /// Consume one result while retaining the receiver across cancelled waiters.
+    ///
+    /// # Errors
+    /// Returns invocation failure, deadline, or unavailable supervision. A closed
+    /// response lane is not cleanup proof; use `cancel_and_wait` before releasing
+    /// higher-level work permits after cancellation or uncertain failure.
+    ///
+    /// ```no_run
+    /// # async fn result(call: &mut rustack_lambda_core::docker::PoolInvocation) {
+    /// let result = call.wait().await;
+    /// # }
+    /// ```
+    pub async fn wait(&mut self) -> Result<EnvironmentResponse, EnvironmentError> {
+        if self.consumed || self.response.is_none() {
+            return Err(EnvironmentError::Configuration);
+        }
+        let response = self
+            .response
+            .as_mut()
+            .ok_or(EnvironmentError::Configuration)?;
+        let received = timeout_at(self.deadline, response)
+            .await
+            .map_err(|_| EnvironmentError::Deadline)?;
+        self.response.take();
+        let offer = received.map_err(|_| {
+            if self.failed.load(Ordering::Acquire) {
+                EnvironmentError::Worker
+            } else {
+                EnvironmentError::Stopped
+            }
+        })?;
+        // Remove a completed receiver even when the deadline check rejects its
+        // offer. Dropping that offer revokes any unconsumed warm-return receipt.
+        if Instant::now() >= self.deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        if let Some(receipt) = offer.receipt {
+            receipt.send(()).map_err(|()| EnvironmentError::Worker)?;
+        }
+        self.consumed = true;
+        offer.result
+    }
+
+    /// Request cancellation and await independently owned physical settlement.
+    ///
+    /// A cancelled/expired waiter can resume with a fresh cleanup deadline.
+    /// Consumed success belongs to the pool and cannot be cancelled by this call.
+    ///
+    /// # Errors
+    /// Returns Deadline while cleanup remains retained, or Worker when recovery
+    /// was uncertain or the settlement producer disappeared without proof.
+    /// Cleanup deadlines over ten minutes return Configuration after signalling.
+    ///
+    /// ```no_run
+    /// # async fn stop(call: &mut rustack_lambda_core::docker::PoolInvocation) {
+    /// let settled = call.cancel_and_wait(tokio::time::Instant::now()
+    ///     + std::time::Duration::from_secs(60)).await;
+    /// # }
+    /// ```
+    pub async fn cancel_and_wait(&mut self, deadline: Instant) -> Result<(), EnvironmentError> {
+        if !self.consumed {
+            self.stop.send_replace(true);
+            self.response.take();
+        }
+        Self::check_cleanup_deadline(deadline)?;
+        loop {
+            let result = self.settlement.borrow().clone();
+            if let Some(result) = result {
+                return result;
+            }
+            timeout_at(deadline, self.settlement.changed())
+                .await
+                .map_err(|_| EnvironmentError::Deadline)?
+                .map_err(|_| EnvironmentError::Worker)?;
+            Self::check_cleanup_deadline(deadline)?;
+        }
+    }
+    fn check_cleanup_deadline(deadline: Instant) -> Result<(), EnvironmentError> {
+        check_deadline(deadline).map_err(|error| match error {
+            DockerError::Deadline => EnvironmentError::Deadline,
+            DockerError::Configuration => EnvironmentError::Configuration,
+            error => error.into(),
+        })
+    }
+}
+impl Drop for PoolInvocation {
+    fn drop(&mut self) {
+        if !self.consumed {
+            self.stop.send_replace(true);
+        }
+    }
+}
+/// Cloneable call port; the retained pool owner must outlive its shutdown.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct PoolPort {
+    sender: mpsc::Sender<Call>,
+    queue: Arc<Semaphore>,
+    maximum: usize,
+    stop: watch::Sender<bool>,
+    failed: Arc<AtomicBool>,
+    status: watch::Receiver<PoolStatus>,
+}
+impl fmt::Debug for PoolPort {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("PoolPort")
+            .field("status", &self.status())
+            .finish()
+    }
+}
+impl PoolPort {
+    /// Execute once through a matching warm environment or bounded cold allocation.
+    ///
+    /// # Errors
+    /// Returns queue overload, deadline, cancellation, initialization or runtime
+    /// failure. Dropping the future signals retained cleanup without replay.
+    ///
+    /// ```no_run
+    /// # async fn invoke(port: rustack_lambda_core::docker::PoolPort, plan: rustack_lambda_core::docker::EnvironmentPlan, call: rustack_lambda_runtime::session::Invocation) {
+    /// let result = port.invoke(plan, call, false).await;
+    /// # }
+    /// ```
+    pub async fn invoke(
+        &self,
+        plan: EnvironmentPlan,
+        invocation: Invocation,
+        capture_logs: bool,
+    ) -> Result<EnvironmentResponse, EnvironmentError> {
+        self.start(plan, invocation, capture_logs)?.wait().await
+    }
+    /// Admit once and retain separate response/cancellation-settlement ownership.
+    ///
+    /// # Errors
+    /// Rejects expired calls, unavailable image pins, overload or closed admission
+    /// before enqueueing. Scope validation also occurs before physical allocation.
+    ///
+    /// ```no_run
+    /// # fn start(port: &rustack_lambda_core::docker::PoolPort, plan: rustack_lambda_core::docker::EnvironmentPlan, event: rustack_lambda_runtime::session::Invocation) {
+    /// let call = port.start(plan, event, false);
+    /// # }
+    /// ```
+    pub fn start(
+        &self,
+        plan: EnvironmentPlan,
+        invocation: Invocation,
+        capture_logs: bool,
+    ) -> Result<PoolInvocation, EnvironmentError> {
+        let deadline = invocation.parts().1;
+        if Instant::now() >= deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        if !self.status().accepting {
+            return Err(self.closed_error());
+        }
+        plan.live()?;
+        let queue = self
+            .queue
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| EnvironmentError::Busy)?;
+        let (stop, cancellation) = watch::channel(false);
+        let (reply, response) = oneshot::channel();
+        let (settlement, observed) = watch::channel(None);
+        self.sender
+            .try_send(Call {
+                plan: Arc::new(plan),
+                invocation,
+                capture_logs,
+                cancellation,
+                reply,
+                queue: Some(queue),
+                settlement,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => EnvironmentError::Busy,
+                mpsc::error::TrySendError::Closed(_) => self.closed_error(),
+            })?;
+        Ok(PoolInvocation {
+            deadline,
+            stop,
+            response: Some(response),
+            settlement: observed,
+            failed: self.failed.clone(),
+            consumed: false,
+        })
+    }
+    fn closed_error(&self) -> EnvironmentError {
+        if self.failed.load(Ordering::Acquire) {
+            EnvironmentError::Worker
+        } else {
+            EnvironmentError::Stopped
+        }
+    }
+    /// Read pool counts without waiting for the business mailbox.
+    ///
+    /// ```no_run
+    /// # fn status(port: &rustack_lambda_core::docker::PoolPort) { let counts = port.status(); }
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> PoolStatus {
+        let mut status = *self.status.borrow();
+        status.queued = self.maximum.saturating_sub(self.queue.available_permits());
+        status.worker_failed = self.failed.load(Ordering::Acquire);
+        status.accepting = !*self.stop.borrow() && !status.worker_failed;
+        status
+    }
+}
+/// Retained pool root, shut down before the environment and image owners.
+#[non_exhaustive]
+pub struct EnvironmentPool {
+    port: PoolPort,
+    task: Option<JoinHandle<Result<(), EnvironmentError>>>,
+    primary: Option<Result<(), EnvironmentError>>,
+    settled: Option<Result<(), EnvironmentError>>,
+    emergency: Arc<CleanupTask>,
+}
+impl fmt::Debug for EnvironmentPool {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("EnvironmentPool")
+            .field("port", &self.port)
+            .field("settled", &self.settled)
+            .finish_non_exhaustive()
+    }
+}
+impl EnvironmentPool {
+    /// Start bounded checkout over an already-owned environment service.
+    ///
+    /// # Errors
+    /// Returns Worker when no Tokio runtime is available. This does not establish
+    /// Docker startup readiness or enable the production executor.
+    ///
+    /// ```no_run
+    /// # fn start(environments: rustack_lambda_core::docker::EnvironmentPort) {
+    /// let pool = rustack_lambda_core::docker::EnvironmentPool::start(environments, Default::default());
+    /// # }
+    /// ```
+    pub fn start(
+        environments: EnvironmentPort,
+        config: PoolConfig,
+    ) -> Result<Self, EnvironmentError> {
+        let runtime = Handle::try_current().map_err(|_| EnvironmentError::Worker)?;
+        let maximum = usize::from(config.0.queue);
+        let (sender, inbox) = mpsc::channel(maximum);
+        let (stop, _) = watch::channel(false);
+        let failed = Arc::new(AtomicBool::new(false));
+        let (status, observed) = watch::channel(PoolStatus::default());
+        let emergency = Arc::new(CleanupTask::default());
+        let actor = actor::Actor::builder()
+            .environments(environments)
+            .config(config)
+            .inbox(inbox)
+            .stop(stop.clone())
+            .failed(failed.clone())
+            .status(status)
+            .emergency(emergency.clone())
+            .runtime(runtime.clone())
+            .build();
+        let port = PoolPort {
+            sender,
+            queue: Arc::new(Semaphore::new(maximum)),
+            maximum,
+            stop,
+            failed,
+            status: observed,
+        };
+        Ok(Self {
+            port,
+            task: Some(runtime.spawn(actor.run())),
+            primary: None,
+            settled: None,
+            emergency,
+        })
+    }
+    /// Clone the call port without transferring root shutdown ownership.
+    ///
+    /// ```no_run
+    /// # fn port(pool: &rustack_lambda_core::docker::EnvironmentPool) { let port = pool.port(); }
+    /// ```
+    #[must_use]
+    pub fn port(&self) -> PoolPort {
+        self.port.clone()
+    }
+    /// Close admission, retire active/idle environments and join retained cleanup.
+    ///
+    /// # Errors
+    /// Returns timeout while cleanup stays owned, or a cached supervision failure.
+    /// A cancelled waiter does not lose the join or emergency cleanup receipt.
+    ///
+    /// ```no_run
+    /// # async fn stop(pool: &mut rustack_lambda_core::docker::EnvironmentPool) {
+    /// let clean = pool.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(60)).await;
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), EnvironmentError> {
+        self.port.stop.send_replace(true);
+        check_deadline(deadline)?;
+        if let Some(settled) = &self.settled {
+            return settled.clone();
+        }
+        if self.primary.is_none() {
+            let result = match self.task.as_mut() {
+                Some(task) => timeout_at(deadline, task)
+                    .await
+                    .map_err(|_| EnvironmentError::Deadline)?
+                    .map_err(|_| EnvironmentError::Worker)
+                    .and_then(|result| result),
+                None => Err(EnvironmentError::Worker),
+            };
+            self.task.take();
+            self.primary = Some(result);
+        }
+        timeout_at(deadline, self.emergency.wait())
+            .await
+            .map_err(|_| EnvironmentError::Deadline)?
+            .map_err(|_| EnvironmentError::Worker)?;
+        if Instant::now() >= deadline {
+            return Err(EnvironmentError::Deadline);
+        }
+        let result = self.primary.clone().ok_or(EnvironmentError::Worker)?;
+        self.settled = Some(result.clone());
+        result
+    }
+}
+impl Drop for EnvironmentPool {
+    fn drop(&mut self) {
+        self.port.stop.send_replace(true);
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/pool/tests.rs b/crates/rustack-lambda-core/src/docker/pool/tests.rs
new file mode 100644
index 00000000..63ee0c00
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pool/tests.rs
@@ -0,0 +1,731 @@
+use std::{sync::atomic::AtomicUsize, time::Duration};
+
+use super::{actor::testing_start, *};
+use crate::docker::{
+    DirectoryLease, EnvironmentConfig, EnvironmentManager, EnvironmentSettings, RelayBudgets,
+    environment::test_peer::pair,
+    plan::tests::{image_with, policy, revision},
+    tests::Daemon,
+};
+
+mod settlement;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn directory() -> DirectoryLease {
+    DirectoryLease::testing(uuid::Uuid::new_v4(), uuid::Uuid::new_v4())
+}
+fn plan(directory: &DirectoryLease) -> EnvironmentPlan {
+    EnvironmentPlan::new(
+        directory.clone(),
+        image_with("1000", vec![]),
+        Arc::new(revision()),
+        policy(),
+    )
+    .unwrap()
+}
+fn invocation(until: Instant) -> Invocation {
+    Invocation::new(
+        rustack_lambda_runtime::protocol::AttemptId::default(),
+        until,
+        "arn:aws:lambda:us-east-1:000000000000:function:policy-fixture"
+            .parse()
+            .unwrap(),
+        rustack_lambda_runtime::metadata::local_trace_id().unwrap(),
+        rustack_lambda_runtime::protocol::Payload::try_from(bytes::Bytes::from_static(b"{}"))
+            .unwrap(),
+    )
+    .unwrap()
+}
+#[test]
+fn test_should_reject_invalid_pool_limits_and_allow_disabled_warm_retention() {
+    for settings in [
+        PoolSettings::builder().warm(33).build(),
+        PoolSettings::builder().warm_per_revision(33).build(),
+        PoolSettings::builder().queue(0).build(),
+        PoolSettings::builder().queue(257).build(),
+    ] {
+        assert!(PoolConfig::try_from(settings).is_err());
+    }
+    assert!(
+        PoolConfig::try_from(PoolSettings::builder().warm(0).warm_per_revision(0).build()).is_ok()
+    );
+}
+#[tokio::test]
+async fn test_should_reject_queued_call_after_pool_stop_without_allocation() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let mut pool = EnvironmentPool::start(environments.port(), PoolConfig::default()).unwrap();
+    let port = pool.port();
+    pool.shutdown(deadline()).await.unwrap();
+    assert!(matches!(
+        port.invoke(plan(&lease), invocation(deadline()), false)
+            .await,
+        Err(EnvironmentError::Stopped)
+    ));
+    assert_eq!(environments.port().status().allocated, 0);
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_cache_root_failure_and_release_queued_permits_without_mutation() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let mut pool = EnvironmentPool::start(environments.port(), PoolConfig::default()).unwrap();
+    pool.task.as_ref().unwrap().abort();
+    assert!(matches!(
+        pool.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(matches!(
+        pool.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(pool.port().status().worker_failed);
+    assert_eq!(environments.port().status().allocated, 0);
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[test]
+fn test_should_key_allocation_values_without_fresh_identities_or_hashmap_order() {
+    let lease = directory();
+    let original = revision();
+    let make = |revision, policy| {
+        EnvironmentPlan::new(
+            lease.clone(),
+            image_with("1000", vec![]),
+            Arc::new(revision),
+            policy,
+        )
+        .unwrap()
+    };
+    let first = make(original.clone(), policy());
+    let mut reordered = original.clone();
+    let mut entries: Vec<_> = original.environment.iter().collect();
+    entries.sort();
+    reordered.environment = entries
+        .into_iter()
+        .rev()
+        .map(|(k, v)| (k.clone(), v.clone()))
+        .collect();
+    let second = make(reordered, policy());
+    assert_ne!(first.environment_id(), second.environment_id());
+    assert_eq!(first.warm_key(), second.warm_key());
+    let mut changed = original.clone();
+    changed
+        .environment
+        .insert("TEST_VALUE".into(), "another-secret".into());
+    assert_ne!(first.warm_key(), make(changed, policy()).warm_key());
+    let mut changed = original.clone();
+    changed.memory_mb = 256;
+    assert_ne!(first.warm_key(), make(changed, policy()).warm_key());
+    let mut changed = original.clone();
+    changed.revision_id = uuid::Uuid::new_v4().to_string();
+    assert_ne!(first.warm_key(), make(changed, policy()).warm_key());
+    let another_policy = crate::docker::ContainerPolicy::new(
+        "none".parse().unwrap(),
+        1001,
+        1000,
+        1_000_000_000,
+        RelayBudgets::default(),
+    )
+    .unwrap();
+    assert_ne!(
+        first.warm_key(),
+        make(original.clone(), another_policy).warm_key()
+    );
+    assert_ne!(
+        first.warm_key(),
+        EnvironmentPlan::new(
+            directory(),
+            image_with("1000", vec![]),
+            Arc::new(original),
+            policy()
+        )
+        .unwrap()
+        .warm_key()
+    );
+    assert!(!format!("{first:?}").contains("secret-value"));
+}
+async fn idle(port: &PoolPort) {
+    tokio::time::timeout(Duration::from_secs(3), async {
+        while port.status().active != 0 || port.status().warm != 1 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+#[tokio::test]
+async fn test_should_reuse_only_consumed_warm_results_and_join_idle_shutdown() {
+    use std::sync::atomic::AtomicUsize;
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let revision = Arc::new(revision());
+    let make = || {
+        EnvironmentPlan::new(
+            lease.clone(),
+            image_with("1000", vec![]),
+            revision.clone(),
+            policy(),
+        )
+        .unwrap()
+    };
+    let (handle, peer) = crate::docker::environment::test_peer::pair();
+    let count = Arc::new(AtomicUsize::new(0));
+    let served = tokio::spawn(peer.serve(count.clone()));
+    let mut pool = actor::testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![(make().warm_key().into(), handle)],
+    );
+    let port = pool.port();
+    for expected in 1..=3 {
+        port.invoke(make(), invocation(deadline()), false)
+            .await
+            .unwrap();
+        idle(&port).await;
+        assert_eq!(count.load(Ordering::Acquire), expected);
+    }
+    pool.shutdown(deadline()).await.unwrap();
+    served.await.unwrap();
+    assert_eq!(port.status().warm, 0);
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest::rstest]
+#[case::abandoned(true)]
+#[case::live_but_unpolled(false)]
+#[tokio::test]
+async fn test_should_retire_unconsumed_ready_reply_even_without_public_future_polling(
+    #[case] abandoned: bool,
+) {
+    use std::{future::Future, sync::atomic::AtomicUsize, task::Poll};
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let plan = plan(&lease);
+    let key = plan.warm_key().to_owned();
+    let (handle, peer) = crate::docker::environment::test_peer::pair();
+    let receipt = handle.retirement();
+    let served = tokio::spawn(peer.serve(Arc::new(AtomicUsize::new(0))));
+    let mut pool = actor::testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![(key, handle)],
+    );
+    let port = pool.port();
+    let mut call = Box::pin(port.invoke(
+        plan,
+        invocation(Instant::now() + Duration::from_millis(250)),
+        false,
+    ));
+    assert!(matches!(
+        call.as_mut()
+            .poll(&mut std::task::Context::from_waker(std::task::Waker::noop())),
+        Poll::Pending
+    ));
+    tokio::time::sleep(Duration::from_millis(20)).await;
+    if abandoned {
+        drop(call);
+    } else {
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        assert!(
+            receipt.removed(),
+            "unpolled waiter retained its environment past deadline"
+        );
+        assert!(matches!(
+            call.as_mut()
+                .poll(&mut std::task::Context::from_waker(std::task::Waker::noop())),
+            Poll::Ready(Err(EnvironmentError::Deadline))
+        ));
+    }
+    tokio::time::timeout(Duration::from_secs(2), served)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(receipt.removed());
+    pool.shutdown(deadline()).await.unwrap();
+    assert_eq!(port.status().warm, 0);
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_bound_one_queue_across_mailbox_and_waiting_dispatch_then_cancel_without_replay()
+ {
+    use std::{
+        future::Future,
+        task::{Context, Poll, Waker},
+    };
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let config = crate::docker::EnvironmentSettings::builder()
+        .environments(1)
+        .build()
+        .try_into()
+        .unwrap();
+    let mut environments = EnvironmentManager::start(wire.port(), lease.clone(), config).unwrap();
+    let mut occupied = environments.port().spawn(plan(&lease), deadline()).unwrap();
+    let held = daemon.next().await;
+    let mut pool = EnvironmentPool::start(
+        environments.port(),
+        PoolSettings::builder().queue(1).build().try_into().unwrap(),
+    )
+    .unwrap();
+    let port = pool.port();
+    let mut waiting = Box::pin(port.invoke(plan(&lease), invocation(deadline()), false));
+    assert!(matches!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop())),
+        Poll::Pending
+    ));
+    tokio::time::sleep(Duration::from_millis(120)).await;
+    assert_eq!(port.status().queued, 1);
+    assert_eq!(port.status().active, 0);
+    assert!(matches!(
+        port.invoke(plan(&lease), invocation(deadline()), false)
+            .await,
+        Err(EnvironmentError::Busy)
+    ));
+    drop(waiting);
+    tokio::time::timeout(Duration::from_secs(2), async {
+        while port.status().queued != 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(daemon.requests.try_recv().is_err());
+    pool.shutdown(deadline()).await.unwrap();
+    held.reply(400, b"{}").await;
+    occupied.shutdown(deadline()).await.unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest::rstest]
+#[case::idle(false)]
+#[case::offered_result(true)]
+#[tokio::test]
+async fn test_should_recover_idle_or_dispatched_environment_after_root_abort(
+    #[case] offered: bool,
+) {
+    use std::{
+        future::Future,
+        sync::atomic::AtomicUsize,
+        task::{Context, Poll, Waker},
+    };
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let plan = plan(&lease);
+    let key = plan.warm_key().into();
+    let (handle, peer) = crate::docker::environment::test_peer::pair();
+    let receipt = handle.retirement();
+    let count = Arc::new(AtomicUsize::new(0));
+    let served = tokio::spawn(peer.serve(count.clone()));
+    let mut pool = actor::testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![(key, handle)],
+    );
+    let port = pool.port();
+    let mut call = Box::pin(port.invoke(plan, invocation(deadline()), false));
+    if offered {
+        assert!(matches!(
+            call.as_mut().poll(&mut Context::from_waker(Waker::noop())),
+            Poll::Pending
+        ));
+        tokio::time::timeout(Duration::from_secs(2), async {
+            while count.load(Ordering::Acquire) == 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+    }
+    pool.task.as_ref().unwrap().abort();
+    assert!(matches!(
+        pool.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(matches!(
+        pool.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(receipt.removed());
+    served.await.unwrap();
+    drop(call);
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_one_lru_eviction_barrier_while_cleanup_is_delayed() {
+    use std::{
+        future::Future,
+        sync::atomic::AtomicUsize,
+        task::{Context, Poll, Waker},
+    };
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let config = crate::docker::EnvironmentSettings::builder()
+        .environments(1)
+        .build()
+        .try_into()
+        .unwrap();
+    let mut environments = EnvironmentManager::start(wire.port(), lease.clone(), config).unwrap();
+    let mut occupied = environments.port().spawn(plan(&lease), deadline()).unwrap();
+    let held = daemon.next().await;
+    let (oldest, first) = crate::docker::environment::test_peer::pair();
+    let first_receipt = oldest.retirement();
+    let (release, gate) = oneshot::channel();
+    let (stopping, stopped) = oneshot::channel();
+    let first_task = tokio::spawn(first.serve_gated(Arc::new(AtomicUsize::new(0)), gate, stopping));
+    let (next, second) = crate::docker::environment::test_peer::pair();
+    let second_receipt = next.retirement();
+    let second_task = tokio::spawn(second.serve(Arc::new(AtomicUsize::new(0))));
+    let mut pool = actor::testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![("oldest".into(), oldest), ("next".into(), next)],
+    );
+    let port = pool.port();
+    let mut waiting = Box::pin(port.invoke(plan(&lease), invocation(deadline()), false));
+    assert!(matches!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop())),
+        Poll::Pending
+    ));
+    tokio::time::timeout(Duration::from_secs(2), stopped)
+        .await
+        .unwrap()
+        .unwrap();
+    tokio::time::sleep(Duration::from_millis(350)).await;
+    assert!(!first_receipt.removed());
+    assert!(!second_receipt.removed());
+    assert_eq!(port.status().warm, 1);
+    assert_eq!(port.status().active, 1);
+    drop(waiting);
+    release.send(()).unwrap();
+    pool.shutdown(deadline()).await.unwrap();
+    first_task.await.unwrap();
+    second_task.await.unwrap();
+    held.reply(400, b"{}").await;
+    occupied.shutdown(deadline()).await.unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_retirement_owned_when_shutdown_waiter_is_cancelled() {
+    use std::sync::atomic::AtomicUsize;
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let (handle, peer) = crate::docker::environment::test_peer::pair();
+    let receipt = handle.retirement();
+    let (release, gate) = oneshot::channel();
+    let (stopping, stopped) = oneshot::channel();
+    let served = tokio::spawn(peer.serve_gated(Arc::new(AtomicUsize::new(0)), gate, stopping));
+    let mut pool = actor::testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![("idle".into(), handle)],
+    );
+    assert!(
+        tokio::time::timeout(Duration::from_millis(30), pool.shutdown(deadline()))
+            .await
+            .is_err()
+    );
+    stopped.await.unwrap();
+    assert!(!receipt.removed());
+    release.send(()).unwrap();
+    pool.shutdown(deadline()).await.unwrap();
+    pool.shutdown(deadline()).await.unwrap();
+    served.await.unwrap();
+    assert!(receipt.removed());
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[test]
+fn test_should_reject_oversized_captured_inputs_before_warm_fingerprinting() {
+    let lease = directory();
+    let mut invalid = revision();
+    invalid
+        .environment
+        .insert("OVERSIZED".into(), "s".repeat(8192));
+    assert!(
+        EnvironmentPlan::new(
+            lease.clone(),
+            image_with("1000", vec![]),
+            Arc::new(invalid),
+            policy()
+        )
+        .is_err()
+    );
+    let mut invalid = revision();
+    invalid.image_config = Some(rustack_lambda_model::types::ImageConfig {
+        command: Some(vec!["x".repeat(32768)]),
+        ..Default::default()
+    });
+    assert!(
+        EnvironmentPlan::new(
+            lease,
+            image_with("1000", vec![]),
+            Arc::new(invalid),
+            policy()
+        )
+        .is_err()
+    );
+}
+
+#[tokio::test]
+async fn test_should_preserve_retirement_above_an_aborted_dispatch_worker() {
+    use std::sync::atomic::AtomicUsize;
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease, EnvironmentConfig::default()).unwrap();
+    let (handle, peer) = crate::docker::environment::test_peer::pair();
+    let receipt = handle.retirement();
+    let served = tokio::spawn(peer.serve(Arc::new(AtomicUsize::new(0))));
+    let mut pool =
+        actor::testing_failed_worker_start(environments.port(), vec![("owned".into(), handle)]);
+    assert!(matches!(
+        pool.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(matches!(
+        pool.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(pool.port().status().worker_failed);
+    assert!(receipt.removed());
+    served.await.unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_wait_for_capacity_in_fifo_order_and_never_replay_rejected_startup() {
+    use std::{
+        future::Future,
+        task::{Context, Poll, Waker},
+    };
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let config = crate::docker::EnvironmentSettings::builder()
+        .environments(1)
+        .build()
+        .try_into()
+        .unwrap();
+    let mut environments = EnvironmentManager::start(wire.port(), lease.clone(), config).unwrap();
+    let mut occupied = environments.port().spawn(plan(&lease), deadline()).unwrap();
+    let held = daemon.next().await;
+    let mut pool = EnvironmentPool::start(environments.port(), PoolConfig::default()).unwrap();
+    let port = pool.port();
+    let first = plan(&lease);
+    let first_key = first.relay_key().as_str().to_owned();
+    let second = plan(&lease);
+    let second_key = second.relay_key().as_str().to_owned();
+    let mut first = Box::pin(port.invoke(first, invocation(deadline()), false));
+    let mut second = Box::pin(port.invoke(second, invocation(deadline()), false));
+    for call in [&mut first, &mut second] {
+        assert!(matches!(
+            call.as_mut().poll(&mut Context::from_waker(Waker::noop())),
+            Poll::Pending
+        ));
+    }
+    held.reply(400, b"{}").await;
+    occupied.shutdown(deadline()).await.unwrap();
+    for key in [first_key, second_key] {
+        let request = daemon.next().await;
+        assert!(
+            percent_encoding::percent_decode_str(&request.head)
+                .decode_utf8()
+                .unwrap()
+                .contains(&key)
+        );
+        request.reply(400, b"{}").await;
+    }
+    assert!(first.await.is_err());
+    assert!(second.await.is_err());
+    pool.shutdown(deadline()).await.unwrap();
+    assert!(daemon.requests.try_recv().is_err());
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest::rstest]
+#[case::no_global_retention(0, 1, 0)]
+#[case::no_revision_retention(32, 0, 0)]
+#[case::one_per_revision(32, 1, 1)]
+#[tokio::test]
+async fn test_should_retire_successful_excess_concurrent_returns(
+    #[case] warm: u8,
+    #[case] per_revision: u8,
+    #[case] retained: usize,
+) {
+    use std::{
+        future::Future,
+        sync::atomic::AtomicUsize,
+        task::{Context, Poll, Waker},
+    };
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let revision = Arc::new(revision());
+    let make = || {
+        EnvironmentPlan::new(
+            lease.clone(),
+            image_with("1000", vec![]),
+            revision.clone(),
+            policy(),
+        )
+        .unwrap()
+    };
+    let key = make().warm_key().to_owned();
+    let count = Arc::new(AtomicUsize::new(0));
+    let mut seeded = Vec::new();
+    let mut peers = Vec::new();
+    for _ in 0..2 {
+        let (handle, peer) = crate::docker::environment::test_peer::pair();
+        seeded.push((key.clone(), handle));
+        peers.push(tokio::spawn(peer.serve(count.clone())));
+    }
+    let config = PoolSettings::builder()
+        .warm(warm)
+        .warm_per_revision(per_revision)
+        .build()
+        .try_into()
+        .unwrap();
+    let mut pool = actor::testing_start(environments.port(), config, seeded);
+    let port = pool.port();
+    let mut first = Box::pin(port.invoke(make(), invocation(deadline()), false));
+    let mut second = Box::pin(port.invoke(make(), invocation(deadline()), false));
+    for call in [&mut first, &mut second] {
+        assert!(matches!(
+            call.as_mut().poll(&mut Context::from_waker(Waker::noop())),
+            Poll::Pending
+        ));
+    }
+    tokio::time::timeout(Duration::from_secs(2), async {
+        while count.load(Ordering::Acquire) < 2 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    first.await.unwrap();
+    second.await.unwrap();
+    tokio::time::timeout(Duration::from_secs(2), async {
+        while port.status().active != 0 || port.status().warm != retained {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    pool.shutdown(deadline()).await.unwrap();
+    for peer in peers {
+        peer.await.unwrap();
+    }
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_impossible_memory_without_evicting_warm_work_or_blocking_fitting_calls()
+{
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let config = EnvironmentSettings::builder()
+        .memory_bytes(256 * 1024 * 1024)
+        .build()
+        .try_into()
+        .unwrap();
+    let mut environments = EnvironmentManager::start(wire.port(), lease.clone(), config).unwrap();
+    let fitting = plan(&lease);
+    let (handle, peer) = pair();
+    let count = Arc::new(AtomicUsize::new(0));
+    let served = tokio::spawn(peer.serve(count.clone()));
+    let mut pool = testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![(fitting.warm_key().into(), handle)],
+    );
+    let mut oversized = revision();
+    oversized.memory_mb = 256;
+    let oversized = EnvironmentPlan::new(
+        lease,
+        image_with("1000", vec![]),
+        Arc::new(oversized),
+        policy(),
+    )
+    .unwrap();
+    assert!(matches!(
+        pool.port()
+            .invoke(oversized, invocation(deadline()), false)
+            .await,
+        Err(EnvironmentError::MemoryLimit)
+    ));
+    assert_eq!(pool.port().status().warm, 1);
+    pool.port()
+        .invoke(fitting, invocation(deadline()), false)
+        .await
+        .unwrap();
+    idle(&pool.port()).await;
+    assert_eq!(count.load(Ordering::Acquire), 1);
+    assert_eq!(environments.port().status().allocated, 0);
+    pool.shutdown(deadline()).await.unwrap();
+    served.await.unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/pool/tests/settlement.rs b/crates/rustack-lambda-core/src/docker/pool/tests/settlement.rs
new file mode 100644
index 00000000..e10c0c1d
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pool/tests/settlement.rs
@@ -0,0 +1,298 @@
+use std::{
+    future::Future,
+    sync::atomic::AtomicUsize,
+    task::{Context, Waker},
+};
+
+use super::*;
+use crate::docker::environment::test_peer;
+
+#[rstest::rstest]
+#[case::cancel(false, false)]
+#[case::expired(true, false)]
+#[case::root_abort(false, true)]
+#[tokio::test]
+async fn test_should_retain_per_call_settlement_across_expiry_waiter_drop_and_root_recovery(
+    #[case] expired: bool,
+    #[case] abort: bool,
+) {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let plan = plan(&lease);
+    let (handle, peer) = test_peer::pair();
+    let physical = handle.retirement();
+    let count = Arc::new(AtomicUsize::new(0));
+    let (release, gate) = oneshot::channel();
+    let (stopping, stopped) = oneshot::channel();
+    let serving = tokio::spawn(peer.serve_gated(count.clone(), gate, stopping));
+    let mut pool = actor::testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![(plan.warm_key().into(), handle)],
+    );
+    let until = if expired {
+        Instant::now() + Duration::from_millis(250)
+    } else {
+        deadline()
+    };
+    let mut call = pool.port().start(plan, invocation(until), false).unwrap();
+    timeout_at(deadline(), async {
+        while count.load(Ordering::Acquire) == 0 {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    if abort {
+        pool.task.as_ref().unwrap().abort();
+    } else if expired {
+        tokio::time::sleep_until(until).await;
+        assert!(matches!(call.wait().await, Err(EnvironmentError::Deadline)));
+    }
+    let mut waiting = Box::pin(call.cancel_and_wait(deadline()));
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    timeout_at(deadline(), stopped).await.unwrap().unwrap();
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    assert!(!physical.removed());
+    assert!(matches!(
+        call.cancel_and_wait(Instant::now() + Duration::from_millis(20))
+            .await,
+        Err(EnvironmentError::Deadline)
+    ));
+    assert!(!physical.removed());
+    release.send(()).unwrap();
+    let result = call.cancel_and_wait(deadline()).await;
+    assert!(physical.removed());
+    if abort {
+        assert!(matches!(result, Err(EnvironmentError::Worker)));
+        assert!(matches!(
+            call.cancel_and_wait(deadline()).await,
+            Err(EnvironmentError::Worker)
+        ));
+        assert!(matches!(
+            pool.shutdown(deadline()).await,
+            Err(EnvironmentError::Worker)
+        ));
+    } else {
+        result.unwrap();
+        call.cancel_and_wait(deadline()).await.unwrap();
+        pool.shutdown(deadline()).await.unwrap();
+    }
+    serving.await.unwrap();
+    assert_eq!(count.load(Ordering::Acquire), 1);
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_resume_pending_response_wait_and_leave_consumed_success_warm() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let revision = Arc::new(revision());
+    let make = || {
+        EnvironmentPlan::new(
+            lease.clone(),
+            image_with("1000", vec![]),
+            revision.clone(),
+            policy(),
+        )
+        .unwrap()
+    };
+    let (handle, peer) = test_peer::pair();
+    let physical = handle.retirement();
+    let count = Arc::new(AtomicUsize::new(0));
+    let serving = tokio::spawn(peer.serve(count.clone()));
+    let mut pool = actor::testing_start(
+        environments.port(),
+        PoolConfig::default(),
+        vec![(make().warm_key().into(), handle)],
+    );
+    let port = pool.port();
+    for expected in 1..=2 {
+        let mut call = port.start(make(), invocation(deadline()), false).unwrap();
+        let mut waiting = Box::pin(call.wait());
+        assert!(
+            waiting
+                .as_mut()
+                .poll(&mut Context::from_waker(Waker::noop()))
+                .is_pending()
+        );
+        drop(waiting);
+        call.wait().await.unwrap();
+        assert!(matches!(
+            call.wait().await,
+            Err(EnvironmentError::Configuration)
+        ));
+        call.cancel_and_wait(deadline()).await.unwrap();
+        drop(call);
+        idle(&port).await;
+        assert!(!physical.removed());
+        assert_eq!(count.load(Ordering::Acquire), expected);
+    }
+    pool.shutdown(deadline()).await.unwrap();
+    serving.await.unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_settle_cancelled_queued_call_without_waiting_for_an_unrelated_allocation() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments = EnvironmentManager::start(
+        wire.port(),
+        lease.clone(),
+        crate::docker::EnvironmentSettings::builder()
+            .environments(1)
+            .build()
+            .try_into()
+            .unwrap(),
+    )
+    .unwrap();
+    let mut occupied = environments.port().spawn(plan(&lease), deadline()).unwrap();
+    let held = daemon.next().await;
+    let mut pool = EnvironmentPool::start(environments.port(), PoolConfig::default()).unwrap();
+    let mut call = pool
+        .port()
+        .start(plan(&lease), invocation(deadline()), false)
+        .unwrap();
+    call.cancel_and_wait(deadline()).await.unwrap();
+    assert_eq!(environments.port().status().allocated, 1);
+    assert!(daemon.requests.try_recv().is_err());
+    pool.shutdown(deadline()).await.unwrap();
+    held.reply(400, b"{}").await;
+    occupied.shutdown(deadline()).await.unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_call_receipt_above_a_failed_dispatch_worker() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory();
+    let mut environments =
+        EnvironmentManager::start(wire.port(), lease.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let (environment, peer) = test_peer::pair();
+    let physical = environment.retirement();
+    let (release, gate) = oneshot::channel();
+    let (stopping, stopped) = oneshot::channel();
+    let serving = tokio::spawn(peer.serve_gated(Arc::new(AtomicUsize::new(0)), gate, stopping));
+    let (mut pool, mut call) = actor::testing_failed_call_start(
+        environments.port(),
+        plan(&lease),
+        invocation(deadline()),
+        environment,
+    );
+    timeout_at(deadline(), stopped).await.unwrap().unwrap();
+    assert!(matches!(call.wait().await, Err(EnvironmentError::Worker)));
+    let mut waiting = Box::pin(call.cancel_and_wait(deadline()));
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    assert!(!physical.removed());
+    release.send(()).unwrap();
+    assert!(matches!(
+        call.cancel_and_wait(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(physical.removed());
+    assert!(matches!(
+        pool.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    serving.await.unwrap();
+    environments.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_treat_a_closed_response_and_missing_settlement_as_uncertain() {
+    let (reply, response) = oneshot::channel();
+    let (settlement, observed) = watch::channel(None);
+    drop(reply);
+    drop(settlement);
+    let mut call = PoolInvocation {
+        deadline: deadline(),
+        stop: watch::channel(false).0,
+        response: Some(response),
+        settlement: observed,
+        failed: Arc::new(AtomicBool::new(false)),
+        consumed: false,
+    };
+    assert!(matches!(call.wait().await, Err(EnvironmentError::Stopped)));
+    assert!(matches!(
+        call.wait().await,
+        Err(EnvironmentError::Configuration)
+    ));
+    assert!(matches!(
+        call.cancel_and_wait(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    assert!(matches!(
+        call.cancel_and_wait(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+}
+
+#[rstest::rstest]
+#[case::expired(true)]
+#[case::excessive(false)]
+#[tokio::test]
+async fn test_should_signal_cancellation_before_rejecting_invalid_cleanup_deadline(
+    #[case] expired: bool,
+) {
+    let (reply, response) = oneshot::channel();
+    let (_settled, observed) = watch::channel(Some(Ok(())));
+    let mut call = PoolInvocation {
+        deadline: deadline(),
+        stop: watch::channel(false).0,
+        response: Some(response),
+        settlement: observed,
+        failed: Arc::new(AtomicBool::new(false)),
+        consumed: false,
+    };
+    let until = if expired {
+        Instant::now()
+    } else {
+        Instant::now() + Duration::from_secs(601)
+    };
+    let error = call.cancel_and_wait(until).await.unwrap_err();
+    if expired {
+        assert!(matches!(error, EnvironmentError::Deadline));
+    } else {
+        assert!(matches!(error, EnvironmentError::Configuration));
+    }
+    assert!(*call.stop.borrow());
+    assert!(reply.is_closed());
+    call.cancel_and_wait(deadline()).await.unwrap();
+}
diff --git a/crates/rustack-lambda-core/src/docker/probe.rs b/crates/rustack-lambda-core/src/docker/probe.rs
new file mode 100644
index 00000000..088957f9
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/probe.rs
@@ -0,0 +1,441 @@
+//! Actual resource qualification through the retained environment owner.
+
+mod endpoint;
+use std::{collections::HashMap, fmt, sync::Arc, time::Duration};
+
+use bytes::Bytes;
+pub use endpoint::{EndpointProbe, EndpointProbeConfig, probe_endpoint};
+use rustack_core::json::{JsonError, JsonLimits, from_slice};
+use rustack_lambda_model::types::ImageConfig;
+use rustack_lambda_runtime::{
+    metadata::local_trace_id,
+    probe::{REPORT_BYTES, ResourceReport},
+    protocol::{Architecture as RuntimeArchitecture, AttemptId, Payload},
+    session::{Invocation, RuntimeResult},
+};
+use thiserror::Error;
+use tokio::time::Instant;
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use super::{
+    ContainerPolicy, DirectoryLease, EnvironmentError, EnvironmentPlan, EnvironmentPort,
+    QualifiedNetwork, check_deadline,
+};
+use crate::{
+    artifact::{Architecture, DeploymentArtifact, PinnedImage},
+    executor::{ExecutionRevision, ExecutorBackend},
+    identity::FunctionResourceId,
+};
+
+/// Specific bounded resource qualification mismatch.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+#[non_exhaustive]
+pub enum ProbeFailure {
+    /// Wrong report schema, attempt or compiled architecture.
+    #[error("resource probe identity mismatch")]
+    Identity,
+    /// Controller files are not rooted at the current process membership.
+    #[error("resource probe cgroup namespace mismatch")]
+    Namespace,
+    /// Memory hard cap was not enforced.
+    #[error("resource probe memory mismatch")]
+    Memory,
+    /// Extra swap was permitted or unavailable.
+    #[error("resource probe swap mismatch")]
+    Swap,
+    /// PID cap was not enforced.
+    #[error("resource probe PID mismatch")]
+    Pids,
+    /// CPU quota/period was not enforced.
+    #[error("resource probe CPU mismatch")]
+    Cpu,
+    /// The actual process has a root UID/GID.
+    #[error("resource probe user mismatch")]
+    User,
+    /// Effective capabilities are not empty.
+    #[error("resource probe capability mismatch")]
+    Capabilities,
+    /// `no_new_privs` was not enforced.
+    #[error("resource probe privilege mismatch")]
+    Privilege,
+    /// No active seccomp filter.
+    #[error("resource probe seccomp mismatch")]
+    Seccomp,
+    /// The effective root mount is writable.
+    #[error("resource probe root filesystem mismatch")]
+    Root,
+    /// The effective tmp mount differs from the captured policy.
+    #[error("resource probe temporary filesystem mismatch")]
+    Temporary,
+    /// The observed gateway was not the exact expected instance/attempt/platform.
+    #[error("endpoint probe identity mismatch")]
+    Endpoint,
+    /// The trusted probe did not return a report.
+    #[error("resource probe execution failed")]
+    Outcome,
+}
+/// Probe failures preserve bounded classes and redacted typed sources.
+#[derive(Clone, Error)]
+#[non_exhaustive]
+pub enum EnvironmentProbeError {
+    /// Invalid settings or mismatched retained runtime scope.
+    #[error("invalid environment probe configuration")]
+    Configuration,
+    /// Bounded strict report decoding failed.
+    #[error("invalid environment probe report")]
+    Report(#[from] JsonError),
+    /// Actual observations did not satisfy policy.
+    #[error("{0}")]
+    Rejected(#[from] ProbeFailure),
+    /// Retained allocation/invocation failed.
+    #[error("environment probe failed: {0}")]
+    Environment(#[from] EnvironmentError),
+    /// Cleanup did not confirm physical/IO settlement; lower owner retains it.
+    #[error("environment probe cleanup not confirmed")]
+    Cleanup(#[source] EnvironmentError),
+}
+impl fmt::Debug for EnvironmentProbeError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+
+/// Validated positive whole-second startup and independent cleanup budgets.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct ProbeSettings {
+    start: Duration,
+    cleanup: Duration,
+}
+impl Default for ProbeSettings {
+    fn default() -> Self {
+        Self {
+            start: Duration::from_secs(60),
+            cleanup: Duration::from_secs(10),
+        }
+    }
+}
+impl ProbeSettings {
+    /// Validate both budgets in1..60 whole seconds.
+    ///
+    /// # Errors
+    /// Rejects zero, fractional or excessive durations.
+    ///
+    /// ```
+    /// let settings=rustack_lambda_core::docker::ProbeSettings::new(
+    ///     std::time::Duration::from_secs(30),std::time::Duration::from_secs(10))?;
+    /// # Ok::<(),rustack_lambda_core::docker::EnvironmentProbeError>(())
+    /// ```
+    pub fn new(start: Duration, cleanup: Duration) -> Result<Self, EnvironmentProbeError> {
+        for duration in [start, cleanup] {
+            if duration.subsec_nanos() != 0 || !(1..=60).contains(&duration.as_secs()) {
+                return Err(EnvironmentProbeError::Configuration);
+            }
+        }
+        Ok(Self { start, cleanup })
+    }
+}
+/// Operator-owned private probe inputs; no user image or endpoint is accepted.
+#[derive(Debug, Clone, TypedBuilder)]
+#[non_exhaustive]
+pub struct EnvironmentProbeConfig {
+    /// Persistent namespace capability.
+    pub directory: DirectoryLease,
+    /// Pinned runtime image used for both relay and trusted probe function.
+    pub relay: PinnedImage,
+    /// Matching retained environment service.
+    pub environments: EnvironmentPort,
+    /// Operator policy, bound to the qualified network before allocation.
+    pub policy: ContainerPolicy,
+    /// Independent read-only network qualification.
+    pub network: QualifiedNetwork,
+    /// Validated startup/cleanup budgets.
+    #[builder(default)]
+    pub settings: ProbeSettings,
+}
+/// Private proof of actual matching kernel observations after joined retirement.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct EnvironmentProbe {
+    report: ResourceReport,
+    directory: DirectoryLease,
+    relay: PinnedImage,
+    policy: ContainerPolicy,
+    environments: EnvironmentPort,
+}
+impl EnvironmentProbe {
+    /// Inspect bounded observation data; it cannot reconstruct this proof.
+    ///
+    /// ```no_run
+    /// # fn inspect(probe:&rustack_lambda_core::docker::EnvironmentProbe){
+    /// let memory=probe.report().memory_max;
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn report(&self) -> &ResourceReport {
+        &self.report
+    }
+    /// Check the exact retained inputs and accepting environment service.
+    ///
+    /// ```no_run
+    /// # fn matches(probe:&rustack_lambda_core::docker::EnvironmentProbe, inputs:&rustack_lambda_core::docker::EnvironmentProbeConfig){
+    /// let current=probe.matches(inputs);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn matches(&self, inputs: &EnvironmentProbeConfig) -> bool {
+        let metadata = self.relay.resolved().metadata();
+        let other = inputs.relay.resolved().metadata();
+        self.directory.owner_id() == inputs.directory.owner_id()
+            && self.directory.run_id() == inputs.directory.run_id()
+            && self.relay.is_live()
+            && inputs.relay.is_live()
+            && metadata.image_id == other.image_id
+            && metadata.inspection_hash == other.inspection_hash
+            && inputs
+                .network
+                .apply(&inputs.policy)
+                .is_ok_and(|policy| policy == self.policy)
+            && self.environments.same_service(&inputs.environments)
+            && self.environments.status().accepting
+    }
+}
+
+/// Execute the pinned Rust probe once and issue proof only after actual retirement.
+///
+/// This does not grant production readiness. The environment manager must outlive
+/// a dropped/expired waiter, retaining uncertain container/IO cleanup.
+///
+/// # Errors
+/// Returns invalid inputs, runtime/wire failure, strict report mismatch or cleanup
+/// uncertainty. A failed accepted probe is never replayed.
+///
+/// ```no_run
+/// # async fn probe(config:rustack_lambda_core::docker::EnvironmentProbeConfig){
+/// let evidence=rustack_lambda_core::docker::probe_environment(config,
+///     tokio::time::Instant::now()+std::time::Duration::from_secs(60)).await;
+/// # }
+/// ```
+pub async fn probe_environment(
+    config: EnvironmentProbeConfig,
+    deadline: Instant,
+) -> Result<EnvironmentProbe, EnvironmentProbeError> {
+    let deadline = deadline.min(Instant::now() + config.settings.start);
+    let payload = Payload::try_from(Bytes::from_static(b"{}"))
+        .map_err(|_| EnvironmentProbeError::Configuration)?;
+    let (report, policy) = invoke_probe(
+        &config,
+        ProbeCommand::Resource,
+        payload,
+        deadline,
+        |bytes, attempt, architecture, policy| {
+            let report = decode_report(bytes)?;
+            verify(&report, attempt, architecture, policy)?;
+            Ok(report)
+        },
+    )
+    .await?;
+    check_live(&config, deadline)?;
+    Ok(EnvironmentProbe {
+        report,
+        directory: config.directory,
+        relay: config.relay,
+        policy,
+        environments: config.environments,
+    })
+}
+#[derive(Debug, Clone, Copy)]
+enum ProbeCommand {
+    Resource,
+    Endpoint,
+}
+impl ProbeCommand {
+    fn entry(self) -> &'static str {
+        match self {
+            Self::Resource => "probe",
+            Self::Endpoint => "endpoint-probe",
+        }
+    }
+    fn name(self) -> &'static str {
+        match self {
+            Self::Resource => "rustack-runtime-probe",
+            Self::Endpoint => "rustack-endpoint-probe",
+        }
+    }
+}
+fn check_live(
+    config: &EnvironmentProbeConfig,
+    deadline: Instant,
+) -> Result<(), EnvironmentProbeError> {
+    if Instant::now() >= deadline {
+        return Err(EnvironmentError::Deadline.into());
+    }
+    if !config.environments.same_scope(&config.directory)
+        || !config.relay.is_live()
+        || !config.environments.status().accepting
+    {
+        return Err(EnvironmentProbeError::Configuration);
+    }
+    Ok(())
+}
+async fn invoke_probe<T>(
+    config: &EnvironmentProbeConfig,
+    command: ProbeCommand,
+    payload: Payload,
+    deadline: Instant,
+    validate: impl FnOnce(
+        &[u8],
+        AttemptId,
+        Architecture,
+        &ContainerPolicy,
+    ) -> Result<T, EnvironmentProbeError>,
+) -> Result<(T, ContainerPolicy), EnvironmentProbeError> {
+    check_deadline(deadline).map_err(EnvironmentError::from)?;
+    check_live(config, deadline)?;
+    let policy = config
+        .network
+        .apply(&config.policy)
+        .map_err(EnvironmentError::from)?;
+    let architecture = config.relay.resolved().metadata().architecture;
+    let revision = ExecutionRevision::builder()
+        .resource_id(FunctionResourceId::new())
+        .revision_id(Uuid::new_v4().to_string())
+        .backend(ExecutorBackend::Docker)
+        .function_name(command.name().into())
+        .qualifier("$LATEST".into())
+        .runtime(None)
+        .handler(None)
+        .architecture(architecture)
+        .artifact(DeploymentArtifact::Image(config.relay.clone()))
+        .image_config(Some(ImageConfig {
+            entry_point: Some(vec![
+                "/rustack-lambda-runtime".into(),
+                command.entry().into(),
+            ]),
+            command: Some(vec![]),
+            working_directory: None,
+        }))
+        .environment(HashMap::from([
+            ("AWS_REGION".into(), "us-east-1".into()),
+            ("AWS_DEFAULT_REGION".into(), "us-east-1".into()),
+        ]))
+        .timeout(Duration::from_secs(10))
+        .memory_mb(128)
+        .ephemeral_storage_mb(512)
+        .build();
+    let plan = EnvironmentPlan::new(
+        config.directory.clone(),
+        config.relay.clone(),
+        Arc::new(revision),
+        policy.clone(),
+    )
+    .map_err(EnvironmentError::from)?;
+    let attempt = AttemptId::default();
+    let call = Invocation::new(
+        attempt,
+        deadline,
+        format!(
+            "arn:aws:lambda:us-east-1:000000000000:function:{}",
+            command.name()
+        )
+        .parse()
+        .map_err(|_| EnvironmentProbeError::Configuration)?,
+        local_trace_id().map_err(|_| EnvironmentProbeError::Configuration)?,
+        payload,
+    )
+    .map_err(|_| EnvironmentProbeError::Configuration)?;
+    let mut environment = config.environments.spawn(plan, deadline)?;
+    let result = async {
+        environment.wait_ready(deadline).await?;
+        let response = environment.invoke(call, false).await?;
+        let RuntimeResult::Success(payload) = response.result else {
+            return Err(ProbeFailure::Outcome.into());
+        };
+        validate(payload.as_ref(), attempt, architecture, &policy)
+    }
+    .await;
+    environment
+        .shutdown(Instant::now() + config.settings.cleanup)
+        .await
+        .map_err(EnvironmentProbeError::Cleanup)?;
+    Ok((result?, policy))
+}
+
+fn decode_report(bytes: &[u8]) -> Result<ResourceReport, EnvironmentProbeError> {
+    Ok(from_slice(
+        bytes,
+        JsonLimits::new(REPORT_BYTES, 8, 128, 256, 32)?,
+    )?)
+}
+fn verify(
+    report: &ResourceReport,
+    attempt: AttemptId,
+    architecture: Architecture,
+    policy: &ContainerPolicy,
+) -> Result<(), ProbeFailure> {
+    if report.version != 1
+        || report.attempt != attempt
+        || report.architecture
+            != match architecture {
+                Architecture::Arm64 => RuntimeArchitecture::Arm64,
+                Architecture::X86_64 => RuntimeArchitecture::X86_64,
+            }
+    {
+        return Err(ProbeFailure::Identity);
+    }
+    if report.memory_max != Some(128 * 1024 * 1024) {
+        return Err(ProbeFailure::Memory);
+    }
+    if !report.cgroup_root {
+        return Err(ProbeFailure::Namespace);
+    }
+    if report.swap_max != Some(0) {
+        return Err(ProbeFailure::Swap);
+    }
+    if report.pids_max != Some(256) {
+        return Err(ProbeFailure::Pids);
+    }
+    let expected = u64::try_from(policy.nano_cpus)
+        .ok()
+        .and_then(|cpu| cpu.checked_mul(report.cpu_period))
+        .map(|total| total / 1_000_000_000);
+    if !(1000..=1_000_000).contains(&report.cpu_period)
+        || !report
+            .cpu_quota
+            .is_some_and(|quota| (1000..=16_000_000).contains(&quota))
+        || expected == Some(0)
+        || report.cpu_quota != expected
+        || expected.is_none()
+    {
+        return Err(ProbeFailure::Cpu);
+    }
+    if report.euid == 0 || report.egid == 0 {
+        return Err(ProbeFailure::User);
+    }
+    if report.cap_effective != 0 {
+        return Err(ProbeFailure::Capabilities);
+    }
+    if !report.no_new_privileges {
+        return Err(ProbeFailure::Privilege);
+    }
+    if report.seccomp_mode != 2 {
+        return Err(ProbeFailure::Seccomp);
+    }
+    if !report.root_readonly {
+        return Err(ProbeFailure::Root);
+    }
+    let temporary = &report.temporary;
+    if temporary.bytes != 512 * 1024 * 1024
+        || temporary.mode != 0o1777
+        || !temporary.tmpfs
+        || !temporary.nosuid
+        || !temporary.nodev
+    {
+        return Err(ProbeFailure::Temporary);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+pub(super) mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/probe/endpoint.rs b/crates/rustack-lambda-core/src/docker/probe/endpoint.rs
new file mode 100644
index 00000000..a053f9ac
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/probe/endpoint.rs
@@ -0,0 +1,160 @@
+//! Matching real resource evidence and retained container-origin endpoint proof.
+
+use bytes::Bytes;
+use rustack_core::json::{JsonLimits, from_slice};
+use rustack_lambda_runtime::{
+    probe::{EndpointChallenge, EndpointReport, GatewayEndpoint, GatewayInstanceId, REPORT_BYTES},
+    protocol::{Architecture as RuntimeArchitecture, AttemptId, Payload},
+};
+use serde_json::to_vec;
+use tokio::time::Instant;
+
+use super::{
+    EnvironmentProbe, EnvironmentProbeConfig, EnvironmentProbeError, ProbeCommand, ProbeFailure,
+    check_live, invoke_probe,
+};
+use crate::{artifact::Architecture, docker::DockerGatewayEndpoint};
+
+/// Immutable endpoint qualification inputs, requiring actual matching kernel proof.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct EndpointProbeConfig {
+    base: EnvironmentProbeConfig,
+    resource: EnvironmentProbe,
+    endpoint: DockerGatewayEndpoint,
+    instance: GatewayInstanceId,
+}
+impl EndpointProbeConfig {
+    pub(in crate::docker) fn gateway_endpoint(&self) -> &DockerGatewayEndpoint {
+        &self.endpoint
+    }
+    /// Capture the exact qualified resource inputs and configured endpoint instance.
+    /// # Errors
+    /// Rejects disconnected networks and revoked/mismatching retained resource evidence.
+    /// ```no_run
+    /// # fn config(base:rustack_lambda_core::docker::EnvironmentProbeConfig,resource:rustack_lambda_core::docker::EnvironmentProbe,endpoint:rustack_lambda_core::docker::DockerGatewayEndpoint,instance:rustack_lambda_core::docker::GatewayInstanceId)->Result<(),rustack_lambda_core::docker::EnvironmentProbeError>{
+    /// let config=rustack_lambda_core::docker::EndpointProbeConfig::new(base,resource,endpoint,instance)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        base: EnvironmentProbeConfig,
+        resource: EnvironmentProbe,
+        endpoint: DockerGatewayEndpoint,
+        instance: GatewayInstanceId,
+    ) -> Result<Self, EnvironmentProbeError> {
+        if base.network.disconnected() || !resource.matches(&base) {
+            return Err(EnvironmentProbeError::Configuration);
+        }
+        Ok(Self {
+            base,
+            resource,
+            endpoint,
+            instance,
+        })
+    }
+    fn check(&self, deadline: Instant) -> Result<(), EnvironmentProbeError> {
+        check_live(&self.base, deadline)?;
+        if self.base.network.disconnected() || !self.resource.matches(&self.base) {
+            return Err(EnvironmentProbeError::Configuration);
+        }
+        Ok(())
+    }
+}
+/// Private receipt issued only after actual validated IO and physical retirement.
+/// ```compile_fail
+/// let forged=serde_json::from_str::<rustack_lambda_core::docker::EndpointProbe>("{}");
+/// ```
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct EndpointProbe {
+    report: EndpointReport,
+    inputs: EndpointProbeConfig,
+}
+impl EndpointProbe {
+    /// Recheck exact endpoint/identity and all retained live resource inputs.
+    /// ```no_run
+    /// # fn matches(proof:&rustack_lambda_core::docker::EndpointProbe,inputs:&rustack_lambda_core::docker::EndpointProbeConfig){
+    /// let current=proof.matches(inputs);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn matches(&self, inputs: &EndpointProbeConfig) -> bool {
+        self.inputs.endpoint == inputs.endpoint
+            && self.inputs.instance == inputs.instance
+            && self.inputs.resource.matches(&inputs.base)
+            && inputs.resource.matches(&inputs.base)
+            && self.inputs.resource.matches(&self.inputs.base)
+            && !inputs.base.network.disconnected()
+    }
+    /// Bounded observed report data; cloning/serializing data cannot issue proof.
+    /// ```no_run
+    /// # fn report(proof:&rustack_lambda_core::docker::EndpointProbe){let data=proof.report();}
+    /// ```
+    #[must_use]
+    pub fn report(&self) -> &EndpointReport {
+        &self.report
+    }
+}
+/// Execute one endpoint probe; a failed accepted invocation is never replayed.
+/// # Errors
+/// Rejects stale/invalid inputs, network/protocol/report mismatch, timeout or
+/// uncertain cleanup. Dropped callers leave retirement with the environment owner.
+/// ```no_run
+/// # async fn probe(config:rustack_lambda_core::docker::EndpointProbeConfig){
+/// let proof=rustack_lambda_core::docker::probe_endpoint(config,tokio::time::Instant::now()+std::time::Duration::from_secs(60)).await;
+/// # }
+/// ```
+pub async fn probe_endpoint(
+    config: EndpointProbeConfig,
+    deadline: Instant,
+) -> Result<EndpointProbe, EnvironmentProbeError> {
+    let deadline = deadline.min(Instant::now() + config.base.settings.start);
+    config.check(deadline)?;
+    let challenge = EndpointChallenge::new(
+        GatewayEndpoint::from(config.endpoint.clone()),
+        config.instance,
+    );
+    let bytes = to_vec(&challenge).map_err(|_| EnvironmentProbeError::Configuration)?;
+    if bytes.len() > REPORT_BYTES {
+        return Err(EnvironmentProbeError::Configuration);
+    }
+    let payload =
+        Payload::try_from(Bytes::from(bytes)).map_err(|_| EnvironmentProbeError::Configuration)?;
+    let (report, _policy) = invoke_probe(
+        &config.base,
+        ProbeCommand::Endpoint,
+        payload,
+        deadline,
+        |bytes, attempt, architecture, _policy| {
+            verify_report(bytes, attempt, architecture, config.instance)
+        },
+    )
+    .await?;
+    config.check(deadline)?;
+    Ok(EndpointProbe {
+        report,
+        inputs: config,
+    })
+}
+
+fn verify_report(
+    bytes: &[u8],
+    attempt: AttemptId,
+    architecture: Architecture,
+    instance: GatewayInstanceId,
+) -> Result<EndpointReport, EnvironmentProbeError> {
+    let report: EndpointReport = from_slice(bytes, JsonLimits::new(REPORT_BYTES, 8, 16, 256, 32)?)?;
+    let expected = match architecture {
+        Architecture::Arm64 => RuntimeArchitecture::Arm64,
+        Architecture::X86_64 => RuntimeArchitecture::X86_64,
+    };
+    if report.attempt() != attempt
+        || report.architecture() != expected
+        || report.instance_id() != instance
+    {
+        return Err(ProbeFailure::Endpoint.into());
+    }
+    Ok(report)
+}
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/probe/endpoint/tests.rs b/crates/rustack-lambda-core/src/docker/probe/endpoint/tests.rs
new file mode 100644
index 00000000..d7792eb5
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/probe/endpoint/tests.rs
@@ -0,0 +1,198 @@
+use std::time::Duration;
+
+use rstest::rstest;
+use rustack_lambda_runtime::protocol::AttemptId;
+use serde_json::{json, to_vec};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{EndpointProbe, EndpointProbeConfig, verify_report};
+use crate::{
+    artifact::Architecture,
+    docker::{
+        ContainerPolicy, DirectoryLease, DockerWire, EnvironmentConfig, EnvironmentManager,
+        EnvironmentProbe, EnvironmentProbeConfig, EnvironmentProbeError, GatewayInstanceId,
+        NetworkSelection, RelayBudgets, plan::tests::image_with, probe::tests::report,
+        probe_endpoint, tests::Daemon,
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn report_bytes(attempt: AttemptId, id: GatewayInstanceId) -> Vec<u8> {
+    to_vec(&json!({"version":1,"attempt":attempt,"architecture":"arm64","instanceId":id})).unwrap()
+}
+#[rstest]
+#[case::attempt(0)]
+#[case::architecture(1)]
+#[case::instance(2)]
+#[case::version(3)]
+#[case::unknown(4)]
+#[test]
+fn test_should_require_exact_endpoint_report_schema_attempt_architecture_and_instance(
+    #[case] case: u8,
+) {
+    let attempt = AttemptId::default();
+    let id = GatewayInstanceId::generate().unwrap();
+    let mut value = json!({"version":1,"attempt":attempt,"architecture":"arm64","instanceId":id});
+    match case {
+        0 => value["attempt"] = json!(AttemptId::default()),
+        1 => value["architecture"] = json!("x86_64"),
+        2 => value["instanceId"] = json!(GatewayInstanceId::generate().unwrap()),
+        3 => value["version"] = json!(2),
+        _ => value["extra"] = json!("PRIVATE-PEER"),
+    }
+    let error =
+        verify_report(&to_vec(&value).unwrap(), attempt, Architecture::Arm64, id).unwrap_err();
+    assert!(!format!("{error:?}:{error}").contains("PRIVATE-PEER"));
+}
+#[test]
+fn test_should_decode_bounded_endpoint_report_without_turning_data_into_a_receipt() {
+    let attempt = AttemptId::default();
+    let id = GatewayInstanceId::generate().unwrap();
+    let bytes = report_bytes(attempt, id);
+    let report = verify_report(&bytes, attempt, Architecture::Arm64, id).unwrap();
+    assert_eq!(report.instance_id(), id);
+    assert!(verify_report(&vec![b' '; 4097], attempt, Architecture::Arm64, id).is_err());
+    let duplicate = format!(
+        "{{\"version\":1,\"version\":1,\"attempt\":\"{attempt}\",\"architecture\":\"arm64\",\"\
+         instanceId\":{}}}",
+        serde_json::to_string(&id).unwrap()
+    );
+    assert!(verify_report(duplicate.as_bytes(), attempt, Architecture::Arm64, id).is_err());
+}
+async fn fixture() -> (Daemon, DockerWire, EnvironmentManager, EndpointProbeConfig) {
+    let mut daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+    let owner =
+        EnvironmentManager::start(wire.port(), directory.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let selection: NetworkSelection = "endpoint-fixture".parse().unwrap();
+    let port = wire.port();
+    let (network, ()) = tokio::join!(selection.qualify(&port, deadline()), async {
+        daemon.next().await.reply(200,&to_vec(&json!({"Name":"endpoint-fixture","Id":"a".repeat(64),"Driver":"bridge","Scope":"local","Ingress":false,"ConfigOnly":false})).unwrap()).await;
+    });
+    let network = network.unwrap();
+    let policy = ContainerPolicy::new(
+        selection,
+        1000,
+        1000,
+        1_000_000_000,
+        RelayBudgets::default(),
+    )
+    .unwrap();
+    let relay = image_with("1000", vec![]);
+    let base = EnvironmentProbeConfig::builder()
+        .directory(directory.clone())
+        .relay(relay.clone())
+        .environments(owner.port())
+        .network(network.clone())
+        .policy(policy.clone())
+        .build();
+    // Synthetic private receipt only tests scope/cleanup logic; real proof is separately gated.
+    let resource = EnvironmentProbe {
+        report: report(AttemptId::default()),
+        directory,
+        relay,
+        policy: network.apply(&policy).unwrap(),
+        environments: owner.port(),
+    };
+    let config = EndpointProbeConfig::new(
+        base,
+        resource,
+        "http://private-gateway.example:4566".parse().unwrap(),
+        GatewayInstanceId::generate().unwrap(),
+    )
+    .unwrap();
+    (daemon, wire, owner, config)
+}
+#[tokio::test]
+async fn test_should_bind_endpoint_receipt_to_exact_origin_instance_scope_policy_and_live_owner() {
+    let (daemon, mut wire, mut owner, config) = fixture().await;
+    let attempt = AttemptId::default();
+    let receipt = EndpointProbe {
+        report: verify_report(
+            &report_bytes(attempt, config.instance),
+            attempt,
+            Architecture::Arm64,
+            config.instance,
+        )
+        .unwrap(),
+        inputs: config.clone(),
+    };
+    assert!(receipt.matches(&config));
+    let mut changed = config.clone();
+    changed.endpoint = "http://other-gateway.example".parse().unwrap();
+    assert!(!receipt.matches(&changed));
+    let mut changed = config.clone();
+    changed.instance = GatewayInstanceId::generate().unwrap();
+    assert!(!receipt.matches(&changed));
+    let mut changed = config.clone();
+    changed.base.directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+    assert!(!receipt.matches(&changed));
+    let mut changed = config.clone();
+    changed.base.policy = ContainerPolicy::new(
+        "endpoint-fixture".parse().unwrap(),
+        1000,
+        1000,
+        200_000_000,
+        RelayBudgets::default(),
+    )
+    .unwrap();
+    assert!(!receipt.matches(&changed));
+    assert!(matches!(
+        probe_endpoint(config.clone(), Instant::now()).await,
+        Err(EnvironmentProbeError::Environment(_))
+    ));
+    let mut base = config.base.clone();
+    base.network = "none"
+        .parse::<NetworkSelection>()
+        .unwrap()
+        .qualify(&wire.port(), deadline())
+        .await
+        .unwrap();
+    assert!(
+        EndpointProbeConfig::new(
+            base,
+            config.resource.clone(),
+            config.endpoint.clone(),
+            config.instance
+        )
+        .is_err()
+    );
+    owner.shutdown(deadline()).await.unwrap();
+    assert!(!receipt.matches(&config));
+    assert!(probe_endpoint(config, deadline()).await.is_err());
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest]
+#[case::rejected(false)]
+#[case::abandoned(true)]
+#[tokio::test]
+async fn test_should_retain_endpoint_environment_cleanup_without_replaying_admitted_probe(
+    #[case] abandoned: bool,
+) {
+    let (mut daemon, mut wire, mut owner, config) = fixture().await;
+    let task = tokio::spawn(probe_endpoint(config, deadline()));
+    let held = daemon.next().await;
+    if abandoned {
+        task.abort();
+        assert!(task.await.unwrap_err().is_cancelled());
+        assert_eq!(owner.port().status().allocated, 1);
+        held.reply(400, b"{}").await;
+    } else {
+        held.reply(400, b"{}").await;
+        assert!(matches!(
+            task.await.unwrap(),
+            Err(EnvironmentProbeError::Environment(_))
+        ));
+    }
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(owner.port().status().allocated, 0);
+    assert!(daemon.requests.try_recv().is_err());
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/probe/tests.rs b/crates/rustack-lambda-core/src/docker/probe/tests.rs
new file mode 100644
index 00000000..5e212399
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/probe/tests.rs
@@ -0,0 +1,182 @@
+use rustack_lambda_runtime::{
+    probe::TemporaryReport, protocol::Architecture as RuntimeArchitecture,
+};
+use serde_json::{Value, json};
+
+use super::*;
+use crate::docker::{
+    DockerWire, EnvironmentConfig, EnvironmentManager, RelayBudgets,
+    plan::tests::{image_with, policy},
+    tests::Daemon,
+};
+
+pub(super) fn report(attempt: AttemptId) -> ResourceReport {
+    ResourceReport::builder()
+        .version(1)
+        .attempt(attempt)
+        .architecture(RuntimeArchitecture::Arm64)
+        .cgroup_root(true)
+        .memory_max(Some(128 * 1024 * 1024))
+        .swap_max(Some(0))
+        .pids_max(Some(256))
+        .cpu_quota(Some(100_000))
+        .cpu_period(100_000)
+        .euid(1000)
+        .egid(1000)
+        .cap_effective(0)
+        .no_new_privileges(true)
+        .seccomp_mode(2)
+        .root_readonly(true)
+        .temporary(
+            TemporaryReport::builder()
+                .bytes(512 * 1024 * 1024)
+                .mode(0o1777)
+                .tmpfs(true)
+                .nosuid(true)
+                .nodev(true)
+                .build(),
+        )
+        .build()
+}
+#[rstest::rstest]
+#[case::version("version",json!(2),ProbeFailure::Identity)]
+#[case::namespace("cgroupRoot",json!(false),ProbeFailure::Namespace)]
+#[case::architecture("architecture",json!("x86_64"),ProbeFailure::Identity)]
+#[case::memory("memoryMax",json!(134_217_729),ProbeFailure::Memory)]
+#[case::unlimited_memory("memoryMax", Value::Null, ProbeFailure::Memory)]
+#[case::swap("swapMax",json!(1),ProbeFailure::Swap)]
+#[case::pids("pidsMax",json!(257),ProbeFailure::Pids)]
+#[case::cpu("cpuQuota", Value::Null, ProbeFailure::Cpu)]
+#[case::period("cpuPeriod",json!(0),ProbeFailure::Cpu)]
+#[case::overflow("cpuPeriod",json!(u64::MAX),ProbeFailure::Cpu)]
+#[case::root_uid("euid",json!(0),ProbeFailure::User)]
+#[case::root_gid("egid",json!(0),ProbeFailure::User)]
+#[case::capabilities("capEffective",json!(1),ProbeFailure::Capabilities)]
+#[case::privileges("noNewPrivileges",json!(false),ProbeFailure::Privilege)]
+#[case::seccomp("seccompMode",json!(0),ProbeFailure::Seccomp)]
+#[case::rootfs("rootReadonly",json!(false),ProbeFailure::Root)]
+#[case::tmp_size("temporary",json!({"bytes":1,"mode":1023,"tmpfs":true,"nosuid":true,"nodev":true}),ProbeFailure::Temporary)]
+#[case::tmp_flags("temporary",json!({"bytes":536_870_912,"mode":1023,"tmpfs":true,"nosuid":false,"nodev":true}),ProbeFailure::Temporary)]
+#[test]
+fn test_should_reject_each_actual_policy_mismatch(
+    #[case] field: &str,
+    #[case] value: Value,
+    #[case] failure: ProbeFailure,
+) {
+    let attempt = AttemptId::default();
+    let mut report = serde_json::to_value(report(attempt)).unwrap();
+    report[field] = value;
+    let decoded = decode_report(&serde_json::to_vec(&report).unwrap()).unwrap();
+    assert_eq!(
+        verify(&decoded, attempt, Architecture::Arm64, &policy()),
+        Err(failure)
+    );
+}
+#[test]
+fn test_should_verify_exact_attempt_and_checked_cpu_rounding_and_bound_reports() {
+    let attempt = AttemptId::default();
+    let mut observed = report(attempt);
+    verify(&observed, attempt, Architecture::Arm64, &policy()).unwrap();
+    assert_eq!(
+        verify(
+            &observed,
+            AttemptId::default(),
+            Architecture::Arm64,
+            &policy()
+        ),
+        Err(ProbeFailure::Identity)
+    );
+    let policy = ContainerPolicy::new(
+        "none".parse().unwrap(),
+        1000,
+        1000,
+        333_333_333,
+        RelayBudgets::default(),
+    )
+    .unwrap();
+    observed.cpu_quota = Some(33_000);
+    verify(&observed, attempt, Architecture::Arm64, &policy).unwrap();
+    for quota in [33_333, 34_000] {
+        observed.cpu_quota = Some(quota);
+        assert_eq!(
+            verify(&observed, attempt, Architecture::Arm64, &policy),
+            Err(ProbeFailure::Cpu)
+        );
+    }
+    observed.cpu_quota = Some(33_000);
+    assert!(decode_report(&vec![b' '; REPORT_BYTES + 1]).is_err());
+    let mut raw = serde_json::to_value(&observed).unwrap();
+    raw["unknown"] = json!(true);
+    assert!(decode_report(&serde_json::to_vec(&raw).unwrap()).is_err());
+    assert!(decode_report(br#"{"version":1,"version":1}"#).is_err());
+    assert!(ProbeSettings::new(Duration::ZERO, Duration::from_secs(1)).is_err());
+    assert!(ProbeSettings::new(Duration::from_secs(1), Duration::from_millis(1500)).is_err());
+}
+#[rstest::rstest]
+#[case::rejected(false)]
+#[case::abandoned(true)]
+#[tokio::test]
+async fn test_should_settle_rejected_probe_creation_and_retain_abandoned_waiter_cleanup(
+    #[case] abandoned: bool,
+) {
+    let mut daemon = Daemon::new();
+    let mut wire: DockerWire = daemon.wire().await;
+    let directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+    let mut environments =
+        EnvironmentManager::start(wire.port(), directory.clone(), EnvironmentConfig::default())
+            .unwrap();
+    let deadline = Instant::now() + Duration::from_secs(10);
+    let network = "none"
+        .parse::<super::super::NetworkSelection>()
+        .unwrap()
+        .qualify(&wire.port(), deadline)
+        .await
+        .unwrap();
+    let config = EnvironmentProbeConfig::builder()
+        .directory(directory)
+        .relay(image_with("1000", vec![]))
+        .environments(environments.port())
+        .policy(policy())
+        .network(network)
+        .build();
+    let mut foreign = config.clone();
+    foreign.directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+    assert!(matches!(
+        probe_environment(foreign, deadline).await,
+        Err(EnvironmentProbeError::Configuration)
+    ));
+    let task = tokio::spawn(probe_environment(config, deadline));
+    let creation = daemon.next().await;
+    if abandoned {
+        task.abort();
+        assert!(task.await.unwrap_err().is_cancelled());
+        assert_eq!(environments.port().status().allocated, 1);
+        creation.reply(400, b"{}").await;
+    } else {
+        creation.reply(400, b"{}").await;
+        assert!(matches!(
+            task.await.unwrap(),
+            Err(EnvironmentProbeError::Environment(_))
+        ));
+        assert_eq!(environments.port().status().allocated, 0);
+    }
+    assert!(daemon.requests.try_recv().is_err());
+    environments.shutdown(deadline).await.unwrap();
+    assert_eq!(environments.port().status().allocated, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+// Synthetic receipt for private binding/revocation unit regressions only. Actual
+// runtime qualification remains covered by the explicit real-daemon suites.
+pub(in crate::docker) fn synthetic_resource(
+    config: &EnvironmentProbeConfig,
+) -> super::EnvironmentProbe {
+    super::EnvironmentProbe {
+        report: report(AttemptId::default()),
+        directory: config.directory.clone(),
+        relay: config.relay.clone(),
+        policy: config.network.apply(&config.policy).unwrap(),
+        environments: config.environments.clone(),
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/pull.rs b/crates/rustack-lambda-core/src/docker/pull.rs
new file mode 100644
index 00000000..1fa6807c
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pull.rs
@@ -0,0 +1,368 @@
+//! Explicit registry policy, secret credentials and retained progress requests.
+
+pub(super) mod progress;
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fmt,
+    num::NonZeroU16,
+    str::FromStr,
+    sync::Arc,
+    time::Duration,
+};
+
+use base64::{Engine, engine::general_purpose::URL_SAFE};
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use secrecy::{ExposeSecret, SecretString, zeroize::Zeroize};
+use serde_json::to_vec;
+use tokio::{sync::watch, time::Instant};
+
+use super::{DockerError, DockerPort, Operation, RawReply, RawRequest};
+use crate::artifact::{Architecture, ImageReference};
+
+/// Canonical exact registry host/port; debug omits operator infrastructure.
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
+#[non_exhaustive]
+pub struct RegistryHost(String);
+impl fmt::Debug for RegistryHost {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryHost(<redacted>)")
+    }
+}
+impl FromStr for RegistryHost {
+    type Err = DockerError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.is_empty()
+            || value.len() > 253
+            || !value
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || b".-:[]".contains(&b))
+        {
+            return Err(DockerError::Configuration);
+        }
+        let canonical = value.to_ascii_lowercase();
+        let canonical = if canonical == "index.docker.io" {
+            "docker.io".to_owned()
+        } else {
+            canonical
+        };
+        let port = if canonical.starts_with('[') {
+            canonical
+                .split_once(']')
+                .and_then(|(_, tail)| tail.strip_prefix(':'))
+        } else {
+            canonical.split_once(':').map(|(_, port)| port)
+        };
+        if port.is_some_and(|port| port.parse::<NonZeroU16>().is_err()) {
+            return Err(DockerError::Configuration);
+        }
+        if !canonical.starts_with('[') {
+            let name = canonical
+                .split_once(':')
+                .map_or(canonical.as_str(), |(host, _)| host);
+            if name.split('.').any(|label| {
+                label.is_empty()
+                    || label.len() > 63
+                    || !label
+                        .bytes()
+                        .next()
+                        .is_some_and(|b| b.is_ascii_alphanumeric())
+                    || !label
+                        .bytes()
+                        .last()
+                        .is_some_and(|b| b.is_ascii_alphanumeric())
+            }) {
+                return Err(DockerError::Configuration);
+            }
+        }
+        let reference: ImageReference = format!("{canonical}/a")
+            .parse()
+            .map_err(|_| DockerError::Configuration)?;
+        if reference.registry() != Some(canonical.as_str()) {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self(canonical))
+    }
+}
+impl TryFrom<&str> for RegistryHost {
+    type Error = DockerError;
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+impl RegistryHost {
+    /// Canonical host, excluding any scheme/path.
+    /// ```
+    /// let host: rustack_lambda_core::docker::RegistryHost="registry.example:5000".parse()?;
+    /// assert_eq!(host.as_str(),"registry.example:5000");
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+enum Credential {
+    Basic(SecretString, SecretString),
+    Token(SecretString),
+}
+/// Validated mutually exclusive registry credentials, never serializable publicly.
+#[non_exhaustive]
+pub struct RegistryCredential(Credential);
+impl fmt::Debug for Credential {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Credential(<redacted>)")
+    }
+}
+impl fmt::Debug for RegistryCredential {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryCredential(<redacted>)")
+    }
+}
+fn secret(value: &SecretString, max: usize) -> Result<(), DockerError> {
+    let value = value.expose_secret();
+    if value.is_empty() || value.len() > max || value.chars().any(char::is_control) {
+        return Err(DockerError::Configuration);
+    }
+    Ok(())
+}
+impl RegistryCredential {
+    /// Validate explicit basic credentials without trimming or discovery.
+    /// # Errors
+    /// Rejects empty, overlong or control-bearing secrets.
+    /// ```
+    /// let credentials=rustack_lambda_core::docker::RegistryCredential::basic("user".into(),"password".into())?;
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn basic(username: SecretString, password: SecretString) -> Result<Self, DockerError> {
+        secret(&username, 256)?;
+        secret(&password, 4096)?;
+        Ok(Self(Credential::Basic(username, password)))
+    }
+    /// Validate an explicit identity token.
+    /// # Errors
+    /// Rejects empty, overlong or control-bearing tokens.
+    /// ```
+    /// let credentials=rustack_lambda_core::docker::RegistryCredential::identity_token("token".into())?;
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn identity_token(token: SecretString) -> Result<Self, DockerError> {
+        secret(&token, 8192)?;
+        Ok(Self(Credential::Token(token)))
+    }
+    fn bytes(&self) -> usize {
+        match &self.0 {
+            Credential::Basic(user, password) => user
+                .expose_secret()
+                .len()
+                .saturating_add(password.expose_secret().len()),
+            Credential::Token(token) => token.expose_secret().len(),
+        }
+    }
+    fn header(&self, host: &RegistryHost) -> Result<SecretString, DockerError> {
+        let mut fields = BTreeMap::from([("serveraddress", host.as_str())]);
+        match &self.0 {
+            Credential::Basic(user, password) => {
+                fields.insert("username", user.expose_secret());
+                fields.insert("password", password.expose_secret());
+            }
+            Credential::Token(token) => {
+                fields.insert("identitytoken", token.expose_secret());
+            }
+        }
+        let mut bytes = to_vec(&fields).map_err(|_| DockerError::Schema)?;
+        let encoded: SecretString = URL_SAFE.encode(&bytes).into();
+        bytes.zeroize();
+        if encoded.expose_secret().len() > 32 * 1024 {
+            return Err(DockerError::TooLarge);
+        }
+        Ok(encoded)
+    }
+}
+
+/// Bounded unique registry credential records; YAML/file loading is caller-owned.
+#[derive(Default)]
+#[non_exhaustive]
+pub struct RegistryCredentials(BTreeMap<RegistryHost, RegistryCredential>);
+impl fmt::Debug for RegistryCredentials {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryCredentials(<redacted>)")
+    }
+}
+impl TryFrom<Vec<(RegistryHost, RegistryCredential)>> for RegistryCredentials {
+    type Error = DockerError;
+    fn try_from(records: Vec<(RegistryHost, RegistryCredential)>) -> Result<Self, Self::Error> {
+        if records.len() > 32 {
+            return Err(DockerError::Configuration);
+        }
+        let mut total = 0_usize;
+        let mut map = BTreeMap::new();
+        for (host, credential) in records {
+            total = total
+                .checked_add(host.0.len())
+                .and_then(|n| n.checked_add(credential.bytes()))
+                .ok_or(DockerError::TooLarge)?;
+            if total > 64 * 1024 || map.insert(host, credential).is_some() {
+                return Err(DockerError::Configuration);
+            }
+        }
+        Ok(Self(map))
+    }
+}
+
+#[derive(Debug)]
+struct Approved {
+    hosts: BTreeSet<RegistryHost>,
+    credentials: RegistryCredentials,
+    timeout: Duration,
+}
+/// Default-never policy for explicitly configured deployment preparation.
+#[derive(Debug, Clone, Default)]
+#[non_exhaustive]
+pub struct ImagePullPolicy(Option<Arc<Approved>>);
+impl ImagePullPolicy {
+    /// Validate exact approved registries, matching credentials and total budget.
+    /// # Errors
+    /// Rejects empty/duplicate/over32 hosts, unapproved credentials and budgets
+    /// outside1..600 whole seconds.
+    /// ```
+    /// let policy=rustack_lambda_core::docker::ImagePullPolicy::if_missing(
+    ///     vec!["registry.example".parse()?],Default::default(),std::time::Duration::from_secs(300))?;
+    /// # Ok::<(),rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    pub fn if_missing(
+        hosts: Vec<RegistryHost>,
+        credentials: RegistryCredentials,
+        timeout: Duration,
+    ) -> Result<Self, DockerError> {
+        if hosts.is_empty()
+            || hosts.len() > 32
+            || timeout.subsec_nanos() != 0
+            || !(1..=600).contains(&timeout.as_secs())
+        {
+            return Err(DockerError::Configuration);
+        }
+        let len = hosts.len();
+        let hosts: BTreeSet<_> = hosts.into_iter().collect();
+        if hosts.len() != len || credentials.0.keys().any(|host| !hosts.contains(host)) {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self(Some(Arc::new(Approved {
+            hosts,
+            credentials,
+            timeout,
+        }))))
+    }
+    fn authorize(
+        &self,
+        reference: &ImageReference,
+    ) -> Result<(&Approved, RegistryHost), DockerError> {
+        let policy = self
+            .0
+            .as_deref()
+            .ok_or(DockerError::Status(StatusCode::NOT_FOUND))?;
+        let host: RegistryHost = reference.registry().unwrap_or("docker.io").parse()?;
+        if !policy.hosts.contains(&host) {
+            return Err(DockerError::PullDenied);
+        }
+        let repository = reference.repository();
+        let local = reference
+            .registry()
+            .and_then(|registry| repository.strip_prefix(registry))
+            .and_then(|path| path.strip_prefix('/'))
+            .unwrap_or(repository);
+        if host.as_str() == "docker.io" && local.starts_with("rustack-internal/") {
+            return Err(DockerError::PullDenied);
+        }
+        Ok((policy, host))
+    }
+    pub(super) async fn pull(
+        &self,
+        docker: &DockerPort,
+        reference: &ImageReference,
+        architecture: Architecture,
+        cancel: watch::Receiver<()>,
+        stop: watch::Receiver<bool>,
+    ) -> Result<(), DockerError> {
+        let (policy, host) = self.authorize(reference)?;
+        let auth = policy
+            .credentials
+            .0
+            .get(&host)
+            .map(|credential| credential.header(&host))
+            .transpose()?;
+        docker
+            .pull_image(
+                reference,
+                architecture,
+                Transfer { auth, cancel, stop },
+                Instant::now() + policy.timeout,
+            )
+            .await
+    }
+}
+
+pub(super) struct Transfer {
+    pub(super) auth: Option<SecretString>,
+    pub(super) cancel: watch::Receiver<()>,
+    pub(super) stop: watch::Receiver<bool>,
+}
+impl fmt::Debug for Transfer {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Transfer(<redacted>)")
+    }
+}
+
+impl DockerPort {
+    async fn pull_image(
+        &self,
+        reference: &ImageReference,
+        architecture: Architecture,
+        transfer: Transfer,
+        deadline: Instant,
+    ) -> Result<(), DockerError> {
+        if self.raw.binding.is_none() {
+            return Err(DockerError::DaemonBinding);
+        }
+        let tag = reference
+            .digest()
+            .or_else(|| {
+                reference
+                    .as_str()
+                    .strip_prefix(reference.repository())
+                    .and_then(|suffix| suffix.strip_prefix(':'))
+            })
+            .unwrap_or("latest");
+        let query = form_urlencoded::Serializer::new(String::new())
+            .append_pair("fromImage", reference.repository())
+            .append_pair("tag", tag)
+            .append_pair("platform", architecture.docker_platform())
+            .finish();
+        let result = self
+            .raw
+            .request_owned(
+                RawRequest {
+                    archive: None,
+                    pull: Some(transfer),
+                    binding: None,
+                    mutation: None,
+                    operation: Operation::Pull,
+                    method: Method::POST,
+                    target: format!("/v{}/images/create?{query}", self.version),
+                    body: Bytes::new(),
+                    expected: StatusCode::OK,
+                },
+                deadline,
+            )
+            .await?;
+        match result {
+            RawReply::Pulled => Ok(()),
+            _ => Err(DockerError::Protocol),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/pull/progress.rs b/crates/rustack-lambda-core/src/docker/pull/progress.rs
new file mode 100644
index 00000000..4b184005
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pull/progress.rs
@@ -0,0 +1,98 @@
+//! Incremental pull metadata; peer messages never escape as diagnostics.
+
+use std::fmt;
+
+use rustack_core::json::{JsonLimits, from_slice};
+use serde::{Deserialize, de::IgnoredAny};
+
+use crate::docker::DockerError;
+
+pub(in crate::docker) const MAX_TOTAL: usize = 16 * 1024 * 1024;
+const MAX_LINE: usize = 64 * 1024;
+const MAX_RECORDS: usize = 65_536;
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct Record {
+    error: Option<IgnoredAny>,
+    error_detail: Option<IgnoredAny>,
+}
+impl fmt::Debug for Record {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Record(<redacted>)")
+    }
+}
+#[derive(Default)]
+pub(in crate::docker) struct Progress {
+    line: Vec<u8>,
+    bytes: usize,
+    records: usize,
+}
+impl fmt::Debug for Progress {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Progress(<redacted>)")
+    }
+}
+impl Progress {
+    pub(in crate::docker) fn push(&mut self, bytes: &[u8]) -> Result<(), DockerError> {
+        self.bytes = self
+            .bytes
+            .checked_add(bytes.len())
+            .ok_or(DockerError::TooLarge)?;
+        if self.bytes > MAX_TOTAL {
+            return Err(DockerError::TooLarge);
+        }
+        for byte in bytes {
+            if *byte == b'\n' {
+                if self.line.last() == Some(&b'\r') {
+                    self.line.pop();
+                }
+                if self.line.is_empty() || self.line.len() > MAX_LINE {
+                    return Err(DockerError::Protocol);
+                }
+                if self
+                    .line
+                    .iter()
+                    .copied()
+                    .find(|byte| !byte.is_ascii_whitespace())
+                    != Some(b'{')
+                {
+                    return Err(DockerError::Protocol);
+                }
+                let record: Record =
+                    from_slice(&self.line, JsonLimits::new(MAX_LINE, 8, 128, 8192, 256)?)?;
+                if record.error.is_some() || record.error_detail.is_some() {
+                    return Err(DockerError::PullFailed);
+                }
+                self.records = self.records.checked_add(1).ok_or(DockerError::TooLarge)?;
+                if self.records > MAX_RECORDS {
+                    return Err(DockerError::TooLarge);
+                }
+                self.line.clear();
+            } else {
+                if self.line.len() > MAX_LINE || (self.line.len() == MAX_LINE && *byte != b'\r') {
+                    return Err(DockerError::TooLarge);
+                }
+                if self.line.len() == self.line.capacity() {
+                    let extra = (MAX_LINE + 1)
+                        .saturating_sub(self.line.len())
+                        .min(16 * 1024);
+                    self.line
+                        .try_reserve_exact(extra)
+                        .map_err(|_| DockerError::Allocation)?;
+                }
+                self.line.push(*byte);
+            }
+        }
+        Ok(())
+    }
+    pub(in crate::docker) fn finish(self) -> Result<(), DockerError> {
+        if self.records == 0 || !self.line.is_empty() {
+            return Err(DockerError::Protocol);
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/pull/progress/tests.rs b/crates/rustack-lambda-core/src/docker/pull/progress/tests.rs
new file mode 100644
index 00000000..7967f984
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pull/progress/tests.rs
@@ -0,0 +1,73 @@
+use rstest::rstest;
+
+use super::{MAX_LINE, MAX_RECORDS, MAX_TOTAL, Progress};
+use crate::docker::DockerError;
+
+#[rstest]
+#[case(b"{}\n".as_slice())]
+#[case(b"{\"status\":\"Pull complete\"}\r\n".as_slice())]
+#[case(b"{\"error\":null,\"errorDetail\":null,\"aux\":{\"Digest\":\"data\"}}\n".as_slice())]
+fn test_should_consume_every_fragment_boundary(#[case] source: &[u8]) {
+    for split in 0..=source.len() {
+        let mut progress = Progress::default();
+        progress.push(&source[..split]).unwrap();
+        progress.push(&source[split..]).unwrap();
+        progress.finish().unwrap();
+    }
+}
+#[rstest]
+#[case(b"\n".as_slice())]
+#[case(b"[]\n".as_slice())]
+#[case(b"[null,null]\n".as_slice())]
+#[case(b"null\n".as_slice())]
+#[case(b"\"text\"\n".as_slice())]
+#[case(b"{bad}\n".as_slice())]
+#[case(b"{\"x\":1,\"x\":2}\n".as_slice())]
+fn test_should_reject_nonobject_or_malformed_records(#[case] source: &[u8]) {
+    assert!(Progress::default().push(source).is_err());
+}
+#[rstest]
+#[case(b"{\"error\":\"SECRET-PEER\"}\n".as_slice())]
+#[case(b"{\"errorDetail\":{\"message\":\"SECRET-PEER\"}}\n".as_slice())]
+#[case(b"{\"errorDetail\":{}}\n".as_slice())]
+fn test_should_reject_in_band_errors_without_peer_text(#[case] source: &[u8]) {
+    let error = Progress::default().push(source).unwrap_err();
+    assert!(matches!(error, DockerError::PullFailed));
+    assert!(!format!("{error:?}: {error}").contains("SECRET"));
+}
+#[test]
+fn test_should_require_nonempty_complete_lines_at_eof() {
+    assert!(Progress::default().finish().is_err());
+    let mut progress = Progress::default();
+    progress.push(b"{}").unwrap();
+    assert!(progress.finish().is_err());
+}
+#[test]
+fn test_should_bound_line_bytes_records_and_total_progress() {
+    let mut line = b"{}".to_vec();
+    line.resize(MAX_LINE, b' ');
+    let mut progress = Progress::default();
+    progress.push(&line).unwrap();
+    progress.push(b"\r\n").unwrap();
+    progress.finish().unwrap();
+    line.push(b' ');
+    assert!(matches!(
+        Progress::default().push(&line),
+        Err(DockerError::TooLarge)
+    ));
+    let source = b"{}\n".repeat(MAX_RECORDS);
+    let mut progress = Progress::default();
+    progress.push(&source).unwrap();
+    assert!(matches!(progress.push(b"{}\n"), Err(DockerError::TooLarge)));
+    assert!(matches!(
+        Progress::default().push(&vec![b' '; MAX_TOTAL + 1]),
+        Err(DockerError::TooLarge)
+    ));
+}
+#[test]
+fn test_should_reject_deep_and_oversized_progress_scalars() {
+    let long = format!("{{\"status\":\"{}\"}}\n", "x".repeat(8193));
+    assert!(Progress::default().push(long.as_bytes()).is_err());
+    let deep = format!("{{\"aux\":{}0{}}}\n", "[".repeat(9), "]".repeat(9));
+    assert!(Progress::default().push(deep.as_bytes()).is_err());
+}
diff --git a/crates/rustack-lambda-core/src/docker/pull/tests.rs b/crates/rustack-lambda-core/src/docker/pull/tests.rs
new file mode 100644
index 00000000..4c4793de
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pull/tests.rs
@@ -0,0 +1,183 @@
+use std::time::Duration;
+
+use base64::{Engine, engine::general_purpose::URL_SAFE};
+use http::StatusCode;
+use rstest::rstest;
+use secrecy::ExposeSecret;
+use serde_json::{Value, from_slice};
+
+use super::{ImagePullPolicy, RegistryCredential, RegistryCredentials, RegistryHost};
+use crate::docker::DockerError;
+
+mod preparation;
+mod real;
+mod wire;
+
+#[rstest]
+#[case("")]
+#[case("https://registry.example")]
+#[case("registry.example/path")]
+#[case("user@registry.example")]
+#[case("*.example")]
+#[case("registry")]
+#[case("registry.example:0")]
+#[case("registry.example:65536")]
+#[case("registry.example\n")]
+#[case("-registry.example")]
+#[case("registry-.example")]
+#[case("registry.-example")]
+fn test_should_reject_unsafe_ambiguous_registry_hosts(#[case] host: &str) {
+    assert!(host.parse::<RegistryHost>().is_err());
+}
+#[rstest]
+#[case("registry.example")]
+#[case("localhost:5000")]
+#[case("[::1]:5000")]
+fn test_should_validate_and_redact_exact_registry_hosts(#[case] host: &str) {
+    let parsed: RegistryHost = host.parse().unwrap();
+    assert_eq!(parsed.as_str(), host);
+    assert!(!format!("{parsed:?}").contains(host));
+}
+#[test]
+fn test_should_canonicalize_dns_case_and_only_documented_default_hub_alias() {
+    assert_eq!(
+        "INDEX.DOCKER.IO".parse::<RegistryHost>().unwrap(),
+        "docker.io".parse().unwrap()
+    );
+    assert_eq!(
+        "REGISTRY.example:5000"
+            .parse::<RegistryHost>()
+            .unwrap()
+            .as_str(),
+        "registry.example:5000"
+    );
+    assert!("a".repeat(254).parse::<RegistryHost>().is_err());
+}
+#[test]
+fn test_should_bound_and_redact_credentials_with_padded_docker_auth_encoding() {
+    let host = "registry.example".parse().unwrap();
+    let credential =
+        RegistryCredential::basic("PRIVATE-USER".into(), "PRIVATE-PASSWORD".into()).unwrap();
+    let header = credential.header(&host).unwrap();
+    let json: Value = from_slice(&URL_SAFE.decode(header.expose_secret()).unwrap()).unwrap();
+    assert_eq!(json["username"], "PRIVATE-USER");
+    assert_eq!(json["password"], "PRIVATE-PASSWORD");
+    assert_eq!(json["serveraddress"], "registry.example");
+    assert!(!format!("{credential:?} {header:?}").contains("PRIVATE"));
+    assert!(RegistryCredential::basic("u".repeat(257).into(), "p".into()).is_err());
+    assert!(RegistryCredential::basic("u".into(), "p".repeat(4097).into()).is_err());
+    assert!(RegistryCredential::identity_token("t".repeat(8193).into()).is_err());
+    assert!(RegistryCredential::identity_token("t\n".into()).is_err());
+    assert!(RegistryCredential::basic("".into(), "p".into()).is_err());
+    let token = RegistryCredential::identity_token("t".repeat(8192).into()).unwrap();
+    assert!(token.header(&host).unwrap().expose_secret().len() <= 32 * 1024);
+}
+fn policy(host: &str) -> ImagePullPolicy {
+    ImagePullPolicy::if_missing(
+        vec![host.parse().unwrap()],
+        RegistryCredentials::default(),
+        Duration::from_secs(10),
+    )
+    .unwrap()
+}
+#[test]
+fn test_should_require_exact_host_port_allowlist_and_never_pull_internal_aliases() {
+    let configured = policy("registry.example:5000");
+    assert!(
+        configured
+            .authorize(&"registry.example:5000/team/fn:v1".parse().unwrap())
+            .is_ok()
+    );
+    for source in [
+        "registry.example:5001/team/fn:v1",
+        "registry.example.evil/team/fn:v1",
+        "evilregistry.example/team/fn:v1",
+        "worker:v1",
+    ] {
+        assert!(matches!(
+            configured.authorize(&source.parse().unwrap()),
+            Err(DockerError::PullDenied)
+        ));
+    }
+    let hub = policy("docker.io");
+    assert!(hub.authorize(&"worker:v1".parse().unwrap()).is_ok());
+    for source in [
+        "rustack-internal/lambda-owner/run:pin",
+        "docker.io/rustack-internal/run:pin",
+        "index.docker.io/rustack-internal/run:pin",
+    ] {
+        assert!(matches!(
+            hub.authorize(&source.parse().unwrap()),
+            Err(DockerError::PullDenied)
+        ));
+    }
+    assert!(matches!(
+        ImagePullPolicy::default().authorize(&"worker:v1".parse().unwrap()),
+        Err(DockerError::Status(StatusCode::NOT_FOUND))
+    ));
+}
+#[test]
+fn test_should_reject_duplicate_unapproved_or_excessive_policy_records_and_budgets() {
+    let host: RegistryHost = "registry.example".parse().unwrap();
+    assert!(
+        ImagePullPolicy::if_missing(
+            vec![],
+            RegistryCredentials::default(),
+            Duration::from_secs(1)
+        )
+        .is_err()
+    );
+    assert!(
+        ImagePullPolicy::if_missing(
+            vec![host.clone(), host.clone()],
+            RegistryCredentials::default(),
+            Duration::from_secs(1)
+        )
+        .is_err()
+    );
+    assert!(
+        ImagePullPolicy::if_missing(
+            vec![host.clone(); 33],
+            RegistryCredentials::default(),
+            Duration::from_secs(1)
+        )
+        .is_err()
+    );
+    for timeout in [
+        Duration::ZERO,
+        Duration::from_millis(1500),
+        Duration::from_secs(601),
+    ] {
+        assert!(
+            ImagePullPolicy::if_missing(
+                vec![host.clone()],
+                RegistryCredentials::default(),
+                timeout
+            )
+            .is_err()
+        );
+    }
+    let make = || RegistryCredential::identity_token("secret".into()).unwrap();
+    assert!(
+        RegistryCredentials::try_from(vec![(host.clone(), make()), (host.clone(), make())])
+            .is_err()
+    );
+    let map = RegistryCredentials::try_from(vec![(host, make())]).unwrap();
+    assert!(
+        ImagePullPolicy::if_missing(
+            vec!["other.example".parse().unwrap()],
+            map,
+            Duration::from_secs(1)
+        )
+        .is_err()
+    );
+    let records: Vec<(RegistryHost, RegistryCredential)> = (0..9)
+        .map(|i| {
+            (
+                format!("registry{i}.example").parse().unwrap(),
+                RegistryCredential::identity_token("x".repeat(8192).into()).unwrap(),
+            )
+        })
+        .collect();
+    assert!(RegistryCredentials::try_from(records).is_err());
+}
diff --git a/crates/rustack-lambda-core/src/docker/pull/tests/preparation.rs b/crates/rustack-lambda-core/src/docker/pull/tests/preparation.rs
new file mode 100644
index 00000000..42bafb3b
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pull/tests/preparation.rs
@@ -0,0 +1,280 @@
+use std::time::Duration;
+
+use http::StatusCode;
+use tempfile::tempdir;
+use tokio::{
+    spawn,
+    time::{Instant, timeout},
+};
+
+use super::policy;
+use crate::{
+    artifact::{Architecture, ArtifactError},
+    docker::{
+        DirectoryLease, DockerError, ImageLeaseConfig, ImageLeaseManager, ImagePinScope,
+        lease::tests::{FakePins, Mode},
+        tests::Daemon,
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+
+#[tokio::test]
+async fn test_should_never_pull_when_a_local_image_is_already_valid() {
+    let root = tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let fake = FakePins::new(Mode::Normal).await;
+    let bound = fake
+        .wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let mut owner = ImageLeaseManager::start_with_pull(
+        bound,
+        ImagePinScope::new(directory),
+        ImageLeaseConfig::default(),
+        policy("registry.example"),
+    )
+    .unwrap();
+    // FakePins only serves inspection/tag/retirement, so an unexpected pull fails.
+    let image = owner
+        .port()
+        .prepare(
+            &"worker:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+        .unwrap();
+    assert!(image.is_live());
+    drop(image);
+    owner.shutdown(deadline()).await.unwrap();
+    fake.close().await;
+}
+
+#[tokio::test]
+async fn test_should_pull_only_after_initial_missing_root_and_never_publish_invalid_post_pull_image()
+ {
+    let root = tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let mut owner = ImageLeaseManager::start_with_pull(
+        port,
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+        policy("registry.example"),
+    )
+    .unwrap();
+    let port = owner.port();
+    let reference = "registry.example/fn:v1".parse().unwrap();
+    let (result, ()) = tokio::join!(
+        port.prepare(&reference, Architecture::Arm64, None, deadline()),
+        async {
+            let initial = daemon.next().await;
+            assert!(initial.head.contains("/images/"));
+            initial.reply(404, b"{}").await;
+            let pull = daemon.next().await;
+            assert!(pull.head.starts_with("POST /v1.53/images/create?"));
+            pull.reply(200, b"{\"status\":\"Pull complete\"}\n").await;
+            let recheck = daemon.next().await;
+            assert!(recheck.head.starts_with("GET /v1.53/images/"));
+            recheck.reply(200, b"{\"Id\":\"not-a-digest\"}").await;
+        }
+    );
+    assert!(result.is_err());
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(port.status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_not_pull_after_nonmissing_initial_failure_or_unapproved_registry() {
+    for status in [StatusCode::FORBIDDEN, StatusCode::NOT_FOUND] {
+        let root = tempdir().unwrap();
+        let directory = DirectoryLease::acquire(root.path().into(), deadline())
+            .await
+            .unwrap();
+        let mut daemon = Daemon::new();
+        let mut wire = daemon.wire().await;
+        let bound = wire
+            .port()
+            .bind_directory(&directory, deadline())
+            .await
+            .unwrap();
+        let mut owner = ImageLeaseManager::start_with_pull(
+            bound,
+            ImagePinScope::new(directory),
+            ImageLeaseConfig::default(),
+            policy("allowed.example"),
+        )
+        .unwrap();
+        let port = owner.port();
+        let reference = "denied.example/fn:v1".parse().unwrap();
+        let (result, ()) = tokio::join!(
+            port.prepare(&reference, Architecture::Arm64, None, deadline()),
+            async {
+                daemon.next().await.reply(status.as_u16(), b"{}").await;
+            }
+        );
+        assert!(result.is_err());
+        owner.shutdown(deadline()).await.unwrap();
+        assert_eq!(port.status().pins, 0);
+        wire.shutdown().await.unwrap();
+        daemon.close().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_keep_preparation_owned_until_cancelled_pull_driver_is_joined() {
+    let root = tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let bound = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let mut owner = ImageLeaseManager::start_with_pull(
+        bound,
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+        policy("registry.example"),
+    )
+    .unwrap();
+    let port = owner.port();
+    let task = spawn(async move {
+        port.prepare(
+            &"registry.example/fn:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            deadline(),
+        )
+        .await
+    });
+    daemon.next().await.reply(404, b"{}").await;
+    let held = daemon.next().await;
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    drop(held);
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(owner.port().status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_not_treat_platform_metadata_missing_as_initial_root_missing() {
+    let root = tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let bound = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let mut owner = ImageLeaseManager::start_with_pull(
+        bound,
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+        policy("registry.example"),
+    )
+    .unwrap();
+    let port = owner.port();
+    let reference = "registry.example/fn:v1".parse().unwrap();
+    let (result, ()) = tokio::join!(
+        port.prepare(&reference, Architecture::Arm64, None, deadline()),
+        async {
+            daemon
+                .next()
+                .await
+                .reply(
+                    200,
+                    format!("{{\"Id\":\"sha256:{}\"}}", "a".repeat(64)).as_bytes(),
+                )
+                .await;
+            let selected = daemon.next().await;
+            assert!(selected.head.starts_with("GET /v1.53/images/sha256"));
+            assert!(selected.head.contains("platform="));
+            selected.reply(404, b"{}").await;
+        }
+    );
+    assert!(matches!(
+        result,
+        Err(DockerError::Image(ArtifactError::Inspection))
+    ));
+    assert!(daemon.requests.try_recv().is_err());
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_cancel_owned_pull_when_preparation_waiter_expires() {
+    let root = tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let bound = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let mut owner = ImageLeaseManager::start_with_pull(
+        bound,
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+        policy("registry.example"),
+    )
+    .unwrap();
+    let port = owner.port();
+    let task = spawn(async move {
+        port.prepare(
+            &"registry.example/fn:v1".parse().unwrap(),
+            Architecture::Arm64,
+            None,
+            Instant::now() + Duration::from_secs(1),
+        )
+        .await
+    });
+    daemon.next().await.reply(404, b"{}").await;
+    let held = daemon.next().await;
+    assert!(matches!(
+        timeout(Duration::from_secs(3), task)
+            .await
+            .unwrap()
+            .unwrap(),
+        Err(DockerError::Deadline)
+    ));
+    owner.shutdown(deadline()).await.unwrap();
+    assert_eq!(owner.port().status().pins, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    drop(held);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/pull/tests/real.rs b/crates/rustack-lambda-core/src/docker/pull/tests/real.rs
new file mode 100644
index 00000000..1b4de145
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pull/tests/real.rs
@@ -0,0 +1,192 @@
+use std::{collections::BTreeMap, env, fmt, path::Path, time::Duration};
+
+use anyhow::{Context, Error, Result, ensure};
+use http::StatusCode;
+use rustack_core::settings::ValidatedSettings;
+use tempfile::{TempDir, tempdir};
+use tokio::{
+    fs,
+    io::AsyncWriteExt,
+    sync::watch,
+    time::{Instant, timeout_at},
+};
+
+use crate::{
+    artifact::{Architecture, ImageReference},
+    docker::{
+        DirectoryLease, DockerError, DockerRuntimeSettings, DockerWire, ImageLeaseConfig,
+        ImageLeaseManager, ImagePinScope, ImagePullPolicy, reconcile_namespace,
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(600)
+}
+fn io_deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+struct Evidence(Option<TempDir>);
+impl fmt::Debug for Evidence {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Evidence(<retained>)")
+    }
+}
+impl Evidence {
+    fn path(&self) -> Result<&Path> {
+        Ok(self.0.as_ref().context("evidence directory")?.path())
+    }
+}
+impl Drop for Evidence {
+    fn drop(&mut self) {
+        if let Some(root) = self.0.take() {
+            eprintln!("retained pull evidence: {}", root.keep().display());
+        }
+    }
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker socket, architecture and immutable approved image"]
+async fn test_should_pull_approved_immutable_image_prepare_live_pin_and_join_cleanup() -> Result<()>
+{
+    let socket = env::var("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit Docker socket")?;
+    let architecture = match env::var("RUSTACK_RUNTIME_ARCH")?.as_str() {
+        "arm64" => Architecture::Arm64,
+        "amd64" => Architecture::X86_64,
+        _ => anyhow::bail!("unknown architecture"),
+    };
+    let reference: ImageReference = env::var("RUSTACK_PULL_IMAGE")
+        .context("explicit immutable approved pull image")?
+        .parse()?;
+    let mut evidence = Evidence(Some(tempdir()?));
+    let mut wire = DockerWire::connect(format!("unix://{socket}").parse()?, io_deadline()).await?;
+    let mut images = None;
+    let result = async {
+        let directory = DirectoryLease::acquire(evidence.path()?.into(), io_deadline()).await?;
+        let docker = wire
+            .port()
+            .bind_directory(&directory, io_deadline())
+            .await?;
+        ensure!(
+            reference.digest().is_some() && reference.registry() == Some("public.ecr.aws"),
+            "fixture requires immutable public.ecr.aws reference"
+        );
+        let cache_miss = match docker.inspect_image(&reference, io_deadline()).await {
+            Ok(_) => false,
+            Err(DockerError::Status(StatusCode::NOT_FOUND)) => true,
+            Err(error) => return Err(error.into()),
+        };
+        let policy = configured_policy(evidence.path()?, &reference).await?;
+        images = Some(ImageLeaseManager::start_with_pull(
+            docker.clone(),
+            ImagePinScope::new(directory.clone()),
+            ImageLeaseConfig::default(),
+            policy.clone(),
+        )?);
+        let image = images
+            .as_ref()
+            .context("image owner")?
+            .port()
+            .prepare(&reference, architecture, None, deadline())
+            .await?;
+        ensure!(
+            image.is_live() && image.unpacked_size().get() > 0,
+            "prepared image is not live"
+        );
+        let records = directory.image_records(io_deadline()).await?;
+        ensure!(
+            records.len() == 1 && records.iter().all(|record| record.committed),
+            "pin not committed"
+        );
+        let expected = image.resolved().metadata().image_id.clone();
+        // Always execute the actual endpoint too, even on a repeated warm run.
+        let (_cancel, cancel) = watch::channel(());
+        let (_stop, stop) = watch::channel(false);
+        policy
+            .pull(&docker, &reference, architecture, cancel, stop)
+            .await?;
+        ensure!(
+            docker
+                .inspect_image(&reference, io_deadline())
+                .await?
+                .id
+                .as_deref()
+                == Some(expected.as_str()),
+            "immutable source changed"
+        );
+        drop(image);
+        eprintln!(
+            "approved real pull/preparation cacheMiss={cache_miss}; source cache intentionally \
+             retained"
+        );
+        Ok::<(), Error>(())
+    }
+    .await;
+    let cleanup = match images.as_mut() {
+        Some(owner) => owner.shutdown(deadline()).await,
+        None => Ok(()),
+    };
+    if cleanup.is_ok() {
+        images.take();
+    }
+    let audit = audit_scope(&wire, evidence.path()?).await;
+    let wire_cleanup = wire.shutdown().await;
+    result?;
+    cleanup?;
+    audit?;
+    wire_cleanup?;
+    evidence.0.take();
+    Ok(())
+}
+
+async fn audit_scope(wire: &DockerWire, root: &Path) -> Result<()> {
+    let directory = DirectoryLease::acquire(root.into(), io_deadline()).await?;
+    let docker = wire
+        .port()
+        .bind_directory(&directory, io_deadline())
+        .await?;
+    let report = reconcile_namespace(&directory, &docker, io_deadline()).await?;
+    ensure!(
+        report.containers.remaining == 0 && report.pins.remaining == 0,
+        "owned resources remain"
+    );
+    Ok(())
+}
+
+async fn configured_policy(root: &Path, reference: &ImageReference) -> Result<ImagePullPolicy> {
+    timeout_at(io_deadline(), async {
+        let path = fs::canonicalize(root)
+            .await?
+            .join("registry-credentials.yaml");
+        let mut file = fs::OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .mode(0o600)
+            .open(&path)
+            .await?;
+        file.write_all(b"{}\n").await?;
+        drop(file);
+        let shared = ValidatedSettings::parse(
+            "budgets:\n  lambdaDockerPullSeconds: 600",
+            &BTreeMap::from([
+                (
+                    "LAMBDA_DOCKER_RELAY_IMAGE".into(),
+                    reference.as_str().to_owned(),
+                ),
+                ("LAMBDA_DOCKER_NETWORK".into(), "none".into()),
+                ("LAMBDA_DOCKER_PULL_POLICY".into(), "ifMissing".into()),
+                ("LAMBDA_DOCKER_REGISTRIES".into(), "public.ecr.aws".into()),
+                (
+                    "LAMBDA_DOCKER_REGISTRY_AUTH_FILE".into(),
+                    path.to_str().context("UTF-8 fixture path")?.to_owned(),
+                ),
+            ]),
+        )?;
+        let settings = DockerRuntimeSettings::from_lookup(
+            |key| shared.get(key).map(str::to_owned),
+            shared.budgets(),
+            Duration::from_secs(600),
+        )?;
+        Ok::<_, Error>(settings.load_pull_policy(io_deadline()).await?)
+    })
+    .await?
+}
diff --git a/crates/rustack-lambda-core/src/docker/pull/tests/wire.rs b/crates/rustack-lambda-core/src/docker/pull/tests/wire.rs
new file mode 100644
index 00000000..0c238918
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/pull/tests/wire.rs
@@ -0,0 +1,414 @@
+use std::{collections::BTreeMap, sync::Arc, time::Duration};
+
+use base64::{Engine, engine::general_purpose::URL_SAFE};
+use http::StatusCode;
+use rstest::rstest;
+use serde_json::{Value, from_slice};
+use tempfile::{TempDir, tempdir};
+use tokio::{
+    spawn,
+    sync::watch,
+    time::{Instant, sleep, timeout},
+};
+use tracing::{Level, instrument::WithSubscriber};
+
+use super::policy;
+use crate::{
+    artifact::Architecture,
+    docker::{
+        DirectoryLease, DockerError, DockerPort, DockerWire, ImagePullPolicy, RegistryCredential,
+        RegistryCredentials,
+        tests::{Daemon, LogWriter},
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+async fn fixture() -> (TempDir, Daemon, DockerWire, DockerPort) {
+    let root = tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    (root, daemon, wire, port)
+}
+
+#[rstest]
+#[case("registry.example/team/worker:v1", "v1")]
+#[case("registry.example/team/worker", "latest")]
+#[case(
+    "registry.example/team/worker@sha256:\
+     aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+)]
+#[tokio::test]
+async fn test_should_encode_explicit_tag_digest_platform_and_selected_secret(
+    #[case] source: &str,
+    #[case] tag: &str,
+) {
+    let (_root, mut daemon, mut wire, port) = fixture().await;
+    let host = "registry.example".parse().unwrap();
+    let credentials = RegistryCredentials::try_from(vec![(
+        host,
+        RegistryCredential::basic("PRIVATE-USER".into(), "PRIVATE-PASSWORD".into()).unwrap(),
+    )])
+    .unwrap();
+    let policy = ImagePullPolicy::if_missing(
+        vec!["registry.example".parse().unwrap()],
+        credentials,
+        Duration::from_secs(10),
+    )
+    .unwrap();
+    let reference = source.parse().unwrap();
+    let (_cancel, cancel) = watch::channel(());
+    let (_stop, stop) = watch::channel(false);
+    let (result, ()) = tokio::join!(
+        policy.pull(&port, &reference, Architecture::Arm64, cancel, stop),
+        async {
+            let request = daemon.next().await;
+            let target = request
+                .head
+                .lines()
+                .next()
+                .unwrap()
+                .split_whitespace()
+                .nth(1)
+                .unwrap();
+            let (path, query) = target.split_once('?').unwrap();
+            assert_eq!(path, "/v1.53/images/create");
+            let query = form_urlencoded::parse(query.as_bytes())
+                .into_owned()
+                .collect::<BTreeMap<_, _>>();
+            assert_eq!(query.len(), 3);
+            assert_eq!(query["fromImage"], "registry.example/team/worker");
+            assert_eq!(query["tag"], tag);
+            assert_eq!(query["platform"], "linux/arm64");
+            let auth = request
+                .head
+                .lines()
+                .find_map(|line| {
+                    line.split_once(':')
+                        .filter(|(name, _)| name.eq_ignore_ascii_case("x-registry-auth"))
+                        .map(|(_, value)| value.trim())
+                })
+                .unwrap();
+            let credentials: Value = from_slice(&URL_SAFE.decode(auth).unwrap()).unwrap();
+            assert_eq!(credentials["username"], "PRIVATE-USER");
+            assert_eq!(credentials["password"], "PRIVATE-PASSWORD");
+            request
+                .reply(200, b"{\"status\":\"Pull complete\"}\n")
+                .await;
+        }
+    );
+    result.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(200,b"{\"errorDetail\":{\"message\":\"SECRET-PEER\"}}\n".as_slice())]
+#[case(200,b"{}".as_slice())]
+#[case(200,b"".as_slice())]
+#[case(404,b"{\"message\":\"SECRET-PEER\"}".as_slice())]
+#[tokio::test]
+async fn test_should_reject_failed_empty_or_truncated_streams_without_peer_text(
+    #[case] status: u16,
+    #[case] body: &[u8],
+) {
+    let (_root, mut daemon, mut wire, port) = fixture().await;
+    let policy = policy("registry.example");
+    let reference = "registry.example/fn:v1".parse().unwrap();
+    let (_cancel, cancel) = watch::channel(());
+    let (_stop, stop) = watch::channel(false);
+    let (result, ()) = tokio::join!(
+        policy.pull(&port, &reference, Architecture::Arm64, cancel, stop),
+        async {
+            daemon.next().await.reply(status, body).await;
+        }
+    );
+    let error = result.unwrap_err();
+    assert!(!format!("{error:?}: {error}").contains("SECRET-PEER"));
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_bound_running_and_queued_pulls_without_starving_cleanup() {
+    let (_root, mut daemon, mut wire, port) = fixture().await;
+    let policy = policy("registry.example");
+    let (cancel, cancelled) = watch::channel(());
+    let (_stop, stopped) = watch::channel(false);
+    let mut tasks = Vec::new();
+    let mut held = Vec::new();
+    for _ in 0..4 {
+        let (policy, port, cancel, stop) = (
+            policy.clone(),
+            port.clone(),
+            cancelled.clone(),
+            stopped.clone(),
+        );
+        tasks.push(spawn(async move {
+            policy
+                .pull(
+                    &port,
+                    &"registry.example/fn:v1".parse().unwrap(),
+                    Architecture::Arm64,
+                    cancel,
+                    stop,
+                )
+                .await
+        }));
+        held.push(daemon.next().await);
+    }
+    for _ in 0..8 {
+        let (policy, port, cancel, stop) = (
+            policy.clone(),
+            port.clone(),
+            cancelled.clone(),
+            stopped.clone(),
+        );
+        tasks.push(spawn(async move {
+            policy
+                .pull(
+                    &port,
+                    &"registry.example/fn:v1".parse().unwrap(),
+                    Architecture::Arm64,
+                    cancel,
+                    stop,
+                )
+                .await
+        }));
+    }
+    timeout(Duration::from_secs(3), async {
+        while port.raw.pulls.capacity() != 0 {
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(matches!(
+        policy
+            .pull(
+                &port,
+                &"registry.example/fn:v1".parse().unwrap(),
+                Architecture::Arm64,
+                cancelled.clone(),
+                stopped.clone()
+            )
+            .await,
+        Err(DockerError::Busy)
+    ));
+    let key = "a".repeat(64).parse().unwrap();
+    let (result, ()) = tokio::join!(port.inspect_container(&key, deadline()), async {
+        let request = daemon.next().await;
+        assert!(request.head.contains("/containers/"));
+        request.reply(404, b"{}").await;
+    });
+    assert!(matches!(
+        result,
+        Err(DockerError::Status(StatusCode::NOT_FOUND))
+    ));
+    drop(cancel);
+    drop(held);
+    for task in tasks {
+        assert!(task.await.unwrap().is_err());
+    }
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_cancel_and_join_an_active_pull_before_terminal_receipt() {
+    let (root, mut daemon, mut wire, port) = fixture().await;
+    let policy = policy("registry.example");
+    let (cancel, cancelled) = watch::channel(());
+    let (_stop, stopped) = watch::channel(false);
+    let call = port.clone();
+    let task = spawn(async move {
+        policy
+            .pull(
+                &call,
+                &"registry.example/fn:v1".parse().unwrap(),
+                Architecture::Arm64,
+                cancelled,
+                stopped,
+            )
+            .await
+    });
+    let held = daemon.next().await;
+    drop(cancel);
+    assert!(matches!(task.await.unwrap(), Err(DockerError::Cancelled)));
+    drop(held);
+    drop(port);
+    wire.shutdown().await.unwrap();
+    drop(wire);
+    let _next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case::deadline(false)]
+#[case::owner_stop(true)]
+#[tokio::test]
+async fn test_should_join_an_active_pull_on_deadline_or_owner_stop(#[case] stopping: bool) {
+    let (root, mut daemon, mut wire, port) = fixture().await;
+    let policy = ImagePullPolicy::if_missing(
+        vec!["registry.example".parse().unwrap()],
+        RegistryCredentials::default(),
+        Duration::from_secs(1),
+    )
+    .unwrap();
+    let (_cancel, cancel) = watch::channel(());
+    let (stop, stopped) = watch::channel(false);
+    let task = spawn(async move {
+        policy
+            .pull(
+                &port,
+                &"registry.example/fn:v1".parse().unwrap(),
+                Architecture::Arm64,
+                cancel,
+                stopped,
+            )
+            .await
+    });
+    let held = daemon.next().await;
+    if stopping {
+        stop.send_replace(true);
+    }
+    let error = timeout(Duration::from_secs(3), task)
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap_err();
+    assert!(if stopping {
+        matches!(error, DockerError::Stopped)
+    } else {
+        matches!(error, DockerError::Deadline)
+    });
+    drop(held);
+    wire.shutdown().await.unwrap();
+    drop(wire);
+    let _directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case::abandoned_waiter(false)]
+#[case::failed_root(true)]
+#[tokio::test]
+async fn test_should_retain_accepted_pull_after_waiter_or_root_is_abandoned(#[case] failed: bool) {
+    let (root, mut daemon, mut wire, port) = fixture().await;
+    let policy = policy("registry.example");
+    let (_cancel, cancel) = watch::channel(());
+    let (_stop, stop) = watch::channel(false);
+    let task = spawn(async move {
+        policy
+            .pull(
+                &port,
+                &"registry.example/fn:v1".parse().unwrap(),
+                Architecture::Arm64,
+                cancel,
+                stop,
+            )
+            .await
+    });
+    let held = daemon.next().await;
+    if failed {
+        wire.owner.task.as_ref().unwrap().abort();
+        assert!(task.await.unwrap().is_err());
+    } else {
+        task.abort();
+        assert!(task.await.unwrap_err().is_cancelled());
+        assert!(
+            DirectoryLease::acquire(root.path().into(), deadline())
+                .await
+                .is_err()
+        );
+    }
+    let result = wire.shutdown().await;
+    assert!(if failed {
+        matches!(result, Err(DockerError::Worker))
+    } else {
+        result.is_ok()
+    });
+    drop(held);
+    drop(wire);
+    let _directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_filter_pull_auth_target_progress_and_errors_under_trace() {
+    let capture = LogWriter(Arc::default());
+    let writer = capture.clone();
+    let subscriber = tracing_subscriber::fmt()
+        .with_max_level(Level::TRACE)
+        .with_ansi(false)
+        .with_writer(move || writer.clone())
+        .finish();
+    async {
+        tracing::debug!("pull_application_event");
+        let (_root, mut daemon, mut wire, port) = fixture().await;
+        let host = "private-registry.example".parse().unwrap();
+        let credential =
+            RegistryCredential::basic("PRIVATE-USERNAME".into(), "PRIVATE-PASSWORD".into())
+                .unwrap();
+        let credentials = RegistryCredentials::try_from(vec![(host, credential)]).unwrap();
+        let policy = ImagePullPolicy::if_missing(
+            vec!["private-registry.example".parse().unwrap()],
+            credentials,
+            Duration::from_secs(10),
+        )
+        .unwrap();
+        let (_cancel, cancel) = watch::channel(());
+        let (_stop, stop) = watch::channel(false);
+        let source = "private-registry.example/private-source:v1"
+            .parse()
+            .unwrap();
+        let (result, ()) = tokio::join!(
+            policy.pull(&port, &source, Architecture::Arm64, cancel, stop),
+            async {
+                daemon
+                    .next()
+                    .await
+                    .reply(
+                        200,
+                        b"{\"status\":\"PRIVATE-PROGRESS\"}\n{\"error\":\"PRIVATE-ERROR\"}\n",
+                    )
+                    .await;
+            }
+        );
+        assert!(matches!(result, Err(DockerError::PullFailed)));
+        wire.shutdown().await.unwrap();
+        daemon.close().await;
+    }
+    .with_subscriber(subscriber)
+    .await;
+    let output = String::from_utf8(capture.0.lock().unwrap().clone()).unwrap();
+    assert!(output.contains("pull_application_event"));
+    for secret in [
+        "private-registry.example",
+        "private-source",
+        "PRIVATE-USERNAME",
+        "PRIVATE-PASSWORD",
+        "PRIVATE-PROGRESS",
+        "PRIVATE-ERROR",
+        "X-Registry-Auth",
+        "x-registry-auth",
+    ] {
+        assert!(!output.contains(secret));
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery.rs b/crates/rustack-lambda-core/src/docker/recovery.rs
new file mode 100644
index 00000000..da939578
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery.rs
@@ -0,0 +1,146 @@
+//! Resumable historical container cleanup; unknown absence is never settlement.
+
+use http::StatusCode;
+use tokio::time::Instant;
+
+pub use self::{
+    code::CodeRecovery,
+    images::{ImagePinRecovery, reconcile_image_pins},
+    namespace::{NamespaceRecovery, reconcile_namespace},
+};
+use super::{
+    DirectoryLease, DockerError, DockerPort, EnvironmentError, check_deadline,
+    ownership::ContainerRecord,
+};
+
+pub(super) mod code;
+mod images;
+pub(super) mod inventory;
+mod namespace;
+
+/// Container-only recovery accounting, not a complete backend readiness proof.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct ContainerRecovery {
+    /// Records durably erased during this pass.
+    pub settled: usize,
+    /// Records still retained, including current-run records never touched here.
+    pub remaining: usize,
+}
+
+/// Reconcile previous-run recorded containers using exact identity and ID proofs.
+///
+/// Unknown404 responses retain the record; unresolved functions retain their
+/// relay. Every destructive request follows durable publication of the full ID.
+/// Cancellation or errors preserve records for a subsequent pass. This function
+/// never creates containers and never touches current-run records.
+///
+/// # Errors
+/// Returns invalid/expired budgets, unsafe/corrupt/unavailable ownership storage,
+/// daemon transport/protocol failures or foreign resource identity. No error
+/// grants readiness, and previous successfully settled records remain settled.
+/// Requires a port from `DockerPort::bind_directory` for this exact lease.
+///
+/// ```no_run
+/// # async fn recover(directory: &rustack_lambda_core::docker::DirectoryLease, docker: &rustack_lambda_core::docker::DockerPort) -> Result<(), rustack_lambda_core::docker::EnvironmentError> {
+/// let report = rustack_lambda_core::docker::reconcile_containers(directory, docker,
+///     tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await?;
+/// assert_eq!(report.remaining, 0);
+/// // Image aliases and the other startup proofs still require qualification.
+/// # Ok(()) }
+/// ```
+pub async fn reconcile_containers(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<ContainerRecovery, EnvironmentError> {
+    docker.require_directory(directory)?;
+    check_deadline(deadline)?;
+    let mut records = directory.container_records(deadline).await?;
+    records.sort_by_key(|record| (!record.function(), record.environment));
+    let mut report = ContainerRecovery {
+        settled: 0,
+        remaining: records.len(),
+    };
+    let mut blocked = Vec::new();
+    for record in records {
+        check_deadline(deadline)?;
+        if record.run == directory.run_id() {
+            continue;
+        }
+        if !record.function() && blocked.contains(&record.environment) {
+            continue;
+        }
+        if Box::pin(recover(directory, docker, record.clone(), deadline)).await? {
+            report.settled += 1;
+            report.remaining -= 1;
+        } else if record.function() {
+            blocked.push(record.environment);
+        }
+    }
+    check_deadline(deadline)?;
+    Ok(report)
+}
+
+async fn recover(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    mut record: ContainerRecord,
+    deadline: Instant,
+) -> Result<bool, EnvironmentError> {
+    let key = record.known_key()?.unwrap_or(record.key()?);
+    let inspected = match docker.inspect_container(&key, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) if record.known.is_some() => {
+            directory.settle_container(record, deadline).await?;
+            return Ok(true);
+        }
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => return Ok(false),
+        result => result?,
+    };
+    let id = record.owned(directory.owner_id(), &inspected)?;
+    directory
+        .know_container(record.clone(), id.clone(), deadline)
+        .await?;
+    // Re-read the durable identity so subsequent mutation never relies on an
+    // unpersisted local success or a name which can be reused.
+    record = directory
+        .container_records(deadline)
+        .await?
+        .into_iter()
+        .find(|saved| {
+            saved.environment == record.environment && saved.function() == record.function()
+        })
+        .ok_or(DockerError::Quarantined)?;
+    let current = match docker.inspect_container(&id, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            directory.settle_container(record, deadline).await?;
+            return Ok(true);
+        }
+        result => result?,
+    };
+    record.owned(directory.owner_id(), &current)?;
+    match current.state.and_then(|state| state.running) {
+        Some(true) => {
+            let _ = docker.kill_container(&id, deadline).await;
+            let exit = docker.wait_container(&id, deadline).await?;
+            if exit.error.is_some() {
+                return Err(DockerError::Quarantined.into());
+            }
+        }
+        Some(false) => {}
+        None => return Err(DockerError::Protocol.into()),
+    }
+    check_deadline(deadline)?;
+    let _ = docker.remove_container(&id, deadline).await;
+    match docker.inspect_container(&id, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            directory.settle_container(record, deadline).await?;
+            Ok(true)
+        }
+        Ok(_) => Ok(false),
+        Err(error) => Err(error.into()),
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/recovery/code.rs b/crates/rustack-lambda-core/src/docker/recovery/code.rs
new file mode 100644
index 00000000..2c822968
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/code.rs
@@ -0,0 +1,224 @@
+//! Historical loader-before-volume retirement; unknown absence retains pins.
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use tokio::time::Instant;
+
+use crate::docker::{
+    DirectoryLease, DockerError, DockerPort, Operation, check_deadline, escaped,
+    ownership::codes::{CodeRecord, LoaderState, VolumeState},
+    unit,
+};
+
+/// Durable code-record accounting; neither resource counts nor readiness.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct CodeRecovery {
+    /// Records durably erased by this pass after both effects retired.
+    pub settled: usize,
+    /// Records still retained, including unresolved issued effects.
+    pub remaining: usize,
+}
+
+pub(super) async fn reconcile_code(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<CodeRecovery, DockerError> {
+    docker.require_directory(directory)?;
+    // Namespace recovery calls us only after recorded consumers have joined.
+    if !directory.container_records(deadline).await?.is_empty() {
+        return Err(DockerError::Quarantined);
+    }
+    let records = directory.code_records(deadline).await?;
+    if records
+        .iter()
+        .any(|record| record.run == directory.run_id())
+    {
+        return Err(DockerError::Quarantined);
+    }
+    let mut report = CodeRecovery {
+        settled: 0,
+        remaining: records.len(),
+    };
+    for record in records {
+        check_deadline(deadline)?;
+        if recover(directory, docker, record, deadline).await? {
+            report.settled = report.settled.checked_add(1).ok_or(DockerError::Protocol)?;
+            report.remaining = report
+                .remaining
+                .checked_sub(1)
+                .ok_or(DockerError::Protocol)?;
+        }
+    }
+    check_deadline(deadline)?;
+    Ok(report)
+}
+async fn save(
+    directory: &DirectoryLease,
+    record: &mut CodeRecord,
+    next: CodeRecord,
+    deadline: Instant,
+) -> Result<(), DockerError> {
+    directory
+        .advance_code(record.clone(), next.clone(), deadline)
+        .await?;
+    *record = next;
+    Ok(())
+}
+async fn recover(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    mut record: CodeRecord,
+    deadline: Instant,
+) -> Result<bool, DockerError> {
+    if retire_effects(directory, docker, &mut record, deadline).await? {
+        directory.settle_code(record, deadline).await?;
+        Ok(true)
+    } else {
+        Ok(false)
+    }
+}
+pub(in crate::docker) async fn retire_effects(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    record: &mut CodeRecord,
+    deadline: Instant,
+) -> Result<bool, DockerError> {
+    if record.volume == VolumeState::Planned {
+        let mut next = record.clone();
+        next.volume = VolumeState::Retired;
+        next.loader = LoaderState::Retired;
+        save(directory, record, next, deadline).await?;
+    }
+    if record.volume == VolumeState::Uncertain {
+        let inspected = match docker.inspect_volume(&record.volume_key()?, deadline).await {
+            Err(DockerError::Status(StatusCode::NOT_FOUND)) => return Ok(false),
+            result => result?,
+        };
+        record.owned_volume(directory.owner_id(), &inspected)?;
+        let mut next = record.clone();
+        next.volume = VolumeState::Known;
+        save(directory, record, next, deadline).await?;
+    }
+    if !Box::pin(retire_loader(directory, docker, record, deadline)).await? {
+        return Ok(false);
+    }
+    if !retire_volume(directory, docker, record, deadline).await? {
+        return Ok(false);
+    }
+    Ok(true)
+}
+pub(in crate::docker) async fn retire_loader(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    record: &mut CodeRecord,
+    deadline: Instant,
+) -> Result<bool, DockerError> {
+    match record.loader {
+        LoaderState::Retired => return Ok(true),
+        LoaderState::Planned => return loader_retired(directory, record, deadline).await,
+        LoaderState::Uncertain | LoaderState::Known(_) => {}
+    }
+    let inspected = match docker
+        .inspect_container(&record.loader_key()?, deadline)
+        .await
+    {
+        Err(DockerError::Status(StatusCode::NOT_FOUND))
+            if matches!(record.loader, LoaderState::Known(_)) =>
+        {
+            return loader_retired(directory, record, deadline).await;
+        }
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => return Ok(false),
+        result => result?,
+    };
+    let id = record.owned_loader(directory.owner_id(), &inspected)?;
+    if record.loader == LoaderState::Uncertain {
+        let mut next = record.clone();
+        next.loader = LoaderState::Known(id);
+        save(directory, record, next, deadline).await?;
+    }
+    let key = record.loader_key()?;
+    let checked = match docker.inspect_container(&key, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            return loader_retired(directory, record, deadline).await;
+        }
+        result => result?,
+    };
+    record.owned_loader(directory.owner_id(), &checked)?;
+    let _ = async {
+        unit(
+            docker
+                .call(
+                    Operation::Remove,
+                    Method::DELETE,
+                    format!("/containers/{}?force=false", escaped(key.as_str())),
+                    Bytes::new(),
+                    StatusCode::NO_CONTENT,
+                    deadline,
+                )
+                .await?,
+            deadline,
+        )
+    }
+    .await;
+    match docker.inspect_container(&key, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            loader_retired(directory, record, deadline).await
+        }
+        Ok(_) => Ok(false),
+        Err(error) => Err(error),
+    }
+}
+async fn loader_retired(
+    directory: &DirectoryLease,
+    record: &mut CodeRecord,
+    deadline: Instant,
+) -> Result<bool, DockerError> {
+    let mut next = record.clone();
+    next.loader = LoaderState::Retired;
+    save(directory, record, next, deadline).await?;
+    Ok(true)
+}
+async fn retire_volume(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    record: &mut CodeRecord,
+    deadline: Instant,
+) -> Result<bool, DockerError> {
+    if record.volume == VolumeState::Retired {
+        return Ok(true);
+    }
+    if record.volume != VolumeState::Known || record.loader != LoaderState::Retired {
+        return Err(DockerError::Quarantined);
+    }
+    let key = record.volume_key()?;
+    let inspected = match docker.inspect_volume(&key, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            return volume_retired(directory, record, deadline).await;
+        }
+        result => result?,
+    };
+    record.owned_volume(directory.owner_id(), &inspected)?;
+    let _ = docker.remove_volume(&key, deadline).await;
+    match docker.inspect_volume(&key, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            volume_retired(directory, record, deadline).await
+        }
+        Ok(_) => Ok(false),
+        Err(error) => Err(error),
+    }
+}
+async fn volume_retired(
+    directory: &DirectoryLease,
+    record: &mut CodeRecord,
+    deadline: Instant,
+) -> Result<bool, DockerError> {
+    let mut next = record.clone();
+    next.volume = VolumeState::Retired;
+    save(directory, record, next, deadline).await?;
+    Ok(true)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/recovery/code/tests.rs b/crates/rustack-lambda-core/src/docker/recovery/code/tests.rs
new file mode 100644
index 00000000..81e11024
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/code/tests.rs
@@ -0,0 +1,580 @@
+use std::time::Duration;
+
+use rstest::rstest;
+use serde_json::{Value, json, to_vec};
+use tempfile::TempDir;
+use tokio::{
+    spawn,
+    time::{Instant, timeout},
+};
+
+use super::*;
+use crate::docker::{
+    DockerWire, EnvironmentError, ImagePinScope,
+    ownership::{
+        ImageRecord,
+        codes::tests::{publish, record},
+    },
+    reconcile_namespace,
+    tests::{Daemon, IncomingRequest},
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+async fn fixture(
+    volume: VolumeState,
+    loader: LoaderState,
+) -> (TempDir, DirectoryLease, CodeRecord) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let row = record(directory.run_id(), volume, loader);
+    publish(&directory, vec![row.clone()]).await;
+    drop(directory);
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    (root, directory, row)
+}
+async fn wire(directory: &DirectoryLease) -> (Daemon, DockerWire, DockerPort) {
+    let daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(directory, deadline())
+        .await
+        .unwrap();
+    (daemon, wire, port)
+}
+fn volume_json(directory: &DirectoryLease, row: &CodeRecord) -> Value {
+    json!({"Name":row.volume_key().unwrap().as_str(),"Driver":"local","Scope":"local","Mountpoint":"/unused","Labels":row.labels(directory.owner_id(),false),"Options":{}})
+}
+fn loader_json(directory: &DirectoryLease, row: &CodeRecord) -> Value {
+    json!({"Id":"cc".repeat(32),"Name":format!("/rustack-code-loader-{}",row.environment),"Image":format!("sha256:{}","aa".repeat(32)),"Config":{"Image":format!("sha256:{}","aa".repeat(32)),"Labels":row.labels(directory.owner_id(),true)},"State":{"Status":"created","Running":false,"StartedAt":"0001-01-01T00:00:00Z"},"Mounts":[{"Type":"volume","Name":row.volume_key().unwrap().as_str(),"Destination":"/var/task","RW":true,"Driver":"local"}]})
+}
+async fn reply_json(request: IncomingRequest, value: &Value) {
+    request.reply(200, &to_vec(value).unwrap()).await;
+}
+async fn no_more(daemon: &mut Daemon) {
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+}
+async fn audit(daemon: &mut Daemon, directory: &DirectoryLease) {
+    let request = daemon.next().await;
+    assert!(request.head.contains("/containers/json?all=true"));
+    request.reply(200, b"[]").await;
+    let request = daemon.next().await;
+    volume_query(&request, directory);
+    request.reply(200, br#"{"Volumes":[],"Warnings":[]}"#).await;
+}
+fn volume_query(request: &IncomingRequest, directory: &DirectoryLease) {
+    let target = request
+        .head
+        .lines()
+        .next()
+        .unwrap()
+        .split_whitespace()
+        .nth(1)
+        .unwrap();
+    let (path, query) = target.split_once('?').unwrap();
+    assert_eq!(path, "/v1.53/volumes");
+    let pairs = form_urlencoded::parse(query.as_bytes())
+        .into_owned()
+        .collect::<Vec<_>>();
+    assert_eq!(pairs.len(), 1);
+    assert_eq!(pairs[0].0, "filters");
+    assert_eq!(
+        serde_json::from_str::<Value>(&pairs[0].1).unwrap(),
+        json!({"label":[format!("rustack.lambda.ownerId={}",directory.owner_id())]})
+    );
+}
+
+#[rstest]
+#[case(VolumeState::Planned, LoaderState::Planned)]
+#[case(VolumeState::Retired, LoaderState::Retired)]
+#[tokio::test]
+async fn test_should_erase_no_effect_or_retired_records_without_docker_requests(
+    #[case] volume: VolumeState,
+    #[case] loader: LoaderState,
+) {
+    let (_root, directory, _) = fixture(volume, loader).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let report = reconcile_code(&directory, &port, deadline()).await.unwrap();
+    assert_eq!(
+        report,
+        CodeRecovery {
+            settled: 1,
+            remaining: 0
+        }
+    );
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest]
+#[case(VolumeState::Uncertain, LoaderState::Planned)]
+#[case(VolumeState::Known, LoaderState::Uncertain)]
+#[tokio::test]
+async fn test_should_retain_unknown_absence_without_volume_or_pin_deletion(
+    #[case] volume: VolumeState,
+    #[case] loader: LoaderState,
+) {
+    let (_root, directory, row) = fixture(volume, loader).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(
+        report.unwrap(),
+        CodeRecovery {
+            settled: 0,
+            remaining: 1
+        }
+    );
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), [row]);
+    assert!(matches!(
+        super::super::images::reconcile_image_pins(&directory, &port, deadline()).await,
+        Err(DockerError::Quarantined)
+    ));
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_erase_known_absent_loader_before_known_absent_volume() {
+    let (_root, directory, _) = fixture(VolumeState::Known, LoaderState::Known([0xcc; 32])).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        let request = daemon.next().await;
+        assert!(request.head.contains(&"cc".repeat(32)));
+        request.reply(404, b"{}").await;
+        let request = daemon.next().await;
+        assert!(request.head.contains("/volumes/rustack%2Dcode%2D"));
+        assert_eq!(
+            directory.code_records(deadline()).await.unwrap()[0].loader,
+            LoaderState::Retired
+        );
+        request.reply(404, b"{}").await;
+    });
+    assert_eq!(
+        report.unwrap(),
+        CodeRecovery {
+            settled: 1,
+            remaining: 0
+        }
+    );
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_publish_observed_id_before_delete_and_retire_loader_before_volume() {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Uncertain).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let loader = loader_json(&directory, &row);
+    let volume = volume_json(&directory, &row);
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        let request = daemon.next().await;
+        assert!(
+            request
+                .head
+                .contains("/containers/rustack%2Dcode%2Dloader%2D")
+        );
+        reply_json(request, &loader).await;
+        let request = daemon.next().await;
+        assert!(request.head.contains(&"cc".repeat(32)));
+        assert_eq!(
+            directory.code_records(deadline()).await.unwrap()[0].loader,
+            LoaderState::Known([0xcc; 32])
+        );
+        reply_json(request, &loader).await;
+        let request = daemon.next().await;
+        assert!(request.head.starts_with("DELETE "));
+        assert!(request.head.contains("force=false"));
+        assert!(request.head.contains(&"cc".repeat(32)));
+        request.reply(204, b"").await;
+        daemon.next().await.reply(404, b"{}").await;
+        let request = daemon.next().await;
+        assert!(request.head.contains("/volumes/rustack%2Dcode%2D"));
+        assert_eq!(
+            directory.code_records(deadline()).await.unwrap()[0].loader,
+            LoaderState::Retired
+        );
+        reply_json(request, &volume).await;
+        let request = daemon.next().await;
+        assert!(request.head.starts_with("DELETE "));
+        assert!(request.head.contains("force=false"));
+        assert!(request.head.contains("force=false"));
+        request.reply(204, b"").await;
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(
+        report.unwrap(),
+        CodeRecovery {
+            settled: 1,
+            remaining: 0
+        }
+    );
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_commit_uncertain_volume_before_retiring_planned_loader_and_deleting_volume() {
+    let (_root, directory, row) = fixture(VolumeState::Uncertain, LoaderState::Planned).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let volume = volume_json(&directory, &row);
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        reply_json(daemon.next().await, &volume).await;
+        let request = daemon.next().await;
+        let saved = directory.code_records(deadline()).await.unwrap();
+        assert_eq!(saved[0].volume, VolumeState::Known);
+        assert_eq!(saved[0].loader, LoaderState::Retired);
+        reply_json(request, &volume).await;
+        daemon.next().await.reply(204, b"").await;
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(report.unwrap().remaining, 0);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest]
+#[case("running")]
+#[case("started")]
+#[case("image")]
+#[case("configImage")]
+#[case("name")]
+#[case("id")]
+#[case("knownId")]
+#[case("labels")]
+#[case("mountName")]
+#[case("mountMode")]
+#[case("mountType")]
+#[case("mountDriver")]
+#[case("extraMount")]
+#[case("destination")]
+#[tokio::test]
+async fn test_should_quarantine_conflicting_or_executed_loader_without_delete(
+    #[case] conflict: &str,
+) {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Known([0xcc; 32])).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let mut loader = loader_json(&directory, &row);
+    match conflict {
+        "running" => {
+            loader["State"]["Status"] = json!("running");
+            loader["State"]["Running"] = json!(true);
+        }
+        "started" => loader["State"]["StartedAt"] = json!("2026-01-01T00:00:00Z"),
+        "image" => loader["Image"] = json!(format!("sha256:{}", "dd".repeat(32))),
+        "configImage" => loader["Config"]["Image"] = json!("operator:mutable"),
+        "name" => loader["Name"] = json!("/foreign"),
+        "id" => loader["Id"] = json!("CC".repeat(32)),
+        "knownId" => loader["Id"] = json!("dd".repeat(32)),
+        "labels" => loader["Config"]["Labels"]["rustack.lambda.unexpected"] = json!("foreign"),
+        "mountName" => loader["Mounts"][0]["Name"] = json!("foreign"),
+        "mountMode" => loader["Mounts"][0]["RW"] = json!(false),
+        "mountType" => loader["Mounts"][0]["Type"] = json!("bind"),
+        "mountDriver" => loader["Mounts"][0]["Driver"] = json!("foreign"),
+        "extraMount" => loader["Mounts"]
+            .as_array_mut()
+            .unwrap()
+            .push(json!({"Type":"bind"})),
+        _ => loader["Mounts"][0]["Destination"] = json!("/wrong"),
+    }
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        reply_json(daemon.next().await, &loader).await;
+    });
+    assert!(matches!(report, Err(DockerError::Quarantined)));
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), [row]);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest]
+#[case("driver")]
+#[case("scope")]
+#[case("options")]
+#[case("labels")]
+#[tokio::test]
+async fn test_should_quarantine_foreign_volume_without_delete(#[case] conflict: &str) {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Retired).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let mut volume = volume_json(&directory, &row);
+    match conflict {
+        "driver" => volume["Driver"] = json!("foreign"),
+        "scope" => volume["Scope"] = json!("global"),
+        "options" => volume["Options"] = json!({"device":"/host"}),
+        _ => volume["Labels"]["unexpected"] = json!("foreign"),
+    }
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        reply_json(daemon.next().await, &volume).await;
+    });
+    assert!(matches!(report, Err(DockerError::Quarantined)));
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), [row]);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_retain_attached_volume_after_conflicting_delete_until_positive_absence() {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Retired).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let volume = volume_json(&directory, &row);
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        reply_json(daemon.next().await, &volume).await;
+        daemon.next().await.reply(409, b"{}").await;
+        reply_json(daemon.next().await, &volume).await;
+    });
+    assert_eq!(report.unwrap().remaining, 1);
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), [row]);
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(report.unwrap().remaining, 0);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_keep_durable_known_id_after_observer_loss_and_resume_exact_cleanup() {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Uncertain).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let loader = loader_json(&directory, &row);
+    let copy = directory.clone();
+    let call = port.clone();
+    let task = spawn(async move { reconcile_code(&copy, &call, deadline()).await });
+    reply_json(daemon.next().await, &loader).await;
+    let held = daemon.next().await;
+    assert_eq!(
+        directory.code_records(deadline()).await.unwrap()[0].loader,
+        LoaderState::Known([0xcc; 32])
+    );
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    held.reply(404, b"{}").await;
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        let request = daemon.next().await;
+        assert!(request.head.contains(&"cc".repeat(32)));
+        request.reply(404, b"{}").await;
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(report.unwrap().remaining, 0);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_refuse_identity_fence_404_without_settling_resource() {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Retired).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    daemon.identity_status.send_replace(404);
+    assert!(matches!(
+        reconcile_code(&directory, &port, deadline()).await,
+        Err(DockerError::IdentityCheck(_))
+    ));
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), [row]);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_block_namespace_and_pin_retirement_while_code_is_uncertain() {
+    let (_root, directory, _) = fixture(VolumeState::Known, LoaderState::Uncertain).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    let report = report.unwrap();
+    assert_eq!(report.code.remaining, 1);
+    assert_eq!(report.pins.settled, 0);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_recover_code_before_pin_and_complete_untruncated_volume_audits() {
+    let root = tempfile::tempdir().unwrap();
+    let previous = DirectoryLease::acquire_code(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&previous).await;
+    publish(
+        &previous,
+        vec![record(
+            previous.run_id(),
+            VolumeState::Known,
+            LoaderState::Retired,
+        )],
+    )
+    .await;
+    let pin = ImagePinScope::new(previous.clone()).allocate().unwrap();
+    let entry = ImageRecord::new(
+        &pin,
+        &format!("sha256:{}", "aa".repeat(32)).parse().unwrap(),
+    )
+    .unwrap();
+    previous
+        .prepare_image(entry.clone(), deadline())
+        .await
+        .unwrap();
+    previous.commit_image(entry, deadline()).await.unwrap();
+    drop(pin);
+    drop(previous);
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        let request = daemon.next().await;
+        assert!(request.head.contains("/volumes/rustack%2Dcode%2D"));
+        request.reply(404, b"{}").await;
+        audit(&mut daemon, &directory).await;
+        assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+        let request = daemon.next().await;
+        assert!(request.head.contains("/images/"));
+        request.reply(404, b"{}").await;
+        let request = daemon.next().await;
+        assert!(request.head.contains("/images/json?all=true"));
+        request.reply(200, b"[]").await;
+        audit(&mut daemon, &directory).await;
+    });
+    let report = report.unwrap();
+    assert_eq!(report.code.settled, 1);
+    assert_eq!(report.pins.settled, 1);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_refuse_orphan_volume_without_adoption_or_pin_deletion(#[case] late: bool) {
+    let (_root, directory, row) = fixture(VolumeState::Retired, LoaderState::Retired).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let volume = volume_json(&directory, &row);
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        if late {
+            audit(&mut daemon, &directory).await;
+            daemon.next().await.reply(200, b"[]").await;
+        }
+        daemon.next().await.reply(200, b"[]").await;
+        let request = daemon.next().await;
+        volume_query(&request, &directory);
+        reply_json(request, &json!({"Volumes":[volume],"Warnings":[]})).await;
+    });
+    assert!(matches!(
+        report,
+        Err(EnvironmentError::Docker(DockerError::Quarantined))
+    ));
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_reject_current_run_code_before_any_namespace_request() {
+    let (_root, directory, _) = fixture(VolumeState::Retired, LoaderState::Retired).await;
+    publish(
+        &directory,
+        vec![record(
+            directory.run_id(),
+            VolumeState::Known,
+            LoaderState::Retired,
+        )],
+    )
+    .await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    assert!(matches!(
+        reconcile_namespace(&directory, &port, deadline()).await,
+        Err(EnvironmentError::Docker(DockerError::Quarantined))
+    ));
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+mod real;
+
+#[tokio::test]
+async fn test_should_use_nonforce_loader_delete_and_retain_started_race_without_kill() {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Known([0xcc; 32])).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let loader = loader_json(&directory, &row);
+    let mut running = loader.clone();
+    running["State"]["Status"] = json!("running");
+    running["State"]["Running"] = json!(true);
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        reply_json(daemon.next().await, &loader).await;
+        reply_json(daemon.next().await, &loader).await;
+        let request = daemon.next().await;
+        assert!(request.head.starts_with(&format!(
+            "DELETE /v1.53/containers/{}?force=false HTTP/",
+            "cc".repeat(32)
+        )));
+        request.reply(409, b"{}").await;
+        reply_json(daemon.next().await, &running).await;
+    });
+    assert_eq!(report.unwrap().remaining, 1);
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), [row]);
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        reply_json(daemon.next().await, &running).await;
+    });
+    assert!(matches!(report, Err(DockerError::Quarantined)));
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_recheck_loader_identity_after_durable_publication_before_delete() {
+    let (_root, directory, row) = fixture(VolumeState::Known, LoaderState::Uncertain).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let loader = loader_json(&directory, &row);
+    let mut foreign = loader.clone();
+    foreign["Id"] = json!("dd".repeat(32));
+    let (report, ()) = tokio::join!(reconcile_code(&directory, &port, deadline()), async {
+        reply_json(daemon.next().await, &loader).await;
+        let request = daemon.next().await;
+        assert_eq!(
+            directory.code_records(deadline()).await.unwrap()[0].loader,
+            LoaderState::Known([0xcc; 32])
+        );
+        reply_json(request, &foreign).await;
+    });
+    assert!(matches!(report, Err(DockerError::Quarantined)));
+    assert_eq!(
+        directory.code_records(deadline()).await.unwrap()[0].loader,
+        LoaderState::Known([0xcc; 32])
+    );
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[test]
+fn test_should_allow_bounded_inherited_labels_but_reject_unknown_reserved_or_oversized_labels() {
+    let row = record(
+        uuid::Uuid::new_v4(),
+        VolumeState::Known,
+        LoaderState::Known([0xcc; 32]),
+    );
+    let directory = DirectoryLease::testing(uuid::Uuid::new_v4(), uuid::Uuid::new_v4());
+    let mut loader = loader_json(&directory, &row);
+    loader["Config"]["Labels"]["com.amazonaws.lambda.platform.kernel"] = json!("k510ga");
+    let parsed = serde_json::from_value(loader.clone()).unwrap();
+    assert!(row.owned_loader(directory.owner_id(), &parsed).is_ok());
+    loader["Config"]["Labels"]["com.amazonaws.lambda.platform.kernel"] = json!("x".repeat(257));
+    let parsed = serde_json::from_value(loader).unwrap();
+    assert!(matches!(
+        row.owned_loader(directory.owner_id(), &parsed),
+        Err(DockerError::Quarantined)
+    ));
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/code/tests/real.rs b/crates/rustack-lambda-core/src/docker/recovery/code/tests/real.rs
new file mode 100644
index 00000000..98495fe3
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/code/tests/real.rs
@@ -0,0 +1,209 @@
+use std::{env, path::Path, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use crate::{
+    artifact::{Architecture, ImageReference, ResolvedImage, Sha256Digest},
+    docker::{
+        DirectoryLease, DockerWire, ImagePinScope, ImageResolver,
+        models::{ContainerCreateBody, HostConfig, Mount, MountType, MountVolumeOptions},
+        ownership::{
+            ImageRecord,
+            codes::{CodeRecord, LoaderState, VolumeState, tests::publish},
+        },
+        reconcile_namespace,
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+fn code_record(run: Uuid, image: &ResolvedImage) -> Result<CodeRecord> {
+    let mut base = [0; 32];
+    let mut fingerprint = [0; 32];
+    hex::decode_to_slice(
+        image
+            .metadata()
+            .image_id
+            .as_str()
+            .strip_prefix("sha256:")
+            .context("base digest")?,
+        &mut base,
+    )?;
+    hex::decode_to_slice(
+        image
+            .metadata()
+            .inspection_hash
+            .as_str()
+            .strip_prefix("sha256:")
+            .context("inspection digest")?,
+        &mut fingerprint,
+    )?;
+    Ok(CodeRecord::builder()
+        .run(run)
+        .environment(Uuid::new_v4())
+        .resource(Uuid::new_v4())
+        .revision(Uuid::new_v4())
+        .zip([0x11; 32])
+        .base(base)
+        .fingerprint(fingerprint)
+        .volume(VolumeState::Uncertain)
+        .loader(LoaderState::Planned)
+        .build())
+}
+fn loader_body(
+    row: &CodeRecord,
+    directory: &DirectoryLease,
+    parent: &Sha256Digest,
+) -> Result<ContainerCreateBody> {
+    Ok(ContainerCreateBody {
+        image: Some(parent.as_str().into()),
+        user: Some("65534:65534".into()),
+        entrypoint: Some(vec!["/never-start-this-loader".into()]),
+        cmd: Some(Vec::new()),
+        working_dir: Some("/var/task".into()),
+        labels: Some(row.labels(directory.owner_id(), true).into_iter().collect()),
+        host_config: Some(HostConfig {
+            network_mode: Some("none".into()),
+            readonly_rootfs: Some(true),
+            memory: Some(128 * 1024 * 1024),
+            pids_limit: Some(64),
+            cap_drop: Some(vec!["ALL".into()]),
+            security_opt: Some(vec!["no-new-privileges:true".into()]),
+            mounts: Some(vec![Mount {
+                typ: Some(MountType::VOLUME),
+                source: Some(row.volume_key()?.as_str().into()),
+                target: Some("/var/task".into()),
+                read_only: Some(false),
+                volume_options: Some(MountVolumeOptions {
+                    no_copy: Some(true),
+                    ..MountVolumeOptions::default()
+                }),
+                ..Mount::default()
+            }]),
+            ..HostConfig::default()
+        }),
+        ..ContainerCreateBody::default()
+    })
+}
+async fn exercise(
+    wire: &DockerWire,
+    root: &Path,
+    architecture: Architecture,
+    source: &ImageReference,
+) -> Result<()> {
+    let directory = DirectoryLease::acquire_code(root.into(), deadline()).await?;
+    let port = wire.port().bind_directory(&directory, deadline()).await?;
+    let resolved = ImageResolver::new(port.clone())
+        .resolve_local(source, architecture, None, deadline())
+        .await?;
+    let parent = resolved.metadata().image_id.clone();
+    let pin = ImagePinScope::new(directory.clone()).allocate()?;
+    let image_record = ImageRecord::new(&pin, &parent)?;
+    directory
+        .prepare_image(image_record.clone(), deadline())
+        .await?;
+    port.tag_image_pin(&parent, &pin, deadline()).await?;
+    directory.commit_image(image_record, deadline()).await?;
+    let mut row = code_record(directory.run_id(), &resolved)?;
+    publish(&directory, vec![row.clone()]).await;
+    let volume_key = row.volume_key()?;
+    let volume = port
+        .create_volume(
+            &volume_key,
+            &row.labels(directory.owner_id(), false),
+            deadline(),
+        )
+        .await?;
+    row.owned_volume(directory.owner_id(), &volume)?;
+    row.volume = VolumeState::Known;
+    row.loader = LoaderState::Uncertain;
+    publish(&directory, vec![row.clone()]).await;
+    let loader_key = row.loader_key()?;
+    let body = loader_body(&row, &directory, &parent)?;
+    let created = port
+        .create_container(&loader_key, &body, deadline())
+        .await?;
+    let inspected = port
+        .inspect_container(&created.id.parse()?, deadline())
+        .await?;
+    let id = row.owned_loader(directory.owner_id(), &inspected)?;
+    row.loader = LoaderState::Known(id);
+    publish(&directory, vec![row.clone()]).await;
+    let old_run = directory.run_id();
+    let owner = directory.owner_id();
+    drop(port);
+    drop(pin);
+    drop(directory);
+    let directory = DirectoryLease::acquire(root.into(), deadline()).await?;
+    ensure!(
+        directory.owner_id() == owner && directory.run_id() != old_run,
+        "immutable owner/fresh run"
+    );
+    let port = wire.port().bind_directory(&directory, deadline()).await?;
+    let report = reconcile_namespace(&directory, &port, deadline()).await?;
+    ensure!(
+        report.code.settled == 1
+            && report.code.remaining == 0
+            && report.pins.settled == 1
+            && report.pins.remaining == 0
+            && report.containers.remaining == 0,
+        "recorded code/pin retirement"
+    );
+    ensure!(
+        directory.code_records(deadline()).await?.is_empty(),
+        "code journal remains"
+    );
+    ensure!(
+        port.inspect_image(source, deadline()).await?.id.as_deref() == Some(parent.as_str()),
+        "source image changed"
+    );
+    let repeated = reconcile_namespace(&directory, &port, deadline()).await?;
+    ensure!(
+        repeated.code.settled == 0 && repeated.code.remaining == 0,
+        "recovery not idempotent"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker socket and selected local runtime image"]
+async fn test_should_recover_real_code_volume_and_unstarted_loader_across_reacquisition()
+-> Result<()> {
+    let socket = env::var("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit Docker socket")?;
+    let architecture = match env::var("RUSTACK_RUNTIME_ARCH")?.as_str() {
+        "arm64" => Architecture::Arm64,
+        "amd64" => Architecture::X86_64,
+        _ => anyhow::bail!("unknown architecture"),
+    };
+    let source = env::var("RUSTACK_RUNTIME_IMAGE")?.parse()?;
+    let mut root = tempfile::tempdir()?;
+    root.disable_cleanup(true);
+    eprintln!(
+        "retained code namespace recovery evidence: {}",
+        root.path().display()
+    );
+    let mut wire = DockerWire::connect(format!("unix://{socket}").parse()?, deadline()).await?;
+    let result = async {
+        if let Some(previous) = env::var_os("RUSTACK_CODE_RECOVERY_RESUME") {
+            let directory = DirectoryLease::acquire(previous.into(), deadline()).await?;
+            let port = wire.port().bind_directory(&directory, deadline()).await?;
+            let report = reconcile_namespace(&directory, &port, deadline()).await?;
+            ensure!(
+                report.code.remaining == 0
+                    && report.containers.remaining == 0
+                    && report.pins.remaining == 0,
+                "retained evidence still unresolved"
+            );
+        }
+        exercise(&wire, root.path(), architecture, &source).await
+    }
+    .await;
+    let joined = wire.shutdown().await;
+    result?;
+    joined?;
+    root.disable_cleanup(false);
+    Ok(())
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/images.rs b/crates/rustack-lambda-core/src/docker/recovery/images.rs
new file mode 100644
index 00000000..ef1bbd55
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/images.rs
@@ -0,0 +1,119 @@
+//! Historical alias cleanup only after container ownership has settled.
+
+use http::StatusCode;
+use tokio::time::Instant;
+
+use super::super::{
+    DirectoryLease, DockerError, DockerPort, check_deadline, ownership::ImageRecord,
+};
+
+/// Pin-only recovery accounting, not full backend readiness.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct ImagePinRecovery {
+    /// Records durably erased during this pass.
+    pub settled: usize,
+    /// Records still retained, including current-run pins never touched here.
+    pub remaining: usize,
+}
+
+/// Retire recorded historical private aliases after historical containers settle.
+///
+/// Never replay tag, delete source tags or infer unknown absence as settlement.
+/// A positive matching alias is durably committed before removal; an absent
+/// committed alias can be erased. Cancellation preserves resumable ownership.
+///
+/// # Errors
+/// Returns ownership/budget/wire failures, Quarantined for remaining historical
+/// containers or mismatching alias identity, and protocol failures. This does
+/// not grant readiness or release another owner's live allocations. Requires a
+/// port from `DockerPort::bind_directory` for this exact lease; each connection
+/// verifies its persisted installation identity before the actual operation.
+///
+/// ```no_run
+/// # async fn recover(directory: &rustack_lambda_core::docker::DirectoryLease, docker: &rustack_lambda_core::docker::DockerPort) -> Result<(), rustack_lambda_core::docker::DockerError> {
+/// let report = rustack_lambda_core::docker::reconcile_image_pins(directory, docker,
+///     tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await?;
+/// assert_eq!(report.remaining, 0);
+/// # Ok(()) }
+/// ```
+pub async fn reconcile_image_pins(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<ImagePinRecovery, DockerError> {
+    docker.require_directory(directory)?;
+    if directory
+        .container_records(deadline)
+        .await?
+        .iter()
+        .any(|record| record.run != directory.run_id())
+    {
+        return Err(DockerError::Quarantined);
+    }
+    if !directory.code_records(deadline).await?.is_empty() {
+        return Err(DockerError::Quarantined);
+    }
+    let records = directory.image_records(deadline).await?;
+    let mut report = ImagePinRecovery {
+        settled: 0,
+        remaining: records.len(),
+    };
+    for record in records {
+        if record.run == directory.run_id() {
+            continue;
+        }
+        if recover(directory, docker, record, deadline).await? {
+            report.settled = report.settled.checked_add(1).ok_or(DockerError::Protocol)?;
+            report.remaining = report
+                .remaining
+                .checked_sub(1)
+                .ok_or(DockerError::Protocol)?;
+        }
+    }
+    check_deadline(deadline)?;
+    Ok(report)
+}
+async fn recover(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    record: ImageRecord,
+    deadline: Instant,
+) -> Result<bool, DockerError> {
+    let pin = record.pin(directory)?;
+    let expected = record.expected()?;
+    let inspected = match docker.inspect_image_pin(&pin, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) if record.committed => {
+            directory.settle_image(record, deadline).await?;
+            return Ok(true);
+        }
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => return Ok(false),
+        result => result?,
+    };
+    if inspected.id.as_deref() != Some(expected.as_str()) {
+        return Err(DockerError::Quarantined);
+    }
+    directory.commit_image(record.clone(), deadline).await?;
+    let checked = match docker.inspect_image_pin(&pin, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            directory.settle_image(record, deadline).await?;
+            return Ok(true);
+        }
+        result => result?,
+    };
+    if checked.id.as_deref() != Some(expected.as_str()) {
+        return Err(DockerError::Quarantined);
+    }
+    let _ = docker.remove_image_pin(&pin, deadline).await;
+    match docker.inspect_image_pin(&pin, deadline).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => {
+            directory.settle_image(record, deadline).await?;
+            Ok(true)
+        }
+        Ok(_) => Ok(false),
+        Err(error) => Err(error),
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/recovery/images/tests.rs b/crates/rustack-lambda-core/src/docker/recovery/images/tests.rs
new file mode 100644
index 00000000..39a4627d
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/images/tests.rs
@@ -0,0 +1,403 @@
+use std::{path::Path, sync::Arc, time::Duration};
+
+use anyhow::{Context, Result as TestResult, ensure};
+use http::StatusCode;
+use serde_json::json;
+use tokio::time::{Instant, timeout};
+
+use super::{ImagePinRecovery, reconcile_image_pins};
+use crate::{
+    artifact::Architecture,
+    docker::{
+        DirectoryLease, DockerError, DockerWire, EnvironmentPlan, ImagePin, ImagePinScope,
+        ImageResolver,
+        ownership::{ContainerRecord, ImageRecord},
+        plan::{
+            ContainerRole,
+            tests::{image_with, policy, revision},
+        },
+        tests::Daemon,
+    },
+};
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+async fn fixture(
+    committed: bool,
+    containers: bool,
+) -> (tempfile::TempDir, DirectoryLease, ImageRecord, ImagePin) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+    let record =
+        ImageRecord::new(&pin, &format!("sha256:{}", "a".repeat(64)).parse().unwrap()).unwrap();
+    directory
+        .prepare_image(record.clone(), deadline())
+        .await
+        .unwrap();
+    if committed {
+        directory
+            .commit_image(record.clone(), deadline())
+            .await
+            .unwrap();
+    }
+    if containers {
+        let plan = EnvironmentPlan::new(
+            directory.clone(),
+            image_with("1000", vec![]),
+            Arc::new(revision()),
+            policy(),
+        )
+        .unwrap();
+        directory
+            .prepare_container(
+                ContainerRecord::from_plan(&plan, ContainerRole::Relay).unwrap(),
+                deadline(),
+            )
+            .await
+            .unwrap();
+    }
+    drop(pin);
+    drop(directory);
+    let next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let saved = next.image_records(deadline()).await.unwrap().remove(0);
+    let pin = saved.pin(&next).unwrap();
+    (root, next, saved, pin)
+}
+async fn matching(daemon: &mut Daemon) {
+    daemon
+        .next()
+        .await
+        .reply(
+            200,
+            &serde_json::to_vec(&json!({"Id":format!("sha256:{}","a".repeat(64))})).unwrap(),
+        )
+        .await;
+}
+#[tokio::test]
+async fn test_should_retain_unknown_absence_then_commit_and_remove_exact_historical_alias() {
+    let (_root, directory, record, pin) = fixture(false, false).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let (report, ()) = tokio::join!(reconcile_image_pins(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(
+        report.unwrap(),
+        ImagePinRecovery {
+            settled: 0,
+            remaining: 1
+        }
+    );
+    assert_eq!(
+        directory.image_records(deadline()).await.unwrap(),
+        vec![record]
+    );
+    let (report, ()) = tokio::join!(reconcile_image_pins(&directory, &port, deadline()), async {
+        matching(&mut daemon).await;
+        let checked = daemon.next().await;
+        assert!(directory.image_records(deadline()).await.unwrap()[0].committed);
+        checked
+            .reply(
+                200,
+                &serde_json::to_vec(&json!({"Id":format!("sha256:{}","a".repeat(64))})).unwrap(),
+            )
+            .await;
+        let remove = daemon.next().await;
+        assert!(remove.head.starts_with("DELETE "));
+        assert!(
+            remove
+                .head
+                .contains(&crate::docker::escaped(pin.reference().as_str()))
+        );
+        assert!(remove.head.contains("force=false&noprune=true"));
+        remove.reply(200, b"[]").await;
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(
+        report.unwrap(),
+        ImagePinRecovery {
+            settled: 1,
+            remaining: 0
+        }
+    );
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_settle_absence_only_after_durable_commitment() {
+    let (_root, directory, _, _pin) = fixture(true, false).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let (report, ()) = tokio::join!(reconcile_image_pins(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(
+        report.unwrap(),
+        ImagePinRecovery {
+            settled: 1,
+            remaining: 0
+        }
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_never_delete_a_mismatching_alias(#[case] after_commit: bool) {
+    let (_root, directory, _, _pin) = fixture(false, false).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let (result, ()) = tokio::join!(reconcile_image_pins(&directory, &port, deadline()), async {
+        if after_commit {
+            matching(&mut daemon).await;
+        }
+        daemon
+            .next()
+            .await
+            .reply(
+                200,
+                &serde_json::to_vec(&json!({"Id":format!("sha256:{}","b".repeat(64))})).unwrap(),
+            )
+            .await;
+    });
+    assert!(matches!(result, Err(DockerError::Quarantined)));
+    assert_eq!(
+        directory.image_records(deadline()).await.unwrap()[0].committed,
+        after_commit
+    );
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_block_alias_mutations_while_historical_container_intents_remain() {
+    let (_root, directory, _, _pin) = fixture(false, true).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    assert!(matches!(
+        reconcile_image_pins(
+            &directory,
+            &wire
+                .port()
+                .bind_directory(&directory, deadline())
+                .await
+                .unwrap(),
+            deadline()
+        )
+        .await,
+        Err(DockerError::Quarantined)
+    ));
+    assert_eq!(directory.image_records(deadline()).await.unwrap().len(), 1);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_exclude_current_run_aliases() {
+    let (_root, directory, old, _pin) = fixture(false, false).await;
+    directory.settle_image(old, deadline()).await.unwrap();
+    let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+    directory
+        .prepare_image(
+            ImageRecord::new(&pin, &format!("sha256:{}", "a".repeat(64)).parse().unwrap()).unwrap(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    assert_eq!(
+        reconcile_image_pins(
+            &directory,
+            &wire
+                .port()
+                .bind_directory(&directory, deadline())
+                .await
+                .unwrap(),
+            deadline()
+        )
+        .await
+        .unwrap()
+        .remaining,
+        1
+    );
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_resume_after_waiter_abandonment_with_persisted_commitment() {
+    let (_root, directory, _, _pin) = fixture(false, false).await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let retained = directory.clone();
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let task =
+        tokio::spawn(async move { reconcile_image_pins(&retained, &port, deadline()).await });
+    matching(&mut daemon).await;
+    let held = daemon.next().await;
+    assert!(directory.image_records(deadline()).await.unwrap()[0].committed);
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    held.reply(200, b"{}").await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let (report, ()) = tokio::join!(reconcile_image_pins(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(report.unwrap().remaining, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[derive(Debug)]
+struct RecoveryEvidence(Option<tempfile::TempDir>);
+impl RecoveryEvidence {
+    fn path(&self) -> TestResult<&Path> {
+        self.0
+            .as_ref()
+            .map(tempfile::TempDir::path)
+            .context("missing retained image recovery evidence")
+    }
+    fn complete(&mut self) {
+        drop(self.0.take());
+    }
+}
+impl Drop for RecoveryEvidence {
+    fn drop(&mut self) {
+        if let Some(root) = self.0.take() {
+            eprintln!(
+                "unsettled image recovery evidence retained at {}",
+                root.keep().display()
+            );
+        }
+    }
+}
+
+#[rstest::rstest]
+#[case::unknown_visible(false)]
+#[case::committed_absent(true)]
+#[tokio::test]
+#[ignore = "requires explicit Docker socket and matching runtime image"]
+async fn test_should_recover_real_private_alias_across_directory_reacquisition(
+    #[case] committed_absent: bool,
+) -> TestResult<()> {
+    let socket =
+        std::env::var("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit Docker socket")?;
+    let architecture = match std::env::var("RUSTACK_RUNTIME_ARCH")?.as_str() {
+        "arm64" => Architecture::Arm64,
+        "amd64" => Architecture::X86_64,
+        _ => anyhow::bail!("unknown fixture architecture"),
+    };
+    let reference = std::env::var("RUSTACK_RUNTIME_IMAGE")?.parse()?;
+    let limit = || Instant::now() + Duration::from_secs(60);
+    let mut evidence = RecoveryEvidence(Some(tempfile::tempdir()?));
+    let mut wire = DockerWire::connect(format!("unix://{socket}").parse()?, limit()).await?;
+    let mut previous = None;
+    let mut original = None;
+    let mut alias = None;
+    let setup = async {
+        let directory = DirectoryLease::acquire(evidence.path()?.into(), limit()).await?;
+        let docker = wire.port().bind_directory(&directory, limit()).await?;
+        previous = Some(directory.run_id());
+        let resolved = ImageResolver::new(docker.clone())
+            .resolve_local(&reference, architecture, None, limit())
+            .await?;
+        let expected = resolved.metadata().image_id.clone();
+        original = Some(expected.clone());
+        let pin = ImagePinScope::new(directory.clone()).allocate()?;
+        alias = Some(pin.reference().clone());
+        let record = ImageRecord::new(&pin, &expected)?;
+        directory.prepare_image(record.clone(), limit()).await?;
+        docker.tag_image_pin(&expected, &pin, limit()).await?;
+        if committed_absent {
+            directory.commit_image(record, limit()).await?;
+            docker.remove_image_pin(&pin, limit()).await?;
+        }
+        anyhow::Ok(())
+    }
+    .await;
+    let recovery = async {
+        let next = DirectoryLease::acquire(evidence.path()?.into(), limit()).await?;
+        ensure!(
+            Some(next.run_id()) != previous,
+            "run identity did not change"
+        );
+        let docker = wire.port().bind_directory(&next, limit()).await?;
+        let report = reconcile_image_pins(&next, &docker, limit()).await?;
+        ensure!(
+            report.settled == 1 && report.remaining == 0,
+            "historical pin not settled"
+        );
+        ensure!(
+            next.image_records(limit()).await?.is_empty(),
+            "durable pin records remain"
+        );
+        let source = docker.inspect_image(&reference, limit()).await?;
+        ensure!(
+            source.id.as_deref()
+                == Some(original.as_ref().context("captured source image")?.as_str()),
+            "operator source tag changed or disappeared"
+        );
+        ensure!(
+            matches!(
+                docker
+                    .inspect_image(alias.as_ref().context("captured private alias")?, limit())
+                    .await,
+                Err(DockerError::Status(StatusCode::NOT_FOUND))
+            ),
+            "private alias remains visible"
+        );
+        anyhow::Ok(())
+    }
+    .await;
+    let wire_cleanup = wire.shutdown().await;
+    setup?;
+    recovery?;
+    wire_cleanup?;
+    evidence.complete();
+    Ok(())
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/inventory.rs b/crates/rustack-lambda-core/src/docker/recovery/inventory.rs
new file mode 100644
index 00000000..e516476a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/inventory.rs
@@ -0,0 +1,141 @@
+//! Complete bounded observed inventories, never authority to adopt an effect.
+
+use std::fmt;
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use serde::{Deserialize, Deserializer};
+use tokio::time::Instant;
+
+use crate::{
+    artifact::ImageReference,
+    docker::{
+        DirectoryLease, DockerError, DockerPort, Operation, OwnerFilter, check_deadline, decode,
+        models::ContainerSummary,
+    },
+};
+
+const MAX_IMAGES: usize = 4096;
+const MAX_TAGS: usize = 4096;
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct ImageTags {
+    #[serde(rename = "RepoTags", deserialize_with = "tags")]
+    tags: Vec<String>,
+}
+impl fmt::Debug for ImageTags {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ImageTags(<redacted>)")
+    }
+}
+fn tags<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Vec<String>, D::Error> {
+    Ok(Option::<Vec<String>>::deserialize(deserializer)?.unwrap_or_default())
+}
+
+pub(in crate::docker) async fn containers(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<(), DockerError> {
+    docker.require_directory(directory)?;
+    let filter = OwnerFilter::new(directory.owner_id(), None, None)?;
+    let rows: Vec<ContainerSummary> = decode(
+        docker
+            .call(
+                Operation::List,
+                Method::GET,
+                format!("/containers/json?{}", filter.query(None)?),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+        deadline,
+    )?;
+    if rows.len() > 64 {
+        return Err(DockerError::TooLarge);
+    }
+    if !rows.is_empty() {
+        return Err(DockerError::Quarantined);
+    }
+    check_deadline(deadline)
+}
+
+pub(in crate::docker) async fn images(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<(), DockerError> {
+    docker.require_directory(directory)?;
+    let rows: Vec<ImageTags> = decode(
+        docker
+            .call(
+                Operation::ListImages,
+                Method::GET,
+                "/images/json?all=true".into(),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+        deadline,
+    )?;
+    check_tags(rows, directory, deadline)
+}
+fn check_tags(
+    rows: Vec<ImageTags>,
+    directory: &DirectoryLease,
+    deadline: Instant,
+) -> Result<(), DockerError> {
+    if rows.len() > MAX_IMAGES {
+        return Err(DockerError::TooLarge);
+    }
+    let prefix = format!("rustack-internal/lambda-{}/", directory.owner_id().simple());
+    let mut count = 0_usize;
+    for row in rows {
+        count = count
+            .checked_add(row.tags.len())
+            .ok_or(DockerError::TooLarge)?;
+        if count > MAX_TAGS {
+            return Err(DockerError::TooLarge);
+        }
+        for tag in row.tags {
+            check_deadline(deadline)?;
+            if tag.len() > 1024 {
+                return Err(DockerError::TooLarge);
+            }
+            if tag == "<none>:<none>" {
+                continue;
+            }
+            let familiar = tag
+                .strip_prefix("docker.io/")
+                .or_else(|| tag.strip_prefix("index.docker.io/"))
+                .unwrap_or(&tag);
+            if familiar.starts_with(&prefix) {
+                return Err(DockerError::Quarantined);
+            }
+            tag.parse::<ImageReference>()
+                .map_err(|_| DockerError::Protocol)?;
+        }
+    }
+    check_deadline(deadline)
+}
+
+#[cfg(test)]
+mod tests;
+
+pub(in crate::docker) async fn volumes(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<(), DockerError> {
+    docker.require_directory(directory)?;
+    if directory.code_journaled() {
+        let scope = OwnerFilter::new(directory.owner_id(), None, None)?;
+        if !docker.list_volumes(scope, deadline).await?.is_empty() {
+            return Err(DockerError::Quarantined);
+        }
+    }
+    check_deadline(deadline)
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/inventory/tests.rs b/crates/rustack-lambda-core/src/docker/recovery/inventory/tests.rs
new file mode 100644
index 00000000..f244a70c
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/inventory/tests.rs
@@ -0,0 +1,135 @@
+use std::time::Duration;
+
+use rstest::rstest;
+use serde_json::from_str;
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use super::{ImageTags, MAX_IMAGES, MAX_TAGS, check_tags};
+use crate::docker::{DirectoryLease, DockerError};
+
+fn lease() -> DirectoryLease {
+    DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4())
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+fn row(tag: String) -> ImageTags {
+    ImageTags { tags: vec![tag] }
+}
+
+#[rstest]
+#[case("")]
+#[case("docker.io/")]
+#[case("index.docker.io/")]
+#[test]
+fn test_should_refuse_owner_prefix_at_any_depth_or_spelling(#[case] registry: &str) {
+    let directory = lease();
+    let prefix = format!(
+        "{registry}rustack-internal/lambda-{}/",
+        directory.owner_id().simple()
+    );
+    for suffix in ["run:pin", "run/deep/path:pin", "not a reference", ""] {
+        assert!(matches!(
+            check_tags(
+                vec![row(format!("{prefix}{suffix}"))],
+                &directory,
+                deadline()
+            ),
+            Err(DockerError::Quarantined)
+        ));
+    }
+}
+
+#[test]
+fn test_should_preserve_other_owner_registry_and_lookalike_names() {
+    let directory = lease();
+    let owner = directory.owner_id().simple();
+    let tags = vec![
+        format!(
+            "rustack-internal/lambda-{}/run:pin",
+            Uuid::new_v4().simple()
+        ),
+        format!("rustack-internal/lambda-{owner}-other/run:pin"),
+        format!("registry.example/rustack-internal/lambda-{owner}/run:pin"),
+        "operator/function:latest".into(),
+        "<none>:<none>".into(),
+    ];
+    assert!(check_tags(vec![ImageTags { tags }], &directory, deadline()).is_ok());
+}
+
+#[rstest]
+#[case(r#"[{"RepoTags":null}]"#)]
+#[case(r#"[{"RepoTags":[]}]"#)]
+#[case(r#"[{"RepoTags":["<none>:<none>"]}]"#)]
+#[test]
+fn test_should_accept_dangling_or_empty_tag_lists(#[case] source: &str) {
+    let rows = from_str::<Vec<ImageTags>>(source).unwrap();
+    assert!(check_tags(rows, &lease(), deadline()).is_ok());
+}
+
+#[test]
+fn test_should_reject_missing_required_tag_field() {
+    assert!(from_str::<Vec<ImageTags>>(r"[{}]").is_err());
+}
+
+#[rstest]
+#[case("https://registry.example/image")]
+#[case("bad reference")]
+#[case("worker:v1\n")]
+#[case("")]
+#[test]
+fn test_should_reject_malformed_foreign_metadata(#[case] tag: &str) {
+    assert!(matches!(
+        check_tags(vec![row(tag.into())], &lease(), deadline()),
+        Err(DockerError::Protocol)
+    ));
+}
+
+#[test]
+fn test_should_bound_rows_total_tags_and_external_tag_bytes() {
+    let directory = lease();
+    let rows = || {
+        (0..MAX_IMAGES)
+            .map(|_| ImageTags { tags: vec![] })
+            .collect::<Vec<_>>()
+    };
+    assert!(check_tags(rows(), &directory, deadline()).is_ok());
+    let mut extra = rows();
+    extra.push(ImageTags { tags: vec![] });
+    assert!(matches!(
+        check_tags(extra, &directory, deadline()),
+        Err(DockerError::TooLarge)
+    ));
+    let tags = vec!["worker:v1".into(); MAX_TAGS];
+    assert!(
+        check_tags(
+            vec![ImageTags { tags: tags.clone() }],
+            &directory,
+            deadline()
+        )
+        .is_ok()
+    );
+    assert!(matches!(
+        check_tags(
+            vec![ImageTags { tags }, row("worker:v2".into())],
+            &directory,
+            deadline()
+        ),
+        Err(DockerError::TooLarge)
+    ));
+    assert!(matches!(
+        check_tags(vec![row("a".repeat(1025))], &directory, deadline()),
+        Err(DockerError::TooLarge)
+    ));
+}
+
+#[test]
+fn test_should_reject_late_classification_and_redact_inventory_debug() {
+    let rows = vec![row("operator/private:secret".into())];
+    assert!(!format!("{rows:?}").contains("secret"));
+    assert!(matches!(
+        check_tags(rows, &lease(), Instant::now()),
+        Err(DockerError::Deadline)
+    ));
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/namespace.rs b/crates/rustack-lambda-core/src/docker/recovery/namespace.rs
new file mode 100644
index 00000000..e32dce17
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/namespace.rs
@@ -0,0 +1,112 @@
+//! Startup-only composition; inventories cannot settle unproven mutations.
+
+use std::time::Duration;
+
+use tokio::time::Instant;
+
+use super::{
+    CodeRecovery, ContainerRecovery, ImagePinRecovery, code::reconcile_code, inventory,
+    reconcile_containers, reconcile_image_pins,
+};
+use crate::docker::{DirectoryLease, DockerError, DockerPort, EnvironmentError, check_deadline};
+
+/// Recorded retirement counters; this is not a readiness capability.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct NamespaceRecovery {
+    /// Historical container records settled/retained by this pass.
+    pub containers: ContainerRecovery,
+    /// Historical pin records settled/retained by this pass.
+    pub pins: ImagePinRecovery,
+    /// Historical code records settled/retained by this pass.
+    pub code: CodeRecovery,
+}
+
+/// Drain recorded historical effects and audit the complete observed namespace.
+///
+/// Call before starting any runtime producer, under one exclusive coordinator.
+/// Unknown effects remain recorded; inventories never authorize adoption or
+/// prove absence of unseen pre-journal legacy mutations. Earlier durable cleanup
+/// may succeed before a later error; repeating the call resumes that state.
+///
+/// # Errors
+/// Rejects unbound/foreign ports, current-run work, unrecorded owned resources,
+/// inventory bounds, storage/wire/identity failures and expired budgets.
+///
+/// ```no_run
+/// # async fn recover(directory: &rustack_lambda_core::docker::DirectoryLease, port: &rustack_lambda_core::docker::DockerPort) -> Result<(), rustack_lambda_core::docker::EnvironmentError> {
+/// let bound = port.bind_directory(directory, tokio::time::Instant::now() + std::time::Duration::from_secs(10)).await?;
+/// let report = rustack_lambda_core::docker::reconcile_namespace(directory, &bound,
+///     tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await?;
+/// assert_eq!(report.containers.remaining, 0);
+/// assert_eq!(report.pins.remaining, 0);
+/// // Startup must still qualify pulls, resources, networking and provenance.
+/// # Ok(()) }
+/// ```
+pub async fn reconcile_namespace(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    deadline: Instant,
+) -> Result<NamespaceRecovery, EnvironmentError> {
+    docker.require_directory(directory)?;
+    check_deadline(deadline)?;
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .ok_or(DockerError::Deadline)?;
+    if remaining > Duration::from_secs(60) {
+        return Err(DockerError::Configuration.into());
+    }
+    let containers = directory.container_records(deadline).await?;
+    let pins = directory.image_records(deadline).await?;
+    let code = directory.code_records(deadline).await?;
+    if containers
+        .iter()
+        .any(|record| record.run == directory.run_id())
+        || pins.iter().any(|record| record.run == directory.run_id())
+        || code.iter().any(|record| record.run == directory.run_id())
+    {
+        return Err(DockerError::Quarantined.into());
+    }
+    let containers = reconcile_containers(directory, docker, deadline).await?;
+    let mut report = NamespaceRecovery {
+        containers,
+        code: CodeRecovery {
+            settled: 0,
+            remaining: code.len(),
+        },
+        pins: ImagePinRecovery {
+            settled: 0,
+            remaining: pins.len(),
+        },
+    };
+    if containers.remaining != 0 {
+        check_deadline(deadline)?;
+        return Ok(report);
+    }
+    report.code = reconcile_code(directory, docker, deadline).await?;
+    if report.code.remaining != 0 {
+        check_deadline(deadline)?;
+        return Ok(report);
+    }
+    inventory::containers(directory, docker, deadline).await?;
+    inventory::volumes(directory, docker, deadline).await?;
+    report.pins = reconcile_image_pins(directory, docker, deadline).await?;
+    if report.pins.remaining != 0 {
+        check_deadline(deadline)?;
+        return Ok(report);
+    }
+    inventory::images(directory, docker, deadline).await?;
+    inventory::containers(directory, docker, deadline).await?;
+    inventory::volumes(directory, docker, deadline).await?;
+    if !directory.container_records(deadline).await?.is_empty()
+        || !directory.image_records(deadline).await?.is_empty()
+        || !directory.code_records(deadline).await?.is_empty()
+    {
+        return Err(DockerError::Quarantined.into());
+    }
+    check_deadline(deadline)?;
+    Ok(report)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/recovery/namespace/tests.rs b/crates/rustack-lambda-core/src/docker/recovery/namespace/tests.rs
new file mode 100644
index 00000000..c1260dd3
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/namespace/tests.rs
@@ -0,0 +1,378 @@
+use std::{sync::Arc, time::Duration};
+
+use http::StatusCode;
+use rstest::rstest;
+use serde_json::{Value, json, to_vec};
+use tempfile::TempDir;
+use tokio::{
+    spawn,
+    time::{Instant, timeout},
+};
+
+use super::{NamespaceRecovery, reconcile_namespace};
+use crate::docker::{
+    DirectoryLease, DockerError, DockerPort, DockerWire, EnvironmentError, EnvironmentPlan,
+    ImagePinScope,
+    ownership::{ContainerRecord, ImageRecord},
+    plan::{
+        ContainerRole,
+        tests::{image_with, policy, revision},
+    },
+    tests::{Daemon, IncomingRequest},
+};
+
+mod boundaries;
+mod real;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Entry {
+    None,
+    Unknown,
+    Known,
+}
+
+async fn fixture(container: Entry, pin_entry: Entry) -> (TempDir, DirectoryLease) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    if !matches!(container, Entry::None) {
+        let plan = EnvironmentPlan::new(
+            directory.clone(),
+            image_with("1000", vec![]),
+            Arc::new(revision()),
+            policy(),
+        )
+        .unwrap();
+        let record = ContainerRecord::from_plan(&plan, ContainerRole::Relay).unwrap();
+        directory
+            .prepare_container(record.clone(), deadline())
+            .await
+            .unwrap();
+        if matches!(container, Entry::Known) {
+            directory
+                .know_container(record, "a".repeat(64).parse().unwrap(), deadline())
+                .await
+                .unwrap();
+        }
+    }
+    if !matches!(pin_entry, Entry::None) {
+        let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+        let record =
+            ImageRecord::new(&pin, &format!("sha256:{}", "a".repeat(64)).parse().unwrap()).unwrap();
+        directory
+            .prepare_image(record.clone(), deadline())
+            .await
+            .unwrap();
+        if matches!(pin_entry, Entry::Known) {
+            directory.commit_image(record, deadline()).await.unwrap();
+        }
+    }
+    drop(directory);
+    let next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    (root, next)
+}
+
+async fn wire(directory: &DirectoryLease) -> (Daemon, DockerWire, DockerPort) {
+    let daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(directory, deadline())
+        .await
+        .unwrap();
+    (daemon, wire, port)
+}
+fn container_query(request: &IncomingRequest, directory: &DirectoryLease) {
+    let target = request
+        .head
+        .lines()
+        .next()
+        .unwrap()
+        .split_whitespace()
+        .nth(1)
+        .unwrap();
+    let (path, query) = target.split_once('?').unwrap();
+    assert_eq!(path, "/v1.53/containers/json");
+    let pairs = form_urlencoded::parse(query.as_bytes())
+        .into_owned()
+        .collect::<Vec<_>>();
+    assert_eq!(pairs.len(), 2);
+    assert_eq!(pairs[0], ("all".into(), "true".into()));
+    assert_eq!(
+        serde_json::from_str::<Value>(&pairs[1].1).unwrap(),
+        json!({"label":[format!("rustack.lambda.ownerId={}",directory.owner_id())]})
+    );
+    assert_eq!(pairs[1].0, "filters");
+}
+async fn empty_container(daemon: &mut Daemon, directory: &DirectoryLease) {
+    let request = daemon.next().await;
+    container_query(&request, directory);
+    request.reply(200, b"[]").await;
+}
+async fn image_inventory(daemon: &mut Daemon, body: &[u8]) {
+    let request = daemon.next().await;
+    assert!(request.head.starts_with("GET /v1.53/images/json?all=true "));
+    request.reply(200, body).await;
+}
+async fn no_more(daemon: &mut Daemon) {
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+}
+
+#[tokio::test]
+async fn test_should_audit_empty_namespace_repeatedly_without_truncated_queries() {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    for _ in 0..2 {
+        let (report, ()) =
+            tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+                empty_container(&mut daemon, &directory).await;
+                image_inventory(
+                    &mut daemon,
+                    br#"[{"RepoTags":null},{"RepoTags":["operator/image:v1"]}]"#,
+                )
+                .await;
+                empty_container(&mut daemon, &directory).await;
+            });
+        let report = report.unwrap();
+        assert_eq!(report.containers.remaining, 0);
+        assert_eq!(report.pins.remaining, 0);
+    }
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_settle_recorded_containers_before_pins_and_audit_afterward() {
+    let (_root, directory) = fixture(Entry::Known, Entry::Known).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        let request = daemon.next().await;
+        assert!(request.head.contains(&"a".repeat(64)));
+        request.reply(404, b"{}").await;
+        empty_container(&mut daemon, &directory).await;
+        assert_eq!(directory.container_records(deadline()).await.unwrap(), []);
+        assert_eq!(directory.image_records(deadline()).await.unwrap().len(), 1);
+        let request = daemon.next().await;
+        assert!(request.head.contains("/images/"));
+        request.reply(404, b"{}").await;
+        image_inventory(&mut daemon, b"[]").await;
+        assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+        empty_container(&mut daemon, &directory).await;
+    });
+    let report = report.unwrap();
+    assert_eq!(report.containers.settled, 1);
+    assert_eq!(report.pins.settled, 1);
+    assert_eq!(report.containers.remaining, 0);
+    assert_eq!(report.pins.remaining, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_leave_pins_untouched_while_unknown_containers_remain() {
+    let (_root, directory) = fixture(Entry::Unknown, Entry::Known).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let before = directory.image_records(deadline()).await.unwrap();
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    let report = report.unwrap();
+    assert_eq!(report.containers.remaining, 1);
+    assert_eq!(report.pins.remaining, 1);
+    assert_eq!(report.pins.settled, 0);
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), before);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_not_use_absent_inventory_to_settle_unknown_pin() {
+    let (_root, directory) = fixture(Entry::None, Entry::Unknown).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        empty_container(&mut daemon, &directory).await;
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    let report = report.unwrap();
+    assert_eq!(report.pins.remaining, 1);
+    assert_eq!(report.pins.settled, 0);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(1, false)]
+#[case(65, false)]
+#[case(1, true)]
+#[tokio::test]
+async fn test_should_refuse_orphan_or_late_containers_without_adoption(
+    #[case] count: usize,
+    #[case] late: bool,
+) {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        if late {
+            empty_container(&mut daemon, &directory).await;
+            image_inventory(&mut daemon, b"[]").await;
+        }
+        let request = daemon.next().await;
+        container_query(&request, &directory);
+        request
+            .reply(
+                200,
+                &to_vec(&vec![json!({"Id":"a".repeat(64)}); count]).unwrap(),
+            )
+            .await;
+    });
+    assert!(matches!(
+        report,
+        Err(EnvironmentError::Docker(
+            DockerError::Quarantined | DockerError::TooLarge
+        ))
+    ));
+    assert_eq!(directory.container_records(deadline()).await.unwrap(), []);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_refuse_unrecorded_owned_alias_without_image_deletion() {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let tag = format!(
+        "rustack-internal/lambda-{}/old/deep:pin",
+        directory.owner_id().simple()
+    );
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        empty_container(&mut daemon, &directory).await;
+        image_inventory(&mut daemon, &to_vec(&json!([{"RepoTags":[tag]}])).unwrap()).await;
+    });
+    assert!(matches!(
+        report,
+        Err(EnvironmentError::Docker(DockerError::Quarantined))
+    ));
+    assert_eq!(directory.image_records(deadline()).await.unwrap(), []);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_reject_current_run_or_late_journal_entries(#[case] late: bool) {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let pin = ImagePinScope::new(directory.clone()).allocate().unwrap();
+    let record =
+        ImageRecord::new(&pin, &format!("sha256:{}", "a".repeat(64)).parse().unwrap()).unwrap();
+    if !late {
+        directory
+            .prepare_image(record.clone(), deadline())
+            .await
+            .unwrap();
+    }
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        if late {
+            empty_container(&mut daemon, &directory).await;
+            image_inventory(&mut daemon, b"[]").await;
+            let request = daemon.next().await;
+            directory.prepare_image(record, deadline()).await.unwrap();
+            request.reply(200, b"[]").await;
+        }
+    });
+    assert!(matches!(
+        report,
+        Err(EnvironmentError::Docker(DockerError::Quarantined))
+    ));
+    assert_eq!(directory.image_records(deadline()).await.unwrap().len(), 1);
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(false, 404)]
+#[case(false, 500)]
+#[case(true, 404)]
+#[tokio::test]
+async fn test_should_preserve_list_status_origin_instead_of_empty_success(
+    #[case] images: bool,
+    #[case] status: u16,
+) {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        if images {
+            empty_container(&mut daemon, &directory).await;
+        }
+        daemon.next().await.reply(status, b"{}").await;
+    });
+    assert!(
+        matches!(report, Err(EnvironmentError::Docker(DockerError::Status(actual))) if actual.as_u16()==status)
+    );
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_resume_recorded_cleanup_after_abandoned_observer() {
+    let (_root, directory) = fixture(Entry::Known, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let copy = directory.clone();
+    let call = port.clone();
+    let task = spawn(async move { reconcile_namespace(&copy, &call, deadline()).await });
+    let held = daemon.next().await;
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    held.reply(404, b"{}").await;
+    assert_eq!(
+        directory.container_records(deadline()).await.unwrap().len(),
+        1
+    );
+    let (report, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        daemon.next().await.reply(404, b"{}").await;
+        empty_container(&mut daemon, &directory).await;
+        image_inventory(&mut daemon, b"[]").await;
+        empty_container(&mut daemon, &directory).await;
+    });
+    let NamespaceRecovery {
+        containers, pins, ..
+    } = report.unwrap();
+    assert_eq!(containers.settled, 1);
+    assert_eq!(pins.remaining, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_identity_404_without_auditing_or_claiming_absence() {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    daemon.identity_status.send_replace(404);
+    assert!(
+        matches!(reconcile_namespace(&directory, &port, deadline()).await,
+        Err(EnvironmentError::Docker(DockerError::IdentityCheck(source))) if matches!(source.as_ref(),DockerError::Status(StatusCode::NOT_FOUND)))
+    );
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/namespace/tests/boundaries.rs b/crates/rustack-lambda-core/src/docker/recovery/namespace/tests/boundaries.rs
new file mode 100644
index 00000000..34e38b6e
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/namespace/tests/boundaries.rs
@@ -0,0 +1,165 @@
+use std::{sync::Arc, time::Duration};
+
+use rstest::rstest;
+use serde_json::{json, to_vec};
+use tokio::{io::AsyncWriteExt, time::Instant};
+
+use super::{Entry, deadline, empty_container, fixture, no_more, wire};
+use crate::docker::{
+    DirectoryLease, DockerError, EnvironmentError, EnvironmentPlan, MAX_BODY_BYTES,
+    ownership::ContainerRecord,
+    plan::{
+        ContainerRole,
+        tests::{image_with, policy, revision},
+    },
+    reconcile_namespace,
+};
+
+#[rstest]
+#[case::root_shape(0)]
+#[case::tag_type(1)]
+#[case::duplicate_fields(2)]
+#[case::tag_bytes(3)]
+#[case::row_members(4)]
+#[case::tag_members(5)]
+#[case::declared_body(6)]
+#[case::exact_body(7)]
+#[case::chunked_body(8)]
+#[case::missing_tags(9)]
+#[tokio::test]
+async fn test_should_bound_actual_image_inventory_before_clean_result(#[case] mode: u8) {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let (result, ()) = tokio::join!(reconcile_namespace(&directory, &port, deadline()), async {
+        empty_container(&mut daemon, &directory).await;
+        let mut request = daemon.next().await;
+        assert!(request.head.starts_with("GET /v1.53/images/json?all=true "));
+        match mode {
+            6 => {
+                request
+                    .raw(
+                        format!(
+                            "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+                            MAX_BODY_BYTES + 1
+                        )
+                        .as_bytes(),
+                    )
+                    .await;
+            }
+            8 => {
+                let mut response = format!(
+                    "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nConnection: \
+                     close\r\n\r\n{:x}\r\n",
+                    MAX_BODY_BYTES + 1
+                )
+                .into_bytes();
+                response.extend(vec![b' '; MAX_BODY_BYTES + 1]);
+                response.extend_from_slice(b"\r\n0\r\n\r\n");
+                let _ = request.stream.write_all(&response).await;
+            }
+            _ => {
+                let body = match mode {
+                    0 => b"{}".to_vec(),
+                    1 => br#"[{"RepoTags":[42]}]"#.to_vec(),
+                    2 => br#"[{"RepoTags":[],"RepoTags":[]}]"#.to_vec(),
+                    3 => to_vec(&json!([{"RepoTags":["a".repeat(1025)]}])).unwrap(),
+                    4 => to_vec(&vec![json!({}); 4097]).unwrap(),
+                    5 => to_vec(&json!([{"RepoTags":vec!["worker:v1";4097]}])).unwrap(),
+                    9 => b"[{}]".to_vec(),
+                    _ => {
+                        let mut bytes = b"[]".to_vec();
+                        bytes.resize(MAX_BODY_BYTES, b' ');
+                        bytes
+                    }
+                };
+                request.reply(200, &body).await;
+                if mode == 7 {
+                    empty_container(&mut daemon, &directory).await;
+                }
+            }
+        }
+    });
+    if mode == 7 {
+        let report = result.unwrap();
+        assert_eq!(report.containers.remaining, 0);
+        assert_eq!(report.pins.remaining, 0);
+    } else {
+        assert!(result.is_err());
+    }
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_reject_invalid_budget_without_daemon_work(#[case] overlong: bool) {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let limit = if overlong {
+        Instant::now() + Duration::from_secs(61)
+    } else {
+        Instant::now()
+    };
+    assert!(matches!(
+        reconcile_namespace(&directory, &port, limit).await,
+        Err(EnvironmentError::Docker(
+            DockerError::Deadline | DockerError::Configuration
+        ))
+    ));
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_require_exact_directory_binding_before_reading_or_mutation() {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let other_root = tempfile::tempdir().unwrap();
+    let other = DirectoryLease::acquire(other_root.path().into(), deadline())
+        .await
+        .unwrap();
+    assert!(matches!(
+        reconcile_namespace(&other, &port, deadline()).await,
+        Err(EnvironmentError::Docker(DockerError::DaemonBinding))
+    ));
+    assert!(matches!(
+        reconcile_namespace(&directory, &wire.port(), deadline()).await,
+        Err(EnvironmentError::Docker(DockerError::DaemonBinding))
+    ));
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_refuse_current_run_container_before_any_recovery_io() {
+    let (_root, directory) = fixture(Entry::None, Entry::None).await;
+    let (mut daemon, mut wire, port) = wire(&directory).await;
+    let plan = EnvironmentPlan::new(
+        directory.clone(),
+        image_with("1000", vec![]),
+        Arc::new(revision()),
+        policy(),
+    )
+    .unwrap();
+    let record = ContainerRecord::from_plan(&plan, ContainerRole::Relay).unwrap();
+    directory
+        .prepare_container(record.clone(), deadline())
+        .await
+        .unwrap();
+    assert!(matches!(
+        reconcile_namespace(&directory, &port, deadline()).await,
+        Err(EnvironmentError::Docker(DockerError::Quarantined))
+    ));
+    assert_eq!(
+        directory.container_records(deadline()).await.unwrap(),
+        [record]
+    );
+    no_more(&mut daemon).await;
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/namespace/tests/real.rs b/crates/rustack-lambda-core/src/docker/recovery/namespace/tests/real.rs
new file mode 100644
index 00000000..f5fa8904
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/namespace/tests/real.rs
@@ -0,0 +1,479 @@
+use std::{collections::BTreeSet, env, fmt, path::Path, sync::Arc, time::Duration};
+
+use anyhow::{Context, Ok as anyhow_ok, Result, ensure};
+use http::StatusCode;
+use percent_encoding::percent_decode_str;
+use rstest::rstest;
+use tempfile::{TempDir, tempdir};
+use tokio::time::Instant;
+use typed_builder::TypedBuilder;
+use uuid::Uuid;
+
+use crate::{
+    artifact::{Architecture, DeploymentArtifact, ImageReference, Sha256Digest},
+    docker::{
+        DirectoryLease, DockerError, DockerPort, DockerWire, EnvironmentError, EnvironmentPlan,
+        ImageLeaseConfig, ImageLeaseManager, ImagePin, ImagePinScope,
+        ownership::{ContainerRecord, ImageRecord},
+        plan::{
+            ContainerRole,
+            tests::{image_with, policy, revision},
+        },
+        reconcile_namespace,
+        tests::Daemon,
+    },
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+
+struct Evidence(Option<TempDir>);
+impl fmt::Debug for Evidence {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Evidence(<retained>)")
+    }
+}
+impl Evidence {
+    fn path(&self) -> Result<&Path> {
+        Ok(self.0.as_ref().context("retained evidence")?.path())
+    }
+    fn complete(&mut self) {
+        self.0.take();
+    }
+}
+impl Drop for Evidence {
+    fn drop(&mut self) {
+        if let Some(directory) = self.0.take() {
+            eprintln!(
+                "retained namespace qualification evidence: {}",
+                directory.keep().display()
+            );
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Mode {
+    Recorded,
+    OrphanContainer,
+    OrphanAlias,
+}
+
+#[derive(TypedBuilder)]
+struct Fixture {
+    wire: DockerWire,
+    evidence: Evidence,
+    #[builder(default)]
+    images: Option<ImageLeaseManager>,
+    #[builder(default)]
+    planned: Vec<ContainerRecord>,
+    #[builder(default)]
+    alias: Option<(Uuid, Uuid)>,
+    #[builder(default)]
+    previous_run: Option<Uuid>,
+    #[builder(default)]
+    source: Option<ImageReference>,
+    #[builder(default)]
+    parent: Option<Sha256Digest>,
+}
+impl fmt::Debug for Fixture {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Fixture(<owned>)")
+    }
+}
+impl Fixture {
+    async fn setup(
+        &mut self,
+        architecture: Architecture,
+        reference: ImageReference,
+        mode: Mode,
+    ) -> Result<()> {
+        let directory = DirectoryLease::acquire(self.evidence.path()?.into(), deadline()).await?;
+        let docker = self
+            .wire
+            .port()
+            .bind_directory(&directory, deadline())
+            .await?;
+        self.previous_run = Some(directory.run_id());
+        self.source = Some(reference.clone());
+        self.images = Some(ImageLeaseManager::start(
+            docker.clone(),
+            ImagePinScope::new(directory.clone()),
+            ImageLeaseConfig::default(),
+        )?);
+        let image = self
+            .images
+            .as_ref()
+            .context("image owner")?
+            .port()
+            .prepare(&reference, architecture, None, deadline())
+            .await?;
+        self.parent = Some(image.resolved().metadata().image_id.clone());
+        let mut revision = revision();
+        revision.architecture = architecture;
+        revision.artifact = DeploymentArtifact::Image(image.clone());
+        let plan = EnvironmentPlan::new(directory.clone(), image, Arc::new(revision), policy())?;
+        if !matches!(mode, Mode::OrphanAlias) {
+            for role in [ContainerRole::Relay, ContainerRole::Function] {
+                let record = ContainerRecord::from_plan(&plan, role)?;
+                self.planned.push(record.clone());
+                if matches!(mode, Mode::Recorded) {
+                    directory.prepare_container(record, deadline()).await?;
+                }
+                let created = match role {
+                    ContainerRole::Relay => plan.create_relay(&docker, deadline()).await?,
+                    ContainerRole::Function => plan.create_function(&docker, deadline()).await?,
+                };
+                if matches!(role, ContainerRole::Relay) {
+                    docker
+                        .start_container(&created.id.parse()?, deadline())
+                        .await?;
+                }
+            }
+        }
+        if !matches!(mode, Mode::OrphanContainer) {
+            let pin = ImagePinScope::new(directory.clone()).allocate()?;
+            self.alias = Some((pin.run, pin.id));
+            let expected = self.parent.as_ref().context("parent image")?;
+            if matches!(mode, Mode::Recorded) {
+                directory
+                    .prepare_image(ImageRecord::new(&pin, expected)?, deadline())
+                    .await?;
+            }
+            docker.tag_image_pin(expected, &pin, deadline()).await?;
+        }
+        Ok(())
+    }
+    async fn close_images(&mut self) -> Result<()> {
+        if let Some(images) = &mut self.images {
+            images.shutdown(deadline()).await?;
+        }
+        self.images.take();
+        Ok(())
+    }
+    async fn exercise(&self, mode: Mode) -> Result<()> {
+        let directory = DirectoryLease::acquire(self.evidence.path()?.into(), deadline()).await?;
+        ensure!(
+            Some(directory.run_id()) != self.previous_run,
+            "run identity did not change"
+        );
+        let docker = self
+            .wire
+            .port()
+            .bind_directory(&directory, deadline())
+            .await?;
+        let result = reconcile_namespace(&directory, &docker, deadline()).await;
+        match mode {
+            Mode::Recorded => {
+                let report = result?;
+                ensure!(
+                    report.containers.settled == 2
+                        && report.containers.remaining == 0
+                        && report.pins.settled == 1
+                        && report.pins.remaining == 0,
+                    "recorded namespace not fully settled"
+                );
+            }
+            Mode::OrphanContainer => {
+                ensure!(
+                    matches!(
+                        result,
+                        Err(EnvironmentError::Docker(DockerError::Quarantined))
+                    ),
+                    "unrecorded container accepted"
+                );
+                for record in &self.planned {
+                    let inspected = docker.inspect_container(&record.key()?, deadline()).await?;
+                    record.owned(directory.owner_id(), &inspected)?;
+                }
+            }
+            Mode::OrphanAlias => {
+                ensure!(
+                    matches!(
+                        result,
+                        Err(EnvironmentError::Docker(DockerError::Quarantined))
+                    ),
+                    "unrecorded alias accepted"
+                );
+                let (run, id) = self.alias.context("captured private alias")?;
+                let pin = ImagePin::historical(directory.clone(), run, id)?;
+                ensure!(
+                    docker
+                        .inspect_image_pin(&pin, deadline())
+                        .await?
+                        .id
+                        .as_deref()
+                        == Some(self.parent.as_ref().context("parent")?.as_str()),
+                    "orphan alias was changed"
+                );
+            }
+        }
+        Ok(())
+    }
+    async fn cleanup(&self) -> Result<()> {
+        let directory = DirectoryLease::acquire(self.evidence.path()?.into(), deadline()).await?;
+        let docker = self
+            .wire
+            .port()
+            .bind_directory(&directory, deadline())
+            .await?;
+        // Fixture-only cleanup uses identities captured before its own creates;
+        // production namespace recovery never adopts unrecorded effects.
+        let mut result = Ok(());
+        let mut blocked = BTreeSet::new();
+        for record in self.planned.iter().rev() {
+            if !record.function() && blocked.contains(&record.environment) {
+                continue;
+            }
+            let retired = cleanup_container(&directory, &docker, record).await;
+            if retired.is_err() && record.function() {
+                blocked.insert(record.environment);
+            }
+            preserve_error(&mut result, retired);
+        }
+        if let Some((run, id)) = self.alias.filter(|_| result.is_ok()) {
+            let retired = async {
+                let pin = ImagePin::historical(directory.clone(), run, id)?;
+                cleanup_alias(
+                    &directory,
+                    &docker,
+                    &pin,
+                    self.parent.as_ref().context("parent")?,
+                )
+                .await
+            }
+            .await;
+            preserve_error(&mut result, retired);
+        }
+        let audit = async {
+            let report = reconcile_namespace(&directory, &docker, deadline()).await?;
+            ensure!(
+                report.containers.remaining == 0 && report.pins.remaining == 0,
+                "cleanup retains unresolved ownership"
+            );
+            anyhow_ok(())
+        }
+        .await;
+        preserve_error(&mut result, audit);
+        let source = async {
+            let source = docker
+                .inspect_image(self.source.as_ref().context("source tag")?, deadline())
+                .await?;
+            ensure!(
+                source.id.as_deref() == Some(self.parent.as_ref().context("parent")?.as_str()),
+                "operator source tag changed"
+            );
+            anyhow_ok(())
+        }
+        .await;
+        preserve_error(&mut result, source);
+        result
+    }
+}
+fn preserve_error(result: &mut Result<()>, next: Result<()>) {
+    if result.is_ok() {
+        *result = next;
+    }
+}
+async fn cleanup_container(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    record: &ContainerRecord,
+) -> Result<()> {
+    let inspected = match docker.inspect_container(&record.key()?, deadline()).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => return Ok(()),
+        result => result?,
+    };
+    let id = record.owned(directory.owner_id(), &inspected)?;
+    if directory
+        .container_records(deadline())
+        .await?
+        .iter()
+        .any(|saved| {
+            saved.environment == record.environment && saved.function() == record.function()
+        })
+    {
+        directory
+            .know_container(record.clone(), id.clone(), deadline())
+            .await?;
+    }
+    if inspected.state.and_then(|state| state.running) == Some(true) {
+        docker.kill_container(&id, deadline()).await?;
+        ensure!(
+            docker
+                .wait_container(&id, deadline())
+                .await?
+                .error
+                .is_none(),
+            "container wait failed"
+        );
+    }
+    docker.remove_container(&id, deadline()).await?;
+    ensure!(
+        matches!(
+            docker.inspect_container(&id, deadline()).await,
+            Err(DockerError::Status(StatusCode::NOT_FOUND))
+        ),
+        "fixture container remains"
+    );
+    Ok(())
+}
+async fn cleanup_alias(
+    directory: &DirectoryLease,
+    docker: &DockerPort,
+    pin: &ImagePin,
+    parent: &Sha256Digest,
+) -> Result<()> {
+    match docker.inspect_image_pin(pin, deadline()).await {
+        Err(DockerError::Status(StatusCode::NOT_FOUND)) => return Ok(()),
+        Ok(image) => ensure!(
+            image.id.as_deref() == Some(parent.as_str()),
+            "foreign private alias"
+        ),
+        Err(error) => return Err(error.into()),
+    }
+    let expected = ImageRecord::new(pin, parent)?;
+    if directory
+        .image_records(deadline())
+        .await?
+        .iter()
+        .any(|saved| {
+            saved
+                .pin(directory)
+                .is_ok_and(|saved| saved.reference() == pin.reference())
+        })
+    {
+        directory.commit_image(expected, deadline()).await?;
+    }
+    ensure!(
+        docker
+            .inspect_image_pin(pin, deadline())
+            .await?
+            .id
+            .as_deref()
+            == Some(parent.as_str()),
+        "alias identity changed"
+    );
+    docker.remove_image_pin(pin, deadline()).await?;
+    ensure!(
+        matches!(
+            docker.inspect_image_pin(pin, deadline()).await,
+            Err(DockerError::Status(StatusCode::NOT_FOUND))
+        ),
+        "fixture alias remains"
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case::recorded(Mode::Recorded)]
+#[case::orphan_container(Mode::OrphanContainer)]
+#[case::orphan_alias(Mode::OrphanAlias)]
+#[tokio::test]
+#[ignore = "requires explicit Docker socket and matching runtime image"]
+async fn test_should_reconcile_real_namespace_and_preserve_unrecorded_observations(
+    #[case] mode: Mode,
+) -> Result<()> {
+    let socket = env::var("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit Docker socket")?;
+    let architecture = match env::var("RUSTACK_RUNTIME_ARCH")?.as_str() {
+        "arm64" => Architecture::Arm64,
+        "amd64" => Architecture::X86_64,
+        _ => anyhow::bail!("unknown architecture"),
+    };
+    let source = env::var("RUSTACK_RUNTIME_IMAGE")?.parse()?;
+    let evidence = Evidence(Some(tempdir()?));
+    let wire = DockerWire::connect(format!("unix://{socket}").parse()?, deadline()).await?;
+    let mut fixture = Fixture::builder().wire(wire).evidence(evidence).build();
+    let setup = fixture.setup(architecture, source, mode).await;
+    let images = fixture.close_images().await;
+    let exercise = if setup.is_ok() && images.is_ok() {
+        fixture.exercise(mode).await
+    } else {
+        Ok(())
+    };
+    let cleanup = fixture.cleanup().await;
+    let wire = fixture.wire.shutdown().await;
+    setup?;
+    images?;
+    exercise?;
+    cleanup?;
+    wire?;
+    fixture.evidence.complete();
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_attempt_independent_cleanup_and_audit_after_first_failure() {
+    let root = tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let mut planned = Vec::new();
+    for _ in 0..2 {
+        let plan = EnvironmentPlan::new(
+            directory.clone(),
+            image_with("1000", vec![]),
+            Arc::new(revision()),
+            policy(),
+        )
+        .unwrap();
+        for role in [ContainerRole::Relay, ContainerRole::Function] {
+            planned.push(ContainerRecord::from_plan(&plan, role).unwrap());
+        }
+    }
+    let failure = planned[3].key().unwrap().as_str().to_owned();
+    let independent = [planned[1].key().unwrap(), planned[0].key().unwrap()];
+    drop(directory);
+    let mut daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let parent: Sha256Digest = format!("sha256:{}", "a".repeat(64)).parse().unwrap();
+    let mut fixture = Fixture::builder()
+        .wire(wire)
+        .evidence(Evidence(Some(root)))
+        .planned(planned)
+        .source(Some("operator/image:v1".parse().unwrap()))
+        .parent(Some(parent.clone()))
+        .build();
+    let (result, ()) = tokio::join!(fixture.cleanup(), async {
+        let request = daemon.next().await;
+        ensure_fixture_target(&request.head, &failure);
+        request.reply(500, b"{}").await;
+        for key in independent {
+            let request = daemon.next().await;
+            ensure_fixture_target(&request.head, key.as_str());
+            request.reply(404, b"{}").await;
+        }
+        for target in [
+            "/containers/json?",
+            "/images/json?all=true",
+            "/containers/json?",
+        ] {
+            let request = daemon.next().await;
+            assert!(request.head.contains(target));
+            request.reply(200, b"[]").await;
+        }
+        let request = daemon.next().await;
+        assert!(request.head.contains("/images/operator%2Fimage%3Av1/json"));
+        request
+            .reply(200, format!(r#"{{"Id":"{}"}}"#, parent.as_str()).as_bytes())
+            .await;
+    });
+    let cleanup = fixture.wire.shutdown().await;
+    daemon.close().await;
+    assert!(matches!(
+        result.unwrap_err().downcast_ref::<DockerError>(),
+        Some(DockerError::Status(StatusCode::INTERNAL_SERVER_ERROR))
+    ));
+    cleanup.unwrap();
+    fixture.evidence.complete();
+}
+fn ensure_fixture_target(head: &str, key: &str) {
+    assert!(
+        percent_decode_str(head)
+            .decode_utf8()
+            .unwrap()
+            .contains(&format!("/containers/{key}/json"))
+    );
+}
diff --git a/crates/rustack-lambda-core/src/docker/recovery/tests.rs b/crates/rustack-lambda-core/src/docker/recovery/tests.rs
new file mode 100644
index 00000000..22b71276
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/recovery/tests.rs
@@ -0,0 +1,382 @@
+use std::{sync::Arc, time::Duration};
+
+use serde_json::{Value, json};
+use tokio::time::timeout;
+
+use super::*;
+use crate::docker::{
+    EnvironmentPlan,
+    plan::{
+        ContainerRole,
+        tests::{image_with, policy, revision},
+    },
+    tests::Daemon,
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+async fn fixture() -> (
+    tempfile::TempDir,
+    DirectoryLease,
+    Vec<ContainerRecord>,
+    Vec<Value>,
+) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    Daemon::bind_fixture(&directory).await;
+    let plan = EnvironmentPlan::new(
+        directory.clone(),
+        image_with("1000", vec![]),
+        Arc::new(revision()),
+        policy(),
+    )
+    .unwrap();
+    let mut records = Vec::new();
+    let mut inspected = Vec::new();
+    for role in [ContainerRole::Function, ContainerRole::Relay] {
+        let record = ContainerRecord::from_plan(&plan, role).unwrap();
+        directory
+            .prepare_container(record.clone(), deadline())
+            .await
+            .unwrap();
+        let role = if record.function() {
+            "function"
+        } else {
+            "relay"
+        };
+        let id = if record.function() { "a" } else { "b" }.repeat(64);
+        inspected.push(json!({"Id": id,"Name":format!("/{}",record.key().unwrap().as_str()),"Config":{"Image":plan.image_id(if record.function() {ContainerRole::Function} else {ContainerRole::Relay}),"Labels":{
+            "rustack.lambda.ownerId":directory.owner_id().to_string(),"rustack.lambda.runId":directory.run_id().to_string(),"rustack.lambda.environmentId":plan.environment_id().to_string(),"rustack.lambda.functionResourceId":plan.revision().resource_id.to_string(),"rustack.lambda.role":role}},"State":{"Running":false}}));
+        records.push(record);
+    }
+    drop(plan);
+    drop(directory);
+    let next = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    (root, next, records, inspected)
+}
+async fn respond(daemon: &mut Daemon, value: &Value) {
+    daemon
+        .next()
+        .await
+        .reply(200, &serde_json::to_vec(value).unwrap())
+        .await;
+}
+#[tokio::test]
+async fn test_should_keep_unknown_absence_and_block_relay_then_recover_late_commit() {
+    let (_root, directory, records, inspected) = fixture().await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let recover = reconcile_containers(&directory, &port, deadline());
+    let serve = async {
+        let request = daemon.next().await;
+        assert!(request.head.contains("function"));
+        request.reply(404, b"{}").await;
+    };
+    let (result, ()) = tokio::join!(recover, serve);
+    assert_eq!(
+        result.unwrap(),
+        ContainerRecovery {
+            settled: 0,
+            remaining: 2
+        }
+    );
+    assert_eq!(
+        directory.container_records(deadline()).await.unwrap(),
+        records
+    );
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let recover = reconcile_containers(&directory, &port, deadline());
+    let serve = async {
+        for value in &inspected {
+            respond(&mut daemon, value).await;
+            // The full ID must already be durable before any destructive call.
+            let request = daemon.next().await;
+            let saved = directory.container_records(deadline()).await.unwrap();
+            assert!(saved.iter().any(|record| record.known.is_some()));
+            assert!(request.head.contains(value["Id"].as_str().unwrap()));
+            request
+                .reply(200, &serde_json::to_vec(value).unwrap())
+                .await;
+            let remove = daemon.next().await;
+            assert!(remove.head.starts_with("DELETE "));
+            remove.reply(204, b"").await;
+            daemon.next().await.reply(404, b"{}").await;
+        }
+    };
+    let (result, ()) = tokio::join!(recover, serve);
+    assert_eq!(
+        result.unwrap(),
+        ContainerRecovery {
+            settled: 2,
+            remaining: 0
+        }
+    );
+    assert_eq!(directory.container_records(deadline()).await.unwrap(), []);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_settle_only_durable_known_absence() {
+    let (_root, directory, records, _) = fixture().await;
+    for record in &records {
+        directory
+            .know_container(record.clone(), "a".repeat(64).parse().unwrap(), deadline())
+            .await
+            .unwrap();
+    }
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let (result, ()) = tokio::join!(reconcile_containers(&directory, &port, deadline()), async {
+        for _ in 0..2 {
+            let request = daemon.next().await;
+            assert!(request.head.contains(&"a".repeat(64)));
+            request.reply(404, b"{}").await;
+        }
+    });
+    assert_eq!(result.unwrap().remaining, 0);
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[rstest::rstest]
+#[case("/Name")]
+#[case("/Id")]
+#[case("/Config/Image")]
+#[case("/Config/Labels/rustack.lambda.ownerId")]
+#[case("/Config/Labels/rustack.lambda.runId")]
+#[case("/Config/Labels/rustack.lambda.environmentId")]
+#[case("/Config/Labels/rustack.lambda.functionResourceId")]
+#[case("/Config/Labels/rustack.lambda.role")]
+#[tokio::test]
+async fn test_should_never_mutate_foreign_or_malformed_resources(#[case] field: &str) {
+    let (_root, directory, _, mut inspected) = fixture().await;
+    *inspected[0].pointer_mut(field).unwrap() = json!("foreign");
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let (result, ()) = tokio::join!(
+        reconcile_containers(&directory, &port, deadline()),
+        respond(&mut daemon, &inspected[0])
+    );
+    assert!(result.is_err());
+    assert_eq!(
+        directory.container_records(deadline()).await.unwrap().len(),
+        2
+    );
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+#[tokio::test]
+async fn test_should_never_reconcile_current_run_records() {
+    let (_root, directory, records, _) = fixture().await;
+    for record in records {
+        directory
+            .settle_container(record, deadline())
+            .await
+            .unwrap();
+    }
+    let plan = EnvironmentPlan::new(
+        directory.clone(),
+        image_with("1000", vec![]),
+        Arc::new(revision()),
+        policy(),
+    )
+    .unwrap();
+    directory
+        .prepare_container(
+            ContainerRecord::from_plan(&plan, ContainerRole::Relay).unwrap(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    assert_eq!(
+        reconcile_containers(
+            &directory,
+            &wire
+                .port()
+                .bind_directory(&directory, deadline())
+                .await
+                .unwrap(),
+            deadline()
+        )
+        .await
+        .unwrap()
+        .remaining,
+        1
+    );
+    assert!(
+        timeout(Duration::from_millis(20), daemon.requests.recv())
+            .await
+            .is_err()
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker socket and matching runtime image"]
+async fn test_should_reconcile_real_previous_run_containers_from_durable_intents()
+-> anyhow::Result<()> {
+    use anyhow::{Context, ensure};
+
+    use crate::{
+        artifact::{Architecture, DeploymentArtifact},
+        docker::{DockerWire, ImageLeaseConfig, ImageLeaseManager, ImagePinScope},
+    };
+    let socket =
+        std::env::var("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit Docker socket")?;
+    let architecture = match std::env::var("RUSTACK_RUNTIME_ARCH")?.as_str() {
+        "arm64" => Architecture::Arm64,
+        "amd64" => Architecture::X86_64,
+        _ => anyhow::bail!("unknown fixture architecture"),
+    };
+    let image = std::env::var("RUSTACK_RUNTIME_IMAGE")?.parse()?;
+    let limit = || Instant::now() + Duration::from_secs(60);
+    let mut wire = DockerWire::connect(format!("unix://{socket}").parse()?, limit()).await?;
+    let root = tempfile::tempdir()?;
+    let directory = DirectoryLease::acquire(root.path().into(), limit()).await?;
+    let docker = wire.port().bind_directory(&directory, limit()).await?;
+    let previous_run = directory.run_id();
+    let mut images = ImageLeaseManager::start(
+        docker.clone(),
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+    )?;
+    let setup = async {
+        let image = images
+            .port()
+            .prepare(&image, architecture, None, limit())
+            .await?;
+        let mut revision = revision();
+        revision.architecture = architecture;
+        revision.artifact = DeploymentArtifact::Image(image.clone());
+        let plan = EnvironmentPlan::new(directory.clone(), image, Arc::new(revision), policy())?;
+        for role in [ContainerRole::Relay, ContainerRole::Function] {
+            directory
+                .prepare_container(ContainerRecord::from_plan(&plan, role)?, limit())
+                .await?;
+            let created = match role {
+                ContainerRole::Relay => plan.create_relay(&docker.clone(), limit()).await?,
+                ContainerRole::Function => plan.create_function(&docker.clone(), limit()).await?,
+            };
+            if matches!(role, ContainerRole::Relay) {
+                docker
+                    .start_container(&created.id.parse()?, limit())
+                    .await?;
+            }
+        }
+        anyhow::Ok(())
+    }
+    .await;
+    let image_cleanup = images.shutdown(limit()).await;
+    drop(images);
+    drop(docker);
+    drop(directory);
+    let recovery = async {
+        let next = DirectoryLease::acquire(root.path().into(), limit()).await?;
+        ensure!(next.run_id() != previous_run, "run identity did not change");
+        let docker = wire.port().bind_directory(&next, limit()).await?;
+        let report = reconcile_containers(&next, &docker, limit()).await?;
+        ensure!(
+            next.container_records(limit()).await?.is_empty(),
+            "durable records remain"
+        );
+        anyhow::Ok(report)
+    }
+    .await;
+    if !recovery.as_ref().is_ok_and(|report| report.remaining == 0)
+        || image_cleanup.is_err()
+        || setup.is_err()
+    {
+        // Any post-intent failure retains the evidence, including failed lease
+        // reacquisition while an image recovery owner still holds exclusion.
+        let _ = root.keep();
+    }
+    let wire_cleanup = wire.shutdown().await;
+    setup?;
+    image_cleanup?;
+    let report = recovery?;
+    ensure!(
+        report.settled == 2 && report.remaining == 0,
+        "historical containers were not both settled"
+    );
+    wire_cleanup?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_resume_known_identity_after_recovery_waiter_is_aborted() {
+    let (_root, directory, _, inspected) = fixture().await;
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let lease = directory.clone();
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let task = tokio::spawn(async move { reconcile_containers(&lease, &port, deadline()).await });
+    respond(&mut daemon, &inspected[0]).await;
+    let held = daemon.next().await;
+    assert!(held.head.contains(&"a".repeat(64)));
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    held.reply(200, &serde_json::to_vec(&inspected[0]).unwrap())
+        .await;
+    let saved = directory.container_records(deadline()).await.unwrap();
+    assert!(
+        saved
+            .iter()
+            .any(|record| record.function() && record.known.is_some())
+    );
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let (result, ()) = tokio::join!(reconcile_containers(&directory, &port, deadline()), async {
+        let known = daemon.next().await;
+        assert!(known.head.contains(&"a".repeat(64)));
+        known.reply(404, b"{}").await;
+        daemon.next().await.reply(404, b"{}").await;
+    });
+    assert_eq!(
+        result.unwrap(),
+        ContainerRecovery {
+            settled: 1,
+            remaining: 1
+        }
+    );
+    assert!(!directory.container_records(deadline()).await.unwrap()[0].function());
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/sdk.rs b/crates/rustack-lambda-core/src/docker/sdk.rs
new file mode 100644
index 00000000..cdbf31d1
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/sdk.rs
@@ -0,0 +1,273 @@
+//! Explicit local handler credentials, qualified affiliation and bounded environment.
+//!
+//! Only private startup qualification issues contexts. Context identity separates
+//! warm plans; the retained proof and exact scope, not that identity, authorize use.
+
+use std::{
+    collections::BTreeMap,
+    fmt,
+    num::NonZeroU64,
+    sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    },
+};
+
+use secrecy::{ExposeSecret, SecretString};
+
+use super::{
+    ContainerPolicy, DirectoryLease, DockerError, DockerExecutorConfig, DockerGatewayEndpoint,
+    DockerReadiness, EnvironmentPort,
+};
+use crate::artifact::PinnedImage;
+
+const MAX_AUGMENTATION_BYTES: usize = 4096;
+const MAX_ENV_ENTRIES: usize = 320;
+const MAX_ENV_BYTES: usize = 80 * 1024;
+const MAX_ENV_ENTRY_BYTES: usize = 4097;
+const UNSET: [&str; 16] = [
+    "AWS_PROFILE",
+    "AWS_DEFAULT_PROFILE",
+    "AWS_SDK_LOAD_CONFIG",
+    "AWS_SESSION_TOKEN",
+    "AWS_SECURITY_TOKEN",
+    "AWS_ACCESS_KEY",
+    "AWS_SECRET_KEY",
+    "AWS_WEB_IDENTITY_TOKEN_FILE",
+    "AWS_ROLE_ARN",
+    "AWS_ROLE_SESSION_NAME",
+    "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+    "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
+    "AWS_EC2_METADATA_SERVICE_ENDPOINT",
+    "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE",
+];
+static NEXT_CONTEXT: AtomicU64 = AtomicU64::new(1);
+
+#[derive(Clone)]
+pub(super) struct LocalSdkCredentials {
+    access: SecretString,
+    secret: SecretString,
+}
+impl fmt::Debug for LocalSdkCredentials {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("LocalSdkCredentials(<redacted>)")
+    }
+}
+impl TryFrom<(String, String)> for LocalSdkCredentials {
+    type Error = DockerError;
+    fn try_from((access, secret): (String, String)) -> Result<Self, Self::Error> {
+        if !(1..=128).contains(&access.len())
+            || !access
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || b"_-".contains(&b))
+            || !(1..=256).contains(&secret.len())
+            || !secret.bytes().all(|b| (33..=126).contains(&b))
+        {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self {
+            access: access.into(),
+            secret: secret.into(),
+        })
+    }
+}
+impl LocalSdkCredentials {
+    pub(super) fn parse(
+        access: Option<String>,
+        secret: Option<String>,
+    ) -> Result<Option<Self>, DockerError> {
+        match (access, secret) {
+            (None, None) => Ok(None),
+            (Some(access), Some(secret)) => (access, secret).try_into().map(Some),
+            _ => Err(DockerError::Configuration),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct SdkAffiliation {
+    directory: DirectoryLease,
+    relay: PinnedImage,
+    policy: ContainerPolicy,
+    environments: EnvironmentPort,
+    readiness: Arc<dyn DockerReadiness>,
+}
+impl SdkAffiliation {
+    pub(super) fn new(
+        directory: DirectoryLease,
+        relay: PinnedImage,
+        policy: ContainerPolicy,
+        environments: EnvironmentPort,
+        readiness: Arc<dyn DockerReadiness>,
+    ) -> Self {
+        Self {
+            directory,
+            relay,
+            policy,
+            environments,
+            readiness,
+        }
+    }
+    pub(super) fn live(&self) -> Result<(), DockerError> {
+        self.readiness.check().map_err(|_| DockerError::Stopped)
+    }
+    fn matches(&self, config: &DockerExecutorConfig) -> bool {
+        let expected = self.relay.resolved().metadata();
+        let actual = config.relay.resolved().metadata();
+        Arc::ptr_eq(&self.readiness, &config.readiness)
+            && self.directory.same_instance(&config.directory)
+            && self.environments.same_service(&config.environments)
+            && self.policy == config.policy
+            && expected.image_id == actual.image_id
+            && expected.inspection_hash == actual.inspection_hash
+            && self.relay.is_live()
+            && config.relay.is_live()
+            && self.readiness.check().is_ok()
+    }
+}
+
+/// Opaque qualified local SDK environment; credentials never enter saved revisions.
+///
+/// Only the private startup issuer can construct this context from actual proof.
+/// Clones retain the same nonsecret warm identity and live qualification holder.
+///
+/// ```compile_fail
+/// let _ = serde_json::from_str::<rustack_lambda_core::docker::DockerSdkEnvironment>("{}");
+/// ```
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct DockerSdkEnvironment {
+    credentials: LocalSdkCredentials,
+    endpoint: DockerGatewayEndpoint,
+    affiliation: SdkAffiliation,
+    identity: NonZeroU64,
+}
+impl fmt::Debug for DockerSdkEnvironment {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DockerSdkEnvironment(<redacted>)")
+    }
+}
+impl DockerSdkEnvironment {
+    pub(super) fn new(
+        credentials: LocalSdkCredentials,
+        endpoint: DockerGatewayEndpoint,
+        affiliation: SdkAffiliation,
+    ) -> Result<Self, DockerError> {
+        affiliation
+            .readiness
+            .check()
+            .map_err(|_| DockerError::Stopped)?;
+        Ok(Self {
+            credentials,
+            endpoint,
+            affiliation,
+            identity: next_identity(&NEXT_CONTEXT)?,
+        })
+    }
+    pub(super) fn matches(&self, config: &DockerExecutorConfig) -> bool {
+        self.affiliation.matches(config)
+    }
+    pub(super) fn liveness(&self) -> SdkAffiliation {
+        self.affiliation.clone()
+    }
+    pub(super) fn identity(&self) -> NonZeroU64 {
+        self.identity
+    }
+    pub(super) fn environment(&self, entries: Vec<String>) -> Result<Vec<String>, DockerError> {
+        environment(&self.credentials, &self.endpoint, entries)
+    }
+}
+
+fn next_identity(counter: &AtomicU64) -> Result<NonZeroU64, DockerError> {
+    let value = counter
+        .try_update(Ordering::Relaxed, Ordering::Relaxed, |value| {
+            NonZeroU64::new(value).and_then(|_| value.checked_add(1))
+        })
+        .map_err(|_| DockerError::Configuration)?;
+    NonZeroU64::new(value).ok_or(DockerError::Configuration)
+}
+
+fn environment(
+    credentials: &LocalSdkCredentials,
+    endpoint: &DockerGatewayEndpoint,
+    entries: Vec<String>,
+) -> Result<Vec<String>, DockerError> {
+    if entries.len() > MAX_ENV_ENTRIES {
+        return Err(DockerError::Configuration);
+    }
+    let mut values = BTreeMap::new();
+    let mut input_bytes = 0usize;
+    for entry in entries {
+        input_bytes = add_bytes(input_bytes, entry.len(), MAX_ENV_BYTES)?;
+        if entry.len() > MAX_ENV_ENTRY_BYTES || entry.contains('\0') {
+            return Err(DockerError::Configuration);
+        }
+        let (key, value) = entry
+            .split_once('=')
+            .map_or((entry.as_str(), None), |(k, v)| (k, Some(v.to_owned())));
+        values.insert(key.to_owned(), value);
+    }
+    for (key, value) in &mut values {
+        if key.starts_with("AWS_ENDPOINT_URL_") || UNSET.contains(&key.as_str()) {
+            *value = None;
+        }
+    }
+    let fixed = [
+        ("AWS_ACCESS_KEY_ID", credentials.access.expose_secret()),
+        ("AWS_SECRET_ACCESS_KEY", credentials.secret.expose_secret()),
+        ("AWS_ENDPOINT_URL", endpoint.as_str()),
+        ("AWS_IGNORE_CONFIGURED_ENDPOINT_URLS", "false"),
+        ("AWS_EC2_METADATA_DISABLED", "true"),
+        ("AWS_CONFIG_FILE", "/dev/null"),
+        ("AWS_SHARED_CREDENTIALS_FILE", "/dev/null"),
+    ];
+    let mut augmentation = 0usize;
+    for key in UNSET {
+        augmentation = add_bytes(augmentation, key.len(), MAX_AUGMENTATION_BYTES)?;
+        values.insert(key.to_owned(), None);
+    }
+    for (key, value) in fixed {
+        let length = key
+            .len()
+            .checked_add(1)
+            .and_then(|n| n.checked_add(value.len()))
+            .ok_or(DockerError::Configuration)?;
+        augmentation = add_bytes(augmentation, length, MAX_AUGMENTATION_BYTES)?;
+        values.insert(key.to_owned(), Some(value.to_owned()));
+    }
+    if values.len() > MAX_ENV_ENTRIES {
+        return Err(DockerError::Configuration);
+    }
+    let mut output = Vec::with_capacity(values.len());
+    let mut bytes = 0usize;
+    for (key, value) in values {
+        let length = match &value {
+            Some(value) => key
+                .len()
+                .checked_add(1)
+                .and_then(|n| n.checked_add(value.len()))
+                .ok_or(DockerError::Configuration)?,
+            None => key.len(),
+        };
+        if length > MAX_ENV_ENTRY_BYTES {
+            return Err(DockerError::Configuration);
+        }
+        bytes = add_bytes(bytes, length, MAX_ENV_BYTES)?;
+        output.push(match value {
+            Some(value) => format!("{key}={value}"),
+            None => key,
+        });
+    }
+    Ok(output)
+}
+fn add_bytes(current: usize, extra: usize, maximum: usize) -> Result<usize, DockerError> {
+    current
+        .checked_add(extra)
+        .filter(|value| *value <= maximum)
+        .ok_or(DockerError::Configuration)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/sdk/tests.rs b/crates/rustack-lambda-core/src/docker/sdk/tests.rs
new file mode 100644
index 00000000..33108c7a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/sdk/tests.rs
@@ -0,0 +1,117 @@
+use rstest::rstest;
+
+use super::*;
+
+fn credentials() -> LocalSdkCredentials {
+    ("local-sdk-key".to_owned(), "private-sdk-value".to_owned())
+        .try_into()
+        .unwrap()
+}
+fn endpoint() -> DockerGatewayEndpoint {
+    "http://127.0.0.1:4566".parse().unwrap()
+}
+#[rstest]
+#[case("", "value")]
+#[case("key", "")]
+#[case("bad/key", "value")]
+#[case("bad key", "value")]
+#[case("é", "value")]
+#[case("key", "bad value")]
+#[case("key", "bad\nvalue")]
+#[case("key", "bad\0value")]
+#[case("key", "é")]
+fn test_should_reject_invalid_sdk_credentials(#[case] access: &str, #[case] secret: &str) {
+    assert!(LocalSdkCredentials::try_from((access.into(), secret.into())).is_err());
+}
+#[test]
+fn test_should_bound_pair_and_never_fabricate_a_partial_sdk_pair() {
+    assert!(LocalSdkCredentials::parse(None, None).unwrap().is_none());
+    assert!(LocalSdkCredentials::parse(Some("key".into()), None).is_err());
+    assert!(LocalSdkCredentials::parse(None, Some("secret".into())).is_err());
+    for (access, secret, accepted) in [
+        ("k".repeat(128), "s".repeat(256), true),
+        ("k".repeat(129), "s".into(), false),
+        ("k".into(), "s".repeat(257), false),
+    ] {
+        assert_eq!(
+            LocalSdkCredentials::try_from((access, secret)).is_ok(),
+            accepted
+        );
+    }
+    let value = credentials();
+    assert_eq!(format!("{value:?}"), "LocalSdkCredentials(<redacted>)");
+}
+#[test]
+fn test_should_allocate_checked_nonzero_context_ids_without_reuse_or_wrap() {
+    let counter = AtomicU64::new(1);
+    assert_eq!(next_identity(&counter).unwrap().get(), 1);
+    assert_eq!(next_identity(&counter).unwrap().get(), 2);
+    for invalid in [0, u64::MAX] {
+        let counter = AtomicU64::new(invalid);
+        assert!(next_identity(&counter).is_err());
+        assert_eq!(counter.load(Ordering::Relaxed), invalid);
+    }
+}
+#[test]
+fn test_should_override_sdk_values_and_retain_all_explicit_unset_markers() {
+    let mut entries = vec![
+        "BUSINESS=preserved".into(),
+        "AWS_ACCESS_KEY_ID=poison".into(),
+        "AWS_SECRET_ACCESS_KEY=poison".into(),
+        "AWS_ENDPOINT_URL=http://127.0.0.1:9".into(),
+        "AWS_ENDPOINT_URL_S3=http://127.0.0.1:9".into(),
+        "AWS_ENDPOINT_URL_DYNAMODB=http://127.0.0.1:9".into(),
+        "AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true".into(),
+    ];
+    entries.extend(UNSET.map(|key| format!("{key}=poison")));
+    let result = environment(&credentials(), &endpoint(), entries).unwrap();
+    for key in UNSET
+        .into_iter()
+        .chain(["AWS_ENDPOINT_URL_S3", "AWS_ENDPOINT_URL_DYNAMODB"])
+    {
+        assert_eq!(
+            result
+                .iter()
+                .filter(|entry| entry.split('=').next() == Some(key))
+                .collect::<Vec<_>>(),
+            vec![key]
+        );
+    }
+    for expected in [
+        "BUSINESS=preserved",
+        "AWS_ACCESS_KEY_ID=local-sdk-key",
+        "AWS_SECRET_ACCESS_KEY=private-sdk-value",
+        "AWS_ENDPOINT_URL=http://127.0.0.1:4566/",
+        "AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=false",
+        "AWS_EC2_METADATA_DISABLED=true",
+        "AWS_CONFIG_FILE=/dev/null",
+        "AWS_SHARED_CREDENTIALS_FILE=/dev/null",
+    ] {
+        assert!(result.iter().any(|entry| entry == expected), "{expected}");
+    }
+    assert!(result.windows(2).all(|pair| pair.first() < pair.get(1)));
+    assert!(result.iter().all(|entry| !entry.contains("poison")));
+}
+#[test]
+fn test_should_preserve_maximum_valid_user_entry_and_bound_final_sdk_environment() {
+    let maximum = format!("ZZ={}", "v".repeat(4094));
+    let result = environment(&credentials(), &endpoint(), vec![maximum.clone()]).unwrap();
+    assert!(result.contains(&maximum));
+    for entries in [
+        vec!["x".repeat(MAX_ENV_ENTRY_BYTES + 1)],
+        (0..21)
+            .map(|i| format!("KEY_{i}={}", "v".repeat(4090)))
+            .collect(),
+        (0..298).map(|i| format!("KEY_{i}=v")).collect(),
+        vec!["AA=bad\0value".into()],
+    ] {
+        assert!(environment(&credentials(), &endpoint(), entries).is_err());
+    }
+    let result = environment(
+        &credentials(),
+        &endpoint(),
+        (0..297).map(|i| format!("KEY_{i}=v")).collect(),
+    )
+    .unwrap();
+    assert_eq!(result.len(), MAX_ENV_ENTRIES);
+}
diff --git a/crates/rustack-lambda-core/src/docker/startup.rs b/crates/rustack-lambda-core/src/docker/startup.rs
new file mode 100644
index 00000000..fac34b2a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/startup.rs
@@ -0,0 +1,499 @@
+//! Actual startup receipts and one ordered cleanup owner, never request-supplied readiness.
+
+mod qualify;
+use std::{
+    fmt,
+    path::PathBuf,
+    sync::{
+        Arc, OnceLock,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use serde::Serialize;
+use thiserror::Error;
+use tokio::{
+    runtime::Handle,
+    sync::{Semaphore, SemaphorePermit},
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+
+use super::{
+    CodeVolumeManager, DirectoryLease, DirectoryLeaseError, DockerCpuAllocation, DockerError,
+    DockerExecutor, DockerExecutorError, DockerPort, DockerReadiness, DockerRuntimeSettings,
+    DockerSdkEnvironment, DockerWire, DockerZipRuntime, EndpointProbe, EndpointProbeConfig,
+    EnvironmentCapacity, EnvironmentError, EnvironmentManager, EnvironmentProbe,
+    EnvironmentProbeConfig, EnvironmentProbeError, GatewayInstanceId, ImageLeaseManager,
+    ImageLeasePort, RegistryAuthError,
+    ownership::{DataDirectory, DirectoryAcquisition},
+    sdk::{LocalSdkCredentials, SdkAffiliation},
+};
+use crate::{
+    artifact::{Architecture, PinnedImage},
+    config::LambdaConfig,
+    deployment::ImageDeploymentConfig,
+    error::LambdaServiceError,
+    executor::{Executor, ExecutorBackend, ExecutorError},
+    invocation::CleanupTask,
+    provider::RustackLambda,
+    storage::FunctionStore,
+};
+
+static STARTUPS: Semaphore = Semaphore::const_new(4);
+
+/// Static startup errors retain typed sources without displaying operator values.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum DockerStartupError {
+    /// Invalid or mismatching operator inputs.
+    #[error("invalid Docker startup configuration")]
+    Configuration,
+    /// This attempt was already begun, failed, abandoned or stopped.
+    #[error("Docker startup attempt is unavailable")]
+    Unavailable,
+    /// Global startup or cleanup observation expired.
+    #[error("Docker startup observation deadline exceeded")]
+    Deadline,
+    /// Current runtime or bounded startup admission is unavailable.
+    #[error("Docker startup supervision unavailable")]
+    Worker,
+    /// Unsafe, legacy, busy or damaged namespace.
+    #[error("Docker startup ownership failed")]
+    Directory(#[source] Arc<DirectoryLeaseError>),
+    /// Bounded daemon or image failure.
+    #[error("Docker startup daemon failed: {0}")]
+    Docker(#[from] DockerError),
+    /// The selected relay could not be prepared.
+    #[error("Docker startup relay preparation failed: {0}")]
+    Relay(#[source] DockerError),
+    /// The configured endpoint failed its actual container-origin proof.
+    #[error("Docker startup endpoint qualification failed: {0}")]
+    Endpoint(#[source] EnvironmentProbeError),
+    /// Actual resource qualification failed.
+    #[error("Docker startup probe failed: {0}")]
+    Probe(#[from] EnvironmentProbeError),
+    /// Retained runtime allocation failed.
+    #[error("Docker startup environment failed: {0}")]
+    Environment(#[from] EnvironmentError),
+    /// Private credential loading failed.
+    #[error("Docker startup credentials failed: {0}")]
+    Credentials(#[from] RegistryAuthError),
+    /// Executor/provider construction failed.
+    #[error("Docker startup installation failed")]
+    Installation(#[source] Arc<LambdaServiceError>),
+    /// Runtime graph has not confirmed physical cleanup.
+    #[error("Docker runtime cleanup is not confirmed")]
+    Cleanup(#[source] ExecutorError),
+}
+impl From<DirectoryLeaseError> for DockerStartupError {
+    fn from(error: DirectoryLeaseError) -> Self {
+        Self::Directory(Arc::new(error))
+    }
+}
+impl From<DockerExecutorError> for DockerStartupError {
+    fn from(error: DockerExecutorError) -> Self {
+        Self::Cleanup(error.into())
+    }
+}
+
+/// Validated immutable production settings, including the exact provider configuration.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct DockerStartupConfig {
+    settings: DockerRuntimeSettings,
+    directory: PathBuf,
+    instance: GatewayInstanceId,
+    lambda: LambdaConfig,
+}
+impl fmt::Debug for DockerStartupConfig {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DockerStartupConfig(<redacted>)")
+    }
+}
+impl DockerStartupConfig {
+    /// Validate one selected image runtime before any listener or filesystem IO.
+    /// # Errors
+    /// Rejects non-Docker settings, invalid directory, init/idle/warm limits or a
+    /// configured endpoint paired with disconnected networking.
+    /// ```no_run
+    /// # fn config(settings:rustack_lambda_core::docker::DockerRuntimeSettings,lambda:rustack_lambda_core::config::LambdaConfig,id:rustack_lambda_core::docker::GatewayInstanceId)->Result<(),rustack_lambda_core::docker::DockerStartupError>{
+    /// let config=rustack_lambda_core::docker::DockerStartupConfig::new(settings,"/private/data".into(),id,lambda)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        settings: DockerRuntimeSettings,
+        directory: PathBuf,
+        instance: GatewayInstanceId,
+        lambda: LambdaConfig,
+    ) -> Result<Self, DockerStartupError> {
+        DataDirectory::try_from(directory.clone())?;
+        if settings.zip_image().is_some() && settings.budgets().lambda_docker_image_pins < 2 {
+            return Err(DockerStartupError::Configuration);
+        }
+
+        if lambda.executor != ExecutorBackend::Docker
+            || lambda.max_warm_instances != 1
+            || lambda.init_timeout.subsec_nanos() != 0
+            || !(1..=900).contains(&lambda.init_timeout.as_secs())
+            || lambda.idle_timeout != settings.container_policy().idle()
+            || (settings.gateway_endpoint().is_some()
+                && settings.container_policy().network.value() == "none")
+        {
+            return Err(DockerStartupError::Configuration);
+        }
+        Ok(Self {
+            settings,
+            directory,
+            instance,
+            lambda,
+        })
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Phase {
+    New,
+    Qualifying,
+    Ready,
+    Failed,
+    Stopping,
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Evidence {
+    base: EnvironmentProbeConfig,
+    resource: EnvironmentProbe,
+    endpoint: Option<(EndpointProbeConfig, EndpointProbe)>,
+    images: ImageLeasePort,
+    docker: DockerPort,
+    architecture: Architecture,
+    #[builder(default)]
+    zip: Option<DockerZipRuntime>,
+}
+#[derive(Debug, Default)]
+struct Qualification {
+    installed: AtomicBool,
+    revoked: AtomicBool,
+    evidence: OnceLock<Evidence>,
+}
+impl Qualification {
+    fn sdk_environment(
+        self: &Arc<Self>,
+        credentials: LocalSdkCredentials,
+    ) -> Result<DockerSdkEnvironment, DockerStartupError> {
+        self.check().map_err(|_| DockerStartupError::Unavailable)?;
+        let evidence = self.evidence.get().ok_or(DockerStartupError::Unavailable)?;
+        let (endpoint, _) = evidence
+            .endpoint
+            .as_ref()
+            .ok_or(DockerStartupError::Configuration)?;
+        let readiness: Arc<dyn DockerReadiness> = self.clone();
+        Ok(DockerSdkEnvironment::new(
+            credentials,
+            endpoint.gateway_endpoint().clone(),
+            SdkAffiliation::new(
+                evidence.base.directory.clone(),
+                evidence.base.relay.clone(),
+                evidence.base.policy.clone(),
+                evidence.base.environments.clone(),
+                readiness,
+            ),
+        )?)
+    }
+}
+impl DockerReadiness for Qualification {
+    fn check(&self) -> Result<(), DockerExecutorError> {
+        if self.revoked.load(Ordering::Acquire) {
+            return Err(DockerExecutorError::Unavailable);
+        }
+        let evidence = self
+            .evidence
+            .get()
+            .ok_or(DockerExecutorError::Unavailable)?;
+        let environment = evidence.base.environments.status();
+        if evidence.base.directory.require_journaled().is_err()
+            || evidence
+                .docker
+                .require_directory(&evidence.base.directory)
+                .is_err()
+            || *evidence.docker.raw.stop.borrow()
+            || evidence.images.available().is_err()
+            || evidence
+                .zip
+                .as_ref()
+                .is_some_and(|zip| zip.available().is_err())
+            || !environment.accepting
+            || environment.worker_failed
+            || !evidence.resource.matches(&evidence.base)
+            || evidence
+                .endpoint
+                .as_ref()
+                .is_some_and(|(config, proof)| !proof.matches(config))
+        {
+            return Err(DockerExecutorError::Unavailable);
+        }
+        Ok(())
+    }
+}
+
+/// Read-only live backend diagnostics; cloning never transfers shutdown authority.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct DockerRuntimeStatus(Arc<Qualification>);
+/// Bounded capability data, separate from private startup receipts.
+#[derive(Debug, Clone, Copy, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+pub struct DockerCapabilities {
+    /// Requested/effective CPU pair from retained kernel-qualified policy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cpu: Option<DockerCpuAllocation>,
+    /// Actual retained allocation/memory charges, absent before qualification.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capacity: Option<EnvironmentCapacity>,
+    /// Actual installed owner health and receipt validity.
+    pub ready: bool,
+    /// Qualified Linux platform, absent before successful qualification.
+    pub platform: Option<&'static str>,
+    /// Whether a configured gateway passed the actual endpoint proof.
+    pub sdk_gateway: bool,
+    /// Qualified provided.al2023 execution through the installed code owner.
+    pub zip: bool,
+}
+impl DockerRuntimeStatus {
+    /// Observe current receipt/owner health without IO or peer data.
+    /// ```no_run
+    /// # fn status(status:&rustack_lambda_core::docker::DockerRuntimeStatus){let capabilities=status.capabilities();}
+    /// ```
+    #[must_use]
+    pub fn capabilities(&self) -> DockerCapabilities {
+        let evidence = self.0.evidence.get();
+        DockerCapabilities {
+            cpu: evidence.map(|evidence| evidence.base.policy.cpu_allocation()),
+            capacity: evidence.map(|evidence| evidence.base.environments.status()),
+            ready: self.0.installed.load(Ordering::Acquire) && self.0.check().is_ok(),
+            platform: evidence.map(|e| match e.architecture {
+                Architecture::Arm64 => "linux/arm64",
+                Architecture::X86_64 => "linux/amd64",
+            }),
+            sdk_gateway: evidence.is_some_and(|e| e.endpoint.is_some()),
+            zip: self.0.installed.load(Ordering::Acquire)
+                && self.0.check().is_ok()
+                && evidence.is_some_and(|e| e.zip.is_some()),
+        }
+    }
+}
+
+/// Qualified provider installation, issued only by the private startup owner.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct DockerInstallation {
+    lambda: LambdaConfig,
+    executor: Arc<DockerExecutor>,
+    images: ImageLeasePort,
+    deployment: ImageDeploymentConfig,
+}
+impl fmt::Debug for DockerInstallation {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DockerInstallation(<retained>)")
+    }
+}
+impl DockerInstallation {
+    /// Install the exact validated provider over its real executor and image owner.
+    /// # Errors
+    /// Rejects revoked startup evidence or failed deployment construction.
+    /// ```no_run
+    /// # fn install(installation:&rustack_lambda_core::docker::DockerInstallation,store:rustack_lambda_core::storage::FunctionStore)->Result<(),rustack_lambda_core::docker::DockerStartupError>{
+    /// let provider=installation.provider(store)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn provider(&self, store: FunctionStore) -> Result<RustackLambda, DockerStartupError> {
+        self.executor
+            .image_available()
+            .map_err(DockerStartupError::Cleanup)?;
+        RustackLambda::with_executor(store, self.lambda.clone(), self.executor.clone())
+            .with_image_preparation(self.images.clone(), self.deployment)
+            .map_err(|error| DockerStartupError::Installation(Arc::new(error)))
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+struct State {
+    config: DockerStartupConfig,
+    _admission: SemaphorePermit<'static>,
+    #[builder(default)]
+    directory: Option<DirectoryLease>,
+    #[builder(default)]
+    acquiring: Option<DirectoryAcquisition>,
+    #[builder(default)]
+    connecting: Option<JoinHandle<Result<DockerWire, DockerError>>>,
+    #[builder(default)]
+    fault: Option<ExecutorError>,
+    #[builder(default)]
+    wire: Option<DockerWire>,
+    #[builder(default)]
+    bound: Option<DockerPort>,
+    #[builder(default)]
+    producing: bool,
+    #[builder(default)]
+    images: Option<ImageLeaseManager>,
+    #[builder(default)]
+    code: Option<CodeVolumeManager>,
+    #[builder(default)]
+    zip: Option<DockerZipRuntime>,
+    #[builder(default)]
+    environments: Option<EnvironmentManager>,
+    #[builder(default)]
+    relay: Option<PinnedImage>,
+    #[builder(default)]
+    executor: Option<Arc<DockerExecutor>>,
+}
+/// Unique startup/shutdown authority for the exact production runtime graph.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct DockerRuntime {
+    state: Option<State>,
+    phase: Phase,
+    qualification: Arc<Qualification>,
+    runtime: Handle,
+    cleanup: CleanupTask,
+}
+impl DockerRuntime {
+    /// Reserve a bounded startup owner without IO; qualification is one attempt.
+    /// # Errors
+    /// Rejects absent runtime or four already-retained runtime owners.
+    /// ```no_run
+    /// # fn begin(config:rustack_lambda_core::docker::DockerStartupConfig)->Result<(),rustack_lambda_core::docker::DockerStartupError>{
+    /// let owner=rustack_lambda_core::docker::DockerRuntime::new(config)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(config: DockerStartupConfig) -> Result<Self, DockerStartupError> {
+        let runtime = Handle::try_current().map_err(|_| DockerStartupError::Worker)?;
+        let admission = STARTUPS
+            .try_acquire()
+            .map_err(|_| DockerStartupError::Worker)?;
+        Ok(Self {
+            state: Some(
+                State::builder()
+                    .config(config)
+                    ._admission(admission)
+                    .build(),
+            ),
+            phase: Phase::New,
+            qualification: Arc::new(Qualification::default()),
+            runtime,
+            cleanup: CleanupTask::default(),
+        })
+    }
+    /// Consume actual receipts once under the supplied absolute process deadline.
+    /// # Errors
+    /// Returns typed qualification failure. Dropping this observer cannot replay
+    /// the attempt; retain this owner for shutdown, or Drop starts that same cleanup.
+    /// ```no_run
+    /// # async fn qualify(owner:&mut rustack_lambda_core::docker::DockerRuntime){
+    /// let result=owner.qualify(tokio::time::Instant::now()+std::time::Duration::from_secs(600)).await;
+    /// # }
+    /// ```
+    pub async fn qualify(&mut self, deadline: Instant) -> Result<(), DockerStartupError> {
+        if self.phase != Phase::New {
+            return Err(DockerStartupError::Unavailable);
+        }
+        qualify::deadline(deadline)?;
+        self.phase = Phase::Qualifying;
+        let state = self.state.as_mut().ok_or(DockerStartupError::Unavailable)?;
+        let result = Box::pin(state.qualify(&self.qualification, deadline)).await;
+        self.phase = if result.is_ok() {
+            self.qualification.installed.store(true, Ordering::Release);
+            Phase::Ready
+        } else {
+            self.qualification.revoked.store(true, Ordering::Release);
+            Phase::Failed
+        };
+        result
+    }
+    /// Obtain a qualified installation without granting alternate configuration.
+    /// # Errors
+    /// Rejects incomplete, failed, abandoned, stopped or revoked qualification.
+    /// ```no_run
+    /// # fn installation(owner:&rustack_lambda_core::docker::DockerRuntime){let installation=owner.installation();}
+    /// ```
+    pub fn installation(&self) -> Result<DockerInstallation, DockerStartupError> {
+        if self.phase != Phase::Ready {
+            return Err(DockerStartupError::Unavailable);
+        }
+        self.qualification
+            .check()
+            .map_err(|_| DockerStartupError::Unavailable)?;
+        let state = self.state.as_ref().ok_or(DockerStartupError::Unavailable)?;
+        let budgets = state.config.settings.budgets();
+        Ok(DockerInstallation {
+            lambda: state.config.lambda.clone(),
+            executor: state
+                .executor
+                .as_ref()
+                .ok_or(DockerStartupError::Unavailable)?
+                .clone(),
+            images: state
+                .images
+                .as_ref()
+                .ok_or(DockerStartupError::Unavailable)?
+                .port(),
+            deployment: ImageDeploymentConfig::new(
+                budgets
+                    .lambda_docker_deployment_jobs
+                    .try_into()
+                    .map_err(|_| DockerStartupError::Configuration)?,
+                Duration::from_secs(budgets.lambda_docker_deployment_seconds),
+            )
+            .map_err(|error| DockerStartupError::Installation(Arc::new(error)))?,
+        })
+    }
+    /// Retain live read-only capability observations, without startup authority.
+    /// ```no_run
+    /// # fn status(owner:&rustack_lambda_core::docker::DockerRuntime){let status=owner.status();}
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> DockerRuntimeStatus {
+        DockerRuntimeStatus(self.qualification.clone())
+    }
+    fn start_cleanup(&mut self) {
+        self.phase = Phase::Stopping;
+        self.qualification.revoked.store(true, Ordering::Release);
+        if let Some(state) = self.state.take() {
+            self.cleanup
+                .start_on(&self.runtime, move || state.cleanup());
+        }
+    }
+    /// Revoke admission and observe the same retained ordered cleanup operation.
+    /// # Errors
+    /// Returns expiry or failed cleanup observation without releasing unresolved
+    /// ownership. A later call resumes observation; Drop keeps that operation alive.
+    /// ```no_run
+    /// # async fn stop(owner:&mut rustack_lambda_core::docker::DockerRuntime){let result=owner.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(30)).await;}
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), DockerStartupError> {
+        self.start_cleanup();
+        if Instant::now() >= deadline {
+            return Err(DockerStartupError::Deadline);
+        }
+        timeout_at(deadline, self.cleanup.wait())
+            .await
+            .map_err(|_| DockerStartupError::Deadline)?
+            .map_err(DockerStartupError::Cleanup)?;
+        if Instant::now() >= deadline {
+            return Err(DockerStartupError::Deadline);
+        }
+        Ok(())
+    }
+}
+impl Drop for DockerRuntime {
+    fn drop(&mut self) {
+        self.start_cleanup();
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/startup/qualify.rs b/crates/rustack-lambda-core/src/docker/startup/qualify.rs
new file mode 100644
index 00000000..e96c4253
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/startup/qualify.rs
@@ -0,0 +1,496 @@
+//! Dependency-ordered qualification and physical reverse-order retirement.
+
+use std::{env::consts::ARCH, sync::Arc, time::Duration};
+
+use tokio::time::{Instant, sleep, timeout_at};
+
+use super::{DockerStartupError, Evidence, Qualification, State};
+use crate::{
+    artifact::{Architecture, PinnedImage},
+    docker::{
+        CodeVolumeConfig, CodeVolumeManager, DirectoryLease, DockerError, DockerExecutor,
+        DockerExecutorConfig, DockerExecutorError, DockerExecutorSettings, DockerPort,
+        DockerReadiness, DockerWire, DockerZipRuntime, EndpointProbeConfig, EnvironmentManager,
+        EnvironmentProbeConfig, EnvironmentSettings, ImageLeaseConfig, ImageLeaseManager,
+        ImageLeasePort, ImagePinScope, PoolSettings, ProbeSettings,
+        code_volume::validate_base,
+        ownership::DirectoryAcquisition,
+        probe_endpoint, probe_environment, reconcile_namespace,
+        recovery::inventory::{containers, images, volumes},
+    },
+    executor::{Executor, ExecutorError},
+};
+
+pub(super) fn deadline(at: Instant) -> Result<(), DockerStartupError> {
+    let remaining = at
+        .checked_duration_since(Instant::now())
+        .ok_or(DockerStartupError::Deadline)?;
+    if remaining.is_zero() {
+        return Err(DockerStartupError::Deadline);
+    }
+    if remaining > Duration::from_secs(3600) {
+        return Err(DockerStartupError::Configuration);
+    }
+    Ok(())
+}
+fn step(at: Instant, seconds: u64) -> Instant {
+    at.min(Instant::now() + Duration::from_secs(seconds))
+}
+
+#[derive(Debug)]
+struct PreparedImages {
+    directory: DirectoryLease,
+    docker: DockerPort,
+    architecture: Architecture,
+    images: ImageLeasePort,
+    relay: PinnedImage,
+}
+
+impl State {
+    async fn acquire_directory(
+        &mut self,
+        at: Instant,
+    ) -> Result<DirectoryLease, DockerStartupError> {
+        self.acquiring = Some(if self.config.settings.zip_image().is_some() {
+            DirectoryAcquisition::begin_code(self.config.directory.clone(), step(at, 60))?
+        } else {
+            DirectoryAcquisition::begin(self.config.directory.clone(), step(at, 60))?
+        });
+        let acquired = self
+            .acquiring
+            .as_mut()
+            .ok_or(DockerStartupError::Unavailable)?
+            .wait(at)
+            .await?;
+        self.acquiring.take();
+        self.directory = Some(acquired?);
+        let directory = self
+            .directory
+            .as_ref()
+            .ok_or(DockerStartupError::Unavailable)?
+            .clone();
+        directory.require_journaled()?;
+        Ok(directory)
+    }
+    async fn prepare_images(&mut self, at: Instant) -> Result<PreparedImages, DockerStartupError> {
+        let settings = self.config.settings.clone();
+        let budgets = settings.budgets();
+        let directory = self.acquire_directory(at).await?;
+        self.connecting = Some(tokio::spawn(DockerWire::connect(
+            settings.socket().clone(),
+            step(at, budgets.lambda_docker_io_seconds),
+        )));
+        let connected = timeout_at(
+            at,
+            self.connecting
+                .as_mut()
+                .ok_or(DockerStartupError::Unavailable)?,
+        )
+        .await
+        .map_err(|_| DockerStartupError::Deadline)?;
+        self.connecting.take();
+        self.wire = Some(connected.map_err(|_| DockerStartupError::Worker)??);
+        let docker = self
+            .wire
+            .as_ref()
+            .ok_or(DockerStartupError::Unavailable)?
+            .port()
+            .bind_directory(&directory, step(at, budgets.lambda_docker_io_seconds))
+            .await?;
+        self.bound = Some(docker.clone());
+        let recovery = reconcile_namespace(&directory, &docker, step(at, 60)).await?;
+        if recovery.containers.remaining != 0
+            || recovery.pins.remaining != 0
+            || recovery.code.remaining != 0
+        {
+            return Err(DockerError::Quarantined.into());
+        }
+        let info = docker
+            .info(step(at, budgets.lambda_docker_io_seconds))
+            .await?;
+        let architecture = platform(
+            info.os_type.as_deref(),
+            info.architecture.as_deref(),
+            settings.cross_architecture(),
+        )?;
+        let pull = settings.load_pull_policy(step(at, 60)).await?;
+        self.producing = true;
+        self.images = Some(ImageLeaseManager::start_qualified(
+            docker.clone(),
+            ImagePinScope::new(directory.clone()),
+            ImageLeaseConfig::new(
+                budgets
+                    .lambda_docker_image_pins
+                    .try_into()
+                    .map_err(|_| DockerStartupError::Configuration)?,
+                budgets
+                    .lambda_docker_deployment_jobs
+                    .try_into()
+                    .map_err(|_| DockerStartupError::Configuration)?,
+                Duration::from_secs(budgets.lambda_docker_io_seconds),
+            )?,
+            pull,
+            architecture,
+        )?);
+        let images = self
+            .images
+            .as_ref()
+            .ok_or(DockerStartupError::Unavailable)?
+            .port();
+        self.relay = Some(
+            images
+                .prepare(
+                    settings.relay_image(),
+                    architecture,
+                    None,
+                    step(at, budgets.lambda_docker_deployment_seconds),
+                )
+                .await
+                .map_err(DockerStartupError::Relay)?,
+        );
+        let relay = self
+            .relay
+            .as_ref()
+            .ok_or(DockerStartupError::Unavailable)?
+            .clone();
+        Ok(PreparedImages {
+            directory,
+            docker,
+            architecture,
+            images,
+            relay,
+        })
+    }
+    async fn prepare_zip(
+        &mut self,
+        prepared: &PreparedImages,
+        at: Instant,
+    ) -> Result<(), DockerStartupError> {
+        let settings = self.config.settings.clone();
+        let budgets = settings.budgets();
+        if let Some(reference) = settings.zip_image() {
+            let base = prepared
+                .images
+                .prepare(
+                    reference,
+                    prepared.architecture,
+                    None,
+                    step(at, budgets.lambda_docker_deployment_seconds),
+                )
+                .await?;
+            validate_base(
+                &base,
+                &prepared.docker,
+                step(at, budgets.lambda_docker_io_seconds),
+            )
+            .await?;
+            let volumes: u8 = budgets
+                .lambda_docker_environments
+                .try_into()
+                .map_err(|_| DockerStartupError::Configuration)?;
+            self.code = Some(CodeVolumeManager::start(
+                prepared.docker.clone(),
+                prepared.directory.clone(),
+                CodeVolumeConfig::new(
+                    volumes,
+                    volumes.min(2),
+                    Duration::from_secs(budgets.lambda_docker_io_seconds),
+                    Duration::from_secs(budgets.lambda_docker_code_upload_seconds),
+                )?,
+            )?);
+            self.zip = Some(DockerZipRuntime::new(
+                &prepared.directory,
+                base,
+                self.code
+                    .as_ref()
+                    .ok_or(DockerStartupError::Unavailable)?
+                    .port(),
+            )?);
+        }
+        Ok(())
+    }
+    async fn prepare_probe(
+        &mut self,
+        prepared: &PreparedImages,
+        at: Instant,
+    ) -> Result<EnvironmentProbeConfig, DockerStartupError> {
+        let settings = self.config.settings.clone();
+        let budgets = settings.budgets();
+        let directory = prepared.directory.clone();
+        let docker = prepared.docker.clone();
+        let relay = prepared.relay.clone();
+        let network = settings
+            .container_policy()
+            .network
+            .qualify(&docker, step(at, budgets.lambda_docker_io_seconds))
+            .await?;
+        let policy = network.apply(settings.container_policy())?;
+        self.environments = Some(EnvironmentManager::start(
+            docker.clone(),
+            directory.clone(),
+            EnvironmentSettings::builder()
+                .environments(
+                    budgets
+                        .lambda_docker_environments
+                        .try_into()
+                        .map_err(|_| DockerStartupError::Configuration)?,
+                )
+                .memory_bytes(budgets.lambda_docker_memory_bytes)
+                .io(Duration::from_secs(budgets.lambda_docker_io_seconds))
+                .start(Duration::from_secs(budgets.lambda_docker_start_seconds))
+                .init(self.config.lambda.init_timeout)
+                .idle(self.config.lambda.idle_timeout)
+                .log_ring_bytes(settings.log_ring_bytes())
+                .build()
+                .try_into()?,
+        )?);
+        let environments = self
+            .environments
+            .as_ref()
+            .ok_or(DockerStartupError::Unavailable)?
+            .port();
+        let base = EnvironmentProbeConfig::builder()
+            .directory(directory.clone())
+            .relay(relay.clone())
+            .environments(environments.clone())
+            .policy(policy.clone())
+            .network(network)
+            .settings(ProbeSettings::new(
+                Duration::from_secs(budgets.lambda_docker_start_seconds),
+                Duration::from_secs(budgets.lambda_docker_cleanup_seconds),
+            )?)
+            .build();
+        Ok(base)
+    }
+    pub(super) async fn qualify(
+        &mut self,
+        qualification: &Arc<Qualification>,
+        at: Instant,
+    ) -> Result<(), DockerStartupError> {
+        let prepared = self.prepare_images(at).await?;
+        self.prepare_zip(&prepared, at).await?;
+        let base = self.prepare_probe(&prepared, at).await?;
+        let settings = self.config.settings.clone();
+        let budgets = settings.budgets();
+        let resource = probe_environment(base.clone(), at).await?;
+        let endpoint = if let Some(endpoint) = settings.gateway_endpoint() {
+            let config = EndpointProbeConfig::new(
+                base.clone(),
+                resource.clone(),
+                endpoint.clone(),
+                self.config.instance,
+            )
+            .map_err(DockerStartupError::Endpoint)?;
+            let proof = probe_endpoint(config.clone(), at)
+                .await
+                .map_err(DockerStartupError::Endpoint)?;
+            Some((config, proof))
+        } else {
+            None
+        };
+        deadline(at)?;
+        let evidence = Evidence::builder()
+            .base(base.clone())
+            .resource(resource)
+            .endpoint(endpoint)
+            .images(prepared.images)
+            .docker(prepared.docker)
+            .architecture(prepared.architecture)
+            .zip(self.zip.clone())
+            .build();
+        qualification
+            .evidence
+            .set(evidence)
+            .map_err(|_| DockerStartupError::Unavailable)?;
+        // Installing the exact proof is separate from constructing dispatch. The
+        // final live/clock fence still precedes any installation publication.
+        qualification
+            .check()
+            .map_err(|_| DockerStartupError::Unavailable)?;
+        self.executor = Some(Arc::new(DockerExecutor::new(
+            DockerExecutorConfig::builder()
+                .directory(base.directory)
+                .relay(base.relay)
+                .policy(base.policy)
+                .environments(base.environments)
+                .readiness(qualification.clone())
+                .zip(self.zip.clone())
+                .sdk(
+                    settings
+                        .sdk_credentials()
+                        .cloned()
+                        .map(|credentials| qualification.sdk_environment(credentials))
+                        .transpose()?,
+                )
+                .settings(DockerExecutorSettings::new(
+                    PoolSettings::builder()
+                        .warm(
+                            budgets
+                                .lambda_docker_environments
+                                .try_into()
+                                .map_err(|_| DockerStartupError::Configuration)?,
+                        )
+                        .warm_per_revision(
+                            self.config
+                                .lambda
+                                .max_warm_instances
+                                .try_into()
+                                .map_err(|_| DockerStartupError::Configuration)?,
+                        )
+                        .build()
+                        .try_into()?,
+                    Duration::from_secs(budgets.lambda_docker_cleanup_seconds),
+                )?)
+                .build(),
+        )?));
+        deadline(at)?;
+        qualification
+            .check()
+            .map_err(|_| DockerStartupError::Unavailable)
+    }
+    pub(super) async fn cleanup(mut self) -> Result<(), ExecutorError> {
+        let mut delay = Duration::from_secs(1);
+        loop {
+            if self.cleanup_attempt().await.is_ok() {
+                return match self.fault.take() {
+                    Some(error) => Err(error),
+                    None => Ok(()),
+                };
+            }
+            tracing::warn!("Docker cleanup remains owned; retrying without releasing namespace");
+            sleep(delay).await;
+            delay = delay.saturating_mul(2).min(Duration::from_secs(30));
+        }
+    }
+    fn retain_fault(&mut self, error: DockerStartupError) {
+        self.fault
+            .get_or_insert_with(|| DockerExecutorError::Owner(Arc::new(error)).into());
+    }
+    async fn pending(&mut self) -> Result<(), DockerStartupError> {
+        if let Some(acquiring) = &mut self.acquiring {
+            acquiring.cancel();
+            let result = acquiring
+                .wait(Instant::now() + Duration::from_secs(60))
+                .await?;
+            self.acquiring.take();
+            if let Ok(directory) = result {
+                self.directory = Some(directory);
+            }
+        }
+        if let Some(connecting) = &mut self.connecting {
+            let result = timeout_at(Instant::now() + Duration::from_secs(60), connecting)
+                .await
+                .map_err(|_| DockerStartupError::Deadline)?;
+            self.connecting.take();
+            match result {
+                Ok(Ok(wire)) => self.wire = Some(wire),
+                Ok(Err(_)) => {}
+                Err(_) => self.retain_fault(DockerStartupError::Worker),
+            }
+        }
+        Ok(())
+    }
+    async fn cleanup_attempt(&mut self) -> Result<(), DockerStartupError> {
+        self.pending().await?;
+        if let Some(executor) = &self.executor {
+            let result = executor.shutdown().await;
+            let settled = executor.physically_settled();
+            if let Err(error) = result {
+                self.retain_fault(DockerStartupError::Cleanup(error));
+            }
+            if !settled {
+                return Err(DockerStartupError::Unavailable);
+            }
+        }
+        if let Some(environments) = &mut self.environments {
+            let result = environments
+                .shutdown(Instant::now() + Duration::from_secs(60))
+                .await;
+            let settled = environments.physically_settled();
+            if let Err(error) = result {
+                self.retain_fault(error.into());
+            }
+            if !settled {
+                return Err(DockerStartupError::Unavailable);
+            }
+        }
+        if let Some(code) = &mut self.code {
+            let result = code
+                .shutdown(Instant::now() + Duration::from_secs(60))
+                .await;
+            let settled = code.physically_settled();
+            if let Err(error) = result {
+                self.retain_fault(error.into());
+            }
+            if !settled {
+                return Err(DockerStartupError::Unavailable);
+            }
+        }
+        if let Some(images) = &mut self.images {
+            let result = images
+                .shutdown(Instant::now() + Duration::from_secs(60))
+                .await;
+            let settled = images.physically_settled();
+            if let Err(error) = result {
+                self.retain_fault(error.into());
+            }
+            if !settled {
+                return Err(DockerStartupError::Unavailable);
+            }
+        }
+        if self.producing {
+            let directory = self
+                .directory
+                .as_ref()
+                .ok_or(DockerStartupError::Unavailable)?;
+            let docker = self.bound.as_ref().ok_or(DockerStartupError::Unavailable)?;
+            let at = Instant::now() + Duration::from_secs(60);
+            containers(directory, docker, at).await?;
+            images(directory, docker, at).await?;
+            volumes(directory, docker, at).await?;
+            if !directory.container_records(at).await?.is_empty()
+                || !directory.image_records(at).await?.is_empty()
+                || !directory.code_records(at).await?.is_empty()
+            {
+                return Err(DockerError::Quarantined.into());
+            }
+            self.producing = false;
+        }
+        if let Some(wire) = &mut self.wire {
+            let result = timeout_at(Instant::now() + Duration::from_secs(60), wire.shutdown())
+                .await
+                .map_err(|_| DockerStartupError::Deadline)?;
+            let settled = wire.physically_settled();
+            if let Err(error) = result {
+                self.retain_fault(error.into());
+            }
+            if !settled {
+                return Err(DockerStartupError::Unavailable);
+            }
+        }
+        Ok(())
+    }
+}
+fn platform(
+    os: Option<&str>,
+    architecture: Option<&str>,
+    cross: bool,
+) -> Result<Architecture, DockerStartupError> {
+    if os != Some("linux") {
+        return Err(DockerStartupError::Configuration);
+    }
+    let selected = match architecture {
+        Some("aarch64" | "arm64") => Architecture::Arm64,
+        Some("x86_64" | "amd64") => Architecture::X86_64,
+        _ => return Err(DockerStartupError::Configuration),
+    };
+    if !cross
+        && !matches!(
+            (ARCH, selected),
+            ("aarch64", Architecture::Arm64) | ("x86_64", Architecture::X86_64)
+        )
+    {
+        return Err(DockerStartupError::Configuration);
+    }
+    Ok(selected)
+}
diff --git a/crates/rustack-lambda-core/src/docker/startup/tests.rs b/crates/rustack-lambda-core/src/docker/startup/tests.rs
new file mode 100644
index 00000000..380fac95
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/startup/tests.rs
@@ -0,0 +1,529 @@
+use std::{path::PathBuf, time::Duration};
+
+use rstest::rstest;
+use rustack_core::settings::RuntimeBudgets;
+use tokio::time::Instant;
+
+use super::*;
+use crate::docker::{EnvironmentConfig, ImageLeaseConfig};
+
+fn settings() -> DockerRuntimeSettings {
+    DockerRuntimeSettings::from_lookup(
+        |key| match key {
+            "LAMBDA_DOCKER_RELAY_IMAGE" => Some("relay:v1".into()),
+            "LAMBDA_DOCKER_NETWORK" => Some("none".into()),
+            "LAMBDA_DOCKER_SOCKET" => {
+                Some("unix:///private/rustack-missing-fixture/docker.sock".into())
+            }
+            _ => None,
+        },
+        &RuntimeBudgets::default(),
+        Duration::from_secs(600),
+    )
+    .unwrap()
+}
+fn lambda() -> LambdaConfig {
+    LambdaConfig {
+        executor: ExecutorBackend::Docker,
+        ..Default::default()
+    }
+}
+async fn begin(config: DockerStartupConfig) -> DockerRuntime {
+    tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            match DockerRuntime::new(config.clone()) {
+                Ok(owner) => return owner,
+                Err(DockerStartupError::Worker) => tokio::task::yield_now().await,
+                Err(error) => panic!("unexpected startup constructor: {error}"),
+            }
+        }
+    })
+    .await
+    .unwrap()
+}
+
+fn config(directory: PathBuf) -> DockerStartupConfig {
+    DockerStartupConfig::new(
+        settings(),
+        directory,
+        GatewayInstanceId::generate().unwrap(),
+        lambda(),
+    )
+    .unwrap()
+}
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(2)]
+#[case(3)]
+#[case(4)]
+#[test]
+fn test_should_reject_mismatching_startup_inputs_before_io(#[case] case: u8) {
+    let mut lambda = lambda();
+    match case {
+        0 => lambda.executor = ExecutorBackend::Native,
+        1 => lambda.max_warm_instances = 2,
+        2 => lambda.init_timeout = Duration::ZERO,
+        3 => lambda.init_timeout = Duration::from_secs(901),
+        _ => lambda.idle_timeout = Duration::from_secs(599),
+    }
+    assert!(matches!(
+        DockerStartupConfig::new(
+            settings(),
+            "/private/data".into(),
+            GatewayInstanceId::generate().unwrap(),
+            lambda
+        ),
+        Err(DockerStartupError::Configuration)
+    ));
+}
+#[test]
+fn test_should_reject_disconnected_configured_endpoint_before_startup() {
+    let settings = DockerRuntimeSettings::from_lookup(
+        |key| match key {
+            "LAMBDA_DOCKER_RELAY_IMAGE" => Some("relay:v1".into()),
+            "LAMBDA_DOCKER_NETWORK" => Some("none".into()),
+            "LAMBDA_DOCKER_GATEWAY_ENDPOINT" => Some("http://localhost:4566".into()),
+            _ => None,
+        },
+        &RuntimeBudgets::default(),
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    assert!(
+        DockerStartupConfig::new(
+            settings,
+            "/private/data".into(),
+            GatewayInstanceId::generate().unwrap(),
+            lambda()
+        )
+        .is_err()
+    );
+}
+#[tokio::test]
+async fn test_should_retain_failed_attempt_without_replay_and_release_after_owned_shutdown() {
+    let directory = tempfile::tempdir().unwrap();
+    let mut owner = begin(config(directory.path().into())).await;
+    let status = owner.status();
+    assert!(!status.capabilities().ready && !status.capabilities().sdk_gateway);
+    assert!(status.capabilities().capacity.is_none());
+    assert!(
+        serde_json::to_value(status.capabilities())
+            .unwrap()
+            .get("capacity")
+            .is_none()
+    );
+    assert!(owner.installation().is_err());
+    assert!(
+        owner
+            .qualify(Instant::now() + Duration::from_secs(10))
+            .await
+            .is_err()
+    );
+    assert_eq!(owner.phase, Phase::Failed);
+    assert!(matches!(
+        owner
+            .qualify(Instant::now() + Duration::from_secs(10))
+            .await,
+        Err(DockerStartupError::Unavailable)
+    ));
+    assert!(matches!(
+        DirectoryLease::acquire(
+            directory.path().into(),
+            Instant::now() + Duration::from_secs(5)
+        )
+        .await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(10))
+        .await
+        .unwrap();
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(10))
+        .await
+        .unwrap();
+    assert!(!status.capabilities().ready);
+    let lease = DirectoryLease::acquire(
+        directory.path().into(),
+        Instant::now() + Duration::from_secs(5),
+    )
+    .await
+    .unwrap();
+    lease.require_journaled().unwrap();
+}
+#[tokio::test]
+async fn test_should_reject_expired_qualification_without_publishing_or_touching_directory() {
+    let root = tempfile::tempdir().unwrap();
+    let path = root.path().join("absent");
+    let mut owner = begin(config(path.clone())).await;
+    assert!(matches!(
+        owner.qualify(Instant::now()).await,
+        Err(DockerStartupError::Deadline)
+    ));
+    assert!(!tokio::fs::try_exists(path).await.unwrap());
+    assert!(owner.installation().is_err());
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+#[test]
+fn test_should_redact_startup_configuration_and_error_diagnostics() {
+    let config = config("/private/OPERATOR-SECRET".into());
+    assert!(!format!("{config:?}").contains("OPERATOR-SECRET"));
+    assert_eq!(
+        config.settings.container_policy().idle(),
+        Duration::from_secs(600)
+    );
+    assert!(DockerRuntime::new(config).is_err());
+}
+
+#[tokio::test]
+async fn test_should_keep_abandoned_qualification_io_and_directory_until_same_cleanup_joins() {
+    let root = tempfile::tempdir().unwrap();
+    let mut daemon = crate::docker::tests::Daemon::new();
+    let socket = daemon.socket_uri();
+    let settings = DockerRuntimeSettings::from_lookup(
+        |key| match key {
+            "LAMBDA_DOCKER_RELAY_IMAGE" => Some("relay:v1".into()),
+            "LAMBDA_DOCKER_NETWORK" => Some("none".into()),
+            "LAMBDA_DOCKER_SOCKET" => Some(socket.clone()),
+            _ => None,
+        },
+        &RuntimeBudgets::default(),
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    let config = DockerStartupConfig::new(
+        settings,
+        root.path().into(),
+        GatewayInstanceId::generate().unwrap(),
+        lambda(),
+    )
+    .unwrap();
+    let mut owner = begin(config).await;
+    let mut qualification = Box::pin(owner.qualify(Instant::now() + Duration::from_secs(20)));
+    let request = tokio::select! {
+        request=daemon.next()=>request,
+        result=&mut qualification=>panic!("qualification completed before inventory: {result:?}"),
+    };
+    assert!(request.head.contains("/containers/json?"));
+    drop(qualification);
+    assert_eq!(owner.phase, Phase::Qualifying);
+    assert!(matches!(
+        owner
+            .qualify(Instant::now() + Duration::from_secs(10))
+            .await,
+        Err(DockerStartupError::Unavailable)
+    ));
+    assert!(matches!(
+        owner.shutdown(Instant::now()).await,
+        Err(DockerStartupError::Deadline)
+    ));
+    drop(request);
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(10))
+        .await
+        .unwrap();
+    daemon.close().await;
+    DirectoryLease::acquire(root.path().into(), Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+
+#[tokio::test]
+async fn test_should_keep_cancelled_version_connect_owned_until_response_and_repeated_shutdown() {
+    use tokio::net::UnixListener;
+    let root = tempfile::tempdir().unwrap();
+    let socket_root = tempfile::tempdir().unwrap();
+    let socket = socket_root.path().join("docker.sock");
+    let listener = UnixListener::bind(&socket).unwrap();
+    let settings_lookup = std::collections::BTreeMap::from([
+        ("LAMBDA_DOCKER_RELAY_IMAGE", "relay:v1".to_owned()),
+        ("LAMBDA_DOCKER_NETWORK", "none".to_owned()),
+        (
+            "LAMBDA_DOCKER_SOCKET",
+            format!("unix://{}", socket.display()),
+        ),
+    ]);
+    let settings = DockerRuntimeSettings::from_lookup(
+        |key| settings_lookup.get(key).cloned(),
+        &RuntimeBudgets::default(),
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    let config = DockerStartupConfig::new(
+        settings,
+        root.path().into(),
+        GatewayInstanceId::generate().unwrap(),
+        lambda(),
+    )
+    .unwrap();
+    let mut owner = begin(config).await;
+    let mut work = Box::pin(owner.qualify(Instant::now() + Duration::from_secs(10)));
+    let (stream, _) = tokio::select! {connection=listener.accept()=>connection.unwrap(),result=&mut work=>panic!("early connect {result:?}")};
+    let request = crate::docker::tests::read_request(stream).await.unwrap();
+    assert!(request.head.starts_with("GET /version "));
+    drop(work);
+    assert!(matches!(
+        owner.shutdown(Instant::now()).await,
+        Err(DockerStartupError::Deadline)
+    ));
+    assert!(matches!(
+        DirectoryLease::acquire(root.path().into(), Instant::now() + Duration::from_secs(3)).await,
+        Err(DirectoryLeaseError::InUse)
+    ));
+    request
+        .reply(200, br#"{"ApiVersion":"1.53","MinAPIVersion":"1.44"}"#)
+        .await;
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(10))
+        .await
+        .unwrap();
+    owner
+        .shutdown(Instant::now() + Duration::from_secs(10))
+        .await
+        .unwrap();
+    DirectoryLease::acquire(root.path().into(), Instant::now() + Duration::from_secs(3))
+        .await
+        .unwrap();
+}
+#[tokio::test]
+async fn test_should_cache_connect_worker_failure_and_never_repoll_completed_join() {
+    let root = tempfile::tempdir().unwrap();
+    let mut owner = begin(config(root.path().into())).await;
+    owner.state.as_mut().unwrap().connecting = Some(tokio::spawn(async {
+        panic!("injected connect worker panic")
+    }));
+    for _ in 0..2 {
+        assert!(matches!(
+            owner
+                .shutdown(Instant::now() + Duration::from_secs(5))
+                .await,
+            Err(DockerStartupError::Cleanup(_))
+        ));
+    }
+}
+#[tokio::test]
+async fn test_should_continue_physical_image_and_wire_cleanup_after_sticky_environment_fault() {
+    use uuid::Uuid;
+
+    use crate::docker::{EnvironmentManager, ImageLeaseManager, ImagePinScope, tests::Daemon};
+    let root = tempfile::tempdir().unwrap();
+    let mut owner = begin(config(root.path().into())).await;
+    let daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let port = wire.port();
+    let directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+    let environments = EnvironmentManager::start(
+        port.clone(),
+        directory.clone(),
+        EnvironmentConfig::default(),
+    )
+    .unwrap();
+    environments.abort_test_worker();
+    let images = ImageLeaseManager::start(
+        port.clone(),
+        ImagePinScope::new(directory),
+        ImageLeaseConfig::default(),
+    )
+    .unwrap();
+    let image_status = images.port();
+    let state = owner.state.as_mut().unwrap();
+    state.wire = Some(wire);
+    state.images = Some(images);
+    state.environments = Some(environments);
+    for _ in 0..2 {
+        assert!(matches!(
+            owner
+                .shutdown(Instant::now() + Duration::from_secs(5))
+                .await,
+            Err(DockerStartupError::Cleanup(_))
+        ));
+    }
+    assert!(!image_status.status().accepting);
+    assert_eq!(image_status.status().pins, 0);
+    assert!(matches!(
+        port.info(Instant::now() + Duration::from_secs(3)).await,
+        Err(DockerError::Stopped)
+    ));
+    daemon.close().await;
+}
+
+async fn synthetic_ready(
+    owner: &mut DockerRuntime,
+) -> (crate::docker::tests::Daemon, crate::docker::DockerPort) {
+    use uuid::Uuid;
+
+    use crate::docker::{
+        DockerExecutorConfig, EnvironmentProbeConfig, ImageLeaseManager, ImagePinScope,
+        NetworkSelection, plan::tests::image_with, probe::tests::synthetic_resource, tests::Daemon,
+    };
+
+    let daemon = Daemon::new();
+    let wire = daemon.wire().await;
+    let port = wire.port();
+    let directory = DirectoryLease::testing(Uuid::new_v4(), Uuid::new_v4());
+    let environments = EnvironmentManager::start(
+        port.clone(),
+        directory.clone(),
+        EnvironmentConfig::default(),
+    )
+    .unwrap();
+    let images = ImageLeaseManager::start(
+        port.clone(),
+        ImagePinScope::new(directory.clone()),
+        ImageLeaseConfig::default(),
+    )
+    .unwrap();
+    let network: NetworkSelection = "none".parse().unwrap();
+    let base = EnvironmentProbeConfig::builder()
+        .directory(directory.clone())
+        .relay(image_with("1000", vec![]))
+        .environments(environments.port())
+        .policy(
+            owner
+                .state
+                .as_ref()
+                .unwrap()
+                .config
+                .settings
+                .container_policy()
+                .clone(),
+        )
+        .network(
+            network
+                .qualify(&port, Instant::now() + Duration::from_secs(5))
+                .await
+                .unwrap(),
+        )
+        .build();
+    owner
+        .qualification
+        .evidence
+        .set(
+            Evidence::builder()
+                .base(base.clone())
+                .resource(synthetic_resource(&base))
+                .endpoint(None)
+                .images(images.port())
+                .docker(port.clone())
+                .architecture(Architecture::Arm64)
+                .build(),
+        )
+        .unwrap();
+    let executor = Arc::new(
+        DockerExecutor::new(
+            DockerExecutorConfig::builder()
+                .directory(directory.clone())
+                .relay(base.relay)
+                .policy(base.policy)
+                .environments(base.environments)
+                .readiness(owner.qualification.clone())
+                .build(),
+        )
+        .unwrap(),
+    );
+    let state = owner.state.as_mut().unwrap();
+    state.directory = Some(directory);
+    state.environments = Some(environments);
+    state.images = Some(images);
+    state.wire = Some(wire);
+    state.executor = Some(executor);
+    owner.phase = Phase::Ready;
+    (daemon, port)
+}
+#[tokio::test]
+async fn test_should_refuse_late_installation_after_dependency_revocation_and_join_faulted_graph() {
+    let root = tempfile::tempdir().unwrap();
+    let mut owner = begin(config(root.path().into())).await;
+    let (daemon, port) = synthetic_ready(&mut owner).await;
+    owner.phase = Phase::Ready;
+    assert!(owner.installation().is_ok());
+    let environments = owner.state.as_mut().unwrap().environments.as_mut().unwrap();
+    environments.abort_test_worker();
+    assert!(
+        environments
+            .shutdown(Instant::now() + Duration::from_secs(5))
+            .await
+            .is_err()
+    );
+    assert!(matches!(
+        owner.installation(),
+        Err(DockerStartupError::Unavailable)
+    ));
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_secs(5))
+            .await,
+        Err(DockerStartupError::Cleanup(_))
+    ));
+    assert!(matches!(
+        port.info(Instant::now() + Duration::from_secs(5)).await,
+        Err(DockerError::Stopped)
+    ));
+    daemon.close().await;
+}
+#[test]
+fn test_should_reject_mutable_zip_selection_before_startup() {
+    assert!(
+        DockerRuntimeSettings::from_lookup(
+            |key| match key {
+                "LAMBDA_DOCKER_RELAY_IMAGE" => Some("relay:v1".into()),
+                "LAMBDA_DOCKER_NETWORK" => Some("none".into()),
+                "LAMBDA_DOCKER_ZIP_IMAGE" => Some("zip:v1".into()),
+                _ => None,
+            },
+            &RuntimeBudgets::default(),
+            Duration::from_secs(600),
+        )
+        .is_err()
+    );
+}
+
+#[rstest]
+#[case::insufficient_pins(1, false)]
+#[case::separate_source_and_relay(2, true)]
+#[test]
+fn test_should_accept_pinned_zip_only_with_separate_source_pin_capacity(
+    #[case] pins: usize,
+    #[case] accepted: bool,
+) {
+    let mut budgets = RuntimeBudgets::default();
+    budgets.lambda_docker_image_pins = pins;
+    budgets.lambda_docker_deployment_jobs = 1;
+    let settings = DockerRuntimeSettings::from_lookup(
+        |key| match key {
+            "LAMBDA_DOCKER_RELAY_IMAGE" => Some("relay:v1".into()),
+            "LAMBDA_DOCKER_NETWORK" => Some("none".into()),
+            "LAMBDA_DOCKER_ZIP_IMAGE" => Some(format!("base@sha256:{}", "a".repeat(64))),
+            _ => None,
+        },
+        &budgets,
+        Duration::from_secs(600),
+    )
+    .unwrap();
+    assert_eq!(
+        DockerStartupConfig::new(
+            settings,
+            "/private/data".into(),
+            GatewayInstanceId::generate().unwrap(),
+            lambda()
+        )
+        .is_ok(),
+        accepted
+    );
+}
+
+#[test]
+fn test_should_never_issue_handler_sdk_context_without_qualified_endpoint_evidence() {
+    let qualification = Arc::new(Qualification::default());
+    let credentials: LocalSdkCredentials = ("local-key".into(), "local-secret".into())
+        .try_into()
+        .unwrap();
+    assert!(matches!(
+        qualification.sdk_environment(credentials),
+        Err(DockerStartupError::Unavailable)
+    ));
+}
diff --git a/crates/rustack-lambda-core/src/docker/tests.rs b/crates/rustack-lambda-core/src/docker/tests.rs
new file mode 100644
index 00000000..7e7b1cb5
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/tests.rs
@@ -0,0 +1,990 @@
+use std::{
+    future::{Future, pending},
+    task::{Context, Waker},
+};
+
+use tempfile::TempDir;
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt, duplex},
+    net::{UnixListener, UnixStream},
+};
+
+use super::*;
+use crate::artifact::{Architecture, ArtifactError};
+
+#[derive(Debug, Clone)]
+pub(super) struct LogWriter(pub(super) std::sync::Arc<std::sync::Mutex<Vec<u8>>>);
+impl Write for LogWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let mut output = self.0.lock().unwrap();
+        if output.len().saturating_add(bytes.len()) > 2 * MAX_BODY_BYTES {
+            return Err(io::Error::other("capture exceeded limit"));
+        }
+        output.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+pub(super) fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(3)
+}
+
+pub(super) struct IncomingRequest {
+    pub(super) head: String,
+    pub(super) body: Vec<u8>,
+    pub(super) stream: UnixStream,
+}
+impl IncomingRequest {
+    pub(super) async fn reply(mut self, status: u16, body: &[u8]) {
+        let head = format!(
+            "HTTP/1.1 {status} OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+            body.len()
+        );
+        timeout_at(deadline(), async {
+            self.stream.write_all(head.as_bytes()).await?;
+            self.stream.write_all(body).await
+        })
+        .await
+        .unwrap()
+        .unwrap();
+    }
+    pub(super) async fn raw(mut self, response: &[u8]) {
+        timeout_at(deadline(), self.stream.write_all(response))
+            .await
+            .unwrap()
+            .unwrap();
+    }
+}
+
+pub(super) const DAEMON_ID: &str = "44ca5378-c28c-4bac-b6ed-2b298f02ecb5";
+
+pub(super) struct Daemon {
+    directory: TempDir,
+    pub(super) requests: mpsc::Receiver<IncomingRequest>,
+    stop: watch::Sender<bool>,
+    task: JoinHandle<()>,
+    pub(super) identity: watch::Sender<String>,
+    pub(super) identity_status: watch::Sender<u16>,
+}
+impl Daemon {
+    pub(super) async fn bind_fixture(directory: &DirectoryLease) {
+        directory
+            .bind_daemon(
+                binding::DaemonIdentity::try_from(DAEMON_ID).unwrap(),
+                deadline(),
+            )
+            .await
+            .unwrap();
+    }
+
+    pub(super) fn new() -> Self {
+        Self::with_version("1.53")
+    }
+    fn with_version(version: &'static str) -> Self {
+        let directory = tempfile::tempdir().unwrap();
+        let listener = UnixListener::bind(directory.path().join("docker.sock")).unwrap();
+        let (requests, received) = mpsc::channel(32);
+        let (stop, mut stopped) = watch::channel(false);
+        let (identity, daemon_identity) = watch::channel(DAEMON_ID.to_owned());
+        let (identity_status, daemon_status) = watch::channel(200);
+        let task = tokio::spawn(async move {
+            let mut jobs = JoinSet::new();
+            loop {
+                tokio::select! {
+                    biased;
+                    () = connection::stopped(&mut stopped) => break,
+                    job = jobs.join_next(), if !jobs.is_empty() => { job.unwrap().unwrap(); },
+                    stream = listener.accept(), if jobs.len() < 16 => {
+                        let requests = requests.clone();
+                        let daemon_identity = daemon_identity.clone();
+                        let daemon_status = daemon_status.clone();
+                        let (stream, _) = stream.unwrap();
+                        jobs.spawn(async move {
+                            // Closing a fixture connection during shutdown is
+                            // normal. Panics still fail the joined server task.
+                            let mut stream = stream;
+                            while let Ok(mut incoming) = read_request(stream).await {
+                                if incoming.head.starts_with("GET /version ") {
+                                    incoming.reply(200, format!(r#"{{"ApiVersion":"{version}","MinAPIVersion":"1.44"}}"#).as_bytes()).await;
+                                    break;
+                                } else if incoming.head.starts_with("GET /info ") {
+                                    let body = serde_json::to_vec(&serde_json::json!({"ID":daemon_identity.borrow().clone()})).unwrap();
+                                    let status = *daemon_status.borrow();
+                                    let head = format!("HTTP/1.1 {status} OK\r\nContent-Length: {}\r\nConnection: keep-alive\r\n\r\n", body.len());
+                                    if incoming.stream.write_all(head.as_bytes()).await.is_err()
+                                        || incoming.stream.write_all(&body).await.is_err() { break; }
+                                    stream = incoming.stream;
+                                } else { let _ = requests.send(incoming).await; break; }
+                            }
+                        });
+                    }
+                }
+            }
+            jobs.abort_all();
+            while let Some(result) = jobs.join_next().await {
+                if let Err(error) = result {
+                    assert!(error.is_cancelled());
+                }
+            }
+        });
+        Self {
+            directory,
+            requests: received,
+            stop,
+            task,
+            identity,
+            identity_status,
+        }
+    }
+    pub(super) fn socket_uri(&self) -> String {
+        format!(
+            "unix://{}",
+            self.directory.path().join("docker.sock").display()
+        )
+    }
+    pub(super) fn socket(&self) -> DockerSocket {
+        self.socket_uri().parse().unwrap()
+    }
+    pub(super) async fn wire(&self) -> DockerWire {
+        match DockerWire::connect(self.socket(), deadline()).await {
+            Ok(wire) => wire,
+            Err(DockerError::Http(error)) => panic!("fixture HTTP startup failed: {error:?}"),
+            Err(error) => panic!("fixture startup failed: {error}"),
+        }
+    }
+    pub(super) async fn next(&mut self) -> IncomingRequest {
+        timeout_at(deadline(), self.requests.recv())
+            .await
+            .unwrap()
+            .unwrap()
+    }
+    pub(super) async fn close(self) {
+        self.stop.send_replace(true);
+        self.task.await.unwrap();
+    }
+}
+
+pub(super) async fn read_request(mut stream: UnixStream) -> io::Result<IncomingRequest> {
+    timeout_at(deadline(), async {
+        let mut input = Vec::new();
+        let boundary = loop {
+            if let Some(index) = input.windows(4).position(|value| value == b"\r\n\r\n") {
+                break index + 4;
+            }
+            if input.len() > 16 * 1024 {
+                return Err(io::Error::other("fixture header exceeded cap"));
+            }
+            let mut block = [0; 512];
+            let count = stream.read(&mut block).await?;
+            if count == 0 {
+                return Err(io::ErrorKind::UnexpectedEof.into());
+            }
+            input.extend_from_slice(block.get(..count).unwrap());
+        };
+        let head =
+            String::from_utf8(input.get(..boundary).unwrap().to_vec()).map_err(io::Error::other)?;
+        let length = head
+            .lines()
+            .find_map(|line| {
+                line.split_once(':')
+                    .filter(|(name, _)| name.eq_ignore_ascii_case("content-length"))
+                    .map(|(_, value)| value.trim().parse::<usize>().unwrap())
+            })
+            .unwrap_or(0);
+        let limit = if head.starts_with("PUT ") && head.contains("/archive?") {
+            4 * MAX_BODY_BYTES
+        } else {
+            MAX_BODY_BYTES
+        };
+        if length > limit {
+            return Err(io::Error::other("fixture body exceeded cap"));
+        }
+        let mut body = input.get(boundary..).unwrap().to_vec();
+        let missing = length
+            .checked_sub(body.len())
+            .ok_or_else(|| io::Error::other("unexpected pipelining"))?;
+        let mut remainder = vec![0; missing];
+        stream.read_exact(&mut remainder).await?;
+        body.extend(remainder);
+        Ok(IncomingRequest { head, body, stream })
+    })
+    .await
+    .map_err(|_| io::Error::other("fixture deadline"))?
+}
+
+fn record(channel: u8, bytes: &[u8]) -> Vec<u8> {
+    let mut output = vec![channel, 0, 0, 0];
+    output.extend_from_slice(&u32::try_from(bytes.len()).unwrap().to_be_bytes());
+    output.extend_from_slice(bytes);
+    output
+}
+
+#[tokio::test]
+async fn test_should_negotiate_bound_metadata_encode_paths_and_preserve_status() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    assert_eq!(port.api_version().to_string(), "1.53");
+    let (info, ()) = tokio::join!(port.info(deadline()), async {
+        let request = daemon.next().await;
+        assert!(request.head.starts_with("GET /v1.53/info "));
+        request
+            .reply(200, br#"{"ID":"daemon-id","OSType":"linux"}"#)
+            .await;
+    });
+    assert_eq!(info.unwrap().id.as_deref(), Some("daemon-id"));
+    let image: ImageReference = "localhost:5000/team/worker:v1".parse().unwrap();
+    let (result, ()) = tokio::join!(port.inspect_image(&image, deadline()), async {
+        let request = daemon.next().await;
+        assert!(
+            request
+                .head
+                .starts_with("GET /v1.53/images/localhost%3A5000%2Fteam%2Fworker%3Av1/json ")
+        );
+        request.reply(404, b"secret daemon error").await;
+    });
+    let error = result.unwrap_err();
+    assert!(matches!(error, DockerError::Status(StatusCode::NOT_FOUND)));
+    assert!(!format!("{error:?} {error}").contains("secret"));
+    wire.shutdown().await.unwrap();
+    assert!(matches!(
+        port.info(deadline()).await,
+        Err(DockerError::Stopped)
+    ));
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_oversized_truncated_chunked_trailer_and_duplicate_metadata() {
+    for mode in 0..6 {
+        let mut daemon = Daemon::new();
+        let mut wire = daemon.wire().await;
+        let port = wire.port();
+        let (result, ()) = tokio::join!(port.info(deadline()), async {
+            let request = daemon.next().await;
+            match mode {
+                0 => request.raw(b"HTTP/1.1 200 OK\r\nContent-Length: 1048577\r\n\r\n").await,
+                1 => request.raw(b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\n{}").await,
+                2 => request.raw(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n2\r\n{}\r\n0\r\nSecret: trailer\r\n\r\n").await,
+                3 => request.reply(200, br#"{"ID":"one","ID":"two"}"#).await,
+                4 => request.raw(format!("HTTP/1.1 200 OK\r\nSecret: {}\r\nContent-Length: 2\r\n\r\n{{}}", "x".repeat(4097)).as_bytes()).await,
+                _ => {
+                    let mut response = b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n".to_vec();
+                    response.extend_from_slice(b"100001\r\n");
+                    response.extend(std::iter::repeat_n(b'x', MAX_BODY_BYTES + 1));
+                    response.extend_from_slice(b"\r\n0\r\n\r\n");
+                    // The client closes as soon as its byte cap is reached.
+                    let mut stream = request.stream;
+                    let _ = timeout_at(deadline(), stream.write_all(&response)).await;
+                }
+            }
+        });
+        assert!(result.is_err(), "case {mode}");
+        wire.shutdown().await.unwrap();
+        daemon.close().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_send_typed_container_create_and_management_operations() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let key: DockerKey = "owned-test".parse().unwrap();
+    let body = ContainerCreateBody {
+        image: Some("sha256:fixture".into()),
+        env: Some(vec!["SECRET=value".into()]),
+        ..Default::default()
+    };
+    let (created, ()) = tokio::join!(port.create_container(&key, &body, deadline()), async {
+        let request = daemon.next().await;
+        assert!(
+            request
+                .head
+                .starts_with("POST /v1.53/containers/create?name=owned-test ")
+        );
+        let body: serde_json::Value = serde_json::from_slice(&request.body).unwrap();
+        assert_eq!(body["Env"], serde_json::json!(["SECRET=value"]));
+        request
+            .reply(201, br#"{"Id":"owned-test","Warnings":[]}"#)
+            .await;
+    });
+    assert_eq!(created.unwrap().id, "owned-test");
+    for operation in 0..5 {
+        let (result, ()) = tokio::join!(
+            async {
+                match operation {
+                    0 => port.start_container(&key, deadline()).await,
+                    1 => port
+                        .inspect_container(&key, deadline())
+                        .await
+                        .map(|inspect| assert_eq!(inspect.id.as_deref(), Some("owned-test"))),
+                    2 => port.kill_container(&key, deadline()).await,
+                    3 => port
+                        .wait_container(&key, deadline())
+                        .await
+                        .map(|wait| assert_eq!(wait.status_code, 0)),
+                    _ => port.remove_container(&key, deadline()).await,
+                }
+            },
+            async {
+                let request = daemon.next().await;
+                assert!(request.head.contains("/containers/owned%2Dtest"));
+                match operation {
+                    1 => request.reply(200, br#"{"Id":"owned-test"}"#).await,
+                    3 => request.reply(200, br#"{"StatusCode":0}"#).await,
+                    _ => request.reply(204, b"").await,
+                }
+            }
+        );
+        result.unwrap();
+    }
+    let filter = OwnerFilter::new(Uuid::new_v4(), Some(Uuid::new_v4()), None).unwrap();
+    let (found, ()) = tokio::join!(port.list_containers(filter, deadline()), async {
+        let request = daemon.next().await;
+        assert!(request.head.contains("rustack.lambda.ownerId"));
+        request.reply(200, b"[]").await;
+    });
+    assert_eq!(found.unwrap(), Vec::<ContainerSummary>::new());
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_bound_request_serialization_and_redact_request_debug() {
+    let body = ContainerCreateBody {
+        env: Some(vec!["TOP_SECRET=value".into()]),
+        ..Default::default()
+    };
+    let request = RawRequest {
+        archive: None,
+        pull: None,
+        binding: None,
+        mutation: None,
+        operation: Operation::Create,
+        method: Method::POST,
+        target: "/secret-target".into(),
+        body: encode(&body).unwrap(),
+        expected: StatusCode::CREATED,
+    };
+    let shown = format!("{request:?}");
+    assert!(!shown.contains("TOP_SECRET") && !shown.contains("secret-target"));
+    let oversized = ContainerCreateBody {
+        env: Some(vec!["x".repeat(MAX_BODY_BYTES)]),
+        ..Default::default()
+    };
+    assert!(matches!(encode(&oversized), Err(DockerError::TooLarge)));
+    assert!(
+        !format!(
+            "{:?}",
+            Encoded {
+                bytes: b"secret".to_vec(),
+                failure: None
+            }
+        )
+        .contains("secret")
+    );
+}
+
+#[tokio::test]
+async fn test_should_upgrade_handoff_and_decode_fragmented_binary_output_without_a_management_slot()
+{
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let key: DockerKey = "relay-test".parse().unwrap();
+    let (attached, mut server) = tokio::join!(port.attach(&key, deadline()), async {
+        let mut request = daemon.next().await;
+        assert!(request.head.contains("logs=false"));
+        request
+            .stream
+            .write_all(
+                b"HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: tcp\r\n\r\n",
+            )
+            .await
+            .unwrap();
+        request.stream
+    });
+    let attach = attached.unwrap();
+    assert!(!format!("{attach:?}").contains("secret"));
+    let (mut reader, mut writer) = attach.split(Duration::from_secs(1)).unwrap();
+    let mut records = record(1, b"binary\0secret");
+    records.extend(record(2, b"stderr secret"));
+    let (chunks, ()) = tokio::join!(
+        async {
+            let first = reader.next(deadline()).await.unwrap().unwrap();
+            let second = reader.next(deadline()).await.unwrap().unwrap();
+            (first, second)
+        },
+        async {
+            for byte in records {
+                server.write_all(&[byte]).await.unwrap();
+            }
+        }
+    );
+    assert_eq!(chunks.0.bytes.as_ref(), b"binary\0secret");
+    assert_eq!(chunks.1.channel, OutputChannel::Stderr);
+    assert!(!format!("{:?} {reader:?}", chunks.0).contains("secret"));
+    writer.write_all(b"raw stdin").await.unwrap();
+    let mut stdin = [0; 9];
+    server.read_exact(&mut stdin).await.unwrap();
+    assert_eq!(&stdin, b"raw stdin");
+    // Exported attach has no management driver left to block shutdown.
+    wire.shutdown().await.unwrap();
+    drop(reader);
+    drop(writer);
+    drop(server);
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_cleanup_capacity_while_business_calls_and_mailbox_are_full() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let mut calls = JoinSet::new();
+    for _ in 0..6 {
+        let port = port.clone();
+        calls.spawn(async move { port.info(deadline()).await });
+    }
+    let mut held = Vec::new();
+    for _ in 0..6 {
+        held.push(daemon.next().await);
+    }
+    let mut queued = Vec::new();
+    for _ in 0..32 {
+        let (reply, response) = oneshot::channel();
+        port.raw
+            .business
+            .try_send(Envelope {
+                upload_completion: None,
+                request: RawRequest {
+                    archive: None,
+                    pull: None,
+                    binding: None,
+                    mutation: None,
+                    operation: Operation::Info,
+                    method: Method::GET,
+                    target: "/v1.53/info".into(),
+                    body: Bytes::new(),
+                    expected: StatusCode::OK,
+                },
+                deadline: deadline(),
+                reply,
+            })
+            .unwrap();
+        queued.push(response);
+    }
+    assert!(matches!(
+        port.info(deadline()).await,
+        Err(DockerError::Busy)
+    ));
+    let key: DockerKey = "owned-container".parse().unwrap();
+    let (removed, ()) = tokio::join!(port.remove_container(&key, deadline()), async {
+        let request = daemon.next().await;
+        assert!(
+            request
+                .head
+                .starts_with("DELETE /v1.53/containers/owned%2Dcontainer?")
+        );
+        request.reply(204, b"").await;
+    });
+    removed.unwrap();
+    wire.shutdown().await.unwrap();
+    for response in queued {
+        assert!(matches!(response.await.unwrap(), Err(DockerError::Stopped)));
+    }
+    while let Some(result) = calls.join_next().await {
+        assert!(result.unwrap().is_err());
+    }
+    for mut request in held {
+        let mut byte = [0; 1];
+        assert_eq!(
+            timeout_at(deadline(), request.stream.read(&mut byte))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+    }
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_admit_kill_while_two_lifecycle_waits_are_blocked() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let mut calls = JoinSet::new();
+    let key: DockerKey = "running-container".parse().unwrap();
+    for _ in 0..2 {
+        let port = port.clone();
+        let key = key.clone();
+        calls.spawn(async move { port.wait_container(&key, deadline()).await });
+    }
+    let mut held = Vec::new();
+    for _ in 0..2 {
+        let request = daemon.next().await;
+        assert!(request.head.contains("/wait?condition=not-running"));
+        held.push(request);
+    }
+    let (killed, ()) = tokio::join!(
+        port.kill_container(&key, Instant::now() + Duration::from_secs(1)),
+        async {
+            let request = daemon.next().await;
+            assert!(request.head.contains("/kill?signal=SIGKILL"));
+            request.reply(204, b"").await;
+        }
+    );
+    killed.unwrap();
+    wire.shutdown().await.unwrap();
+    while let Some(result) = calls.join_next().await {
+        assert!(result.unwrap().is_err());
+    }
+    for mut request in held {
+        let mut byte = [0; 1];
+        assert_eq!(
+            timeout_at(deadline(), request.stream.read(&mut byte))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+    }
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_inflight_calls_after_waiter_drop_and_join_after_cancelled_shutdown() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let caller = tokio::spawn(async move { port.info(deadline()).await });
+    let request = daemon.next().await;
+    caller.abort();
+    assert!(caller.await.unwrap_err().is_cancelled());
+    // The accepted request still owns its driver even though its response
+    // waiter is gone. Finish the body before stopping the retained wire owner.
+    request.reply(200, b"{}").await;
+    let mut shutdown = Box::pin(wire.shutdown());
+    assert!(
+        shutdown
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(shutdown);
+    wire.shutdown().await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_filter_secret_requests_responses_and_partial_trailers_under_trace() {
+    let capture = LogWriter(std::sync::Arc::default());
+    let writer = capture.clone();
+    let subscriber = tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::TRACE)
+        .with_ansi(false)
+        .with_writer(move || writer.clone())
+        .finish();
+    async {
+        tracing::debug!("application_event_is_preserved");
+        let dispatch = runtime_dispatch();
+        tracing::dispatcher::with_default(&dispatch, || {
+            tracing::trace!(target: "bollard::docker", "secret_constructed_bollard");
+        });
+        let mut daemon = Daemon::new();
+        let mut wire = daemon.wire().await;
+        let port = wire.port();
+        let key = "secret-request-target".parse().unwrap();
+        let body = ContainerCreateBody { env: Some(vec!["SECRET_ENV=secret_request_body".into()]), ..Default::default() };
+        let (created, ()) = tokio::join!(port.create_container(&key, &body, deadline()), async {
+            let request = daemon.next().await;
+            request.reply(201, br#"{"Id":"known","Warnings":["secret_response_body"]}"#).await;
+        });
+        assert_eq!(created.unwrap().id, "known");
+        let (result, ()) = tokio::join!(port.info(deadline()), async {
+            let request = daemon.next().await;
+            let mut stream = request.stream;
+            stream.write_all(b"HTTP/1.1 200 OK\r\nSecret: secret_response_header\r\nTransfer-Encoding: chunked\r\n\r\n2\r\n{}\r\n0\r\nSecret: secret_partial_trailer").await.unwrap();
+            // Force at least one partial trailer-buffer parse before finishing.
+            tokio::task::yield_now().await;
+            stream.write_all(b"\r\n\r\n").await.unwrap();
+        });
+        assert!(result.is_err());
+        wire.shutdown().await.unwrap();
+        daemon.close().await;
+    }.with_subscriber(subscriber).await;
+    let shown = String::from_utf8(capture.0.lock().unwrap().clone()).unwrap();
+    assert!(shown.contains("application_event_is_preserved"));
+    for secret in [
+        "secret_constructed_bollard",
+        "secret-request-target",
+        "secret_request_body",
+        "secret_response_body",
+        "secret_response_header",
+        "secret_partial_trailer",
+    ] {
+        assert!(
+            !shown.contains(secret),
+            "transport secret escaped the filter"
+        );
+    }
+}
+
+#[tokio::test]
+async fn test_should_stream_large_records_in_bounded_chunks_and_reject_bad_outer_framing() {
+    let data = record(1, &vec![7; 100_000]);
+    let mut reader = DockerOutputReader::new(data.as_slice(), Duration::from_secs(1)).unwrap();
+    let mut total = 0;
+    while let Some(chunk) = reader.next(deadline()).await.unwrap() {
+        assert!(chunk.bytes.len() <= 16 * 1024);
+        total += chunk.bytes.len();
+    }
+    assert_eq!(total, 100_000);
+    assert!(reader.next(deadline()).await.unwrap().is_none());
+    for bytes in [
+        vec![0, 0, 0, 0, 0, 0, 0, 0],
+        vec![3, 0, 0, 0, 0, 0, 0, 0],
+        vec![1, 1, 0, 0, 0, 0, 0, 0],
+        vec![1, 0],
+        vec![1, 0, 0, 0, 0xff, 0xff, 0xff, 0xff],
+        vec![1, 0, 0, 0, 0, 0, 0, 1],
+    ] {
+        let mut reader = DockerOutputReader::new(bytes.as_slice(), Duration::from_secs(1)).unwrap();
+        assert!(reader.next(deadline()).await.is_err());
+        assert!(matches!(
+            reader.next(deadline()).await,
+            Err(DockerError::Poisoned)
+        ));
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_not_extend_partial_record_deadlines_across_chunks_or_restart_cancelled_reads()
+{
+    let data = record(1, &vec![9; 32 * 1024]);
+    let mut reader = DockerOutputReader::new(data.as_slice(), Duration::from_secs(1)).unwrap();
+    assert_eq!(
+        reader.next(deadline()).await.unwrap().unwrap().bytes.len(),
+        16 * 1024
+    );
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert!(matches!(
+        reader.next(deadline()).await,
+        Err(DockerError::Deadline)
+    ));
+    let (mut input, source) = duplex(8);
+    input.write_all(&[1]).await.unwrap();
+    let mut reader = DockerOutputReader::new(source, Duration::from_secs(1)).unwrap();
+    let mut waiting = Box::pin(reader.next(deadline()));
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    assert!(matches!(
+        reader.next(deadline()).await,
+        Err(DockerError::Poisoned)
+    ));
+}
+
+#[test]
+fn test_should_validate_explicit_sockets_identifiers_and_version_negotiation() {
+    for socket in [
+        "/var/run/docker.sock",
+        "tcp://localhost:2375",
+        "unix://relative",
+        "unix:///bad\0socket",
+    ] {
+        assert!(socket.parse::<DockerSocket>().is_err());
+    }
+    for key in ["", "../bad", "path/name", "-bad", "space name"] {
+        assert!(key.parse::<DockerKey>().is_err());
+    }
+    assert!("a".repeat(129).parse::<DockerKey>().is_err());
+    assert_eq!(ApiVersion::negotiate("1.99", "1.44").unwrap().minor(), 53);
+    assert!(ApiVersion::negotiate("1.43", "1.24").is_err());
+    assert!(ApiVersion::negotiate("1.99", "1.54").is_err());
+    for version in ["1.053", "2.53", "1.-1", "1.1000"] {
+        assert!(version.parse::<ApiVersion>().is_err());
+    }
+    assert!(OwnerFilter::new(Uuid::nil(), None, None).is_err());
+    assert!(OwnerFilter::new(Uuid::new_v4(), None, Some(Uuid::new_v4())).is_err());
+}
+
+#[tokio::test]
+async fn test_should_close_a_timed_out_body_driver_without_stopping_the_wire() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let (result, ()) = tokio::join!(port.info(Instant::now() + Duration::from_secs(1)), async {
+        let mut request = daemon.next().await;
+        request
+            .stream
+            .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 100\r\n\r\n")
+            .await
+            .unwrap();
+        let mut byte = [0; 1];
+        assert_eq!(
+            timeout_at(deadline(), request.stream.read(&mut byte))
+                .await
+                .unwrap()
+                .unwrap(),
+            0
+        );
+    });
+    assert!(matches!(result, Err(DockerError::Deadline)));
+    let (next, ()) = tokio::join!(port.info(deadline()), async {
+        daemon.next().await.reply(200, b"{}").await;
+    });
+    next.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_cache_supervision_failure_when_priority_stop_wins() {
+    let (_business, requests) = mpsc::channel(32);
+    let (_cleanup, priority) = mpsc::channel(8);
+    let (_waits, waits) = mpsc::channel(8);
+    let (_pulls, pulls) = mpsc::channel(8);
+    let (control, _) = watch::channel(true);
+    let emergency = Arc::new(CleanupTask::default());
+    let mut actor = Actor::builder()
+        .runtime(Handle::current())
+        .emergency(emergency.clone())
+        .socket(PathBuf::from("/unused-fixture-socket"))
+        .business(requests)
+        .cleanup(priority)
+        .waits(waits)
+        .pulls(pulls)
+        .control(control.clone())
+        .build();
+    let failed = actor
+        .jobs
+        .spawn(async { panic!("controlled wire worker failure") });
+    while !failed.is_finished() {
+        tokio::task::yield_now().await;
+    }
+    let task = tokio::spawn(actor.run());
+    let mut owner = Owner {
+        emergency,
+        stop: control,
+        task: Some(task),
+        primary: None,
+        settlement: None,
+    };
+    assert!(matches!(owner.shutdown().await, Err(DockerError::Worker)));
+    assert!(matches!(owner.shutdown().await, Err(DockerError::Worker)));
+}
+
+#[tokio::test]
+async fn test_should_reject_expired_and_excessive_deadlines_before_metadata_publication() {
+    assert!(matches!(
+        check_deadline(Instant::now()),
+        Err(DockerError::Deadline)
+    ));
+    assert!(matches!(
+        check_deadline(Instant::now() + Duration::from_secs(601)),
+        Err(DockerError::Configuration)
+    ));
+    let response = RawReply::Body {
+        status: StatusCode::OK,
+        bytes: Bytes::from_static(b"{}"),
+    };
+    let decoded: Result<SystemInfo, DockerError> = decode(response, Instant::now());
+    assert!(matches!(decoded, Err(DockerError::Deadline)));
+}
+
+#[rstest::rstest]
+#[case("1.44", false)]
+#[case("1.48", false)]
+#[case("1.49", true)]
+#[case("1.53", true)]
+#[tokio::test]
+async fn test_should_resolve_preloaded_images_with_versioned_platform_selection(
+    #[case] version: &'static str,
+    #[case] platform: bool,
+) {
+    use crate::artifact::Architecture;
+    let mut daemon = Daemon::with_version(version);
+    let mut wire = daemon.wire().await;
+    let resolver = ImageResolver::new(wire.port());
+    let reference = "registry.test:5000/team/worker:v1".parse().unwrap();
+    let invalid_override = rustack_lambda_model::types::ImageConfig {
+        working_directory: Some("relative".into()),
+        ..Default::default()
+    };
+    assert!(matches!(
+        resolver
+            .resolve_local(
+                &reference,
+                Architecture::Arm64,
+                Some(&invalid_override),
+                deadline()
+            )
+            .await,
+        Err(DockerError::Configuration)
+    ));
+    assert!(daemon.requests.try_recv().is_err());
+    let (image, ()) = tokio::join!(
+        resolver.resolve_local(&reference, Architecture::Arm64, None, deadline()),
+        async {
+            let request = daemon.next().await;
+            let target = request.head.split_whitespace().nth(1).unwrap();
+            assert_eq!(
+                target,
+                format!("/v{version}/images/registry%2Etest%3A5000%2Fteam%2Fworker%3Av1/json")
+            );
+            let id = format!("sha256:{}", "a".repeat(64));
+            let body = serde_json::json!({"Id":id,"Os":"linux","Architecture":"arm64","Size":1024,"Config":{"Cmd":["/start"]},"GraphDriver":{"Name":"overlay2","Data":{}}});
+            request
+                .reply(200, &serde_json::to_vec(&body).unwrap())
+                .await;
+            if platform {
+                let request = daemon.next().await;
+                let target = request.head.split_whitespace().nth(1).unwrap();
+                let (path, query) = target.split_once('?').unwrap();
+                assert_eq!(
+                    path,
+                    format!("/v{version}/images/sha256%3A{}/json", "a".repeat(64))
+                );
+                let pairs: Vec<_> = form_urlencoded::parse(query.as_bytes()).collect();
+                assert_eq!(pairs.len(), 1);
+                assert_eq!(pairs.first().unwrap().0, "platform");
+                assert_eq!(
+                    serde_json::from_str::<serde_json::Value>(&pairs.first().unwrap().1).unwrap(),
+                    serde_json::json!({"os":"linux","architecture":"arm64"})
+                );
+                let mut selected = body;
+                selected["Id"] = serde_json::json!(format!("sha256:{}", "b".repeat(64)));
+                selected["Descriptor"] = serde_json::json!({"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":format!("sha256:{}","b".repeat(64))});
+                request
+                    .reply(200, &serde_json::to_vec(&selected).unwrap())
+                    .await;
+            } else {
+                let request = daemon.next().await;
+                assert!(request.head.starts_with(&format!("GET /v{version}/info ")));
+                request
+                    .reply(
+                        200,
+                        br#"{"Driver":"overlay2","DriverStatus":[["Backing Filesystem","extfs"]]}"#,
+                    )
+                    .await;
+            }
+        }
+    );
+    let image = image.unwrap();
+    assert_eq!(image.metadata().architecture, Architecture::Arm64);
+    assert_eq!(
+        image.metadata().image_id.as_str(),
+        format!("sha256:{}", "a".repeat(64))
+    );
+    assert_eq!(
+        image.metadata().execution.plan(None).unwrap().entrypoint(),
+        [""]
+    );
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest::rstest]
+#[case::missing_reference(false, false, 404)]
+#[case::missing_selected_platform(true, false, 404)]
+#[case::other_selected_failure(true, false, 500)]
+#[case::identity_not_found(true, true, 404)]
+#[tokio::test]
+async fn test_should_distinguish_selected_platform_absence_from_reference_and_identity_failures(
+    #[case] captured: bool,
+    #[case] identity_failure: bool,
+    #[case] status: u16,
+) {
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().into(), deadline())
+        .await
+        .unwrap();
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire
+        .port()
+        .bind_directory(&directory, deadline())
+        .await
+        .unwrap();
+    let resolver = ImageResolver::new(port);
+    let reference = "worker:v1".parse().unwrap();
+    let (result, ()) = tokio::join!(
+        resolver.resolve_local(&reference, Architecture::Arm64, None, deadline()),
+        async {
+            let request = daemon.next().await;
+            assert!(request.head.contains("/images/worker%3Av1/json "));
+            if !captured {
+                request.reply(status, b"{}").await;
+                return;
+            }
+            if identity_failure {
+                daemon.identity_status.send_replace(status);
+            }
+            let body = serde_json::json!({"Id":format!("sha256:{}", "a".repeat(64))});
+            request
+                .reply(200, &serde_json::to_vec(&body).unwrap())
+                .await;
+            if !identity_failure {
+                let selected = daemon.next().await;
+                assert!(selected.head.contains("/json?platform="));
+                selected.reply(status, b"{}").await;
+            }
+        }
+    );
+    if identity_failure {
+        assert!(matches!(result, Err(DockerError::IdentityCheck(source))
+            if matches!(source.as_ref(), DockerError::Status(StatusCode::NOT_FOUND))));
+    } else if captured && status == 404 {
+        assert!(matches!(
+            result,
+            Err(DockerError::Image(ArtifactError::Inspection))
+        ));
+    } else {
+        assert!(matches!(result, Err(DockerError::Status(code)) if code.as_u16() == status));
+    }
+    assert!(daemon.requests.try_recv().is_err());
+    wire.shutdown().await.unwrap();
+    drop(directory);
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_failed_wire_root_across_abandoned_emergency_shutdown_waiter() {
+    let emergency = Arc::new(CleanupTask::default());
+    let (release, wait) = oneshot::channel();
+    assert!(emergency.start(move || async move {
+        wait.await
+            .map_err(|_| ExecutorError::CleanupFailed("fixture release closed".into()))
+    }));
+    let (stop, _) = watch::channel(false);
+    let task = tokio::spawn(pending::<Result<(), DockerError>>());
+    task.abort();
+    let mut owner = Owner {
+        emergency,
+        stop,
+        task: Some(task),
+        primary: None,
+        settlement: None,
+    };
+    assert!(
+        tokio::time::timeout(Duration::from_millis(25), owner.shutdown())
+            .await
+            .is_err()
+    );
+    assert!(owner.task.is_none());
+    assert!(matches!(owner.primary, Some(Err(DockerError::Worker))));
+    release.send(()).unwrap();
+    assert!(matches!(owner.shutdown().await, Err(DockerError::Worker)));
+    assert!(matches!(owner.shutdown().await, Err(DockerError::Worker)));
+}
diff --git a/crates/rustack-lambda-core/src/docker/types.rs b/crates/rustack-lambda-core/src/docker/types.rs
new file mode 100644
index 00000000..73e5cb87
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/types.rs
@@ -0,0 +1,238 @@
+//! Validated local Docker identities, versions and redacted errors.
+
+use std::{fmt, io, os::unix::fs::FileTypeExt, path::PathBuf, str::FromStr, sync::Arc};
+
+use http::StatusCode;
+use rustack_core::json::JsonError;
+use tokio::time::{Instant, timeout_at};
+
+use super::{DirectoryLeaseError, check_deadline};
+use crate::artifact::ArtifactError;
+
+/// Docker boundary failure classes; no peer response body is displayed.
+#[derive(Clone, thiserror::Error)]
+#[non_exhaustive]
+pub enum DockerError {
+    /// Invalid local configuration or identifier.
+    #[error("invalid Docker configuration")]
+    Configuration,
+    /// ZIP bytes or the provided-runtime ELF bootstrap violate the code profile.
+    #[error("invalid Docker ZIP code")]
+    InvalidCode,
+    /// The runtime port cannot prove the persisted daemon/directory association.
+    #[error("Docker daemon binding failed")]
+    DaemonBinding,
+    /// Pulling is not authorized for this exact operator-selected registry.
+    #[error("Docker registry pull is not allowed")]
+    PullDenied,
+    /// The daemon reported an in-band pull failure; peer text is discarded.
+    #[error("Docker image pull failed")]
+    PullFailed,
+    /// The connection identity stage failed before the requested operation.
+    #[error("Docker connection identity check failed")]
+    IdentityCheck(#[source] Arc<DockerError>),
+    /// The local daemon's API range is incompatible.
+    #[error("unsupported Docker API version")]
+    Version,
+    /// A declared/actual byte or collection allowance was exceeded.
+    #[error("Docker byte budget exceeded")]
+    TooLarge,
+    /// A framing/header/response is malformed.
+    #[error("invalid Docker protocol")]
+    Protocol,
+    /// A cancelled partial stream cannot be restarted.
+    #[error("Docker stream is invalidated")]
+    Poisoned,
+    /// Absolute IO deadline expired.
+    #[error("Docker deadline exceeded")]
+    Deadline,
+    /// Wire service has stopped admission.
+    #[error("Docker wire is stopped")]
+    Stopped,
+    /// A bounded mailbox has no capacity.
+    #[error("Docker wire is busy")]
+    Busy,
+    /// An attached preparation caller cancelled before receiving an artifact.
+    #[error("Docker preparation cancelled")]
+    Cancelled,
+    /// An owned image mutation/cleanup is not yet proven settled.
+    #[error("Docker image cleanup is quarantined")]
+    Quarantined,
+    /// An owned task panicked or failed to join.
+    #[error("Docker supervision failed")]
+    Worker,
+    /// Persistent mutation ownership could not be read or durably settled.
+    #[error("persistent Docker ownership failed")]
+    Ownership(#[source] Arc<DirectoryLeaseError>),
+    /// A bounded output allocation could not be reserved.
+    #[error("Docker allocation failed")]
+    Allocation,
+    /// Request/model encoding failed without exposing input text.
+    #[error("invalid Docker request schema")]
+    Schema,
+    /// Non-success HTTP response; daemon error text is intentionally excluded.
+    #[error("Docker response status {0}")]
+    Status(StatusCode),
+    /// Local socket/stream IO failed.
+    #[error("Docker IO failed")]
+    Io(#[source] Arc<io::Error>),
+    /// HTTP transport failed.
+    #[error("Docker HTTP failed")]
+    Http(#[source] Arc<hyper::Error>),
+    /// Bounded metadata validation failed.
+    #[error(transparent)]
+    Json(#[from] JsonError),
+    /// Image inspection cannot establish a valid executable artifact.
+    #[error(transparent)]
+    Image(#[from] ArtifactError),
+}
+
+impl fmt::Debug for DockerError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, formatter)
+    }
+}
+impl From<io::Error> for DockerError {
+    fn from(error: io::Error) -> Self {
+        Self::Io(Arc::new(error))
+    }
+}
+impl From<DirectoryLeaseError> for DockerError {
+    fn from(error: DirectoryLeaseError) -> Self {
+        Self::Ownership(Arc::new(error))
+    }
+}
+impl From<hyper::Error> for DockerError {
+    fn from(error: hyper::Error) -> Self {
+        Self::Http(Arc::new(error))
+    }
+}
+
+/// Explicit local Unix socket, independent of ambient Docker environment.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct DockerSocket(PathBuf);
+
+impl fmt::Debug for DockerSocket {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("DockerSocket(<redacted>)")
+    }
+}
+impl FromStr for DockerSocket {
+    type Err = DockerError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let path = value
+            .strip_prefix("unix://")
+            .ok_or(DockerError::Configuration)?;
+        if !path.starts_with('/') || path.len() > 4096 || path.chars().any(char::is_control) {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self(PathBuf::from(path)))
+    }
+}
+impl DockerSocket {
+    pub(super) async fn verified(&self, deadline: Instant) -> Result<PathBuf, DockerError> {
+        check_deadline(deadline)?;
+        let path = timeout_at(deadline, tokio::fs::canonicalize(&self.0))
+            .await
+            .map_err(|_| DockerError::Deadline)??;
+        let metadata = timeout_at(deadline, tokio::fs::metadata(&path))
+            .await
+            .map_err(|_| DockerError::Deadline)??;
+        if Instant::now() >= deadline {
+            return Err(DockerError::Deadline);
+        }
+        if !metadata.file_type().is_socket() {
+            return Err(DockerError::Configuration);
+        }
+        Ok(path)
+    }
+}
+
+/// Validated Docker object name or content identifier used as a path component.
+#[derive(Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct DockerKey(String);
+
+impl fmt::Debug for DockerKey {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("DockerKey(<redacted>)")
+    }
+}
+impl FromStr for DockerKey {
+    type Err = DockerError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.len() > 128
+            || !value
+                .bytes()
+                .next()
+                .is_some_and(|byte| byte.is_ascii_alphanumeric())
+            || !value
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || b"_.-".contains(&byte))
+        {
+            return Err(DockerError::Configuration);
+        }
+        Ok(Self(value.to_owned()))
+    }
+}
+impl DockerKey {
+    /// Borrow the validated spelling; it is still encoded when placed in a URI.
+    ///
+    /// ```
+    /// let key: rustack_lambda_core::docker::DockerKey = "rustack-relay-123".parse()?;
+    /// assert_eq!(key.as_str(), "rustack-relay-123");
+    /// # Ok::<(), rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+/// A bounded Docker API version; negotiations select the local1.44..1.53 range.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[non_exhaustive]
+pub struct ApiVersion(u16);
+
+impl FromStr for ApiVersion {
+    type Err = DockerError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let minor = value.strip_prefix("1.").ok_or(DockerError::Version)?;
+        if minor.is_empty() || minor.len() > 3 || !minor.bytes().all(|byte| byte.is_ascii_digit()) {
+            return Err(DockerError::Version);
+        }
+        let parsed = minor.parse::<u16>().map_err(|_| DockerError::Version)?;
+        if parsed.to_string() != minor {
+            return Err(DockerError::Version);
+        }
+        Ok(Self(parsed))
+    }
+}
+impl ApiVersion {
+    pub(super) fn negotiate(maximum: &str, minimum: &str) -> Result<Self, DockerError> {
+        let selected = maximum.parse::<Self>()?.min(Self(53));
+        let minimum: Self = minimum.parse()?;
+        if selected < Self(44) || selected < minimum {
+            return Err(DockerError::Version);
+        }
+        Ok(selected)
+    }
+
+    /// Numeric API minor version, without its major version or URI prefix.
+    ///
+    /// ```
+    /// let version: rustack_lambda_core::docker::ApiVersion = "1.53".parse()?;
+    /// assert_eq!(version.minor(), 53);
+    /// # Ok::<(), rustack_lambda_core::docker::DockerError>(())
+    /// ```
+    #[must_use]
+    pub fn minor(self) -> u16 {
+        self.0
+    }
+}
+impl fmt::Display for ApiVersion {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "1.{}", self.0)
+    }
+}
diff --git a/crates/rustack-lambda-core/src/docker/volumes.rs b/crates/rustack-lambda-core/src/docker/volumes.rs
new file mode 100644
index 00000000..73a21bae
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/volumes.rs
@@ -0,0 +1,293 @@
+//! Local volumes and typed code upload; callers retain mutation recovery.
+
+use std::collections::BTreeMap;
+
+use bytes::Bytes;
+use http::{Method, StatusCode};
+use tokio::time::Instant;
+
+use super::{
+    DockerCodeArchive, DockerError, DockerKey, DockerPort, Operation, OwnerFilter, RawRequest,
+    decode, encode, escaped,
+    models::{Volume, VolumeCreateRequest, VolumeListResponse, VolumeScopeEnum},
+    mutation::MutationGuard,
+    unit,
+};
+
+impl DockerPort {
+    /// Upload checked code to fixed `/var/task`, retaining buffer admission.
+    ///
+    /// Requires an existing writable code volume. Creates/starts no container.
+    ///
+    /// # Errors
+    /// Returns normal wire failures. Cancellation/error does not prove no writes.
+    ///
+    /// ```no_run
+    /// # async fn upload(p: &rustack_lambda_core::docker::DockerPort, c: &rustack_lambda_core::docker::DockerKey, a: &rustack_lambda_core::docker::DockerCodeArchive) {
+    /// let result = p.upload_code(c, a, tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await;
+    /// # }
+    /// ```
+    pub async fn upload_code(
+        &self,
+        container: &DockerKey,
+        code: &DockerCodeArchive,
+        deadline: Instant,
+    ) -> Result<(), DockerError> {
+        let query = form_urlencoded::Serializer::new(String::new())
+            .append_pair("path", "/var/task")
+            .append_pair("noOverwriteDirNonDir", "true")
+            .append_pair("copyUIDGID", "false")
+            .finish();
+        unit(
+            self.raw
+                .request(
+                    RawRequest {
+                        archive: Some(code.clone()),
+                        pull: None,
+                        binding: None,
+                        mutation: None,
+                        operation: Operation::UploadCode,
+                        method: Method::PUT,
+                        target: format!(
+                            "/v{}/containers/{}/archive?{query}",
+                            self.version,
+                            escaped(container.as_str())
+                        ),
+                        body: code.bytes().clone(),
+                        expected: StatusCode::OK,
+                    },
+                    deadline,
+                )
+                .await?,
+            deadline,
+        )
+    }
+
+    /// Create a named local volume without driver, bind or cluster options.
+    ///
+    /// Caller must first journal intent and retain it through uncertain creation.
+    ///
+    /// # Errors
+    /// Returns invalid labels, mismatched reply metadata or normal wire failures.
+    /// No error authorizes deletion/retry; a matching reply is not journal authority.
+    ///
+    /// ```no_run
+    /// # async fn create(p: &rustack_lambda_core::docker::DockerPort, n: &rustack_lambda_core::docker::DockerKey) {
+    /// let labels = std::collections::BTreeMap::new();
+    /// let result = p.create_volume(n, &labels, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn create_volume(
+        &self,
+        name: &DockerKey,
+        labels: &BTreeMap<String, String>,
+        deadline: Instant,
+    ) -> Result<Volume, DockerError> {
+        self.create_volume_tracked(name, labels, deadline, None)
+            .await
+    }
+    pub(super) async fn create_volume_tracked(
+        &self,
+        name: &DockerKey,
+        labels: &BTreeMap<String, String>,
+        deadline: Instant,
+        mutation: Option<MutationGuard>,
+    ) -> Result<Volume, DockerError> {
+        validate_labels(
+            labels
+                .iter()
+                .map(|(key, value)| (key.as_str(), value.as_str())),
+        )?;
+        let body = VolumeCreateRequest {
+            name: Some(name.as_str().to_owned()),
+            driver: Some("local".into()),
+            labels: Some(
+                labels
+                    .iter()
+                    .map(|(key, value)| (key.clone(), value.clone()))
+                    .collect(),
+            ),
+            ..VolumeCreateRequest::default()
+        };
+        let volume: Volume = decode(
+            self.raw
+                .request(
+                    RawRequest {
+                        archive: None,
+                        pull: None,
+                        binding: None,
+                        mutation,
+                        operation: Operation::CreateVolume,
+                        method: Method::POST,
+                        target: format!("/v{}/volumes/create", self.version),
+                        body: encode(&body)?,
+                        expected: StatusCode::CREATED,
+                    },
+                    deadline,
+                )
+                .await?,
+            deadline,
+        )?;
+        validate_volume(&volume)?;
+        if volume.name != name.as_str()
+            || volume.driver != "local"
+            || volume.scope != Some(VolumeScopeEnum::LOCAL)
+            || !volume.options.is_empty()
+            || volume.labels.len() != labels.len()
+            || !labels
+                .iter()
+                .all(|(key, value)| volume.labels.get(key) == Some(value))
+        {
+            return Err(DockerError::Protocol);
+        }
+        Ok(volume)
+    }
+
+    /// Inspect one volume through reserved cleanup admission.
+    ///
+    /// # Errors
+    /// Returns invalid/bounded metadata or wire failures. Observation grants no
+    /// destructive authority; the caller must verify its durable identity.
+    ///
+    /// ```no_run
+    /// # async fn inspect(p: &rustack_lambda_core::docker::DockerPort, n: &rustack_lambda_core::docker::DockerKey) {
+    /// let result = p.inspect_volume(n, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn inspect_volume(
+        &self,
+        name: &DockerKey,
+        deadline: Instant,
+    ) -> Result<Volume, DockerError> {
+        let volume: Volume = decode(
+            self.call(
+                Operation::InspectVolume,
+                Method::GET,
+                format!("/volumes/{}", escaped(name.as_str())),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )?;
+        validate_volume(&volume)?;
+        if volume.name != name.as_str() {
+            return Err(DockerError::Protocol);
+        }
+        Ok(volume)
+    }
+
+    /// List a complete owner-label volume scope, without a positive result limit.
+    ///
+    /// # Errors
+    /// Rejects warnings, missing collections, over1024 rows, invalid metadata and
+    /// wire failures; no incomplete response is returned as an absence proof.
+    ///
+    /// ```no_run
+    /// # async fn list(p: &rustack_lambda_core::docker::DockerPort) -> Result<(), rustack_lambda_core::docker::DockerError> {
+    /// let scope = rustack_lambda_core::docker::OwnerFilter::new(uuid::Uuid::new_v4(), None, None)?;
+    /// let result = p.list_volumes(scope, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # Ok(()) }
+    /// ```
+    pub async fn list_volumes(
+        &self,
+        scope: OwnerFilter,
+        deadline: Instant,
+    ) -> Result<Vec<Volume>, DockerError> {
+        let query = form_urlencoded::Serializer::new(String::new())
+            .append_pair("filters", &scope.encoded_labels()?)
+            .finish();
+        let response: VolumeListResponse = decode(
+            self.call(
+                Operation::ListVolumes,
+                Method::GET,
+                format!("/volumes?{query}"),
+                Bytes::new(),
+                StatusCode::OK,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )?;
+        if response
+            .warnings
+            .is_some_and(|warnings| !warnings.is_empty())
+        {
+            return Err(DockerError::Protocol);
+        }
+        let volumes = response.volumes.ok_or(DockerError::Protocol)?;
+        if volumes.len() > 1024 {
+            return Err(DockerError::TooLarge);
+        }
+        for volume in &volumes {
+            validate_volume(volume)?;
+        }
+        Ok(volumes)
+    }
+
+    /// Remove a named volume with force disabled and reserved cleanup admission.
+    ///
+    /// # Errors
+    /// Returns normal wire failures, including attached-volume conflict. Caller
+    /// must prove ownership/consumer absence first, then inspect absence; neither
+    ///404 nor this response settles a journal here.
+    ///
+    /// ```no_run
+    /// # async fn remove(p: &rustack_lambda_core::docker::DockerPort, n: &rustack_lambda_core::docker::DockerKey) {
+    /// let result = p.remove_volume(n, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn remove_volume(
+        &self,
+        name: &DockerKey,
+        deadline: Instant,
+    ) -> Result<(), DockerError> {
+        unit(
+            self.call(
+                Operation::RemoveVolume,
+                Method::DELETE,
+                format!("/volumes/{}?force=false", escaped(name.as_str())),
+                Bytes::new(),
+                StatusCode::NO_CONTENT,
+                deadline,
+            )
+            .await?,
+            deadline,
+        )
+    }
+}
+
+fn validate_labels<'a>(
+    labels: impl Iterator<Item = (&'a str, &'a str)>,
+) -> Result<(), DockerError> {
+    for (index, (key, value)) in labels.enumerate() {
+        if index >= 16
+            || key.is_empty()
+            || key.len() > 128
+            || value.len() > 256
+            || !key
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || b"_.-".contains(&byte))
+            || value.chars().any(char::is_control)
+        {
+            return Err(DockerError::Configuration);
+        }
+    }
+    Ok(())
+}
+fn validate_volume(volume: &Volume) -> Result<(), DockerError> {
+    let _: DockerKey = volume.name.parse()?;
+    if volume.driver.len() > 256 || volume.mountpoint.len() > 4096 || volume.options.len() > 16 {
+        return Err(DockerError::TooLarge);
+    }
+    validate_labels(
+        volume
+            .labels
+            .iter()
+            .map(|(key, value)| (key.as_str(), value.as_str())),
+    )
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/volumes/tests.rs b/crates/rustack-lambda-core/src/docker/volumes/tests.rs
new file mode 100644
index 00000000..8e501704
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/volumes/tests.rs
@@ -0,0 +1,267 @@
+use std::{collections::BTreeMap, sync::Arc};
+
+use bytes::Bytes;
+use rstest::rstest;
+use serde_json::{Value, json};
+use tokio::sync::Semaphore;
+
+use super::*;
+use crate::{
+    artifact::Architecture,
+    docker::{
+        DirectoryLease,
+        code::tests::{elf, prepare, prepare_with, source, zip},
+        tests::{Daemon, deadline},
+    },
+};
+
+fn volume(name: &str, labels: &BTreeMap<String, String>) -> Value {
+    json!({"Name":name,"Driver":"local","Mountpoint":"/daemon/private","Labels":labels,"Scope":"local","Options":{}})
+}
+
+#[tokio::test]
+async fn test_should_create_observe_list_and_remove_only_explicit_local_volumes() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let name: DockerKey = "rustack-code-fixture".parse().unwrap();
+    let labels = BTreeMap::from([("rustack.lambda.ownerId".into(), "recorded-owner".into())]);
+    let pending = tokio::spawn({
+        let (port, name, labels) = (port.clone(), name.clone(), labels.clone());
+        async move { port.create_volume(&name, &labels, deadline()).await }
+    });
+    let request = daemon.requests.recv().await.unwrap();
+    assert!(request.head.starts_with("POST /v1.53/volumes/create "));
+    let body: Value = serde_json::from_slice(&request.body).unwrap();
+    assert_eq!(
+        body,
+        json!({"Name":name.as_str(),"Driver":"local","Labels":labels})
+    );
+    request
+        .reply(
+            201,
+            &serde_json::to_vec(&volume(name.as_str(), &labels)).unwrap(),
+        )
+        .await;
+    assert_eq!(pending.await.unwrap().unwrap().name, name.as_str());
+    let pending = tokio::spawn({
+        let (port, name) = (port.clone(), name.clone());
+        async move { port.inspect_volume(&name, deadline()).await }
+    });
+    let request = daemon.requests.recv().await.unwrap();
+    assert!(
+        request
+            .head
+            .starts_with("GET /v1.53/volumes/rustack%2Dcode%2Dfixture ")
+    );
+    request
+        .reply(
+            200,
+            &serde_json::to_vec(&volume(name.as_str(), &labels)).unwrap(),
+        )
+        .await;
+    pending.await.unwrap().unwrap();
+    let filter = OwnerFilter::new(uuid::Uuid::new_v4(), None, None).unwrap();
+    let pending = tokio::spawn({
+        let port = port.clone();
+        async move { port.list_volumes(filter, deadline()).await }
+    });
+    let request = daemon.requests.recv().await.unwrap();
+    assert!(request.head.starts_with("GET /v1.53/volumes?filters="));
+    assert!(!request.head.contains("limit="));
+    assert!(!request.head.contains("all="));
+    request.reply(200, br#"{"Volumes":[],"Warnings":[]}"#).await;
+    assert_eq!(pending.await.unwrap().unwrap(), [] as [Volume; 0]);
+    let pending = tokio::spawn({
+        let (port, name) = (port.clone(), name.clone());
+        async move { port.remove_volume(&name, deadline()).await }
+    });
+    let request = daemon.requests.recv().await.unwrap();
+    assert!(
+        request
+            .head
+            .starts_with("DELETE /v1.53/volumes/rustack%2Dcode%2Dfixture?force=false ")
+    );
+    request.reply(204, b"").await;
+    pending.await.unwrap().unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_upload_large_typed_tar_without_relaxing_json_or_response_limits() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let bootstrap = elf(Architecture::Arm64);
+    let data = vec![b'x'; 2 * 1024 * 1024];
+    let (_root, source) = source(zip(&[
+        ("bootstrap", &bootstrap, 0o755),
+        ("large", &data, 0o644),
+    ]))
+    .await;
+    let code = prepare(source).await;
+    let expected = code.bytes().clone();
+    let key: DockerKey = "loader".parse().unwrap();
+    let pending = tokio::spawn({
+        let port = port.clone();
+        async move { port.upload_code(&key, &code, deadline()).await }
+    });
+    let request = daemon.requests.recv().await.unwrap();
+    assert!(request.head.starts_with(
+        "PUT /v1.53/containers/loader/archive?path=%2Fvar%2Ftask&noOverwriteDirNonDir=true&\
+         copyUIDGID=false "
+    ));
+    assert!(
+        request
+            .head
+            .to_ascii_lowercase()
+            .contains("content-type: application/x-tar")
+    );
+    assert_eq!(request.body, expected);
+    request.reply(200, b"").await;
+    pending.await.unwrap().unwrap();
+    assert!(matches!(
+        port.call(
+            Operation::CreateVolume,
+            Method::POST,
+            "/volumes/create".into(),
+            Bytes::from(vec![0; 1024 * 1024 + 1]),
+            StatusCode::CREATED,
+            deadline()
+        )
+        .await,
+        Err(DockerError::TooLarge)
+    ));
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_unsafe_labels_before_any_wire_request() {
+    let daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let name = "volume".parse().unwrap();
+    for labels in [
+        BTreeMap::from([("bad/key".into(), "value".into())]),
+        BTreeMap::from([("valid".into(), "bad\nvalue".into())]),
+        BTreeMap::from([("valid".into(), "a".repeat(257))]),
+    ] {
+        assert!(matches!(
+            port.create_volume(&name, &labels, deadline()).await,
+            Err(DockerError::Configuration)
+        ));
+    }
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retain_accepted_upload_admission_after_its_caller_is_abandoned() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let admission = Arc::new(Semaphore::new(1));
+    let bootstrap = elf(Architecture::Arm64);
+    let (_root, source) = source(zip(&[("bootstrap", &bootstrap, 0o755)])).await;
+    let code = prepare_with(source, admission.clone()).await;
+    let pending = tokio::spawn(async move {
+        let key = "held-loader".parse().unwrap();
+        port.upload_code(&key, &code, deadline()).await
+    });
+    let request = daemon.next().await;
+    assert!(request.head.starts_with("PUT "));
+    pending.abort();
+    assert!(pending.await.unwrap_err().is_cancelled());
+    assert_eq!(admission.available_permits(), 0);
+    request.reply(200, b"").await;
+    wire.shutdown().await.unwrap();
+    assert_eq!(admission.available_permits(), 1);
+    daemon.close().await;
+}
+
+#[rstest]
+#[case::missing(json!({"Warnings":[]}))]
+#[case::null(json!({"Volumes":null}))]
+#[case::warning(json!({"Volumes":[],"Warnings":["partial result"]}))]
+#[case::row_kind(json!({"Volumes":[false]}))]
+#[tokio::test]
+async fn test_should_reject_incomplete_or_malformed_volume_inventories(#[case] response: Value) {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let scope = OwnerFilter::new(uuid::Uuid::new_v4(), None, None).unwrap();
+    let pending = tokio::spawn(async move { port.list_volumes(scope, deadline()).await });
+    daemon
+        .next()
+        .await
+        .reply(200, &serde_json::to_vec(&response).unwrap())
+        .await;
+    assert!(pending.await.unwrap().is_err());
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case::name("Name",json!("foreign"))]
+#[case::driver("Driver",json!("plugin"))]
+#[case::scope("Scope",json!("global"))]
+#[case::options("Options",json!({"device":"/host/source"}))]
+#[case::labels("Labels",json!({"foreign":"SECRET_VALUE"}))]
+#[tokio::test]
+async fn test_should_reject_volume_create_identity_or_policy_substitution(
+    #[case] field: &str,
+    #[case] value: Value,
+) {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let name: DockerKey = "volume".parse().unwrap();
+    let pending = tokio::spawn(async move {
+        port.create_volume(&name, &BTreeMap::new(), deadline())
+            .await
+    });
+    let mut response = volume("volume", &BTreeMap::new());
+    response[field] = value;
+    daemon
+        .next()
+        .await
+        .reply(201, &serde_json::to_vec(&response).unwrap())
+        .await;
+    let error = pending.await.unwrap().unwrap_err();
+    assert!(matches!(error, DockerError::Protocol));
+    assert!(!format!("{error:?}").contains("SECRET_VALUE"));
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_response_caps_and_connection_identity_fences_on_volume_operations() {
+    let mut daemon = Daemon::new();
+    let mut wire = daemon.wire().await;
+    let port = wire.port();
+    let name: DockerKey = "volume".parse().unwrap();
+    let pending = tokio::spawn({
+        let port = port.clone();
+        let name = name.clone();
+        async move { port.inspect_volume(&name, deadline()).await }
+    });
+    daemon
+        .next()
+        .await
+        .raw(b"HTTP/1.1 200 OK\r\nContent-Length: 1048577\r\nConnection: close\r\n\r\n")
+        .await;
+    assert!(matches!(pending.await.unwrap(), Err(DockerError::TooLarge)));
+    let root = tempfile::tempdir().unwrap();
+    let directory = DirectoryLease::acquire(root.path().to_owned(), deadline())
+        .await
+        .unwrap();
+    let bound = port.bind_directory(&directory, deadline()).await.unwrap();
+    daemon.identity_status.send_replace(404);
+    let error = bound.inspect_volume(&name, deadline()).await.unwrap_err();
+    assert!(matches!(error, DockerError::IdentityCheck(_)));
+    assert!(daemon.requests.try_recv().is_err());
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/docker/zip.rs b/crates/rustack-lambda-core/src/docker/zip.rs
new file mode 100644
index 00000000..e2a8e217
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/zip.rs
@@ -0,0 +1,325 @@
+//! Provided-runtime sources and retained per-plan code preparation ownership.
+
+#[cfg(test)]
+use std::sync::atomic::AtomicU8;
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, Ordering},
+};
+
+use tokio::{
+    runtime::Handle,
+    sync::watch,
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+
+use super::{
+    CodeRetirement, CodeVolumeIdentity, CodeVolumePort, DirectoryLease, DockerCodeArchive,
+    DockerError, DockerKey, PinnedCode, check_deadline, connection::stopped, models::Mount,
+    ownership::codes::volume_key,
+};
+use crate::{
+    artifact::{PinnedImage, ValidatedArtifact},
+    invocation::CleanupTask,
+};
+
+/// Exact affiliated OS-image and code-owner inputs; production startup qualifies them.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct DockerZipRuntime {
+    pub(super) base: PinnedImage,
+    pub(super) code: CodeVolumePort,
+}
+impl DockerZipRuntime {
+    /// Bind a live source and producer to the exact code-profile acquisition.
+    ///
+    /// This performs no IO and confers no production readiness.
+    ///
+    /// # Errors
+    /// Rejects foreign acquisitions, older profiles or unavailable ownership.
+    ///
+    /// ```no_run
+    /// # fn source(directory:rustack_lambda_core::docker::DirectoryLease,base:rustack_lambda_core::artifact::PinnedImage,code:rustack_lambda_core::docker::CodeVolumePort)->Result<(),rustack_lambda_core::docker::DockerError>{
+    /// let source=rustack_lambda_core::docker::DockerZipRuntime::new(&directory,base,code)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        directory: &DirectoryLease,
+        base: PinnedImage,
+        code: CodeVolumePort,
+    ) -> Result<Self, DockerError> {
+        let source = Self { base, code };
+        if !directory.code_journaled() || !source.same_scope(directory) {
+            return Err(DockerError::Configuration);
+        }
+        source.available()?;
+        Ok(source)
+    }
+    pub(super) fn same_scope(&self, directory: &DirectoryLease) -> bool {
+        self.base.belongs_to(directory) && self.code.same_scope(directory)
+    }
+    pub(super) fn live(&self) -> Result<(), DockerError> {
+        if !self.base.liveness().is_live() || !self.code.live() {
+            return Err(DockerError::Stopped);
+        }
+        Ok(())
+    }
+    pub(super) fn available(&self) -> Result<(), DockerError> {
+        self.live()?;
+        if !self.code.status().accepting {
+            return Err(DockerError::Quarantined);
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, thiserror::Error)]
+pub(super) enum CodeStageError {
+    #[error("code preparation admission saturated")]
+    AdmissionBusy,
+    #[error(transparent)]
+    Docker(#[from] DockerError),
+}
+
+#[derive(Debug, Default)]
+struct Preparation {
+    ready: Option<PinnedCode>,
+    receipt: Option<CodeRetirement>,
+    outcome: Option<Result<(), CodeStageError>>,
+}
+
+#[derive(Debug, TypedBuilder)]
+pub(super) struct ZipPlan {
+    pub(super) source: DockerZipRuntime,
+    identity: watch::Sender<Option<CodeVolumeIdentity>>,
+    pub(super) volume: DockerKey,
+    #[builder(default)]
+    stage: CleanupTask,
+    state: watch::Sender<Preparation>,
+    #[builder(default)]
+    claimed: AtomicBool,
+    #[builder(default)]
+    started: AtomicBool,
+    #[builder(default = AtomicBool::new(true))]
+    settled: AtomicBool,
+    #[cfg(test)]
+    #[builder(default)]
+    fault: AtomicU8,
+}
+impl ZipPlan {
+    #[cfg(test)]
+    fn fault(&self, point: u8) {
+        if self
+            .fault
+            .compare_exchange(point, 0, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+        {
+            panic!("deliberate ZIP stage fault");
+        }
+    }
+    pub(super) fn new(
+        source: DockerZipRuntime,
+        identity: CodeVolumeIdentity,
+    ) -> Result<Arc<Self>, DockerError> {
+        let volume = volume_key(identity.environment_id())?;
+        Ok(Arc::new(
+            Self::builder()
+                .source(source)
+                .identity(watch::channel(Some(identity)).0)
+                .volume(volume)
+                .state(watch::channel(Preparation::default()).0)
+                .build(),
+        ))
+    }
+    pub(super) fn claim(self: &Arc<Self>) -> Result<AllocationClaim, DockerError> {
+        self.claimed
+            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+            .map_err(|_| DockerError::Configuration)?;
+        Ok(AllocationClaim {
+            plan: self.clone(),
+            committed: false,
+        })
+    }
+    pub(super) fn live(&self) -> Result<(), DockerError> {
+        self.source.live()?;
+        if self.started.load(Ordering::Acquire) && self.clean() {
+            return Err(DockerError::Stopped);
+        }
+        if self
+            .state
+            .borrow()
+            .ready
+            .as_ref()
+            .is_some_and(|ready| !ready.is_live())
+        {
+            return Err(DockerError::Stopped);
+        }
+        Ok(())
+    }
+    pub(super) fn ready_mount(&self) -> Result<Mount, DockerError> {
+        self.live()?;
+        let state = self.state.borrow();
+        let ready = state.ready.as_ref().ok_or(DockerError::Configuration)?;
+        if ready.volume_name() != &self.volume
+            || ready.base_image_id() != &self.source.base.resolved().metadata().image_id
+        {
+            return Err(DockerError::Quarantined);
+        }
+        ready.mount()
+    }
+    pub(super) fn clean(&self) -> bool {
+        self.settled.load(Ordering::Acquire)
+    }
+    pub(super) fn start(
+        self: &Arc<Self>,
+        input: StageInput,
+        runtime: &Handle,
+    ) -> Result<(), DockerError> {
+        self.started
+            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+            .map_err(|_| DockerError::Configuration)?;
+        self.settled.store(false, Ordering::Release);
+        let retained = self.clone();
+        self.stage.start_on(runtime, move || async move {
+            let outcome = retained.prepare(input).await;
+            retained
+                .state
+                .send_modify(|state| state.outcome = Some(outcome));
+            Ok(())
+        });
+        Ok(())
+    }
+    async fn prepare(&self, mut input: StageInput) -> Result<(), CodeStageError> {
+        input.check()?;
+        self.source.available()?;
+        let mut identity = None;
+        self.identity.send_modify(|slot| identity = slot.take());
+        let identity = identity.ok_or(DockerError::Configuration)?;
+        let archive = DockerCodeArchive::prepare(
+            input.artifact.clone(),
+            self.source.base.resolved().metadata().architecture,
+            input.deadline,
+        )
+        .await?;
+        input.check()?;
+        #[cfg(test)]
+        self.fault(1);
+        let preparation = self
+            .source
+            .code
+            .start_with_receipt(
+                identity,
+                archive,
+                self.source.base.clone(),
+                input.deadline,
+                |receipt| {
+                    #[cfg(test)]
+                    self.fault(2);
+                    self.state
+                        .send_modify(|state| state.receipt = Some(receipt));
+                    #[cfg(test)]
+                    self.fault(3);
+                },
+            )
+            .map_err(|error| match error {
+                DockerError::Busy => CodeStageError::AdmissionBusy,
+                other => CodeStageError::Docker(other),
+            })?;
+        let ready = tokio::select! {biased;
+            ()=stopped(&mut input.global)=>return Err(DockerError::Cancelled.into()),
+            ()=stopped(&mut input.stop)=>return Err(DockerError::Cancelled.into()),
+            ready=preparation.wait()=>ready?,
+        };
+        input.check()?;
+        if ready.volume_name() != &self.volume
+            || ready.base_image_id() != &self.source.base.resolved().metadata().image_id
+        {
+            return Err(DockerError::Quarantined.into());
+        }
+        self.state.send_modify(|state| state.ready = Some(ready));
+        Ok(())
+    }
+    pub(super) async fn wait_ready(&self, deadline: Instant) -> Result<(), CodeStageError> {
+        timeout_at(deadline, self.stage.wait())
+            .await
+            .map_err(|_| DockerError::Deadline)?
+            .map_err(|_| DockerError::Worker)?;
+        check_deadline(deadline)?;
+        self.state
+            .borrow()
+            .outcome
+            .clone()
+            .ok_or(DockerError::Worker)??;
+        self.ready_mount()?;
+        Ok(())
+    }
+    /// Returns a sticky supervisor diagnostic separately from positive retirement.
+    pub(super) async fn retire(&self, deadline: Instant) -> Result<bool, DockerError> {
+        let joined = timeout_at(deadline, self.stage.wait())
+            .await
+            .map_err(|_| DockerError::Deadline)?;
+        let failed = joined.is_err()
+            || matches!(
+                self.state.borrow().outcome,
+                Some(Err(CodeStageError::Docker(DockerError::Worker)))
+            );
+        self.state.send_modify(|state| {
+            state.ready.take();
+        });
+        let receipt = self.state.borrow().receipt.clone();
+        if let Some(mut receipt) = receipt {
+            receipt.wait(deadline).await?;
+        }
+        // Every accepted preparation publishes above before-enqueue; no receipt
+        // after this original stage joins therefore proves no acceptance.
+        check_deadline(deadline)?;
+        self.settled.store(true, Ordering::Release);
+        Ok(failed)
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct AllocationClaim {
+    plan: Arc<ZipPlan>,
+    committed: bool,
+}
+impl AllocationClaim {
+    pub(super) fn belongs_to(&self, plan: &Arc<ZipPlan>) -> bool {
+        Arc::ptr_eq(&self.plan, plan)
+    }
+    pub(super) fn commit(&mut self) {
+        self.committed = true;
+    }
+}
+impl Drop for AllocationClaim {
+    fn drop(&mut self) {
+        if !self.committed {
+            self.plan.claimed.store(false, Ordering::Release);
+        }
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+pub(super) struct StageInput {
+    artifact: ValidatedArtifact,
+    deadline: Instant,
+    global: watch::Receiver<bool>,
+    stop: watch::Receiver<bool>,
+}
+impl StageInput {
+    fn check(&self) -> Result<(), DockerError> {
+        check_deadline(self.deadline)?;
+        if *self.global.borrow()
+            || *self.stop.borrow()
+            || self.global.has_changed().is_err()
+            || self.stop.has_changed().is_err()
+        {
+            return Err(DockerError::Cancelled);
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/docker/zip/tests.rs b/crates/rustack-lambda-core/src/docker/zip/tests.rs
new file mode 100644
index 00000000..c302626a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/docker/zip/tests.rs
@@ -0,0 +1,483 @@
+use std::{sync::Arc, time::Duration};
+
+use rstest::rstest;
+use rustack_lambda_model::types::ImageConfig;
+use serde_json::to_vec;
+use tempfile::TempDir;
+use tokio::{spawn, sync::mpsc, task::yield_now, time::timeout};
+use uuid::Uuid;
+
+use super::*;
+use crate::{
+    artifact::{Architecture, DeploymentArtifact},
+    docker::{
+        CodeVolumeConfig, CodeVolumeIdentity, CodeVolumeManager, DockerExecutorError, DockerPort,
+        EnvironmentError, EnvironmentManager, EnvironmentPlan, EnvironmentPort,
+        EnvironmentSettings, Operation,
+        code::tests::{elf, source, zip},
+        code_volume::tests::{
+            allocated, base, begin_volume, code, deadline, finish_loader, fixture, retire,
+        },
+        plan::tests::{function_body, image_with, policy, revision},
+    },
+    error::LambdaServiceError,
+    executor::ExecutorError,
+};
+
+async fn plan(
+    directory: &DirectoryLease,
+    runtime: DockerZipRuntime,
+) -> (TempDir, Arc<EnvironmentPlan>) {
+    let (root, code) = source(zip(&[("bootstrap", &elf(Architecture::Arm64), 0o755)])).await;
+    let mut revision = revision();
+    revision.artifact = DeploymentArtifact::Zip(code);
+    revision.runtime = Some("provided.al2023".into());
+    revision.handler = Some("handler.entry".into());
+    let plan = EnvironmentPlan::new_zip(
+        directory.clone(),
+        image_with("1000", vec![]),
+        Arc::new(revision),
+        policy(),
+        runtime,
+    )
+    .unwrap();
+    (root, Arc::new(plan))
+}
+fn environment(docker: DockerPort, directory: DirectoryLease) -> EnvironmentManager {
+    EnvironmentManager::start(
+        docker,
+        directory,
+        EnvironmentSettings::builder()
+            .environments(2)
+            .io(Duration::from_secs(1))
+            .start(Duration::from_secs(10))
+            .build()
+            .try_into()
+            .unwrap(),
+    )
+    .unwrap()
+}
+async fn empty(port: &EnvironmentPort) {
+    timeout(Duration::from_secs(5), async {
+        while port.status().allocated != 0 {
+            yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+
+#[tokio::test]
+async fn test_should_materialize_fixed_provided_body_and_reject_function_creation_before_code_ready()
+ {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut code = CodeVolumeManager::start(
+        docker.clone(),
+        directory.clone(),
+        CodeVolumeConfig::default(),
+    )
+    .unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, code.port()).unwrap();
+    let (_source, plan) = plan(&directory, runtime).await;
+    let body = function_body(&plan);
+    assert_eq!(body.entrypoint, Some(vec!["/var/task/bootstrap".into()]));
+    assert_eq!(body.cmd, Some(vec![]));
+    assert_eq!(body.user.as_deref(), Some("1000:1000"));
+    assert_eq!(body.working_dir.as_deref(), Some("/var/task"));
+    let host = body.host_config.as_ref().unwrap();
+    let mounts = host.mounts.as_ref().unwrap();
+    assert_eq!(mounts.len(), 1);
+    let mount = mounts.first().unwrap();
+    assert_eq!(mount.target.as_deref(), Some("/var/task"));
+    assert_eq!(mount.read_only, Some(true));
+    assert_eq!(mount.volume_options.as_ref().unwrap().no_copy, Some(true));
+    assert!(
+        body.env
+            .as_ref()
+            .unwrap()
+            .contains(&"_HANDLER=handler.entry".into())
+    );
+    assert!(matches!(
+        plan.create_function(&docker, deadline()).await,
+        Err(DockerError::Configuration)
+    ));
+    assert!(
+        timeout(Duration::from_millis(20), daemon.next())
+            .await
+            .is_err()
+    );
+    code.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_environment_memory_until_cancelled_preparation_physically_retires() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut code = CodeVolumeManager::start(
+        docker.clone(),
+        directory.clone(),
+        CodeVolumeConfig::default(),
+    )
+    .unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, code.port()).unwrap();
+    let (_source, plan) = plan(&directory, runtime).await;
+    let mut owner = environment(docker, directory.clone());
+    let port = owner.port();
+    let mut handle = port.spawn_shared(plan.clone(), deadline()).unwrap();
+    let (request, volume) = begin_volume(&mut daemon, &directory).await;
+    handle.cancel();
+    assert!(matches!(
+        handle
+            .shutdown(Instant::now() + Duration::from_millis(20))
+            .await,
+        Err(EnvironmentError::Deadline)
+    ));
+    assert_eq!(port.status().allocated, 1);
+    assert!(port.status().memory_bytes > 0);
+    assert!(!plan.code_clean());
+    assert_eq!(code.port().status().volumes, 1);
+    request.reply(201, &to_vec(&volume).unwrap()).await;
+    retire(&mut daemon, &volume).await;
+    handle.shutdown(deadline()).await.unwrap();
+    empty(&port).await;
+    assert_eq!(port.status().memory_bytes, 0);
+    assert!(plan.code_clean());
+    assert!(matches!(
+        handle.status().error,
+        Some(EnvironmentError::Docker(DockerError::Cancelled))
+    ));
+    owner.shutdown(deadline()).await.unwrap();
+    code.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case(1)]
+#[case(2)]
+#[case(3)]
+#[tokio::test]
+async fn test_should_reap_stage_panic_before_enqueue_without_inventing_acceptance(
+    #[case] point: u8,
+) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut code = CodeVolumeManager::start(
+        docker.clone(),
+        directory.clone(),
+        CodeVolumeConfig::default(),
+    )
+    .unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, code.port()).unwrap();
+    let (_source, plan) = plan(&directory, runtime).await;
+    plan.zip
+        .as_ref()
+        .unwrap()
+        .fault
+        .store(point, Ordering::Release);
+    let mut owner = environment(docker, directory.clone());
+    let port = owner.port();
+    let mut handle = port.spawn_shared(plan.clone(), deadline()).unwrap();
+    timeout(Duration::from_secs(5), async {
+        while !port.status().worker_failed {
+            yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+    assert!(matches!(
+        handle.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    empty(&port).await;
+    assert_eq!(port.status().memory_bytes, 0);
+    assert!(plan.code_clean());
+    assert_eq!(code.port().status().volumes, 0);
+    assert_eq!(directory.code_records(deadline()).await.unwrap(), []);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.next())
+            .await
+            .is_err()
+    );
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    code.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_join_original_upload_and_receipt_after_environment_root_loss() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut code = CodeVolumeManager::start(
+        docker.clone(),
+        directory.clone(),
+        CodeVolumeConfig::default(),
+    )
+    .unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, code.port()).unwrap();
+    let (_source, plan) = plan(&directory, runtime).await;
+    let mut owner = environment(docker, directory.clone());
+    let port = owner.port();
+    let mut handle = port.spawn_shared(plan.clone(), deadline()).unwrap();
+    let (volume, inspected) = allocated(&mut daemon, &directory).await;
+    let upload = daemon.next().await;
+    assert!(upload.head.starts_with("PUT "));
+    owner.abort_test_worker();
+    assert!(matches!(
+        handle
+            .shutdown(Instant::now() + Duration::from_millis(20))
+            .await,
+        Err(EnvironmentError::Deadline)
+    ));
+    assert_eq!(port.status().allocated, 1);
+    assert!(port.status().memory_bytes > 0);
+    assert!(!plan.code_clean());
+    upload.reply(200, b"").await;
+    finish_loader(&mut daemon, &inspected).await;
+    retire(&mut daemon, &volume).await;
+    assert!(matches!(
+        handle.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    empty(&port).await;
+    assert_eq!(port.status().memory_bytes, 0);
+    assert!(plan.code_clean());
+    assert!(matches!(
+        owner.shutdown(deadline()).await,
+        Err(EnvironmentError::Worker)
+    ));
+    code.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_exclude_cross_manager_plan_replay_and_reset_only_unaccepted_claims() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut code = CodeVolumeManager::start(
+        docker.clone(),
+        directory.clone(),
+        CodeVolumeConfig::default(),
+    )
+    .unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, code.port()).unwrap();
+    let (_source, plan) = plan(&directory, runtime).await;
+    let mut first = environment(docker.clone(), directory.clone());
+    let mut second = environment(docker, directory.clone());
+    let one = first.port();
+    let two = second.port();
+    let mut queued = one.spawn_shared(plan.clone(), deadline()).unwrap();
+    assert!(two.spawn_shared(plan.clone(), deadline()).is_err());
+    queued.cancel();
+    queued.shutdown(deadline()).await.unwrap();
+    empty(&one).await;
+    assert!(!plan.zip.as_ref().unwrap().claimed.load(Ordering::Acquire));
+    let mut committed = two.spawn_shared(plan.clone(), deadline()).unwrap();
+    let (request, volume) = begin_volume(&mut daemon, &directory).await;
+    assert!(one.spawn_shared(plan.clone(), deadline()).is_err());
+    committed.cancel();
+    request.reply(201, &to_vec(&volume).unwrap()).await;
+    retire(&mut daemon, &volume).await;
+    committed.shutdown(deadline()).await.unwrap();
+    empty(&two).await;
+    assert!(one.spawn_shared(plan, deadline()).is_err());
+    assert_eq!(one.status().allocated, 0);
+    assert_eq!(two.status().allocated, 0);
+    first.shutdown(deadline()).await.unwrap();
+    second.shutdown(deadline()).await.unwrap();
+    code.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_warm_identity_independent_of_fresh_volume_and_isolate_handler_changes() {
+    let (_root, directory, daemon, mut wire, docker) = fixture().await;
+    let mut owner =
+        CodeVolumeManager::start(docker, directory.clone(), CodeVolumeConfig::default()).unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, owner.port()).unwrap();
+    let (_source, original) = plan(&directory, runtime.clone()).await;
+    let relay = image_with("1000", vec![]);
+    let second = EnvironmentPlan::new_zip(
+        directory.clone(),
+        relay.clone(),
+        Arc::new(original.revision().clone()),
+        policy(),
+        runtime.clone(),
+    )
+    .unwrap();
+    assert_eq!(original.warm_key(), second.warm_key());
+    assert_ne!(original.function_key(), second.function_key());
+    let mut revised = original.revision().clone();
+    revised.handler = Some("other.entry".into());
+    let changed = EnvironmentPlan::new_zip(
+        directory.clone(),
+        relay,
+        Arc::new(revised),
+        policy(),
+        runtime,
+    )
+    .unwrap();
+    assert_ne!(original.warm_key(), changed.warm_key());
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[rstest]
+#[case::runtime(0)]
+#[case::handler(1)]
+#[case::architecture(2)]
+#[case::image_config(3)]
+#[tokio::test]
+async fn test_should_reject_incompatible_zip_plan_before_any_effect(#[case] case: u8) {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut owner =
+        CodeVolumeManager::start(docker, directory.clone(), CodeVolumeConfig::default()).unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, owner.port()).unwrap();
+    let (_source, original) = plan(&directory, runtime.clone()).await;
+    let mut revision = original.revision().clone();
+    match case {
+        0 => revision.runtime = Some("python3.13".into()),
+        1 => revision.handler = Some("bad\nhandler".into()),
+        2 => revision.architecture = Architecture::X86_64,
+        _ => revision.image_config = Some(ImageConfig::default()),
+    }
+    assert!(
+        EnvironmentPlan::new_zip(
+            directory.clone(),
+            image_with("1000", vec![]),
+            Arc::new(revision),
+            policy(),
+            runtime
+        )
+        .is_err()
+    );
+    assert!(
+        timeout(Duration::from_millis(20), daemon.next())
+            .await
+            .is_err()
+    );
+    owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_throttle_only_no_enqueue_code_admission_and_release_parent_memory() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let mut code_owner = CodeVolumeManager::start(
+        docker.clone(),
+        directory.clone(),
+        CodeVolumeConfig::new(2, 1, Duration::from_secs(1), Duration::from_secs(2)).unwrap(),
+    )
+    .unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image.clone(), code_owner.port()).unwrap();
+    let (_first_source, archive) = code().await;
+    let first = code_owner
+        .port()
+        .start_preparation(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4()).unwrap(),
+            archive,
+            image,
+            deadline(),
+        )
+        .unwrap();
+    let mut first_retirement = first.retirement();
+    let (held, volume) = begin_volume(&mut daemon, &directory).await;
+    let (_source, plan) = plan(&directory, runtime).await;
+    let mut owner = environment(docker, directory.clone());
+    let port = owner.port();
+    let mut handle = port.spawn_shared(plan.clone(), deadline()).unwrap();
+    let error = handle.wait_ready(deadline()).await.unwrap_err();
+    assert!(matches!(error, EnvironmentError::Busy));
+    assert!(matches!(
+        LambdaServiceError::from(ExecutorError::Docker(DockerExecutorError::Environment(
+            error
+        ))),
+        LambdaServiceError::TooManyRequests
+    ));
+    handle.shutdown(deadline()).await.unwrap();
+    empty(&port).await;
+    assert_eq!(port.status().memory_bytes, 0);
+    assert!(plan.code_clean());
+    assert_eq!(code_owner.port().status().volumes, 1);
+    assert_eq!(code_owner.port().status().preparing, 1);
+    assert!(
+        timeout(Duration::from_millis(20), daemon.next())
+            .await
+            .is_err()
+    );
+    drop(first);
+    held.reply(201, &to_vec(&volume).unwrap()).await;
+    retire(&mut daemon, &volume).await;
+    first_retirement.wait(deadline()).await.unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+    code_owner.shutdown(deadline()).await.unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
+
+#[tokio::test]
+async fn test_should_keep_accepted_nested_wire_busy_as_infrastructure_error_until_retirement() {
+    let (_root, directory, mut daemon, mut wire, docker) = fixture().await;
+    let (sender, mut receiver) = mpsc::channel(32);
+    let actual = docker.raw.business.clone();
+    let mut code_docker = docker.clone();
+    code_docker.raw.business = sender;
+    let forward = spawn(async move {
+        while let Some(message) = receiver.recv().await {
+            if matches!(message.request.operation, Operation::UploadCode) {
+                let _ = message.reply.send(Err(DockerError::Busy));
+            } else {
+                actual.send(message).await.unwrap();
+            }
+        }
+    });
+    let mut code_owner =
+        CodeVolumeManager::start(code_docker, directory.clone(), CodeVolumeConfig::default())
+            .unwrap();
+    let (image, _stop, _released) = base(&directory);
+    let runtime = DockerZipRuntime::new(&directory, image, code_owner.port()).unwrap();
+    let (_source, plan) = plan(&directory, runtime).await;
+    let mut owner = environment(docker, directory.clone());
+    let port = owner.port();
+    let mut handle = port.spawn_shared(plan.clone(), deadline()).unwrap();
+    let (volume, inspected) = allocated(&mut daemon, &directory).await;
+    let error = handle.wait_ready(deadline()).await.unwrap_err();
+    assert!(matches!(error, EnvironmentError::Docker(DockerError::Busy)));
+    assert!(matches!(
+        LambdaServiceError::from(ExecutorError::Docker(DockerExecutorError::Environment(
+            error
+        ))),
+        LambdaServiceError::Internal { .. }
+    ));
+    assert_eq!(port.status().allocated, 1);
+    assert!(port.status().memory_bytes > 0);
+    assert!(!plan.code_clean());
+    finish_loader(&mut daemon, &inspected).await;
+    retire(&mut daemon, &volume).await;
+    handle.shutdown(deadline()).await.unwrap();
+    empty(&port).await;
+    assert_eq!(port.status().memory_bytes, 0);
+    assert!(plan.code_clean());
+    owner.shutdown(deadline()).await.unwrap();
+    code_owner.shutdown(deadline()).await.unwrap();
+    timeout(Duration::from_secs(3), forward)
+        .await
+        .unwrap()
+        .unwrap();
+    wire.shutdown().await.unwrap();
+    daemon.close().await;
+}
diff --git a/crates/rustack-lambda-core/src/error.rs b/crates/rustack-lambda-core/src/error.rs
index 3a5637b7..5c1cb0f8 100644
--- a/crates/rustack-lambda-core/src/error.rs
+++ b/crates/rustack-lambda-core/src/error.rs
@@ -3,7 +3,69 @@
 //! These errors represent business logic failures and are converted to
 //! [`LambdaError`] for the HTTP response layer.
 
+#[cfg(unix)]
+use std::{error::Error, fmt};
+
 use rustack_lambda_model::error::{LambdaError, LambdaErrorCode};
+#[cfg(unix)]
+use tokio::task::JoinError;
+
+#[cfg(unix)]
+use crate::docker::DockerError;
+
+/// Typed validation worker failure; diagnostics never expose its panic payload.
+#[cfg(unix)]
+#[non_exhaustive]
+pub struct ImageRestoreWorker {
+    source: JoinError,
+}
+#[cfg(unix)]
+impl From<JoinError> for ImageRestoreWorker {
+    fn from(source: JoinError) -> Self {
+        Self { source }
+    }
+}
+#[cfg(unix)]
+impl ImageRestoreWorker {
+    /// Whether the original retained worker panicked.
+    ///
+    /// ```no_run
+    /// # fn inspect(error: &rustack_lambda_core::error::ImageRestoreWorker) { let panicked = error.is_panic(); }
+    /// ```
+    #[must_use]
+    pub fn is_panic(&self) -> bool {
+        self.source.is_panic()
+    }
+    /// Whether the original retained worker was canceled.
+    ///
+    /// ```no_run
+    /// # fn inspect(error: &rustack_lambda_core::error::ImageRestoreWorker) { let cancelled = error.is_cancelled(); }
+    /// ```
+    #[must_use]
+    pub fn is_cancelled(&self) -> bool {
+        self.source.is_cancelled()
+    }
+}
+#[cfg(unix)]
+impl fmt::Debug for ImageRestoreWorker {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+#[cfg(unix)]
+impl fmt::Display for ImageRestoreWorker {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(if self.is_panic() {
+            "image archive validation worker panicked"
+        } else {
+            "image archive validation worker cancelled"
+        })
+    }
+}
+// Retain JoinError for typed classification; chaining its Display would leak
+// arbitrary panic payload through startup's anyhow error rendering.
+#[cfg(unix)]
+impl Error for ImageRestoreWorker {}
 
 /// Internal service error type for Lambda operations.
 #[derive(Debug, thiserror::Error)]
@@ -50,6 +112,10 @@ pub enum LambdaServiceError {
         message: String,
     },
 
+    /// An explicit optimistic-update precondition did not match.
+    #[error("The supplied precondition does not match the current function revision")]
+    PreconditionFailed,
+
     /// Invalid parameter value.
     #[error("Invalid parameter: {message}")]
     InvalidParameter {
@@ -82,6 +148,24 @@ pub enum LambdaServiceError {
     #[error("Docker not available")]
     DockerNotAvailable,
 
+    /// Immutable image archive reacquisition failed without publishing resources.
+    #[cfg(unix)]
+    #[error("Lambda immutable image restore failed")]
+    ImageRestore {
+        /// Redacted typed daemon/ownership/deadline provenance.
+        #[source]
+        source: Box<DockerError>,
+    },
+
+    /// Retained image metadata validation worker failed.
+    #[cfg(unix)]
+    #[error("Lambda image archive validation worker failed")]
+    ImageRestoreWorker {
+        /// Typed worker provenance with redacted panic text.
+        #[source]
+        source: ImageRestoreWorker,
+    },
+
     /// Event source mapping does not exist.
     #[error("Event source mapping not found: {uuid}")]
     EventSourceMappingNotFound {
@@ -152,6 +236,10 @@ impl From<LambdaServiceError> for LambdaError {
             LambdaServiceError::ResourceConflict { ref message } => {
                 LambdaError::resource_conflict(message)
             }
+            LambdaServiceError::PreconditionFailed => LambdaError::new(
+                LambdaErrorCode::PreconditionFailedException,
+                "The supplied precondition does not match the current function revision",
+            ),
             LambdaServiceError::InvalidParameter { ref message } => {
                 LambdaError::invalid_parameter(message)
             }
@@ -164,6 +252,11 @@ impl From<LambdaServiceError> for LambdaError {
             LambdaServiceError::ResourceNotReady { ref message } => {
                 LambdaError::new(LambdaErrorCode::ResourceNotReadyException, message.clone())
             }
+            #[cfg(unix)]
+            LambdaServiceError::ImageRestore { .. }
+            | LambdaServiceError::ImageRestoreWorker { .. } => {
+                LambdaError::service_error("Immutable image archive restore failed")
+            }
             LambdaServiceError::DockerNotAvailable => LambdaError::service_error(
                 "Docker execution is not available. Set LAMBDA_DOCKER_ENABLED=true to enable.",
             ),
@@ -236,3 +329,18 @@ mod tests {
         );
     }
 }
+
+#[cfg(test)]
+mod precondition_tests {
+    use super::*;
+
+    #[test]
+    fn test_should_encode_stale_revision_as_http_412_with_the_aws_error_code() {
+        let error: LambdaError = LambdaServiceError::PreconditionFailed.into();
+        assert_eq!(error.code.as_str(), "PreconditionFailedException");
+        assert_eq!(
+            error.code.status_code(),
+            http::StatusCode::PRECONDITION_FAILED
+        );
+    }
+}
diff --git a/crates/rustack-lambda-core/src/executor/auto.rs b/crates/rustack-lambda-core/src/executor/auto.rs
index 2ace648b..5f8e69ff 100644
--- a/crates/rustack-lambda-core/src/executor/auto.rs
+++ b/crates/rustack-lambda-core/src/executor/auto.rs
@@ -10,9 +10,10 @@ use std::time::Duration;
 use async_trait::async_trait;
 
 use super::{
-    Executor, ExecutorError, InvokeRequest, InvokeResponse, NativeExecutor, PackageType,
-    SquibExecutor, SquibExecutorConfig,
+    Executor, ExecutorError, InvokeRequest, InvokeResponse, NativeExecutor, SquibExecutor,
+    SquibExecutorConfig,
 };
+use crate::{artifact::DeploymentArtifact, invocation::InvocationContext};
 
 /// Executor that chooses the concrete backend for each invocation.
 #[derive(Debug)]
@@ -38,66 +39,60 @@ impl AutoExecutor {
     }
 
     fn should_use_squib(req: &InvokeRequest) -> bool {
-        cfg!(target_os = "macos") && req.package_type == PackageType::Zip
+        cfg!(target_os = "macos") && matches!(req.revision.artifact, DeploymentArtifact::Zip(_))
     }
 }
 
 #[async_trait]
 impl Executor for AutoExecutor {
-    async fn invoke(&self, req: InvokeRequest) -> Result<InvokeResponse, ExecutorError> {
+    fn available(&self, request: &InvokeRequest) -> Result<(), ExecutorError> {
+        if Self::should_use_squib(request) {
+            self.squib.available(request)
+        } else {
+            self.native.available(request)
+        }
+    }
+
+    async fn invoke(
+        &self,
+        req: InvokeRequest,
+        context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
         if Self::should_use_squib(&req) {
-            self.squib.invoke(req).await
+            self.squib.invoke(req, context).await
         } else {
-            self.native.invoke(req).await
+            self.native.invoke(req, context).await
         }
     }
 
-    async fn shutdown(&self) {
-        self.squib.shutdown().await;
-        self.native.shutdown().await;
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        let squib = self.squib.shutdown().await;
+        let native = self.native.shutdown().await;
+        squib.and(native)
     }
 }
 
 #[cfg(test)]
 mod tests {
-    use std::{collections::HashMap, path::PathBuf, time::Duration};
-
-    use bytes::Bytes;
+    use std::sync::Arc;
 
     use super::*;
-
-    fn request(package_type: PackageType) -> InvokeRequest {
-        InvokeRequest {
-            function_arn: "arn:aws:lambda:us-east-1:000000000000:function:echo".to_owned(),
-            function_name: "echo".to_owned(),
-            qualifier: "$LATEST".to_owned(),
-            runtime: Some("provided.al2023".to_owned()),
-            handler: Some("bootstrap".to_owned()),
-            architectures: vec!["arm64".to_owned()],
-            package_type,
-            code_root: Some(PathBuf::from("/tmp/code")),
-            code_zip: Some(Bytes::from_static(b"PK\x03\x04")),
-            image_uri: None,
-            environment: HashMap::new(),
-            timeout: Duration::from_secs(1),
-            memory_mb: 128,
-            payload: Bytes::new(),
-            capture_logs: false,
-        }
-    }
+    use crate::artifact::{Architecture, ResolvedImage};
 
     #[test]
     fn test_should_default_macos_zip_to_squib() {
         assert_eq!(
-            AutoExecutor::should_use_squib(&request(PackageType::Zip)),
+            AutoExecutor::should_use_squib(&InvokeRequest::fixture()),
             cfg!(target_os = "macos")
         );
     }
 
     #[test]
     fn test_should_not_use_squib_for_image_package() {
-        assert!(!AutoExecutor::should_use_squib(&request(
-            PackageType::Image
-        )));
+        let mut request = InvokeRequest::fixture();
+        Arc::make_mut(&mut request.revision).artifact = DeploymentArtifact::Image(
+            crate::artifact::PinnedImage::fixture(ResolvedImage::fixture(Architecture::Arm64)),
+        );
+        assert!(!AutoExecutor::should_use_squib(&request));
     }
 }
diff --git a/crates/rustack-lambda-core/src/executor/error.rs b/crates/rustack-lambda-core/src/executor/error.rs
index 78719d73..31a2d80d 100644
--- a/crates/rustack-lambda-core/src/executor/error.rs
+++ b/crates/rustack-lambda-core/src/executor/error.rs
@@ -1,10 +1,25 @@
 //! Errors surfaced by an [`Executor`](super::Executor).
 
+#[cfg(unix)]
+use crate::docker::{DockerExecutorError, EnvironmentError};
 use crate::error::LambdaServiceError;
 
 /// Failure modes for an execution backend.
-#[derive(Debug, thiserror::Error)]
+#[derive(Debug, Clone, thiserror::Error)]
 pub enum ExecutorError {
+    /// Typed image-runtime, request or readiness failure with redacted sources.
+    #[cfg(unix)]
+    #[error("{0}")]
+    Docker(#[from] DockerExecutorError),
+    /// Caller or owner requested cancellation; settlement is tracked separately.
+    #[error("invocation cancelled")]
+    Cancelled,
+    /// Absolute invocation budget expired.
+    #[error("invocation deadline exceeded")]
+    DeadlineExceeded,
+    /// Cleanup could not be confirmed; ownership remains supervised.
+    #[error("cleanup not confirmed: {0}")]
+    CleanupFailed(String),
     /// No backend is wired up — set `LAMBDA_EXECUTOR=native` (or `docker`).
     #[error("execution is disabled. Set LAMBDA_EXECUTOR=native or LAMBDA_EXECUTOR=docker")]
     Disabled,
@@ -39,6 +54,19 @@ pub enum ExecutorError {
 impl From<ExecutorError> for LambdaServiceError {
     fn from(e: ExecutorError) -> Self {
         match e {
+            #[cfg(unix)]
+            ExecutorError::Docker(error) => match &error {
+                DockerExecutorError::Unavailable => Self::DockerNotAvailable,
+                DockerExecutorError::Environment(
+                    EnvironmentError::Busy | EnvironmentError::MemoryLimit,
+                ) => Self::TooManyRequests,
+                _ => Self::Internal {
+                    message: error.to_string(),
+                },
+            },
+            ExecutorError::Cancelled | ExecutorError::DeadlineExceeded => Self::ResourceNotReady {
+                message: e.to_string(),
+            },
             ExecutorError::Disabled => Self::ResourceNotReady {
                 message: "Lambda execution is disabled; explicitly select a trusted execution \
                           backend"
@@ -48,7 +76,8 @@ impl From<ExecutorError> for LambdaServiceError {
             | ExecutorError::InvalidCode(m)
             | ExecutorError::InitFailed(m)
             | ExecutorError::RuntimeExited(m)
-            | ExecutorError::Io(m) => Self::Internal { message: m },
+            | ExecutorError::Io(m)
+            | ExecutorError::CleanupFailed(m) => Self::Internal { message: m },
             ExecutorError::Timeout(d) => Self::Internal {
                 message: format!("function timed out after {d:?}"),
             },
diff --git a/crates/rustack-lambda-core/src/executor/instance.rs b/crates/rustack-lambda-core/src/executor/instance.rs
index 573e287f..3493c664 100644
--- a/crates/rustack-lambda-core/src/executor/instance.rs
+++ b/crates/rustack-lambda-core/src/executor/instance.rs
@@ -1,26 +1,39 @@
 //! A single warm execution instance and its pool.
 //!
-//! Used by both the native and Docker backends. Each instance owns its own
+//! Used by host bootstrap backends. Each instance owns its own
 //! [`runtime_api::RuntimeApiHandle`] and a way to start / kill the
 //! corresponding bootstrap (process or container). Pool entries are scoped
 //! per `(function_name, qualifier)` because code can diverge between
 //! versions.
 
 use std::{
+    mem::take,
+    net::{IpAddr, Ipv4Addr, SocketAddr},
     sync::Arc,
     time::{Duration, Instant},
 };
 
 use async_trait::async_trait;
+use bytes::Bytes;
 use dashmap::DashMap;
-use tokio::sync::{OwnedSemaphorePermit, Semaphore, oneshot};
+use rustack_lambda_runtime::{
+    metadata::local_trace_id,
+    protocol::{AttemptId, HandlerTimeout, Payload},
+};
+use tokio::{
+    sync::{OwnedSemaphorePermit, Semaphore, oneshot},
+    task::{JoinHandle, JoinSet},
+    time::{Instant as TokioInstant, timeout_at},
+};
 use tracing::debug;
+use typed_builder::TypedBuilder;
 
 use super::{
     error::ExecutorError,
-    runtime_api::{self, Job, RuntimeApiHandle, RuntimeResult},
+    runtime_api::{self, Invocation, RuntimeApiHandle, RuntimeResult, SessionError},
     types::{InvokeRequest, InvokeResponse},
 };
+use crate::{artifact::DeploymentArtifact, invocation::InvocationContext};
 
 /// Identifier for the pool slot — a function/version pair.
 pub(crate) type PoolKey = (String, String);
@@ -36,7 +49,8 @@ pub(crate) trait InstanceBackend: Send + Sync + std::fmt::Debug {
     }
 
     /// Spawn a bootstrap pointing at `runtime_api_addr` for the given function.
-    /// Returns a handle the pool will keep alive until the instance is reaped.
+    /// Register external ownership before an await after creation. Cancellation
+    /// before returning a handle must leave no unowned process.
     async fn spawn(
         &self,
         req: &InvokeRequest,
@@ -46,8 +60,11 @@ pub(crate) trait InstanceBackend: Send + Sync + std::fmt::Debug {
 
 /// Opaque handle to a backend-specific running thing (process or container).
 /// Drop must clean it up; the pool also calls `kill` on graceful shutdown.
+#[async_trait]
 pub(crate) trait BackendHandleObj: Send + Sync + std::fmt::Debug {
     fn kill(&mut self);
+    fn running(&self) -> bool;
+    async fn wait(&mut self) -> Result<(), ExecutorError>;
 }
 
 /// Wrapper for object-safety + Drop.
@@ -58,8 +75,15 @@ impl BackendHandle {
         Self(Box::new(handle))
     }
 
-    pub(crate) fn kill(mut self) {
+    fn running(&self) -> bool {
+        self.0.running()
+    }
+    async fn wait(&mut self) -> Result<(), ExecutorError> {
+        self.0.wait().await
+    }
+    async fn terminate(mut self) -> Result<(), ExecutorError> {
         self.0.kill();
+        self.0.wait().await
     }
 }
 
@@ -82,7 +106,52 @@ struct Instance {
     backend: BackendHandle,
     last_used: Instant,
     idle_permit: Option<OwnedSemaphorePermit>,
-    init_error: Option<oneshot::Receiver<bytes::Bytes>>,
+    init_error: Option<oneshot::Receiver<Payload>>,
+}
+
+impl Instance {
+    async fn run(
+        &mut self,
+        invocation: Invocation,
+        context: &InvocationContext,
+        timeout: Duration,
+    ) -> Result<RuntimeResult, ExecutorError> {
+        let response = async {
+            let ticket = self
+                .api
+                .session()
+                .submit(invocation, context.deadline())
+                .await
+                .map_err(|error| invocation_error(error, timeout))?;
+            match self.init_error.take() {
+                Some(mut init) => tokio::select! {
+                    biased;
+                    result = ticket.wait() => result.map_err(|error| invocation_error(error, timeout)),
+                    error = &mut init => error.map(RuntimeResult::InitError).map_err(|_| ExecutorError::RuntimeExited("Runtime initialization channel closed".into())),
+                },
+                None => ticket
+                    .wait()
+                    .await
+                    .map_err(|error| invocation_error(error, timeout)),
+            }
+        };
+        tokio::select! {
+            biased;
+            reason = context.cancelled() => Err(reason.error()),
+            result = response => result,
+            exit = self.backend.wait() => exit.and(Err(ExecutorError::RuntimeExited("Bootstrap exited before completing invocation".into()))),
+        }
+    }
+
+    async fn retire(mut self) -> Result<(), ExecutorError> {
+        let api = self
+            .api
+            .shutdown()
+            .await
+            .map_err(|_| ExecutorError::CleanupFailed("Runtime API shutdown failed".into()));
+        let backend = self.backend.terminate().await;
+        backend.and(api)
+    }
 }
 
 /// Pool of warm instances per `(function, qualifier)` key.
@@ -90,7 +159,7 @@ struct Instance {
 /// `acquire` fast-paths a warm instance and otherwise asks the backend to spawn
 /// a new one. `release` returns the instance to the pool subject to
 /// `max_warm`. `reap_idle` evicts instances older than `idle_timeout`.
-#[derive(Debug)]
+#[derive(Debug, TypedBuilder)]
 pub(crate) struct InstancePool {
     backend: Arc<dyn InstanceBackend>,
     max_warm: usize,
@@ -107,188 +176,352 @@ impl InstancePool {
         idle_timeout: Duration,
         init_timeout: Duration,
     ) -> Self {
-        Self {
-            backend,
-            max_warm,
-            idle_timeout,
-            init_timeout,
-            pools: DashMap::new(),
-            idle_capacity: Arc::new(Semaphore::new(32)),
-        }
+        Self::builder()
+            .backend(backend)
+            .max_warm(max_warm)
+            .idle_timeout(idle_timeout)
+            .init_timeout(init_timeout)
+            .pools(DashMap::new())
+            .idle_capacity(Arc::new(Semaphore::new(32)))
+            .build()
     }
 
     pub(crate) fn key(req: &InvokeRequest) -> PoolKey {
-        let mut environment: Vec<_> = req.environment.iter().collect();
+        let mut environment: Vec<_> = req.revision.environment.iter().collect();
         environment.sort();
+        let code_root = match &req.revision.artifact {
+            DeploymentArtifact::Zip(artifact) => Some(artifact.code_root()),
+            DeploymentArtifact::Image(_) => None,
+        };
         let identity = format!(
             "{:?}",
             (
-                &req.qualifier,
-                &req.code_root,
-                &req.image_uri,
-                &req.runtime,
-                &req.handler,
-                &req.architectures,
+                (
+                    req.revision.resource_id,
+                    &req.revision.revision_id,
+                    &req.revision.qualifier,
+                    req.revision.backend,
+                ),
+                (&req.revision.artifact, code_root),
+                (
+                    &req.revision.runtime,
+                    &req.revision.handler,
+                    req.revision.architecture
+                ),
                 environment,
-                req.timeout,
-                req.memory_mb
+                (
+                    req.revision.timeout,
+                    req.revision.memory_mb,
+                    req.revision.ephemeral_storage_mb
+                ),
+                &req.revision.image_config,
             )
         );
         (
-            req.function_name.clone(),
+            req.revision.function_name.clone(),
             crate::storage::compute_sha256(identity.as_bytes()),
         )
     }
 
     /// Run a single invocation against an acquired (or freshly spawned) instance.
-    pub(crate) async fn invoke(&self, req: InvokeRequest) -> Result<InvokeResponse, ExecutorError> {
+    pub(crate) async fn invoke(
+        &self,
+        req: InvokeRequest,
+        context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        context.check()?;
+        let attempt: AttemptId = context
+            .id()
+            .to_string()
+            .parse()
+            .map_err(|_| ExecutorError::InvalidCode("Invalid invocation identity".into()))?;
+        let arn = req
+            .function_arn
+            .parse()
+            .map_err(|_| ExecutorError::InvalidCode("Invalid invocation ARN".into()))?;
+        let trace = local_trace_id()
+            .map_err(|_| ExecutorError::InvalidCode("Invalid invocation clock metadata".into()))?;
+        let payload = Payload::try_from(req.payload.clone())
+            .map_err(|_| ExecutorError::InvalidCode("Invocation payload too large".into()))?;
+        let handler_timeout = HandlerTimeout::try_from(req.revision.timeout)
+            .map_err(|_| ExecutorError::InvalidCode("Invalid handler timeout".into()))?;
         let key = Self::key(&req);
-        let mut instance = match self.try_acquire(&key) {
-            Some(inst) => inst,
-            None => self.spawn_new(&req).await?,
-        };
-
-        let request_id = uuid::Uuid::new_v4().to_string();
-        let deadline = Instant::now() + req.timeout;
-        let (resp_tx, resp_rx) = oneshot::channel();
-        let job = Job {
-            request_id: request_id.clone(),
-            function_arn: req.function_arn.clone(),
-            deadline,
-            payload: req.payload.clone(),
-            response_tx: resp_tx,
-        };
-        instance
-            .api
-            .submit(job)
-            .await
-            .map_err(|e| ExecutorError::Io(e.to_string()))?;
-
-        let response = async {
-            match instance.init_error.take() {
-                Some(mut init) => tokio::select! {
-                    response = resp_rx => response,
-                    error = &mut init => error.map(RuntimeResult::InitError),
-                },
-                None => resp_rx.await,
-            }
-        };
-        let result = match tokio::time::timeout(req.timeout, response).await {
-            Ok(Ok(r)) => r,
-            Ok(Err(_)) => {
-                // Bootstrap died before responding.
-                instance.backend.kill();
-                return Err(ExecutorError::RuntimeExited(
-                    "bootstrap exited mid-invocation".to_owned(),
-                ));
+        let (instance, retired) = self.try_acquire(&key);
+        retire_all(retired).await?;
+        let instance = match instance {
+            Some(instance) if instance.backend.running() && !instance.api.session().is_closed() => {
+                Some(instance)
             }
-            Err(_) => {
-                instance.backend.kill();
-                return Err(ExecutorError::Timeout(req.timeout));
+            Some(instance) => {
+                instance.retire().await?;
+                None
             }
+            None => None,
         };
-
-        if !matches!(result, RuntimeResult::InitError(_)) {
+        let mut instance = match instance {
+            Some(instance) => instance,
+            None => self.spawn_new(&req, &context).await?,
+        };
+        let Ok(invocation) = Invocation::new(attempt, context.deadline(), arn, trace, payload)
+        else {
+            instance.retire().await?;
+            context.check()?;
+            return Err(ExecutorError::Timeout(req.revision.timeout));
+        };
+        let result = instance
+            .run(
+                invocation.with_handler_timeout(handler_timeout),
+                &context,
+                req.revision.timeout,
+            )
+            .await;
+        let result = context.check().and(result);
+        let reusable = matches!(&result, Ok(RuntimeResult::Success(_)))
+            && instance.backend.running()
+            && !instance.api.session().is_closed();
+        if reusable {
             instance.last_used = Instant::now();
-            self.release(key, instance);
+            if let Some(instance) = self.release(key, instance) {
+                instance.retire().await?;
+            }
+        } else {
+            instance.retire().await?;
         }
-
-        match result {
-            RuntimeResult::Success(payload) => Ok(InvokeResponse {
+        match result? {
+            RuntimeResult::Success(payload) => Ok(InvokeResponse::success(
+                Bytes::from(payload),
+                req.revision.qualifier.clone(),
+            )),
+            RuntimeResult::FunctionError(payload) => Ok(InvokeResponse {
                 status: 200,
-                payload,
-                function_error: None,
+                payload: Bytes::from(payload),
+                function_error: Some("Unhandled".into()),
                 log_tail: None,
-                executed_version: req.qualifier,
+                executed_version: req.revision.qualifier.clone(),
             }),
-            RuntimeResult::Error(payload) => Ok(InvokeResponse {
-                status: 200,
-                payload,
-                function_error: Some("Unhandled".to_owned()),
-                log_tail: None,
-                executed_version: req.qualifier,
-            }),
-            RuntimeResult::InitError(payload) => {
-                let msg = String::from_utf8_lossy(&payload).into_owned();
-                Err(ExecutorError::InitFailed(msg))
-            }
+            RuntimeResult::InitError(_) => Err(ExecutorError::InitFailed(
+                "Bootstrap reported initialization failure".into(),
+            )),
+            _ => Err(ExecutorError::RuntimeExited(
+                "Unsupported runtime result".into(),
+            )),
         }
     }
 
-    fn try_acquire(&self, key: &PoolKey) -> Option<Instance> {
-        let mut bucket = self.pools.get_mut(&key.0)?;
-        let Some(index) = bucket.iter().position(|(revision, _)| revision == &key.1) else {
-            bucket.clear();
-            return None;
+    fn try_acquire(&self, key: &PoolKey) -> (Option<Instance>, Vec<Instance>) {
+        let Some(mut bucket) = self.pools.get_mut(&key.0) else {
+            return (None, Vec::new());
         };
-        let (_, mut instance) = bucket.swap_remove(index);
-        instance.idle_permit.take();
-        Some(instance)
+        let result = if let Some(index) = bucket.iter().position(|(revision, _)| revision == &key.1)
+        {
+            let (_, mut instance) = bucket.swap_remove(index);
+            instance.idle_permit.take();
+            (Some(instance), Vec::new())
+        } else {
+            (
+                None,
+                take(&mut *bucket)
+                    .into_iter()
+                    .map(|(_, instance)| instance)
+                    .collect(),
+            )
+        };
+        drop(bucket);
+        self.pools.remove_if(&key.0, |_, bucket| bucket.is_empty());
+        result
     }
 
-    fn release(&self, key: PoolKey, mut instance: Instance) {
+    fn release(&self, key: PoolKey, mut instance: Instance) -> Option<Instance> {
         let Ok(permit) = Arc::clone(&self.idle_capacity).try_acquire_owned() else {
-            return;
+            return Some(instance);
         };
-        let mut bucket = self.pools.entry(key.0).or_default();
-        if bucket.len() < self.max_warm.min(1) {
+        let mut bucket = self.pools.entry(key.0.clone()).or_default();
+        if !self.idle_capacity.is_closed() && bucket.len() < self.max_warm.min(1) {
             instance.idle_permit = Some(permit);
             bucket.push((key.1, instance));
+            None
+        } else {
+            drop(bucket);
+            self.pools.remove_if(&key.0, |_, bucket| bucket.is_empty());
+            Some(instance)
         }
     }
 
-    async fn spawn_new(&self, req: &InvokeRequest) -> Result<Instance, ExecutorError> {
+    async fn spawn_new(
+        &self,
+        req: &InvokeRequest,
+        context: &InvocationContext,
+    ) -> Result<Instance, ExecutorError> {
+        context.check()?;
         if !self.backend.has_capacity() {
+            let mut evicted = None;
             for mut bucket in self.pools.iter_mut() {
                 if let Some((_, instance)) = bucket.pop() {
-                    drop(instance);
+                    evicted = Some(instance);
                     break;
                 }
             }
+            if let Some(instance) = evicted {
+                instance.retire().await?;
+            }
         }
-        let api = runtime_api::start()
-            .await
-            .map_err(|e| ExecutorError::Io(format!("bind runtime api: {e}")))?;
+        let deadline = TokioInstant::now()
+            .checked_add(self.init_timeout)
+            .ok_or_else(|| ExecutorError::InvalidCode("Invalid initialization budget".into()))?
+            .min(context.deadline());
+        let mut api = tokio::select! {
+            biased;
+            reason = context.cancelled() => return Err(reason.error()),
+            result = timeout_at(deadline, runtime_api::start_at(SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0), self.idle_timeout)) => {
+                result.map_err(|_| initialization_error(SessionError::Deadline, self.init_timeout, context))?.map_err(|_| ExecutorError::InitFailed("Runtime API startup failed".into()))?
+            }
+        };
         let addr = api.addr();
-        let init_error = api.take_init_error_rx().await;
-
-        // Race: backend spawn + first /next poll.  We don't observe /next here
-        // directly — we rely on either submit landing on a polling bootstrap
-        // OR an `/init/error` arriving.  To keep liveness, spawn the backend
-        // within the init window and watch the init-error channel for a
-        // fast-fail signal.
-        let backend = tokio::time::timeout(self.init_timeout, self.backend.spawn(req, addr))
-            .await
-            .map_err(|_| ExecutorError::Timeout(self.init_timeout))??;
-        let inst = Instance {
+        let init_error = api.take_initialization_error();
+        let backend = tokio::select! {
+            biased;
+            reason = context.cancelled() => Err(reason.error()),
+            result = timeout_at(deadline, self.backend.spawn(req, addr)) => result.map_err(|_| initialization_error(SessionError::Deadline, self.init_timeout, context)).and_then(|result| result),
+        };
+        let backend = match backend {
+            Ok(backend) => backend,
+            Err(error) => {
+                api.shutdown().await.map_err(|_| {
+                    ExecutorError::CleanupFailed("Runtime API startup cleanup failed".into())
+                })?;
+                return Err(error);
+            }
+        };
+        let mut instance = Instance {
             api,
             backend,
             last_used: Instant::now(),
             idle_permit: None,
             init_error,
         };
-        debug!(function = %req.function_name, addr = %addr, "spawned new lambda instance");
-        Ok(inst)
+        let readiness = {
+            let ready = async {
+                match instance.init_error.as_mut() {
+                    Some(init) => tokio::select! {
+                        biased;
+                        error = init => match error {
+                            Ok(_) => Err(ExecutorError::InitFailed("Bootstrap reported initialization failure".into())),
+                            Err(_) => Err(ExecutorError::RuntimeExited("Runtime initialization channel closed".into())),
+                        },
+                        ready = instance.api.session().bootstrap_ready(deadline) => ready.map_err(|error| initialization_error(error, self.init_timeout, context)),
+                    },
+                    None => instance
+                        .api
+                        .session()
+                        .bootstrap_ready(deadline)
+                        .await
+                        .map_err(|error| initialization_error(error, self.init_timeout, context)),
+                }
+            };
+            tokio::select! {
+                biased;
+                reason = context.cancelled() => Err(reason.error()),
+                result = ready => result,
+                exit = instance.backend.wait() => exit.and(Err(ExecutorError::RuntimeExited("Bootstrap exited before first Runtime API poll".into()))),
+            }
+        };
+        if let Err(error) = readiness {
+            instance.retire().await?;
+            return Err(error);
+        }
+        debug!(function = %req.revision.function_name, "Lambda bootstrap completed first Runtime API poll");
+        Ok(instance)
     }
 
-    /// Reap instances idle for longer than `idle_timeout`. Returns count.
-    pub(crate) fn reap_idle(&self) -> usize {
+    /// Reap expired idle instances and join their API/process cleanup.
+    pub(crate) async fn reap_idle(&self) -> Result<usize, ExecutorError> {
         let now = Instant::now();
-        let idle = self.idle_timeout;
-        let mut killed = 0usize;
+        let mut retired = Vec::new();
         for mut bucket in self.pools.iter_mut() {
-            let before = bucket.len();
-            bucket.retain(|(_, instance)| now.duration_since(instance.last_used) <= idle);
-            killed += before.saturating_sub(bucket.len());
+            let mut index = 0;
+            while index < bucket.len() {
+                let expired = bucket.get(index).is_some_and(|(_, instance)| {
+                    now.duration_since(instance.last_used) > self.idle_timeout
+                });
+                if expired {
+                    let (_, instance) = bucket.swap_remove(index);
+                    retired.push(instance);
+                } else {
+                    index += 1;
+                }
+            }
         }
         self.pools.retain(|_, bucket| !bucket.is_empty());
-        killed
+        let count = retired.len();
+        retire_all(retired).await?;
+        Ok(count)
     }
 
-    /// Drain and kill every instance in every pool.
-    pub(crate) fn shutdown(&self) {
+    /// Close warm retention before starting owned asynchronous cleanup.
+    pub(crate) fn stop_retention(&self) {
+        self.idle_capacity.close();
+    }
+
+    /// Stop warm retention and join every idle API/process owner.
+    pub(crate) async fn shutdown(&self) -> Result<(), ExecutorError> {
+        self.idle_capacity.close();
+        let mut retired = Vec::new();
+        for mut bucket in self.pools.iter_mut() {
+            retired.extend(take(&mut *bucket).into_iter().map(|(_, instance)| instance));
+        }
         self.pools.clear();
+        retire_all(retired).await
+    }
+}
+
+fn initialization_error(
+    error: SessionError,
+    timeout: Duration,
+    context: &InvocationContext,
+) -> ExecutorError {
+    if let Err(error) = context.check() {
+        return error;
+    }
+    match error {
+        SessionError::Deadline => ExecutorError::Timeout(timeout),
+        _ => invocation_error(error, timeout),
+    }
+}
+
+fn invocation_error(error: SessionError, timeout: Duration) -> ExecutorError {
+    match error {
+        SessionError::HandlerTimeout => ExecutorError::Timeout(timeout),
+        SessionError::Deadline => ExecutorError::DeadlineExceeded,
+        SessionError::Cancelled => ExecutorError::Cancelled,
+        SessionError::SupervisorFailed => {
+            ExecutorError::CleanupFailed("Runtime session supervisor failed".into())
+        }
+        _ => ExecutorError::RuntimeExited("Runtime session is unavailable".into()),
+    }
+}
+
+async fn retire_all(instances: Vec<Instance>) -> Result<(), ExecutorError> {
+    // Idle retention is bounded to32; retire independently so one stalled
+    // HTTP connection cannot multiply the shutdown budget by the pool size.
+    let mut tasks = JoinSet::new();
+    for instance in instances {
+        tasks.spawn(instance.retire());
+    }
+    let mut failure = None;
+    while let Some(result) = tasks.join_next().await {
+        match result {
+            Ok(Ok(())) => {}
+            Ok(Err(error)) => {
+                failure.get_or_insert(error);
+            }
+            Err(_) => {
+                failure.get_or_insert(ExecutorError::CleanupFailed(
+                    "Idle instance cleanup task failed".into(),
+                ));
+            }
+        }
     }
+    failure.map_or(Ok(()), Err)
 }
 
 /// Spawn a periodic idle-reaper background task. Stops when `cancel` flips.
@@ -296,20 +529,87 @@ pub(crate) fn spawn_reaper(
     pool: Arc<InstancePool>,
     interval: Duration,
     mut cancel: tokio::sync::watch::Receiver<bool>,
-) -> tokio::task::JoinHandle<()> {
+) -> JoinHandle<Result<(), ExecutorError>> {
     tokio::spawn(async move {
         let mut tick = tokio::time::interval(interval);
         tick.tick().await; // skip the immediate tick
         loop {
             tokio::select! {
-                _ = cancel.changed() => break,
+                biased;
+                () = async { let _ = cancel.wait_for(|stopped| *stopped).await; } => break,
                 _ = tick.tick() => {
-                    let n = pool.reap_idle();
-                    if n > 0 {
-                        debug!(reaped = n, "lambda idle reaper");
+                    match pool.reap_idle().await {
+                        Ok(n) if n > 0 => debug!(reaped = n, "lambda idle reaper"),
+                        Ok(_) => {},
+                        Err(error) => { pool.idle_capacity.close(); return Err(error); }
                     }
                 }
             }
         }
+        Ok(())
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use rustack_lambda_model::types::ImageConfig;
+
+    use super::*;
+
+    #[test]
+    fn test_should_key_warm_environment_by_resource_and_captured_configuration() {
+        let request = InvokeRequest::fixture();
+        let original = InstancePool::key(&request);
+        let mut alias = request.clone();
+        alias.function_arn.push_str(":prod");
+        assert_eq!(InstancePool::key(&alias), original);
+
+        let mut recreated = request.clone();
+        Arc::make_mut(&mut recreated.revision).resource_id =
+            crate::identity::FunctionResourceId::default();
+        assert_ne!(InstancePool::key(&recreated), original);
+        let mut updated = request.clone();
+        Arc::make_mut(&mut updated.revision).revision_id = "new-revision".into();
+        assert_ne!(InstancePool::key(&updated), original);
+        let mut rehydrated = request.clone();
+        Arc::make_mut(&mut rehydrated.revision).artifact =
+            DeploymentArtifact::Zip(crate::artifact::ValidatedArtifact::fixture());
+        assert_ne!(InstancePool::key(&rehydrated), original);
+        let mut storage = request.clone();
+        Arc::make_mut(&mut storage.revision).ephemeral_storage_mb = 1024;
+        assert_ne!(InstancePool::key(&storage), original);
+        let mut image = request.clone();
+        Arc::make_mut(&mut image.revision).image_config = Some(ImageConfig {
+            command: Some(vec![]),
+            ..ImageConfig::default()
+        });
+        assert_ne!(InstancePool::key(&image), original);
+        let explicitly_empty = InstancePool::key(&image);
+        Arc::make_mut(&mut image.revision).image_config = Some(ImageConfig::default());
+        assert_ne!(InstancePool::key(&image), explicitly_empty);
+    }
+
+    #[test]
+    fn test_should_fingerprint_environment_independently_of_hashmap_iteration_order() {
+        let mut first = InvokeRequest::fixture();
+        Arc::make_mut(&mut first.revision)
+            .environment
+            .insert("FIRST".into(), "one".into());
+        Arc::make_mut(&mut first.revision)
+            .environment
+            .insert("SECOND".into(), "two".into());
+        let mut second = first.clone();
+        Arc::make_mut(&mut second.revision).environment.clear();
+        Arc::make_mut(&mut second.revision)
+            .environment
+            .insert("SECOND".into(), "two".into());
+        Arc::make_mut(&mut second.revision)
+            .environment
+            .insert("FIRST".into(), "one".into());
+        assert_eq!(InstancePool::key(&first), InstancePool::key(&second));
+        Arc::make_mut(&mut second.revision)
+            .environment
+            .insert("SECOND".into(), "changed".into());
+        assert_ne!(InstancePool::key(&first), InstancePool::key(&second));
+    }
+}
diff --git a/crates/rustack-lambda-core/src/executor/mod.rs b/crates/rustack-lambda-core/src/executor/mod.rs
index aec3e863..9452f1eb 100644
--- a/crates/rustack-lambda-core/src/executor/mod.rs
+++ b/crates/rustack-lambda-core/src/executor/mod.rs
@@ -2,15 +2,16 @@
 //!
 //! Routes execution through an object-safe backend with explicit availability.
 //!
-//! - [`NoopExecutor`] rejects execution in Disabled/unsupported Docker modes.
+//! - [`NoopExecutor`] rejects execution in Disabled/unqualified Docker modes.
 //! - [`AutoExecutor`] explicitly opts into Squib on macOS Zip functions, native otherwise.
 //! - [`NativeExecutor`] runs trusted host-matching bootstraps without isolation.
 //! - [`SquibExecutor`] runs arm64 Zip functions through a microVM guest agent.
 //!
-//! Docker execution is not supported; it never falls back to native or successful echo.
+//! On Unix, `DockerExecutor` composes the retained image runtime using a trusted
+//! readiness port. Ordinary CLI Docker selection requires the startup coordinator.
 //!
-//! All backends share a single in-process Lambda Runtime API server (Phase 2)
-//! so the bootstrap-side protocol is identical to AWS.
+//! Native instances expose a host Runtime API socket; Squib delegates the
+//! bootstrap-side protocol to its guest agent.
 //!
 //! `async-trait` is required because `RustackLambda` stores the executor as
 //! `Arc<dyn Executor>` for backend swapping at startup; the trait must be
@@ -31,19 +32,111 @@ pub use error::ExecutorError;
 pub use native::NativeExecutor;
 pub use noop::NoopExecutor;
 pub use squib::{SquibExecutor, SquibExecutorConfig};
-pub use types::{ExecutorBackend, InvokeRequest, InvokeResponse, PackageType};
+pub use types::{ExecutionRevision, ExecutorBackend, InvokeRequest, InvokeResponse};
+
+#[cfg(unix)]
+pub use crate::docker::{
+    DockerExecutor, DockerExecutorConfig, DockerExecutorError, DockerExecutorSettings,
+    DockerReadiness,
+};
+use crate::{artifact::Architecture, invocation::InvocationContext};
 
 /// Backend that turns an [`InvokeRequest`] into an [`InvokeResponse`].
 #[async_trait]
 pub trait Executor: std::fmt::Debug + Send + Sync + 'static {
+    /// Verify image execution readiness before admitting asynchronous deployment.
+    ///
+    /// Backends must explicitly opt in after their Docker runtime probes succeed.
+    ///
+    /// # Errors
+    /// The default rejects image deployment for unsupported or disabled backends.
+    ///
+    /// ```
+    /// # fn check(executor: &dyn rustack_lambda_core::executor::Executor) {
+    /// let ready = executor.image_available().is_ok();
+    /// # }
+    /// ```
+    fn image_available(&self) -> Result<(), ExecutorError> {
+        Err(ExecutorError::Unsupported(
+            "Image execution is unavailable".into(),
+        ))
+    }
+
+    /// Configured Docker ZIP platform for bounded archive profile selection.
+    ///
+    /// This does not grant readiness; callers must separately use
+    /// [`Self::zip_available`] before preparation and publication.
+    ///
+    /// ```
+    /// # fn profile(executor: &dyn rustack_lambda_core::executor::Executor) {
+    /// let configured = executor.docker_zip_architecture();
+    /// # }
+    /// ```
+    fn docker_zip_architecture(&self) -> Option<Architecture> {
+        None
+    }
+
+    /// Check optional provided-runtime ZIP support for a captured architecture.
+    ///
+    /// # Errors
+    /// The default rejects capability which this backend has not installed.
+    ///
+    /// ```
+    /// # fn check(executor:&dyn rustack_lambda_core::executor::Executor) {
+    /// let available=executor.zip_available(rustack_lambda_core::artifact::Architecture::Arm64).is_ok();
+    /// # }
+    /// ```
+    fn zip_available(&self, _architecture: Architecture) -> Result<(), ExecutorError> {
+        Err(ExecutorError::Unsupported(
+            "ZIP execution is unavailable".into(),
+        ))
+    }
+
     /// Check whether execution is enabled before accepting asynchronous work.
-    fn available(&self) -> Result<(), ExecutorError> {
+    ///
+    /// # Errors
+    /// Returns an unavailable-backend or incompatible-artifact/configuration error.
+    ///
+    /// ```
+    /// # use rustack_lambda_core::executor::{Executor, InvokeRequest};
+    /// # fn probe(executor: &dyn Executor, request: &InvokeRequest) {
+    /// let available = executor.available(request).is_ok();
+    /// # }
+    /// ```
+    fn available(&self, _request: &InvokeRequest) -> Result<(), ExecutorError> {
         Ok(())
     }
 
     /// Run the function and return its response.
-    async fn invoke(&self, req: InvokeRequest) -> Result<InvokeResponse, ExecutorError>;
+    ///
+    /// The work supervisor retains this future through cancellation and cleanup.
+    ///
+    /// # Errors
+    /// Returns invocation, initialization, transport or cleanup errors. A clean
+    /// outcome requires backend resources to be reusable or confirmed retired.
+    ///
+    /// ```no_run
+    /// # use rustack_lambda_core::{executor::{Executor, InvokeRequest}, invocation::InvocationContext};
+    /// # async fn invoke(executor: &dyn Executor, request: InvokeRequest, context: InvocationContext) {
+    /// let result = executor.invoke(request, context).await;
+    /// # }
+    /// ```
+    async fn invoke(
+        &self,
+        req: InvokeRequest,
+        context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError>;
 
     /// Stop all warm instances and release resources.
-    async fn shutdown(&self);
+    ///
+    /// # Errors
+    /// Returns `CleanupFailed` if owned resource cleanup cannot be confirmed.
+    /// Dropping a shutdown waiter must retain the underlying cleanup operation.
+    ///
+    /// ```no_run
+    /// # async fn stop(executor: &dyn rustack_lambda_core::executor::Executor) {
+    /// let clean = executor.shutdown().await.is_ok();
+    /// # }
+    /// ```
+    async fn shutdown(&self) -> Result<(), ExecutorError>;
 }
diff --git a/crates/rustack-lambda-core/src/executor/native.rs b/crates/rustack-lambda-core/src/executor/native.rs
index 38310114..22694953 100644
--- a/crates/rustack-lambda-core/src/executor/native.rs
+++ b/crates/rustack-lambda-core/src/executor/native.rs
@@ -5,39 +5,83 @@
 //! match the host. The auto executor keeps macOS Zip functions on Squib and
 //! leaves unsupported image packages for the future Docker backend.
 
-use std::{net::SocketAddr, path::Path, process::Stdio, sync::Arc, time::Duration};
+use std::{
+    future::poll_fn,
+    net::SocketAddr,
+    path::Path,
+    process::Stdio,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
 
 use async_trait::async_trait;
 use parking_lot::Mutex as PMutex;
 use tokio::{
     io::AsyncReadExt,
     process::Command,
+    runtime::Handle,
     sync::{Semaphore, oneshot, watch},
     task::JoinSet,
 };
 use tracing::{debug, warn};
 
 use super::{
-    Executor, ExecutorError, InvokeRequest, InvokeResponse, PackageType,
+    Executor, ExecutorError, InvokeRequest, InvokeResponse,
     instance::{BackendHandle, BackendHandleObj, InstanceBackend, InstancePool, spawn_reaper},
 };
+use crate::{
+    artifact::{Architecture, DeploymentArtifact},
+    invocation::{CleanupTask, InvocationContext, Settlement},
+};
 
 /// Native process executor.
 #[derive(Debug)]
 pub struct NativeExecutor {
     pool: Arc<InstancePool>,
     cancel_tx: watch::Sender<bool>,
-    reaper: PMutex<Option<tokio::task::JoinHandle<()>>>,
-    processes: Arc<PMutex<JoinSet<()>>>,
+    reaper: PMutex<Option<tokio::task::JoinHandle<Result<(), ExecutorError>>>>,
+    processes: Arc<NativeProcesses>,
+    cleanup: CleanupTask,
+}
+
+#[derive(Debug)]
+struct NativeProcesses {
+    tasks: PMutex<JoinSet<()>>,
+    cleanup: CleanupTask,
+    accepting: AtomicBool,
+    capacity: Arc<Semaphore>,
+    runtime: Handle,
+}
+
+impl NativeProcesses {
+    fn start_cleanup(self: &Arc<Self>) {
+        let processes = Arc::clone(self);
+        self.cleanup.start_on(&self.runtime, move || async move {
+            let mut failed = false;
+            while let Some(result) =
+                poll_fn(|context| processes.tasks.lock().poll_join_next(context)).await
+            {
+                if result.is_err() {
+                    failed = true;
+                }
+            }
+            if failed {
+                Err(ExecutorError::CleanupFailed(
+                    "Native process supervisor failed".into(),
+                ))
+            } else {
+                Ok(())
+            }
+        });
+    }
 }
 
 impl Drop for NativeExecutor {
     fn drop(&mut self) {
-        self.pool.shutdown();
-        if let Some(reaper) = self.reaper.lock().take() {
-            reaper.abort();
-        }
-        self.processes.lock().abort_all();
+        self.start_cleanup();
     }
 }
 
@@ -45,10 +89,17 @@ impl NativeExecutor {
     /// Build a new native executor.
     #[must_use]
     pub fn new(max_warm: usize, idle_timeout: Duration, init_timeout: Duration) -> Self {
-        let processes = Arc::new(PMutex::new(JoinSet::new()));
+        let processes = Arc::new(NativeProcesses {
+            tasks: PMutex::new(JoinSet::new()),
+            cleanup: CleanupTask::default(),
+            accepting: AtomicBool::new(true),
+            capacity: Arc::new(Semaphore::new(32)),
+            runtime: Handle::current(),
+        });
+        let (cancel_tx, cancel_rx) = watch::channel(false);
         let backend = Arc::new(NativeBackend {
             processes: Arc::clone(&processes),
-            capacity: Arc::new(Semaphore::new(32)),
+            shutdown: cancel_rx.clone(),
         });
         let pool = Arc::new(InstancePool::new(
             backend,
@@ -56,32 +107,80 @@ impl NativeExecutor {
             idle_timeout,
             init_timeout,
         ));
-        let (cancel_tx, cancel_rx) = watch::channel(false);
         let reaper = spawn_reaper(Arc::clone(&pool), Duration::from_secs(30), cancel_rx);
         Self {
             pool,
             cancel_tx,
             reaper: PMutex::new(Some(reaper)),
             processes,
+            cleanup: CleanupTask::default(),
         }
     }
+
+    fn start_cleanup(&self) {
+        self.processes.accepting.store(false, Ordering::Release);
+        self.cancel_tx.send_replace(true);
+        self.pool.stop_retention();
+        self.cleanup.start_on(&self.processes.runtime, || {
+            let pool = Arc::clone(&self.pool);
+            let processes = Arc::clone(&self.processes);
+            let reaper = self.reaper.lock().take();
+            async move {
+                processes.start_cleanup();
+                let reaper = match reaper {
+                    Some(reaper) => reaper
+                        .await
+                        .map_err(|_| ExecutorError::CleanupFailed("Native reaper failed".into()))
+                        .and_then(|result| result),
+                    None => Ok(()),
+                };
+                let pool = pool.shutdown().await;
+                let children = processes.cleanup.wait().await;
+                reaper.and(pool).and(children)
+            }
+        });
+    }
 }
 
 #[async_trait]
 impl Executor for NativeExecutor {
-    async fn invoke(&self, req: InvokeRequest) -> Result<InvokeResponse, ExecutorError> {
-        if req.package_type != PackageType::Zip {
+    fn available(&self, request: &InvokeRequest) -> Result<(), ExecutorError> {
+        if !self.processes.accepting.load(Ordering::Acquire) {
+            return Err(ExecutorError::Cancelled);
+        }
+        if !matches!(request.revision.artifact, DeploymentArtifact::Zip(_)) {
             return Err(ExecutorError::Unsupported(
-                "native backend only supports Zip packages".to_owned(),
+                "native backend only supports Zip packages".into(),
             ));
         }
-        let code_root = req
-            .code_root
-            .as_ref()
-            .ok_or_else(|| ExecutorError::InvalidCode("missing code root".to_owned()))?;
+        if request.revision.architecture.as_str() != host_architecture() {
+            return Err(ExecutorError::Unsupported(
+                "native backend requires the host architecture".into(),
+            ));
+        }
+        Ok(())
+    }
+
+    async fn invoke(
+        &self,
+        req: InvokeRequest,
+        context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        self.available(&req)?;
+        context.check()?;
+        let DeploymentArtifact::Zip(artifact) = &req.revision.artifact else {
+            return Err(ExecutorError::Unsupported(
+                "native backend only supports Zip packages".into(),
+            ));
+        };
+        let code_root = artifact.code_root();
         let bootstrap = code_root.join("bootstrap");
-        ensure_executable(&bootstrap).await?;
-        if !bootstrap_runs_on_host(&bootstrap, &req.architectures).await? {
+        let supported = tokio::select! {
+            biased;
+            reason = context.cancelled() => return Err(reason.error()),
+            result = async { ensure_executable(&bootstrap).await?; bootstrap_runs_on_host(&bootstrap, req.revision.architecture).await } => result?,
+        };
+        if !supported {
             return Err(ExecutorError::Unsupported(format!(
                 "bootstrap {} cannot run on host {}/{}; use docker backend",
                 bootstrap.display(),
@@ -89,51 +188,41 @@ impl Executor for NativeExecutor {
                 std::env::consts::ARCH,
             )));
         }
-        self.pool.invoke(req).await
+        self.pool.invoke(req, context).await
     }
 
-    async fn shutdown(&self) {
-        let _ = self.cancel_tx.send(true);
-        let reaper = self.reaper.lock().take();
-        if let Some(r) = reaper {
-            if let Err(error) = r.await {
-                warn!(%error, "Lambda idle reaper failed");
-            }
-        }
-        self.pool.shutdown();
-        let mut processes = std::mem::take(&mut *self.processes.lock());
-        while let Some(result) = processes.join_next().await {
-            if let Err(error) = result {
-                warn!(%error, "Lambda process supervisor failed");
-            }
-        }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        self.start_cleanup();
+        self.cleanup.wait().await
     }
 }
 
 #[derive(Debug)]
 struct NativeBackend {
-    processes: Arc<PMutex<JoinSet<()>>>,
-    capacity: Arc<Semaphore>,
+    processes: Arc<NativeProcesses>,
+    shutdown: watch::Receiver<bool>,
 }
 
 #[async_trait]
 impl InstanceBackend for NativeBackend {
     fn has_capacity(&self) -> bool {
-        self.capacity.available_permits() != 0
+        self.processes.capacity.available_permits() != 0
     }
     async fn spawn(
         &self,
         req: &InvokeRequest,
         runtime_api_addr: SocketAddr,
     ) -> Result<BackendHandle, ExecutorError> {
-        let code_root = req
-            .code_root
-            .clone()
-            .ok_or_else(|| ExecutorError::InvalidCode("missing code root".to_owned()))?;
+        let DeploymentArtifact::Zip(artifact) = &req.revision.artifact else {
+            return Err(ExecutorError::Unsupported(
+                "native backend only supports Zip packages".into(),
+            ));
+        };
+        let code_root = artifact.code_root();
         let bootstrap = code_root.join("bootstrap");
 
         let mut cmd = Command::new(&bootstrap);
-        cmd.current_dir(&code_root)
+        cmd.current_dir(code_root)
             .env_clear()
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
@@ -143,6 +232,14 @@ impl InstanceBackend for NativeBackend {
             cmd.env(k, v);
         }
 
+        let permit = Arc::clone(&self.processes.capacity)
+            .acquire_owned()
+            .await
+            .map_err(|_| ExecutorError::Cancelled)?;
+        let mut processes = self.processes.tasks.lock();
+        if !self.processes.accepting.load(Ordering::Acquire) {
+            return Err(ExecutorError::Cancelled);
+        }
         let mut child = cmd
             .spawn()
             .map_err(|e| ExecutorError::Io(format!("spawn bootstrap: {e}")))?;
@@ -157,22 +254,47 @@ impl InstanceBackend for NativeBackend {
             logs.spawn(drain_to_buf(stderr, log_buf, "stderr"));
         }
         let (cancel, cancelled) = oneshot::channel();
-        let mut processes = self.processes.lock();
+        let artifact_lease = artifact.clone();
         while let Some(result) = processes.try_join_next() {
             if let Err(error) = result {
                 warn!(%error, "Lambda process supervisor failed");
             }
         }
+        let (completion, completed) = watch::channel(Settlement::Pending);
+        let mut shutdown = self.shutdown.clone();
         processes.spawn(async move {
-            tokio::select! {
-                _ = cancelled => { if let Err(error) = child.kill().await { warn!(%error, "Lambda process cancellation failed"); } },
-                result = child.wait() => { if let Err(error) = result { warn!(%error, "Lambda process wait failed"); } },
+            {
+                let _artifact_lease = artifact_lease;
+                let _permit = permit;
+                let result = tokio::select! {
+                    biased;
+                    () = async { let _ = shutdown.wait_for(|stopped| *stopped).await; } => child.kill().await,
+                    _ = cancelled => child.kill().await,
+                    result = child.wait() => result.map(|_| ()),
+                };
+                if result.is_err() {
+                    completion.send_replace(Settlement::Uncertain);
+                    // Preserve child/lease/allocation ownership until reaping is confirmed.
+                    loop {
+                        let _ = child.start_kill();
+                        match child.wait().await {
+                            Ok(_) => break,
+                            Err(_) => tokio::time::sleep(Duration::from_secs(1)).await,
+                        }
+                    }
+                }
+                logs.abort_all();
+                while let Some(result) = logs.join_next().await {
+                    if result.is_err_and(|error| !error.is_cancelled()) {
+                        warn!("Native log task failed");
+                    }
+                }
             }
-            logs.abort_all();
-            while let Some(result) = logs.join_next().await { if let Err(error) = result { if !error.is_cancelled() { warn!(%error, "Lambda log task failed"); } } }
+            completion.send_replace(Settlement::Clean);
         });
         Ok(BackendHandle::new(NativeHandle {
             cancel: Some(cancel),
+            completion: completed,
         }))
     }
 }
@@ -180,9 +302,28 @@ impl InstanceBackend for NativeBackend {
 #[derive(Debug)]
 struct NativeHandle {
     cancel: Option<oneshot::Sender<()>>,
+    completion: watch::Receiver<Settlement>,
 }
 
+#[async_trait]
 impl BackendHandleObj for NativeHandle {
+    fn running(&self) -> bool {
+        *self.completion.borrow() == Settlement::Pending
+    }
+
+    async fn wait(&mut self) -> Result<(), ExecutorError> {
+        match self
+            .completion
+            .wait_for(|state| *state != Settlement::Pending)
+            .await
+        {
+            Ok(state) if *state == Settlement::Clean => Ok(()),
+            _ => Err(ExecutorError::CleanupFailed(
+                "Native child exit is not confirmed".into(),
+            )),
+        }
+    }
+
     fn kill(&mut self) {
         if let Some(cancel) = self.cancel.take() {
             if cancel.send(()).is_err() {
@@ -201,16 +342,11 @@ impl Drop for NativeHandle {
 /// Check declared architecture and executable format with fallible asynchronous IO.
 async fn bootstrap_runs_on_host(
     path: &Path,
-    declared_archs: &[String],
+    architecture: Architecture,
 ) -> Result<bool, ExecutorError> {
     // Architecture check first — declared `architectures` must include the
     // host arch.
-    let host_arch = match std::env::consts::ARCH {
-        "x86_64" => "x86_64",
-        "aarch64" => "arm64",
-        other => other,
-    };
-    if !declared_archs.iter().any(|a| a == host_arch) {
+    if architecture.as_str() != host_architecture() {
         return Ok(false);
     }
     let mut file = tokio::fs::File::open(path)
@@ -230,6 +366,13 @@ async fn bootstrap_runs_on_host(
     Ok((elf && host_is_linux) || (macho && host_is_macos))
 }
 
+fn host_architecture() -> &'static str {
+    match std::env::consts::ARCH {
+        "aarch64" => "arm64",
+        other => other,
+    }
+}
+
 /// Require a regular executable bootstrap without modifying immutable artifacts.
 #[cfg(unix)]
 async fn ensure_executable(path: &Path) -> Result<(), ExecutorError> {
@@ -251,32 +394,40 @@ async fn ensure_executable(_path: &Path) -> Result<(), ExecutorError> {
 }
 
 fn lambda_env_vars(req: &InvokeRequest, runtime_api: SocketAddr) -> Vec<(String, String)> {
-    let mut env = Vec::with_capacity(16 + req.environment.len());
-    let task_root = req
-        .code_root
-        .as_ref()
-        .map(|p| p.display().to_string())
-        .unwrap_or_default();
+    let mut env = Vec::with_capacity(16 + req.revision.environment.len());
+    let task_root = match &req.revision.artifact {
+        DeploymentArtifact::Zip(artifact) => artifact.code_root().display().to_string(),
+        DeploymentArtifact::Image(_) => String::new(),
+    };
     env.push(("AWS_LAMBDA_RUNTIME_API".into(), runtime_api.to_string()));
-    env.push(("AWS_LAMBDA_FUNCTION_NAME".into(), req.function_name.clone()));
-    env.push(("AWS_LAMBDA_FUNCTION_VERSION".into(), req.qualifier.clone()));
+    env.push((
+        "AWS_LAMBDA_FUNCTION_NAME".into(),
+        req.revision.function_name.clone(),
+    ));
+    env.push((
+        "AWS_LAMBDA_FUNCTION_VERSION".into(),
+        req.revision.qualifier.clone(),
+    ));
     env.push((
         "AWS_LAMBDA_FUNCTION_MEMORY_SIZE".into(),
-        req.memory_mb.to_string(),
+        req.revision.memory_mb.to_string(),
     ));
     env.push((
         "AWS_LAMBDA_FUNCTION_TIMEOUT".into(),
-        req.timeout.as_secs().to_string(),
+        req.revision.timeout.as_secs().to_string(),
     ));
     env.push((
         "AWS_LAMBDA_LOG_GROUP_NAME".into(),
-        format!("/aws/lambda/{}", req.function_name),
+        format!("/aws/lambda/{}", req.revision.function_name),
     ));
     env.push((
         "AWS_LAMBDA_LOG_STREAM_NAME".into(),
         uuid::Uuid::new_v4().to_string(),
     ));
-    env.push(("_HANDLER".into(), req.handler.clone().unwrap_or_default()));
+    env.push((
+        "_HANDLER".into(),
+        req.revision.handler.clone().unwrap_or_default(),
+    ));
     env.push(("LAMBDA_TASK_ROOT".into(), task_root.clone()));
     env.push(("LAMBDA_RUNTIME_DIR".into(), task_root));
     env.push(("TZ".into(), ":UTC".into()));
@@ -286,7 +437,7 @@ fn lambda_env_vars(req: &InvokeRequest, runtime_api: SocketAddr) -> Vec<(String,
     env.push(("AWS_SECRET_ACCESS_KEY".into(), "test".into()));
     env.push(("AWS_SESSION_TOKEN".into(), "test".into()));
     // User env overrides last, but do not let it shadow the runtime API var.
-    for (k, v) in &req.environment {
+    for (k, v) in &req.revision.environment {
         if k == "AWS_LAMBDA_RUNTIME_API" || k == "_HANDLER" || k == "LAMBDA_TASK_ROOT" {
             warn!(key = %k, "ignoring user override for reserved Lambda env var");
             continue;
@@ -331,7 +482,14 @@ where
         match reader.read(&mut chunk).await {
             Ok(0) => break,
             Ok(n) => {
-                buf.lock().push(&chunk[..n]);
+                let Some(bytes) = chunk.get(..n) else {
+                    warn!(
+                        stream = label,
+                        "lambda runtime reader returned an invalid byte count"
+                    );
+                    break;
+                };
+                buf.lock().push(bytes);
                 debug!(stream = label, bytes = n, "lambda runtime output");
             }
             Err(e) => {
diff --git a/crates/rustack-lambda-core/src/executor/noop.rs b/crates/rustack-lambda-core/src/executor/noop.rs
index 7d052c74..8c0d3465 100644
--- a/crates/rustack-lambda-core/src/executor/noop.rs
+++ b/crates/rustack-lambda-core/src/executor/noop.rs
@@ -2,11 +2,12 @@
 use async_trait::async_trait;
 
 use super::{Executor, ExecutorError, InvokeRequest, InvokeResponse};
+use crate::invocation::InvocationContext;
 
 /// Explicit unavailable backend for metadata-only operation.
 #[derive(Debug, Default, Clone)]
 pub struct NoopExecutor {
-    unsupported_docker: bool,
+    unqualified_docker: bool,
 }
 impl NoopExecutor {
     /// Construct a disabled executor.
@@ -14,14 +15,14 @@ impl NoopExecutor {
     pub fn new() -> Self {
         Self::default()
     }
-    pub(crate) fn docker_unavailable() -> Self {
+    pub(crate) fn without_docker_runtime() -> Self {
         Self {
-            unsupported_docker: true,
+            unqualified_docker: true,
         }
     }
     fn error(&self) -> ExecutorError {
-        if self.unsupported_docker {
-            ExecutorError::Unsupported("Docker execution is not implemented in this build".into())
+        if self.unqualified_docker {
+            ExecutorError::Unsupported("qualified Docker startup has not been installed".into())
         } else {
             ExecutorError::Disabled
         }
@@ -29,11 +30,17 @@ impl NoopExecutor {
 }
 #[async_trait]
 impl Executor for NoopExecutor {
-    fn available(&self) -> Result<(), ExecutorError> {
+    fn available(&self, _request: &InvokeRequest) -> Result<(), ExecutorError> {
         Err(self.error())
     }
-    async fn invoke(&self, _req: InvokeRequest) -> Result<InvokeResponse, ExecutorError> {
+    async fn invoke(
+        &self,
+        _req: InvokeRequest,
+        _context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
         Err(self.error())
     }
-    async fn shutdown(&self) {}
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
 }
diff --git a/crates/rustack-lambda-core/src/executor/runtime_api.rs b/crates/rustack-lambda-core/src/executor/runtime_api.rs
index c32e7b95..826d19c5 100644
--- a/crates/rustack-lambda-core/src/executor/runtime_api.rs
+++ b/crates/rustack-lambda-core/src/executor/runtime_api.rs
@@ -1,518 +1,8 @@
-//! In-process Lambda Runtime API server.
+//! Shared Lambda Runtime API reexports for existing executor consumers.
 //!
-//! Each warm runtime instance (process or container) gets its own socket bound
-//! on `127.0.0.1:0`. The bootstrap inside the instance speaks the standard
-//! Lambda Runtime API to it:
-//!
-//! - `GET  /2018-06-01/runtime/invocation/next` — long-poll for the next job.
-//! - `POST /2018-06-01/runtime/invocation/{id}/response` — deliver success.
-//! - `POST /2018-06-01/runtime/invocation/{id}/error` — deliver function error.
-//! - `POST /2018-06-01/runtime/init/error` — fatal init failure.
-//!
-//! Per AWS, an instance handles one invocation at a time. The receiver is
-//! locked once per `/next` call so concurrent polls (which shouldn't happen
-//! in practice) serialize cleanly.
-
-use std::{
-    convert::Infallible,
-    net::SocketAddr,
-    sync::Arc,
-    time::{Instant, SystemTime, UNIX_EPOCH},
-};
+//! Native and relay adapters use the same bounded runtime session implementation.
 
-use bytes::Bytes;
-use dashmap::DashMap;
-use http_body_util::{BodyExt, Full, Limited};
-use hyper::{
-    Method, Request, Response, StatusCode, body::Incoming, server::conn::http1, service::service_fn,
+pub use rustack_lambda_runtime::{
+    http::{ApiError, RuntimeApiHandle, start, start_at},
+    session::{Invocation, InvocationTicket, RuntimeResult, SessionError},
 };
-use hyper_util::rt::TokioIo;
-use tokio::{
-    net::TcpListener,
-    sync::{Mutex, mpsc, oneshot, watch},
-    task::{JoinHandle, JoinSet},
-};
-use tracing::{debug, warn};
-
-/// One unit of work for a runtime instance: payload in, result out.
-#[derive(Debug)]
-pub struct Job {
-    /// Synthetic AWS request id (UUID).
-    pub request_id: String,
-    /// Function ARN reported via `Lambda-Runtime-Invoked-Function-Arn`.
-    pub function_arn: String,
-    /// Wall-clock deadline (used for `Lambda-Runtime-Deadline-Ms`).
-    pub deadline: Instant,
-    /// Body delivered as the invocation event.
-    pub payload: Bytes,
-    /// Where to send the bootstrap's response (or error).
-    pub response_tx: oneshot::Sender<RuntimeResult>,
-}
-
-/// Result of a runtime round-trip.
-#[derive(Debug, Clone)]
-pub enum RuntimeResult {
-    /// Bootstrap posted to `/response`.
-    Success(Bytes),
-    /// Bootstrap posted to `/error`.
-    Error(Bytes),
-    /// Bootstrap posted to `/init/error` before invocation.
-    InitError(Bytes),
-}
-
-/// Handle to a running runtime API socket. Drop or call `shutdown` to stop.
-#[derive(Debug)]
-pub struct RuntimeApiHandle {
-    addr: SocketAddr,
-    job_tx: mpsc::Sender<Job>,
-    shutdown_tx: watch::Sender<bool>,
-    accept_task: Option<JoinHandle<()>>,
-    /// Optional channel that the orchestrator subscribes to in order to be
-    /// notified of `/init/error` failures.
-    init_error_rx: Mutex<Option<oneshot::Receiver<Bytes>>>,
-}
-
-impl RuntimeApiHandle {
-    /// Bound socket address.
-    #[must_use]
-    pub fn addr(&self) -> SocketAddr {
-        self.addr
-    }
-
-    /// Submit a new invocation job. Fails if the runtime task has stopped.
-    pub async fn submit(&self, job: Job) -> Result<(), &'static str> {
-        self.job_tx
-            .send(job)
-            .await
-            .map_err(|_| "runtime api task is gone")
-    }
-
-    /// Take the init-error receiver. Returns `Some` exactly once.
-    pub async fn take_init_error_rx(&self) -> Option<oneshot::Receiver<Bytes>> {
-        self.init_error_rx.lock().await.take()
-    }
-
-    /// Stop the accept loop and wait for it to exit.
-    pub async fn shutdown(&mut self) {
-        let _ = self.shutdown_tx.send(true);
-        if let Some(task) = self.accept_task.take() {
-            let _ = task.await;
-        }
-    }
-}
-
-impl Drop for RuntimeApiHandle {
-    fn drop(&mut self) {
-        let _ = self.shutdown_tx.send(true);
-        if let Some(task) = self.accept_task.take() {
-            task.abort();
-        }
-    }
-}
-
-/// State shared across connection handlers.
-#[derive(Debug)]
-struct State {
-    /// Single-consumer queue of pending jobs.
-    job_rx: Mutex<mpsc::Receiver<Job>>,
-    /// `request_id` -> `oneshot::Sender<RuntimeResult>` for the in-flight job.
-    pending: DashMap<String, oneshot::Sender<RuntimeResult>>,
-    /// One-shot to signal an init-error to the orchestrator.
-    init_error_tx: Mutex<Option<oneshot::Sender<Bytes>>>,
-}
-
-/// Bind a fresh runtime API socket and return a handle.
-///
-/// The bootstrap process should be started **after** this returns, with
-/// `AWS_LAMBDA_RUNTIME_API` set to `handle.addr()`.
-pub async fn start() -> std::io::Result<RuntimeApiHandle> {
-    let listener = TcpListener::bind(("127.0.0.1", 0)).await?;
-    let addr = listener.local_addr()?;
-
-    let (job_tx, job_rx) = mpsc::channel::<Job>(8);
-    let (shutdown_tx, mut shutdown_rx) = watch::channel(false);
-    let (init_err_tx, init_err_rx) = oneshot::channel::<Bytes>();
-
-    let state = Arc::new(State {
-        job_rx: Mutex::new(job_rx),
-        pending: DashMap::new(),
-        init_error_tx: Mutex::new(Some(init_err_tx)),
-    });
-
-    let accept_task = tokio::spawn(async move {
-        let mut connections = JoinSet::new();
-        loop {
-            tokio::select! {
-                result = connections.join_next(), if !connections.is_empty() => { if let Some(Err(error)) = result { warn!(%error, "Runtime API connection task failed"); } }
-                _ = shutdown_rx.changed() => {
-                    debug!("runtime api: shutdown signalled, exiting accept loop");
-                    break;
-                }
-                accepted = listener.accept() => {
-                    let (stream, _peer) = match accepted {
-                        Ok(c) => c,
-                        Err(e) => {
-                            warn!(error = %e, "runtime api accept failed");
-                            continue;
-                        }
-                    };
-                    if connections.len() >= 4 { drop(stream); continue; }
-                    let state = Arc::clone(&state);
-                    connections.spawn(async move {
-                        let io = TokioIo::new(stream);
-                        let svc = service_fn(move |req| {
-                            let state = Arc::clone(&state);
-                            async move { handle(state, req).await }
-                        });
-                        if let Err(e) = http1::Builder::new()
-                            .serve_connection(io, svc)
-                            .await
-                        {
-                            // EOF / reset is expected when the bootstrap exits.
-                            debug!(error = %e, "runtime api connection closed");
-                        }
-                    });
-                }
-            }
-        }
-        connections.abort_all();
-        while let Some(result) = connections.join_next().await {
-            if let Err(error) = result {
-                debug!(%error, "Runtime API connection stopped");
-            }
-        }
-    });
-
-    Ok(RuntimeApiHandle {
-        addr,
-        job_tx,
-        shutdown_tx,
-        accept_task: Some(accept_task),
-        init_error_rx: Mutex::new(Some(init_err_rx)),
-    })
-}
-
-/// Service entry point.
-async fn handle(
-    state: Arc<State>,
-    req: Request<Incoming>,
-) -> Result<Response<Full<Bytes>>, Infallible> {
-    let method = req.method().clone();
-    let path = req.uri().path().to_owned();
-    debug!(%method, %path, "runtime api request");
-
-    let result = match (method, path.as_str()) {
-        (Method::GET, "/2018-06-01/runtime/invocation/next") => handle_next(&state).await,
-        (Method::POST, p)
-            if p.starts_with("/2018-06-01/runtime/invocation/") && p.ends_with("/response") =>
-        {
-            handle_complete(&state, &path, req, RuntimeResult::Success).await
-        }
-        (Method::POST, p)
-            if p.starts_with("/2018-06-01/runtime/invocation/") && p.ends_with("/error") =>
-        {
-            handle_complete(&state, &path, req, RuntimeResult::Error).await
-        }
-        (Method::POST, "/2018-06-01/runtime/init/error") => handle_init_error(&state, req).await,
-        _ => Ok(simple(StatusCode::NOT_FOUND, b"not found".as_ref())),
-    };
-
-    Ok(result.unwrap_or_else(|status| simple(status, b"".as_ref())))
-}
-
-/// Long-poll for the next job. Returns once a job is queued or shutdown
-/// drops the channel.
-async fn handle_next(state: &Arc<State>) -> Result<Response<Full<Bytes>>, StatusCode> {
-    let mut rx = state.job_rx.lock().await;
-    let Some(job) = rx.recv().await else {
-        return Err(StatusCode::SERVICE_UNAVAILABLE);
-    };
-    drop(rx); // release before doing any work
-
-    let Job {
-        request_id,
-        function_arn,
-        deadline,
-        payload,
-        response_tx,
-    } = job;
-
-    state.pending.insert(request_id.clone(), response_tx);
-
-    let deadline_ms = deadline_unix_ms(deadline);
-    // X-Ray-shaped trace id for runtime SDKs that expect the header to be
-    // present. Format isn't validated downstream — a UUID-derived value is
-    // fine for local emulation.
-    let trace_id = format!(
-        "Root=1-{:08x}-{};Parent={};Sampled=1",
-        unix_secs_lower32(),
-        uuid::Uuid::new_v4().simple(),
-        &uuid::Uuid::new_v4().simple().to_string()[..16],
-    );
-
-    let resp = Response::builder()
-        .status(StatusCode::OK)
-        .header("Lambda-Runtime-Aws-Request-Id", &request_id)
-        .header("Lambda-Runtime-Deadline-Ms", deadline_ms.to_string())
-        .header("Lambda-Runtime-Invoked-Function-Arn", &function_arn)
-        .header("Lambda-Runtime-Trace-Id", trace_id)
-        .header("Content-Type", "application/json")
-        .body(Full::new(payload))
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    Ok(resp)
-}
-
-/// Handle `/response` or `/error` — fire the matching oneshot, return 202.
-async fn handle_complete<F>(
-    state: &Arc<State>,
-    path: &str,
-    req: Request<Incoming>,
-    map_result: F,
-) -> Result<Response<Full<Bytes>>, StatusCode>
-where
-    F: FnOnce(Bytes) -> RuntimeResult,
-{
-    let request_id = parse_request_id(path).ok_or(StatusCode::BAD_REQUEST)?;
-    let body = collect(req.into_body()).await?;
-    if let Some((_, sender)) = state.pending.remove(&request_id) {
-        let _ = sender.send(map_result(body));
-        Ok(simple(StatusCode::ACCEPTED, b"".as_ref()))
-    } else {
-        Ok(simple(
-            StatusCode::BAD_REQUEST,
-            b"unknown request id".as_ref(),
-        ))
-    }
-}
-
-async fn handle_init_error(
-    state: &Arc<State>,
-    req: Request<Incoming>,
-) -> Result<Response<Full<Bytes>>, StatusCode> {
-    let body = collect(req.into_body()).await?;
-    if let Some(tx) = state.init_error_tx.lock().await.take() {
-        let _ = tx.send(body);
-    }
-    Ok(simple(StatusCode::ACCEPTED, b"".as_ref()))
-}
-
-fn parse_request_id(path: &str) -> Option<String> {
-    let after = path.strip_prefix("/2018-06-01/runtime/invocation/")?;
-    let id = after.split('/').next()?;
-    if id.is_empty() {
-        None
-    } else {
-        Some(id.to_owned())
-    }
-}
-
-fn deadline_unix_ms(deadline: Instant) -> u64 {
-    let now = Instant::now();
-    let remaining = deadline.saturating_duration_since(now);
-    let now_ms = u64::try_from(
-        SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_millis(),
-    )
-    .unwrap_or(u64::MAX);
-    now_ms.saturating_add(u64::try_from(remaining.as_millis()).unwrap_or(0))
-}
-
-#[allow(clippy::cast_possible_truncation)]
-fn unix_secs_lower32() -> u32 {
-    let secs = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_secs();
-    // Wrapping is fine — the trace id is opaque to consumers.
-    (secs & 0xFFFF_FFFF) as u32
-}
-
-async fn collect(body: Incoming) -> Result<Bytes, StatusCode> {
-    tokio::time::timeout(
-        std::time::Duration::from_secs(5),
-        Limited::new(body, 6 * 1024 * 1024).collect(),
-    )
-    .await
-    .map_err(|_| StatusCode::REQUEST_TIMEOUT)?
-    .map(http_body_util::Collected::to_bytes)
-    .map_err(|error| {
-        if error.is::<http_body_util::LengthLimitError>() {
-            StatusCode::PAYLOAD_TOO_LARGE
-        } else {
-            StatusCode::BAD_REQUEST
-        }
-    })
-}
-
-fn simple(status: StatusCode, body: &[u8]) -> Response<Full<Bytes>> {
-    Response::builder()
-        .status(status)
-        .body(Full::new(Bytes::copy_from_slice(body)))
-        .unwrap_or_else(|_| Response::new(Full::new(Bytes::from_static(b""))))
-}
-
-#[cfg(test)]
-mod tests {
-    use std::time::Duration;
-
-    use tokio::{
-        io::{AsyncReadExt, AsyncWriteExt},
-        net::TcpStream,
-    };
-
-    use super::*;
-
-    /// Send a raw HTTP/1.1 request, return (status_line, headers_block, body_bytes).
-    async fn http_request(
-        addr: SocketAddr,
-        method: &str,
-        path: &str,
-        body: &[u8],
-    ) -> (String, String, Vec<u8>) {
-        let mut stream = TcpStream::connect(addr).await.unwrap();
-        let req = format!(
-            "{method} {path} HTTP/1.1\r\nHost: {addr}\r\nContent-Length: {len}\r\nConnection: \
-             close\r\n\r\n",
-            len = body.len(),
-        );
-        stream.write_all(req.as_bytes()).await.unwrap();
-        if !body.is_empty() {
-            stream.write_all(body).await.unwrap();
-        }
-        let mut buf = Vec::new();
-        stream.read_to_end(&mut buf).await.unwrap();
-
-        // Split status / headers / body manually.
-        let split = buf
-            .windows(4)
-            .position(|w| w == b"\r\n\r\n")
-            .expect("header terminator");
-        let head_text = String::from_utf8_lossy(&buf[..split]).to_string();
-        let body_bytes = buf[split + 4..].to_vec();
-        let mut lines = head_text.split("\r\n");
-        let status = lines.next().unwrap_or("").to_owned();
-        let headers = lines.collect::<Vec<_>>().join("\r\n");
-        (status, headers, body_bytes)
-    }
-
-    fn header_value(headers: &str, name: &str) -> Option<String> {
-        let needle = name.to_ascii_lowercase();
-        headers.split("\r\n").find_map(|line| {
-            let (k, v) = line.split_once(':')?;
-            if k.trim().to_ascii_lowercase() == needle {
-                Some(v.trim().to_owned())
-            } else {
-                None
-            }
-        })
-    }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn test_should_round_trip_invocation_via_runtime_api() {
-        let handle = start().await.unwrap();
-        let addr = handle.addr();
-
-        let (resp_tx, resp_rx) = oneshot::channel();
-        let job = Job {
-            request_id: "req-1".to_owned(),
-            function_arn: "arn:fake".to_owned(),
-            deadline: Instant::now() + Duration::from_secs(3),
-            payload: Bytes::from_static(b"{\"hi\":1}"),
-            response_tx: resp_tx,
-        };
-        handle.submit(job).await.unwrap();
-
-        let bootstrap = tokio::spawn(async move {
-            let (status, headers, body) =
-                http_request(addr, "GET", "/2018-06-01/runtime/invocation/next", b"").await;
-            assert!(status.starts_with("HTTP/1.1 200"), "status: {status}");
-            let request_id =
-                header_value(&headers, "Lambda-Runtime-Aws-Request-Id").expect("request id header");
-            assert_eq!(request_id, "req-1");
-            assert_eq!(&body[..], b"{\"hi\":1}");
-
-            let path = format!("/2018-06-01/runtime/invocation/{request_id}/response");
-            let (status, _h, _b) = http_request(addr, "POST", &path, b"{\"echo\":1}").await;
-            assert!(status.starts_with("HTTP/1.1 202"), "post status: {status}");
-        });
-
-        let result = tokio::time::timeout(Duration::from_secs(3), resp_rx)
-            .await
-            .expect("oneshot timed out")
-            .unwrap();
-        match result {
-            RuntimeResult::Success(b) => assert_eq!(&b[..], b"{\"echo\":1}"),
-            other => panic!("expected Success, got {other:?}"),
-        }
-        bootstrap.await.unwrap();
-    }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn test_should_propagate_function_error() {
-        let handle = start().await.unwrap();
-        let addr = handle.addr();
-
-        let (resp_tx, resp_rx) = oneshot::channel();
-        handle
-            .submit(Job {
-                request_id: "req-2".to_owned(),
-                function_arn: "arn:fake".to_owned(),
-                deadline: Instant::now() + Duration::from_secs(3),
-                payload: Bytes::from_static(b"{}"),
-                response_tx: resp_tx,
-            })
-            .await
-            .unwrap();
-
-        tokio::spawn(async move {
-            let (_s, headers, _b) =
-                http_request(addr, "GET", "/2018-06-01/runtime/invocation/next", b"").await;
-            let id = header_value(&headers, "Lambda-Runtime-Aws-Request-Id").unwrap();
-            let path = format!("/2018-06-01/runtime/invocation/{id}/error");
-            http_request(
-                addr,
-                "POST",
-                &path,
-                br#"{"errorMessage":"boom","errorType":"TestError"}"#,
-            )
-            .await;
-        });
-
-        let result = tokio::time::timeout(Duration::from_secs(3), resp_rx)
-            .await
-            .unwrap()
-            .unwrap();
-        match result {
-            RuntimeResult::Error(b) => {
-                let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-                assert_eq!(v["errorType"], "TestError");
-            }
-            other => panic!("expected Error, got {other:?}"),
-        }
-    }
-
-    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-    async fn test_should_capture_init_error() {
-        let handle = start().await.unwrap();
-        let addr = handle.addr();
-        let init_rx = handle.take_init_error_rx().await.unwrap();
-
-        tokio::spawn(async move {
-            http_request(
-                addr,
-                "POST",
-                "/2018-06-01/runtime/init/error",
-                br#"{"errorMessage":"init failed"}"#,
-            )
-            .await;
-        });
-        let body = tokio::time::timeout(Duration::from_secs(3), init_rx)
-            .await
-            .unwrap()
-            .unwrap();
-        let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
-        assert_eq!(v["errorMessage"], "init failed");
-    }
-}
diff --git a/crates/rustack-lambda-core/src/executor/squib.rs b/crates/rustack-lambda-core/src/executor/squib.rs
index fd656489..790a9682 100644
--- a/crates/rustack-lambda-core/src/executor/squib.rs
+++ b/crates/rustack-lambda-core/src/executor/squib.rs
@@ -6,8 +6,10 @@
 
 use std::{
     collections::HashMap,
-    env,
+    env, fmt,
+    future::Future,
     path::{Path, PathBuf},
+    sync::Arc,
     time::Duration,
 };
 
@@ -15,11 +17,18 @@ use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::STANDARD};
 use bytes::Bytes;
 use serde::{Deserialize, Serialize};
-use tokio::{sync::Mutex, time::Instant};
-use tracing::warn;
+use tokio::{
+    runtime::Handle,
+    sync::{Mutex, watch},
+    time::Instant,
+};
 use uuid::Uuid;
 
-use super::{Executor, ExecutorError, InvokeRequest, InvokeResponse, PackageType};
+use super::{Executor, ExecutorError, InvokeRequest, InvokeResponse};
+use crate::{
+    artifact::{Architecture, DeploymentArtifact},
+    invocation::{CleanupTask, InvocationContext},
+};
 
 const DEFAULT_INSTANCE_ID: &str = "rustack_lambda";
 const DEFAULT_STAGE_PORT: u32 = 5003;
@@ -33,9 +42,7 @@ const DEFAULT_RESPONSE_LIMIT_BYTES: usize =
 const DEFAULT_RUN_BUDGET: Duration = Duration::from_hours(24);
 const DEFAULT_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(10);
 const CONNECT_RESPONSE_LIMIT_BYTES: usize = 128;
-const CONTROL_RESPONSE_LIMIT_BYTES: usize = 1024;
 const PROTOCOL_VERSION: &str = "rustack.squib.lambda.v1";
-const SHUTDOWN_REQUEST_KIND: &str = "shutdown";
 
 /// Configuration for [`SquibExecutor`].
 #[derive(Debug, Clone)]
@@ -60,6 +67,10 @@ pub struct SquibExecutorConfig {
 
 impl SquibExecutorConfig {
     /// Read Squib executor configuration from environment variables.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid paths, instance IDs, ports, timeouts, response limits or run budgets.
     pub fn from_env() -> Result<Self, ExecutorError> {
         Self::from_env_reader(|key| match rustack_core::settings::var(key) {
             Ok(value) => Some(value),
@@ -165,12 +176,61 @@ impl Default for SquibExecutorConfig {
 #[derive(Debug)]
 pub struct SquibExecutor {
     config: SquibExecutorConfig,
-    runtime: Mutex<Option<squib::Squib>>,
+    runtime: Mutex<Option<OwnedVm<squib::Squib>>>,
     poisoned: std::sync::atomic::AtomicBool,
+    stop: watch::Sender<bool>,
+    cleanup: Arc<CleanupTask>,
+}
+
+/// A concrete VM owner; even an idle owner's Drop starts retained shutdown.
+struct OwnedVm<R: VmShutdown> {
+    runtime: Option<R>,
+    cleanup: Arc<CleanupTask>,
+    spawner: Handle,
+}
+
+trait VmShutdown: Send + 'static {
+    fn shutdown(self) -> impl Future<Output = Result<(), ExecutorError>> + Send;
+}
+
+impl VmShutdown for squib::Squib {
+    async fn shutdown(mut self) -> Result<(), ExecutorError> {
+        squib::Squib::shutdown(&mut self)
+            .await
+            .map_err(|_| ExecutorError::CleanupFailed("Squib VM shutdown failed".into()))
+    }
+}
+
+impl<R: VmShutdown> OwnedVm<R> {
+    fn new(runtime: R, cleanup: Arc<CleanupTask>) -> Self {
+        Self {
+            runtime: Some(runtime),
+            cleanup,
+            spawner: Handle::current(),
+        }
+    }
+}
+
+impl<R: VmShutdown> fmt::Debug for OwnedVm<R> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("OwnedVm").finish_non_exhaustive()
+    }
+}
+
+impl<R: VmShutdown> Drop for OwnedVm<R> {
+    fn drop(&mut self) {
+        if let Some(runtime) = self.runtime.take() {
+            // This owner creates the only VM for this cleanup task. Use the
+            // captured runtime even if Drop runs outside an entered Tokio context.
+            self.cleanup
+                .start_on(&self.spawner, move || runtime.shutdown());
+        }
+    }
 }
 
+#[derive(Debug)]
 struct RuntimeLease<'a> {
-    runtime: Option<squib::Squib>,
+    runtime: Option<OwnedVm<squib::Squib>>,
     poisoned: &'a std::sync::atomic::AtomicBool,
 }
 impl Drop for RuntimeLease<'_> {
@@ -178,24 +238,36 @@ impl Drop for RuntimeLease<'_> {
         if self.runtime.is_some() {
             self.poisoned
                 .store(true, std::sync::atomic::Ordering::Release);
-            // Squib's RAII handle requests VM shutdown. Never admit another guest after
-            // cancellation.
+            // OwnedVm transfers shutdown to the retained cleanup task on Drop.
         }
     }
 }
 
+impl Drop for SquibExecutor {
+    fn drop(&mut self) {
+        self.poisoned
+            .store(true, std::sync::atomic::Ordering::Release);
+        self.stop.send_replace(true);
+        // An idle VM must follow the same owned shutdown path as a busy one.
+        drop(self.runtime.get_mut().take());
+    }
+}
+
 impl SquibExecutor {
     /// Build a Squib executor.
     #[must_use]
     pub fn new(config: SquibExecutorConfig) -> Self {
+        let (stop, _) = watch::channel(false);
         Self {
             config,
             runtime: Mutex::new(None),
             poisoned: std::sync::atomic::AtomicBool::new(false),
+            stop,
+            cleanup: Arc::new(CleanupTask::default()),
         }
     }
 
-    async fn start_runtime(&self) -> Result<squib::Squib, ExecutorError> {
+    async fn start_runtime(&self) -> Result<OwnedVm<squib::Squib>, ExecutorError> {
         let config_file = self.config.required_config_file()?;
         ensure_config_file_exists(config_file).await?;
 
@@ -206,21 +278,26 @@ impl SquibExecutor {
             .without_api_socket()
             .run_budget(self.config.run_budget);
 
-        let squib = builder
-            .spawn()
-            .await
-            .map_err(|err| ExecutorError::InitFailed(format!("start Squib runtime: {err}")))?;
-        Ok(squib)
+        let squib = builder.spawn().await.map_err(|_| {
+            ExecutorError::CleanupFailed(
+                "Squib startup did not establish confirmed runtime ownership".into(),
+            )
+        })?;
+        Ok(OwnedVm::new(squib, Arc::clone(&self.cleanup)))
     }
 
-    async fn invoke_guest(&self, req: InvokeRequest) -> Result<InvokeResponse, ExecutorError> {
+    async fn invoke_guest(
+        &self,
+        req: &InvokeRequest,
+        context: &InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
         #[cfg(unix)]
         {
             let mut stream = connect_stage_socket_with_retry(&self.config).await?;
-            let request = SquibInvokeRequestWire::from_request(&req)?;
+            let request = SquibInvokeRequestWire::from_request(req, context.id())?;
             let request_bytes = serde_json::to_vec(&request)
                 .map_err(|err| ExecutorError::Io(format!("encode Squib request: {err}")))?;
-            tokio::time::timeout(req.timeout, async {
+            tokio::time::timeout(req.revision.timeout, async {
                 use tokio::io::AsyncWriteExt as _;
 
                 stream
@@ -236,10 +313,10 @@ impl SquibExecutor {
                     "Squib response",
                 )
                 .await?;
-                decode_response(&line, req.qualifier.as_str())
+                decode_response(&line, req.revision.qualifier.as_str())
             })
             .await
-            .map_err(|_| ExecutorError::Timeout(req.timeout))?
+            .map_err(|_| ExecutorError::Timeout(req.revision.timeout))?
         }
 
         #[cfg(not(unix))]
@@ -250,11 +327,29 @@ impl SquibExecutor {
             ))
         }
     }
+    async fn retire_vm(&self, vm: OwnedVm<squib::Squib>) -> Result<(), ExecutorError> {
+        self.poisoned
+            .store(true, std::sync::atomic::Ordering::Release);
+        drop(vm);
+        self.wait_for_cleanup().await
+    }
+
+    async fn wait_for_cleanup(&self) -> Result<(), ExecutorError> {
+        // Only the waiter has a deadline. CleanupTask retains the VM shutdown
+        // future even when this budget expires or the caller drops the waiter.
+        tokio::time::timeout(self.config.shutdown_timeout, self.cleanup.wait())
+            .await
+            .map_err(|_| {
+                ExecutorError::CleanupFailed("Squib VM shutdown is not confirmed".into())
+            })?
+    }
 }
 
 #[async_trait]
 impl Executor for SquibExecutor {
-    fn available(&self) -> Result<(), ExecutorError> {
+    fn available(&self, request: &InvokeRequest) -> Result<(), ExecutorError> {
+        validate_request(request)?;
+        self.config.required_vsock_path()?;
         if self.poisoned.load(std::sync::atomic::Ordering::Acquire) {
             return Err(ExecutorError::Unsupported(
                 "Squib guest execution was cancelled; restart the runtime before invoking again"
@@ -264,60 +359,70 @@ impl Executor for SquibExecutor {
         Ok(())
     }
 
-    async fn invoke(&self, req: InvokeRequest) -> Result<InvokeResponse, ExecutorError> {
-        validate_request(&req)?;
-        self.config.required_vsock_path()?;
-        let mut runtime = self.runtime.lock().await;
-        self.available()?;
+    async fn invoke(
+        &self,
+        req: InvokeRequest,
+        context: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        self.available(&req)?;
+        context.check()?;
+        let mut runtime = tokio::select! {
+            biased;
+            reason = context.cancelled() => return Err(reason.error()),
+            runtime = self.runtime.lock() => runtime,
+        };
+        self.available(&req)?;
+        // Squib's startup future owns unjoined VMM handles; never drop it on cancellation.
         let vm = match runtime.take() {
             Some(vm) => vm,
-            None => self.start_runtime().await?,
+            None => match self.start_runtime().await {
+                Ok(vm) => vm,
+                Err(error) => {
+                    if matches!(&error, ExecutorError::CleanupFailed(_)) {
+                        self.poisoned
+                            .store(true, std::sync::atomic::Ordering::Release);
+                    }
+                    return Err(error);
+                }
+            },
         };
         let mut lease = RuntimeLease {
             runtime: Some(vm),
             poisoned: &self.poisoned,
         };
-        let result = self.invoke_guest(req).await;
+        let mut stop = self.stop.subscribe();
+        let mut result = tokio::select! {
+            biased;
+            reason = context.cancelled() => Err(reason.error()),
+            _ = stop.wait_for(|stopped| *stopped) => Err(ExecutorError::Cancelled),
+            result = self.invoke_guest(&req, &context) => result,
+        };
+        if self.poisoned.load(std::sync::atomic::Ordering::Acquire) || *self.stop.borrow() {
+            result = Err(ExecutorError::Cancelled);
+        }
+        if result.is_ok() {
+            if let Err(error) = context.check() {
+                result = Err(error);
+            }
+        }
         if result.is_ok() {
             *runtime = lease.runtime.take();
+        } else if let Some(vm) = lease.runtime.take() {
+            self.retire_vm(vm).await?;
         }
         result
     }
 
-    async fn shutdown(&self) {
-        let mut runtime = self.runtime.lock().await.take();
-        if let Some(squib) = runtime.as_mut() {
-            #[cfg(unix)]
-            match tokio::time::timeout(
-                self.config.shutdown_timeout,
-                request_guest_shutdown(&self.config),
-            )
-            .await
-            {
-                Ok(Ok(())) => {}
-                Ok(Err(err)) => {
-                    warn!(error = %err, "failed to request Squib Lambda guest shutdown");
-                }
-                Err(_) => {
-                    warn!(
-                        timeout_ms = self.config.shutdown_timeout.as_millis(),
-                        "timed out requesting Squib Lambda guest shutdown"
-                    );
-                }
-            }
-            match tokio::time::timeout(self.config.shutdown_timeout, squib.shutdown()).await {
-                Ok(Ok(())) => {}
-                Ok(Err(err)) => {
-                    warn!(error = %err, "failed to shut down Squib Lambda runtime");
-                }
-                Err(_) => {
-                    warn!(
-                        timeout_ms = self.config.shutdown_timeout.as_millis(),
-                        "timed out shutting down Squib Lambda runtime"
-                    );
-                }
-            }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        self.poisoned
+            .store(true, std::sync::atomic::Ordering::Release);
+        self.stop.send_replace(true);
+        let mut runtime = self.runtime.lock().await;
+        if let Some(vm) = runtime.take() {
+            self.retire_vm(vm).await?;
         }
+        drop(runtime);
+        self.wait_for_cleanup().await
     }
 }
 
@@ -342,36 +447,27 @@ struct SquibInvokeRequestWire {
     payload_base64: String,
 }
 
-#[derive(Debug, Serialize)]
-#[serde(rename_all = "camelCase")]
-struct SquibControlRequestWire {
-    protocol_version: &'static str,
-    kind: &'static str,
-}
-
 impl SquibInvokeRequestWire {
-    fn from_request(req: &InvokeRequest) -> Result<Self, ExecutorError> {
-        let code_zip = req
-            .code_zip
-            .as_ref()
-            .ok_or_else(|| ExecutorError::InvalidCode("missing code zip".to_owned()))?;
+    fn from_request(req: &InvokeRequest, request_id: Uuid) -> Result<Self, ExecutorError> {
+        let DeploymentArtifact::Zip(artifact) = &req.revision.artifact else {
+            return Err(ExecutorError::Unsupported(
+                "Squib backend only supports Zip packages".into(),
+            ));
+        };
         Ok(Self {
             protocol_version: PROTOCOL_VERSION,
-            request_id: Uuid::new_v4().to_string(),
+            request_id: request_id.to_string(),
             function_arn: req.function_arn.clone(),
-            function_name: req.function_name.clone(),
-            qualifier: req.qualifier.clone(),
-            runtime: req.runtime.clone(),
-            handler: req.handler.clone(),
-            architectures: req.architectures.clone(),
-            code_root: req
-                .code_root
-                .as_ref()
-                .map(|path| path.display().to_string()),
-            code_zip_base64: STANDARD.encode(code_zip.as_ref()),
-            environment: req.environment.clone(),
-            timeout_ms: duration_millis(req.timeout),
-            memory_mb: req.memory_mb,
+            function_name: req.revision.function_name.clone(),
+            qualifier: req.revision.qualifier.clone(),
+            runtime: req.revision.runtime.clone(),
+            handler: req.revision.handler.clone(),
+            architectures: vec![req.revision.architecture.as_str().into()],
+            code_root: Some(artifact.code_root().display().to_string()),
+            code_zip_base64: STANDARD.encode(artifact.zip_bytes()),
+            environment: req.revision.environment.clone(),
+            timeout_ms: duration_millis(req.revision.timeout),
+            memory_mb: req.revision.memory_mb,
             capture_logs: req.capture_logs,
             payload_base64: STANDARD.encode(req.payload.as_ref()),
         })
@@ -393,19 +489,16 @@ struct SquibInvokeResponseWire {
 }
 
 fn validate_request(req: &InvokeRequest) -> Result<(), ExecutorError> {
-    if req.package_type != PackageType::Zip {
+    if !matches!(req.revision.artifact, DeploymentArtifact::Zip(_)) {
         return Err(ExecutorError::Unsupported(
             "Squib backend only supports Zip packages".to_owned(),
         ));
     }
-    if !req.architectures.iter().any(|arch| arch == "arm64") {
+    if req.revision.architecture != Architecture::Arm64 {
         return Err(ExecutorError::Unsupported(
             "Squib backend requires an arm64 Lambda function".to_owned(),
         ));
     }
-    if req.code_zip.is_none() {
-        return Err(ExecutorError::InvalidCode("missing code zip".to_owned()));
-    }
     Ok(())
 }
 
@@ -431,30 +524,6 @@ async fn ensure_config_file_exists(path: &Path) -> Result<(), ExecutorError> {
     Ok(())
 }
 
-#[cfg(unix)]
-async fn request_guest_shutdown(config: &SquibExecutorConfig) -> Result<(), ExecutorError> {
-    use tokio::io::AsyncWriteExt as _;
-
-    let mut stream = connect_stage_socket_with_retry(config).await?;
-    let request = SquibControlRequestWire {
-        protocol_version: PROTOCOL_VERSION,
-        kind: SHUTDOWN_REQUEST_KIND,
-    };
-    let request_bytes = serde_json::to_vec(&request)
-        .map_err(|err| ExecutorError::Io(format!("encode Squib shutdown request: {err}")))?;
-    stream
-        .write_all(&request_bytes)
-        .await
-        .map_err(|err| ExecutorError::Io(format!("write Squib shutdown request: {err}")))?;
-    stream
-        .write_all(b"\n")
-        .await
-        .map_err(|err| ExecutorError::Io(format!("write Squib shutdown newline: {err}")))?;
-    let _line =
-        read_bounded_line(&mut stream, CONTROL_RESPONSE_LIMIT_BYTES, "Squib shutdown").await?;
-    Ok(())
-}
-
 #[cfg(unix)]
 async fn connect_stage_socket_with_retry(
     config: &SquibExecutorConfig,
@@ -636,10 +705,54 @@ fn default_artifact_dir() -> PathBuf {
 
 #[cfg(test)]
 mod tests {
-    use std::time::Duration;
+    use std::{sync::Arc, time::Duration};
 
     use super::*;
 
+    struct ProbeVm {
+        started: Arc<tokio::sync::Semaphore>,
+        gate: Arc<tokio::sync::Semaphore>,
+        reservation: tokio::sync::OwnedSemaphorePermit,
+    }
+
+    impl VmShutdown for ProbeVm {
+        async fn shutdown(self) -> Result<(), ExecutorError> {
+            self.started.add_permits(1);
+            self.gate.acquire().await.unwrap().forget();
+            drop(self.reservation);
+            Ok(())
+        }
+    }
+
+    #[tokio::test]
+    async fn test_should_transfer_idle_vm_drop_to_owned_shutdown_before_releasing_resources() {
+        let cleanup = Arc::new(CleanupTask::default());
+        let capacity = Arc::new(tokio::sync::Semaphore::new(1));
+        let started = Arc::new(tokio::sync::Semaphore::new(0));
+        let gate = Arc::new(tokio::sync::Semaphore::new(0));
+        let owner = OwnedVm::new(
+            ProbeVm {
+                started: Arc::clone(&started),
+                gate: Arc::clone(&gate),
+                reservation: capacity.clone().acquire_owned().await.unwrap(),
+            },
+            Arc::clone(&cleanup),
+        );
+        // Drop on an ordinary thread with no entered Tokio context.
+        std::thread::spawn(move || drop(owner)).join().unwrap();
+        started.acquire().await.unwrap().forget();
+        assert_eq!(capacity.available_permits(), 0);
+        assert!(
+            tokio::time::timeout(Duration::ZERO, cleanup.wait())
+                .await
+                .is_err()
+        );
+        assert_eq!(capacity.available_permits(), 0);
+        gate.add_permits(1);
+        cleanup.wait().await.unwrap();
+        assert_eq!(capacity.available_permits(), 1);
+    }
+
     #[test]
     fn test_should_parse_squib_config_from_env_reader() {
         let config = SquibExecutorConfig::from_env_reader(|key| match key {
@@ -700,29 +813,23 @@ mod tests {
 
     #[test]
     fn test_should_encode_request_payload_base64() {
-        let req = InvokeRequest {
-            function_arn: "arn:aws:lambda:us-east-1:000000000000:function:echo".to_owned(),
-            function_name: "echo".to_owned(),
-            qualifier: "$LATEST".to_owned(),
-            runtime: Some("provided.al2023".to_owned()),
-            handler: Some("bootstrap".to_owned()),
-            architectures: vec!["arm64".to_owned()],
-            package_type: PackageType::Zip,
-            code_root: Some(PathBuf::from("/tmp/code")),
-            code_zip: Some(Bytes::from_static(b"PK\x03\x04zip")),
-            image_uri: None,
-            environment: HashMap::from([("KEY".to_owned(), "VALUE".to_owned())]),
-            timeout: Duration::from_secs(3),
-            memory_mb: 128,
-            payload: Bytes::from_static(b"{}"),
-            capture_logs: true,
-        };
-
-        let wire = SquibInvokeRequestWire::from_request(&req).unwrap();
+        let mut req = InvokeRequest::fixture();
+        req.payload = Bytes::from_static(b"{}");
+        req.capture_logs = true;
+        let wire = SquibInvokeRequestWire::from_request(&req, Uuid::new_v4()).unwrap();
 
         assert_eq!(wire.protocol_version, PROTOCOL_VERSION);
-        assert_eq!(wire.code_root.as_deref(), Some("/tmp/code"));
-        assert_eq!(wire.code_zip_base64, "UEsDBHppcA==");
+        let DeploymentArtifact::Zip(artifact) = &req.revision.artifact else {
+            panic!("unit fixture is ZIP");
+        };
+        assert_eq!(
+            wire.code_root,
+            Some(artifact.code_root().display().to_string())
+        );
+        assert_eq!(
+            STANDARD.decode(&wire.code_zip_base64).unwrap(),
+            *artifact.zip_bytes()
+        );
         assert_eq!(wire.timeout_ms, 3000);
         assert_eq!(wire.payload_base64, "e30=");
     }
@@ -785,23 +892,8 @@ mod tests {
 
     #[test]
     fn test_should_reject_non_arm64_request() {
-        let req = InvokeRequest {
-            function_arn: String::new(),
-            function_name: "echo".to_owned(),
-            qualifier: "$LATEST".to_owned(),
-            runtime: None,
-            handler: None,
-            architectures: vec!["x86_64".to_owned()],
-            package_type: PackageType::Zip,
-            code_root: Some(PathBuf::from("/tmp/code")),
-            code_zip: Some(Bytes::from_static(b"PK\x03\x04zip")),
-            image_uri: None,
-            environment: HashMap::new(),
-            timeout: Duration::from_secs(1),
-            memory_mb: 128,
-            payload: Bytes::new(),
-            capture_logs: false,
-        };
+        let mut req = InvokeRequest::fixture();
+        Arc::make_mut(&mut req.revision).architecture = Architecture::X86_64;
 
         assert!(matches!(
             validate_request(&req),
diff --git a/crates/rustack-lambda-core/src/executor/types.rs b/crates/rustack-lambda-core/src/executor/types.rs
index 5ad04574..62918375 100644
--- a/crates/rustack-lambda-core/src/executor/types.rs
+++ b/crates/rustack-lambda-core/src/executor/types.rs
@@ -1,8 +1,17 @@
 //! Shared executor request/response/config types.
 
-use std::{collections::HashMap, path::PathBuf, str::FromStr, time::Duration};
+use std::{collections::HashMap, fmt, str::FromStr, sync::Arc, time::Duration};
 
 use bytes::Bytes;
+use rustack_lambda_model::types::ImageConfig;
+use typed_builder::TypedBuilder;
+
+#[cfg(test)]
+use crate::artifact::ValidatedArtifact;
+use crate::{
+    artifact::{Architecture, DeploymentArtifact},
+    identity::FunctionResourceId,
+};
 
 /// Selects which execution backend the provider should construct at startup.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
@@ -36,65 +45,139 @@ impl FromStr for ExecutorBackend {
     }
 }
 
-/// Deployment package kind, mirroring the Lambda API.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PackageType {
-    /// Unzipped function code on the local filesystem.
-    Zip,
-    /// Container image referenced by URI.
-    Image,
-}
-
-impl PackageType {
-    /// Parse from the wire string used by the Lambda model.
-    #[must_use]
-    pub fn from_wire(s: &str) -> Self {
-        if s.eq_ignore_ascii_case("Image") {
-            Self::Image
-        } else {
-            Self::Zip
-        }
-    }
-}
-
-/// Everything an executor needs to run one invocation.
-#[derive(Debug, Clone)]
-pub struct InvokeRequest {
-    /// Qualified ARN — used for `Lambda-Runtime-Invoked-Function-Arn`.
-    pub function_arn: String,
+/// Validated function configuration captured before invocation admission.
+///
+/// Requests share this value through Arc; updates create another captured revision.
+#[derive(Clone, TypedBuilder)]
+#[non_exhaustive]
+pub struct ExecutionRevision {
+    /// Stable function lifetime identity.
+    pub resource_id: FunctionResourceId,
+    /// Captured configuration revision identifier.
+    pub revision_id: String,
+    /// Backend selection policy captured at admission.
+    pub backend: ExecutorBackend,
     /// Bare function name.
     pub function_name: String,
-    /// Resolved version string, e.g. `"$LATEST"` or `"3"`.
+    /// Resolved numeric version or `$LATEST`, never an invoked alias.
     pub qualifier: String,
-    /// Lambda runtime identifier, e.g. `"provided.al2023"`.
+    /// Runtime identifier for ZIP code.
     pub runtime: Option<String>,
-    /// Handler string from the function config.
+    /// Configured ZIP handler.
     pub handler: Option<String>,
-    /// Architectures the function was created with, e.g. `["x86_64"]`.
-    pub architectures: Vec<String>,
-    /// Package type — Zip uses `code_root`, Image uses `image_uri`.
-    pub package_type: PackageType,
-    /// Filesystem path to the unzipped code root (for Zip packages).
-    pub code_root: Option<PathBuf>,
-    /// Raw uploaded Zip bytes (for microVM staging).
-    pub code_zip: Option<Bytes>,
-    /// Image URI (for Image packages).
-    pub image_uri: Option<String>,
-    /// User-supplied environment variables.
+    /// One validated architecture.
+    pub architecture: Architecture,
+    /// One immutable artifact, with shared lifetime ownership.
+    pub artifact: DeploymentArtifact,
+    /// Complete image entry configuration; missing and empty argv differ.
+    pub image_config: Option<ImageConfig>,
+    /// Captured user and provider-injected environment.
     pub environment: HashMap<String, String>,
-    /// Function timeout. Excess => `Sandbox.Timedout`.
+    /// Function handler time limit.
     pub timeout: Duration,
-    /// Memory size in MB (used as the container memory cap).
+    /// Function memory in MiB.
     pub memory_mb: u32,
-    /// Raw invocation payload (typically JSON, but not required).
+    /// Ephemeral storage in MiB.
+    pub ephemeral_storage_mb: u32,
+}
+
+impl fmt::Debug for ExecutionRevision {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ExecutionRevision")
+            .field("resource_id", &self.resource_id)
+            .field("revision_id", &self.revision_id)
+            .field("backend", &self.backend)
+            .field("function_name", &self.function_name)
+            .field("qualifier", &self.qualifier)
+            .field("artifact", &self.artifact)
+            .field("architecture", &self.architecture)
+            .field("environment", &"[REDACTED]")
+            .field("image_config", &"[REDACTED]")
+            .field("timeout", &self.timeout)
+            .field("memory_mb", &self.memory_mb)
+            .field("ephemeral_storage_mb", &self.ephemeral_storage_mb)
+            .finish_non_exhaustive()
+    }
+}
+
+/// One invocation of an immutable captured revision.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct InvokeRequest {
+    /// Shared captured configuration and artifact ownership.
+    pub revision: Arc<ExecutionRevision>,
+    /// Canonical requested ARN, preserving the invoked qualifier.
+    pub function_arn: String,
+    /// Original event bytes.
     pub payload: Bytes,
-    /// When set, the executor captures the last 4KB of stderr as `log_tail`.
+    /// Whether to return the final runtime log bytes.
     pub capture_logs: bool,
 }
 
+impl InvokeRequest {
+    /// Create an invocation without copying its captured configuration.
+    ///
+    /// ```
+    /// # use std::sync::Arc;
+    /// # use bytes::Bytes;
+    /// # use rustack_lambda_core::executor::{ExecutionRevision, InvokeRequest};
+    /// # fn capture(revision: Arc<ExecutionRevision>, arn: String) {
+    /// let request = InvokeRequest::new(Arc::clone(&revision), arn, Bytes::new());
+    /// assert!(Arc::ptr_eq(&request.revision, &revision));
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn new(revision: Arc<ExecutionRevision>, function_arn: String, payload: Bytes) -> Self {
+        Self {
+            revision,
+            function_arn,
+            payload,
+            capture_logs: false,
+        }
+    }
+}
+
+impl fmt::Debug for InvokeRequest {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("InvokeRequest")
+            .field("revision", &self.revision)
+            .field("function_arn", &self.function_arn)
+            .field("payload", &"[REDACTED]")
+            .field("capture_logs", &self.capture_logs)
+            .finish()
+    }
+}
+
+#[cfg(test)]
+impl InvokeRequest {
+    pub(crate) fn fixture() -> Self {
+        let revision = ExecutionRevision::builder()
+            .resource_id(FunctionResourceId::default())
+            .revision_id("fixture-revision".into())
+            .backend(ExecutorBackend::Native)
+            .function_name("fixture".into())
+            .qualifier("$LATEST".into())
+            .runtime(Some("provided.al2023".into()))
+            .handler(Some("bootstrap".into()))
+            .architecture(Architecture::Arm64)
+            .artifact(DeploymentArtifact::Zip(ValidatedArtifact::fixture()))
+            .image_config(None)
+            .environment(HashMap::new())
+            .timeout(Duration::from_secs(3))
+            .memory_mb(128)
+            .ephemeral_storage_mb(512)
+            .build();
+        Self::new(
+            Arc::new(revision),
+            "arn:aws:lambda:us-east-1:000000000000:function:fixture".into(),
+            Bytes::new(),
+        )
+    }
+}
+
 /// Outcome of a successful round-trip with the user code (which may itself
 /// have reported a function error).
-#[derive(Debug, Clone)]
+#[derive(Clone)]
 pub struct InvokeResponse {
     /// HTTP status to mirror back to the caller (typically 200).
     pub status: u16,
@@ -102,12 +185,25 @@ pub struct InvokeResponse {
     pub payload: Bytes,
     /// `Some("Unhandled")` when the bootstrap posted to `/error`.
     pub function_error: Option<String>,
-    /// Base64-encoded last 4KB of stderr, if `capture_logs` was set.
+    /// Base64-encoded final bounded log bytes when requested. Docker combines
+    /// observed stdout/stderr in its invocation window; Native uses stderr.
     pub log_tail: Option<String>,
     /// What the executor actually invoked (echoes back the qualifier).
     pub executed_version: String,
 }
 
+impl fmt::Debug for InvokeResponse {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("InvokeResponse")
+            .field("status", &self.status)
+            .field("function_error", &self.function_error.is_some())
+            .field("executed_version", &self.executed_version)
+            .field("payload", &"[REDACTED]")
+            .field("log_tail", &"[REDACTED]")
+            .finish()
+    }
+}
+
 impl InvokeResponse {
     /// Convenience constructor for a plain JSON success response.
     #[must_use]
@@ -126,6 +222,39 @@ impl InvokeResponse {
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_should_share_captured_revisions_and_isolate_separately_updated_configuration() {
+        let original = InvokeRequest::fixture();
+        let mut updated = original.clone();
+        assert!(Arc::ptr_eq(&original.revision, &updated.revision));
+        Arc::make_mut(&mut updated.revision).memory_mb = 512;
+        assert_eq!(original.revision.memory_mb, 128);
+        assert_eq!(updated.revision.memory_mb, 512);
+        assert!(!Arc::ptr_eq(&original.revision, &updated.revision));
+    }
+
+    #[test]
+    fn test_should_redact_invocation_request_and_response_debug() {
+        let secret = "fixture-secret-should-never-be-rendered";
+        let mut request = InvokeRequest::fixture();
+        Arc::make_mut(&mut request.revision)
+            .environment
+            .insert("SECRET".into(), secret.into());
+        request.payload = Bytes::from(secret);
+        Arc::make_mut(&mut request.revision).image_config = Some(ImageConfig {
+            entry_point: Some(vec![secret.into()]),
+            command: Some(vec![secret.into()]),
+            working_directory: Some(format!("/{secret}")),
+        });
+        let mut response = InvokeResponse::success(Bytes::from(secret), "1".into());
+        response.function_error = Some(secret.into());
+        response.log_tail = Some(secret.into());
+        for rendered in [format!("{request:?}"), format!("{response:?}")] {
+            assert!(!rendered.contains(secret));
+            assert!(rendered.contains("[REDACTED]"));
+        }
+    }
+
     #[test]
     fn test_should_parse_executor_backend_strings() {
         assert_eq!(
@@ -154,13 +283,4 @@ mod tests {
         );
         assert!("nope".parse::<ExecutorBackend>().is_err());
     }
-
-    #[test]
-    fn test_should_parse_package_type_from_wire() {
-        assert_eq!(PackageType::from_wire("Image"), PackageType::Image);
-        assert_eq!(PackageType::from_wire("image"), PackageType::Image);
-        assert_eq!(PackageType::from_wire("Zip"), PackageType::Zip);
-        // Anything unrecognized falls back to Zip — matches the provider default.
-        assert_eq!(PackageType::from_wire(""), PackageType::Zip);
-    }
 }
diff --git a/crates/rustack-lambda-core/src/function_config.rs b/crates/rustack-lambda-core/src/function_config.rs
new file mode 100644
index 00000000..64dee520
--- /dev/null
+++ b/crates/rustack-lambda-core/src/function_config.rs
@@ -0,0 +1,416 @@
+//! Validate captured function settings before storage or execution admission.
+
+use std::{collections::HashMap, fmt};
+
+use rustack_lambda_model::{input::CreateFunctionInput, types::ImageConfig};
+use typed_builder::TypedBuilder;
+
+use crate::{
+    artifact::{Architecture, ImageReference, ResolvedImage},
+    error::LambdaServiceError,
+    storage::{VersionRecord, VersionRecordSnapshot},
+};
+
+fn invalid(message: &'static str) -> LambdaServiceError {
+    LambdaServiceError::InvalidParameter {
+        message: message.into(),
+    }
+}
+
+#[derive(TypedBuilder)]
+struct Settings<'a> {
+    package_type: &'a str,
+    runtime: Option<&'a str>,
+    handler: Option<&'a str>,
+    architectures: Option<&'a [String]>,
+    environment: Option<&'a HashMap<String, String>>,
+    image_config: Option<&'a ImageConfig>,
+    image_uri: Option<&'a str>,
+    timeout: u32,
+    memory: u32,
+    ephemeral: u32,
+}
+
+impl fmt::Debug for Settings<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Settings")
+            .field("package_type", &self.package_type)
+            .field("environment", &"[REDACTED]")
+            .field("image_config", &"[REDACTED]")
+            .finish_non_exhaustive()
+    }
+}
+
+impl Settings<'_> {
+    fn validate(&self) -> Result<Architecture, LambdaServiceError> {
+        if !(1..=900).contains(&self.timeout)
+            || !(128..=10240).contains(&self.memory)
+            || !(512..=10240).contains(&self.ephemeral)
+        {
+            return Err(invalid(
+                "Invalid function timeout, memory or ephemeral storage",
+            ));
+        }
+        let architecture = match self.architectures {
+            None => Architecture::X86_64,
+            Some([architecture]) => architecture
+                .parse()
+                .map_err(|_| invalid("Invalid Lambda architecture"))?,
+            Some(_) => return Err(invalid("Exactly one Lambda architecture is required")),
+        };
+        match self.package_type {
+            "Zip" => {
+                if self.runtime.is_none_or(|runtime| {
+                    runtime.is_empty() || runtime.len() > 128 || runtime.contains('\0')
+                }) || self.handler.is_none_or(|handler| {
+                    handler.is_empty() || handler.len() > 256 || handler.contains('\0')
+                }) || self.image_uri.is_some()
+                    || self.image_config.is_some()
+                {
+                    return Err(invalid("Invalid ZIP runtime, handler or image fields"));
+                }
+            }
+            "Image" => {
+                let reference = self
+                    .image_uri
+                    .ok_or_else(|| invalid("ImageUri is required"))?;
+                reference
+                    .parse::<ImageReference>()
+                    .map_err(|_| invalid("Invalid ImageUri"))?;
+                if self.runtime.is_some() || self.handler.is_some() {
+                    return Err(invalid(
+                        "Image functions cannot contain ZIP runtime or handler fields",
+                    ));
+                }
+                if let Some(config) = self.image_config {
+                    validate_image_config(config)?;
+                }
+            }
+            _ => return Err(invalid("Unsupported deployment package type")),
+        }
+        if let Some(environment) = self.environment {
+            validate_environment(environment)?;
+        }
+        Ok(architecture)
+    }
+}
+
+pub(crate) fn validate_provided_settings(
+    runtime: Option<&str>,
+    handler: Option<&str>,
+) -> Result<(), LambdaServiceError> {
+    if runtime != Some("provided.al2023")
+        || handler.is_none_or(|value| {
+            value.is_empty()
+                || value.len() > 128
+                || !value
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || b"_./:-".contains(&byte))
+        })
+    {
+        return Err(invalid(
+            "Docker ZIP requires provided.al2023 and a supported handler",
+        ));
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_create_settings(
+    input: &CreateFunctionInput,
+) -> Result<Architecture, LambdaServiceError> {
+    Settings::builder()
+        .package_type(input.package_type.as_deref().unwrap_or("Zip"))
+        .runtime(input.runtime.as_deref())
+        .handler(input.handler.as_deref())
+        .architectures(input.architectures.as_deref())
+        .environment(
+            input
+                .environment
+                .as_ref()
+                .and_then(|environment| environment.variables.as_ref()),
+        )
+        .image_config(input.image_config.as_ref())
+        .image_uri(input.code.image_uri.as_deref())
+        .timeout(input.timeout.unwrap_or(3))
+        .memory(input.memory_size.unwrap_or(128))
+        .ephemeral(
+            input
+                .ephemeral_storage
+                .as_ref()
+                .map_or(512, |storage| storage.size),
+        )
+        .build()
+        .validate()
+}
+
+pub(crate) fn validate_execution_settings(
+    version: &VersionRecord,
+) -> Result<Architecture, LambdaServiceError> {
+    let architecture = Settings::builder()
+        .package_type(&version.package_type)
+        .runtime(version.runtime.as_deref())
+        .handler(version.handler.as_deref())
+        .architectures(Some(&version.architectures))
+        .environment(Some(&version.environment))
+        .image_config(version.image_config.as_ref())
+        .image_uri(version.image_uri.as_deref())
+        .timeout(version.timeout)
+        .memory(version.memory_size)
+        .ephemeral(version.ephemeral_storage_size)
+        .build()
+        .validate()?;
+    validate_layout(
+        &version.package_type,
+        version.zip_bytes.is_some(),
+        version.code_path.is_some(),
+        version.image.resolved(),
+        architecture,
+        version.image_uri.as_deref(),
+    )?;
+    validate_image_fingerprint(
+        version.image.resolved(),
+        &version.code_sha256,
+        version.code_size,
+        version
+            .image
+            .pinned()
+            .map(|image| image.unpacked_size().get()),
+    )?;
+    Ok(architecture)
+}
+
+pub(crate) fn validate_snapshot_settings(
+    version: &VersionRecordSnapshot,
+) -> Result<(), LambdaServiceError> {
+    let architecture = Settings::builder()
+        .package_type(&version.package_type)
+        .runtime(version.runtime.as_deref())
+        .handler(version.handler.as_deref())
+        .architectures(Some(&version.architectures))
+        .environment(Some(&version.environment))
+        .image_config(version.image_config.as_ref())
+        .image_uri(version.image_uri.as_deref())
+        .timeout(version.timeout)
+        .memory(version.memory_size)
+        .ephemeral(version.ephemeral_storage_size)
+        .build()
+        .validate()?;
+    validate_layout(
+        &version.package_type,
+        version.zip_bytes_base64.is_some(),
+        false,
+        version.resolved_image.as_ref(),
+        architecture,
+        version.image_uri.as_deref(),
+    )?;
+    validate_image_fingerprint(
+        version.resolved_image.as_ref(),
+        &version.code_sha256,
+        version.code_size,
+        None,
+    )
+}
+
+fn validate_image_fingerprint(
+    image: Option<&ResolvedImage>,
+    hash: &str,
+    size: u64,
+    pinned_size: Option<u64>,
+) -> Result<(), LambdaServiceError> {
+    if let Some(image) = image {
+        if hash
+            != image
+                .code_sha256()
+                .map_err(|_| invalid("Invalid image fingerprint"))?
+            || !(1..=crate::artifact::MAX_IMAGE_BYTES).contains(&size)
+            || pinned_size.is_some_and(|proven| proven != size)
+        {
+            return Err(invalid("Image deployment metadata mismatch"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_layout(
+    package_type: &str,
+    has_zip: bool,
+    has_extracted: bool,
+    image: Option<&ResolvedImage>,
+    architecture: Architecture,
+    reference: Option<&str>,
+) -> Result<(), LambdaServiceError> {
+    if (package_type == "Zip" && image.is_some())
+        || (package_type == "Image" && (has_extracted || has_zip))
+    {
+        return Err(invalid("Deployment package fields are inconsistent"));
+    }
+    if let Some(image) = image {
+        if image.metadata().architecture != architecture
+            || Some(image.metadata().requested_reference.as_str()) != reference
+        {
+            return Err(invalid(
+                "Resolved image does not match function configuration",
+            ));
+        }
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_image_config(config: &ImageConfig) -> Result<(), LambdaServiceError> {
+    let mut bytes = 0usize;
+    for args in [config.entry_point.as_deref(), config.command.as_deref()]
+        .into_iter()
+        .flatten()
+    {
+        if args.len() > 1500 {
+            return Err(invalid("Image argv count exceeds the local limit"));
+        }
+        for arg in args {
+            if arg.len() > 4096 || arg.contains('\0') {
+                return Err(invalid("Invalid image argument"));
+            }
+            bytes = bytes
+                .checked_add(arg.len())
+                .ok_or_else(|| invalid("Image argv size overflow"))?;
+            if bytes > 64 * 1024 {
+                return Err(invalid("Image argv exceeds the local byte limit"));
+            }
+        }
+    }
+    if config
+        .working_directory
+        .as_ref()
+        .is_some_and(|path| !path.starts_with('/') || path.len() > 1000 || path.contains('\0'))
+    {
+        return Err(invalid(
+            "Image working directory must be a bounded absolute path",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_environment(environment: &HashMap<String, String>) -> Result<(), LambdaServiceError> {
+    validate_environment_entries(environment)
+}
+
+pub(crate) fn validate_environment_entries<'a>(
+    environment: impl IntoIterator<Item = (&'a String, &'a String)>,
+) -> Result<(), LambdaServiceError> {
+    let mut count = 0_u16;
+    let mut bytes = 0usize;
+    for (key, value) in environment {
+        count = count.saturating_add(1);
+        if count > 128 {
+            return Err(invalid("Environment has too many variables"));
+        }
+        if !(2..=64).contains(&key.len())
+            || !key.as_bytes().first().is_some_and(u8::is_ascii_alphabetic)
+            || !key.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_')
+            || value.len() > 4096
+            || value.contains('\0')
+            || is_reserved(key)
+        {
+            return Err(invalid("Invalid or reserved environment variable"));
+        }
+        bytes = bytes
+            .checked_add(key.len())
+            .and_then(|bytes| bytes.checked_add(value.len()))
+            .ok_or_else(|| invalid("Environment size overflow"))?;
+        if bytes > 4096 {
+            return Err(invalid("Environment exceeds 4 KiB"));
+        }
+    }
+    Ok(())
+}
+
+fn is_reserved(key: &str) -> bool {
+    matches!(
+        key,
+        "_HANDLER"
+            | "_X_AMZN_TRACE_ID"
+            | "AWS_DEFAULT_REGION"
+            | "AWS_REGION"
+            | "AWS_EXECUTION_ENV"
+            | "AWS_LAMBDA_FUNCTION_NAME"
+            | "AWS_LAMBDA_FUNCTION_MEMORY_SIZE"
+            | "AWS_LAMBDA_FUNCTION_VERSION"
+            | "AWS_LAMBDA_FUNCTION_TIMEOUT"
+            | "AWS_LAMBDA_INITIALIZATION_TYPE"
+            | "AWS_LAMBDA_LOG_GROUP_NAME"
+            | "AWS_LAMBDA_LOG_STREAM_NAME"
+            | "AWS_ACCESS_KEY"
+            | "AWS_ACCESS_KEY_ID"
+            | "AWS_SECRET_ACCESS_KEY"
+            | "AWS_SESSION_TOKEN"
+            | "AWS_LAMBDA_RUNTIME_API"
+            | "LAMBDA_TASK_ROOT"
+            | "LAMBDA_RUNTIME_DIR"
+            | "AWS_LAMBDA_MAX_CONCURRENCY"
+            | "AWS_LAMBDA_METADATA_API"
+            | "AWS_LAMBDA_METADATA_TOKEN"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_should_bound_environment_bytes_and_reject_reserved_or_invalid_keys() {
+        let at_limit = HashMap::from([("KEY".into(), "v".repeat(4093))]);
+        assert!(validate_environment(&at_limit).is_ok());
+        let over_limit = HashMap::from([("KEY".into(), "v".repeat(4094))]);
+        assert!(validate_environment(&over_limit).is_err());
+        for key in [
+            "AWS_REGION",
+            "AWS_LAMBDA_RUNTIME_API",
+            "AWS_SECRET_ACCESS_KEY",
+            "LAMBDA_TASK_ROOT",
+            "A",
+            "A-B",
+            "ÄB",
+        ] {
+            let environment = HashMap::from([(key.into(), "value".into())]);
+            assert!(validate_environment(&environment).is_err(), "{key}");
+        }
+        for key in ["AWS_ENDPOINT_URL", "TZ", "PATH"] {
+            assert!(validate_environment(&HashMap::from([(key.into(), "value".into())])).is_ok());
+        }
+    }
+
+    #[test]
+    fn test_should_validate_image_argv_without_collapsing_empty_and_missing() {
+        assert!(validate_image_config(&ImageConfig::default()).is_ok());
+        assert!(
+            validate_image_config(&ImageConfig {
+                command: Some(vec![]),
+                ..ImageConfig::default()
+            })
+            .is_ok()
+        );
+        for config in [
+            ImageConfig {
+                command: Some(vec!["x".repeat(4097)]),
+                ..ImageConfig::default()
+            },
+            ImageConfig {
+                command: Some(vec![String::new(); 1501]),
+                ..ImageConfig::default()
+            },
+            ImageConfig {
+                command: Some(vec!["x".repeat(4096); 17]),
+                ..ImageConfig::default()
+            },
+            ImageConfig {
+                entry_point: Some(vec!["x\0".into()]),
+                ..ImageConfig::default()
+            },
+            ImageConfig {
+                working_directory: Some("relative".into()),
+                ..ImageConfig::default()
+            },
+        ] {
+            assert!(validate_image_config(&config).is_err());
+        }
+    }
+}
diff --git a/crates/rustack-lambda-core/src/handler.rs b/crates/rustack-lambda-core/src/handler.rs
index 3339f584..77af70f0 100644
--- a/crates/rustack-lambda-core/src/handler.rs
+++ b/crates/rustack-lambda-core/src/handler.rs
@@ -30,7 +30,10 @@ use rustack_lambda_model::{
     types::InvocationType,
 };
 
-use crate::provider::{InvokeKind, InvokeOutcome, RustackLambda};
+use crate::{
+    deployment_input::{Profile, decode},
+    provider::{InvokeKind, InvokeOutcome, RustackLambda},
+};
 
 /// Handler that bridges the HTTP layer to the Lambda provider.
 #[derive(Debug)]
@@ -121,7 +124,7 @@ async fn dispatch(
     path_params: &PathParams,
     query: &str,
     headers: &http::HeaderMap,
-    body: &[u8],
+    body: &Bytes,
 ) -> Result<http::Response<LambdaResponseBody>, LambdaError> {
     let query_params = parse_query_params(query);
     let qualifier = get_query_param(&query_params, "Qualifier");
@@ -129,9 +132,8 @@ async fn dispatch(
     match op {
         // ---- Phase 0: Function CRUD ----
         LambdaOperation::CreateFunction => {
-            let input: CreateFunctionInput = serde_json::from_slice(body).map_err(|e| {
-                LambdaError::invalid_parameter(format!("Invalid request body: {e}"))
-            })?;
+            let (input, _input_permit): (CreateFunctionInput, _) =
+                decode(body, Profile::Create).await?;
             let config = provider
                 .create_function(input)
                 .await
@@ -165,11 +167,10 @@ async fn dispatch(
 
         LambdaOperation::UpdateFunctionCode => {
             let function_name = require_path_param(path_params, "FunctionName")?;
-            let input: UpdateFunctionCodeInput = serde_json::from_slice(body).map_err(|e| {
-                LambdaError::invalid_parameter(format!("Invalid request body: {e}"))
-            })?;
+            let (input, input_permit): (UpdateFunctionCodeInput, _) =
+                decode(body, Profile::Code).await?;
             let config = provider
-                .update_function_code(function_name, input)
+                .update_function_code_parsed(function_name, input, input_permit)
                 .await
                 .map_err(LambdaError::from)?;
             wrap_json_response(200, &config)
@@ -177,10 +178,8 @@ async fn dispatch(
 
         LambdaOperation::UpdateFunctionConfiguration => {
             let function_name = require_path_param(path_params, "FunctionName")?;
-            let input: UpdateFunctionConfigurationInput =
-                serde_json::from_slice(body).map_err(|e| {
-                    LambdaError::invalid_parameter(format!("Invalid request body: {e}"))
-                })?;
+            let (input, _input_permit): (UpdateFunctionConfigurationInput, _) =
+                decode(body, Profile::Configuration).await?;
             let config = provider
                 .update_function_configuration(function_name, &input)
                 .map_err(LambdaError::from)?;
@@ -209,11 +208,21 @@ async fn dispatch(
             let function_name = require_path_param(path_params, "FunctionName")?;
 
             // Parse InvocationType from header.
-            let invocation_type = headers
-                .get("x-amz-invocation-type")
-                .and_then(|v| v.to_str().ok())
-                .and_then(InvocationType::from_str_value)
-                .unwrap_or(InvocationType::RequestResponse);
+            let invocation_type = match single_invoke_header(headers, "x-amz-invocation-type")? {
+                None => InvocationType::RequestResponse,
+                Some(value) => value
+                    .to_str()
+                    .ok()
+                    .and_then(InvocationType::from_str_value)
+                    .ok_or_else(|| LambdaError::invalid_parameter("Invalid InvocationType"))?,
+            };
+            let capture_logs = match single_invoke_header(headers, "x-amz-log-type")?
+                .map(http::HeaderValue::as_bytes)
+            {
+                None | Some(b"None") => false,
+                Some(b"Tail") => true,
+                Some(_) => return Err(LambdaError::invalid_parameter("Invalid LogType")),
+            };
             let kind = match invocation_type {
                 InvocationType::RequestResponse => InvokeKind::RequestResponse,
                 InvocationType::Event => InvokeKind::Event,
@@ -221,7 +230,7 @@ async fn dispatch(
             };
 
             let outcome = provider
-                .invoke(function_name, qualifier, body, kind)
+                .invoke_with_logs(function_name, qualifier, body, kind, capture_logs)
                 .await
                 .map_err(LambdaError::from)?;
 
@@ -713,6 +722,20 @@ fn require_path_param<'a>(params: &'a PathParams, name: &str) -> Result<&'a str,
         .ok_or_else(|| LambdaError::invalid_parameter(format!("Missing path parameter: {name}")))
 }
 
+fn single_invoke_header<'a>(
+    headers: &'a http::HeaderMap,
+    name: &'static str,
+) -> Result<Option<&'a http::HeaderValue>, LambdaError> {
+    let mut values = headers.get_all(name).iter();
+    let value = values.next();
+    if values.next().is_some() {
+        return Err(LambdaError::invalid_parameter(
+            "Duplicate invocation header",
+        ));
+    }
+    Ok(value)
+}
+
 /// Wrap a serializable value into a JSON `LambdaResponseBody` response.
 fn wrap_json_response(
     status: u16,
@@ -738,7 +761,64 @@ fn wrap_empty_response(status: u16) -> Result<http::Response<LambdaResponseBody>
 
 #[cfg(test)]
 mod tests {
+    use http::{HeaderMap, HeaderValue, Method};
+    use rustack_lambda_http::router::resolve_operation;
+    use rustack_lambda_model::error::LambdaErrorCode;
+
     use super::*;
+    use crate::config::LambdaConfig;
+
+    #[rstest::rstest]
+    #[case::log_case("x-amz-log-type", b"tail".as_slice())]
+    #[case::log_unknown("x-amz-log-type", b"private-invalid-log-type".as_slice())]
+    #[case::log_nonascii("x-amz-log-type", b"\xff".as_slice())]
+    #[case::invocation_case("x-amz-invocation-type", b"event".as_slice())]
+    #[case::invocation_unknown("x-amz-invocation-type", b"private-invalid-invocation-type".as_slice())]
+    #[case::invocation_nonascii("x-amz-invocation-type", b"\xff".as_slice())]
+    #[tokio::test]
+    async fn test_should_reject_invalid_invoke_headers_before_resource_lookup(
+        #[case] key: &'static str,
+        #[case] value: &[u8],
+    ) {
+        let provider = RustackLambda::new(LambdaConfig::default());
+        let (operation, params, _) =
+            resolve_operation(&Method::POST, "/2015-03-31/functions/missing/invocations").unwrap();
+        let mut headers = HeaderMap::new();
+        headers.insert(key, HeaderValue::from_bytes(value).unwrap());
+        let error = dispatch(&provider, operation, &params, "", &headers, &Bytes::new())
+            .await
+            .unwrap_err();
+        assert_eq!(error.code, LambdaErrorCode::InvalidParameterValueException);
+        assert!(!format!("{error:?}").contains("private-invalid"));
+        provider.shutdown().await;
+    }
+
+    #[rstest::rstest]
+    #[case::tail_none("x-amz-log-type", "Tail", "None")]
+    #[case::none_tail("x-amz-log-type", "None", "Tail")]
+    #[case::tail_invalid("x-amz-log-type", "Tail", "private-invalid-value")]
+    #[case::sync_event("x-amz-invocation-type", "RequestResponse", "Event")]
+    #[case::event_sync("x-amz-invocation-type", "Event", "RequestResponse")]
+    #[case::sync_invalid("x-amz-invocation-type", "RequestResponse", "private-invalid-value")]
+    #[tokio::test]
+    async fn test_should_reject_duplicate_invoke_enum_headers_before_resource_lookup(
+        #[case] key: &'static str,
+        #[case] first: &'static str,
+        #[case] second: &'static str,
+    ) {
+        let provider = RustackLambda::new(LambdaConfig::default());
+        let (operation, params, _) =
+            resolve_operation(&Method::POST, "/2015-03-31/functions/missing/invocations").unwrap();
+        let mut headers = HeaderMap::new();
+        headers.append(key, HeaderValue::from_static(first));
+        headers.append(key, HeaderValue::from_static(second));
+        let error = dispatch(&provider, operation, &params, "", &headers, &Bytes::new())
+            .await
+            .unwrap_err();
+        assert_eq!(error.code, LambdaErrorCode::InvalidParameterValueException);
+        assert!(!format!("{error:?}").contains("private-invalid"));
+        provider.shutdown().await;
+    }
 
     #[test]
     fn test_should_parse_empty_query() {
diff --git a/crates/rustack-lambda-core/src/identity.rs b/crates/rustack-lambda-core/src/identity.rs
new file mode 100644
index 00000000..747496e4
--- /dev/null
+++ b/crates/rustack-lambda-core/src/identity.rs
@@ -0,0 +1,133 @@
+//! Stable function resource identity, independent of mutable names and revisions.
+
+use std::{fmt, str::FromStr};
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de};
+use uuid::Uuid;
+
+/// Identity of one function's lifetime, preserved across updates and snapshots.
+///
+/// Deleting and recreating a name must allocate a new identity.
+///
+/// ```
+/// use rustack_lambda_core::identity::FunctionResourceId;
+/// let identity = FunctionResourceId::default();
+/// assert_eq!(identity.to_string().parse::<FunctionResourceId>()?, identity);
+/// # Ok::<(), rustack_lambda_core::identity::ResourceIdError>(())
+/// ```
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+#[non_exhaustive]
+pub struct FunctionResourceId(Uuid);
+
+/// A saved resource identity is malformed or absent of meaningful identity.
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum ResourceIdError {
+    /// Only the 36-byte hyphenated UUID representation is accepted.
+    #[error("function resource identity must be a 36-byte UUID")]
+    Length,
+    /// The input is not a UUID.
+    #[error("invalid function resource UUID")]
+    Invalid {
+        /// UUID parser failure, without the original input.
+        #[source]
+        source: uuid::Error,
+    },
+    /// A nil UUID cannot identify a function lifetime.
+    #[error("function resource UUID must not be nil")]
+    Nil,
+}
+
+impl Default for FunctionResourceId {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl FunctionResourceId {
+    /// Allocate a random identity for a new function resource.
+    ///
+    /// ```
+    /// use rustack_lambda_core::identity::FunctionResourceId;
+    /// let first = FunctionResourceId::new();
+    /// assert_ne!(first, FunctionResourceId::new());
+    /// ```
+    #[must_use]
+    pub fn new() -> Self {
+        Self(Uuid::new_v4())
+    }
+}
+
+impl fmt::Display for FunctionResourceId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+impl FromStr for FunctionResourceId {
+    type Err = ResourceIdError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.len() != 36 {
+            return Err(ResourceIdError::Length);
+        }
+        let uuid = Uuid::parse_str(value).map_err(|source| ResourceIdError::Invalid { source })?;
+        if uuid.is_nil() {
+            return Err(ResourceIdError::Nil);
+        }
+        Ok(Self(uuid))
+    }
+}
+
+impl Serialize for FunctionResourceId {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.collect_str(self)
+    }
+}
+
+impl<'de> Deserialize<'de> for FunctionResourceId {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        struct Visitor;
+        impl de::Visitor<'_> for Visitor {
+            type Value = FunctionResourceId;
+
+            fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                f.write_str("a nonnil hyphenated function resource UUID")
+            }
+
+            fn visit_str<E: de::Error>(self, value: &str) -> Result<Self::Value, E> {
+                value.parse().map_err(E::custom)
+            }
+        }
+        deserializer.deserialize_str(Visitor)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_should_generate_distinct_nonnil_serializable_identities()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let first = FunctionResourceId::default();
+        let second = FunctionResourceId::default();
+        assert_ne!(first, second);
+        let saved = serde_json::to_string(&first)?;
+        assert_eq!(serde_json::from_str::<FunctionResourceId>(&saved)?, first);
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_reject_nil_malformed_and_oversized_resource_identity() {
+        assert!(matches!(
+            "00000000-0000-0000-0000-000000000000".parse::<FunctionResourceId>(),
+            Err(ResourceIdError::Nil)
+        ));
+        for value in ["x".repeat(36), "x".repeat(4096), String::new()] {
+            assert!(value.parse::<FunctionResourceId>().is_err());
+            let saved = serde_json::Value::String(value);
+            assert!(serde_json::from_value::<FunctionResourceId>(saved).is_err());
+        }
+    }
+}
diff --git a/crates/rustack-lambda-core/src/invocation.rs b/crates/rustack-lambda-core/src/invocation.rs
new file mode 100644
index 00000000..fbfc898a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/invocation.rs
@@ -0,0 +1,769 @@
+//! Attempt identity, cooperative cancellation and supervised invocation handles.
+//!
+//! Cancellation signals do not drop backend futures. The work supervisor owns
+//! those futures until their resources are settled.
+
+use std::{
+    fmt,
+    future::{Future, pending},
+    sync::Arc,
+};
+
+use parking_lot::Mutex as OwnerMutex;
+use tokio::{
+    runtime::Handle,
+    sync::{Mutex, oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, sleep_until, timeout_at},
+};
+use uuid::Uuid;
+
+use crate::{
+    error::LambdaServiceError,
+    executor::{ExecutorError, InvokeResponse},
+};
+
+/// Why an invocation must stop accepting a result.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum CancellationReason {
+    /// Explicit cancellation or loss of the attached caller.
+    Requested,
+    /// The absolute invocation budget expired.
+    Deadline,
+}
+
+impl CancellationReason {
+    pub(crate) fn error(self) -> ExecutorError {
+        match self {
+            Self::Requested => ExecutorError::Cancelled,
+            Self::Deadline => ExecutorError::DeadlineExceeded,
+        }
+    }
+}
+
+/// Immutable attempt metadata and a cooperative cancellation receiver.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct InvocationContext {
+    id: Uuid,
+    deadline: Instant,
+    cancellation: watch::Receiver<bool>,
+    external: Option<watch::Receiver<bool>>,
+}
+
+impl InvocationContext {
+    #[cfg(test)]
+    pub(crate) fn channel(deadline: Instant) -> (watch::Sender<bool>, Self) {
+        Self::channel_with_cancellation(deadline, None)
+    }
+
+    pub(crate) fn channel_with_cancellation(
+        deadline: Instant,
+        external: Option<watch::Receiver<bool>>,
+    ) -> (watch::Sender<bool>, Self) {
+        let (sender, cancellation) = watch::channel(false);
+        (
+            sender,
+            Self {
+                id: Uuid::new_v4(),
+                deadline,
+                cancellation,
+                external,
+            },
+        )
+    }
+
+    /// Attempt identity shared with the Runtime API and invocation handle.
+    ///
+    /// ```
+    /// # fn inspect(context: &rustack_lambda_core::invocation::InvocationContext) {
+    /// assert!(!context.id().is_nil());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn id(&self) -> Uuid {
+        self.id
+    }
+
+    /// Absolute monotonic budget, including queue and cold start.
+    ///
+    /// ```
+    /// # fn inspect(context: &rustack_lambda_core::invocation::InvocationContext) {
+    /// let deadline = context.deadline();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn deadline(&self) -> Instant {
+        self.deadline
+    }
+
+    /// Check cancellation before allocating a runtime resource.
+    ///
+    /// # Errors
+    /// Returns cancellation or deadline expiry, without cancelling cleanup.
+    ///
+    /// ```
+    /// # fn inspect(context: &rustack_lambda_core::invocation::InvocationContext) {
+    /// let still_active = context.check().is_ok();
+    /// # }
+    /// ```
+    pub fn check(&self) -> Result<(), ExecutorError> {
+        if Instant::now() >= self.deadline {
+            return Err(ExecutorError::DeadlineExceeded);
+        }
+        if *self.cancellation.borrow()
+            || self.cancellation.has_changed().is_err()
+            || self
+                .external
+                .as_ref()
+                .is_some_and(|signal| *signal.borrow() || signal.has_changed().is_err())
+        {
+            return Err(ExecutorError::Cancelled);
+        }
+        Ok(())
+    }
+
+    /// Wait for an explicit signal or the absolute deadline.
+    ///
+    /// ```no_run
+    /// # async fn stop(context: &rustack_lambda_core::invocation::InvocationContext) {
+    /// let reason = context.cancelled().await;
+    /// # }
+    /// ```
+    pub async fn cancelled(&self) -> CancellationReason {
+        let mut cancellation = self.cancellation.clone();
+        let mut external = self.external.clone();
+        match self.check() {
+            Err(ExecutorError::DeadlineExceeded) => return CancellationReason::Deadline,
+            Err(_) => return CancellationReason::Requested,
+            Ok(()) => {}
+        }
+        tokio::select! {
+            biased;
+            () = sleep_until(self.deadline) => CancellationReason::Deadline,
+            _ = cancellation.wait_for(|cancelled| *cancelled) => {
+                if Instant::now() >= self.deadline { CancellationReason::Deadline } else { CancellationReason::Requested }
+            }
+            () = external_cancelled(&mut external) => {
+                if Instant::now() >= self.deadline { CancellationReason::Deadline } else { CancellationReason::Requested }
+            }
+        }
+    }
+}
+
+async fn external_cancelled(external: &mut Option<watch::Receiver<bool>>) {
+    if let Some(signal) = external {
+        let _ = signal.wait_for(|cancelled| *cancelled).await;
+    } else {
+        pending::<()>().await;
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Settlement {
+    Pending,
+    Clean,
+    Uncertain,
+}
+
+/// Attached ownership of an admitted invocation; Drop requests cancellation.
+#[non_exhaustive]
+pub struct InvocationHandle {
+    context: InvocationContext,
+    cancellation: watch::Sender<bool>,
+    response: Option<oneshot::Receiver<Result<InvokeResponse, ExecutorError>>>,
+    settlement: watch::Receiver<Settlement>,
+    cancel_on_drop: bool,
+}
+
+impl fmt::Debug for InvocationHandle {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("InvocationHandle")
+            .field("id", &self.context.id)
+            .field("deadline", &self.context.deadline)
+            .field("settlement", &*self.settlement.borrow())
+            .finish_non_exhaustive()
+    }
+}
+
+impl InvocationHandle {
+    pub(crate) fn new(
+        context: InvocationContext,
+        cancellation: watch::Sender<bool>,
+        response: oneshot::Receiver<Result<InvokeResponse, ExecutorError>>,
+        settlement: watch::Receiver<Settlement>,
+    ) -> Self {
+        Self {
+            context,
+            cancellation,
+            response: Some(response),
+            settlement,
+            cancel_on_drop: true,
+        }
+    }
+
+    /// UUID used for this admitted attempt.
+    ///
+    /// ```
+    /// # fn inspect(handle: &rustack_lambda_core::invocation::InvocationHandle) {
+    /// assert!(!handle.id().is_nil());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn id(&self) -> Uuid {
+        self.context.id
+    }
+
+    /// Signal cancellation while retaining the ability to await cleanup.
+    ///
+    /// ```
+    /// # fn stop(handle: &rustack_lambda_core::invocation::InvocationHandle) {
+    /// handle.cancel();
+    /// # }
+    /// ```
+    pub fn cancel(&self) {
+        self.cancellation.send_replace(true);
+    }
+
+    /// Await the backend outcome within the admitted invocation deadline.
+    ///
+    /// # Errors
+    /// Returns backend errors, deadline expiry, or an uncertain worker failure.
+    /// Deadline failure signals cancellation; the supervisor still owns cleanup.
+    ///
+    /// ```no_run
+    /// # async fn finish(handle: rustack_lambda_core::invocation::InvocationHandle) {
+    /// let response = handle.wait().await;
+    /// # }
+    /// ```
+    pub async fn wait(mut self) -> Result<InvokeResponse, ExecutorError> {
+        let result = self.wait_response().await;
+        if self.response.is_none() {
+            self.cancel_on_drop = false;
+        }
+        result
+    }
+
+    /// Read the business response while retaining the same cleanup handle.
+    ///
+    /// A dropped waiter can resume. A consumed result cannot be read twice.
+    ///
+    /// # Errors
+    /// Returns cancellation/deadline/backend failure, lost owner or consumed result.
+    ///
+    /// ```no_run
+    /// # async fn read(handle:&mut rustack_lambda_core::invocation::InvocationHandle) {
+    /// let response=handle.wait_response().await;
+    /// # }
+    /// ```
+    pub async fn wait_response(&mut self) -> Result<InvokeResponse, ExecutorError> {
+        if let Err(error) = self.context.check() {
+            self.cancel();
+            return Err(error);
+        }
+        let Some(receiver) = &mut self.response else {
+            return Err(ExecutorError::CleanupFailed(
+                "Invocation response already consumed".into(),
+            ));
+        };
+        let response = tokio::select! {
+            biased;
+            reason=self.context.cancelled()=>{self.cancel();return Err(reason.error());},
+            result=receiver=>result,
+        };
+        self.response = None;
+        if let Err(error) = self.context.check() {
+            self.cancel();
+            return Err(error);
+        }
+        response.map_err(|_| {
+            ExecutorError::CleanupFailed("Invocation worker terminated without settlement".into())
+        })?
+    }
+
+    /// Await confirmed cleanup independently of response/deadline/cancellation.
+    ///
+    /// Expiry or dropping this waiter leaves the handle resumable and owned.
+    ///
+    /// # Errors
+    /// Returns `CleanupFailed` on expiry, uncertainty or a closed settlement channel.
+    ///
+    /// ```no_run
+    /// # async fn join(handle:&mut rustack_lambda_core::invocation::InvocationHandle,deadline:tokio::time::Instant) {
+    /// let cleanup=handle.wait_settlement(deadline).await;
+    /// # }
+    /// ```
+    pub async fn wait_settlement(&mut self, deadline: Instant) -> Result<(), ExecutorError> {
+        timeout_at(deadline, self.wait_cleanup())
+            .await
+            .map_err(|_| {
+                ExecutorError::CleanupFailed("Invocation cleanup observer expired".into())
+            })?
+    }
+
+    /// Retain ownership while joining cleanup without an observation deadline.
+    ///
+    /// This waits only on the supervisor's state channel; backend IO retains its
+    /// own deadlines. Use `wait_settlement` for a bounded observer of the same work.
+    ///
+    /// # Errors
+    /// Returns `CleanupFailed` if the owner closes or reports uncertain settlement.
+    ///
+    /// ```no_run
+    /// # async fn join(handle:&mut rustack_lambda_core::invocation::InvocationHandle) {
+    /// let settled=handle.wait_cleanup().await;
+    /// # }
+    /// ```
+    pub async fn wait_cleanup(&mut self) -> Result<(), ExecutorError> {
+        match self
+            .settlement
+            .wait_for(|state| *state != Settlement::Pending)
+            .await
+        {
+            Ok(state) if *state == Settlement::Clean => {
+                self.cancel_on_drop = false;
+                Ok(())
+            }
+            _ => Err(ExecutorError::CleanupFailed(
+                "Invocation cleanup is not confirmed".into(),
+            )),
+        }
+    }
+
+    /// Request cancellation and await confirmed cleanup, independently of the call deadline.
+    ///
+    /// # Errors
+    /// Returns `CleanupFailed` when the cleanup waiter expires or settlement is uncertain.
+    /// Cleanup remains owned after this method returns an error or is dropped.
+    ///
+    /// ```no_run
+    /// # async fn stop(handle: rustack_lambda_core::invocation::InvocationHandle) {
+    /// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(10);
+    /// let settled = handle.cancel_and_wait(deadline).await;
+    /// # }
+    /// ```
+    pub async fn cancel_and_wait(mut self, deadline: Instant) -> Result<(), ExecutorError> {
+        self.cancel();
+        self.wait_settlement(deadline).await
+    }
+
+    /// Transfer Event invocation ownership to the supervisor after successful admission.
+    ///
+    /// ```
+    /// # fn accept(handle: rustack_lambda_core::invocation::InvocationHandle) {
+    /// handle.detach();
+    /// # }
+    /// ```
+    pub fn detach(mut self) {
+        self.cancel_on_drop = false;
+    }
+}
+
+impl Drop for InvocationHandle {
+    fn drop(&mut self) {
+        if self.cancel_on_drop {
+            self.cancel();
+        }
+    }
+}
+
+/// Owned queued submission, retaining cleanup even when admission observation fails.
+#[non_exhaustive]
+pub struct InvocationSubmission {
+    handle: InvocationHandle,
+    accepted: Option<oneshot::Receiver<Result<(), LambdaServiceError>>>,
+    admitted: bool,
+}
+impl fmt::Debug for InvocationSubmission {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("InvocationSubmission")
+            .field("handle", &self.handle)
+            .field("admitted", &self.admitted)
+            .finish_non_exhaustive()
+    }
+}
+impl InvocationSubmission {
+    pub(crate) fn new(
+        handle: InvocationHandle,
+        accepted: oneshot::Receiver<Result<(), LambdaServiceError>>,
+    ) -> Self {
+        Self {
+            handle,
+            accepted: Some(accepted),
+            admitted: false,
+        }
+    }
+    /// Await execution admission while keeping the cleanup receipt on every path.
+    ///
+    /// # Errors
+    /// Returns service rejection, cancellation/deadline or a lost admission owner.
+    /// Dropping this waiter does not drop the submission or restart admission.
+    ///
+    /// ```no_run
+    /// # async fn accepted(submission:&mut rustack_lambda_core::invocation::InvocationSubmission) {
+    /// let result=submission.admitted().await;
+    /// # }
+    /// ```
+    pub async fn admitted(&mut self) -> Result<(), LambdaServiceError> {
+        if self.admitted {
+            return Ok(());
+        }
+        let Some(receiver) = &mut self.accepted else {
+            return Err(admission_error(
+                "Invocation admission result already consumed",
+            ));
+        };
+        let result = tokio::select! {
+            biased;
+            reason=self.handle.context.cancelled()=>{self.handle.cancel();return Err(reason.error().into());},
+            result=receiver=>result,
+        };
+        self.accepted = None;
+        result.map_err(|_| admission_error("Invocation admission owner lost"))??;
+        self.handle
+            .context
+            .check()
+            .map_err(LambdaServiceError::from)?;
+        self.admitted = true;
+        Ok(())
+    }
+    /// Signal cancellation before admission completes without consuming ownership.
+    ///
+    /// ```
+    /// # fn cancel(submission:&rustack_lambda_core::invocation::InvocationSubmission) {submission.cancel();}
+    /// ```
+    pub fn cancel(&self) {
+        self.handle.cancel();
+    }
+    /// Transfer the invocation handle even after admission rejection or timeout.
+    ///
+    /// ```
+    /// # fn transfer(submission:rustack_lambda_core::invocation::InvocationSubmission) {
+    /// let retained=submission.into_handle();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn into_handle(self) -> InvocationHandle {
+        self.handle
+    }
+}
+fn admission_error(message: &str) -> LambdaServiceError {
+    LambdaServiceError::ResourceNotReady {
+        message: message.into(),
+    }
+}
+
+/// Single cleanup operation whose future survives cancellation of any waiter.
+#[derive(Default)]
+pub(crate) struct CleanupTask {
+    state: OwnerMutex<Option<Arc<Mutex<CleanupState>>>>,
+}
+
+enum CleanupState {
+    Running(JoinHandle<Result<(), ExecutorError>>),
+    Complete(Result<(), ExecutorError>),
+}
+
+impl fmt::Debug for CleanupTask {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("CleanupTask")
+            .field("started", &self.state.lock().is_some())
+            .finish()
+    }
+}
+impl fmt::Debug for CleanupState {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::Running(_) => "Running",
+            Self::Complete(Ok(())) => "Clean",
+            Self::Complete(Err(_)) => "Failed",
+        })
+    }
+}
+
+impl CleanupTask {
+    #[cfg(test)]
+    pub(crate) fn start<F, Fut>(&self, factory: F) -> bool
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = Result<(), ExecutorError>> + Send + 'static,
+    {
+        self.start_on(&Handle::current(), factory)
+    }
+
+    pub(crate) fn start_on<F, Fut>(&self, runtime: &Handle, factory: F) -> bool
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = Result<(), ExecutorError>> + Send + 'static,
+    {
+        let mut state = self.state.lock();
+        if state.is_some() {
+            return false;
+        }
+        // Retain the JoinHandle before returning; dropping a waiter never drops this future.
+        *state = Some(Arc::new(Mutex::new(CleanupState::Running(
+            runtime.spawn(factory()),
+        ))));
+        true
+    }
+
+    pub(crate) fn is_finished(&self) -> bool {
+        let state = self.state.lock().clone();
+        let Some(state) = state else {
+            return true;
+        };
+        match state.try_lock() {
+            Ok(state) => match &*state {
+                CleanupState::Complete(_) => true,
+                CleanupState::Running(task) => task.is_finished(),
+            },
+            Err(_) => false,
+        }
+    }
+
+    pub(crate) async fn wait(&self) -> Result<(), ExecutorError> {
+        let state = self.state.lock().clone();
+        let Some(state) = state else {
+            return Ok(());
+        };
+        let mut state = state.lock().await;
+        if let CleanupState::Running(task) = &mut *state {
+            let result = task.await.unwrap_or_else(|_| {
+                Err(ExecutorError::CleanupFailed(
+                    "Cleanup supervisor task failed".into(),
+                ))
+            });
+            *state = CleanupState::Complete(result);
+        }
+        match &*state {
+            CleanupState::Complete(result) => result.clone(),
+            CleanupState::Running(_) => Err(ExecutorError::CleanupFailed(
+                "Cleanup supervisor is unsettled".into(),
+            )),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use bytes::Bytes;
+    use tokio::sync::Semaphore;
+
+    use super::*;
+
+    #[tokio::test(start_paused = true)]
+    async fn test_should_prioritize_absolute_expiry_and_notice_closed_cancellation_owner() {
+        let deadline = Instant::now() + Duration::from_secs(2);
+        let (cancel, context) = InvocationContext::channel(deadline);
+        assert!(context.check().is_ok());
+        cancel.send_replace(true);
+        assert_eq!(context.cancelled().await, CancellationReason::Requested);
+        tokio::time::advance(Duration::from_secs(2)).await;
+        assert_eq!(context.cancelled().await, CancellationReason::Deadline);
+        assert!(matches!(
+            context.check(),
+            Err(ExecutorError::DeadlineExceeded)
+        ));
+
+        let (cancel, context) = InvocationContext::channel(Instant::now() + Duration::from_secs(2));
+        drop(cancel);
+        assert_eq!(context.cancelled().await, CancellationReason::Requested);
+        assert!(matches!(context.check(), Err(ExecutorError::Cancelled)));
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn test_should_discard_a_result_received_after_the_attempt_deadline() {
+        let (cancel, context) = InvocationContext::channel(Instant::now() + Duration::from_secs(1));
+        let (response, received) = oneshot::channel();
+        let (_, settled) = watch::channel(Settlement::Clean);
+        let handle = InvocationHandle::new(context, cancel.clone(), received, settled);
+        response
+            .send(Ok(InvokeResponse::success(Bytes::new(), "$LATEST".into())))
+            .unwrap();
+        tokio::time::advance(Duration::from_secs(1)).await;
+        assert!(matches!(
+            handle.wait().await,
+            Err(ExecutorError::DeadlineExceeded)
+        ));
+        assert!(
+            *cancel.borrow(),
+            "expiry must request owned backend cleanup"
+        );
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn test_should_wait_for_cleanup_after_expiry_and_detach_only_explicitly() {
+        let (cancel, context) = InvocationContext::channel(Instant::now());
+        let (_, received) = oneshot::channel();
+        let (settlement, settled) = watch::channel(Settlement::Pending);
+        let handle = InvocationHandle::new(context, cancel.clone(), received, settled);
+        settlement.send_replace(Settlement::Clean);
+        handle
+            .cancel_and_wait(Instant::now() + Duration::from_secs(2))
+            .await
+            .unwrap();
+        assert!(*cancel.borrow());
+
+        let (cancel, context) = InvocationContext::channel(Instant::now() + Duration::from_secs(2));
+        let (_, received) = oneshot::channel();
+        let (_, settled) = watch::channel(Settlement::Pending);
+        InvocationHandle::new(context, cancel.clone(), received, settled).detach();
+        assert!(!*cancel.borrow(), "Event detach preserves admitted work");
+    }
+
+    #[tokio::test]
+    async fn test_should_retain_cleanup_resources_when_a_waiter_is_aborted() {
+        let cleanup = Arc::new(CleanupTask::default());
+        let resources = Arc::new(Semaphore::new(1));
+        let reservation = resources.clone().acquire_owned().await.unwrap();
+        let release = Arc::new(Semaphore::new(0));
+        let ready = Arc::new(Semaphore::new(0));
+        let gate = Arc::clone(&release);
+        let started = Arc::clone(&ready);
+        assert!(cleanup.start(move || async move {
+            let _reservation = reservation;
+            started.add_permits(1);
+            gate.acquire().await.unwrap().forget();
+            Ok(())
+        }));
+        ready.acquire().await.unwrap().forget();
+        let owner = Arc::clone(&cleanup);
+        let waiter = tokio::spawn(async move { owner.wait().await });
+        tokio::task::yield_now().await;
+        waiter.abort();
+        assert!(waiter.await.unwrap_err().is_cancelled());
+        assert_eq!(resources.available_permits(), 0);
+        assert!(!cleanup.start(|| async { Ok(()) }));
+
+        release.add_permits(1);
+        let (first, second) = tokio::join!(cleanup.wait(), cleanup.wait());
+        first.unwrap();
+        second.unwrap();
+        assert_eq!(resources.available_permits(), 1);
+        cleanup.wait().await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_should_preserve_failed_cleanup_and_supervised_panics_for_all_waiters() {
+        let cleanup = CleanupTask::default();
+        assert!(cleanup.start(|| async { Err(ExecutorError::CleanupFailed("failed".into())) }));
+        for _ in 0..2 {
+            assert!(
+                matches!(cleanup.wait().await, Err(ExecutorError::CleanupFailed(message)) if message == "failed")
+            );
+        }
+        let cleanup = CleanupTask::default();
+        assert!(cleanup.start(|| async { panic!("intentional cleanup task panic") }));
+        for _ in 0..2 {
+            assert!(matches!(
+                cleanup.wait().await,
+                Err(ExecutorError::CleanupFailed(_))
+            ));
+        }
+    }
+}
+
+#[cfg(test)]
+mod submission_tests {
+    use std::time::Duration;
+
+    use bytes::Bytes;
+
+    use super::*;
+    #[tokio::test(start_paused = true)]
+    async fn test_should_propagate_external_cancellation_and_keep_deadline_precedence() {
+        let (external, signal) = watch::channel(false);
+        let (_own, context) = InvocationContext::channel_with_cancellation(
+            Instant::now() + Duration::from_secs(1),
+            Some(signal),
+        );
+        external.send_replace(true);
+        assert_eq!(context.cancelled().await, CancellationReason::Requested);
+        tokio::time::advance(Duration::from_secs(1)).await;
+        assert_eq!(context.cancelled().await, CancellationReason::Deadline);
+        let (external, signal) = watch::channel(false);
+        let (_own, context) = InvocationContext::channel_with_cancellation(
+            Instant::now() + Duration::from_secs(1),
+            Some(signal),
+        );
+        drop(external);
+        assert!(matches!(context.check(), Err(ExecutorError::Cancelled)));
+        assert_eq!(context.cancelled().await, CancellationReason::Requested);
+    }
+    #[tokio::test(start_paused = true)]
+    async fn test_should_keep_cleanup_receipt_after_rejected_admission_and_waiter_timeout() {
+        let (cancel, context) =
+            InvocationContext::channel(Instant::now() + Duration::from_secs(10));
+        let (_response, receiver) = oneshot::channel();
+        let (settlement, settled) = watch::channel(Settlement::Pending);
+        let handle = InvocationHandle::new(context, cancel, receiver, settled);
+        let (admitted, accepted) = oneshot::channel();
+        let mut submission = InvocationSubmission::new(handle, accepted);
+        admitted
+            .send(Err(LambdaServiceError::TooManyRequests))
+            .unwrap();
+        assert!(matches!(
+            submission.admitted().await,
+            Err(LambdaServiceError::TooManyRequests)
+        ));
+        let mut handle = submission.into_handle();
+        assert!(
+            handle
+                .wait_settlement(Instant::now() + Duration::from_secs(1))
+                .await
+                .is_err()
+        );
+        settlement.send_replace(Settlement::Clean);
+        handle.wait_cleanup().await.unwrap();
+    }
+    #[tokio::test(start_paused = true)]
+    async fn test_should_resume_response_wait_and_reject_second_consumption_without_panic() {
+        let (cancel, context) =
+            InvocationContext::channel(Instant::now() + Duration::from_secs(10));
+        let (response, receiver) = oneshot::channel();
+        let (settlement, settled) = watch::channel(Settlement::Pending);
+        let mut handle = InvocationHandle::new(context, cancel.clone(), receiver, settled);
+        assert!(
+            timeout_at(
+                Instant::now() + Duration::from_secs(1),
+                handle.wait_response()
+            )
+            .await
+            .is_err()
+        );
+        assert!(!*cancel.borrow());
+        response
+            .send(Ok(InvokeResponse::success(
+                Bytes::from_static(b"5"),
+                "$LATEST".into(),
+            )))
+            .unwrap();
+        assert_eq!(
+            handle.wait_response().await.unwrap().payload,
+            Bytes::from_static(b"5")
+        );
+        assert!(matches!(
+            handle.wait_response().await,
+            Err(ExecutorError::CleanupFailed(_))
+        ));
+        settlement.send_replace(Settlement::Clean);
+        handle.wait_cleanup().await.unwrap();
+    }
+    #[tokio::test(start_paused = true)]
+    async fn test_should_not_certify_uncertain_or_lost_cleanup_from_owned_submission() {
+        for state in [Settlement::Pending, Settlement::Uncertain] {
+            let (cancel, context) =
+                InvocationContext::channel(Instant::now() + Duration::from_secs(10));
+            let (_response, receiver) = oneshot::channel();
+            let (settlement, settled) = watch::channel(state);
+            let mut handle = InvocationHandle::new(context, cancel, receiver, settled);
+            drop(settlement);
+            assert!(matches!(
+                handle.wait_cleanup().await,
+                Err(ExecutorError::CleanupFailed(_))
+            ));
+        }
+    }
+}
diff --git a/crates/rustack-lambda-core/src/lib.rs b/crates/rustack-lambda-core/src/lib.rs
index 1ed63610..8f311cb6 100644
--- a/crates/rustack-lambda-core/src/lib.rs
+++ b/crates/rustack-lambda-core/src/lib.rs
@@ -10,11 +10,20 @@
 
 #![forbid(unsafe_code)]
 
+pub mod artifact;
 pub mod code;
 pub mod config;
+pub mod deployment;
+mod deployment_input;
+pub mod diagnostics;
+#[cfg(unix)]
+pub mod docker;
 pub mod error;
 pub mod executor;
+mod function_config;
 pub mod handler;
+pub mod identity;
+pub mod invocation;
 pub mod provider;
 pub mod resolver;
 pub mod storage;
diff --git a/crates/rustack-lambda-core/src/provider.rs b/crates/rustack-lambda-core/src/provider.rs
index 7db04184..b7e75c05 100644
--- a/crates/rustack-lambda-core/src/provider.rs
+++ b/crates/rustack-lambda-core/src/provider.rs
@@ -5,18 +5,21 @@
 //! implemented; later phases (versions, aliases, permissions, tags, URLs)
 //! return appropriate errors until implemented.
 
-use std::{collections::HashMap, sync::Arc, time::Duration};
+use std::{collections::HashMap, path::PathBuf, sync::Arc, time::Duration};
 
 use bytes::Bytes;
 use serde::{Deserialize, Serialize};
 use tracing::info;
 
 /// Maximum deployment package size (50 MB zipped, per Appendix C).
-const MAX_ZIP_SIZE: u64 = 50 * 1024 * 1024;
+const MAX_ZIP_SIZE: usize = crate::artifact::MAX_ZIP_BYTES;
 
 /// Maximum synchronous invoke payload size (6 MB, per Appendix C).
 const MAX_SYNC_PAYLOAD: usize = 6 * 1024 * 1024;
 
+/// Hard upper bound for one code-source fetch before any artifact is staged.
+const CODE_FETCH_TIMEOUT: Duration = Duration::from_secs(30);
+
 /// Maximum S3 bucket name length (per S3 naming rules).
 const MAX_S3_BUCKET_LEN: usize = 63;
 
@@ -50,15 +53,27 @@ use rustack_lambda_model::{
         TracingConfigResponse, VpcConfigResponse,
     },
 };
+use tokio::{
+    sync::{SemaphorePermit, watch},
+    time::{Instant, timeout_at},
+};
 
 use crate::{
+    artifact::{Architecture, DeploymentArtifact, ImageArtifact, ImageReference},
     code::{S3CodeFetchError, S3CodeFetcher, UnavailableS3CodeFetcher},
     config::LambdaConfig,
+    deployment::{DeploymentState, check_revision},
+    diagnostics::InvocationWorkStatus,
     error::LambdaServiceError,
     executor::{
-        AutoExecutor, Executor, ExecutorBackend, InvokeRequest, NativeExecutor, NoopExecutor,
-        PackageType, SquibExecutor,
+        AutoExecutor, ExecutionRevision, Executor, ExecutorBackend, ExecutorError, InvokeRequest,
+        NativeExecutor, NoopExecutor, SquibExecutor,
+    },
+    function_config::{
+        validate_create_settings, validate_execution_settings, validate_provided_settings,
     },
+    identity::FunctionResourceId,
+    invocation::{InvocationHandle, InvocationSubmission},
     resolver::{
         alias_arn, function_arn, function_version_arn, layer_arn, layer_version_arn,
         parse_layer_version_arn, resolve_function_ref, resolve_version,
@@ -67,9 +82,14 @@ use crate::{
         AliasRecord, EventInvokeConfigRecord, EventSourceMappingRecord, EventSourceMappingStore,
         EventSourceMappingStoreSnapshot, FunctionRecord, FunctionStore, FunctionStoreSnapshot,
         FunctionUrlConfigRecord, LayerStore, LayerStoreSnapshot, LayerVersionRecord,
-        PolicyDocument, PolicyStatement, VersionRecord, compute_sha256,
+        PolicyDocument, PolicyStatement, StagedArtifact, VersionRecord, compute_sha256,
     },
 };
+#[cfg(unix)]
+use crate::{
+    deployment::{ImageDeploymentConfig, ImageDeploymentManager},
+    docker::{DockerCodeArchive, DockerError, ImageLeasePort},
+};
 
 /// Selects the AWS `Invoke` invocation type.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -84,12 +104,12 @@ pub enum InvokeKind {
 
 /// Build the executor backend for the given configuration.
 ///
-/// `Disabled` and unsupported Docker selections fail execution explicitly.
+/// `Disabled` and unqualified Docker constructors fail execution explicitly.
 /// `Auto` is an explicit operator opt-in and chooses the concrete backend per invocation.
 fn build_executor(config: &LambdaConfig) -> Arc<dyn Executor> {
     match config.executor {
         ExecutorBackend::Disabled => Arc::new(NoopExecutor::new()),
-        ExecutorBackend::Docker => Arc::new(NoopExecutor::docker_unavailable()),
+        ExecutorBackend::Docker => Arc::new(NoopExecutor::without_docker_runtime()),
         ExecutorBackend::Auto => Arc::new(AutoExecutor::new(
             config.max_warm_instances,
             config.idle_timeout,
@@ -105,6 +125,9 @@ fn build_executor(config: &LambdaConfig) -> Arc<dyn Executor> {
     }
 }
 
+mod snapshot;
+pub use snapshot::DockerArchiveProfile;
+
 /// Outcome of an [`RustackLambda::invoke`] call, mapping cleanly to AWS
 /// `Invoke` response codes.
 #[derive(Debug, Clone)]
@@ -126,13 +149,15 @@ pub enum InvokeOutcome {
 /// All operations are implemented as methods that return domain types or errors.
 #[derive(Debug)]
 pub struct RustackLambda {
-    store: FunctionStore,
-    layer_store: LayerStore,
-    esm_store: EventSourceMappingStore,
+    store: Arc<FunctionStore>,
+    layer_store: Arc<LayerStore>,
+    esm_store: Arc<EventSourceMappingStore>,
     config: LambdaConfig,
     executor: Arc<dyn Executor>,
     code_fetcher: Arc<dyn S3CodeFetcher>,
     work: crate::work::WorkManager,
+    #[cfg(unix)]
+    deployments: Option<ImageDeploymentManager>,
 }
 
 /// Serializable Lambda provider snapshot.
@@ -165,7 +190,77 @@ struct CodeSource<'a> {
     image_uri: Option<&'a str>,
 }
 
+#[derive(Debug)]
+enum ProcessedCode<'a> {
+    Zip(StagedArtifact<'a>),
+    Image(ImageReference),
+}
+
+impl ProcessedCode<'_> {
+    fn parts(&self) -> (String, u64, Option<Bytes>, Option<PathBuf>, Option<String>) {
+        match self {
+            Self::Zip(staged) => {
+                let artifact = staged.artifact();
+                (
+                    artifact.sha256().to_owned(),
+                    artifact.zip_bytes().len() as u64,
+                    Some(artifact.zip_bytes().clone()),
+                    Some(artifact.code_root().to_path_buf()),
+                    None,
+                )
+            }
+            Self::Image(reference) => (
+                String::new(),
+                0,
+                None,
+                None,
+                Some(reference.as_str().into()),
+            ),
+        }
+    }
+
+    fn commit(self) {
+        if let Self::Zip(staged) = self {
+            staged.commit();
+        }
+    }
+}
+
+#[derive(Debug)]
+struct InvocationOptions {
+    asynchronous: bool,
+    deadline: Option<Instant>,
+    capture_logs: bool,
+    cancellation: Option<watch::Receiver<bool>>,
+}
+fn check_external_cancellation(
+    signal: Option<&watch::Receiver<bool>>,
+) -> Result<(), LambdaServiceError> {
+    if signal.is_some_and(|signal| *signal.borrow() || signal.has_changed().is_err()) {
+        Err(ExecutorError::Cancelled.into())
+    } else {
+        Ok(())
+    }
+}
+
 impl RustackLambda {
+    /// Sample real invocation ownership without admission or supervisor startup.
+    ///
+    /// The counters are independently sampled and include retained cleanup and
+    /// backend pool waiting. They do not count physical running containers.
+    ///
+    /// ```
+    /// use rustack_lambda_core::{config::LambdaConfig, provider::RustackLambda};
+    /// let provider = RustackLambda::new(LambdaConfig::default());
+    /// let status = provider.work_status();
+    /// assert_eq!(status.active_executions, 0);
+    /// assert_eq!(status.limits.active_executions, 32);
+    /// ```
+    #[must_use]
+    pub fn work_status(&self) -> InvocationWorkStatus {
+        self.work.status()
+    }
+
     /// Create a new Lambda provider with the given store and config.
     ///
     /// The executor is selected from `config.executor`.
@@ -173,13 +268,15 @@ impl RustackLambda {
     pub fn with_store(store: FunctionStore, config: LambdaConfig) -> Self {
         let executor = build_executor(&config);
         Self {
-            store,
-            layer_store: LayerStore::new(),
-            esm_store: EventSourceMappingStore::new(),
+            store: Arc::new(store),
+            layer_store: Arc::new(LayerStore::new()),
+            esm_store: Arc::new(EventSourceMappingStore::new()),
             config,
             executor,
             code_fetcher: Arc::new(UnavailableS3CodeFetcher),
             work: crate::work::WorkManager::new(),
+            #[cfg(unix)]
+            deployments: None,
         }
     }
 
@@ -190,13 +287,15 @@ impl RustackLambda {
         let store = FunctionStore::new(code_dir);
         let executor = build_executor(&config);
         Self {
-            store,
-            layer_store: LayerStore::new(),
-            esm_store: EventSourceMappingStore::new(),
+            store: Arc::new(store),
+            layer_store: Arc::new(LayerStore::new()),
+            esm_store: Arc::new(EventSourceMappingStore::new()),
             config,
             executor,
             code_fetcher: Arc::new(UnavailableS3CodeFetcher),
             work: crate::work::WorkManager::new(),
+            #[cfg(unix)]
+            deployments: None,
         }
     }
 
@@ -209,13 +308,15 @@ impl RustackLambda {
         executor: Arc<dyn Executor>,
     ) -> Self {
         Self {
-            store,
-            layer_store: LayerStore::new(),
-            esm_store: EventSourceMappingStore::new(),
+            store: Arc::new(store),
+            layer_store: Arc::new(LayerStore::new()),
+            esm_store: Arc::new(EventSourceMappingStore::new()),
             config,
             executor,
             code_fetcher: Arc::new(UnavailableS3CodeFetcher),
             work: crate::work::WorkManager::new(),
+            #[cfg(unix)]
+            deployments: None,
         }
     }
 
@@ -229,6 +330,89 @@ impl RustackLambda {
         self
     }
 
+    /// Attach qualified image preparation after executor readiness probes succeed.
+    ///
+    /// # Errors
+    /// Rejects non-Docker/unavailable executors, duplicate attachment or invalid owner
+    /// configuration. The runtime must retain the image owner until all deployment/execution
+    /// consumers settle.
+    ///
+    /// ```no_run
+    /// # fn attach(provider:rustack_lambda_core::provider::RustackLambda, port:rustack_lambda_core::docker::ImageLeasePort) -> Result<(),rustack_lambda_core::error::LambdaServiceError> {
+    /// let provider = provider.with_image_preparation(port, rustack_lambda_core::deployment::ImageDeploymentConfig::default())?;
+    /// # Ok(()) }
+    /// ```
+    #[cfg(unix)]
+    pub fn with_image_preparation(
+        mut self,
+        port: ImageLeasePort,
+        config: ImageDeploymentConfig,
+    ) -> Result<Self, LambdaServiceError> {
+        if self.config.executor != ExecutorBackend::Docker
+            || self.executor.image_available().is_err()
+            || self.deployments.is_some()
+        {
+            return Err(LambdaServiceError::DockerNotAvailable);
+        }
+        self.deployments = Some(ImageDeploymentManager::start(
+            self.store.clone(),
+            port,
+            config,
+        )?);
+        Ok(self)
+    }
+
+    #[cfg(unix)]
+    fn image_deployments(&self) -> Result<&ImageDeploymentManager, LambdaServiceError> {
+        if self.config.executor != ExecutorBackend::Docker
+            || self.executor.image_available().is_err()
+        {
+            return Err(LambdaServiceError::DockerNotAvailable);
+        }
+        self.deployments
+            .as_ref()
+            .ok_or(LambdaServiceError::DockerNotAvailable)
+    }
+
+    fn create_image_deployment(
+        &self,
+        record: FunctionRecord,
+    ) -> Result<FunctionRecord, LambdaServiceError> {
+        #[cfg(unix)]
+        {
+            self.image_deployments()?.create(record)
+        }
+        #[cfg(not(unix))]
+        {
+            drop(record);
+            Err(LambdaServiceError::DockerNotAvailable)
+        }
+    }
+
+    fn update_image_deployment(
+        &self,
+        before: &FunctionRecord,
+        reference: ImageReference,
+        architecture: Architecture,
+        requested: Option<&str>,
+    ) -> Result<FunctionConfiguration, LambdaServiceError> {
+        #[cfg(unix)]
+        {
+            let accepted = self.image_deployments()?.update_with_revision(
+                before,
+                reference,
+                architecture,
+                requested,
+            )?;
+            Ok(self.build_function_configuration(&accepted, &accepted.latest))
+        }
+        #[cfg(not(unix))]
+        {
+            let _ = (before, reference, architecture, requested);
+            Err(LambdaServiceError::DockerNotAvailable)
+        }
+    }
+
     /// Borrow the executor (e.g. for tests asserting backend behavior).
     #[must_use]
     pub fn executor(&self) -> &Arc<dyn Executor> {
@@ -238,10 +422,126 @@ impl RustackLambda {
     /// Stop all warm executor instances. Wired into the rustack server's
     /// graceful shutdown path.
     pub async fn shutdown(&self) {
-        if let Err(error) = self.work.quiesce(Duration::ZERO).await {
-            tracing::error!(%error, "Lambda shutdown cancelled unfinished work");
+        if let Err(error) = self
+            .shutdown_before(Instant::now() + Duration::from_secs(10))
+            .await
+        {
+            tracing::error!(%error, "Lambda shutdown did not confirm cleanup");
+        }
+    }
+
+    /// Stop deployment, invocation and executor owners under one absolute deadline.
+    /// # Errors
+    /// Returns retained deployment/work/executor failures or deadline expiry.
+    /// Repeating a timed-out observation resumes the same lower owners.
+    /// ```no_run
+    /// # async fn stop(provider:&rustack_lambda_core::provider::RustackLambda){
+    /// let result=provider.shutdown_before(tokio::time::Instant::now()+std::time::Duration::from_secs(30)).await;
+    /// # }
+    /// ```
+    pub async fn shutdown_before(&self, deadline: Instant) -> Result<(), LambdaServiceError> {
+        #[cfg(unix)]
+        let deployment = match &self.deployments {
+            Some(owner) => owner.shutdown(deadline).await,
+            None => Ok(()),
+        };
+        self.work.cancel_all();
+        let work = self
+            .work
+            .quiesce(deadline.saturating_duration_since(Instant::now()))
+            .await;
+        let executor = timeout_at(deadline, self.executor.shutdown())
+            .await
+            .map_err(|_| {
+                ExecutorError::CleanupFailed("Lambda executor cleanup observation expired".into())
+            })
+            .and_then(|result| result);
+        #[cfg(unix)]
+        deployment?;
+        work?;
+        executor?;
+        if Instant::now() >= deadline {
+            return Err(ExecutorError::DeadlineExceeded.into());
+        }
+        Ok(())
+    }
+
+    /// Check selected backend/deployment health without invoking a function.
+    /// Ordinary handler failures do not poison this observation.
+    /// ```no_run
+    /// # fn ready(provider:&rustack_lambda_core::provider::RustackLambda){let ready=provider.is_ready();}
+    /// ```
+    #[must_use]
+    pub fn is_ready(&self) -> bool {
+        if self.config.executor != ExecutorBackend::Docker {
+            return true;
+        }
+        if self.executor.image_available().is_err() {
+            return false;
+        }
+        #[cfg(unix)]
+        {
+            self.deployments.as_ref().is_some_and(|owner| {
+                let status = owner.status();
+                status.accepting && !status.failed
+            })
+        }
+        #[cfg(not(unix))]
+        {
+            false
+        }
+    }
+
+    /// Reject metadata-only image archives before opening ordinary Docker ingress.
+    /// # Errors
+    /// Returns an error if usable saved images lack live immutable leases or the
+    /// qualified backend is unavailable. Failed creations remain inspectable.
+    /// ```no_run
+    /// # fn restore(provider:&rustack_lambda_core::provider::RustackLambda){let result=provider.validate_runtime_restore();}
+    /// ```
+    pub fn validate_runtime_restore(&self) -> Result<(), LambdaServiceError> {
+        if self.config.executor == ExecutorBackend::Docker && self.store.has_unleased_images() {
+            return Err(invalid_parameter(
+                "Docker archive contains an unleased usable image",
+            ));
         }
-        self.executor.shutdown().await;
+        if self.config.executor == ExecutorBackend::Docker {
+            self.executor.image_available()?;
+            if let Some(architecture) = self.executor.docker_zip_architecture() {
+                self.executor.zip_available(architecture)?;
+            }
+        }
+        Ok(())
+    }
+
+    /// Configured Docker archive bound, separate from Native archive payloads.
+    ///
+    /// ```no_run
+    /// # fn limit(provider: &rustack_lambda_core::provider::RustackLambda) {
+    /// let limit = provider.archive_payload_limit();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn archive_payload_limit(&self) -> Option<usize> {
+        self.docker_archive_profile()
+            .map(DockerArchiveProfile::payload_limit)
+    }
+
+    /// Configured Docker archive profile, independently of current readiness.
+    ///
+    /// ```
+    /// # use rustack_lambda_core::{config::LambdaConfig, provider::RustackLambda};
+    /// let provider = RustackLambda::new(LambdaConfig::default());
+    /// assert_eq!(provider.docker_archive_profile(), None);
+    /// ```
+    #[must_use]
+    pub fn docker_archive_profile(&self) -> Option<DockerArchiveProfile> {
+        (self.config.executor == ExecutorBackend::Docker).then(|| {
+            self.executor.docker_zip_architecture().map_or(
+                DockerArchiveProfile::ImageOnly,
+                DockerArchiveProfile::ProvidedZip,
+            )
+        })
     }
 
     /// Stop accepting invocation work and drain it before snapshot export.
@@ -249,20 +549,36 @@ impl RustackLambda {
     /// # Errors
     /// Returns an error after cancelling remaining tasks when the deadline expires.
     pub async fn quiesce(&self, timeout: Duration) -> Result<(), LambdaServiceError> {
-        let deadline = tokio::time::Instant::now() + timeout;
-        let cleanup_budget = (timeout / 10).min(Duration::from_secs(1));
+        let deadline = Instant::now()
+            .checked_add(timeout)
+            .ok_or_else(|| invalid_parameter("Invalid Lambda quiesce budget"))?;
+        #[cfg(unix)]
+        if let Some(owner) = &self.deployments {
+            if let Err(error) = owner.quiesce(deadline).await {
+                owner.cancel();
+                self.work.cancel_all();
+                return Err(error.into());
+            }
+        }
+        let remaining = deadline.saturating_duration_since(Instant::now());
+        let cleanup_budget = (remaining / 10).min(Duration::from_secs(1));
         let result = self
             .work
-            .quiesce(timeout.saturating_sub(cleanup_budget))
+            .quiesce(remaining.saturating_sub(cleanup_budget))
             .await;
         if result.is_err()
-            && tokio::time::timeout_at(deadline, self.executor.shutdown())
-                .await
-                .is_err()
+            && !matches!(
+                timeout_at(deadline, self.executor.shutdown()).await,
+                Ok(Ok(()))
+            )
         {
             tracing::error!("Lambda executor cancellation deadline exceeded");
         }
-        result
+        result?;
+        if self.config.executor == ExecutorBackend::Docker {
+            self.executor.image_available()?;
+        }
+        Ok(())
     }
 
     /// Export a point-in-time snapshot of Lambda resources.
@@ -275,6 +591,46 @@ impl RustackLambda {
         }
     }
 
+    /// Export archive metadata only when the installed profile can restore it.
+    ///
+    /// # Errors
+    /// Returns unavailable/unleased Image backend, excessive metadata, worker or
+    /// deadline failure. Native ZIP export keeps its existing representation.
+    ///
+    /// ```no_run
+    /// # async fn save(provider: &rustack_lambda_core::provider::RustackLambda) -> Result<(), rustack_lambda_core::error::LambdaServiceError> {
+    /// let saved = provider.export_snapshot_before(tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn export_snapshot_before(
+        &self,
+        deadline: Instant,
+    ) -> Result<LambdaSnapshot, LambdaServiceError> {
+        if self.config.executor == ExecutorBackend::Docker {
+            self.validate_runtime_restore()?;
+            self.store.check_snapshot_counts(
+                snapshot::MAX_IMAGE_FUNCTIONS,
+                snapshot::MAX_IMAGE_REVISIONS,
+            )?;
+            #[cfg(unix)]
+            {
+                let saved = snapshot::export_docker(
+                    self,
+                    deadline,
+                    self.docker_archive_profile()
+                        .ok_or(LambdaServiceError::DockerNotAvailable)?,
+                )
+                .await?;
+                self.validate_runtime_restore()?;
+                self.image_deployments()?;
+                return Ok(saved);
+            }
+            #[cfg(not(unix))]
+            return Err(LambdaServiceError::DockerNotAvailable);
+        }
+        Ok(self.export_snapshot())
+    }
+
     /// Replace Lambda resources from a snapshot.
     ///
     /// # Errors
@@ -284,6 +640,66 @@ impl RustackLambda {
         &self,
         snapshot: LambdaSnapshot,
     ) -> Result<(), LambdaServiceError> {
+        let deadline = Instant::now()
+            .checked_add(Duration::from_secs(300))
+            .ok_or_else(|| invalid_parameter("Invalid Lambda restore deadline"))?;
+        self.import_snapshot_before(snapshot, deadline).await
+    }
+
+    /// Restore quiescent/startup resources before one captured commit deadline.
+    ///
+    /// Docker validates the complete candidate and reacquires exact saved content
+    /// before replacing any resource. There is no live import HTTP action.
+    ///
+    /// # Errors
+    /// Returns bounded validation, unavailable backend, immutable content, quota,
+    /// deadline or retained cleanup failure without publishing a failed candidate.
+    ///
+    /// ```no_run
+    /// # async fn restore(provider: &rustack_lambda_core::provider::RustackLambda, saved: rustack_lambda_core::provider::LambdaSnapshot) -> Result<(), rustack_lambda_core::error::LambdaServiceError> {
+    /// provider.import_snapshot_before(saved, tokio::time::Instant::now() + std::time::Duration::from_secs(30)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn import_snapshot_before(
+        &self,
+        snapshot: LambdaSnapshot,
+        deadline: Instant,
+    ) -> Result<(), LambdaServiceError> {
+        if self.config.executor == ExecutorBackend::Docker {
+            #[cfg(unix)]
+            {
+                self.image_deployments()?;
+                let profile = self
+                    .docker_archive_profile()
+                    .ok_or(LambdaServiceError::DockerNotAvailable)?;
+                if let Some(architecture) = profile.zip_architecture() {
+                    self.executor.zip_available(architecture)?;
+                }
+                let snapshot = snapshot::validate_docker(
+                    snapshot,
+                    deadline,
+                    &self.config.default_region,
+                    &self.config.account_id,
+                    profile,
+                )
+                .await?;
+                let manager = self.image_deployments()?;
+                let prepared = manager
+                    .prepare_restore(snapshot.functions, deadline, profile)
+                    .await?;
+                self.image_deployments()?.restore_available()?;
+                if let Some(architecture) = profile.zip_architecture() {
+                    self.executor.zip_available(architecture)?;
+                }
+                prepared.commit_before(deadline)?;
+                self.layer_store.import_snapshot(snapshot.layers);
+                self.esm_store
+                    .import_snapshot(snapshot.event_source_mappings);
+                return Ok(());
+            }
+            #[cfg(not(unix))]
+            return Err(LambdaServiceError::DockerNotAvailable);
+        }
         self.store.import_snapshot(snapshot.functions).await?;
         self.layer_store.import_snapshot(snapshot.layers);
         self.esm_store
@@ -323,6 +739,11 @@ impl RustackLambda {
     ///
     /// Validates the input, stores the deployment package, and inserts
     /// the function record into the store.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid deployment settings, duplicate functions, unavailable image execution,
+    /// exhausted deployment admission, or ZIP/S3 staging and storage failures.
     #[allow(clippy::too_many_lines)]
     pub async fn create_function(
         &self,
@@ -458,9 +879,19 @@ impl RustackLambda {
             }
         }
 
-        // Process code.
-        let (code_sha256, code_size, zip_bytes, code_path, image_uri) =
-            self.process_code(name, "$LATEST", code_source).await?;
+        validate_image_publication(&package_type, input.publish.unwrap_or(false))?;
+        let architecture = validate_create_settings(&input)?;
+        if package_type == "Zip" {
+            self.validate_docker_zip_settings(
+                input.runtime.as_deref(),
+                input.handler.as_deref(),
+                architecture,
+            )?;
+        }
+        let processed = self.process_code(name, "$LATEST", code_source).await?;
+        self.validate_docker_zip_candidate(&processed, architecture)
+            .await?;
+        let (code_sha256, code_size, zip_bytes, code_path, image_uri) = processed.parts();
 
         let timeout = input.timeout.unwrap_or(3);
         let memory_size = input.memory_size.unwrap_or(128);
@@ -487,8 +918,9 @@ impl RustackLambda {
             package_type: package_type.clone(),
             code_path,
             image_uri,
+            image: ImageArtifact::Unresolved,
             zip_bytes,
-            state: "Active".to_owned(),
+            deployment: DeploymentState::Ready,
             last_modified: now.clone(),
             architectures,
             ephemeral_storage_size,
@@ -505,6 +937,7 @@ impl RustackLambda {
         };
 
         let record = FunctionRecord {
+            resource_id: FunctionResourceId::new(),
             name: name.clone(),
             arn: arn.clone(),
             latest: version_record,
@@ -520,8 +953,18 @@ impl RustackLambda {
             created_at: now,
         };
 
+        if package_type == "Image" {
+            let accepted = self.create_image_deployment(record)?;
+            return Ok(self.build_function_configuration(&accepted, &accepted.latest));
+        }
         let should_publish = input.publish.unwrap_or(false);
+        self.validate_docker_zip_settings(
+            record.latest.runtime.as_deref(),
+            record.latest.handler.as_deref(),
+            architecture,
+        )?;
         self.store.insert(record)?;
+        processed.commit();
 
         // If publish=true, publish version 1 immediately.
         let config = if should_publish {
@@ -537,6 +980,11 @@ impl RustackLambda {
     }
 
     /// Get function information including configuration, code location, and tags.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references or qualifiers, and missing functions, versions or
+    /// aliases.
     pub fn get_function(
         &self,
         function_ref: &str,
@@ -552,15 +1000,16 @@ impl RustackLambda {
         let version = resolve_version(&record, qualifier)?;
         let config = self.build_function_configuration(&record, version);
 
+        let is_image = version.package_type == "Image";
         let code_location = FunctionCodeLocation {
-            repository_type: Some("S3".to_owned()),
-            location: Some(format!(
+            repository_type: Some(if is_image { "ECR" } else { "S3" }.into()),
+            location: (!is_image).then(|| format!(
                 "https://awslambda-{region}-tasks.s3.{region}.amazonaws.com/snapshots/{account}/{name}",
                 region = self.config.default_region,
                 account = self.config.account_id,
             )),
             image_uri: version.image_uri.clone(),
-            resolved_image_uri: None,
+            resolved_image_uri: version.image.resolved().map(crate::artifact::ResolvedImage::resolved_uri),
         };
 
         let tags = if record.tags.is_empty() {
@@ -577,6 +1026,11 @@ impl RustackLambda {
     }
 
     /// Get function configuration only.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references or qualifiers, and missing functions, versions or
+    /// aliases.
     pub fn get_function_configuration(
         &self,
         function_ref: &str,
@@ -594,6 +1048,10 @@ impl RustackLambda {
     }
 
     /// Get the code signing config association for a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references and missing functions.
     pub fn get_function_code_signing_config(
         &self,
         function_ref: &str,
@@ -608,10 +1066,35 @@ impl RustackLambda {
     }
 
     /// Update function code.
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid or immutable references, incompatible code sources/settings, stale
+    /// revisions, in-progress deployments or unavailable/exhausted image preparation. ZIP/S3
+    /// staging and validation failures propagate; `DryRun` preserves metadata and performs no
+    /// deployment effects.
     pub async fn update_function_code(
         &self,
         function_ref: &str,
         input: UpdateFunctionCodeInput,
+    ) -> Result<FunctionConfiguration, LambdaServiceError> {
+        self.update_code(function_ref, input, None).await
+    }
+
+    pub(crate) async fn update_function_code_parsed(
+        &self,
+        function_ref: &str,
+        input: UpdateFunctionCodeInput,
+        permit: SemaphorePermit<'static>,
+    ) -> Result<FunctionConfiguration, LambdaServiceError> {
+        self.update_code(function_ref, input, Some(permit)).await
+    }
+
+    async fn update_code(
+        &self,
+        function_ref: &str,
+        mut input: UpdateFunctionCodeInput,
+        mut admitted: Option<SemaphorePermit<'static>>,
     ) -> Result<FunctionConfiguration, LambdaServiceError> {
         let code_source = CodeSource {
             zip_file_b64: input.zip_file.as_deref(),
@@ -622,126 +1105,117 @@ impl RustackLambda {
         };
         validate_code_source(&code_source)?;
 
-        // Validate that some code source is provided.
-        if code_source.zip_file_b64.is_none()
-            && code_source.image_uri.is_none()
-            && code_source.s3_bucket.is_none()
-        {
-            return Err(LambdaServiceError::InvalidParameter {
-                message: "Provide at least one of ZipFile, S3Bucket, or ImageUri.".to_owned(),
-            });
-        }
-
-        let (name, _) = resolve_function_ref(function_ref)?;
+        let name = mutable_function_name(function_ref)?;
         let should_publish = input.publish.unwrap_or(false);
         let before = self.get_record(&name)?;
-        if input.architectures.as_ref().is_some_and(|architectures| {
-            architectures.len() != 1
-                || architectures
-                    .iter()
-                    .any(|architecture| architecture != "arm64" && architecture != "x86_64")
-        }) {
-            return Err(invalid_parameter(
-                "Exactly one supported architecture is required",
-            ));
+        let architecture = validate_code_update(&before, &input, code_source)?;
+
+        if input.dry_run.unwrap_or(false) {
+            if let Some(reference) = code_source.image_uri {
+                reference
+                    .parse::<ImageReference>()
+                    .map_err(|_| invalid_parameter("Invalid ImageUri"))?;
+            }
+            let _inline_permit = if let Some(encoded) = input.zip_file.take() {
+                Some(crate::deployment_input::validate_inline(encoded, admitted.take()).await?)
+            } else {
+                None
+            };
+            let current = self.get_record(&name)?;
+            check_revision(input.revision_id.as_deref(), &current.latest.revision_id)?;
+            check_staged_revision(&current, &before)?;
+            current.latest.deployment.ensure_mutable()?;
+            return Ok(self.build_function_configuration(&current, &current.latest));
         }
 
-        let (code_sha256, code_size, zip_bytes, code_path, image_uri) =
-            self.process_code(&name, "$LATEST", code_source).await?;
-
-        let config =
-            self.store
-                .update_if_revision(&name, Some(&before.latest.revision_id), |record| {
-                    let now = now_iso8601();
-                    record.latest.code_sha256 = code_sha256;
-                    record.latest.code_size = code_size;
-                    record.latest.zip_bytes = zip_bytes;
-                    record.latest.code_path = code_path;
-                    record.latest.image_uri = image_uri;
-                    record.latest.last_modified = now;
-                    record.latest.revision_id = uuid::Uuid::new_v4().to_string();
-
-                    if let Some(archs) = input.architectures.clone() {
-                        record.latest.architectures = archs;
-                    }
-                    if should_publish {
-                        let number = record.next_version;
-                        record.next_version = number.saturating_add(1);
-                        let mut published = record.latest.clone();
-                        published.version = number.to_string();
-                        let configuration = self.build_function_configuration(record, &published);
-                        record.versions.insert(number, published);
-                        configuration
-                    } else {
-                        self.build_function_configuration(record, &record.latest)
-                    }
-                })?;
+        if before.latest.package_type == "Image" {
+            let reference = code_source
+                .image_uri
+                .ok_or_else(|| invalid_parameter("ImageUri is required"))?
+                .parse()
+                .map_err(|_| invalid_parameter("Invalid ImageUri"))?;
+            return self.update_image_deployment(
+                &before,
+                reference,
+                architecture,
+                input.revision_id.as_deref(),
+            );
+        }
+        if before.latest.package_type == "Zip" {
+            self.validate_docker_zip_settings(
+                before.latest.runtime.as_deref(),
+                before.latest.handler.as_deref(),
+                architecture,
+            )?;
+        }
+        let processed = self.process_code(&name, "$LATEST", code_source).await?;
+        self.validate_docker_zip_candidate(&processed, architecture)
+            .await?;
+        let (code_sha256, code_size, zip_bytes, code_path, image_uri) = processed.parts();
+
+        let config = self.store.try_update_if_revision(&name, None, |record| {
+            check_revision(input.revision_id.as_deref(), &record.latest.revision_id)?;
+            check_staged_revision(record, &before)?;
+            record.latest.deployment.ensure_mutable()?;
+            self.validate_docker_zip_settings(
+                record.latest.runtime.as_deref(),
+                record.latest.handler.as_deref(),
+                architecture,
+            )?;
+            let now = now_iso8601();
+            record.latest.code_sha256 = code_sha256;
+            record.latest.code_size = code_size;
+            record.latest.zip_bytes = zip_bytes;
+            record.latest.code_path = code_path;
+            record.latest.image_uri = image_uri;
+            record.latest.image = ImageArtifact::Unresolved;
+            record.latest.last_modified = now;
+            record.latest.revision_id = uuid::Uuid::new_v4().to_string();
+
+            if let Some(archs) = input.architectures.clone() {
+                record.latest.architectures = archs;
+            }
+            record.latest.deployment = DeploymentState::Ready;
+            let configuration = if should_publish {
+                let number = record.next_version;
+                record.next_version = number.saturating_add(1);
+                let mut published = record.latest.clone();
+                published.version = number.to_string();
+                let configuration = self.build_function_configuration(record, &published);
+                record.versions.insert(number, published);
+                configuration
+            } else {
+                self.build_function_configuration(record, &record.latest)
+            };
+            Ok(configuration)
+        })?;
 
+        processed.commit();
         info!(function_name = %name, "updated Lambda function code");
         Ok(config)
     }
 
     /// Update function configuration (handler, runtime, env vars, etc.).
+    ///
+    /// # Errors
+    ///
+    /// Rejects invalid or immutable references/settings, stale revisions, in-progress deployments,
+    /// missing functions or changes that violate the stored execution configuration.
     pub fn update_function_configuration(
         &self,
         function_ref: &str,
         input: &UpdateFunctionConfigurationInput,
     ) -> Result<FunctionConfiguration, LambdaServiceError> {
-        let (name, _) = resolve_function_ref(function_ref)?;
+        let name = mutable_function_name(function_ref)?;
 
-        // Validate handler length (Appendix C: max 128 chars).
-        if let Some(ref handler) = input.handler {
-            if handler.len() > 128 {
-                return Err(LambdaServiceError::InvalidParameter {
-                    message: "Handler must be at most 128 characters".to_owned(),
-                });
-            }
-        }
-        // Validate description length (Appendix C: max 256 chars).
-        if let Some(ref desc) = input.description {
-            if desc.len() > 256 {
-                return Err(LambdaServiceError::InvalidParameter {
-                    message: "Description must be at most 256 characters".to_owned(),
-                });
-            }
-        }
-        // Validate timeout (Appendix C: 1-900 seconds).
-        if let Some(timeout) = input.timeout {
-            if !(1..=900).contains(&timeout) {
-                return Err(LambdaServiceError::InvalidParameter {
-                    message: "Timeout must be between 1 and 900 seconds".to_owned(),
-                });
-            }
-        }
-        // Validate memory size (Appendix C: 128-10240 MB).
-        if let Some(memory) = input.memory_size {
-            if !(128..=10_240).contains(&memory) {
-                return Err(LambdaServiceError::InvalidParameter {
-                    message: "Memory size must be between 128 and 10240 MB".to_owned(),
-                });
-            }
-        }
-        // Validate ephemeral storage (Appendix C: 512-10240 MB).
-        if let Some(ref ephemeral) = input.ephemeral_storage {
-            if !(512..=10_240).contains(&ephemeral.size) {
-                return Err(LambdaServiceError::InvalidParameter {
-                    message: "Ephemeral storage must be between 512 and 10240 MB".to_owned(),
-                });
-            }
-        }
-        // Validate environment variables total size (Appendix C: 4 KB).
-        if let Some(ref env) = input.environment {
-            if let Some(ref vars) = env.variables {
-                let total_size: usize = vars.iter().map(|(k, v)| k.len() + v.len()).sum();
-                if total_size > 4096 {
-                    return Err(LambdaServiceError::InvalidParameter {
-                        message: "Environment variables total size exceeds 4 KB limit".to_owned(),
-                    });
-                }
-            }
-        }
+        validate_configuration_update(input)?;
 
-        let config = self.store.update(&name, |record| {
+        let before = self.get_record(&name)?;
+        check_revision(input.revision_id.as_deref(), &before.latest.revision_id)?;
+        let config = self.store.try_update_if_revision(&name, None, |record| {
+            check_revision(input.revision_id.as_deref(), &record.latest.revision_id)?;
+            check_staged_revision(record, &before)?;
+            record.latest.deployment.ensure_mutable()?;
             let now = now_iso8601();
 
             if let Some(runtime) = &input.runtime {
@@ -793,7 +1267,29 @@ impl RustackLambda {
             record.latest.last_modified = now;
             record.latest.revision_id = uuid::Uuid::new_v4().to_string();
 
-            self.build_function_configuration(record, &record.latest)
+            if matches!(record.latest.deployment, DeploymentState::UpdateFailed(_)) {
+                record.latest.deployment = DeploymentState::Ready;
+            }
+            if let Some(image) = record.latest.image.resolved() {
+                image
+                    .metadata()
+                    .execution
+                    .plan(record.latest.image_config.as_ref())
+                    .map_err(|_| {
+                        invalid_parameter("Invalid effective image entry configuration")
+                    })?;
+            }
+            if record.latest.package_type == "Zip"
+                && self.config.executor == ExecutorBackend::Docker
+            {
+                let architecture = validate_execution_settings(&record.latest)?;
+                self.validate_docker_zip_settings(
+                    record.latest.runtime.as_deref(),
+                    record.latest.handler.as_deref(),
+                    architecture,
+                )?;
+            }
+            Ok(self.build_function_configuration(record, &record.latest))
         })?;
 
         info!(function_name = %name, "updated Lambda function configuration");
@@ -801,6 +1297,12 @@ impl RustackLambda {
     }
 
     /// Delete a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references, nonnumeric deletion qualifiers, missing functions/versions,
+    /// or artifact-root preflight failures. Final cleanup revalidates the root and can fail
+    /// after metadata removal if the root changes or filesystem inspection fails.
     pub async fn delete_function(
         &self,
         function_ref: &str,
@@ -877,104 +1379,333 @@ impl RustackLambda {
         }
     }
 
-    // ---------------------------------------------------------------
-    // Phase 0: Invoke
-    // ---------------------------------------------------------------
+    // ---------------------------------------------------------------
+    // Phase 0: Invoke
+    // ---------------------------------------------------------------
+
+    /// Invoke a function through shared admission and supervised execution.
+    ///
+    /// # Errors
+    /// Rejects invalid payload/reference, missing resources, unavailable execution,
+    /// exhausted capacity and mapped backend errors. `DryRun` starts no runtime.
+    pub async fn invoke(
+        &self,
+        function_ref: &str,
+        qualifier: Option<&str>,
+        payload: &[u8],
+        invocation_type: InvokeKind,
+    ) -> Result<InvokeOutcome, LambdaServiceError> {
+        self.invoke_with_logs(function_ref, qualifier, payload, invocation_type, false)
+            .await
+    }
+
+    /// Invoke through shared admission with an optional synchronous log tail.
+    ///
+    /// Event and `DryRun` calls never capture response logs. The HTTP adapter passes
+    /// only its already-validated `LogType` choice; internal adapters default to None.
+    ///
+    /// # Errors
+    /// Returns the same validation, admission and backend errors as `invoke`.
+    ///
+    /// ```no_run
+    /// # async fn call(provider: &rustack_lambda_core::provider::RustackLambda) {
+    /// use rustack_lambda_core::provider::InvokeKind;
+    /// let result = provider.invoke_with_logs("worker", None, b"{}", InvokeKind::RequestResponse, true).await;
+    /// # }
+    /// ```
+    pub async fn invoke_with_logs(
+        &self,
+        function_ref: &str,
+        qualifier: Option<&str>,
+        payload: &[u8],
+        invocation_type: InvokeKind,
+        capture_logs: bool,
+    ) -> Result<InvokeOutcome, LambdaServiceError> {
+        validate_invoke_payload(
+            payload,
+            if invocation_type == InvokeKind::Event {
+                1024 * 1024
+            } else {
+                MAX_SYNC_PAYLOAD
+            },
+        )?;
+        let (record, qualifier) = self.resolve_invocation(function_ref, qualifier)?;
+        resolve_version(&record, qualifier.as_deref())?;
+        if invocation_type == InvokeKind::DryRun {
+            return Ok(InvokeOutcome::DryRun);
+        }
+        let handle = self
+            .admit_invocation(
+                &record,
+                qualifier.as_deref(),
+                payload,
+                invocation_type == InvokeKind::Event,
+                None,
+                capture_logs && invocation_type == InvokeKind::RequestResponse,
+            )
+            .await?;
+        if invocation_type == InvokeKind::Event {
+            let request_id = handle.id().to_string();
+            handle.detach();
+            return Ok(InvokeOutcome::Async { request_id });
+        }
+        handle
+            .wait()
+            .await
+            .map(InvokeOutcome::Sync)
+            .map_err(LambdaServiceError::from)
+    }
+
+    /// Admit a cancellable synchronous invocation for an internal service adapter.
+    ///
+    /// Shares version resolution, validation and quotas with ordinary HTTP Invoke.
+    /// The optional absolute deadline bounds capture, queueing and cold start.
+    ///
+    /// # Errors
+    /// Rejects invalid input, missing resources, capture timeout, unavailable backend
+    /// or exhausted admission/execution capacity. Runtime outcomes use the handle.
+    ///
+    /// ```no_run
+    /// # async fn invoke(provider: &rustack_lambda_core::provider::RustackLambda)
+    /// # -> Result<(), Box<dyn std::error::Error>> {
+    /// let handle = provider.start_invocation("worker", None, b"{}", None).await?;
+    /// let result = handle.wait().await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn start_invocation(
+        &self,
+        function_ref: &str,
+        qualifier: Option<&str>,
+        payload: &[u8],
+        deadline: Option<Instant>,
+    ) -> Result<InvocationHandle, LambdaServiceError> {
+        validate_invoke_payload(payload, MAX_SYNC_PAYLOAD)?;
+        let (record, qualifier) = self.resolve_invocation(function_ref, qualifier)?;
+        self.admit_invocation(
+            &record,
+            qualifier.as_deref(),
+            payload,
+            false,
+            deadline,
+            false,
+        )
+        .await
+    }
 
-    /// Invoke a function.
+    /// Capture and queue an invocation, returning ownership before admission waits.
     ///
-    /// Resolves the target version, validates the payload size, then routes
-    /// to the configured [`Executor`]. `DryRun` short-circuits before the
-    /// executor is touched. `Event` returns immediately with a synthetic
-    /// request id only after a slot in the bounded, supervised work set is acquired.
-    pub async fn invoke(
+    /// An error means no call was queued. After success, retain the submission or
+    /// its handle through cleanup even if `admitted()` fails or the caller stops.
+    /// External cancellation is checked across capture, queueing and execution.
+    ///
+    /// # Errors
+    /// Rejects invalid input/scope/revision, capture failure, cancellation or full queue.
+    ///
+    /// ```no_run
+    /// # async fn begin(provider:&rustack_lambda_core::provider::RustackLambda,signal:tokio::sync::watch::Receiver<bool>) -> Result<(),Box<dyn std::error::Error>> {
+    /// let mut submission=provider.start_invocation_owned("worker",None,b"{}",None,signal).await?;
+    /// let admitted=submission.admitted().await;
+    /// let handle=submission.into_handle();
+    /// # Ok(()) }
+    /// ```
+    pub async fn start_invocation_owned(
         &self,
         function_ref: &str,
         qualifier: Option<&str>,
         payload: &[u8],
-        invocation_type: InvokeKind,
-    ) -> Result<InvokeOutcome, LambdaServiceError> {
-        // Validate synchronous payload size (Appendix C: 6 MB).
-        let payload_limit = if invocation_type == InvokeKind::Event {
-            1024 * 1024
-        } else {
-            MAX_SYNC_PAYLOAD
-        };
-        if payload.len() > payload_limit {
-            let payload_len = payload.len();
-            return Err(LambdaServiceError::RequestTooLarge {
-                message: format!(
-                    "Request payload size {payload_len} exceeds the invoke limit of \
-                     {payload_limit} bytes",
-                ),
-            });
-        }
+        deadline: Option<Instant>,
+        cancellation: watch::Receiver<bool>,
+    ) -> Result<InvocationSubmission, LambdaServiceError> {
+        validate_invoke_payload(payload, MAX_SYNC_PAYLOAD)?;
+        check_external_cancellation(Some(&cancellation))?;
+        let (record, qualifier) = self.resolve_invocation(function_ref, qualifier)?;
+        self.prepare_invocation(
+            &record,
+            qualifier.as_deref(),
+            payload,
+            InvocationOptions {
+                asynchronous: false,
+                deadline,
+                capture_logs: false,
+                cancellation: Some(cancellation),
+            },
+        )
+        .await
+    }
 
-        let (name, ref_qualifier) = resolve_function_ref(function_ref)?;
-        let qualifier = qualifier.or(ref_qualifier.as_deref());
-        if let Some(q) = qualifier {
-            crate::resolver::Qualifier::parse(q)?;
+    fn resolve_invocation(
+        &self,
+        reference: &str,
+        qualifier: Option<&str>,
+    ) -> Result<(FunctionRecord, Option<String>), LambdaServiceError> {
+        if reference
+            .split_once(':')
+            .is_some_and(|(account, resource)| {
+                account.len() == 12
+                    && account.bytes().all(|b| b.is_ascii_digit())
+                    && resource.starts_with("function:")
+                    && account != self.config.account_id
+            })
+        {
+            return Err(invalid_parameter(
+                "Invocation partial ARN does not match this Lambda scope",
+            ));
         }
-
-        // Validate function exists and qualifier resolves.
-        let record = self.get_record(&name)?;
-        let version = resolve_version(&record, qualifier)?;
-
-        if invocation_type == InvokeKind::DryRun {
-            return Ok(InvokeOutcome::DryRun);
+        let (name, embedded) = resolve_function_ref(reference)?;
+        if qualifier
+            .zip(embedded.as_deref())
+            .is_some_and(|(explicit, embedded)| explicit != embedded)
+        {
+            return Err(invalid_parameter("Conflicting invocation qualifiers"));
         }
-
-        if self.config.executor == ExecutorBackend::Docker {
-            return Err(LambdaServiceError::Internal {
-                message: "Docker execution is not implemented in this build".into(),
-            });
+        let qualifier = qualifier.map(str::to_owned).or(embedded.clone());
+        if let Some(qualifier) = &qualifier {
+            crate::resolver::Qualifier::parse(qualifier)?;
         }
-        self.store.validate_root().await?;
-        if let Some(path) = &version.code_path {
-            self.store.validate_artifact(path).await?;
+        let record = self.get_record(&name)?;
+        if reference.starts_with("arn:") {
+            let expected = embedded.as_ref().map_or_else(
+                || record.arn.clone(),
+                |qualifier| format!("{}:{qualifier}", record.arn),
+            );
+            if reference != expected {
+                return Err(invalid_parameter(
+                    "Invocation ARN does not match this Lambda scope",
+                ));
+            }
         }
-        let req = self.build_invoke_request(&record, version, payload);
+        Ok((record, qualifier))
+    }
 
-        let (response, handle) = self
-            .work
-            .submit(
-                Arc::clone(&self.executor),
-                req,
-                record.reserved_concurrent_executions,
-                invocation_type == InvokeKind::Event,
+    async fn admit_invocation(
+        &self,
+        record: &FunctionRecord,
+        qualifier: Option<&str>,
+        payload: &[u8],
+        asynchronous: bool,
+        deadline: Option<Instant>,
+        capture_logs: bool,
+    ) -> Result<InvocationHandle, LambdaServiceError> {
+        let mut submission = self
+            .prepare_invocation(
+                record,
+                qualifier,
+                payload,
+                InvocationOptions {
+                    asynchronous,
+                    deadline,
+                    capture_logs,
+                    cancellation: None,
+                },
             )
             .await?;
-        if invocation_type == InvokeKind::Event {
-            return Ok(InvokeOutcome::Async {
-                request_id: uuid::Uuid::new_v4().to_string(),
-            });
-        }
-        let _cancel = crate::work::CancelOnDrop(handle);
-        let response = response
-            .await
-            .map_err(|error| LambdaServiceError::Internal {
-                message: format!("Lambda worker cancelled: {error}"),
-            })??;
-        Ok(InvokeOutcome::Sync(response))
+        submission.admitted().await?;
+        Ok(submission.into_handle())
+    }
+
+    async fn prepare_invocation(
+        &self,
+        record: &FunctionRecord,
+        qualifier: Option<&str>,
+        payload: &[u8],
+        options: InvocationOptions,
+    ) -> Result<InvocationSubmission, LambdaServiceError> {
+        let InvocationOptions {
+            asynchronous,
+            deadline,
+            capture_logs,
+            cancellation,
+        } = options;
+        check_external_cancellation(cancellation.as_ref())?;
+        let version = resolve_version(record, qualifier)?;
+        let capture = self.build_invoke_request(record, version, qualifier, payload);
+        let mut request = if let Some(deadline) = deadline {
+            timeout_at(deadline, capture).await.map_err(|_| {
+                LambdaServiceError::from(crate::executor::ExecutorError::DeadlineExceeded)
+            })??
+        } else {
+            capture.await?
+        };
+        request.capture_logs = capture_logs;
+        check_external_cancellation(cancellation.as_ref())?;
+        self.work.submit_owned(
+            Arc::clone(&self.executor),
+            request,
+            record.reserved_concurrent_executions,
+            asynchronous,
+            deadline,
+            cancellation,
+        )
     }
 
     /// Build the executor request from a resolved function/version record.
-    fn build_invoke_request(
+    async fn build_invoke_request(
         &self,
         record: &FunctionRecord,
         version: &VersionRecord,
+        invoked_qualifier: Option<&str>,
         payload: &[u8],
-    ) -> InvokeRequest {
-        let function_arn = if version.version == "$LATEST" {
-            record.arn.clone()
-        } else {
-            function_version_arn(
-                &self.config.default_region,
-                &self.config.account_id,
-                &record.name,
-                &version.version,
-            )
+    ) -> Result<InvokeRequest, LambdaServiceError> {
+        let architecture = validate_execution_settings(version)?;
+        if version.deployment.state() != "Active" {
+            return Err(LambdaServiceError::ResourceNotReady {
+                message: "Function revision is not Active".into(),
+            });
+        }
+        let artifact = match version.package_type.as_str() {
+            "Zip" => {
+                let path = version
+                    .code_path
+                    .as_ref()
+                    .ok_or_else(|| invalid_parameter("ZIP code has not been staged"))?;
+                let artifact = self.store.capture_artifact(path).await?;
+                if artifact.sha256() != version.code_sha256
+                    || artifact.zip_bytes().len() as u64 != version.code_size
+                {
+                    return Err(invalid_parameter(
+                        "Captured ZIP metadata does not match the revision",
+                    ));
+                }
+                DeploymentArtifact::Zip(artifact)
+            }
+            "Image" => {
+                let image = version.image.resolved().ok_or_else(|| {
+                    LambdaServiceError::ResourceNotReady {
+                        message: "Image deployment has not been resolved".into(),
+                    }
+                })?;
+                if image.metadata().architecture != architecture
+                    || version.image_uri.as_deref()
+                        != Some(image.metadata().requested_reference.as_str())
+                    || version.runtime.is_some()
+                    || version.handler.is_some()
+                {
+                    return Err(invalid_parameter(
+                        "Image metadata does not match the captured revision",
+                    ));
+                }
+                image
+                    .metadata()
+                    .execution
+                    .plan(version.image_config.as_ref())
+                    .map_err(|_| {
+                        invalid_parameter("Invalid effective image entry configuration")
+                    })?;
+                let lease = version
+                    .image
+                    .pinned()
+                    .filter(|image| image.is_live())
+                    .ok_or_else(|| LambdaServiceError::ResourceNotReady {
+                        message: "Image availability has not been acquired".into(),
+                    })?;
+                DeploymentArtifact::Image(lease.clone())
+            }
+            _ => return Err(invalid_parameter("Unsupported deployment package type")),
         };
+        let function_arn = invoked_qualifier.map_or_else(
+            || record.arn.clone(),
+            |qualifier| format!("{}:{qualifier}", record.arn),
+        );
         let mut env = version.environment.clone();
         // Always make the rustack region/account visible inside the runtime so
         // SDK calls back to the same rustack instance work without extra setup.
@@ -982,23 +1713,27 @@ impl RustackLambda {
             .or_insert_with(|| self.config.default_region.clone());
         env.entry("AWS_DEFAULT_REGION".to_owned())
             .or_insert_with(|| self.config.default_region.clone());
-        InvokeRequest {
+        let revision = ExecutionRevision::builder()
+            .resource_id(record.resource_id)
+            .revision_id(version.revision_id.clone())
+            .image_config(version.image_config.clone())
+            .ephemeral_storage_mb(version.ephemeral_storage_size)
+            .function_name(record.name.clone())
+            .qualifier(version.version.clone())
+            .runtime(version.runtime.clone())
+            .handler(version.handler.clone())
+            .architecture(architecture)
+            .artifact(artifact)
+            .environment(env)
+            .timeout(Duration::from_secs(u64::from(version.timeout)))
+            .memory_mb(version.memory_size)
+            .backend(self.config.executor)
+            .build();
+        Ok(InvokeRequest::new(
+            Arc::new(revision),
             function_arn,
-            function_name: record.name.clone(),
-            qualifier: version.version.clone(),
-            runtime: version.runtime.clone(),
-            handler: version.handler.clone(),
-            architectures: version.architectures.clone(),
-            package_type: PackageType::from_wire(&version.package_type),
-            code_root: version.code_path.clone(),
-            code_zip: version.zip_bytes.clone(),
-            image_uri: version.image_uri.clone(),
-            environment: env,
-            timeout: Duration::from_secs(u64::from(version.timeout)),
-            memory_mb: version.memory_size,
-            payload: Bytes::copy_from_slice(payload),
-            capture_logs: false,
-        }
+            Bytes::copy_from_slice(payload),
+        ))
     }
 
     // ---------------------------------------------------------------
@@ -1006,6 +1741,11 @@ impl RustackLambda {
     // ---------------------------------------------------------------
 
     /// Publish a version from `$LATEST`.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references, missing functions, stale revision/hash preconditions,
+    /// unsuccessful deployments, unavailable image leases or invalid stored publication settings.
     pub fn publish_version(
         &self,
         function_ref: &str,
@@ -1013,7 +1753,31 @@ impl RustackLambda {
     ) -> Result<FunctionConfiguration, LambdaServiceError> {
         let (name, _) = resolve_function_ref(function_ref)?;
 
-        let config = self.store.update(&name, |record| {
+        let config = self.store.try_update_if_revision(&name, None, |record| {
+            check_revision(input.revision_id.as_deref(), &record.latest.revision_id)?;
+            if record.latest.deployment != DeploymentState::Ready {
+                return Err(LambdaServiceError::ResourceConflict {
+                    message: "Function deployment must be successful before publication".into(),
+                });
+            }
+            if record.latest.package_type == "Image"
+                && record
+                    .latest
+                    .image
+                    .pinned()
+                    .is_none_or(|image| !image.is_live())
+            {
+                return Err(LambdaServiceError::ResourceNotReady {
+                    message: "Image availability must be acquired before publication".into(),
+                });
+            }
+            if input
+                .code_sha256
+                .as_ref()
+                .is_some_and(|hash| hash != &record.latest.code_sha256)
+            {
+                return Err(LambdaServiceError::PreconditionFailed);
+            }
             let version_num = record.next_version;
             record.next_version += 1;
 
@@ -1027,7 +1791,7 @@ impl RustackLambda {
 
             let config = self.build_function_configuration(record, &published);
             record.versions.insert(version_num, published);
-            config
+            Ok(config)
         })?;
 
         info!(function_name = %name, "published Lambda function version");
@@ -1035,6 +1799,10 @@ impl RustackLambda {
     }
 
     /// List versions of a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references and missing functions.
     pub fn list_versions_by_function(
         &self,
         function_ref: &str,
@@ -1076,6 +1844,11 @@ impl RustackLambda {
     }
 
     /// Create an alias.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references, missing functions, duplicate aliases, invalid target versions
+    /// or targets that do not exist; invalid resulting store records also reject.
     pub fn create_alias(
         &self,
         function_ref: &str,
@@ -1145,6 +1918,10 @@ impl RustackLambda {
     }
 
     /// Get an alias.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references, missing functions and missing aliases.
     pub fn get_alias(
         &self,
         function_ref: &str,
@@ -1188,6 +1965,11 @@ impl RustackLambda {
     }
 
     /// Update an alias.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references, missing functions/aliases, invalid target versions
+    /// or targets that do not exist; invalid resulting store records also reject.
     pub fn update_alias(
         &self,
         function_ref: &str,
@@ -1263,6 +2045,10 @@ impl RustackLambda {
     }
 
     /// Delete an alias.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references, missing functions and missing aliases.
     pub fn delete_alias(
         &self,
         function_ref: &str,
@@ -1284,6 +2070,10 @@ impl RustackLambda {
     }
 
     /// List aliases for a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references and missing functions.
     pub fn list_aliases(
         &self,
         function_ref: &str,
@@ -1348,6 +2138,11 @@ impl RustackLambda {
     // ---------------------------------------------------------------
 
     /// Add a permission to a function's resource policy.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions, missing required permission
+    /// fields or duplicate statement IDs; store validation failures also propagate.
     pub fn add_permission(
         &self,
         function_ref: &str,
@@ -1424,6 +2219,10 @@ impl RustackLambda {
     }
 
     /// Remove a permission from a function's resource policy.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions and absent statement IDs.
     pub fn remove_permission(
         &self,
         function_ref: &str,
@@ -1451,6 +2250,10 @@ impl RustackLambda {
     }
 
     /// Get the resource policy for a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions and empty resource policies.
     pub fn get_policy(
         &self,
         function_ref: &str,
@@ -1496,6 +2299,11 @@ impl RustackLambda {
     }
 
     /// Tag a resource.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed resource references, missing functions, a merged tag count above50,
+    /// or resulting records that fail store validation.
     pub fn tag_resource(
         &self,
         resource_arn: &str,
@@ -1524,6 +2332,10 @@ impl RustackLambda {
     }
 
     /// Remove tags from a resource.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed resource references, missing functions and store validation failures.
     pub fn untag_resource(
         &self,
         resource_arn: &str,
@@ -1541,6 +2353,10 @@ impl RustackLambda {
     }
 
     /// List tags for a resource.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed resource references and missing functions.
     pub fn list_tags(&self, resource_arn: &str) -> Result<ListTagsOutput, LambdaServiceError> {
         let name = Self::extract_function_name_from_arn(resource_arn)?;
         let record = self.get_record(&name)?;
@@ -1580,6 +2396,11 @@ impl RustackLambda {
     // ---------------------------------------------------------------
 
     /// Create a function URL configuration.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions, duplicate URL configurations
+    /// or resulting records that fail store validation.
     pub fn create_function_url_config(
         &self,
         function_ref: &str,
@@ -1647,6 +2468,10 @@ impl RustackLambda {
     }
 
     /// Get function URL configuration.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions and absent URL configurations.
     pub fn get_function_url_config(
         &self,
         function_ref: &str,
@@ -1682,6 +2507,11 @@ impl RustackLambda {
     }
 
     /// Update function URL configuration.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions, absent URL configurations
+    /// or resulting records that fail store validation.
     pub fn update_function_url_config(
         &self,
         function_ref: &str,
@@ -1735,6 +2565,10 @@ impl RustackLambda {
     }
 
     /// Delete function URL configuration.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions and absent URL configurations.
     pub fn delete_function_url_config(
         &self,
         function_ref: &str,
@@ -1761,6 +2595,10 @@ impl RustackLambda {
     }
 
     /// List function URL configurations.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references and missing functions.
     pub fn list_function_url_configs(
         &self,
         function_ref: &str,
@@ -1795,6 +2633,11 @@ impl RustackLambda {
     // ---------------------------------------------------------------
 
     /// Publish a new layer version.
+    ///
+    /// # Errors
+    ///
+    /// Rejects empty/oversized layer names, oversized license text, invalid inline base64,
+    /// or a layer version that disappears before its assigned metadata is updated.
     pub fn publish_layer_version(
         &self,
         layer_name: &str,
@@ -1894,6 +2737,10 @@ impl RustackLambda {
     }
 
     /// Get a specific layer version.
+    ///
+    /// # Errors
+    ///
+    /// Returns `InvalidParameter` when the requested layer version does not exist.
     pub fn get_layer_version(
         &self,
         layer_name: &str,
@@ -1910,6 +2757,10 @@ impl RustackLambda {
     }
 
     /// Get a layer version by its full ARN.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed layer-version ARNs and missing layer versions.
     pub fn get_layer_version_by_arn(
         &self,
         arn: &str,
@@ -1919,6 +2770,10 @@ impl RustackLambda {
     }
 
     /// List versions of a layer.
+    ///
+    /// # Errors
+    ///
+    /// This implementation returns no errors; an unknown layer produces an empty page.
     pub fn list_layer_versions(
         &self,
         layer_name: &str,
@@ -2036,6 +2891,10 @@ impl RustackLambda {
     }
 
     /// Delete a layer version.
+    ///
+    /// # Errors
+    ///
+    /// This implementation returns no errors; deleting an absent version succeeds.
     pub fn delete_layer_version(
         &self,
         layer_name: &str,
@@ -2048,6 +2907,10 @@ impl RustackLambda {
     }
 
     /// Add a permission to a layer version's resource policy.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing required fields, duplicate statement IDs or missing layer versions.
     pub fn add_layer_version_permission(
         &self,
         layer_name: &str,
@@ -2125,6 +2988,10 @@ impl RustackLambda {
     }
 
     /// Get the resource policy for a layer version.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing layer versions and empty layer resource policies.
     pub fn get_layer_version_policy(
         &self,
         layer_name: &str,
@@ -2171,6 +3038,10 @@ impl RustackLambda {
     }
 
     /// Remove a permission from a layer version's resource policy.
+    ///
+    /// # Errors
+    ///
+    /// Rejects missing layer versions and absent statement IDs.
     pub fn remove_layer_version_permission(
         &self,
         layer_name: &str,
@@ -2474,6 +3345,10 @@ impl RustackLambda {
     // -----------------------------------------------------------------
 
     /// Put (set) reserved concurrency for a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references, missing functions and store validation failures.
     pub fn put_function_concurrency(
         &self,
         function_ref: &str,
@@ -2492,6 +3367,10 @@ impl RustackLambda {
     }
 
     /// Get reserved concurrency for a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references and missing functions.
     pub fn get_function_concurrency(
         &self,
         function_ref: &str,
@@ -2504,6 +3383,10 @@ impl RustackLambda {
     }
 
     /// Delete reserved concurrency for a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references, missing functions and store validation failures.
     pub fn delete_function_concurrency(
         &self,
         function_ref: &str,
@@ -2521,6 +3404,10 @@ impl RustackLambda {
     // -----------------------------------------------------------------
 
     /// Put (create/replace) an event invoke config for a function qualifier.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions and store validation failures.
     pub fn put_function_event_invoke_config(
         &self,
         function_ref: &str,
@@ -2555,6 +3442,11 @@ impl RustackLambda {
     }
 
     /// Get an event invoke config for a function qualifier.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions and absent event invoke
+    /// configurations.
     pub fn get_function_event_invoke_config(
         &self,
         function_ref: &str,
@@ -2578,6 +3470,11 @@ impl RustackLambda {
     }
 
     /// Update (merge) an event invoke config for a function qualifier.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions or resulting records
+    /// that fail store validation. An absent configuration is created before merging.
     pub fn update_function_event_invoke_config(
         &self,
         function_ref: &str,
@@ -2623,6 +3520,11 @@ impl RustackLambda {
     }
 
     /// Delete an event invoke config for a function qualifier.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed references/qualifiers, missing functions and store validation failures.
+    /// Deleting an absent event invoke configuration succeeds.
     pub fn delete_function_event_invoke_config(
         &self,
         function_ref: &str,
@@ -2640,6 +3542,10 @@ impl RustackLambda {
     }
 
     /// List all event invoke configs for a function.
+    ///
+    /// # Errors
+    ///
+    /// Rejects malformed function references and missing functions.
     pub fn list_function_event_invoke_configs(
         &self,
         function_ref: &str,
@@ -2684,73 +3590,108 @@ impl RustackLambda {
     /// S3 packages are downloaded through the configured [`S3CodeFetcher`] and
     /// stored via the same path as inline `ZipFile`, so downstream validation,
     /// checksum computation, and executor behavior are identical.
-    async fn process_code(
+    fn validate_docker_zip_settings(
+        &self,
+        runtime: Option<&str>,
+        handler: Option<&str>,
+        architecture: Architecture,
+    ) -> Result<(), LambdaServiceError> {
+        if self.config.executor != ExecutorBackend::Docker {
+            return Ok(());
+        }
+        validate_provided_settings(runtime, handler)?;
+        self.executor
+            .zip_available(architecture)
+            .map_err(|error| match error {
+                ExecutorError::Unsupported(_) => {
+                    invalid_parameter("Docker ZIP source or architecture is unavailable")
+                }
+                other => other.into(),
+            })
+    }
+
+    async fn validate_docker_zip_candidate(
         &self,
+        code: &ProcessedCode<'_>,
+        architecture: Architecture,
+    ) -> Result<(), LambdaServiceError> {
+        if self.config.executor != ExecutorBackend::Docker {
+            return Ok(());
+        }
+        let ProcessedCode::Zip(staged) = code else {
+            return Ok(());
+        };
+        #[cfg(unix)]
+        {
+            DockerCodeArchive::prepare(
+                staged.artifact().clone(),
+                architecture,
+                Instant::now() + CODE_FETCH_TIMEOUT,
+            )
+            .await
+            .map(drop)
+            .map_err(|error| match error {
+                DockerError::InvalidCode | DockerError::TooLarge | DockerError::Image(_) => {
+                    LambdaServiceError::InvalidZipFile {
+                        message: "Unsupported provided.al2023 ZIP artifact".into(),
+                    }
+                }
+                DockerError::Busy => LambdaServiceError::TooManyRequests,
+                DockerError::Deadline => LambdaServiceError::ResourceNotReady {
+                    message: "Docker ZIP validation deadline exceeded".into(),
+                },
+                _ => LambdaServiceError::DockerNotAvailable,
+            })
+        }
+        #[cfg(not(unix))]
+        {
+            let _ = (staged, architecture);
+            Err(LambdaServiceError::DockerNotAvailable)
+        }
+    }
+
+    async fn process_code<'a>(
+        &'a self,
         function_name: &str,
         version: &str,
         source: CodeSource<'_>,
-    ) -> Result<
-        (
-            String,
-            u64,
-            Option<Bytes>,
-            Option<std::path::PathBuf>,
-            Option<String>,
-        ),
-        LambdaServiceError,
-    > {
-        if let Some(b64) = source.zip_file_b64 {
+    ) -> Result<ProcessedCode<'a>, LambdaServiceError> {
+        let zip_bytes = if let Some(b64) = source.zip_file_b64 {
             use base64::Engine;
-            let zip_bytes = base64::engine::general_purpose::STANDARD
-                .decode(b64)
-                .map_err(|e| LambdaServiceError::InvalidZipFile {
-                    message: format!("Invalid base64 encoding: {e}"),
-                })?;
-            // Fail fast on oversized packages before any storage or
-            // extraction happens.
-            check_code_size(zip_bytes.len())?;
-
-            let (code_path, sha256, size) = self
-                .store
-                .store_zip_code(function_name, version, &zip_bytes)
-                .await?;
-
-            Ok((
-                sha256,
-                size,
-                Some(Bytes::from(zip_bytes)),
-                Some(code_path),
-                None,
-            ))
+            Bytes::from(
+                base64::engine::general_purpose::STANDARD
+                    .decode(b64)
+                    .map_err(|error| LambdaServiceError::InvalidZipFile {
+                        message: format!("Invalid base64 encoding: {error}"),
+                    })?,
+            )
         } else if let Some(bucket) = source.s3_bucket {
-            let key = source
-                .s3_key
-                .ok_or_else(|| LambdaServiceError::InvalidParameter {
-                    message: "Code.S3Key is required when Code.S3Bucket is provided".to_owned(),
-                })?;
-            let zip_bytes = self
-                .code_fetcher
-                .fetch_code(bucket, key, source.s3_object_version)
-                .await
-                .map_err(map_s3_code_fetch_error)?;
-            // Fail fast on oversized packages before any storage or
-            // extraction happens.
-            check_code_size(zip_bytes.len())?;
-
-            let (code_path, sha256, size) = self
-                .store
-                .store_zip_code(function_name, version, &zip_bytes)
-                .await?;
-
-            Ok((sha256, size, Some(zip_bytes), Some(code_path), None))
-        } else if let Some(uri) = source.image_uri {
-            let sha256 = compute_sha256(uri.as_bytes());
-            Ok((sha256, 0, None, None, Some(uri.to_owned())))
+            let key = source.s3_key.ok_or_else(|| {
+                invalid_parameter("Code.S3Key is required when Code.S3Bucket is provided")
+            })?;
+            tokio::time::timeout(
+                CODE_FETCH_TIMEOUT,
+                self.code_fetcher
+                    .fetch_code(bucket, key, source.s3_object_version),
+            )
+            .await
+            .map_err(|_| LambdaServiceError::ResourceNotReady {
+                message: "Code source fetch deadline exceeded".into(),
+            })?
+            .map_err(map_s3_code_fetch_error)?
+        } else if let Some(reference) = source.image_uri {
+            return reference
+                .parse()
+                .map(ProcessedCode::Image)
+                .map_err(|_| invalid_parameter("Invalid ImageUri"));
         } else {
-            // No code provided - use empty hash.
-            let sha256 = compute_sha256(b"");
-            Ok((sha256, 0, None, None, None))
-        }
+            return Err(invalid_parameter("Deployment code is required"));
+        };
+        check_code_size(zip_bytes.len())?;
+        self.store
+            .stage_zip_code(function_name, version, &zip_bytes)
+            .await
+            .map(ProcessedCode::Zip)
     }
 
     /// Build a `FunctionConfiguration` from internal records.
@@ -2819,6 +3760,7 @@ impl RustackLambda {
             optimization_status: Some("Off".to_owned()),
         });
 
+        let state_failure = version.deployment.creation_failure();
         FunctionConfiguration {
             function_name: Some(record.name.clone()),
             function_arn: Some(arn),
@@ -2835,7 +3777,7 @@ impl RustackLambda {
             timeout: Some(version.timeout),
             memory_size: Some(version.memory_size),
             last_modified: Some(version.last_modified.clone()),
-            code_sha256: Some(version.code_sha256.clone()),
+            code_sha256: (!version.code_sha256.is_empty()).then(|| version.code_sha256.clone()),
             version: Some(version.version.clone()),
             environment: env_response,
             vpc_config: vpc_response,
@@ -2843,9 +3785,9 @@ impl RustackLambda {
             tracing_config: tracing_response,
             revision_id: Some(version.revision_id.clone()),
             layers,
-            state: Some(version.state.clone()),
-            state_reason: None,
-            state_reason_code: None,
+            state: Some(version.deployment.state().into()),
+            state_reason: state_failure.map(|failure| failure.reason().into()),
+            state_reason_code: state_failure.map(|failure| failure.code().into()),
             package_type: Some(version.package_type.clone()),
             architectures: Some(version.architectures.clone()),
             ephemeral_storage: Some(EphemeralStorage {
@@ -2854,9 +3796,15 @@ impl RustackLambda {
             logging_config: version.logging_config.clone(),
             snap_start: snap_start_response,
             image_config_response,
-            last_update_status: Some("Successful".to_owned()),
-            last_update_status_reason: None,
-            last_update_status_reason_code: None,
+            last_update_status: Some(version.deployment.update_status().into()),
+            last_update_status_reason: version
+                .deployment
+                .failure()
+                .map(|failure| failure.reason().into()),
+            last_update_status_reason_code: version
+                .deployment
+                .failure()
+                .map(|failure| failure.code().into()),
         }
     }
 
@@ -2872,8 +3820,144 @@ impl RustackLambda {
     }
 }
 
-/// Get current time in ISO 8601 format matching AWS Lambda conventions.
-fn now_iso8601() -> String {
+/// Reject publication before asynchronous image preparation can begin.
+fn validate_code_update(
+    before: &FunctionRecord,
+    input: &UpdateFunctionCodeInput,
+    code_source: CodeSource<'_>,
+) -> Result<Architecture, LambdaServiceError> {
+    // Validate that some code source is provided.
+    if code_source.zip_file_b64.is_none()
+        && code_source.image_uri.is_none()
+        && code_source.s3_bucket.is_none()
+    {
+        return Err(LambdaServiceError::InvalidParameter {
+            message: "Provide at least one of ZipFile, S3Bucket, or ImageUri.".to_owned(),
+        });
+    }
+
+    check_revision(input.revision_id.as_deref(), &before.latest.revision_id)?;
+    before.latest.deployment.ensure_mutable()?;
+    validate_image_publication(&before.latest.package_type, input.publish.unwrap_or(false))?;
+    if (before.latest.package_type == "Zip" && code_source.image_uri.is_some())
+        || (before.latest.package_type == "Image" && code_source.image_uri.is_none())
+    {
+        return Err(invalid_parameter("Deployment package type cannot change"));
+    }
+    if input.architectures.as_ref().is_some_and(|architectures| {
+        architectures.len() != 1
+            || architectures
+                .iter()
+                .any(|architecture| architecture != "arm64" && architecture != "x86_64")
+    }) {
+        return Err(invalid_parameter(
+            "Exactly one supported architecture is required",
+        ));
+    }
+    match input
+        .architectures
+        .as_ref()
+        .and_then(|values| values.first())
+    {
+        Some(value) => value
+            .parse()
+            .map_err(|_| invalid_parameter("Invalid architecture")),
+        None => validate_execution_settings(&before.latest),
+    }
+}
+
+fn mutable_function_name(reference: &str) -> Result<String, LambdaServiceError> {
+    let (name, qualifier) = resolve_function_ref(reference)?;
+    if qualifier.as_deref().is_some_and(|value| value != "$LATEST") {
+        return Err(invalid_parameter(
+            "Only the unpublished function configuration can be updated",
+        ));
+    }
+    Ok(name)
+}
+
+fn check_staged_revision(
+    record: &FunctionRecord,
+    before: &FunctionRecord,
+) -> Result<(), LambdaServiceError> {
+    if record.resource_id != before.resource_id
+        || record.latest.revision_id != before.latest.revision_id
+    {
+        return Err(LambdaServiceError::ResourceConflict {
+            message: "Function changed while deployment was staged".into(),
+        });
+    }
+    Ok(())
+}
+
+fn validate_image_publication(package_type: &str, publish: bool) -> Result<(), LambdaServiceError> {
+    if package_type == "Image" && publish {
+        return Err(invalid_parameter(
+            "Image deployment requires a separate PublishVersion after successful preparation",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_configuration_update(
+    input: &UpdateFunctionConfigurationInput,
+) -> Result<(), LambdaServiceError> {
+    // Validate handler length (Appendix C: max 128 chars).
+    if let Some(ref handler) = input.handler {
+        if handler.len() > 128 {
+            return Err(LambdaServiceError::InvalidParameter {
+                message: "Handler must be at most 128 characters".to_owned(),
+            });
+        }
+    }
+    // Validate description length (Appendix C: max 256 chars).
+    if let Some(ref desc) = input.description {
+        if desc.len() > 256 {
+            return Err(LambdaServiceError::InvalidParameter {
+                message: "Description must be at most 256 characters".to_owned(),
+            });
+        }
+    }
+    // Validate timeout (Appendix C: 1-900 seconds).
+    if let Some(timeout) = input.timeout {
+        if !(1..=900).contains(&timeout) {
+            return Err(LambdaServiceError::InvalidParameter {
+                message: "Timeout must be between 1 and 900 seconds".to_owned(),
+            });
+        }
+    }
+    // Validate memory size (Appendix C: 128-10240 MB).
+    if let Some(memory) = input.memory_size {
+        if !(128..=10_240).contains(&memory) {
+            return Err(LambdaServiceError::InvalidParameter {
+                message: "Memory size must be between 128 and 10240 MB".to_owned(),
+            });
+        }
+    }
+    // Validate ephemeral storage (Appendix C: 512-10240 MB).
+    if let Some(ref ephemeral) = input.ephemeral_storage {
+        if !(512..=10_240).contains(&ephemeral.size) {
+            return Err(LambdaServiceError::InvalidParameter {
+                message: "Ephemeral storage must be between 512 and 10240 MB".to_owned(),
+            });
+        }
+    }
+    // Validate environment variables total size (Appendix C: 4 KB).
+    if let Some(ref env) = input.environment {
+        if let Some(ref vars) = env.variables {
+            let total_size: usize = vars.iter().map(|(k, v)| k.len() + v.len()).sum();
+            if total_size > 4096 {
+                return Err(LambdaServiceError::InvalidParameter {
+                    message: "Environment variables total size exceeds 4 KB limit".to_owned(),
+                });
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Get current time as an ISO 8601 string in AWS Lambda format.
+pub(crate) fn now_iso8601() -> String {
     chrono::Utc::now()
         .format("%Y-%m-%dT%H:%M:%S%.3f+0000")
         .to_string()
@@ -2967,7 +4051,7 @@ fn validate_code_source(source: &CodeSource<'_>) -> Result<(), LambdaServiceErro
 /// storage or extraction happens, so oversized packages fail fast instead
 /// of materializing onto disk.
 fn check_code_size(size_bytes: usize) -> Result<(), LambdaServiceError> {
-    if size_bytes as u64 > MAX_ZIP_SIZE {
+    if size_bytes > MAX_ZIP_SIZE {
         return Err(LambdaServiceError::InvalidParameter {
             message: format!("Unzipped size must be smaller than {MAX_ZIP_SIZE} bytes"),
         });
@@ -2989,6 +4073,15 @@ fn validate_s3_field(name: &str, value: &str, max_bytes: usize) -> Result<(), La
 }
 
 /// Build an `InvalidParameter` service error.
+fn validate_invoke_payload(payload: &[u8], limit: usize) -> Result<(), LambdaServiceError> {
+    if payload.len() > limit {
+        return Err(LambdaServiceError::RequestTooLarge {
+            message: format!("Invocation payload exceeds {limit} bytes"),
+        });
+    }
+    Ok(())
+}
+
 fn invalid_parameter(message: &str) -> LambdaServiceError {
     LambdaServiceError::InvalidParameter {
         message: message.to_owned(),
@@ -3024,6 +4117,134 @@ fn map_s3_code_fetch_error(err: S3CodeFetchError) -> LambdaServiceError {
 mod tests {
     use super::*;
 
+    #[derive(Debug)]
+    struct DelayedFetcher {
+        started: tokio::sync::Notify,
+        release: tokio::sync::Notify,
+    }
+
+    #[async_trait::async_trait]
+    impl S3CodeFetcher for DelayedFetcher {
+        async fn fetch_code(
+            &self,
+            _bucket: &str,
+            _key: &str,
+            _version: Option<&str>,
+        ) -> Result<Bytes, S3CodeFetchError> {
+            self.started.notify_one();
+            self.release.notified().await;
+            Ok(Bytes::from(crate::test_zip::minimal_zip(
+                b"conflicting-update",
+            )))
+        }
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn test_should_bound_a_stalled_code_fetch_without_creating_an_artifact()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let fetcher = Arc::new(DelayedFetcher {
+            started: tokio::sync::Notify::new(),
+            release: tokio::sync::Notify::new(),
+        });
+        let provider =
+            RustackLambda::with_store(FunctionStore::new(root.path()), LambdaConfig::default())
+                .with_code_fetcher(fetcher);
+        let started = Instant::now();
+        assert!(matches!(
+            provider
+                .create_function(s3_code_input("fetch-timeout"))
+                .await,
+            Err(LambdaServiceError::ResourceNotReady { .. })
+        ));
+        assert!(started.elapsed() >= CODE_FETCH_TIMEOUT);
+        assert!(provider.store.is_empty());
+        assert!(
+            tokio::fs::read_dir(root.path())
+                .await?
+                .next_entry()
+                .await?
+                .is_none()
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_rollback_staged_code_after_a_real_revision_compare_and_swap_conflict()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let fetcher = Arc::new(DelayedFetcher {
+            started: tokio::sync::Notify::new(),
+            release: tokio::sync::Notify::new(),
+        });
+        let provider = Arc::new(
+            RustackLambda::with_store(FunctionStore::new(root.path()), LambdaConfig::default())
+                .with_code_fetcher(fetcher.clone()),
+        );
+        provider
+            .create_function(sample_create_input("conflict"))
+            .await?;
+        let original = provider.get_record("conflict")?.latest;
+        let updating = Arc::clone(&provider);
+        let task = tokio::spawn(async move {
+            updating
+                .update_function_code(
+                    "conflict",
+                    UpdateFunctionCodeInput {
+                        s3_bucket: Some("code-bucket".into()),
+                        s3_key: Some("new.zip".into()),
+                        ..UpdateFunctionCodeInput::default()
+                    },
+                )
+                .await
+        });
+        let _cancel = crate::work::CancelOnDrop(task.abort_handle());
+        tokio::time::timeout(Duration::from_secs(5), fetcher.started.notified()).await?;
+        provider.update_function_configuration(
+            "conflict",
+            &UpdateFunctionConfigurationInput {
+                description: Some("newer configuration".into()),
+                ..UpdateFunctionConfigurationInput::default()
+            },
+        )?;
+        fetcher.release.notify_one();
+        let result = tokio::time::timeout(Duration::from_secs(5), task).await??;
+        assert!(matches!(
+            result,
+            Err(LambdaServiceError::ResourceConflict { .. })
+        ));
+        let current = provider.get_record("conflict")?.latest;
+        assert_eq!(current.code_sha256, original.code_sha256);
+        assert_eq!(current.code_path, original.code_path);
+        assert_eq!(current.description, "newer configuration");
+        let mut entries = tokio::fs::read_dir(root.path()).await?;
+        assert!(entries.next_entry().await?.is_some());
+        assert!(entries.next_entry().await?.is_none());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_validate_partial_invocation_account_before_local_resolution() {
+        let provider = test_provider();
+        provider
+            .create_function(sample_create_input("scoped"))
+            .await
+            .unwrap();
+        assert!(
+            provider
+                .resolve_invocation("000000000000:function:scoped", None)
+                .is_ok()
+        );
+        assert!(matches!(
+            provider.resolve_invocation("999999999999:function:scoped", None),
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert!(matches!(
+            provider.resolve_invocation("999999999999:function:scoped:1", None),
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+    }
+
     fn test_provider() -> RustackLambda {
         let tmp = tempfile::tempdir().unwrap();
         let store = FunctionStore::new(tmp.path());
@@ -3048,6 +4269,443 @@ mod tests {
         }
     }
 
+    async fn artifact_count(path: &std::path::Path) -> usize {
+        let mut entries = tokio::fs::read_dir(path).await.unwrap();
+        let mut count = 0usize;
+        while entries.next_entry().await.unwrap().is_some() {
+            count = count.saturating_add(1);
+        }
+        count
+    }
+
+    #[derive(Debug, Default)]
+    struct CountingFetcher(std::sync::atomic::AtomicUsize);
+    #[async_trait::async_trait]
+    impl S3CodeFetcher for CountingFetcher {
+        async fn fetch_code(
+            &self,
+            _: &str,
+            _: &str,
+            _: Option<&str>,
+        ) -> Result<Bytes, S3CodeFetchError> {
+            self.0.fetch_add(1, std::sync::atomic::Ordering::AcqRel);
+            Err(S3CodeFetchError::Internal(anyhow::anyhow!(
+                "unexpected fetch"
+            )))
+        }
+    }
+
+    #[tokio::test]
+    async fn test_should_validate_code_dry_run_without_staging_fetching_or_publishing() {
+        use base64::{Engine, engine::general_purpose::STANDARD};
+        let root = tempfile::tempdir().unwrap();
+        let fetcher = Arc::new(CountingFetcher::default());
+        let provider =
+            RustackLambda::with_store(FunctionStore::new(root.path()), LambdaConfig::default())
+                .with_code_fetcher(fetcher.clone());
+        provider
+            .create_function(sample_create_input("dry-update"))
+            .await
+            .unwrap();
+        let before = serde_json::to_value(provider.export_snapshot()).unwrap();
+        let count = artifact_count(root.path()).await;
+        for input in [
+            UpdateFunctionCodeInput {
+                zip_file: Some(STANDARD.encode(b"not an archive")),
+                dry_run: Some(true),
+                publish: Some(true),
+                ..Default::default()
+            },
+            UpdateFunctionCodeInput {
+                s3_bucket: Some("bucket".into()),
+                s3_key: Some("missing.zip".into()),
+                dry_run: Some(true),
+                ..Default::default()
+            },
+        ] {
+            let result = provider
+                .update_function_code("dry-update", input)
+                .await
+                .unwrap();
+            assert_eq!(result.version.as_deref(), Some("$LATEST"));
+        }
+        assert_eq!(
+            serde_json::to_value(provider.export_snapshot()).unwrap(),
+            before
+        );
+        assert_eq!(artifact_count(root.path()).await, count);
+        assert_eq!(fetcher.0.load(std::sync::atomic::Ordering::Acquire), 0);
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_invalid_or_qualified_code_dry_run_without_mutation() {
+        let provider = test_provider();
+        provider
+            .create_function(sample_create_input("dry-invalid"))
+            .await
+            .unwrap();
+        let before = serde_json::to_value(provider.export_snapshot()).unwrap();
+        for input in [
+            UpdateFunctionCodeInput {
+                zip_file: Some("AB==".into()),
+                dry_run: Some(true),
+                ..Default::default()
+            },
+            UpdateFunctionCodeInput {
+                zip_file: Some("AA==".into()),
+                dry_run: Some(true),
+                revision_id: Some("stale".into()),
+                ..Default::default()
+            },
+            UpdateFunctionCodeInput {
+                zip_file: Some("AA==".into()),
+                dry_run: Some(true),
+                architectures: Some(Vec::new()),
+                ..Default::default()
+            },
+        ] {
+            assert!(
+                provider
+                    .update_function_code("dry-invalid", input)
+                    .await
+                    .is_err()
+            );
+        }
+        for reference in ["dry-invalid:1", "dry-invalid:prod"] {
+            assert!(
+                provider
+                    .update_function_code(
+                        reference,
+                        UpdateFunctionCodeInput {
+                            zip_file: Some("AA==".into()),
+                            dry_run: Some(true),
+                            ..Default::default()
+                        }
+                    )
+                    .await
+                    .is_err()
+            );
+            assert!(
+                provider
+                    .update_function_configuration(
+                        reference,
+                        &UpdateFunctionConfigurationInput::default()
+                    )
+                    .is_err()
+            );
+        }
+        assert_eq!(
+            serde_json::to_value(provider.export_snapshot()).unwrap(),
+            before
+        );
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_invalid_settings_before_fetching_or_staging_code()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let provider =
+            RustackLambda::with_store(FunctionStore::new(root.path()), LambdaConfig::default());
+        let mut input = sample_create_input("invalid-env");
+        input.environment = Some(rustack_lambda_model::types::Environment {
+            variables: Some(HashMap::from([("AWS_REGION".into(), "us-east-1".into())])),
+        });
+        assert!(matches!(
+            provider.create_function(input).await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        let mut input = sample_create_input("invalid-image-config");
+        input.image_config = Some(rustack_lambda_model::types::ImageConfig::default());
+        assert!(matches!(
+            provider.create_function(input).await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        let mut input = s3_code_input("invalid-s3-settings");
+        input.timeout = Some(901);
+        // The default fetcher is unavailable; InvalidParameter proves it was not called.
+        assert!(matches!(
+            provider.create_function(input).await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert!(provider.store.is_empty());
+        assert!(
+            tokio::fs::read_dir(root.path())
+                .await?
+                .next_entry()
+                .await?
+                .is_none()
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_cross_scope_arns_and_conflicting_invocation_qualifiers()
+    -> Result<(), LambdaServiceError> {
+        let provider = test_provider();
+        provider
+            .create_function(sample_create_input("scoped"))
+            .await?;
+        let arn = provider.get_record("scoped")?.arn;
+        for reference in [
+            arn.replace("us-east-1", "us-west-2"),
+            arn.replace("000000000000", "111111111111"),
+            arn.replace("arn:aws:", "arn:aws-cn:"),
+        ] {
+            assert!(matches!(
+                provider
+                    .invoke(&reference, None, b"{}", InvokeKind::DryRun)
+                    .await,
+                Err(LambdaServiceError::InvalidParameter { .. })
+            ));
+        }
+        assert!(matches!(
+            provider
+                .invoke(
+                    &format!("{arn}:$LATEST"),
+                    Some("1"),
+                    b"{}",
+                    InvokeKind::DryRun
+                )
+                .await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert!(matches!(
+            provider
+                .invoke(
+                    &format!("{arn}:$LATEST"),
+                    Some("$LATEST"),
+                    b"{}",
+                    InvokeKind::DryRun
+                )
+                .await?,
+            InvokeOutcome::DryRun
+        ));
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_preserve_invoked_alias_separately_from_resolved_version()
+    -> Result<(), LambdaServiceError> {
+        let provider = test_provider();
+        provider
+            .create_function(sample_create_input("qualified"))
+            .await?;
+        provider.publish_version("qualified", &PublishVersionInput::default())?;
+        provider.create_alias(
+            "qualified",
+            CreateAliasInput {
+                name: "prod".into(),
+                function_version: "1".into(),
+                ..CreateAliasInput::default()
+            },
+        )?;
+        let record = provider.get_record("qualified")?;
+        for (qualifier, resolved) in [
+            (None, "$LATEST"),
+            (Some("$LATEST"), "$LATEST"),
+            (Some("prod"), "1"),
+            (Some("1"), "1"),
+        ] {
+            let version = resolve_version(&record, qualifier)?;
+            let request = provider
+                .build_invoke_request(&record, version, qualifier, b"{}")
+                .await?;
+            let expected_arn =
+                qualifier.map_or_else(|| record.arn.clone(), |q| format!("{}:{q}", record.arn));
+            assert_eq!(request.function_arn, expected_arn);
+            assert_eq!(request.revision.qualifier, resolved);
+            assert_eq!(request.revision.resource_id, record.resource_id);
+            assert_eq!(request.revision.revision_id, version.revision_id);
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_capture_image_overrides_and_ephemeral_storage_by_value()
+    -> Result<(), LambdaServiceError> {
+        let provider = test_provider();
+        provider
+            .create_function(sample_create_input("captured"))
+            .await?;
+        let record = provider.get_record("captured")?;
+        let mut version = record.latest.clone();
+        version.ephemeral_storage_size = 2048;
+        version.package_type = "Image".into();
+        version.runtime = None;
+        version.handler = None;
+        version.code_path = None;
+        version.zip_bytes = None;
+        let resolved = crate::artifact::ResolvedImage::fixture(Architecture::X86_64);
+        version.image_uri = Some(resolved.metadata().requested_reference.as_str().into());
+        version.code_sha256 = resolved
+            .code_sha256()
+            .map_err(|_| invalid_parameter("Invalid unit image hash"))?;
+        version.code_size = resolved.metadata().size_bytes;
+        version.image = ImageArtifact::Pinned(crate::artifact::PinnedImage::fixture(resolved));
+        version.image_config = Some(rustack_lambda_model::types::ImageConfig {
+            entry_point: Some(vec!["/custom/entrypoint".into()]),
+            command: Some(vec![]),
+            working_directory: Some("/function".into()),
+        });
+        let request = provider
+            .build_invoke_request(&record, &version, None, b"{\"value\":1}")
+            .await?;
+        version.ephemeral_storage_size = 4096;
+        version.image_config = None;
+        assert_eq!(request.revision.ephemeral_storage_mb, 2048);
+        let image = request
+            .revision
+            .image_config
+            .as_ref()
+            .ok_or_else(|| invalid_parameter("Image configuration was lost"))?;
+        assert_eq!(
+            image.entry_point.as_deref(),
+            Some(["/custom/entrypoint".to_owned()].as_slice())
+        );
+        assert_eq!(image.command.as_deref(), Some([].as_slice()));
+        assert_eq!(image.working_directory.as_deref(), Some("/function"));
+        assert_eq!(request.payload, Bytes::from_static(b"{\"value\":1}"));
+        assert_ne!(
+            request.revision.ephemeral_storage_mb,
+            version.ephemeral_storage_size
+        );
+        assert!(version.image_config.is_none());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_image_create_publication_before_inserting_a_resource() {
+        let provider = test_provider();
+        let mut input = sample_create_input("image-publish");
+        input.package_type = Some("Image".into());
+        input.runtime = None;
+        input.handler = None;
+        input.code = rustack_lambda_model::types::FunctionCode {
+            image_uri: Some("worker:v1".into()),
+            ..Default::default()
+        };
+        input.publish = Some(true);
+        assert!(matches!(
+            provider.create_function(input).await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert!(!provider.store.contains("image-publish").unwrap());
+    }
+
+    #[tokio::test]
+    async fn test_should_capture_and_retain_only_live_image_availability()
+    -> Result<(), LambdaServiceError> {
+        let provider = test_provider();
+        provider
+            .create_function(sample_create_input("image-lease"))
+            .await?;
+        let record = provider.get_record("image-lease")?;
+        let mut version = record.latest.clone();
+        version.package_type = "Image".into();
+        version.runtime = None;
+        version.handler = None;
+        version.code_path = None;
+        version.zip_bytes = None;
+        let resolved = crate::artifact::ResolvedImage::fixture(Architecture::X86_64);
+        version.image_uri = Some(resolved.metadata().requested_reference.as_str().into());
+        version.code_sha256 = resolved
+            .code_sha256()
+            .map_err(|_| invalid_parameter("Unit image hash"))?;
+        version.code_size = resolved.metadata().size_bytes;
+        version.image = ImageArtifact::Restored(resolved.clone());
+        assert!(matches!(
+            provider
+                .build_invoke_request(&record, &version, None, b"{}")
+                .await,
+            Err(LambdaServiceError::ResourceNotReady { .. })
+        ));
+        let (release, released) = tokio::sync::watch::channel(());
+        let (stop, stopping) = tokio::sync::watch::channel(false);
+        version.image = ImageArtifact::Pinned(crate::artifact::PinnedImage::new(
+            resolved,
+            version
+                .code_size
+                .try_into()
+                .map_err(|_| invalid_parameter("Unit image size"))?,
+            release,
+            Arc::new(std::sync::atomic::AtomicBool::new(true)),
+            stopping,
+        ));
+        let request = provider
+            .build_invoke_request(&record, &version, None, b"{}")
+            .await?;
+        let hash = version.code_sha256.clone();
+        version.code_sha256 = "tampered".into();
+        assert!(matches!(
+            provider
+                .build_invoke_request(&record, &version, None, b"{}")
+                .await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        version.code_sha256 = hash;
+        stop.send_replace(true);
+        assert!(matches!(
+            provider
+                .build_invoke_request(&record, &version, None, b"{}")
+                .await,
+            Err(LambdaServiceError::ResourceNotReady { .. })
+        ));
+        drop(version);
+        assert!(
+            !released
+                .has_changed()
+                .map_err(|_| invalid_parameter("Lease lost before request"))?
+        );
+        assert!(matches!(
+            request.revision.artifact,
+            DeploymentArtifact::Image(_)
+        ));
+        drop(request);
+        assert!(released.has_changed().is_err());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_unresolved_or_inconsistent_artifacts_before_work_admission()
+    -> Result<(), LambdaServiceError> {
+        let provider = test_provider();
+        provider
+            .create_function(sample_create_input("artifact-capture"))
+            .await?;
+        let record = provider.get_record("artifact-capture")?;
+        let mut invalid_zip = record.latest.clone();
+        invalid_zip.code_sha256 = "different".into();
+        assert!(matches!(
+            provider
+                .build_invoke_request(&record, &invalid_zip, None, b"{}")
+                .await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        let mut image = record.latest.clone();
+        image.package_type = "Image".into();
+        image.runtime = None;
+        image.handler = None;
+        image.zip_bytes = None;
+        image.code_path = None;
+        let resolved = crate::artifact::ResolvedImage::fixture(Architecture::X86_64);
+        image.image_uri = Some(resolved.metadata().requested_reference.as_str().into());
+        assert!(matches!(
+            provider
+                .build_invoke_request(&record, &image, None, b"{}")
+                .await,
+            Err(LambdaServiceError::ResourceNotReady { .. })
+        ));
+        image.image = ImageArtifact::Restored(resolved);
+        image.architectures = vec!["arm64".into()];
+        assert!(matches!(
+            provider
+                .build_invoke_request(&record, &image, None, b"{}")
+                .await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        Ok(())
+    }
+
     #[tokio::test]
     async fn test_should_create_and_get_function() {
         let provider = test_provider();
@@ -4208,3 +5866,7 @@ mod tests {
             .unwrap();
     }
 }
+
+#[cfg(all(test, unix))]
+#[path = "provider/zip_tests.rs"]
+pub(crate) mod provided_zip_tests;
diff --git a/crates/rustack-lambda-core/src/provider/snapshot.rs b/crates/rustack-lambda-core/src/provider/snapshot.rs
new file mode 100644
index 00000000..d60ffcc1
--- /dev/null
+++ b/crates/rustack-lambda-core/src/provider/snapshot.rs
@@ -0,0 +1,644 @@
+//! Bounded Docker archive profiles and validation before candidate preparation.
+
+use crate::artifact::{Architecture, MAX_ZIP_BYTES as MAX_ORIGINAL_ZIP_BYTES};
+
+/// Configured Docker archive allowance, independent of execution readiness.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum DockerArchiveProfile {
+    /// Immutable image metadata only.
+    ImageOnly,
+    /// Original provided-runtime ZIP code and image metadata.
+    ProvidedZip(Architecture),
+}
+impl DockerArchiveProfile {
+    /// Compact metadata allowance, excluding original ZIP bodies.
+    pub const METADATA_BYTES: usize = 16 * 1024 * 1024;
+    /// Maximum number of functions in either Docker profile.
+    pub const MAX_FUNCTIONS: usize = 256;
+    /// Maximum aggregate latest and published revisions.
+    pub const MAX_REVISIONS: usize = 1024;
+    /// Maximum original ZIP bytes per revision.
+    pub const MAX_ZIP_BYTES: usize = MAX_ORIGINAL_ZIP_BYTES;
+    /// Aggregate original ZIP bytes, counting every saved revision.
+    pub const MAX_ZIP_DATA_BYTES: usize = 64 * 1024 * 1024;
+
+    /// Complete service payload/work allowance for this configured profile.
+    ///
+    /// ```
+    /// use rustack_lambda_core::provider::DockerArchiveProfile;
+    /// assert_eq!(DockerArchiveProfile::ImageOnly.payload_limit(), 16 * 1024 * 1024);
+    /// ```
+    #[must_use]
+    pub const fn payload_limit(self) -> usize {
+        match self {
+            Self::ImageOnly => Self::METADATA_BYTES,
+            Self::ProvidedZip(_) => 128 * 1024 * 1024,
+        }
+    }
+
+    /// Configured ZIP platform; this is not a health or execution grant.
+    ///
+    /// ```
+    /// use rustack_lambda_core::provider::DockerArchiveProfile;
+    /// assert_eq!(DockerArchiveProfile::ImageOnly.zip_architecture(), None);
+    /// ```
+    #[must_use]
+    pub const fn zip_architecture(self) -> Option<Architecture> {
+        match self {
+            Self::ImageOnly => None,
+            Self::ProvidedZip(architecture) => Some(architecture),
+        }
+    }
+}
+
+pub(super) const IMAGE_METADATA_BYTES: usize = DockerArchiveProfile::METADATA_BYTES;
+pub(super) const MAX_IMAGE_FUNCTIONS: usize = DockerArchiveProfile::MAX_FUNCTIONS;
+pub(super) const MAX_IMAGE_REVISIONS: usize = DockerArchiveProfile::MAX_REVISIONS;
+
+#[cfg(unix)]
+mod projection;
+#[cfg(unix)]
+mod zip;
+
+#[cfg(unix)]
+mod validation {
+    use std::{
+        fmt::{Debug, Formatter, Result as FmtResult},
+        io::{Error as IoError, ErrorKind, Result as IoResult, Write},
+        iter::once,
+    };
+
+    use rustack_core::json::{JsonLimits, validate};
+    use serde::Serialize;
+    use serde_json::Value;
+    use tokio::{
+        sync::Semaphore,
+        task::spawn_blocking,
+        time::{Instant, timeout_at},
+    };
+
+    use super::{
+        DockerArchiveProfile, IMAGE_METADATA_BYTES, MAX_IMAGE_FUNCTIONS, MAX_IMAGE_REVISIONS,
+        projection::Metadata, zip,
+    };
+    use crate::{
+        docker::DockerError,
+        error::LambdaServiceError,
+        provider::{LambdaSnapshot, RustackLambda},
+        resolver::{FunctionName, function_arn},
+        storage::{
+            FunctionRecord, FunctionSnapshotRef, LayerRecord, LayerSnapshotRef, MappingSnapshotRef,
+            PolicyDocument, check_restore_deadline, image_error,
+        },
+    };
+
+    static VALIDATORS: Semaphore = Semaphore::const_new(4);
+
+    pub(super) fn invalid() -> LambdaServiceError {
+        LambdaServiceError::InvalidParameter {
+            message: "Invalid or oversized Docker archive metadata".into(),
+        }
+    }
+    struct BoundedBytes(Vec<u8>, usize);
+    impl Debug for BoundedBytes {
+        fn fmt(&self, formatter: &mut Formatter<'_>) -> FmtResult {
+            formatter
+                .debug_struct("BoundedBytes")
+                .field("bytes", &self.0.len())
+                .field("limit", &self.1)
+                .finish()
+        }
+    }
+    impl Default for BoundedBytes {
+        fn default() -> Self {
+            Self(Vec::new(), IMAGE_METADATA_BYTES)
+        }
+    }
+    impl Write for BoundedBytes {
+        fn write(&mut self, bytes: &[u8]) -> IoResult<usize> {
+            if bytes.len() > self.1.saturating_sub(self.0.len()) {
+                return Err(IoError::from(ErrorKind::FileTooLarge));
+            }
+            self.0
+                .try_reserve(bytes.len())
+                .map_err(|_| IoError::from(ErrorKind::OutOfMemory))?;
+            self.0.extend_from_slice(bytes);
+            Ok(bytes.len())
+        }
+        fn flush(&mut self) -> IoResult<()> {
+            Ok(())
+        }
+    }
+    #[derive(Debug)]
+    struct GuardWork {
+        remaining: usize,
+        #[cfg(test)]
+        visited_nodes: usize,
+    }
+    impl GuardWork {
+        fn new() -> Self {
+            Self {
+                remaining: 65_536,
+                #[cfg(test)]
+                visited_nodes: 0,
+            }
+        }
+        fn charge(&mut self, units: usize) -> Result<(), LambdaServiceError> {
+            self.remaining = self.remaining.checked_sub(units).ok_or_else(invalid)?;
+            Ok(())
+        }
+    }
+    fn condition(value: &Value, work: &mut GuardWork) -> Result<(), LambdaServiceError> {
+        let mut pending = vec![(value, 1usize)];
+        while let Some((value, depth)) = pending.pop() {
+            work.charge(1)?;
+            #[cfg(test)]
+            {
+                work.visited_nodes = work.visited_nodes.checked_add(1).ok_or_else(invalid)?;
+            }
+            if depth > 64 {
+                return Err(invalid());
+            }
+            let children = match value {
+                Value::Array(values) => values.len(),
+                Value::Object(values) => values.len(),
+                Value::String(value) if value.len() > 128 * 1024 => return Err(invalid()),
+                _ => 0,
+            };
+            if children > work.remaining.saturating_sub(pending.len()) {
+                return Err(invalid());
+            }
+            let next_depth = depth.checked_add(1).ok_or_else(invalid)?;
+            match value {
+                Value::Array(values) => {
+                    pending.extend(values.iter().map(|value| (value, next_depth)));
+                }
+                Value::Object(values) => {
+                    for (key, value) in values {
+                        if key.len() > 1024 {
+                            return Err(invalid());
+                        }
+                        pending.push((value, next_depth));
+                    }
+                }
+                _ => {}
+            }
+        }
+        Ok(())
+    }
+    fn policy(policy: &PolicyDocument, work: &mut GuardWork) -> Result<(), LambdaServiceError> {
+        if policy.statements.len() > 128 {
+            return Err(invalid());
+        }
+        work.charge(policy.statements.len())?;
+        for statement in &policy.statements {
+            if let Some(value) = &statement.condition {
+                condition(value, work)?;
+            }
+        }
+        Ok(())
+    }
+    fn function_record(record: &FunctionRecord) -> Result<(), LambdaServiceError> {
+        let mut work = GuardWork::new();
+        work.charge(record.versions.len().checked_add(1).ok_or_else(invalid)?)?;
+        policy(&record.policy, &mut work)?;
+        for version in once(&record.latest).chain(record.versions.values()) {
+            if version.package_type != "Image" || version.zip_bytes.is_some() {
+                return Err(invalid());
+            }
+        }
+        Ok(())
+    }
+    fn managed_record(record: &FunctionRecord) -> Result<(), LambdaServiceError> {
+        zip::record(record)?;
+        let mut work = GuardWork::new();
+        work.charge(record.versions.len().checked_add(1).ok_or_else(invalid)?)?;
+        policy(&record.policy, &mut work)
+    }
+    fn layer_record(record: &LayerRecord) -> Result<(), LambdaServiceError> {
+        layer_record_guarded(record, &mut GuardWork::new())
+    }
+    fn layer_record_guarded(
+        record: &LayerRecord,
+        work: &mut GuardWork,
+    ) -> Result<(), LambdaServiceError> {
+        work.charge(record.versions.len())?;
+        for version in record.versions.values() {
+            policy(&version.policy, work)?;
+        }
+        Ok(())
+    }
+    #[derive(Debug, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    struct BorrowedSnapshot<'a> {
+        functions: FunctionSnapshotRef<'a>,
+        layers: LayerSnapshotRef<'a>,
+        event_source_mappings: MappingSnapshotRef<'a>,
+    }
+    pub(crate) async fn export_docker(
+        provider: &RustackLambda,
+        deadline: Instant,
+        profile: DockerArchiveProfile,
+    ) -> Result<LambdaSnapshot, LambdaServiceError> {
+        check_restore_deadline(deadline)?;
+        let permit = timeout_at(deadline, VALIDATORS.acquire())
+            .await
+            .map_err(|_| image_error(DockerError::Deadline))?
+            .map_err(|_| image_error(DockerError::Stopped))?;
+        let stores = (
+            provider.store.clone(),
+            provider.layer_store.clone(),
+            provider.esm_store.clone(),
+        );
+        let scope = (
+            provider.config.default_region.clone(),
+            provider.config.account_id.clone(),
+        );
+        let mut job = spawn_blocking(move || {
+            let retained = (stores, permit);
+            check_restore_deadline(deadline)?;
+            retained
+                .0
+                .0
+                .check_snapshot_counts(MAX_IMAGE_FUNCTIONS, MAX_IMAGE_REVISIONS)?;
+            if profile.zip_architecture().is_some() {
+                retained.0.0.check_snapshot_zip_profile(deadline)?;
+            }
+            let guard = if profile.zip_architecture().is_some() {
+                managed_record
+            } else {
+                function_record
+            };
+            let borrowed = BorrowedSnapshot {
+                functions: retained.0.0.borrow_snapshot(guard),
+                layers: retained.0.1.borrow_snapshot(layer_record),
+                event_source_mappings: retained.0.2.borrow_snapshot(),
+            };
+            if profile.zip_architecture().is_some() {
+                let mut metadata = BoundedBytes::default();
+                serde_json::to_writer(&mut metadata, &Metadata::new(&borrowed))
+                    .map_err(|_| invalid())?;
+                let limits = JsonLimits::new(IMAGE_METADATA_BYTES, 64, 65_536, 128 * 1024, 1024)
+                    .map_err(|_| invalid())?;
+                validate(&metadata.0, limits).map_err(|_| invalid())?;
+            }
+            let mut bytes = BoundedBytes(Vec::new(), profile.payload_limit());
+            serde_json::to_writer(&mut bytes, &borrowed).map_err(|_| invalid())?;
+            if profile.zip_architecture().is_none() {
+                let limits = JsonLimits::new(IMAGE_METADATA_BYTES, 64, 65_536, 128 * 1024, 1024)
+                    .map_err(|_| invalid())?;
+                validate(&bytes.0, limits).map_err(|_| invalid())?;
+            }
+            check_restore_deadline(deadline)?;
+            let mut snapshot: LambdaSnapshot =
+                serde_json::from_slice(&bytes.0).map_err(|_| invalid())?;
+            input_profile(&mut snapshot, &scope.0, &scope.1, profile)?;
+            snapshot
+                .functions
+                .functions
+                .sort_by(|left, right| left.name.cmp(&right.name));
+            snapshot
+                .layers
+                .layers
+                .sort_by(|left, right| left.name.cmp(&right.name));
+            snapshot
+                .event_source_mappings
+                .mappings
+                .sort_by(|left, right| left.uuid.cmp(&right.uuid));
+            check_restore_deadline(deadline)?;
+            Ok(snapshot)
+        });
+        let result = timeout_at(deadline, &mut job)
+            .await
+            .map_err(|_| image_error(DockerError::Deadline))?
+            .map_err(|source| LambdaServiceError::ImageRestoreWorker {
+                source: source.into(),
+            })?;
+        check_restore_deadline(deadline)?;
+        result
+    }
+
+    fn input(
+        snapshot: &LambdaSnapshot,
+        region: &str,
+        account: &str,
+    ) -> Result<(), LambdaServiceError> {
+        if snapshot.functions.functions.len() > MAX_IMAGE_FUNCTIONS {
+            return Err(invalid());
+        }
+        let mut work = GuardWork::new();
+        work.charge(snapshot.functions.functions.len())?;
+        work.charge(snapshot.layers.layers.len())?;
+        work.charge(snapshot.event_source_mappings.mappings.len())?;
+        let mut versions = 0usize;
+        for function in &snapshot.functions.functions {
+            FunctionName::parse(&function.name).map_err(|_| invalid())?;
+            if function.arn != function_arn(region, account, &function.name) {
+                return Err(invalid());
+            }
+            versions = versions
+                .checked_add(1)
+                .and_then(|n| n.checked_add(function.versions.len()))
+                .ok_or_else(invalid)?;
+            if versions > MAX_IMAGE_REVISIONS || function.policy.statements.len() > 128 {
+                return Err(invalid());
+            }
+            work.charge(function.versions.len().checked_add(1).ok_or_else(invalid)?)?;
+            for version in once(&function.latest).chain(function.versions.values()) {
+                if version.zip_bytes_base64.is_some() {
+                    return Err(invalid());
+                }
+            }
+            policy(&function.policy, &mut work)?;
+        }
+        for layer in &snapshot.layers.layers {
+            layer_record_guarded(layer, &mut work)?;
+        }
+        let mut bytes = BoundedBytes::default();
+        serde_json::to_writer(&mut bytes, snapshot).map_err(|_| invalid())?;
+        let limits = JsonLimits::new(IMAGE_METADATA_BYTES, 64, 65_536, 128 * 1024, 1024)
+            .map_err(|_| invalid())?;
+        validate(&bytes.0, limits).map_err(|_| invalid())
+    }
+    fn input_profile(
+        snapshot: &mut LambdaSnapshot,
+        region: &str,
+        account: &str,
+        profile: DockerArchiveProfile,
+    ) -> Result<(), LambdaServiceError> {
+        if snapshot.functions.functions.len() > MAX_IMAGE_FUNCTIONS {
+            return Err(invalid());
+        }
+        let revisions =
+            snapshot
+                .functions
+                .functions
+                .iter()
+                .try_fold(0usize, |count, function| {
+                    count
+                        .checked_add(1)
+                        .and_then(|n| n.checked_add(function.versions.len()))
+                        .ok_or_else(invalid)
+                })?;
+        if revisions > MAX_IMAGE_REVISIONS {
+            return Err(invalid());
+        }
+        let bodies = zip::detach(snapshot, profile)?;
+        input(snapshot, region, account)?;
+        zip::reattach(snapshot, bodies)
+    }
+    pub(crate) async fn validate_docker(
+        snapshot: LambdaSnapshot,
+        deadline: Instant,
+        region: &str,
+        account: &str,
+        profile: DockerArchiveProfile,
+    ) -> Result<LambdaSnapshot, LambdaServiceError> {
+        validate_with(
+            snapshot,
+            deadline,
+            (region.into(), account.into()),
+            move |snapshot, region, account| input_profile(snapshot, region, account, profile),
+        )
+        .await
+    }
+    #[cfg(test)]
+    pub(crate) async fn validate_image(
+        snapshot: LambdaSnapshot,
+        deadline: Instant,
+        region: &str,
+        account: &str,
+    ) -> Result<LambdaSnapshot, LambdaServiceError> {
+        validate_docker(
+            snapshot,
+            deadline,
+            region,
+            account,
+            DockerArchiveProfile::ImageOnly,
+        )
+        .await
+    }
+    async fn validate_with<F>(
+        snapshot: LambdaSnapshot,
+        deadline: Instant,
+        scope: (String, String),
+        worker: F,
+    ) -> Result<LambdaSnapshot, LambdaServiceError>
+    where
+        F: FnOnce(&mut LambdaSnapshot, &str, &str) -> Result<(), LambdaServiceError>
+            + Send
+            + 'static,
+    {
+        check_restore_deadline(deadline)?;
+        let permit = timeout_at(deadline, VALIDATORS.acquire())
+            .await
+            .map_err(|_| image_error(DockerError::Deadline))?
+            .map_err(|_| image_error(DockerError::Stopped))?;
+        // The read-only job owns input before its slot in drop order, retaining
+        // admission through iterative policy destruction even on worker unwind.
+        let mut job = spawn_blocking(move || {
+            let mut retained = (snapshot, permit);
+            let result = (|| {
+                check_restore_deadline(deadline)?;
+                worker(&mut retained.0, &scope.0, &scope.1)?;
+                check_restore_deadline(deadline)
+            })();
+            match result {
+                Ok(()) => Ok(retained.0),
+                Err(error) => {
+                    drop(retained);
+                    Err(error)
+                }
+            }
+        });
+        // Dropped observations detach only bounded read-only owned CPU work.
+        // No late result has a store or publication capability.
+        let result = timeout_at(deadline, &mut job)
+            .await
+            .map_err(|_| image_error(DockerError::Deadline))?
+            .map_err(|source| LambdaServiceError::ImageRestoreWorker {
+                source: source.into(),
+            })?;
+        check_restore_deadline(deadline)?;
+        result
+    }
+
+    #[cfg(test)]
+    mod tests {
+        use std::{error::Error as _, time::Duration};
+
+        use rustack_lambda_model::error::{LambdaError, LambdaErrorCode};
+
+        use super::*;
+        use crate::{
+            config::LambdaConfig,
+            deployment::image_record_fixture as record,
+            executor::ExecutorBackend,
+            provider::RustackLambda,
+            storage::{FunctionStore, PolicyStatement},
+        };
+
+        fn deep_snapshot() -> LambdaSnapshot {
+            let store = FunctionStore::new("unused-pure-snapshot-fixture");
+            store.insert(record()).unwrap();
+            let mut snapshot = LambdaSnapshot {
+                functions: store.export_snapshot(),
+                ..LambdaSnapshot::default()
+            };
+            let mut condition = Value::Null;
+            for _ in 0..50_000 {
+                condition = Value::Array(vec![condition]);
+            }
+            snapshot
+                .functions
+                .functions
+                .first_mut()
+                .unwrap()
+                .policy
+                .statements
+                .push(PolicyStatement {
+                    sid: "deep".into(),
+                    effect: "Allow".into(),
+                    principal: "*".into(),
+                    action: "lambda:InvokeFunction".into(),
+                    resource: "*".into(),
+                    condition: Some(condition),
+                });
+            snapshot
+        }
+        #[tokio::test]
+        async fn test_should_destroy_deep_rejected_expired_and_unpolled_policy_inputs_without_recursion()
+         {
+            let error = validate_image(
+                deep_snapshot(),
+                Instant::now() + Duration::from_secs(30),
+                "us-east-1",
+                "000000000000",
+            )
+            .await
+            .unwrap_err();
+            assert!(matches!(error, LambdaServiceError::InvalidParameter { .. }));
+            let error =
+                validate_image(deep_snapshot(), Instant::now(), "us-east-1", "000000000000")
+                    .await
+                    .unwrap_err();
+            assert!(
+                matches!(error, LambdaServiceError::ImageRestore { source } if matches!(*source, DockerError::Deadline))
+            );
+            let provider = RustackLambda::new(LambdaConfig {
+                executor: ExecutorBackend::Docker,
+                ..LambdaConfig::default()
+            });
+            drop(
+                provider.import_snapshot_before(
+                    deep_snapshot(),
+                    Instant::now() + Duration::from_secs(30),
+                ),
+            );
+        }
+        fn panic_worker(
+            _: &mut LambdaSnapshot,
+            _: &str,
+            _: &str,
+        ) -> Result<(), LambdaServiceError> {
+            panic!("private-image-validator-panic");
+        }
+        #[tokio::test]
+        async fn test_should_preserve_typed_worker_panic_without_exposing_payload_or_parameter_error()
+         {
+            let error = validate_with(
+                LambdaSnapshot::default(),
+                Instant::now() + Duration::from_secs(30),
+                ("us-east-1".into(), "000000000000".into()),
+                panic_worker,
+            )
+            .await
+            .unwrap_err();
+            assert!(
+                matches!(&error, LambdaServiceError::ImageRestoreWorker { source } if source.is_panic() && !source.is_cancelled())
+            );
+            assert!(!format!("{error:?}").contains("private-image-validator-panic"));
+            let source = error.source().unwrap();
+            assert!(!source.to_string().contains("private-image-validator-panic"));
+            assert!(source.source().is_none());
+            let public: LambdaError = error.into();
+            assert_eq!(public.code, LambdaErrorCode::ServiceException);
+        }
+        #[test]
+        fn test_should_share_guard_work_across_ancillary_versions_and_conditions() {
+            let mut layer: LayerRecord = serde_json::from_value(serde_json::json!({"name":"work","layerArn":"arn:aws:lambda:us-east-1:000000000000:layer:work","nextVersion":2,
+                "versions":{"1":{"version":1,"description":"","compatibleRuntimes":[],"compatibleArchitectures":[],"licenseInfo":null,"codeSha256":"unused","codeSize":0,"createdDate":"2026-10-27T00:00:00Z","layerArn":"arn:aws:lambda:us-east-1:000000000000:layer:work","layerVersionArn":"arn:aws:lambda:us-east-1:000000000000:layer:work:1","policy":{"statements":[]}}}})).unwrap();
+            let version = layer.versions.get_mut(&1).unwrap();
+            for index in 0..128 {
+                version.policy.statements.push(PolicyStatement {
+                    sid: index.to_string(),
+                    effect: "Allow".into(),
+                    principal: "*".into(),
+                    action: "lambda:GetLayerVersion".into(),
+                    resource: "*".into(),
+                    condition: Some(Value::Array(vec![Value::Null; 512])),
+                });
+            }
+            let mut work = GuardWork::new();
+            assert!(layer_record_guarded(&layer, &mut work).is_err());
+            assert!(
+                work.visited_nodes > 1
+                    && work.visited_nodes <= 65_536
+                    && work.visited_nodes < 128 * 513
+            );
+            layer.versions.get_mut(&1).unwrap().policy = PolicyDocument::default();
+            let template = layer.versions.get(&1).unwrap().clone();
+            for index in 2..=6 {
+                layer.versions.insert(index, template.clone());
+            }
+            let mut work = GuardWork::new();
+            work.remaining = 5;
+            assert!(layer_record_guarded(&layer, &mut work).is_err());
+            assert_eq!(work.visited_nodes, 0);
+            assert_eq!(work.remaining, 5);
+        }
+        #[tokio::test]
+        async fn test_should_classify_canceled_validation_workers_without_raw_join_diagnostics() {
+            let task = tokio::spawn(std::future::pending::<()>());
+            task.abort();
+            let source = crate::error::ImageRestoreWorker::from(task.await.unwrap_err());
+            assert!(source.is_cancelled() && !source.is_panic());
+            assert!(source.source().is_none());
+            let error = LambdaServiceError::ImageRestoreWorker { source };
+            let public: LambdaError = error.into();
+            assert_eq!(public.code, LambdaErrorCode::ServiceException);
+        }
+        #[test]
+        fn test_should_bound_profile_counts_strings_depth_and_writer_before_effects() {
+            let mut bytes = BoundedBytes::default();
+            assert!(bytes.write(&vec![0; IMAGE_METADATA_BYTES + 1]).is_err());
+            assert_eq!(bytes.0, [] as [u8; 0]);
+            let mut snapshot = LambdaSnapshot::default();
+            let store = FunctionStore::new("unused-count-fixture");
+            store.insert(record()).unwrap();
+            let one = store.export_snapshot().functions.pop().unwrap();
+            snapshot.functions.functions = vec![one; 257];
+            assert!(input(&snapshot, "us-east-1", "000000000000").is_err());
+            assert!(
+                condition(
+                    &Value::String("x".repeat(128 * 1024 + 1)),
+                    &mut GuardWork::new()
+                )
+                .is_err()
+            );
+            assert!(
+                condition(
+                    &Value::Array(vec![Value::Null; 65_536]),
+                    &mut GuardWork::new()
+                )
+                .is_err()
+            );
+        }
+    }
+}
+#[cfg(unix)]
+pub(super) use validation::{export_docker, validate_docker};
+
+#[cfg(all(test, unix))]
+mod managed_tests;
diff --git a/crates/rustack-lambda-core/src/provider/snapshot/managed_tests.rs b/crates/rustack-lambda-core/src/provider/snapshot/managed_tests.rs
new file mode 100644
index 00000000..3ee459cf
--- /dev/null
+++ b/crates/rustack-lambda-core/src/provider/snapshot/managed_tests.rs
@@ -0,0 +1,233 @@
+//! Managed source bodies remain separate from bounded ordinary metadata.
+
+use std::{
+    io::{Cursor, Write},
+    time::Duration,
+};
+
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rstest::rstest;
+use serde_json::{Value, json};
+use tokio::time::Instant;
+use zip::{CompressionMethod, ZipWriter, write::SimpleFileOptions};
+
+use super::{
+    DockerArchiveProfile,
+    validation::{export_docker, validate_docker},
+    zip as zip_source,
+};
+use crate::{
+    artifact::Architecture,
+    error::LambdaServiceError,
+    identity::FunctionResourceId,
+    provider::{
+        LambdaSnapshot, RustackLambda,
+        provided_zip_tests::{fixture, input, package},
+    },
+    storage::PolicyStatement,
+};
+
+fn profile() -> DockerArchiveProfile {
+    DockerArchiveProfile::ProvidedZip(Architecture::Arm64)
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(10)
+}
+async fn source(large: bool) -> (tempfile::TempDir, RustackLambda, LambdaSnapshot) {
+    let (root, provider) = fixture();
+    let mut input = input();
+    input.publish = Some(true);
+    if large {
+        let bytes = STANDARD.decode(package(true)).unwrap();
+        let mut writer = ZipWriter::new_append(Cursor::new(bytes)).unwrap();
+        writer
+            .start_file(
+                "payload",
+                SimpleFileOptions::default().compression_method(CompressionMethod::Stored),
+            )
+            .unwrap();
+        writer.write_all(&vec![42; 200 * 1024]).unwrap();
+        input.code.zip_file = Some(STANDARD.encode(writer.finish().unwrap().into_inner()));
+    }
+    provider.create_function(input).await.unwrap();
+    let snapshot = provider.export_snapshot();
+    (root, provider, snapshot)
+}
+async fn validated(snapshot: LambdaSnapshot) -> Result<LambdaSnapshot, LambdaServiceError> {
+    validate_docker(snapshot, deadline(), "us-east-1", "000000000000", profile()).await
+}
+#[tokio::test]
+async fn test_should_round_trip_borrowed_large_original_bodies_without_relaxing_metadata() {
+    let (_root, provider, original) = source(true).await;
+    let expected = serde_json::to_value(&original).unwrap();
+    assert!(
+        original
+            .functions
+            .functions
+            .first()
+            .unwrap()
+            .latest
+            .zip_bytes_base64
+            .as_ref()
+            .unwrap()
+            .len()
+            > 128 * 1024
+    );
+    let saved = export_docker(&provider, deadline(), profile())
+        .await
+        .unwrap();
+    assert_eq!(serde_json::to_value(&saved).unwrap(), expected);
+    assert_eq!(
+        serde_json::to_value(validated(saved).await.unwrap()).unwrap(),
+        expected
+    );
+    assert!(
+        export_docker(&provider, deadline(), DockerArchiveProfile::ImageOnly)
+            .await
+            .is_err()
+    );
+    provider.shutdown_before(deadline()).await.unwrap();
+}
+#[rstest]
+#[case::description(false)]
+#[case::policy_lookalike(true)]
+#[tokio::test]
+async fn test_should_reject_large_ancillary_text_while_zip_bodies_keep_their_own_allowance(
+    #[case] policy: bool,
+) {
+    let (_root, provider, mut snapshot) = source(true).await;
+    let record = snapshot.functions.functions.first_mut().unwrap();
+    if policy {
+        record.policy.statements.push(PolicyStatement {
+            sid: "lookalike".into(),
+            effect: "Allow".into(),
+            principal: "*".into(),
+            action: "lambda:InvokeFunction".into(),
+            resource: "*".into(),
+            condition: Some(json!({"zipBytesBase64":"x".repeat(128 * 1024 + 1)})),
+        });
+    } else {
+        record.latest.description = "x".repeat(128 * 1024 + 1);
+    }
+    assert!(matches!(
+        validated(snapshot).await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    provider.shutdown_before(deadline()).await.unwrap();
+}
+#[rstest]
+#[case::name(false)]
+#[case::resource(true)]
+#[tokio::test]
+async fn test_should_reject_duplicate_function_scope_before_any_staging(#[case] identity: bool) {
+    let (_root, provider, mut snapshot) = source(false).await;
+    let mut duplicate = snapshot.functions.functions.first().unwrap().clone();
+    if identity {
+        duplicate.name = "another".into();
+        duplicate.arn = "arn:aws:lambda:us-east-1:000000000000:function:another".into();
+    } else {
+        duplicate.resource_id = FunctionResourceId::new();
+    }
+    snapshot.functions.functions.push(duplicate);
+    assert!(matches!(
+        validated(snapshot).await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    provider.shutdown_before(deadline()).await.unwrap();
+}
+#[rstest]
+#[case("runtime")]
+#[case("handler")]
+#[case("architecture")]
+#[case("size")]
+#[case("hash")]
+#[case("inactive")]
+#[case("mixed")]
+#[case("missing")]
+#[tokio::test]
+async fn test_should_reject_invalid_saved_zip_configuration_and_identity_without_effects(
+    #[case] changed: &str,
+) {
+    let (_root, provider, mut snapshot) = source(false).await;
+    let row = &mut snapshot.functions.functions.first_mut().unwrap().latest;
+    match changed {
+        "runtime" => row.runtime = Some("provided.al2".into()),
+        "handler" => row.handler = Some("bad handler".into()),
+        "architecture" => row.architectures = vec!["x86_64".into()],
+        "size" => row.code_size += 1,
+        "hash" => row.code_sha256 = "AA==".into(),
+        "inactive" => row.state = "Failed".into(),
+        "mixed" => row.package_type = "Image".into(),
+        _ => row.zip_bytes_base64 = None,
+    }
+    let old = serde_json::to_value(provider.export_snapshot()).unwrap();
+    assert!(matches!(
+        validated(snapshot).await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    assert_eq!(
+        serde_json::to_value(provider.export_snapshot()).unwrap(),
+        old
+    );
+    provider.shutdown_before(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_count_repeated_revision_source_bytes_at_exact_aggregate_boundary() {
+    let (_root, provider, mut snapshot) = source(false).await;
+    let expected: Value = serde_json::to_value(&snapshot).unwrap();
+    let row = snapshot.functions.functions.first().unwrap();
+    let bytes = usize::try_from(row.latest.code_size)
+        .unwrap()
+        .checked_mul(2)
+        .unwrap();
+    provider.store.check_snapshot_zip_bytes(bytes).unwrap();
+    assert!(provider.store.check_snapshot_zip_bytes(bytes - 1).is_err());
+    assert!(zip_source::detach_with_limit(&mut snapshot.clone(), profile(), bytes - 1).is_err());
+    let bodies = zip_source::detach_with_limit(&mut snapshot, profile(), bytes).unwrap();
+    assert_eq!(bodies.len(), 2);
+    zip_source::reattach(&mut snapshot, bodies).unwrap();
+    assert_eq!(serde_json::to_value(snapshot).unwrap(), expected);
+    provider.shutdown_before(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_preflight_global_metadata_nodes_across_individually_legal_live_records() {
+    let (_root, provider, _) = source(false).await;
+    let original = provider.store.get("provided-control").unwrap().unwrap();
+    for index in 0..16 {
+        let mut row = original.clone();
+        row.name = format!("metadata-{index}");
+        row.arn = format!("arn:aws:lambda:us-east-1:000000000000:function:metadata-{index}");
+        row.resource_id = FunctionResourceId::new();
+        row.policy.statements.push(PolicyStatement {
+            sid: "nodes".into(),
+            effect: "Allow".into(),
+            principal: "*".into(),
+            action: "lambda:InvokeFunction".into(),
+            resource: "*".into(),
+            condition: Some(Value::Array(vec![Value::Null; 5000])),
+        });
+        provider.store.insert(row).unwrap();
+    }
+    assert!(matches!(
+        export_docker(&provider, deadline(), profile()).await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    provider.shutdown_before(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_reject_oversized_live_ancillary_text_before_full_dto_construction() {
+    let (_root, provider, _) = source(false).await;
+    provider
+        .store
+        .try_update_if_revision("provided-control", None, |record| {
+            record.latest.description = "x".repeat(20 * 1024 * 1024);
+            Ok(())
+        })
+        .unwrap();
+    assert!(matches!(
+        export_docker(&provider, deadline(), profile()).await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    provider.shutdown_before(deadline()).await.unwrap();
+}
diff --git a/crates/rustack-lambda-core/src/provider/snapshot/projection.rs b/crates/rustack-lambda-core/src/provider/snapshot/projection.rs
new file mode 100644
index 00000000..39c91f4a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/provider/snapshot/projection.rs
@@ -0,0 +1,391 @@
+//! Borrowed metadata serializer; original body serializers are never invoked.
+//!
+//! The source is the fixed live-store schema, not arbitrary input JSON. Field
+//! paths are tracked through both derives and flattened maps. The projected JSON
+//! is validated under the ordinary limits before a full owned DTO can exist.
+
+use std::{
+    fmt::{Debug, Display, Formatter, Result as FmtResult},
+    io::{Error as IoError, ErrorKind, Result as IoResult, Write},
+};
+
+use serde::{
+    Serialize, Serializer,
+    ser::{
+        Error as SerializeError, SerializeMap, SerializeSeq, SerializeStruct,
+        SerializeStructVariant, SerializeTuple, SerializeTupleStruct, SerializeTupleVariant,
+    },
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Path {
+    Root,
+    Functions,
+    Rows,
+    Function,
+    Versions,
+    Version,
+    Zip,
+    Other,
+}
+impl Path {
+    fn named(self, key: &str) -> Self {
+        match (self, key) {
+            (Self::Root, "functions") => Self::Functions,
+            (Self::Functions, "functions") => Self::Rows,
+            (Self::Function, "latest") => Self::Version,
+            (Self::Function, "versions") => Self::Versions,
+            (Self::Version, "zipBytesBase64") => Self::Zip,
+            _ => Self::Other,
+        }
+    }
+    fn element(self) -> Self {
+        if self == Self::Rows {
+            Self::Function
+        } else {
+            Self::Other
+        }
+    }
+    fn key<K: Serialize + ?Sized, E: SerializeError>(self, key: &K) -> Result<Self, E> {
+        if self == Self::Other {
+            return Ok(Self::Other);
+        }
+        let mut bytes = KeyBytes(Vec::new());
+        serde_json::to_writer(&mut bytes, key)
+            .map_err(|_| E::custom("invalid archive metadata key"))?;
+        Ok(match bytes.0.as_slice() {
+            b"\"functions\"" => self.named("functions"),
+            b"\"latest\"" => self.named("latest"),
+            b"\"versions\"" => self.named("versions"),
+            b"\"zipBytesBase64\"" => self.named("zipBytesBase64"),
+            value
+                if self == Self::Versions
+                    && !value.is_empty()
+                    && value.iter().all(u8::is_ascii_digit) =>
+            {
+                Self::Version
+            }
+            _ => Self::Other,
+        })
+    }
+}
+struct KeyBytes(Vec<u8>);
+impl Debug for KeyBytes {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> FmtResult {
+        formatter.write_str("KeyBytes(<redacted>)")
+    }
+}
+impl Write for KeyBytes {
+    fn write(&mut self, bytes: &[u8]) -> IoResult<usize> {
+        let end = self
+            .0
+            .len()
+            .checked_add(bytes.len())
+            .ok_or(ErrorKind::FileTooLarge)?;
+        // JSON escapes can encode one bounded key byte in six bytes, plus quotes.
+        if end > 6 * 1024 + 2 {
+            return Err(IoError::from(ErrorKind::FileTooLarge));
+        }
+        self.0
+            .try_reserve(bytes.len())
+            .map_err(|_| IoError::from(ErrorKind::OutOfMemory))?;
+        self.0.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> IoResult<()> {
+        Ok(())
+    }
+}
+
+pub(super) struct Metadata<'a, T: ?Sized> {
+    value: &'a T,
+    path: Path,
+}
+impl<T: ?Sized> Debug for Metadata<'_, T> {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> FmtResult {
+        formatter.write_str("Metadata(<borrowed>)")
+    }
+}
+impl<'a, T: ?Sized> Metadata<'a, T> {
+    pub(super) fn new(value: &'a T) -> Self {
+        Self {
+            value,
+            path: Path::Root,
+        }
+    }
+}
+impl<T: Serialize + ?Sized> Serialize for Metadata<'_, T> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        self.value.serialize(Project {
+            inner: serializer,
+            path: self.path,
+        })
+    }
+}
+struct Project<S> {
+    inner: S,
+    path: Path,
+}
+struct List<S> {
+    inner: S,
+    path: Path,
+}
+struct Fields<S> {
+    inner: S,
+    path: Path,
+}
+struct Map<S> {
+    inner: S,
+    path: Path,
+    pending: Option<Path>,
+}
+macro_rules! private_debug {
+    ($name:ident) => {
+        impl<S> Debug for $name<S> {
+            fn fmt(&self, formatter: &mut Formatter<'_>) -> FmtResult {
+                formatter
+                    .debug_struct(stringify!($name))
+                    .field("path", &self.path)
+                    .finish_non_exhaustive()
+            }
+        }
+    };
+}
+private_debug!(Project);
+private_debug!(List);
+private_debug!(Fields);
+private_debug!(Map);
+macro_rules! scalar {
+    ($name:ident, $type:ty) => {
+        fn $name(self, value: $type) -> Result<Self::Ok, Self::Error> {
+            self.inner.$name(value)
+        }
+    };
+}
+impl<S: Serializer> Serializer for Project<S> {
+    type Ok = S::Ok;
+    type Error = S::Error;
+    type SerializeSeq = List<S::SerializeSeq>;
+    type SerializeTuple = List<S::SerializeTuple>;
+    type SerializeTupleStruct = List<S::SerializeTupleStruct>;
+    type SerializeTupleVariant = List<S::SerializeTupleVariant>;
+    type SerializeMap = Map<S::SerializeMap>;
+    type SerializeStruct = Fields<S::SerializeStruct>;
+    type SerializeStructVariant = Fields<S::SerializeStructVariant>;
+    scalar!(serialize_bool, bool);
+    scalar!(serialize_i8, i8);
+    scalar!(serialize_i16, i16);
+    scalar!(serialize_i32, i32);
+    scalar!(serialize_i64, i64);
+    scalar!(serialize_i128, i128);
+    scalar!(serialize_u8, u8);
+    scalar!(serialize_u16, u16);
+    scalar!(serialize_u32, u32);
+    scalar!(serialize_u64, u64);
+    scalar!(serialize_u128, u128);
+    scalar!(serialize_f32, f32);
+    scalar!(serialize_f64, f64);
+    scalar!(serialize_char, char);
+    scalar!(serialize_str, &str);
+    scalar!(serialize_bytes, &[u8]);
+    fn serialize_none(self) -> Result<Self::Ok, Self::Error> {
+        self.inner.serialize_none()
+    }
+    fn serialize_unit(self) -> Result<Self::Ok, Self::Error> {
+        self.inner.serialize_unit()
+    }
+    fn serialize_unit_struct(self, name: &'static str) -> Result<Self::Ok, Self::Error> {
+        self.inner.serialize_unit_struct(name)
+    }
+    fn serialize_unit_variant(
+        self,
+        name: &'static str,
+        index: u32,
+        variant: &'static str,
+    ) -> Result<Self::Ok, Self::Error> {
+        self.inner.serialize_unit_variant(name, index, variant)
+    }
+    fn serialize_some<T: Serialize + ?Sized>(self, value: &T) -> Result<Self::Ok, Self::Error> {
+        self.inner.serialize_some(&Metadata {
+            value,
+            path: self.path,
+        })
+    }
+    fn serialize_newtype_struct<T: Serialize + ?Sized>(
+        self,
+        name: &'static str,
+        value: &T,
+    ) -> Result<Self::Ok, Self::Error> {
+        self.inner.serialize_newtype_struct(
+            name,
+            &Metadata {
+                value,
+                path: self.path,
+            },
+        )
+    }
+    fn serialize_newtype_variant<T: Serialize + ?Sized>(
+        self,
+        name: &'static str,
+        index: u32,
+        variant: &'static str,
+        value: &T,
+    ) -> Result<Self::Ok, Self::Error> {
+        self.inner.serialize_newtype_variant(
+            name,
+            index,
+            variant,
+            &Metadata {
+                value,
+                path: Path::Other,
+            },
+        )
+    }
+    fn serialize_seq(self, len: Option<usize>) -> Result<Self::SerializeSeq, Self::Error> {
+        Ok(List {
+            inner: self.inner.serialize_seq(len)?,
+            path: self.path,
+        })
+    }
+    fn serialize_tuple(self, len: usize) -> Result<Self::SerializeTuple, Self::Error> {
+        Ok(List {
+            inner: self.inner.serialize_tuple(len)?,
+            path: self.path,
+        })
+    }
+    fn serialize_tuple_struct(
+        self,
+        name: &'static str,
+        len: usize,
+    ) -> Result<Self::SerializeTupleStruct, Self::Error> {
+        Ok(List {
+            inner: self.inner.serialize_tuple_struct(name, len)?,
+            path: self.path,
+        })
+    }
+    fn serialize_tuple_variant(
+        self,
+        name: &'static str,
+        index: u32,
+        variant: &'static str,
+        len: usize,
+    ) -> Result<Self::SerializeTupleVariant, Self::Error> {
+        Ok(List {
+            inner: self
+                .inner
+                .serialize_tuple_variant(name, index, variant, len)?,
+            path: Path::Other,
+        })
+    }
+    fn serialize_map(self, len: Option<usize>) -> Result<Self::SerializeMap, Self::Error> {
+        Ok(Map {
+            inner: self.inner.serialize_map(len)?,
+            path: self.path,
+            pending: None,
+        })
+    }
+    fn serialize_struct(
+        self,
+        name: &'static str,
+        len: usize,
+    ) -> Result<Self::SerializeStruct, Self::Error> {
+        Ok(Fields {
+            inner: self.inner.serialize_struct(name, len)?,
+            path: self.path,
+        })
+    }
+    fn serialize_struct_variant(
+        self,
+        name: &'static str,
+        index: u32,
+        variant: &'static str,
+        len: usize,
+    ) -> Result<Self::SerializeStructVariant, Self::Error> {
+        Ok(Fields {
+            inner: self
+                .inner
+                .serialize_struct_variant(name, index, variant, len)?,
+            path: Path::Other,
+        })
+    }
+    fn collect_str<T: Display + ?Sized>(self, value: &T) -> Result<Self::Ok, Self::Error> {
+        self.inner.collect_str(value)
+    }
+    fn is_human_readable(&self) -> bool {
+        self.inner.is_human_readable()
+    }
+}
+macro_rules! list {
+    ($trait:ident, $method:ident) => {
+        impl<S: $trait> $trait for List<S> {
+            type Ok = S::Ok;
+            type Error = S::Error;
+            fn $method<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Self::Error> {
+                self.inner.$method(&Metadata {
+                    value,
+                    path: self.path.element(),
+                })
+            }
+            fn end(self) -> Result<Self::Ok, Self::Error> {
+                self.inner.end()
+            }
+        }
+    };
+}
+list!(SerializeSeq, serialize_element);
+list!(SerializeTuple, serialize_element);
+list!(SerializeTupleStruct, serialize_field);
+list!(SerializeTupleVariant, serialize_field);
+macro_rules! fields {
+    ($trait:ident) => {
+        impl<S: $trait> $trait for Fields<S> {
+            type Ok = S::Ok;
+            type Error = S::Error;
+            fn serialize_field<T: Serialize + ?Sized>(
+                &mut self,
+                key: &'static str,
+                value: &T,
+            ) -> Result<(), Self::Error> {
+                let path = self.path.named(key);
+                if path == Path::Zip {
+                    self.inner.serialize_field(key, &Option::<u8>::None)
+                } else {
+                    self.inner.serialize_field(key, &Metadata { value, path })
+                }
+            }
+            fn skip_field(&mut self, key: &'static str) -> Result<(), Self::Error> {
+                self.inner.skip_field(key)
+            }
+            fn end(self) -> Result<Self::Ok, Self::Error> {
+                self.inner.end()
+            }
+        }
+    };
+}
+fields!(SerializeStruct);
+fields!(SerializeStructVariant);
+impl<S: SerializeMap> SerializeMap for Map<S> {
+    type Ok = S::Ok;
+    type Error = S::Error;
+    fn serialize_key<T: Serialize + ?Sized>(&mut self, key: &T) -> Result<(), Self::Error> {
+        self.pending = Some(self.path.key::<_, Self::Error>(key)?);
+        self.inner.serialize_key(key)
+    }
+    fn serialize_value<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<(), Self::Error> {
+        let path = self
+            .pending
+            .take()
+            .ok_or_else(|| Self::Error::custom("archive metadata value without key"))?;
+        if path == Path::Zip {
+            self.inner.serialize_value(&Option::<u8>::None)
+        } else {
+            self.inner.serialize_value(&Metadata { value, path })
+        }
+    }
+    fn end(self) -> Result<Self::Ok, Self::Error> {
+        self.inner.end()
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-core/src/provider/snapshot/projection/tests.rs b/crates/rustack-lambda-core/src/provider/snapshot/projection/tests.rs
new file mode 100644
index 00000000..a4e9f440
--- /dev/null
+++ b/crates/rustack-lambda-core/src/provider/snapshot/projection/tests.rs
@@ -0,0 +1,102 @@
+//! Before-copy projection controls, including the flattened live revision shape.
+
+use std::{cell::Cell, collections::BTreeMap};
+
+use rstest::rstest;
+use serde::{Serialize, Serializer, ser::Error as _};
+use serde_json::{Value, json};
+
+use super::Metadata;
+
+#[derive(Debug, Serialize)]
+struct Root<V> {
+    functions: Rows<V>,
+}
+#[derive(Debug, Serialize)]
+struct Rows<V> {
+    functions: Vec<Function<V>>,
+}
+#[derive(Debug, Serialize)]
+struct Function<V> {
+    latest: V,
+    versions: BTreeMap<u64, V>,
+}
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct Plain<V> {
+    zip_bytes_base64: V,
+    note: &'static str,
+}
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct Flat<V> {
+    zip_bytes_base64: V,
+    #[serde(flatten)]
+    extra: BTreeMap<String, Value>,
+}
+#[derive(Debug)]
+struct Body<'a>(&'a Cell<usize>);
+impl Serialize for Body<'_> {
+    fn serialize<S: Serializer>(&self, _: S) -> Result<S::Ok, S::Error> {
+        self.0.set(self.0.get().saturating_add(1));
+        Err(S::Error::custom("ZIP body formatter was invoked"))
+    }
+}
+fn project<V: Serialize>(latest: V, published: V) -> Value {
+    let source = Root {
+        functions: Rows {
+            functions: vec![Function {
+                latest,
+                versions: [(1, published)].into_iter().collect(),
+            }],
+        },
+    };
+    serde_json::to_value(Metadata::new(&source)).unwrap()
+}
+#[rstest]
+#[case::plain(false)]
+#[case::flattened(true)]
+fn test_should_never_invoke_original_body_serializers_in_known_struct_and_flattened_slots(
+    #[case] flat: bool,
+) {
+    let calls = Cell::new(0);
+    let output = if flat {
+        let make = || Flat {
+            zip_bytes_base64: Body(&calls),
+            extra: [("note".into(), json!("retained"))].into_iter().collect(),
+        };
+        project(make(), make())
+    } else {
+        let make = || Plain {
+            zip_bytes_base64: Body(&calls),
+            note: "retained",
+        };
+        project(make(), make())
+    };
+    assert_eq!(calls.get(), 0);
+    for row in [
+        &output["functions"]["functions"][0]["latest"],
+        &output["functions"]["functions"][0]["versions"]["1"],
+    ] {
+        assert!(row["zipBytesBase64"].is_null());
+        assert_eq!(row["note"], "retained");
+    }
+}
+#[rstest]
+#[case(json!({"unknown":{"functions":{"functions":[{"latest":{"zipBytesBase64":"retained"}}]}}}))]
+#[case(json!({"layers":{"latest":{"zipBytesBase64":"retained"}}}))]
+#[case(json!({"functions":{"functions":[{"policy":{"latest":{"zipBytesBase64":"retained"}}}]}}))]
+#[case(json!({"functions":{"functions":[{"versions":{"1":{"zipBytesBase64":"retained"}}}]}}))]
+#[case(json!({"functions":{"functions":{"latest":{"zipBytesBase64":"retained"}}}}))]
+#[case(json!({"functions":{"functions":[{"latest":[{"zipBytesBase64":"retained"}]}]}}))]
+fn test_should_keep_nonmatching_paths_and_text_version_key_lookalikes(#[case] source: Value) {
+    let encoded = serde_json::to_vec(&Metadata::new(&source)).unwrap();
+    assert_eq!(serde_json::from_slice::<Value>(&encoded).unwrap(), source);
+}
+#[test]
+fn test_should_bound_map_key_formatting_before_value_serialization() {
+    let source = json!({"x".repeat(7 * 1024):{"zipBytesBase64":"retained"}});
+    let error = serde_json::to_vec(&Metadata::new(&source)).unwrap_err();
+    assert!(error.to_string().contains("invalid archive metadata key"));
+    assert!(!format!("{:?}", Metadata::new(&source)).contains("retained"));
+}
diff --git a/crates/rustack-lambda-core/src/provider/snapshot/zip.rs b/crates/rustack-lambda-core/src/provider/snapshot/zip.rs
new file mode 100644
index 00000000..53008fb1
--- /dev/null
+++ b/crates/rustack-lambda-core/src/provider/snapshot/zip.rs
@@ -0,0 +1,209 @@
+//! Original body ownership and canonical budgets, separate from compact metadata.
+
+use std::{collections::HashSet, iter::once};
+
+use base64::{Engine, engine::general_purpose::STANDARD};
+
+use super::{DockerArchiveProfile, validation::invalid};
+use crate::{
+    artifact::Architecture,
+    error::LambdaServiceError,
+    function_config::{validate_provided_settings, validate_snapshot_settings},
+    provider::LambdaSnapshot,
+    resolver::FunctionName,
+    storage::{FunctionRecord, VersionRecordSnapshot},
+};
+
+fn digit(byte: u8) -> Result<u8, LambdaServiceError> {
+    let (base, offset) = match byte {
+        b'A'..=b'Z' => (b'A', 0),
+        b'a'..=b'z' => (b'a', 26),
+        b'0'..=b'9' => (b'0', 52),
+        b'+' => return Ok(62),
+        b'/' => return Ok(63),
+        _ => return Err(invalid()),
+    };
+    byte.checked_sub(base)
+        .and_then(|value| value.checked_add(offset))
+        .ok_or_else(invalid)
+}
+/// Validate without decoding or producing a second owned body.
+fn decoded_len(encoded: &str, maximum: usize) -> Result<usize, LambdaServiceError> {
+    let bytes = encoded.as_bytes();
+    let maximum_encoded = maximum.div_ceil(3).checked_mul(4).ok_or_else(invalid)?;
+    if bytes.is_empty() || bytes.len() > maximum_encoded || !bytes.len().is_multiple_of(4) {
+        return Err(invalid());
+    }
+    let padding = if bytes.ends_with(b"==") {
+        2
+    } else {
+        usize::from(bytes.ends_with(b"="))
+    };
+    let end = bytes.len().checked_sub(padding).ok_or_else(invalid)?;
+    let mut last = 0;
+    for byte in bytes.get(..end).ok_or_else(invalid)? {
+        last = digit(*byte)?;
+    }
+    if (padding == 1 && last & 3 != 0) || (padding == 2 && last & 15 != 0) {
+        return Err(invalid());
+    }
+    bytes
+        .len()
+        .checked_div(4)
+        .and_then(|n| n.checked_mul(3))
+        .and_then(|n| n.checked_sub(padding))
+        .filter(|n| *n <= maximum)
+        .ok_or_else(invalid)
+}
+fn version(
+    version: &VersionRecordSnapshot,
+    architecture: Architecture,
+) -> Result<usize, LambdaServiceError> {
+    validate_snapshot_settings(version).map_err(|_| invalid())?;
+    validate_provided_settings(version.runtime.as_deref(), version.handler.as_deref())
+        .map_err(|_| invalid())?;
+    if version.state != "Active"
+        || version
+            .deployment
+            .is_some_and(|state| state.state() != "Active")
+        || version.architectures.as_slice() != [architecture.as_str()]
+        || version.image_uri.is_some()
+        || version.resolved_image.is_some()
+        || version.image_config.is_some()
+    {
+        return Err(invalid());
+    }
+    let bytes = decoded_len(
+        version.zip_bytes_base64.as_deref().ok_or_else(invalid)?,
+        DockerArchiveProfile::MAX_ZIP_BYTES,
+    )?;
+    if u64::try_from(bytes).ok() != Some(version.code_size) || version.code_sha256.len() != 44 {
+        return Err(invalid());
+    }
+    let digest = STANDARD
+        .decode(&version.code_sha256)
+        .map_err(|_| invalid())?;
+    if digest.len() != 32 || STANDARD.encode(digest) != version.code_sha256 {
+        return Err(invalid());
+    }
+    Ok(bytes)
+}
+
+pub(super) fn detach(
+    snapshot: &mut LambdaSnapshot,
+    profile: DockerArchiveProfile,
+) -> Result<Vec<String>, LambdaServiceError> {
+    detach_with_limit(snapshot, profile, DockerArchiveProfile::MAX_ZIP_DATA_BYTES)
+}
+pub(super) fn detach_with_limit(
+    snapshot: &mut LambdaSnapshot,
+    profile: DockerArchiveProfile,
+    maximum: usize,
+) -> Result<Vec<String>, LambdaServiceError> {
+    let mut remaining = maximum.min(DockerArchiveProfile::MAX_ZIP_DATA_BYTES);
+    let mut names = HashSet::new();
+    let mut identities = HashSet::new();
+    for function in &snapshot.functions.functions {
+        FunctionName::parse(&function.name).map_err(|_| invalid())?;
+        if !names.insert(function.name.as_str()) || !identities.insert(function.resource_id) {
+            return Err(invalid());
+        }
+    }
+    let mut bodies = Vec::new();
+    for function in &mut snapshot.functions.functions {
+        let package = match function.latest.package_type.as_str() {
+            "Image" => "Image",
+            "Zip" => "Zip",
+            _ => return Err(invalid()),
+        };
+        for row in once(&mut function.latest).chain(function.versions.values_mut()) {
+            if row.package_type != package {
+                return Err(invalid());
+            }
+            match row.package_type.as_str() {
+                "Image" if row.zip_bytes_base64.is_none() => {}
+                "Zip" => {
+                    let len = version(row, profile.zip_architecture().ok_or_else(invalid)?)?;
+                    remaining = remaining.checked_sub(len).ok_or_else(invalid)?;
+                    bodies.push(row.zip_bytes_base64.take().ok_or_else(invalid)?);
+                }
+                _ => return Err(invalid()),
+            }
+        }
+    }
+    Ok(bodies)
+}
+pub(super) fn reattach(
+    snapshot: &mut LambdaSnapshot,
+    bodies: Vec<String>,
+) -> Result<(), LambdaServiceError> {
+    let mut bodies = bodies.into_iter();
+    for function in &mut snapshot.functions.functions {
+        for row in once(&mut function.latest).chain(function.versions.values_mut()) {
+            if row.package_type == "Zip" {
+                if row.zip_bytes_base64.is_some() {
+                    return Err(invalid());
+                }
+                row.zip_bytes_base64 = Some(bodies.next().ok_or_else(invalid)?);
+            }
+        }
+    }
+    if bodies.next().is_some() {
+        return Err(invalid());
+    }
+    Ok(())
+}
+
+pub(super) fn record(record: &FunctionRecord) -> Result<(), LambdaServiceError> {
+    for row in once(&record.latest).chain(record.versions.values()) {
+        if row.package_type != record.latest.package_type {
+            return Err(invalid());
+        }
+        if row.package_type == "Zip" {
+            validate_provided_settings(row.runtime.as_deref(), row.handler.as_deref())
+                .map_err(|_| invalid())?;
+            if row.deployment.state() != "Active"
+                || row
+                    .zip_bytes
+                    .as_ref()
+                    .is_none_or(|bytes| bytes.len() > DockerArchiveProfile::MAX_ZIP_BYTES)
+            {
+                return Err(invalid());
+            }
+        } else if row.package_type != "Image" || row.zip_bytes.is_some() {
+            return Err(invalid());
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use rstest::rstest;
+
+    use super::*;
+    #[rstest]
+    #[case("AA==", 1)]
+    #[case("AAA=", 2)]
+    #[case("AAAA", 3)]
+    fn test_should_measure_canonical_bodies_without_decoding(
+        #[case] body: &str,
+        #[case] bytes: usize,
+    ) {
+        assert_eq!(decoded_len(body, bytes).unwrap(), bytes);
+        assert!(decoded_len(body, bytes.saturating_sub(1)).is_err());
+    }
+    #[rstest]
+    #[case("")]
+    #[case("AA")]
+    #[case("AB==")]
+    #[case("AAB=")]
+    #[case("A===")]
+    #[case("AA-A")]
+    #[case("AA_A")]
+    #[case("AA A")]
+    #[case("====")]
+    fn test_should_reject_noncanonical_source_without_copying(#[case] body: &str) {
+        assert!(decoded_len(body, 64).is_err());
+    }
+}
diff --git a/crates/rustack-lambda-core/src/provider/zip_tests.rs b/crates/rustack-lambda-core/src/provider/zip_tests.rs
new file mode 100644
index 00000000..1d3b721d
--- /dev/null
+++ b/crates/rustack-lambda-core/src/provider/zip_tests.rs
@@ -0,0 +1,360 @@
+//! Control-plane validation only; this fixture never executes a handler.
+
+use std::{
+    io::{Cursor, Write},
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+};
+
+use async_trait::async_trait;
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rstest::rstest;
+use rustack_lambda_model::types::FunctionCode;
+use tempfile::TempDir;
+use tokio::{spawn, sync::Notify, time::timeout};
+use zip::{ZipWriter, write::SimpleFileOptions};
+
+use super::*;
+use crate::{
+    docker::DockerExecutorError,
+    executor::{ExecutorError, InvokeResponse},
+    invocation::InvocationContext,
+};
+
+#[derive(Debug)]
+struct ZipControl(Arc<AtomicBool>);
+#[async_trait]
+impl Executor for ZipControl {
+    fn image_available(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+    fn zip_available(&self, architecture: Architecture) -> Result<(), ExecutorError> {
+        if !self.0.load(Ordering::Acquire) {
+            return Err(ExecutorError::Docker(DockerExecutorError::Unavailable));
+        }
+        if architecture != Architecture::Arm64 {
+            return Err(ExecutorError::Unsupported("control platform".into()));
+        }
+        Ok(())
+    }
+    async fn invoke(
+        &self,
+        _: InvokeRequest,
+        _: InvocationContext,
+    ) -> Result<InvokeResponse, ExecutorError> {
+        Err(ExecutorError::Unsupported(
+            "control-plane-only fixture".into(),
+        ))
+    }
+    async fn shutdown(&self) -> Result<(), ExecutorError> {
+        Ok(())
+    }
+}
+pub(super) fn fixture() -> (TempDir, RustackLambda) {
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_executor(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Docker,
+            ..Default::default()
+        },
+        Arc::new(ZipControl(Arc::new(AtomicBool::new(true)))),
+    );
+    (root, provider)
+}
+pub(crate) fn package(elf: bool) -> String {
+    let mut body = vec![0_u8; 64];
+    if elf {
+        body.get_mut(..7)
+            .unwrap()
+            .copy_from_slice(b"\x7fELF\x02\x01\x01");
+        body.get_mut(16..18)
+            .unwrap()
+            .copy_from_slice(&2_u16.to_le_bytes());
+        body.get_mut(18..20)
+            .unwrap()
+            .copy_from_slice(&183_u16.to_le_bytes());
+        body.get_mut(20..24)
+            .unwrap()
+            .copy_from_slice(&1_u32.to_le_bytes());
+        body.get_mut(52..54)
+            .unwrap()
+            .copy_from_slice(&64_u16.to_le_bytes());
+    }
+    let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+    writer
+        .start_file(
+            "bootstrap",
+            SimpleFileOptions::default().unix_permissions(0o755),
+        )
+        .unwrap();
+    writer.write_all(&body).unwrap();
+    STANDARD.encode(writer.finish().unwrap().into_inner())
+}
+pub(crate) fn input() -> CreateFunctionInput {
+    CreateFunctionInput {
+        function_name: "provided-control".into(),
+        runtime: Some("provided.al2023".into()),
+        handler: Some("handler.entry".into()),
+        role: "arn:aws:iam::000000000000:role/test-role".into(),
+        architectures: Some(vec!["arm64".into()]),
+        code: FunctionCode {
+            zip_file: Some(package(true)),
+            ..Default::default()
+        },
+        ..Default::default()
+    }
+}
+
+#[tokio::test]
+async fn test_should_preserve_latest_and_publications_after_bad_zip_or_configuration_updates() {
+    let (_root, provider) = fixture();
+    let mut input = input();
+    input.publish = Some(true);
+    provider.create_function(input).await.unwrap();
+    let before = provider.get_record("provided-control").unwrap();
+    assert!(matches!(
+        provider
+            .update_function_code(
+                "provided-control",
+                UpdateFunctionCodeInput {
+                    zip_file: Some(package(false)),
+                    ..Default::default()
+                }
+            )
+            .await,
+        Err(LambdaServiceError::InvalidZipFile { .. })
+    ));
+    assert!(matches!(
+        provider.update_function_configuration(
+            "provided-control",
+            &UpdateFunctionConfigurationInput {
+                runtime: Some("python3.13".into()),
+                ..Default::default()
+            }
+        ),
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    let after = provider.get_record("provided-control").unwrap();
+    assert_eq!(before.latest.revision_id, after.latest.revision_id);
+    assert_eq!(before.latest.code_sha256, after.latest.code_sha256);
+    assert_eq!(before.latest.code_path, after.latest.code_path);
+    assert_eq!(before.versions.len(), after.versions.len());
+    assert_eq!(before.latest.runtime, after.latest.runtime);
+    let loaded = provider
+        .store
+        .capture_artifact(after.latest.code_path.as_ref().unwrap())
+        .await
+        .unwrap();
+    assert_eq!(loaded.sha256(), before.latest.code_sha256);
+    assert!(
+        provider
+            .export_snapshot_before(Instant::now() + Duration::from_secs(5))
+            .await
+            .is_err()
+    );
+    provider
+        .shutdown_before(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+
+#[rstest]
+#[case("python3.13", "handler.entry", "arm64")]
+#[case("provided.al2", "handler.entry", "arm64")]
+#[case("provided.al2023", "bad handler", "arm64")]
+#[case("provided.al2023", "handler.entry", "x86_64")]
+#[tokio::test]
+async fn test_should_reject_uninstalled_runtime_handler_or_platform_before_publication(
+    #[case] runtime: &str,
+    #[case] handler: &str,
+    #[case] architecture: &str,
+) {
+    let (_root, provider) = fixture();
+    let mut input = input();
+    input.runtime = Some(runtime.into());
+    input.handler = Some(handler.into());
+    input.architectures = Some(vec![architecture.into()]);
+    assert!(matches!(
+        provider.create_function(input).await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    assert!(provider.get_record("provided-control").is_err());
+    provider
+        .shutdown_before(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+
+#[tokio::test]
+async fn test_should_reject_bootstrap_before_initial_commit_and_wrong_architecture_before_update_staging()
+ {
+    let (_root, provider) = fixture();
+    let mut bad = input();
+    bad.code.zip_file = Some(package(false));
+    assert!(matches!(
+        provider.create_function(bad).await,
+        Err(LambdaServiceError::InvalidZipFile { .. })
+    ));
+    assert!(provider.get_record("provided-control").is_err());
+    provider.create_function(input()).await.unwrap();
+    let before = provider.get_record("provided-control").unwrap();
+    assert!(matches!(
+        provider
+            .update_function_code(
+                "provided-control",
+                UpdateFunctionCodeInput {
+                    zip_file: Some(package(true)),
+                    architectures: Some(vec!["x86_64".into()]),
+                    ..Default::default()
+                }
+            )
+            .await,
+        Err(LambdaServiceError::InvalidParameter { .. })
+    ));
+    assert_eq!(
+        provider
+            .get_record("provided-control")
+            .unwrap()
+            .latest
+            .revision_id,
+        before.latest.revision_id
+    );
+    provider
+        .shutdown_before(Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+}
+
+#[derive(Debug)]
+struct HeldZip {
+    entered: Notify,
+    release: Notify,
+}
+#[async_trait]
+impl S3CodeFetcher for HeldZip {
+    async fn fetch_code(
+        &self,
+        _: &str,
+        _: &str,
+        _: Option<&str>,
+    ) -> Result<Bytes, S3CodeFetchError> {
+        self.entered.notify_one();
+        self.release.notified().await;
+        Ok(Bytes::from(STANDARD.decode(package(true)).unwrap()))
+    }
+}
+
+#[rstest]
+#[case::create(false)]
+#[case::update(true)]
+#[tokio::test]
+async fn test_should_recheck_zip_capability_at_commit_after_held_fetch(#[case] update: bool) {
+    let root = tempfile::tempdir().unwrap();
+    let live = Arc::new(AtomicBool::new(true));
+    let fetch = Arc::new(HeldZip {
+        entered: Notify::new(),
+        release: Notify::new(),
+    });
+    let provider = Arc::new(
+        RustackLambda::with_executor(
+            FunctionStore::new(root.path()),
+            LambdaConfig {
+                executor: ExecutorBackend::Docker,
+                ..Default::default()
+            },
+            Arc::new(ZipControl(live.clone())),
+        )
+        .with_code_fetcher(fetch.clone()),
+    );
+    if update {
+        let mut request = input();
+        request.publish = Some(true);
+        provider.create_function(request).await.unwrap();
+    }
+    let before = provider.get_record("provided-control").ok();
+    let call = provider.clone();
+    let waiting = spawn(async move {
+        if update {
+            call.update_function_code(
+                "provided-control",
+                UpdateFunctionCodeInput {
+                    s3_bucket: Some("test-bucket".into()),
+                    s3_key: Some("test.zip".into()),
+                    publish: Some(true),
+                    ..Default::default()
+                },
+            )
+            .await
+        } else {
+            let mut request = input();
+            request.code = FunctionCode {
+                s3_bucket: Some("test-bucket".into()),
+                s3_key: Some("test.zip".into()),
+                ..Default::default()
+            };
+            call.create_function(request).await
+        }
+    });
+    timeout(Duration::from_secs(5), fetch.entered.notified())
+        .await
+        .unwrap();
+    live.store(false, Ordering::Release);
+    fetch.release.notify_one();
+    let result = timeout(Duration::from_secs(5), waiting)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(matches!(
+        result,
+        Err(LambdaServiceError::DockerNotAvailable)
+    ));
+    if let Some(before) = before {
+        let after = provider.get_record("provided-control").unwrap();
+        assert_eq!(after.latest.revision_id, before.latest.revision_id);
+        assert_eq!(after.latest.code_sha256, before.latest.code_sha256);
+        assert_eq!(after.latest.code_path, before.latest.code_path);
+        assert_eq!(after.versions.len(), before.versions.len());
+    } else {
+        assert!(provider.get_record("provided-control").is_err());
+    }
+}
+
+#[rstest]
+#[case::maximum(128, true)]
+#[case::over_limit(129, false)]
+#[tokio::test]
+async fn test_should_apply_same_handler_byte_bound_to_create_and_configuration(
+    #[case] length: usize,
+    #[case] accepted: bool,
+) {
+    let (_root, provider) = fixture();
+    let mut request = input();
+    request.handler = Some("x".repeat(length));
+    let result = provider.create_function(request).await;
+    assert_eq!(result.is_ok(), accepted);
+    if !accepted {
+        provider.create_function(input()).await.unwrap();
+    }
+    let before = provider.get_record("provided-control").unwrap();
+    let result = provider.update_function_configuration(
+        "provided-control",
+        &UpdateFunctionConfigurationInput {
+            handler: Some("x".repeat(length)),
+            ..Default::default()
+        },
+    );
+    assert_eq!(result.is_ok(), accepted);
+    if !accepted {
+        assert_eq!(
+            provider
+                .get_record("provided-control")
+                .unwrap()
+                .latest
+                .revision_id,
+            before.latest.revision_id
+        );
+    }
+}
diff --git a/crates/rustack-lambda-core/src/resolver.rs b/crates/rustack-lambda-core/src/resolver.rs
index 01afab34..4f9625dc 100644
--- a/crates/rustack-lambda-core/src/resolver.rs
+++ b/crates/rustack-lambda-core/src/resolver.rs
@@ -38,6 +38,10 @@ pub fn resolve_function_ref(
 pub struct FunctionName(String);
 impl FunctionName {
     /// Validate an AWS function name.
+    ///
+    /// # Errors
+    /// Rejects empty names, names above64 bytes or characters outside ASCII letters/digits, hyphen
+    /// and underscore.
     pub fn parse(value: &str) -> Result<Self, LambdaServiceError> {
         if value.is_empty()
             || value.len() > 64
@@ -83,6 +87,9 @@ impl FunctionArn {
 pub struct Qualifier(String);
 impl Qualifier {
     /// Validate a version or alias.
+    ///
+    /// # Errors
+    /// Rejects invalid/oversized aliases and zero or overflowing numeric versions.
     pub fn parse(value: &str) -> Result<Self, LambdaServiceError> {
         if value != "$LATEST"
             && (value.is_empty()
@@ -268,14 +275,14 @@ pub fn layer_version_arn(region: &str, account_id: &str, layer_name: &str, versi
 pub fn parse_layer_version_arn(arn: &str) -> Result<(String, u64), LambdaServiceError> {
     let parts: Vec<&str> = arn.split(':').collect();
     // Expected: arn:aws:lambda:region:account:layer:name:version = 8 parts
-    if parts.len() < 8 || parts[0] != "arn" || parts[2] != "lambda" || parts[5] != "layer" {
+    let ["arn", _, "lambda", _, _, "layer", name, version, ..] = parts.as_slice() else {
         return Err(LambdaServiceError::InvalidArn {
             arn: arn.to_owned(),
         });
-    }
+    };
 
-    let name = parts[6].to_owned();
-    let version: u64 = parts[7]
+    let name = (*name).to_owned();
+    let version: u64 = version
         .parse()
         .map_err(|_| LambdaServiceError::InvalidArn {
             arn: arn.to_owned(),
@@ -304,8 +311,9 @@ mod tests {
             package_type: "Zip".to_owned(),
             code_path: None,
             image_uri: None,
+            image: crate::artifact::ImageArtifact::Unresolved,
             zip_bytes: None,
-            state: "Active".to_owned(),
+            deployment: crate::deployment::DeploymentState::Ready,
             last_modified: "2024-01-01T00:00:00.000+0000".to_owned(),
             architectures: vec!["x86_64".to_owned()],
             ephemeral_storage_size: 512,
@@ -339,6 +347,7 @@ mod tests {
         );
 
         FunctionRecord {
+            resource_id: crate::identity::FunctionResourceId::default(),
             name: "my-func".to_owned(),
             arn: "arn:aws:lambda:us-east-1:000000000000:function:my-func".to_owned(),
             latest: make_version("$LATEST"),
diff --git a/crates/rustack-lambda-core/src/storage.rs b/crates/rustack-lambda-core/src/storage.rs
index a9b392d8..5d5243f5 100644
--- a/crates/rustack-lambda-core/src/storage.rs
+++ b/crates/rustack-lambda-core/src/storage.rs
@@ -6,8 +6,11 @@
 
 use std::{
     collections::{BTreeMap, HashMap},
-    io::ErrorKind,
+    fmt,
+    io::{Error as IoError, ErrorKind, Read},
+    iter::once,
     path::{Path, PathBuf},
+    str::from_utf8,
 };
 
 use base64::{Engine, engine::general_purpose::STANDARD};
@@ -18,9 +21,28 @@ use rustack_lambda_model::types::{
     TracingConfig, VpcConfig,
 };
 use serde::{Deserialize, Serialize};
+use serde_json::Value;
 use sha2::{Digest, Sha256};
+use tokio::{sync::watch, time::Instant};
+use zip::{System, read::ZipFile};
+
+use crate::{
+    artifact::{ImageArtifact, ResolvedImage, ValidatedArtifact},
+    deployment::DeploymentState,
+    error::LambdaServiceError,
+    identity::FunctionResourceId,
+};
 
-use crate::error::LambdaServiceError;
+mod restore;
+mod restore_zip;
+mod snapshot_view;
+mod zip_layout;
+pub(crate) use restore::PreparedImport;
+#[cfg(unix)]
+pub(crate) use restore::{check_deadline as check_restore_deadline, image_error};
+use restore_zip::ZipRestoreBudget;
+pub(crate) use snapshot_view::{FunctionSnapshotRef, LayerSnapshotRef, MappingSnapshotRef};
+pub(crate) use zip_layout::ZipLayout;
 
 /// In-memory store for Lambda functions.
 #[derive(Debug)]
@@ -30,43 +52,58 @@ pub struct FunctionStore {
     /// Root directory for storing extracted code.
     code_dir: PathBuf,
     /// Own completed artifacts until the store is dropped; in-flight revisions remain readable.
-    artifacts: DashMap<PathBuf, Artifact>,
+    artifacts: DashMap<PathBuf, ValidatedArtifact>,
     staging: std::sync::Arc<tokio::sync::Semaphore>,
+    changes: watch::Sender<()>,
 }
 
-/// Owns a completed artifact and its resolved filesystem boundary.
-#[derive(Debug)]
-struct Artifact {
-    directory: Option<tempfile::TempDir>,
-    root: PathBuf,
-    extracted: PathBuf,
+/// Rolls back a newly registered artifact unless its record mutation commits.
+pub(crate) struct StagedArtifact<'a> {
+    store: &'a FunctionStore,
+    artifact: ValidatedArtifact,
+    committed: bool,
 }
 
-impl Drop for Artifact {
-    #[allow(clippy::disallowed_methods)] // Drop has no async context; cleanup is bounded to a store-owned directory and failures are reported.
-    fn drop(&mut self) {
-        let Some(directory) = self.directory.take() else {
-            return;
-        };
-        let path = directory.keep();
-        let safe = std::fs::canonicalize(&self.root).is_ok_and(|root| root == self.root)
-            && std::fs::symlink_metadata(&self.root)
-                .is_ok_and(|meta| meta.is_dir() && !meta.file_type().is_symlink())
-            && std::fs::symlink_metadata(&path)
-                .is_ok_and(|meta| meta.is_dir() && !meta.file_type().is_symlink());
-        if !safe {
-            tracing::error!("Refusing cleanup of replaced Lambda artifact root");
-            return;
+impl fmt::Debug for StagedArtifact<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("StagedArtifact")
+            .field("artifact", &self.artifact)
+            .field("committed", &self.committed)
+            .finish()
+    }
+}
+
+impl<'a> StagedArtifact<'a> {
+    fn new(store: &'a FunctionStore, artifact: ValidatedArtifact) -> Self {
+        Self {
+            store,
+            artifact,
+            committed: false,
         }
-        if let Err(error) = std::fs::remove_dir_all(path) {
-            tracing::error!(%error, "Lambda artifact cleanup failed");
+    }
+    pub(crate) fn artifact(&self) -> &ValidatedArtifact {
+        &self.artifact
+    }
+    pub(crate) fn commit(mut self) {
+        self.committed = true;
+    }
+}
+
+impl Drop for StagedArtifact<'_> {
+    fn drop(&mut self) {
+        if !self.committed {
+            self.store
+                .discard_staged_artifact(self.artifact.code_root());
         }
     }
 }
 
 /// Complete record for a Lambda function.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
 pub struct FunctionRecord {
+    /// Stable identity for this resource's lifetime, independent of its name.
+    pub resource_id: FunctionResourceId,
     /// Function name.
     pub name: String,
     /// Function ARN.
@@ -114,7 +151,8 @@ pub struct EventInvokeConfigRecord {
 }
 
 /// A snapshot of function configuration at a specific version.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
 pub struct VersionRecord {
     /// Version string (`$LATEST` or a numeric string like `"1"`).
     pub version: String,
@@ -135,13 +173,19 @@ pub struct VersionRecord {
     /// Package type (`Zip` or `Image`).
     pub package_type: String,
     /// Path to extracted code on disk.
+    #[serde(skip_serializing)]
     pub code_path: Option<PathBuf>,
     /// Container image URI.
     pub image_uri: Option<String>,
+    /// Unresolved, restored metadata, or shared live image availability.
+    #[serde(rename = "resolvedImage", serialize_with = "snapshot_view::image")]
+    pub image: ImageArtifact,
     /// Raw zip bytes.
+    #[serde(rename = "zipBytesBase64", serialize_with = "snapshot_view::zip")]
     pub zip_bytes: Option<Bytes>,
-    /// Function state (`Active`, `Pending`, etc.).
-    pub state: String,
+    /// Authoritative readiness and update progress.
+    #[serde(flatten, serialize_with = "snapshot_view::deployment")]
+    pub deployment: DeploymentState,
     /// ISO 8601 last-modified timestamp.
     pub last_modified: String,
     /// Supported architectures.
@@ -166,7 +210,7 @@ pub struct VersionRecord {
     pub image_config: Option<ImageConfig>,
     /// Logging configuration.
     pub logging_config: Option<LoggingConfig>,
-    /// SnapStart configuration.
+    /// `SnapStart` configuration.
     pub snap_start: Option<SnapStart>,
 }
 
@@ -212,6 +256,21 @@ pub struct PolicyStatement {
     pub condition: Option<serde_json::Value>,
 }
 
+impl Drop for PolicyStatement {
+    fn drop(&mut self) {
+        // A rejected or unpolled import still owns hostile dynamic conditions.
+        // Move children out before their containers drop; never recurse on depth.
+        let mut pending: Vec<_> = self.condition.take().into_iter().collect();
+        while let Some(value) = pending.pop() {
+            match value {
+                Value::Array(mut children) => pending.append(&mut children),
+                Value::Object(children) => pending.extend(children.into_values()),
+                _ => {}
+            }
+        }
+    }
+}
+
 /// Function URL configuration record.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -438,7 +497,7 @@ pub struct LayerStoreSnapshot {
 pub struct EventSourceMappingRecord {
     /// Unique identifier for the mapping.
     pub uuid: String,
-    /// ARN of the event source (e.g., SQS queue, DynamoDB stream).
+    /// ARN of the event source (e.g., SQS queue, `DynamoDB` stream).
     pub event_source_arn: String,
     /// ARN of the target Lambda function.
     pub function_arn: String,
@@ -601,6 +660,9 @@ pub struct FunctionStoreSnapshot {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct FunctionRecordSnapshot {
+    /// Stable identity; older snapshots allocate one when first decoded.
+    #[serde(default)]
+    pub resource_id: FunctionResourceId,
     /// Function name.
     pub name: String,
     /// Function ARN.
@@ -653,10 +715,16 @@ pub struct VersionRecordSnapshot {
     pub package_type: String,
     /// Container image URI.
     pub image_uri: Option<String>,
+    /// Immutable image identity; older metadata-only snapshots have none.
+    #[serde(default)]
+    pub resolved_image: Option<ResolvedImage>,
     /// Raw zip bytes encoded as standard base64.
     pub zip_bytes_base64: Option<String>,
-    /// Function state.
+    /// Legacy function state, derived from deployment on new exports.
     pub state: String,
+    /// Authoritative deployment state in current snapshots.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub deployment: Option<DeploymentState>,
     /// ISO 8601 last-modified timestamp.
     pub last_modified: String,
     /// Supported architectures.
@@ -681,13 +749,14 @@ pub struct VersionRecordSnapshot {
     pub image_config: Option<ImageConfig>,
     /// Logging configuration.
     pub logging_config: Option<LoggingConfig>,
-    /// SnapStart configuration.
+    /// `SnapStart` configuration.
     pub snap_start: Option<SnapStart>,
 }
 
 impl FunctionRecordSnapshot {
     fn from_record(record: FunctionRecord) -> Self {
         Self {
+            resource_id: record.resource_id,
             name: record.name,
             arn: record.arn,
             latest: VersionRecordSnapshot::from_record(record.latest),
@@ -708,31 +777,42 @@ impl FunctionRecordSnapshot {
         }
     }
 
-    async fn into_record(
+    async fn into_record<'a>(
         self,
-        store: &FunctionStore,
-    ) -> Result<FunctionRecord, LambdaServiceError> {
+        store: &'a FunctionStore,
+        mut zip: Option<&mut ZipRestoreBudget>,
+    ) -> Result<(FunctionRecord, Vec<StagedArtifact<'a>>), LambdaServiceError> {
         let name = self.name;
-        let latest = self.latest.into_record(store, &name).await?;
+        let (latest, pending) = self
+            .latest
+            .into_record(store, &name, zip.as_deref_mut())
+            .await?;
+        let mut artifacts: Vec<_> = pending.into_iter().collect();
         let mut versions = BTreeMap::new();
         for (version, record) in self.versions {
-            versions.insert(version, record.into_record(store, &name).await?);
+            let (record, artifact) = record.into_record(store, &name, zip.as_deref_mut()).await?;
+            artifacts.extend(artifact);
+            versions.insert(version, record);
         }
-        Ok(FunctionRecord {
-            name,
-            arn: self.arn,
-            latest,
-            versions,
-            next_version: self.next_version,
-            aliases: self.aliases,
-            policy: self.policy,
-            tags: self.tags,
-            code_signing_config_arn: self.code_signing_config_arn,
-            url_config: self.url_config,
-            reserved_concurrent_executions: self.reserved_concurrent_executions,
-            event_invoke_configs: self.event_invoke_configs,
-            created_at: self.created_at,
-        })
+        Ok((
+            FunctionRecord {
+                resource_id: self.resource_id,
+                name,
+                arn: self.arn,
+                latest,
+                versions,
+                next_version: self.next_version,
+                aliases: self.aliases,
+                policy: self.policy,
+                tags: self.tags,
+                code_signing_config_arn: self.code_signing_config_arn,
+                url_config: self.url_config,
+                reserved_concurrent_executions: self.reserved_concurrent_executions,
+                event_invoke_configs: self.event_invoke_configs,
+                created_at: self.created_at,
+            },
+            artifacts,
+        ))
     }
 }
 
@@ -749,11 +829,13 @@ impl VersionRecordSnapshot {
             environment: record.environment,
             package_type: record.package_type,
             image_uri: record.image_uri,
+            resolved_image: record.image.resolved().cloned(),
             zip_bytes_base64: record
                 .zip_bytes
                 .as_ref()
                 .map(|bytes| STANDARD.encode(bytes.as_ref())),
-            state: record.state,
+            state: record.deployment.state().into(),
+            deployment: Some(record.deployment),
             last_modified: record.last_modified,
             architectures: record.architectures,
             ephemeral_storage_size: record.ephemeral_storage_size,
@@ -770,63 +852,86 @@ impl VersionRecordSnapshot {
         }
     }
 
-    async fn into_record(
+    async fn into_record<'a>(
         self,
-        store: &FunctionStore,
+        store: &'a FunctionStore,
         function_name: &str,
-    ) -> Result<VersionRecord, LambdaServiceError> {
-        let zip_bytes = match self.zip_bytes_base64 {
-            Some(encoded) => {
-                let decoded = STANDARD.decode(encoded.as_bytes()).map_err(|source| {
+        mut zip: Option<&mut ZipRestoreBudget>,
+    ) -> Result<(VersionRecord, Option<StagedArtifact<'a>>), LambdaServiceError> {
+        crate::function_config::validate_snapshot_settings(&self)?;
+        if let Some(budget) = zip.as_deref() {
+            budget.check()?;
+        }
+        let (zip_bytes, artifact) = match (self.zip_bytes_base64, zip.as_deref_mut()) {
+            (Some(encoded), Some(budget)) => {
+                let staged = budget.stage(store, encoded).await?;
+                (Some(staged.artifact().zip_bytes().clone()), Some(staged))
+            }
+            (Some(encoded), None) => {
+                let bytes = Bytes::from(STANDARD.decode(encoded.as_bytes()).map_err(|source| {
                     LambdaServiceError::Internal {
                         message: format!("Failed to decode Lambda zip bytes: {source}"),
                     }
-                })?;
-                Some(Bytes::from(decoded))
+                })?);
+                let staged = store
+                    .stage_zip_code(function_name, &self.version, &bytes)
+                    .await?;
+                (Some(bytes), Some(staged))
             }
-            None => None,
+            (None, _) => (None, None),
         };
-        let code_path = if let Some(bytes) = zip_bytes.as_ref() {
-            let (path, _, _) = store
-                .store_zip_code(function_name, &self.version, bytes.as_ref())
-                .await?;
-            Some(path)
-        } else {
-            None
-        };
-
-        Ok(VersionRecord {
-            version: self.version,
-            runtime: self.runtime,
-            handler: self.handler,
-            role: self.role,
-            description: self.description,
-            timeout: self.timeout,
-            memory_size: self.memory_size,
-            environment: self.environment,
-            package_type: self.package_type,
-            code_path,
-            image_uri: self.image_uri,
-            zip_bytes,
-            state: self.state,
-            last_modified: self.last_modified,
-            architectures: self.architectures,
-            ephemeral_storage_size: self.ephemeral_storage_size,
-            code_sha256: self.code_sha256,
-            code_size: self.code_size,
-            revision_id: self.revision_id,
-            layers: self.layers,
-            vpc_config: self.vpc_config,
-            dead_letter_config: self.dead_letter_config,
-            tracing_config: self.tracing_config,
-            image_config: self.image_config,
-            logging_config: self.logging_config,
-            snap_start: self.snap_start,
-        })
+        if let Some(budget) = zip {
+            budget.check()?;
+        }
+        let code_path = artifact
+            .as_ref()
+            .map(|artifact| artifact.artifact().code_root().to_path_buf());
+
+        Ok((
+            VersionRecord {
+                version: self.version,
+                runtime: self.runtime,
+                handler: self.handler,
+                role: self.role,
+                description: self.description,
+                timeout: self.timeout,
+                memory_size: self.memory_size,
+                environment: self.environment,
+                package_type: self.package_type,
+                code_path,
+                image_uri: self.image_uri,
+                image: self
+                    .resolved_image
+                    .map_or(ImageArtifact::Unresolved, ImageArtifact::Restored),
+                zip_bytes,
+                deployment: DeploymentState::restore(&self.state, self.deployment)?,
+                last_modified: self.last_modified,
+                architectures: self.architectures,
+                ephemeral_storage_size: self.ephemeral_storage_size,
+                code_sha256: self.code_sha256,
+                code_size: self.code_size,
+                revision_id: self.revision_id,
+                layers: self.layers,
+                vpc_config: self.vpc_config,
+                dead_letter_config: self.dead_letter_config,
+                tracing_config: self.tracing_config,
+                image_config: self.image_config,
+                logging_config: self.logging_config,
+                snap_start: self.snap_start,
+            },
+            artifact,
+        ))
     }
 }
 
 impl FunctionStore {
+    /// Inspect image availability without cloning stored metadata or following tags.
+    pub(crate) fn has_unleased_images(&self) -> bool {
+        self.functions.iter().any(|record| {
+            once(&record.latest).chain(record.versions.values())
+                .any(|version| version.package_type == "Image" && version.deployment.state() == "Active" && !matches!(&version.image, ImageArtifact::Pinned(image) if image.is_live()))
+        })
+    }
     fn validate_record(&self, record: &FunctionRecord) -> Result<(), LambdaServiceError> {
         let invalid = |message: &str| LambdaServiceError::InvalidParameter {
             message: message.into(),
@@ -851,7 +956,11 @@ impl FunctionStore {
             return Err(invalid("Invalid function version or concurrency"));
         }
         for (number, version) in &record.versions {
-            if *number == 0 || version.version != number.to_string() {
+            if *number == 0
+                || version.version != number.to_string()
+                || version.deployment != DeploymentState::Ready
+                || (version.package_type == "Image" && version.image.resolved().is_none())
+            {
                 return Err(invalid("Published version number mismatch"));
             }
         }
@@ -868,34 +977,27 @@ impl FunctionStore {
                 return Err(invalid("Event qualifier mismatch"));
             }
         }
-        for version in std::iter::once(&record.latest).chain(record.versions.values()) {
+        for version in once(&record.latest).chain(record.versions.values()) {
             crate::resolver::Qualifier::parse(&version.version)?;
-            if !(1..=900).contains(&version.timeout)
-                || !(128..=10240).contains(&version.memory_size)
-                || version.architectures.len() != 1
-                || version
-                    .architectures
-                    .iter()
-                    .any(|architecture| architecture != "arm64" && architecture != "x86_64")
-                || version.environment.len() > 128
-                || version
-                    .environment
-                    .iter()
-                    .any(|(key, value)| key.len() > 256 || value.len() > 4096)
-            {
-                return Err(invalid("Invalid execution configuration"));
-            }
+            crate::function_config::validate_execution_settings(version)?;
             if let Some(path) = &version.code_path {
-                if !self.artifacts.contains_key(path) {
-                    return Err(invalid("Code path is not an owned immutable artifact"));
-                }
-            }
-            if let Some(bytes) = &version.zip_bytes {
-                if version.code_sha256 != compute_sha256(bytes)
-                    || version.code_size != bytes.len() as u64
+                let artifact = self
+                    .artifacts
+                    .get(path)
+                    .ok_or_else(|| invalid("Code path is not an owned immutable artifact"))?;
+                let zip_matches = version.zip_bytes.as_ref().is_some_and(|bytes| {
+                    bytes.len() == artifact.zip_bytes().len()
+                        && (bytes.as_ptr() == artifact.zip_bytes().as_ptr()
+                            || bytes == artifact.zip_bytes())
+                });
+                if !zip_matches
+                    || version.code_sha256 != artifact.sha256()
+                    || version.code_size != artifact.zip_bytes().len() as u64
                 {
                     return Err(invalid("Deployment package metadata mismatch"));
                 }
+            } else if version.zip_bytes.is_some() {
+                return Err(invalid("ZIP bytes have no owned extracted artifact"));
             }
         }
         Ok(())
@@ -908,9 +1010,15 @@ impl FunctionStore {
             code_dir: code_dir.into(),
             artifacts: DashMap::new(),
             staging: std::sync::Arc::new(tokio::sync::Semaphore::new(4)),
+            changes: watch::channel(()).0,
         }
     }
 
+    #[cfg(unix)]
+    pub(crate) fn changes(&self) -> watch::Receiver<()> {
+        self.changes.subscribe()
+    }
+
     /// Returns a reference to the code directory path.
     #[must_use]
     pub fn code_dir(&self) -> &Path {
@@ -931,18 +1039,27 @@ impl FunctionStore {
             }),
             Entry::Vacant(entry) => {
                 entry.insert(record);
+                self.changes.send_replace(());
                 Ok(())
             }
         }
     }
 
     /// Get a clone of a function record by name.
+    ///
+    /// # Errors
+    ///
+    /// Rejects an invalid logical function name; an absent valid name returns `None`.
     pub fn get(&self, name: &str) -> Result<Option<FunctionRecord>, LambdaServiceError> {
         crate::resolver::FunctionName::parse(name)?;
         Ok(self.functions.get(name).map(|r| r.value().clone()))
     }
 
     /// Check whether a function exists.
+    ///
+    /// # Errors
+    ///
+    /// Rejects an invalid logical function name.
     pub fn contains(&self, name: &str) -> Result<bool, LambdaServiceError> {
         crate::resolver::FunctionName::parse(name)?;
         Ok(self.functions.contains_key(name))
@@ -974,6 +1091,32 @@ impl FunctionStore {
     ) -> Result<R, LambdaServiceError>
     where
         F: FnOnce(&mut FunctionRecord) -> R,
+    {
+        self.try_update_if_revision(name, expected, |record| Ok(f(record)))
+    }
+
+    /// Apply a fallible mutation to a private candidate and commit only on success.
+    ///
+    /// # Errors
+    /// Rejects stale revisions, invalid records, missing functions or closure failures;
+    /// a closure error leaves all live metadata unchanged.
+    ///
+    /// ```no_run
+    /// # fn update(store: &rustack_lambda_core::storage::FunctionStore) -> Result<(), rustack_lambda_core::error::LambdaServiceError> {
+    /// store.try_update_if_revision("worker", None, |record| {
+    ///     record.latest.description = "updated".into();
+    ///     Ok(())
+    /// })?;
+    /// # Ok(()) }
+    /// ```
+    pub fn try_update_if_revision<F, R>(
+        &self,
+        name: &str,
+        expected: Option<&str>,
+        f: F,
+    ) -> Result<R, LambdaServiceError>
+    where
+        F: FnOnce(&mut FunctionRecord) -> Result<R, LambdaServiceError>,
     {
         crate::resolver::FunctionName::parse(name)?;
         match self.functions.get_mut(name) {
@@ -984,14 +1127,15 @@ impl FunctionStore {
                     });
                 }
                 let mut candidate = entry.value().clone();
-                let result = f(&mut candidate);
-                if candidate.name != name {
+                let result = f(&mut candidate)?;
+                if candidate.name != name || candidate.resource_id != entry.resource_id {
                     return Err(LambdaServiceError::InvalidParameter {
                         message: "Function identity is immutable".into(),
                     });
                 }
                 self.validate_record(&candidate)?;
                 *entry = candidate;
+                self.changes.send_replace(());
                 Ok(result)
             }
             None => Err(LambdaServiceError::FunctionNotFound {
@@ -1003,9 +1147,17 @@ impl FunctionStore {
     /// Remove a function from the store.
     ///
     /// Returns the removed record, or `None` if it did not exist.
+    ///
+    /// # Errors
+    ///
+    /// Rejects an invalid logical function name before changing the store.
     pub fn remove(&self, name: &str) -> Result<Option<FunctionRecord>, LambdaServiceError> {
         crate::resolver::FunctionName::parse(name)?;
-        Ok(self.functions.remove(name).map(|(_, v)| v))
+        let removed = self.functions.remove(name).map(|(_, v)| v);
+        if removed.is_some() {
+            self.changes.send_replace(());
+        }
+        Ok(removed)
     }
 
     /// List all function records.
@@ -1052,32 +1204,7 @@ impl FunctionStore {
         &self,
         snapshot: FunctionStoreSnapshot,
     ) -> Result<(), LambdaServiceError> {
-        self.validate_root().await?;
-        let mut staged = BTreeMap::new();
-        for function in snapshot.functions {
-            crate::resolver::FunctionName::parse(&function.name)?;
-            let (name, qualifier) = crate::resolver::resolve_function_ref(&function.arn)?;
-            if name != function.name || qualifier.is_some() {
-                return Err(LambdaServiceError::InvalidParameter {
-                    message: "Snapshot function ARN mismatch".into(),
-                });
-            }
-            for (alias, record) in &function.aliases {
-                crate::resolver::Qualifier::parse(alias)?;
-                crate::resolver::Qualifier::parse(&record.function_version)?;
-            }
-            let record = function.into_record(self).await?;
-            self.validate_record(&record)?;
-            if staged.insert(record.name.clone(), record).is_some() {
-                return Err(LambdaServiceError::InvalidParameter {
-                    message: "Duplicate snapshot function".into(),
-                });
-            }
-        }
-        self.functions.clear();
-        for (name, record) in staged {
-            self.functions.insert(name, record);
-        }
+        self.prepare_snapshot(snapshot).await?.commit();
         Ok(())
     }
 
@@ -1102,7 +1229,7 @@ impl FunctionStore {
         &self,
         function_name: &str,
         version: &str,
-        zip_bytes: &[u8],
+        zip_bytes: &Bytes,
     ) -> Result<(PathBuf, String, u64), LambdaServiceError> {
         crate::resolver::FunctionName::parse(function_name)?;
         crate::resolver::Qualifier::parse(version)?;
@@ -1118,10 +1245,10 @@ impl FunctionStore {
                 message: "ZIP staging capacity exhausted".into(),
             })?;
         let root = self.code_dir.clone();
-        let bytes_owned = zip_bytes.to_vec();
+        let bytes_owned = zip_bytes.clone();
         let task = tokio::task::spawn_blocking(move || {
             let _permit = permit;
-            stage_zip(&root, &bytes_owned)
+            stage_zip(&root, bytes_owned)
         });
         let artifact = tokio::time::timeout(std::time::Duration::from_secs(30), task)
             .await
@@ -1131,31 +1258,62 @@ impl FunctionStore {
             .map_err(|e| LambdaServiceError::Internal {
                 message: format!("ZIP extraction task failed: {e}"),
             })??;
-        let extracted = artifact.extracted.clone();
+        let extracted = artifact.code_root().to_path_buf();
+        let sha256 = artifact.sha256().to_owned();
+        let code_size = artifact.zip_bytes().len() as u64;
         self.artifacts.insert(extracted.clone(), artifact);
 
-        let sha256 = compute_sha256(zip_bytes);
-        let code_size = zip_bytes.len() as u64;
-
         Ok((extracted, sha256, code_size))
     }
 
+    pub(crate) async fn stage_zip_code(
+        &self,
+        function_name: &str,
+        version: &str,
+        bytes: &Bytes,
+    ) -> Result<StagedArtifact<'_>, LambdaServiceError> {
+        let (path, _, _) = self.store_zip_code(function_name, version, bytes).await?;
+        let artifact = self
+            .artifacts
+            .get(&path)
+            .map(|artifact| artifact.value().clone())
+            .ok_or_else(|| LambdaServiceError::Internal {
+                message: "Newly staged artifact is missing".into(),
+            })?;
+        Ok(StagedArtifact::new(self, artifact))
+    }
+
+    fn discard_staged_artifact(&self, path: &Path) {
+        self.artifacts.remove(path);
+    }
+
     /// Validate logical retirement of a function's code.
     ///
     /// Immutable artifacts are retained until store drop so published/in-flight
     /// references remain valid. No name-derived directory is ever deleted.
+    ///
+    /// # Errors
+    ///
+    /// Rejects an invalid function name, a symlink/non-directory artifact root, or
+    /// filesystem inspection failures.
     pub async fn cleanup_code(&self, function_name: &str) -> Result<(), LambdaServiceError> {
         crate::resolver::FunctionName::parse(function_name)?;
         self.validate_root().await
     }
 
     /// Check an immutable artifact before handing it to an executor.
+    ///
+    /// # Errors
+    ///
+    /// Rejects unowned artifacts, replaced roots, symlinked artifact components/bootstrap,
+    /// paths outside the root, or filesystem inspection/canonicalization failures.
+    /// An absent bootstrap is accepted here; execution performs its own readiness check.
     pub async fn validate_artifact(&self, path: &Path) -> Result<(), LambdaServiceError> {
         self.validate_root().await?;
         let owned_root = self
             .artifacts
             .get(path)
-            .map(|artifact| artifact.root.clone())
+            .map(|artifact| artifact.storage_root().to_path_buf())
             .ok_or_else(|| LambdaServiceError::InvalidParameter {
                 message: "Unowned Lambda artifact".into(),
             })?;
@@ -1213,7 +1371,44 @@ impl FunctionStore {
         }
     }
 
+    /// Issue a shared artifact lease after bounded ownership/filesystem validation.
+    ///
+    /// # Errors
+    /// Rejects unowned or replaced paths, filesystem failures and validation timeout.
+    ///
+    /// ```no_run
+    /// # async fn capture(store: &rustack_lambda_core::storage::FunctionStore, path: &std::path::Path)
+    /// # -> Result<(), rustack_lambda_core::error::LambdaServiceError> {
+    /// let artifact = store.capture_artifact(path).await?;
+    /// assert_eq!(artifact.code_root(), path);
+    /// # Ok(()) }
+    /// ```
+    pub async fn capture_artifact(
+        &self,
+        path: &Path,
+    ) -> Result<ValidatedArtifact, LambdaServiceError> {
+        tokio::time::timeout(
+            std::time::Duration::from_secs(30),
+            self.validate_artifact(path),
+        )
+        .await
+        .map_err(|_| LambdaServiceError::ResourceNotReady {
+            message: "Artifact validation deadline exceeded".into(),
+        })??;
+        self.artifacts
+            .get(path)
+            .map(|artifact| artifact.value().clone())
+            .ok_or_else(|| LambdaServiceError::InvalidParameter {
+                message: "Unowned Lambda artifact".into(),
+            })
+    }
+
     /// Reject a symlink at the operator-selected artifact root.
+    ///
+    /// # Errors
+    ///
+    /// Rejects a symlink/non-directory root or filesystem inspection errors; an absent
+    /// root is valid before first staging.
     pub async fn validate_root(&self) -> Result<(), LambdaServiceError> {
         match tokio::fs::symlink_metadata(&self.code_dir).await {
             Ok(meta) if meta.file_type().is_symlink() || !meta.is_dir() => {
@@ -1231,8 +1426,22 @@ impl FunctionStore {
 }
 
 /// Stage a package in a freshly created private directory on a blocking worker.
-#[allow(clippy::disallowed_methods, clippy::disallowed_types)] // Synchronous filesystem work is isolated to spawn_blocking.
-fn stage_zip(root: &Path, bytes: &[u8]) -> Result<Artifact, LambdaServiceError> {
+pub(crate) fn stage_zip(
+    root: &Path,
+    bytes: Bytes,
+) -> Result<ValidatedArtifact, LambdaServiceError> {
+    stage_zip_before(root, bytes, MAX_EXTRACTED_SIZE, None)
+}
+
+/// Blocking staging retains only private artifact state, never store publication.
+#[allow(clippy::disallowed_methods, clippy::disallowed_types)] // Called only in spawn_blocking, as the original staging boundary.
+fn stage_zip_before(
+    root: &Path,
+    bytes: Bytes,
+    max_extracted: u64,
+    deadline: Option<Instant>,
+) -> Result<ValidatedArtifact, LambdaServiceError> {
+    restore_zip::check(deadline)?;
     let io_error = |source| LambdaServiceError::ArtifactIo { source };
     std::fs::create_dir_all(root).map_err(io_error)?;
     if std::fs::symlink_metadata(root)
@@ -1252,23 +1461,21 @@ fn stage_zip(root: &Path, bytes: &[u8]) -> Result<Artifact, LambdaServiceError>
     let extracted = artifact.path().join("extracted");
     let result = (|| {
         std::fs::create_dir(&extracted).map_err(io_error)?;
-        std::fs::write(artifact.path().join("code.zip"), bytes).map_err(io_error)?;
-        extract_zip(bytes, &extracted, MAX_EXTRACTED_SIZE)
+        std::fs::write(artifact.path().join("code.zip"), &bytes).map_err(io_error)?;
+        extract_zip(&bytes, &extracted, max_extracted, deadline)
     })();
     if let Err(error) = result {
         artifact.close().map_err(io_error)?;
         return Err(error);
     }
-    Ok(Artifact {
-        directory: Some(artifact),
-        root,
-        extracted,
-    })
+    Ok(ValidatedArtifact::from_staged(
+        artifact, root, extracted, bytes,
+    ))
 }
 
 /// Maximum extracted deployment package size (250 MB, mirroring the AWS
 /// unzipped-package limit). Bounds zip-bomb expansion during extraction.
-const MAX_EXTRACTED_SIZE: u64 = 250 * 1024 * 1024;
+pub(crate) const MAX_EXTRACTED_SIZE: u64 = 250 * 1024 * 1024;
 
 /// Extract a zip archive into `target`, preserving unix file modes.
 ///
@@ -1276,7 +1483,7 @@ const MAX_EXTRACTED_SIZE: u64 = 250 * 1024 * 1024;
 /// and archives whose entries would expand beyond [`MAX_EXTRACTED_SIZE`]
 /// (zip bombs). ZIP and filesystem failures are always returned to the caller.
 ///
-/// Synchronous std::fs is intentional: this runs inside `spawn_blocking` and
+/// Synchronous `std::fs` is intentional: this runs inside `spawn_blocking` and
 /// the `zip` crate's reader API is itself blocking, so wrapping each I/O in
 /// tokio would only add overhead.
 #[allow(clippy::disallowed_methods, clippy::disallowed_types)]
@@ -1284,6 +1491,7 @@ fn extract_zip(
     zip_bytes: &[u8],
     target: &Path,
     max_extracted: u64,
+    deadline: Option<Instant>,
 ) -> Result<(), LambdaServiceError> {
     use std::{
         fs::{self, File},
@@ -1296,44 +1504,36 @@ fn extract_zip(
             message: format!("not a valid zip archive: {e}"),
         })?;
 
+    if archive.has_duplicate_names() {
+        return Err(LambdaServiceError::InvalidZipFile {
+            message: "Duplicate ZIP entry".into(),
+        });
+    }
     if archive.len() > 10_000 {
         return Err(LambdaServiceError::InvalidZipFile {
             message: "Too many ZIP entries".into(),
         });
     }
-    let mut paths = std::collections::HashSet::new();
+    let mut layout = ZipLayout::default();
     let mut extracted_total: u64 = 0;
     for i in 0..archive.len() {
+        restore_zip::check(deadline)?;
         let mut entry = archive
             .by_index(i)
             .map_err(|e| LambdaServiceError::InvalidZipFile {
                 message: format!("zip entry {i}: {e}"),
             })?;
-        let Some(rel) = entry.enclosed_name() else {
-            return Err(LambdaServiceError::InvalidZipFile {
-                message: format!("zip entry has invalid path: {}", entry.name()),
-            });
-        };
-        if entry.name().len() > 1024
-            || entry.name().contains('\\')
-            || entry.name().split('/').any(|component| component == "..")
-            || entry
-                .unix_mode()
-                .is_some_and(|mode| mode & 0o170_000 == 0o120_000 || mode & 0o7000 != 0)
-            || !paths.insert(rel.clone())
-        {
-            return Err(LambdaServiceError::InvalidZipFile {
-                message: "Unsafe or duplicate ZIP entry".into(),
-            });
-        }
+        let rel = validated_zip_path(&entry)?;
+        layout.admit(&rel, entry.is_dir())?;
         let out_path = target.join(&rel);
         // Defense in depth: ensure the resolved path stays within target.
         if !out_path.starts_with(target) {
             return Err(LambdaServiceError::InvalidZipFile {
-                message: format!("zip entry escapes extraction root: {}", entry.name()),
+                message: "ZIP entry escapes extraction root".into(),
             });
         }
         if entry.is_dir() {
+            validate_zip_directory(&mut entry)?;
             fs::create_dir_all(&out_path).map_err(|e| LambdaServiceError::Internal {
                 message: format!("create dir {}: {e}", out_path.display()),
             })?;
@@ -1344,10 +1544,7 @@ fn extract_zip(
         let remaining = max_extracted.saturating_sub(extracted_total);
         if entry.size() > remaining {
             return Err(LambdaServiceError::InvalidZipFile {
-                message: format!(
-                    "zip archive expands beyond {max_extracted} bytes (entry: {})",
-                    entry.name(),
-                ),
+                message: format!("ZIP archive expands beyond {max_extracted} bytes"),
             });
         }
         if let Some(parent) = out_path.parent() {
@@ -1357,19 +1554,9 @@ fn extract_zip(
         }
         let mut out = File::create_new(&out_path)
             .map_err(|source| LambdaServiceError::ArtifactIo { source })?;
-        let copied = io::copy(
-            &mut (&mut entry).take(remaining.saturating_add(1)),
-            &mut out,
-        )
-        .map_err(|source| {
-            if source.kind() == ErrorKind::InvalidData {
-                LambdaServiceError::InvalidZipFile {
-                    message: format!("ZIP CRC/decompression failed: {source}"),
-                }
-            } else {
-                LambdaServiceError::ArtifactIo { source }
-            }
-        })?;
+        let copied =
+            io::copy(&mut (&mut entry).take(remaining), &mut out).map_err(zip_read_error)?;
+        verify_zip_entry(&mut entry, copied)?;
         extracted_total = extracted_total.saturating_add(copied);
         if extracted_total > max_extracted {
             return Err(LambdaServiceError::InvalidZipFile {
@@ -1392,6 +1579,78 @@ fn extract_zip(
     Ok(())
 }
 
+/// Probe EOF/CRC without writing beyond the charged expansion allowance.
+fn verify_zip_entry<R: Read + ?Sized>(
+    entry: &mut ZipFile<'_, R>,
+    copied: u64,
+) -> Result<(), LambdaServiceError> {
+    let mut overflow = [0_u8];
+    if entry.read(&mut overflow).map_err(zip_read_error)? != 0 || copied != entry.size() {
+        return Err(LambdaServiceError::InvalidZipFile {
+            message: "ZIP size/decompression mismatch".into(),
+        });
+    }
+    Ok(())
+}
+fn zip_read_error(source: IoError) -> LambdaServiceError {
+    if source.kind() == ErrorKind::InvalidData {
+        LambdaServiceError::InvalidZipFile {
+            message: "ZIP CRC/decompression failed".into(),
+        }
+    } else {
+        LambdaServiceError::ArtifactIo { source }
+    }
+}
+
+/// Require positive compressed-stream EOF for a metadata-validated directory.
+pub(crate) fn validate_zip_directory<R: Read + ?Sized>(
+    entry: &mut ZipFile<'_, R>,
+) -> Result<(), LambdaServiceError> {
+    let mut byte = [0];
+    match entry.read(&mut byte) {
+        Ok(0) => Ok(()),
+        _ => Err(LambdaServiceError::InvalidZipFile {
+            message: "Invalid ZIP directory stream".into(),
+        }),
+    }
+}
+
+/// Check original names and attributes before ZIP9 normalizes decoded metadata.
+pub(crate) fn validated_zip_path<R: Read + ?Sized>(
+    entry: &ZipFile<'_, R>,
+) -> Result<PathBuf, LambdaServiceError> {
+    let invalid = || LambdaServiceError::InvalidZipFile {
+        message: "Unsafe ZIP entry name or attributes".into(),
+    };
+    let raw_name = entry.name_raw();
+    if raw_name.len() > 1024
+        || (entry.flags().as_u16() & (1 << 11) != 0 && from_utf8(raw_name).is_err())
+    {
+        return Err(invalid());
+    }
+    let name = entry.name().map_err(|_| invalid())?;
+    let mode = if entry.system() == System::Dos {
+        0
+    } else {
+        entry.external_attributes() >> 16
+    };
+    if name.len() > 1024
+        || name.starts_with('/')
+        || name.as_bytes().get(1) == Some(&b':')
+        || name.contains('\0')
+        || name.contains('\\')
+        || name.split('/').any(|component| component == "..")
+        || !matches!(mode & 0o170_000, 0 | 0o100_000 | 0o040_000)
+        || (mode & 0o170_000 == 0o040_000 && !entry.is_dir())
+        || (mode & 0o170_000 == 0o100_000 && entry.is_dir())
+        || mode & 0o7000 != 0
+        || (entry.is_dir() && (entry.size() != 0 || entry.crc32() != 0))
+    {
+        return Err(invalid());
+    }
+    entry.enclosed_name().ok_or_else(invalid)
+}
+
 /// Compute base64-encoded SHA-256 hash of the given data.
 #[must_use]
 pub fn compute_sha256(data: &[u8]) -> String {
@@ -1401,9 +1660,141 @@ pub fn compute_sha256(data: &[u8]) -> String {
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod tests {
     use super::*;
 
+    #[tokio::test]
+    async fn test_should_release_unpublished_artifacts_and_preserve_committed_code()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let store = FunctionStore::new(root.path());
+        let bytes = Bytes::from(crate::test_zip::minimal_zip(b"code"));
+        let (committed, _, _) = store.store_zip_code("committed", "$LATEST", &bytes).await?;
+        let pending = store.stage_zip_code("pending", "$LATEST", &bytes).await?;
+        let pending_path = pending.artifact().code_root().to_path_buf();
+        assert_eq!(store.artifacts.len(), 2);
+        drop(pending);
+        assert_eq!(store.artifacts.len(), 1);
+        assert!(tokio::fs::try_exists(committed).await?);
+        assert!(!tokio::fs::try_exists(pending_path).await?);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_rollback_unpublished_code_when_its_owner_future_is_aborted()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let store = std::sync::Arc::new(FunctionStore::new(root.path()));
+        let owner = std::sync::Arc::clone(&store);
+        let (started, receiver) = tokio::sync::oneshot::channel();
+        let task = tokio::spawn(async move {
+            let bytes = Bytes::from(crate::test_zip::minimal_zip(b"pending"));
+            let staged = owner.stage_zip_code("cancelled", "$LATEST", &bytes).await?;
+            let _ = started.send(staged.artifact().code_root().to_path_buf());
+            std::future::pending::<()>().await;
+            staged.commit();
+            Ok::<(), LambdaServiceError>(())
+        });
+        let _cancel = crate::work::CancelOnDrop(task.abort_handle());
+        let path = tokio::time::timeout(std::time::Duration::from_secs(5), receiver).await??;
+        task.abort();
+        assert!(task.await.is_err_and(|error| error.is_cancelled()));
+        assert!(store.artifacts.is_empty());
+        assert!(!tokio::fs::try_exists(path).await?);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_rollback_snapshot_artifacts_when_later_validation_rejects_restore()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let store = FunctionStore::new(root.path());
+        store.insert(sample_record("live"))?;
+        let bytes = Bytes::from(crate::test_zip::minimal_zip(b"unpublished"));
+        let mut candidate = sample_record("candidate");
+        candidate.latest.code_sha256 = "mismatched-snapshot-hash".into();
+        candidate.latest.code_size = bytes.len() as u64;
+        candidate.latest.zip_bytes = Some(bytes);
+        let snapshot = FunctionStoreSnapshot {
+            functions: vec![FunctionRecordSnapshot::from_record(candidate)],
+        };
+        assert!(matches!(
+            store.import_snapshot(snapshot).await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert!(store.contains("live")?);
+        assert_eq!(store.artifacts.len(), 0);
+        assert!(
+            tokio::fs::read_dir(root.path())
+                .await?
+                .next_entry()
+                .await?
+                .is_none()
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_validate_snapshot_settings_before_decoding_or_staging_its_archive()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let store = FunctionStore::new(root.path());
+        let mut snapshot = FunctionRecordSnapshot::from_record(sample_record("invalid-settings"));
+        snapshot.latest.timeout = 0;
+        snapshot.latest.zip_bytes_base64 = Some("invalid-base64".into());
+        let result = store
+            .import_snapshot(FunctionStoreSnapshot {
+                functions: vec![snapshot],
+            })
+            .await;
+        assert!(matches!(
+            result,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert!(store.is_empty());
+        assert!(store.artifacts.is_empty());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_keep_code_alive_until_the_last_invocation_lease_releases_it()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let store = FunctionStore::new(root.path());
+        let bytes = Bytes::from(crate::test_zip::minimal_zip(b"owned-code"));
+        let (path, sha256, size) = store.store_zip_code("leased", "$LATEST", &bytes).await?;
+        let lease = store.capture_artifact(&path).await?;
+        assert_eq!(lease.zip_bytes().as_ptr(), bytes.as_ptr());
+        assert_eq!(lease.sha256(), sha256);
+        assert_eq!(lease.zip_bytes().len() as u64, size);
+        drop(store);
+        assert!(tokio::fs::metadata(&path).await?.is_dir());
+        assert_eq!(
+            tokio::fs::read(path.join("fixture.txt")).await?,
+            b"owned-code"
+        );
+        let retained = lease.clone();
+        drop(lease);
+        assert!(tokio::fs::metadata(&path).await?.is_dir());
+        drop(retained);
+        assert!(
+            matches!(tokio::fs::metadata(path).await, Err(error) if error.kind() == ErrorKind::NotFound)
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_unowned_code_when_issuing_an_artifact_lease()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let root = tempfile::tempdir()?;
+        let store = FunctionStore::new(root.path());
+        assert!(matches!(
+            store.capture_artifact(root.path()).await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        Ok(())
+    }
+
     #[tokio::test]
     async fn test_should_reject_hostile_names_at_every_store_boundary() {
         let root = tempfile::tempdir().unwrap();
@@ -1424,7 +1815,12 @@ mod tests {
             assert!(store.contains(name).is_err());
             assert!(store.remove(name).is_err());
             assert!(store.update(name, |_| ()).is_err());
-            assert!(store.store_zip_code(name, "$LATEST", &zip).await.is_err());
+            assert!(
+                store
+                    .store_zip_code(name, "$LATEST", &Bytes::copy_from_slice(&zip))
+                    .await
+                    .is_err()
+            );
             assert!(store.cleanup_code(name).await.is_err());
         }
         assert!(store.is_empty());
@@ -1444,15 +1840,25 @@ mod tests {
         let root = tempfile::tempdir().unwrap();
         let store = FunctionStore::new(root.path());
         let (a, _, _) = store
-            .store_zip_code("safe", "$LATEST", &crate::test_zip::minimal_zip(b"A"))
+            .store_zip_code(
+                "safe",
+                "$LATEST",
+                &Bytes::from(crate::test_zip::minimal_zip(b"A")),
+            )
             .await
             .unwrap();
         assert!(matches!(
-            store.store_zip_code("safe", "$LATEST", b"bad ZIP").await,
+            store
+                .store_zip_code("safe", "$LATEST", &Bytes::from_static(b"bad ZIP"))
+                .await,
             Err(LambdaServiceError::InvalidZipFile { .. })
         ));
         let (b, _, _) = store
-            .store_zip_code("safe", "$LATEST", &crate::test_zip::minimal_zip(b"B"))
+            .store_zip_code(
+                "safe",
+                "$LATEST",
+                &Bytes::from(crate::test_zip::minimal_zip(b"B")),
+            )
             .await
             .unwrap();
         assert_ne!(a, b);
@@ -1470,7 +1876,11 @@ mod tests {
         let root = tempfile::tempdir().unwrap();
         let store = FunctionStore::new(root.path());
         let (old, _, _) = store
-            .store_zip_code("safe", "$LATEST", &crate::test_zip::minimal_zip(b"old"))
+            .store_zip_code(
+                "safe",
+                "$LATEST",
+                &Bytes::from(crate::test_zip::minimal_zip(b"old")),
+            )
             .await
             .unwrap();
         let mut corrupt = crate::test_zip::minimal_zip(b"crc-marker");
@@ -1481,7 +1891,7 @@ mod tests {
         corrupt[position] ^= 1;
         assert!(
             store
-                .store_zip_code("safe", "$LATEST", &corrupt)
+                .store_zip_code("safe", "$LATEST", &Bytes::copy_from_slice(&corrupt))
                 .await
                 .is_err()
         );
@@ -1497,7 +1907,7 @@ mod tests {
         let conflict = writer.finish().unwrap().into_inner();
         assert!(
             store
-                .store_zip_code("safe", "$LATEST", &conflict)
+                .store_zip_code("safe", "$LATEST", &Bytes::copy_from_slice(&conflict))
                 .await
                 .is_err()
         );
@@ -1547,7 +1957,11 @@ mod tests {
         let store = FunctionStore::new(&link);
         assert!(
             store
-                .store_zip_code("safe", "$LATEST", &crate::test_zip::minimal_zip(b"A"))
+                .store_zip_code(
+                    "safe",
+                    "$LATEST",
+                    &Bytes::from(crate::test_zip::minimal_zip(b"A"))
+                )
                 .await
                 .is_err()
         );
@@ -1560,7 +1974,11 @@ mod tests {
         );
         let store = FunctionStore::new(root.path().join("owned"));
         let (artifact, _, _) = store
-            .store_zip_code("safe", "$LATEST", &crate::test_zip::minimal_zip(b"A"))
+            .store_zip_code(
+                "safe",
+                "$LATEST",
+                &Bytes::from(crate::test_zip::minimal_zip(b"A")),
+            )
             .await
             .unwrap();
         tokio::fs::remove_dir_all(&artifact).await.unwrap();
@@ -1571,7 +1989,11 @@ mod tests {
         let managed = root.path().join("replaceable");
         let store = FunctionStore::new(&managed);
         let (artifact, _, _) = store
-            .store_zip_code("safe", "$LATEST", &crate::test_zip::minimal_zip(b"A"))
+            .store_zip_code(
+                "safe",
+                "$LATEST",
+                &Bytes::from(crate::test_zip::minimal_zip(b"A")),
+            )
             .await
             .unwrap();
         let artifact_id = artifact.parent().unwrap().file_name().unwrap();
@@ -1611,8 +2033,9 @@ mod tests {
             package_type: "Zip".to_owned(),
             code_path: None,
             image_uri: None,
+            image: ImageArtifact::Unresolved,
             zip_bytes: None,
-            state: "Active".to_owned(),
+            deployment: DeploymentState::Ready,
             last_modified: "2024-01-01T00:00:00.000+0000".to_owned(),
             architectures: vec!["x86_64".to_owned()],
             ephemeral_storage_size: 512,
@@ -1629,8 +2052,9 @@ mod tests {
         }
     }
 
-    fn sample_record(name: &str) -> FunctionRecord {
+    pub(crate) fn sample_record(name: &str) -> FunctionRecord {
         FunctionRecord {
+            resource_id: FunctionResourceId::default(),
             name: name.to_owned(),
             arn: format!("arn:aws:lambda:us-east-1:000000000000:function:{name}"),
             latest: sample_version(),
@@ -1647,6 +2071,95 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn test_should_preserve_function_resource_identity_through_snapshot_and_updates()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let store = test_store();
+        let record = sample_record("identity");
+        let identity = record.resource_id;
+        store.insert(record)?;
+        store.update("identity", |record| {
+            record.latest.description = "changed".into();
+        })?;
+        let saved = serde_json::to_vec(&store.export_snapshot())?;
+        let snapshot: FunctionStoreSnapshot = serde_json::from_slice(&saved)?;
+        assert_eq!(
+            snapshot.functions.first().map(|record| record.resource_id),
+            Some(identity)
+        );
+        let restored = test_store();
+        restored.import_snapshot(snapshot).await?;
+        assert_eq!(
+            restored.get("identity")?.map(|record| record.resource_id),
+            Some(identity)
+        );
+        let result = restored.update("identity", |record| {
+            record.resource_id = FunctionResourceId::default();
+        });
+        assert!(matches!(
+            result,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert_eq!(
+            restored.get("identity")?.map(|record| record.resource_id),
+            Some(identity)
+        );
+        restored.remove("identity")?;
+        restored.insert(sample_record("identity"))?;
+        assert_ne!(
+            restored.get("identity")?.map(|record| record.resource_id),
+            Some(identity)
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_duplicate_snapshot_identities_without_replacing_live_store()
+    -> Result<(), LambdaServiceError> {
+        let store = test_store();
+        store.insert(sample_record("live"))?;
+        let mut first = sample_record("first");
+        let second = sample_record("second");
+        first.resource_id = second.resource_id;
+        let snapshot = FunctionStoreSnapshot {
+            functions: vec![
+                FunctionRecordSnapshot::from_record(first),
+                FunctionRecordSnapshot::from_record(second),
+            ],
+        };
+        assert!(matches!(
+            store.import_snapshot(snapshot).await,
+            Err(LambdaServiceError::InvalidParameter { .. })
+        ));
+        assert!(store.contains("live")?);
+        assert_eq!(store.len(), 1);
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_assign_identity_only_when_legacy_snapshot_omits_it()
+    -> Result<(), Box<dyn std::error::Error>> {
+        let snapshot = FunctionRecordSnapshot::from_record(sample_record("legacy"));
+        let mut value = serde_json::to_value(snapshot)?;
+        let fields = value.as_object_mut().ok_or("snapshot must be an object")?;
+        fields.remove("resourceId");
+        let restored: FunctionRecordSnapshot = serde_json::from_value(value.clone())?;
+        let saved = serde_json::to_value(&restored)?;
+        assert_eq!(
+            serde_json::from_value::<FunctionRecordSnapshot>(saved)?.resource_id,
+            restored.resource_id
+        );
+        value
+            .as_object_mut()
+            .ok_or("snapshot must be an object")?
+            .insert(
+                "resourceId".into(),
+                "00000000-0000-0000-0000-000000000000".into(),
+            );
+        assert!(serde_json::from_value::<FunctionRecordSnapshot>(value).is_err());
+        Ok(())
+    }
+
     #[test]
     fn test_should_insert_and_get_function() {
         let store = test_store();
@@ -1842,7 +2355,7 @@ mod tests {
 
         let zip_data = crate::test_zip::minimal_zip(b"fixture");
         let (dir, sha256, size) = store
-            .store_zip_code("test-func", "$LATEST", &zip_data)
+            .store_zip_code("test-func", "$LATEST", &Bytes::copy_from_slice(&zip_data))
             .await
             .unwrap();
 
@@ -1891,7 +2404,7 @@ mod tests {
         }
 
         let (dir, _sha, _size) = store
-            .store_zip_code("real-func", "$LATEST", &buf)
+            .store_zip_code("real-func", "$LATEST", &Bytes::copy_from_slice(&buf))
             .await
             .unwrap();
 
@@ -1932,12 +2445,215 @@ mod tests {
         }
 
         let err = store
-            .store_zip_code("evil", "$LATEST", &buf)
+            .store_zip_code("evil", "$LATEST", &Bytes::copy_from_slice(&buf))
             .await
             .unwrap_err();
         assert!(matches!(err, LambdaServiceError::InvalidZipFile { .. }));
     }
 
+    #[rstest::rstest]
+    #[case::invalid_utf8(vec![0xff; 11], true)]
+    #[case::raw_limit(vec![b'a'; 1025], true)]
+    #[case::decoded_limit(vec![0x82; 513], false)]
+    #[tokio::test]
+    async fn test_should_reject_invalid_zip_names_without_publishing_artifacts(
+        #[case] raw: Vec<u8>,
+        #[case] utf8: bool,
+    ) {
+        use std::io::{Cursor, Write};
+
+        let mut writer = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        writer
+            .start_file(
+                "a".repeat(raw.len()),
+                zip::write::SimpleFileOptions::default(),
+            )
+            .unwrap();
+        writer.write_all(b"payload").unwrap();
+        let mut bytes = writer.finish().unwrap().into_inner();
+        let central = bytes
+            .windows(4)
+            .position(|part| part == b"PK\x01\x02")
+            .unwrap();
+        let flag = if utf8 { 1u16 << 11 } else { 0 };
+        bytes
+            .get_mut(6..8)
+            .unwrap()
+            .copy_from_slice(&flag.to_le_bytes());
+        bytes
+            .get_mut(central + 8..central + 10)
+            .unwrap()
+            .copy_from_slice(&flag.to_le_bytes());
+        bytes
+            .get_mut(30..30 + raw.len())
+            .unwrap()
+            .copy_from_slice(&raw);
+        bytes
+            .get_mut(central + 46..central + 46 + raw.len())
+            .unwrap()
+            .copy_from_slice(&raw);
+
+        let root = tempfile::tempdir().unwrap();
+        let store = FunctionStore::new(root.path());
+        let error = store
+            .store_zip_code("safe", "$LATEST", &Bytes::from(bytes))
+            .await
+            .unwrap_err();
+        assert!(matches!(error, LambdaServiceError::InvalidZipFile { .. }));
+        assert!(store.artifacts.is_empty());
+        let mut entries = tokio::fs::read_dir(root.path()).await.unwrap();
+        assert!(entries.next_entry().await.unwrap().is_none());
+    }
+
+    #[rstest::rstest]
+    #[case::symlink(0o120_777)]
+    #[case::setuid(0o104_755)]
+    #[case::setgid(0o102_755)]
+    #[case::sticky(0o101_755)]
+    #[case::fifo(0o010_644)]
+    #[case::character_device(0o020_644)]
+    #[case::block_device(0o060_644)]
+    #[case::socket(0o140_644)]
+    #[case::directory_as_file(0o040_755)]
+    #[tokio::test]
+    async fn test_should_reject_hostile_zip_attributes_without_replacing_code(#[case] mode: u32) {
+        use std::io::Cursor;
+
+        let root = tempfile::tempdir().unwrap();
+        let code_dir = root.path().join("code");
+        let sentinel = root.path().join("sentinel");
+        tokio::fs::write(&sentinel, b"outside").await.unwrap();
+        let store = FunctionStore::new(&code_dir);
+        let (old, _, _) = store
+            .store_zip_code(
+                "safe",
+                "$LATEST",
+                &Bytes::from(crate::test_zip::minimal_zip(b"old")),
+            )
+            .await
+            .unwrap();
+
+        // Encode the central-directory attributes directly: safe writer APIs
+        // deliberately strip special permission bits. The symlink payload would
+        // target the outside sentinel if materialized as a link.
+        let mut hostile = crate::test_zip::minimal_zip(sentinel.as_os_str().as_encoded_bytes());
+        let central = hostile
+            .windows(4)
+            .position(|bytes| bytes == b"PK\x01\x02")
+            .unwrap();
+        hostile
+            .get_mut(central + 4..central + 6)
+            .unwrap()
+            .copy_from_slice(&((3u16 << 8) | 0x14).to_le_bytes());
+        hostile
+            .get_mut(central + 38..central + 42)
+            .unwrap()
+            .copy_from_slice(&(mode << 16).to_le_bytes());
+        let mut archive = zip::ZipArchive::new(Cursor::new(&hostile)).unwrap();
+        assert_eq!(
+            archive.by_index(0).unwrap().external_attributes() >> 16,
+            mode
+        );
+
+        let error = store
+            .store_zip_code("safe", "$LATEST", &Bytes::from(hostile))
+            .await
+            .unwrap_err();
+        assert!(matches!(error, LambdaServiceError::InvalidZipFile { .. }));
+        assert_eq!(tokio::fs::read(&sentinel).await.unwrap(), b"outside");
+        assert_eq!(
+            tokio::fs::read(old.join("fixture.txt")).await.unwrap(),
+            b"old"
+        );
+        assert_eq!(store.artifacts.len(), 1);
+        let mut entries = tokio::fs::read_dir(&code_dir).await.unwrap();
+        assert!(entries.next_entry().await.unwrap().is_some());
+        assert!(entries.next_entry().await.unwrap().is_none());
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_duplicate_raw_zip_names_before_indexed_extraction() {
+        use std::io::{Cursor, Write};
+
+        let mut writer = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        writer
+            .start_file("first", zip::write::SimpleFileOptions::default())
+            .unwrap();
+        writer.write_all(b"one").unwrap();
+        writer
+            .start_file("other", zip::write::SimpleFileOptions::default())
+            .unwrap();
+        writer.write_all(b"two").unwrap();
+        let mut bytes = writer.finish().unwrap().into_inner();
+        let local = bytes
+            .windows(4)
+            .rposition(|part| part == b"PK\x03\x04")
+            .unwrap();
+        let central = bytes
+            .windows(4)
+            .rposition(|part| part == b"PK\x01\x02")
+            .unwrap();
+        bytes
+            .get_mut(local + 30..local + 35)
+            .unwrap()
+            .copy_from_slice(b"first");
+        bytes
+            .get_mut(central + 46..central + 51)
+            .unwrap()
+            .copy_from_slice(b"first");
+        let archive = zip::ZipArchive::new(Cursor::new(&bytes)).unwrap();
+        assert_eq!(
+            archive.len(),
+            1,
+            "upstream metadata deduplicates identical raw names"
+        );
+        assert!(archive.has_duplicate_names());
+
+        let root = tempfile::tempdir().unwrap();
+        let store = FunctionStore::new(root.path());
+        let error = store
+            .store_zip_code("duplicate", "$LATEST", &Bytes::from(bytes))
+            .await
+            .unwrap_err();
+        assert!(matches!(error, LambdaServiceError::InvalidZipFile { .. }));
+        assert!(store.artifacts.is_empty());
+        let mut entries = tokio::fs::read_dir(root.path()).await.unwrap();
+        assert!(entries.next_entry().await.unwrap().is_none());
+    }
+
+    #[tokio::test]
+    async fn test_should_preserve_dos_attribute_semantics_without_special_permissions() {
+        let mut bytes = crate::test_zip::minimal_zip(b"safe");
+        let central = bytes
+            .windows(4)
+            .position(|part| part == b"PK\x01\x02")
+            .unwrap();
+        bytes
+            .get_mut(central + 4..central + 6)
+            .unwrap()
+            .copy_from_slice(&20u16.to_le_bytes());
+        bytes
+            .get_mut(central + 38..central + 42)
+            .unwrap()
+            .copy_from_slice(&(0o104_755u32 << 16).to_le_bytes());
+        let root = tempfile::tempdir().unwrap();
+        let store = FunctionStore::new(root.path());
+        let (path, _, _) = store
+            .store_zip_code("dos", "$LATEST", &Bytes::from(bytes))
+            .await
+            .unwrap();
+        assert_eq!(
+            tokio::fs::read(path.join("fixture.txt")).await.unwrap(),
+            b"safe"
+        );
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let metadata = tokio::fs::metadata(path.join("fixture.txt")).await.unwrap();
+            assert_eq!(metadata.permissions().mode() & 0o7000, 0);
+        }
+    }
+
     #[test]
     fn test_should_reject_zip_that_expands_beyond_extraction_budget() {
         use std::io::Write as _;
@@ -1954,8 +2670,8 @@ mod tests {
         }
 
         let tmp = tempfile::tempdir().unwrap();
-        let err =
-            extract_zip(&buf, tmp.path(), 100).expect_err("expansion beyond budget must fail");
+        let err = extract_zip(&buf, tmp.path(), 100, None)
+            .expect_err("expansion beyond budget must fail");
         assert!(
             matches!(err, LambdaServiceError::InvalidZipFile { .. }),
             "got: {err:?}"
@@ -1976,7 +2692,7 @@ mod tests {
         }
 
         let tmp = tempfile::tempdir().unwrap();
-        extract_zip(&buf, tmp.path(), 1024).expect("within-budget zip extracts");
+        extract_zip(&buf, tmp.path(), 1024, None).expect("within-budget zip extracts");
         assert!(tmp.path().join("small.txt").exists());
     }
 
diff --git a/crates/rustack-lambda-core/src/storage/restore.rs b/crates/rustack-lambda-core/src/storage/restore.rs
new file mode 100644
index 00000000..7589b78a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/storage/restore.rs
@@ -0,0 +1,308 @@
+//! Prepare every fallible record/artifact before the startup publication boundary.
+
+#[cfg(unix)]
+use std::time::Duration;
+use std::{
+    collections::{BTreeMap, HashSet},
+    iter::once,
+};
+
+#[cfg(unix)]
+use tokio::time::Instant;
+
+#[cfg(unix)]
+use super::restore_zip::ZipMeasurements;
+use super::{
+    FunctionRecord, FunctionStore, FunctionStoreSnapshot, StagedArtifact, ZipRestoreBudget,
+};
+use crate::{
+    artifact::MAX_ZIP_BYTES,
+    error::LambdaServiceError,
+    resolver::{FunctionName, Qualifier, resolve_function_ref},
+};
+#[cfg(unix)]
+use crate::{
+    artifact::{ImageArtifact, PinnedImage},
+    docker::{DockerCodeArchive, DockerError, ImageLeasePort},
+    function_config::validate_provided_settings,
+    provider::DockerArchiveProfile,
+};
+
+#[derive(Debug)]
+pub(crate) struct PreparedImport<'a> {
+    store: &'a FunctionStore,
+    functions: BTreeMap<String, FunctionRecord>,
+    artifacts: Vec<StagedArtifact<'a>>,
+}
+impl PreparedImport<'_> {
+    /// Infallible startup publication after all validation and ownership checks.
+    pub(crate) fn commit(self) {
+        self.store.functions.clear();
+        for (name, record) in self.functions {
+            self.store.functions.insert(name, record);
+        }
+        for artifact in self.artifacts {
+            artifact.commit();
+        }
+        self.store.changes.send_replace(());
+    }
+    #[cfg(unix)]
+    pub(crate) fn commit_before(self, deadline: Instant) -> Result<(), LambdaServiceError> {
+        check_deadline(deadline)?;
+        self.commit();
+        Ok(())
+    }
+}
+impl FunctionStore {
+    pub(crate) fn check_snapshot_counts(
+        &self,
+        functions: usize,
+        revisions: usize,
+    ) -> Result<(), LambdaServiceError> {
+        if self.functions.len() > functions {
+            return Err(invalid("Image archive function count exceeds its profile"));
+        }
+        let mut count = 0usize;
+        for record in &self.functions {
+            count = count
+                .checked_add(1)
+                .and_then(|n| n.checked_add(record.versions.len()))
+                .ok_or_else(|| invalid("Image archive revision count overflow"))?;
+            if count > revisions {
+                return Err(invalid("Image archive revision count exceeds its profile"));
+            }
+        }
+        Ok(())
+    }
+    pub(crate) fn check_snapshot_zip_bytes(
+        &self,
+        maximum: usize,
+    ) -> Result<(), LambdaServiceError> {
+        let mut remaining = maximum;
+        for function in &self.functions {
+            for row in once(&function.latest).chain(function.versions.values()) {
+                if let Some(bytes) = &row.zip_bytes {
+                    if bytes.len() > MAX_ZIP_BYTES {
+                        return Err(invalid("ZIP archive source is oversized"));
+                    }
+                    remaining = remaining
+                        .checked_sub(bytes.len())
+                        .ok_or_else(|| invalid("ZIP archive source budget exceeded"))?;
+                }
+            }
+        }
+        Ok(())
+    }
+
+    #[cfg(unix)]
+    pub(crate) fn check_snapshot_zip_profile(
+        &self,
+        deadline: Instant,
+    ) -> Result<(), LambdaServiceError> {
+        self.check_snapshot_zip_bytes(DockerArchiveProfile::MAX_ZIP_DATA_BYTES)?;
+        let mut measurements = ZipMeasurements::default();
+        for function in &self.functions {
+            for row in once(&function.latest).chain(function.versions.values()) {
+                check_deadline(deadline)?;
+                if let Some(bytes) = &row.zip_bytes {
+                    measurements.charge(bytes)?;
+                }
+            }
+        }
+        check_deadline(deadline)
+    }
+
+    pub(super) async fn prepare_snapshot(
+        &self,
+        snapshot: FunctionStoreSnapshot,
+    ) -> Result<PreparedImport<'_>, LambdaServiceError> {
+        self.prepare_snapshot_inner(snapshot, None).await
+    }
+    async fn prepare_snapshot_inner(
+        &self,
+        snapshot: FunctionStoreSnapshot,
+        mut zip: Option<ZipRestoreBudget>,
+    ) -> Result<PreparedImport<'_>, LambdaServiceError> {
+        if let Some(budget) = &zip {
+            budget.check()?;
+        }
+        self.validate_root().await?;
+        if let Some(budget) = &zip {
+            budget.check()?;
+        }
+        let mut staged = BTreeMap::new();
+        let mut identities = HashSet::new();
+        let mut artifacts = Vec::new();
+        for function in snapshot.functions {
+            if !identities.insert(function.resource_id) {
+                return Err(invalid("Duplicate snapshot function resource identity"));
+            }
+            FunctionName::parse(&function.name)?;
+            let (name, qualifier) = resolve_function_ref(&function.arn)?;
+            if name != function.name || qualifier.is_some() {
+                return Err(invalid("Snapshot function ARN mismatch"));
+            }
+            for (alias, record) in &function.aliases {
+                Qualifier::parse(alias)?;
+                Qualifier::parse(&record.function_version)?;
+            }
+            let (record, allocations) = function.into_record(self, zip.as_mut()).await?;
+            artifacts.extend(allocations);
+            self.validate_record(&record)?;
+            if staged.insert(record.name.clone(), record).is_some() {
+                return Err(invalid("Duplicate snapshot function"));
+            }
+        }
+        Ok(PreparedImport {
+            store: self,
+            functions: staged,
+            artifacts,
+        })
+    }
+
+    #[cfg(unix)]
+    pub(crate) async fn prepare_docker_snapshot(
+        &self,
+        snapshot: FunctionStoreSnapshot,
+        images: &ImageLeasePort,
+        deadline: Instant,
+        profile: DockerArchiveProfile,
+    ) -> Result<PreparedImport<'_>, LambdaServiceError> {
+        check_deadline(deadline)?;
+        let mut candidate = self
+            .prepare_snapshot_inner(snapshot, Some(ZipRestoreBudget::new(deadline)))
+            .await?;
+        // Validate all usable revisions and effective plans before any pin effect.
+        for record in candidate.functions.values() {
+            validate_restored_aliases(record)?;
+            for version in once(&record.latest).chain(record.versions.values()) {
+                if version.package_type == "Zip" {
+                    let architecture = profile
+                        .zip_architecture()
+                        .ok_or_else(|| invalid("Docker ZIP archive runtime is unavailable"))?;
+                    validate_provided_settings(
+                        version.runtime.as_deref(),
+                        version.handler.as_deref(),
+                    )?;
+                    if version.architectures.as_slice() != [architecture.as_str()] {
+                        return Err(invalid("Docker ZIP archive platform mismatch"));
+                    }
+                    let path = version
+                        .code_path
+                        .as_ref()
+                        .ok_or_else(|| invalid("Restored ZIP has no owned code"))?;
+                    let artifact = self
+                        .artifacts
+                        .get(path)
+                        .map(|artifact| artifact.value().clone())
+                        .ok_or_else(|| invalid("Restored ZIP artifact is missing"))?;
+                    let conversion_deadline = Instant::now()
+                        .checked_add(Duration::from_secs(600))
+                        .map_or(deadline, |limit| deadline.min(limit));
+                    DockerCodeArchive::prepare(artifact, architecture, conversion_deadline)
+                        .await
+                        .map_err(|error| match error {
+                            DockerError::InvalidCode | DockerError::TooLarge => {
+                                invalid("Invalid or oversized Docker ZIP archive candidate")
+                            }
+                            other => image_error(other),
+                        })?;
+                    check_deadline(deadline)?;
+                } else if version.deployment.state() == "Active" {
+                    let saved = version.image.resolved().ok_or_else(|| {
+                        invalid("Usable restored image has no immutable metadata")
+                    })?;
+                    saved
+                        .metadata()
+                        .execution
+                        .plan(version.image_config.as_ref())
+                        .map_err(|_| invalid("Invalid restored image execution plan"))?;
+                }
+            }
+        }
+        let mut leases: BTreeMap<Vec<u8>, PinnedImage> = BTreeMap::new();
+        for record in candidate.functions.values_mut() {
+            for version in once(&mut record.latest).chain(record.versions.values_mut()) {
+                check_deadline(deadline)?;
+                if version.package_type == "Zip" || version.deployment.state() != "Active" {
+                    continue;
+                }
+                let saved = version
+                    .image
+                    .resolved()
+                    .ok_or_else(|| invalid("Usable restored image has no immutable metadata"))?;
+                let key = serde_json::to_vec(saved)
+                    .map_err(|_| invalid("Invalid restored image metadata"))?;
+                let image = if let Some(image) = leases.get(&key) {
+                    image.clone()
+                } else {
+                    let image = images
+                        .restore(saved, version.image_config.as_ref(), deadline)
+                        .await
+                        .map_err(image_error)?;
+                    leases.insert(key, image.clone());
+                    image
+                };
+                if image.unpacked_size().get() != version.code_size {
+                    return Err(invalid("Restored image storage proof mismatch"));
+                }
+                version.image = ImageArtifact::Pinned(image);
+            }
+        }
+        for record in candidate.functions.values() {
+            self.validate_record(record)?;
+        }
+        images.available().map_err(image_error)?;
+        check_deadline(deadline)?;
+        Ok(candidate)
+    }
+}
+#[cfg(unix)]
+fn validate_restored_aliases(record: &FunctionRecord) -> Result<(), LambdaServiceError> {
+    for alias in record.aliases.values() {
+        let target = alias
+            .function_version
+            .parse::<u64>()
+            .map_err(|_| invalid("Invalid restored alias version"))?;
+        if !record.versions.contains_key(&target) {
+            return Err(invalid("Restored alias target is missing"));
+        }
+        if let Some(weights) = &alias.routing_config {
+            for (version, weight) in weights {
+                let target = version
+                    .parse::<u64>()
+                    .map_err(|_| invalid("Invalid restored alias routing"))?;
+                if !record.versions.contains_key(&target)
+                    || !weight.is_finite()
+                    || !(0.0..=1.0).contains(weight)
+                {
+                    return Err(invalid("Invalid restored alias routing"));
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+fn invalid(message: &str) -> LambdaServiceError {
+    LambdaServiceError::InvalidParameter {
+        message: message.into(),
+    }
+}
+#[cfg(unix)]
+pub(crate) fn check_deadline(deadline: Instant) -> Result<(), LambdaServiceError> {
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .filter(|value| !value.is_zero())
+        .ok_or_else(|| image_error(DockerError::Deadline))?;
+    if remaining > Duration::from_secs(3600) {
+        return Err(image_error(DockerError::Configuration));
+    }
+    Ok(())
+}
+#[cfg(unix)]
+pub(crate) fn image_error(source: DockerError) -> LambdaServiceError {
+    LambdaServiceError::ImageRestore {
+        source: Box::new(source),
+    }
+}
diff --git a/crates/rustack-lambda-core/src/storage/restore_zip.rs b/crates/rustack-lambda-core/src/storage/restore_zip.rs
new file mode 100644
index 00000000..a2eb91d2
--- /dev/null
+++ b/crates/rustack-lambda-core/src/storage/restore_zip.rs
@@ -0,0 +1,381 @@
+//! Bounded private ZIP staging under one original import deadline.
+
+use std::io::Cursor;
+
+use base64::{Engine, engine::general_purpose::STANDARD};
+use bytes::Bytes;
+use tokio::{
+    task::spawn_blocking,
+    time::{Instant, timeout_at},
+};
+use zip::ZipArchive;
+
+use super::{
+    FunctionStore, MAX_EXTRACTED_SIZE, StagedArtifact, ZipLayout, stage_zip_before,
+    validate_zip_directory, validated_zip_path,
+};
+use crate::{
+    artifact::{MAX_ZIP_BASE64_BYTES, MAX_ZIP_BYTES},
+    error::LambdaServiceError,
+    provider::DockerArchiveProfile,
+};
+
+const EXPANDED: u64 = 512 * 1024 * 1024;
+const NODES: usize = 20_000;
+const SOURCES: usize = DockerArchiveProfile::MAX_ZIP_DATA_BYTES;
+
+fn invalid() -> LambdaServiceError {
+    LambdaServiceError::InvalidParameter {
+        message: "Invalid or oversized Docker ZIP archive candidate".into(),
+    }
+}
+pub(super) fn check(deadline: Option<Instant>) -> Result<(), LambdaServiceError> {
+    if deadline.is_some_and(|deadline| Instant::now() >= deadline) {
+        return Err(LambdaServiceError::ResourceNotReady {
+            message: "ZIP archive import deadline exceeded".into(),
+        });
+    }
+    Ok(())
+}
+fn stage_error(error: LambdaServiceError) -> LambdaServiceError {
+    match error {
+        LambdaServiceError::InvalidParameter { .. } | LambdaServiceError::InvalidZipFile { .. } => {
+            invalid()
+        }
+        LambdaServiceError::Internal { .. } => LambdaServiceError::Internal {
+            message: "ZIP archive staging failed".into(),
+        },
+        other => other,
+    }
+}
+#[derive(Debug, Clone, Copy)]
+pub(super) struct Measurement {
+    expanded: u64,
+    nodes: usize,
+}
+fn measure(bytes: &Bytes) -> Result<Measurement, LambdaServiceError> {
+    let mut archive = ZipArchive::new(Cursor::new(bytes)).map_err(|_| invalid())?;
+    if archive.len() > 10_000 || archive.has_duplicate_names() {
+        return Err(invalid());
+    }
+    let mut layout = ZipLayout::default();
+    let mut expanded = 0_u64;
+    for n in 0..archive.len() {
+        let mut entry = archive.by_index(n).map_err(|_| invalid())?;
+        let path = validated_zip_path(&entry).map_err(stage_error)?;
+        layout.admit(&path, entry.is_dir()).map_err(stage_error)?;
+        if entry.is_dir() {
+            validate_zip_directory(&mut entry).map_err(stage_error)?;
+        } else {
+            expanded = expanded
+                .checked_add(entry.size())
+                .filter(|n| *n <= MAX_EXTRACTED_SIZE)
+                .ok_or_else(invalid)?;
+        }
+    }
+    let nodes = layout.node_count().checked_add(3).ok_or_else(invalid)?;
+    Ok(Measurement { expanded, nodes })
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(super) struct ZipMeasurements {
+    expanded: u64,
+    nodes: usize,
+    sources: usize,
+}
+impl Default for ZipMeasurements {
+    fn default() -> Self {
+        Self {
+            expanded: EXPANDED,
+            nodes: NODES,
+            sources: SOURCES,
+        }
+    }
+}
+impl ZipMeasurements {
+    pub(super) fn charge(&mut self, bytes: &Bytes) -> Result<Measurement, LambdaServiceError> {
+        if bytes.len() > MAX_ZIP_BYTES {
+            return Err(invalid());
+        }
+        let sources = self.sources.checked_sub(bytes.len()).ok_or_else(invalid)?;
+        let measured = measure(bytes)?;
+        let expanded = self
+            .expanded
+            .checked_sub(measured.expanded)
+            .ok_or_else(invalid)?;
+        let nodes = self.nodes.checked_sub(measured.nodes).ok_or_else(invalid)?;
+        self.sources = sources;
+        self.expanded = expanded;
+        self.nodes = nodes;
+        Ok(measured)
+    }
+}
+
+#[cfg(test)]
+#[derive(Debug)]
+struct StageGate {
+    entered: tokio::sync::oneshot::Sender<()>,
+    release: std::sync::mpsc::Receiver<()>,
+}
+
+#[derive(Debug)]
+pub(super) struct ZipRestoreBudget {
+    deadline: Instant,
+    limits: ZipMeasurements,
+    #[cfg(test)]
+    gate: Option<StageGate>,
+}
+impl ZipRestoreBudget {
+    #[cfg(unix)]
+    pub(super) fn new(deadline: Instant) -> Self {
+        Self {
+            deadline,
+            limits: ZipMeasurements::default(),
+            #[cfg(test)]
+            gate: None,
+        }
+    }
+    pub(super) fn check(&self) -> Result<(), LambdaServiceError> {
+        check(Some(self.deadline))
+    }
+    pub(super) async fn stage<'a>(
+        &mut self,
+        store: &'a FunctionStore,
+        encoded: String,
+    ) -> Result<StagedArtifact<'a>, LambdaServiceError> {
+        self.check()?;
+        if encoded.len() > MAX_ZIP_BASE64_BYTES {
+            return Err(invalid());
+        }
+        timeout_at(self.deadline, store.validate_root())
+            .await
+            .map_err(|_| LambdaServiceError::ResourceNotReady {
+                message: "ZIP archive import deadline exceeded".into(),
+            })??;
+        self.check()?;
+        let permit = store.staging.clone().try_acquire_owned().map_err(|_| {
+            LambdaServiceError::ResourceNotReady {
+                message: "ZIP staging capacity exhausted".into(),
+            }
+        })?;
+        let root = store.code_dir.clone();
+        let deadline = self.deadline;
+        let mut limits = self.limits;
+        #[cfg(test)]
+        let gate = self.gate.take();
+        let mut job = spawn_blocking(move || {
+            let retained = (encoded, permit);
+            check(Some(deadline))?;
+            let bytes = STANDARD
+                .decode(retained.0.as_bytes())
+                .map(Bytes::from)
+                .map_err(|_| invalid())?;
+            let measured = limits.charge(&bytes)?;
+            check(Some(deadline))?;
+            let artifact = stage_zip_before(&root, bytes, measured.expanded, Some(deadline))
+                .map_err(stage_error)?;
+            #[cfg(test)]
+            if let Some(gate) = gate {
+                let _ = gate.entered.send(());
+                gate.release
+                    .recv_timeout(std::time::Duration::from_secs(5))
+                    .map_err(|_| invalid())?;
+            }
+            check(Some(deadline))?;
+            Ok::<_, LambdaServiceError>((artifact, limits))
+        });
+        let Ok(outcome) = timeout_at(deadline, &mut job).await else {
+            // Retain the original transaction until this same extraction joins.
+            drop(job.await);
+            return Err(LambdaServiceError::ResourceNotReady {
+                message: "ZIP archive import deadline exceeded".into(),
+            });
+        };
+        let (artifact, limits) =
+            outcome.map_err(|source| LambdaServiceError::ImageRestoreWorker {
+                source: source.into(),
+            })??;
+        // No detached worker has a store capability. Fence before registration.
+        self.check()?;
+        self.limits = limits;
+        store
+            .artifacts
+            .insert(artifact.code_root().to_path_buf(), artifact.clone());
+        Ok(StagedArtifact::new(store, artifact))
+    }
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use std::{
+        io::{Cursor, Write},
+        path::Path,
+        sync::{Arc, mpsc},
+        time::Duration,
+    };
+
+    use rstest::rstest;
+    use tokio::{
+        fs,
+        sync::oneshot,
+        time::{sleep, sleep_until, timeout},
+    };
+    use zip::{CompressionMethod, ZipWriter, write::SimpleFileOptions};
+
+    use super::*;
+
+    fn source() -> String {
+        let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+        writer
+            .start_file(
+                "tree/file",
+                SimpleFileOptions::default().compression_method(CompressionMethod::Deflated),
+            )
+            .unwrap();
+        writer.write_all(&[42_u8; 64]).unwrap();
+        STANDARD.encode(writer.finish().unwrap().into_inner())
+    }
+    async fn entries(path: &Path) -> usize {
+        let mut entries = fs::read_dir(path).await.unwrap();
+        let mut count = 0;
+        while entries.next_entry().await.unwrap().is_some() {
+            count += 1;
+        }
+        count
+    }
+    fn held(deadline: Instant) -> (ZipRestoreBudget, oneshot::Receiver<()>, mpsc::Sender<()>) {
+        let (entered, observed) = oneshot::channel();
+        let (release, receiver) = mpsc::channel();
+        let mut budget = ZipRestoreBudget::new(deadline);
+        budget.gate = Some(StageGate {
+            entered,
+            release: receiver,
+        });
+        (budget, observed, release)
+    }
+    #[rstest]
+    #[case::exact(64, 5, true)]
+    #[case::expanded(63, 5, false)]
+    #[case::nodes(64, 4, false)]
+    #[tokio::test]
+    async fn test_should_charge_expansion_and_wrapper_nodes_before_artifact_allocation(
+        #[case] expanded: u64,
+        #[case] nodes: usize,
+        #[case] accepted: bool,
+    ) {
+        let root = tempfile::tempdir().unwrap();
+        let store = FunctionStore::new(root.path());
+        let mut budget = ZipRestoreBudget::new(Instant::now() + Duration::from_secs(5));
+        budget.limits.expanded = expanded;
+        budget.limits.nodes = nodes;
+        let stage = budget.stage(&store, source()).await;
+        assert_eq!(stage.is_ok(), accepted);
+        assert_eq!(entries(root.path()).await, usize::from(accepted));
+        if accepted {
+            assert_eq!(budget.limits.expanded, 0);
+            assert_eq!(budget.limits.nodes, 0);
+            assert!(budget.stage(&store, source()).await.is_err());
+            assert_eq!(entries(root.path()).await, 1);
+        }
+        drop(stage);
+        assert!(store.artifacts.is_empty());
+        assert_eq!(entries(root.path()).await, 0);
+    }
+    #[tokio::test]
+    async fn test_should_charge_repeated_compressed_sources_and_preserve_first_pending_artifact() {
+        let root = tempfile::tempdir().unwrap();
+        let store = FunctionStore::new(root.path());
+        let encoded = source();
+        let bytes = STANDARD.decode(&encoded).unwrap().len();
+        let mut budget = ZipRestoreBudget::new(Instant::now() + Duration::from_secs(5));
+        budget.limits.sources = bytes;
+        let first = budget.stage(&store, encoded.clone()).await.unwrap();
+        assert!(budget.stage(&store, encoded).await.is_err());
+        assert_eq!(entries(root.path()).await, 1);
+        assert!(first.artifact().code_root().is_absolute());
+        drop(first);
+        assert_eq!(entries(root.path()).await, 0);
+    }
+    #[tokio::test]
+    async fn test_should_join_accepted_private_extraction_past_original_deadline_before_returning_error()
+     {
+        let root = tempfile::tempdir().unwrap();
+        let store = Arc::new(FunctionStore::new(root.path()));
+        let deadline = Instant::now() + Duration::from_secs(2);
+        let (mut budget, entered, release) = held(deadline);
+        let worker_store = store.clone();
+        let job =
+            tokio::spawn(async move { budget.stage(&worker_store, source()).await.map(drop) });
+        timeout(Duration::from_secs(3), entered)
+            .await
+            .unwrap()
+            .unwrap();
+        sleep_until(deadline + Duration::from_millis(10)).await;
+        assert!(!job.is_finished());
+        assert!(store.artifacts.is_empty());
+        assert_eq!(store.staging.available_permits(), 3);
+        assert_eq!(entries(root.path()).await, 1);
+        release.send(()).unwrap();
+        assert!(matches!(
+            timeout(Duration::from_secs(3), job).await.unwrap().unwrap(),
+            Err(LambdaServiceError::ResourceNotReady { .. })
+        ));
+        assert!(store.artifacts.is_empty());
+        assert_eq!(store.staging.available_permits(), 4);
+        assert_eq!(entries(root.path()).await, 0);
+    }
+    #[tokio::test]
+    async fn test_should_retain_abandoned_worker_cleanup_without_late_store_registration() {
+        let root = tempfile::tempdir().unwrap();
+        let store = Arc::new(FunctionStore::new(root.path()));
+        let (mut budget, entered, release) = held(Instant::now() + Duration::from_secs(10));
+        let worker_store = store.clone();
+        let job =
+            tokio::spawn(async move { budget.stage(&worker_store, source()).await.map(drop) });
+        timeout(Duration::from_secs(3), entered)
+            .await
+            .unwrap()
+            .unwrap();
+        job.abort();
+        assert!(job.await.unwrap_err().is_cancelled());
+        assert_eq!(store.staging.available_permits(), 3);
+        assert!(store.artifacts.is_empty());
+        release.send(()).unwrap();
+        timeout(Duration::from_secs(3), async {
+            loop {
+                if entries(root.path()).await == 0 && store.staging.available_permits() == 4 {
+                    break;
+                }
+                sleep(Duration::from_millis(5)).await;
+            }
+        })
+        .await
+        .unwrap();
+        assert!(store.artifacts.is_empty());
+    }
+    #[tokio::test]
+    async fn test_should_probe_size_overflow_without_writing_beyond_the_charged_bytes() {
+        let root = tempfile::tempdir().unwrap();
+        let mut bytes = STANDARD.decode(source()).unwrap();
+        let central = bytes
+            .windows(4)
+            .position(|bytes| bytes == b"PK\x01\x02")
+            .unwrap();
+        bytes
+            .get_mut(central + 24..central + 28)
+            .unwrap()
+            .copy_from_slice(&2_u32.to_le_bytes());
+        let path = root.path().to_path_buf();
+        let result = spawn_blocking(move || super::super::extract_zip(&bytes, &path, 2, None))
+            .await
+            .unwrap();
+        assert!(result.is_err());
+        assert_eq!(
+            fs::metadata(root.path().join("tree/file"))
+                .await
+                .unwrap()
+                .len(),
+            2
+        );
+    }
+}
diff --git a/crates/rustack-lambda-core/src/storage/snapshot_view.rs b/crates/rustack-lambda-core/src/storage/snapshot_view.rs
new file mode 100644
index 00000000..923da06a
--- /dev/null
+++ b/crates/rustack-lambda-core/src/storage/snapshot_view.rs
@@ -0,0 +1,115 @@
+//! Borrow archive projections while map entry guards protect dynamic values.
+
+use std::{borrow::Borrow, fmt};
+
+use base64::{display::Base64Display, engine::general_purpose::STANDARD};
+use bytes::Bytes;
+use dashmap::DashMap;
+use serde::{
+    Serialize, Serializer,
+    ser::{Error as _, SerializeSeq},
+};
+
+use super::{
+    EventSourceMappingRecord, EventSourceMappingStore, FunctionRecord, FunctionStore, LayerRecord,
+    LayerStore,
+};
+use crate::{artifact::ImageArtifact, deployment::DeploymentState, error::LambdaServiceError};
+
+type Guard<T> = fn(&T) -> Result<(), LambdaServiceError>;
+struct Records<'a, T> {
+    values: &'a DashMap<String, T>,
+    guard: Guard<T>,
+}
+impl<T> Serialize for Records<'_, T>
+where
+    T: Serialize + Send + Sync,
+{
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let mut sequence = serializer.serialize_seq(Some(self.values.len()))?;
+        for record in self.values {
+            (self.guard)(record.value())
+                .map_err(|_| S::Error::custom("invalid image archive record"))?;
+            sequence.serialize_element(record.value())?;
+        }
+        sequence.end()
+    }
+}
+impl<T> fmt::Debug for Records<'_, T> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Records(<borrowed>)")
+    }
+}
+#[derive(Debug, Serialize)]
+pub(crate) struct FunctionSnapshotRef<'a> {
+    functions: Records<'a, FunctionRecord>,
+}
+#[derive(Debug, Serialize)]
+pub(crate) struct LayerSnapshotRef<'a> {
+    layers: Records<'a, LayerRecord>,
+}
+#[derive(Debug, Serialize)]
+pub(crate) struct MappingSnapshotRef<'a> {
+    mappings: Records<'a, EventSourceMappingRecord>,
+}
+impl FunctionStore {
+    pub(crate) fn borrow_snapshot(&self, guard: Guard<FunctionRecord>) -> FunctionSnapshotRef<'_> {
+        FunctionSnapshotRef {
+            functions: Records {
+                values: &self.functions,
+                guard,
+            },
+        }
+    }
+}
+impl LayerStore {
+    pub(crate) fn borrow_snapshot(&self, guard: Guard<LayerRecord>) -> LayerSnapshotRef<'_> {
+        LayerSnapshotRef {
+            layers: Records {
+                values: &self.layers,
+                guard,
+            },
+        }
+    }
+}
+impl EventSourceMappingStore {
+    pub(crate) fn borrow_snapshot(&self) -> MappingSnapshotRef<'_> {
+        MappingSnapshotRef {
+            mappings: Records {
+                values: &self.mappings,
+                guard: |_| Ok(()),
+            },
+        }
+    }
+}
+pub(super) fn image<S: Serializer>(
+    value: &ImageArtifact,
+    serializer: S,
+) -> Result<S::Ok, S::Error> {
+    value.resolved().serialize(serializer)
+}
+pub(super) fn zip<S: Serializer, B: Borrow<Option<Bytes>>>(
+    value: B,
+    serializer: S,
+) -> Result<S::Ok, S::Error> {
+    if let Some(bytes) = value.borrow() {
+        serializer.collect_str(&Base64Display::new(bytes, &STANDARD))
+    } else {
+        serializer.serialize_none()
+    }
+}
+pub(super) fn deployment<S: Serializer>(
+    value: &DeploymentState,
+    serializer: S,
+) -> Result<S::Ok, S::Error> {
+    #[derive(Serialize)]
+    struct State<'a> {
+        state: &'a str,
+        deployment: &'a DeploymentState,
+    }
+    State {
+        state: value.state(),
+        deployment: value,
+    }
+    .serialize(serializer)
+}
diff --git a/crates/rustack-lambda-core/src/storage/zip_layout.rs b/crates/rustack-lambda-core/src/storage/zip_layout.rs
new file mode 100644
index 00000000..d48b2fbd
--- /dev/null
+++ b/crates/rustack-lambda-core/src/storage/zip_layout.rs
@@ -0,0 +1,114 @@
+//! Shared bounded filesystem-tree validation, including implicit ZIP parents.
+
+use std::{
+    collections::{BTreeMap, HashSet},
+    path::{Path, PathBuf},
+};
+
+use crate::error::LambdaServiceError;
+
+const MAX_NODES: usize = 10_000;
+
+#[derive(Debug, Default)]
+pub(crate) struct ZipLayout {
+    nodes: BTreeMap<PathBuf, bool>,
+    explicit: HashSet<PathBuf>,
+}
+
+impl ZipLayout {
+    pub(super) fn node_count(&self) -> usize {
+        self.nodes.len()
+    }
+
+    /// Validate a member and return newly required directories, root first.
+    pub(crate) fn admit(
+        &mut self,
+        path: &Path,
+        directory: bool,
+    ) -> Result<Vec<PathBuf>, LambdaServiceError> {
+        if path.file_name().is_none() || !self.explicit.insert(path.to_owned()) {
+            return Err(invalid());
+        }
+        let mut parents: Vec<&Path> = path
+            .ancestors()
+            .skip(1)
+            .filter(|parent| parent.file_name().is_some())
+            .collect();
+        parents.reverse();
+        let mut created = Vec::new();
+        for parent in parents {
+            match self.nodes.get(parent) {
+                Some(false) => return Err(invalid()),
+                Some(true) => {}
+                None => {
+                    self.insert(parent, true)?;
+                    created.push(parent.to_owned());
+                }
+            }
+        }
+        match self.nodes.get(path) {
+            Some(true) if directory => {}
+            Some(_) => return Err(invalid()),
+            None => {
+                self.insert(path, directory)?;
+                if directory {
+                    created.push(path.to_owned());
+                }
+            }
+        }
+        Ok(created)
+    }
+    fn insert(&mut self, path: &Path, directory: bool) -> Result<(), LambdaServiceError> {
+        if self.nodes.len() >= MAX_NODES {
+            return Err(invalid());
+        }
+        self.nodes.insert(path.to_owned(), directory);
+        Ok(())
+    }
+}
+
+fn invalid() -> LambdaServiceError {
+    LambdaServiceError::InvalidZipFile {
+        message: "Invalid or oversized ZIP filesystem tree".into(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_should_bound_the_complete_tree_including_implicit_directories() {
+        let mut layout = ZipLayout::default();
+        assert_eq!(
+            layout.admit(Path::new("root/branch/file"), false).unwrap(),
+            vec![PathBuf::from("root"), PathBuf::from("root/branch")]
+        );
+        assert_eq!(
+            layout.admit(Path::new("root/branch"), true).unwrap(),
+            [] as [PathBuf; 0]
+        );
+        for n in 3..MAX_NODES {
+            layout.admit(Path::new(&format!("f{n}")), false).unwrap();
+        }
+        assert_eq!(layout.nodes.len(), MAX_NODES);
+        assert!(layout.admit(Path::new("one-more"), false).is_err());
+    }
+
+    #[test]
+    fn test_should_reject_duplicate_and_parent_file_conflicts_in_either_order() {
+        for reverse in [false, true] {
+            let mut layout = ZipLayout::default();
+            let (first, second) = if reverse {
+                ("parent/file", "parent")
+            } else {
+                ("parent", "parent/file")
+            };
+            layout.admit(Path::new(first), false).unwrap();
+            assert!(layout.admit(Path::new(second), false).is_err());
+        }
+        let mut layout = ZipLayout::default();
+        layout.admit(Path::new("directory"), true).unwrap();
+        assert!(layout.admit(Path::new("directory"), true).is_err());
+    }
+}
diff --git a/crates/rustack-lambda-core/src/work.rs b/crates/rustack-lambda-core/src/work.rs
index 24ebb4ed..8b6e60b7 100644
--- a/crates/rustack-lambda-core/src/work.rs
+++ b/crates/rustack-lambda-core/src/work.rs
@@ -1,36 +1,90 @@
-//! Bounded, supervised invocation lifecycle. No detached Event tasks.
+//! Bounded invocation admission and a single owner for execution/cleanup futures.
+
 use std::{
+    collections::HashMap,
     sync::{
-        Arc,
+        Arc, OnceLock,
         atomic::{AtomicBool, AtomicUsize, Ordering},
     },
     time::Duration,
 };
 
-use dashmap::DashMap;
 use tokio::{
-    sync::{Mutex, Notify, OwnedSemaphorePermit, Semaphore, oneshot},
-    task::{AbortHandle, JoinSet},
+    sync::{Mutex, Notify, OwnedSemaphorePermit, Semaphore, mpsc, oneshot, watch},
+    task::{Id, JoinHandle, JoinSet},
+    time::{Instant, timeout},
 };
+use typed_builder::TypedBuilder;
 
 use crate::{
+    diagnostics::{
+        ACCEPTED_LIMIT, DEFAULT_FUNCTION_LIMIT, EXECUTION_LIMIT, InvocationWorkLimits,
+        InvocationWorkStatus,
+    },
     error::LambdaServiceError,
-    executor::{Executor, InvokeRequest, InvokeResponse},
+    executor::{Executor, ExecutorError, InvokeRequest, InvokeResponse},
+    invocation::{InvocationContext, InvocationHandle, InvocationSubmission, Settlement},
 };
 
 #[derive(Debug)]
 pub(crate) struct WorkManager {
-    tasks: Mutex<JoinSet<()>>,
-    accepting: AtomicBool,
+    accepting: Arc<AtomicBool>,
     capacity: Arc<Semaphore>,
     global: Arc<Semaphore>,
-    functions: DashMap<String, Arc<FunctionCapacity>>,
+    drain: Arc<Notify>,
+    supervisor: OnceLock<SupervisorHandle>,
+}
+
+#[derive(Debug)]
+struct SupervisorHandle {
+    inbox: mpsc::Sender<Submission>,
+    stop: watch::Sender<bool>,
+    state: watch::Receiver<SupervisorState>,
+    task: Mutex<Option<JoinHandle<()>>>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SupervisorState {
+    Running,
+    Stopped { failed: bool },
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Submission {
+    executor: Arc<dyn Executor>,
+    request: InvokeRequest,
+    context: InvocationContext,
+    cancellation: watch::Sender<bool>,
+    reserved: usize,
+    asynchronous: bool,
+    slot: OwnedSemaphorePermit,
+    admitted: oneshot::Sender<Result<(), LambdaServiceError>>,
+    response: oneshot::Sender<Result<InvokeResponse, ExecutorError>>,
+    settlement: watch::Sender<Settlement>,
+}
+
+#[derive(Debug, TypedBuilder)]
+struct Supervisor {
+    inbox: mpsc::Receiver<Submission>,
+    stop: watch::Receiver<bool>,
+    drain: Arc<Notify>,
+    accepting: Arc<AtomicBool>,
+    global: Arc<Semaphore>,
+    state: watch::Sender<SupervisorState>,
+    #[builder(default)]
+    jobs: JoinSet<bool>,
+    #[builder(default)]
+    cancellations: HashMap<Id, watch::Sender<bool>>,
+    #[builder(default)]
+    functions: HashMap<String, Arc<FunctionCapacity>>,
 }
+
 #[derive(Debug, Default)]
 struct FunctionCapacity {
     active: AtomicUsize,
     changed: Notify,
 }
+
 #[derive(Debug)]
 struct FunctionPermit(Arc<FunctionCapacity>);
 impl Drop for FunctionPermit {
@@ -39,8 +93,11 @@ impl Drop for FunctionPermit {
         self.0.changed.notify_waiters();
     }
 }
+
+#[cfg(test)]
 #[derive(Debug)]
-pub(crate) struct CancelOnDrop(pub(crate) AbortHandle);
+pub(crate) struct CancelOnDrop(pub(crate) tokio::task::AbortHandle);
+#[cfg(test)]
 impl Drop for CancelOnDrop {
     fn drop(&mut self) {
         self.0.abort();
@@ -52,9 +109,6 @@ fn unavailable(message: &str) -> LambdaServiceError {
         message: message.into(),
     }
 }
-fn throttled() -> LambdaServiceError {
-    LambdaServiceError::TooManyRequests
-}
 
 impl FunctionCapacity {
     fn try_acquire(self: &Arc<Self>, limit: usize) -> Result<FunctionPermit, LambdaServiceError> {
@@ -66,9 +120,10 @@ impl FunctionCapacity {
                     None
                 }
             })
-            .map_err(|_| throttled())?;
+            .map_err(|_| LambdaServiceError::TooManyRequests)?;
         Ok(FunctionPermit(Arc::clone(self)))
     }
+
     async fn acquire(self: &Arc<Self>, limit: usize) -> FunctionPermit {
         loop {
             let changed = self.changed.notified();
@@ -85,260 +140,704 @@ impl FunctionCapacity {
 impl WorkManager {
     pub(crate) fn new() -> Self {
         Self {
-            tasks: Mutex::new(JoinSet::new()),
-            accepting: AtomicBool::new(true),
-            capacity: Arc::new(Semaphore::new(128)),
-            global: Arc::new(Semaphore::new(32)),
-            functions: DashMap::new(),
+            accepting: Arc::new(AtomicBool::new(true)),
+            capacity: Arc::new(Semaphore::new(ACCEPTED_LIMIT)),
+            global: Arc::new(Semaphore::new(EXECUTION_LIMIT)),
+            drain: Arc::new(Notify::new()),
+            supervisor: OnceLock::new(),
+        }
+    }
+
+    pub(crate) fn status(&self) -> InvocationWorkStatus {
+        InvocationWorkStatus {
+            accepted_invocations: ACCEPTED_LIMIT.saturating_sub(self.capacity.available_permits()),
+            active_executions: EXECUTION_LIMIT.saturating_sub(self.global.available_permits()),
+            accepting: self.accepting.load(Ordering::Acquire),
+            limits: InvocationWorkLimits {
+                accepted_invocations: ACCEPTED_LIMIT,
+                active_executions: EXECUTION_LIMIT,
+                default_function_executions: DEFAULT_FUNCTION_LIMIT,
+            },
         }
     }
 
+    fn supervisor(&self) -> &SupervisorHandle {
+        self.supervisor.get_or_init(|| {
+            let (inbox, receiver) = mpsc::channel(ACCEPTED_LIMIT);
+            let (stop, cancellation) = watch::channel(false);
+            let (state, snapshot) = watch::channel(SupervisorState::Running);
+            let supervisor = Supervisor::builder()
+                .inbox(receiver)
+                .stop(cancellation)
+                .drain(Arc::clone(&self.drain))
+                .accepting(Arc::clone(&self.accepting))
+                .global(Arc::clone(&self.global))
+                .state(state)
+                .build();
+            let task = tokio::spawn(supervisor.run());
+            SupervisorHandle {
+                inbox,
+                stop,
+                state: snapshot,
+                task: Mutex::new(Some(task)),
+            }
+        })
+    }
+
+    #[cfg(test)]
     pub(crate) async fn submit(
         &self,
         executor: Arc<dyn Executor>,
-        req: InvokeRequest,
+        request: InvokeRequest,
+        reserved: Option<i32>,
+        asynchronous: bool,
+        caller_deadline: Option<Instant>,
+    ) -> Result<InvocationHandle, LambdaServiceError> {
+        let mut submission = self.submit_owned(
+            executor,
+            request,
+            reserved,
+            asynchronous,
+            caller_deadline,
+            None,
+        )?;
+        submission.admitted().await?;
+        Ok(submission.into_handle())
+    }
+
+    pub(crate) fn submit_owned(
+        &self,
+        executor: Arc<dyn Executor>,
+        request: InvokeRequest,
         reserved: Option<i32>,
         asynchronous: bool,
-    ) -> Result<
-        (
-            oneshot::Receiver<Result<InvokeResponse, LambdaServiceError>>,
-            AbortHandle,
-        ),
-        LambdaServiceError,
-    > {
-        executor.available()?;
-        let limit = usize::try_from(reserved.unwrap_or(8))
-            .map_err(|_| unavailable("Invalid reserved concurrency"))?;
-        if limit == 0 {
-            return Err(throttled());
+        caller_deadline: Option<Instant>,
+        external: Option<watch::Receiver<bool>>,
+    ) -> Result<InvocationSubmission, LambdaServiceError> {
+        executor.available(&request)?;
+        if !self.accepting.load(Ordering::Acquire) {
+            return Err(unavailable("Lambda is quiescing"));
+        }
+        let reserved = match reserved {
+            Some(reserved) => usize::try_from(reserved)
+                .map_err(|_| unavailable("Invalid reserved concurrency"))?,
+            None => DEFAULT_FUNCTION_LIMIT,
+        };
+        if reserved == 0 {
+            return Err(LambdaServiceError::TooManyRequests);
         }
         let slot = Arc::clone(&self.capacity)
             .try_acquire_owned()
-            .map_err(|_| throttled())?;
-        self.functions.retain(|_, capacity| {
-            Arc::strong_count(capacity) > 1 || capacity.active.load(Ordering::Acquire) != 0
+            .map_err(|_| LambdaServiceError::TooManyRequests)?;
+        let total = request
+            .revision
+            .timeout
+            .saturating_add(Duration::from_secs(10));
+        let deadline = Instant::now()
+            .checked_add(total)
+            .ok_or_else(|| unavailable("Invalid invocation budget"))?;
+        let deadline = caller_deadline.map_or(deadline, |caller| caller.min(deadline));
+        let (cancellation, context) =
+            InvocationContext::channel_with_cancellation(deadline, external);
+        context.check()?;
+        let (admitted, accepted) = oneshot::channel();
+        let (response, receiver) = oneshot::channel();
+        let (settlement, settled) = watch::channel(Settlement::Pending);
+        let handle =
+            InvocationHandle::new(context.clone(), cancellation.clone(), receiver, settled);
+        let submission = Submission::builder()
+            .executor(executor)
+            .request(request)
+            .context(context.clone())
+            .cancellation(cancellation)
+            .reserved(reserved)
+            .asynchronous(asynchronous)
+            .slot(slot)
+            .admitted(admitted)
+            .response(response)
+            .settlement(settlement)
+            .build();
+        self.supervisor()
+            .inbox
+            .try_send(submission)
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => LambdaServiceError::TooManyRequests,
+                mpsc::error::TrySendError::Closed(_) => unavailable("Lambda supervisor stopped"),
+            })?;
+        Ok(InvocationSubmission::new(handle, accepted))
+    }
+
+    pub(crate) fn cancel_all(&self) {
+        self.accepting.store(false, Ordering::Release);
+        if let Some(supervisor) = self.supervisor.get() {
+            supervisor.stop.send_replace(true);
+        }
+        self.drain.notify_one();
+    }
+
+    pub(crate) async fn quiesce(&self, budget: Duration) -> Result<(), LambdaServiceError> {
+        self.accepting.store(false, Ordering::Release);
+        self.drain.notify_one();
+        let Some(supervisor) = self.supervisor.get() else {
+            return Ok(());
+        };
+        let mut state = supervisor.state.clone();
+        let clean = {
+            let result = timeout(
+                budget,
+                state.wait_for(|state| matches!(state, SupervisorState::Stopped { .. })),
+            )
+            .await;
+            match result {
+                Ok(Ok(state)) => matches!(*state, SupervisorState::Stopped { failed: false }),
+                _ => false,
+            }
+        };
+        if !clean {
+            supervisor.stop.send_replace(true);
+            return Err(unavailable(
+                "Lambda quiesce did not confirm all invocation cleanup",
+            ));
+        }
+        let mut task = supervisor.task.lock().await;
+        if let Some(task) = task.as_mut() {
+            task.await
+                .map_err(|_| unavailable("Lambda supervisor failed"))?;
+        }
+        task.take();
+        Ok(())
+    }
+}
+
+impl Drop for WorkManager {
+    fn drop(&mut self) {
+        // Fallback only: the detached actor keeps cleanup futures alive until settlement.
+        // Normal provider shutdown awaits quiescence before dropping this owner.
+        self.cancel_all();
+    }
+}
+
+impl Supervisor {
+    fn cancel_all(&self) {
+        for cancellation in self.cancellations.values() {
+            cancellation.send_replace(true);
+        }
+    }
+
+    fn admit(&mut self, submission: Submission) {
+        let result = if self.accepting.load(Ordering::Acquire) {
+            submission.context.check().map_err(LambdaServiceError::from)
+        } else {
+            Err(unavailable("Lambda is quiescing"))
+        };
+        if let Err(error) = result {
+            reject(submission, error);
+            return;
+        }
+        self.functions.retain(|_, function| {
+            Arc::strong_count(function) > 1 || function.active.load(Ordering::Acquire) != 0
         });
         let function = Arc::clone(
             self.functions
-                .entry(req.function_name.clone())
-                .or_insert_with(|| Arc::new(FunctionCapacity::default()))
-                .value(),
+                .entry(submission.request.revision.function_name.clone())
+                .or_default(),
         );
-        let permits = if asynchronous {
+        let permits = if submission.asynchronous {
             None
         } else {
-            Some((
-                function.try_acquire(limit)?,
-                Arc::clone(&self.global)
-                    .try_acquire_owned()
-                    .map_err(|_| throttled())?,
-            ))
-        };
-        let mut tasks = self.tasks.lock().await;
-        while let Some(result) = tasks.try_join_next() {
-            if let Err(error) = result {
-                tracing::error!(%error, "Lambda worker failed");
+            match function
+                .try_acquire(submission.reserved)
+                .and_then(|function| {
+                    Arc::clone(&self.global)
+                        .try_acquire_owned()
+                        .map(|global| (function, global))
+                        .map_err(|_| LambdaServiceError::TooManyRequests)
+                }) {
+                Ok(permits) => Some(permits),
+                Err(error) => {
+                    reject(submission, error);
+                    return;
+                }
             }
-        }
-        if !self.accepting.load(Ordering::Acquire) {
-            return Err(unavailable("Lambda is quiescing"));
-        }
-        let (tx, rx) = oneshot::channel();
+        };
+        let Submission {
+            executor,
+            request,
+            context,
+            cancellation,
+            reserved,
+            slot,
+            admitted,
+            response,
+            settlement,
+            ..
+        } = submission;
         let global = Arc::clone(&self.global);
-        let handle = tasks.spawn(async move {
-            let _slot = slot;
-            let result = execute(executor, req, function, global, limit, permits).await;
-            match &result {
-                Ok(_) => tracing::debug!("Lambda invocation completed"),
-                Err(error) => tracing::warn!(%error, "Lambda invocation failed"),
-            }
-            if tx.send(result).is_err() {
-                tracing::debug!("Lambda invocation completed without a waiting caller");
-            }
+        let worker = self.jobs.spawn(async move {
+            let result = execute(
+                executor, request, context, function, global, reserved, permits,
+            )
+            .await;
+            let clean = !matches!(&result, Err(ExecutorError::CleanupFailed(_)));
+            // Backend cleanup completes before permits and the admission slot are released.
+            drop(slot);
+            settlement.send_replace(if clean {
+                Settlement::Clean
+            } else {
+                Settlement::Uncertain
+            });
+            let _ = response.send(result);
+            clean
         });
-        Ok((rx, handle))
+        self.cancellations.insert(worker.id(), cancellation);
+        let _ = admitted.send(Ok(()));
     }
 
-    pub(crate) async fn quiesce(&self, timeout: Duration) -> Result<(), LambdaServiceError> {
-        self.accepting.store(false, Ordering::Release);
-        // Own the JoinSet across awaits so cancellation of quiesce drops/aborts every task.
-        let mut tasks = std::mem::take(&mut *self.tasks.lock().await);
-        let drained = tokio::time::timeout(timeout, async {
-            while let Some(result) = tasks.join_next().await {
-                if let Err(error) = result {
-                    return Err(unavailable(&format!("Lambda task failed: {error}")));
-                }
+    async fn run(mut self) {
+        let mut failed = false;
+        loop {
+            if !self.accepting.load(Ordering::Acquire) || *self.stop.borrow() {
+                self.inbox.close();
             }
-            // Includes workers aborted by a previously cancelled quiesce future.
-            let _all_capacity = Arc::clone(&self.capacity)
-                .acquire_many_owned(128)
-                .await
-                .map_err(|_| unavailable("Lambda accepted-work capacity closed"))?;
-            Ok(())
-        })
-        .await;
-        match drained {
-            Ok(Ok(())) => Ok(()),
-            result => {
-                tasks.abort_all();
-                while let Some(result) = tasks.join_next().await {
-                    if let Err(error) = result {
-                        tracing::warn!(%error, "Lambda task cancelled during quiesce");
+            if *self.stop.borrow() {
+                self.cancel_all();
+            }
+            if self.inbox.is_closed() && self.inbox.is_empty() && self.jobs.is_empty() {
+                break;
+            }
+            tokio::select! {
+                biased;
+                _ = self.stop.changed(), if !*self.stop.borrow() => { self.accepting.store(false, Ordering::Release); }
+                () = self.drain.notified() => {}
+                completed = self.jobs.join_next_with_id(), if !self.jobs.is_empty() => {
+                    match completed {
+                        Some(Ok((id, clean))) => {
+                            self.cancellations.remove(&id);
+                            if !clean { failed = true; }
+                        }
+                        Some(Err(error)) => {
+                            self.cancellations.remove(&error.id());
+                            failed = true;
+                            tracing::error!("Lambda invocation worker terminated without confirmed settlement");
+                        }
+                        None => {}
                     }
+                    if failed { self.accepting.store(false, Ordering::Release); self.cancel_all(); }
                 }
-                match result {
-                    Ok(Err(error)) => Err(error),
-                    _ => Err(unavailable(
-                        "Lambda quiesce deadline exceeded; remaining invocations cancelled",
-                    )),
+                submission = self.inbox.recv(), if !self.inbox.is_closed() || !self.inbox.is_empty() => {
+                    if let Some(submission) = submission { self.admit(submission); }
                 }
             }
         }
+        self.accepting.store(false, Ordering::Release);
+        self.state.send_replace(SupervisorState::Stopped { failed });
     }
 }
 
+fn reject(submission: Submission, error: LambdaServiceError) {
+    let Submission {
+        slot,
+        admitted,
+        response,
+        settlement,
+        ..
+    } = submission;
+    drop(slot);
+    settlement.send_replace(Settlement::Clean);
+    let _ = response.send(Err(ExecutorError::Cancelled));
+    let _ = admitted.send(Err(error));
+}
+
 async fn execute(
     executor: Arc<dyn Executor>,
-    req: InvokeRequest,
+    request: InvokeRequest,
+    context: InvocationContext,
     function: Arc<FunctionCapacity>,
     global: Arc<Semaphore>,
     limit: usize,
     permits: Option<(FunctionPermit, OwnedSemaphorePermit)>,
-) -> Result<InvokeResponse, LambdaServiceError> {
-    let (_function, _global) = match permits {
-        Some(permits) => permits,
-        None => (
-            function.acquire(limit).await,
-            global
-                .acquire_owned()
-                .await
-                .map_err(|_| unavailable("Lambda execution closed"))?,
-        ),
+) -> Result<InvokeResponse, ExecutorError> {
+    let acquired = async {
+        match permits {
+            Some(permits) => Ok::<_, ExecutorError>(permits),
+            None => Ok((
+                function.acquire(limit).await,
+                global
+                    .acquire_owned()
+                    .await
+                    .map_err(|_| ExecutorError::Cancelled)?,
+            )),
+        }
     };
-    let deadline = req.timeout.saturating_add(Duration::from_secs(10));
-    match tokio::time::timeout(deadline, executor.invoke(req)).await {
-        Ok(result) => result.map_err(LambdaServiceError::from),
-        Err(_) => Err(unavailable("Lambda invocation deadline exceeded")),
-    }
+    let (_function, _global) = tokio::select! {
+        biased;
+        reason = context.cancelled() => return Err(reason.error()),
+        result = acquired => result?,
+    };
+    context.check()?;
+    executor.invoke(request, context).await
 }
 
 #[cfg(test)]
 mod tests {
-    use std::collections::HashMap;
+    use std::sync::atomic::AtomicBool;
 
     use async_trait::async_trait;
-    use bytes::Bytes;
+    use tokio::sync::Semaphore;
 
     use super::*;
-    use crate::executor::{ExecutorError, PackageType};
 
     #[derive(Debug)]
-    struct WaitingExecutor;
+    struct ProbeExecutor {
+        started: Semaphore,
+        cancelling: Semaphore,
+        cleanup: Semaphore,
+        hold_cleanup: AtomicBool,
+        calls: AtomicUsize,
+    }
+    impl ProbeExecutor {
+        fn new(hold_cleanup: bool) -> Self {
+            Self {
+                started: Semaphore::new(0),
+                cancelling: Semaphore::new(0),
+                cleanup: Semaphore::new(0),
+                hold_cleanup: AtomicBool::new(hold_cleanup),
+                calls: AtomicUsize::new(0),
+            }
+        }
+        async fn started(&self, count: u32) {
+            timeout(Duration::from_secs(2), self.started.acquire_many(count))
+                .await
+                .unwrap()
+                .unwrap()
+                .forget();
+        }
+        async fn cancelling(&self) {
+            timeout(Duration::from_secs(2), self.cancelling.acquire())
+                .await
+                .unwrap()
+                .unwrap()
+                .forget();
+        }
+    }
     #[async_trait]
-    impl Executor for WaitingExecutor {
-        async fn invoke(&self, _request: InvokeRequest) -> Result<InvokeResponse, ExecutorError> {
-            std::future::pending().await
+    impl Executor for ProbeExecutor {
+        async fn invoke(
+            &self,
+            _request: InvokeRequest,
+            context: InvocationContext,
+        ) -> Result<InvokeResponse, ExecutorError> {
+            self.calls.fetch_add(1, Ordering::AcqRel);
+            self.started.add_permits(1);
+            let reason = context.cancelled().await;
+            self.cancelling.add_permits(1);
+            if self.hold_cleanup.load(Ordering::Acquire) {
+                self.cleanup
+                    .acquire()
+                    .await
+                    .map_err(|_| ExecutorError::CleanupFailed("Probe cleanup closed".into()))?
+                    .forget();
+            }
+            Err(reason.error())
+        }
+        async fn shutdown(&self) -> Result<(), ExecutorError> {
+            Ok(())
         }
-        async fn shutdown(&self) {}
     }
     fn request(name: &str) -> InvokeRequest {
-        InvokeRequest {
-            function_name: name.into(),
-            function_arn: "arn".into(),
-            qualifier: "$LATEST".into(),
-            runtime: None,
-            handler: None,
-            architectures: vec![],
-            package_type: PackageType::Zip,
-            code_root: None,
-            code_zip: None,
-            image_uri: None,
-            environment: HashMap::new(),
-            timeout: Duration::from_mins(1),
-            memory_mb: 128,
-            payload: Bytes::new(),
-            capture_logs: false,
+        let mut request = InvokeRequest::fixture();
+        let revision = Arc::make_mut(&mut request.revision);
+        revision.function_name = name.into();
+        revision.timeout = Duration::from_secs(60);
+        request
+    }
+
+    #[tokio::test]
+    async fn test_should_observe_actual_accepted_active_and_retained_cleanup_without_admission() {
+        let work = WorkManager::new();
+        let idle = work.status();
+        assert!(work.supervisor.get().is_none());
+        assert_eq!(
+            (
+                idle.accepted_invocations,
+                idle.active_executions,
+                idle.accepting
+            ),
+            (0, 0, true)
+        );
+        let serialized = serde_json::to_value(idle).unwrap();
+        assert_eq!(
+            serialized,
+            serde_json::json!({"acceptedInvocations":0,"activeExecutions":0,"accepting":true,
+            "limits":{"acceptedInvocations":128,"activeExecutions":32,"defaultFunctionExecutions":8}})
+        );
+        let executor = Arc::new(ProbeExecutor::new(true));
+        for _ in 0..3 {
+            work.submit(executor.clone(), request("one"), Some(1), true, None)
+                .await
+                .unwrap()
+                .detach();
         }
+        executor.started(1).await;
+        let active = work.status();
+        assert_eq!(
+            (active.accepted_invocations, active.active_executions),
+            (3, 1)
+        );
+        work.cancel_all();
+        executor.cancelling().await;
+        timeout(Duration::from_secs(2), async {
+            while work.status().accepted_invocations != 1 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+        let retained = work.status();
+        assert_eq!(
+            (
+                retained.accepted_invocations,
+                retained.active_executions,
+                retained.accepting
+            ),
+            (1, 1, false)
+        );
+        executor.cleanup.add_permits(1);
+        work.quiesce(Duration::from_secs(2)).await.unwrap();
+        let settled = work.status();
+        assert_eq!(
+            (
+                settled.accepted_invocations,
+                settled.active_executions,
+                settled.accepting
+            ),
+            (0, 0, false)
+        );
     }
+
     #[tokio::test]
-    async fn test_should_bound_event_set_before_accepting_and_release_on_cancel() {
+    async fn test_should_bound_event_admission_and_cancel_queued_work_without_starting_it() {
         let work = WorkManager::new();
+        let executor = Arc::new(ProbeExecutor::new(false));
         for _ in 0..128 {
-            work.submit(Arc::new(WaitingExecutor), request("bounded"), None, true)
+            work.submit(executor.clone(), request("bounded"), None, true, None)
                 .await
-                .unwrap();
+                .unwrap()
+                .detach();
         }
+        executor.started(8).await;
+        assert_eq!(
+            (
+                work.status().accepted_invocations,
+                work.status().active_executions
+            ),
+            (128, 8)
+        );
+        assert_eq!(executor.calls.load(Ordering::Acquire), 8);
         assert!(matches!(
-            work.submit(Arc::new(WaitingExecutor), request("bounded"), None, true)
+            work.submit(executor.clone(), request("bounded"), None, true, None)
                 .await,
             Err(LambdaServiceError::TooManyRequests)
         ));
-        tokio::task::yield_now().await;
-        assert!(
-            work.functions
-                .get("bounded")
-                .unwrap()
-                .active
-                .load(Ordering::Acquire)
-                <= 8
-        );
-        assert!(work.global.available_permits() >= 24);
-        assert!(work.quiesce(Duration::ZERO).await.is_err());
+        work.cancel_all();
+        work.quiesce(Duration::from_secs(2)).await.unwrap();
         assert_eq!(work.capacity.available_permits(), 128);
         assert_eq!(work.global.available_permits(), 32);
-        assert_eq!(
-            work.functions
-                .get("bounded")
-                .unwrap()
-                .active
-                .load(Ordering::Acquire),
-            0
-        );
+        assert_eq!(executor.calls.load(Ordering::Acquire), 8);
         assert!(
-            work.submit(Arc::new(WaitingExecutor), request("bounded"), None, true)
+            work.submit(executor, request("bounded"), None, true, None)
                 .await
                 .is_err()
         );
     }
+
     #[tokio::test]
-    async fn test_should_enforce_function_global_and_zero_reserved_execution_limits() {
+    async fn test_should_enforce_shared_function_global_and_zero_reserved_execution_limits() {
         let work = WorkManager::new();
+        let executor = Arc::new(ProbeExecutor::new(false));
         assert!(matches!(
-            work.submit(Arc::new(WaitingExecutor), request("zero"), Some(0), true)
+            work.submit(executor.clone(), request("zero"), Some(0), true, None)
                 .await,
             Err(LambdaServiceError::TooManyRequests)
         ));
+        let mut handles = Vec::new();
         for name in ["a", "b", "c", "d"] {
             for _ in 0..8 {
-                work.submit(Arc::new(WaitingExecutor), request(name), None, false)
-                    .await
-                    .unwrap();
+                handles.push(
+                    work.submit(executor.clone(), request(name), None, false, None)
+                        .await
+                        .unwrap(),
+                );
             }
             assert!(matches!(
-                work.submit(Arc::new(WaitingExecutor), request(name), None, false)
+                work.submit(executor.clone(), request(name), None, false, None)
                     .await,
                 Err(LambdaServiceError::TooManyRequests)
             ));
         }
+        assert_eq!(work.global.available_permits(), 0);
         assert!(matches!(
-            work.submit(Arc::new(WaitingExecutor), request("e"), Some(32), false)
+            work.submit(executor, request("e"), Some(32), false, None)
                 .await,
             Err(LambdaServiceError::TooManyRequests)
         ));
-        assert_eq!(work.global.available_permits(), 0);
-        assert!(work.quiesce(Duration::ZERO).await.is_err());
+        drop(handles);
+        work.quiesce(Duration::from_secs(2)).await.unwrap();
         assert_eq!(work.global.available_permits(), 32);
     }
+
     #[tokio::test]
-    async fn test_should_release_capacity_when_sync_caller_cancels() {
+    async fn test_should_hold_permits_until_cancelled_backend_cleanup_is_confirmed() {
         let work = WorkManager::new();
-        let (_response, handle) = work
-            .submit(Arc::new(WaitingExecutor), request("cancel"), None, false)
+        let executor = Arc::new(ProbeExecutor::new(true));
+        let handle = work
+            .submit(executor.clone(), request("cleanup"), Some(1), false, None)
+            .await
+            .unwrap();
+        executor.started(1).await;
+        handle.cancel();
+        executor.cancelling().await;
+        assert_eq!(work.capacity.available_permits(), 127);
+        assert_eq!(work.global.available_permits(), 31);
+        assert!(matches!(
+            work.submit(executor.clone(), request("cleanup"), Some(1), false, None)
+                .await,
+            Err(LambdaServiceError::TooManyRequests)
+        ));
+        executor.cleanup.add_permits(1);
+        handle
+            .cancel_and_wait(Instant::now() + Duration::from_secs(2))
             .await
             .unwrap();
-        drop(CancelOnDrop(handle));
-        assert!(work.quiesce(Duration::from_secs(1)).await.is_err());
         assert_eq!(work.capacity.available_permits(), 128);
         assert_eq!(work.global.available_permits(), 32);
+        work.quiesce(Duration::from_secs(2)).await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_should_keep_cleanup_owned_after_handle_deadline_and_aborted_quiesce_waiter() {
+        let work = Arc::new(WorkManager::new());
+        let executor = Arc::new(ProbeExecutor::new(true));
+        let handle = work
+            .submit(executor.clone(), request("retained"), None, false, None)
+            .await
+            .unwrap();
+        executor.started(1).await;
+        assert!(matches!(
+            handle.cancel_and_wait(Instant::now()).await,
+            Err(ExecutorError::CleanupFailed(_))
+        ));
+        executor.cancelling().await;
+        let waiting = Arc::clone(&work);
+        let task = tokio::spawn(async move { waiting.quiesce(Duration::from_secs(30)).await });
+        tokio::task::yield_now().await;
+        task.abort();
+        assert!(task.await.unwrap_err().is_cancelled());
+        assert_eq!(work.capacity.available_permits(), 127);
+        executor.cleanup.add_permits(1);
+        work.quiesce(Duration::from_secs(2)).await.unwrap();
+        assert_eq!(work.capacity.available_permits(), 128);
+    }
+
+    #[tokio::test]
+    async fn test_should_cancel_on_handle_drop_and_reject_already_expired_admission() {
+        let work = WorkManager::new();
+        let executor = Arc::new(ProbeExecutor::new(false));
+        assert!(matches!(
+            work.submit(
+                executor.clone(),
+                request("expired"),
+                None,
+                false,
+                Some(Instant::now())
+            )
+            .await,
+            Err(LambdaServiceError::ResourceNotReady { .. })
+        ));
+        let handle = work
+            .submit(executor.clone(), request("drop"), None, false, None)
+            .await
+            .unwrap();
+        executor.started(1).await;
+        drop(handle);
+        executor.cancelling().await;
+        work.quiesce(Duration::from_secs(2)).await.unwrap();
+        assert_eq!(work.capacity.available_permits(), 128);
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn test_should_return_at_caller_deadline_while_retaining_backend_cleanup_capacity() {
+        let work = WorkManager::new();
+        let executor = Arc::new(ProbeExecutor::new(true));
+        let handle = work
+            .submit(
+                executor.clone(),
+                request("deadline"),
+                None,
+                false,
+                Some(Instant::now() + Duration::from_secs(1)),
+            )
+            .await
+            .unwrap();
+        executor.started(1).await;
+        tokio::time::advance(Duration::from_secs(1)).await;
+        assert!(matches!(
+            handle.wait().await,
+            Err(ExecutorError::DeadlineExceeded)
+        ));
+        executor.cancelling().await;
+        assert_eq!(work.global.available_permits(), 31);
+        assert_eq!(work.capacity.available_permits(), 127);
+        assert!(work.quiesce(Duration::ZERO).await.is_err());
+        executor.cleanup.add_permits(1);
+        work.quiesce(Duration::from_secs(2)).await.unwrap();
+        assert_eq!(work.global.available_permits(), 32);
+        assert_eq!(work.capacity.available_permits(), 128);
+    }
+
+    #[derive(Debug)]
+    struct PanickingExecutor;
+    #[async_trait]
+    impl Executor for PanickingExecutor {
+        async fn invoke(
+            &self,
+            _request: InvokeRequest,
+            _context: InvocationContext,
+        ) -> Result<InvokeResponse, ExecutorError> {
+            panic!("intentional supervised panic");
+        }
+        async fn shutdown(&self) -> Result<(), ExecutorError> {
+            Ok(())
+        }
+    }
+    #[tokio::test]
+    async fn test_should_never_report_successful_quiescence_after_a_worker_panic() {
+        let work = WorkManager::new();
+        let handle = work
+            .submit(
+                Arc::new(PanickingExecutor),
+                request("panic"),
+                None,
+                false,
+                None,
+            )
+            .await
+            .unwrap();
+        assert!(matches!(
+            handle.wait().await,
+            Err(ExecutorError::CleanupFailed(_))
+        ));
+        assert!(work.quiesce(Duration::from_secs(2)).await.is_err());
+        assert!(
+            work.submit(
+                Arc::new(ProbeExecutor::new(false)),
+                request("after-panic"),
+                None,
+                false,
+                None
+            )
+            .await
+            .is_err()
+        );
     }
 }
diff --git a/crates/rustack-lambda-core/tests/common/docker.rs b/crates/rustack-lambda-core/tests/common/docker.rs
new file mode 100644
index 00000000..579e0b42
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/common/docker.rs
@@ -0,0 +1,133 @@
+//! Shared explicit-daemon fixture. Readiness/probes are not implied by setup.
+use std::{env, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::{
+    artifact::{Architecture, PinnedImage},
+    docker::{
+        DirectoryLease, DockerPort, DockerWire, EnvironmentConfig, EnvironmentManager,
+        EnvironmentSettings, ImageLeaseConfig, ImageLeaseManager, ImagePinScope, OwnerFilter,
+    },
+};
+use tempfile::TempDir;
+use tokio::time::Instant;
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+pub(crate) struct Fixture {
+    pub(crate) owner: EnvironmentManager,
+    pub(crate) images: ImageLeaseManager,
+    pub(crate) wire: DockerWire,
+    pub(crate) docker: DockerPort,
+    pub(crate) lease: DirectoryLease,
+    pub(crate) relay: Option<PinnedImage>,
+    pub(crate) function: Option<PinnedImage>,
+    pub(crate) directory: Option<TempDir>,
+}
+impl Fixture {
+    pub(crate) async fn new() -> Result<Self> {
+        let socket =
+            env::var("RUSTACK_RUNTIME_DOCKER_SOCKET").context("explicit Docker socket required")?;
+        let wire = DockerWire::connect(format!("unix://{socket}").parse()?, deadline()).await?;
+        let directory = tempfile::tempdir()?;
+        let lease = DirectoryLease::acquire(directory.path().into(), deadline()).await?;
+        let docker = wire.port().bind_directory(&lease, deadline()).await?;
+        let images = ImageLeaseManager::start(
+            docker.clone(),
+            ImagePinScope::new(lease.clone()),
+            ImageLeaseConfig::default(),
+        )?;
+        let arch = match env::var("RUSTACK_RUNTIME_ARCH")?.as_str() {
+            "arm64" => Architecture::Arm64,
+            "amd64" => Architecture::X86_64,
+            _ => anyhow::bail!("unknown architecture"),
+        };
+        let config = EnvironmentConfig::try_from(
+            EnvironmentSettings::builder()
+                .environments(1)
+                .memory_bytes(256 * 1024 * 1024)
+                .io(Duration::from_secs(60))
+                .start(Duration::from_secs(60))
+                .build(),
+        )?;
+        let owner = EnvironmentManager::start(docker.clone(), lease.clone(), config)?;
+        let mut fixture = Self {
+            owner,
+            images,
+            wire,
+            docker,
+            lease,
+            relay: None,
+            function: None,
+            directory: Some(directory),
+        };
+        if let Err(error) = fixture.prepare(arch).await {
+            let cleanup = fixture.cleanup().await;
+            return Err(error.context(format!(
+                "setup cleanup: {}",
+                if cleanup.is_ok() {
+                    "confirmed"
+                } else {
+                    "unresolved"
+                }
+            )));
+        }
+        Ok(fixture)
+    }
+    async fn prepare(&mut self, arch: Architecture) -> Result<()> {
+        let relay_reference = env::var("RUSTACK_RUNTIME_IMAGE")?.parse()?;
+        let relay = self
+            .images
+            .port()
+            .prepare(&relay_reference, arch, None, deadline())
+            .await?;
+        self.relay = Some(relay);
+        let suffix = if arch == Architecture::Arm64 {
+            "arm64"
+        } else {
+            "amd64"
+        };
+        let function = self
+            .images
+            .port()
+            .prepare(
+                &format!("rustack-p0-handler:{suffix}").parse()?,
+                arch,
+                None,
+                deadline(),
+            )
+            .await?;
+        self.function = Some(function);
+        Ok(())
+    }
+
+    pub(crate) async fn cleanup(&mut self) -> Result<()> {
+        let result = async {
+            self.owner.shutdown(deadline()).await?;
+            ensure!(
+                self.owner.port().status().allocated == 0,
+                "allocation reservation remains"
+            );
+            let containers = self
+                .docker
+                .list_containers(
+                    OwnerFilter::new(self.lease.owner_id(), Some(self.lease.run_id()), None)?,
+                    deadline(),
+                )
+                .await?;
+            ensure!(containers.is_empty(), "owned containers remain");
+            self.relay.take();
+            self.function.take();
+            self.images.shutdown(deadline()).await?;
+            self.wire.shutdown().await?;
+            Ok(())
+        }
+        .await;
+        if result.is_err() {
+            if let Some(directory) = self.directory.take() {
+                let _ = directory.keep();
+            }
+        }
+        result
+    }
+}
diff --git a/crates/rustack-lambda-core/tests/common/mod.rs b/crates/rustack-lambda-core/tests/common/mod.rs
new file mode 100644
index 00000000..c4fdd744
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/common/mod.rs
@@ -0,0 +1 @@
+pub(crate) mod docker;
diff --git a/crates/rustack-lambda-core/tests/docker_endpoint.rs b/crates/rustack-lambda-core/tests/docker_endpoint.rs
new file mode 100644
index 00000000..5f99e2ef
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/docker_endpoint.rs
@@ -0,0 +1,235 @@
+//! Explicit container-origin endpoint qualification against a controlled gateway peer.
+#![cfg(unix)]
+#![forbid(unsafe_code)]
+
+use std::{
+    env,
+    net::{IpAddr, SocketAddr},
+    sync::atomic::Ordering,
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use rstest::rstest;
+use rustack_lambda_core::{
+    artifact::ImageReference,
+    docker::{
+        ContainerPolicy, DockerWire, EndpointProbeConfig, EnvironmentProbeConfig,
+        EnvironmentProbeError, GatewayInstanceId, NetworkSelection, ProbeFailure, ProbeSettings,
+        RelayBudgets, probe_endpoint, probe_environment,
+    },
+};
+use tokio::{
+    net::TcpListener,
+    time::{Instant, sleep, timeout},
+};
+
+mod common;
+#[path = "docker_endpoint/gateway.rs"]
+mod gateway;
+use common::docker::Fixture;
+use gateway::Gateway;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+#[rstest]
+#[case::matching(0)]
+#[case::wrong_instance(1)]
+#[case::unavailable_listener(2)]
+#[case::abandoned(3)]
+#[tokio::test]
+#[ignore = "requires explicit Docker socket, pinned runtime, operator bridge and function-visible \
+            host"]
+async fn test_should_qualify_actual_container_endpoint_and_retain_physical_retirement(
+    #[case] scenario: u8,
+) -> Result<()> {
+    let host: IpAddr = env::var("RUSTACK_RUNTIME_GATEWAY_HOST")
+        .context("explicit function-visible host IP required")?
+        .parse()?;
+    let network: NetworkSelection = env::var("RUSTACK_RUNTIME_NETWORK")
+        .context("explicit operator bridge required")?
+        .parse()?;
+    let source_reference: ImageReference = env::var("RUSTACK_RUNTIME_IMAGE")?.parse()?;
+    let mut fixture = Fixture::new().await?;
+    let mut source_id = None;
+    let evidence = fixture
+        .directory
+        .as_ref()
+        .map(|root| root.path().to_owned());
+    let mut gateway = None;
+    let result: Result<()> = async {
+        source_id = Some(
+            fixture
+                .docker
+                .inspect_image(&source_reference, deadline())
+                .await?
+                .id
+                .context("source identity")?,
+        );
+        let network_proof = network.qualify(&fixture.docker, deadline()).await?;
+        let policy = ContainerPolicy::new(
+            network,
+            1000,
+            1000,
+            333_333_333,
+            RelayBudgets::new(
+                Duration::from_secs(60),
+                Duration::from_secs(600),
+                Duration::from_secs(60),
+            )?,
+        )?;
+        let base = EnvironmentProbeConfig::builder()
+            .directory(fixture.lease.clone())
+            .relay(fixture.relay.as_ref().context("pinned runtime")?.clone())
+            .environments(fixture.owner.port())
+            .policy(policy)
+            .network(network_proof)
+            .settings(ProbeSettings::new(
+                Duration::from_secs(60),
+                Duration::from_secs(60),
+            )?)
+            .build();
+        let resources = probe_environment(base.clone(), deadline()).await?;
+        ensure!(resources.matches(&base), "resource evidence stale");
+        ensure!(
+            fixture.owner.port().status().allocated == 0,
+            "resource proof before retirement"
+        );
+        let (port, expected) = if scenario == 2 {
+            let reserved = TcpListener::bind("0.0.0.0:0").await?;
+            let port = reserved.local_addr()?.port();
+            drop(reserved);
+            (port, GatewayInstanceId::generate_owned(deadline()).await?)
+        } else {
+            gateway = Some(Gateway::start(scenario == 3).await?);
+            let gateway = gateway.as_ref().context("gateway peer")?;
+            (
+                gateway.address.port(),
+                if scenario == 1 {
+                    GatewayInstanceId::generate_owned(deadline()).await?
+                } else {
+                    gateway.instance
+                },
+            )
+        };
+        let endpoint = format!("http://{}", SocketAddr::new(host, port)).parse()?;
+        let config = EndpointProbeConfig::new(base.clone(), resources.clone(), endpoint, expected)?;
+        if scenario == 3 {
+            let job = tokio::spawn(probe_endpoint(config, deadline()));
+            let observation: Result<()> = async {
+                gateway
+                    .as_mut()
+                    .context("held gateway")?
+                    .observed(deadline())
+                    .await?;
+                ensure!(
+                    fixture.owner.port().status().allocated == 1,
+                    "no running endpoint environment"
+                );
+                Ok(())
+            }
+            .await;
+            job.abort();
+            let cancelled = job.await.is_err_and(|error| error.is_cancelled());
+            observation?;
+            ensure!(cancelled, "probe caller was not cancelled");
+            fixture.owner.shutdown(deadline()).await?;
+            timeout(Duration::from_secs(10), async {
+                while !gateway
+                    .as_ref()
+                    .is_some_and(|gateway| gateway.closed.load(Ordering::Acquire))
+                {
+                    sleep(Duration::from_millis(5)).await;
+                }
+            })
+            .await
+            .context("abandoned HTTP IO not closed")?;
+        } else {
+            let observed = probe_endpoint(config.clone(), deadline()).await;
+            if scenario == 0 {
+                let proof = observed?;
+                ensure!(
+                    proof.matches(&config) && proof.report().instance_id() == expected,
+                    "endpoint receipt differs"
+                );
+                let changed = EndpointProbeConfig::new(
+                    base,
+                    resources,
+                    format!("http://{}", SocketAddr::new(host, port)).parse()?,
+                    GatewayInstanceId::generate_owned(deadline()).await?,
+                )?;
+                ensure!(
+                    !proof.matches(&changed),
+                    "proof matched another gateway instance"
+                );
+            } else {
+                ensure!(
+                    matches!(
+                        observed,
+                        Err(EnvironmentProbeError::Rejected(ProbeFailure::Outcome))
+                    ),
+                    "unavailable/wrong gateway did not produce a consumed probe failure"
+                );
+            }
+        }
+        ensure!(
+            fixture.owner.port().status().allocated == 0,
+            "endpoint proof/failure before physical retirement"
+        );
+        if let Some(gateway) = &gateway {
+            ensure!(
+                gateway.requests.load(Ordering::Acquire) == 1,
+                "endpoint probe replayed"
+            );
+        }
+        Ok(())
+    }
+    .await;
+    let cleanup = fixture.cleanup().await;
+    let source_audit: Result<()> = if cleanup.is_ok() && source_id.is_some() {
+        async {
+            let socket = env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")?;
+            let mut wire =
+                DockerWire::connect(format!("unix://{socket}").parse()?, deadline()).await?;
+            let result: Result<()> = async {
+                let port = wire
+                    .port()
+                    .bind_directory(&fixture.lease, deadline())
+                    .await?;
+                ensure!(
+                    port.inspect_image(&source_reference, deadline())
+                        .await?
+                        .id
+                        .as_deref()
+                        == source_id.as_deref(),
+                    "source image changed during endpoint cleanup"
+                );
+                Ok(())
+            }
+            .await;
+            let closed = wire.shutdown().await;
+            result?;
+            closed?;
+            Ok(())
+        }
+        .await
+    } else {
+        Ok(())
+    };
+    let peer_cleanup = match &mut gateway {
+        Some(gateway) => gateway.shutdown().await,
+        None => Ok(()),
+    };
+    if result.is_err() || cleanup.is_err() || peer_cleanup.is_err() || source_audit.is_err() {
+        if let Some(root) = fixture.directory.take() {
+            eprintln!("retained endpoint evidence: {}", root.keep().display());
+        } else if let Some(root) = evidence {
+            eprintln!("retained endpoint evidence: {}", root.display());
+        }
+    }
+    cleanup?;
+    peer_cleanup?;
+    source_audit?;
+    result
+}
diff --git a/crates/rustack-lambda-core/tests/docker_endpoint/gateway.rs b/crates/rustack-lambda-core/tests/docker_endpoint/gateway.rs
new file mode 100644
index 00000000..b91c9cf0
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/docker_endpoint/gateway.rs
@@ -0,0 +1,154 @@
+//! Controlled gateway protocol peer; actual binary route has separate socket tests.
+
+use std::{
+    io,
+    net::SocketAddr,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::docker::{GatewayInstanceId, GatewayReply};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+    sync::watch,
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use typed_builder::TypedBuilder;
+
+#[derive(Debug, TypedBuilder)]
+pub(super) struct Gateway {
+    pub address: SocketAddr,
+    pub instance: GatewayInstanceId,
+    seen: watch::Receiver<usize>,
+    pub requests: Arc<AtomicUsize>,
+    pub closed: Arc<AtomicBool>,
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<()>>>,
+    settled: Option<Result<(), Arc<anyhow::Error>>>,
+}
+impl Gateway {
+    pub async fn start(hold: bool) -> Result<Self> {
+        let listener = TcpListener::bind("0.0.0.0:0").await?;
+        let address = listener.local_addr()?;
+        let instance =
+            GatewayInstanceId::generate_owned(Instant::now() + Duration::from_secs(5)).await?;
+        let (stop, mut stopped) = watch::channel(false);
+        let (observed, seen) = watch::channel(0);
+        let requests = Arc::new(AtomicUsize::new(0));
+        let counter = requests.clone();
+        let closed = Arc::new(AtomicBool::new(false));
+        let eof = closed.clone();
+        let bytes = serde_json::to_vec(&GatewayReply::new(instance))?;
+        let task = tokio::spawn(async move {
+            let work = async {
+                loop {
+                    let (mut stream, _) = listener.accept().await?;
+                    let head =
+                        read_head(&mut stream, Instant::now() + Duration::from_secs(10)).await?;
+                    ensure!(
+                        head.starts_with(b"GET /_rustack/runtime-probe HTTP/1.1\r\n"),
+                        "wrong endpoint request"
+                    );
+                    let raw: String = instance.into();
+                    ensure!(
+                        !String::from_utf8_lossy(&head).contains(&raw),
+                        "expected identity leaked into GET"
+                    );
+                    let count = counter.fetch_add(1, Ordering::AcqRel).saturating_add(1);
+                    ensure!(count <= 2, "probe retried excessively");
+                    observed.send_replace(count);
+                    if hold {
+                        let mut byte = [0];
+                        let result = timeout_at(
+                            Instant::now() + Duration::from_secs(60),
+                            stream.read(&mut byte),
+                        )
+                        .await?;
+                        ensure!(
+                            matches!(result, Ok(0))
+                                || result.is_err_and(|error| matches!(
+                                    error.kind(),
+                                    io::ErrorKind::ConnectionReset | io::ErrorKind::BrokenPipe
+                                )),
+                            "abandoned connection still transmitted data"
+                        );
+                        eof.store(true, Ordering::Release);
+                    } else {
+                        let head = format!(
+                            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nCache-Control: \
+                             no-store\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+                            bytes.len()
+                        );
+                        stream.write_all(head.as_bytes()).await?;
+                        stream.write_all(&bytes).await?;
+                        stream.shutdown().await?;
+                    }
+                }
+            };
+            tokio::select! {biased;_ = stopped.changed()=>Ok(()),result=work=>result,}
+        });
+        Ok(Self::builder()
+            .address(address)
+            .instance(instance)
+            .seen(seen)
+            .requests(requests)
+            .closed(closed)
+            .stop(stop)
+            .task(Some(task))
+            .settled(None)
+            .build())
+    }
+    pub async fn observed(&mut self, deadline: Instant) -> Result<()> {
+        while *self.seen.borrow() == 0 {
+            timeout_at(deadline, self.seen.changed())
+                .await
+                .context("gateway request observer expired")??;
+        }
+        Ok(())
+    }
+    pub async fn shutdown(&mut self) -> Result<()> {
+        self.stop.send_replace(true);
+        if self.settled.is_none() {
+            let result = match self.task.as_mut() {
+                Some(task) => timeout_at(Instant::now() + Duration::from_secs(10), task)
+                    .await
+                    .context("gateway join deadline")?
+                    .context("gateway worker failed")
+                    .and_then(|result| result),
+                None => Ok(()),
+            };
+            self.task.take();
+            self.settled = Some(result.map_err(Arc::new));
+        }
+        match &self.settled {
+            Some(Ok(())) => Ok(()),
+            Some(Err(error)) => Err(anyhow::anyhow!("gateway cleanup failed: {error:#}")),
+            None => anyhow::bail!("gateway cleanup unsettled"),
+        }
+    }
+}
+impl Drop for Gateway {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+async fn read_head(stream: &mut TcpStream, deadline: Instant) -> Result<Vec<u8>> {
+    timeout_at(deadline, async {
+        let mut bytes = Vec::new();
+        loop {
+            ensure!(bytes.len() < 4096, "oversized fixture request");
+            bytes.push(stream.read_u8().await?);
+            if bytes.ends_with(b"\r\n\r\n") {
+                return Ok(bytes);
+            }
+        }
+    })
+    .await
+    .context("fixture request deadline")?
+}
diff --git a/crates/rustack-lambda-core/tests/docker_environment.rs b/crates/rustack-lambda-core/tests/docker_environment.rs
new file mode 100644
index 00000000..500398aa
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/docker_environment.rs
@@ -0,0 +1,445 @@
+//! Real container lifecycle qualification of the retained environment owner.
+#![cfg(unix)]
+#![forbid(unsafe_code)]
+use std::{collections::HashMap, sync::Arc, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use bytes::Bytes;
+use rustack_lambda_core::{
+    artifact::DeploymentArtifact,
+    docker::{
+        ContainerPolicy, EnvironmentError, EnvironmentHandle, EnvironmentPlan, EnvironmentPool,
+        FunctionLogs, PoolConfig, RelayBudgets,
+    },
+    executor::{ExecutionRevision, ExecutorBackend},
+    identity::FunctionResourceId,
+};
+use rustack_lambda_runtime::{
+    metadata::local_trace_id,
+    protocol::{AttemptId, HandlerTimeout, Payload},
+    session::{Invocation, RuntimeResult},
+};
+use serde_json::{Value, json};
+use tokio::time::{Instant, timeout};
+use uuid::Uuid;
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(60)
+}
+mod common;
+use common::docker::Fixture;
+impl Fixture {
+    pub(crate) fn revision(&self) -> Result<Arc<ExecutionRevision>> {
+        let revision = ExecutionRevision::builder()
+            .resource_id(FunctionResourceId::new())
+            .revision_id(Uuid::new_v4().to_string())
+            .backend(ExecutorBackend::Docker)
+            .function_name("environment-fixture".into())
+            .qualifier("$LATEST".into())
+            .runtime(None)
+            .handler(None)
+            .architecture(
+                self.function
+                    .as_ref()
+                    .context("function image")?
+                    .resolved()
+                    .metadata()
+                    .architecture,
+            )
+            .artifact(DeploymentArtifact::Image(
+                self.function.as_ref().context("function image")?.clone(),
+            ))
+            .image_config(None)
+            .environment(HashMap::from([
+                ("AWS_REGION".into(), "us-east-1".into()),
+                ("AWS_DEFAULT_REGION".into(), "us-east-1".into()),
+            ]))
+            .timeout(Duration::from_secs(120))
+            .memory_mb(192)
+            .ephemeral_storage_mb(512)
+            .build();
+        Ok(Arc::new(revision))
+    }
+    pub(crate) fn plan(&self) -> Result<EnvironmentPlan> {
+        self.plan_revision(self.revision()?)
+    }
+    pub(crate) fn plan_revision(
+        &self,
+        revision: Arc<ExecutionRevision>,
+    ) -> Result<EnvironmentPlan> {
+        Ok(EnvironmentPlan::new(
+            self.lease.clone(),
+            self.relay.as_ref().context("relay image")?.clone(),
+            revision,
+            ContainerPolicy::new(
+                "none".parse()?,
+                1000,
+                1000,
+                1_000_000_000,
+                RelayBudgets::new(
+                    Duration::from_secs(60),
+                    Duration::from_secs(600),
+                    Duration::from_secs(60),
+                )?,
+            )?,
+        )?)
+    }
+}
+
+fn invocation(event: &Value) -> Result<Invocation> {
+    Ok(Invocation::new(
+        AttemptId::default(),
+        Instant::now() + Duration::from_secs(120),
+        "arn:aws:lambda:us-east-1:000000000000:function:environment-fixture:prod".parse()?,
+        local_trace_id()?,
+        Payload::try_from(Bytes::from(serde_json::to_vec(event)?))?,
+    )?)
+}
+async fn call(handle: &mut EnvironmentHandle, event: &Value, failed: bool) -> Result<Value> {
+    let response = handle.invoke(invocation(event)?, true).await?;
+    match response.result {
+        RuntimeResult::Success(payload) if !failed => Ok(serde_json::from_slice(payload.as_ref())?),
+        RuntimeResult::FunctionError(payload) if failed => {
+            Ok(serde_json::from_slice(payload.as_ref())?)
+        }
+        _ => anyhow::bail!("unexpected handler result"),
+    }
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker environment images/socket"]
+async fn test_should_own_real_initialization_warm_calls_function_error_and_cleanup() -> Result<()> {
+    let mut fixture = Fixture::new().await?;
+    let result=async{
+        let mut handle=fixture.owner.port().spawn(fixture.plan()?,deadline())?;handle.wait_ready(deadline()).await?;
+        ensure!(matches!(fixture.owner.port().spawn(fixture.plan()?,deadline()),Err(EnvironmentError::Busy)),"global environment bound not enforced");
+        let first=call(&mut handle,&json!({"value":35,"padding":"x".repeat(6*1024*1024-4096),"response_bytes":6*1024*1024-4096}),false).await?;
+        ensure!(first["computed"]==42&&first["counter"]==1,"computed result differs");ensure!(first["large"].as_str().is_some_and(|value|value.len()==6*1024*1024-4096),"large result differs");
+        let second=call(&mut handle,&json!({"value":0}),false).await?;ensure!(second["computed"]==7&&second["counter"]==2,"warm result differs");
+        let failure=call(&mut handle,&json!({"fail":true}),true).await?;ensure!(failure["errorType"]=="ValueError","FunctionError differs");handle.shutdown(deadline()).await?;Ok(())
+    }.await;
+    let cleanup = fixture.cleanup().await;
+    result.and(cleanup)
+}
+#[tokio::test]
+#[ignore = "requires explicit Docker environment images/socket"]
+async fn test_should_retire_running_code_after_abandoned_call_and_join_all_owned_io() -> Result<()>
+{
+    let mut fixture = Fixture::new().await?;
+    let result = async {
+        let plan = fixture.plan()?;
+        let key = plan.function_key().clone();
+        let mut handle = fixture.owner.port().spawn(plan, deadline())?;
+        handle.wait_ready(deadline()).await?;
+        let mut observed = FunctionLogs::start(
+            fixture.docker.attach_logs(&key, deadline()).await?,
+            Duration::from_secs(60),
+            262_144,
+        )?;
+        let call = tokio::spawn(async move {
+            handle
+                .invoke(invocation(&json!({"value":1,"sleep":true})).unwrap(), false)
+                .await
+        });
+        let observation = timeout(Duration::from_secs(30), async {
+            loop {
+                let snapshot = observed.snapshot(deadline()).await?;
+                if snapshot
+                    .tail
+                    .windows(14)
+                    .any(|part| part == b"P0_BUSY_START=")
+                {
+                    break Ok::<(), anyhow::Error>(());
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .context("handler did not start");
+        call.abort();
+        let joined = call.await;
+        let retired = fixture.owner.shutdown(deadline()).await;
+        let logs = observed.shutdown().await;
+        observation??;
+        ensure!(
+            matches!(joined,Err(ref error) if error.is_cancelled()),
+            "abandoned call was not cancelled"
+        );
+        retired?;
+        logs?;
+        Ok(())
+    }
+    .await;
+    let cleanup = fixture.cleanup().await;
+    result.and(cleanup)
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker environment images/socket"]
+async fn test_should_pool_real_warm_calls_and_evict_capacity_across_revision_changes() -> Result<()>
+{
+    let mut fixture = Fixture::new().await?;
+    let mut pool = EnvironmentPool::start(fixture.owner.port(), PoolConfig::default())?;
+    let result = async {
+        let original = fixture.revision()?;
+        let port = pool.port();
+        for expected in 1..=2 {
+            let response = port
+                .invoke(
+                    fixture.plan_revision(original.clone())?,
+                    invocation(&json!({"value":35}))?,
+                    false,
+                )
+                .await?;
+            let RuntimeResult::Success(payload) = response.result else {
+                anyhow::bail!("unexpected function failure");
+            };
+            let value: Value = serde_json::from_slice(payload.as_ref())?;
+            ensure!(
+                value["computed"] == 42 && value["counter"] == expected,
+                "pool did not preserve warm counter"
+            );
+        }
+        let mut changed = (*original).clone();
+        changed.revision_id = Uuid::new_v4().to_string();
+        changed
+            .environment
+            .insert("TEST_VALUE".into(), "changed".into());
+        let changed = Arc::new(changed);
+        for revision in [changed, original.clone()] {
+            let response = port
+                .invoke(
+                    fixture.plan_revision(revision)?,
+                    invocation(&json!({"value":0,"policy":true}))?,
+                    false,
+                )
+                .await?;
+            let RuntimeResult::Success(payload) = response.result else {
+                anyhow::bail!("unexpected function failure");
+            };
+            let value: Value = serde_json::from_slice(payload.as_ref())?;
+            ensure!(
+                value["computed"] == 7 && value["counter"] == 1,
+                "revision or evicted environment was reused"
+            );
+        }
+        let failed = port
+            .invoke(
+                fixture.plan_revision(original.clone())?,
+                invocation(&json!({"fail":true}))?,
+                false,
+            )
+            .await?;
+        let RuntimeResult::FunctionError(payload) = failed.result else {
+            anyhow::bail!("pool hid FunctionError");
+        };
+        let error: Value = serde_json::from_slice(payload.as_ref())?;
+        ensure!(
+            error["errorType"] == "ValueError",
+            "pool error payload differs"
+        );
+        let response = port
+            .invoke(
+                fixture.plan_revision(original)?,
+                invocation(&json!({"value":0}))?,
+                false,
+            )
+            .await?;
+        let RuntimeResult::Success(payload) = response.result else {
+            anyhow::bail!("replacement invocation failed");
+        };
+        let value: Value = serde_json::from_slice(payload.as_ref())?;
+        ensure!(
+            value["counter"] == 1,
+            "failed environment was returned to warm pool"
+        );
+        Ok(())
+    }
+    .await;
+    let retired = pool.shutdown(deadline()).await;
+    let cleanup = fixture.cleanup().await;
+    result.and(retired.map_err(Into::into)).and(cleanup)
+}
+
+#[rstest::rstest]
+#[case::abandoned(false)]
+#[case::awaited_settlement(true)]
+#[tokio::test]
+#[ignore = "requires explicit Docker environment images/socket"]
+async fn test_should_join_pool_retirement_after_cancelling_an_observed_running_handler(
+    #[case] awaited: bool,
+) -> Result<()> {
+    let mut fixture = Fixture::new().await?;
+    let mut pool = EnvironmentPool::start(fixture.owner.port(), PoolConfig::default())?;
+    let result = async {
+        let revision = fixture.revision()?;
+        let plan = fixture.plan_revision(revision.clone())?;
+        let key = plan.function_key().clone();
+        let port = pool.port();
+        let initial = port
+            .invoke(plan, invocation(&json!({"value":0}))?, false)
+            .await?;
+        ensure!(
+            matches!(initial.result, RuntimeResult::Success(_)),
+            "warm setup failed"
+        );
+        let plan = fixture.plan_revision(revision.clone())?;
+        let event = invocation(&json!({"value":1,"sleep":true}))?;
+        let mut observed = FunctionLogs::start(
+            fixture.docker.attach_logs(&key, deadline()).await?,
+            Duration::from_secs(60),
+            262_144,
+        )?;
+        let mut call = match port.start(plan, event, false) {
+            Ok(call) => call,
+            Err(error) => {
+                observed.shutdown().await?;
+                return Err(error.into());
+            }
+        };
+        let observation = timeout(Duration::from_secs(30), async {
+            loop {
+                let snapshot = observed.snapshot(deadline()).await?;
+                if snapshot
+                    .tail
+                    .windows(14)
+                    .any(|part| part == b"P0_BUSY_START=")
+                {
+                    break Ok::<(), anyhow::Error>(());
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .context("pooled handler did not start");
+        let cancellation = if awaited {
+            call.cancel_and_wait(deadline()).await
+        } else {
+            drop(call);
+            pool.shutdown(deadline()).await
+        };
+        let logs = observed.shutdown().await;
+        observation??;
+        cancellation?;
+        logs?;
+        ensure!(
+            fixture.owner.port().status().allocated == 0,
+            "call returned before environment retirement"
+        );
+        ensure!(
+            matches!(
+                fixture.docker.inspect_container(&key, deadline()).await,
+                Err(rustack_lambda_core::docker::DockerError::Status(
+                    http::StatusCode::NOT_FOUND
+                ))
+            ),
+            "cancelled function still exists"
+        );
+        if awaited {
+            ensure!(
+                port.status().accepting,
+                "per-call cancellation stopped the pool"
+            );
+            let replacement = port
+                .invoke(
+                    fixture.plan_revision(revision)?,
+                    invocation(&json!({"value":2}))?,
+                    false,
+                )
+                .await?;
+            let RuntimeResult::Success(payload) = replacement.result else {
+                anyhow::bail!("replacement handler failed");
+            };
+            let output: Value = serde_json::from_slice(payload.as_ref())?;
+            ensure!(output["counter"] == 1, "cancelled environment was reused");
+        }
+        Ok(())
+    }
+    .await;
+    let retired = pool.shutdown(deadline()).await;
+    let cleanup = fixture.cleanup().await;
+    result.and(retired.map_err(Into::into)).and(cleanup)
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker environment images/socket"]
+async fn test_should_enforce_captured_handler_timeout_and_replace_the_retired_pooled_environment()
+-> Result<()> {
+    let mut fixture = Fixture::new().await?;
+    let mut pool = EnvironmentPool::start(fixture.owner.port(), PoolConfig::default())?;
+    let result = async {
+        let mut revision = (*fixture.revision()?).clone();
+        revision.timeout = Duration::from_secs(3);
+        let revision = Arc::new(revision);
+        let port = pool.port();
+        let response = port.invoke(
+            fixture.plan_revision(revision.clone())?,
+            invocation(&json!({"value":0}))?,
+            false,
+        ).await?;
+        let RuntimeResult::Success(payload) = response.result else {
+            anyhow::bail!("timeout fixture warm setup failed");
+        };
+        let value: Value = serde_json::from_slice(payload.as_ref())?;
+        ensure!(value["counter"] == 1, "initial counter differs");
+        let result = port.invoke(
+            fixture.plan_revision(revision.clone())?,
+            invocation(&json!({"value":1,"sleep":true}))?.with_handler_timeout(HandlerTimeout::try_from(Duration::from_mins(15))?),
+            false,
+        ).await;
+        ensure!(
+            matches!(result, Err(EnvironmentError::Timeout(duration)) if duration == Duration::from_secs(3)),
+            "handler timeout was not preserved",
+        );
+        ensure!(fixture.owner.port().status().allocated == 0, "timeout returned before resource settlement");
+        let response = port.invoke(
+            fixture.plan_revision(revision)?,
+            invocation(&json!({"value":35}))?,
+            false,
+        ).await?;
+        let RuntimeResult::Success(payload) = response.result else {
+            anyhow::bail!("timeout replacement invocation failed");
+        };
+        let value: Value = serde_json::from_slice(payload.as_ref())?;
+        ensure!(value["computed"] == 42 && value["counter"] == 1, "timed out environment was reused");
+        Ok(())
+    }.await;
+    let retired = pool.shutdown(deadline()).await;
+    let cleanup = fixture.cleanup().await;
+    result.and(retired.map_err(Into::into)).and(cleanup)
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker environment images/socket"]
+async fn test_should_isolate_requested_log_tails_across_logging_silent_and_uncaptured_warm_calls()
+-> Result<()> {
+    let mut fixture = Fixture::new().await?;
+    let mut pool = EnvironmentPool::start(fixture.owner.port(), PoolConfig::default())?;
+    let result = async {
+        let revision = fixture.revision()?;
+        let port = pool.port();
+        for (capture, emit, counter) in [(true, true, 1), (false, true, 2), (true, false, 3), (true, true, 4)] {
+            let response = port.invoke(
+                fixture.plan_revision(revision.clone())?,
+                invocation(&json!({"value":35,"logs":emit,"response_bytes":if emit {1024*1024} else {0}}))?,
+                capture,
+            ).await?;
+            let RuntimeResult::Success(payload) = response.result else {
+                anyhow::bail!("logging fixture invocation failed");
+            };
+            let value: Value = serde_json::from_slice(payload.as_ref())?;
+            ensure!(value["computed"] == 42 && value["counter"] == counter, "log windows prevented actual warm reuse");
+            ensure!(response.logs.len() <= 4096, "log window exceeds response bound");
+            if capture && emit {
+                for marker in [b"WIRE_STDOUT_CAPTURE".as_slice(), b"WIRE_STDERR_CAPTURE".as_slice()] {
+                    ensure!(response.logs.windows(marker.len()).any(|bytes| bytes == marker), "observed invocation marker missing");
+                }
+            } else {
+                ensure!(response.logs.is_empty(), "silent or uncaptured invocation inherited earlier logs");
+            }
+        }
+        Ok(())
+    }.await;
+    let retired = pool.shutdown(deadline()).await;
+    let cleanup = fixture.cleanup().await;
+    result.and(retired.map_err(Into::into)).and(cleanup)
+}
diff --git a/crates/rustack-lambda-core/tests/docker_executor.rs b/crates/rustack-lambda-core/tests/docker_executor.rs
new file mode 100644
index 00000000..c2bf4e23
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/docker_executor.rs
@@ -0,0 +1,182 @@
+//! Real SDK/HTTP/provider execution; controlled fixture readiness is not startup evidence.
+#![cfg(unix)]
+#![forbid(unsafe_code)]
+
+use std::{path::Path, sync::Arc, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use hyper::server::conn::http1;
+use hyper_util::rt::TokioIo;
+use rustack_lambda_core::{
+    config::LambdaConfig,
+    deployment::ImageDeploymentConfig,
+    docker::{ContainerPolicy, PoolConfig, RelayBudgets},
+    executor::{
+        DockerExecutor, DockerExecutorConfig, DockerExecutorError, DockerExecutorSettings,
+        DockerReadiness, Executor, ExecutorBackend,
+    },
+    handler::RustackLambdaHandler,
+    provider::RustackLambda,
+    storage::FunctionStore,
+};
+use rustack_lambda_http::{LambdaHttpConfig, LambdaHttpService};
+use tokio::{net::TcpListener, process::Command, sync::watch, task::JoinSet, time::timeout};
+
+mod common;
+use common::docker::Fixture;
+
+#[derive(Debug)]
+struct CompositionOnlyReadiness;
+impl DockerReadiness for CompositionOnlyReadiness {
+    fn check(&self) -> Result<(), DockerExecutorError> {
+        Ok(())
+    }
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker images/socket and pinned boto3 fixture"]
+async fn test_should_deploy_publish_alias_and_invoke_real_images_through_boto3_http() -> Result<()>
+{
+    let mut fixture = Fixture::new().await?;
+    let result = run(&fixture).await;
+    let cleanup = fixture.cleanup().await;
+    result.and(cleanup)
+}
+async fn run(fixture: &Fixture) -> Result<()> {
+    let relay = fixture.relay.as_ref().context("relay image")?.clone();
+    let executor = Arc::new(DockerExecutor::new(
+        DockerExecutorConfig::builder()
+            .directory(fixture.lease.clone())
+            .relay(relay)
+            .policy(ContainerPolicy::new(
+                "none".parse()?,
+                1000,
+                1000,
+                1_000_000_000,
+                RelayBudgets::new(
+                    Duration::from_secs(60),
+                    Duration::from_secs(600),
+                    Duration::from_secs(60),
+                )?,
+            )?)
+            .environments(fixture.owner.port())
+            .readiness(Arc::new(CompositionOnlyReadiness))
+            .settings(DockerExecutorSettings::new(
+                PoolConfig::default(),
+                Duration::from_secs(60),
+            )?)
+            .build(),
+    )?);
+    let result = serve(fixture, executor.clone()).await;
+    let retired = executor.shutdown().await;
+    result.and(retired.map_err(Into::into))
+}
+async fn serve(fixture: &Fixture, executor: Arc<DockerExecutor>) -> Result<()> {
+    let store = FunctionStore::new(
+        fixture
+            .directory
+            .as_ref()
+            .context("data directory")?
+            .path()
+            .join("code"),
+    );
+    let config = LambdaConfig {
+        executor: ExecutorBackend::Docker,
+        ..Default::default()
+    };
+    let provider = Arc::new(
+        RustackLambda::with_executor(store, config, executor.clone())
+            .with_image_preparation(fixture.images.port(), ImageDeploymentConfig::default())?,
+    );
+    let result = run_server(fixture, provider.clone()).await;
+    let quiesced = provider.quiesce(Duration::from_secs(60)).await;
+    let retired = executor.shutdown().await;
+    provider.shutdown().await;
+    result
+        .and(quiesced.map_err(Into::into))
+        .and(retired.map_err(Into::into))
+}
+async fn run_server(fixture: &Fixture, provider: Arc<RustackLambda>) -> Result<()> {
+    let image = fixture
+        .function
+        .as_ref()
+        .context("function image")?
+        .resolved()
+        .metadata();
+    let listener = TcpListener::bind("127.0.0.1:0").await?;
+    let endpoint = format!("http://{}", listener.local_addr()?);
+    let service = LambdaHttpService::new(
+        Arc::new(RustackLambdaHandler::new(provider)),
+        LambdaHttpConfig::default(),
+    );
+    let (stop, mut stopped) = watch::channel(false);
+    let mut server = tokio::spawn(async move {
+        let mut jobs = JoinSet::new();
+        let result = async { loop {
+            tokio::select! {biased;
+                _=stopped.wait_for(|stop|*stop)=>return Ok::<(),anyhow::Error>(()),
+                joined=jobs.join_next(),if !jobs.is_empty()=> {joined.unwrap()??;},
+                stream=listener.accept(),if jobs.len()<8=> {
+                    let (stream,_)=stream?;let service=service.clone();
+                    jobs.spawn(async move {http1::Builder::new().serve_connection(TokioIo::new(stream),service).await});
+                }
+            }
+        } }.await;
+        jobs.abort_all();
+        let mut workers_ok = true;
+        while let Some(joined) = jobs.join_next().await {
+            if let Err(error) = joined {
+                workers_ok &= error.is_cancelled();
+            }
+        }
+        result?;
+        ensure!(workers_ok, "HTTP worker failed");
+        Ok::<(), anyhow::Error>(())
+    });
+    let result = run_sdk(
+        &endpoint,
+        image.requested_reference.as_str(),
+        image.architecture.as_str(),
+    )
+    .await;
+    stop.send_replace(true);
+    let joined = timeout(Duration::from_secs(60), &mut server).await;
+    let joined = match joined {
+        Ok(result) => result.context("HTTP supervisor join")?,
+        Err(error) => {
+            server.abort();
+            let _ = server.await;
+            Err(error.into())
+        }
+    };
+    result.and(joined)
+}
+async fn run_sdk(endpoint: &str, image: &str, architecture: &str) -> Result<()> {
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let mut child = Command::new("uv");
+    child
+        .args([
+            "run",
+            "--no-project",
+            "--python",
+            "3.13",
+            "--with-requirements",
+        ])
+        .arg(root.join("tests/workflows/requirements.txt"))
+        .arg("python")
+        .arg(root.join("tests/workflows/docker_lambda_sdk.py"))
+        .args([endpoint, image, architecture])
+        .kill_on_drop(true);
+    let mut process = child.spawn().context("start pinned SDK fixture")?;
+    let result = timeout(Duration::from_secs(300), process.wait()).await;
+    let status = match result {
+        Ok(result) => result?,
+        Err(error) => {
+            let _ = process.kill().await;
+            let _ = process.wait().await;
+            return Err(error.into());
+        }
+    };
+    ensure!(status.success(), "SDK fixture failed: {status}");
+    Ok(())
+}
diff --git a/crates/rustack-lambda-core/tests/docker_probe.rs b/crates/rustack-lambda-core/tests/docker_probe.rs
new file mode 100644
index 00000000..e51c8e92
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/docker_probe.rs
@@ -0,0 +1,112 @@
+//! Actual pinned Rust resource probe in disconnected and operator bridge networks.
+#![cfg(unix)]
+#![forbid(unsafe_code)]
+
+use std::{env, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use rustack_lambda_core::docker::{
+    ContainerPolicy, EnvironmentProbeConfig, NetworkSelection, ProbeSettings, RelayBudgets,
+    probe_environment,
+};
+use tokio::time::Instant;
+
+mod common;
+use common::docker::Fixture;
+
+#[rstest::rstest]
+#[case::disconnected(false)]
+#[case::operator_bridge(true)]
+#[tokio::test]
+#[ignore = "requires explicit Docker runtime image/socket and operator probe bridge"]
+async fn test_should_qualify_actual_kernel_limits_and_join_probe_retirement(
+    #[case] bridge: bool,
+) -> Result<()> {
+    let mut fixture = Fixture::new().await?;
+    let result = async {
+        let selection: NetworkSelection = if bridge {
+            env::var("RUSTACK_RUNTIME_NETWORK")
+                .ok()
+                .filter(|value| !value.is_empty())
+                .context("explicit operator probe bridge required")?
+                .parse()?
+        } else {
+            "none".parse()?
+        };
+        let deadline = Instant::now() + Duration::from_secs(60);
+        let network = selection.qualify(&fixture.docker, deadline).await?;
+        ensure!(network.disconnected() != bridge, "network mode differs");
+        let policy = ContainerPolicy::new(
+            selection,
+            1000,
+            1000,
+            333_333_333,
+            RelayBudgets::new(
+                Duration::from_secs(60),
+                Duration::from_secs(600),
+                Duration::from_secs(60),
+            )?,
+        )?;
+        let config = EnvironmentProbeConfig::builder()
+            .directory(fixture.lease.clone())
+            .relay(fixture.relay.as_ref().context("relay pin")?.clone())
+            .environments(fixture.owner.port())
+            .policy(policy)
+            .network(network)
+            .settings(ProbeSettings::new(
+                Duration::from_secs(60),
+                Duration::from_secs(60),
+            )?)
+            .build();
+        let evidence = probe_environment(config.clone(), deadline).await?;
+        ensure!(
+            evidence.matches(&config),
+            "fresh probe does not match retained inputs"
+        );
+        ensure!(
+            fixture.owner.port().status().allocated == 0,
+            "proof issued before physical retirement"
+        );
+        let report = evidence.report();
+        ensure!(
+            report.memory_max == Some(128 * 1024 * 1024)
+                && report.swap_max == Some(0)
+                && report.pids_max == Some(256),
+            "kernel limits differ"
+        );
+        ensure!(
+            report.cpu_quota == Some(33_000) && report.cpu_period == 100_000,
+            "CPU rounding differs"
+        );
+        ensure!(
+            report.euid != 0
+                && report.egid != 0
+                && report.cap_effective == 0
+                && report.no_new_privileges
+                && report.seccomp_mode == 2,
+            "privilege isolation differs"
+        );
+        ensure!(
+            report.root_readonly
+                && report.temporary.bytes == 512 * 1024 * 1024
+                && report.temporary.mode == 0o1777,
+            "filesystem isolation differs"
+        );
+        let mut changed = config.clone();
+        changed.policy = ContainerPolicy::new(
+            "none".parse()?,
+            1000,
+            1000,
+            1_000_000_000,
+            RelayBudgets::default(),
+        )?;
+        ensure!(
+            !evidence.matches(&changed),
+            "proof matched a different policy"
+        );
+        Ok(())
+    }
+    .await;
+    let cleanup = fixture.cleanup().await;
+    result.and(cleanup)
+}
diff --git a/crates/rustack-lambda-core/tests/docker_wire.rs b/crates/rustack-lambda-core/tests/docker_wire.rs
new file mode 100644
index 00000000..5efe2c51
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/docker_wire.rs
@@ -0,0 +1,560 @@
+//! Explicit local Docker qualification of production HTTP/upgrade/control IO.
+
+#![cfg(unix)]
+#![forbid(unsafe_code)]
+
+#[path = "docker_wire/code.rs"]
+mod code;
+
+use std::{collections::HashMap, env, sync::Arc, time::Duration};
+
+use anyhow::{Context, Result, bail, ensure};
+use bytes::Bytes;
+use http::StatusCode;
+use rustack_lambda_core::{
+    artifact::{
+        Architecture as ImageArchitecture, DeploymentArtifact, ImageReference, PinnedImage,
+        ResolvedImage,
+    },
+    docker::{
+        ContainerPolicy, DirectoryLease, DirectoryLeaseError, DockerError, DockerKey, DockerPort,
+        DockerSocket, DockerWire, EnvironmentPlan, FunctionLogs, ImageLeaseConfig,
+        ImageLeaseManager, ImagePinScope, ImageResolver, OutputChannel, OwnerFilter, RelayBudgets,
+    },
+    executor::{ExecutionRevision, ExecutorBackend},
+    identity::FunctionResourceId,
+};
+use rustack_lambda_model::types::ImageConfig;
+use rustack_lambda_runtime::{
+    client::{ClientConfig, ClientEvent, ControlClient},
+    metadata::local_trace_id,
+    protocol::{Architecture, AttemptId, EnvironmentId, Payload},
+    session::{Invocation, RuntimeResult},
+};
+use serde_json::{Value, json};
+use tempfile::TempDir;
+use tokio::{
+    io::AsyncWriteExt,
+    sync::watch,
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+use uuid::Uuid;
+
+const IO: Duration = Duration::from_secs(60);
+const LARGE: usize = 6 * 1024 * 1024 - 4096;
+fn deadline() -> Instant {
+    Instant::now() + IO
+}
+
+#[derive(Debug)]
+struct Names {
+    relay: DockerKey,
+    function: DockerKey,
+    owner: Uuid,
+    run: Uuid,
+    environment: EnvironmentId,
+}
+
+#[derive(Debug)]
+struct Runtime {
+    client: ControlClient,
+    stop: watch::Sender<bool>,
+    pump: Option<JoinHandle<Result<(), DockerError>>>,
+    settlement: Option<Result<(), DockerError>>,
+}
+impl Runtime {
+    async fn shutdown(&mut self) -> Result<()> {
+        let protocol = self
+            .client
+            .shutdown(deadline())
+            .await
+            .map_err(anyhow::Error::from);
+        self.stop.send_replace(true);
+        let pump = if let Some(result) = &self.settlement {
+            result.clone()
+        } else {
+            let result = if let Some(pump) = &mut self.pump {
+                pump.await
+                    .map_err(|_| DockerError::Worker)
+                    .and_then(|result| result)
+            } else {
+                Ok(())
+            };
+            self.pump.take();
+            self.settlement = Some(result.clone());
+            result
+        };
+        protocol.and(pump.map_err(anyhow::Error::from))
+    }
+}
+impl Drop for Runtime {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+
+#[derive(Debug)]
+struct Environment {
+    wire: DockerWire,
+    docker: DockerPort,
+    names: Names,
+    runtime: Option<Runtime>,
+    logs: Option<FunctionLogs>,
+    images: ImageLeaseManager,
+    artifacts: Vec<PinnedImage>,
+    plan: Option<EnvironmentPlan>,
+    lease: DirectoryLease,
+    directory: Option<TempDir>,
+}
+impl Environment {
+    async fn new() -> Result<Self> {
+        Self::new_with_code(false).await
+    }
+
+    async fn new_with_code(code: bool) -> Result<Self> {
+        let socket = env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")
+            .context("explicit test Docker socket required")?;
+        let socket: DockerSocket = format!("unix://{socket}").parse()?;
+        let wire = DockerWire::connect(socket, deadline()).await?;
+        let directory = tempfile::tempdir()?;
+        let lease = if code {
+            DirectoryLease::acquire_code(directory.path().to_path_buf(), deadline()).await?
+        } else {
+            DirectoryLease::acquire(directory.path().to_path_buf(), deadline()).await?
+        };
+        let run = lease.run_id();
+        let owner = lease.owner_id();
+        let docker = wire.port().bind_directory(&lease, deadline()).await?;
+        let images = ImageLeaseManager::start(
+            docker.clone(),
+            ImagePinScope::new(lease.clone()),
+            ImageLeaseConfig::default(),
+        )?;
+        ensure!(
+            matches!(
+                DirectoryLease::acquire(directory.path().to_path_buf(), deadline()).await,
+                Err(DirectoryLeaseError::InUse)
+            ),
+            "image owner did not retain directory exclusion"
+        );
+        Ok(Self {
+            wire,
+            docker,
+            names: Names {
+                relay: format!("rustack-wire-relay-{run}").parse()?,
+                function: format!("rustack-wire-function-{run}").parse()?,
+                owner,
+                run,
+                environment: EnvironmentId::default(),
+            },
+            runtime: None,
+            logs: None,
+            images,
+            artifacts: Vec::new(),
+            plan: None,
+            lease,
+            directory: Some(directory),
+        })
+    }
+
+    async fn image(&mut self, reference: &str, architecture: &str) -> Result<PinnedImage> {
+        let reference: ImageReference = reference.parse()?;
+        let architecture = match architecture {
+            "arm64" => ImageArchitecture::Arm64,
+            "amd64" => ImageArchitecture::X86_64,
+            _ => bail!("unknown fixture architecture"),
+        };
+        let resolved = ImageResolver::new(self.docker.clone())
+            .resolve_local(&reference, architecture, None, deadline())
+            .await?;
+        let saved: ResolvedImage = serde_json::from_slice(&serde_json::to_vec(&resolved)?)?;
+        let image = self.images.port().restore(&saved, None, deadline()).await?;
+        ensure!(
+            image.resolved().code_sha256()? == saved.code_sha256()?,
+            "restored image hash changed"
+        );
+        self.artifacts.push(image.clone());
+        Ok(image)
+    }
+
+    async fn start(&mut self) -> Result<()> {
+        self.start_with(None, true).await
+    }
+
+    async fn start_with(&mut self, overrides: Option<ImageConfig>, bootstrap: bool) -> Result<()> {
+        let arch = env::var("RUSTACK_RUNTIME_ARCH").context("explicit architecture required")?;
+        let (architecture, daemon_arch) = match arch.as_str() {
+            "arm64" => (Architecture::Arm64, "aarch64"),
+            "amd64" => (Architecture::X86_64, "x86_64"),
+            _ => bail!("architecture must be arm64 or amd64"),
+        };
+        let relay = env::var("RUSTACK_RUNTIME_IMAGE").context("relay fixture image required")?;
+        let port = self.docker.clone();
+        let info = port.info(deadline()).await?;
+        ensure!(
+            info.os_type.as_deref() == Some("linux")
+                && info.architecture.as_deref() == Some(daemon_arch),
+            "daemon platform mismatch"
+        );
+        let relay = self.image(&relay, &arch).await?;
+        let function = self
+            .image(&format!("rustack-p0-handler:{arch}"), &arch)
+            .await?;
+        let revision = ExecutionRevision::builder()
+            .resource_id(FunctionResourceId::new())
+            .revision_id(Uuid::new_v4().to_string())
+            .backend(ExecutorBackend::Docker)
+            .function_name("wire-fixture".into())
+            .qualifier("$LATEST".into())
+            .runtime(None)
+            .handler(None)
+            .architecture(function.resolved().metadata().architecture)
+            .artifact(DeploymentArtifact::Image(function))
+            .image_config(overrides)
+            .environment(HashMap::from([
+                ("AWS_REGION".into(), "us-east-1".into()),
+                ("AWS_DEFAULT_REGION".into(), "us-east-1".into()),
+                ("TEST_VALUE".into(), "from-captured-revision".into()),
+            ]))
+            .timeout(Duration::from_secs(120))
+            .memory_mb(192)
+            .ephemeral_storage_mb(512)
+            .build();
+        let plan = EnvironmentPlan::new(
+            self.lease.clone(),
+            relay,
+            Arc::new(revision),
+            ContainerPolicy::new(
+                "none".parse()?,
+                1000,
+                1000,
+                1_000_000_000,
+                RelayBudgets::new(IO, Duration::from_secs(600), IO)?,
+            )?,
+        )?;
+        self.names.relay = plan.relay_key().clone();
+        self.names.function = plan.function_key().clone();
+        self.names.environment = plan.environment_id();
+        self.plan = Some(plan);
+        self.plan
+            .as_ref()
+            .context("allocation plan")?
+            .create_relay(&port, deadline())
+            .await?;
+        self.attach(&port, architecture).await?;
+        port.start_container(&self.names.relay, deadline()).await?;
+        let client = &mut self.runtime.as_mut().context("runtime owner")?.client;
+        ensure!(
+            client.next(deadline()).await? == ClientEvent::RelayReady,
+            "relay handshake mismatch"
+        );
+        self.plan
+            .as_ref()
+            .context("allocation plan")?
+            .create_function(&port, deadline())
+            .await?;
+        self.logs = Some(FunctionLogs::start(
+            port.attach_logs(&self.names.function, deadline()).await?,
+            IO,
+            262_144,
+        )?);
+        port.start_container(&self.names.function, deadline())
+            .await?;
+        if bootstrap {
+            ensure!(
+                client.next(deadline()).await? == ClientEvent::BootstrapReady,
+                "function readiness mismatch"
+            );
+        }
+        Ok(())
+    }
+
+    async fn attach(&mut self, port: &DockerPort, architecture: Architecture) -> Result<()> {
+        let attached = port.attach(&self.names.relay, deadline()).await?;
+        let (mut output, input) = attached.split(IO)?;
+        let (mut bridge, reader) = tokio::io::duplex(64 * 1024);
+        let client = ControlClient::start(
+            ClientConfig::new(self.names.environment, architecture, IO)?,
+            reader,
+            input,
+        )?;
+        let (stop, mut stopped) = watch::channel(false);
+        let pump = tokio::spawn(async move {
+            loop {
+                let chunk = tokio::select! {
+                    biased;
+                    () = async { let _ = stopped.wait_for(|stop| *stop).await; } => return Ok(()),
+                    chunk = output.next(Instant::now() + Duration::from_secs(600)) => chunk?,
+                };
+                match chunk {
+                    Some(chunk) if chunk.channel == OutputChannel::Stdout => {
+                        timeout_at(deadline(), bridge.write_all(&chunk.bytes))
+                            .await
+                            .map_err(|_| DockerError::Deadline)??;
+                    }
+                    Some(_) => {} // Relay diagnostics are deliberately not copied into logs.
+                    None => return Ok(()),
+                }
+            }
+        });
+        self.runtime = Some(Runtime {
+            client,
+            stop,
+            pump: Some(pump),
+            settlement: None,
+        });
+        Ok(())
+    }
+
+    async fn call(&mut self, event: &Value, failed: bool) -> Result<Value> {
+        let call = Invocation::new(
+            AttemptId::default(),
+            Instant::now() + Duration::from_secs(120),
+            "arn:aws:lambda:us-east-1:000000000000:function:wire-fixture:prod".parse()?,
+            local_trace_id()?,
+            Payload::try_from(Bytes::from(serde_json::to_vec(event)?))?,
+        )?;
+        let id = call.parts().0;
+        let client = &mut self.runtime.as_mut().context("runtime owner")?.client;
+        client.invoke(call, deadline()).await?;
+        match client
+            .next(Instant::now() + Duration::from_secs(120))
+            .await?
+        {
+            ClientEvent::InvocationResult { attempt, result } if attempt == id => match result {
+                RuntimeResult::Success(payload) if !failed => {
+                    Ok(serde_json::from_slice(payload.as_ref())?)
+                }
+                RuntimeResult::FunctionError(payload) if failed => {
+                    Ok(serde_json::from_slice(payload.as_ref())?)
+                }
+                _ => bail!("unexpected function outcome"),
+            },
+            _ => bail!("unexpected control outcome"),
+        }
+    }
+
+    async fn cleanup(&mut self) -> Result<()> {
+        let port = self.docker.clone();
+        let function = remove(&port, &self.names.function).await;
+        let logs = if let Some(logs) = &mut self.logs {
+            logs.shutdown().await.map(drop).map_err(anyhow::Error::from)
+        } else {
+            Ok(())
+        };
+        let runtime = if let Some(runtime) = &mut self.runtime {
+            runtime.shutdown().await
+        } else {
+            Ok(())
+        };
+        let relay = remove(&port, &self.names.relay).await;
+        let remaining = port
+            .list_containers(
+                OwnerFilter::new(self.names.owner, Some(self.names.run), None)?,
+                deadline(),
+            )
+            .await;
+        let listed = remaining.map_err(anyhow::Error::from).and_then(|items| {
+            ensure!(
+                items.is_empty(),
+                "owned containers remain after wire cleanup"
+            );
+            Ok(())
+        });
+        self.plan.take();
+        self.artifacts.clear();
+        let images = self
+            .images
+            .shutdown(deadline())
+            .await
+            .map_err(anyhow::Error::from);
+        let joined = if images.is_ok() {
+            self.wire.shutdown().await.map_err(anyhow::Error::from)
+        } else {
+            Ok(())
+        };
+        let result = function
+            .and(logs)
+            .and(runtime)
+            .and(relay)
+            .and(listed)
+            .and(images)
+            .and(joined);
+        if result.is_err() {
+            // Uncertain cleanup still owns the namespace; retain its files for
+            // recovery rather than unlinking the live lock inode on test Drop.
+            if let Some(directory) = self.directory.take() {
+                let _retained = directory.keep();
+            }
+        }
+        result
+    }
+}
+
+async fn remove(port: &DockerPort, key: &DockerKey) -> Result<()> {
+    match port.remove_container(key, deadline()).await {
+        Ok(()) | Err(DockerError::Status(StatusCode::NOT_FOUND)) => Ok(()),
+        Err(error) => Err(error.into()),
+    }
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker wire qualification images/socket"]
+async fn test_should_execute_real_ric_over_production_wire_with_large_binary_frames_and_cleanup()
+-> Result<()> {
+    let mut environment = Environment::new().await?;
+    let result = async {
+        environment.start().await?;
+        let event =
+            json!({"value":35,"padding":"p".repeat(LARGE),"response_bytes":LARGE,"logs":true,"policy":true});
+        let computed = environment.call(&event, false).await?;
+        ensure!(
+            computed["computed"] == 42
+                && computed["counter"] == 1
+                && computed["inputBytes"] == LARGE,
+            "computed/large input mismatch"
+        );
+        ensure!(
+                computed["large"].as_str().is_some_and(
+                    |value| value.len() == LARGE && value.bytes().all(|byte| byte == b'r')
+                ),
+                "large output mismatch"
+            );
+        ensure!(
+            computed["uid"] == 1000
+                && computed["rootReadOnly"] == true
+                && computed["memoryMax"] == "201326592"
+                && computed["pidsMax"] == "256",
+            "function resource controls differ"
+        );
+        ensure!(
+            computed["tmpBytes"] == 512 * 1024 * 1024_u64
+                && computed["tmpMode"] == 0o1777
+                && computed["swapMax"] == "0"
+                && computed["capEff"] == "0000000000000000"
+                && computed["noNewPrivs"] == "1"
+                && computed["taskRoot"] == "/var/task"
+                && computed["functionName"] == "wire-fixture"
+                && computed["functionVersion"] == "$LATEST"
+                && computed["region"] == "us-east-1"
+                && computed["configuredValue"] == "from-captured-revision",
+            "allocation policy runtime enforcement differs"
+        );
+        let cpu = computed["cpuMax"].as_str().context("CPU quota report")?;
+        let cpu: Vec<_> = cpu.split_whitespace().collect();
+        ensure!(matches!(cpu.as_slice(), [quota, period] if quota.parse::<u64>().is_ok_and(|quota| quota > 0 && period.parse::<u64>() == Ok(quota))), "CPU quota does not enforce one CPU");
+        let warm = environment.call(&json!({"value":0}), false).await?;
+        ensure!(
+            warm["computed"] == 7 && warm["counter"] == 2,
+            "warm reuse mismatch"
+        );
+        let failure = environment.call(&json!({"fail":true}), true).await?;
+        ensure!(
+            failure["errorType"] == "ValueError",
+            "function error mismatch"
+        );
+        let logs = environment.logs.as_ref().context("function log capture")?;
+        timeout_at(deadline(), async {
+            loop {
+                let snapshot = logs.snapshot(deadline()).await?;
+                ensure!(snapshot.failure.is_none(), "log capture failed");
+                if snapshot
+                    .tail
+                    .windows(19)
+                    .any(|part| part == b"WIRE_STDOUT_CAPTURE")
+                    && snapshot
+                        .tail
+                        .windows(19)
+                        .any(|part| part == b"WIRE_STDERR_CAPTURE")
+                {
+                    break Ok::<(), anyhow::Error>(());
+                }
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .context("function log receipt deadline")??;
+        Ok(())
+    }
+    .await;
+    let cleanup = environment.cleanup().await;
+    result.and(cleanup)
+}
+
+#[tokio::test]
+#[ignore = "requires explicit Docker wire qualification images/socket"]
+async fn test_should_preserve_empty_overrides_in_actual_docker_create_merging() -> Result<()> {
+    for reset in [false, true] {
+        let mut environment = Environment::new().await?;
+        let result = async {
+            let overrides = ImageConfig {
+                entry_point: reset.then(Vec::new),
+                command: Some(if reset {
+                    vec!["/bin/true".into()]
+                } else {
+                    vec![]
+                }),
+                working_directory: Some("/tmp".into()),
+            };
+            environment
+                .start_with(Some(overrides.clone()), false)
+                .await?;
+            let port = environment.docker.clone();
+            let expected = environment
+                .artifacts
+                .last()
+                .context("function artifact")?
+                .resolved()
+                .metadata()
+                .execution
+                .plan(Some(&overrides))?;
+            let actual = port
+                .inspect_container(&environment.names.function, deadline())
+                .await?
+                .config
+                .context("actual create config")?;
+            ensure!(
+                actual.working_dir.as_deref() == Some("/tmp"),
+                "working directory override differs"
+            );
+            if reset {
+                ensure!(
+                    actual.entrypoint.as_deref().unwrap_or_default().is_empty(),
+                    "daemon restored a cleared entrypoint"
+                );
+                ensure!(
+                    actual
+                        .cmd
+                        .as_deref()
+                        .is_some_and(|command| command == ["/bin/true"]),
+                    "reset command mismatch"
+                );
+            } else {
+                ensure!(
+                    actual
+                        .entrypoint
+                        .as_deref()
+                        .is_some_and(|entrypoint| entrypoint == expected.entrypoint()),
+                    "inherited entrypoint mismatch"
+                );
+                ensure!(
+                    actual.cmd.as_deref().unwrap_or_default().is_empty(),
+                    "daemon restored a cleared command"
+                );
+            }
+            let exit = port
+                .wait_container(&environment.names.function, deadline())
+                .await?;
+            ensure!(
+                exit.status_code == if reset { 0 } else { 142 },
+                "empty override execution exit differs"
+            );
+            Ok(())
+        }
+        .await;
+        let cleanup = environment.cleanup().await;
+        result.and(cleanup)?;
+    }
+    Ok(())
+}
diff --git a/crates/rustack-lambda-core/tests/docker_wire/code.rs b/crates/rustack-lambda-core/tests/docker_wire/code.rs
new file mode 100644
index 00000000..b2751a17
--- /dev/null
+++ b/crates/rustack-lambda-core/tests/docker_wire/code.rs
@@ -0,0 +1,830 @@
+//! Actual typed ZIP transfer into a separately owned daemon-local code volume.
+
+use std::{
+    collections::{BTreeMap, HashMap},
+    env,
+    io::{Cursor, Write},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, bail, ensure};
+use bytes::Bytes;
+use http::StatusCode;
+use rustack_lambda_core::{
+    artifact::Architecture,
+    docker::{
+        CodeRetirement, CodeVolumeConfig, CodeVolumeIdentity, CodeVolumeManager, DockerCodeArchive,
+        DockerError, DockerKey, FunctionLogs, OwnerFilter, PinnedCode,
+        models::{
+            ContainerCreateBody, ContainerInspectResponse, ContainerStateStatusEnum, HostConfig,
+            Mount, MountType, MountVolumeOptions,
+        },
+    },
+    storage::FunctionStore,
+};
+use serde_json::{Value, json};
+use tokio::{
+    fs,
+    io::{AsyncReadExt, AsyncWriteExt},
+    task::spawn_blocking,
+    time::{sleep, timeout_at},
+};
+use uuid::Uuid;
+use zip::{ZipWriter, write::SimpleFileOptions};
+
+use super::{Environment, IO, deadline};
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum VolumePhase {
+    Unissued,
+    Uncertain,
+    Known,
+}
+impl VolumePhase {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Unissued => "unissued",
+            Self::Uncertain => "uncertain",
+            Self::Known => "known",
+        }
+    }
+}
+#[derive(Clone)]
+enum ContainerPhase {
+    Unissued,
+    Uncertain,
+    Known(DockerKey),
+}
+impl ContainerPhase {
+    fn key(&self) -> Option<&DockerKey> {
+        if let Self::Known(key) = self {
+            Some(key)
+        } else {
+            None
+        }
+    }
+    fn record(&self) -> Value {
+        match self {
+            Self::Unissued => json!({"state":"unissued"}),
+            Self::Uncertain => json!({"state":"uncertain"}),
+            Self::Known(key) => json!({"state":"known","id":key.as_str()}),
+        }
+    }
+}
+
+struct Fixture {
+    environment: Environment,
+    volume: DockerKey,
+    loader: DockerKey,
+    function: DockerKey,
+    labels: BTreeMap<String, String>,
+    image: String,
+    hash: String,
+    volume_phase: VolumePhase,
+    loader_phase: ContainerPhase,
+    function_phase: ContainerPhase,
+    manager: Option<CodeVolumeManager>,
+    ready: Option<PinnedCode>,
+    retirement: Option<CodeRetirement>,
+    native_zip_sha256: Option<String>,
+}
+
+impl Fixture {
+    async fn new() -> Result<Self> {
+        Self::new_with_manager(false).await
+    }
+
+    async fn new_with_manager(managed: bool) -> Result<Self> {
+        let mut environment = Environment::new_with_code(managed).await?;
+        let root = environment
+            .directory
+            .as_mut()
+            .context("code fixture evidence")?;
+        root.disable_cleanup(true);
+        eprintln!("ZIP code evidence: {}", root.path().display());
+        let id = Uuid::new_v4();
+        let labels = BTreeMap::from([
+            (
+                "rustack.lambda.ownerId".into(),
+                environment.names.owner.to_string(),
+            ),
+            (
+                "rustack.lambda.runId".into(),
+                environment.names.run.to_string(),
+            ),
+            ("rustack.lambda.environmentId".into(), id.to_string()),
+            ("rustack.test.code".into(), id.to_string()),
+        ]);
+        Ok(Self {
+            environment,
+            volume: format!("rustack-code-{id}").parse()?,
+            loader: format!("rustack-code-loader-{id}").parse()?,
+            function: format!("rustack-code-consumer-{id}").parse()?,
+            labels,
+            image: String::new(),
+            hash: String::new(),
+            volume_phase: VolumePhase::Unissued,
+            loader_phase: ContainerPhase::Unissued,
+            function_phase: ContainerPhase::Unissued,
+            manager: None,
+            ready: None,
+            retirement: None,
+            native_zip_sha256: None,
+        })
+    }
+
+    async fn record(&self) -> Result<()> {
+        let root = self
+            .environment
+            .directory
+            .as_ref()
+            .context("code evidence root")?
+            .path();
+        let record = serde_json::to_vec(&json!({"schemaVersion":1,"volume":self.volume.as_str(),
+            "loader":self.loader.as_str(),"function":self.function.as_str(),"labels":self.labels,
+            "image":self.image,"zipSha256":self.hash,"nativeZipSha256":self.native_zip_sha256,"volumeState":self.volume_phase.name(),
+            "loaderState":self.loader_phase.record(),"functionState":self.function_phase.record()}))?;
+        timeout_at(deadline(), async {
+            let pending = root.join("code-intent.pending");
+            let mut file = fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .mode(0o600)
+                .open(&pending)
+                .await?;
+            file.write_all(&record).await?;
+            file.sync_all().await?;
+            drop(file);
+            fs::rename(&pending, root.join("code-intent.json")).await?;
+            fs::File::open(root).await?.sync_all().await
+        })
+        .await??;
+        Ok(())
+    }
+
+    fn body(&self, loader: bool) -> ContainerCreateBody {
+        let mut labels: HashMap<String, String> = self.labels.clone().into_iter().collect();
+        labels.insert(
+            "rustack.lambda.role".into(),
+            if loader {
+                "code-loader"
+            } else {
+                "code-consumer"
+            }
+            .into(),
+        );
+        ContainerCreateBody {
+            image: Some(self.image.clone()),
+            user: Some(if loader { "65534:65534" } else { "1000:1000" }.into()),
+            entrypoint: Some(vec![
+                if loader {
+                    "/never-start-this-loader"
+                } else {
+                    "/var/task/bootstrap"
+                }
+                .into(),
+            ]),
+            cmd: Some(Vec::new()),
+            working_dir: Some("/var/task".into()),
+            labels: Some(labels),
+            tty: Some(false),
+            host_config: Some(HostConfig {
+                network_mode: Some("none".into()),
+                readonly_rootfs: Some(true),
+                memory: Some(
+                    if self.native_zip_sha256.is_some() {
+                        512
+                    } else {
+                        128
+                    } * 1024
+                        * 1024,
+                ),
+                nano_cpus: Some(1_000_000_000),
+                pids_limit: Some(64),
+                cap_drop: Some(vec!["ALL".into()]),
+                security_opt: Some(vec!["no-new-privileges:true".into()]),
+                tmpfs: Some(HashMap::from([(
+                    "/tmp".into(),
+                    if self.native_zip_sha256.is_some() {
+                        // The separately owned Linux verifier executes Native children here.
+                        "rw,exec,nosuid,nodev,size=536870912"
+                    } else {
+                        "rw,nosuid,nodev,size=536870912"
+                    }
+                    .into(),
+                )])),
+                mounts: Some(vec![Mount {
+                    typ: Some(MountType::VOLUME),
+                    source: Some(self.volume.as_str().into()),
+                    target: Some("/var/task".into()),
+                    read_only: Some(!loader),
+                    volume_options: Some(MountVolumeOptions {
+                        no_copy: Some(true),
+                        ..MountVolumeOptions::default()
+                    }),
+                    ..Mount::default()
+                }]),
+                ..HostConfig::default()
+            }),
+            ..ContainerCreateBody::default()
+        }
+    }
+
+    fn owned(&self, inspected: &ContainerInspectResponse, loader: bool) -> Result<DockerKey> {
+        let name = if loader { &self.loader } else { &self.function };
+        let config = inspected
+            .config
+            .as_ref()
+            .context("owned container config")?;
+        let expected = self.body(loader);
+        let id = inspected.id.as_deref().context("owned container ID")?;
+        ensure!(
+            id.len() == 64
+                && id
+                    .bytes()
+                    .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte)),
+            "noncanonical container ID"
+        );
+        ensure!(
+            inspected.name.as_deref() == Some(format!("/{}", name.as_str()).as_str())
+                && config.image.as_deref() == Some(self.image.as_str())
+                && expected.labels.as_ref().is_some_and(|required| config
+                    .labels
+                    .as_ref()
+                    .is_some_and(|actual| required
+                        .iter()
+                        .all(|(key, value)| actual.get(key) == Some(value)))),
+            "foreign code fixture container"
+        );
+        let mounts = inspected.mounts.as_ref().context("actual code mount")?;
+        ensure!(
+            mounts
+                .iter()
+                .any(|mount| mount.name.as_deref() == Some(self.volume.as_str())
+                    && mount.destination.as_deref() == Some("/var/task")
+                    && mount.rw == Some(loader)),
+            "actual volume mount mode/name mismatch"
+        );
+        Ok(id.parse()?)
+    }
+
+    async fn observe(&mut self, loader: bool) -> Result<DockerKey> {
+        let name = if loader { &self.loader } else { &self.function };
+        let inspected = self
+            .environment
+            .docker
+            .inspect_container(name, deadline())
+            .await?;
+        let id = self.owned(&inspected, loader)?;
+        if loader {
+            self.loader_phase = ContainerPhase::Known(id.clone());
+        } else {
+            self.function_phase = ContainerPhase::Known(id.clone());
+        }
+        self.record().await?;
+        Ok(id)
+    }
+
+    async fn prepare_code(&mut self) -> Result<(DockerCodeArchive, Architecture)> {
+        let arch = env::var("RUSTACK_RUNTIME_ARCH")?;
+        let image = self
+            .environment
+            .image(&format!("rustack-custom-ric:a-{arch}"), &arch)
+            .await?;
+        image
+            .resolved()
+            .metadata()
+            .image_id
+            .as_str()
+            .clone_into(&mut self.image);
+        let architecture = image.resolved().metadata().architecture;
+        let path = env::var("RUSTACK_ZIP_CODE_BOOTSTRAP")
+            .context("explicit cross-built ZIP probe required")?;
+        let bytes = timeout_at(deadline(), async {
+            let mut file = fs::File::open(path).await?;
+            let mut bytes = Vec::new();
+            (&mut file)
+                .take(20 * 1024 * 1024 + 1)
+                .read_to_end(&mut bytes)
+                .await?;
+            ensure!(bytes.len() <= 20 * 1024 * 1024, "probe source cap");
+            Ok::<_, anyhow::Error>(bytes)
+        })
+        .await??;
+        let zip = timeout_at(deadline(), spawn_blocking(move || package(&bytes))).await???;
+        let root = self
+            .environment
+            .directory
+            .as_ref()
+            .context("artifact root")?
+            .path()
+            .join("artifacts");
+        let store = FunctionStore::new(&root);
+        let (path, hash, _) = store
+            .store_zip_code("code-probe", "$LATEST", &Bytes::from(zip))
+            .await?;
+        let artifact = store.capture_artifact(&path).await?;
+        self.hash = hash;
+        timeout_at(
+            deadline(),
+            fs::write(path.join("bootstrap"), b"mutated host extraction"),
+        )
+        .await??;
+        let code = DockerCodeArchive::prepare(artifact, architecture, deadline()).await?;
+        ensure!(
+            code.len() > 1024 * 1024 && code.code_sha256() == self.hash,
+            "large immutable transfer identity"
+        );
+        Ok((code, architecture))
+    }
+
+    async fn prepare_native_code(&mut self) -> Result<(DockerCodeArchive, Architecture)> {
+        let arch = env::var("RUSTACK_RUNTIME_ARCH")?;
+        let image = self
+            .environment
+            .image(&env::var("RUSTACK_ZIP_BASE_IMAGE")?, &arch)
+            .await?;
+        image
+            .resolved()
+            .metadata()
+            .image_id
+            .as_str()
+            .clone_into(&mut self.image);
+        let architecture = image.resolved().metadata().architecture;
+        let zip = bounded_file(&env::var("RUSTACK_PROVIDED_ZIP_A")?, 50 * 1024 * 1024).await?;
+        let original_hash = rustack_lambda_core::storage::compute_sha256(&zip);
+        eprintln!("Native original ZIP digest: {original_hash}");
+        self.native_zip_sha256 = Some(original_hash.clone());
+        let bootstrap =
+            bounded_file(&env::var("RUSTACK_ZIP_NATIVE_VERIFIER")?, 50 * 1024 * 1024).await?;
+        let manifest = serde_json::to_vec(
+            &json!({"architecture": if arch == "arm64" { "arm64" } else { "x86_64" },
+            "zipSha256":original_hash,"codeMarker":"A"}),
+        )?;
+        let packaged = timeout_at(
+            deadline(),
+            spawn_blocking(move || {
+                let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+                for (name, data, mode) in [
+                    ("bootstrap", bootstrap, 0o755),
+                    ("input.zip", zip, 0o644),
+                    ("manifest.json", manifest, 0o644),
+                ] {
+                    writer.start_file(name, SimpleFileOptions::default().unix_permissions(mode))?;
+                    writer.write_all(&data)?;
+                }
+                Ok::<_, anyhow::Error>(writer.finish()?.into_inner())
+            }),
+        )
+        .await???;
+        let root = self
+            .environment
+            .directory
+            .as_ref()
+            .context("Native artifact evidence")?
+            .path()
+            .join("artifacts");
+        let store = FunctionStore::new(root);
+        let (path, hash, _) = store
+            .store_zip_code("native-verifier", "$LATEST", &Bytes::from(packaged))
+            .await?;
+        self.hash = hash;
+        let artifact = store.capture_artifact(&path).await?;
+        Ok((
+            DockerCodeArchive::prepare(artifact, architecture, deadline()).await?,
+            architecture,
+        ))
+    }
+
+    async fn exercise(&mut self) -> Result<()> {
+        let (code, architecture) = self.prepare_code().await?;
+        self.volume_phase = VolumePhase::Uncertain;
+        self.record().await?;
+        self.environment
+            .docker
+            .create_volume(&self.volume, &self.labels, deadline())
+            .await?;
+        self.volume_phase = VolumePhase::Known;
+        self.record().await?;
+        self.loader_phase = ContainerPhase::Uncertain;
+        self.record().await?;
+        self.environment
+            .docker
+            .create_container_on_platform(&self.loader, &self.body(true), architecture, deadline())
+            .await?;
+        let loader = self.observe(true).await?;
+        self.require_unstarted(&loader).await?;
+        self.environment
+            .docker
+            .upload_code(&loader, &code, deadline())
+            .await?;
+        self.require_unstarted(&loader).await?;
+        self.retire(true).await?;
+        self.function_phase = ContainerPhase::Uncertain;
+        self.record().await?;
+        self.environment
+            .docker
+            .create_container_on_platform(
+                &self.function,
+                &self.body(false),
+                architecture,
+                deadline(),
+            )
+            .await?;
+        let function = self.observe(false).await?;
+        self.consume_probe(&function).await?;
+        Ok(())
+    }
+
+    async fn exercise_managed(&mut self) -> Result<()> {
+        let (code, architecture) = if self.native_zip_sha256.is_some() {
+            self.prepare_native_code().await?
+        } else {
+            self.prepare_code().await?
+        };
+        let base = self
+            .environment
+            .artifacts
+            .last()
+            .context("source pin")?
+            .clone();
+        let manager = CodeVolumeManager::start(
+            self.environment.docker.clone(),
+            self.environment.lease.clone(),
+            CodeVolumeConfig::default(),
+        )?;
+        let port = manager.port();
+        self.manager = Some(manager);
+        let preparation = port.start_preparation(
+            CodeVolumeIdentity::new(Uuid::new_v4(), Uuid::new_v4())?,
+            code,
+            base,
+            deadline() + Duration::from_secs(120),
+        )?;
+        self.retirement = Some(preparation.retirement());
+        let ready = preparation.wait().await?;
+        self.volume = ready.volume_name().clone();
+        ensure!(
+            ready.base_image_id().as_str() == self.image,
+            "changed base image"
+        );
+        let mount = ready.mount()?;
+        self.ready = Some(ready);
+        ensure!(
+            port.status().volumes == 1 && port.status().preparing == 0,
+            "Ready admission"
+        );
+        self.function_phase = ContainerPhase::Uncertain;
+        self.record().await?;
+        let mut body = self.body(false);
+        body.host_config.as_mut().context("consumer policy")?.mounts = Some(vec![mount]);
+        self.environment
+            .docker
+            .create_container_on_platform(&self.function, &body, architecture, deadline())
+            .await?;
+        let function = self.observe(false).await?;
+        self.consume_probe(&function).await?;
+        ensure!(
+            port.status().volumes == 1,
+            "consumer must retain code ownership"
+        );
+        Ok(())
+    }
+
+    async fn consume_probe(&mut self, function: &DockerKey) -> Result<()> {
+        self.environment.logs = Some(FunctionLogs::start(
+            self.environment
+                .docker
+                .attach_logs(function, deadline())
+                .await?,
+            IO,
+            65_536,
+        )?);
+        self.environment
+            .docker
+            .start_container(function, deadline())
+            .await?;
+        let exit = self
+            .environment
+            .docker
+            .wait_container(function, deadline())
+            .await?;
+        let logs = self.environment.logs.as_mut().context("probe log owner")?;
+        timeout_at(deadline(), async {
+            loop {
+                let snapshot = logs.snapshot(deadline()).await?;
+                if snapshot.closed {
+                    ensure!(snapshot.failure.is_none(), "probe log failure");
+                    break;
+                }
+                sleep(Duration::from_millis(10)).await;
+            }
+            Ok::<_, anyhow::Error>(())
+        })
+        .await??;
+        let tail = logs.shutdown().await?.tail;
+        let evidence = self
+            .environment
+            .directory
+            .as_ref()
+            .context("probe evidence root")?
+            .path()
+            .join("code-output.log");
+        timeout_at(deadline(), fs::write(evidence, &tail)).await??;
+        ensure!(
+            exit.status_code == 0 && exit.error.is_none(),
+            "code probe exited unsuccessfully"
+        );
+        let output: Value = serde_json::from_slice(&tail)?;
+        if let Some(hash) = &self.native_zip_sha256 {
+            return verify_native(&output, hash);
+        }
+        ensure!(
+            output
+                == json!({"computed":42,"readOnly":true,"tmpWritable":true,"metadata":[
+            {"uid":0,"gid":0,"mode":0o555},{"uid":0,"gid":0,"mode":0o555},{"uid":0,"gid":0,"mode":0o444}]}),
+            "actual ZIP code/ownership/mode computation mismatch"
+        );
+        Ok(())
+    }
+
+    async fn require_unstarted(&self, key: &DockerKey) -> Result<()> {
+        let inspected = self
+            .environment
+            .docker
+            .inspect_container(key, deadline())
+            .await?;
+        self.owned(&inspected, true)?;
+        ensure!(
+            inspected
+                .state
+                .is_some_and(|state| state.running == Some(false)
+                    && state.status == Some(ContainerStateStatusEnum::CREATED)),
+            "loader was started"
+        );
+        Ok(())
+    }
+
+    async fn retire(&mut self, loader: bool) -> Result<()> {
+        let (phase, name) = if loader {
+            (self.loader_phase.clone(), self.loader.clone())
+        } else {
+            (self.function_phase.clone(), self.function.clone())
+        };
+        if matches!(phase, ContainerPhase::Unissued) {
+            return Ok(());
+        }
+        let known = phase.key().cloned();
+        let lookup = known.as_ref().unwrap_or(&name);
+        let inspected = match self
+            .environment
+            .docker
+            .inspect_container(lookup, deadline())
+            .await
+        {
+            Err(DockerError::Status(StatusCode::NOT_FOUND)) if known.is_some() => return Ok(()),
+            result => result?,
+        };
+        let id = self.owned(&inspected, loader)?;
+        ensure!(
+            known.as_ref().is_none_or(|known| known == &id),
+            "changed known container identity"
+        );
+        if loader {
+            self.loader_phase = ContainerPhase::Known(id.clone());
+        } else {
+            self.function_phase = ContainerPhase::Known(id.clone());
+        }
+        self.record().await?;
+        match inspected.state.and_then(|state| state.running) {
+            Some(true) => {
+                let _ = self
+                    .environment
+                    .docker
+                    .kill_container(&id, deadline())
+                    .await;
+                self.environment
+                    .docker
+                    .wait_container(&id, deadline())
+                    .await?;
+            }
+            Some(false) => {}
+            None => bail!("missing code container state"),
+        }
+        let _ = self
+            .environment
+            .docker
+            .remove_container(&id, deadline())
+            .await;
+        ensure!(
+            matches!(
+                self.environment
+                    .docker
+                    .inspect_container(&id, deadline())
+                    .await,
+                Err(DockerError::Status(StatusCode::NOT_FOUND))
+            ),
+            "code container retirement unproven"
+        );
+        Ok(())
+    }
+
+    async fn cleanup(&mut self) -> Result<()> {
+        self.retire(false).await?;
+        if let Some(manager) = &mut self.manager {
+            self.ready.take();
+            if let Some(retirement) = &mut self.retirement {
+                retirement.wait(deadline()).await?;
+            }
+            manager.shutdown(deadline()).await?;
+        }
+        self.retire(true).await?;
+        if self.volume_phase != VolumePhase::Unissued {
+            match self
+                .environment
+                .docker
+                .inspect_volume(&self.volume, deadline())
+                .await
+            {
+                Err(DockerError::Status(StatusCode::NOT_FOUND))
+                    if self.volume_phase == VolumePhase::Known => {}
+                result => {
+                    let volume = result?;
+                    ensure!(
+                        volume.name == self.volume.as_str()
+                            && volume.driver == "local"
+                            && volume.options.is_empty()
+                            && volume.labels == self.labels.clone().into_iter().collect(),
+                        "foreign code volume"
+                    );
+                    self.volume_phase = VolumePhase::Known;
+                    self.record().await?;
+                    let _ = self
+                        .environment
+                        .docker
+                        .remove_volume(&self.volume, deadline())
+                        .await;
+                    ensure!(
+                        matches!(
+                            self.environment
+                                .docker
+                                .inspect_volume(&self.volume, deadline())
+                                .await,
+                            Err(DockerError::Status(StatusCode::NOT_FOUND))
+                        ),
+                        "code volume retirement unproven"
+                    );
+                }
+            }
+        }
+        ensure!(
+            self.environment
+                .docker
+                .list_volumes(
+                    OwnerFilter::new(self.environment.names.owner, None, None)?,
+                    deadline()
+                )
+                .await?
+                .is_empty(),
+            "owned code volumes remain"
+        );
+        self.environment.cleanup().await
+    }
+}
+
+#[tokio::test]
+#[ignore = "requires actual retained code owner; run make test-lambda-docker"]
+async fn test_should_prepare_code_with_retained_owner_and_consume_it_read_only() -> Result<()> {
+    let mut fixture = Fixture::new_with_manager(true).await?;
+    let result = timeout_at(
+        deadline() + Duration::from_secs(180),
+        fixture.exercise_managed(),
+    )
+    .await
+    .context("managed code fixture observer expired")
+    .and_then(|result| result);
+    let cleanup = fixture.cleanup().await;
+    result?;
+    cleanup?;
+    fixture
+        .environment
+        .directory
+        .as_mut()
+        .context("code evidence root")?
+        .disable_cleanup(false);
+    Ok(())
+}
+
+fn package(bootstrap: &[u8]) -> Result<Vec<u8>> {
+    let mut writer = ZipWriter::new(Cursor::new(Vec::new()));
+    writer.start_file(
+        "bootstrap",
+        SimpleFileOptions::default().unix_permissions(0o755),
+    )?;
+    writer.write_all(bootstrap)?;
+    writer.start_file(
+        "data/input",
+        SimpleFileOptions::default().unix_permissions(0o644),
+    )?;
+    writer.write_all(b"21")?;
+    writer.start_file(
+        "large-data",
+        SimpleFileOptions::default().unix_permissions(0o644),
+    )?;
+    writer.write_all(&vec![b'x'; 2 * 1024 * 1024])?;
+    Ok(writer.finish()?.into_inner())
+}
+
+#[tokio::test]
+#[ignore = "requires actual code-volume transport; run make test-lambda-docker-wire"]
+async fn test_should_upload_zip_code_to_a_private_volume_and_consume_it_read_only() -> Result<()> {
+    let mut fixture = Fixture::new().await?;
+    let result = timeout_at(deadline() + Duration::from_secs(180), fixture.exercise())
+        .await
+        .context("code fixture observer expired")
+        .and_then(|result| result);
+    let cleanup = fixture.cleanup().await;
+    result?;
+    cleanup?;
+    fixture
+        .environment
+        .directory
+        .as_mut()
+        .context("code evidence root")?
+        .disable_cleanup(false);
+    Ok(())
+}
+
+async fn bounded_file(path: &str, maximum: u64) -> Result<Vec<u8>> {
+    timeout_at(deadline(), async {
+        let metadata = fs::symlink_metadata(path).await?;
+        ensure!(
+            metadata.is_file() && metadata.len() <= maximum,
+            "bounded regular source file"
+        );
+        let file = fs::File::open(path).await?;
+        let mut bytes = Vec::new();
+        file.take(maximum.checked_add(1).context("source cap overflow")?)
+            .read_to_end(&mut bytes)
+            .await?;
+        ensure!(u64::try_from(bytes.len())? <= maximum, "source byte cap");
+        Ok(bytes)
+    })
+    .await?
+}
+
+fn verify_native(output: &Value, hash: &str) -> Result<()> {
+    ensure!(
+        output["schemaVersion"] == 1
+            && output["kind"] == "native-same-zip"
+            && output["joined"] == true
+            && output["zipSha256"] == hash,
+        "Native original ZIP identity/join proof"
+    );
+    let observed = output["observed"]
+        .as_array()
+        .context("Native computed observations")?;
+    ensure!(observed.len() == 2, "Native cold/warm inventory");
+    for (index, n) in [42, 46].into_iter().enumerate() {
+        let result = observed.get(index).context("Native observation")?;
+        ensure!(
+            result["computed"] == n
+                && result["codeMarker"] == "A"
+                && result["providedCounter"].as_u64() == Some(u64::try_from(index)? + 1),
+            "actual Native computation/reuse"
+        );
+    }
+    let cold = observed.first().context("Native cold observation")?;
+    let warm = observed.get(1).context("Native warm observation")?;
+    ensure!(
+        cold["pid"].as_u64().is_some_and(|pid| pid > 1) && warm["pid"] == cold["pid"],
+        "actual reused Native child identity"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires actual Linux Native verifier and exact provided ZIP; run make \
+            test-lambda-docker"]
+async fn test_should_execute_the_same_provided_zip_bytes_through_real_linux_native_and_join_children()
+-> Result<()> {
+    let mut fixture = Fixture::new_with_manager(true).await?;
+    fixture.native_zip_sha256 = Some(String::new());
+    let result = timeout_at(
+        deadline() + Duration::from_secs(180),
+        fixture.exercise_managed(),
+    )
+    .await
+    .context("Native same ZIP resource observer expired")
+    .and_then(|result| result);
+    let cleanup = fixture.cleanup().await;
+    result?;
+    cleanup?;
+    fixture
+        .environment
+        .directory
+        .as_mut()
+        .context("Native evidence root")?
+        .disable_cleanup(false);
+    Ok(())
+}
diff --git a/crates/rustack-lambda-http/src/dispatch.rs b/crates/rustack-lambda-http/src/dispatch.rs
index 5f53c776..1e1c1645 100644
--- a/crates/rustack-lambda-http/src/dispatch.rs
+++ b/crates/rustack-lambda-http/src/dispatch.rs
@@ -32,6 +32,8 @@ pub trait LambdaHandler: Send + Sync + 'static {
 }
 
 /// Dispatch a Lambda operation to the handler.
+/// # Errors
+/// Returns the handler error for invalid requests, unavailable resources or failed operations.
 pub async fn dispatch_operation<H: LambdaHandler>(
     handler: &H,
     op: LambdaOperation,
diff --git a/crates/rustack-lambda-http/src/lib.rs b/crates/rustack-lambda-http/src/lib.rs
index f8e5ee76..082cf6f4 100644
--- a/crates/rustack-lambda-http/src/lib.rs
+++ b/crates/rustack-lambda-http/src/lib.rs
@@ -7,7 +7,7 @@
 //! - **Service**: Hyper `Service` implementation for the Lambda protocol
 //! - **Response helpers**: JSON success/error response formatting
 //!
-//! Unlike `awsJson1.1` services (SSM, DynamoDB), Lambda uses REST-style
+//! Unlike `awsJson1.1` services (SSM, `DynamoDB`), Lambda uses REST-style
 //! routing where each operation has a unique method + path combination.
 //! Path parameters (e.g., `{FunctionName}`) are extracted and passed to
 //! the handler.
diff --git a/crates/rustack-lambda-http/src/router.rs b/crates/rustack-lambda-http/src/router.rs
index 5c343f46..4afffc46 100644
--- a/crates/rustack-lambda-http/src/router.rs
+++ b/crates/rustack-lambda-http/src/router.rs
@@ -115,7 +115,7 @@ fn normalize_date_prefix(path: &str) -> Option<String> {
     let (date_part, rest) = trimmed.split_once('/')?;
 
     // Validate it looks like a date: YYYY-MM-DD (10 chars).
-    if date_part.len() != 10 || date_part.as_bytes()[4] != b'-' || date_part.as_bytes()[7] != b'-' {
+    if !matches!(date_part.as_bytes(), [_, _, _, _, b'-', _, _, b'-', _, _]) {
         return None;
     }
 
diff --git a/crates/rustack-lambda-model/src/error.rs b/crates/rustack-lambda-model/src/error.rs
index 00768287..52e2f4e0 100644
--- a/crates/rustack-lambda-model/src/error.rs
+++ b/crates/rustack-lambda-model/src/error.rs
@@ -14,6 +14,8 @@ pub enum LambdaErrorCode {
     ResourceNotFoundException,
     /// Resource already exists.
     ResourceConflictException,
+    /// An optimistic update precondition did not match.
+    PreconditionFailedException,
     /// Request payload too large.
     RequestTooLargeException,
     /// Unsupported media type.
@@ -39,6 +41,7 @@ impl LambdaErrorCode {
             Self::InvalidRequestContentException => "InvalidRequestContentException",
             Self::ResourceNotFoundException => "ResourceNotFoundException",
             Self::ResourceConflictException => "ResourceConflictException",
+            Self::PreconditionFailedException => "PreconditionFailedException",
             Self::RequestTooLargeException => "RequestTooLargeException",
             Self::UnsupportedMediaTypeException => "UnsupportedMediaTypeException",
             Self::InvalidRuntimeException => "InvalidRuntimeException",
@@ -57,6 +60,7 @@ impl LambdaErrorCode {
             }
             Self::ResourceNotFoundException => http::StatusCode::NOT_FOUND,
             Self::ResourceConflictException => http::StatusCode::CONFLICT,
+            Self::PreconditionFailedException => http::StatusCode::PRECONDITION_FAILED,
             Self::RequestTooLargeException => http::StatusCode::PAYLOAD_TOO_LARGE,
             Self::UnsupportedMediaTypeException => http::StatusCode::UNSUPPORTED_MEDIA_TYPE,
             Self::InvalidRuntimeException | Self::ResourceNotReadyException => {
diff --git a/crates/rustack-lambda-model/src/input.rs b/crates/rustack-lambda-model/src/input.rs
index 248928f2..544c4bde 100644
--- a/crates/rustack-lambda-model/src/input.rs
+++ b/crates/rustack-lambda-model/src/input.rs
@@ -12,7 +12,7 @@ use crate::types::{
 
 /// Input for `CreateFunction`.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct CreateFunctionInput {
     /// Function name (1-140 characters).
     pub function_name: String,
@@ -71,7 +71,7 @@ pub struct CreateFunctionInput {
     /// Logging configuration.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub logging_config: Option<LoggingConfig>,
-    /// SnapStart configuration.
+    /// `SnapStart` configuration.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub snap_start: Option<SnapStart>,
     /// Code signing config ARN (stored, not enforced).
@@ -81,8 +81,14 @@ pub struct CreateFunctionInput {
 
 /// Input for `UpdateFunctionCode`.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct UpdateFunctionCodeInput {
+    /// Validate parameters without modifying code or publishing a version.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub dry_run: Option<bool>,
+    /// Revision ID precondition for an optimistic update.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revision_id: Option<String>,
     /// Base64-encoded zip file.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub zip_file: Option<String>,
@@ -111,8 +117,11 @@ pub struct UpdateFunctionCodeInput {
 
 /// Input for `UpdateFunctionConfiguration`.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct UpdateFunctionConfigurationInput {
+    /// Revision ID precondition for an optimistic update.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revision_id: Option<String>,
     /// Runtime.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub runtime: Option<String>,
@@ -155,7 +164,7 @@ pub struct UpdateFunctionConfigurationInput {
     /// Logging configuration.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub logging_config: Option<LoggingConfig>,
-    /// SnapStart configuration.
+    /// `SnapStart` configuration.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub snap_start: Option<SnapStart>,
 }
@@ -304,7 +313,7 @@ pub struct PublishLayerVersionInput {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "PascalCase")]
 pub struct CreateEventSourceMappingInput {
-    /// ARN of the event source (e.g., SQS queue, DynamoDB stream, Kinesis stream).
+    /// ARN of the event source (e.g., SQS queue, `DynamoDB` stream, Kinesis stream).
     pub event_source_arn: String,
     /// Function name or ARN.
     pub function_name: String,
@@ -424,3 +433,22 @@ pub struct EventInvokeConfigInput {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub destination_config: Option<DestinationConfig>,
 }
+
+#[cfg(test)]
+mod revision_tests {
+    use super::{UpdateFunctionCodeInput, UpdateFunctionConfigurationInput};
+
+    #[test]
+    fn test_should_preserve_explicit_revision_preconditions_in_both_update_wire_shapes() {
+        let json = r#"{"RevisionId":"expected-revision"}"#;
+        let code: UpdateFunctionCodeInput = serde_json::from_str(json).unwrap();
+        let configuration: UpdateFunctionConfigurationInput = serde_json::from_str(json).unwrap();
+        assert_eq!(code.revision_id.as_deref(), Some("expected-revision"));
+        assert_eq!(
+            configuration.revision_id.as_deref(),
+            Some("expected-revision")
+        );
+        assert_eq!(serde_json::to_string(&code).unwrap(), json);
+        assert_eq!(serde_json::to_string(&configuration).unwrap(), json);
+    }
+}
diff --git a/crates/rustack-lambda-model/src/types.rs b/crates/rustack-lambda-model/src/types.rs
index 4af421cc..8dd54d6a 100644
--- a/crates/rustack-lambda-model/src/types.rs
+++ b/crates/rustack-lambda-model/src/types.rs
@@ -97,7 +97,7 @@ pub enum PackageType {
 /// Function architecture.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Architecture {
-    /// x86_64 architecture.
+    /// `x86_64` architecture.
     #[serde(rename = "x86_64")]
     #[default]
     X86_64,
@@ -227,7 +227,7 @@ pub enum InvokeMode {
 
 /// Function code input for `CreateFunction` and `UpdateFunctionCode`.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct FunctionCode {
     /// Base64-encoded zip file contents.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -269,7 +269,7 @@ pub struct FunctionCodeLocation {
 
 /// Environment variable configuration.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct Environment {
     /// Environment variable key-value pairs.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -302,7 +302,7 @@ pub struct EnvironmentError {
 
 /// VPC configuration (stored, not enforced).
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct VpcConfig {
     /// Subnet IDs.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -329,7 +329,7 @@ pub struct VpcConfigResponse {
 
 /// Tracing configuration (stored, not enforced).
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct TracingConfig {
     /// Tracing mode.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -347,7 +347,7 @@ pub struct TracingConfigResponse {
 
 /// Dead letter queue configuration.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct DeadLetterConfig {
     /// Target ARN (SQS queue or SNS topic).
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -356,7 +356,7 @@ pub struct DeadLetterConfig {
 
 /// Ephemeral storage configuration.
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct EphemeralStorage {
     /// Size in MB (512-10240).
     pub size: u32,
@@ -370,7 +370,7 @@ impl Default for EphemeralStorage {
 
 /// Image configuration override.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct ImageConfig {
     /// Entry point override.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -409,7 +409,7 @@ pub struct ImageConfigError {
 
 /// Logging configuration.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct LoggingConfig {
     /// Log format.
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -425,16 +425,16 @@ pub struct LoggingConfig {
     pub log_group: Option<String>,
 }
 
-/// SnapStart configuration (stored, not enforced).
+/// `SnapStart` configuration (stored, not enforced).
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(rename_all = "PascalCase")]
+#[serde(rename_all = "PascalCase", deny_unknown_fields)]
 pub struct SnapStart {
     /// Apply on.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub apply_on: Option<String>,
 }
 
-/// SnapStart response.
+/// `SnapStart` response.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "PascalCase")]
 pub struct SnapStartResponse {
@@ -627,7 +627,7 @@ pub struct FunctionConfiguration {
     /// Logging configuration.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub logging_config: Option<LoggingConfig>,
-    /// SnapStart response.
+    /// `SnapStart` response.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub snap_start: Option<SnapStartResponse>,
     /// Image configuration response.
diff --git a/crates/rustack-lambda-runtime/Cargo.toml b/crates/rustack-lambda-runtime/Cargo.toml
new file mode 100644
index 00000000..0aa37ffa
--- /dev/null
+++ b/crates/rustack-lambda-runtime/Cargo.toml
@@ -0,0 +1,40 @@
+[package]
+name = "rustack-lambda-runtime"
+description = "Shared Lambda runtime session and bounded relay protocol for Rustack"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+getrandom = { workspace = true }
+url = { workspace = true }
+rustls = { workspace = true }
+tokio-rustls = { workspace = true }
+webpki-roots = { workspace = true }
+bytes = { workspace = true, features = ["serde"] }
+ciborium = { workspace = true }
+http = { workspace = true }
+http-body-util = { workspace = true }
+hyper = { workspace = true }
+hyper-util = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+typed-builder = { workspace = true }
+tokio = { workspace = true }
+tracing = { workspace = true }
+tracing-core = { workspace = true }
+tracing-subscriber = { workspace = true }
+uuid = { workspace = true }
+
+[dev-dependencies]
+rcgen = { workspace = true }
+anyhow = { workspace = true }
+proptest = { workspace = true }
+rstest = { workspace = true }
+tokio = { workspace = true, features = ["test-util"] }
diff --git a/crates/rustack-lambda-runtime/src/client.rs b/crates/rustack-lambda-runtime/src/client.rs
new file mode 100644
index 00000000..ac84fe81
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/client.rs
@@ -0,0 +1,491 @@
+//! Ordered host-side relay protocol; external resources remain host-owned.
+//!
+//! Partial framing lives in retained stream workers. Selecting and cancelling
+//! `next()` never cancels those workers or replays a business invocation.
+
+use std::time::Duration;
+
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    time::{Instant, timeout_at},
+};
+
+use crate::{
+    metadata::deadline_unix_ms,
+    protocol::{
+        Acknowledgement, Architecture, AttemptId, EnvironmentId, Frame, HandlerTimeout, Message,
+        Outcome, Payload,
+    },
+    relay::RelayError,
+    session::{Invocation, RuntimeResult},
+    transport::{InputEnd, Settings, Transport, after, preserve_worker_failure},
+};
+
+/// Validated host identity, expected architecture and control IO budget.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct ClientConfig {
+    environment: EnvironmentId,
+    architecture: Architecture,
+    io_budget: Duration,
+}
+
+impl ClientConfig {
+    /// Validate a nonzero control budget of at most sixty seconds.
+    ///
+    /// # Errors
+    /// Returns Configuration when the budget is outside its allowed range.
+    ///
+    /// ```
+    /// # use rustack_lambda_runtime::{client::ClientConfig, protocol::{Architecture, EnvironmentId}};
+    /// let config = ClientConfig::new(EnvironmentId::default(), Architecture::Arm64,
+    ///     std::time::Duration::from_secs(5))?;
+    /// # Ok::<(), rustack_lambda_runtime::relay::RelayError>(())
+    /// ```
+    pub fn new(
+        environment: EnvironmentId,
+        architecture: Architecture,
+        io_budget: Duration,
+    ) -> Result<Self, RelayError> {
+        if io_budget.is_zero() || io_budget > Duration::from_secs(60) {
+            return Err(RelayError::Configuration);
+        }
+        Ok(Self {
+            environment,
+            architecture,
+            io_budget,
+        })
+    }
+}
+
+/// One validated relay event, with payload diagnostics redacted.
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum ClientEvent {
+    /// Hello/architecture and Ready were received in order.
+    RelayReady,
+    /// The function issued its first valid Runtime API poll.
+    BootstrapReady,
+    /// One matching attempt completed; `FunctionError` retires this session.
+    InvocationResult {
+        /// Correlated invocation identity.
+        attempt: AttemptId,
+        /// Raw success or function error, without an implicit retry.
+        result: RuntimeResult,
+    },
+    /// A matching delivered handler clock expired; this session is retiring.
+    InvocationTimedOut(AttemptId),
+    /// Initialization failed; this environment cannot be reused.
+    InitError(Payload),
+    /// The relay invalidated the attempt; external code may still be running.
+    Cancelled(AttemptId),
+    /// Close was acknowledged after the peer joined its Runtime API.
+    Closed,
+}
+
+#[derive(Debug)]
+enum Phase {
+    AwaitHello,
+    AwaitReady,
+    Initializing,
+    Idle,
+    Busy(AttemptId),
+    Cancelling {
+        attempt: AttemptId,
+        outcome_seen: bool,
+    },
+    Retiring,
+    Closed,
+    Failed(RelayError),
+}
+
+#[derive(Debug)]
+struct State {
+    phase: Phase,
+    closing: bool,
+    writing: bool,
+    delivered: bool,
+    handler_timeout: Option<HandlerTimeout>,
+}
+
+/// One host control session with retained IO and fail-closed send semantics.
+///
+/// Drop signals its stream supervisor. Normal environment shutdown must call
+/// shutdown and separately terminate/remove every external resource.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct ControlClient {
+    config: ClientConfig,
+    transport: Transport,
+    state: State,
+    last_attempt: Option<AttemptId>,
+    settlement: Option<Result<(), RelayError>>,
+}
+
+impl ControlClient {
+    /// Own asynchronously cancellable streams and start their retained workers.
+    ///
+    /// # Errors
+    /// Returns Worker if no Tokio runtime is entered.
+    ///
+    /// ```no_run
+    /// # async fn example(config: rustack_lambda_runtime::client::ClientConfig) -> Result<(), rustack_lambda_runtime::relay::RelayError> {
+    /// let (reader, _) = tokio::io::duplex(1024);
+    /// let (writer, _) = tokio::io::duplex(1024);
+    /// let mut client = rustack_lambda_runtime::client::ControlClient::start(config, reader, writer)?;
+    /// let first = client.next(tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # Ok(()) }
+    /// ```
+    pub fn start<R, W>(config: ClientConfig, reader: R, writer: W) -> Result<Self, RelayError>
+    where
+        R: AsyncRead + Unpin + Send + 'static,
+        W: AsyncWrite + Unpin + Send + 'static,
+    {
+        Ok(Self {
+            config,
+            transport: Transport::start(
+                reader,
+                writer,
+                Settings {
+                    silence: Duration::from_hours(1),
+                    io_budget: config.io_budget,
+                    input_end: InputEnd::CloseAcknowledgement,
+                },
+            )?,
+            state: State {
+                phase: Phase::AwaitHello,
+                closing: false,
+                writing: false,
+                delivered: false,
+                handler_timeout: None,
+            },
+            last_attempt: None,
+            settlement: None,
+        })
+    }
+
+    /// Whether a healthy, bootstrapped session can accept a new attempt now.
+    ///
+    /// ```no_run
+    /// # fn inspect(client: &rustack_lambda_runtime::client::ControlClient) {
+    /// let may_invoke = client.is_idle();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn is_idle(&self) -> bool {
+        matches!(self.state.phase, Phase::Idle)
+            && !self.state.closing
+            && !self.state.writing
+            && !self.transport.finished()
+    }
+
+    /// Receive one validated event; cancelling this future preserves framing.
+    ///
+    /// # Errors
+    /// Returns a cached protocol/IO failure or invalidates the session at the
+    /// absolute deadline. It rejects calls after an interrupted send.
+    ///
+    /// ```no_run
+    /// # async fn receive(client: &mut rustack_lambda_runtime::client::ControlClient) {
+    /// let event = client.next(tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn next(&mut self, deadline: Instant) -> Result<ClientEvent, RelayError> {
+        self.check()?;
+        loop {
+            if Instant::now() >= deadline {
+                return Err(self.fail(RelayError::Deadline));
+            }
+            let received = timeout_at(deadline, self.transport.recv()).await;
+            if Instant::now() >= deadline {
+                return Err(self.fail(RelayError::Deadline));
+            }
+            let frame = match received {
+                Ok(Ok(frame)) => frame,
+                Ok(Err(error)) => return Err(self.fail(error)),
+                Err(_) => return Err(self.fail(RelayError::Deadline)),
+            };
+            if frame.environment() != self.config.environment {
+                return Err(self.fail(RelayError::Scope));
+            }
+            match self.accept(frame.into_message()) {
+                Ok(Some(event)) => return Ok(event),
+                Ok(None) => {}
+                Err(error) => return Err(self.fail(error)),
+            }
+        }
+    }
+
+    /// Flush one attempt after first-poll readiness; never reconnect or replay.
+    ///
+    /// # Errors
+    /// Returns invalid order/identity, expired metadata or transport failure.
+    /// Dropping this send future poisons later business operations.
+    ///
+    /// ```no_run
+    /// # async fn invoke(client: &mut rustack_lambda_runtime::client::ControlClient, invocation: rustack_lambda_runtime::session::Invocation) {
+    /// let sent = client.invoke(invocation, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn invoke(
+        &mut self,
+        invocation: Invocation,
+        deadline: Instant,
+    ) -> Result<(), RelayError> {
+        self.check()?;
+        let (attempt, call_deadline, function_arn, trace_id, payload) = invocation.parts();
+        if self.state.closing
+            || !matches!(self.state.phase, Phase::Idle)
+            || self.last_attempt == Some(attempt)
+        {
+            return Err(self.fail(RelayError::UnexpectedMessage));
+        }
+        let deadline_unix_ms = match deadline_unix_ms(call_deadline) {
+            Ok(deadline)
+                if call_deadline.saturating_duration_since(Instant::now())
+                    <= Duration::from_hours(1) =>
+            {
+                deadline
+            }
+            _ => return Err(self.fail(RelayError::Deadline)),
+        };
+        self.last_attempt = Some(attempt);
+        self.state.handler_timeout = invocation.handler_timeout();
+        self.state.phase = Phase::Busy(attempt);
+        self.send(
+            Message::Invoke {
+                attempt,
+                deadline_unix_ms,
+                handler_timeout_ms: invocation.handler_timeout(),
+                function_arn: function_arn.clone(),
+                trace_id: trace_id.clone(),
+                payload: payload.clone(),
+            },
+            deadline.min(call_deadline),
+        )
+        .await
+    }
+
+    /// Invalidate the active or just-completed last attempt; await its event next.
+    ///
+    /// # Errors
+    /// Rejects another identity, overlapping cancellation or a closing session.
+    /// IO failure invalidates the connection without asserting process exit.
+    ///
+    /// ```no_run
+    /// # async fn cancel(client: &mut rustack_lambda_runtime::client::ControlClient, id: rustack_lambda_runtime::protocol::AttemptId) {
+    /// let sent = client.cancel(id, tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn cancel(
+        &mut self,
+        attempt: AttemptId,
+        deadline: Instant,
+    ) -> Result<(), RelayError> {
+        self.check()?;
+        if self.state.closing || self.last_attempt != Some(attempt) {
+            return Err(self.fail(RelayError::UnexpectedMessage));
+        }
+        let outcome_seen = match self.state.phase {
+            Phase::Busy(active) if active == attempt => false,
+            Phase::Idle | Phase::Retiring => true,
+            _ => return Err(self.fail(RelayError::UnexpectedMessage)),
+        };
+        self.state.phase = Phase::Cancelling {
+            attempt,
+            outcome_seen,
+        };
+        self.send(Message::Cancel { attempt }, deadline).await
+    }
+
+    /// Flush Close while retaining validation of preceding peer events.
+    ///
+    /// # Errors
+    /// Requires ordered Hello/Ready and a healthy, uninterrupted transport.
+    ///
+    /// ```no_run
+    /// # async fn close(client: &mut rustack_lambda_runtime::client::ControlClient) {
+    /// let sent = client.begin_close(tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await;
+    /// # }
+    /// ```
+    pub async fn begin_close(&mut self, deadline: Instant) -> Result<(), RelayError> {
+        self.check()?;
+        if matches!(self.state.phase, Phase::AwaitHello | Phase::AwaitReady) {
+            return Err(self.fail(RelayError::UnexpectedMessage));
+        }
+        if !self.state.closing {
+            self.state.closing = true;
+            self.send(Message::Close, deadline).await?;
+        }
+        Ok(())
+    }
+
+    /// Complete Close/Ack and join IO, retaining ownership across dropped waiters.
+    ///
+    /// # Errors
+    /// Caches protocol, deadline, uncertain-write and worker failures. A failed
+    /// handshake still stops/joins stream workers; external cleanup is separate.
+    ///
+    /// ```no_run
+    /// # async fn shutdown(client: &mut rustack_lambda_runtime::client::ControlClient) {
+    /// let clean = client.shutdown(tokio::time::Instant::now() + std::time::Duration::from_secs(5)).await.is_ok();
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), RelayError> {
+        if let Some(result) = &self.settlement {
+            return result.clone();
+        }
+        let outcome = async {
+            if matches!(self.state.phase, Phase::Closed) {
+                return Ok(());
+            }
+            self.check()?;
+            while matches!(self.state.phase, Phase::AwaitHello | Phase::AwaitReady) {
+                self.next(deadline).await?;
+            }
+            self.begin_close(deadline).await?;
+            while !matches!(self.state.phase, Phase::Closed) {
+                self.next(deadline).await?;
+            }
+            Ok(())
+        }
+        .await;
+        let io = self.transport.shutdown().await;
+        let outcome = preserve_worker_failure(outcome, io);
+        self.settlement = Some(outcome.clone());
+        outcome
+    }
+
+    fn check(&mut self) -> Result<(), RelayError> {
+        if let Phase::Failed(error) = &self.state.phase {
+            return Err(error.clone());
+        }
+        if self.state.writing {
+            return Err(self.fail(RelayError::Output));
+        }
+        if matches!(self.state.phase, Phase::Closed) {
+            return Err(RelayError::UnexpectedMessage);
+        }
+        Ok(())
+    }
+
+    fn fail(&mut self, error: RelayError) -> RelayError {
+        self.state.phase = Phase::Failed(error.clone());
+        self.transport.stop();
+        error
+    }
+
+    async fn send(&mut self, message: Message, deadline: Instant) -> Result<(), RelayError> {
+        let deadline = deadline.min(after(self.config.io_budget)?);
+        if Instant::now() >= deadline {
+            return Err(self.fail(RelayError::Deadline));
+        }
+        self.state.writing = true;
+        let result = self
+            .transport
+            .send(Frame::new(self.config.environment, message), deadline)
+            .await;
+        match result {
+            Ok(()) => {
+                self.state.writing = false;
+                Ok(())
+            }
+            Err(error) => Err(self.fail(error)),
+        }
+    }
+
+    fn accept(&mut self, message: Message) -> Result<Option<ClientEvent>, RelayError> {
+        match message {
+            Message::Hello { architecture }
+                if matches!(self.state.phase, Phase::AwaitHello)
+                    && architecture == self.config.architecture =>
+            {
+                self.state.phase = Phase::AwaitReady;
+                Ok(None)
+            }
+            Message::Ready if matches!(self.state.phase, Phase::AwaitReady) => {
+                self.state.phase = Phase::Initializing;
+                Ok(Some(ClientEvent::RelayReady))
+            }
+            Message::BootstrapReady if matches!(self.state.phase, Phase::Initializing) => {
+                self.state.phase = Phase::Idle;
+                Ok(Some(ClientEvent::BootstrapReady))
+            }
+            Message::InvocationResult {
+                attempt,
+                outcome,
+                payload,
+            } => match &mut self.state.phase {
+                Phase::Busy(active) if *active == attempt => {
+                    self.state.delivered = true;
+                    let result = match outcome {
+                        Outcome::Success => {
+                            self.state.phase = Phase::Idle;
+                            RuntimeResult::Success(payload)
+                        }
+                        Outcome::FunctionError => {
+                            self.state.phase = Phase::Retiring;
+                            RuntimeResult::FunctionError(payload)
+                        }
+                    };
+                    Ok(Some(ClientEvent::InvocationResult { attempt, result }))
+                }
+                Phase::Cancelling {
+                    attempt: active,
+                    outcome_seen,
+                } if *active == attempt && !*outcome_seen => {
+                    self.state.delivered = true;
+                    *outcome_seen = true;
+                    Ok(None)
+                }
+                _ => Err(RelayError::UnexpectedMessage),
+            },
+            Message::InvocationTimedOut { attempt } if self.state.handler_timeout.is_some() => {
+                match &mut self.state.phase {
+                    Phase::Busy(active) if *active == attempt => {
+                        self.state.delivered = true;
+                        self.state.phase = Phase::Retiring;
+                        Ok(Some(ClientEvent::InvocationTimedOut(attempt)))
+                    }
+                    Phase::Cancelling {
+                        attempt: active,
+                        outcome_seen,
+                    } if *active == attempt && !*outcome_seen => {
+                        self.state.delivered = true;
+                        *outcome_seen = true;
+                        Ok(None)
+                    }
+                    _ => Err(RelayError::UnexpectedMessage),
+                }
+            }
+            Message::InitError { payload } if !self.state.delivered => {
+                match &mut self.state.phase {
+                    Phase::Initializing | Phase::Idle | Phase::Busy(_) => {
+                        self.state.phase = Phase::Retiring;
+                        Ok(Some(ClientEvent::InitError(payload)))
+                    }
+                    Phase::Cancelling { outcome_seen, .. } if !*outcome_seen => {
+                        *outcome_seen = true;
+                        Ok(None)
+                    }
+                    _ => Err(RelayError::UnexpectedMessage),
+                }
+            }
+            Message::Ack(Acknowledgement::Cancel(attempt)) if matches!(self.state.phase, Phase::Cancelling { attempt: active, .. } if active == attempt) =>
+            {
+                self.state.phase = Phase::Retiring;
+                Ok(Some(ClientEvent::Cancelled(attempt)))
+            }
+            Message::Ack(Acknowledgement::Close)
+                if self.state.closing && !matches!(self.state.phase, Phase::Cancelling { .. }) =>
+            {
+                self.state.phase = Phase::Closed;
+                Ok(Some(ClientEvent::Closed))
+            }
+            _ => Err(RelayError::UnexpectedMessage),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-runtime/src/client/tests.rs b/crates/rustack-lambda-runtime/src/client/tests.rs
new file mode 100644
index 00000000..8656a1e8
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/client/tests.rs
@@ -0,0 +1,712 @@
+use std::{
+    future::Future,
+    task::{Context, Waker},
+};
+
+use bytes::Bytes;
+use tokio::{
+    io::{AsyncWriteExt, DuplexStream, duplex},
+    net::TcpStream,
+    task::JoinHandle,
+};
+
+use super::*;
+use crate::{
+    http::tests::{Reply, request},
+    metadata::local_trace_id,
+    protocol::{encode, read_frame, write_frame},
+    relay::{RelayConfig, RelayHandle, start},
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(3)
+}
+
+fn invocation() -> Invocation {
+    Invocation::new(
+        AttemptId::default(),
+        Instant::now() + Duration::from_secs(30),
+        "arn:aws:lambda:us-east-1:000000000000:function:test:prod"
+            .parse()
+            .unwrap(),
+        local_trace_id().unwrap(),
+        Payload::try_from(Bytes::from_static(b"event-secret")).unwrap(),
+    )
+    .unwrap()
+}
+
+struct Peer {
+    client: ControlClient,
+    environment: EnvironmentId,
+    input: DuplexStream,
+    output: DuplexStream,
+}
+
+impl Peer {
+    fn new(output_size: usize) -> Self {
+        Self::with_limits(16, output_size, Duration::from_secs(1))
+    }
+
+    fn with_limits(input_size: usize, output_size: usize, budget: Duration) -> Self {
+        let environment = EnvironmentId::default();
+        let config = ClientConfig::new(environment, Architecture::Arm64, budget).unwrap();
+        let (reader, output) = duplex(input_size);
+        let (input, writer) = duplex(output_size);
+        let client = ControlClient::start(config, reader, writer).unwrap();
+        Self {
+            client,
+            environment,
+            input,
+            output,
+        }
+    }
+
+    async fn send(&mut self, message: Message) {
+        write_frame(
+            &mut self.output,
+            &Frame::new(self.environment, message),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    }
+
+    async fn read(&mut self) -> Message {
+        let frame = read_frame(&mut self.input, deadline())
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(frame.environment(), self.environment);
+        frame.into_message()
+    }
+
+    async fn ready(&mut self, bootstrap: bool) {
+        self.send(Message::Hello {
+            architecture: Architecture::Arm64,
+        })
+        .await;
+        self.send(Message::Ready).await;
+        assert_eq!(
+            self.client.next(deadline()).await.unwrap(),
+            ClientEvent::RelayReady
+        );
+        if bootstrap {
+            self.send(Message::BootstrapReady).await;
+            assert_eq!(
+                self.client.next(deadline()).await.unwrap(),
+                ClientEvent::BootstrapReady
+            );
+        }
+    }
+
+    async fn close(mut self) {
+        self.client.begin_close(deadline()).await.unwrap();
+        assert_eq!(self.read().await, Message::Close);
+        self.send(Message::Ack(Acknowledgement::Close)).await;
+        self.client.shutdown(deadline()).await.unwrap();
+        self.client.shutdown(deadline()).await.unwrap();
+        assert!(!self.client.is_idle());
+    }
+
+    async fn failed(mut self) {
+        assert!(self.client.shutdown(deadline()).await.is_err());
+        assert!(self.client.shutdown(deadline()).await.is_err());
+        assert!(!self.client.is_idle());
+    }
+}
+
+struct Harness {
+    client: ControlClient,
+    relay: RelayHandle,
+    api: std::net::SocketAddr,
+}
+
+impl Harness {
+    async fn new() -> Self {
+        let api = crate::http::start().await.unwrap();
+        let address = api.addr();
+        let environment = EnvironmentId::default();
+        let relay_config = RelayConfig::new(
+            environment,
+            Architecture::Arm64,
+            Duration::from_secs(600),
+            Duration::from_secs(1),
+            Duration::from_secs(2),
+        )
+        .unwrap();
+        let config =
+            ClientConfig::new(environment, Architecture::Arm64, Duration::from_secs(1)).unwrap();
+        let (writer, relay_reader) = duplex(24);
+        let (relay_writer, reader) = duplex(24);
+        let relay = start(api, relay_config, relay_reader, relay_writer).unwrap();
+        let mut client = ControlClient::start(config, reader, writer).unwrap();
+        assert_eq!(
+            client.next(deadline()).await.unwrap(),
+            ClientEvent::RelayReady
+        );
+        assert!(!client.is_idle());
+        Self {
+            client,
+            relay,
+            api: address,
+        }
+    }
+
+    async fn bootstrap(&mut self) -> JoinHandle<Reply> {
+        let address = self.api;
+        let poll = tokio::spawn(async move {
+            request(
+                address,
+                "GET",
+                "/2018-06-01/runtime/invocation/next",
+                "",
+                b"",
+            )
+            .await
+        });
+        assert_eq!(
+            self.client.next(deadline()).await.unwrap(),
+            ClientEvent::BootstrapReady
+        );
+        assert!(self.client.is_idle());
+        poll
+    }
+
+    async fn close(mut self) {
+        self.client.shutdown(deadline()).await.unwrap();
+        self.relay.wait().await.unwrap();
+        assert!(TcpStream::connect(self.api).await.is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_pair_client_with_real_relay_http_and_reuse_matching_attempts() {
+    let mut harness = Harness::new().await;
+    let mut poll = Some(harness.bootstrap().await);
+    for index in 0..3 {
+        let poll = poll.take().unwrap_or_else(|| {
+            let address = harness.api;
+            tokio::spawn(async move {
+                request(
+                    address,
+                    "GET",
+                    "/2018-06-01/runtime/invocation/next",
+                    "",
+                    b"",
+                )
+                .await
+            })
+        });
+        let call = invocation();
+        let attempt = call.parts().0;
+        harness.client.invoke(call, deadline()).await.unwrap();
+        let event = poll.await.unwrap();
+        assert_eq!(event.status, 200);
+        assert_eq!(event.body, b"event-secret");
+        let suffix = if index == 2 { "error" } else { "response" };
+        assert_eq!(
+            request(
+                harness.api,
+                "POST",
+                &format!("/2018-06-01/runtime/invocation/{attempt}/{suffix}"),
+                "",
+                b"computed-secret"
+            )
+            .await
+            .status,
+            202
+        );
+        let expected = Payload::try_from(Bytes::from_static(b"computed-secret")).unwrap();
+        let result = if index == 2 {
+            RuntimeResult::FunctionError(expected)
+        } else {
+            RuntimeResult::Success(expected)
+        };
+        assert_eq!(
+            harness.client.next(deadline()).await.unwrap(),
+            ClientEvent::InvocationResult { attempt, result }
+        );
+        assert_eq!(harness.client.is_idle(), index != 2);
+    }
+    harness.close().await;
+}
+
+#[tokio::test]
+async fn test_should_forward_init_failure_before_bootstrap_and_close_both_owners() {
+    let mut harness = Harness::new().await;
+    assert_eq!(
+        request(
+            harness.api,
+            "POST",
+            "/2018-06-01/runtime/init/error",
+            "",
+            b"init-secret"
+        )
+        .await
+        .status,
+        202
+    );
+    assert!(
+        matches!(harness.client.next(deadline()).await.unwrap(), ClientEvent::InitError(payload) if payload.as_ref() == b"init-secret")
+    );
+    assert!(!harness.client.is_idle());
+    harness.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_foreign_scope_architecture_and_out_of_order_handshakes() {
+    for mode in 0..6 {
+        let mut peer = Peer::new(8192);
+        match mode {
+            0 => write_frame(
+                &mut peer.output,
+                &Frame::new(EnvironmentId::default(), Message::Ready),
+                deadline(),
+            )
+            .await
+            .unwrap(),
+            1 => {
+                peer.send(Message::Hello {
+                    architecture: Architecture::X86_64,
+                })
+                .await;
+            }
+            2 => peer.send(Message::Ready).await,
+            3 => peer.send(Message::BootstrapReady).await,
+            4 => peer.send(Message::Close).await,
+            _ => {
+                peer.send(Message::Hello {
+                    architecture: Architecture::Arm64,
+                })
+                .await;
+                peer.send(Message::Hello {
+                    architecture: Architecture::Arm64,
+                })
+                .await;
+            }
+        }
+        assert!(peer.client.next(deadline()).await.is_err());
+        peer.failed().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_reject_foreign_and_duplicate_results_and_cancel_ack_ids() {
+    for mode in 0..3 {
+        let mut peer = Peer::new(8192);
+        peer.ready(true).await;
+        let call = invocation();
+        let attempt = call.parts().0;
+        peer.client.invoke(call, deadline()).await.unwrap();
+        assert!(matches!(peer.read().await, Message::Invoke { attempt: id, .. } if id == attempt));
+        let outcome = Message::InvocationResult {
+            attempt,
+            outcome: Outcome::Success,
+            payload: Payload::try_from(Bytes::from_static(b"result")).unwrap(),
+        };
+        match mode {
+            0 => {
+                peer.send(Message::InvocationResult {
+                    attempt: AttemptId::default(),
+                    outcome: Outcome::Success,
+                    payload: Payload::try_from(Bytes::new()).unwrap(),
+                })
+                .await;
+            }
+            1 => {
+                peer.send(outcome.clone()).await;
+                assert!(matches!(
+                    peer.client.next(deadline()).await.unwrap(),
+                    ClientEvent::InvocationResult { .. }
+                ));
+                peer.send(outcome).await;
+            }
+            _ => {
+                peer.client.cancel(attempt, deadline()).await.unwrap();
+                assert_eq!(peer.read().await, Message::Cancel { attempt });
+                peer.send(Message::Ack(Acknowledgement::Cancel(AttemptId::default())))
+                    .await;
+            }
+        }
+        assert!(matches!(
+            peer.client.next(deadline()).await,
+            Err(RelayError::UnexpectedMessage)
+        ));
+        peer.failed().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_discard_only_one_late_result_during_cancellation_and_require_matching_ack() {
+    for completed in [false, true] {
+        let mut peer = Peer::new(8192);
+        peer.ready(true).await;
+        let call = invocation();
+        let attempt = call.parts().0;
+        peer.client.invoke(call, deadline()).await.unwrap();
+        peer.read().await;
+        peer.send(Message::InvocationResult {
+            attempt,
+            outcome: Outcome::Success,
+            payload: Payload::try_from(Bytes::from_static(b"late")).unwrap(),
+        })
+        .await;
+        if completed {
+            assert!(matches!(
+                peer.client.next(deadline()).await.unwrap(),
+                ClientEvent::InvocationResult { .. }
+            ));
+        }
+        peer.client.cancel(attempt, deadline()).await.unwrap();
+        assert_eq!(peer.read().await, Message::Cancel { attempt });
+        peer.send(Message::Ack(Acknowledgement::Cancel(attempt)))
+            .await;
+        assert_eq!(
+            peer.client.next(deadline()).await.unwrap(),
+            ClientEvent::Cancelled(attempt)
+        );
+        assert!(!peer.client.is_idle());
+        peer.client.cancel(attempt, deadline()).await.unwrap();
+        assert_eq!(peer.read().await, Message::Cancel { attempt });
+        peer.send(Message::Ack(Acknowledgement::Cancel(attempt)))
+            .await;
+        assert_eq!(
+            peer.client.next(deadline()).await.unwrap(),
+            ClientEvent::Cancelled(attempt)
+        );
+        peer.close().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_validate_pending_events_before_close_and_reject_early_close_ack() {
+    for mode in 0..4 {
+        let mut peer = Peer::new(8192);
+        peer.ready(mode != 0).await;
+        let call = invocation();
+        let attempt = call.parts().0;
+        if mode != 0 {
+            peer.client.invoke(call, deadline()).await.unwrap();
+            peer.read().await;
+        }
+        if mode >= 2 {
+            peer.client.cancel(attempt, deadline()).await.unwrap();
+            peer.read().await;
+        }
+        peer.client.begin_close(deadline()).await.unwrap();
+        assert_eq!(peer.read().await, Message::Close);
+        let preceding = match mode {
+            0 => Message::BootstrapReady,
+            1 => Message::InvocationResult {
+                attempt,
+                outcome: Outcome::Success,
+                payload: Payload::try_from(Bytes::new()).unwrap(),
+            },
+            _ => Message::Ack(Acknowledgement::Cancel(attempt)),
+        };
+        if mode == 3 {
+            peer.send(Message::Ack(Acknowledgement::Close)).await;
+            assert!(peer.client.next(deadline()).await.is_err());
+            peer.failed().await;
+        } else {
+            peer.send(preceding).await;
+            peer.send(Message::Ack(Acknowledgement::Close)).await;
+            peer.client.shutdown(deadline()).await.unwrap();
+        }
+    }
+}
+
+#[tokio::test]
+async fn test_should_keep_partial_framing_when_a_next_waiter_is_cancelled() {
+    let mut peer = Peer::new(8192);
+    peer.ready(false).await;
+    let bytes = encode(&Frame::new(peer.environment, Message::BootstrapReady)).unwrap();
+    peer.output
+        .write_all(bytes.get(..2).unwrap())
+        .await
+        .unwrap();
+    let mut waiting = Box::pin(peer.client.next(deadline()));
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    peer.output
+        .write_all(bytes.get(2..).unwrap())
+        .await
+        .unwrap();
+    assert_eq!(
+        peer.client.next(deadline()).await.unwrap(),
+        ClientEvent::BootstrapReady
+    );
+    peer.close().await;
+}
+
+#[tokio::test]
+async fn test_should_fail_closed_after_a_cancelled_send_without_losing_io_ownership() {
+    let mut peer = Peer::new(1);
+    peer.ready(true).await;
+    let mut sending = Box::pin(peer.client.invoke(invocation(), deadline()));
+    assert!(
+        sending
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(sending);
+    assert!(matches!(
+        peer.client.next(deadline()).await,
+        Err(RelayError::Output)
+    ));
+    peer.failed().await;
+}
+
+#[tokio::test]
+async fn test_should_resume_close_after_its_waiter_is_dropped() {
+    let mut peer = Peer::new(8192);
+    peer.ready(false).await;
+    peer.client.begin_close(deadline()).await.unwrap();
+    assert_eq!(peer.read().await, Message::Close);
+    let mut waiting = Box::pin(peer.client.shutdown(deadline()));
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    peer.send(Message::Ack(Acknowledgement::Close)).await;
+    peer.client.shutdown(deadline()).await.unwrap();
+    peer.client.shutdown(deadline()).await.unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_bound_partial_frames_and_cache_receive_deadline_failures() {
+    for partial in [false, true] {
+        let mut peer = Peer::new(8192);
+        peer.ready(false).await;
+        if partial {
+            peer.output.write_all(&[0]).await.unwrap();
+        }
+        assert!(peer.client.next(deadline()).await.is_err());
+        peer.failed().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_reject_local_invocation_before_bootstrap_and_reused_attempt_identity() {
+    for bootstrap in [false, true] {
+        let mut peer = Peer::new(8192);
+        peer.ready(bootstrap).await;
+        let call = invocation();
+        if bootstrap {
+            let attempt = call.parts().0;
+            peer.client.invoke(call.clone(), deadline()).await.unwrap();
+            peer.read().await;
+            peer.send(Message::InvocationResult {
+                attempt,
+                outcome: Outcome::Success,
+                payload: Payload::try_from(Bytes::new()).unwrap(),
+            })
+            .await;
+            peer.client.next(deadline()).await.unwrap();
+        }
+        assert!(peer.client.invoke(call, deadline()).await.is_err());
+        peer.failed().await;
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_a_queued_frame_when_a_pending_waiter_resumes_after_its_deadline() {
+    let mut peer = Peer::with_limits(1, 8192, Duration::from_secs(60));
+    peer.ready(false).await;
+    let expires = Instant::now() + Duration::from_secs(1);
+    let mut waiting = Box::pin(peer.client.next(expires));
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    write_frame(
+        &mut peer.output,
+        &Frame::new(peer.environment, Message::BootstrapReady),
+        deadline(),
+    )
+    .await
+    .unwrap();
+    // Capacity one forces the reader to finish the preceding frame before this
+    // byte fits. Its next partial-frame budget is sixty seconds, beyond the
+    // caller's one-second deadline, so a valid queued frame wins an inner poll.
+    peer.output.write_all(&[0]).await.unwrap();
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert!(matches!(waiting.await, Err(RelayError::Deadline)));
+    peer.failed().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_initialization_errors_after_a_result_proves_delivery() {
+    for mode in 0..4 {
+        let mut peer = Peer::new(8192);
+        peer.ready(true).await;
+        let call = invocation();
+        let mut attempt = call.parts().0;
+        peer.client.invoke(call, deadline()).await.unwrap();
+        peer.read().await;
+        peer.send(Message::InvocationResult {
+            attempt,
+            outcome: Outcome::Success,
+            payload: Payload::try_from(Bytes::new()).unwrap(),
+        })
+        .await;
+        peer.client.next(deadline()).await.unwrap();
+        if mode == 1 || mode == 3 {
+            let next = invocation();
+            attempt = next.parts().0;
+            peer.client.invoke(next, deadline()).await.unwrap();
+            peer.read().await;
+        }
+        if mode >= 2 {
+            peer.client.cancel(attempt, deadline()).await.unwrap();
+            peer.read().await;
+        }
+        peer.send(Message::InitError {
+            payload: Payload::try_from(Bytes::from_static(b"late-init-secret")).unwrap(),
+        })
+        .await;
+        assert!(matches!(
+            peer.client.next(deadline()).await,
+            Err(RelayError::UnexpectedMessage)
+        ));
+        peer.failed().await;
+    }
+}
+
+#[test]
+fn test_should_validate_client_io_budget() {
+    for budget in [Duration::ZERO, Duration::from_secs(61)] {
+        assert!(ClientConfig::new(EnvironmentId::default(), Architecture::Arm64, budget).is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_preserve_transport_worker_failure_after_a_prior_scope_error() {
+    let environment = EnvironmentId::default();
+    let (reader, mut peer) = duplex(4096);
+    let mut client = ControlClient::start(
+        ClientConfig::new(environment, Architecture::Arm64, Duration::from_secs(1)).unwrap(),
+        reader,
+        tokio::io::sink(),
+    )
+    .unwrap();
+    peer.write_all(
+        &encode(&Frame::new(
+            EnvironmentId::default(),
+            Message::Hello {
+                architecture: Architecture::Arm64,
+            },
+        ))
+        .unwrap(),
+    )
+    .await
+    .unwrap();
+    assert!(matches!(
+        client.next(deadline()).await,
+        Err(RelayError::Scope)
+    ));
+    client.transport.abort_owner();
+    assert!(matches!(
+        client.shutdown(deadline()).await,
+        Err(RelayError::Worker)
+    ));
+    assert!(matches!(
+        client.shutdown(deadline()).await,
+        Err(RelayError::Worker)
+    ));
+}
+
+#[rstest::rstest]
+#[case::idle("idle")]
+#[case::initializing("initializing")]
+#[case::without_budget("without_budget")]
+#[case::foreign_attempt("foreign")]
+#[case::duplicate("duplicate")]
+#[case::init_after_timeout("init_after_timeout")]
+#[tokio::test]
+async fn test_should_reject_impossible_handler_timeout_events(#[case] condition: &str) {
+    let mut peer = Peer::new(4096);
+    peer.ready(condition != "initializing").await;
+    let call = invocation();
+    let attempt = call.parts().0;
+    if !matches!(condition, "idle" | "initializing") {
+        let call = if condition == "without_budget" {
+            call
+        } else {
+            call.with_handler_timeout(
+                crate::protocol::HandlerTimeout::try_from(Duration::from_secs(1)).unwrap(),
+            )
+        };
+        peer.client.invoke(call, deadline()).await.unwrap();
+        let sent = peer.read().await;
+        assert!(
+            matches!(
+                sent,
+                Message::Invoke {
+                    handler_timeout_ms: Some(_),
+                    ..
+                }
+            ) || condition == "without_budget"
+        );
+    }
+    let reported = if condition == "foreign" {
+        AttemptId::default()
+    } else {
+        attempt
+    };
+    peer.send(Message::InvocationTimedOut { attempt: reported })
+        .await;
+    if matches!(condition, "duplicate" | "init_after_timeout") {
+        assert_eq!(
+            peer.client.next(deadline()).await.unwrap(),
+            ClientEvent::InvocationTimedOut(attempt)
+        );
+        assert!(!peer.client.is_idle());
+        let message = if condition == "duplicate" {
+            Message::InvocationTimedOut { attempt }
+        } else {
+            Message::InitError {
+                payload: Payload::try_from(Bytes::new()).unwrap(),
+            }
+        };
+        peer.send(message).await;
+    }
+    assert!(matches!(
+        peer.client.next(deadline()).await,
+        Err(RelayError::UnexpectedMessage)
+    ));
+    assert!(peer.client.shutdown(deadline()).await.is_err());
+}
+#[tokio::test]
+async fn test_should_discard_only_one_matching_handler_timeout_during_cancel_before_ack() {
+    let mut peer = Peer::new(4096);
+    peer.ready(true).await;
+    let call = invocation().with_handler_timeout(
+        crate::protocol::HandlerTimeout::try_from(Duration::from_secs(1)).unwrap(),
+    );
+    let attempt = call.parts().0;
+    peer.client.invoke(call, deadline()).await.unwrap();
+    peer.read().await;
+    peer.client.cancel(attempt, deadline()).await.unwrap();
+    assert_eq!(peer.read().await, Message::Cancel { attempt });
+    peer.send(Message::InvocationTimedOut { attempt }).await;
+    peer.send(Message::Ack(Acknowledgement::Cancel(attempt)))
+        .await;
+    assert_eq!(
+        peer.client.next(deadline()).await.unwrap(),
+        ClientEvent::Cancelled(attempt)
+    );
+    assert!(!peer.client.is_idle());
+    peer.close().await;
+}
diff --git a/crates/rustack-lambda-runtime/src/diagnostics.rs b/crates/rustack-lambda-runtime/src/diagnostics.rs
new file mode 100644
index 00000000..ecdc868c
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/diagnostics.rs
@@ -0,0 +1,147 @@
+//! Mandatory per-task dependency filter, independent of application `RUST_LOG`.
+//!
+//! Hyper's chunk decoder can put partial trailer bytes in TRACE fields. Keep
+//! its verbose events/spans out before delegating to the application's subscriber.
+
+use tracing_core::{
+    Dispatch, Event, Interest, Level, Metadata, Subscriber, dispatcher,
+    span::{Attributes, Current, Id, Record},
+};
+
+#[derive(Debug)]
+struct RuntimeSubscriber {
+    parent: Dispatch,
+}
+
+fn allowed(metadata: &Metadata<'_>) -> bool {
+    let target = metadata.target();
+    let tls = ["rustls", "tokio_rustls"].iter().any(|name| {
+        target == *name
+            || target
+                .strip_prefix(name)
+                .is_some_and(|suffix| suffix.starts_with("::"))
+    });
+    if tls {
+        return false;
+    }
+    let dependency = ["hyper", "hyper_util", "bollard"].iter().any(|name| {
+        target == *name
+            || target
+                .strip_prefix(name)
+                .is_some_and(|suffix| suffix.starts_with("::"))
+    });
+    !dependency || *metadata.level() <= Level::INFO
+}
+
+impl Subscriber for RuntimeSubscriber {
+    fn register_callsite(&self, metadata: &'static Metadata<'static>) -> Interest {
+        if allowed(metadata) {
+            self.parent.register_callsite(metadata)
+        } else {
+            Interest::never()
+        }
+    }
+    fn enabled(&self, metadata: &Metadata<'_>) -> bool {
+        allowed(metadata) && self.parent.enabled(metadata)
+    }
+    fn new_span(&self, attributes: &Attributes<'_>) -> Id {
+        self.parent.new_span(attributes)
+    }
+    fn record(&self, id: &Id, values: &Record<'_>) {
+        self.parent.record(id, values);
+    }
+    fn record_follows_from(&self, id: &Id, follows: &Id) {
+        self.parent.record_follows_from(id, follows);
+    }
+    fn event(&self, event: &Event<'_>) {
+        // Recheck even when a different live dispatcher enabled this callsite.
+        if allowed(event.metadata()) {
+            self.parent.event(event);
+        }
+    }
+    fn enter(&self, id: &Id) {
+        self.parent.enter(id);
+    }
+    fn exit(&self, id: &Id) {
+        self.parent.exit(id);
+    }
+    fn clone_span(&self, id: &Id) -> Id {
+        self.parent.clone_span(id)
+    }
+    fn try_close(&self, id: Id) -> bool {
+        self.parent.try_close(id)
+    }
+    fn current_span(&self) -> Current {
+        self.parent.current_span()
+    }
+}
+
+/// Capture application context while denying verbose transport dependency logs.
+///
+/// The policy covers verbose Hyper/`hyper_util`/Bollard and all rustls/
+/// tokio-rustls events independently of `RUST_LOG`; TLS diagnostics may contain
+/// operator server names or peer certificate data even at warning levels.
+/// Apply the dispatch to construction and every poll/spawned transport worker.
+///
+/// ```
+/// let dispatch = rustack_lambda_runtime::diagnostics::runtime_dispatch();
+/// tracing::dispatcher::with_default(&dispatch, || tracing::debug!("application event"));
+/// ```
+#[must_use]
+pub fn runtime_dispatch() -> Dispatch {
+    dispatcher::get_default(|parent| {
+        Dispatch::new(RuntimeSubscriber {
+            parent: parent.clone(),
+        })
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        io::{self, Write},
+        sync::{Arc, Mutex},
+    };
+
+    use tracing::{Level, dispatcher};
+
+    use super::runtime_dispatch;
+
+    #[derive(Debug, Clone)]
+    struct Capture(Arc<Mutex<Vec<u8>>>);
+    impl Write for Capture {
+        fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+            let mut output = self.0.lock().unwrap();
+            if output.len().saturating_add(bytes.len()) > 16_384 {
+                return Err(io::Error::other("fixture capture exceeded budget"));
+            }
+            output.extend_from_slice(bytes);
+            Ok(bytes.len())
+        }
+        fn flush(&mut self) -> io::Result<()> {
+            Ok(())
+        }
+    }
+    #[test]
+    fn test_should_filter_all_tls_peer_events_while_preserving_application_diagnostics() {
+        let capture = Capture(Arc::default());
+        let writer = capture.clone();
+        let subscriber = tracing_subscriber::fmt()
+            .with_max_level(Level::TRACE)
+            .with_ansi(false)
+            .with_writer(move || writer.clone())
+            .finish();
+        tracing::subscriber::with_default(subscriber, || {
+            let dispatch = runtime_dispatch();
+            dispatcher::with_default(&dispatch, || {
+                tracing::trace!(target:"rustls","PRIVATE-TLS-TRACE");
+                tracing::warn!(target:"rustls::client","PRIVATE-PEER-CERT");
+                tracing::error!(target:"tokio_rustls","PRIVATE-SNI");
+                tracing::info!("owned_application_event");
+            });
+        });
+        let output = String::from_utf8(capture.0.lock().unwrap().clone()).unwrap();
+        assert!(output.contains("owned_application_event"));
+        assert!(!output.contains("PRIVATE"));
+    }
+}
diff --git a/crates/rustack-lambda-runtime/src/http.rs b/crates/rustack-lambda-runtime/src/http.rs
new file mode 100644
index 00000000..76948018
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/http.rs
@@ -0,0 +1,602 @@
+//! Loopback Runtime API adapter backed by the shared session actor.
+//!
+//! One supervisor owns the session, listener and bounded HTTP connection tasks.
+//! Infrastructure diagnostics never include peer targets, headers or payloads.
+
+use std::{
+    convert::Infallible,
+    io,
+    net::{IpAddr, Ipv4Addr, SocketAddr},
+    sync::Arc,
+    time::Duration,
+};
+
+use ::http::{
+    HeaderMap, HeaderValue, Method, Request, Response, StatusCode, Uri,
+    header::{CONNECTION, CONTENT_LENGTH, CONTENT_TYPE},
+};
+use bytes::Bytes;
+use http_body_util::{BodyExt, Full, Limited};
+use hyper::{body::Incoming, server::conn::http1, service::service_fn};
+use hyper_util::rt::{TokioIo, TokioTimer};
+use thiserror::Error;
+use tokio::{
+    net::{TcpListener, TcpStream},
+    sync::{Semaphore, oneshot, watch},
+    task::{JoinHandle, JoinSet},
+    time::{Instant, timeout, timeout_at},
+};
+use tracing::instrument::WithSubscriber;
+
+use crate::{
+    diagnostics::runtime_dispatch,
+    metadata::deadline_unix_ms,
+    protocol::{AttemptId, MAX_PAYLOAD_BYTES, Outcome, Payload},
+    session::{Invocation, RuntimeSession, SessionError, SessionHandle},
+};
+
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(5);
+const HEADER_BYTES: usize = 16 * 1024;
+const HEADER_COUNT: usize = 64;
+const HEADER_VALUE_BYTES: usize = 256;
+const XRAY_ERROR_CAUSE_BYTES: usize = 8 * 1024;
+const XRAY_ERROR_CAUSE: &str = "lambda-runtime-function-xray-error-cause";
+const TARGET_BYTES: usize = 256;
+const CONNECTIONS: usize = 8;
+const BODY_READERS: usize = 4;
+const INVOCATION_ID: &str = "lambda-runtime-invocation-id";
+
+/// Adapter/supervision failures without invalid peer data in their diagnostics.
+#[derive(Debug, Clone, Error)]
+#[non_exhaustive]
+pub enum ApiError {
+    /// Listener IO failure.
+    #[error("runtime API listener IO failed")]
+    Io(#[source] Arc<io::Error>),
+    /// Shared session failed.
+    #[error(transparent)]
+    Session(#[from] SessionError),
+    /// A supervised HTTP task failed or exceeded graceful shutdown.
+    #[error("runtime API connection failed")]
+    ConnectionFailed,
+    /// The server task failed to join.
+    #[error("runtime API supervisor failed")]
+    SupervisorFailed,
+    /// Runtime API listeners must remain environment-local.
+    #[error("runtime API requires a loopback address")]
+    NonLoopback,
+}
+
+impl From<io::Error> for ApiError {
+    fn from(error: io::Error) -> Self {
+        Self::Io(Arc::new(error))
+    }
+}
+
+#[derive(Debug)]
+struct ServerTask {
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<(), ApiError>>>,
+    settlement: Option<Result<(), ApiError>>,
+}
+
+impl ServerTask {
+    async fn shutdown(&mut self) -> Result<(), ApiError> {
+        self.stop.send_replace(true);
+        if let Some(result) = &self.settlement {
+            return result.clone();
+        }
+        let result = match self.task.as_mut() {
+            Some(task) => task
+                .await
+                .map_err(|_| ApiError::SupervisorFailed)
+                .and_then(|result| result),
+            None => Ok(()),
+        };
+        self.task.take();
+        self.settlement = Some(result.clone());
+        result
+    }
+}
+
+impl Drop for ServerTask {
+    fn drop(&mut self) {
+        // Fallback: the retained supervisor still owns its session/connections.
+        // Normal shutdown joins this handle before the parent Tokio runtime stops.
+        self.stop.send_replace(true);
+    }
+}
+
+/// Owned loopback listener and shared-session command port.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct RuntimeApiHandle {
+    addr: SocketAddr,
+    session: SessionHandle,
+    server: ServerTask,
+    initialization_error: Option<oneshot::Receiver<Payload>>,
+}
+
+impl RuntimeApiHandle {
+    /// Bound listener address for `AWS_LAMBDA_RUNTIME_API`.
+    ///
+    /// ```
+    /// # fn inspect(api: &rustack_lambda_runtime::http::RuntimeApiHandle) {
+    /// assert!(api.addr().ip().is_loopback());
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn addr(&self) -> SocketAddr {
+        self.addr
+    }
+
+    /// Shared session port used by the executor or control relay.
+    ///
+    /// ```
+    /// # fn inspect(api: &rustack_lambda_runtime::http::RuntimeApiHandle) {
+    /// let session = api.session().clone();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn session(&self) -> &SessionHandle {
+        &self.session
+    }
+
+    /// Transfer the initialization-error receiver at most once.
+    ///
+    /// ```
+    /// # fn inspect(api: &mut rustack_lambda_runtime::http::RuntimeApiHandle) {
+    /// let notification = api.take_initialization_error();
+    /// assert!(api.take_initialization_error().is_none());
+    /// # }
+    /// ```
+    pub fn take_initialization_error(&mut self) -> Option<oneshot::Receiver<Payload>> {
+        self.initialization_error.take()
+    }
+
+    /// Stop admission and join all connection/session tasks.
+    ///
+    /// # Errors
+    /// Returns cached IO/session/supervisor failures; dropping a waiter retains ownership.
+    ///
+    /// ```no_run
+    /// # async fn stop(api: &mut rustack_lambda_runtime::http::RuntimeApiHandle) {
+    /// let clean = api.shutdown().await.is_ok();
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self) -> Result<(), ApiError> {
+        self.server.shutdown().await
+    }
+}
+
+/// Start the default Native loopback adapter with a ten-minute idle lease.
+///
+/// # Errors
+/// Returns listener/session startup failures.
+///
+/// ```no_run
+/// # async fn example() -> Result<(), rustack_lambda_runtime::http::ApiError> {
+/// let mut api = rustack_lambda_runtime::http::start().await?;
+/// api.shutdown().await?;
+/// # Ok(()) }
+/// ```
+pub async fn start() -> Result<RuntimeApiHandle, ApiError> {
+    start_at(
+        SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0),
+        Duration::from_mins(10),
+    )
+    .await
+}
+
+/// Bind an explicit loopback endpoint, shared by Native and the relay.
+///
+/// # Errors
+/// Rejects non-loopback addresses or listener/session startup failures.
+///
+/// ```no_run
+/// # async fn example() -> Result<(), rustack_lambda_runtime::http::ApiError> {
+/// let mut api = rustack_lambda_runtime::http::start_at("127.0.0.1:9001".parse().map_err(|_| rustack_lambda_runtime::http::ApiError::NonLoopback)?, std::time::Duration::from_secs(60)).await?;
+/// api.shutdown().await?;
+/// # Ok(()) }
+/// ```
+#[tracing::instrument(skip_all)]
+pub async fn start_at(
+    addr: SocketAddr,
+    idle_lease: Duration,
+) -> Result<RuntimeApiHandle, ApiError> {
+    start_with_body_budget(addr, idle_lease, Arc::new(Semaphore::new(BODY_READERS))).await
+}
+
+async fn start_with_body_budget(
+    addr: SocketAddr,
+    idle_lease: Duration,
+    body_budget: Arc<Semaphore>,
+) -> Result<RuntimeApiHandle, ApiError> {
+    if !addr.ip().is_loopback() {
+        return Err(ApiError::NonLoopback);
+    }
+    let listener = timeout(REQUEST_TIMEOUT, TcpListener::bind(addr))
+        .await
+        .map_err(|_| ApiError::ConnectionFailed)??;
+    let addr = listener.local_addr()?;
+    let mut owner = RuntimeSession::start(idle_lease)?;
+    let session = owner.handle().clone();
+    let initialization_error = owner.take_initialization_error();
+    let (stop, _) = watch::channel(false);
+    let task = tokio::spawn(
+        serve(listener, owner, idle_lease, stop.clone(), body_budget)
+            .with_subscriber(runtime_dispatch()),
+    );
+    Ok(RuntimeApiHandle {
+        addr,
+        session,
+        server: ServerTask {
+            stop,
+            task: Some(task),
+            settlement: None,
+        },
+        initialization_error,
+    })
+}
+
+async fn serve(
+    listener: TcpListener,
+    mut owner: RuntimeSession,
+    idle_lease: Duration,
+    stop: watch::Sender<bool>,
+    body_budget: Arc<Semaphore>,
+) -> Result<(), ApiError> {
+    let session = owner.handle().clone();
+    let mut stopped = stop.subscribe();
+    let mut connections = JoinSet::new();
+    let mut failure = None;
+    loop {
+        tokio::select! {
+            biased;
+            () = async { let _ = stopped.wait_for(|stopped| *stopped).await; } => break,
+            () = session.closed() => break,
+            completed = connections.join_next(), if !connections.is_empty() => {
+                if !matches!(completed, Some(Ok(Ok(())))) { failure = Some(ApiError::ConnectionFailed); break; }
+            }
+            accepted = listener.accept() => {
+                match accepted {
+                    Ok((socket, _)) if connections.len() < CONNECTIONS => {
+                        let session = session.clone();
+                        let stop = stop.subscribe();
+                        let body_budget = Arc::clone(&body_budget);
+                        connections.spawn(connection(socket, session, idle_lease, stop, body_budget).with_current_subscriber());
+                    }
+                    Ok(_) => {}
+                    Err(error) => { failure = Some(ApiError::from(error)); break; }
+                }
+            }
+        }
+    }
+    drop(listener);
+    stop.send_replace(true);
+    session.close();
+    while let Some(result) = connections.join_next().await {
+        if !matches!(result, Ok(Ok(()))) {
+            failure.get_or_insert(ApiError::ConnectionFailed);
+        }
+    }
+    if let Err(error) = owner.shutdown().await {
+        failure.get_or_insert(ApiError::Session(error));
+    }
+    failure.map_or(Ok(()), Err)
+}
+
+#[tracing::instrument(skip_all)]
+async fn connection(
+    socket: TcpStream,
+    session: SessionHandle,
+    idle_lease: Duration,
+    mut stop: watch::Receiver<bool>,
+    body_budget: Arc<Semaphore>,
+) -> Result<(), ApiError> {
+    let service_session = session.clone();
+    let service = service_fn(move |request| {
+        handle(
+            service_session.clone(),
+            idle_lease,
+            request,
+            Arc::clone(&body_budget),
+        )
+    });
+    let mut builder = http1::Builder::new();
+    builder
+        .timer(TokioTimer::new())
+        .header_read_timeout(REQUEST_TIMEOUT)
+        .max_headers(HEADER_COUNT)
+        .max_buf_size(HEADER_BYTES);
+    let connection = builder.serve_connection(TokioIo::new(socket), service);
+    tokio::pin!(connection);
+    let result = tokio::select! {
+        biased;
+        () = async { let _ = stop.wait_for(|stopped| *stopped).await; } => {
+            connection.as_mut().graceful_shutdown();
+            timeout(REQUEST_TIMEOUT, &mut connection).await.map_err(|_| ApiError::ConnectionFailed)?
+        }
+        result = &mut connection => result,
+    };
+    // Rejected HTTP syntax and idle header timeouts close only that connection.
+    // The session bounds long polls/writes; genuine IO failures invalidate it.
+    match result {
+        Ok(()) => Ok(()),
+        Err(error) if error.is_timeout() || error.is_parse() => Ok(()),
+        Err(_) => {
+            session.close();
+            Err(ApiError::ConnectionFailed)
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Route {
+    Next,
+    Complete {
+        attempt: AttemptId,
+        outcome: Outcome,
+    },
+    InitError,
+}
+
+fn route(method: &Method, target: &Uri) -> Result<Route, StatusCode> {
+    if target
+        .path_and_query()
+        .is_some_and(|value| value.as_str().len() > TARGET_BYTES)
+        || target.scheme().is_some()
+        || target.authority().is_some()
+        || target.query().is_some()
+    {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    let path = target.path();
+    if path == "/2018-06-01/runtime/invocation/next" {
+        return if method == Method::GET {
+            Ok(Route::Next)
+        } else {
+            Err(StatusCode::METHOD_NOT_ALLOWED)
+        };
+    }
+    if path == "/2018-06-01/runtime/init/error" {
+        return if method == Method::POST {
+            Ok(Route::InitError)
+        } else {
+            Err(StatusCode::METHOD_NOT_ALLOWED)
+        };
+    }
+    let rest = path
+        .strip_prefix("/2018-06-01/runtime/invocation/")
+        .ok_or(StatusCode::NOT_FOUND)?;
+    let (attempt, suffix) = rest.split_once('/').ok_or(StatusCode::NOT_FOUND)?;
+    let outcome = match suffix {
+        "response" => Outcome::Success,
+        "error" => Outcome::FunctionError,
+        _ => return Err(StatusCode::NOT_FOUND),
+    };
+    if method != Method::POST {
+        return Err(StatusCode::METHOD_NOT_ALLOWED);
+    }
+    Ok(Route::Complete {
+        attempt: attempt.parse().map_err(|_| StatusCode::BAD_REQUEST)?,
+        outcome,
+    })
+}
+
+fn validate_headers(headers: &HeaderMap, route: Option<&Route>) -> Result<(), StatusCode> {
+    if headers.len() > HEADER_COUNT || headers.get_all(XRAY_ERROR_CAUSE).iter().count() > 1 {
+        return Err(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE);
+    }
+    let error_route = matches!(
+        route,
+        Some(Route::Complete {
+            outcome: Outcome::FunctionError,
+            ..
+        })
+    );
+    let mut total = 0usize;
+    for (name, value) in headers {
+        let xray_cause = error_route && name == XRAY_ERROR_CAUSE;
+        let limit = if xray_cause {
+            XRAY_ERROR_CAUSE_BYTES
+        } else {
+            HEADER_VALUE_BYTES
+        };
+        if value.as_bytes().len() > limit
+            || !value.as_bytes().iter().all(|byte| {
+                if xray_cause {
+                    *byte >= 32 && *byte != 127
+                } else {
+                    (32..=126).contains(byte)
+                }
+            })
+        {
+            return Err(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE);
+        }
+        total = total
+            .checked_add(name.as_str().len())
+            .and_then(|n| n.checked_add(value.as_bytes().len()))
+            .ok_or(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE)?;
+        if total > HEADER_BYTES {
+            return Err(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE);
+        }
+    }
+    Ok(())
+}
+
+async fn handle(
+    session: SessionHandle,
+    idle_lease: Duration,
+    request: Request<Incoming>,
+    body_budget: Arc<Semaphore>,
+) -> Result<Response<Full<Bytes>>, Infallible> {
+    Ok(dispatch(&session, idle_lease, request, &body_budget)
+        .await
+        .unwrap_or_else(error_response))
+}
+
+async fn dispatch(
+    session: &SessionHandle,
+    idle_lease: Duration,
+    request: Request<Incoming>,
+    body_budget: &Arc<Semaphore>,
+) -> Result<Response<Full<Bytes>>, StatusCode> {
+    let route = route(request.method(), request.uri());
+    validate_headers(request.headers(), route.as_ref().ok())?;
+    let route = route?;
+    let invocation_id = if matches!(route, Route::Complete { .. }) {
+        match parse_invocation_id(request.headers()) {
+            Ok(id) => id,
+            Err(_) => return Ok(invalid_invocation_id()),
+        }
+    } else {
+        None
+    };
+    if matches!(route, Route::Complete { attempt, .. } if invocation_id.is_some_and(|id| id != attempt))
+    {
+        return Ok(invalid_invocation_id());
+    }
+    let limit = if matches!(route, Route::Next) {
+        0
+    } else {
+        MAX_PAYLOAD_BYTES
+    };
+    if request
+        .headers()
+        .get(CONTENT_LENGTH)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.parse::<u64>().ok())
+        .is_some_and(|length| length > limit as u64)
+    {
+        return Err(StatusCode::PAYLOAD_TOO_LARGE);
+    }
+    let body_permit = if matches!(route, Route::Next) {
+        None
+    } else {
+        Some(
+            body_budget
+                .clone()
+                .try_acquire_owned()
+                .map_err(|_| StatusCode::TOO_MANY_REQUESTS)?,
+        )
+    };
+    let deadline = Instant::now()
+        .checked_add(REQUEST_TIMEOUT)
+        .ok_or(StatusCode::INTERNAL_SERVER_ERROR)?;
+    let body = timeout_at(deadline, Limited::new(request.into_body(), limit).collect())
+        .await
+        .map_err(|_| StatusCode::REQUEST_TIMEOUT)?
+        .map_err(|error| {
+            if error.is::<http_body_util::LengthLimitError>() {
+                StatusCode::PAYLOAD_TOO_LARGE
+            } else {
+                StatusCode::BAD_REQUEST
+            }
+        })?;
+    if body.trailers().is_some() {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    let payload = Payload::try_from(body.to_bytes()).map_err(|_| StatusCode::PAYLOAD_TOO_LARGE)?;
+    match route {
+        Route::Next => {
+            let deadline = Instant::now()
+                .checked_add(idle_lease)
+                .ok_or(StatusCode::INTERNAL_SERVER_ERROR)?;
+            let invocation = session.next(deadline).await.map_err(status)?;
+            match invocation_response(&invocation) {
+                Ok(response) => Ok(response),
+                Err(error) => {
+                    session.close();
+                    Err(error)
+                }
+            }
+        }
+        Route::Complete { attempt, outcome } => {
+            let completed = session
+                .complete_with_body_permit(
+                    attempt,
+                    invocation_id,
+                    outcome,
+                    payload,
+                    deadline,
+                    body_permit,
+                )
+                .await;
+            if matches!(completed, Err(SessionError::UnknownAttempt)) && invocation_id.is_some() {
+                return Ok(invalid_invocation_id());
+            }
+            completed.map_err(status)?;
+            Ok(response(StatusCode::ACCEPTED, Bytes::new(), false))
+        }
+        Route::InitError => {
+            session
+                .initialization_error_with_body_permit(payload, deadline, body_permit)
+                .await
+                .map_err(status)?;
+            Ok(response(StatusCode::ACCEPTED, Bytes::new(), false))
+        }
+    }
+}
+
+fn parse_invocation_id(headers: &HeaderMap) -> Result<Option<AttemptId>, StatusCode> {
+    if headers.get_all(INVOCATION_ID).iter().count() > 1 {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    headers
+        .get(INVOCATION_ID)
+        .map(|value| {
+            value
+                .to_str()
+                .ok()
+                .and_then(|value| value.parse().ok())
+                .ok_or(StatusCode::BAD_REQUEST)
+        })
+        .transpose()
+}
+
+fn invocation_response(invocation: &Invocation) -> Result<Response<Full<Bytes>>, StatusCode> {
+    let (attempt, deadline, arn, trace, payload) = invocation.parts();
+    let deadline = deadline_unix_ms(deadline).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    Response::builder()
+        .status(StatusCode::OK)
+        .header("Lambda-Runtime-Aws-Request-Id", attempt.to_string())
+        .header(INVOCATION_ID, attempt.to_string())
+        .header("Lambda-Runtime-Deadline-Ms", deadline.get().to_string())
+        .header("Lambda-Runtime-Invoked-Function-Arn", arn.as_ref())
+        .header("Lambda-Runtime-Trace-Id", trace.as_ref())
+        .header(CONTENT_TYPE, "application/json")
+        .body(Full::new(Bytes::from(payload.clone())))
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
+}
+
+fn status(error: SessionError) -> StatusCode {
+    match error {
+        SessionError::Busy => StatusCode::CONFLICT,
+        SessionError::UnknownAttempt | SessionError::InvalidMetadata => StatusCode::BAD_REQUEST,
+        SessionError::Deadline | SessionError::HandlerTimeout => StatusCode::REQUEST_TIMEOUT,
+        _ => StatusCode::SERVICE_UNAVAILABLE,
+    }
+}
+
+fn response(status: StatusCode, body: Bytes, close: bool) -> Response<Full<Bytes>> {
+    let mut response = Response::new(Full::new(body));
+    *response.status_mut() = status;
+    if close {
+        response
+            .headers_mut()
+            .insert(CONNECTION, HeaderValue::from_static("close"));
+    }
+    response
+}
+
+fn error_response(status: StatusCode) -> Response<Full<Bytes>> {
+    response(status, Bytes::new(), true)
+}
+
+fn invalid_invocation_id() -> Response<Full<Bytes>> {
+    response(StatusCode::BAD_REQUEST, Bytes::from_static(br#"{"errorType":"InvalidInvocationId","errorMessage":"Invocation ID does not match active invocation"}"#), true)
+}
+
+#[cfg(test)]
+pub(crate) mod tests;
diff --git a/crates/rustack-lambda-runtime/src/http/tests.rs b/crates/rustack-lambda-runtime/src/http/tests.rs
new file mode 100644
index 00000000..4e671082
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/http/tests.rs
@@ -0,0 +1,901 @@
+use std::{
+    future::Future,
+    task::{Context, Waker},
+};
+
+use rstest::rstest;
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::TcpStream,
+};
+
+use super::*;
+use crate::{metadata::local_trace_id, session::RuntimeResult};
+
+#[tokio::test]
+async fn test_should_retain_five_completed_keepalive_connections_for_default_node_ric() {
+    let cutoff = Instant::now() + Duration::from_secs(4);
+    let mut api = start().await.unwrap();
+    let mut retained = Vec::new();
+    for _ in 0..5 {
+        let call = invocation();
+        let ticket = api
+            .session()
+            .submit(call.clone(), call.parts().1)
+            .await
+            .unwrap();
+        api.session().next(call.parts().1).await.unwrap();
+        let mut stream = TcpStream::connect(api.addr()).await.unwrap();
+        let request = format!(
+            "POST /2018-06-01/runtime/invocation/{}/response HTTP/1.1\r\nHost: \
+             {}\r\nContent-Length: 0\r\n\r\n",
+            ticket.attempt(),
+            api.addr()
+        );
+        stream.write_all(request.as_bytes()).await.unwrap();
+        let head = timeout_at(cutoff, async {
+            let mut head = Vec::new();
+            while !head.ends_with(b"\r\n\r\n") {
+                assert!(head.len() < 16384);
+                head.push(stream.read_u8().await.unwrap());
+            }
+            String::from_utf8(head).unwrap()
+        })
+        .await
+        .unwrap();
+        assert!(head.starts_with("HTTP/1.1 202"));
+        assert!(!head.to_ascii_lowercase().contains("connection: close"));
+        assert!(
+            matches!(ticket.wait().await.unwrap(), RuntimeResult::Success(payload) if payload.as_ref().is_empty())
+        );
+        retained.push(stream);
+    }
+    assert!(
+        Instant::now() < cutoff,
+        "keepalive proof exceeded the original pre-idle-timeout cutoff"
+    );
+    assert_eq!(retained.len(), 5);
+    drop(retained);
+    api.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_bound_four_actual_body_readers_without_consuming_the_current_attempt() {
+    let body_budget = Arc::new(Semaphore::new(4));
+    let mut api = start_with_body_budget(
+        "127.0.0.1:0".parse().unwrap(),
+        Duration::from_secs(60),
+        Arc::clone(&body_budget),
+    )
+    .await
+    .unwrap();
+    let call = invocation();
+    let ticket = api
+        .session()
+        .submit(call.clone(), call.parts().1)
+        .await
+        .unwrap();
+    api.session().next(call.parts().1).await.unwrap();
+    let mut held = Vec::new();
+    let foreign = AttemptId::default();
+    for _ in 0..4 {
+        let mut stream = TcpStream::connect(api.addr()).await.unwrap();
+        stream
+            .write_all(
+                format!(
+                    "POST /2018-06-01/runtime/invocation/{foreign}/error HTTP/1.1\r\nHost: \
+                     {}\r\nConnection: close\r\nContent-Length: 1\r\n\r\n",
+                    api.addr()
+                )
+                .as_bytes(),
+            )
+            .await
+            .unwrap();
+        held.push(stream);
+    }
+    timeout(Duration::from_secs(2), async {
+        while body_budget.available_permits() != 0 {
+            tokio::time::sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+    .unwrap();
+    let path = format!(
+        "/2018-06-01/runtime/invocation/{}/response",
+        ticket.attempt()
+    );
+    assert_eq!(
+        request(api.addr(), "POST", &path, "", b"not-accepted")
+            .await
+            .status,
+        429
+    );
+    assert_eq!(
+        request(
+            api.addr(),
+            "GET",
+            "/2018-06-01/runtime/invocation/next",
+            "",
+            b""
+        )
+        .await
+        .status,
+        409
+    );
+    for mut stream in held {
+        stream.write_all(b"x").await.unwrap();
+        let mut reply = Vec::new();
+        timeout(
+            Duration::from_secs(3),
+            stream.take(16385).read_to_end(&mut reply),
+        )
+        .await
+        .unwrap()
+        .unwrap();
+        assert!(reply.starts_with(b"HTTP/1.1 400"));
+    }
+    assert_eq!(body_budget.available_permits(), 4);
+    assert_eq!(
+        request(api.addr(), "POST", &path, "", b"original-result")
+            .await
+            .status,
+        202
+    );
+    assert!(
+        matches!(ticket.wait().await.unwrap(), RuntimeResult::Success(payload) if payload.as_ref()==b"original-result")
+    );
+    api.shutdown().await.unwrap();
+}
+
+#[rstest]
+#[case(8192, true)]
+#[case(8193, false)]
+fn test_should_bound_the_exact_xray_error_cause(#[case] bytes: usize, #[case] accepted: bool) {
+    let route = Route::Complete {
+        attempt: AttemptId::default(),
+        outcome: Outcome::FunctionError,
+    };
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        XRAY_ERROR_CAUSE,
+        HeaderValue::from_str(&"x".repeat(bytes)).unwrap(),
+    );
+    assert_eq!(validate_headers(&headers, Some(&route)).is_ok(), accepted);
+}
+
+#[rstest]
+#[case("GET", "/2018-06-01/runtime/invocation/next", XRAY_ERROR_CAUSE)]
+#[case("POST", "/2018-06-01/runtime/init/error", XRAY_ERROR_CAUSE)]
+#[case(
+    "POST",
+    "/2018-06-01/runtime/invocation/12345678-1234-4234-8234-123456789012/response",
+    XRAY_ERROR_CAUSE
+)]
+#[case(
+    "GET",
+    "/2018-06-01/runtime/invocation/12345678-1234-4234-8234-123456789012/error",
+    XRAY_ERROR_CAUSE
+)]
+#[case(
+    "POST",
+    "/2018-06-01/runtime/invocation/not-a-uuid/error",
+    XRAY_ERROR_CAUSE
+)]
+#[case(
+    "POST",
+    "/2018-06-01/runtime/invocation/12345678-1234-4234-8234-123456789012/error",
+    "x-xray-error-cause"
+)]
+fn test_should_not_grant_xray_allowance_to_other_headers_or_routes(
+    #[case] method: &str,
+    #[case] path: &str,
+    #[case] name: &'static str,
+) {
+    let parsed = route(&method.parse().unwrap(), &path.parse().unwrap());
+    let mut headers = HeaderMap::new();
+    headers.insert(name, HeaderValue::from_str(&"x".repeat(257)).unwrap());
+    assert_eq!(
+        validate_headers(&headers, parsed.as_ref().ok()),
+        Err(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE)
+    );
+}
+
+#[test]
+fn test_should_bound_xray_opaque_bytes_duplicates_count_and_aggregate() {
+    let route = Route::Complete {
+        attempt: AttemptId::default(),
+        outcome: Outcome::FunctionError,
+    };
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        XRAY_ERROR_CAUSE,
+        HeaderValue::from_bytes(&[0x80, 0xff]).unwrap(),
+    );
+    assert!(validate_headers(&headers, Some(&route)).is_ok());
+    headers.insert(XRAY_ERROR_CAUSE, HeaderValue::from_bytes(b"x\tx").unwrap());
+    assert!(validate_headers(&headers, Some(&route)).is_err());
+    headers.insert(XRAY_ERROR_CAUSE, HeaderValue::from_static("first"));
+    headers.append(XRAY_ERROR_CAUSE, HeaderValue::from_static("second"));
+    assert!(validate_headers(&headers, Some(&route)).is_err());
+    headers.clear();
+    headers.insert(
+        XRAY_ERROR_CAUSE,
+        HeaderValue::from_str(&"x".repeat(8192)).unwrap(),
+    );
+    for _ in 0..30 {
+        headers.append("x-other", HeaderValue::from_str(&"o".repeat(256)).unwrap());
+    }
+    headers.append("x-other", HeaderValue::from_str(&"o".repeat(255)).unwrap());
+    assert!(validate_headers(&headers, Some(&route)).is_ok());
+    headers.append("x-other", HeaderValue::from_str(&"o".repeat(256)).unwrap());
+    assert_eq!(
+        validate_headers(&headers, Some(&route)),
+        Err(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE)
+    );
+    headers.clear();
+    for _ in 0..65 {
+        headers.append("x-other", HeaderValue::from_static(""));
+    }
+    assert_eq!(
+        validate_headers(&headers, Some(&route)),
+        Err(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE)
+    );
+}
+
+#[tokio::test]
+async fn test_should_preserve_attempt_through_rejected_xray_then_deliver_original_error() {
+    let mut api = start().await.unwrap();
+    let call = invocation();
+    let ticket = api
+        .session()
+        .submit(call.clone(), call.parts().1)
+        .await
+        .unwrap();
+    assert_eq!(
+        request(
+            api.addr(),
+            "GET",
+            "/2018-06-01/runtime/invocation/next",
+            "",
+            b""
+        )
+        .await
+        .status,
+        200
+    );
+    let path = format!("/2018-06-01/runtime/invocation/{}/error", ticket.attempt());
+    for (headers, expected) in [
+        (format!("{XRAY_ERROR_CAUSE}: {}\r\n", "x".repeat(8193)), 431),
+        (
+            format!("{XRAY_ERROR_CAUSE}: x\r\n{XRAY_ERROR_CAUSE}: y\r\n"),
+            431,
+        ),
+        (format!("{XRAY_ERROR_CAUSE}: x\tx\r\n"), 431),
+        (format!("{XRAY_ERROR_CAUSE}: x\x7fx\r\n"), 400),
+        (format!("{XRAY_ERROR_CAUSE}: x\0x\r\n"), 400),
+    ] {
+        assert_eq!(
+            request(api.addr(), "POST", &path, &headers, b"rejected-error")
+                .await
+                .status,
+            expected
+        );
+    }
+    let cause = format!(
+        "{XRAY_ERROR_CAUSE}: {}诊断\r\n",
+        "private-xray-cause".repeat(200)
+    );
+    let mismatch = format!("{cause}{INVOCATION_ID}: {}\r\n", AttemptId::default());
+    assert_eq!(
+        request(api.addr(), "POST", &path, &mismatch, b"wrong-error")
+            .await
+            .status,
+        400
+    );
+    let foreign = format!(
+        "/2018-06-01/runtime/invocation/{}/error",
+        AttemptId::default()
+    );
+    assert_eq!(
+        request(api.addr(), "POST", &foreign, &cause, b"foreign-error")
+            .await
+            .status,
+        400
+    );
+    let payload = b"original-error\0\xff";
+    let accepted = format!("{cause}{INVOCATION_ID}: {}\r\n", ticket.attempt());
+    assert_eq!(
+        request(api.addr(), "POST", &path, &accepted, payload)
+            .await
+            .status,
+        202
+    );
+    assert!(
+        matches!(ticket.wait().await.unwrap(), RuntimeResult::FunctionError(bytes) if bytes.as_ref()==payload)
+    );
+    api.shutdown().await.unwrap();
+}
+
+#[derive(Debug)]
+pub(crate) struct Reply {
+    pub(crate) status: u16,
+    headers: Vec<(String, String)>,
+    pub(crate) body: Vec<u8>,
+}
+
+#[derive(Debug, Clone)]
+struct LogWriter(Arc<std::sync::Mutex<Vec<u8>>>);
+
+impl io::Write for LogWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let mut output = self.0.lock().unwrap();
+        if output.len().saturating_add(bytes.len()) > 2 * 1024 * 1024 {
+            return Err(io::Error::other("log capture capacity exceeded"));
+        }
+        output.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+impl Reply {
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .iter()
+            .find_map(|(key, value)| key.eq_ignore_ascii_case(name).then_some(value.as_str()))
+    }
+}
+
+async fn raw(addr: SocketAddr, request: Vec<u8>) -> Reply {
+    timeout(Duration::from_secs(3), async {
+        let mut stream = TcpStream::connect(addr).await.unwrap();
+        stream.write_all(&request).await.unwrap();
+        let mut bytes = Vec::new();
+        stream.read_to_end(&mut bytes).await.unwrap();
+        let position = bytes
+            .windows(4)
+            .position(|bytes| bytes == b"\r\n\r\n")
+            .unwrap();
+        let headers = String::from_utf8(bytes.get(..position).unwrap().to_vec()).unwrap();
+        let mut lines = headers.lines();
+        let status = lines
+            .next()
+            .unwrap()
+            .split_whitespace()
+            .nth(1)
+            .unwrap()
+            .parse()
+            .unwrap();
+        let headers = lines
+            .map(|line| {
+                let (key, value) = line.split_once(':').unwrap();
+                (key.into(), value.trim().into())
+            })
+            .collect();
+        Reply {
+            status,
+            headers,
+            body: bytes.get(position + 4..).unwrap().to_vec(),
+        }
+    })
+    .await
+    .unwrap()
+}
+
+pub(crate) async fn request(
+    addr: SocketAddr,
+    method: &str,
+    path: &str,
+    headers: &str,
+    body: &[u8],
+) -> Reply {
+    let mut bytes = format!(
+        "{method} {path} HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\nContent-Length: \
+         {}\r\n{headers}\r\n",
+        body.len()
+    )
+    .into_bytes();
+    bytes.extend_from_slice(body);
+    raw(addr, bytes).await
+}
+
+fn invocation() -> Invocation {
+    Invocation::new(
+        AttemptId::default(),
+        Instant::now() + Duration::from_secs(10),
+        "arn:aws:lambda:us-east-1:000000000000:function:echo:prod"
+            .parse()
+            .unwrap(),
+        local_trace_id().unwrap(),
+        Payload::try_from(Bytes::from_static(b"secret-event\0\xff")).unwrap(),
+    )
+    .unwrap()
+}
+
+#[tokio::test]
+async fn test_should_round_trip_binary_invocations_and_supply_complete_runtime_metadata() {
+    let mut api = start().await.unwrap();
+    let call = invocation();
+    let ticket = api
+        .session()
+        .submit(call.clone(), call.parts().1)
+        .await
+        .unwrap();
+    let response = request(
+        api.addr(),
+        "GET",
+        "/2018-06-01/runtime/invocation/next",
+        "",
+        b"",
+    )
+    .await;
+    assert_eq!(response.status, 200);
+    assert_eq!(response.body, call.parts().4.as_ref());
+    assert_eq!(
+        response.header("Lambda-Runtime-Aws-Request-Id").unwrap(),
+        ticket.attempt().to_string()
+    );
+    assert_eq!(
+        response.header(INVOCATION_ID).unwrap(),
+        ticket.attempt().to_string()
+    );
+    assert_eq!(
+        response.header("Lambda-Runtime-Invoked-Function-Arn"),
+        Some("arn:aws:lambda:us-east-1:000000000000:function:echo:prod")
+    );
+    assert!(
+        response
+            .header("Lambda-Runtime-Trace-Id")
+            .unwrap()
+            .ends_with("Sampled=0")
+    );
+    assert!(
+        response
+            .header("Lambda-Runtime-Deadline-Ms")
+            .unwrap()
+            .parse::<u64>()
+            .unwrap()
+            > 0
+    );
+    let path = format!(
+        "/2018-06-01/runtime/invocation/{}/response",
+        ticket.attempt()
+    );
+    let result = request(
+        api.addr(),
+        "POST",
+        &path,
+        &format!("Lambda-Runtime-Invocation-Id: {}\r\n", ticket.attempt()),
+        b"secret-result\0\xff",
+    )
+    .await;
+    assert_eq!(result.status, 202);
+    assert!(
+        matches!(ticket.wait().await.unwrap(), RuntimeResult::Success(payload) if payload.as_ref() == b"secret-result\0\xff")
+    );
+    api.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_preserve_current_attempt_after_unknown_duplicate_or_wrong_header_completions()
+{
+    let mut api = start().await.unwrap();
+    let call = invocation();
+    let ticket = api
+        .session()
+        .submit(call.clone(), call.parts().1)
+        .await
+        .unwrap();
+    request(
+        api.addr(),
+        "GET",
+        "/2018-06-01/runtime/invocation/next",
+        "",
+        b"",
+    )
+    .await;
+    let path = format!("/2018-06-01/runtime/invocation/{}/error", ticket.attempt());
+    let mismatch = request(
+        api.addr(),
+        "POST",
+        &path,
+        &format!("Lambda-Runtime-Invocation-Id: {}\r\n", AttemptId::default()),
+        b"{}",
+    )
+    .await;
+    assert_eq!(mismatch.status, 400);
+    assert!(
+        String::from_utf8(mismatch.body)
+            .unwrap()
+            .contains("InvalidInvocationId")
+    );
+    let duplicate_headers = request(
+        api.addr(),
+        "POST",
+        &path,
+        &format!(
+            "Lambda-Runtime-Invocation-Id: {}\r\nLambda-Runtime-Invocation-Id: {}\r\n",
+            ticket.attempt(),
+            ticket.attempt()
+        ),
+        b"{}",
+    )
+    .await;
+    assert_eq!(duplicate_headers.status, 400);
+    let unknown = request(
+        api.addr(),
+        "POST",
+        &format!(
+            "/2018-06-01/runtime/invocation/{}/response",
+            AttemptId::default()
+        ),
+        "",
+        b"{}",
+    )
+    .await;
+    assert_eq!(unknown.status, 400);
+    assert_eq!(
+        request(api.addr(), "POST", &path, "", b"function-error")
+            .await
+            .status,
+        202
+    );
+    assert!(
+        matches!(ticket.wait().await.unwrap(), RuntimeResult::FunctionError(payload) if payload.as_ref() == b"function-error")
+    );
+    assert_eq!(
+        request(api.addr(), "POST", &path, "", b"duplicate")
+            .await
+            .status,
+        400
+    );
+    api.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_acknowledge_initialization_error_before_joining_the_closed_session() {
+    let mut api = start().await.unwrap();
+    let receiver = api.take_initialization_error().unwrap();
+    assert!(api.take_initialization_error().is_none());
+    assert_eq!(
+        request(
+            api.addr(),
+            "POST",
+            "/2018-06-01/runtime/init/error",
+            "",
+            b"secret-init-error"
+        )
+        .await
+        .status,
+        202
+    );
+    assert_eq!(receiver.await.unwrap().as_ref(), b"secret-init-error");
+    api.shutdown().await.unwrap();
+}
+
+#[rstest]
+#[case("GET", "/2018-06-01/runtime/invocation/next?secret-query=1", 400)]
+#[case("GET", "http://localhost/2018-06-01/runtime/invocation/next", 400)]
+#[case("POST", "/2018-06-01/runtime/invocation/next", 405)]
+#[case("GET", "/2018-06-01/runtime/init/error", 405)]
+#[case("POST", "/2018-06-01/runtime/invocation/not-an-id/response", 400)]
+#[case(
+    "POST",
+    "/2018-06-01/runtime/invocation/00112233-4455-6677-8899-aabbccddeeff/extra/response",
+    404
+)]
+#[tokio::test]
+async fn test_should_reject_invalid_routes_before_bootstrap_readiness(
+    #[case] method: &str,
+    #[case] path: &str,
+    #[case] expected: u16,
+) {
+    let mut api = start().await.unwrap();
+    assert_eq!(
+        request(api.addr(), method, path, "", b"").await.status,
+        expected
+    );
+    assert_eq!(
+        api.session().bootstrap_ready(Instant::now()).await,
+        Err(SessionError::Deadline)
+    );
+    api.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_bound_headers_get_bodies_and_declared_post_bodies_before_session_commands() {
+    let mut api = start().await.unwrap();
+    assert_eq!(
+        request(
+            api.addr(),
+            "GET",
+            "/2018-06-01/runtime/invocation/next",
+            "",
+            b"x"
+        )
+        .await
+        .status,
+        413
+    );
+    assert_eq!(
+        request(
+            api.addr(),
+            "GET",
+            "/2018-06-01/runtime/invocation/next",
+            &format!("X-Secret: {}\r\n", "s".repeat(257)),
+            b""
+        )
+        .await
+        .status,
+        431
+    );
+    let request = format!(
+        "POST /2018-06-01/runtime/init/error HTTP/1.1\r\nHost: localhost\r\nConnection: \
+         close\r\nContent-Length: {}\r\n\r\n",
+        MAX_PAYLOAD_BYTES + 1
+    )
+    .into_bytes();
+    assert_eq!(raw(api.addr(), request).await.status, 413);
+    api.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_enforce_streamed_chunked_body_limit_without_accepting_init_error() {
+    let mut api = start().await.unwrap();
+    let mut notification = api.take_initialization_error().unwrap();
+    let stream = TcpStream::connect(api.addr()).await.unwrap();
+    let (mut reader, mut writer) = stream.into_split();
+    let send = tokio::spawn(async move {
+        writer.write_all(b"POST /2018-06-01/runtime/init/error HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n").await.unwrap();
+        let header = format!("{:x}\r\n", MAX_PAYLOAD_BYTES + 1);
+        writer.write_all(header.as_bytes()).await.unwrap();
+        let _ = writer.write_all(&vec![0xff; MAX_PAYLOAD_BYTES + 1]).await;
+        let _ = writer.write_all(b"\r\n0\r\n\r\n").await;
+    });
+    let mut reply = Vec::new();
+    timeout(Duration::from_secs(3), reader.read_to_end(&mut reply))
+        .await
+        .unwrap()
+        .unwrap();
+    send.await.unwrap();
+    assert!(reply.starts_with(b"HTTP/1.1 413"));
+    assert!(notification.try_recv().is_err());
+    api.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_keep_shutdown_owned_when_its_waiter_is_dropped_and_close_the_listener() {
+    let mut api = start().await.unwrap();
+    let addr = api.addr();
+    let mut waiting = Box::pin(api.shutdown());
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    assert!(api.server.task.is_some());
+    api.shutdown().await.unwrap();
+    api.shutdown().await.unwrap();
+    assert!(TcpStream::connect(addr).await.is_err());
+    assert!(matches!(
+        start_at("0.0.0.0:0".parse().unwrap(), Duration::from_secs(60)).await,
+        Err(ApiError::NonLoopback)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_retain_failed_supervision_on_repeated_shutdown() {
+    let mut api = start().await.unwrap();
+    api.server.task.as_ref().unwrap().abort();
+    assert!(matches!(
+        api.shutdown().await,
+        Err(ApiError::SupervisorFailed)
+    ));
+    assert!(matches!(
+        api.shutdown().await,
+        Err(ApiError::SupervisorFailed)
+    ));
+}
+
+async fn observe_private_error_diagnostics(api: &RuntimeApiHandle) {
+    let error_call = invocation();
+    let error_ticket = api
+        .session()
+        .submit(error_call.clone(), error_call.parts().1)
+        .await
+        .unwrap();
+    assert_eq!(
+        request(
+            api.addr(),
+            "GET",
+            "/2018-06-01/runtime/invocation/next",
+            "",
+            b""
+        )
+        .await
+        .status,
+        200
+    );
+    let error_path = format!(
+        "/2018-06-01/runtime/invocation/{}/error",
+        error_ticket.attempt()
+    );
+    assert_eq!(
+        request(
+            api.addr(),
+            "POST",
+            &error_path,
+            &format!(
+                "{XRAY_ERROR_CAUSE}: {}\r\n",
+                "secret-xray-cause".repeat(100)
+            ),
+            b"secret-function-error"
+        )
+        .await
+        .status,
+        202
+    );
+    error_ticket.wait().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_omit_payloads_headers_and_targets_from_trace_level_runtime_diagnostics() {
+    let logs = Arc::new(std::sync::Mutex::new(Vec::new()));
+    let captured = Arc::clone(&logs);
+    let subscriber = tracing_subscriber::fmt()
+        .with_ansi(false)
+        .with_max_level(tracing::Level::TRACE)
+        .with_span_events(
+            tracing_subscriber::fmt::format::FmtSpan::NEW
+                | tracing_subscriber::fmt::format::FmtSpan::CLOSE,
+        )
+        .with_writer(move || LogWriter(Arc::clone(&captured)))
+        .finish();
+    // This current-thread runtime keeps its tasks under one thread-local
+    // dispatcher, without changing process-wide logging or environment settings.
+    let _subscriber = tracing::subscriber::set_default(subscriber);
+    let mut api = start().await.unwrap();
+    let call = invocation();
+    let ticket = api
+        .session()
+        .submit(call.clone(), call.parts().1)
+        .await
+        .unwrap();
+    assert_eq!(
+        request(
+            api.addr(),
+            "GET",
+            "/2018-06-01/runtime/invocation/next",
+            "X-Secret: secret-header\r\n",
+            b""
+        )
+        .await
+        .status,
+        200
+    );
+    let path = format!(
+        "/2018-06-01/runtime/invocation/{}/response",
+        ticket.attempt()
+    );
+    assert_eq!(
+        request(api.addr(), "POST", &path, "", b"secret-result")
+            .await
+            .status,
+        202
+    );
+    ticket.wait().await.unwrap();
+    observe_private_error_diagnostics(&api).await;
+    assert_eq!(
+        request(
+            api.addr(),
+            "GET",
+            "/2018-06-01/runtime/invocation/next?secret-target",
+            "",
+            b""
+        )
+        .await
+        .status,
+        400
+    );
+    let mut stream = TcpStream::connect(api.addr()).await.unwrap();
+    stream.write_all(b"POST /2018-06-01/runtime/init/error HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\nTransfer-Encoding: chunked\r\n\r\n0\r\nX-Secret: secret-fragmented-trailer").await.unwrap();
+    // Force another decoder poll with a partially buffered trailer.
+    tokio::time::sleep(Duration::from_millis(30)).await;
+    stream.write_all(b"\r\n\r\n").await.unwrap();
+    let mut reply = Vec::new();
+    timeout(Duration::from_secs(3), stream.read_to_end(&mut reply))
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(reply.starts_with(b"HTTP/1.1 400"));
+    api.shutdown().await.unwrap();
+    let output = String::from_utf8(logs.lock().unwrap().clone()).unwrap();
+    assert!(
+        !output.is_empty(),
+        "trace capture must observe runtime spans"
+    );
+    for secret in [
+        "secret-event",
+        "secret-header",
+        "secret-result",
+        "secret-target",
+        "secret-fragmented-trailer",
+        "secret-xray-cause",
+        "secret-function-error",
+    ] {
+        assert!(
+            !output.contains(secret),
+            "runtime diagnostics leaked {secret}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn test_should_reject_all_trailers_before_initialization_or_invocation_mutation() {
+    let mut api = start().await.unwrap();
+    let mut notification = api.take_initialization_error().unwrap();
+    for trailer in [
+        "X-Secret: secret-trailer".to_owned(),
+        format!("X-Long: {}", "s".repeat(300)),
+        format!("Lambda-Runtime-Invocation-Id: {}", AttemptId::default()),
+    ] {
+        let bytes = format!(
+            "POST /2018-06-01/runtime/init/error HTTP/1.1\r\nHost: localhost\r\nConnection: \
+             close\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n{trailer}\r\n\r\n"
+        )
+        .into_bytes();
+        assert_eq!(raw(api.addr(), bytes).await.status, 400);
+        assert!(notification.try_recv().is_err());
+        assert!(!api.session().is_closed());
+    }
+    api.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_publish_effective_delivery_deadline_and_join_api_after_handler_timeout() {
+    use crate::{metadata::deadline_unix_ms, protocol::HandlerTimeout};
+    let mut api = start().await.unwrap();
+    let handle = api.session().clone();
+    let mut call = invocation();
+    call = Invocation::new(
+        call.parts().0,
+        Instant::now() + Duration::from_secs(30),
+        call.parts().2.clone(),
+        call.parts().3.clone(),
+        call.parts().4.clone(),
+    )
+    .unwrap()
+    .with_handler_timeout(HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+    let outer = deadline_unix_ms(call.parts().1).unwrap().get();
+    let ticket = handle
+        .submit(call, Instant::now() + Duration::from_secs(3))
+        .await
+        .unwrap();
+    let reply = request(
+        api.addr(),
+        "GET",
+        "/2018-06-01/runtime/invocation/next",
+        "",
+        b"",
+    )
+    .await;
+    assert_eq!(reply.status, 200);
+    let effective = reply
+        .header("Lambda-Runtime-Deadline-Ms")
+        .unwrap()
+        .parse::<u64>()
+        .unwrap();
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_millis();
+    assert!(u128::from(effective) <= now + 1000 && u128::from(effective) > now);
+    assert!(effective + 20_000 < outer);
+    assert_eq!(ticket.wait().await, Err(SessionError::HandlerTimeout));
+    api.shutdown().await.unwrap();
+    assert!(TcpStream::connect(api.addr()).await.is_err());
+}
diff --git a/crates/rustack-lambda-runtime/src/lib.rs b/crates/rustack-lambda-runtime/src/lib.rs
new file mode 100644
index 00000000..5a18232d
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/lib.rs
@@ -0,0 +1,17 @@
+//! Shared, host-portable Lambda runtime contracts.
+//!
+//! The control protocol validates untrusted CBOR before deserialization and
+//! preserves raw payload bytes without logging their contents. This crate has
+//! no dependency on a function provider, VM implementation or Docker client.
+
+#![forbid(unsafe_code)]
+
+pub mod client;
+pub mod diagnostics;
+pub mod http;
+pub mod metadata;
+pub mod probe;
+pub mod protocol;
+pub mod relay;
+pub mod session;
+mod transport;
diff --git a/crates/rustack-lambda-runtime/src/main.rs b/crates/rustack-lambda-runtime/src/main.rs
new file mode 100644
index 00000000..3c30eccb
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/main.rs
@@ -0,0 +1,39 @@
+//! Linux-only Lambda relay process. Stdout is reserved for binary control frames.
+
+#![forbid(unsafe_code)]
+
+#[cfg(not(target_os = "linux"))]
+use std::future::{Ready, ready};
+use std::process::ExitCode;
+
+#[cfg(not(target_os = "linux"))]
+use rustack_lambda_runtime::relay::RelayError;
+
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> ExitCode {
+    let subscriber = tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::INFO)
+        .with_target(false)
+        .with_writer(std::io::stderr)
+        .finish();
+    if tracing::subscriber::set_global_default(subscriber).is_err() {
+        return ExitCode::FAILURE;
+    }
+    match run().await {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            tracing::error!(%error, "Lambda runtime relay exited");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+#[cfg(not(target_os = "linux"))]
+fn run() -> Ready<Result<(), RelayError>> {
+    ready(Err(RelayError::UnsupportedPlatform))
+}
+
+#[cfg(target_os = "linux")]
+mod process;
+#[cfg(target_os = "linux")]
+use process::run;
diff --git a/crates/rustack-lambda-runtime/src/metadata.rs b/crates/rustack-lambda-runtime/src/metadata.rs
new file mode 100644
index 00000000..1ee6d34b
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/metadata.rs
@@ -0,0 +1,134 @@
+//! Checked wall/monotonic deadline conversion and local tracing metadata.
+
+use std::{
+    num::NonZeroU64,
+    time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+use thiserror::Error;
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use crate::protocol::TraceId;
+
+/// Clock/metadata failures contain no invocation contents.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+#[non_exhaustive]
+pub enum MetadataError {
+    /// Supplied deadline has already elapsed.
+    #[error("runtime deadline expired")]
+    Expired,
+    /// Clock/range/conversion cannot represent the metadata.
+    #[error("invalid runtime clock metadata")]
+    Invalid,
+}
+
+/// Convert a future monotonic deadline into checked Unix milliseconds.
+///
+/// # Errors
+/// Rejects expired deadlines, a pre-epoch wall clock or arithmetic overflow.
+///
+/// ```
+/// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(5);
+/// assert!(rustack_lambda_runtime::metadata::deadline_unix_ms(deadline).is_ok());
+/// ```
+pub fn deadline_unix_ms(deadline: Instant) -> Result<NonZeroU64, MetadataError> {
+    to_wall(deadline, Instant::now(), SystemTime::now())
+}
+
+fn to_wall(deadline: Instant, now: Instant, wall: SystemTime) -> Result<NonZeroU64, MetadataError> {
+    let remaining = deadline
+        .checked_duration_since(now)
+        .filter(|remaining| !remaining.is_zero())
+        .ok_or(MetadataError::Expired)?;
+    let epoch = wall
+        .duration_since(UNIX_EPOCH)
+        .map_err(|_| MetadataError::Invalid)?;
+    let total = epoch.checked_add(remaining).ok_or(MetadataError::Invalid)?;
+    NonZeroU64::new(u64::try_from(total.as_millis()).map_err(|_| MetadataError::Invalid)?)
+        .ok_or(MetadataError::Invalid)
+}
+
+/// Translate an incoming wall deadline into a bounded monotonic deadline.
+///
+/// # Errors
+/// Rejects expired deadlines, invalid clocks and more than one hour remaining.
+/// Lambda's≤900s handler plus bounded startup fits within this local ceiling.
+///
+/// ```
+/// # use rustack_lambda_runtime::metadata::{deadline_unix_ms, deadline_from_unix_ms};
+/// let value = deadline_unix_ms(tokio::time::Instant::now() + std::time::Duration::from_secs(5))?;
+/// assert!(deadline_from_unix_ms(value).is_ok());
+/// # Ok::<(), rustack_lambda_runtime::metadata::MetadataError>(())
+/// ```
+pub fn deadline_from_unix_ms(value: NonZeroU64) -> Result<Instant, MetadataError> {
+    from_wall(value, Instant::now(), SystemTime::now())
+}
+
+fn from_wall(value: NonZeroU64, now: Instant, wall: SystemTime) -> Result<Instant, MetadataError> {
+    let epoch = wall
+        .duration_since(UNIX_EPOCH)
+        .map_err(|_| MetadataError::Invalid)?;
+    let remaining = Duration::from_millis(value.get())
+        .checked_sub(epoch)
+        .filter(|remaining| !remaining.is_zero())
+        .ok_or(MetadataError::Expired)?;
+    if remaining > Duration::from_hours(1) {
+        return Err(MetadataError::Invalid);
+    }
+    now.checked_add(remaining).ok_or(MetadataError::Invalid)
+}
+
+/// Generate an X-Ray-shaped local trace, without claiming upstream sampling.
+///
+/// # Errors
+/// Returns Invalid if the wall clock/validated header cannot be represented.
+///
+/// ```
+/// assert!(rustack_lambda_runtime::metadata::local_trace_id()?.as_ref().ends_with("Sampled=0"));
+/// # Ok::<(), rustack_lambda_runtime::metadata::MetadataError>(())
+/// ```
+pub fn local_trace_id() -> Result<TraceId, MetadataError> {
+    let epoch = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_err(|_| MetadataError::Invalid)?
+        .as_secs()
+        % (1_u64 << 32);
+    let root = Uuid::new_v4().simple().to_string();
+    let parent = Uuid::new_v4().simple().to_string();
+    let root = root.get(..24).ok_or(MetadataError::Invalid)?;
+    let parent = parent.get(..16).ok_or(MetadataError::Invalid)?;
+    format!("Root=1-{epoch:08x}-{root};Parent={parent};Sampled=0")
+        .parse()
+        .map_err(|_| MetadataError::Invalid)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_should_convert_checked_fractional_deadlines_and_reject_invalid_clocks() {
+        let now = Instant::now();
+        let wall = UNIX_EPOCH + Duration::from_millis(1000);
+        let deadline = now + Duration::from_micros(2500);
+        assert_eq!(to_wall(deadline, now, wall).unwrap().get(), 1002);
+        assert_eq!(
+            from_wall(NonZeroU64::new(1002).unwrap(), now, wall).unwrap(),
+            now + Duration::from_millis(2)
+        );
+        assert_eq!(to_wall(now, now, wall), Err(MetadataError::Expired));
+        assert_eq!(
+            to_wall(deadline, now, UNIX_EPOCH - Duration::from_secs(1)),
+            Err(MetadataError::Invalid)
+        );
+        assert_eq!(
+            from_wall(NonZeroU64::new(1000).unwrap(), now, wall),
+            Err(MetadataError::Expired)
+        );
+        assert_eq!(
+            from_wall(NonZeroU64::new(u64::MAX).unwrap(), now, wall),
+            Err(MetadataError::Invalid)
+        );
+    }
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/client.rs b/crates/rustack-lambda-runtime/src/probe/client.rs
new file mode 100644
index 00000000..66dc388a
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/client.rs
@@ -0,0 +1,180 @@
+//! One owned HTTP connection per request; never spawn a detached connection task.
+
+use std::{env, future::pending, num::NonZeroU64, sync::Arc, time::Duration};
+
+use bytes::Bytes;
+use http::{HeaderMap, Method, Request, StatusCode};
+use http_body_util::{BodyExt, Full, Limited};
+use hyper::client::conn::http1;
+use hyper_util::rt::TokioIo;
+use tokio::{
+    net::TcpStream,
+    time::{Instant, sleep_until, timeout_at},
+};
+
+use super::{EndpointChallenge, ProbeError, REPORT_BYTES, collect, endpoint};
+use crate::{metadata::deadline_from_unix_ms, protocol::AttemptId};
+
+struct Reply {
+    status: StatusCode,
+    headers: HeaderMap,
+    body: Bytes,
+}
+async fn request(
+    method: Method,
+    path: &str,
+    body: Bytes,
+    deadline: Instant,
+) -> Result<Reply, ProbeError> {
+    let stream = timeout_at(deadline, TcpStream::connect("127.0.0.1:9001"))
+        .await
+        .map_err(|_| ProbeError::Deadline)??;
+    let mut builder = http1::Builder::new();
+    builder.max_buf_size(16384).max_headers(32);
+    let (mut sender, connection) = timeout_at(deadline, builder.handshake(TokioIo::new(stream)))
+        .await
+        .map_err(|_| ProbeError::Deadline)??;
+    tokio::pin!(connection);
+    let operation = async {
+        let request = Request::builder()
+            .method(method)
+            .uri(path)
+            .header("host", "127.0.0.1:9001")
+            .header("connection", "close")
+            .header("content-type", "application/json")
+            .body(Full::new(body))
+            .map_err(|_| ProbeError::Protocol)?;
+        let response = sender.send_request(request).await?;
+        let (parts, body) = response.into_parts();
+        let body = Limited::new(body, REPORT_BYTES)
+            .collect()
+            .await
+            .map_err(|_| ProbeError::Protocol)?
+            .to_bytes();
+        Ok(Reply {
+            status: parts.status,
+            headers: parts.headers,
+            body,
+        })
+    };
+    tokio::pin!(operation);
+    let mut finished = false;
+    loop {
+        tokio::select! {biased;
+            ()=sleep_until(deadline)=>return Err(ProbeError::Deadline),
+            result=&mut operation=>return result,
+            result=&mut connection,if !finished=>{result?;finished=true;},
+        }
+    }
+}
+fn header<'a>(headers: &'a HeaderMap, key: &str, cap: usize) -> Result<&'a str, ProbeError> {
+    let mut values = headers.get_all(key).iter();
+    let value = values.next().ok_or(ProbeError::Protocol)?;
+    if values.next().is_some() || value.as_bytes().len() > cap {
+        return Err(ProbeError::Protocol);
+    }
+    value.to_str().map_err(|_| ProbeError::Protocol)
+}
+#[derive(Debug, Clone, Copy)]
+enum Mode {
+    Resource,
+    Endpoint,
+}
+pub(super) async fn run() -> Result<(), ProbeError> {
+    run_probe(Mode::Resource).await
+}
+pub(super) async fn run_endpoint() -> Result<(), ProbeError> {
+    run_probe(Mode::Endpoint).await
+}
+async fn run_probe(mode: Mode) -> Result<(), ProbeError> {
+    if !cfg!(target_os = "linux")
+        || env::var("AWS_LAMBDA_RUNTIME_API").as_deref() != Ok("127.0.0.1:9001")
+    {
+        return Err(ProbeError::Configuration);
+    }
+    let challenge = request(
+        Method::GET,
+        "/2018-06-01/runtime/invocation/next",
+        Bytes::new(),
+        Instant::now() + Duration::from_secs(60),
+    )
+    .await?;
+    if challenge.status != StatusCode::OK
+        || (!matches!(mode, Mode::Endpoint) && challenge.body.as_ref() != b"{}")
+    {
+        return Err(ProbeError::Protocol);
+    }
+    let attempt: AttemptId = header(&challenge.headers, "lambda-runtime-aws-request-id", 36)?
+        .parse()
+        .map_err(|_| ProbeError::Protocol)?;
+    let wall = header(&challenge.headers, "lambda-runtime-deadline-ms", 20)?
+        .parse::<NonZeroU64>()
+        .map_err(|_| ProbeError::Protocol)?;
+    let deadline = deadline_from_unix_ms(wall).map_err(|_| ProbeError::Deadline)?;
+    let observation = if matches!(mode, Mode::Endpoint) {
+        match EndpointChallenge::decode(&challenge.body) {
+            Ok(challenge) => endpoint::observe(&challenge, attempt, deadline)
+                .await
+                .and_then(|report| {
+                    serde_json::to_vec(&report).map_err(|error| ProbeError::Report(Arc::new(error)))
+                }),
+            Err(error) => Err(error),
+        }
+    } else {
+        collect::collect(attempt, deadline)
+            .await
+            .and_then(|report| {
+                serde_json::to_vec(&report).map_err(|error| ProbeError::Report(Arc::new(error)))
+            })
+    };
+    let (suffix, body) = match observation {
+        Ok(bytes) if bytes.len() <= REPORT_BYTES => ("response", Bytes::from(bytes)),
+        Ok(_) => return Err(ProbeError::Protocol),
+        Err(_) => (
+            "error",
+            Bytes::from_static(
+                br#"{"errorType":"Rustack.ProbeFailed","errorMessage":"runtime probe failed"}"#,
+            ),
+        ),
+    };
+    let reply = request(
+        Method::POST,
+        &format!("/2018-06-01/runtime/invocation/{attempt}/{suffix}"),
+        body,
+        deadline.min(Instant::now() + Duration::from_secs(5)),
+    )
+    .await?;
+    if reply.status != StatusCode::ACCEPTED || !reply.body.is_empty() {
+        return Err(ProbeError::Protocol);
+    }
+    // The host owns this one-shot function's retirement, including on rejection.
+    pending().await
+}
+
+#[cfg(test)]
+mod tests {
+    use http::HeaderValue;
+
+    use super::*;
+
+    #[test]
+    fn test_should_require_exact_single_bounded_ascii_probe_metadata() {
+        let mut values = HeaderMap::new();
+        assert!(header(&values, "probe", 3).is_err());
+        values.insert("probe", HeaderValue::from_static("123"));
+        assert_eq!(header(&values, "probe", 3).unwrap(), "123");
+        assert!(header(&values, "probe", 2).is_err());
+        values.append("probe", HeaderValue::from_static("456"));
+        assert!(header(&values, "probe", 3).is_err());
+        values.clear();
+        values.insert("probe", HeaderValue::from_bytes(b"\xff").unwrap());
+        assert!(header(&values, "probe", 3).is_err());
+    }
+    #[test]
+    fn test_should_redact_probe_error_sources() {
+        use std::error::Error as _;
+        let error = ProbeError::from(std::io::Error::other("private-kernel-path"));
+        assert!(error.source().is_some());
+        assert!(!format!("{error:?} {error}").contains("private-kernel-path"));
+    }
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/collect.rs b/crates/rustack-lambda-runtime/src/probe/collect.rs
new file mode 100644
index 00000000..3b76e814
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/collect.rs
@@ -0,0 +1,102 @@
+//! Fixed-path bounded async reads; process/container retirement owns cancellation.
+
+use std::{env::consts::ARCH, io, os::unix::fs::MetadataExt};
+
+use tokio::{
+    fs::{File, metadata},
+    io::AsyncReadExt,
+    time::{Instant, timeout_at},
+};
+
+use super::{ProbeError, ResourceReport, parse};
+use crate::protocol::{Architecture, AttemptId};
+
+async fn read(path: &'static str, cap: usize) -> Result<String, ProbeError> {
+    let mut bytes = Vec::new();
+    File::open(path)
+        .await?
+        .take(
+            u64::try_from(cap)
+                .map_err(|_| ProbeError::Observation)?
+                .saturating_add(1),
+        )
+        .read_to_end(&mut bytes)
+        .await?;
+    if bytes.len() > cap {
+        return Err(ProbeError::Observation);
+    }
+    String::from_utf8(bytes).map_err(|_| ProbeError::Observation)
+}
+pub(super) async fn collect(
+    attempt: AttemptId,
+    deadline: Instant,
+) -> Result<ResourceReport, ProbeError> {
+    timeout_at(deadline, async {
+        let memory = read("/sys/fs/cgroup/memory.max", 128).await;
+        let (memory_max, swap_max, pids_max, cpu_quota, cpu_period, unified) = match memory {
+            Ok(memory) => {
+                let (quota, period) = parse::cpu(&read("/sys/fs/cgroup/cpu.max", 128).await?)?;
+                (
+                    parse::limit(&memory)?,
+                    parse::limit(&read("/sys/fs/cgroup/memory.swap.max", 128).await?)?,
+                    parse::limit(&read("/sys/fs/cgroup/pids.max", 128).await?)?,
+                    quota,
+                    period,
+                    true,
+                )
+            }
+            Err(ProbeError::Io(error)) if error.kind() == io::ErrorKind::NotFound => {
+                let memory =
+                    parse::limit(&read("/sys/fs/cgroup/memory/memory.limit_in_bytes", 128).await?)?;
+                let total = parse::limit(
+                    &read("/sys/fs/cgroup/memory/memory.memsw.limit_in_bytes", 128).await?,
+                )?;
+                let swap = match (memory, total) {
+                    (Some(memory), Some(total)) => {
+                        Some(total.checked_sub(memory).ok_or(ProbeError::Observation)?)
+                    }
+                    _ => None,
+                };
+                (
+                    memory,
+                    swap,
+                    parse::limit(&read("/sys/fs/cgroup/pids/pids.max", 128).await?)?,
+                    parse::limit(&read("/sys/fs/cgroup/cpu/cpu.cfs_quota_us", 128).await?)?,
+                    parse::number(&read("/sys/fs/cgroup/cpu/cpu.cfs_period_us", 128).await?)?,
+                    false,
+                )
+            }
+            Err(error) => return Err(error),
+        };
+        let status = parse::status(&read("/proc/self/status", 65536).await?)?;
+        let cgroup_root = parse::membership(&read("/proc/self/cgroup", 65536).await?, unified)?;
+        let mode = metadata("/tmp").await?.mode() & 0o7777;
+        let (root_readonly, temporary) =
+            parse::mounts(&read("/proc/self/mountinfo", 65536).await?, mode)?;
+        let architecture = match ARCH {
+            "aarch64" => Architecture::Arm64,
+            "x86_64" => Architecture::X86_64,
+            _ => return Err(ProbeError::Configuration),
+        };
+        Ok(ResourceReport::builder()
+            .version(1)
+            .attempt(attempt)
+            .architecture(architecture)
+            .cgroup_root(cgroup_root)
+            .memory_max(memory_max)
+            .swap_max(swap_max)
+            .pids_max(pids_max)
+            .cpu_quota(cpu_quota)
+            .cpu_period(cpu_period)
+            .euid(status.uid)
+            .egid(status.gid)
+            .cap_effective(status.capabilities)
+            .no_new_privileges(status.no_new_privileges)
+            .seccomp_mode(status.seccomp)
+            .root_readonly(root_readonly)
+            .temporary(temporary)
+            .build())
+    })
+    .await
+    .map_err(|_| ProbeError::Deadline)?
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/endpoint.rs b/crates/rustack-lambda-runtime/src/probe/endpoint.rs
new file mode 100644
index 00000000..d7a3c208
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/endpoint.rs
@@ -0,0 +1,192 @@
+//! One container-origin HTTP(S) observation; all IO futures stay locally owned.
+
+pub(super) mod entropy;
+pub(super) mod types;
+
+use std::{env::consts::ARCH, sync::Arc};
+
+use bytes::{Bytes, BytesMut};
+use http::{
+    Request, StatusCode,
+    header::{CONNECTION, CONTENT_ENCODING, CONTENT_LENGTH, HOST},
+};
+use http_body_util::{BodyExt, Full};
+use hyper::client::conn::http1;
+use hyper_util::rt::TokioIo;
+use rustls::{
+    ClientConfig, RootCertStore, crypto::aws_lc_rs::default_provider, pki_types::ServerName,
+};
+use serde_json::from_slice;
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    net::TcpStream,
+    time::{Instant, timeout_at},
+};
+use tokio_rustls::TlsConnector;
+use tracing::instrument::WithSubscriber;
+use url::{Host, Url};
+use webpki_roots::TLS_SERVER_ROOTS;
+
+use self::types::{EndpointChallenge, EndpointReport, GATEWAY_PROBE_PATH, GatewayReply};
+use super::{ProbeError, REPORT_BYTES};
+use crate::{
+    diagnostics::runtime_dispatch,
+    protocol::{Architecture, AttemptId},
+};
+
+pub(super) async fn observe(
+    challenge: &EndpointChallenge,
+    attempt: AttemptId,
+    deadline: Instant,
+) -> Result<EndpointReport, ProbeError> {
+    let roots = RootCertStore {
+        roots: TLS_SERVER_ROOTS.to_vec(),
+    };
+    let observed = observe_with_roots(challenge, deadline, roots)
+        .with_subscriber(runtime_dispatch())
+        .await?;
+    let architecture = match ARCH {
+        "aarch64" => Architecture::Arm64,
+        "x86_64" => Architecture::X86_64,
+        _ => return Err(ProbeError::Configuration),
+    };
+    if Instant::now() >= deadline {
+        return Err(ProbeError::Deadline);
+    }
+    Ok(EndpointReport::observed(
+        attempt,
+        architecture,
+        observed.instance_id(),
+    ))
+}
+async fn observe_with_roots(
+    challenge: &EndpointChallenge,
+    deadline: Instant,
+    roots: RootCertStore,
+) -> Result<GatewayReply, ProbeError> {
+    let reply = timeout_at(deadline, async {
+        let url =
+            Url::parse(challenge.endpoint().as_str()).map_err(|_| ProbeError::Configuration)?;
+        let host = match url.host().ok_or(ProbeError::Configuration)? {
+            Host::Domain(name) => name.to_owned(),
+            Host::Ipv4(ip) => ip.to_string(),
+            Host::Ipv6(ip) => ip.to_string(),
+        };
+        let port = url
+            .port_or_known_default()
+            .ok_or(ProbeError::Configuration)?;
+        let wire_host = url.host_str().ok_or(ProbeError::Configuration)?;
+        let authority = match url.port() {
+            Some(port) => format!("{wire_host}:{port}"),
+            None => wire_host.to_owned(),
+        };
+        let stream = TcpStream::connect((host.as_str(), port)).await?;
+        if url.scheme() == "https" {
+            let name = ServerName::try_from(host).map_err(|_| ProbeError::Configuration)?;
+            let config = ClientConfig::builder_with_provider(Arc::new(default_provider()))
+                .with_safe_default_protocol_versions()
+                .map_err(|_| ProbeError::Tls)?
+                .with_root_certificates(roots)
+                .with_no_client_auth();
+            let connector = TlsConnector::from(Arc::new(config));
+            let stream = connector
+                .connect(name, stream)
+                .await
+                .map_err(|_| ProbeError::Tls)?;
+            exchange(stream, &authority).await
+        } else {
+            exchange(stream, &authority).await
+        }
+    })
+    .await
+    .map_err(|_| ProbeError::Deadline)??;
+    if Instant::now() >= deadline {
+        return Err(ProbeError::Deadline);
+    }
+    if reply.instance_id() != challenge.expected() {
+        return Err(ProbeError::Protocol);
+    }
+    Ok(reply)
+}
+async fn exchange<S: AsyncRead + AsyncWrite + Unpin>(
+    stream: S,
+    authority: &str,
+) -> Result<GatewayReply, ProbeError> {
+    let (mut sender, connection) = http1::Builder::new()
+        .max_headers(32)
+        .max_buf_size(16 * 1024)
+        .handshake(TokioIo::new(stream))
+        .await?;
+    let connection = connection.without_shutdown();
+    tokio::pin!(connection);
+    let mut ended = false;
+    let outcome = {
+        let operation = async {
+            let request = Request::builder()
+                .method("GET")
+                .uri(GATEWAY_PROBE_PATH)
+                .header(HOST, authority)
+                .header(CONNECTION, "close")
+                .header(CONTENT_LENGTH, 0)
+                .body(Full::new(Bytes::new()))
+                .map_err(|_| ProbeError::Protocol)?;
+            let response = sender.send_request(request).await?;
+            if response.status() != StatusCode::OK
+                || response.headers().contains_key(CONTENT_ENCODING)
+            {
+                return Err(ProbeError::Protocol);
+            }
+            let mut header_bytes = 0_usize;
+            for (name, value) in response.headers() {
+                header_bytes = header_bytes
+                    .checked_add(name.as_str().len())
+                    .and_then(|count| count.checked_add(value.as_bytes().len()))
+                    .ok_or(ProbeError::Protocol)?;
+            }
+            if header_bytes > 16 * 1024 {
+                return Err(ProbeError::Protocol);
+            }
+            let mut lengths = response.headers().get_all(CONTENT_LENGTH).iter();
+            if let Some(length) = lengths.next() {
+                if lengths.next().is_some()
+                    || length
+                        .to_str()
+                        .ok()
+                        .and_then(|value| value.parse::<usize>().ok())
+                        .is_none_or(|length| length > REPORT_BYTES)
+                {
+                    return Err(ProbeError::Protocol);
+                }
+            }
+            let mut body = response.into_body();
+            let mut bytes = BytesMut::new();
+            while let Some(frame) = body.frame().await {
+                let data = frame?.into_data().map_err(|_| ProbeError::Protocol)?;
+                if bytes
+                    .len()
+                    .checked_add(data.len())
+                    .is_none_or(|size| size > REPORT_BYTES)
+                {
+                    return Err(ProbeError::Protocol);
+                }
+                bytes.extend_from_slice(&data);
+            }
+            from_slice::<GatewayReply>(&bytes).map_err(|_| ProbeError::Protocol)
+        };
+        tokio::pin!(operation);
+        loop {
+            tokio::select! {biased;
+                result=&mut operation=>break result,
+                result=&mut connection,if !ended=>{drop(result?);ended=true;},
+            }
+        }
+    };
+    drop(sender);
+    if outcome.is_ok() && !ended {
+        drop(connection.await?);
+    }
+    outcome
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-runtime/src/probe/endpoint/entropy.rs b/crates/rustack-lambda-runtime/src/probe/endpoint/entropy.rs
new file mode 100644
index 00000000..b3978e3d
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/endpoint/entropy.rs
@@ -0,0 +1,152 @@
+//! Read-only OS entropy jobs retain bounded permits through observer loss/results.
+
+use std::time::Duration;
+
+use tokio::{
+    runtime::Handle,
+    sync::{Semaphore, SemaphorePermit},
+    task::{JoinHandle, spawn_blocking},
+    time::{Instant, timeout_at},
+};
+
+use super::types::GatewayInstanceId;
+use crate::probe::ProbeError;
+
+static WORKERS: Semaphore = Semaphore::const_new(4);
+type IdentityResult = (
+    Result<GatewayInstanceId, ProbeError>,
+    SemaphorePermit<'static>,
+);
+
+pub(super) async fn generate(deadline: Instant) -> Result<GatewayInstanceId, ProbeError> {
+    owned(deadline, &WORKERS, GatewayInstanceId::generate).await
+}
+async fn owned(
+    deadline: Instant,
+    pool: &'static Semaphore,
+    work: impl FnOnce() -> Result<GatewayInstanceId, ProbeError> + Send + 'static,
+) -> Result<GatewayInstanceId, ProbeError> {
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .filter(|value| !value.is_zero())
+        .ok_or(ProbeError::Deadline)?;
+    if remaining > Duration::from_secs(60) {
+        return Err(ProbeError::Configuration);
+    }
+    Handle::try_current().map_err(|_| ProbeError::Worker)?;
+    let permit = timeout_at(deadline, pool.acquire())
+        .await
+        .map_err(|_| ProbeError::Deadline)?
+        .map_err(|_| ProbeError::Worker)?;
+    let job = spawn_identity(permit, deadline, work);
+    // Expired/dropped observers discard their read-only result; the blocking job
+    // retains its physical permit until OS return and ready-result disposal.
+    let (result, _permit) = timeout_at(deadline, job)
+        .await
+        .map_err(|_| ProbeError::Deadline)?
+        .map_err(|_| ProbeError::Worker)?;
+    if Instant::now() >= deadline {
+        return Err(ProbeError::Deadline);
+    }
+    result
+}
+fn spawn_identity(
+    permit: SemaphorePermit<'static>,
+    deadline: Instant,
+    work: impl FnOnce() -> Result<GatewayInstanceId, ProbeError> + Send + 'static,
+) -> JoinHandle<IdentityResult> {
+    spawn_blocking(move || {
+        let result = if Instant::now() >= deadline {
+            Err(ProbeError::Deadline)
+        } else {
+            work()
+        };
+        let result = if Instant::now() >= deadline {
+            Err(ProbeError::Deadline)
+        } else {
+            result
+        };
+        (result, permit)
+    })
+}
+#[cfg(test)]
+mod tests {
+    use std::{sync::mpsc, time::Duration};
+
+    use tokio::{
+        spawn,
+        sync::{Semaphore, oneshot},
+        task::yield_now,
+        time::{Instant, timeout},
+    };
+
+    use super::{owned, spawn_identity};
+    use crate::probe::{GatewayInstanceId, ProbeError};
+    fn id() -> GatewayInstanceId {
+        "aaaaaaaa-1111-4111-8111-111111111111".parse().unwrap()
+    }
+    #[tokio::test]
+    async fn test_should_keep_entropy_work_charged_after_waiter_abandonment_and_queue_expiry() {
+        static POOL: Semaphore = Semaphore::const_new(1);
+        let (release, held) = mpsc::sync_channel(1);
+        let (entered, saw) = oneshot::channel();
+        let job = spawn(owned(
+            Instant::now() + Duration::from_secs(5),
+            &POOL,
+            move || {
+                entered.send(()).unwrap();
+                held.recv().unwrap();
+                Ok(id())
+            },
+        ));
+        saw.await.unwrap();
+        job.abort();
+        assert!(job.await.unwrap_err().is_cancelled());
+        assert_eq!(POOL.available_permits(), 0);
+        assert!(matches!(
+            owned(Instant::now() + Duration::from_millis(25), &POOL, || Ok(
+                id()
+            ))
+            .await,
+            Err(ProbeError::Deadline)
+        ));
+        assert_eq!(POOL.available_permits(), 0);
+        release.send(()).unwrap();
+        timeout(Duration::from_secs(2), async {
+            while POOL.available_permits() != 1 {
+                yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+    }
+    #[tokio::test]
+    async fn test_should_hold_ready_entropy_result_until_observed_and_reject_expired_budget() {
+        static POOL: Semaphore = Semaphore::const_new(1);
+        let job = spawn_identity(
+            POOL.acquire().await.unwrap(),
+            Instant::now() + Duration::from_secs(5),
+            || Ok(id()),
+        );
+        timeout(Duration::from_secs(2), async {
+            while !job.is_finished() {
+                yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+        assert_eq!(POOL.available_permits(), 0);
+        let (result, permit) = job.await.unwrap();
+        assert_eq!(result.unwrap(), id());
+        drop(permit);
+        assert_eq!(POOL.available_permits(), 1);
+        assert!(matches!(
+            owned(Instant::now(), &POOL, || Ok(id())).await,
+            Err(ProbeError::Deadline)
+        ));
+        assert!(matches!(
+            owned(Instant::now() + Duration::from_secs(61), &POOL, || Ok(id())).await,
+            Err(ProbeError::Configuration)
+        ));
+    }
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/endpoint/tests.rs b/crates/rustack-lambda-runtime/src/probe/endpoint/tests.rs
new file mode 100644
index 00000000..3460df92
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/endpoint/tests.rs
@@ -0,0 +1,190 @@
+use std::{io, time::Duration};
+
+use rstest::rstest;
+use rustls::RootCertStore;
+use serde_json::to_vec;
+use tokio::{
+    io::{AsyncRead, AsyncReadExt, AsyncWriteExt},
+    net::TcpListener,
+    spawn,
+    sync::oneshot,
+    task::JoinHandle,
+    time::{Instant, timeout},
+};
+
+use super::{
+    observe_with_roots,
+    types::{EndpointChallenge, GatewayInstanceId, GatewayReply},
+};
+use crate::probe::ProbeError;
+
+mod tls;
+
+async fn read_head<S: AsyncRead + Unpin>(stream: &mut S) -> io::Result<Vec<u8>> {
+    let mut bytes = Vec::new();
+    while bytes.len() < 8192 {
+        let byte = stream.read_u8().await?;
+        bytes.push(byte);
+        if bytes.ends_with(b"\r\n\r\n") {
+            return Ok(bytes);
+        }
+    }
+    Err(io::Error::other("fixture request exceeded bound"))
+}
+fn response(status: u16, body: &[u8], headers: &str) -> Vec<u8> {
+    let mut bytes = format!(
+        "HTTP/1.1 {status} Fixture\r\nContent-Length: {}\r\nConnection: close\r\n{headers}\r\n",
+        body.len()
+    )
+    .into_bytes();
+    bytes.extend_from_slice(body);
+    bytes
+}
+async fn fixture(
+    build: impl FnOnce(GatewayInstanceId) -> Vec<u8>,
+) -> (EndpointChallenge, JoinHandle<Vec<u8>>) {
+    let id = GatewayInstanceId::generate().unwrap();
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let endpoint = format!("http://{}", listener.local_addr().unwrap())
+        .parse()
+        .unwrap();
+    let reply = build(id);
+    let server = spawn(async move {
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let request = read_head(&mut stream).await.unwrap();
+        let _ = stream.write_all(&reply).await;
+        let _ = stream.shutdown().await;
+        request
+    });
+    (EndpointChallenge::new(endpoint, id), server)
+}
+async fn join(server: JoinHandle<Vec<u8>>) -> Vec<u8> {
+    timeout(Duration::from_secs(5), server)
+        .await
+        .unwrap()
+        .unwrap()
+}
+#[tokio::test]
+async fn test_should_observe_independent_instance_without_sending_expected_identity() {
+    let (challenge, server) =
+        fixture(|id| response(200, &to_vec(&GatewayReply::new(id)).unwrap(), "")).await;
+    let reply = observe_with_roots(
+        &challenge,
+        Instant::now() + Duration::from_secs(5),
+        RootCertStore::empty(),
+    )
+    .await
+    .unwrap();
+    assert_eq!(reply.instance_id(), challenge.expected());
+    let request = String::from_utf8(join(server).await).unwrap();
+    assert!(request.starts_with("GET /_rustack/runtime-probe HTTP/1.1\r\n"));
+    let id: String = challenge.expected().into();
+    assert!(!request.contains(&id));
+    assert!(request.to_ascii_lowercase().contains("connection: close"));
+}
+#[rstest]
+#[case::redirect(0)]
+#[case::wrong_instance(1)]
+#[case::unknown_field(2)]
+#[case::duplicate_field(3)]
+#[case::encoding(4)]
+#[case::unterminated(5)]
+#[case::wrong_version(6)]
+#[case::empty(7)]
+#[case::overlong_declared_body(8)]
+#[case::overlong_actual_body(9)]
+#[case::headers(10)]
+#[case::header_bytes(11)]
+#[case::trailers(12)]
+#[tokio::test]
+async fn test_should_reject_untrusted_gateway_responses_without_peer_text(#[case] case: u8) {
+    let (challenge,server)=fixture(|id|{
+        let id:String=id.into();
+        match case {
+            0=>response(302,b"PRIVATE-PEER","Location: http://127.0.0.1:1/\r\n"),
+            1=>response(200,&to_vec(&GatewayReply::new(GatewayInstanceId::generate().unwrap())).unwrap(),""),
+            2=>response(200,format!("{{\"version\":1,\"instanceId\":\"{id}\",\"PRIVATE-PEER\":1}}").as_bytes(),""),
+            3=>response(200,format!("{{\"version\":1,\"version\":1,\"instanceId\":\"{id}\"}}").as_bytes(),""),
+            4=>response(200,&to_vec(&GatewayReply::new(id.parse().unwrap())).unwrap(),"Content-Encoding: gzip\r\n"),
+            5=>b"HTTP/1.1 200 OK\r\nContent-Length: 100\r\nConnection: close\r\n\r\n{}".to_vec(),
+            6=>response(200,format!("{{\"version\":2,\"instanceId\":\"{id}\"}}").as_bytes(),""),
+            7=>response(200,b"",""),
+            8=>response(200,&vec![b'x';4097],""),
+            9=>{let mut bytes=b"HTTP/1.1 200 OK\r\nConnection: close\r\n\r\n".to_vec();bytes.extend_from_slice(&vec![b'x';4097]);bytes},
+            10=>response(200,b"{}",&"X-Fixture: x\r\n".repeat(33)),
+            11=>response(200,b"{}",&format!("X-Fixture: {}\r\n","x".repeat(16_385))),
+            _=>b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n2\r\n{}\r\n0\r\nPRIVATE-PEER: trailer\r\n\r\n".to_vec(),
+        }
+    }).await;
+    let error = observe_with_roots(
+        &challenge,
+        Instant::now() + Duration::from_secs(5),
+        RootCertStore::empty(),
+    )
+    .await
+    .unwrap_err();
+    assert!(!format!("{error:?}:{error}").contains("PRIVATE-PEER"));
+    join(server).await;
+}
+#[rstest]
+#[case::deadline(false)]
+#[case::abandonment(true)]
+#[tokio::test]
+async fn test_should_close_owned_http_io_on_expiry_or_abandoned_caller(#[case] abandon: bool) {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let challenge = EndpointChallenge::new(
+        format!("http://{}", listener.local_addr().unwrap())
+            .parse()
+            .unwrap(),
+        GatewayInstanceId::generate().unwrap(),
+    );
+    let (entered, saw) = oneshot::channel();
+    let server = spawn(async move {
+        let (mut stream, _) = listener.accept().await.unwrap();
+        read_head(&mut stream).await.unwrap();
+        entered.send(()).unwrap();
+        let mut byte = [0];
+        assert_eq!(stream.read(&mut byte).await.unwrap(), 0);
+    });
+    let client = spawn(async move {
+        observe_with_roots(
+            &challenge,
+            Instant::now() + Duration::from_secs(1),
+            RootCertStore::empty(),
+        )
+        .await
+    });
+    saw.await.unwrap();
+    if abandon {
+        client.abort();
+        assert!(client.await.unwrap_err().is_cancelled());
+    } else {
+        assert!(matches!(client.await.unwrap(), Err(ProbeError::Deadline)));
+    }
+    timeout(Duration::from_secs(3), server)
+        .await
+        .unwrap()
+        .unwrap();
+}
+#[tokio::test]
+async fn test_should_not_follow_a_redirect_to_another_listener() {
+    let other = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let target = other.local_addr().unwrap();
+    let (challenge, server) =
+        fixture(|_| response(302, b"", &format!("Location: http://{target}/\r\n"))).await;
+    assert!(
+        observe_with_roots(
+            &challenge,
+            Instant::now() + Duration::from_secs(5),
+            RootCertStore::empty()
+        )
+        .await
+        .is_err()
+    );
+    join(server).await;
+    assert!(
+        timeout(Duration::from_millis(50), other.accept())
+            .await
+            .is_err()
+    );
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/endpoint/tests/tls.rs b/crates/rustack-lambda-runtime/src/probe/endpoint/tests/tls.rs
new file mode 100644
index 00000000..145ae3e0
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/endpoint/tests/tls.rs
@@ -0,0 +1,121 @@
+use std::{sync::Arc, time::Duration};
+
+use rcgen::generate_simple_self_signed;
+use rstest::rstest;
+use rustls::{
+    RootCertStore, ServerConfig,
+    crypto::aws_lc_rs::default_provider,
+    pki_types::{PrivateKeyDer, PrivatePkcs8KeyDer},
+};
+use serde_json::to_vec;
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::TcpListener,
+    spawn,
+    sync::oneshot,
+    task::spawn_blocking,
+    time::{Instant, timeout},
+};
+use tokio_rustls::TlsAcceptor;
+
+use super::{read_head, response};
+use crate::probe::{
+    ProbeError,
+    endpoint::{
+        observe_with_roots,
+        types::{EndpointChallenge, GatewayInstanceId, GatewayReply},
+    },
+};
+
+#[rstest]
+#[case::valid(true, true)]
+#[case::untrusted(false, true)]
+#[case::wrong_name(true, false)]
+#[tokio::test]
+async fn test_should_verify_tls_ca_and_server_name_with_explicit_aws_lc(
+    #[case] trusted: bool,
+    #[case] named: bool,
+) {
+    let certificate = spawn_blocking(|| generate_simple_self_signed(vec!["localhost".into()]))
+        .await
+        .unwrap()
+        .unwrap();
+    let mut roots = RootCertStore::empty();
+    if trusted {
+        roots.add(certificate.cert.der().clone()).unwrap();
+    }
+    let key = PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(
+        certificate.signing_key.serialize_der(),
+    ));
+    let server_config = ServerConfig::builder_with_provider(Arc::new(default_provider()))
+        .with_safe_default_protocol_versions()
+        .unwrap()
+        .with_no_client_auth()
+        .with_single_cert(vec![certificate.cert.der().clone()], key)
+        .unwrap();
+    let acceptor = TlsAcceptor::from(Arc::new(server_config));
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let host = if named { "localhost" } else { "127.0.0.1" };
+    let id = GatewayInstanceId::generate().unwrap();
+    let challenge = EndpointChallenge::new(format!("https://{host}:{port}").parse().unwrap(), id);
+    let server = spawn(async move {
+        let (stream, _) = listener.accept().await.unwrap();
+        match acceptor.accept(stream).await {
+            Ok(mut stream) => {
+                let request = read_head(&mut stream).await.unwrap();
+                let _ = stream
+                    .write_all(&response(200, &to_vec(&GatewayReply::new(id)).unwrap(), ""))
+                    .await;
+                let _ = stream.shutdown().await;
+                Some(request)
+            }
+            Err(_) => None,
+        }
+    });
+    let result =
+        observe_with_roots(&challenge, Instant::now() + Duration::from_secs(5), roots).await;
+    let observed = timeout(Duration::from_secs(5), server)
+        .await
+        .unwrap()
+        .unwrap();
+    if trusted && named {
+        assert_eq!(result.unwrap().instance_id(), id);
+        assert!(observed.is_some());
+    } else {
+        assert!(matches!(result, Err(ProbeError::Tls)));
+        assert!(observed.is_none());
+    }
+}
+#[tokio::test]
+async fn test_should_close_owned_tls_handshake_on_deadline() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let challenge = EndpointChallenge::new(
+        format!("https://{}", listener.local_addr().unwrap())
+            .parse()
+            .unwrap(),
+        GatewayInstanceId::generate().unwrap(),
+    );
+    let (entered, saw) = oneshot::channel();
+    let server = spawn(async move {
+        let (stream, _) = listener.accept().await.unwrap();
+        entered.send(()).unwrap();
+        let mut bytes = Vec::new();
+        stream.take(65_537).read_to_end(&mut bytes).await.unwrap();
+        assert!(bytes.len() <= 65_536);
+    });
+    let client = spawn(async move {
+        observe_with_roots(
+            &challenge,
+            Instant::now() + Duration::from_secs(1),
+            RootCertStore::empty(),
+        )
+        .await
+    });
+    saw.await.unwrap();
+    assert!(matches!(client.await.unwrap(), Err(ProbeError::Deadline)));
+    timeout(Duration::from_secs(3), server)
+        .await
+        .unwrap()
+        .unwrap();
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/endpoint/types.rs b/crates/rustack-lambda-runtime/src/probe/endpoint/types.rs
new file mode 100644
index 00000000..8317301a
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/endpoint/types.rs
@@ -0,0 +1,285 @@
+//! Shared bounded data, deliberately separate from host-owned readiness receipts.
+
+use std::{fmt, str::FromStr};
+
+use getrandom::fill;
+use serde::{Deserialize, Deserializer, Serialize, de::Error};
+use serde_json::from_slice;
+use tokio::time::Instant;
+use url::Url;
+use uuid::{Builder, Uuid};
+
+use crate::{
+    probe::{ProbeError, REPORT_BYTES},
+    protocol::{Architecture, AttemptId},
+};
+
+/// Fixed admission-independent diagnostic route; no caller-selected path.
+pub const GATEWAY_PROBE_PATH: &str = "/_rustack/runtime-probe";
+
+/// Non-secret process identity; not authentication or a readiness capability.
+#[derive(Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+#[non_exhaustive]
+pub struct GatewayInstanceId(Uuid);
+impl fmt::Debug for GatewayInstanceId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("GatewayInstanceId(<redacted>)")
+    }
+}
+impl GatewayInstanceId {
+    /// Generate a fresh identity with OS randomness, without a panic/fallback.
+    ///
+    /// This can block on OS entropy. Use a blocking owner or call
+    /// [`Self::generate_owned`] from async startup.
+    /// # Errors
+    /// Returns a static entropy failure if the OS source is unavailable.
+    /// ```
+    /// let id=rustack_lambda_runtime::probe::GatewayInstanceId::generate()?;
+    /// # Ok::<(),rustack_lambda_runtime::probe::ProbeError>(())
+    /// ```
+    pub fn generate() -> Result<Self, ProbeError> {
+        let mut bytes = [0; 16];
+        fill(&mut bytes).map_err(|_| ProbeError::Entropy)?;
+        Ok(Self(Builder::from_random_bytes(bytes).into_uuid()))
+    }
+    /// Generate identity in bounded retained blocking work under one deadline.
+    /// # Errors
+    /// Rejects nonpositive/over60s budgets, queue expiry, entropy or worker failure.
+    /// Abandoned observers never publish a late identity or release a running slot.
+    /// ```no_run
+    /// # async fn id()->Result<(),rustack_lambda_runtime::probe::ProbeError>{
+    /// let id=rustack_lambda_runtime::probe::GatewayInstanceId::generate_owned(tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub async fn generate_owned(deadline: Instant) -> Result<Self, ProbeError> {
+        super::entropy::generate(deadline).await
+    }
+}
+impl FromStr for GatewayInstanceId {
+    type Err = ProbeError;
+    fn from_str(raw: &str) -> Result<Self, Self::Err> {
+        if raw.len() != 36 {
+            return Err(ProbeError::Configuration);
+        }
+        let id = Uuid::parse_str(raw).map_err(|_| ProbeError::Configuration)?;
+        if id.is_nil() || id.to_string() != raw {
+            return Err(ProbeError::Configuration);
+        }
+        Ok(Self(id))
+    }
+}
+impl TryFrom<String> for GatewayInstanceId {
+    type Error = ProbeError;
+    fn try_from(raw: String) -> Result<Self, Self::Error> {
+        raw.parse()
+    }
+}
+impl From<GatewayInstanceId> for String {
+    fn from(id: GatewayInstanceId) -> Self {
+        id.0.to_string()
+    }
+}
+/// Validated literal-root operator endpoint; parsing performs no network IO.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+#[non_exhaustive]
+pub struct GatewayEndpoint(String);
+impl fmt::Debug for GatewayEndpoint {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("GatewayEndpoint(<redacted>)")
+    }
+}
+impl FromStr for GatewayEndpoint {
+    type Err = ProbeError;
+    fn from_str(raw: &str) -> Result<Self, Self::Err> {
+        if raw.is_empty()
+            || raw.len() > 2048
+            || raw.chars().any(char::is_control)
+            || raw.bytes().any(|byte| byte.is_ascii_whitespace())
+            || raw.contains('\\')
+        {
+            return Err(ProbeError::Configuration);
+        }
+        let rest = raw
+            .split_once("://")
+            .map(|(_, rest)| rest)
+            .ok_or(ProbeError::Configuration)?;
+        let authority = rest
+            .split(['/', '?', '#'])
+            .next()
+            .ok_or(ProbeError::Configuration)?;
+        let tail = rest
+            .strip_prefix(authority)
+            .ok_or(ProbeError::Configuration)?;
+        if authority.contains('@') || !matches!(tail, "" | "/") {
+            return Err(ProbeError::Configuration);
+        }
+        let url = Url::parse(raw).map_err(|_| ProbeError::Configuration)?;
+        if !matches!(url.scheme(), "http" | "https")
+            || url.host_str().is_none()
+            || url.port() == Some(0)
+            || !url.username().is_empty()
+            || url.password().is_some()
+            || url.query().is_some()
+            || url.fragment().is_some()
+            || url.path() != "/"
+            || url.as_str().len() > 2048
+        {
+            return Err(ProbeError::Configuration);
+        }
+        Ok(Self(url.into()))
+    }
+}
+impl TryFrom<String> for GatewayEndpoint {
+    type Error = ProbeError;
+    fn try_from(raw: String) -> Result<Self, Self::Error> {
+        raw.parse()
+    }
+}
+impl From<GatewayEndpoint> for String {
+    fn from(endpoint: GatewayEndpoint) -> Self {
+        endpoint.0
+    }
+}
+impl GatewayEndpoint {
+    /// Canonical operator origin, excluding any caller request path.
+    /// ```
+    /// let endpoint:rustack_lambda_runtime::probe::GatewayEndpoint="http://localhost:4566".parse()?;
+    /// assert_eq!(endpoint.as_str(),"http://localhost:4566/");
+    /// # Ok::<(),rustack_lambda_runtime::probe::ProbeError>(())
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+fn version<'de, D: Deserializer<'de>>(deserializer: D) -> Result<u8, D::Error> {
+    let version = u8::deserialize(deserializer)?;
+    if version != 1 {
+        return Err(D::Error::custom("invalid probe schema"));
+    }
+    Ok(version)
+}
+/// Intentional public diagnostic data, never a readiness receipt.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct GatewayReply {
+    #[serde(deserialize_with = "version")]
+    version: u8,
+    instance_id: GatewayInstanceId,
+}
+impl GatewayReply {
+    /// Reply for the exact installed process identity.
+    /// ```
+    /// let reply=rustack_lambda_runtime::probe::GatewayReply::new(rustack_lambda_runtime::probe::GatewayInstanceId::generate()?);
+    /// # Ok::<(),rustack_lambda_runtime::probe::ProbeError>(())
+    /// ```
+    #[must_use]
+    pub fn new(instance_id: GatewayInstanceId) -> Self {
+        Self {
+            version: 1,
+            instance_id,
+        }
+    }
+    /// Observed independent process identity.
+    /// ```
+    /// let id=rustack_lambda_runtime::probe::GatewayInstanceId::generate()?;
+    /// assert_eq!(rustack_lambda_runtime::probe::GatewayReply::new(id).instance_id(),id);
+    /// # Ok::<(),rustack_lambda_runtime::probe::ProbeError>(())
+    /// ```
+    #[must_use]
+    pub fn instance_id(&self) -> GatewayInstanceId {
+        self.instance_id
+    }
+}
+/// Private Runtime API challenge; expected identity is never sent in gateway GET.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct EndpointChallenge {
+    #[serde(deserialize_with = "version")]
+    version: u8,
+    endpoint: GatewayEndpoint,
+    instance_id: GatewayInstanceId,
+}
+impl EndpointChallenge {
+    /// Capture already validated origin and expected instance.
+    /// ```
+    /// let challenge=rustack_lambda_runtime::probe::EndpointChallenge::new("http://localhost:4566".parse()?,rustack_lambda_runtime::probe::GatewayInstanceId::generate()?);
+    /// # Ok::<(),rustack_lambda_runtime::probe::ProbeError>(())
+    /// ```
+    #[must_use]
+    pub fn new(endpoint: GatewayEndpoint, instance_id: GatewayInstanceId) -> Self {
+        Self {
+            version: 1,
+            endpoint,
+            instance_id,
+        }
+    }
+    pub(in crate::probe) fn decode(bytes: &[u8]) -> Result<Self, ProbeError> {
+        if bytes.len() > REPORT_BYTES {
+            return Err(ProbeError::Protocol);
+        }
+        from_slice(bytes).map_err(|_| ProbeError::Protocol)
+    }
+    pub(in crate::probe) fn endpoint(&self) -> &GatewayEndpoint {
+        &self.endpoint
+    }
+    pub(in crate::probe) fn expected(&self) -> GatewayInstanceId {
+        self.instance_id
+    }
+}
+/// Untrusted report data; only the retained host owner can issue endpoint proof.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct EndpointReport {
+    #[serde(deserialize_with = "version")]
+    version: u8,
+    attempt: AttemptId,
+    architecture: Architecture,
+    instance_id: GatewayInstanceId,
+}
+impl EndpointReport {
+    pub(in crate::probe) fn observed(
+        attempt: AttemptId,
+        architecture: Architecture,
+        instance_id: GatewayInstanceId,
+    ) -> Self {
+        Self {
+            version: 1,
+            attempt,
+            architecture,
+            instance_id,
+        }
+    }
+    /// Consumed attempt to match against the host's actual invocation.
+    /// ```no_run
+    /// # fn inspect(r:&rustack_lambda_runtime::probe::EndpointReport){let attempt=r.attempt();}
+    /// ```
+    #[must_use]
+    pub fn attempt(&self) -> AttemptId {
+        self.attempt
+    }
+    /// Actual compiled probe architecture.
+    /// ```no_run
+    /// # fn inspect(r:&rustack_lambda_runtime::probe::EndpointReport){let architecture=r.architecture();}
+    /// ```
+    #[must_use]
+    pub fn architecture(&self) -> Architecture {
+        self.architecture
+    }
+    /// Independently observed gateway instance identity.
+    /// ```no_run
+    /// # fn inspect(r:&rustack_lambda_runtime::probe::EndpointReport){let id=r.instance_id();}
+    /// ```
+    #[must_use]
+    pub fn instance_id(&self) -> GatewayInstanceId {
+        self.instance_id
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-runtime/src/probe/endpoint/types/tests.rs b/crates/rustack-lambda-runtime/src/probe/endpoint/types/tests.rs
new file mode 100644
index 00000000..a6545d8f
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/endpoint/types/tests.rs
@@ -0,0 +1,68 @@
+use rstest::rstest;
+use serde_json::{from_str, json, to_string, to_vec};
+
+use super::{EndpointChallenge, EndpointReport, GatewayEndpoint, GatewayInstanceId, GatewayReply};
+
+#[rstest]
+#[case("")]
+#[case("00000000-0000-0000-0000-000000000000")]
+#[case("AAAAAAAA-1111-4111-8111-111111111111")]
+#[case("aaaaaaaa111141118111111111111111")]
+fn test_should_reject_noncanonical_or_nil_gateway_identity(#[case] raw: &str) {
+    assert!(raw.parse::<GatewayInstanceId>().is_err());
+}
+#[test]
+fn test_should_roundtrip_validated_identity_reply_and_challenge_without_debug_values() {
+    let id = GatewayInstanceId::generate().unwrap();
+    let raw: String = id.into();
+    assert_eq!(raw.parse::<GatewayInstanceId>().unwrap(), id);
+    let reply = GatewayReply::new(id);
+    let text = to_string(&reply).unwrap();
+    assert_eq!(from_str::<GatewayReply>(&text).unwrap(), reply);
+    assert!(!format!("{id:?}").contains(&raw));
+    let endpoint: GatewayEndpoint = "http://private-endpoint.example:4566".parse().unwrap();
+    let challenge = EndpointChallenge::new(endpoint, id);
+    let bytes = to_vec(&challenge).unwrap();
+    let decoded = EndpointChallenge::decode(&bytes).unwrap();
+    assert_eq!(decoded.expected(), id);
+    assert!(!format!("{decoded:?}").contains("private-endpoint"));
+}
+#[rstest]
+#[case(" http://localhost")]
+#[case("http://localhost ")]
+#[case("http://@localhost")]
+#[case("http://user:password@localhost")]
+#[case("http://localhost/a/..")]
+#[case("http://localhost/%2e")]
+#[case("http://localhost/?x")]
+#[case("http://localhost/#x")]
+#[case("http://localhost\\")]
+#[case("http://localhost:0")]
+#[case("ssh://localhost")]
+#[case("http:localhost")]
+fn test_should_reject_endpoint_rewrites_before_url_normalization(#[case] raw: &str) {
+    assert!(raw.parse::<GatewayEndpoint>().is_err());
+}
+#[test]
+fn test_should_reject_report_schema_identity_and_challenge_bounds() {
+    let id = GatewayInstanceId::generate().unwrap();
+    let id: String = id.into();
+    for text in [
+        format!("{{\"version\":0,\"instanceId\":\"{id}\"}}"),
+        format!("{{\"version\":1,\"instanceId\":\"{id}\",\"extra\":1}}"),
+        format!("{{\"version\":1,\"instanceId\":\"{id}\",\"instanceId\":\"{id}\"}}"),
+        format!("{{\"version\":1,\"instanceId\":\"{id}\"}} trailing"),
+    ] {
+        assert!(from_str::<GatewayReply>(&text).is_err());
+    }
+    assert!(EndpointChallenge::decode(&vec![b' '; 4097]).is_err());
+    assert!(
+        EndpointChallenge::decode(
+            to_vec(&json!({"version":1,"endpoint":"http://localhost/path","instanceId":id}))
+                .unwrap()
+                .as_slice()
+        )
+        .is_err()
+    );
+    assert!(from_str::<EndpointReport>(r#"{"version":2,"attempt":"00000000-0000-0000-0000-000000000000","architecture":"arm64","instanceId":"00000000-0000-0000-0000-000000000000"}"#).is_err());
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/mod.rs b/crates/rustack-lambda-runtime/src/probe/mod.rs
new file mode 100644
index 00000000..3ecad1fa
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/mod.rs
@@ -0,0 +1,168 @@
+//! Typed bounded kernel observations; qualification belongs to the host owner.
+
+#[cfg(unix)]
+mod client;
+#[cfg(unix)]
+mod collect;
+mod endpoint;
+#[cfg(any(unix, test))]
+mod parse;
+
+use std::{fmt, io, sync::Arc};
+
+pub use endpoint::types::{
+    EndpointChallenge, EndpointReport, GATEWAY_PROBE_PATH, GatewayEndpoint, GatewayInstanceId,
+    GatewayReply,
+};
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+use typed_builder::TypedBuilder;
+
+use crate::protocol::{Architecture, AttemptId};
+
+/// Maximum encoded resource report/challenge response size.
+pub const REPORT_BYTES: usize = 4096;
+
+/// Static probe errors never display kernel text or filesystem paths.
+#[derive(Clone, Error)]
+#[non_exhaustive]
+pub enum ProbeError {
+    /// No runtime or retained probe worker failed to join.
+    #[error("runtime probe worker failed")]
+    Worker,
+    /// The OS randomness source failed; no identity fallback is generated.
+    #[error("runtime probe entropy failed")]
+    Entropy,
+    /// TLS configuration or certificate/name verification failed; peer text is discarded.
+    #[error("runtime probe TLS failed")]
+    Tls,
+    /// Unsupported platform, arguments or private API configuration.
+    #[error("invalid runtime probe configuration")]
+    Configuration,
+    /// Incomplete, duplicate, malformed or unsupported kernel observations.
+    #[error("invalid runtime probe observation")]
+    Observation,
+    /// The private API protocol/challenge did not match.
+    #[error("invalid runtime probe protocol")]
+    Protocol,
+    /// Absolute collection/request budget expired.
+    #[error("runtime probe deadline exceeded")]
+    Deadline,
+    /// Fixed local kernel/API IO failed.
+    #[error("runtime probe IO failed")]
+    Io(#[source] Arc<io::Error>),
+    /// Private Runtime API HTTP failed.
+    #[error("runtime probe HTTP failed")]
+    Http(#[source] Arc<hyper::Error>),
+    /// Typed report serialization failed.
+    #[error("runtime probe report failed")]
+    Report(#[source] Arc<serde_json::Error>),
+}
+impl fmt::Debug for ProbeError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl From<io::Error> for ProbeError {
+    fn from(error: io::Error) -> Self {
+        Self::Io(Arc::new(error))
+    }
+}
+impl From<hyper::Error> for ProbeError {
+    fn from(error: hyper::Error) -> Self {
+        Self::Http(Arc::new(error))
+    }
+}
+
+/// Observed container-local temporary filesystem, without mount source text.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, TypedBuilder)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct TemporaryReport {
+    /// Kernel-reported tmpfs size in bytes.
+    pub bytes: u64,
+    /// Actual permission/special mode bits.
+    pub mode: u32,
+    /// The mount filesystem is tmpfs.
+    pub tmpfs: bool,
+    /// The effective mount disallows setuid transitions.
+    pub nosuid: bool,
+    /// The effective mount disallows device interpretation.
+    pub nodev: bool,
+}
+
+/// Finite/unlimited normalized controller and process observations.
+///
+/// A deserialized report is untrusted data, never a readiness capability.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, TypedBuilder)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct ResourceReport {
+    /// Report schema, currently1.
+    pub version: u8,
+    /// Consumed Runtime API attempt identity.
+    pub attempt: AttemptId,
+    /// Actual compiled Linux architecture.
+    pub architecture: Architecture,
+    /// Required controller memberships are rooted in this private namespace.
+    pub cgroup_root: bool,
+    /// Observed memory controller value; textual unlimited becomes None. Numeric
+    /// v1 unlimited sentinels retain their numeric value and cannot qualify.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub memory_max: Option<u64>,
+    /// Observed extra swap cap; textual unlimited becomes None.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub swap_max: Option<u64>,
+    /// Process/thread hard cap; None means unlimited.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pids_max: Option<u64>,
+    /// CPU time quota in microseconds; None means unlimited.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cpu_quota: Option<u64>,
+    /// CPU scheduling period in microseconds.
+    pub cpu_period: u64,
+    /// Effective UID observed from proc status.
+    pub euid: u32,
+    /// Effective GID observed from proc status.
+    pub egid: u32,
+    /// Effective Linux capability bitmask.
+    pub cap_effective: u64,
+    /// Actual `no_new_privs` flag.
+    pub no_new_privileges: bool,
+    /// Actual seccomp mode (2 means filter mode).
+    pub seccomp_mode: u8,
+    /// Root's effective mount flags include read-only.
+    pub root_readonly: bool,
+    /// Actual /tmp mount observation.
+    pub temporary: TemporaryReport,
+}
+
+/// Run one private Linux probe challenge, then wait for host-owned retirement.
+///
+/// # Errors
+/// Rejects non-Linux execution, any endpoint other than fixed loopback9001,
+/// malformed challenges, expired budgets and failed kernel/API observations.
+///
+/// ```no_run
+/// # #[cfg(unix)] async fn probe() {
+/// let outcome = rustack_lambda_runtime::probe::run().await;
+/// # }
+/// ```
+#[cfg(unix)]
+pub async fn run() -> Result<(), ProbeError> {
+    client::run().await
+}
+
+/// Run one pinned gateway probe from the actual function network.
+/// # Errors
+/// Rejects invalid private challenges, unreachable/wrong endpoints, TLS/protocol
+/// failure or expiry. The host owns physical function retirement.
+/// ```no_run
+/// # #[cfg(unix)] async fn probe(){
+/// let result=rustack_lambda_runtime::probe::run_endpoint().await;
+/// # }
+/// ```
+#[cfg(unix)]
+pub async fn run_endpoint() -> Result<(), ProbeError> {
+    client::run_endpoint().await
+}
diff --git a/crates/rustack-lambda-runtime/src/probe/parse.rs b/crates/rustack-lambda-runtime/src/probe/parse.rs
new file mode 100644
index 00000000..747d2424
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/parse.rs
@@ -0,0 +1,214 @@
+//! Checked parsers over fixed, bounded kernel text; no paths are derived from it.
+
+use super::{ProbeError, TemporaryReport};
+
+pub(super) fn number(value: &str) -> Result<u64, ProbeError> {
+    let value = value.trim();
+    if value.is_empty() || value.len() > 20 || !value.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err(ProbeError::Observation);
+    }
+    value.parse().map_err(|_| ProbeError::Observation)
+}
+pub(super) fn limit(value: &str) -> Result<Option<u64>, ProbeError> {
+    if matches!(value.trim(), "max" | "-1") {
+        Ok(None)
+    } else {
+        number(value).map(Some)
+    }
+}
+pub(super) fn cpu(value: &str) -> Result<(Option<u64>, u64), ProbeError> {
+    let mut fields = value.split_ascii_whitespace();
+    let quota = limit(fields.next().ok_or(ProbeError::Observation)?)?;
+    let period = number(fields.next().ok_or(ProbeError::Observation)?)?;
+    if fields.next().is_some() {
+        return Err(ProbeError::Observation);
+    }
+    Ok((quota, period))
+}
+pub(super) struct Status {
+    pub(super) uid: u32,
+    pub(super) gid: u32,
+    pub(super) capabilities: u64,
+    pub(super) no_new_privileges: bool,
+    pub(super) seccomp: u8,
+}
+pub(super) fn status(text: &str) -> Result<Status, ProbeError> {
+    bounded(text)?;
+    let field = |key: &str| -> Result<&str, ProbeError> {
+        let mut matching = text
+            .lines()
+            .filter_map(|line| line.split_once(':'))
+            .filter(|(name, _)| *name == key)
+            .map(|(_, value)| value.trim());
+        let value = matching.next().ok_or(ProbeError::Observation)?;
+        if matching.next().is_some() {
+            return Err(ProbeError::Observation);
+        }
+        Ok(value)
+    };
+    let effective = |text: &str| -> Result<u32, ProbeError> {
+        let mut fields = text.split_ascii_whitespace();
+        let mut ids = [0_u32; 4];
+        for id in &mut ids {
+            *id = u32::try_from(number(fields.next().ok_or(ProbeError::Observation)?)?)
+                .map_err(|_| ProbeError::Observation)?;
+        }
+        if fields.next().is_some() {
+            return Err(ProbeError::Observation);
+        }
+        let [_, effective, _, _] = ids;
+        Ok(effective)
+    };
+    let cap = field("CapEff")?;
+    if cap.len() != 16 || !cap.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return Err(ProbeError::Observation);
+    }
+    let no_new_privileges = match field("NoNewPrivs")? {
+        "0" => false,
+        "1" => true,
+        _ => return Err(ProbeError::Observation),
+    };
+    Ok(Status {
+        uid: effective(field("Uid")?)?,
+        gid: effective(field("Gid")?)?,
+        capabilities: u64::from_str_radix(cap, 16).map_err(|_| ProbeError::Observation)?,
+        no_new_privileges,
+        seccomp: u8::try_from(number(field("Seccomp")?)?).map_err(|_| ProbeError::Observation)?,
+    })
+}
+fn bounded(text: &str) -> Result<(), ProbeError> {
+    if text.len() > 65536
+        || text.lines().count() > 512
+        || text.lines().any(|line| line.len() > 4096)
+    {
+        Err(ProbeError::Observation)
+    } else {
+        Ok(())
+    }
+}
+pub(super) fn membership(text: &str, unified: bool) -> Result<bool, ProbeError> {
+    bounded(text)?;
+    let mut v2 = None;
+    let mut required = [None; 3];
+    for line in text.lines() {
+        let mut fields = line.splitn(3, ':');
+        let id = number(fields.next().ok_or(ProbeError::Observation)?)?;
+        u32::try_from(id).map_err(|_| ProbeError::Observation)?;
+        let controllers = fields.next().ok_or(ProbeError::Observation)?;
+        let path = fields.next().ok_or(ProbeError::Observation)?;
+        if controllers.len() > 256 || controllers.split(',').count() > 32 || path.is_empty() {
+            return Err(ProbeError::Observation);
+        }
+        if controllers.is_empty() {
+            if id != 0 {
+                return Err(ProbeError::Observation);
+            }
+            if v2.replace(path == "/").is_some() {
+                return Err(ProbeError::Observation);
+            }
+        } else if !unified {
+            if id == 0 {
+                return Err(ProbeError::Observation);
+            }
+            for controller in controllers.split(',') {
+                let slot = match controller {
+                    "memory" => required.get_mut(0),
+                    "pids" => required.get_mut(1),
+                    "cpu" => required.get_mut(2),
+                    _ => None,
+                };
+                if let Some(slot) = slot {
+                    if slot.replace(path == "/").is_some() {
+                        return Err(ProbeError::Observation);
+                    }
+                }
+            }
+        }
+    }
+    if unified {
+        v2.ok_or(ProbeError::Observation)
+    } else {
+        if required.iter().any(Option::is_none) {
+            return Err(ProbeError::Observation);
+        }
+        Ok(required.iter().all(|value| *value == Some(true)))
+    }
+}
+fn size(value: &str) -> Result<u64, ProbeError> {
+    let (digits, scale) = match value.as_bytes().last() {
+        Some(b'k') => (
+            value.strip_suffix('k').ok_or(ProbeError::Observation)?,
+            1024,
+        ),
+        Some(b'm') => (
+            value.strip_suffix('m').ok_or(ProbeError::Observation)?,
+            1024 * 1024,
+        ),
+        Some(b'g') => (
+            value.strip_suffix('g').ok_or(ProbeError::Observation)?,
+            1024 * 1024 * 1024,
+        ),
+        _ => (value, 1),
+    };
+    number(digits)?
+        .checked_mul(scale)
+        .ok_or(ProbeError::Observation)
+}
+pub(super) fn mounts(text: &str, mode: u32) -> Result<(bool, TemporaryReport), ProbeError> {
+    bounded(text)?;
+    let mut root = None;
+    let mut temporary = None;
+    for line in text.lines() {
+        let mut fields = line.split_ascii_whitespace();
+        for _ in 0..4 {
+            fields.next().ok_or(ProbeError::Observation)?;
+        }
+        let target = fields.next().ok_or(ProbeError::Observation)?;
+        let options = fields.next().ok_or(ProbeError::Observation)?;
+        if !matches!(target, "/" | "/tmp") {
+            continue;
+        }
+        if !fields.by_ref().any(|field| field == "-") {
+            return Err(ProbeError::Observation);
+        }
+        let filesystem = fields.next().ok_or(ProbeError::Observation)?;
+        fields.next().ok_or(ProbeError::Observation)?;
+        let super_options = fields.next().ok_or(ProbeError::Observation)?;
+        if fields.next().is_some() {
+            return Err(ProbeError::Observation);
+        }
+        if target == "/" {
+            if root
+                .replace(options.split(',').any(|v| v == "ro"))
+                .is_some()
+            {
+                return Err(ProbeError::Observation);
+            }
+        } else {
+            let mut sizes = super_options
+                .split(',')
+                .filter_map(|v| v.strip_prefix("size="));
+            let bytes = size(sizes.next().ok_or(ProbeError::Observation)?)?;
+            if sizes.next().is_some() {
+                return Err(ProbeError::Observation);
+            }
+            let observed = TemporaryReport::builder()
+                .bytes(bytes)
+                .mode(mode)
+                .tmpfs(filesystem == "tmpfs")
+                .nosuid(options.split(',').any(|v| v == "nosuid"))
+                .nodev(options.split(',').any(|v| v == "nodev"))
+                .build();
+            if temporary.replace(observed).is_some() {
+                return Err(ProbeError::Observation);
+            }
+        }
+    }
+    Ok((
+        root.ok_or(ProbeError::Observation)?,
+        temporary.ok_or(ProbeError::Observation)?,
+    ))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-runtime/src/probe/parse/tests.rs b/crates/rustack-lambda-runtime/src/probe/parse/tests.rs
new file mode 100644
index 00000000..93969eeb
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/probe/parse/tests.rs
@@ -0,0 +1,83 @@
+use super::*;
+
+const STATUS: &str = "Uid:\t1000 1001 1000 1000\nGid:\t1000 1002 1000 \
+                      1000\nCapEff:\t0000000000000000\nNoNewPrivs:\t1\nSeccomp:\t2\n";
+const MOUNTS: &str = "1 0 0:1 / / ro,relatime - overlay overlay rw\n2 1 0:2 / /tmp \
+                      rw,nosuid,nodev,relatime - tmpfs tmpfs rw,size=524288k,inode64\n";
+#[test]
+fn test_should_parse_independent_kernel_observation_fixtures() {
+    let report = status(STATUS).unwrap();
+    assert_eq!((report.uid, report.gid), (1001, 1002));
+    assert_eq!(report.capabilities, 0);
+    assert!(report.no_new_privileges);
+    assert_eq!(report.seccomp, 2);
+    let (root, tmp) = mounts(MOUNTS, 0o1777).unwrap();
+    assert!(root);
+    assert_eq!((tmp.bytes, tmp.mode), (512 * 1024 * 1024, 0o1777));
+    assert!(tmp.tmpfs && tmp.nosuid && tmp.nodev);
+    assert_eq!(cpu("100000 100000\n").unwrap(), (Some(100_000), 100_000));
+    assert_eq!(cpu("max 100000").unwrap(), (None, 100_000));
+    assert_eq!(limit("-1").unwrap(), None);
+    assert_eq!(
+        limit("9223372036854771712").unwrap(),
+        Some(9_223_372_036_854_771_712)
+    );
+}
+#[rstest::rstest]
+#[case::empty("")]
+#[case::overflow("18446744073709551616")]
+#[case::negative("-2")]
+#[case::fraction("1.0")]
+#[case::nonascii("١")]
+#[case::multiple("1 2")]
+#[test]
+fn test_should_reject_invalid_kernel_numbers(#[case] value: &str) {
+    assert!(number(value).is_err());
+}
+#[rstest::rstest]
+#[case::missing("Seccomp:\t2\n", "")]
+#[case::duplicate("Seccomp:\t2\n", "Seccomp:\t2\nSeccomp:\t2\n")]
+#[case::short_uid("1000 1001 1000 1000", "1000 1001 1000")]
+#[case::long_uid("1000 1001 1000 1000", "1000 1001 1000 1000 1000")]
+#[case::uid_overflow("1000 1001 1000 1000", "1000 4294967296 1000 1000")]
+#[case::bad_privilege("NoNewPrivs:\t1", "NoNewPrivs:\t2")]
+#[case::bad_cap("0000000000000000", "00000000000000zz")]
+#[test]
+fn test_should_reject_missing_duplicate_or_invalid_process_status(
+    #[case] before: &str,
+    #[case] after: &str,
+) {
+    assert!(status(&STATUS.replace(before, after)).is_err());
+}
+#[rstest::rstest]
+#[case::missing(
+    "2 1 0:2 / /tmp rw,nosuid,nodev,relatime - tmpfs tmpfs rw,size=524288k,inode64\n",
+    ""
+)]
+#[case::size("size=524288k", "size=18446744073709551615g")]
+#[case::duplicate_size("size=524288k", "size=524288k,size=1")]
+#[case::missing_separator(" - tmpfs", " tmpfs")]
+#[test]
+fn test_should_reject_incomplete_or_overflowing_mounts(#[case] before: &str, #[case] after: &str) {
+    assert!(mounts(&MOUNTS.replace(before, after), 0o1777).is_err());
+}
+#[test]
+fn test_should_bound_lines_and_reject_duplicate_root_or_temporary_mounts() {
+    assert!(status(&"x".repeat(65537)).is_err());
+    assert!(status(&format!("{STATUS}{}", "x\n".repeat(513))).is_err());
+    assert!(mounts(&format!("{MOUNTS}{MOUNTS}"), 0o1777).is_err());
+    assert!(cpu("1 2 3").is_err());
+}
+
+#[test]
+fn test_should_require_current_controller_membership_at_namespace_root() {
+    assert!(membership("0::/\n", true).unwrap());
+    assert!(!membership("0::/docker/foreign\n", true).unwrap());
+    let v1 = "2:memory:/\n3:pids:/\n4:cpu,cpuacct:/\n5:name=systemd:/unrelated\n";
+    assert!(membership(v1, false).unwrap());
+    assert!(!membership(&v1.replace("memory:/", "memory:/docker/current"), false).unwrap());
+    assert!(membership(&v1.replace("2:memory:/\n", ""), false).is_err());
+    assert!(membership(&format!("{v1}9:memory:/\n"), false).is_err());
+    assert!(membership("0::/\n0::/\n", true).is_err());
+    assert!(membership("1::/\n", true).is_err());
+}
diff --git a/crates/rustack-lambda-runtime/src/process.rs b/crates/rustack-lambda-runtime/src/process.rs
new file mode 100644
index 00000000..964c801e
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/process.rs
@@ -0,0 +1,84 @@
+//! Linux process wiring with nonblocking owned pipe descriptors.
+
+use std::{
+    env,
+    io::{stdin, stdout},
+    os::fd::AsFd,
+    time::Duration,
+};
+
+use rustack_lambda_runtime::{
+    http::start_at,
+    protocol::{Architecture, EnvironmentId},
+    relay::{RelayConfig, RelayError, start},
+};
+use tokio::net::unix::pipe::{Receiver, Sender};
+
+fn seconds(key: &str, default: u64, maximum: u64) -> Result<Duration, RelayError> {
+    let value = match env::var(key) {
+        Ok(value) => {
+            if value.len() > 5 || !value.bytes().all(|byte| byte.is_ascii_digit()) {
+                return Err(RelayError::Configuration);
+            }
+            let parsed = value
+                .parse::<u64>()
+                .map_err(|_| RelayError::Configuration)?;
+            if parsed.to_string() != value {
+                return Err(RelayError::Configuration);
+            }
+            parsed
+        }
+        Err(env::VarError::NotPresent) => default,
+        Err(_) => return Err(RelayError::Configuration),
+    };
+    if value == 0 || value > maximum {
+        return Err(RelayError::Configuration);
+    }
+    Ok(Duration::from_secs(value))
+}
+
+/// Run the private Linux relay process.
+pub(crate) async fn run() -> Result<(), RelayError> {
+    let mut arguments = env::args_os();
+    arguments.next();
+    match arguments.next() {
+        None => {}
+        Some(command) if command == "probe" && arguments.next().is_none() => {
+            return rustack_lambda_runtime::probe::run()
+                .await
+                .map_err(|_| RelayError::Configuration);
+        }
+        Some(command) if command == "endpoint-probe" && arguments.next().is_none() => {
+            return rustack_lambda_runtime::probe::run_endpoint()
+                .await
+                .map_err(|_| RelayError::Configuration);
+        }
+        Some(_) => return Err(RelayError::Configuration),
+    }
+    let environment =
+        env::var("RUSTACK_LAMBDA_ENVIRONMENT_ID").map_err(|_| RelayError::Configuration)?;
+    if environment.len() != 36 {
+        return Err(RelayError::Configuration);
+    }
+    let environment: EnvironmentId = environment.parse().map_err(|_| RelayError::Configuration)?;
+    let architecture = match env::consts::ARCH {
+        "x86_64" => Architecture::X86_64,
+        "aarch64" => Architecture::Arm64,
+        _ => return Err(RelayError::UnsupportedPlatform),
+    };
+    let idle = seconds("RUSTACK_LAMBDA_RELAY_IDLE_SECONDS", 600, 86_400)?;
+    let io = seconds("RUSTACK_LAMBDA_RELAY_IO_SECONDS", 5, 60)?;
+    let retirement = seconds("RUSTACK_LAMBDA_RELAY_RETIRE_SECONDS", 10, 60)?;
+    let config = RelayConfig::new(environment, architecture, idle, io, retirement)?;
+    let input = Receiver::from_owned_fd(stdin().as_fd().try_clone_to_owned()?)?;
+    let output = Sender::from_owned_fd(stdout().as_fd().try_clone_to_owned()?)?;
+    let api = start_at(
+        "127.0.0.1:9001"
+            .parse()
+            .map_err(|_| RelayError::Configuration)?,
+        idle,
+    )
+    .await?;
+    let mut relay = start(api, config, input, output)?;
+    relay.wait().await
+}
diff --git a/crates/rustack-lambda-runtime/src/protocol/mod.rs b/crates/rustack-lambda-runtime/src/protocol/mod.rs
new file mode 100644
index 00000000..45f772e3
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/protocol/mod.rs
@@ -0,0 +1,273 @@
+//! Length-prefixed, bounded CBOR for one environment's attach connection.
+//!
+//! A partial read/write failure invalidates the connection. Callers own the IO
+//! task and must retire that transport rather than retrying a partially read
+//! frame or replaying an invocation.
+
+mod preflight;
+#[cfg(test)]
+mod tests;
+mod types;
+
+use std::{io, num::TryFromIntError};
+
+use bytes::Bytes;
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+use tokio::{
+    io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt},
+    time::{Instant, timeout_at},
+};
+pub use types::{
+    Acknowledgement, Architecture, AttemptId, EnvironmentId, FunctionArn, HandlerTimeout, Message,
+    Outcome, Payload, TraceId,
+};
+
+/// Maximum event or result payload, in bytes.
+pub const MAX_PAYLOAD_BYTES: usize = 6 * 1024 * 1024;
+/// Maximum CBOR envelope metadata, excluding raw payload bytes.
+pub const MAX_METADATA_BYTES: usize = 64 * 1024;
+/// Maximum frame body, excluding its four-byte prefix.
+pub const MAX_FRAME_BYTES: usize = MAX_PAYLOAD_BYTES + MAX_METADATA_BYTES;
+/// Host/relay contract version; older relays cannot enforce delivery-based timeouts.
+pub const PROTOCOL_VERSION: u32 = 2;
+
+/// Protocol failures contain classes and IO sources, never invalid peer values.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum ProtocolError {
+    /// A declared/allotted length exceeds a protocol budget.
+    #[error("control protocol size budget exceeded")]
+    TooLarge,
+    /// The byte structure is invalid, unsupported, duplicated or truncated.
+    #[error("invalid control CBOR structure")]
+    InvalidStructure,
+    /// The valid CBOR does not match the typed message schema.
+    #[error("invalid control message schema")]
+    InvalidSchema,
+    /// An incompatible host/relay version was supplied.
+    #[error("unsupported control protocol version")]
+    UnsupportedVersion,
+    /// A validated primitive has invalid syntax or range.
+    #[error("invalid control metadata")]
+    InvalidMetadata,
+    /// IO failed, including truncated transport input.
+    #[error("control transport IO failed")]
+    Io(#[from] io::Error),
+    /// An absolute IO deadline expired; the transport must be retired.
+    #[error("control transport deadline exceeded")]
+    Deadline,
+}
+
+impl From<TryFromIntError> for ProtocolError {
+    fn from(_: TryFromIntError) -> Self {
+        Self::TooLarge
+    }
+}
+
+/// A validated, environment-scoped control envelope.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", try_from = "RawFrame")]
+#[non_exhaustive]
+pub struct Frame {
+    version: u32,
+    environment: EnvironmentId,
+    message: Message,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct RawFrame {
+    version: u32,
+    environment: EnvironmentId,
+    message: Message,
+}
+
+impl TryFrom<RawFrame> for Frame {
+    type Error = ProtocolError;
+
+    fn try_from(raw: RawFrame) -> Result<Self, Self::Error> {
+        if raw.version != PROTOCOL_VERSION {
+            return Err(ProtocolError::UnsupportedVersion);
+        }
+        Ok(Self::new(raw.environment, raw.message))
+    }
+}
+
+impl Frame {
+    /// Wrap a typed message in the current protocol version.
+    ///
+    /// ```
+    /// use rustack_lambda_runtime::protocol::{EnvironmentId, Frame, Message};
+    /// let frame = Frame::new(EnvironmentId::default(), Message::Ready);
+    /// assert_eq!(frame.message(), &Message::Ready);
+    /// ```
+    #[must_use]
+    pub fn new(environment: EnvironmentId, message: Message) -> Self {
+        Self {
+            version: PROTOCOL_VERSION,
+            environment,
+            message,
+        }
+    }
+
+    /// Identity that must match the connection's owned environment.
+    ///
+    /// ```
+    /// # use rustack_lambda_runtime::protocol::{EnvironmentId, Frame, Message};
+    /// let id = EnvironmentId::default();
+    /// assert_eq!(Frame::new(id, Message::Close).environment(), id);
+    /// ```
+    #[must_use]
+    pub fn environment(&self) -> EnvironmentId {
+        self.environment
+    }
+
+    /// Borrow the typed message without cloning its payload.
+    ///
+    /// ```
+    /// # use rustack_lambda_runtime::protocol::{EnvironmentId, Frame, Message};
+    /// let frame = Frame::new(EnvironmentId::default(), Message::Close);
+    /// assert!(matches!(frame.message(), Message::Close));
+    /// ```
+    #[must_use]
+    pub fn message(&self) -> &Message {
+        &self.message
+    }
+
+    /// Move the message into the owning session or transport actor.
+    ///
+    /// ```
+    /// # use rustack_lambda_runtime::protocol::{EnvironmentId, Frame, Message};
+    /// let frame = Frame::new(EnvironmentId::default(), Message::Close);
+    /// assert_eq!(frame.into_message(), Message::Close);
+    /// ```
+    #[must_use]
+    pub fn into_message(self) -> Message {
+        self.message
+    }
+}
+
+/// Encode one complete frame, including the big-endian length prefix.
+///
+/// # Errors
+/// Rejects excessive metadata or an encoding/size failure.
+///
+/// ```
+/// # use rustack_lambda_runtime::protocol::{EnvironmentId, Frame, Message, encode};
+/// let bytes = encode(&Frame::new(EnvironmentId::default(), Message::Ready))?;
+/// assert!(bytes.len() > 4);
+/// # Ok::<(), rustack_lambda_runtime::protocol::ProtocolError>(())
+/// ```
+pub fn encode(frame: &Frame) -> Result<Bytes, ProtocolError> {
+    let mut output = vec![0; 4];
+    ciborium::into_writer(frame, &mut output).map_err(|_| ProtocolError::InvalidSchema)?;
+    let body = output.get(4..).ok_or(ProtocolError::InvalidStructure)?;
+    preflight::validate(body)?;
+    let length = u32::try_from(body.len())?.to_be_bytes();
+    output
+        .get_mut(..4)
+        .ok_or(ProtocolError::InvalidStructure)?
+        .copy_from_slice(&length);
+    Ok(Bytes::from(output))
+}
+
+/// Decode one bounded frame body, without its length prefix.
+///
+/// # Errors
+/// Rejects malformed CBOR, unsupported schema/version or invalid metadata.
+/// No untrusted text is included in the returned error.
+///
+/// ```
+/// use rustack_lambda_runtime::protocol::decode;
+/// assert!(decode(&[]).is_err());
+/// ```
+pub fn decode(body: &[u8]) -> Result<Frame, ProtocolError> {
+    preflight::validate(body)?;
+    let raw: RawFrame = ciborium::from_reader(body).map_err(|_| ProtocolError::InvalidSchema)?;
+    Frame::try_from(raw)
+}
+
+/// Read a frame under one absolute deadline; None denotes clean boundary EOF.
+///
+/// # Errors
+/// Returns IO/truncation, deadline or protocol validation errors. A failed or
+/// cancelled read invalidates the connection, including any consumed prefix.
+///
+/// ```no_run
+/// # async fn read(mut input: impl tokio::io::AsyncRead + Unpin) -> Result<(), rustack_lambda_runtime::protocol::ProtocolError> {
+/// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(5);
+/// let frame = rustack_lambda_runtime::protocol::read_frame(&mut input, deadline).await?;
+/// # Ok(()) }
+/// ```
+pub async fn read_frame<R: AsyncRead + Unpin>(
+    reader: &mut R,
+    deadline: Instant,
+) -> Result<Option<Frame>, ProtocolError> {
+    if Instant::now() >= deadline {
+        return Err(ProtocolError::Deadline);
+    }
+    let frame = timeout_at(deadline, async {
+        let mut prefix = [0; 4];
+        let count = reader.read(&mut prefix).await?;
+        if count == 0 {
+            return Ok(None);
+        }
+        reader
+            .read_exact(
+                prefix
+                    .get_mut(count..)
+                    .ok_or(ProtocolError::InvalidStructure)?,
+            )
+            .await?;
+        let length = usize::try_from(u32::from_be_bytes(prefix))?;
+        if length > MAX_FRAME_BYTES {
+            return Err(ProtocolError::TooLarge);
+        }
+        let mut body = vec![0; length];
+        reader.read_exact(&mut body).await?;
+        decode(&body).map(Some)
+    })
+    .await
+    .map_err(|_| ProtocolError::Deadline)??;
+    if Instant::now() >= deadline {
+        return Err(ProtocolError::Deadline);
+    }
+    Ok(frame)
+}
+
+/// Encode, write and flush a frame under one absolute deadline.
+///
+/// # Errors
+/// Returns encoding, IO or deadline failure. Partial writes require retiring
+/// the connection; retrying a business invocation is never implicit.
+///
+/// ```no_run
+/// # async fn write(mut output: impl tokio::io::AsyncWrite + Unpin, frame: rustack_lambda_runtime::protocol::Frame) -> Result<(), rustack_lambda_runtime::protocol::ProtocolError> {
+/// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(5);
+/// rustack_lambda_runtime::protocol::write_frame(&mut output, &frame, deadline).await?;
+/// # Ok(()) }
+/// ```
+pub async fn write_frame<W: AsyncWrite + Unpin>(
+    writer: &mut W,
+    frame: &Frame,
+    deadline: Instant,
+) -> Result<(), ProtocolError> {
+    if Instant::now() >= deadline {
+        return Err(ProtocolError::Deadline);
+    }
+    let encoded = encode(frame)?;
+    if Instant::now() >= deadline {
+        return Err(ProtocolError::Deadline);
+    }
+    timeout_at(deadline, async {
+        writer.write_all(&encoded).await?;
+        writer.flush().await
+    })
+    .await
+    .map_err(|_| ProtocolError::Deadline)??;
+    if Instant::now() >= deadline {
+        return Err(ProtocolError::Deadline);
+    }
+    Ok(())
+}
diff --git a/crates/rustack-lambda-runtime/src/protocol/preflight.rs b/crates/rustack-lambda-runtime/src/protocol/preflight.rs
new file mode 100644
index 00000000..e387550e
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/protocol/preflight.rs
@@ -0,0 +1,140 @@
+//! Allocation-bounded CBOR structural validation before Serde materialization.
+
+use std::{collections::HashSet, str};
+
+use super::{MAX_FRAME_BYTES, MAX_METADATA_BYTES, MAX_PAYLOAD_BYTES, ProtocolError};
+
+#[derive(Debug)]
+struct Scanner<'a> {
+    remaining: &'a [u8],
+    members: usize,
+    payload: Option<usize>,
+}
+
+pub(super) fn validate(body: &[u8]) -> Result<(), ProtocolError> {
+    if body.len() > MAX_FRAME_BYTES {
+        return Err(ProtocolError::TooLarge);
+    }
+    let mut scanner = Scanner {
+        remaining: body,
+        members: 0,
+        payload: None,
+    };
+    scanner.item(1, false)?;
+    if !scanner.remaining.is_empty() {
+        return Err(ProtocolError::InvalidStructure);
+    }
+    if body.len().saturating_sub(scanner.payload.unwrap_or(0)) > MAX_METADATA_BYTES {
+        return Err(ProtocolError::TooLarge);
+    }
+    Ok(())
+}
+
+impl<'a> Scanner<'a> {
+    fn take(&mut self, length: usize) -> Result<&'a [u8], ProtocolError> {
+        let (value, rest) = self
+            .remaining
+            .split_at_checked(length)
+            .ok_or(ProtocolError::InvalidStructure)?;
+        self.remaining = rest;
+        Ok(value)
+    }
+
+    fn header(&mut self) -> Result<(u8, u64), ProtocolError> {
+        let (&initial, rest) = self
+            .remaining
+            .split_first()
+            .ok_or(ProtocolError::InvalidStructure)?;
+        self.remaining = rest;
+        let major = initial >> 5;
+        if major == 7 && initial != 0xf4 && initial != 0xf5 {
+            return Err(ProtocolError::InvalidStructure);
+        }
+        let additional = initial & 31;
+        let value = match additional {
+            0..=23 => u64::from(additional),
+            24 => u64::from(u8::from_be_bytes(
+                self.take(1)?
+                    .try_into()
+                    .map_err(|_| ProtocolError::InvalidStructure)?,
+            )),
+            25 => u64::from(u16::from_be_bytes(
+                self.take(2)?
+                    .try_into()
+                    .map_err(|_| ProtocolError::InvalidStructure)?,
+            )),
+            26 => u64::from(u32::from_be_bytes(
+                self.take(4)?
+                    .try_into()
+                    .map_err(|_| ProtocolError::InvalidStructure)?,
+            )),
+            27 => u64::from_be_bytes(
+                self.take(8)?
+                    .try_into()
+                    .map_err(|_| ProtocolError::InvalidStructure)?,
+            ),
+            _ => return Err(ProtocolError::InvalidStructure),
+        };
+        Ok((major, value))
+    }
+
+    fn text(&mut self, key: bool) -> Result<&'a str, ProtocolError> {
+        let (major, length) = self.header()?;
+        if major != 3 {
+            return Err(ProtocolError::InvalidStructure);
+        }
+        let length = usize::try_from(length)?;
+        if length > if key { 64 } else { 2048 } {
+            return Err(ProtocolError::TooLarge);
+        }
+        str::from_utf8(self.take(length)?).map_err(|_| ProtocolError::InvalidStructure)
+    }
+
+    fn item(&mut self, depth: usize, payload: bool) -> Result<(), ProtocolError> {
+        if depth > 16 {
+            return Err(ProtocolError::TooLarge);
+        }
+        let (major, value) = self.header()?;
+        match major {
+            0 => Ok(()),
+            2 if payload && self.payload.is_none() => {
+                let length = usize::try_from(value)?;
+                if length > MAX_PAYLOAD_BYTES {
+                    return Err(ProtocolError::TooLarge);
+                }
+                self.take(length)?;
+                self.payload = Some(length);
+                Ok(())
+            }
+            3 => {
+                let length = usize::try_from(value)?;
+                if length > 2048 {
+                    return Err(ProtocolError::TooLarge);
+                }
+                str::from_utf8(self.take(length)?).map_err(|_| ProtocolError::InvalidStructure)?;
+                Ok(())
+            }
+            5 => {
+                let count = usize::try_from(value)?;
+                self.members = self
+                    .members
+                    .checked_add(count)
+                    .ok_or(ProtocolError::TooLarge)?;
+                if self.members > 128 {
+                    return Err(ProtocolError::TooLarge);
+                }
+                let mut keys = HashSet::with_capacity(count);
+                for _ in 0..count {
+                    let key = self.text(true)?;
+                    if !keys.insert(key) {
+                        return Err(ProtocolError::InvalidStructure);
+                    }
+                    self.item(depth + 1, key == "payload")?;
+                }
+                Ok(())
+            }
+            7 if value == 20 || value == 21 => Ok(()),
+            _ => Err(ProtocolError::InvalidStructure),
+        }
+    }
+}
diff --git a/crates/rustack-lambda-runtime/src/protocol/tests.rs b/crates/rustack-lambda-runtime/src/protocol/tests.rs
new file mode 100644
index 00000000..1081b287
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/protocol/tests.rs
@@ -0,0 +1,506 @@
+use std::{num::NonZeroU64, time::Duration};
+
+use ciborium::Value;
+use proptest::{collection, prelude::*};
+use rstest::rstest;
+use tokio::io::{duplex, empty};
+
+use super::*;
+
+fn payload() -> Payload {
+    Bytes::from_static(b"secret-payload\0\xff")
+        .try_into()
+        .unwrap()
+}
+
+fn messages() -> Vec<Message> {
+    let attempt = AttemptId::default();
+    vec![
+        Message::Hello {
+            architecture: Architecture::Arm64,
+        },
+        Message::Hello {
+            architecture: Architecture::X86_64,
+        },
+        Message::Ready,
+        Message::BootstrapReady,
+        Message::Invoke {
+            attempt,
+            deadline_unix_ms: NonZeroU64::new(1_800_000_000_000).unwrap(),
+            handler_timeout_ms: None,
+            function_arn: "arn:aws:lambda:us-east-1:000000000000:function:echo:prod"
+                .parse()
+                .unwrap(),
+            trace_id: "Root=1-00000000-000000000000000000000000;Sampled=0"
+                .parse()
+                .unwrap(),
+            payload: payload(),
+        },
+        Message::InvocationResult {
+            attempt,
+            outcome: Outcome::Success,
+            payload: payload(),
+        },
+        Message::InvocationResult {
+            attempt,
+            outcome: Outcome::FunctionError,
+            payload: payload(),
+        },
+        Message::InitError { payload: payload() },
+        Message::Cancel { attempt },
+        Message::Close,
+        Message::Ack(Acknowledgement::Close),
+        Message::Ack(Acknowledgement::Cancel(attempt)),
+        Message::InvocationTimedOut { attempt },
+    ]
+}
+
+fn body(value: &Value) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    ciborium::into_writer(value, &mut bytes).unwrap();
+    bytes
+}
+
+fn value(message: Message) -> Value {
+    let encoded = encode(&Frame::new(EnvironmentId::default(), message)).unwrap();
+    ciborium::from_reader(encoded.get(4..).unwrap()).unwrap()
+}
+
+fn field<'a>(value: &'a mut Value, key: &str) -> &'a mut Value {
+    value
+        .as_map_mut()
+        .unwrap()
+        .iter_mut()
+        .find_map(|(k, v)| (k.as_text() == Some(key)).then_some(v))
+        .unwrap()
+}
+
+#[test]
+fn test_should_round_trip_every_variant_and_redact_payload_debug() {
+    for message in messages() {
+        let frame = Frame::new(EnvironmentId::default(), message);
+        let bytes = encode(&frame).unwrap();
+        let length = u32::from_be_bytes(bytes.get(..4).unwrap().try_into().unwrap());
+        assert_eq!(usize::try_from(length).unwrap(), bytes.len() - 4);
+        assert_eq!(decode(bytes.get(4..).unwrap()).unwrap(), frame);
+        assert!(!format!("{frame:?}").contains("secret-payload"));
+    }
+    let encoded = value(Message::InitError { payload: payload() });
+    let mut encoded = encoded;
+    let data = field(field(&mut encoded, "message"), "data");
+    assert!(matches!(field(data, "payload"), Value::Bytes(_)));
+}
+
+#[rstest]
+#[case("00000000-0000-0000-0000-000000000000")]
+#[case("00112233-4455-6677-8899-AABBCCDDEEFF")]
+#[case("00112233445566778899aabbccddeeff")]
+#[case("00112233-4455-6677-8899-aabbccddeeff\n")]
+#[case("not-an-id")]
+fn test_should_reject_noncanonical_or_nil_identities(#[case] value: &str) {
+    assert!(value.parse::<EnvironmentId>().is_err());
+    assert!(value.parse::<AttemptId>().is_err());
+}
+
+#[rstest]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:echo")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:echo:$LATEST")]
+#[case("arn:aws-cn:lambda:cn-north-1:123456789012:function:echo:1")]
+#[case("arn:aws-us-gov:lambda:us-gov-west-1:123456789012:function:echo:prod")]
+fn test_should_accept_scoped_function_metadata(#[case] value: &str) {
+    assert_eq!(value.parse::<FunctionArn>().unwrap().as_ref(), value);
+}
+
+#[rstest]
+#[case("")]
+#[case("arn:aws:s3:us-east-1:000000000000:function:echo")]
+#[case("arn:aws:lambda::000000000000:function:echo")]
+#[case("arn:aws:lambda:us-east-1:0000:function:echo")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:echo:")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:echo:0")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:echo:18446744073709551616")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:echo:prod:extra")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:echo\r\nsecret")]
+fn test_should_reject_invalid_header_metadata_without_echoing_it(#[case] value: &str) {
+    let error = value.parse::<FunctionArn>().unwrap_err();
+    assert_eq!(error.to_string(), "invalid control metadata");
+    assert!(!format!("{error:?}").contains("secret"));
+    assert!("trace\nsecret".parse::<TraceId>().is_err());
+    assert!("é".parse::<TraceId>().is_err());
+    assert!("x".repeat(257).parse::<TraceId>().is_err());
+
+    let mut packet = self::value(messages().into_iter().nth(4).unwrap());
+    *field(field(field(&mut packet, "message"), "data"), "functionArn") = Value::Text(value.into());
+    assert!(matches!(
+        decode(&body(&packet)),
+        Err(ProtocolError::InvalidSchema)
+    ));
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+
+    #[test]
+    fn test_should_never_panic_on_bounded_malformed_control_input(bytes in collection::vec(any::<u8>(), 0..8192)) {
+        if let Ok(frame) = decode(&bytes) {
+            let encoded = encode(&frame).unwrap();
+            prop_assert_eq!(decode(encoded.get(4..).unwrap()).unwrap(), frame);
+        }
+    }
+
+    #[test]
+    fn test_should_preserve_arbitrary_binary_payloads(bytes in collection::vec(any::<u8>(), 0..16384)) {
+        let frame = Frame::new(EnvironmentId::default(), Message::InitError {
+            payload: Payload::try_from(Bytes::from(bytes)).unwrap(),
+        });
+        let encoded = encode(&frame).unwrap();
+        prop_assert_eq!(decode(encoded.get(4..).unwrap()).unwrap(), frame);
+    }
+
+    #[test]
+    fn test_should_handle_mutated_valid_envelopes_without_panicking(position in any::<usize>(), mask in any::<u8>()) {
+        let frame = Frame::new(EnvironmentId::default(), Message::InitError { payload: payload() });
+        let mut encoded = encode(&frame).unwrap().get(4..).unwrap().to_vec();
+        let position = position % encoded.len();
+        *encoded.get_mut(position).unwrap() ^= mask;
+        if let Ok(frame) = decode(&encoded) {
+            let bytes = encode(&frame).unwrap();
+            prop_assert_eq!(decode(bytes.get(4..).unwrap()).unwrap(), frame);
+        }
+    }
+}
+
+#[test]
+fn test_should_reject_unknown_duplicate_and_mismatched_variant_fields() {
+    let frame = value(Message::Ready);
+    let mut unknown = frame.clone();
+    unknown
+        .as_map_mut()
+        .unwrap()
+        .push((Value::Text("secret-unrecognized".into()), Value::Bool(true)));
+    let error = decode(&body(&unknown)).unwrap_err();
+    assert!(matches!(error, ProtocolError::InvalidSchema));
+    assert!(!format!("{error:?} {error}").contains("secret-unrecognized"));
+    let mut duplicate = frame.clone();
+    let first = duplicate.as_map().unwrap().first().unwrap().clone();
+    duplicate.as_map_mut().unwrap().push(first);
+    assert!(matches!(
+        decode(&body(&duplicate)),
+        Err(ProtocolError::InvalidStructure)
+    ));
+    let mut unknown_kind = frame.clone();
+    *field(field(&mut unknown_kind, "message"), "kind") = Value::Text("secret-variant".into());
+    assert!(matches!(
+        decode(&body(&unknown_kind)),
+        Err(ProtocolError::InvalidSchema)
+    ));
+    let mut version = frame;
+    *field(&mut version, "version") = Value::Integer(1.into());
+    assert!(matches!(
+        decode(&body(&version)),
+        Err(ProtocolError::UnsupportedVersion)
+    ));
+
+    let mut ack = value(Message::Ack(Acknowledgement::Cancel(AttemptId::default())));
+    *field(field(field(&mut ack, "message"), "data"), "operation") = Value::Text("close".into());
+    assert!(decode(&body(&ack)).is_err());
+    let data = field(field(&mut ack, "message"), "data");
+    data.as_map_mut()
+        .unwrap()
+        .retain(|(k, _)| k.as_text() != Some("attempt"));
+    *field(data, "operation") = Value::Text("cancel".into());
+    assert!(decode(&body(&ack)).is_err());
+
+    for mut message in [
+        value(Message::InitError { payload: payload() }),
+        value(Message::InvocationResult {
+            attempt: AttemptId::default(),
+            outcome: Outcome::Success,
+            payload: payload(),
+        }),
+    ] {
+        let data = field(field(&mut message, "message"), "data");
+        let duplicate = data.as_map().unwrap().first().unwrap().clone();
+        data.as_map_mut().unwrap().push(duplicate);
+        assert!(matches!(
+            decode(&body(&message)),
+            Err(ProtocolError::InvalidStructure)
+        ));
+    }
+}
+
+#[test]
+fn test_should_reject_extra_data_fields_for_every_message_variant_and_zero_deadlines() {
+    for message in messages() {
+        let mut packet = value(message);
+        let message = field(&mut packet, "message");
+        if let Some((_, data)) = message
+            .as_map_mut()
+            .unwrap()
+            .iter_mut()
+            .find(|(key, _)| key.as_text() == Some("data"))
+        {
+            data.as_map_mut()
+                .unwrap()
+                .push((Value::Text("secret-extra".into()), Value::Bool(true)));
+        } else {
+            message
+                .as_map_mut()
+                .unwrap()
+                .push((Value::Text("data".into()), Value::Bool(true)));
+        }
+        let error = decode(&body(&packet)).unwrap_err();
+        assert!(!format!("{error} {error:?}").contains("secret-extra"));
+    }
+    let mut packet = value(messages().into_iter().nth(4).unwrap());
+    *field(
+        field(field(&mut packet, "message"), "data"),
+        "deadlineUnixMs",
+    ) = Value::Integer(0.into());
+    assert!(matches!(
+        decode(&body(&packet)),
+        Err(ProtocolError::InvalidSchema)
+    ));
+}
+
+#[test]
+fn test_should_bound_payload_metadata_nesting_and_collection_counts_before_deserialization() {
+    let maximum = Payload::try_from(Bytes::from(vec![0xff; MAX_PAYLOAD_BYTES])).unwrap();
+    let frame = Frame::new(
+        EnvironmentId::default(),
+        Message::InitError { payload: maximum },
+    );
+    let encoded = encode(&frame).unwrap();
+    assert_eq!(decode(encoded.get(4..).unwrap()).unwrap(), frame);
+    assert!(Payload::try_from(Bytes::from(vec![0; MAX_PAYLOAD_BYTES + 1])).is_err());
+    let mut too_large = value(Message::InitError { payload: payload() });
+    *field(field(field(&mut too_large, "message"), "data"), "payload") =
+        Value::Bytes(vec![0; MAX_PAYLOAD_BYTES + 1]);
+    assert!(matches!(
+        decode(&body(&too_large)),
+        Err(ProtocolError::TooLarge)
+    ));
+    let metadata = Value::Map(
+        (0..65)
+            .map(|i| (Value::Text(format!("k{i}")), Value::Text("x".repeat(1024))))
+            .collect(),
+    );
+    assert!(matches!(
+        preflight::validate(&body(&metadata)),
+        Err(ProtocolError::TooLarge)
+    ));
+    let members = Value::Map(
+        (0..129)
+            .map(|i| (Value::Text(format!("k{i}")), Value::Bool(true)))
+            .collect(),
+    );
+    assert!(matches!(
+        preflight::validate(&body(&members)),
+        Err(ProtocolError::TooLarge)
+    ));
+    let mut nested = Value::Bool(true);
+    for _ in 0..17 {
+        nested = Value::Map(vec![(Value::Text("x".into()), nested)]);
+    }
+    assert!(matches!(
+        preflight::validate(&body(&nested)),
+        Err(ProtocolError::TooLarge)
+    ));
+    assert!(matches!(
+        preflight::validate(&body(&Value::Map(vec![(
+            Value::Text("k".repeat(65)),
+            Value::Bool(true)
+        )]))),
+        Err(ProtocolError::TooLarge)
+    ));
+}
+
+#[rstest]
+#[case(&[0x9f, 0xff])]
+#[case(&[0xbf, 0xff])]
+#[case(&[0x5f, 0x40, 0xff])]
+#[case(&[0xc0, 0x00])]
+#[case(&[0x20])]
+#[case(&[0x80])]
+#[case(&[0xf9, 0, 20])]
+#[case(&[0xfa, 0, 0, 0, 20])]
+#[case(&[0xfb, 0, 0, 0, 0, 0, 0, 0, 20])]
+#[case(&[0xf6])]
+#[case(&[0xa1, 0x61, b'x', 0x7b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff])]
+fn test_should_reject_forbidden_cbor_shapes_and_huge_declared_lengths(#[case] bytes: &[u8]) {
+    assert!(preflight::validate(bytes).is_err());
+}
+
+#[test]
+fn test_should_reject_trailing_data_and_payload_arrays_or_text() {
+    let frame = Frame::new(EnvironmentId::default(), Message::Ready);
+    let mut bytes = encode(&frame).unwrap().get(4..).unwrap().to_vec();
+    bytes.push(0x00);
+    assert!(matches!(
+        decode(&bytes),
+        Err(ProtocolError::InvalidStructure)
+    ));
+    for invalid in [Value::Array(vec![]), Value::Text("base64-secret".into())] {
+        let mut message = value(Message::InitError { payload: payload() });
+        *field(field(field(&mut message, "message"), "data"), "payload") = invalid;
+        assert!(decode(&body(&message)).is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_round_trip_fragmented_transport_and_distinguish_clean_and_truncated_eof() {
+    let frame = Frame::new(
+        EnvironmentId::default(),
+        Message::InitError { payload: payload() },
+    );
+    let encoded = encode(&frame).unwrap();
+    let (mut writer, mut reader) = duplex(3);
+    let expected = frame.clone();
+    let send = tokio::spawn(async move {
+        write_frame(&mut writer, &frame, Instant::now() + Duration::from_secs(2))
+            .await
+            .unwrap();
+    });
+    assert_eq!(
+        read_frame(&mut reader, Instant::now() + Duration::from_secs(2))
+            .await
+            .unwrap()
+            .unwrap(),
+        expected
+    );
+    send.await.unwrap();
+    assert!(
+        read_frame(&mut reader, Instant::now() + Duration::from_secs(2))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        read_frame(&mut empty(), Instant::now() + Duration::from_secs(1))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    for length in [1, 2, 3, 4, encoded.len() - 1] {
+        let mut truncated = encoded.get(..length).unwrap();
+        assert!(
+            matches!(read_frame(&mut truncated, Instant::now() + Duration::from_secs(1)).await, Err(ProtocolError::Io(error)) if error.kind() == io::ErrorKind::UnexpectedEof)
+        );
+    }
+    let oversized = u32::MAX.to_be_bytes();
+    assert!(matches!(
+        read_frame(
+            &mut oversized.as_slice(),
+            Instant::now() + Duration::from_secs(1)
+        )
+        .await,
+        Err(ProtocolError::TooLarge)
+    ));
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_enforce_absolute_deadlines_for_partial_reads_and_stalled_writes() {
+    let (mut writer, mut reader) = duplex(2);
+    writer.write_all(&[0, 0]).await.unwrap();
+    assert!(matches!(
+        read_frame(&mut reader, Instant::now() + Duration::from_secs(1)).await,
+        Err(ProtocolError::Deadline)
+    ));
+    let frame = Frame::new(EnvironmentId::default(), Message::Ready);
+    assert!(matches!(
+        write_frame(&mut writer, &frame, Instant::now() + Duration::from_secs(1)).await,
+        Err(ProtocolError::Deadline)
+    ));
+    let encoded = encode(&frame).unwrap();
+    let mut unread = encoded.as_ref();
+    assert!(matches!(
+        read_frame(&mut unread, Instant::now()).await,
+        Err(ProtocolError::Deadline)
+    ));
+    assert_eq!(
+        unread,
+        encoded.as_ref(),
+        "expired reads must not consume a ready frame"
+    );
+}
+
+#[rstest]
+#[case(0)]
+#[case(999)]
+#[case(1001)]
+#[case(900_001)]
+#[case(u32::MAX)]
+fn test_should_reject_out_of_profile_handler_timeouts_before_session_admission(
+    #[case] milliseconds: u32,
+) {
+    assert!(HandlerTimeout::try_from(milliseconds).is_err());
+    let mut invoke = messages().into_iter().nth(4).unwrap();
+    if let Message::Invoke {
+        handler_timeout_ms, ..
+    } = &mut invoke
+    {
+        *handler_timeout_ms = Some(HandlerTimeout::try_from(1000).unwrap());
+    }
+    let mut packet = value(invoke);
+    *field(
+        field(field(&mut packet, "message"), "data"),
+        "handlerTimeoutMs",
+    ) = Value::Integer(milliseconds.into());
+    assert!(matches!(
+        decode(&body(&packet)),
+        Err(ProtocolError::InvalidSchema)
+    ));
+}
+#[test]
+fn test_should_round_trip_handler_budget_timeout_event_and_reject_older_relays() {
+    for seconds in [1, 900] {
+        let timeout = HandlerTimeout::try_from(Duration::from_secs(seconds)).unwrap();
+        assert_eq!(timeout.duration(), Duration::from_secs(seconds));
+        let mut invoke = messages().into_iter().nth(4).unwrap();
+        if let Message::Invoke {
+            handler_timeout_ms, ..
+        } = &mut invoke
+        {
+            *handler_timeout_ms = Some(timeout);
+        }
+        let packet = value(invoke.clone());
+        assert_eq!(decode(&body(&packet)).unwrap().into_message(), invoke);
+    }
+    for timeout in [
+        Duration::ZERO,
+        Duration::from_millis(1001),
+        Duration::from_secs(901),
+        Duration::MAX,
+    ] {
+        assert!(HandlerTimeout::try_from(timeout).is_err());
+    }
+    let message = Message::InvocationTimedOut {
+        attempt: AttemptId::default(),
+    };
+    let packet = value(message.clone());
+    assert_eq!(decode(&body(&packet)).unwrap().into_message(), message);
+    for version in [0, 1, 3, u32::MAX] {
+        let mut packet = value(Message::Ready);
+        *field(&mut packet, "version") = Value::Integer(version.into());
+        assert!(matches!(
+            decode(&body(&packet)),
+            Err(ProtocolError::UnsupportedVersion)
+        ));
+    }
+    let mut invoke = messages().into_iter().nth(4).unwrap();
+    if let Message::Invoke {
+        handler_timeout_ms, ..
+    } = &mut invoke
+    {
+        *handler_timeout_ms = Some(HandlerTimeout::try_from(1000).unwrap());
+    }
+    let mut packet = value(invoke);
+    *field(
+        field(field(&mut packet, "message"), "data"),
+        "handlerTimeoutMs",
+    ) = Value::Null;
+    assert!(matches!(
+        decode(&body(&packet)),
+        Err(ProtocolError::InvalidStructure)
+    ));
+}
diff --git a/crates/rustack-lambda-runtime/src/protocol/types.rs b/crates/rustack-lambda-runtime/src/protocol/types.rs
new file mode 100644
index 00000000..af75f76a
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/protocol/types.rs
@@ -0,0 +1,401 @@
+//! Validated metadata and closed control-message variants.
+
+use std::{fmt, num::NonZeroU64, str::FromStr, time::Duration};
+
+use bytes::Bytes;
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de};
+use uuid::Uuid;
+
+use super::{MAX_PAYLOAD_BYTES, ProtocolError};
+
+macro_rules! identity {
+    ($name:ident, $doc:literal) => {
+        #[doc = $doc]
+        #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+        #[serde(try_from = "String", into = "String")]
+        pub struct $name(Uuid);
+
+        impl Default for $name {
+            fn default() -> Self {
+                Self(Uuid::new_v4())
+            }
+        }
+        impl fmt::Display for $name {
+            fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                self.0.fmt(f)
+            }
+        }
+        impl FromStr for $name {
+            type Err = ProtocolError;
+            fn from_str(value: &str) -> Result<Self, Self::Err> {
+                if value.len() != 36 {
+                    return Err(ProtocolError::InvalidMetadata);
+                }
+                let id = Uuid::parse_str(value).map_err(|_| ProtocolError::InvalidMetadata)?;
+                if id.is_nil() || id.to_string() != value {
+                    return Err(ProtocolError::InvalidMetadata);
+                }
+                Ok(Self(id))
+            }
+        }
+        impl TryFrom<String> for $name {
+            type Error = ProtocolError;
+            fn try_from(value: String) -> Result<Self, Self::Error> {
+                value.parse()
+            }
+        }
+        impl From<$name> for String {
+            fn from(value: $name) -> Self {
+                value.to_string()
+            }
+        }
+    };
+}
+
+identity!(
+    EnvironmentId,
+    "Canonical nonnil environment UUID; parse with `FromStr`, generate with `Default`."
+);
+
+/// Validated whole-second handler timeout, encoded as milliseconds on the wire.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "u32", into = "u32")]
+pub struct HandlerTimeout(u32);
+
+impl TryFrom<u32> for HandlerTimeout {
+    type Error = ProtocolError;
+    fn try_from(milliseconds: u32) -> Result<Self, Self::Error> {
+        if !(1000..=900_000).contains(&milliseconds) || !milliseconds.is_multiple_of(1000) {
+            return Err(ProtocolError::InvalidMetadata);
+        }
+        Ok(Self(milliseconds))
+    }
+}
+impl TryFrom<Duration> for HandlerTimeout {
+    type Error = ProtocolError;
+    fn try_from(timeout: Duration) -> Result<Self, Self::Error> {
+        if timeout.subsec_nanos() != 0 {
+            return Err(ProtocolError::InvalidMetadata);
+        }
+        Self::try_from(
+            u32::try_from(timeout.as_millis()).map_err(|_| ProtocolError::InvalidMetadata)?,
+        )
+    }
+}
+impl From<HandlerTimeout> for u32 {
+    fn from(timeout: HandlerTimeout) -> Self {
+        timeout.0
+    }
+}
+impl HandlerTimeout {
+    /// Return the validated relative budget without starting a clock.
+    ///
+    /// ```
+    /// use std::time::Duration;
+    /// let timeout = rustack_lambda_runtime::protocol::HandlerTimeout::try_from(Duration::from_secs(3))?;
+    /// assert_eq!(timeout.duration(), Duration::from_secs(3));
+    /// # Ok::<(), rustack_lambda_runtime::protocol::ProtocolError>(())
+    /// ```
+    #[must_use]
+    pub fn duration(self) -> Duration {
+        Duration::from_millis(u64::from(self.0))
+    }
+}
+identity!(
+    AttemptId,
+    "Canonical nonnil invocation attempt UUID; parse with `FromStr`, generate with `Default`."
+);
+
+/// Architecture advertised by the environment-local relay.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Architecture {
+    /// Linux x86-64.
+    #[serde(rename = "x86_64")]
+    X86_64,
+    /// Linux `AArch64`.
+    #[serde(rename = "arm64")]
+    Arm64,
+}
+
+/// Validated Lambda invocation ARN, including an optional version/alias.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct FunctionArn(String);
+
+impl FromStr for FunctionArn {
+    type Err = ProtocolError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.len() > 2048 {
+            return Err(ProtocolError::InvalidMetadata);
+        }
+        let mut parts = value.split(':');
+        let valid = matches!(parts.next(), Some("arn"))
+            && matches!(parts.next(), Some("aws" | "aws-cn" | "aws-us-gov"))
+            && matches!(parts.next(), Some("lambda"))
+            && parts
+                .next()
+                .is_some_and(|region| identifier(region, 64, false))
+            && parts.next().is_some_and(|account| {
+                account.len() == 12 && account.bytes().all(|b| b.is_ascii_digit())
+            })
+            && matches!(parts.next(), Some("function"))
+            && parts.next().is_some_and(|name| identifier(name, 64, true));
+        if !valid {
+            return Err(ProtocolError::InvalidMetadata);
+        }
+        if let Some(qualifier) = parts.next() {
+            if qualifier != "$LATEST" && !identifier(qualifier, 128, true) {
+                return Err(ProtocolError::InvalidMetadata);
+            }
+            if qualifier.bytes().all(|byte| byte.is_ascii_digit())
+                && !qualifier.parse::<u64>().is_ok_and(|version| version != 0)
+            {
+                return Err(ProtocolError::InvalidMetadata);
+            }
+        }
+        if parts.next().is_some() {
+            return Err(ProtocolError::InvalidMetadata);
+        }
+        Ok(Self(value.into()))
+    }
+}
+
+fn identifier(value: &str, maximum: usize, underscore: bool) -> bool {
+    !value.is_empty()
+        && value.len() <= maximum
+        && value
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || b == b'-' || (underscore && b == b'_'))
+}
+
+impl TryFrom<String> for FunctionArn {
+    type Error = ProtocolError;
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+impl From<FunctionArn> for String {
+    fn from(value: FunctionArn) -> Self {
+        value.0
+    }
+}
+impl AsRef<str> for FunctionArn {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+/// Nonempty printable ASCII trace metadata, at most256 bytes.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct TraceId(String);
+
+impl FromStr for TraceId {
+    type Err = ProtocolError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.is_empty() || value.len() > 256 || !value.bytes().all(|b| (32..=126).contains(&b))
+        {
+            return Err(ProtocolError::InvalidMetadata);
+        }
+        Ok(Self(value.into()))
+    }
+}
+impl TryFrom<String> for TraceId {
+    type Error = ProtocolError;
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        value.parse()
+    }
+}
+impl From<TraceId> for String {
+    fn from(value: TraceId) -> Self {
+        value.0
+    }
+}
+impl AsRef<str> for TraceId {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+/// A size-validated raw event/result whose Debug never displays contents.
+#[derive(Clone, PartialEq, Eq)]
+pub struct Payload(Bytes);
+
+impl TryFrom<Bytes> for Payload {
+    type Error = ProtocolError;
+    fn try_from(value: Bytes) -> Result<Self, Self::Error> {
+        if value.len() > MAX_PAYLOAD_BYTES {
+            return Err(ProtocolError::TooLarge);
+        }
+        Ok(Self(value))
+    }
+}
+impl From<Payload> for Bytes {
+    fn from(value: Payload) -> Self {
+        value.0
+    }
+}
+impl AsRef<[u8]> for Payload {
+    fn as_ref(&self) -> &[u8] {
+        &self.0
+    }
+}
+impl fmt::Debug for Payload {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Payload")
+            .field("bytes", &self.0.len())
+            .finish_non_exhaustive()
+    }
+}
+impl Serialize for Payload {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_bytes(&self.0)
+    }
+}
+impl<'de> Deserialize<'de> for Payload {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        struct PayloadVisitor;
+        impl de::Visitor<'_> for PayloadVisitor {
+            type Value = Payload;
+            fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+                formatter.write_str("a bounded CBOR byte string")
+            }
+            fn visit_bytes<E: de::Error>(self, bytes: &[u8]) -> Result<Payload, E> {
+                if bytes.len() > MAX_PAYLOAD_BYTES {
+                    return Err(E::custom("payload size budget exceeded"));
+                }
+                Ok(Payload(Bytes::copy_from_slice(bytes)))
+            }
+            fn visit_byte_buf<E: de::Error>(self, bytes: Vec<u8>) -> Result<Payload, E> {
+                Payload::try_from(Bytes::from(bytes)).map_err(E::custom)
+            }
+        }
+        deserializer.deserialize_byte_buf(PayloadVisitor)
+    }
+}
+
+/// Acknowledgement scope; cancellation always names exactly one attempt.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(try_from = "AckFields", into = "AckFields")]
+pub enum Acknowledgement {
+    /// The session invalidated this attempt; user-code exit is not proven.
+    Cancel(AttemptId),
+    /// The control session accepted closure.
+    Close,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+enum AckOperation {
+    Cancel,
+    Close,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct AckFields {
+    operation: AckOperation,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    attempt: Option<AttemptId>,
+}
+impl TryFrom<AckFields> for Acknowledgement {
+    type Error = ProtocolError;
+    fn try_from(value: AckFields) -> Result<Self, Self::Error> {
+        match (value.operation, value.attempt) {
+            (AckOperation::Cancel, Some(attempt)) => Ok(Self::Cancel(attempt)),
+            (AckOperation::Close, None) => Ok(Self::Close),
+            _ => Err(ProtocolError::InvalidMetadata),
+        }
+    }
+}
+impl From<Acknowledgement> for AckFields {
+    fn from(value: Acknowledgement) -> Self {
+        match value {
+            Acknowledgement::Cancel(attempt) => Self {
+                operation: AckOperation::Cancel,
+                attempt: Some(attempt),
+            },
+            Acknowledgement::Close => Self {
+                operation: AckOperation::Close,
+                attempt: None,
+            },
+        }
+    }
+}
+
+/// Whether the function posted a success response or a handler error.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Outcome {
+    /// Runtime /response.
+    Success,
+    /// Runtime /error, distinct from a transport or initialization failure.
+    FunctionError,
+}
+
+/// Closed control schema; payload and invocation metadata are validated types.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(
+    tag = "kind",
+    content = "data",
+    rename_all = "camelCase",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+#[non_exhaustive]
+pub enum Message {
+    /// First relay frame advertising the compiled platform.
+    Hello {
+        /// Linux image architecture.
+        architecture: Architecture,
+    },
+    /// Relay listener is bound; does not prove bootstrap readiness.
+    Ready,
+    /// The function issued its first valid GET /next.
+    BootstrapReady,
+    /// One host-owned invocation; never replay automatically.
+    Invoke {
+        /// Shared caller/backend attempt UUID.
+        attempt: AttemptId,
+        /// Absolute wall deadline, checked and converted by the receiver.
+        deadline_unix_ms: NonZeroU64,
+        /// Optional captured handler budget, armed only at consumed delivery.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        handler_timeout_ms: Option<HandlerTimeout>,
+        /// Requested ARN, preserving an invoked alias.
+        function_arn: FunctionArn,
+        /// Runtime trace header.
+        trace_id: TraceId,
+        /// Raw event bytes.
+        payload: Payload,
+    },
+    /// Function completion for one delivered attempt.
+    InvocationResult {
+        /// Completed attempt UUID.
+        attempt: AttemptId,
+        /// /response versus /error.
+        outcome: Outcome,
+        /// Raw result or error bytes.
+        payload: Payload,
+    },
+    /// The delivered handler clock expired before the caller's absolute deadline.
+    InvocationTimedOut {
+        /// Timed-out active attempt; this environment cannot be reused.
+        attempt: AttemptId,
+    },
+    /// Fatal initialization failure before event delivery.
+    InitError {
+        /// Raw initialization error document.
+        payload: Payload,
+    },
+    /// Invalidate an attempt; the host still terminates its function.
+    Cancel {
+        /// Invalidated attempt UUID.
+        attempt: AttemptId,
+    },
+    /// Close the environment's sole control session.
+    Close,
+    /// Cancellation or closure acknowledgement, scoped by operation.
+    Ack(Acknowledgement),
+}
diff --git a/crates/rustack-lambda-runtime/src/relay.rs b/crates/rustack-lambda-runtime/src/relay.rs
new file mode 100644
index 00000000..a43d2c3d
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/relay.rs
@@ -0,0 +1,454 @@
+//! Supervised control transport for an environment-local Lambda Runtime API.
+//!
+//! This owner invalidates the API session; the host environment supervisor
+//! remains responsible for stopping/removing the separate function container.
+
+use std::{future::pending, io, sync::Arc, time::Duration};
+
+use thiserror::Error;
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    runtime::Handle,
+    sync::{oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, sleep_until, timeout_at},
+};
+use tracing::instrument::WithSubscriber;
+use typed_builder::TypedBuilder;
+
+use crate::{
+    http::{ApiError, RuntimeApiHandle},
+    metadata::deadline_from_unix_ms,
+    protocol::{
+        Acknowledgement, Architecture, AttemptId, EnvironmentId, Frame, Message, Outcome, Payload,
+        ProtocolError,
+    },
+    session::{Invocation, InvocationTicket, RuntimeResult, SessionError},
+    transport::{InputEnd, Settings, Transport, after},
+};
+
+const CONTROL_SILENCE: Duration = Duration::from_hours(1);
+
+/// Relay errors contain classes and redacted protocol/IO sources.
+#[derive(Debug, Clone, Error)]
+#[non_exhaustive]
+pub enum RelayError {
+    /// The process entry point needs Linux and supported CPU architecture.
+    #[error("Lambda relay requires Linux x86_64 or arm64")]
+    UnsupportedPlatform,
+    /// Invalid operator-owned worker configuration.
+    #[error("invalid Lambda relay configuration")]
+    Configuration,
+    /// Unexpected EOF before a normal Close exchange.
+    #[error("Lambda relay control EOF")]
+    Eof,
+    /// Protocol validation/transport failure.
+    #[error("Lambda relay protocol failed")]
+    Protocol(#[source] Arc<ProtocolError>),
+    /// IO while reading the frame's first byte failed.
+    #[error("Lambda relay control IO failed")]
+    Io(#[source] Arc<io::Error>),
+    /// A frame belongs to another environment.
+    #[error("Lambda relay environment mismatch")]
+    Scope,
+    /// Message direction, identity or session phase is invalid.
+    #[error("unexpected Lambda relay control message")]
+    UnexpectedMessage,
+    /// An IO/retirement lease expired.
+    #[error("Lambda relay deadline exceeded")]
+    Deadline,
+    /// Output could not be confirmed flushed.
+    #[error("Lambda relay output failed")]
+    Output,
+    /// An owned worker terminated unexpectedly.
+    #[error("Lambda relay worker failed")]
+    Worker,
+    /// Shared session failed.
+    #[error(transparent)]
+    Session(#[from] SessionError),
+    /// The API could not be cleaned up.
+    #[error(transparent)]
+    Api(#[from] ApiError),
+}
+
+impl From<ProtocolError> for RelayError {
+    fn from(error: ProtocolError) -> Self {
+        Self::Protocol(Arc::new(error))
+    }
+}
+impl From<io::Error> for RelayError {
+    fn from(error: io::Error) -> Self {
+        Self::Io(Arc::new(error))
+    }
+}
+
+/// Validated environment identity and forwarded worker leases.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct RelayConfig {
+    environment: EnvironmentId,
+    architecture: Architecture,
+    idle_lease: Duration,
+    io_budget: Duration,
+    retirement_budget: Duration,
+}
+
+impl RelayConfig {
+    /// Validate worker leases without reading/mutating process environment.
+    ///
+    /// # Errors
+    /// Rejects zero leases, idle over24h or IO/retirement over60s.
+    ///
+    /// ```
+    /// # use rustack_lambda_runtime::{protocol::{EnvironmentId, Architecture}, relay::RelayConfig};
+    /// # use std::time::Duration;
+    /// let config = RelayConfig::new(EnvironmentId::default(), Architecture::Arm64,
+    ///     Duration::from_secs(600), Duration::from_secs(5), Duration::from_secs(10))?;
+    /// # Ok::<(), rustack_lambda_runtime::relay::RelayError>(())
+    /// ```
+    pub fn new(
+        environment: EnvironmentId,
+        architecture: Architecture,
+        idle_lease: Duration,
+        io_budget: Duration,
+        retirement_budget: Duration,
+    ) -> Result<Self, RelayError> {
+        if idle_lease.is_zero()
+            || idle_lease > Duration::from_hours(24)
+            || io_budget.is_zero()
+            || io_budget > Duration::from_secs(60)
+            || retirement_budget.is_zero()
+            || retirement_budget > Duration::from_secs(60)
+        {
+            return Err(RelayError::Configuration);
+        }
+        Ok(Self {
+            environment,
+            architecture,
+            idle_lease,
+            io_budget,
+            retirement_budget,
+        })
+    }
+}
+
+/// Owner of the relay supervisor; Drop signals stop without abandoning cleanup.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct RelayHandle {
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<(), RelayError>>>,
+    settlement: Option<Result<(), RelayError>>,
+}
+
+impl RelayHandle {
+    /// Await natural Close/EOF/failure without requesting shutdown.
+    ///
+    /// # Errors
+    /// Returns cached relay/protocol/supervision failures.
+    ///
+    /// ```no_run
+    /// # async fn wait(relay: &mut rustack_lambda_runtime::relay::RelayHandle) {
+    /// let outcome = relay.wait().await;
+    /// # }
+    /// ```
+    pub async fn wait(&mut self) -> Result<(), RelayError> {
+        if let Some(result) = &self.settlement {
+            return result.clone();
+        }
+        let result = match self.task.as_mut() {
+            Some(task) => task
+                .await
+                .map_err(|_| RelayError::Worker)
+                .and_then(|result| result),
+            None => Ok(()),
+        };
+        self.task.take();
+        self.settlement = Some(result.clone());
+        result
+    }
+
+    /// Signal priority stop and join the owned API/control workers.
+    ///
+    /// # Errors
+    /// Returns protocol, API cleanup or supervision failure.
+    ///
+    /// ```no_run
+    /// # async fn stop(relay: &mut rustack_lambda_runtime::relay::RelayHandle) {
+    /// let clean = relay.shutdown().await.is_ok();
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self) -> Result<(), RelayError> {
+        self.stop.send_replace(true);
+        self.wait().await
+    }
+}
+
+impl Drop for RelayHandle {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+
+/// Transfer the API and cancel-safe owned streams into one relay supervisor.
+///
+/// IO must be asynchronously cancellable; the Linux binary supplies nonblocking
+/// Unix pipes. A blocking stdin adapter cannot satisfy the shutdown contract.
+///
+/// # Errors
+/// Returns unavailable supervision when no Tokio runtime is entered.
+///
+/// ```no_run
+/// # async fn example(api: rustack_lambda_runtime::http::RuntimeApiHandle, config: rustack_lambda_runtime::relay::RelayConfig) -> Result<(), rustack_lambda_runtime::relay::RelayError> {
+/// let (reader, _) = tokio::io::duplex(1024);
+/// let (writer, _) = tokio::io::duplex(1024);
+/// let mut relay = rustack_lambda_runtime::relay::start(api, config, reader, writer)?;
+/// relay.shutdown().await?;
+/// # Ok(()) }
+/// ```
+pub fn start<R, W>(
+    mut api: RuntimeApiHandle,
+    config: RelayConfig,
+    reader: R,
+    writer: W,
+) -> Result<RelayHandle, RelayError>
+where
+    R: AsyncRead + Unpin + Send + 'static,
+    W: AsyncWrite + Unpin + Send + 'static,
+{
+    let runtime = Handle::try_current().map_err(|_| RelayError::Worker)?;
+    let (stop, stopped) = watch::channel(false);
+    let transport = Transport::start(
+        reader,
+        writer,
+        Settings {
+            silence: config.idle_lease.max(CONTROL_SILENCE),
+            io_budget: config.io_budget,
+            input_end: InputEnd::Close,
+        },
+    )?;
+    let initialization_error = api.take_initialization_error();
+    let actor = RelayActor::builder()
+        .api(api)
+        .config(config)
+        .transport(transport)
+        .stop(stopped)
+        .initialization_error(initialization_error)
+        .build();
+    let task = runtime.spawn(actor.run().with_current_subscriber());
+    Ok(RelayHandle {
+        stop,
+        task: Some(task),
+        settlement: None,
+    })
+}
+
+#[derive(Debug, Default)]
+enum Phase {
+    #[default]
+    Initializing,
+    Idle,
+    Busy(InvocationTicket),
+    Retiring(Instant),
+}
+
+impl Phase {
+    async fn result(&mut self) -> Result<RuntimeResult, SessionError> {
+        match self {
+            Self::Busy(ticket) => ticket.result().await,
+            _ => pending().await,
+        }
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+struct RelayActor {
+    api: RuntimeApiHandle,
+    config: RelayConfig,
+    transport: Transport,
+    stop: watch::Receiver<bool>,
+    initialization_error: Option<oneshot::Receiver<Payload>>,
+    #[builder(default)]
+    phase: Phase,
+    #[builder(default)]
+    bootstrap_announced: bool,
+    #[builder(default)]
+    last_attempt: Option<AttemptId>,
+}
+
+impl RelayActor {
+    async fn run(mut self) -> Result<(), RelayError> {
+        let outcome = self.control().await;
+        self.api.session().close();
+        let api = self.api.shutdown().await.map_err(RelayError::from);
+        let transport = self.transport.shutdown().await;
+        outcome.and(api).and(transport)
+    }
+
+    async fn emit(&self, message: Message) -> Result<(), RelayError> {
+        let deadline = match self.phase {
+            Phase::Retiring(until) => after(self.config.io_budget)?.min(until),
+            _ => after(self.config.io_budget)?,
+        };
+        self.transport
+            .send(Frame::new(self.config.environment, message), deadline)
+            .await
+    }
+
+    async fn control(&mut self) -> Result<(), RelayError> {
+        if *self.stop.borrow() {
+            return Ok(());
+        }
+        self.emit(Message::Hello {
+            architecture: self.config.architecture,
+        })
+        .await?;
+        self.emit(Message::Ready).await?;
+        let session = self.api.session().clone();
+        loop {
+            let retirement = match self.phase {
+                Phase::Retiring(deadline) => Some(deadline),
+                _ => None,
+            };
+            tokio::select! {
+                biased;
+                () = async { let _ = self.stop.wait_for(|stopped| *stopped).await; } => return Ok(()),
+                () = retirement_deadline(retirement) => return Err(RelayError::Deadline),
+                frame = self.transport.recv() => {
+                    let frame = frame?;
+                    if frame.environment() != self.config.environment { return Err(RelayError::Scope); }
+                    if self.command(frame.into_message()).await? { return Ok(()); }
+                }
+                error = initialization_error(&mut self.initialization_error), if self.initialization_error.is_some() && retirement.is_none() => {
+                    self.initialization_error = None;
+                    if let Some(payload) = error {
+                        self.emit(Message::InitError { payload }).await?;
+                        self.retire().await?;
+                    }
+                }
+                ready = session.bootstrap_ready(after(CONTROL_SILENCE)?), if !self.bootstrap_announced && !matches!(self.phase, Phase::Retiring(_)) => {
+                    ready?;
+                    self.bootstrap_announced = true;
+                    self.phase = Phase::Idle;
+                    self.emit(Message::BootstrapReady).await?;
+                }
+                result = self.phase.result() => {
+                    match result {
+                        Ok(result) => self.completed(result).await?,
+                        Err(SessionError::HandlerTimeout) => {
+                            let attempt=self.last_attempt.ok_or(RelayError::UnexpectedMessage)?;
+                            self.emit(Message::InvocationTimedOut { attempt }).await?;
+                            self.retire().await?;
+                        }
+                        Err(error) => return Err(error.into()),
+                    }
+                }
+                () = session.closed(), if !matches!(self.phase, Phase::Retiring(_)) => return Err(RelayError::Session(SessionError::Unavailable)),
+            }
+        }
+    }
+
+    async fn command(&mut self, message: Message) -> Result<bool, RelayError> {
+        match message {
+            Message::Invoke {
+                attempt,
+                deadline_unix_ms,
+                handler_timeout_ms,
+                function_arn,
+                trace_id,
+                payload,
+            } if matches!(self.phase, Phase::Idle) && self.last_attempt != Some(attempt) => {
+                let deadline =
+                    deadline_from_unix_ms(deadline_unix_ms).map_err(|_| RelayError::Deadline)?;
+                let mut invocation =
+                    Invocation::new(attempt, deadline, function_arn, trace_id, payload)?;
+                if let Some(timeout) = handler_timeout_ms {
+                    invocation = invocation.with_handler_timeout(timeout);
+                }
+                let ticket = self
+                    .api
+                    .session()
+                    .submit(invocation, after(self.config.io_budget)?.min(deadline))
+                    .await?;
+                self.last_attempt = Some(attempt);
+                self.phase = Phase::Busy(ticket);
+            }
+            Message::Cancel { attempt } if self.last_attempt == Some(attempt) => {
+                self.retire().await?;
+                self.emit(Message::Ack(Acknowledgement::Cancel(attempt)))
+                    .await?;
+            }
+            Message::Close => {
+                self.api.session().close();
+                self.api.shutdown().await?;
+                self.emit(Message::Ack(Acknowledgement::Close)).await?;
+                return Ok(true);
+            }
+            _ => return Err(RelayError::UnexpectedMessage),
+        }
+        Ok(false)
+    }
+
+    async fn completed(&mut self, result: RuntimeResult) -> Result<(), RelayError> {
+        let attempt = self.last_attempt.ok_or(RelayError::UnexpectedMessage)?;
+        self.phase = Phase::Idle;
+        match result {
+            RuntimeResult::Success(payload) => {
+                self.emit(Message::InvocationResult {
+                    attempt,
+                    outcome: Outcome::Success,
+                    payload,
+                })
+                .await?;
+            }
+            RuntimeResult::FunctionError(payload) => {
+                self.emit(Message::InvocationResult {
+                    attempt,
+                    outcome: Outcome::FunctionError,
+                    payload,
+                })
+                .await?;
+                self.retire().await?;
+            }
+            RuntimeResult::InitError(payload) => {
+                self.initialization_error = None;
+                self.emit(Message::InitError { payload }).await?;
+                self.retire().await?;
+            }
+        }
+        Ok(())
+    }
+
+    async fn retire(&mut self) -> Result<(), RelayError> {
+        if !matches!(self.phase, Phase::Retiring(_)) {
+            if let Phase::Busy(ticket) = &self.phase {
+                ticket.cancel();
+            }
+            self.api.session().close();
+            timeout_at(after(self.config.io_budget)?, self.api.session().closed())
+                .await
+                .map_err(|_| RelayError::Deadline)?;
+            self.phase = Phase::Retiring(after(self.config.retirement_budget)?);
+        }
+        Ok(())
+    }
+}
+
+async fn initialization_error(
+    receiver: &mut Option<oneshot::Receiver<Payload>>,
+) -> Option<Payload> {
+    match receiver {
+        Some(receiver) => receiver.await.ok(),
+        None => pending().await,
+    }
+}
+
+async fn retirement_deadline(deadline: Option<Instant>) {
+    match deadline {
+        Some(deadline) => sleep_until(deadline).await,
+        None => pending().await,
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-runtime/src/relay/tests.rs b/crates/rustack-lambda-runtime/src/relay/tests.rs
new file mode 100644
index 00000000..9ebaa570
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/relay/tests.rs
@@ -0,0 +1,461 @@
+use std::{
+    future::Future,
+    num::NonZeroU64,
+    task::{Context, Waker},
+};
+
+use bytes::Bytes;
+use tokio::{
+    io::{AsyncWriteExt, DuplexStream, duplex},
+    net::TcpStream,
+};
+
+use super::*;
+use crate::{
+    http::tests::{Reply, request},
+    metadata::{deadline_unix_ms, local_trace_id},
+    protocol::{FunctionArn, Payload, read_frame, write_frame},
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(3)
+}
+
+struct Harness {
+    owner: RelayHandle,
+    environment: EnvironmentId,
+    input: DuplexStream,
+    output: DuplexStream,
+    api: std::net::SocketAddr,
+}
+
+impl Harness {
+    async fn new() -> Self {
+        let api = crate::http::start().await.unwrap();
+        let address = api.addr();
+        let environment = EnvironmentId::default();
+        let config = RelayConfig::new(
+            environment,
+            Architecture::Arm64,
+            Duration::from_secs(600),
+            Duration::from_secs(1),
+            Duration::from_secs(2),
+        )
+        .unwrap();
+        let (input, reader) = duplex(128);
+        let (writer, output) = duplex(128);
+        let owner = start(api, config, reader, writer).unwrap();
+        let mut harness = Self {
+            owner,
+            environment,
+            input,
+            output,
+            api: address,
+        };
+        assert!(matches!(
+            harness.next().await,
+            Message::Hello {
+                architecture: Architecture::Arm64
+            }
+        ));
+        assert_eq!(harness.next().await, Message::Ready);
+        harness
+    }
+
+    async fn next(&mut self) -> Message {
+        let frame = read_frame(&mut self.output, deadline())
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(frame.environment(), self.environment);
+        frame.into_message()
+    }
+
+    async fn send(&mut self, message: Message) {
+        write_frame(
+            &mut self.input,
+            &Frame::new(self.environment, message),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    }
+
+    async fn close(mut self) {
+        self.send(Message::Close).await;
+        assert_eq!(self.next().await, Message::Ack(Acknowledgement::Close));
+        timeout_at(deadline(), self.owner.wait())
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(
+            read_frame(&mut self.output, deadline())
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert!(TcpStream::connect(self.api).await.is_err());
+    }
+
+    async fn bootstrap(&mut self) -> JoinHandle<Reply> {
+        let api = self.api;
+        let poll = tokio::spawn(async move {
+            request(api, "GET", "/2018-06-01/runtime/invocation/next", "", b"").await
+        });
+        assert_eq!(self.next().await, Message::BootstrapReady);
+        poll
+    }
+}
+
+fn invoke() -> (AttemptId, Message) {
+    let attempt = AttemptId::default();
+    (
+        attempt,
+        Message::Invoke {
+            attempt,
+            deadline_unix_ms: deadline_unix_ms(Instant::now() + Duration::from_secs(10)).unwrap(),
+            handler_timeout_ms: None,
+            function_arn: "arn:aws:lambda:us-east-1:000000000000:function:echo:prod"
+                .parse::<FunctionArn>()
+                .unwrap(),
+            trace_id: local_trace_id().unwrap(),
+            payload: Payload::try_from(Bytes::from_static(b"secret-event")).unwrap(),
+        },
+    )
+}
+
+#[tokio::test]
+async fn test_should_handshake_forward_http_results_and_reuse_one_session() {
+    let mut harness = Harness::new().await;
+    let first = harness.bootstrap().await;
+    for (index, poll) in [(0, Some(first)), (1, None)] {
+        let poll = poll.unwrap_or_else(|| {
+            let api = harness.api;
+            tokio::spawn(async move {
+                request(api, "GET", "/2018-06-01/runtime/invocation/next", "", b"").await
+            })
+        });
+        let (attempt, message) = invoke();
+        harness.send(message).await;
+        let event = poll.await.unwrap();
+        assert_eq!(event.status, 200);
+        assert_eq!(event.body, b"secret-event");
+        let computed = format!("{{\"computed\":{},\"iteration\":{index}}}", 6 * 7);
+        assert_eq!(
+            request(
+                harness.api,
+                "POST",
+                &format!("/2018-06-01/runtime/invocation/{attempt}/response"),
+                "",
+                computed.as_bytes()
+            )
+            .await
+            .status,
+            202
+        );
+        assert!(
+            matches!(harness.next().await, Message::InvocationResult { attempt: id, outcome: Outcome::Success, payload } if id == attempt && payload.as_ref() == computed.as_bytes())
+        );
+    }
+    harness.close().await;
+}
+
+#[tokio::test]
+async fn test_should_ack_cancel_while_busy_and_after_completion_without_replaying_a_result() {
+    for completed in [false, true] {
+        let mut harness = Harness::new().await;
+        let poll = harness.bootstrap().await;
+        let (attempt, message) = invoke();
+        harness.send(message).await;
+        assert_eq!(poll.await.unwrap().status, 200);
+        if completed {
+            assert_eq!(
+                request(
+                    harness.api,
+                    "POST",
+                    &format!("/2018-06-01/runtime/invocation/{attempt}/response"),
+                    "",
+                    b"done"
+                )
+                .await
+                .status,
+                202
+            );
+            assert!(matches!(
+                harness.next().await,
+                Message::InvocationResult {
+                    outcome: Outcome::Success,
+                    ..
+                }
+            ));
+        }
+        harness.send(Message::Cancel { attempt }).await;
+        assert_eq!(
+            harness.next().await,
+            Message::Ack(Acknowledgement::Cancel(attempt))
+        );
+        harness.send(Message::Cancel { attempt }).await;
+        assert_eq!(
+            harness.next().await,
+            Message::Ack(Acknowledgement::Cancel(attempt))
+        );
+        harness.close().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_distinguish_function_and_initialization_errors_and_allow_close_ack() {
+    let mut harness = Harness::new().await;
+    assert_eq!(
+        request(
+            harness.api,
+            "POST",
+            "/2018-06-01/runtime/init/error",
+            "",
+            b"secret-init-error"
+        )
+        .await
+        .status,
+        202
+    );
+    assert!(
+        matches!(harness.next().await, Message::InitError { payload } if payload.as_ref() == b"secret-init-error")
+    );
+    harness.close().await;
+    let mut harness = Harness::new().await;
+    let poll = harness.bootstrap().await;
+    let (attempt, message) = invoke();
+    harness.send(message).await;
+    poll.await.unwrap();
+    assert_eq!(
+        request(
+            harness.api,
+            "POST",
+            &format!("/2018-06-01/runtime/invocation/{attempt}/error"),
+            "",
+            b"secret-function-error"
+        )
+        .await
+        .status,
+        202
+    );
+    assert!(
+        matches!(harness.next().await, Message::InvocationResult { outcome: Outcome::FunctionError, payload, .. } if payload.as_ref() == b"secret-function-error")
+    );
+    harness.close().await;
+}
+
+#[tokio::test]
+async fn test_should_reject_foreign_scope_wrong_direction_and_invoke_before_bootstrap() {
+    for variant in 0..4 {
+        let mut harness = Harness::new().await;
+        match variant {
+            0 => write_frame(
+                &mut harness.input,
+                &Frame::new(EnvironmentId::default(), Message::Close),
+                deadline(),
+            )
+            .await
+            .unwrap(),
+            1 => harness.send(Message::Ready).await,
+            2 => {
+                harness
+                    .send(Message::InvocationTimedOut {
+                        attempt: AttemptId::default(),
+                    })
+                    .await;
+            }
+            _ => harness.send(invoke().1).await,
+        }
+        assert!(
+            timeout_at(deadline(), harness.owner.wait())
+                .await
+                .unwrap()
+                .is_err()
+        );
+        assert!(harness.owner.wait().await.is_err());
+        assert!(TcpStream::connect(harness.api).await.is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_retain_shutdown_after_dropping_its_waiter_and_interrupt_idle_input() {
+    let mut harness = Harness::new().await;
+    let mut waiting = Box::pin(harness.owner.shutdown());
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    assert!(harness.owner.task.is_some());
+    timeout_at(deadline(), harness.owner.shutdown())
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(TcpStream::connect(harness.api).await.is_err());
+}
+
+#[tokio::test]
+async fn test_should_cleanup_api_after_eof_and_truncated_control_frames() {
+    for truncated in [false, true] {
+        let mut harness = Harness::new().await;
+        if truncated {
+            harness.input.write_all(&[0, 0]).await.unwrap();
+        }
+        harness.input.shutdown().await.unwrap();
+        assert!(
+            timeout_at(deadline(), harness.owner.wait())
+                .await
+                .unwrap()
+                .is_err()
+        );
+        assert!(TcpStream::connect(harness.api).await.is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_reject_bad_clock_and_overlapping_invocations_without_success() {
+    for overlapping in [false, true] {
+        let mut harness = Harness::new().await;
+        let mut poll = Some(harness.bootstrap().await);
+        let (_, mut message) = invoke();
+        if overlapping {
+            harness.send(message).await;
+            poll.take().unwrap().await.unwrap();
+            message = invoke().1;
+        } else if let Message::Invoke {
+            deadline_unix_ms, ..
+        } = &mut message
+        {
+            *deadline_unix_ms = NonZeroU64::new(1).unwrap();
+        }
+        harness.send(message).await;
+        if let Some(poll) = poll {
+            let _ = poll.await;
+        }
+        assert!(
+            timeout_at(deadline(), harness.owner.wait())
+                .await
+                .unwrap()
+                .is_err()
+        );
+    }
+}
+
+#[tokio::test]
+async fn test_should_close_a_probe_before_any_function_has_polled() {
+    Harness::new().await.close().await;
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_bound_partial_frame_and_blocked_output_io_and_join_the_api() {
+    let mut harness = Harness::new().await;
+    harness.input.write_all(&[0]).await.unwrap();
+    assert!(
+        matches!(harness.owner.wait().await, Err(RelayError::Protocol(error)) if matches!(&*error, ProtocolError::Deadline))
+    );
+    assert!(TcpStream::connect(harness.api).await.is_err());
+
+    let api = crate::http::start().await.unwrap();
+    let address = api.addr();
+    let config = RelayConfig::new(
+        EnvironmentId::default(),
+        Architecture::Arm64,
+        Duration::from_secs(600),
+        Duration::from_secs(1),
+        Duration::from_secs(1),
+    )
+    .unwrap();
+    let (_host_input, reader) = duplex(1);
+    let (writer, _host_output) = duplex(1);
+    let mut owner = start(api, config, reader, writer).unwrap();
+    assert!(matches!(owner.wait().await, Err(RelayError::Output)));
+    assert!(TcpStream::connect(address).await.is_err());
+}
+
+#[tokio::test]
+async fn test_should_preserve_a_completed_io_failure_when_priority_stop_wins() {
+    let api = crate::http::start().await.unwrap();
+    let address = api.addr();
+    let config = RelayConfig::new(
+        EnvironmentId::default(),
+        Architecture::Arm64,
+        Duration::from_secs(600),
+        Duration::from_secs(1),
+        Duration::from_secs(1),
+    )
+    .unwrap();
+    let (input, reader) = duplex(16);
+    let (writer, _output) = duplex(16);
+    drop(input);
+    let mut transport = Transport::start(
+        reader,
+        writer,
+        Settings {
+            silence: CONTROL_SILENCE,
+            io_budget: config.io_budget,
+            input_end: InputEnd::Close,
+        },
+    )
+    .unwrap();
+    assert!(matches!(transport.recv().await, Err(RelayError::Eof)));
+    let (_stop, stopped) = watch::channel(true);
+    let actor = RelayActor::builder()
+        .api(api)
+        .config(config)
+        .transport(transport)
+        .stop(stopped)
+        .initialization_error(None)
+        .build();
+    assert!(matches!(actor.run().await, Err(RelayError::Eof)));
+    assert!(TcpStream::connect(address).await.is_err());
+}
+
+#[test]
+fn test_should_bound_relay_config() {
+    let environment = EnvironmentId::default();
+    assert!(
+        RelayConfig::new(
+            environment,
+            Architecture::Arm64,
+            Duration::ZERO,
+            Duration::from_secs(1),
+            Duration::from_secs(1)
+        )
+        .is_err()
+    );
+    assert!(
+        RelayConfig::new(
+            environment,
+            Architecture::Arm64,
+            Duration::from_secs(600),
+            Duration::from_secs(61),
+            Duration::from_secs(1)
+        )
+        .is_err()
+    );
+}
+
+#[tokio::test]
+async fn test_should_forward_delivered_handler_timeout_and_preserve_close_ack_retirement() {
+    let mut harness = Harness::new().await;
+    let poll = harness.bootstrap().await;
+    let (attempt, mut message) = invoke();
+    if let Message::Invoke {
+        handler_timeout_ms, ..
+    } = &mut message
+    {
+        *handler_timeout_ms =
+            Some(crate::protocol::HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+    }
+    harness.send(message).await;
+    let response = poll.await.unwrap();
+    assert_eq!(response.status, 200);
+    assert_eq!(
+        harness.next().await,
+        Message::InvocationTimedOut { attempt }
+    );
+    harness.close().await;
+}
diff --git a/crates/rustack-lambda-runtime/src/session.rs b/crates/rustack-lambda-runtime/src/session.rs
new file mode 100644
index 00000000..7d490ba8
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/session.rs
@@ -0,0 +1,1102 @@
+//! A single actor owns each environment's invocation and long-poll state.
+//!
+//! This module owns only in-process state/channels. Transport adapters own HTTP
+//! connections and the environment supervisor owns its process/container/VM.
+//! Session cancellation invalidates an attempt; it never proves user-code exit.
+
+use std::{fmt, future::pending, mem::replace, time::Duration};
+
+use thiserror::Error;
+use tokio::{
+    runtime::Handle,
+    sync::{
+        OwnedSemaphorePermit, mpsc,
+        oneshot::{self, error::TryRecvError},
+        watch,
+    },
+    task::JoinHandle,
+    time::{Instant, sleep_until, timeout_at},
+};
+use typed_builder::TypedBuilder;
+
+use crate::protocol::{AttemptId, FunctionArn, HandlerTimeout, Outcome, Payload, TraceId};
+
+const MAILBOX_CAPACITY: usize = 8;
+const MAX_IDLE_LEASE: Duration = Duration::from_hours(24);
+
+/// Bounded session errors never include function inputs or peer-supplied values.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+#[non_exhaustive]
+pub enum SessionError {
+    /// Actor stopped or an owner disappeared.
+    #[error("runtime session unavailable")]
+    Unavailable,
+    /// One invocation/poll is already active, or the mailbox is full.
+    #[error("runtime session busy")]
+    Busy,
+    /// Completion does not identify the delivered active attempt.
+    #[error("unknown runtime invocation attempt")]
+    UnknownAttempt,
+    /// Command, idle lease or attempt deadline expired.
+    #[error("runtime session deadline exceeded")]
+    Deadline,
+    /// The delivered handler's separate function timeout expired first.
+    #[error("function handler timeout exceeded")]
+    HandlerTimeout,
+    /// Caller or environment owner cancelled the session.
+    #[error("runtime session cancelled")]
+    Cancelled,
+    /// A lease/deadline cannot be represented or is outside its range.
+    #[error("invalid runtime session metadata")]
+    InvalidMetadata,
+    /// The owned actor panicked or failed to join.
+    #[error("runtime session supervisor failed")]
+    SupervisorFailed,
+}
+
+/// Captured, validated event and runtime metadata for a single attempt.
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct Invocation {
+    attempt: AttemptId,
+    deadline: Instant,
+    handler_timeout: Option<HandlerTimeout>,
+    function_arn: FunctionArn,
+    trace_id: TraceId,
+    payload: Payload,
+}
+
+impl Invocation {
+    /// Capture one event and its absolute monotonic deadline.
+    ///
+    /// # Errors
+    /// Returns Deadline if the attempt has already expired.
+    ///
+    /// ```
+    /// # use rustack_lambda_runtime::{protocol::{AttemptId, Payload}, session::Invocation};
+    /// # fn example() -> Result<(), Box<dyn std::error::Error>> {
+    /// let call = Invocation::new(
+    ///     AttemptId::default(), tokio::time::Instant::now() + std::time::Duration::from_secs(5),
+    ///     "arn:aws:lambda:us-east-1:000000000000:function:echo".parse()?,
+    ///     "Root=1-00000000-000000000000000000000000;Sampled=0".parse()?,
+    ///     Payload::try_from(bytes::Bytes::from_static(b"{}"))?,
+    /// )?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        attempt: AttemptId,
+        deadline: Instant,
+        function_arn: FunctionArn,
+        trace_id: TraceId,
+        payload: Payload,
+    ) -> Result<Self, SessionError> {
+        check_deadline(deadline)?;
+        Ok(Self {
+            attempt,
+            deadline,
+            handler_timeout: None,
+            function_arn,
+            trace_id,
+            payload,
+        })
+    }
+
+    /// Attach a validated handler budget; it starts only at consumed delivery.
+    ///
+    /// ```no_run
+    /// # fn timed(call: rustack_lambda_runtime::session::Invocation, timeout: rustack_lambda_runtime::protocol::HandlerTimeout) {
+    /// let timed = call.with_handler_timeout(timeout);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn with_handler_timeout(mut self, timeout: HandlerTimeout) -> Self {
+        self.handler_timeout = Some(timeout);
+        self
+    }
+
+    /// Read the relative handler budget without arming it.
+    ///
+    /// ```no_run
+    /// # fn inspect(call: &rustack_lambda_runtime::session::Invocation) { let timeout = call.handler_timeout(); }
+    /// ```
+    #[must_use]
+    pub fn handler_timeout(&self) -> Option<HandlerTimeout> {
+        self.handler_timeout
+    }
+
+    fn timing(&self, started: Instant) -> Result<(Instant, SessionError), SessionError> {
+        if let Some(timeout) = self.handler_timeout {
+            let handler = started
+                .checked_add(timeout.duration())
+                .ok_or(SessionError::InvalidMetadata)?;
+            if handler < self.deadline {
+                return Ok((handler, SessionError::HandlerTimeout));
+            }
+        }
+        Ok((self.deadline, SessionError::Deadline))
+    }
+
+    /// Borrow all event metadata and payload without copying bytes.
+    ///
+    /// ```
+    /// # fn inspect(call: &rustack_lambda_runtime::session::Invocation) {
+    /// let (attempt, deadline, arn, trace, payload) = call.parts();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn parts(&self) -> (AttemptId, Instant, &FunctionArn, &TraceId, &Payload) {
+        (
+            self.attempt,
+            self.deadline,
+            &self.function_arn,
+            &self.trace_id,
+            &self.payload,
+        )
+    }
+}
+
+/// One accepted runtime result; raw payload diagnostics are always redacted.
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum RuntimeResult {
+    /// Function /response.
+    Success(Payload),
+    /// Function /error.
+    FunctionError(Payload),
+    /// Fatal initialization error before any event delivery.
+    InitError(Payload),
+}
+
+/// Attached ownership of a session attempt; Drop invalidates only this attempt.
+#[non_exhaustive]
+pub struct InvocationTicket {
+    attempt: AttemptId,
+    deadline: Instant,
+    cancellation: watch::Sender<bool>,
+    response: oneshot::Receiver<Result<RuntimeResult, SessionError>>,
+    attached: bool,
+}
+
+impl fmt::Debug for InvocationTicket {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("InvocationTicket")
+            .field("attempt", &self.attempt)
+            .field("deadline", &self.deadline)
+            .finish_non_exhaustive()
+    }
+}
+
+impl InvocationTicket {
+    /// Identity used by the delivered Runtime API event.
+    ///
+    /// ```
+    /// # fn inspect(ticket: &rustack_lambda_runtime::session::InvocationTicket) {
+    /// let attempt = ticket.attempt();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn attempt(&self) -> AttemptId {
+        self.attempt
+    }
+
+    /// Request invalidation; the environment supervisor still owns termination.
+    ///
+    /// ```
+    /// # fn stop(ticket: &rustack_lambda_runtime::session::InvocationTicket) {
+    /// ticket.cancel();
+    /// # }
+    /// ```
+    pub fn cancel(&self) {
+        self.cancellation.send_replace(true);
+    }
+
+    /// Await a single result within the attempt's absolute deadline.
+    ///
+    /// # Errors
+    /// Returns cancellation/expiry, session failure or disconnected supervision.
+    ///
+    /// ```no_run
+    /// # async fn finish(ticket: rustack_lambda_runtime::session::InvocationTicket) {
+    /// let result = ticket.wait().await;
+    /// # }
+    /// ```
+    pub async fn wait(mut self) -> Result<RuntimeResult, SessionError> {
+        self.result().await
+    }
+
+    /// Await while retaining ticket ownership across a cancelled select branch.
+    ///
+    /// # Errors
+    /// Returns cancellation, expiry or session failure. Repeated calls after a
+    /// terminal result return Unavailable, without polling the consumed channel.
+    ///
+    /// ```no_run
+    /// # async fn inspect(ticket: &mut rustack_lambda_runtime::session::InvocationTicket) {
+    /// let result = ticket.result().await;
+    /// # }
+    /// ```
+    pub async fn result(&mut self) -> Result<RuntimeResult, SessionError> {
+        if !self.attached {
+            return Err(SessionError::Unavailable);
+        }
+        if let Err(error) = check_deadline(self.deadline) {
+            self.cancel();
+            self.attached = false;
+            return Err(error);
+        }
+        let cancelled = *self.cancellation.borrow();
+        if cancelled {
+            self.attached = false;
+            return Err(SessionError::Cancelled);
+        }
+        let result = timeout_at(self.deadline, &mut self.response).await;
+        // The response channel has either settled or the attempt has expired.
+        // Keep a completed receiver from ever being polled a second time.
+        self.attached = false;
+        let result = match result {
+            Ok(Ok(result)) => result,
+            Ok(Err(_)) => {
+                self.cancel();
+                return Err(SessionError::Unavailable);
+            }
+            Err(_) => {
+                self.cancel();
+                return Err(SessionError::Deadline);
+            }
+        };
+        if let Err(error) = check_deadline(self.deadline) {
+            self.cancel();
+            return Err(error);
+        }
+        if *self.cancellation.borrow() {
+            return Err(SessionError::Cancelled);
+        }
+        result
+    }
+}
+
+impl Drop for InvocationTicket {
+    fn drop(&mut self) {
+        if self.attached {
+            self.cancel();
+        }
+    }
+}
+
+/// Cloneable bounded command port; no mutable invocation state is shared.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct SessionHandle {
+    inbox: mpsc::Sender<Envelope>,
+    stop: watch::Sender<bool>,
+    bootstrap: watch::Receiver<bool>,
+}
+
+/// Owner of the actor and take-once initialization-error notification.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct RuntimeSession {
+    handle: SessionHandle,
+    task: Option<JoinHandle<()>>,
+    initialization_error: Option<oneshot::Receiver<Payload>>,
+    settlement: Option<Result<(), SessionError>>,
+}
+
+impl RuntimeSession {
+    /// Start a single-invocation actor with a bounded idle lease.
+    ///
+    /// # Errors
+    /// Rejects a zero/over24h lease, unrepresentable deadline or missing Tokio runtime.
+    ///
+    /// ```no_run
+    /// # async fn example() -> Result<(), rustack_lambda_runtime::session::SessionError> {
+    /// let mut session = rustack_lambda_runtime::session::RuntimeSession::start(std::time::Duration::from_secs(60))?;
+    /// session.shutdown().await?;
+    /// # Ok(()) }
+    /// ```
+    pub fn start(idle_lease: Duration) -> Result<Self, SessionError> {
+        if idle_lease.is_zero() || idle_lease > MAX_IDLE_LEASE {
+            return Err(SessionError::InvalidMetadata);
+        }
+        let runtime = Handle::try_current().map_err(|_| SessionError::Unavailable)?;
+        let idle_deadline = Instant::now()
+            .checked_add(idle_lease)
+            .ok_or(SessionError::InvalidMetadata)?;
+        let (inbox, commands) = mpsc::channel(MAILBOX_CAPACITY);
+        let (stop, stopped) = watch::channel(false);
+        let (bootstrap, initialized) = watch::channel(false);
+        let (initialization_error, error) = oneshot::channel();
+        let actor = SessionActor::builder()
+            .inbox(commands)
+            .stop(stopped)
+            .bootstrap(bootstrap)
+            .initialization_error(Some(initialization_error))
+            .idle_lease(idle_lease)
+            .idle_deadline(idle_deadline)
+            .build();
+        Ok(Self {
+            handle: SessionHandle {
+                inbox,
+                stop,
+                bootstrap: initialized,
+            },
+            task: Some(runtime.spawn(actor.run())),
+            initialization_error: Some(error),
+            settlement: None,
+        })
+    }
+
+    /// Borrow the actor's command port.
+    ///
+    /// ```
+    /// # fn inspect(session: &rustack_lambda_runtime::session::RuntimeSession) {
+    /// let handle = session.handle().clone();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn handle(&self) -> &SessionHandle {
+        &self.handle
+    }
+
+    /// Transfer the initialization notification exactly once.
+    ///
+    /// ```
+    /// # fn inspect(session: &mut rustack_lambda_runtime::session::RuntimeSession) {
+    /// let notification = session.take_initialization_error();
+    /// assert!(session.take_initialization_error().is_none());
+    /// # }
+    /// ```
+    pub fn take_initialization_error(&mut self) -> Option<oneshot::Receiver<Payload>> {
+        self.initialization_error.take()
+    }
+
+    /// Signal stop and join the owned actor; cancelling a waiter retains its handle.
+    ///
+    /// # Errors
+    /// Returns `SupervisorFailed` if the actor panicked or failed to join.
+    ///
+    /// ```no_run
+    /// # async fn stop(session: &mut rustack_lambda_runtime::session::RuntimeSession) {
+    /// let clean = session.shutdown().await.is_ok();
+    /// # }
+    /// ```
+    pub async fn shutdown(&mut self) -> Result<(), SessionError> {
+        self.handle.close();
+        if let Some(result) = self.settlement {
+            return result;
+        }
+        let result = if let Some(task) = self.task.as_mut() {
+            task.await.map_err(|_| SessionError::SupervisorFailed)
+        } else {
+            Ok(())
+        };
+        self.task.take();
+        self.settlement = Some(result);
+        result
+    }
+}
+
+impl Drop for RuntimeSession {
+    fn drop(&mut self) {
+        self.handle.close();
+    }
+}
+
+impl SessionHandle {
+    fn send(&self, command: Command, deadline: Instant) -> Result<(), SessionError> {
+        self.send_with_body_permit(command, deadline, None)
+    }
+
+    fn send_with_body_permit(
+        &self,
+        command: Command,
+        deadline: Instant,
+        body_permit: Option<OwnedSemaphorePermit>,
+    ) -> Result<(), SessionError> {
+        check_deadline(deadline)?;
+        if *self.stop.borrow() {
+            return Err(SessionError::Unavailable);
+        }
+        self.inbox
+            .try_send(Envelope {
+                deadline,
+                command,
+                _body_permit: body_permit,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => SessionError::Busy,
+                mpsc::error::TrySendError::Closed(_) => SessionError::Unavailable,
+            })
+    }
+
+    /// Admit one event; a dropped admission future cancels its own attempt.
+    ///
+    /// # Errors
+    /// Returns Busy, cancellation/expiry or unavailable supervision.
+    ///
+    /// ```no_run
+    /// # async fn submit(handle: &rustack_lambda_runtime::session::SessionHandle, call: rustack_lambda_runtime::session::Invocation) {
+    /// let deadline = call.parts().1;
+    /// let ticket = handle.submit(call, deadline).await;
+    /// # }
+    /// ```
+    pub async fn submit(
+        &self,
+        invocation: Invocation,
+        deadline: Instant,
+    ) -> Result<InvocationTicket, SessionError> {
+        check_deadline(deadline)?;
+        check_deadline(invocation.deadline)?;
+        let (cancellation, cancelled) = watch::channel(false);
+        let (response, result) = oneshot::channel();
+        let (admitted, accepted) = oneshot::channel();
+        let ticket = InvocationTicket {
+            attempt: invocation.attempt,
+            deadline: invocation.deadline,
+            cancellation,
+            response: result,
+            attached: true,
+        };
+        self.send(
+            Command::Submit {
+                invocation,
+                cancellation: cancelled,
+                response,
+                admitted,
+            },
+            deadline,
+        )?;
+        receive(accepted, deadline).await??;
+        Ok(ticket)
+    }
+
+    /// Wait for the next event, allowing exactly one outstanding poll.
+    ///
+    /// # Errors
+    /// Returns Busy for a concurrent poll/active delivery, expiry or closed session.
+    ///
+    /// ```no_run
+    /// # async fn poll(handle: &rustack_lambda_runtime::session::SessionHandle) {
+    /// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(60);
+    /// let event = handle.next(deadline).await;
+    /// # }
+    /// ```
+    pub async fn next(&self, deadline: Instant) -> Result<Invocation, SessionError> {
+        check_deadline(deadline)?;
+        let (reply, response) = oneshot::channel();
+        self.send(Command::Next { reply }, deadline)?;
+        let mut delivery = receive(response, deadline).await??;
+        let started = Instant::now();
+        let (effective, _) = delivery.invocation.timing(started)?;
+        check_deadline(effective)?;
+        delivery.invocation.deadline = effective;
+        delivery
+            .receipt
+            .send(started)
+            .map_err(|_| SessionError::Unavailable)?;
+        Ok(delivery.invocation)
+    }
+
+    /// Validate and settle exactly one delivered attempt.
+    ///
+    /// # Errors
+    /// Rejects stale/mismatched identities, deadline expiry, overload or closure.
+    ///
+    /// ```no_run
+    /// # async fn complete(handle: &rustack_lambda_runtime::session::SessionHandle, attempt: rustack_lambda_runtime::protocol::AttemptId, payload: rustack_lambda_runtime::protocol::Payload) {
+    /// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(5);
+    /// let result = handle.complete(attempt, None, rustack_lambda_runtime::protocol::Outcome::Success, payload, deadline).await;
+    /// # }
+    /// ```
+    pub async fn complete(
+        &self,
+        attempt: AttemptId,
+        invocation_id: Option<AttemptId>,
+        outcome: Outcome,
+        payload: Payload,
+        deadline: Instant,
+    ) -> Result<(), SessionError> {
+        self.complete_with_body_permit(attempt, invocation_id, outcome, payload, deadline, None)
+            .await
+    }
+
+    /// Retain HTTP body admission with the accepted envelope until actor settlement.
+    pub(crate) async fn complete_with_body_permit(
+        &self,
+        attempt: AttemptId,
+        invocation_id: Option<AttemptId>,
+        outcome: Outcome,
+        payload: Payload,
+        deadline: Instant,
+        body_permit: Option<OwnedSemaphorePermit>,
+    ) -> Result<(), SessionError> {
+        check_deadline(deadline)?;
+        let (reply, response) = oneshot::channel();
+        self.send_with_body_permit(
+            Command::Complete {
+                attempt,
+                invocation_id,
+                outcome,
+                payload,
+                reply,
+            },
+            deadline,
+            body_permit,
+        )?;
+        receive(response, deadline).await?
+    }
+
+    /// Report a fatal initialization failure before any event delivery.
+    ///
+    /// # Errors
+    /// Returns Busy after delivery, or command deadline/overload/session failure.
+    ///
+    /// ```no_run
+    /// # async fn fail(handle: &rustack_lambda_runtime::session::SessionHandle, payload: rustack_lambda_runtime::protocol::Payload) {
+    /// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(5);
+    /// let result = handle.initialization_error(payload, deadline).await;
+    /// # }
+    /// ```
+    pub async fn initialization_error(
+        &self,
+        payload: Payload,
+        deadline: Instant,
+    ) -> Result<(), SessionError> {
+        self.initialization_error_with_body_permit(payload, deadline, None)
+            .await
+    }
+
+    /// Retain an initialization error body even after its HTTP observer disappears.
+    pub(crate) async fn initialization_error_with_body_permit(
+        &self,
+        payload: Payload,
+        deadline: Instant,
+        body_permit: Option<OwnedSemaphorePermit>,
+    ) -> Result<(), SessionError> {
+        check_deadline(deadline)?;
+        let (reply, response) = oneshot::channel();
+        self.send_with_body_permit(Command::InitError { payload, reply }, deadline, body_permit)?;
+        receive(response, deadline).await?
+    }
+
+    /// Await the first valid GET /next; listener readiness cannot satisfy this.
+    ///
+    /// # Errors
+    /// Returns deadline expiry or closure before the first poll.
+    ///
+    /// ```no_run
+    /// # async fn ready(handle: &rustack_lambda_runtime::session::SessionHandle) {
+    /// let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(5);
+    /// let ready = handle.bootstrap_ready(deadline).await;
+    /// # }
+    /// ```
+    pub async fn bootstrap_ready(&self, deadline: Instant) -> Result<(), SessionError> {
+        check_deadline(deadline)?;
+        let mut bootstrap = self.bootstrap.clone();
+        timeout_at(deadline, bootstrap.wait_for(|ready| *ready))
+            .await
+            .map_err(|_| SessionError::Deadline)?
+            .map_err(|_| SessionError::Unavailable)?;
+        check_deadline(deadline)
+    }
+
+    /// Signal priority shutdown without waiting for the ordinary command mailbox.
+    ///
+    /// ```
+    /// # fn stop(handle: &rustack_lambda_runtime::session::SessionHandle) {
+    /// handle.close();
+    /// # }
+    /// ```
+    pub fn close(&self) {
+        self.stop.send_replace(true);
+    }
+
+    /// Wait until the actor closes its command receiver.
+    ///
+    /// ```no_run
+    /// # async fn closed(handle: &rustack_lambda_runtime::session::SessionHandle) {
+    /// handle.closed().await;
+    /// # }
+    /// ```
+    pub async fn closed(&self) {
+        self.inbox.closed().await;
+    }
+
+    /// Whether admission is closed or its owner has requested stop.
+    ///
+    /// ```
+    /// # fn inspect(handle: &rustack_lambda_runtime::session::SessionHandle) {
+    /// let closed = handle.is_closed();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn is_closed(&self) -> bool {
+        *self.stop.borrow() || self.inbox.is_closed()
+    }
+}
+
+fn check_deadline(deadline: Instant) -> Result<(), SessionError> {
+    if Instant::now() >= deadline {
+        Err(SessionError::Deadline)
+    } else {
+        Ok(())
+    }
+}
+
+async fn receive<T>(response: oneshot::Receiver<T>, deadline: Instant) -> Result<T, SessionError> {
+    let result = timeout_at(deadline, response)
+        .await
+        .map_err(|_| SessionError::Deadline)?
+        .map_err(|_| SessionError::Unavailable)?;
+    check_deadline(deadline)?;
+    Ok(result)
+}
+
+#[derive(Debug)]
+struct Envelope {
+    deadline: Instant,
+    command: Command,
+    _body_permit: Option<OwnedSemaphorePermit>,
+}
+
+#[derive(Debug)]
+enum Command {
+    Submit {
+        invocation: Invocation,
+        cancellation: watch::Receiver<bool>,
+        response: oneshot::Sender<Result<RuntimeResult, SessionError>>,
+        admitted: oneshot::Sender<Result<(), SessionError>>,
+    },
+    Next {
+        reply: oneshot::Sender<Result<PollDelivery, SessionError>>,
+    },
+    Complete {
+        attempt: AttemptId,
+        invocation_id: Option<AttemptId>,
+        outcome: Outcome,
+        payload: Payload,
+        reply: oneshot::Sender<Result<(), SessionError>>,
+    },
+    InitError {
+        payload: Payload,
+        reply: oneshot::Sender<Result<(), SessionError>>,
+    },
+}
+
+#[derive(Debug)]
+struct Pending {
+    attempt: AttemptId,
+    deadline: Instant,
+    timeout_error: SessionError,
+    cancellation: watch::Receiver<bool>,
+    response: oneshot::Sender<Result<RuntimeResult, SessionError>>,
+}
+
+impl Pending {
+    fn check(&self) -> Result<(), SessionError> {
+        if Instant::now() >= self.deadline {
+            return Err(self.timeout_error);
+        }
+        if *self.cancellation.borrow() || self.cancellation.has_changed().is_err() {
+            Err(SessionError::Cancelled)
+        } else {
+            Ok(())
+        }
+    }
+}
+
+#[derive(Debug)]
+struct PollDelivery {
+    invocation: Invocation,
+    receipt: oneshot::Sender<Instant>,
+}
+
+#[derive(Debug)]
+enum PhaseEvent {
+    Cancelled,
+    Receipt(Option<Instant>),
+}
+
+#[derive(Debug, Default)]
+enum Phase {
+    #[default]
+    Idle,
+    Queued {
+        invocation: Invocation,
+        pending: Pending,
+    },
+    Offering {
+        invocation: Invocation,
+        pending: Pending,
+        receipt: oneshot::Receiver<Instant>,
+    },
+    Delivered(Pending),
+    Closed,
+}
+
+impl Phase {
+    fn pending(&self) -> Option<&Pending> {
+        match self {
+            Self::Queued { pending, .. }
+            | Self::Offering { pending, .. }
+            | Self::Delivered(pending) => Some(pending),
+            _ => None,
+        }
+    }
+
+    async fn event(&mut self) -> PhaseEvent {
+        match self {
+            Self::Offering {
+                pending, receipt, ..
+            } => {
+                tokio::select! {
+                    biased;
+                    () = async { let _ = pending.cancellation.wait_for(|cancelled| *cancelled).await; } => PhaseEvent::Cancelled,
+                    result = receipt => PhaseEvent::Receipt(result.ok()),
+                }
+            }
+            Self::Queued { pending, .. } | Self::Delivered(pending) => {
+                let _ = pending.cancellation.wait_for(|cancelled| *cancelled).await;
+                PhaseEvent::Cancelled
+            }
+            _ => pending().await,
+        }
+    }
+}
+
+#[derive(Debug, TypedBuilder)]
+struct SessionActor {
+    inbox: mpsc::Receiver<Envelope>,
+    stop: watch::Receiver<bool>,
+    bootstrap: watch::Sender<bool>,
+    initialization_error: Option<oneshot::Sender<Payload>>,
+    idle_lease: Duration,
+    idle_deadline: Instant,
+    #[builder(default)]
+    phase: Phase,
+    #[builder(default)]
+    poll: Option<oneshot::Sender<Result<PollDelivery, SessionError>>>,
+    #[builder(default)]
+    ever_delivered: bool,
+}
+
+impl SessionActor {
+    async fn run(mut self) {
+        loop {
+            if *self.stop.borrow() {
+                self.close(SessionError::Cancelled);
+                break;
+            }
+            self.reconcile_receipt();
+            if matches!(self.phase, Phase::Closed) {
+                break;
+            }
+            let deadline = self
+                .phase
+                .pending()
+                .map_or(self.idle_deadline, |pending| pending.deadline);
+            tokio::select! {
+                biased;
+                () = async { let _ = self.stop.wait_for(|stopped| *stopped).await; } => { self.close(SessionError::Cancelled); break; }
+                () = sleep_until(deadline) => {
+                    self.reconcile_receipt();
+                    if matches!(self.phase, Phase::Closed) { break; }
+                    let error = self.phase.pending().map_or_else(
+                        || (Instant::now() >= self.idle_deadline).then_some(SessionError::Deadline),
+                        |pending| pending.check().err(),
+                    );
+                    if let Some(error) = error { self.close(error); break; }
+                }
+                event = self.phase.event() => {
+                    match event {
+                        PhaseEvent::Cancelled => { self.close(SessionError::Cancelled); break; }
+                        PhaseEvent::Receipt(received) => self.received(received),
+                    }
+                }
+                command = self.inbox.recv() => {
+                    let Some(Envelope { command, deadline, _body_permit }) = command else { self.close(SessionError::Unavailable); break; };
+                    if let Err(error) = check_deadline(deadline) { reject(command, error); continue; }
+                    if self.command(command) {
+                        let Some(deadline) = Instant::now().checked_add(self.idle_lease) else { self.close(SessionError::InvalidMetadata); break; };
+                        self.idle_deadline = deadline;
+                    }
+                    if matches!(self.phase, Phase::Closed) { break; }
+                    self.deliver();
+                }
+            }
+        }
+    }
+
+    fn command(&mut self, command: Command) -> bool {
+        self.reconcile_receipt();
+        let error = if *self.stop.borrow() {
+            Some(SessionError::Cancelled)
+        } else if matches!(self.phase, Phase::Closed) {
+            Some(SessionError::Unavailable)
+        } else {
+            self.phase
+                .pending()
+                .and_then(|pending| pending.check().err())
+        };
+        if let Some(error) = error {
+            self.close(error);
+            reject(command, error);
+            return false;
+        }
+        match command {
+            Command::Submit {
+                invocation,
+                cancellation,
+                response,
+                admitted,
+            } => {
+                let error = if !matches!(self.phase, Phase::Idle) {
+                    Some(SessionError::Busy)
+                } else if check_deadline(invocation.deadline).is_err() {
+                    Some(SessionError::Deadline)
+                } else if *cancellation.borrow() || cancellation.has_changed().is_err() {
+                    Some(SessionError::Cancelled)
+                } else {
+                    None
+                };
+                if let Some(error) = error {
+                    let _ = admitted.send(Err(error));
+                    return false;
+                }
+                let pending = Pending {
+                    attempt: invocation.attempt,
+                    deadline: invocation.deadline,
+                    timeout_error: SessionError::Deadline,
+                    cancellation,
+                    response,
+                };
+                self.phase = Phase::Queued {
+                    invocation,
+                    pending,
+                };
+                let _ = admitted.send(Ok(()));
+                true
+            }
+            Command::Next { reply } => {
+                if matches!(self.phase, Phase::Offering { .. } | Phase::Delivered(_))
+                    || self.poll.as_ref().is_some_and(|poll| !poll.is_closed())
+                {
+                    let _ = reply.send(Err(SessionError::Busy));
+                    return false;
+                }
+                if reply.is_closed() {
+                    return false;
+                }
+                self.bootstrap.send_if_modified(|ready| {
+                    let changed = !*ready;
+                    *ready = true;
+                    changed
+                });
+                self.poll = Some(reply);
+                true
+            }
+            Command::Complete {
+                attempt,
+                invocation_id,
+                outcome,
+                payload,
+                reply,
+            } => self.complete(attempt, invocation_id, outcome, payload, reply),
+            Command::InitError { payload, reply } => {
+                if let Some(error) = self
+                    .phase
+                    .pending()
+                    .and_then(|pending| pending.check().err())
+                {
+                    self.close(error);
+                    let _ = reply.send(Err(error));
+                    return false;
+                }
+                if self.ever_delivered {
+                    let _ = reply.send(Err(SessionError::Busy));
+                    return false;
+                }
+                if let Some(notification) = self.initialization_error.take() {
+                    let _ = notification.send(payload.clone());
+                }
+                if let Some(pending) = self.take_pending() {
+                    let _ = pending.response.send(Ok(RuntimeResult::InitError(payload)));
+                }
+                self.close(SessionError::Unavailable);
+                let _ = reply.send(Ok(()));
+                true
+            }
+        }
+    }
+
+    fn reconcile_receipt(&mut self) {
+        let received = match &mut self.phase {
+            Phase::Offering { receipt, .. } => match receipt.try_recv() {
+                Ok(started) => Some(Some(started)),
+                Err(TryRecvError::Closed) => Some(None),
+                Err(TryRecvError::Empty) => None,
+            },
+            _ => None,
+        };
+        if let Some(received) = received {
+            self.received(received);
+        }
+    }
+
+    fn complete(
+        &mut self,
+        attempt: AttemptId,
+        invocation_id: Option<AttemptId>,
+        outcome: Outcome,
+        payload: Payload,
+        reply: oneshot::Sender<Result<(), SessionError>>,
+    ) -> bool {
+        let valid = matches!(&self.phase, Phase::Delivered(pending) if pending.attempt == attempt)
+            && invocation_id.is_none_or(|id| id == attempt);
+        if !valid {
+            let _ = reply.send(Err(SessionError::UnknownAttempt));
+            return false;
+        }
+        let Phase::Delivered(pending) = replace(&mut self.phase, Phase::Idle) else {
+            let _ = reply.send(Err(SessionError::Unavailable));
+            return false;
+        };
+        let result = if let Err(error) = pending.check() {
+            let _ = pending.response.send(Err(error));
+            self.close(error);
+            Err(error)
+        } else {
+            let result = match outcome {
+                Outcome::Success => RuntimeResult::Success(payload),
+                Outcome::FunctionError => RuntimeResult::FunctionError(payload),
+            };
+            if pending.response.send(Ok(result)).is_err() {
+                self.close(SessionError::Cancelled);
+                Err(SessionError::Cancelled)
+            } else {
+                Ok(())
+            }
+        };
+        let accepted = result.is_ok();
+        let _ = reply.send(result);
+        accepted
+    }
+
+    fn deliver(&mut self) {
+        if !matches!(self.phase, Phase::Queued { .. }) {
+            return;
+        }
+        let Some(poll) = self.poll.take() else {
+            return;
+        };
+        let Phase::Queued {
+            invocation,
+            pending,
+        } = replace(&mut self.phase, Phase::Idle)
+        else {
+            return;
+        };
+        if let Err(error) = pending.check() {
+            let _ = poll.send(Err(error));
+            let _ = pending.response.send(Err(error));
+            self.close(error);
+            return;
+        }
+        let (receipt, received) = oneshot::channel();
+        match poll.send(Ok(PollDelivery {
+            invocation: invocation.clone(),
+            receipt,
+        })) {
+            Ok(()) => {
+                self.phase = Phase::Offering {
+                    invocation,
+                    pending,
+                    receipt: received,
+                };
+            }
+            Err(_) => {
+                self.phase = Phase::Queued {
+                    invocation,
+                    pending,
+                };
+            }
+        }
+    }
+
+    fn received(&mut self, received: Option<Instant>) {
+        let Phase::Offering {
+            invocation,
+            mut pending,
+            ..
+        } = replace(&mut self.phase, Phase::Idle)
+        else {
+            return;
+        };
+        if let Some(started) = received {
+            match invocation.timing(started) {
+                Ok((deadline, error)) => {
+                    pending.deadline = deadline;
+                    pending.timeout_error = error;
+                }
+                Err(error) => {
+                    let _ = pending.response.send(Err(error));
+                    self.close(error);
+                    return;
+                }
+            }
+            self.ever_delivered = true;
+        }
+        if let Err(error) = pending.check() {
+            let _ = pending.response.send(Err(error));
+            self.close(error);
+            return;
+        }
+        self.phase = if received.is_some() {
+            Phase::Delivered(pending)
+        } else {
+            Phase::Queued {
+                invocation,
+                pending,
+            }
+        };
+    }
+
+    fn take_pending(&mut self) -> Option<Pending> {
+        match replace(&mut self.phase, Phase::Closed) {
+            Phase::Queued { pending, .. }
+            | Phase::Offering { pending, .. }
+            | Phase::Delivered(pending) => Some(pending),
+            _ => None,
+        }
+    }
+
+    fn close(&mut self, error: SessionError) {
+        if let Some(pending) = self.take_pending() {
+            let _ = pending.response.send(Err(error));
+        }
+        if let Some(poll) = self.poll.take() {
+            let _ = poll.send(Err(error));
+        }
+        self.inbox.close();
+    }
+}
+
+fn reject(command: Command, error: SessionError) {
+    match command {
+        Command::Submit {
+            admitted, response, ..
+        } => {
+            let _ = admitted.send(Err(error));
+            let _ = response.send(Err(error));
+        }
+        Command::Next { reply } => {
+            let _ = reply.send(Err(error));
+        }
+        Command::Complete { reply, .. } | Command::InitError { reply, .. } => {
+            let _ = reply.send(Err(error));
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-lambda-runtime/src/session/tests.rs b/crates/rustack-lambda-runtime/src/session/tests.rs
new file mode 100644
index 00000000..b75838db
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/session/tests.rs
@@ -0,0 +1,958 @@
+use std::{
+    future::Future,
+    sync::Arc,
+    task::{Context, Poll, Waker},
+};
+
+use bytes::Bytes;
+use tokio::sync::Semaphore;
+
+use super::*;
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+
+fn payload() -> Payload {
+    Payload::try_from(Bytes::from_static(b"secret-payload")).unwrap()
+}
+
+fn invocation() -> Invocation {
+    Invocation::new(
+        AttemptId::default(),
+        deadline(),
+        "arn:aws:lambda:us-east-1:000000000000:function:echo:prod"
+            .parse()
+            .unwrap(),
+        "Root=1-00000000-000000000000000000000000;Sampled=0"
+            .parse()
+            .unwrap(),
+        payload(),
+    )
+    .unwrap()
+}
+
+fn poll_once<F: Future + Unpin>(future: &mut F) -> Poll<F::Output> {
+    Future::poll(
+        std::pin::Pin::new(future),
+        &mut Context::from_waker(Waker::noop()),
+    )
+}
+
+#[tokio::test]
+async fn test_should_deliver_once_validate_completion_and_reuse_after_success_and_function_error() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let first = invocation();
+    let ticket = handle.submit(first.clone(), deadline()).await.unwrap();
+    assert_eq!(ticket.attempt(), first.parts().0);
+    assert_eq!(
+        handle.submit(invocation(), deadline()).await.unwrap_err(),
+        SessionError::Busy
+    );
+    assert_eq!(handle.next(deadline()).await.unwrap(), first);
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Busy
+    );
+    assert_eq!(
+        handle
+            .complete(
+                AttemptId::default(),
+                None,
+                Outcome::Success,
+                payload(),
+                deadline()
+            )
+            .await,
+        Err(SessionError::UnknownAttempt)
+    );
+    assert_eq!(
+        handle
+            .complete(
+                ticket.attempt(),
+                Some(AttemptId::default()),
+                Outcome::Success,
+                payload(),
+                deadline()
+            )
+            .await,
+        Err(SessionError::UnknownAttempt)
+    );
+    handle
+        .complete(
+            ticket.attempt(),
+            Some(ticket.attempt()),
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    let old = ticket.attempt();
+    assert_eq!(
+        ticket.wait().await.unwrap(),
+        RuntimeResult::Success(payload())
+    );
+    let second = handle.submit(invocation(), deadline()).await.unwrap();
+    handle.next(deadline()).await.unwrap();
+    assert_eq!(
+        handle
+            .complete(old, None, Outcome::Success, payload(), deadline())
+            .await,
+        Err(SessionError::UnknownAttempt)
+    );
+    handle
+        .complete(
+            second.attempt(),
+            None,
+            Outcome::FunctionError,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        second.wait().await.unwrap(),
+        RuntimeResult::FunctionError(payload())
+    );
+    session.shutdown().await.unwrap();
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_distinguish_listener_readiness_first_poll_and_cancelled_poll_replacement() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let mut readiness = handle.bootstrap.clone();
+    assert_eq!(
+        handle
+            .bootstrap_ready(Instant::now() + Duration::from_millis(1))
+            .await,
+        Err(SessionError::Deadline)
+    );
+    let mut first = Box::pin(handle.next(deadline()));
+    assert!(poll_once(&mut first).is_pending());
+    handle.bootstrap_ready(deadline()).await.unwrap();
+    assert!(*readiness.borrow_and_update());
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Busy
+    );
+    drop(first);
+    let call = invocation();
+    let ticket = handle.submit(call.clone(), deadline()).await.unwrap();
+    assert_eq!(handle.next(deadline()).await.unwrap(), call);
+    assert!(
+        !readiness.has_changed().unwrap(),
+        "readiness must be emitted once"
+    );
+    handle
+        .complete(
+            ticket.attempt(),
+            None,
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    ticket.wait().await.unwrap();
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_report_initialization_failure_once_before_delivery_and_close_pending_work() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let notification = session.take_initialization_error().unwrap();
+    assert!(session.take_initialization_error().is_none());
+    let handle = session.handle().clone();
+    let ticket = handle.submit(invocation(), deadline()).await.unwrap();
+    handle
+        .initialization_error(payload(), deadline())
+        .await
+        .unwrap();
+    assert_eq!(notification.await.unwrap(), payload());
+    assert_eq!(
+        ticket.wait().await.unwrap(),
+        RuntimeResult::InitError(payload())
+    );
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Unavailable
+    );
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_reject_initialization_error_after_any_delivery_without_consuming_active_result()
+ {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let ticket = handle.submit(invocation(), deadline()).await.unwrap();
+    handle.next(deadline()).await.unwrap();
+    assert_eq!(
+        handle.initialization_error(payload(), deadline()).await,
+        Err(SessionError::Busy)
+    );
+    handle
+        .complete(
+            ticket.attempt(),
+            None,
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    ticket.wait().await.unwrap();
+    assert_eq!(
+        handle.initialization_error(payload(), deadline()).await,
+        Err(SessionError::Busy)
+    );
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_invalidate_dropped_tickets_and_expired_attempts_without_reuse() {
+    for delivered in [false, true] {
+        let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+        let handle = session.handle().clone();
+        let ticket = handle.submit(invocation(), deadline()).await.unwrap();
+        if delivered {
+            handle.next(deadline()).await.unwrap();
+        }
+        drop(ticket);
+        tokio::task::yield_now().await;
+        assert_eq!(
+            handle.submit(invocation(), deadline()).await.unwrap_err(),
+            SessionError::Unavailable
+        );
+        session.shutdown().await.unwrap();
+    }
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let ticket = handle.submit(invocation(), deadline()).await.unwrap();
+    handle.next(deadline()).await.unwrap();
+    tokio::time::advance(Duration::from_secs(5)).await;
+    assert_eq!(ticket.wait().await.unwrap_err(), SessionError::Deadline);
+    tokio::task::yield_now().await;
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Unavailable
+    );
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_cancel_attached_waiters_and_never_cancel_new_work_when_an_old_ticket_drops() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let old = handle.submit(invocation(), deadline()).await.unwrap();
+    handle.next(deadline()).await.unwrap();
+    handle
+        .complete(old.attempt(), None, Outcome::Success, payload(), deadline())
+        .await
+        .unwrap();
+    let current = handle.submit(invocation(), deadline()).await.unwrap();
+    drop(old);
+    handle.next(deadline()).await.unwrap();
+    handle
+        .complete(
+            current.attempt(),
+            None,
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    current.wait().await.unwrap();
+
+    let cancelled = handle.submit(invocation(), deadline()).await.unwrap();
+    let mut waiting = Box::pin(cancelled.wait());
+    assert!(poll_once(&mut waiting).is_pending());
+    drop(waiting);
+    tokio::task::yield_now().await;
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Unavailable
+    );
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_retain_actor_join_ownership_after_a_cancelled_shutdown_waiter() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let mut shutdown = Box::pin(session.shutdown());
+    assert!(poll_once(&mut shutdown).is_pending());
+    drop(shutdown);
+    assert!(session.task.is_some());
+    session.shutdown().await.unwrap();
+    assert!(session.task.is_none());
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Unavailable
+    );
+}
+
+#[tokio::test]
+async fn test_should_cancel_admitted_work_after_the_admission_waiter_is_dropped() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let mut admission = Box::pin(handle.submit(invocation(), deadline()));
+    assert!(poll_once(&mut admission).is_pending());
+    tokio::task::yield_now().await;
+    drop(admission);
+    tokio::task::yield_now().await;
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Unavailable
+    );
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_bound_idle_and_command_deadlines_and_prioritize_stop_over_a_full_mailbox() {
+    assert!(matches!(
+        RuntimeSession::start(Duration::ZERO),
+        Err(SessionError::InvalidMetadata)
+    ));
+    assert!(matches!(
+        RuntimeSession::start(Duration::from_hours(25)),
+        Err(SessionError::InvalidMetadata)
+    ));
+    let mut session = RuntimeSession::start(Duration::from_secs(1)).unwrap();
+    let handle = session.handle().clone();
+    assert_eq!(
+        handle.next(Instant::now()).await.unwrap_err(),
+        SessionError::Deadline
+    );
+    tokio::time::advance(Duration::from_secs(1)).await;
+    tokio::task::yield_now().await;
+    assert_eq!(
+        handle.next(deadline()).await.unwrap_err(),
+        SessionError::Unavailable
+    );
+    session.shutdown().await.unwrap();
+
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let mut receivers = Vec::new();
+    for _ in 0..MAILBOX_CAPACITY {
+        let (reply, receiver) = oneshot::channel();
+        handle.send(Command::Next { reply }, deadline()).unwrap();
+        receivers.push(receiver);
+    }
+    let (reply, _) = oneshot::channel();
+    assert_eq!(
+        handle.send(Command::Next { reply }, deadline()),
+        Err(SessionError::Busy)
+    );
+    handle.close();
+    session.shutdown().await.unwrap();
+    assert!(
+        !*handle.bootstrap.borrow(),
+        "priority stop must beat queued polls"
+    );
+    for receiver in receivers {
+        assert!(receiver.await.is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_never_report_success_after_actor_supervision_failure() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    session.task.as_ref().unwrap().abort();
+    assert_eq!(
+        session.shutdown().await,
+        Err(SessionError::SupervisorFailed)
+    );
+    assert_eq!(
+        session.shutdown().await,
+        Err(SessionError::SupervisorFailed)
+    );
+}
+
+#[test]
+fn test_should_reject_start_without_a_tokio_runtime() {
+    assert!(matches!(
+        RuntimeSession::start(Duration::from_secs(60)),
+        Err(SessionError::Unavailable)
+    ));
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_expired_mailbox_commands_without_delivering_or_settling_work() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let (reply, response) = oneshot::channel();
+    handle
+        .send(
+            Command::Next { reply },
+            Instant::now() + Duration::from_millis(1),
+        )
+        .unwrap();
+    tokio::time::advance(Duration::from_millis(1)).await;
+    assert!(matches!(
+        response.await.unwrap(),
+        Err(SessionError::Deadline)
+    ));
+    assert!(!*handle.bootstrap.borrow());
+
+    let ticket = handle.submit(invocation(), deadline()).await.unwrap();
+    handle.next(deadline()).await.unwrap();
+    let (reply, response) = oneshot::channel();
+    handle
+        .send(
+            Command::Complete {
+                attempt: ticket.attempt(),
+                invocation_id: None,
+                outcome: Outcome::Success,
+                payload: payload(),
+                reply,
+            },
+            Instant::now() + Duration::from_millis(1),
+        )
+        .unwrap();
+    tokio::time::advance(Duration::from_millis(1)).await;
+    assert_eq!(response.await.unwrap(), Err(SessionError::Deadline));
+    handle
+        .complete(
+            ticket.attempt(),
+            None,
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        ticket.wait().await.unwrap(),
+        RuntimeResult::Success(payload())
+    );
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_signal_owned_actor_cleanup_when_the_session_owner_is_dropped() {
+    let session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let call = invocation();
+    assert!(
+        !format!("{call:?} {:?}", RuntimeResult::Success(payload())).contains("secret-payload")
+    );
+    let ticket = handle.submit(call, deadline()).await.unwrap();
+    assert!(!format!("{ticket:?}").contains("secret-payload"));
+    drop(session);
+    assert_eq!(ticket.wait().await, Err(SessionError::Cancelled));
+    assert_eq!(
+        handle.next(deadline()).await,
+        Err(SessionError::Unavailable)
+    );
+}
+
+#[tokio::test]
+async fn test_should_requeue_an_offered_event_if_the_poll_future_drops_before_receiving_it() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let call = invocation();
+    let ticket = handle.submit(call.clone(), deadline()).await.unwrap();
+    let mut poll = Box::pin(handle.next(deadline()));
+    assert!(poll_once(&mut poll).is_pending());
+    // The actor sends the event, but this poll future never consumes the reply.
+    tokio::task::yield_now().await;
+    drop(poll);
+    assert_eq!(handle.next(deadline()).await.unwrap(), call);
+    handle
+        .complete(
+            ticket.attempt(),
+            None,
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    ticket.wait().await.unwrap();
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_reconcile_ready_poll_receipts_before_completion_or_initialization_commands() {
+    for initialization in [false, true] {
+        let mut actor = transition_actor();
+        let invocation = invocation();
+        let attempt = invocation.attempt;
+        let (_cancel, cancellation) = watch::channel(false);
+        let (response, received) = oneshot::channel();
+        let pending = Pending {
+            attempt,
+            deadline: invocation.deadline,
+            timeout_error: SessionError::Deadline,
+            cancellation,
+            response,
+        };
+        let (receipt, acknowledged) = oneshot::channel();
+        actor.phase = Phase::Offering {
+            invocation,
+            pending,
+            receipt: acknowledged,
+        };
+        receipt.send(Instant::now()).unwrap();
+        let (reply, result) = oneshot::channel();
+        if initialization {
+            assert!(!actor.command(Command::InitError {
+                payload: payload(),
+                reply
+            }));
+            assert_eq!(result.await.unwrap(), Err(SessionError::Busy));
+            assert!(actor.ever_delivered);
+            assert!(matches!(actor.phase, Phase::Delivered(_)));
+            let (reply, _) = oneshot::channel();
+            assert!(actor.complete(attempt, None, Outcome::Success, payload(), reply));
+        } else {
+            assert!(actor.command(Command::Complete {
+                attempt,
+                invocation_id: None,
+                outcome: Outcome::Success,
+                payload: payload(),
+                reply
+            }));
+            assert_eq!(result.await.unwrap(), Ok(()));
+        }
+        assert_eq!(
+            received.await.unwrap(),
+            Ok(RuntimeResult::Success(payload()))
+        );
+    }
+}
+
+fn transition_actor() -> SessionActor {
+    let (_, inbox) = mpsc::channel(MAILBOX_CAPACITY);
+    let (_, stop) = watch::channel(false);
+    let (bootstrap, _) = watch::channel(false);
+    SessionActor::builder()
+        .inbox(inbox)
+        .stop(stop)
+        .bootstrap(bootstrap)
+        .initialization_error(None)
+        .idle_lease(Duration::from_secs(60))
+        .idle_deadline(Instant::now() + Duration::from_secs(60))
+        .build()
+}
+
+#[tokio::test]
+async fn test_should_resume_a_borrowed_ticket_result_after_select_cancellation_and_reject_repolling()
+ {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let mut ticket = handle.submit(invocation(), deadline()).await.unwrap();
+    let mut result = Box::pin(ticket.result());
+    assert!(poll_once(&mut result).is_pending());
+    drop(result);
+    assert!(!*ticket.cancellation.borrow());
+    handle.next(deadline()).await.unwrap();
+    handle
+        .complete(
+            ticket.attempt(),
+            None,
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        ticket.result().await.unwrap(),
+        RuntimeResult::Success(payload())
+    );
+    assert_eq!(ticket.result().await, Err(SessionError::Unavailable));
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_revalidate_cancellation_closed_owners_and_expiry_at_every_delivery_transition()
+{
+    for transition in ["deliver", "complete", "receipt"] {
+        for condition in ["cancelled", "closed", "expired"] {
+            let mut actor = transition_actor();
+            let invocation = invocation();
+            let attempt = invocation.attempt;
+            let (cancel, cancellation) = watch::channel(false);
+            let mut cancel = Some(cancel);
+            let (response, received) = oneshot::channel();
+            let pending = Pending {
+                attempt,
+                deadline: invocation.deadline,
+                timeout_error: SessionError::Deadline,
+                cancellation,
+                response,
+            };
+            match condition {
+                "cancelled" => {
+                    cancel.as_ref().unwrap().send_replace(true);
+                }
+                "closed" => {
+                    cancel.take();
+                }
+                "expired" => tokio::time::advance(Duration::from_secs(5)).await,
+                _ => panic!("unknown test case"),
+            }
+            let expected = if condition == "expired" {
+                SessionError::Deadline
+            } else {
+                SessionError::Cancelled
+            };
+            match transition {
+                "deliver" => {
+                    actor.phase = Phase::Queued {
+                        invocation,
+                        pending,
+                    };
+                    let (poll, received) = oneshot::channel();
+                    actor.poll = Some(poll);
+                    actor.deliver();
+                    assert!(matches!(received.await.unwrap(), Err(error) if error == expected));
+                }
+                "complete" => {
+                    actor.phase = Phase::Delivered(pending);
+                    let (reply, received) = oneshot::channel();
+                    assert!(!actor.complete(attempt, None, Outcome::Success, payload(), reply));
+                    assert_eq!(received.await.unwrap(), Err(expected));
+                }
+                "receipt" => {
+                    let (_, receipt) = oneshot::channel();
+                    actor.phase = Phase::Offering {
+                        invocation,
+                        pending,
+                        receipt,
+                    };
+                    actor.received(Some(Instant::now()));
+                }
+                _ => panic!("unknown test case"),
+            }
+            assert_eq!(received.await.unwrap(), Err(expected));
+            assert!(matches!(actor.phase, Phase::Closed));
+            assert!(actor.inbox.is_closed());
+        }
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_arm_handler_timeout_only_when_the_runtime_consumes_the_offered_event() {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let mut call = invocation();
+    call.deadline = Instant::now() + Duration::from_secs(30);
+    call = call.with_handler_timeout(HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+    let ticket = handle.submit(call.clone(), deadline()).await.unwrap();
+    tokio::time::advance(Duration::from_secs(4)).await;
+    assert!(!handle.is_closed());
+    let mut abandoned = Box::pin(handle.next(deadline()));
+    assert!(poll_once(&mut abandoned).is_pending());
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(4)).await;
+    assert!(!handle.is_closed());
+    drop(abandoned);
+    let started = Instant::now();
+    let delivered = handle.next(deadline()).await.unwrap();
+    assert_eq!(delivered.parts().1, started + Duration::from_secs(1));
+    assert_ne!(delivered.parts().1, call.parts().1);
+    tokio::time::advance(Duration::from_secs(1)).await;
+    assert_eq!(ticket.wait().await, Err(SessionError::HandlerTimeout));
+    assert!(handle.is_closed());
+    session.shutdown().await.unwrap();
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_keep_outer_deadline_classification_when_shorter_or_tied_with_handler_timeout()
+{
+    for remaining in [Duration::from_millis(500), Duration::from_secs(1)] {
+        let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+        let handle = session.handle().clone();
+        let mut call = invocation();
+        call.deadline = Instant::now() + remaining;
+        call = call.with_handler_timeout(HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+        let expected = call.parts().1;
+        let ticket = handle.submit(call, deadline()).await.unwrap();
+        assert_eq!(handle.next(deadline()).await.unwrap().parts().1, expected);
+        tokio::time::advance(remaining).await;
+        assert_eq!(ticket.wait().await, Err(SessionError::Deadline));
+        session.shutdown().await.unwrap();
+    }
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_late_handler_completion_and_delayed_consumption_receipt_without_replay()
+{
+    for transition in ["receipt", "complete", "receipt_after_outer"] {
+        let mut actor = transition_actor();
+        let call = invocation()
+            .with_handler_timeout(HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+        let attempt = call.attempt;
+        let (_cancel, cancellation) = watch::channel(false);
+        let (response, received) = oneshot::channel();
+        let pending = Pending {
+            attempt,
+            deadline: call.deadline,
+            timeout_error: SessionError::Deadline,
+            cancellation,
+            response,
+        };
+        let (receipt, acknowledged) = oneshot::channel();
+        actor.phase = Phase::Offering {
+            invocation: call,
+            pending,
+            receipt: acknowledged,
+        };
+        receipt.send(Instant::now()).unwrap();
+        if transition == "complete" {
+            actor.reconcile_receipt();
+        }
+        tokio::time::advance(Duration::from_secs(
+            if transition == "receipt_after_outer" {
+                6
+            } else {
+                1
+            },
+        ))
+        .await;
+        let (reply, result) = oneshot::channel();
+        assert!(!actor.command(Command::Complete {
+            attempt,
+            invocation_id: None,
+            outcome: Outcome::Success,
+            payload: payload(),
+            reply
+        }));
+        assert_eq!(
+            result.await.unwrap(),
+            Err(if transition == "complete" {
+                SessionError::HandlerTimeout
+            } else {
+                SessionError::Unavailable
+            })
+        );
+        assert_eq!(received.await.unwrap(), Err(SessionError::HandlerTimeout));
+        assert!(matches!(actor.phase, Phase::Closed));
+    }
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_preserve_on_time_completion_when_the_ticket_waiter_resumes_after_handler_expiry()
+ {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let call = invocation()
+        .with_handler_timeout(HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+    let ticket = handle.submit(call, deadline()).await.unwrap();
+    handle.next(deadline()).await.unwrap();
+    handle
+        .complete(
+            ticket.attempt(),
+            None,
+            Outcome::Success,
+            payload(),
+            deadline(),
+        )
+        .await
+        .unwrap();
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert_eq!(ticket.wait().await, Ok(RuntimeResult::Success(payload())));
+    assert!(!handle.is_closed());
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_reject_an_offered_call_consumed_after_its_outer_deadline_before_receipting_delivery()
+ {
+    let mut session = RuntimeSession::start(Duration::from_secs(60)).unwrap();
+    let handle = session.handle().clone();
+    let mut call = invocation()
+        .with_handler_timeout(HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+    call.deadline = Instant::now() + Duration::from_secs(2);
+    let ticket = handle.submit(call, deadline()).await.unwrap();
+    let mut next = Box::pin(handle.next(Instant::now() + Duration::from_secs(10)));
+    assert!(poll_once(&mut next).is_pending());
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert_eq!(next.await, Err(SessionError::Deadline));
+    assert_eq!(ticket.wait().await, Err(SessionError::Deadline));
+    tokio::time::timeout(Duration::from_secs(1), handle.closed())
+        .await
+        .unwrap();
+    session.shutdown().await.unwrap();
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_reconcile_consumed_delivery_when_receipt_and_old_outer_timer_become_ready_between_actor_polls()
+ {
+    let (commands, inbox) = mpsc::channel(MAILBOX_CAPACITY);
+    let (stop, stopped) = watch::channel(false);
+    let (bootstrap, _) = watch::channel(false);
+    let mut actor = SessionActor::builder()
+        .inbox(inbox)
+        .stop(stopped)
+        .bootstrap(bootstrap)
+        .initialization_error(None)
+        .idle_lease(Duration::from_secs(60))
+        .idle_deadline(Instant::now() + Duration::from_secs(60))
+        .build();
+    let call = invocation()
+        .with_handler_timeout(HandlerTimeout::try_from(Duration::from_secs(1)).unwrap());
+    let attempt = call.attempt;
+    let (_cancel, cancellation) = watch::channel(false);
+    let (response, received) = oneshot::channel();
+    let (receipt, acknowledged) = oneshot::channel();
+    actor.phase = Phase::Offering {
+        pending: Pending {
+            attempt,
+            deadline: call.deadline,
+            timeout_error: SessionError::Deadline,
+            cancellation,
+            response,
+        },
+        invocation: call,
+        receipt: acknowledged,
+    };
+    let mut running = Box::pin(actor.run());
+    assert!(poll_once(&mut running).is_pending());
+    receipt.send(Instant::now()).unwrap();
+    tokio::time::advance(Duration::from_secs(6)).await;
+    assert!(poll_once(&mut running).is_ready());
+    assert_eq!(received.await.unwrap(), Err(SessionError::HandlerTimeout));
+    drop((commands, stop));
+}
+
+fn held_http_session() -> (SessionHandle, SessionActor) {
+    let (commands, inbox) = mpsc::channel(MAILBOX_CAPACITY);
+    let (stop, stopped) = watch::channel(false);
+    let (bootstrap, initialized) = watch::channel(false);
+    let actor = SessionActor::builder()
+        .inbox(inbox)
+        .stop(stopped)
+        .bootstrap(bootstrap)
+        .initialization_error(None)
+        .idle_lease(Duration::from_secs(60))
+        .idle_deadline(Instant::now() + Duration::from_secs(60))
+        .build();
+    let handle = SessionHandle {
+        inbox: commands,
+        stop,
+        bootstrap: initialized,
+    };
+    (handle, actor)
+}
+
+async fn http_body_command(
+    handle: &SessionHandle,
+    initialization: bool,
+    deadline: Instant,
+    permit: OwnedSemaphorePermit,
+) -> Result<(), SessionError> {
+    if initialization {
+        handle
+            .initialization_error_with_body_permit(payload(), deadline, Some(permit))
+            .await
+    } else {
+        handle
+            .complete_with_body_permit(
+                AttemptId::default(),
+                None,
+                Outcome::Success,
+                payload(),
+                deadline,
+                Some(permit),
+            )
+            .await
+    }
+}
+
+#[rstest::rstest]
+#[case::completion(false)]
+#[case::initialization_error(true)]
+#[tokio::test(start_paused = true)]
+async fn test_should_charge_http_body_until_accepted_command_is_retired(
+    #[case] initialization: bool,
+    #[values(false, true)] abandon: bool,
+    #[values(false, true)] dispose_actor: bool,
+) {
+    let (handle, mut actor) = held_http_session();
+    let (notification, mut notified) = oneshot::channel();
+    actor.initialization_error = Some(notification);
+    let budget = Arc::new(Semaphore::new(4));
+    let cutoff = Instant::now() + Duration::from_secs(1);
+    let mut observers: Vec<_> = (0..4)
+        .map(|_| {
+            Box::pin(http_body_command(
+                &handle,
+                initialization,
+                cutoff,
+                budget.clone().try_acquire_owned().unwrap(),
+            ))
+        })
+        .collect();
+    for observer in &mut observers {
+        assert!(poll_once(observer).is_pending());
+    }
+    assert_eq!(actor.inbox.len(), 4);
+    assert_eq!(budget.available_permits(), 0);
+    if abandon {
+        observers.clear();
+    }
+    tokio::time::advance(Duration::from_secs(1)).await;
+    for observer in &mut observers {
+        assert_eq!(
+            poll_once(observer),
+            Poll::Ready(Err(SessionError::Deadline))
+        );
+    }
+    drop(observers);
+    assert_eq!(actor.inbox.len(), 4);
+    assert!(!*handle.stop.borrow());
+    assert_eq!(budget.available_permits(), 0);
+    assert!(budget.clone().try_acquire_owned().is_err());
+    if dispose_actor {
+        drop(actor);
+    } else {
+        let mut running = Box::pin(actor.run());
+        assert!(poll_once(&mut running).is_pending());
+        assert_eq!(handle.inbox.capacity(), MAILBOX_CAPACITY);
+        assert_eq!(notified.try_recv(), Err(TryRecvError::Empty));
+        handle.close();
+        assert!(poll_once(&mut running).is_ready());
+    }
+    assert_eq!(budget.available_permits(), 4);
+    assert!(budget.try_acquire_owned().is_ok());
+}
+
+#[rstest::rstest]
+#[case::expired(SessionError::Deadline)]
+#[case::full(SessionError::Busy)]
+#[case::closed(SessionError::Unavailable)]
+#[tokio::test(start_paused = true)]
+async fn test_should_charge_http_body_only_when_its_command_is_admitted(
+    #[case] rejection: SessionError,
+    #[values(false, true)] initialization: bool,
+) {
+    let (handle, mut actor) = held_http_session();
+    let mut cutoff = deadline();
+    match rejection {
+        SessionError::Deadline => cutoff = Instant::now(),
+        SessionError::Busy => {
+            for _ in 0..MAILBOX_CAPACITY {
+                let (reply, _) = oneshot::channel();
+                handle.send(Command::Next { reply }, cutoff).unwrap();
+            }
+        }
+        SessionError::Unavailable => actor.inbox.close(),
+        _ => unreachable!("fixed test rejection cases"),
+    }
+    let budget = Arc::new(Semaphore::new(1));
+    let permit = budget.clone().try_acquire_owned().unwrap();
+    assert_eq!(
+        http_body_command(&handle, initialization, cutoff, permit).await,
+        Err(rejection)
+    );
+    assert_eq!(budget.available_permits(), 1);
+    drop(actor);
+}
diff --git a/crates/rustack-lambda-runtime/src/transport.rs b/crates/rustack-lambda-runtime/src/transport.rs
new file mode 100644
index 00000000..8cc7a354
--- /dev/null
+++ b/crates/rustack-lambda-runtime/src/transport.rs
@@ -0,0 +1,285 @@
+//! Retained, bounded stream workers shared by both ends of relay control.
+
+use std::time::Duration;
+
+use tokio::{
+    io::{AsyncRead, AsyncReadExt, AsyncWrite},
+    runtime::Handle,
+    sync::{mpsc, oneshot, watch},
+    task::{JoinHandle, JoinSet},
+    time::{Instant, timeout_at},
+};
+use tracing::instrument::WithSubscriber;
+
+use crate::{
+    protocol::{Acknowledgement, Frame, Message, read_frame, write_frame},
+    relay::RelayError,
+};
+
+const MAILBOX_CAPACITY: usize = 2;
+
+pub(crate) fn preserve_worker_failure(
+    primary: Result<(), RelayError>,
+    joined: Result<(), RelayError>,
+) -> Result<(), RelayError> {
+    if matches!(&primary, Err(RelayError::Worker)) || matches!(&joined, Err(RelayError::Worker)) {
+        Err(RelayError::Worker)
+    } else {
+        primary.and(joined)
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum InputEnd {
+    Close,
+    CloseAcknowledgement,
+}
+
+impl InputEnd {
+    fn matches(self, message: &Message) -> bool {
+        matches!(
+            (self, message),
+            (Self::Close, Message::Close)
+                | (
+                    Self::CloseAcknowledgement,
+                    Message::Ack(Acknowledgement::Close)
+                )
+        )
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct Settings {
+    pub(crate) silence: Duration,
+    pub(crate) io_budget: Duration,
+    pub(crate) input_end: InputEnd,
+}
+
+#[derive(Debug)]
+struct Outbound {
+    frame: Frame,
+    deadline: Instant,
+    written: oneshot::Sender<bool>,
+}
+
+#[derive(Debug)]
+enum WorkerExit {
+    InputClose,
+    OutputClosed,
+}
+
+#[derive(Debug)]
+struct OwnerHandle {
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<(), RelayError>>>,
+    settlement: Option<Result<(), RelayError>>,
+}
+
+#[derive(Debug)]
+pub(crate) struct Transport {
+    input: mpsc::Receiver<Frame>,
+    output: mpsc::Sender<Outbound>,
+    status: watch::Receiver<Option<Result<(), RelayError>>>,
+    owner: OwnerHandle,
+}
+
+impl Transport {
+    #[cfg(test)]
+    pub(crate) fn abort_owner(&self) {
+        if let Some(task) = &self.owner.task {
+            task.abort();
+        }
+    }
+
+    pub(crate) fn start<R, W>(reader: R, writer: W, settings: Settings) -> Result<Self, RelayError>
+    where
+        R: AsyncRead + Unpin + Send + 'static,
+        W: AsyncWrite + Unpin + Send + 'static,
+    {
+        let runtime = Handle::try_current().map_err(|_| RelayError::Worker)?;
+        let (stop, stopped) = watch::channel(false);
+        let (input, frames) = mpsc::channel(MAILBOX_CAPACITY);
+        let (output, queued) = mpsc::channel(MAILBOX_CAPACITY);
+        let (status, observed) = watch::channel(None);
+        let mut workers = JoinSet::new();
+        workers.spawn(read_input(reader, input, settings).with_current_subscriber());
+        workers.spawn(write_output(writer, queued).with_current_subscriber());
+        let task = runtime.spawn(
+            Owner {
+                workers,
+                stop: stopped,
+                status,
+            }
+            .run()
+            .with_current_subscriber(),
+        );
+        Ok(Self {
+            input: frames,
+            output,
+            status: observed,
+            owner: OwnerHandle {
+                stop,
+                task: Some(task),
+                settlement: None,
+            },
+        })
+    }
+
+    pub(crate) fn finished(&self) -> bool {
+        *self.owner.stop.borrow()
+            || self.status.borrow().is_some()
+            || self.status.has_changed().is_err()
+    }
+
+    pub(crate) fn stop(&self) {
+        self.owner.stop.send_replace(true);
+    }
+
+    pub(crate) async fn recv(&mut self) -> Result<Frame, RelayError> {
+        loop {
+            if let Some(result) = self.status.borrow().as_ref() {
+                return Err(result.clone().err().unwrap_or(RelayError::Eof));
+            }
+            tokio::select! {
+                biased;
+                changed = self.status.changed() => {
+                    changed.map_err(|_| RelayError::Worker)?;
+                }
+                frame = self.input.recv() => match frame {
+                    Some(frame) => return Ok(frame),
+                    // The reader drops its sender before the supervisor joins
+                    // it. Await that settlement so EOF cannot mask its actual
+                    // protocol/deadline failure.
+                    None => { self.status.changed().await.map_err(|_| RelayError::Worker)?; }
+                },
+            }
+        }
+    }
+
+    pub(crate) async fn send(&self, frame: Frame, deadline: Instant) -> Result<(), RelayError> {
+        if self.finished() {
+            return Err(RelayError::Output);
+        }
+        let (written, receipt) = oneshot::channel();
+        timeout_at(
+            deadline,
+            self.output.send(Outbound {
+                frame,
+                deadline,
+                written,
+            }),
+        )
+        .await
+        .map_err(|_| RelayError::Deadline)?
+        .map_err(|_| RelayError::Output)?;
+        match timeout_at(deadline, receipt).await {
+            Ok(Ok(true)) if Instant::now() < deadline => Ok(()),
+            Ok(Ok(true)) => Err(RelayError::Deadline),
+            _ => Err(RelayError::Output),
+        }
+    }
+
+    pub(crate) async fn shutdown(&mut self) -> Result<(), RelayError> {
+        self.stop();
+        if let Some(result) = &self.owner.settlement {
+            return result.clone();
+        }
+        let result = match self.owner.task.as_mut() {
+            Some(task) => task
+                .await
+                .map_err(|_| RelayError::Worker)
+                .and_then(|result| result),
+            None => Ok(()),
+        };
+        self.owner.task.take();
+        self.owner.settlement = Some(result.clone());
+        result
+    }
+}
+
+impl Drop for Transport {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
+
+#[derive(Debug)]
+struct Owner {
+    workers: JoinSet<Result<WorkerExit, RelayError>>,
+    stop: watch::Receiver<bool>,
+    status: watch::Sender<Option<Result<(), RelayError>>>,
+}
+
+impl Owner {
+    async fn run(mut self) -> Result<(), RelayError> {
+        let mut outcome = loop {
+            tokio::select! {
+                biased;
+                () = async { let _ = self.stop.wait_for(|stop| *stop).await; } => break Ok(()),
+                worker = self.workers.join_next() => match worker {
+                    Some(Ok(Ok(WorkerExit::InputClose))) => {},
+                    Some(Ok(Err(error))) => break Err(error),
+                    _ => break Err(RelayError::Worker),
+                }
+            }
+        };
+        self.workers.abort_all();
+        while let Some(result) = self.workers.join_next().await {
+            let result = match result {
+                Ok(Ok(WorkerExit::InputClose)) => Ok(()),
+                Ok(Err(error)) => Err(error),
+                Err(error) if error.is_cancelled() => Ok(()),
+                Ok(Ok(WorkerExit::OutputClosed)) | Err(_) => Err(RelayError::Worker),
+            };
+            outcome = preserve_worker_failure(outcome, result);
+        }
+        self.status.send_replace(Some(outcome.clone()));
+        outcome
+    }
+}
+
+async fn read_input<R: AsyncRead + Unpin>(
+    mut reader: R,
+    input: mpsc::Sender<Frame>,
+    settings: Settings,
+) -> Result<WorkerExit, RelayError> {
+    loop {
+        let mut first = [0_u8];
+        let count = timeout_at(after(settings.silence)?, reader.read(&mut first))
+            .await
+            .map_err(|_| RelayError::Deadline)??;
+        if count == 0 {
+            return Err(RelayError::Eof);
+        }
+        let mut prefixed = first.as_slice().chain(&mut reader);
+        let frame = read_frame(&mut prefixed, after(settings.io_budget)?)
+            .await?
+            .ok_or(RelayError::Eof)?;
+        let close = settings.input_end.matches(frame.message());
+        timeout_at(after(settings.io_budget)?, input.send(frame))
+            .await
+            .map_err(|_| RelayError::Deadline)?
+            .map_err(|_| RelayError::Worker)?;
+        if close {
+            return Ok(WorkerExit::InputClose);
+        }
+    }
+}
+
+async fn write_output<W: AsyncWrite + Unpin>(
+    mut writer: W,
+    mut output: mpsc::Receiver<Outbound>,
+) -> Result<WorkerExit, RelayError> {
+    while let Some(frame) = output.recv().await {
+        let result = write_frame(&mut writer, &frame.frame, frame.deadline).await;
+        let _ = frame.written.send(result.is_ok());
+        result?;
+    }
+    Ok(WorkerExit::OutputClosed)
+}
+
+pub(crate) fn after(duration: Duration) -> Result<Instant, RelayError> {
+    Instant::now()
+        .checked_add(duration)
+        .ok_or(RelayError::Configuration)
+}
diff --git a/crates/rustack-lambda-runtime/tests/docker.rs b/crates/rustack-lambda-runtime/tests/docker.rs
new file mode 100644
index 00000000..1250b572
--- /dev/null
+++ b/crates/rustack-lambda-runtime/tests/docker.rs
@@ -0,0 +1,757 @@
+//! Explicit, local-only qualification of the Linux relay and an official RIC.
+//!
+//! The CLI is a test transport. Production attach, deployment and pool behavior
+//! are deliberately tested by the Docker executor's separate acceptance suite.
+
+#![cfg(unix)]
+#![forbid(unsafe_code)]
+
+use std::{env, os::unix::fs::FileTypeExt, process::Stdio, time::Duration};
+
+use anyhow::{Context, Result, bail, ensure};
+use bytes::Bytes;
+use rustack_lambda_runtime::{
+    client::{ClientConfig, ClientEvent, ControlClient},
+    metadata::{deadline_unix_ms, local_trace_id},
+    protocol::{
+        Acknowledgement, Architecture, AttemptId, EnvironmentId, Frame, Message, Outcome, Payload,
+        read_frame, write_frame,
+    },
+    session::{Invocation, RuntimeResult},
+};
+use serde_json::{Value, json};
+use tokio::{
+    io::{AsyncRead, AsyncReadExt, AsyncWriteExt},
+    process::{Child, ChildStdin, ChildStdout, Command},
+    time::{Instant, sleep_until, timeout, timeout_at},
+};
+
+const OPERATION: Duration = Duration::from_secs(45);
+const MAX_OUTPUT: usize = 64 * 1024;
+
+#[derive(Debug)]
+struct Docker {
+    host: String,
+    architecture: Architecture,
+    relay_image: String,
+    function_image: String,
+}
+
+impl Docker {
+    async fn configured() -> Result<Self> {
+        let socket = env::var("RUSTACK_RUNTIME_DOCKER_SOCKET")
+            .context("explicit local Docker socket is required")?;
+        ensure!(
+            socket.starts_with('/') && socket.len() <= 4096,
+            "Docker socket must be a bounded absolute Unix path"
+        );
+        ensure!(
+            tokio::fs::metadata(&socket).await?.file_type().is_socket(),
+            "configured Docker socket is unavailable"
+        );
+        let architecture = env::var("RUSTACK_RUNTIME_ARCH").context("architecture is required")?;
+        let (expected, architecture) = match architecture.as_str() {
+            "arm64" => ("aarch64", Architecture::Arm64),
+            "amd64" => ("x86_64", Architecture::X86_64),
+            _ => bail!("architecture must be arm64 or amd64"),
+        };
+        let relay_image = env::var("RUSTACK_RUNTIME_IMAGE").context("relay image is required")?;
+        ensure!(
+            !relay_image.is_empty()
+                && relay_image.len() <= 1024
+                && relay_image.bytes().all(|byte| byte.is_ascii_graphic()),
+            "relay image reference must be bounded printable ASCII"
+        );
+        let function_image = format!(
+            "rustack-p0-handler:{}",
+            if architecture == Architecture::Arm64 {
+                "arm64"
+            } else {
+                "amd64"
+            }
+        );
+        let docker = Self {
+            host: format!("unix://{socket}"),
+            architecture,
+            relay_image,
+            function_image,
+        };
+        let info = docker
+            .checked(&["info", "--format", "{{.OSType}} {{.Architecture}}"])
+            .await?;
+        ensure!(
+            info.trim() == format!("linux {expected}"),
+            "Docker daemon platform does not match this qualification lane"
+        );
+        for image in [&docker.relay_image, &docker.function_image] {
+            docker.checked(&["image", "inspect", image]).await?;
+        }
+        Ok(docker)
+    }
+
+    fn command(&self) -> Command {
+        let mut command = Command::new("docker");
+        command
+            .arg("--host")
+            .arg(&self.host)
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .kill_on_drop(true);
+        command
+    }
+
+    async fn output(&self, arguments: &[&str]) -> Result<(bool, String)> {
+        self.output_until(arguments, Instant::now() + OPERATION)
+            .await
+    }
+
+    async fn output_until(&self, arguments: &[&str], deadline: Instant) -> Result<(bool, String)> {
+        ensure!(Instant::now() < deadline, "Docker CLI deadline expired");
+        let mut child = self.command().args(arguments).spawn()?;
+        let stdout = child.stdout.take().context("CLI stdout pipe")?;
+        let stderr = child.stderr.take().context("CLI stderr pipe")?;
+        let outcome = timeout_at(deadline, async {
+            let (status, stdout, stderr) =
+                tokio::join!(child.wait(), bounded(stdout), bounded(stderr));
+            Ok::<_, anyhow::Error>((status?.success(), stdout?, stderr?))
+        })
+        .await;
+        if let Ok(result) = outcome {
+            let (success, stdout, _) = result?;
+            Ok((success, String::from_utf8(stdout)?))
+        } else {
+            child.kill().await.context("kill expired Docker CLI")?;
+            child.wait().await.context("reap expired Docker CLI")?;
+            bail!("Docker CLI operation deadline exceeded")
+        }
+    }
+
+    async fn checked(&self, arguments: &[&str]) -> Result<String> {
+        self.checked_until(arguments, Instant::now() + OPERATION)
+            .await
+    }
+
+    async fn checked_until(&self, arguments: &[&str], deadline: Instant) -> Result<String> {
+        let (success, output) = self.output_until(arguments, deadline).await?;
+        ensure!(success, "Docker CLI operation failed");
+        Ok(output)
+    }
+}
+
+async fn bounded(reader: impl AsyncRead + Unpin) -> Result<Vec<u8>> {
+    let mut output = Vec::new();
+    reader
+        .take(u64::try_from(MAX_OUTPUT)? + 1)
+        .read_to_end(&mut output)
+        .await?;
+    ensure!(output.len() <= MAX_OUTPUT, "Docker CLI output exceeded cap");
+    Ok(output)
+}
+
+#[derive(Debug)]
+struct Names {
+    relay: String,
+    function: String,
+    label: String,
+}
+
+#[derive(Debug)]
+struct Control {
+    child: Child,
+    input: Option<ChildStdin>,
+    output: Option<ChildStdout>,
+}
+
+#[derive(Debug)]
+struct Environment {
+    docker: Docker,
+    identity: EnvironmentId,
+    names: Names,
+    control: Option<Control>,
+}
+
+impl Environment {
+    async fn new() -> Result<Self> {
+        let identity = EnvironmentId::default();
+        Ok(Self {
+            docker: Docker::configured().await?,
+            identity,
+            names: Names {
+                relay: format!("rustack-runtime-relay-{identity}"),
+                function: format!("rustack-runtime-function-{identity}"),
+                label: format!("rustack.runtime.test={identity}"),
+            },
+            control: None,
+        })
+    }
+
+    fn spawn(&mut self, idle_seconds: &str) -> Result<()> {
+        let mut command = self.docker.command();
+        command
+            .args([
+                "run",
+                "--pull=never",
+                "--rm",
+                "--interactive",
+                "--name",
+                &self.names.relay,
+                "--label",
+                &self.names.label,
+                "--network",
+                "none",
+                "--user",
+                "1000:1000",
+                "--read-only",
+                "--cap-drop",
+                "ALL",
+                "--security-opt",
+                "no-new-privileges=true",
+                "--memory",
+                "64m",
+                "--cpus",
+                "0.1",
+                "--pids-limit",
+                "64",
+                "--tmpfs",
+                "/tmp:rw,noexec,nosuid,size=16777216",
+                "--env",
+                &format!("RUSTACK_LAMBDA_ENVIRONMENT_ID={}", self.identity),
+                "--env",
+                &format!("RUSTACK_LAMBDA_RELAY_IDLE_SECONDS={idle_seconds}"),
+                &self.docker.relay_image,
+            ])
+            .stdin(Stdio::piped())
+            .stderr(Stdio::null());
+        let mut child = command.spawn()?;
+        let input = child.stdin.take().context("relay input pipe")?;
+        let output = child.stdout.take().context("relay output pipe")?;
+        self.control = Some(Control {
+            child,
+            input: Some(input),
+            output: Some(output),
+        });
+        Ok(())
+    }
+
+    async fn start(&mut self, idle_seconds: &str) -> Result<()> {
+        self.spawn(idle_seconds)?;
+        ensure!(
+            self.next().await?
+                == Message::Hello {
+                    architecture: self.docker.architecture
+                },
+            "relay Hello/platform mismatch"
+        );
+        ensure!(self.next().await? == Message::Ready, "missing relay Ready");
+        let config = self
+            .docker
+            .checked(&["inspect", "--format", "{{json .Config}}", &self.names.relay])
+            .await?;
+        let config: Value = serde_json::from_str(&config)?;
+        ensure!(
+            config["StdinOnce"] == true && config["Tty"] == false,
+            "qualification requires non-TTY stdin with EOF delivery"
+        );
+        Ok(())
+    }
+
+    async fn next(&mut self) -> Result<Message> {
+        let control = self.control.as_mut().context("relay has not started")?;
+        let frame = read_frame(
+            control
+                .output
+                .as_mut()
+                .context("relay output is owned by client")?,
+            Instant::now() + OPERATION,
+        )
+        .await?
+        .context("relay closed control output")?;
+        ensure!(frame.environment() == self.identity, "wrong environment");
+        Ok(frame.into_message())
+    }
+
+    async fn send(&mut self, message: Message) -> Result<()> {
+        let input = self
+            .control
+            .as_mut()
+            .and_then(|control| control.input.as_mut())
+            .context("relay input is closed")?;
+        write_frame(
+            input,
+            &Frame::new(self.identity, message),
+            Instant::now() + OPERATION,
+        )
+        .await?;
+        Ok(())
+    }
+
+    async fn function(&mut self) -> Result<()> {
+        self.create_function().await?;
+        ensure!(
+            self.next().await? == Message::BootstrapReady,
+            "missing first RIC poll"
+        );
+        Ok(())
+    }
+
+    async fn create_function(&self) -> Result<()> {
+        self.docker
+            .checked(&[
+                "create",
+                "--pull=never",
+                "--name",
+                &self.names.function,
+                "--label",
+                &self.names.label,
+                "--network",
+                &format!("container:{}", self.names.relay),
+                "--user",
+                "1000:1000",
+                "--read-only",
+                "--cap-drop",
+                "ALL",
+                "--security-opt",
+                "no-new-privileges=true",
+                "--memory",
+                "192m",
+                "--cpus",
+                "1",
+                "--pids-limit",
+                "256",
+                "--tmpfs",
+                "/tmp:rw,noexec,nosuid,size=536870912",
+                "--env",
+                "AWS_LAMBDA_RUNTIME_API=127.0.0.1:9001",
+                "--env",
+                "AWS_LAMBDA_FUNCTION_NAME=spike",
+                "--env",
+                "AWS_LAMBDA_FUNCTION_VERSION=$LATEST",
+                "--env",
+                "AWS_LAMBDA_FUNCTION_MEMORY_SIZE=192",
+                "--env",
+                "AWS_REGION=us-east-1",
+                "--env",
+                "AWS_DEFAULT_REGION=us-east-1",
+                &self.docker.function_image,
+            ])
+            .await?;
+        self.docker
+            .checked(&["start", &self.names.function])
+            .await?;
+        Ok(())
+    }
+
+    async fn invoke(&mut self, event: Value) -> Result<AttemptId> {
+        let attempt = AttemptId::default();
+        self.send(Message::Invoke {
+            attempt,
+            deadline_unix_ms: deadline_unix_ms(Instant::now() + Duration::from_secs(60))?,
+            handler_timeout_ms: None,
+            function_arn: "arn:aws:lambda:us-east-1:000000000000:function:spike:prod".parse()?,
+            trace_id: local_trace_id()?,
+            payload: Payload::try_from(Bytes::from(serde_json::to_vec(&event)?))?,
+        })
+        .await?;
+        Ok(attempt)
+    }
+
+    async fn result(&mut self, attempt: AttemptId, expected: Outcome) -> Result<Value> {
+        match self.next().await? {
+            Message::InvocationResult {
+                attempt: actual,
+                outcome,
+                payload,
+            } if actual == attempt && outcome == expected => {
+                serde_json::from_slice(payload.as_ref()).context("RIC JSON result")
+            }
+            _ => bail!("unexpected relay result identity/outcome/variant"),
+        }
+    }
+
+    async fn wait(&mut self, success: bool) -> Result<()> {
+        let control = self.control.as_mut().context("relay has not started")?;
+        let status = timeout(OPERATION, control.child.wait())
+            .await
+            .context("relay failed to exit with input ownership retained")??;
+        ensure!(status.success() == success, "unexpected relay exit status");
+        Ok(())
+    }
+
+    async fn close(&mut self) -> Result<()> {
+        self.send(Message::Close).await?;
+        ensure!(
+            self.next().await? == Message::Ack(Acknowledgement::Close),
+            "missing flushed Close acknowledgement"
+        );
+        self.wait(true).await
+    }
+
+    async fn remove_function(&self) -> Result<()> {
+        self.docker
+            .checked(&["rm", "--force", &self.names.function])
+            .await?;
+        Ok(())
+    }
+
+    async fn wait_busy(&self, attempt: AttemptId) -> Result<()> {
+        let marker = format!("P0_BUSY_START={attempt}");
+        let busy_deadline = Instant::now() + OPERATION;
+        loop {
+            // The helper owns the deadline so it cannot be cancelled before
+            // its CLI process has been killed and reaped.
+            let logs = self
+                .docker
+                .checked_until(&["logs", &self.names.function], busy_deadline)
+                .await?;
+            if logs.contains(&marker) {
+                return Ok(());
+            }
+            ensure!(
+                Instant::now() < busy_deadline,
+                "handler never entered its busy section"
+            );
+            sleep_until((Instant::now() + Duration::from_millis(50)).min(busy_deadline)).await;
+        }
+    }
+
+    async fn cleanup(&mut self) -> Result<()> {
+        // Names are reserved before create/run, even if the response is lost.
+        let removal = self
+            .docker
+            .output(&["rm", "--force", &self.names.function, &self.names.relay])
+            .await;
+        let reaped = if let Some(control) = &mut self.control {
+            control.input.take();
+            let killed = control.child.start_kill().context("kill relay CLI");
+            let waited = if let Ok(result) = timeout(OPERATION, control.child.wait()).await {
+                result.map(|_| ()).context("reap relay CLI")
+            } else {
+                // An expired waiter must not discard process ownership.
+                let result = control
+                    .child
+                    .wait()
+                    .await
+                    .context("retained relay CLI reap");
+                result.and_then(|_| bail!("relay CLI cleanup deadline"))
+            };
+            killed.and(waited)
+        } else {
+            Ok(())
+        };
+        let reconciled = async {
+            let remaining = self
+                .docker
+                .checked(&[
+                    "ps",
+                    "--all",
+                    "--quiet",
+                    "--filter",
+                    &format!("label={}", self.names.label),
+                ])
+                .await?;
+            ensure!(remaining.trim().is_empty(), "owned containers remain");
+            Ok(())
+        }
+        .await;
+        removal.map(|_| ()).and(reaped).and(reconciled)
+    }
+
+    async fn finish(&mut self, outcome: Result<()>) -> Result<()> {
+        let cleanup = self.cleanup().await;
+        match (outcome, cleanup) {
+            (Err(error), Err(cleanup)) => {
+                Err(error.context(format!("cleanup failed: {cleanup:#}")))
+            }
+            (Err(error), Ok(())) => Err(error),
+            (Ok(()), cleanup) => cleanup,
+        }
+    }
+}
+
+#[tokio::test]
+#[ignore = "requires the explicit local Docker relay qualification target"]
+async fn test_should_exit_on_close_eof_truncation_and_io_timeout_with_owned_pipes() -> Result<()> {
+    for mode in ["close", "eof", "truncated", "partial", "idle"] {
+        let mut environment = Environment::new().await?;
+        let result = async {
+            // Allow time for inspect during setup; idle expiry must still exit
+            // while the parent retains the open, otherwise silent stdin pipe.
+            environment
+                .start(if mode == "idle" { "5" } else { "600" })
+                .await?;
+            if mode == "close" {
+                environment.close().await?;
+            } else {
+                let control = environment.control.as_mut().context("relay control")?;
+                if mode == "truncated" || mode == "partial" {
+                    control
+                        .input
+                        .as_mut()
+                        .context("input")?
+                        .write_all(&[0])
+                        .await?;
+                }
+                if mode == "eof" || mode == "truncated" {
+                    control.input.take();
+                }
+                environment.wait(false).await?;
+            }
+            Ok(())
+        }
+        .await;
+        environment
+            .finish(result)
+            .await
+            .with_context(|| format!("pipe case {mode}"))?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the explicit local Docker relay qualification target"]
+async fn test_should_reconcile_failed_setup_and_reap_an_expired_cli_helper() -> Result<()> {
+    for mode in ["setup", "scope", "cli"] {
+        let mut environment = Environment::new().await?;
+        let result = async {
+            environment.start("600").await?;
+            match mode {
+                "setup" => {
+                    environment.docker.function_image =
+                        format!("rustack-runtime-missing:{}", environment.identity);
+                    ensure!(
+                        environment.function().await.is_err(),
+                        "missing image setup unexpectedly succeeded"
+                    );
+                }
+                "scope" => {
+                    let input = environment
+                        .control
+                        .as_mut()
+                        .and_then(|control| control.input.as_mut())
+                        .context("relay input")?;
+                    write_frame(
+                        input,
+                        &Frame::new(EnvironmentId::default(), Message::Close),
+                        Instant::now() + OPERATION,
+                    )
+                    .await?;
+                    environment.wait(false).await?;
+                }
+                _ => {
+                    // docker wait owns a different CLI child and cannot finish
+                    // while the relay is running. Its own deadline must reap
+                    // that child without cancelling or stopping the relay.
+                    let expired = environment
+                        .docker
+                        .checked_until(
+                            &["wait", &environment.names.relay],
+                            Instant::now() + Duration::from_millis(200),
+                        )
+                        .await;
+                    ensure!(expired.is_err(), "CLI helper did not reach its deadline");
+                    environment.close().await?;
+                }
+            }
+            Ok(())
+        }
+        .await;
+        environment
+            .finish(result)
+            .await
+            .with_context(|| format!("failure case {mode}"))?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+#[ignore = "requires the explicit local Docker relay qualification target"]
+async fn test_should_compute_reuse_and_report_official_ric_handler_errors() -> Result<()> {
+    let mut environment = Environment::new().await?;
+    let result = async {
+        environment.start("600").await?;
+        environment.function().await?;
+        for (value, computed, counter) in [(35, 42, 1), (0, 7, 2)] {
+            let attempt = environment.invoke(json!({ "value": value })).await?;
+            let result = environment.result(attempt, Outcome::Success).await?;
+            ensure!(
+                result["computed"] == computed && result["counter"] == counter,
+                "incorrect computation or warm counter"
+            );
+            ensure!(
+                result["requestId"] == attempt.to_string(),
+                "incorrect RIC attempt metadata"
+            );
+            ensure!(
+                result["uid"] == 1000 && result["rootReadOnly"] == true,
+                "function user/rootfs limits differ"
+            );
+            ensure!(
+                result["memoryMax"] == "201326592" && result["pidsMax"] == "256",
+                "function cgroup limits differ"
+            );
+        }
+        let attempt = environment.invoke(json!({ "fail": true })).await?;
+        let error = environment.result(attempt, Outcome::FunctionError).await?;
+        ensure!(
+            error["errorType"] == "ValueError",
+            "handler error was not preserved"
+        );
+        environment.remove_function().await?;
+        environment.close().await
+    }
+    .await;
+    environment.finish(result).await
+}
+
+#[tokio::test]
+#[ignore = "requires the explicit local Docker relay qualification target"]
+async fn test_should_cancel_a_running_official_ric_and_remove_both_containers() -> Result<()> {
+    let mut environment = Environment::new().await?;
+    let result = async {
+        environment.start("600").await?;
+        environment.function().await?;
+        let attempt = environment.invoke(json!({ "sleep": true })).await?;
+        environment.wait_busy(attempt).await?;
+        for _ in 0..2 {
+            environment.send(Message::Cancel { attempt }).await?;
+            ensure!(
+                environment.next().await? == Message::Ack(Acknowledgement::Cancel(attempt)),
+                "missing matching cancel acknowledgement"
+            );
+        }
+        let running = environment
+            .docker
+            .checked(&[
+                "inspect",
+                "--format",
+                "{{.State.Running}}",
+                &environment.names.function,
+            ])
+            .await?;
+        ensure!(
+            running.trim() == "true",
+            "Cancel Ack must not claim external process termination"
+        );
+        environment.remove_function().await?;
+        environment.close().await
+    }
+    .await;
+    environment.finish(result).await
+}
+
+fn json_invocation(event: &Value) -> Result<Invocation> {
+    Ok(Invocation::new(
+        AttemptId::default(),
+        Instant::now() + Duration::from_secs(60),
+        "arn:aws:lambda:us-east-1:000000000000:function:spike:prod".parse()?,
+        local_trace_id()?,
+        Payload::try_from(Bytes::from(serde_json::to_vec(event)?))?,
+    )?)
+}
+
+#[tokio::test]
+#[ignore = "requires the explicit local Docker relay qualification target"]
+async fn test_should_drive_real_ric_through_host_client_and_join_its_streams() -> Result<()> {
+    for cancel in [false, true] {
+        let mut environment = Environment::new().await?;
+        let mut owner = None;
+        let result = async {
+            environment.spawn("600")?;
+            let config = ClientConfig::new(
+                environment.identity,
+                environment.docker.architecture,
+                Duration::from_secs(5),
+            )?;
+            let control = environment.control.as_mut().context("relay control")?;
+            owner = Some(ControlClient::start(
+                config,
+                control.output.take().context("client reader")?,
+                control.input.take().context("client writer")?,
+            )?);
+            let client = owner.as_mut().context("client owner")?;
+            ensure!(
+                client.next(Instant::now() + OPERATION).await? == ClientEvent::RelayReady,
+                "client relay handshake failed"
+            );
+            environment.create_function().await?;
+            ensure!(
+                client.next(Instant::now() + OPERATION).await? == ClientEvent::BootstrapReady,
+                "client bootstrap handshake failed"
+            );
+            for (value, computed, counter) in [(35, 42, 1), (0, 7, 2)] {
+                let call = json_invocation(&json!({"value": value}))?;
+                let expected = call.parts().0;
+                client.invoke(call, Instant::now() + OPERATION).await?;
+                match client.next(Instant::now() + OPERATION).await? {
+                    ClientEvent::InvocationResult {
+                        attempt,
+                        result: RuntimeResult::Success(payload),
+                    } if attempt == expected => {
+                        let result: Value = serde_json::from_slice(payload.as_ref())?;
+                        ensure!(
+                            result["computed"] == computed
+                                && result["counter"] == counter
+                                && result["requestId"] == expected.to_string(),
+                            "client computation/warm metadata mismatch"
+                        );
+                    }
+                    _ => bail!("unexpected client computation event"),
+                }
+                ensure!(
+                    client.is_idle(),
+                    "client did not restore Idle after success"
+                );
+            }
+            let event = if cancel {
+                json!({"sleep": true})
+            } else {
+                json!({"fail": true})
+            };
+            let call = json_invocation(&event)?;
+            let expected = call.parts().0;
+            client.invoke(call, Instant::now() + OPERATION).await?;
+            if cancel {
+                environment.wait_busy(expected).await?;
+                client.cancel(expected, Instant::now() + OPERATION).await?;
+                ensure!(
+                    client.next(Instant::now() + OPERATION).await?
+                        == ClientEvent::Cancelled(expected),
+                    "client cancellation acknowledgement mismatch"
+                );
+            } else {
+                match client.next(Instant::now() + OPERATION).await? {
+                    ClientEvent::InvocationResult {
+                        attempt,
+                        result: RuntimeResult::FunctionError(payload),
+                    } if attempt == expected => {
+                        let result: Value = serde_json::from_slice(payload.as_ref())?;
+                        ensure!(
+                            result["errorType"] == "ValueError",
+                            "client function error mismatch"
+                        );
+                    }
+                    _ => bail!("unexpected client handler error event"),
+                }
+            }
+            ensure!(!client.is_idle(), "failed/cancelled client is reusable");
+            environment.remove_function().await?;
+            client.shutdown(Instant::now() + OPERATION).await?;
+            environment.wait(true).await
+        }
+        .await;
+        // Always join streams, remove/reconcile containers and reap the CLI,
+        // including failures after streams have moved out of Control.
+        let client_cleanup = if let Some(client) = &mut owner {
+            client
+                .shutdown(Instant::now() + OPERATION)
+                .await
+                .map_err(anyhow::Error::from)
+        } else {
+            Ok(())
+        };
+        let cleanup = environment.cleanup().await;
+        result.and(client_cleanup).and(cleanup)?;
+    }
+    Ok(())
+}
diff --git a/crates/rustack-s3-http/src/upload.rs b/crates/rustack-s3-http/src/upload.rs
index 29bed563..72d46abd 100644
--- a/crates/rustack-s3-http/src/upload.rs
+++ b/crates/rustack-s3-http/src/upload.rs
@@ -583,7 +583,7 @@ mod tests {
         ] {
             let provider =
                 StaticCredentialProvider::new(vec![("key".to_owned(), "secret".to_owned())]);
-            let key = derive_signing_key("secret", "20260101", "us-east-1", "s3");
+            let key = derive_signing_key("secret", "20260101", "us-east-1", "s3").unwrap();
             let canonical = rustack_auth::canonical::build_canonical_request(
                 "PUT",
                 "/bucket/key",
@@ -599,7 +599,8 @@ mod tests {
                     "20260101/us-east-1/s3/aws4_request",
                     &rustack_auth::hash_payload(canonical.as_bytes()),
                 ),
-            );
+            )
+            .unwrap();
             let make_parts = || {
                 let mut request = parts(marker);
                 if marker.ends_with("-TRAILER") {
@@ -633,6 +634,7 @@ mod tests {
                         rustack_auth::hash_payload(data)
                     ),
                 )
+                .unwrap()
             };
             let first = sign(&seed, b"hello");
             let terminal = sign(&first, b"");
@@ -644,7 +646,8 @@ mod tests {
                          aws4_request\n{terminal}\n{}",
                         rustack_auth::hash_payload(b"x-amz-checksum-crc32:NhCmhg==\n")
                     ),
-                );
+                )
+                .unwrap();
                 format!("x-amz-checksum-crc32:NhCmhg==\r\nx-amz-trailer-signature:{signature}\r\n")
             } else {
                 String::new()
diff --git a/crates/rustack-sqs-http/src/service.rs b/crates/rustack-sqs-http/src/service.rs
index fc77b306..dccd0bd0 100644
--- a/crates/rustack-sqs-http/src/service.rs
+++ b/crates/rustack-sqs-http/src/service.rs
@@ -248,9 +248,10 @@ mod tests {
                 &rustack_auth::hash_payload(canonical.as_bytes()),
             );
             let signature = compute_signature(
-                &derive_signing_key("secret", "20260101", "us-east-1", "sqs"),
+                &derive_signing_key("secret", "20260101", "us-east-1", "sqs").unwrap(),
                 &text,
-            );
+            )
+            .unwrap();
             request.headers_mut().insert(
                 "authorization",
                 format!(
diff --git a/crates/rustack-stepfunctions-core/Cargo.toml b/crates/rustack-stepfunctions-core/Cargo.toml
new file mode 100644
index 00000000..01d58fe2
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/Cargo.toml
@@ -0,0 +1,36 @@
+[package]
+name = "rustack-stepfunctions-core"
+description = "Compiled ASL semantics and supervised Step Functions execution for Rustack"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+rustack-core = { workspace = true }
+rustack-stepfunctions-model = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "sync", "time"] }
+tracing = { workspace = true }
+bytes = { workspace = true }
+chrono = { workspace = true }
+getrandom = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+regex = { workspace = true }
+sha2 = { workspace = true }
+subtle = { workspace = true }
+secrecy = { workspace = true }
+hex = { workspace = true }
+winnow = { workspace = true }
+uuid = { workspace = true }
+
+[dev-dependencies]
+ciborium = { workspace = true }
+tokio = { workspace = true, features = ["test-util"] }
+rstest = { workspace = true }
+proptest = { workspace = true }
diff --git a/crates/rustack-stepfunctions-core/src/callback_parameters.rs b/crates/rustack-stepfunctions-core/src/callback_parameters.rs
new file mode 100644
index 00000000..2dd936cc
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/callback_parameters.rs
@@ -0,0 +1,82 @@
+//! Distinct outbound/history projections for one callback parameter evaluation.
+
+use std::fmt;
+
+use crate::Payload;
+
+/// Bounded history-only Parameters; no unchecked public constructor or serializer.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct CallbackHistory {
+    pub(crate) payload: Payload,
+    pub(crate) redacted: bool,
+}
+impl fmt::Debug for CallbackHistory {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackHistory(<redacted>)")
+    }
+}
+impl CallbackHistory {
+    /// Read the prepared history JSON, with sensitive expression values null.
+    ///
+    /// ```
+    /// # fn journal(h:&rustack_stepfunctions_core::CallbackHistory){let safe=h.payload();}
+    /// ```
+    #[must_use]
+    pub fn payload(&self) -> &Payload {
+        &self.payload
+    }
+    /// Whether local callback provenance removed any sensitive values.
+    ///
+    /// `TaskScheduled` has no AWS truncated metadata field; do not invent one.
+    ///
+    /// ```
+    /// # fn inspect(h:&rustack_stepfunctions_core::CallbackHistory){let redacted=h.redacted();}
+    /// ```
+    #[must_use]
+    pub fn redacted(&self) -> bool {
+        self.redacted
+    }
+}
+/// Actual invocation Parameters and a separately typed safe history projection.
+///
+/// The combined object deliberately cannot be serialized into history:
+///
+/// ```compile_fail
+/// # fn persist(value:rustack_stepfunctions_core::CallbackParameters) {
+/// let unsafe_history = serde_json::to_string(&value);
+/// # }
+/// ```
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct CallbackParameters {
+    pub(crate) outbound: Payload,
+    pub(crate) history: CallbackHistory,
+}
+impl fmt::Debug for CallbackParameters {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackParameters(<redacted>)")
+    }
+}
+impl CallbackParameters {
+    /// Read the actual invocation JSON, including explicitly selected credential.
+    ///
+    /// Do not pass this value to the callback history adapter.
+    ///
+    /// ```
+    /// # fn invoke(p:&rustack_stepfunctions_core::CallbackParameters){let actual=p.outbound();}
+    /// ```
+    #[must_use]
+    pub fn outbound(&self) -> &Payload {
+        &self.outbound
+    }
+    /// Read the distinct projection reserved for journal/persistence consumers.
+    ///
+    /// ```
+    /// # fn journal(p:&rustack_stepfunctions_core::CallbackParameters){let safe=p.history();}
+    /// ```
+    #[must_use]
+    pub fn history(&self) -> &CallbackHistory {
+        &self.history
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/choice.rs b/crates/rustack-stepfunctions-core/src/choice.rs
new file mode 100644
index 00000000..867a7ada
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/choice.rs
@@ -0,0 +1,513 @@
+//! Compiled short-circuit Choice predicates with shared evaluation budgets.
+
+use std::{borrow::Cow, cmp::Ordering, fmt};
+
+use chrono::{DateTime, Timelike};
+use serde_json::{Number, Value};
+
+use crate::{
+    AslError, EvaluationContext, Payload, ReferencePath,
+    payload::{parse_component, validate_component},
+};
+
+mod glob;
+use glob::Glob;
+
+/// Immutable compiled Choice predicate; rule transition targets are compiler-owned.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct Predicate(Node);
+
+#[derive(Clone)]
+enum Node {
+    And(Vec<Predicate>),
+    Or(Vec<Predicate>),
+    Not(Box<Predicate>),
+    Compare {
+        variable: ReferencePath,
+        comparison: Comparison,
+    },
+}
+
+#[derive(Clone)]
+enum Comparison {
+    Test(Test, bool),
+    String(Order, Operand<String>),
+    Numeric(Order, Operand<f64>),
+    Timestamp(Order, Operand<Timestamp>),
+    Boolean(Operand<bool>),
+    Matches(Glob),
+}
+
+#[derive(Clone)]
+enum Operand<T> {
+    Literal(T),
+    Path(ReferencePath),
+}
+
+enum Resolved<'a, T> {
+    Literal(&'a T),
+    Value(&'a Value),
+}
+
+enum Family {
+    String,
+    Numeric,
+    Timestamp,
+}
+
+#[derive(Clone, Copy)]
+enum Test {
+    Present,
+    Null,
+    String,
+    Numeric,
+    Boolean,
+    Timestamp,
+}
+
+#[derive(Clone, Copy)]
+enum Order {
+    Equal,
+    Less,
+    Greater,
+    LessEqual,
+    GreaterEqual,
+}
+
+#[derive(Clone)]
+struct Timestamp {
+    seconds: i64,
+    fraction: String,
+    source_bytes: usize,
+}
+
+impl Timestamp {
+    fn compare(&self, other: &Self) -> Ordering {
+        self.seconds
+            .cmp(&other.seconds)
+            .then_with(|| self.fraction.cmp(&other.fraction))
+    }
+}
+
+impl Order {
+    fn accepts(self, ordering: Ordering) -> bool {
+        match self {
+            Self::Equal => ordering.is_eq(),
+            Self::Less => ordering.is_lt(),
+            Self::Greater => ordering.is_gt(),
+            Self::LessEqual => !ordering.is_gt(),
+            Self::GreaterEqual => !ordering.is_lt(),
+        }
+    }
+}
+
+impl fmt::Debug for Predicate {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Predicate(<redacted>)")
+    }
+}
+
+impl Predicate {
+    /// Preflight source JSON before compiling a predicate without its Next field.
+    ///
+    /// # Errors
+    /// Rejects duplicate/unknown fields, invalid operators and structural limits.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::Predicate;
+    /// let predicate = Predicate::parse(br#"{"Variable":"$.n","NumericEquals":3}"#)?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn parse(input: &[u8]) -> Result<Self, AslError> {
+        let value = parse_component(input)?;
+        Self::compile(&value)
+    }
+
+    /// Compile an existing predicate tree, borrowing before validation/cloning.
+    ///
+    /// # Errors
+    /// Rejects invalid predicates, more than1,024 nodes or32 predicate levels.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::Predicate;
+    /// let predicate = Predicate::compile(&serde_json::json!({"Variable":"$.x","IsPresent":true}))?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn compile(value: &Value) -> Result<Self, AslError> {
+        validate_component(value)?;
+        Self::node(value, 0, &mut 1024)
+    }
+
+    /// Evaluate left-to-right against validated data and internal context.
+    ///
+    /// # Errors
+    /// Missing references (except `IsPresent`), unsupported numeric ranges or
+    /// shared work/string-byte exhaustion fail explicitly, without coercion.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Predicate, Payload, EvaluationContext};
+    /// let data = Payload::parse(br#"{"n":3}"#)?;
+    /// let predicate = Predicate::compile(&serde_json::json!({"Variable":"$.n","NumericEquals":3}))?;
+    /// assert!(predicate.evaluate(&data,&EvaluationContext::from(&data))?);
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn evaluate(&self, data: &Payload, context: &EvaluationContext) -> Result<bool, AslError> {
+        self.eval(
+            data,
+            context,
+            &mut Budget {
+                units: 10_000,
+                bytes: 1024 * 1024,
+            },
+        )
+    }
+
+    pub(crate) fn node_count(&self) -> usize {
+        match &self.0 {
+            Node::And(children) | Node::Or(children) => children
+                .iter()
+                .fold(1_usize, |n, p| n.saturating_add(p.node_count())),
+            Node::Not(child) => 1_usize.saturating_add(child.node_count()),
+            Node::Compare { .. } => 1,
+        }
+    }
+
+    fn node(value: &Value, depth: usize, remaining: &mut usize) -> Result<Self, AslError> {
+        if depth >= 32 {
+            return Err(AslError::InvalidPredicate);
+        }
+        *remaining = remaining.checked_sub(1).ok_or(AslError::InvalidPredicate)?;
+        let object = value.as_object().ok_or(AslError::InvalidPredicate)?;
+        for (key, is_and) in [("And", true), ("Or", false)] {
+            if let Some(children) = object.get(key) {
+                if object.len() != 1 {
+                    return Err(AslError::InvalidPredicate);
+                }
+                let children = children
+                    .as_array()
+                    .filter(|v| !v.is_empty() && v.len() <= 128)
+                    .ok_or(AslError::InvalidPredicate)?;
+                let compiled = children
+                    .iter()
+                    .map(|v| Self::node(v, depth.saturating_add(1), remaining))
+                    .collect::<Result<Vec<_>, _>>()?;
+                return Ok(Self(if is_and {
+                    Node::And(compiled)
+                } else {
+                    Node::Or(compiled)
+                }));
+            }
+        }
+        if let Some(child) = object.get("Not") {
+            if object.len() != 1 {
+                return Err(AslError::InvalidPredicate);
+            }
+            return Ok(Self(Node::Not(Box::new(Self::node(
+                child,
+                depth.saturating_add(1),
+                remaining,
+            )?))));
+        }
+        if object.len() != 2 {
+            return Err(AslError::InvalidPredicate);
+        }
+        let variable = object
+            .get("Variable")
+            .and_then(Value::as_str)
+            .ok_or(AslError::InvalidPredicate)?
+            .parse()?;
+        let (operator, value) = object
+            .iter()
+            .find(|(k, _)| k.as_str() != "Variable")
+            .ok_or(AslError::InvalidPredicate)?;
+        Ok(Self(Node::Compare {
+            variable,
+            comparison: comparison(operator, value)?,
+        }))
+    }
+
+    fn eval(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+        budget: &mut Budget,
+    ) -> Result<bool, AslError> {
+        budget.step()?;
+        match &self.0 {
+            Node::And(children) => {
+                for child in children {
+                    if !child.eval(data, context, budget)? {
+                        return Ok(false);
+                    }
+                }
+                Ok(true)
+            }
+            Node::Or(children) => {
+                for child in children {
+                    if child.eval(data, context, budget)? {
+                        return Ok(true);
+                    }
+                }
+                Ok(false)
+            }
+            Node::Not(child) => Ok(!child.eval(data, context, budget)?),
+            Node::Compare {
+                variable,
+                comparison,
+            } => {
+                let value = variable.lookup(data, context);
+                if let Comparison::Test(Test::Present, expected) = comparison {
+                    return Ok(value.is_some() == *expected);
+                }
+                evaluate(
+                    comparison,
+                    value.ok_or(AslError::Missing)?,
+                    data,
+                    context,
+                    budget,
+                )
+            }
+        }
+    }
+}
+
+fn comparison(operator: &str, value: &Value) -> Result<Comparison, AslError> {
+    let test = match operator {
+        "IsPresent" => Some(Test::Present),
+        "IsNull" => Some(Test::Null),
+        "IsString" => Some(Test::String),
+        "IsNumeric" => Some(Test::Numeric),
+        "IsBoolean" => Some(Test::Boolean),
+        "IsTimestamp" => Some(Test::Timestamp),
+        _ => None,
+    };
+    if let Some(test) = test {
+        return Ok(Comparison::Test(
+            test,
+            value.as_bool().ok_or(AslError::InvalidPredicate)?,
+        ));
+    }
+    if operator == "StringMatches" {
+        return Ok(Comparison::Matches(Glob::compile(
+            value.as_str().ok_or(AslError::InvalidPredicate)?,
+        )?));
+    }
+    let (name, path) = operator
+        .strip_suffix("Path")
+        .map_or((operator, false), |s| (s, true));
+    if name == "BooleanEquals" {
+        return Ok(Comparison::Boolean(operand(value, path, Value::as_bool)?));
+    }
+    let (family, suffix) = if let Some(s) = name.strip_prefix("String") {
+        (Family::String, s)
+    } else if let Some(s) = name.strip_prefix("Numeric") {
+        (Family::Numeric, s)
+    } else if let Some(s) = name.strip_prefix("Timestamp") {
+        (Family::Timestamp, s)
+    } else {
+        return Err(AslError::InvalidPredicate);
+    };
+    let order = match suffix {
+        "Equals" => Order::Equal,
+        "LessThan" => Order::Less,
+        "GreaterThan" => Order::Greater,
+        "LessThanEquals" => Order::LessEqual,
+        "GreaterThanEquals" => Order::GreaterEqual,
+        _ => return Err(AslError::InvalidPredicate),
+    };
+    match family {
+        Family::String => Ok(Comparison::String(
+            order,
+            operand(value, path, |v| v.as_str().map(str::to_owned))?,
+        )),
+        Family::Numeric => Ok(Comparison::Numeric(
+            order,
+            operand(value, path, |v| number(v).ok().flatten())?,
+        )),
+        Family::Timestamp => Ok(Comparison::Timestamp(
+            order,
+            operand(value, path, |v| v.as_str().and_then(timestamp))?,
+        )),
+    }
+}
+
+fn operand<T>(
+    value: &Value,
+    path: bool,
+    literal: impl FnOnce(&Value) -> Option<T>,
+) -> Result<Operand<T>, AslError> {
+    if path {
+        Ok(Operand::Path(
+            value.as_str().ok_or(AslError::InvalidPredicate)?.parse()?,
+        ))
+    } else {
+        Ok(Operand::Literal(
+            literal(value).ok_or(AslError::InvalidPredicate)?,
+        ))
+    }
+}
+
+fn resolve<'a, T>(
+    operand: &'a Operand<T>,
+    data: &'a Payload,
+    context: &'a EvaluationContext,
+) -> Result<Resolved<'a, T>, AslError> {
+    match operand {
+        Operand::Literal(value) => Ok(Resolved::Literal(value)),
+        Operand::Path(path) => Ok(Resolved::Value(
+            path.lookup(data, context).ok_or(AslError::Missing)?,
+        )),
+    }
+}
+
+pub(crate) fn number(value: &Value) -> Result<Option<f64>, AslError> {
+    const LIMIT: f64 = 9_007_199_254_740_992.0;
+    if let Some(n) = value.as_u64() {
+        if n > 9_007_199_254_740_992 {
+            return Err(AslError::NumericRange);
+        }
+    }
+    if let Some(n) = value.as_i64() {
+        if !(-9_007_199_254_740_992..=9_007_199_254_740_992).contains(&n) {
+            return Err(AslError::NumericRange);
+        }
+    }
+    let result = value.as_f64();
+    let floating = value.as_number().is_some_and(Number::is_f64);
+    if result.is_some_and(|n| !n.is_finite() || n.abs() > LIMIT || (floating && n.abs() == LIMIT)) {
+        return Err(AslError::NumericRange);
+    }
+    Ok(result)
+}
+
+fn timestamp(value: &str) -> Option<Timestamp> {
+    let date = DateTime::parse_from_rfc3339(value).ok()?;
+    if date.nanosecond() >= 1_000_000_000 {
+        None
+    } else {
+        let fraction = if let Some(dot) = value.find('.') {
+            let tail = value.get(dot.checked_add(1)?..)?;
+            let end = tail
+                .find(|ch: char| !ch.is_ascii_digit())
+                .unwrap_or(tail.len());
+            tail.get(..end)?.trim_end_matches('0')
+        } else {
+            ""
+        };
+        Some(Timestamp {
+            seconds: date.timestamp(),
+            fraction: fraction.to_owned(),
+            source_bytes: value.len(),
+        })
+    }
+}
+
+fn evaluate(
+    comparison: &Comparison,
+    value: &Value,
+    data: &Payload,
+    context: &EvaluationContext,
+    budget: &mut Budget,
+) -> Result<bool, AslError> {
+    match comparison {
+        Comparison::Test(test, expected) => {
+            let actual = match test {
+                Test::Present => true,
+                Test::Null => value.is_null(),
+                Test::String => value.is_string(),
+                Test::Numeric => value.is_number(),
+                Test::Boolean => value.is_boolean(),
+                Test::Timestamp => {
+                    if let Some(text) = value.as_str() {
+                        budget.text(text.len())?;
+                        timestamp(text).is_some()
+                    } else {
+                        false
+                    }
+                }
+            };
+            Ok(actual == *expected)
+        }
+        Comparison::Boolean(operand) => {
+            let expected = match resolve(operand, data, context)? {
+                Resolved::Literal(value) => Some(*value),
+                Resolved::Value(value) => value.as_bool(),
+            };
+            Ok(value.as_bool().zip(expected).is_some_and(|(a, b)| a == b))
+        }
+        Comparison::Numeric(order, operand) => {
+            let expected = match resolve(operand, data, context)? {
+                Resolved::Literal(value) => Some(*value),
+                Resolved::Value(value) => number(value)?,
+            };
+            Ok(number(value)?
+                .zip(expected)
+                .and_then(|(a, b)| a.partial_cmp(&b))
+                .is_some_and(|ordering| order.accepts(ordering)))
+        }
+        Comparison::String(order, operand) => {
+            let expected = match resolve(operand, data, context)? {
+                Resolved::Literal(value) => Some(value.as_str()),
+                Resolved::Value(value) => value.as_str(),
+            };
+            if let Some((a, b)) = value.as_str().zip(expected) {
+                budget.text(a.len().saturating_add(b.len()))?;
+                Ok(order.accepts(a.cmp(b)))
+            } else {
+                Ok(false)
+            }
+        }
+        Comparison::Timestamp(order, operand) => {
+            let expected = match resolve(operand, data, context)? {
+                Resolved::Literal(value) => {
+                    budget.text(value.source_bytes)?;
+                    Some(Cow::Borrowed(value))
+                }
+                Resolved::Value(value) => {
+                    if let Some(text) = value.as_str() {
+                        budget.text(text.len())?;
+                        timestamp(text).map(Cow::Owned)
+                    } else {
+                        None
+                    }
+                }
+            };
+            let actual = if let Some(text) = value.as_str() {
+                budget.text(text.len())?;
+                timestamp(text)
+            } else {
+                None
+            };
+            Ok(actual
+                .zip(expected)
+                .is_some_and(|(a, b)| order.accepts(a.compare(&b))))
+        }
+        Comparison::Matches(glob) => {
+            if let Some(text) = value.as_str() {
+                budget.text(text.len())?;
+                glob.matches(text, budget)
+            } else {
+                Ok(false)
+            }
+        }
+    }
+}
+
+struct Budget {
+    units: usize,
+    bytes: usize,
+}
+impl Budget {
+    fn step(&mut self) -> Result<(), AslError> {
+        self.units = self.units.checked_sub(1).ok_or(AslError::WorkLimit)?;
+        Ok(())
+    }
+    fn text(&mut self, bytes: usize) -> Result<(), AslError> {
+        self.bytes = self.bytes.checked_sub(bytes).ok_or(AslError::WorkLimit)?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/choice/glob.rs b/crates/rustack-stepfunctions-core/src/choice/glob.rs
new file mode 100644
index 00000000..59711678
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/choice/glob.rs
@@ -0,0 +1,85 @@
+//! Bounded Unicode glob, independent of user regular expressions.
+
+use super::Budget;
+use crate::AslError;
+
+#[derive(Clone)]
+pub(super) struct Glob(Vec<Token>);
+#[derive(Clone, Copy)]
+enum Token {
+    Literal(char),
+    Star,
+}
+
+impl Glob {
+    pub(super) fn compile(pattern: &str) -> Result<Self, AslError> {
+        if pattern.len() > 4096 {
+            return Err(AslError::InvalidPredicate);
+        }
+        let mut tokens = Vec::new();
+        let mut chars = pattern.chars();
+        while let Some(ch) = chars.next() {
+            let token = match ch {
+                '*' => {
+                    if matches!(tokens.last(), Some(Token::Star)) {
+                        continue;
+                    }
+                    Token::Star
+                }
+                '\\' => match chars.next() {
+                    Some(ch @ ('*' | '\\')) => Token::Literal(ch),
+                    _ => return Err(AslError::InvalidPredicate),
+                },
+                ch => Token::Literal(ch),
+            };
+            if tokens.len() >= 1024 {
+                return Err(AslError::InvalidPredicate);
+            }
+            tokens.push(token);
+        }
+        Ok(Self(tokens))
+    }
+
+    pub(super) fn matches(&self, text: &str, budget: &mut Budget) -> Result<bool, AslError> {
+        let mut position = 0_usize;
+        let mut token = 0_usize;
+        let mut star = None;
+        while let Some(ch) = text.get(position..).and_then(|s| s.chars().next()) {
+            budget.step()?;
+            match self.0.get(token) {
+                Some(Token::Literal(expected)) if *expected == ch => {
+                    position = position
+                        .checked_add(ch.len_utf8())
+                        .ok_or(AslError::WorkLimit)?;
+                    token = token.checked_add(1).ok_or(AslError::WorkLimit)?;
+                }
+                Some(Token::Star) => {
+                    token = token.checked_add(1).ok_or(AslError::WorkLimit)?;
+                    if token == self.0.len() {
+                        return Ok(true);
+                    }
+                    star = Some((token, position));
+                }
+                _ => {
+                    let Some((after, backup)) = star else {
+                        return Ok(false);
+                    };
+                    let Some(next) = text.get(backup..).and_then(|s| s.chars().next()) else {
+                        return Ok(false);
+                    };
+                    let advanced = backup
+                        .checked_add(next.len_utf8())
+                        .ok_or(AslError::WorkLimit)?;
+                    position = advanced;
+                    token = after;
+                    star = Some((after, advanced));
+                }
+            }
+        }
+        while matches!(self.0.get(token), Some(Token::Star)) {
+            budget.step()?;
+            token = token.checked_add(1).ok_or(AslError::WorkLimit)?;
+        }
+        Ok(token == self.0.len())
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/choice/tests.rs b/crates/rustack-stepfunctions-core/src/choice/tests.rs
new file mode 100644
index 00000000..a8364c6f
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/choice/tests.rs
@@ -0,0 +1,456 @@
+use std::error::Error;
+
+use proptest::prelude::*;
+use rstest::rstest;
+use rustack_core::json::JsonError;
+use serde_json::{Value, json};
+
+use crate::{AslError, EvaluationContext, Payload, Predicate};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+fn evaluate(rule: &Value, data: &Value) -> Result<bool, AslError> {
+    let predicate = Predicate::compile(rule)?;
+    let data = Payload::from_value(data)?;
+    predicate.evaluate(&data, &EvaluationContext::from(&data))
+}
+
+#[test]
+fn test_should_execute_all_independent_choice_catalog_examples() -> TestResult {
+    let catalog: Value = serde_json::from_str(include_str!(
+        "../../../../tests/workflows/semantic-cases.json"
+    ))?;
+    let mut count = 0;
+    for case in catalog["cases"].as_array().ok_or("missing cases")? {
+        if case["kind"] != "choice" {
+            continue;
+        }
+        assert_eq!(
+            evaluate(&case["rule"], &case["input"].clone())?,
+            case["expected"].as_bool().ok_or("missing expected")?
+        );
+        count += 1;
+    }
+    assert_eq!(count, 4);
+    Ok(())
+}
+
+#[test]
+fn test_should_cover_all_ordered_literal_and_path_operator_variants() -> TestResult {
+    let families = [
+        ("String", vec![json!("a"), json!("b"), json!("c")]),
+        ("Numeric", vec![json!(-1), json!(0), json!(1)]),
+        (
+            "Timestamp",
+            vec![
+                json!("2020-01-01T00:00:00Z"),
+                json!("2020-01-02T00:00:00Z"),
+                json!("2020-01-03T00:00:00Z"),
+            ],
+        ),
+    ];
+    let operators = [
+        ("Equals", [false, true, false]),
+        ("LessThan", [true, false, false]),
+        ("GreaterThan", [false, false, true]),
+        ("LessThanEquals", [true, true, false]),
+        ("GreaterThanEquals", [false, true, true]),
+    ];
+    for (family, values) in families {
+        let middle = values.get(1).ok_or("missing middle")?;
+        for (suffix, expected) in operators {
+            for path in [false, true] {
+                for (index, left) in values.iter().enumerate() {
+                    let op = format!("{family}{suffix}{}", if path { "Path" } else { "" });
+                    let operand = if path {
+                        json!("$.right")
+                    } else {
+                        middle.clone()
+                    };
+                    let rule = json!({"Variable":"$.left",op:operand});
+                    assert_eq!(
+                        evaluate(&rule, &json!({"left":left,"right":middle}))?,
+                        *expected.get(index).ok_or("missing expected")?,
+                        "{family} {suffix} {path} {index}"
+                    );
+                }
+            }
+        }
+    }
+    for path in [false, true] {
+        for value in [false, true] {
+            let op = if path {
+                "BooleanEqualsPath"
+            } else {
+                "BooleanEquals"
+            };
+            let operand = if path { json!("$.right") } else { json!(true) };
+            assert_eq!(
+                evaluate(
+                    &json!({"Variable":"$.left",op:operand}),
+                    &json!({"left":value,"right":true})
+                )?,
+                value
+            );
+        }
+    }
+    Ok(())
+}
+
+#[rstest]
+#[case("IsPresent",json!(null),true)]
+#[case("IsNull",json!(null),true)]
+#[case("IsString",json!("7"),true)]
+#[case("IsNumeric",json!(7),true)]
+#[case("IsBoolean",json!(true),true)]
+#[case("IsTimestamp",json!("2020-01-01T00:00:00Z"),true)]
+#[case("IsNull",json!(0),false)]
+#[case("IsString",json!(7),false)]
+#[case("IsNumeric",json!("7"),false)]
+#[case("IsBoolean",json!("true"),false)]
+#[case("IsTimestamp",json!("invalid"),false)]
+#[case("IsTimestamp",json!("2016-12-31T23:59:60Z"),false)]
+fn test_should_apply_type_tests_without_coercion(
+    #[case] op: &str,
+    #[case] value: Value,
+    #[case] expected: bool,
+) -> TestResult {
+    for requested in [true, false] {
+        assert_eq!(
+            evaluate(&json!({"Variable":"$.x",op:requested}), &json!({"x":value}))?,
+            expected == requested
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_should_short_circuit_in_definition_order_and_preserve_missing_errors() -> TestResult {
+    let present = json!({"Variable":"$.absent","IsPresent":true});
+    let missing = json!({"Variable":"$.absent","IsString":true});
+    assert!(!evaluate(&json!({"And":[present,missing]}), &json!({}))?);
+    assert!(evaluate(
+        &json!({"Or":[{"Not":present},missing]}),
+        &json!({})
+    )?);
+    assert!(matches!(
+        evaluate(&json!({"And":[missing,present]}), &json!({})),
+        Err(AslError::Missing)
+    ));
+    for op in [
+        "IsNull",
+        "IsString",
+        "IsNumeric",
+        "IsBoolean",
+        "IsTimestamp",
+    ] {
+        assert!(matches!(
+            evaluate(&json!({"Variable":"$.absent",op:false}), &json!({})),
+            Err(AslError::Missing)
+        ));
+    }
+    assert!(matches!(
+        evaluate(
+            &json!({"Variable":"$.x","StringEqualsPath":"$.absent"}),
+            &json!({"x":1})
+        ),
+        Err(AslError::Missing)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_compare_instants_and_avoid_numeric_precision_aliasing() -> TestResult {
+    assert!(!evaluate(
+        &json!({"Variable":"$.x","TimestampEquals":"2020-01-01T00:00:00.1234567891Z"}),
+        &json!({"x":"2020-01-01T00:00:00.1234567892Z"})
+    )?);
+    assert!(evaluate(
+        &json!({"Variable":"$.x","TimestampEquals":"2020-01-01T00:00:00.1234567891000Z"}),
+        &json!({"x":"2020-01-01T01:00:00.1234567891+01:00"})
+    )?);
+    assert!(evaluate(
+        &json!({"Variable":"$.x","TimestampEquals":"2020-01-01T00:00:00.123Z"}),
+        &json!({"x":"2020-01-01T01:00:00.123+01:00"})
+    )?);
+    assert!(!evaluate(
+        &json!({"Variable":"$.x","TimestampEquals":"2020-01-01T00:00:00Z"}),
+        &json!({"x":"2020-01-01"})
+    )?);
+    assert!(evaluate(
+        &json!({"Variable":"$.x","NumericEquals":9_007_199_254_740_992_u64}),
+        &json!({"x":9_007_199_254_740_992_u64})
+    )?);
+    assert!(matches!(
+        evaluate(
+            &json!({"Variable":"$.x","NumericEquals":9_007_199_254_740_992_u64}),
+            &json!({"x":9_007_199_254_740_993_u64})
+        ),
+        Err(AslError::NumericRange)
+    ));
+    assert!(matches!(
+        evaluate(
+            &json!({"Variable":"$.x","NumericEqualsPath":"$.right"}),
+            &json!({"x":0,"right":-9_007_199_254_740_993_i64})
+        ),
+        Err(AslError::NumericRange)
+    ));
+    assert!(evaluate(
+        &json!({"Variable":"$.x","IsNumeric":true}),
+        &json!({"x":u64::MAX})
+    )?);
+    for (op, operand, left) in [
+        ("StringEquals", json!("1"), json!(1)),
+        ("NumericEquals", json!(1), json!("1")),
+        ("BooleanEquals", json!(true), json!(1)),
+    ] {
+        assert!(!evaluate(
+            &json!({"Variable":"$.x",op:operand}),
+            &json!({"x":left})
+        )?);
+    }
+    let predicate =
+        Predicate::compile(&json!({"Variable":"$$.State.Name","StringEquals":"current"}))?;
+    assert!(predicate.evaluate(
+        &Payload::parse(b"null")?,
+        &EvaluationContext::from_value(&json!({"State":{"Name":"current"}}))?
+    )?);
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_raw_float_boundary_lexemes_instead_of_aliasing_large_numbers() -> TestResult {
+    let integer = Predicate::parse(br#"{"Variable":"$.x","NumericEquals":9007199254740992}"#)?;
+    for text in [
+        "9007199254740993.0",
+        "9007199254740993e0",
+        "9007199254740992.0",
+        "-9007199254740993.0",
+        "-9007199254740993e0",
+    ] {
+        let data = Payload::parse(format!("{{\"x\":{text}}}").as_bytes())?;
+        assert!(
+            matches!(
+                integer.evaluate(&data, &EvaluationContext::from(&data)),
+                Err(AslError::NumericRange)
+            ),
+            "{text}"
+        );
+        assert!(
+            matches!(
+                Predicate::parse(
+                    format!("{{\"Variable\":\"$.x\",\"NumericEquals\":{text}}}").as_bytes()
+                ),
+                Err(AslError::InvalidPredicate)
+            ),
+            "{text}"
+        );
+    }
+    let inside = Predicate::parse(br#"{"Variable":"$.x","NumericEquals":9007199254740991.0}"#)?;
+    let data = Payload::parse(br#"{"x":9007199254740991e0}"#)?;
+    assert!(inside.evaluate(&data, &EvaluationContext::from(&data))?);
+    Ok(())
+}
+
+#[test]
+fn test_should_charge_precompiled_timestamp_literal_bytes_to_shared_budget() -> TestResult {
+    let actual = format!("2020-01-01T00:00:00.{}Z", "0".repeat(180_000));
+    let expected = format!("2020-01-01T00:00:00.{}1Z", "0".repeat(180_000));
+    let comparison = json!({"Variable":"$.x","TimestampLessThan":expected});
+    let data = Payload::from_value(&json!({"x":actual}))?;
+    let two = Predicate::compile(&json!({"And":[comparison,comparison]}))?;
+    assert!(two.evaluate(&data, &EvaluationContext::from(&data))?);
+    let three = Predicate::compile(&json!({"And":[comparison,comparison,comparison]}))?;
+    assert!(matches!(
+        three.evaluate(&data, &EvaluationContext::from(&data)),
+        Err(AslError::WorkLimit)
+    ));
+    let timestamp = format!("2020-01-01T00:00:00.{}1Z", "0".repeat(220_000));
+    let comparison = json!({"Variable":"$.x","TimestampLessThan":timestamp});
+    let rule = json!({"And":[comparison,comparison,comparison,comparison,comparison]});
+    assert!(Predicate::compile(&rule).is_err());
+    // A shared Path operand supplies the same long fraction repeatedly without
+    // exceeding the separately bounded source definition.
+    let comparison = json!({"Variable":"$.x","TimestampLessThanPath":"$.right"});
+    let data = Payload::from_value(&json!({"x":"2020-01-01T00:00:00Z","right":timestamp}))?;
+    let rule = Predicate::compile(
+        &json!({"And":[comparison,comparison,comparison,comparison,comparison]}),
+    )?;
+    assert!(matches!(
+        rule.evaluate(&data, &EvaluationContext::from(&data)),
+        Err(AslError::WorkLimit)
+    ));
+    Ok(())
+}
+
+#[rstest]
+#[case("", "", true)]
+#[case("*", "", true)]
+#[case("**", "中🙂", true)]
+#[case("中*文", "中🙂文", true)]
+#[case("a\\*b", "a*b", true)]
+#[case("a\\\\b", "a\\b", true)]
+#[case("a?b", "a?b", true)]
+#[case("a?b", "axb", false)]
+#[case("*aba*b", "ababab", true)]
+#[case("a*b*c", "abcc", true)]
+#[case("a*b*c", "abdcx", false)]
+#[case("literal", "Literal", false)]
+fn test_should_match_compiled_unicode_globs(
+    #[case] pattern: &str,
+    #[case] input: &str,
+    #[case] expected: bool,
+) -> TestResult {
+    assert_eq!(
+        evaluate(
+            &json!({"Variable":"$.x","StringMatches":pattern}),
+            &json!({"x":input})
+        )?,
+        expected
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({}))]
+#[case(json!([]))]
+#[case(json!({"And":[]}))]
+#[case(json!({"Or":[]}))]
+#[case(json!({"And":[],"Not":{}}))]
+#[case(json!({"Variable":"$.x","IsNull":"true"}))]
+#[case(json!({"Variable":"$.x","NumericEquals":true}))]
+#[case(json!({"Variable":"$.x","NumericEquals":u64::MAX}))]
+#[case(json!({"Variable":"$.x","TimestampEquals":"invalid"}))]
+#[case(json!({"Variable":"$.x","StringEquals":7}))]
+#[case(json!({"Variable":"$.x","StringMatches":"\\q"}))]
+#[case(json!({"Variable":"$.x","StringMatches":"\\"}))]
+#[case(json!({"Variable":"$.x","IsNull":true,"IsString":false}))]
+#[case(json!({"Variable":"$.x","Unknown":true}))]
+#[case(json!({"Variable":"$.x","StringMatchesPath":"$.y"}))]
+fn test_should_reject_ambiguous_invalid_or_unknown_predicates(#[case] value: Value) {
+    assert!(matches!(
+        Predicate::compile(&value),
+        Err(AslError::InvalidPredicate)
+    ));
+}
+
+#[test]
+fn test_should_bound_source_structure_compiled_nodes_depth_and_glob_tokens() -> TestResult {
+    assert!(matches!(
+        Predicate::parse(br#"{"Variable":"$.a","IsNull":true,"IsNull":false}"#),
+        Err(AslError::Json(JsonError::Duplicate))
+    ));
+    assert!(Predicate::compile(&json!({"Variable":"$[*]","IsNull":true})).is_err());
+    assert!(Predicate::compile(&json!({"Variable":"$.x","StringEqualsPath":"$[*]"})).is_err());
+    let leaf = json!({"Variable":"$.x","IsPresent":true});
+    let mut nested = leaf.clone();
+    for _ in 0..31 {
+        nested = json!({"Not":nested});
+    }
+    Predicate::compile(&nested)?;
+    assert!(matches!(
+        Predicate::compile(&json!({"Not":nested})),
+        Err(AslError::InvalidPredicate)
+    ));
+    Predicate::compile(&json!({"And":vec![leaf.clone();128]}))?;
+    assert!(matches!(
+        Predicate::compile(&json!({"And":vec![leaf.clone();129]})),
+        Err(AslError::InvalidPredicate)
+    ));
+    let group = json!({"And":vec![leaf;8]});
+    assert!(matches!(
+        Predicate::compile(&json!({"And":vec![group;128]})),
+        Err(AslError::InvalidPredicate)
+    ));
+    Predicate::compile(&json!({"Variable":"$.x","StringMatches":"🙂".repeat(1024)}))?;
+    assert!(matches!(
+        Predicate::compile(&json!({"Variable":"$.x","StringMatches":"a".repeat(1025)})),
+        Err(AslError::InvalidPredicate)
+    ));
+    assert!(matches!(
+        Predicate::compile(&json!({"Variable":"$.x","StringMatches":"🙂".repeat(1025)})),
+        Err(AslError::InvalidPredicate)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_share_step_and_string_byte_limits_across_the_complete_predicate() -> TestResult {
+    assert!(matches!(
+        evaluate(
+            &json!({"Variable":"$.x","StringMatches":"*b"}),
+            &json!({"x":"a".repeat(20_000)})
+        ),
+        Err(AslError::WorkLimit)
+    ));
+    assert!(evaluate(
+        &json!({"Variable":"$.x","StringMatches":"a*"}),
+        &json!({"x":"a".repeat(20_000)})
+    )?);
+    let comparison = json!({"Variable":"$.x","StringEqualsPath":"$.x"});
+    let input = json!({"x":"a".repeat(260_000)});
+    assert!(evaluate(
+        &json!({"And":[comparison,comparison]}),
+        &input.clone()
+    )?);
+    assert!(matches!(
+        evaluate(&json!({"And":[comparison,comparison,comparison]}), &input),
+        Err(AslError::WorkLimit)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_borrowed_extreme_predicate_without_recursive_drop_and_redact() -> TestResult {
+    let mut tree = Value::Null;
+    for _ in 0..50_000 {
+        tree = Value::Array(vec![tree]);
+    }
+    let rejected = Predicate::compile(&tree);
+    let mut owned = vec![tree];
+    while let Some(value) = owned.pop() {
+        if let Value::Array(mut children) = value {
+            owned.append(&mut children);
+        }
+    }
+    assert!(matches!(rejected, Err(AslError::Json(JsonError::Depth))));
+    let predicate = Predicate::compile(&json!({"Variable":"$.secret","StringEquals":"private"}))?;
+    assert_eq!(format!("{predicate:?}"), "Predicate(<redacted>)");
+    Ok(())
+}
+
+fn glob_oracle(pattern: &str, text: &str) -> bool {
+    let chars: Vec<_> = text.chars().collect();
+    let mut row = vec![false; chars.len() + 1];
+    row[0] = true;
+    for ch in pattern.chars() {
+        let mut next = vec![false; row.len()];
+        if ch == '*' {
+            next[0] = row[0];
+        }
+        for (i, input) in chars.iter().enumerate() {
+            next[i + 1] = if ch == '*' {
+                next[i] || row[i + 1]
+            } else {
+                row[i] && ch == *input
+            };
+        }
+        row = next;
+    }
+    row.last().copied().unwrap_or(false)
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_match_an_independent_glob_dynamic_program(pattern in "[ab*]{0,12}", text in "[ab]{0,18}") {
+        let actual=evaluate(&json!({"Variable":"$.x","StringMatches":pattern}),&json!({"x":text})).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(actual,glob_oracle(&pattern,&text));
+    }
+
+    #[test]
+    fn test_should_preserve_exact_integer_order_inside_the_supported_range(a in -1_000_000_i64..1_000_000, b in -1_000_000_i64..1_000_000) {
+        let actual=evaluate(&json!({"Variable":"$.a","NumericLessThanPath":"$.b"}),&json!({"a":a,"b":b})).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(actual,a<b);
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/diagnostic.rs b/crates/rustack-stepfunctions-core/src/compiler/diagnostic.rs
new file mode 100644
index 00000000..d79a8135
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/diagnostic.rs
@@ -0,0 +1,199 @@
+//! Bounded RFC6901 diagnostic locations and retained redacted error sources.
+
+use std::fmt;
+
+use rustack_core::json::JsonError;
+use thiserror::Error;
+
+use crate::AslError;
+
+/// Severity of a stable local compiler diagnostic.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum DiagnosticSeverity {
+    /// The definition cannot be installed.
+    Error,
+    /// Valid definition with a nonfatal structural issue.
+    Warning,
+}
+
+/// Bounded public diagnostic; Debug never projects source identifiers.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct Diagnostic {
+    severity: DiagnosticSeverity,
+    code: &'static str,
+    message: &'static str,
+    location: String,
+}
+impl fmt::Debug for Diagnostic {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Diagnostic(<redacted>)")
+    }
+}
+impl Diagnostic {
+    read!(Diagnostic,severity,DiagnosticSeverity,s=>s.severity,"Read severity.");
+    read!(Diagnostic,code,&'static str,s=>s.code,"Read a stable Rustack diagnostic code.");
+    read!(Diagnostic,message,&'static str,s=>s.message,"Read the static bounded message.");
+    read!(Diagnostic,location,&str,s=>s.location.as_str(),"Read the bounded RFC6901 pointer; empty means root.");
+}
+
+#[derive(Error)]
+enum Source {
+    #[error("invalid definition JSON")]
+    Json(#[from] JsonError),
+    #[error("invalid compiled component")]
+    Asl(#[from] AslError),
+}
+impl fmt::Debug for Source {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+
+/// Failed compilation with one diagnostic and an optional typed source.
+#[derive(Error)]
+#[error("ASL definition compilation failed")]
+#[non_exhaustive]
+pub struct CompileError {
+    diagnostic: Diagnostic,
+    #[source]
+    source: Option<Source>,
+}
+impl fmt::Debug for CompileError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl CompileError {
+    read!(CompileError,diagnostic,&Diagnostic,s=>&s.diagnostic,"Read the diagnostic without formatting its source.");
+    pub(super) fn json(location: &Location, error: JsonError) -> Self {
+        let limited = matches!(
+            error,
+            JsonError::Bytes
+                | JsonError::Depth
+                | JsonError::Members
+                | JsonError::String
+                | JsonError::Key
+        );
+        let mut failure = if limited {
+            location.error(
+                Code::LimitExceeded,
+                "definition limits: 1MiB, 64 JSON levels, 65536 members, 1MiB strings, 256KiB keys",
+            )
+        } else {
+            location.error(Code::InvalidJson, "invalid or duplicate definition JSON")
+        };
+        failure.source = Some(Source::Json(error));
+        failure
+    }
+    pub(super) fn asl(location: &Location, error: AslError) -> Self {
+        let message = match &error {
+            AslError::InvalidTemplate => {
+                "invalid template shape/collision or limit (32 containers, 4096 compiled nodes)"
+            }
+            AslError::InvalidExpression => {
+                "invalid expression or limit (4096 bytes, 1024 nodes, 10 calls, 128 arguments)"
+            }
+            AslError::InvalidPredicate => {
+                "invalid Choice predicate or limit (32 levels, 1024 nodes, 128 children)"
+            }
+            AslError::InvalidPath | AslError::InvalidReference | AslError::InvalidResultTarget => {
+                "invalid path or limit (1024 bytes, 128 segments)"
+            }
+            AslError::InvalidWait => {
+                "invalid STANDARD Wait source (integer seconds at most 31536000)"
+            }
+            AslError::Json(_) => {
+                "invalid component JSON (1MiB, 64 levels, 4096 members, 256KiB strings/keys)"
+            }
+            AslError::DataLimit => "compiled component exceeds its encoded JSON budget",
+            _ => "invalid compiled state component",
+        };
+        let mut failure = location.error(Code::InvalidComponent, message);
+        failure.source = Some(Source::Asl(error));
+        failure
+    }
+}
+
+pub(super) struct Location(String);
+impl Location {
+    pub(super) fn root() -> Self {
+        Self(String::new())
+    }
+    pub(super) fn field(&self, token: &str) -> Result<Self, CompileError> {
+        let extra = token.bytes().filter(|b| matches!(b, b'~' | b'/')).count();
+        let length = self
+            .0
+            .len()
+            .saturating_add(1)
+            .saturating_add(token.len())
+            .saturating_add(extra);
+        if length > 4096 {
+            return Err(self.error(Code::LimitExceeded, "diagnostic location limit exceeded"));
+        }
+        let mut value = String::with_capacity(length);
+        value.push_str(&self.0);
+        value.push('/');
+        value.push_str(&token.replace('~', "~0").replace('/', "~1"));
+        Ok(Self(value))
+    }
+    pub(super) fn warning(&self, code: Code, message: &'static str) -> Diagnostic {
+        self.diagnostic(DiagnosticSeverity::Warning, code, message)
+    }
+    fn diagnostic(
+        &self,
+        severity: DiagnosticSeverity,
+        code: Code,
+        message: &'static str,
+    ) -> Diagnostic {
+        Diagnostic {
+            severity,
+            code: code.as_str(),
+            message,
+            location: self.0.clone(),
+        }
+    }
+    pub(super) fn error(&self, code: Code, message: &'static str) -> CompileError {
+        CompileError {
+            diagnostic: self.diagnostic(DiagnosticSeverity::Error, code, message),
+            source: None,
+        }
+    }
+}
+
+#[derive(Clone, Copy)]
+pub(super) enum Code {
+    InvalidJson,
+    InvalidComponent,
+    InvalidSchema,
+    MissingField,
+    UnsupportedField,
+    LimitExceeded,
+    InvalidStateName,
+    MissingTransitionTarget,
+    ProfileUnavailable,
+    DependencyDisabled,
+    InvalidResource,
+    NoReachableTerminal,
+    UnreachableState,
+}
+impl Code {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::InvalidJson => "RUSTACK_INVALID_JSON",
+            Self::InvalidComponent => "RUSTACK_INVALID_COMPONENT",
+            Self::InvalidSchema => "RUSTACK_INVALID_SCHEMA",
+            Self::MissingField => "RUSTACK_MISSING_FIELD",
+            Self::UnsupportedField => "RUSTACK_UNSUPPORTED_FIELD",
+            Self::LimitExceeded => "RUSTACK_LIMIT_EXCEEDED",
+            Self::InvalidStateName => "RUSTACK_INVALID_STATE_NAME",
+            Self::MissingTransitionTarget => "RUSTACK_MISSING_TRANSITION_TARGET",
+            Self::ProfileUnavailable => "RUSTACK_PROFILE_UNAVAILABLE",
+            Self::DependencyDisabled => "RUSTACK_DEPENDENCY_DISABLED",
+            Self::InvalidResource => "RUSTACK_INVALID_RESOURCE",
+            Self::NoReachableTerminal => "RUSTACK_NO_REACHABLE_TERMINAL",
+            Self::UnreachableState => "RUSTACK_UNREACHABLE_STATE",
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/ir.rs b/crates/rustack-stepfunctions-core/src/compiler/ir.rs
new file mode 100644
index 00000000..99fead05
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/ir.rs
@@ -0,0 +1,528 @@
+//! Immutable typed state storage and checked borrowed execution views.
+
+use std::{
+    fmt,
+    num::{NonZeroU8, NonZeroU32},
+    sync::Arc,
+};
+
+use bytes::Bytes;
+use serde_json::Value;
+
+use super::{Catcher, Diagnostic, Integration, RecoveryPolicy, TenantScope};
+use crate::{
+    AslError, DataFlow, Expression, Predicate, ReferencePath, ResultPath, Template, WaitSource,
+};
+
+/// State index constructible only by the compiler; interpreted in its machine.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[non_exhaustive]
+pub struct StateId(pub(super) usize);
+
+/// Pre-resolved sequential control transfer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Transition {
+    /// Continue within the compiled scope.
+    Next(StateId),
+    /// Complete this machine successfully.
+    End,
+}
+
+/// Prevalidated per-attempt timeout source.
+#[derive(Clone)]
+#[non_exhaustive]
+pub enum TaskTimeout {
+    /// Bounded only by the execution/operator deadline.
+    Omitted,
+    /// Positive static seconds.
+    Seconds(NonZeroU32),
+    /// Singular dynamic seconds resolved on entry.
+    Path(ReferencePath),
+}
+impl fmt::Debug for TaskTimeout {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("TaskTimeout(<redacted>)")
+    }
+}
+
+/// Normalized Inline Map concurrency, independent of task/frame capacity.
+#[derive(Clone)]
+#[non_exhaustive]
+pub enum MapConcurrency {
+    /// Positive static limit; omission and zero normalize to forty.
+    Limit(NonZeroU8),
+    /// Singular reference resolved from the effective Map input on entry.
+    Path(ReferencePath),
+}
+impl fmt::Debug for MapConcurrency {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("MapConcurrency(<redacted>)")
+    }
+}
+
+/// Failure field view preserving omission, literal text or compiled expression.
+#[non_exhaustive]
+#[derive(Clone, Copy)]
+pub enum FailureView<'a> {
+    /// No value was supplied.
+    Omitted,
+    /// Bounded literal field.
+    Literal(&'a str),
+    /// Must evaluate to a bounded string on entry.
+    Dynamic(&'a Expression),
+}
+impl fmt::Debug for FailureView<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("FailureView(<redacted>)")
+    }
+}
+
+/// Catch error-object merge behavior.
+#[non_exhaustive]
+pub enum CatchResult<'a> {
+    /// Replace the failed state's raw input with its error object.
+    Replace,
+    /// Preserve its original raw input.
+    Discard,
+    /// Merge into the original input through a validated data-root reference.
+    Path(&'a ResultPath),
+}
+impl fmt::Debug for CatchResult<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CatchResult(<redacted>)")
+    }
+}
+
+/// Borrowed validated state instruction; execution does not interpret ASL maps.
+#[non_exhaustive]
+pub enum StateView<'a> {
+    /// Pass with a possible static result and resolved continuation.
+    Pass {
+        /// Compiled data processing.
+        flow: &'a DataFlow,
+        /// Literal result, if supplied.
+        result: Option<&'a Value>,
+        /// Pre-resolved continuation.
+        next: Transition,
+    },
+    /// Actual Lambda call plan; the executor owns invocation lifetime.
+    Task {
+        /// Compiled data processing.
+        flow: &'a DataFlow,
+        /// Validated integration.
+        resource: &'a Integration,
+        /// Per-attempt timeout source.
+        timeout: &'a TaskTimeout,
+        /// Ordered recovery rules.
+        recovery: &'a RecoveryPolicy,
+        /// Pre-resolved continuation.
+        next: Transition,
+    },
+    /// Independent branch machines sharing this state's effective input.
+    Parallel {
+        /// Compiled input and result processing.
+        flow: &'a DataFlow,
+        /// Branches in definition/result order, each with a lexical state index.
+        branches: &'a [Arc<CompiledMachine>],
+        /// Ordered enclosing-state recovery.
+        recovery: &'a RecoveryPolicy,
+        /// Continuation in the enclosing machine.
+        next: Transition,
+    },
+    /// Normalized Inline Map instruction with one reusable processor artifact.
+    Map {
+        /// Input/output/result processing; excludes legacy selector Parameters.
+        flow: &'a DataFlow,
+        /// Array source, defaulting to the effective input root.
+        items: &'a ReferencePath,
+        /// Item input template evaluated with Map.Item context, when supplied.
+        selector: Option<&'a Template>,
+        /// Immutable processor with an independent lexical index.
+        processor: &'a Arc<CompiledMachine>,
+        /// Normalized local concurrency plan.
+        concurrency: &'a MapConcurrency,
+        /// Ordered enclosing-state recovery.
+        recovery: &'a RecoveryPolicy,
+        /// Continuation in the enclosing machine.
+        next: Transition,
+    },
+    /// Ordered conditional branches with optional fallback.
+    Choice {
+        /// Input/output processing only.
+        flow: &'a DataFlow,
+        /// Compiled predicates and targets.
+        branches: &'a [(Predicate, StateId)],
+        /// Optional default target.
+        default: Option<StateId>,
+    },
+    /// Wait plan; timers remain actor-owned.
+    Wait {
+        /// Input/output processing.
+        flow: &'a DataFlow,
+        /// Compiled wait source.
+        source: &'a WaitSource,
+        /// Pre-resolved continuation.
+        next: Transition,
+    },
+    /// Successful terminal with input/output transforms.
+    Succeed {
+        /// Compiled input/output processing.
+        flow: &'a DataFlow,
+    },
+    /// Failed terminal with independent bounded fields.
+    Fail {
+        /// Error field.
+        error: FailureView<'a>,
+        /// Cause field.
+        cause: FailureView<'a>,
+    },
+}
+impl fmt::Debug for StateView<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("StateView(<redacted>)")
+    }
+}
+
+pub(super) enum Failure {
+    Omitted,
+    Literal(String),
+    Dynamic(Expression),
+}
+impl Failure {
+    fn view(&self) -> FailureView<'_> {
+        match self {
+            Self::Omitted => FailureView::Omitted,
+            Self::Literal(v) => FailureView::Literal(v),
+            Self::Dynamic(v) => FailureView::Dynamic(v),
+        }
+    }
+    fn units(&self) -> usize {
+        match self {
+            Self::Dynamic(v) => v.node_count(),
+            Self::Omitted | Self::Literal(_) => 1,
+        }
+    }
+}
+
+pub(super) enum Node {
+    Pass {
+        flow: DataFlow,
+        result: Option<Arc<Value>>,
+        next: Transition,
+    },
+    Task {
+        flow: DataFlow,
+        resource: Integration,
+        timeout: TaskTimeout,
+        recovery: RecoveryPolicy,
+        next: Transition,
+    },
+    Parallel {
+        flow: DataFlow,
+        branches: Vec<Arc<CompiledMachine>>,
+        recovery: RecoveryPolicy,
+        next: Transition,
+    },
+    Map {
+        flow: DataFlow,
+        items: ReferencePath,
+        selector: Option<Template>,
+        processor: Arc<CompiledMachine>,
+        concurrency: MapConcurrency,
+        recovery: RecoveryPolicy,
+        next: Transition,
+    },
+    Choice {
+        flow: DataFlow,
+        branches: Vec<(Predicate, StateId)>,
+        default: Option<StateId>,
+    },
+    Wait {
+        flow: DataFlow,
+        source: WaitSource,
+        next: Transition,
+    },
+    Succeed(DataFlow),
+    Fail {
+        error: Failure,
+        cause: Failure,
+    },
+}
+impl Node {
+    fn view(&self) -> StateView<'_> {
+        match self {
+            Self::Pass { flow, result, next } => StateView::Pass {
+                flow,
+                result: result.as_deref(),
+                next: *next,
+            },
+            Self::Task {
+                flow,
+                resource,
+                timeout,
+                recovery,
+                next,
+            } => StateView::Task {
+                flow,
+                resource,
+                timeout,
+                recovery,
+                next: *next,
+            },
+            Self::Parallel {
+                flow,
+                branches,
+                recovery,
+                next,
+            } => StateView::Parallel {
+                flow,
+                branches,
+                recovery,
+                next: *next,
+            },
+            Self::Map {
+                flow,
+                items,
+                selector,
+                processor,
+                concurrency,
+                recovery,
+                next,
+            } => StateView::Map {
+                flow,
+                items,
+                selector: selector.as_ref(),
+                processor,
+                concurrency,
+                recovery,
+                next: *next,
+            },
+            Self::Choice {
+                flow,
+                branches,
+                default,
+            } => StateView::Choice {
+                flow,
+                branches,
+                default: *default,
+            },
+            Self::Wait { flow, source, next } => StateView::Wait {
+                flow,
+                source,
+                next: *next,
+            },
+            Self::Succeed(flow) => StateView::Succeed { flow },
+            Self::Fail { error, cause } => StateView::Fail {
+                error: error.view(),
+                cause: cause.view(),
+            },
+        }
+    }
+    pub(super) fn terminal(&self) -> bool {
+        matches!(
+            self,
+            Self::Succeed(_)
+                | Self::Fail { .. }
+                | Self::Pass {
+                    next: Transition::End,
+                    ..
+                }
+                | Self::Task {
+                    next: Transition::End,
+                    ..
+                }
+                | Self::Parallel {
+                    next: Transition::End,
+                    ..
+                }
+                | Self::Map {
+                    next: Transition::End,
+                    ..
+                }
+                | Self::Wait {
+                    next: Transition::End,
+                    ..
+                }
+        )
+    }
+    pub(super) fn edges(&self) -> Vec<StateId> {
+        let mut result = Vec::new();
+        let transition = match self {
+            Self::Pass { next, .. } | Self::Wait { next, .. } => Some(*next),
+            Self::Task { next, recovery, .. }
+            | Self::Parallel { next, recovery, .. }
+            | Self::Map { next, recovery, .. } => {
+                result.extend(recovery.catches().iter().map(Catcher::next));
+                Some(*next)
+            }
+            Self::Choice {
+                branches, default, ..
+            } => {
+                result.extend(branches.iter().map(|(_, id)| *id));
+                result.extend(default);
+                None
+            }
+            Self::Succeed(_) | Self::Fail { .. } => None,
+        };
+        if let Some(Transition::Next(id)) = transition {
+            result.push(id);
+        }
+        result
+    }
+    pub(super) fn units(&self) -> usize {
+        let units = match self {
+            Self::Pass { flow, .. } | Self::Wait { flow, .. } | Self::Succeed(flow) => {
+                flow.node_count()
+            }
+            Self::Task { flow, recovery, .. } | Self::Parallel { flow, recovery, .. } => {
+                flow.node_count().saturating_add(recovery.units())
+            }
+            Self::Map {
+                flow,
+                selector,
+                recovery,
+                ..
+            } => flow
+                .node_count()
+                .saturating_add(recovery.units())
+                .saturating_add(selector.as_ref().map_or(0, Template::node_count)),
+            Self::Choice { flow, branches, .. } => branches
+                .iter()
+                .fold(flow.node_count(), |sum, (predicate, _)| {
+                    sum.saturating_add(predicate.node_count()).saturating_add(1)
+                }),
+            Self::Fail { error, cause } => error.units().saturating_add(cause.units()),
+        };
+        units.saturating_add(1)
+    }
+}
+pub(super) struct Row {
+    pub(super) name: String,
+    pub(super) node: Node,
+}
+
+/// Immutable root-source bytes and indexed instructions in one lexical scope.
+#[non_exhaustive]
+pub struct CompiledMachine {
+    pub(super) original: Bytes,
+    pub(super) definition_root: bool,
+    pub(super) rows: Vec<Row>,
+    pub(super) start: StateId,
+    pub(super) timeout: Option<NonZeroU32>,
+    pub(super) scope: TenantScope,
+}
+impl fmt::Debug for CompiledMachine {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CompiledMachine(<redacted>)")
+    }
+}
+impl CompiledMachine {
+    /// Whether this artifact represents the complete original definition.
+    pub(crate) fn is_root_definition(&self) -> bool {
+        self.definition_root
+    }
+
+    pub(crate) fn uses_lambda(&self) -> bool {
+        self.rows.iter().any(|row| match &row.node {
+            Node::Task { resource, .. } => matches!(
+                resource,
+                Integration::DirectLambda(_)
+                    | Integration::LambdaInvoke
+                    | Integration::LambdaCallback(_)
+            ),
+            Node::Parallel { branches, .. } => branches.iter().any(|branch| branch.uses_lambda()),
+            Node::Map { processor, .. } => processor.uses_lambda(),
+            _ => false,
+        })
+    }
+
+    pub(crate) fn uses_children(&self) -> bool {
+        self.rows.iter().any(|row| match &row.node {
+            Node::Task { resource, .. } => matches!(resource, Integration::StartExecution(_)),
+            Node::Parallel { branches, .. } => branches.iter().any(|branch| branch.uses_children()),
+            Node::Map { processor, .. } => processor.uses_children(),
+            _ => false,
+        })
+    }
+
+    pub(crate) fn uses_callbacks(&self) -> bool {
+        self.rows.iter().any(|row| match &row.node {
+            Node::Task { resource, .. } => matches!(resource, Integration::LambdaCallback(_)),
+            Node::Parallel { branches, .. } => {
+                branches.iter().any(|branch| branch.uses_callbacks())
+            }
+            Node::Map { processor, .. } => processor.uses_callbacks(),
+            _ => false,
+        })
+    }
+
+    /// Whether this scope requires a structured frame owner for execution.
+    ///
+    /// ```
+    /// # fn inspect(machine: &rustack_stepfunctions_core::CompiledMachine) {
+    /// let required = machine.requires_structured_execution();
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn requires_structured_execution(&self) -> bool {
+        self.rows
+            .iter()
+            .any(|row| matches!(&row.node, Node::Parallel { .. } | Node::Map { .. }))
+    }
+
+    read!(CompiledMachine,scope,&TenantScope,s=>&s.scope,"Read the validated scope captured during compilation.");
+    read!(CompiledMachine,start,StateId,s=>s.start,"Read the validated entry ID.");
+    read!(CompiledMachine,state_count,usize,s=>s.rows.len(),"Read the bounded number of compiled states.");
+    read!(CompiledMachine,original_bytes,&[u8],s=>s.original.as_ref(),"Read the exact original root definition bytes, shared by all scopes.");
+    read!(CompiledMachine,timeout_seconds,Option<NonZeroU32>,s=>s.timeout,"Read the optional positive machine timeout.");
+    /// Read a validated instruction through a checked machine-local ID.
+    ///
+    /// # Errors
+    /// Returns `InvalidStateId` for an ID outside this machine's index.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{AslCompiler,StateView};
+    /// let c=AslCompiler::default().compile(br#"{"StartAt":"D","States":{"D":{"Type":"Succeed"}}}"#)?;
+    /// assert!(matches!(c.machine().state(c.machine().start())?,StateView::Succeed {..}));
+    /// # Ok::<(),Box<dyn std::error::Error>>(())
+    /// ```
+    pub fn state(&self, id: StateId) -> Result<StateView<'_>, AslError> {
+        self.rows
+            .get(id.0)
+            .map(|row| row.node.view())
+            .ok_or(AslError::InvalidStateId)
+    }
+    /// Read the state name associated with a checked ID.
+    ///
+    /// # Errors
+    /// Returns `InvalidStateId` when the ID is outside this machine.
+    ///
+    /// ```
+    /// # fn name(machine:&rustack_stepfunctions_core::CompiledMachine,id:rustack_stepfunctions_core::StateId) {
+    /// let name=machine.state_name(id);
+    /// # }
+    /// ```
+    pub fn state_name(&self, id: StateId) -> Result<&str, AslError> {
+        self.rows
+            .get(id.0)
+            .map(|row| row.name.as_str())
+            .ok_or(AslError::InvalidStateId)
+    }
+}
+
+/// Successful immutable machine plus nonfatal structural diagnostics.
+#[non_exhaustive]
+pub struct Compilation {
+    pub(super) machine: Arc<CompiledMachine>,
+    pub(super) warnings: Vec<Diagnostic>,
+}
+impl fmt::Debug for Compilation {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Compilation(<redacted>)")
+    }
+}
+impl Compilation {
+    read!(Compilation,machine,&Arc<CompiledMachine>,s=>&s.machine,"Borrow the immutable artifact for revision capture.");
+    read!(Compilation,warnings,&[Diagnostic],s=>s.warnings.as_slice(),"Read bounded unreachable-state warnings.");
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/mod.rs b/crates/rustack-stepfunctions-core/src/compiler/mod.rs
new file mode 100644
index 00000000..59a27614
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/mod.rs
@@ -0,0 +1,287 @@
+//! Side-effect-free bounded machine compilation and immutable execution IR.
+
+use std::{
+    collections::{BTreeMap, VecDeque},
+    fmt,
+    num::NonZeroU32,
+};
+
+use bytes::Bytes;
+use rustack_core::json::{JsonLimits, from_slice};
+use serde_json::{Map, Value};
+
+macro_rules! read {
+    ($owner:ident,$name:ident,$out:ty,$s:ident=>$body:expr,$doc:literal) => {
+        #[doc=$doc]
+        #[doc=concat!("\n```\n# fn inspect(value: &rustack_stepfunctions_core::",stringify!($owner),") {\nlet _ = value.",stringify!($name),"();\n# }\n```")]
+        #[must_use]
+        pub fn $name(&self)->$out { let $s=self; $body }
+    };
+}
+
+mod diagnostic;
+mod ir;
+mod recovery;
+mod scope;
+mod state;
+mod structured;
+mod task;
+
+use diagnostic::{Code, Location};
+pub use diagnostic::{CompileError, Diagnostic, DiagnosticSeverity};
+pub use ir::{
+    CatchResult, Compilation, CompiledMachine, FailureView, MapConcurrency, StateId, StateView,
+    TaskTimeout, Transition,
+};
+use ir::{Failure, Node, Row};
+pub use recovery::{Catcher, Jitter, RecoveryPolicy, Retrier, RetryTiming};
+pub use task::{ChildPattern, FunctionArn, Integration, TaskSupport, TenantScope};
+
+pub(crate) const TASK_SECONDS_LIMIT: u32 = 99_999_999;
+
+/// Trusted state-instruction profile selected by an execution composition root.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum StateSupport {
+    /// The six sequential instruction forms used by the default library profile.
+    #[default]
+    Sequential,
+    /// Also compile Parallel and Inline Map for a structured frame owner.
+    Structured,
+}
+
+/// Synchronous bounded compiler; async owners provide bounded CPU admission.
+#[derive(Clone, Default)]
+#[non_exhaustive]
+pub struct AslCompiler {
+    scope: TenantScope,
+    tasks: TaskSupport,
+    states: StateSupport,
+    children: bool,
+    callbacks: bool,
+}
+
+impl fmt::Debug for AslCompiler {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("AslCompiler(<redacted>)")
+    }
+}
+
+impl AslCompiler {
+    /// Configure trusted scope and support derived from the installed adapter.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{AslCompiler,TenantScope,TaskSupport};
+    /// let compiler=AslCompiler::new(TenantScope::default(),TaskSupport::Disabled);
+    /// ```
+    #[must_use]
+    pub fn new(scope: TenantScope, tasks: TaskSupport) -> Self {
+        Self {
+            scope,
+            tasks,
+            states: StateSupport::Sequential,
+            children: false,
+            callbacks: false,
+        }
+    }
+
+    /// Select trusted IR support independently of installed Task adapters.
+    ///
+    /// Structured compilation does not enable sequential runtime admission.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{AslCompiler, StateSupport};
+    /// let compiler = AslCompiler::default().with_state_support(StateSupport::Structured);
+    /// ```
+    #[must_use]
+    pub fn with_state_support(mut self, states: StateSupport) -> Self {
+        self.states = states;
+        self
+    }
+
+    /// Enable child Tasks only when a real registry binding is installed.
+    ///
+    /// ```
+    /// let compiler = rustack_stepfunctions_core::AslCompiler::default().with_child_support(true);
+    /// ```
+    #[must_use]
+    pub fn with_child_support(mut self, enabled: bool) -> Self {
+        self.children = enabled;
+        self
+    }
+
+    /// Select callback IR only when the caller implements deferred token effects.
+    ///
+    /// This does not enable runtime, registry or service admission.
+    ///
+    /// ```
+    /// let compiler=rustack_stepfunctions_core::AslCompiler::default().with_callback_support(true);
+    /// ```
+    #[must_use]
+    pub fn with_callback_support(mut self, enabled: bool) -> Self {
+        self.callbacks = enabled;
+        self
+    }
+
+    /// Compile all fields/targets before publishing an immutable artifact.
+    ///
+    /// # Errors
+    /// Returns one bounded diagnostic with optional redacted typed JSON/ASL source.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::AslCompiler;
+    /// let result=AslCompiler::default().compile(br#"{"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}}"#)?;
+    /// assert_eq!(result.machine().state_count(),1);
+    /// # Ok::<(), rustack_stepfunctions_core::CompileError>(())
+    /// ```
+    pub fn compile(&self, input: &[u8]) -> Result<Compilation, CompileError> {
+        let root = Location::root();
+        let limits = JsonLimits::new(1024 * 1024, 64, 65_536, 1024 * 1024, 262_144)
+            .map_err(|error| CompileError::json(&root, error))?;
+        let value: Value =
+            from_slice(input, limits).map_err(|error| CompileError::json(&root, error))?;
+        let mut context = scope::Context::new(self, Bytes::copy_from_slice(input));
+        let machine = context.compile(&value, &root, scope::Kind::Root, 0)?;
+        Ok(Compilation {
+            machine,
+            warnings: context.warnings,
+        })
+    }
+}
+
+fn graph(
+    rows: &[Row],
+    start: StateId,
+    location: &Location,
+) -> Result<Vec<Diagnostic>, CompileError> {
+    let mut seen = vec![false; rows.len()];
+    let mut queue = VecDeque::new();
+    *seen
+        .get_mut(start.0)
+        .ok_or_else(|| location.error(Code::InvalidSchema, "invalid compiled start"))? = true;
+    queue.push_back(start);
+    let mut terminal = false;
+    while let Some(id) = queue.pop_front() {
+        let row = rows
+            .get(id.0)
+            .ok_or_else(|| location.error(Code::InvalidSchema, "invalid compiled target"))?;
+        terminal |= row.node.terminal();
+        for next in row.node.edges() {
+            let mark = seen
+                .get_mut(next.0)
+                .ok_or_else(|| location.error(Code::InvalidSchema, "invalid compiled target"))?;
+            if !*mark {
+                *mark = true;
+                queue.push_back(next);
+            }
+        }
+    }
+    if !terminal {
+        return Err(location.error(
+            Code::NoReachableTerminal,
+            "no terminal state is reachable from the start",
+        ));
+    }
+    rows.iter()
+        .zip(seen)
+        .filter(|(_, seen)| !*seen)
+        .map(|(row, _)| {
+            Ok(location.field(&row.name)?.warning(
+                Code::UnreachableState,
+                "state is unreachable from the start",
+            ))
+        })
+        .collect()
+}
+
+fn object<'a>(
+    value: &'a Value,
+    location: &Location,
+) -> Result<&'a Map<String, Value>, CompileError> {
+    object_value(value, location)
+}
+fn object_value<'a>(
+    value: &'a Value,
+    location: &Location,
+) -> Result<&'a Map<String, Value>, CompileError> {
+    value
+        .as_object()
+        .ok_or_else(|| location.error(Code::InvalidSchema, "expected an object"))
+}
+fn required<'a>(
+    object: &'a Map<String, Value>,
+    key: &str,
+    location: &Location,
+) -> Result<&'a Value, CompileError> {
+    match object.get(key) {
+        Some(value) => Ok(value),
+        None => Err(location
+            .field(key)?
+            .error(Code::MissingField, "required field is absent")),
+    }
+}
+fn text<'a>(value: &'a Value, location: &Location) -> Result<&'a str, CompileError> {
+    value
+        .as_str()
+        .ok_or_else(|| location.error(Code::InvalidSchema, "expected a string"))
+}
+fn fields(
+    object: &Map<String, Value>,
+    allowed: &[&str],
+    location: &Location,
+) -> Result<(), CompileError> {
+    for key in object.keys() {
+        if !allowed.contains(&key.as_str()) {
+            return Err(location.field(key)?.error(
+                Code::UnsupportedField,
+                "field is unavailable in the selected profile",
+            ));
+        }
+    }
+    Ok(())
+}
+fn metadata(object: &Map<String, Value>, location: &Location) -> Result<(), CompileError> {
+    if let Some(comment) = object.get("Comment") {
+        text(comment, &location.field("Comment")?)?;
+    }
+    if let Some(language) = object.get("QueryLanguage") {
+        if language.as_str() != Some("JSONPath") {
+            return Err(location
+                .field("QueryLanguage")?
+                .error(Code::ProfileUnavailable, "query language is unavailable"));
+        }
+    }
+    Ok(())
+}
+fn state_name(value: &str, location: &Location) -> Result<(), CompileError> {
+    if value.is_empty() || value.len() > 128 || value.chars().any(char::is_control) {
+        Err(location.error(Code::InvalidStateName, "invalid state name"))
+    } else {
+        Ok(())
+    }
+}
+fn target(
+    value: &Value,
+    location: &Location,
+    index: &BTreeMap<String, StateId>,
+) -> Result<StateId, CompileError> {
+    let name = text(value, location)?;
+    state_name(name, location)?;
+    index.get(name).copied().ok_or_else(|| {
+        location.error(
+            Code::MissingTransitionTarget,
+            "transition target does not exist in this scope",
+        )
+    })
+}
+fn positive(value: &Value, max: u64, location: &Location) -> Result<NonZeroU32, CompileError> {
+    value
+        .as_u64()
+        .filter(|n| *n <= max)
+        .and_then(|n| u32::try_from(n).ok())
+        .and_then(NonZeroU32::new)
+        .ok_or_else(|| location.error(Code::InvalidSchema, "expected a supported positive integer"))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/compiler/recovery.rs b/crates/rustack-stepfunctions-core/src/compiler/recovery.rs
new file mode 100644
index 00000000..9473330c
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/recovery.rs
@@ -0,0 +1,299 @@
+//! Ordered immutable retry/catch metadata and bounded error-name matching.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fmt,
+    num::NonZeroU32,
+};
+
+use serde_json::{Map, Value};
+
+use super::{
+    CatchResult, Code, CompileError, Location, StateId, fields, object_value, positive, required,
+    target, text,
+};
+use crate::ResultPath;
+
+/// Retry jitter policy; sampling belongs to the execution actor.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Jitter {
+    /// Use the computed backoff delay.
+    None,
+    /// Uniformly sample zero through the computed cap.
+    Full,
+}
+
+/// Validated retry timing metadata; no timer or randomness is created here.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct RetryTiming {
+    interval: NonZeroU32,
+    rate: f64,
+    max_delay: Option<NonZeroU32>,
+    jitter: Jitter,
+}
+impl RetryTiming {
+    read!(RetryTiming,interval_seconds,NonZeroU32,s=>s.interval,"Read positive initial delay seconds.");
+    read!(RetryTiming,backoff_rate,f64,s=>s.rate,"Read the finite rate, at least one.");
+    read!(RetryTiming,max_delay_seconds,Option<NonZeroU32>,s=>s.max_delay,"Read the optional positive delay cap.");
+    read!(RetryTiming,jitter,Jitter,s=>s.jitter,"Read the selected jitter strategy.");
+}
+
+struct Matcher(Vec<String>);
+impl Matcher {
+    fn matches(&self, error: &str) -> bool {
+        if error.len() > 256 || error == "States.Runtime" {
+            return false;
+        }
+        self.0.iter().any(|name| {
+            if name == error {
+                return true;
+            }
+            if error == "States.DataLimitExceeded" {
+                return false;
+            }
+            name == "States.ALL" || (name == "States.TaskFailed" && error != "States.Timeout")
+        })
+    }
+}
+
+/// Compiled retrier, preserving order and zero maximum attempts.
+#[non_exhaustive]
+pub struct Retrier {
+    matcher: Matcher,
+    attempts: u32,
+    timing: RetryTiming,
+}
+impl fmt::Debug for Retrier {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Retrier(<redacted>)")
+    }
+}
+impl Retrier {
+    read!(Retrier,error_names,&[String],s=>s.matcher.0.as_slice(),"Read validated matcher names.");
+    read!(Retrier,max_attempts,u32,s=>s.attempts,"Read retries allowed after the first failure.");
+    read!(Retrier,timing,&RetryTiming,s=>&s.timing,"Read validated timing metadata.");
+    /// Test a bounded failure name using the selected fatal/wildcard policy.
+    ///
+    /// ```
+    /// # fn matches(retrier:&rustack_stepfunctions_core::Retrier) {
+    /// let accepted=retrier.matches("ExampleError");
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn matches(&self, error: &str) -> bool {
+        self.matcher.matches(error)
+    }
+}
+
+enum Merge {
+    Replace,
+    Discard,
+    Path(ResultPath),
+}
+/// Compiled catcher with a resolved same-scope target.
+#[non_exhaustive]
+pub struct Catcher {
+    matcher: Matcher,
+    next: StateId,
+    result: Merge,
+}
+impl fmt::Debug for Catcher {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Catcher(<redacted>)")
+    }
+}
+impl Catcher {
+    read!(Catcher,error_names,&[String],s=>s.matcher.0.as_slice(),"Read validated matcher names.");
+    read!(Catcher,next,StateId,s=>s.next,"Read the resolved continuation.");
+    read!(Catcher,result_path,CatchResult<'_>,s=>match &s.result {Merge::Replace=>CatchResult::Replace,Merge::Discard=>CatchResult::Discard,Merge::Path(p)=>CatchResult::Path(p)},"Read validated error-object merge behavior.");
+    /// Test a failure name without claiming execution cancellation handling.
+    ///
+    /// ```
+    /// # fn matches(catcher:&rustack_stepfunctions_core::Catcher) {
+    /// let accepted=catcher.matches("ExampleError");
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn matches(&self, error: &str) -> bool {
+        self.matcher.matches(error)
+    }
+}
+
+/// Ordered, validated task recovery policies.
+#[non_exhaustive]
+pub struct RecoveryPolicy {
+    retries: Vec<Retrier>,
+    catches: Vec<Catcher>,
+}
+impl fmt::Debug for RecoveryPolicy {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RecoveryPolicy(<redacted>)")
+    }
+}
+impl RecoveryPolicy {
+    read!(RecoveryPolicy,retries,&[Retrier],s=>s.retries.as_slice(),"Read retriers in definition order.");
+    read!(RecoveryPolicy,catches,&[Catcher],s=>s.catches.as_slice(),"Read catchers in definition order.");
+    pub(super) fn units(&self) -> usize {
+        self.retries
+            .iter()
+            .fold(0_usize, |n, r| {
+                n.saturating_add(r.matcher.0.len()).saturating_add(1)
+            })
+            .saturating_add(self.catches.iter().fold(0_usize, |n, c| {
+                n.saturating_add(c.matcher.0.len()).saturating_add(1)
+            }))
+    }
+}
+
+pub(super) fn compile(
+    state: &Map<String, Value>,
+    location: &Location,
+    index: &BTreeMap<String, StateId>,
+) -> Result<RecoveryPolicy, CompileError> {
+    let retries = entries(state.get("Retry"), &location.field("Retry")?)?
+        .iter()
+        .enumerate()
+        .map(|(i, value)| {
+            let pos = location.field("Retry")?.field(&i.to_string())?;
+            let object = object_value(value, &pos)?;
+            fields(
+                object,
+                &[
+                    "ErrorEquals",
+                    "IntervalSeconds",
+                    "MaxAttempts",
+                    "BackoffRate",
+                    "MaxDelaySeconds",
+                    "JitterStrategy",
+                ],
+                &pos,
+            )?;
+            let matcher = matcher(object, &pos)?;
+            let interval = match object.get("IntervalSeconds") {
+                Some(v) => positive(v, 99_999_999, &pos.field("IntervalSeconds")?)?,
+                None => NonZeroU32::MIN,
+            };
+            let attempts_pos = pos.field("MaxAttempts")?;
+            let attempts = match object.get("MaxAttempts") {
+                Some(v) => v
+                    .as_u64()
+                    .filter(|n| *n <= 99_999_999)
+                    .and_then(|n| u32::try_from(n).ok())
+                    .ok_or_else(|| {
+                        attempts_pos.error(Code::InvalidSchema, "invalid retry count")
+                    })?,
+                None => 3,
+            };
+            let rate = match object.get("BackoffRate") {
+                Some(v) => v
+                    .as_f64()
+                    .filter(|n| n.is_finite() && *n >= 1.0)
+                    .ok_or_else(|| pos.error(Code::InvalidSchema, "invalid retry backoff"))?,
+                None => 2.0,
+            };
+            let max_delay = object
+                .get("MaxDelaySeconds")
+                .map(|v| positive(v, 31_622_400, &pos.field("MaxDelaySeconds")?))
+                .transpose()?;
+            let jitter = match object.get("JitterStrategy").map(Value::as_str) {
+                None | Some(Some("NONE")) => Jitter::None,
+                Some(Some("FULL")) => Jitter::Full,
+                _ => return Err(pos.error(Code::InvalidSchema, "invalid retry jitter")),
+            };
+            Ok(Retrier {
+                matcher,
+                attempts,
+                timing: RetryTiming {
+                    interval,
+                    rate,
+                    max_delay,
+                    jitter,
+                },
+            })
+        })
+        .collect::<Result<Vec<_>, CompileError>>()?;
+    let catches = entries(state.get("Catch"), &location.field("Catch")?)?
+        .iter()
+        .enumerate()
+        .map(|(i, value)| {
+            let pos = location.field("Catch")?.field(&i.to_string())?;
+            let object = object_value(value, &pos)?;
+            fields(object, &["ErrorEquals", "Next", "ResultPath"], &pos)?;
+            let matcher = matcher(object, &pos)?;
+            let next = target(required(object, "Next", &pos)?, &pos.field("Next")?, index)?;
+            let result = match object.get("ResultPath") {
+                None => Merge::Replace,
+                Some(Value::Null) => Merge::Discard,
+                Some(Value::String(p)) => {
+                    Merge::Path(p.parse().map_err(|e| CompileError::asl(&pos, e))?)
+                }
+                _ => return Err(pos.error(Code::InvalidSchema, "invalid catch result path")),
+            };
+            Ok(Catcher {
+                matcher,
+                next,
+                result,
+            })
+        })
+        .collect::<Result<Vec<_>, CompileError>>()?;
+    last_all(
+        retries.iter().map(|r| &r.matcher),
+        retries.len(),
+        &location.field("Retry")?,
+    )?;
+    last_all(
+        catches.iter().map(|c| &c.matcher),
+        catches.len(),
+        &location.field("Catch")?,
+    )?;
+    Ok(RecoveryPolicy { retries, catches })
+}
+
+fn entries<'a>(value: Option<&'a Value>, location: &Location) -> Result<&'a [Value], CompileError> {
+    match value {
+        None => Ok(&[]),
+        Some(value) => value
+            .as_array()
+            .filter(|v| v.len() <= 128)
+            .map(Vec::as_slice)
+            .ok_or_else(|| location.error(Code::InvalidSchema, "invalid recovery policy array")),
+    }
+}
+fn matcher(object: &Map<String, Value>, location: &Location) -> Result<Matcher, CompileError> {
+    let pos = location.field("ErrorEquals")?;
+    let names = required(object, "ErrorEquals", location)?
+        .as_array()
+        .filter(|v| !v.is_empty() && v.len() <= 128)
+        .ok_or_else(|| pos.error(Code::InvalidSchema, "invalid error matcher"))?;
+    let mut unique = BTreeSet::new();
+    let mut result = Vec::with_capacity(names.len());
+    for value in names {
+        let name = text(value, &pos)?;
+        if name.is_empty()
+            || name.len() > 256
+            || name.chars().any(char::is_control)
+            || !unique.insert(name)
+        {
+            return Err(pos.error(Code::InvalidSchema, "invalid or duplicate error name"));
+        }
+        result.push(name.to_owned());
+    }
+    if result.iter().any(|n| n == "States.ALL") && result.len() != 1 {
+        return Err(pos.error(Code::InvalidSchema, "States.ALL must be the sole matcher"));
+    }
+    Ok(Matcher(result))
+}
+fn last_all<'a>(
+    entries: impl Iterator<Item = &'a Matcher>,
+    count: usize,
+    location: &Location,
+) -> Result<(), CompileError> {
+    for (position, matcher) in entries.enumerate() {
+        if matcher.0.iter().any(|n| n == "States.ALL") && position.saturating_add(1) != count {
+            return Err(location.error(Code::InvalidSchema, "States.ALL policy must be last"));
+        }
+    }
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/scope.rs b/crates/rustack-stepfunctions-core/src/compiler/scope.rs
new file mode 100644
index 00000000..36ec7d49
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/scope.rs
@@ -0,0 +1,132 @@
+//! Lexical graph compilation under one source allocation and aggregate budget.
+
+use std::{collections::BTreeMap, sync::Arc};
+
+use bytes::Bytes;
+use serde_json::Value;
+
+use super::{
+    AslCompiler, Code, CompileError, CompiledMachine, Diagnostic, Location, Row, StateId, fields,
+    graph, metadata, object, positive, required, state, state_name, text,
+};
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(super) enum Kind {
+    Root,
+    Branch,
+    Processor,
+}
+
+pub(super) struct Context<'a> {
+    pub(super) compiler: &'a AslCompiler,
+    original: Bytes,
+    states: usize,
+    units: usize,
+    pub(super) warnings: Vec<Diagnostic>,
+}
+impl<'a> Context<'a> {
+    pub(super) fn new(compiler: &'a AslCompiler, original: Bytes) -> Self {
+        Self {
+            compiler,
+            original,
+            states: 1000,
+            units: 65_536,
+            warnings: Vec::new(),
+        }
+    }
+
+    pub(super) fn compile(
+        &mut self,
+        value: &Value,
+        location: &Location,
+        kind: Kind,
+        depth: usize,
+    ) -> Result<Arc<CompiledMachine>, CompileError> {
+        if depth > 16 {
+            return Err(location.error(Code::LimitExceeded, "nested machine depth exceeded"));
+        }
+        let object = object(value, location)?;
+        let mut allowed = vec!["StartAt", "States", "Comment", "QueryLanguage"];
+        match kind {
+            Kind::Root => allowed.extend(["Version", "TimeoutSeconds"]),
+            Kind::Processor => allowed.push("ProcessorConfig"),
+            Kind::Branch => {}
+        }
+        fields(object, &allowed, location)?;
+        metadata(object, location)?;
+        if let Some(version) = object.get("Version") {
+            if version.as_str() != Some("1.0") {
+                return Err(location
+                    .field("Version")?
+                    .error(Code::InvalidSchema, "unsupported ASL version"));
+            }
+        }
+        if let Some(config) = object.get("ProcessorConfig") {
+            let pos = location.field("ProcessorConfig")?;
+            let config = super::object_value(config, &pos)?;
+            fields(config, &["Mode"], &pos)?;
+            if config
+                .get("Mode")
+                .is_some_and(|mode| mode.as_str() != Some("INLINE"))
+            {
+                return Err(pos
+                    .field("Mode")?
+                    .error(Code::ProfileUnavailable, "only Inline Map is supported"));
+            }
+        }
+        let timeout = object
+            .get("TimeoutSeconds")
+            .map(|v| positive(v, 31_536_000, &location.field("TimeoutSeconds")?))
+            .transpose()?;
+        let start_loc = location.field("StartAt")?;
+        let start = text(required(object, "StartAt", location)?, &start_loc)?;
+        state_name(start, &start_loc)?;
+        let states_loc = location.field("States")?;
+        let states = super::object_value(required(object, "States", location)?, &states_loc)?;
+        if states.is_empty() {
+            return Err(states_loc.error(Code::LimitExceeded, "state scope must not be empty"));
+        }
+        self.states = self.states.checked_sub(states.len()).ok_or_else(|| {
+            states_loc.error(
+                Code::LimitExceeded,
+                "aggregate state count exceeds one thousand",
+            )
+        })?;
+        let mut index = BTreeMap::new();
+        for name in states.keys() {
+            state_name(name, &states_loc)?;
+            index.insert(name.clone(), StateId(0));
+        }
+        for (position, id) in index.values_mut().enumerate() {
+            *id = StateId(position);
+        }
+        let start = *index.get(start).ok_or_else(|| {
+            start_loc.error(Code::MissingTransitionTarget, "start target does not exist")
+        })?;
+        let mut rows = Vec::with_capacity(states.len());
+        for name in index.keys() {
+            let pos = states_loc.field(name)?;
+            let value = states
+                .get(name)
+                .ok_or_else(|| pos.error(Code::InvalidSchema, "state definition missing"))?;
+            let node = state::compile(value, &pos, &index, self, depth)?;
+            self.units = self
+                .units
+                .checked_sub(node.units())
+                .ok_or_else(|| pos.error(Code::LimitExceeded, "compiled node budget exceeded"))?;
+            rows.push(Row {
+                name: name.clone(),
+                node,
+            });
+        }
+        self.warnings.extend(graph(&rows, start, &states_loc)?);
+        Ok(Arc::new(CompiledMachine {
+            original: self.original.clone(),
+            definition_root: kind == Kind::Root,
+            scope: self.compiler.scope.clone(),
+            rows,
+            start,
+            timeout,
+        }))
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/state.rs b/crates/rustack-stepfunctions-core/src/compiler/state.rs
new file mode 100644
index 00000000..e41bba97
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/state.rs
@@ -0,0 +1,377 @@
+//! Strict scoped state fields compiled once into immutable instructions.
+
+use std::{collections::BTreeMap, sync::Arc};
+
+use serde_json::{Map, Value};
+
+use super::{
+    Code, CompileError, Failure, Location, Node, StateId, StateSupport, TASK_SECONDS_LIMIT,
+    TaskTimeout, Transition, fields, metadata, object_value, positive, recovery, required,
+    scope::Context, structured, target, task, text,
+};
+use crate::{DataFlow, Expression, Predicate, ReferencePath, WaitSource};
+
+const COMMON: &[&str] = &[
+    "Type",
+    "Comment",
+    "QueryLanguage",
+    "InputPath",
+    "OutputPath",
+];
+const FLOW: &[&str] = &[
+    "InputPath",
+    "OutputPath",
+    "Parameters",
+    "ResultSelector",
+    "ResultPath",
+];
+
+pub(super) fn compile(
+    value: &Value,
+    location: &Location,
+    index: &BTreeMap<String, StateId>,
+    context: &mut Context<'_>,
+    depth: usize,
+) -> Result<Node, CompileError> {
+    let object = object_value(value, location)?;
+    let kind = text(
+        required(object, "Type", location)?,
+        &location.field("Type")?,
+    )?;
+    validate_fields(kind, object, location, context.compiler.states)?;
+    match kind {
+        "Pass" => {
+            if object.contains_key("Result") && object.contains_key("Parameters") {
+                return Err(location.error(
+                    Code::InvalidSchema,
+                    "Pass Result and Parameters are mutually exclusive",
+                ));
+            }
+            Ok(Node::Pass {
+                flow: flow(object, location)?,
+                result: object.get("Result").map(|v| Arc::new(v.clone())),
+                next: transition(object, location, index)?,
+            })
+        }
+        "Task" => task_state(object, location, index, context),
+        "Parallel" | "Map" => structured::compile(kind, object, location, index, context, depth),
+        "Choice" => choice(object, location, index),
+        "Wait" => {
+            let source = Value::Object(
+                object
+                    .iter()
+                    .filter(|(key, _)| {
+                        matches!(
+                            key.as_str(),
+                            "Seconds" | "SecondsPath" | "Timestamp" | "TimestampPath"
+                        )
+                    })
+                    .map(|(key, value)| (key.clone(), value.clone()))
+                    .collect(),
+            );
+            Ok(Node::Wait {
+                flow: flow(object, location)?,
+                source: WaitSource::compile(&source).map_err(|e| CompileError::asl(location, e))?,
+                next: transition(object, location, index)?,
+            })
+        }
+        "Succeed" => Ok(Node::Succeed(flow(object, location)?)),
+        "Fail" => Ok(Node::Fail {
+            error: failure(object, "Error", "ErrorPath", 256, location)?,
+            cause: failure(object, "Cause", "CausePath", 32_768, location)?,
+        }),
+        _ => Err(location.error(Code::InvalidSchema, "invalid state type")),
+    }
+}
+
+fn choice(
+    object: &Map<String, Value>,
+    location: &Location,
+    index: &BTreeMap<String, StateId>,
+) -> Result<Node, CompileError> {
+    let pos = location.field("Choices")?;
+    let choices = required(object, "Choices", location)?
+        .as_array()
+        .filter(|v| !v.is_empty() && v.len() <= 128)
+        .ok_or_else(|| pos.error(Code::InvalidSchema, "invalid Choice rule array"))?;
+    let mut branches = Vec::with_capacity(choices.len());
+    for (i, choice) in choices.iter().enumerate() {
+        let pos = pos.field(&i.to_string())?;
+        let rule = object_value(choice, &pos)?;
+        let next = target(required(rule, "Next", &pos)?, &pos.field("Next")?, index)?;
+        let predicate = Value::Object(
+            rule.iter()
+                .filter(|(key, _)| key.as_str() != "Next")
+                .map(|(key, value)| (key.clone(), value.clone()))
+                .collect(),
+        );
+        branches.push((
+            Predicate::compile(&predicate).map_err(|e| CompileError::asl(&pos, e))?,
+            next,
+        ));
+    }
+    let default = object
+        .get("Default")
+        .map(|v| target(v, &location.field("Default")?, index))
+        .transpose()?;
+    Ok(Node::Choice {
+        flow: flow(object, location)?,
+        branches,
+        default,
+    })
+}
+
+fn validate_fields(
+    kind: &str,
+    object: &Map<String, Value>,
+    location: &Location,
+    states: StateSupport,
+) -> Result<(), CompileError> {
+    if matches!(kind, "Parallel" | "Map") && states == StateSupport::Sequential {
+        return Err(location.field("Type")?.error(
+            Code::ProfileUnavailable,
+            "state type requires structured execution support",
+        ));
+    }
+    let extra: &[&str] = match kind {
+        "Pass" => &["Result", "Parameters", "ResultPath", "Next", "End"],
+        "Task" => &[
+            "Resource",
+            "Parameters",
+            "ResultSelector",
+            "ResultPath",
+            "Retry",
+            "Catch",
+            "TimeoutSeconds",
+            "TimeoutSecondsPath",
+            "HeartbeatSeconds",
+            "HeartbeatSecondsPath",
+            "Next",
+            "End",
+        ],
+        "Choice" => &["Choices", "Default"],
+        "Wait" => &[
+            "Seconds",
+            "SecondsPath",
+            "Timestamp",
+            "TimestampPath",
+            "Next",
+            "End",
+        ],
+        "Succeed" => &[],
+        "Fail" => &["Error", "Cause", "ErrorPath", "CausePath"],
+        "Parallel" => &[
+            "Branches",
+            "Parameters",
+            "ResultSelector",
+            "ResultPath",
+            "Retry",
+            "Catch",
+            "Next",
+            "End",
+        ],
+        "Map" => &[
+            "ItemsPath",
+            "ItemSelector",
+            "Parameters",
+            "ItemProcessor",
+            "Iterator",
+            "MaxConcurrency",
+            "MaxConcurrencyPath",
+            "ResultSelector",
+            "ResultPath",
+            "Retry",
+            "Catch",
+            "Next",
+            "End",
+        ],
+        _ => {
+            return Err(location
+                .field("Type")?
+                .error(Code::InvalidSchema, "invalid state type"));
+        }
+    };
+    let mut allowed = if kind == "Fail" {
+        vec!["Type", "Comment", "QueryLanguage"]
+    } else {
+        COMMON.to_vec()
+    };
+    allowed.extend(extra);
+    fields(object, &allowed, location)?;
+    metadata(object, location)?;
+    Ok(())
+}
+
+pub(super) fn flow(
+    object: &Map<String, Value>,
+    location: &Location,
+) -> Result<DataFlow, CompileError> {
+    compile_flow(object, location, true)
+}
+
+pub(super) fn map_flow(
+    object: &Map<String, Value>,
+    location: &Location,
+) -> Result<DataFlow, CompileError> {
+    compile_flow(object, location, false)
+}
+
+fn compile_flow(
+    object: &Map<String, Value>,
+    location: &Location,
+    parameters: bool,
+) -> Result<DataFlow, CompileError> {
+    let value = Value::Object(
+        object
+            .iter()
+            .filter(|(key, _)| {
+                FLOW.contains(&key.as_str()) && (parameters || key.as_str() != "Parameters")
+            })
+            .map(|(key, value)| (key.clone(), value.clone()))
+            .collect(),
+    );
+    match DataFlow::compile_located(&value) {
+        Ok(flow) => Ok(flow),
+        Err((field, error)) => {
+            if field.is_empty() {
+                Err(CompileError::asl(location, error))
+            } else {
+                Err(CompileError::asl(&location.field(field)?, error))
+            }
+        }
+    }
+}
+pub(super) fn transition(
+    object: &Map<String, Value>,
+    location: &Location,
+    index: &BTreeMap<String, StateId>,
+) -> Result<Transition, CompileError> {
+    match (object.get("Next"), object.get("End")) {
+        (Some(value), None) => target(value, &location.field("Next")?, index).map(Transition::Next),
+        (None, Some(Value::Bool(true))) => Ok(Transition::End),
+        _ => Err(location.error(
+            Code::InvalidSchema,
+            "exactly one Next or End=true is required",
+        )),
+    }
+}
+fn task_state(
+    object: &Map<String, Value>,
+    location: &Location,
+    index: &BTreeMap<String, StateId>,
+    context: &Context<'_>,
+) -> Result<Node, CompileError> {
+    let resource = text(
+        required(object, "Resource", location)?,
+        &location.field("Resource")?,
+    )?;
+    let callback = resource
+        == format!(
+            "arn:{}:states:::lambda:invoke.waitForTaskToken",
+            context.compiler.scope.partition()
+        );
+    let heartbeat = if callback {
+        interval(object, "HeartbeatSeconds", "HeartbeatSecondsPath", location)?
+    } else {
+        for key in ["HeartbeatSeconds", "HeartbeatSecondsPath"] {
+            if object.contains_key(key) {
+                return Err(location.field(key)?.error(
+                    Code::ProfileUnavailable,
+                    "heartbeat requires callback task support",
+                ));
+            }
+        }
+        TaskTimeout::Omitted
+    };
+    let timeout = timeout(object, location)?;
+    if matches!((&heartbeat, &timeout), (TaskTimeout::Seconds(h), TaskTimeout::Seconds(t)) if h >= t)
+        || matches!((&heartbeat, &timeout), (TaskTimeout::Seconds(h), TaskTimeout::Omitted) if h.get() >= TASK_SECONDS_LIMIT)
+    {
+        return Err(location.field("HeartbeatSeconds")?.error(
+            Code::InvalidSchema,
+            "heartbeat must be smaller than Task timeout",
+        ));
+    }
+    Ok(Node::Task {
+        flow: flow(object, location)?,
+        resource: task::compile(
+            resource,
+            object.get("Parameters"),
+            context.compiler,
+            heartbeat,
+            location,
+        )?,
+        timeout,
+        recovery: recovery::compile(object, location, index)?,
+        next: transition(object, location, index)?,
+    })
+}
+
+fn timeout(object: &Map<String, Value>, location: &Location) -> Result<TaskTimeout, CompileError> {
+    interval(object, "TimeoutSeconds", "TimeoutSecondsPath", location)
+}
+fn interval(
+    object: &Map<String, Value>,
+    literal: &str,
+    path: &str,
+    location: &Location,
+) -> Result<TaskTimeout, CompileError> {
+    let pos = location.field(literal)?;
+    match (object.get(literal), object.get(path)) {
+        (None, None) => Ok(TaskTimeout::Omitted),
+        (Some(value), None) => {
+            positive(value, u64::from(TASK_SECONDS_LIMIT), &pos).map(TaskTimeout::Seconds)
+        }
+        (None, Some(value)) => {
+            let pos = location.field(path)?;
+            text(value, &pos)?
+                .parse::<ReferencePath>()
+                .map(TaskTimeout::Path)
+                .map_err(|e| CompileError::asl(&pos, e))
+        }
+        _ => Err(pos.error(
+            Code::InvalidSchema,
+            "interval literal and path are mutually exclusive",
+        )),
+    }
+}
+
+fn failure(
+    object: &Map<String, Value>,
+    literal: &str,
+    path: &str,
+    max: usize,
+    location: &Location,
+) -> Result<Failure, CompileError> {
+    match (object.get(literal), object.get(path)) {
+        (None, None) => Ok(Failure::Omitted),
+        (Some(value), None) => {
+            let pos = location.field(literal)?;
+            let value = text(value, &pos)?;
+            if value.len() > max {
+                return Err(pos.error(
+                    Code::LimitExceeded,
+                    "failure literal exceeds its byte limit",
+                ));
+            }
+            Ok(Failure::Literal(value.into()))
+        }
+        (None, Some(value)) => {
+            let pos = location.field(path)?;
+            let value = text(value, &pos)?;
+            if value.starts_with('$') {
+                value
+                    .parse::<ReferencePath>()
+                    .map_err(|e| CompileError::asl(&pos, e))?;
+            }
+            value
+                .parse::<Expression>()
+                .map(Failure::Dynamic)
+                .map_err(|e| CompileError::asl(&pos, e))
+        }
+        _ => Err(location.field(literal)?.error(
+            Code::InvalidSchema,
+            "failure literal and path are mutually exclusive",
+        )),
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/structured.rs b/crates/rustack-stepfunctions-core/src/compiler/structured.rs
new file mode 100644
index 00000000..dad231f8
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/structured.rs
@@ -0,0 +1,132 @@
+//! Parallel branches and normalized Inline Map definitions, compiled once.
+
+use std::{collections::BTreeMap, num::NonZeroU8};
+
+use serde_json::{Map, Value};
+
+use super::{
+    Code, CompileError, Location, MapConcurrency, Node, StateId, recovery, required,
+    scope::{Context, Kind},
+    state, text,
+};
+use crate::{ReferencePath, Template};
+
+pub(super) fn compile(
+    kind: &str,
+    object: &Map<String, Value>,
+    location: &Location,
+    index: &BTreeMap<String, StateId>,
+    context: &mut Context<'_>,
+    depth: usize,
+) -> Result<Node, CompileError> {
+    let next = state::transition(object, location, index)?;
+    let recovery = recovery::compile(object, location, index)?;
+    if kind == "Parallel" {
+        let pos = location.field("Branches")?;
+        let branches = required(object, "Branches", location)?
+            .as_array()
+            .filter(|branches| !branches.is_empty() && branches.len() <= 1000)
+            .ok_or_else(|| pos.error(Code::InvalidSchema, "invalid Parallel branch array"))?;
+        let flow = state::flow(object, location)?;
+        let mut machines = Vec::with_capacity(branches.len());
+        for (i, branch) in branches.iter().enumerate() {
+            machines.push(context.compile(
+                branch,
+                &pos.field(&i.to_string())?,
+                Kind::Branch,
+                depth.saturating_add(1),
+            )?);
+        }
+        return Ok(Node::Parallel {
+            flow,
+            branches: machines,
+            recovery,
+            next,
+        });
+    }
+    let processor_pos = location.field("ItemProcessor")?;
+    let (key, value) = exclusive(object, "ItemProcessor", "Iterator", location)?
+        .ok_or_else(|| processor_pos.error(Code::MissingField, "Map requires a processor"))?;
+    let processor = context.compile(
+        value,
+        &location.field(key)?,
+        Kind::Processor,
+        depth.saturating_add(1),
+    )?;
+    let selector = exclusive(object, "ItemSelector", "Parameters", location)?
+        .map(|(key, value)| {
+            let pos = location.field(key)?;
+            Template::compile(value).map_err(|error| CompileError::asl(&pos, error))
+        })
+        .transpose()?;
+    let items = object.get("ItemsPath").map_or_else(
+        || {
+            "$".parse::<ReferencePath>()
+                .map_err(|e| CompileError::asl(location, e))
+        },
+        |value| reference(value, &location.field("ItemsPath")?),
+    )?;
+    let concurrency = concurrency(object, location)?;
+    let flow = state::map_flow(object, location)?;
+    Ok(Node::Map {
+        flow,
+        items,
+        selector,
+        processor,
+        concurrency,
+        recovery,
+        next,
+    })
+}
+
+fn exclusive<'a>(
+    object: &'a Map<String, Value>,
+    current: &'a str,
+    legacy: &'a str,
+    location: &Location,
+) -> Result<Option<(&'a str, &'a Value)>, CompileError> {
+    match (object.get(current), object.get(legacy)) {
+        (Some(_), Some(_)) => Err(location.field(current)?.error(
+            Code::InvalidSchema,
+            "current and legacy fields are mutually exclusive",
+        )),
+        (Some(value), None) => Ok(Some((current, value))),
+        (None, Some(value)) => Ok(Some((legacy, value))),
+        (None, None) => Ok(None),
+    }
+}
+
+fn concurrency(
+    object: &Map<String, Value>,
+    location: &Location,
+) -> Result<MapConcurrency, CompileError> {
+    let Some((key, value)) = exclusive(object, "MaxConcurrencyPath", "MaxConcurrency", location)?
+    else {
+        return static_concurrency(40, location);
+    };
+    let pos = location.field(key)?;
+    if key == "MaxConcurrencyPath" {
+        return reference(value, &pos).map(MapConcurrency::Path);
+    }
+    let number = value.as_u64().filter(|n| *n <= 40).ok_or_else(|| {
+        pos.error(
+            Code::InvalidSchema,
+            "Inline concurrency must be an integer from zero to forty",
+        )
+    })?;
+    let number = u8::try_from(number)
+        .map_err(|_| pos.error(Code::InvalidSchema, "invalid Inline concurrency"))?;
+    static_concurrency(if number == 0 { 40 } else { number }, &pos)
+}
+
+fn static_concurrency(value: u8, location: &Location) -> Result<MapConcurrency, CompileError> {
+    NonZeroU8::new(value)
+        .map(MapConcurrency::Limit)
+        .ok_or_else(|| location.error(Code::InvalidSchema, "invalid Inline concurrency"))
+}
+
+fn reference(value: &Value, location: &Location) -> Result<ReferencePath, CompileError> {
+    text(value, location)?
+        .parse()
+        .map_err(|error| CompileError::asl(location, error))
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/task.rs b/crates/rustack-stepfunctions-core/src/compiler/task.rs
new file mode 100644
index 00000000..13d22c53
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/task.rs
@@ -0,0 +1,382 @@
+//! Scoped static Lambda resource validation; no invocation or alias resolution.
+
+use std::fmt;
+
+use serde_json::{Map, Value};
+
+use super::{AslCompiler, Code, CompileError, Location, TaskTimeout};
+use crate::{AslError, ExecutionName, Payload, StateMachineArn};
+
+/// Adapter support supplied by trusted composition, never a request field.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum TaskSupport {
+    /// Compile pure workflows only.
+    #[default]
+    Disabled,
+    /// A real Lambda adapter is installed by the owner.
+    Lambda,
+}
+
+/// Validated partition/region/account used for static resource scope checks.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct TenantScope {
+    partition: String,
+    region: String,
+    account: String,
+}
+impl fmt::Debug for TenantScope {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("TenantScope(<redacted>)")
+    }
+}
+impl Default for TenantScope {
+    fn default() -> Self {
+        Self {
+            partition: "aws".into(),
+            region: "us-east-1".into(),
+            account: "000000000000".into(),
+        }
+    }
+}
+impl TenantScope {
+    /// Validate operator identity before storing or using it in resource checks.
+    ///
+    /// # Errors
+    /// Rejects unsupported partitions, malformed regions/accounts and byte limits.
+    ///
+    /// ```
+    /// let scope=rustack_stepfunctions_core::TenantScope::new("aws","us-east-1","000000000000")?;
+    /// # Ok::<(),rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn new(partition: &str, region: &str, account: &str) -> Result<Self, AslError> {
+        let region_valid = !region.is_empty()
+            && region.len() <= 64
+            && region
+                .bytes()
+                .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-')
+            && region
+                .as_bytes()
+                .first()
+                .is_some_and(u8::is_ascii_lowercase)
+            && region
+                .as_bytes()
+                .last()
+                .is_some_and(u8::is_ascii_alphanumeric);
+        if !matches!(partition, "aws" | "aws-cn" | "aws-us-gov")
+            || !region_valid
+            || account.len() != 12
+            || !account.bytes().all(|b| b.is_ascii_digit())
+        {
+            return Err(AslError::InvalidScope);
+        }
+        Ok(Self {
+            partition: partition.into(),
+            region: region.into(),
+            account: account.into(),
+        })
+    }
+    read!(TenantScope,partition,&str,s=>s.partition.as_str(),"Read the validated partition.");
+    read!(TenantScope,region,&str,s=>s.region.as_str(),"Read the validated region.");
+    read!(TenantScope,account,&str,s=>s.account.as_str(),"Read the validated account.");
+}
+
+/// Static same-scope function ARN; resolution remains per invocation attempt.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct FunctionArn {
+    value: String,
+    qualifier: Option<String>,
+}
+impl fmt::Debug for FunctionArn {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("FunctionArn(<redacted>)")
+    }
+}
+impl FunctionArn {
+    read!(FunctionArn,as_str,&str,s=>s.value.as_str(),"Read the validated function ARN.");
+    read!(FunctionArn,qualifier,Option<&str>,s=>s.qualifier.as_deref(),"Read an optional unresolved qualifier.");
+    fn parse(value: &str, scope: &TenantScope, location: &Location) -> Result<Self, CompileError> {
+        if value.len() > 256 {
+            return Err(invalid(location));
+        }
+        let mut parts = value.split(':');
+        if parts.next() != Some("arn")
+            || parts.next() != Some(scope.partition())
+            || parts.next() != Some("lambda")
+            || parts.next() != Some(scope.region())
+            || parts.next() != Some(scope.account())
+            || parts.next() != Some("function")
+        {
+            return Err(invalid(location));
+        }
+        let name = parts
+            .next()
+            .filter(|n| name(n))
+            .ok_or_else(|| invalid(location))?;
+        let qualifier = parts.next();
+        if parts.next().is_some()
+            || qualifier.is_some_and(|q| !valid_qualifier(q))
+            || name.is_empty()
+        {
+            return Err(invalid(location));
+        }
+        Ok(Self {
+            value: value.into(),
+            qualifier: qualifier.map(str::to_owned),
+        })
+    }
+}
+
+impl TryFrom<(&str, &TenantScope)> for FunctionArn {
+    type Error = CompileError;
+    /// Validate a static function ARN against the compiler's scope and grammar.
+    ///
+    /// # Errors
+    /// Rejects malformed, oversized or foreign function ARNs and qualifiers.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{FunctionArn, TenantScope};
+    /// let scope = TenantScope::default();
+    /// let arn = FunctionArn::try_from(("arn:aws:lambda:us-east-1:000000000000:function:worker", &scope))?;
+    /// # Ok::<(), rustack_stepfunctions_core::CompileError>(())
+    /// ```
+    fn try_from((value, scope): (&str, &TenantScope)) -> Result<Self, Self::Error> {
+        Self::parse(value, scope, &Location::root())
+    }
+}
+
+/// Optimized nested integration behavior selected by the trusted caller.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum ChildPattern {
+    /// Detach at successful start acceptance.
+    RequestResponse,
+    /// Await termination; return Input/Output as serialized JSON strings.
+    Sync,
+    /// Await termination; return Input/Output as JSON values.
+    Sync2,
+}
+impl ChildPattern {
+    pub(crate) fn owned(self) -> bool {
+        match self {
+            Self::RequestResponse => false,
+            Self::Sync | Self::Sync2 => true,
+        }
+    }
+}
+/// Fully allowlisted M1 Lambda task pattern.
+#[derive(Clone)]
+#[non_exhaustive]
+pub enum Integration {
+    /// Direct request-response function result.
+    DirectLambda(FunctionArn),
+    /// Optimized request-response result envelope.
+    LambdaInvoke,
+    /// Deferred optimized callback invocation with an optional heartbeat source.
+    LambdaCallback(TaskTimeout),
+    /// Start or await an execution through the installed registry.
+    StartExecution(ChildPattern),
+}
+impl fmt::Debug for Integration {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Integration(<redacted>)")
+    }
+}
+
+fn invalid(location: &Location) -> CompileError {
+    location.error(
+        Code::InvalidResource,
+        "invalid or unsupported scoped Lambda resource",
+    )
+}
+fn name(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 64
+        && value
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-'))
+}
+fn valid_qualifier(value: &str) -> bool {
+    value == "$LATEST"
+        || (!value.is_empty()
+            && value.len() <= 128
+            && value
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-')))
+}
+
+pub(super) fn compile(
+    value: &str,
+    parameters: Option<&Value>,
+    compiler: &AslCompiler,
+    heartbeat: TaskTimeout,
+    location: &Location,
+) -> Result<Integration, CompileError> {
+    let scope = &compiler.scope;
+    let prefix = format!("arn:{}:states:::", scope.partition());
+    let integration = if value == format!("{prefix}lambda:invoke") {
+        optimized(parameters, scope, &location.field("Parameters")?)?;
+        Integration::LambdaInvoke
+    } else if let Some(pattern) = [
+        ("states:startExecution", ChildPattern::RequestResponse),
+        ("states:startExecution.sync", ChildPattern::Sync),
+        ("states:startExecution.sync:2", ChildPattern::Sync2),
+    ]
+    .into_iter()
+    .find_map(|(suffix, pattern)| (value == format!("{prefix}{suffix}")).then_some(pattern))
+    {
+        if !compiler.children {
+            return Err(location.field("Resource")?.error(
+                Code::ProfileUnavailable,
+                "child execution adapter is unavailable",
+            ));
+        }
+        child_parameters(parameters, scope, &location.field("Parameters")?)?;
+        return Ok(Integration::StartExecution(pattern));
+    } else if value == format!("{prefix}lambda:invoke.waitForTaskToken") {
+        if !compiler.callbacks {
+            return Err(location.field("Resource")?.error(
+                Code::ProfileUnavailable,
+                "callback effect support is unavailable",
+            ));
+        }
+        optimized(parameters, scope, &location.field("Parameters")?)?;
+        Integration::LambdaCallback(heartbeat)
+    } else {
+        Integration::DirectLambda(FunctionArn::parse(
+            value,
+            scope,
+            &location.field("Resource")?,
+        )?)
+    };
+    if compiler.tasks == TaskSupport::Disabled {
+        return Err(location.field("Resource")?.error(
+            Code::DependencyDisabled,
+            "Lambda task adapter is unavailable",
+        ));
+    }
+    Ok(integration)
+}
+
+fn optimized(
+    parameters: Option<&Value>,
+    scope: &TenantScope,
+    location: &Location,
+) -> Result<(), CompileError> {
+    let Some(parameters) = parameters else {
+        return Ok(());
+    };
+    let fields = parameters.as_object().ok_or_else(|| {
+        location.error(
+            Code::InvalidSchema,
+            "optimized parameters must be an object",
+        )
+    })?;
+    for key in fields.keys() {
+        let key = key.strip_suffix(".$").unwrap_or(key);
+        if !matches!(
+            key,
+            "FunctionName" | "Payload" | "Qualifier" | "InvocationType"
+        ) {
+            return Err(location.error(
+                Code::UnsupportedField,
+                "unsupported optimized Lambda parameter",
+            ));
+        }
+    }
+    let embedded = if let Some(value) = fields.get("FunctionName") {
+        let value = value.as_str().ok_or_else(|| invalid(location))?;
+        if value.starts_with("arn:") {
+            FunctionArn::parse(value, scope, location)?.qualifier
+        } else {
+            if !name(value) {
+                return Err(invalid(location));
+            }
+            None
+        }
+    } else {
+        None
+    };
+    let qualifier = static_string(fields, "Qualifier", location)?;
+    if qualifier.is_some_and(|value| !valid_qualifier(value))
+        || embedded
+            .as_deref()
+            .zip(qualifier)
+            .is_some_and(|(a, b)| a != b)
+    {
+        return Err(invalid(location));
+    }
+    if static_string(fields, "InvocationType", location)?
+        .is_some_and(|value| value != "RequestResponse")
+    {
+        return Err(location.error(
+            Code::ProfileUnavailable,
+            "only request-response Lambda invocation is supported",
+        ));
+    }
+    Ok(())
+}
+fn static_string<'a>(
+    fields: &'a Map<String, Value>,
+    key: &str,
+    location: &Location,
+) -> Result<Option<&'a str>, CompileError> {
+    fields
+        .get(key)
+        .map(|v| v.as_str().ok_or_else(|| invalid(location)))
+        .transpose()
+}
+
+fn child_parameters(
+    parameters: Option<&Value>,
+    scope: &TenantScope,
+    location: &Location,
+) -> Result<(), CompileError> {
+    let Some(parameters) = parameters else {
+        return Ok(());
+    };
+    let fields = parameters
+        .as_object()
+        .ok_or_else(|| location.error(Code::InvalidSchema, "child parameters must be an object"))?;
+    for key in fields.keys() {
+        if !matches!(
+            key.strip_suffix(".$").unwrap_or(key),
+            "StateMachineArn" | "Input" | "Name"
+        ) {
+            return Err(location.error(
+                Code::UnsupportedField,
+                "unsupported child execution parameter",
+            ));
+        }
+    }
+    if let Some(value) = fields.get("StateMachineArn") {
+        let arn: StateMachineArn = value
+            .as_str()
+            .ok_or_else(|| invalid(location))?
+            .parse()
+            .map_err(|_| invalid(location))?;
+        arn.check(scope).map_err(|_| invalid(location))?;
+    }
+    if let Some(value) = fields.get("Name") {
+        let _: ExecutionName = value
+            .as_str()
+            .ok_or_else(|| invalid(location))?
+            .parse()
+            .map_err(|_| invalid(location))?;
+    }
+    if let Some(Value::String(input)) = fields.get("Input") {
+        Payload::parse(input.as_bytes()).map_err(|e| CompileError::asl(location, e))?;
+    }
+    Ok(())
+}
+impl ChildPattern {
+    pub(crate) fn action(self) -> &'static str {
+        match self {
+            Self::RequestResponse => "startExecution",
+            Self::Sync => "startExecution.sync",
+            Self::Sync2 => "startExecution.sync:2",
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/tests.rs b/crates/rustack-stepfunctions-core/src/compiler/tests.rs
new file mode 100644
index 00000000..cbcdc89f
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/tests.rs
@@ -0,0 +1,458 @@
+use std::{error::Error, num::NonZeroU32};
+
+use proptest::prelude::*;
+use rstest::rstest;
+use serde_json::{Map, Value, json};
+
+use crate::{
+    AslCompiler, AslError, CatchResult, CompileError, DiagnosticSeverity, FailureView, Integration,
+    Jitter, StateView, TaskSupport, TaskTimeout, TenantScope, Transition,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+fn enabled() -> AslCompiler {
+    AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+}
+fn definition(state: &Value) -> Value {
+    json!({"StartAt":"Run","States":{"Run":state}})
+}
+fn compile(value: &Value) -> Result<crate::Compilation, CompileError> {
+    enabled().compile(&serde_json::to_vec(value).map_err(|_| {
+        super::Location::root().error(super::Code::InvalidSchema, "test encoding failed")
+    })?)
+}
+fn task() -> Value {
+    json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","End":true})
+}
+
+#[test]
+fn test_should_compile_all_six_instruction_forms_and_resolve_scoped_targets() -> TestResult {
+    let value = json!({"StartAt":"Pass","TimeoutSeconds":60,"Version":"1.0","QueryLanguage":"JSONPath","States":{
+        "Pass":{"Type":"Pass","Result":{"n":1},"Next":"Task"},
+        "Task":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:worker:alias","TimeoutSecondsPath":"$.timeout","Next":"Choice"},
+        "Choice":{"Type":"Choice","Choices":[{"Variable":"$.n","NumericEquals":1,"Next":"Wait"}],"Default":"Fail"},
+        "Wait":{"Type":"Wait","Seconds":0,"Next":"Success"},
+        "Success":{"Type":"Succeed"},"Fail":{"Type":"Fail","ErrorPath":"States.Format('failure-{}', $.n)","Cause":"bounded"}
+    }});
+    let result = compile(&value)?;
+    let machine = result.machine();
+    assert_eq!(machine.state_count(), 6);
+    assert_eq!(machine.timeout_seconds().map(NonZeroU32::get), Some(60));
+    let StateView::Pass {
+        result: literal,
+        next: Transition::Next(next),
+        ..
+    } = machine.state(machine.start())?
+    else {
+        return Err("not Pass".into());
+    };
+    assert_eq!(literal, Some(&json!({"n":1})));
+    assert_eq!(machine.state_name(next)?, "Task");
+    let StateView::Task {
+        resource,
+        timeout,
+        next: Transition::Next(next),
+        recovery,
+        ..
+    } = machine.state(next)?
+    else {
+        return Err("not Task".into());
+    };
+    assert!(matches!(resource, Integration::DirectLambda(_)));
+    assert!(matches!(timeout, TaskTimeout::Path(_)));
+    assert!(recovery.retries().is_empty());
+    let StateView::Choice {
+        branches,
+        default: Some(fail),
+        ..
+    } = machine.state(next)?
+    else {
+        return Err("not Choice".into());
+    };
+    let (_, wait) = branches.first().ok_or("missing choice")?;
+    let StateView::Wait {
+        next: Transition::Next(success),
+        ..
+    } = machine.state(*wait)?
+    else {
+        return Err("not Wait".into());
+    };
+    assert!(matches!(machine.state(success)?, StateView::Succeed { .. }));
+    let StateView::Fail {
+        error: FailureView::Dynamic(_),
+        cause: FailureView::Literal("bounded"),
+    } = machine.state(fail)?
+    else {
+        return Err("not Fail".into());
+    };
+    assert!(result.warnings().is_empty());
+    Ok(())
+}
+
+#[test]
+fn test_should_allow_loops_warn_unreachable_states_and_reject_unreachable_terminals() -> TestResult
+{
+    let value = json!({"StartAt":"Loop","States":{"Loop":{"Type":"Choice","Choices":[{"Variable":"$.again","BooleanEquals":true,"Next":"Loop"}],"Default":"Done"},"Done":{"Type":"Succeed"},"Unused":{"Type":"Fail"}}});
+    let result = compile(&value)?;
+    assert_eq!(result.warnings().len(), 1);
+    let warning = result.warnings().first().ok_or("missing warning")?;
+    assert_eq!(warning.severity(), DiagnosticSeverity::Warning);
+    assert_eq!(warning.location(), "/States/Unused");
+    let invalid = json!({"StartAt":"Loop","States":{"Loop":{"Type":"Pass","Next":"Loop"},"Unreachable":{"Type":"Succeed"}}});
+    let error = compile(&invalid).err().ok_or("missing failure")?;
+    assert_eq!(error.diagnostic().code(), "RUSTACK_NO_REACHABLE_TERMINAL");
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({"Type":"Pass"}))]
+#[case(json!({"Type":"Pass","End":false}))]
+#[case(json!({"Type":"Pass","Next":"Run","End":true}))]
+#[case(json!({"Type":"Pass","End":true,"Result":null,"Parameters":{}}))]
+#[case(json!({"Type":"Pass","End":true,"Retry":[]}))]
+#[case(json!({"Type":"Succeed","Next":"Run"}))]
+#[case(json!({"Type":"Fail","End":true}))]
+#[case(json!({"Type":"Fail","InputPath":"$"}))]
+#[case(json!({"Type":"Fail","Error":"x","ErrorPath":"$.x"}))]
+#[case(json!({"Type":"Fail","ErrorPath":"$[*]"}))]
+#[case(json!({"Type":"Choice","Choices":[]}))]
+#[case(json!({"Type":"Choice","Choices":[{"Variable":"$","IsNull":true,"Next":"Run"}],"End":true}))]
+#[case(json!({"Type":"Wait","Seconds":1,"Timestamp":"1970-01-01T00:00:00Z","End":true}))]
+#[case(json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","End":true,"TimeoutSeconds":1,"TimeoutSecondsPath":"$.n"}))]
+#[case(json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","End":true,"Credentials":{}}))]
+fn test_should_reject_invalid_state_fields_and_combinations(#[case] state: Value) {
+    assert!(compile(&definition(&state)).is_err());
+}
+
+#[rstest]
+#[case("arn:aws:states:::lambda:invoke.sync")]
+#[case("arn:aws:states:::aws-sdk:lambda:invoke")]
+#[case("arn:aws:sqs:::sendMessage.sync")]
+#[case("arn:aws-cn:states:::lambda:invoke")]
+#[case("arn:aws:lambda:us-west-2:000000000000:function:f")]
+#[case("arn:aws:lambda:us-east-1:123456789012:function:f")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:f:")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:f:q:extra")]
+#[case("arn:aws:lambda:us-east-1:000000000000:role:f")]
+fn test_should_reject_nonallowlisted_or_cross_scope_resources(#[case] resource: &str) {
+    let mut state = task();
+    state["Resource"] = json!(resource);
+    assert!(compile(&definition(&state)).is_err());
+}
+
+#[test]
+fn test_should_distinguish_profile_and_dependency_rejection_and_static_parameter_errors()
+-> TestResult {
+    let data = serde_json::to_vec(&definition(&task()))?;
+    let error = AslCompiler::default()
+        .compile(&data)
+        .err()
+        .ok_or("missing dependency failure")?;
+    assert_eq!(error.diagnostic().code(), "RUSTACK_DEPENDENCY_DISABLED");
+    for resource in [
+        "arn:aws:states:::states:startExecution.sync:2",
+        "arn:aws:states:::lambda:invoke.waitForTaskToken",
+    ] {
+        let mut state = task();
+        state["Resource"] = json!(resource);
+        assert_eq!(
+            compile(&definition(&state))
+                .err()
+                .ok_or("missing profile failure")?
+                .diagnostic()
+                .code(),
+            "RUSTACK_PROFILE_UNAVAILABLE"
+        );
+    }
+    for kind in ["Parallel", "Map"] {
+        assert_eq!(
+            compile(&definition(&json!({"Type":kind})))
+                .err()
+                .ok_or("missing state profile failure")?
+                .diagnostic()
+                .code(),
+            "RUSTACK_PROFILE_UNAVAILABLE"
+        );
+    }
+    for parameters in [
+        json!({"InvocationType":"Event"}),
+        json!({"Unknown":1}),
+        json!({"FunctionName":"bad name"}),
+        json!({"FunctionName":"arn:aws:lambda:us-west-2:000000000000:function:f"}),
+        json!({"FunctionName":"arn:aws:lambda:us-east-1:000000000000:function:f:one","Qualifier":"two"}),
+    ] {
+        let mut state = task();
+        state["Parameters"] = parameters;
+        assert!(compile(&definition(&state)).is_err());
+    }
+    let mut state = task();
+    state["Parameters"] = json!({"FunctionName":"arn:aws:lambda:us-east-1:000000000000:function:f:one","Qualifier":"one","InvocationType":"RequestResponse","Payload.$":"$"});
+    compile(&definition(&state))?;
+    Ok(())
+}
+
+#[test]
+fn test_should_preserve_recovery_defaults_zero_attempts_and_same_scope_catch_targets() -> TestResult
+{
+    let mut state = task();
+    state["Retry"] = json!([{"ErrorEquals":["Example"]},{"ErrorEquals":["States.ALL"],"MaxAttempts":0,"IntervalSeconds":2,"BackoffRate":3,"MaxDelaySeconds":4,"JitterStrategy":"FULL"}]);
+    state["Catch"] = json!([{"ErrorEquals":["Example"],"Next":"Fail","ResultPath":"$.error"},{"ErrorEquals":["States.ALL"],"Next":"Fail","ResultPath":null}]);
+    let result = compile(&json!({"StartAt":"Run","States":{"Run":state,"Fail":{"Type":"Fail"}}}))?;
+    let StateView::Task { recovery, .. } = result.machine().state(result.machine().start())? else {
+        return Err("not Task".into());
+    };
+    let first = recovery.retries().first().ok_or("missing retry")?;
+    assert_eq!(first.max_attempts(), 3);
+    assert_eq!(first.timing().interval_seconds().get(), 1);
+    assert_eq!(first.timing().backoff_rate(), 2.0);
+    assert_eq!(first.timing().jitter(), Jitter::None);
+    let second = recovery.retries().get(1).ok_or("missing retry")?;
+    assert_eq!(second.max_attempts(), 0);
+    assert_eq!(
+        second.timing().max_delay_seconds().map(NonZeroU32::get),
+        Some(4)
+    );
+    assert_eq!(second.timing().jitter(), Jitter::Full);
+    assert!(second.matches("Example"));
+    assert!(!second.matches("States.Runtime"));
+    assert!(!second.matches("States.DataLimitExceeded"));
+    let catch = recovery.catches().first().ok_or("missing catch")?;
+    assert!(matches!(catch.result_path(), CatchResult::Path(_)));
+    assert_eq!(result.machine().state_name(catch.next())?, "Fail");
+    assert!(matches!(
+        recovery
+            .catches()
+            .get(1)
+            .ok_or("missing catch")?
+            .result_path(),
+        CatchResult::Discard
+    ));
+    Ok(())
+}
+
+#[rstest]
+#[case(json!([{"ErrorEquals":[]}]))]
+#[case(json!([{"ErrorEquals":["x","x"]}]))]
+#[case(json!([{"ErrorEquals":["States.ALL","x"]}]))]
+#[case(json!([{"ErrorEquals":["States.ALL"]},{"ErrorEquals":["x"]}]))]
+#[case(json!([{"ErrorEquals":["x"],"MaxAttempts":-1}]))]
+#[case(json!([{"ErrorEquals":["x"],"MaxAttempts":100_000_000}]))]
+#[case(json!([{"ErrorEquals":["x"],"IntervalSeconds":0}]))]
+#[case(json!([{"ErrorEquals":["x"],"BackoffRate":0.5}]))]
+#[case(json!([{"ErrorEquals":["x"],"MaxDelaySeconds":31_622_401}]))]
+#[case(json!([{"ErrorEquals":["x"],"JitterStrategy":"random"}]))]
+fn test_should_reject_invalid_retry_policy_fields_and_ranges(#[case] retry: Value) {
+    let mut state = task();
+    state["Retry"] = retry;
+    assert!(compile(&definition(&state)).is_err());
+}
+
+#[test]
+fn test_should_keep_diagnostics_sources_and_definition_data_redacted() -> TestResult {
+    let input=br#" {"StartAt":"a/~","States":{"a/~":{"Type":"Pass","Parameters":{"bad.$":"invalid private text"},"End":true}}} "#;
+    let error = enabled().compile(input).err().ok_or("missing error")?;
+    assert_eq!(error.diagnostic().location(), "/States/a~1~0/Parameters");
+    assert!(error.source().is_some());
+    assert_eq!(format!("{error:?}"), "ASL definition compilation failed");
+    assert_eq!(
+        format!("{:?}", error.diagnostic()),
+        "Diagnostic(<redacted>)"
+    );
+    let valid = br#" { "StartAt":"Done", "States":{"Done":{"Type":"Succeed"}} } "#;
+    let compilation = enabled().compile(valid)?;
+    assert_eq!(compilation.machine().original_bytes(), valid);
+    assert_eq!(
+        format!("{:?}", compilation.machine()),
+        "CompiledMachine(<redacted>)"
+    );
+    assert!(matches!(
+        compilation.machine().state(super::StateId(1000)),
+        Err(AslError::InvalidStateId)
+    ));
+    assert!(
+        enabled()
+            .compile(br#"{"StartAt":"D","States":{"D":{"Type":"Succeed"},"D":{"Type":"Fail"}}}"#)
+            .is_err()
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_exact_state_name_and_state_count_limits() -> TestResult {
+    let name = "中".repeat(42) + "ab";
+    assert_eq!(name.len(), 128);
+    compile(&json!({"StartAt":name,"States":{name:{"Type":"Succeed"}}}))?;
+    let invalid = "x".repeat(129);
+    assert!(compile(&json!({"StartAt":invalid,"States":{invalid:{"Type":"Succeed"}}})).is_err());
+    let mut states = Map::new();
+    for index in 0..1000 {
+        states.insert(format!("s{index:04}"), json!({"Type":"Succeed"}));
+    }
+    let result = compile(&json!({"StartAt":"s0000","States":states}))?;
+    assert_eq!(result.machine().state_count(), 1000);
+    assert_eq!(result.warnings().len(), 999);
+    states.insert("extra".into(), json!({"Type":"Succeed"}));
+    assert!(compile(&json!({"StartAt":"s0000","States":states})).is_err());
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_exact_definition_bytes_depth_and_choice_count() -> TestResult {
+    let mut value = definition(&json!({"Type":"Succeed"}));
+    value["Comment"] = json!("");
+    let fixed = serde_json::to_vec(&value)?.len();
+    value["Comment"] = json!("x".repeat(1024 * 1024 - fixed));
+    let mut exact = serde_json::to_vec(&value)?;
+    assert_eq!(exact.len(), 1024 * 1024);
+    enabled().compile(&exact)?;
+    exact.push(b' ');
+    assert!(enabled().compile(&exact).is_err());
+    let mut nested = json!(0);
+    for _ in 0..61 {
+        nested = json!([nested]);
+    }
+    compile(&definition(
+        &json!({"Type":"Pass","Result":nested,"End":true}),
+    ))?;
+    assert!(
+        compile(&definition(
+            &json!({"Type":"Pass","Result":[nested],"End":true})
+        ))
+        .is_err()
+    );
+    let rule = json!({"Variable":"$","IsPresent":true,"Next":"Done"});
+    let mut machine = json!({"StartAt":"Run","States":{"Run":{"Type":"Choice","Choices":vec![rule.clone();128]},"Done":{"Type":"Succeed"}}});
+    compile(&machine)?;
+    machine["States"]["Run"]["Choices"] = json!(vec![rule; 129]);
+    assert!(compile(&machine).is_err());
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_exact_aggregate_compiled_node_limit_across_states() -> TestResult {
+    let full = format!("States.Array({})", vec!["0"; 128].join(","));
+    let mut states = Map::new();
+    for index in 0..492 {
+        states.insert(
+            format!("s{index:04}"),
+            json!({"Type":"Pass","Parameters":{"x.$":full},"End":true}),
+        );
+    }
+    let partial = format!("States.Array({})", vec!["0"; 95].join(","));
+    states.insert(
+        "z".into(),
+        json!({"Type":"Pass","Parameters":{"x.$":partial},"End":true}),
+    );
+    let exact = json!({"StartAt":"s0000","States":states});
+    let accepted = compile(&exact)?;
+    assert_eq!(accepted.machine().state_count(), 493);
+    let mut over = exact;
+    over["States"]["z"]["Parameters"]["x.$"] =
+        json!(format!("States.Array({})", vec!["0"; 96].join(",")));
+    assert_eq!(
+        compile(&over)
+            .err()
+            .ok_or("missing aggregate limit")?
+            .diagnostic()
+            .code(),
+        "RUSTACK_LIMIT_EXCEEDED"
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_validate_scope_and_recovery_target_and_fatal_matchers() -> TestResult {
+    for (partition, region, account) in [
+        ("foreign", "us-east-1", "000000000000"),
+        ("aws", "Bad Region", "000000000000"),
+        ("aws", "us-east-1", "short"),
+    ] {
+        assert!(TenantScope::new(partition, region, account).is_err());
+    }
+    let compiler = AslCompiler::new(
+        TenantScope::new("aws-cn", "cn-north-1", "123456789012")?,
+        TaskSupport::Lambda,
+    );
+    compiler.compile(&serde_json::to_vec(&definition(&json!({"Type":"Task","Resource":"arn:aws-cn:lambda:cn-north-1:123456789012:function:f:$LATEST","End":true})))?)?;
+    let mut state = task();
+    state["Catch"] = json!([{"ErrorEquals":["x"],"Next":"Missing"}]);
+    let error = compile(&definition(&state))
+        .err()
+        .ok_or("missing catch failure")?;
+    assert_eq!(error.diagnostic().location(), "/States/Run/Catch/0/Next");
+    state["Catch"] = json!([]);
+    state["Retry"] =
+        json!([{"ErrorEquals":["States.TaskFailed"]},{"ErrorEquals":["States.DataLimitExceeded"]}]);
+    let result = compile(&definition(&state))?;
+    let StateView::Task { recovery, .. } = result.machine().state(result.machine().start())? else {
+        return Err("missing task".into());
+    };
+    let wildcard = recovery.retries().first().ok_or("missing wildcard")?;
+    assert!(wildcard.matches("Other"));
+    assert!(!wildcard.matches("States.Timeout"));
+    assert!(!wildcard.matches("States.Runtime"));
+    assert!(!wildcard.matches("States.DataLimitExceeded"));
+    assert!(
+        recovery
+            .retries()
+            .get(1)
+            .ok_or("missing explicit")?
+            .matches("States.DataLimitExceeded")
+    );
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_reject_arbitrary_definition_bytes_without_panicking(bytes in prop::collection::vec(any::<u8>(),0..4096)) {let _=AslCompiler::default().compile(&bytes);}
+    #[test]
+    fn test_should_compile_bounded_linear_graphs_with_correct_indexed_edges(count in 1_usize..80) {
+        let mut states=Map::new();for index in 0..count {let state=if index+1==count {json!({"Type":"Succeed"})} else {json!({"Type":"Pass","Next":format!("s{}",index+1)})};states.insert(format!("s{index}"),state);}
+        let c=compile(&json!({"StartAt":"s0","States":states})).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let mut id=c.machine().start();for index in 0..count {prop_assert_eq!(c.machine().state_name(id).map_err(|e|TestCaseError::fail(e.to_string()))?,format!("s{index}"));match c.machine().state(id).map_err(|e|TestCaseError::fail(e.to_string()))? {StateView::Pass {next:Transition::Next(next),..}=>id=next,StateView::Succeed {..}=>prop_assert_eq!(index+1,count),_=>return Err(TestCaseError::fail("unexpected state"))}}
+    }
+}
+
+mod structured;
+
+#[test]
+fn test_should_gate_exact_child_resources_independently_of_lambda_support() {
+    let compiler = AslCompiler::default().with_child_support(true);
+    for suffix in ["", ".sync", ".sync:2"] {
+        let value = json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":format!("arn:aws:states:::states:startExecution{suffix}"),"Parameters":{"StateMachineArn":"arn:aws:states:us-east-1:000000000000:stateMachine:Child"},"End":true}}});
+        let bytes = serde_json::to_vec(&value).unwrap();
+        assert!(AslCompiler::default().compile(&bytes).is_err());
+        let artifact = compiler.compile(&bytes).unwrap();
+        assert!(artifact.machine().uses_children());
+        assert!(!artifact.machine().uses_lambda());
+    }
+    for resource in [
+        "arn:aws:states:::states:startExecution.sync:3",
+        "arn:aws:states:::states:startExecution.waitForTaskToken",
+        "arn:aws-cn:states:::states:startExecution",
+        "arn:aws:states:::lambda:invoke.sync",
+    ] {
+        let bytes = serde_json::to_vec(
+            &json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":resource,"End":true}}}),
+        )
+        .unwrap();
+        assert!(compiler.compile(&bytes).is_err());
+    }
+}
+#[test]
+fn test_should_reject_invalid_literal_nested_parameters_during_compilation() {
+    let compiler = AslCompiler::default().with_child_support(true);
+    for parameters in [
+        json!({"StateMachineArn":"bad"}),
+        json!({"StateMachineArn":"arn:aws:states:us-west-2:000000000000:stateMachine:Child"}),
+        json!({"Name":null}),
+        json!({"Name":"bad:name"}),
+        json!({"Unknown":true}),
+        json!({"Input":"invalid"}),
+        json!({"StateMachineArn":"arn:aws:states:us-east-1:000000000000:stateMachine:Child","StateMachineArn.$":"$.arn"}),
+    ] {
+        let bytes=serde_json::to_vec(&json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::states:startExecution.sync:2","Parameters":parameters,"End":true}}})).unwrap();
+        assert!(compiler.compile(&bytes).is_err());
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/compiler/tests/structured.rs b/crates/rustack-stepfunctions-core/src/compiler/tests/structured.rs
new file mode 100644
index 00000000..3664580f
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/compiler/tests/structured.rs
@@ -0,0 +1,566 @@
+//! Structured compiler boundary, lexical ownership and normalization tests.
+
+use std::{sync::Arc, time::Instant};
+
+use chrono::Utc;
+use proptest::prelude::*;
+use rstest::rstest;
+use serde_json::{Map, Value, json};
+
+use super::{TestResult, definition};
+use crate::{
+    AslCompiler, AslError, ClockSample, Compilation, CompileError, EvaluationContext,
+    ExecutionDriver, ExecutionLimits, MapConcurrency, Payload, StateSupport, StateView,
+    TaskSupport, TenantScope, Transition,
+};
+
+fn compiler() -> AslCompiler {
+    AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_state_support(StateSupport::Structured)
+}
+fn compile(value: &Value) -> Result<Compilation, CompileError> {
+    compiler().compile(&serde_json::to_vec(value).map_err(|_| {
+        super::super::Location::root()
+            .error(super::super::Code::InvalidSchema, "test encoding failed")
+    })?)
+}
+fn leaf() -> Value {
+    definition(&json!({"Type":"Succeed"}))
+}
+fn parallel(branches: Vec<Value>) -> Value {
+    let mut state = json!({"Type":"Parallel","End":true});
+    state["Branches"] = Value::Array(branches);
+    definition(&state)
+}
+fn map() -> Value {
+    definition(&json!({"Type":"Map","ItemProcessor":leaf(),"End":true}))
+}
+fn error_at(value: &Value, code: &str, location: &str) -> TestResult {
+    let error = compile(value).err().ok_or("expected compile rejection")?;
+    assert_eq!(error.diagnostic().code(), code);
+    assert_eq!(error.diagnostic().location(), location);
+    Ok(())
+}
+
+#[test]
+fn test_should_resolve_nonlexical_source_order_under_unified_json_features() -> TestResult {
+    let result = AslCompiler::default().compile(br#"{"StartAt":"Zulu","States":{"Zulu":{"Type":"Pass","Next":"Alpha"},"Alpha":{"Type":"Succeed"}}}"#)?;
+    let machine = result.machine();
+    assert_eq!(machine.state_name(machine.start())?, "Zulu");
+    let StateView::Pass {
+        next: Transition::Next(next),
+        ..
+    } = machine.state(machine.start())?
+    else {
+        return Err("incorrect entry instruction".into());
+    };
+    assert_eq!(machine.state_name(next)?, "Alpha");
+    assert!(matches!(machine.state(next)?, StateView::Succeed { .. }));
+    let result = compiler().compile(br#"{"StartAt":"Run","States":{"Run":{"Type":"Parallel","Branches":[{"StartAt":"Zulu","States":{"Zulu":{"Type":"Pass","Next":"Alpha"},"Alpha":{"Type":"Succeed"}}}],"End":true}}}"#)?;
+    let StateView::Parallel { branches, .. } = result.machine().state(result.machine().start())?
+    else {
+        return Err("expected Parallel".into());
+    };
+    let branch = branches.first().ok_or("missing branch")?;
+    assert_eq!(branch.state_name(branch.start())?, "Zulu");
+    let StateView::Pass {
+        next: Transition::Next(next),
+        ..
+    } = branch.state(branch.start())?
+    else {
+        return Err("incorrect branch entry".into());
+    };
+    assert_eq!(branch.state_name(next)?, "Alpha");
+    Ok(())
+}
+
+#[test]
+fn test_should_share_root_source_and_tenant_across_independent_lexical_indexes() -> TestResult {
+    let value = parallel(vec![leaf(), map()]);
+    let mut source = b" \n".to_vec();
+    source.extend(serde_json::to_vec(&value)?);
+    source.extend(b"\n ");
+    let result = compiler().compile(&source)?;
+    let machine = result.machine();
+    assert_eq!(machine.original_bytes(), source);
+    assert_eq!(machine.state_count(), 1);
+    assert!(machine.requires_structured_execution());
+    let StateView::Parallel { branches, .. } = machine.state(machine.start())? else {
+        return Err("expected Parallel".into());
+    };
+    assert_eq!(branches.len(), 2);
+    for branch in branches {
+        assert_eq!(
+            branch.original_bytes().as_ptr(),
+            machine.original_bytes().as_ptr()
+        );
+        assert_eq!(branch.scope().region(), machine.scope().region());
+        assert_eq!(branch.state_name(branch.start())?, "Run");
+    }
+    let first = branches.first().ok_or("missing branch")?;
+    assert!(matches!(
+        first.state(first.start())?,
+        StateView::Succeed { .. }
+    ));
+    let second = branches.get(1).ok_or("missing Map branch")?;
+    let StateView::Map { processor, .. } = second.state(second.start())? else {
+        return Err("expected Map".into());
+    };
+    assert_eq!(
+        processor.original_bytes().as_ptr(),
+        machine.original_bytes().as_ptr()
+    );
+    assert_eq!(processor.state_name(processor.start())?, "Run");
+    assert!(!processor.requires_structured_execution());
+    assert!(matches!(
+        processor.state(processor.start())?,
+        StateView::Succeed { .. }
+    ));
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({"Type":"Pass","Next":"Outer"}), "/Next")]
+#[case(json!({"Type":"Choice","Choices":[{"Variable":"$","IsNull":true,"Next":"Outer"}]}), "/Choices/0/Next")]
+#[case(json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Catch":[{"ErrorEquals":["BusinessError"],"Next":"Outer"}],"End":true}), "/Catch/0/Next")]
+fn test_should_reject_nested_transitions_to_parent_scope(
+    #[case] state: Value,
+    #[case] suffix: &str,
+) -> TestResult {
+    let mut value = parallel(vec![definition(&state)]);
+    value["States"]["Outer"] = json!({"Type":"Succeed"});
+    error_at(
+        &value,
+        "RUSTACK_MISSING_TRANSITION_TARGET",
+        &format!("/States/Run/Branches/0/States/Run{suffix}"),
+    )
+}
+
+#[test]
+fn test_should_reject_start_parent_sibling_and_processor_scope_escapes() -> TestResult {
+    let mut value = parallel(vec![
+        leaf(),
+        json!({"StartAt":"Sibling","States":{"Sibling":{"Type":"Succeed"}}}),
+    ]);
+    value["States"]["Run"]["Branches"][0]["StartAt"] = json!("Sibling");
+    error_at(
+        &value,
+        "RUSTACK_MISSING_TRANSITION_TARGET",
+        "/States/Run/Branches/0/StartAt",
+    )?;
+    let mut value = map();
+    value["States"]["Outer"] = json!({"Type":"Succeed"});
+    value["States"]["Run"]["ItemProcessor"]["States"]["Run"] =
+        json!({"Type":"Pass","Next":"Outer"});
+    error_at(
+        &value,
+        "RUSTACK_MISSING_TRANSITION_TARGET",
+        "/States/Run/ItemProcessor/States/Run/Next",
+    )?;
+    let value = json!({"StartAt":"Child","States":{"Run":{"Type":"Parallel","Branches":[{"StartAt":"Child","States":{"Child":{"Type":"Succeed"}}}],"End":true}}});
+    error_at(&value, "RUSTACK_MISSING_TRANSITION_TARGET", "/StartAt")
+}
+
+#[test]
+fn test_should_validate_all_nested_graphs_and_report_root_relative_escaped_warnings() -> TestResult
+{
+    let branch =
+        json!({"StartAt":"Run","States":{"Run":{"Type":"Succeed"},"unused~/":{"Type":"Fail"}}});
+    let result = compile(&parallel(vec![branch]))?;
+    let warning = result.warnings().first().ok_or("missing nested warning")?;
+    assert_eq!(
+        warning.location(),
+        "/States/Run/Branches/0/States/unused~0~1"
+    );
+    let cycle = definition(&json!({"Type":"Pass","Next":"Run"}));
+    error_at(
+        &parallel(vec![cycle]),
+        "RUSTACK_NO_REACHABLE_TERMINAL",
+        "/States/Run/Branches/0/States",
+    )?;
+    let invalid = json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"},"Unused":{"Type":"Parallel","Branches":[{"StartAt":"Missing","States":{"Run":{"Type":"Succeed"}}}],"End":true}}});
+    error_at(
+        &invalid,
+        "RUSTACK_MISSING_TRANSITION_TARGET",
+        "/States/Unused/Branches/0/StartAt",
+    )
+}
+
+#[rstest]
+#[case("ItemProcessor", "ItemSelector")]
+#[case("ItemProcessor", "Parameters")]
+#[case("Iterator", "ItemSelector")]
+#[case("Iterator", "Parameters")]
+fn test_should_normalize_legacy_and_current_map_fields_independently(
+    #[case] processor_key: &str,
+    #[case] selector_key: &str,
+) -> TestResult {
+    let mut state = json!({"Type":"Map","InputPath":"$.batch","ItemsPath":"$.items","ResultPath":"$.result","End":true});
+    state[processor_key] = leaf();
+    state[selector_key] =
+        json!({"item.$":"$$.Map.Item.Value","index.$":"$$.Map.Item.Index","keep.$":"$.keep"});
+    let result = compile(&definition(&state))?;
+    let machine = result.machine();
+    let StateView::Map {
+        flow,
+        items,
+        selector: Some(selector),
+        concurrency,
+        ..
+    } = machine.state(machine.start())?
+    else {
+        return Err("expected normalized Map".into());
+    };
+    let raw = Payload::from_value(&json!({"batch":{"items":[7,9],"keep":true},"outer":1}))?;
+    let context = EvaluationContext::from(&Payload::from_value(
+        &json!({"Map":{"Item":{"Index":1,"Value":9,"Source":"STATE_DATA"}}}),
+    )?);
+    let effective = flow.prepare(&raw, &context)?;
+    assert_eq!(effective.value(), &json!({"items":[7,9],"keep":true}));
+    assert_eq!(items.lookup(&effective, &context), Some(&json!([7, 9])));
+    assert_eq!(
+        selector.evaluate(&effective, &context)?.value(),
+        &json!({"item":9,"index":1,"keep":true})
+    );
+    assert!(matches!(concurrency, MapConcurrency::Limit(limit) if limit.get() == 40));
+    assert_eq!(
+        flow.finish(&raw, &Payload::parse(b"[8,10]")?, &context)?
+            .value(),
+        &json!({"batch":{"items":[7,9],"keep":true},"outer":1,"result":[8,10]})
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({"ItemSelector":{},"Parameters":{}}), "/ItemSelector")]
+#[case(json!({"Iterator":{"StartAt":"Run","States":{"Run":{"Type":"Succeed"}}}}), "/ItemProcessor")]
+#[case(json!({"ItemSelector":null}), "/ItemSelector")]
+#[case(json!({"ItemsPath":"$[*]"}), "/ItemsPath")]
+#[case(json!({"MaxConcurrencyPath":"$.limits[*]"}), "/MaxConcurrencyPath")]
+#[case(json!({"MaxConcurrency":41}), "/MaxConcurrency")]
+#[case(json!({"MaxConcurrency":-1}), "/MaxConcurrency")]
+#[case(json!({"MaxConcurrency":1.5}), "/MaxConcurrency")]
+#[case(json!({"MaxConcurrency":null}), "/MaxConcurrency")]
+#[case(json!({"MaxConcurrency":1,"MaxConcurrencyPath":"$.n"}), "/MaxConcurrencyPath")]
+fn test_should_reject_map_conflicts_and_invalid_selectors_or_concurrency(
+    #[case] additions: Value,
+    #[case] suffix: &str,
+) -> TestResult {
+    let mut value = map();
+    let state = value
+        .get_mut("States")
+        .and_then(|v| v.get_mut("Run"))
+        .and_then(Value::as_object_mut)
+        .ok_or("missing state")?;
+    state.extend(additions.as_object().ok_or("missing additions")?.clone());
+    let error = compile(&value).err().ok_or("expected map rejection")?;
+    assert_eq!(
+        error.diagnostic().location(),
+        format!("/States/Run{suffix}")
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case(None, 40)]
+#[case(Some(0), 40)]
+#[case(Some(1), 1)]
+#[case(Some(40), 40)]
+fn test_should_normalize_static_map_concurrency(
+    #[case] value: Option<u64>,
+    #[case] expected: u8,
+) -> TestResult {
+    let mut definition = map();
+    if let Some(value) = value {
+        definition["States"]["Run"]["MaxConcurrency"] = json!(value);
+    }
+    let result = compile(&definition)?;
+    let StateView::Map {
+        items,
+        selector,
+        concurrency,
+        ..
+    } = result.machine().state(result.machine().start())?
+    else {
+        return Err("expected Map".into());
+    };
+    assert!(matches!(concurrency, MapConcurrency::Limit(limit) if limit.get() == expected));
+    assert!(selector.is_none());
+    let input = Payload::parse(b"[null,1]")?;
+    assert_eq!(
+        items.lookup(&input, &EvaluationContext::from(&input)),
+        Some(input.value())
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_compile_dynamic_concurrency_without_evaluating_definition_data() -> TestResult {
+    let mut value = map();
+    value["States"]["Run"]["MaxConcurrencyPath"] = json!("$.count");
+    let result = compile(&value)?;
+    let StateView::Map {
+        concurrency: MapConcurrency::Path(path),
+        ..
+    } = result.machine().state(result.machine().start())?
+    else {
+        return Err("expected dynamic Map".into());
+    };
+    let input = Payload::parse(br#"{"count":3}"#)?;
+    assert_eq!(
+        path.lookup(&input, &EvaluationContext::from(&input)),
+        Some(&json!(3))
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({}), true)]
+#[case(json!({"Mode":"INLINE"}), true)]
+#[case(json!({"Mode":"DISTRIBUTED"}), false)]
+#[case(json!({"Mode":null}), false)]
+#[case(json!({"ExecutionType":"STANDARD"}), false)]
+#[case(json!(null), false)]
+fn test_should_validate_inline_processor_configuration(
+    #[case] config: Value,
+    #[case] accepted: bool,
+    #[values("ItemProcessor", "Iterator")] spelling: &str,
+) {
+    let mut value = map();
+    let mut processor = value["States"]["Run"]
+        .as_object_mut()
+        .unwrap()
+        .remove("ItemProcessor")
+        .unwrap();
+    processor["ProcessorConfig"] = config;
+    value["States"]["Run"][spelling] = processor;
+    assert_eq!(compile(&value).is_ok(), accepted);
+}
+
+#[rstest]
+#[case("TimeoutSeconds", json!(1))]
+#[case("Version", json!("1.0"))]
+#[case("ProcessorConfig", json!({"Mode":"INLINE"}))]
+fn test_should_reject_root_only_or_processor_only_fields_in_branches(
+    #[case] key: &str,
+    #[case] field: Value,
+) -> TestResult {
+    let mut branch = leaf();
+    branch[key] = field;
+    error_at(
+        &parallel(vec![branch]),
+        "RUSTACK_UNSUPPORTED_FIELD",
+        &format!("/States/Run/Branches/0/{key}"),
+    )
+}
+
+#[rstest]
+#[case(json!([]))]
+#[case(json!([null]))]
+#[case(json!(null))]
+fn test_should_reject_invalid_parallel_branches(#[case] branches: Value) {
+    assert!(
+        compile(&definition(
+            &json!({"Type":"Parallel","Branches":branches,"End":true})
+        ))
+        .is_err()
+    );
+}
+
+#[test]
+fn test_should_resolve_enclosing_recovery_and_continuation_without_leaking_branch_targets()
+-> TestResult {
+    for mut state in [
+        json!({"Type":"Parallel","Branches":[leaf()]}),
+        json!({"Type":"Map","ItemProcessor":leaf()}),
+    ] {
+        state["Next"] = json!("Done");
+        state["Retry"] = json!([{"ErrorEquals":["BusinessError"],"MaxAttempts":2}]);
+        state["Catch"] = json!([{"ErrorEquals":["States.ALL"],"Next":"Recovered"}]);
+        let value = json!({"StartAt":"Run","States":{"Run":state,"Done":{"Type":"Succeed"},"Recovered":{"Type":"Succeed"}}});
+        let result = compile(&value)?;
+        let machine = result.machine();
+        let (StateView::Parallel { recovery, next, .. } | StateView::Map { recovery, next, .. }) =
+            machine.state(machine.start())?
+        else {
+            return Err("expected structured state".into());
+        };
+        let Transition::Next(next) = next else {
+            return Err("missing continuation".into());
+        };
+        assert_eq!(machine.state_name(next)?, "Done");
+        assert_eq!(
+            machine.state_name(recovery.catches().first().ok_or("missing catch")?.next())?,
+            "Recovered"
+        );
+        assert_eq!(
+            recovery
+                .retries()
+                .first()
+                .ok_or("missing retry")?
+                .max_attempts(),
+            2
+        );
+        assert!(result.warnings().is_empty());
+    }
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_shared_state_count_and_nested_scope_depth() -> TestResult {
+    let mut states = Map::new();
+    for index in 0..999 {
+        states.insert(format!("s{index}"), json!({"Type":"Succeed"}));
+    }
+    let mut value = parallel(vec![json!({"StartAt":"s0","States":states})]);
+    compile(&value)?;
+    value["States"]["Run"]["Branches"][0]["States"]["extra"] = json!({"Type":"Succeed"});
+    error_at(
+        &value,
+        "RUSTACK_LIMIT_EXCEEDED",
+        "/States/Run/Branches/0/States",
+    )?;
+    let mut value = leaf();
+    for _ in 0..16 {
+        value = definition(&json!({"Type":"Map","ItemProcessor":value,"End":true}));
+    }
+    compile(&value)?;
+    let over = definition(&json!({"Type":"Map","ItemProcessor":value,"End":true}));
+    let error = compile(&over).err().ok_or("expected depth rejection")?;
+    assert_eq!(error.diagnostic().code(), "RUSTACK_LIMIT_EXCEEDED");
+    assert!(error.diagnostic().location().ends_with("/ItemProcessor"));
+    let mut json_depth = leaf();
+    for _ in 0..16 {
+        json_depth = parallel(vec![json_depth]);
+    }
+    error_at(&json_depth, "RUSTACK_LIMIT_EXCEEDED", "")?;
+    Ok(())
+}
+
+fn heavy_branch(full_states: usize, partial_arguments: usize) -> Value {
+    let full = format!("States.Array({})", vec!["0"; 128].join(","));
+    let mut states = Map::new();
+    for index in 0..full_states {
+        states.insert(
+            format!("s{index:04}"),
+            json!({"Type":"Pass","Parameters":{"x.$":full},"End":true}),
+        );
+    }
+    let partial = format!("States.Array({})", vec!["0"; partial_arguments].join(","));
+    states.insert(
+        "z".into(),
+        json!({"Type":"Pass","Parameters":{"x.$":partial},"End":true}),
+    );
+    json!({"StartAt":"s0000","States":states})
+}
+
+#[test]
+fn test_should_charge_nested_scope_and_item_selector_units_to_one_exact_budget() -> TestResult {
+    // 492*133 +98 (93 args +5) +2 Parallel units =65,536.
+    compile(&parallel(vec![heavy_branch(492, 93)]))?;
+    let over = parallel(vec![heavy_branch(492, 94)]);
+    assert_eq!(
+        compile(&over)
+            .err()
+            .ok_or("missing unit rejection")?
+            .diagnostic()
+            .code(),
+        "RUSTACK_LIMIT_EXCEEDED"
+    );
+    let mut map = map();
+    map["States"]["Run"]["ItemSelector"] =
+        json!({"x.$":format!("States.Array({})", vec!["0";128].join(","))});
+    // 491*133 +96 +135 (Map +selector +processor) +2 =65,536.
+    compile(&parallel(vec![heavy_branch(491, 91), map.clone()]))?;
+    assert_eq!(
+        compile(&parallel(vec![heavy_branch(491, 92), map]))
+            .err()
+            .ok_or("missing selector unit rejection")?
+            .diagnostic()
+            .code(),
+        "RUSTACK_LIMIT_EXCEEDED"
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_keep_default_compiler_and_sequential_driver_admission_closed() -> TestResult {
+    for value in [parallel(vec![leaf()]), map()] {
+        let source = serde_json::to_vec(&value)?;
+        let error = AslCompiler::default()
+            .compile(&source)
+            .err()
+            .ok_or("default compiler accepted structured states")?;
+        assert_eq!(error.diagnostic().code(), "RUSTACK_PROFILE_UNAVAILABLE");
+        let result = compile(&value)?;
+        let input = Payload::parse(b"{}")?;
+        let driver = ExecutionDriver::new(
+            result.machine().clone(),
+            input.clone(),
+            EvaluationContext::from(&input),
+            ClockSample::new(Instant::now(), Utc::now()),
+            ExecutionLimits::default(),
+        );
+        assert!(matches!(driver, Err(AslError::StructuredExecutionRequired)));
+    }
+    let value = parallel(vec![definition(
+        &json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","End":true}),
+    )]);
+    assert!(compile(&value)?.machine().uses_lambda());
+    let error = AslCompiler::default()
+        .with_state_support(StateSupport::Structured)
+        .compile(&serde_json::to_vec(&value)?)
+        .err()
+        .ok_or("missing nested Lambda dependency rejection")?;
+    assert_eq!(error.diagnostic().code(), "RUSTACK_DEPENDENCY_DISABLED");
+    assert_eq!(
+        error.diagnostic().location(),
+        "/States/Run/Branches/0/States/Run/Resource"
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_preflight_duplicate_keys_and_redact_nested_source_details() -> TestResult {
+    let bytes = br#"{"StartAt":"Run","States":{"Run":{"Type":"Map","ItemProcessor":{"StartAt":"Run","States":{"Run":{"Type":"Succeed","Comment":"secret-a","Comment":"secret-b"}}},"End":true}}}"#;
+    let error = compiler()
+        .compile(bytes)
+        .err()
+        .ok_or("accepted duplicate nested keys")?;
+    assert!(!format!("{error:?} {error}").contains("secret-"));
+    let value = parallel(vec![definition(
+        &json!({"Type":"Fail","Cause":"secret-value"}),
+    )]);
+    let result = compile(&value)?;
+    assert!(!format!("{result:?} {:?}", result.machine()).contains("secret-value"));
+    let StateView::Parallel { branches, .. } = result.machine().state(result.machine().start())?
+    else {
+        return Err("expected Parallel".into());
+    };
+    let branch = branches.first().ok_or("missing branch")?;
+    assert!(!format!("{:?} {:?}", branch, branch.state(branch.start())?).contains("secret-value"));
+    assert_eq!(Arc::strong_count(branch), 1);
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(128))]
+    #[test]
+    fn test_should_preserve_nested_lexical_name_reuse(depth in 0_usize..17) {
+        let mut value = leaf();
+        for level in 0..depth { value = if level % 2 == 0 { parallel(vec![value]) } else { definition(&json!({"Type":"Map","ItemProcessor":value,"End":true})) }; }
+        let result = compile(&value).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let mut machine = result.machine().clone();
+        for _ in 0..depth {
+            prop_assert_eq!(machine.state_name(machine.start()).map_err(|e| TestCaseError::fail(e.to_string()))?, "Run");
+            let branch = match machine.state(machine.start()).map_err(|e| TestCaseError::fail(e.to_string()))? {
+                StateView::Parallel { branches, .. } => branches.first().ok_or_else(|| TestCaseError::fail("missing branch"))?.clone(),
+                StateView::Map { processor, .. } => processor.clone(),
+                _ => return Err(TestCaseError::fail("expected structured state")),
+            };
+            prop_assert_eq!(branch.original_bytes().as_ptr(), machine.original_bytes().as_ptr());
+            machine = branch;
+        }
+        prop_assert!(matches!(machine.state(machine.start()), Ok(StateView::Succeed { .. })), "expected terminal Succeed");
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/dataflow.rs b/crates/rustack-stepfunctions-core/src/dataflow.rs
new file mode 100644
index 00000000..141e1152
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/dataflow.rs
@@ -0,0 +1,297 @@
+//! Pure input/result phases; execution owners retain raw input across resources.
+
+use std::fmt;
+
+use serde_json::Value;
+
+use crate::{
+    AslError, CallbackHistory, CallbackParameters, CallbackToken, EvaluationContext, Path, Payload,
+    ResultPath, SystemUuidSource, Template, UuidSource,
+    expression::Budget,
+    payload::{parse_component, validate_component},
+};
+
+#[derive(Clone)]
+enum Filter {
+    Empty,
+    Path(Path),
+}
+#[derive(Clone)]
+enum Merge {
+    Replace,
+    Discard,
+    Path(ResultPath),
+}
+
+/// Compiled state transformations with explicit original-input/result boundaries.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct DataFlow {
+    input: Filter,
+    parameters: Option<Template>,
+    selector: Option<Template>,
+    result: Merge,
+    output: Filter,
+}
+
+impl fmt::Debug for DataFlow {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("DataFlow(<redacted>)")
+    }
+}
+
+impl DataFlow {
+    /// Preflight a transformation-only JSON object before compiling its fields.
+    ///
+    /// # Errors
+    /// Rejects duplicate/unknown fields, invalid templates and paths.
+    ///
+    /// ```
+    /// let flow=rustack_stepfunctions_core::DataFlow::parse(br#"{"InputPath":"$.data"}"#)?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn parse(input: &[u8]) -> Result<Self, AslError> {
+        Self::compile(&parse_component(input)?)
+    }
+
+    /// Compile the five transformation fields; the state compiler owns its profile.
+    ///
+    /// # Errors
+    /// Rejects unknown fields, invalid types/paths and normalized-key collisions.
+    ///
+    /// ```
+    /// let flow=rustack_stepfunctions_core::DataFlow::compile(&serde_json::json!({"ResultPath":null}))?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn compile(value: &Value) -> Result<Self, AslError> {
+        Self::compile_located(value).map_err(|(_, error)| error)
+    }
+
+    pub(crate) fn compile_located(value: &Value) -> Result<Self, (&'static str, AslError)> {
+        validate_component(value).map_err(|e| ("", e))?;
+        let object = value.as_object().ok_or(("", AslError::InvalidDataFlow))?;
+        if object.keys().any(|key| {
+            !matches!(
+                key.as_str(),
+                "InputPath" | "Parameters" | "ResultSelector" | "ResultPath" | "OutputPath"
+            )
+        }) {
+            return Err(("", AslError::InvalidDataFlow));
+        }
+        let result = match object.get("ResultPath") {
+            None => Merge::Replace,
+            Some(Value::Null) => Merge::Discard,
+            Some(Value::String(path)) => Merge::Path(path.parse().map_err(|e| ("ResultPath", e))?),
+            _ => return Err(("ResultPath", AslError::InvalidDataFlow)),
+        };
+        Ok(Self {
+            input: filter(object.get("InputPath")).map_err(|e| ("InputPath", e))?,
+            parameters: object
+                .get("Parameters")
+                .map(Template::compile)
+                .transpose()
+                .map_err(|e| ("Parameters", e))?,
+            selector: object
+                .get("ResultSelector")
+                .map(Template::compile)
+                .transpose()
+                .map_err(|e| ("ResultSelector", e))?,
+            result,
+            output: filter(object.get("OutputPath")).map_err(|e| ("OutputPath", e))?,
+        })
+    }
+
+    pub(crate) fn node_count(&self) -> usize {
+        1_usize
+            .saturating_add(self.parameters.as_ref().map_or(0, Template::node_count))
+            .saturating_add(self.selector.as_ref().map_or(0, Template::node_count))
+    }
+
+    /// Apply `InputPath` then Parameters before calling a resource.
+    ///
+    /// # Errors
+    /// Returns typed selection/template/budget failures and source failures.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{DataFlow,Payload,EvaluationContext};
+    /// let original=Payload::parse(br#"{"data":{"n":1},"keep":true}"#)?;
+    /// let flow=DataFlow::parse(br#"{"InputPath":"$.data"}"#)?;
+    /// assert_eq!(flow.prepare(&original,&EvaluationContext::from(&original))?.value(),&serde_json::json!({"n":1}));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn prepare(
+        &self,
+        original: &Payload,
+        context: &EvaluationContext,
+    ) -> Result<Payload, AslError> {
+        self.prepare_with_source(original, context, &mut SystemUuidSource)
+    }
+
+    /// Prepare input with an explicit UUID source and one shared phase budget.
+    ///
+    /// # Errors
+    /// Returns data/source failures; original input is unchanged on every outcome.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{DataFlow,Payload,EvaluationContext,SystemUuidSource};
+    /// let input=Payload::parse(b"null")?;
+    /// let flow=DataFlow::parse(b"{}")?;
+    /// flow.prepare_with_source(&input,&EvaluationContext::from(&input),&mut SystemUuidSource::default())?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn prepare_with_source<S: UuidSource + ?Sized>(
+        &self,
+        original: &Payload,
+        context: &EvaluationContext,
+        source: &mut S,
+    ) -> Result<Payload, AslError> {
+        let mut budget = Budget::new();
+        let input = apply(&self.input, original, context, &mut budget)?;
+        if let Some(template) = &self.parameters {
+            template.evaluate_scoped(&input, context, source, &mut budget)
+        } else {
+            Ok(input)
+        }
+    }
+
+    /// Prepare callback invocation/history projections with one scoped credential.
+    ///
+    /// Call only after real callback registration and under bounded CPU admission.
+    /// The transient context never changes the supplied original/base context.
+    ///
+    /// # Errors
+    /// Rejects stale reserved Task context, invalid transformations, source failure
+    /// and independent context/outbound/history byte/depth/member/work limits.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{CallbackTask, DataFlow, Payload, EvaluationContext, SystemUuidSource};
+    /// # fn prepare(task: &CallbackTask) -> Result<(),Box<dyn std::error::Error>> {
+    /// let flow = DataFlow::parse(br#"{"Parameters":{"token.$":"$$.Task.Token","n.$":"$.n"}}"#)?;
+    /// let input = Payload::parse(br#"{"n":21}"#)?;
+    /// let result = flow.prepare_callback_with_source(&input, &EvaluationContext::from_value(&serde_json::json!({}))?, task.token(), &mut SystemUuidSource::default())?;
+    /// assert!(result.outbound().value()["token"].is_string());
+    /// assert!(result.history().payload().value()["token"].is_null());
+    /// assert!(result.history().redacted());
+    /// # Ok(()) }
+    /// ```
+    pub fn prepare_callback_with_source<S: UuidSource + ?Sized>(
+        &self,
+        original: &Payload,
+        base_context: &EvaluationContext,
+        token: &CallbackToken,
+        source: &mut S,
+    ) -> Result<CallbackParameters, AslError> {
+        let context = base_context.for_callback(token)?;
+        let mut budget = Budget::new();
+        let input = apply(&self.input, original, &context, &mut budget)?;
+        let sensitive = match &self.input {
+            Filter::Empty => false,
+            Filter::Path(path) => path.callback_sensitive(false),
+        };
+        if let Some(template) = &self.parameters {
+            template.evaluate_callback(&input, &context, source, &mut budget, sensitive)
+        } else {
+            let history = if sensitive {
+                Payload::parse(b"null")?
+            } else {
+                input.clone()
+            };
+            budget.result(&history)?;
+            Ok(CallbackParameters {
+                outbound: input,
+                history: CallbackHistory {
+                    payload: history,
+                    redacted: sensitive,
+                },
+            })
+        }
+    }
+
+    /// Select raw result, merge into original state input, then apply `OutputPath`.
+    ///
+    /// # Errors
+    /// Returns result-selector, merge/output, source or intermediate-limit failures.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{DataFlow,Payload,EvaluationContext};
+    /// let original=Payload::parse(br#"{"keep":1}"#)?;
+    /// let result=Payload::parse(b"2")?;
+    /// let flow=DataFlow::parse(br#"{"ResultPath":"$.answer"}"#)?;
+    /// assert_eq!(flow.finish(&original,&result,&EvaluationContext::from(&original))?.value(),&serde_json::json!({"keep":1,"answer":2}));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn finish(
+        &self,
+        original: &Payload,
+        raw_result: &Payload,
+        context: &EvaluationContext,
+    ) -> Result<Payload, AslError> {
+        self.finish_with_source(original, raw_result, context, &mut SystemUuidSource)
+    }
+
+    /// Finish with an explicit UUID source and a shared result-phase budget.
+    ///
+    /// # Errors
+    /// Returns typed failures without changing original/result/context values.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{DataFlow,Payload,EvaluationContext,SystemUuidSource};
+    /// let input=Payload::parse(b"null")?;
+    /// DataFlow::parse(b"{}")?.finish_with_source(&input,&input,&EvaluationContext::from(&input),&mut SystemUuidSource::default())?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn finish_with_source<S: UuidSource + ?Sized>(
+        &self,
+        original: &Payload,
+        raw_result: &Payload,
+        context: &EvaluationContext,
+        source: &mut S,
+    ) -> Result<Payload, AslError> {
+        let mut budget = Budget::new();
+        let selected = if let Some(selector) = &self.selector {
+            selector.evaluate_scoped(raw_result, context, source, &mut budget)?
+        } else {
+            raw_result.clone()
+        };
+        budget.work(1)?;
+        let merged = match &self.result {
+            Merge::Replace => selected,
+            Merge::Discard => original.clone(),
+            Merge::Path(path) => path.merge(original, &selected)?,
+        };
+        budget.result(&merged)?;
+        apply(&self.output, &merged, context, &mut budget)
+    }
+}
+
+fn filter(value: Option<&Value>) -> Result<Filter, AslError> {
+    match value {
+        None => Ok(Filter::Path("$".parse()?)),
+        Some(Value::Null) => Ok(Filter::Empty),
+        Some(Value::String(path)) => Ok(Filter::Path(path.parse()?)),
+        _ => Err(AslError::InvalidDataFlow),
+    }
+}
+
+fn apply(
+    filter: &Filter,
+    input: &Payload,
+    context: &EvaluationContext,
+    budget: &mut Budget,
+) -> Result<Payload, AslError> {
+    match filter {
+        Filter::Path(path) => budget.path(path, input, context),
+        Filter::Empty => {
+            budget.work(1)?;
+            let output = Payload::parse(b"{}")?;
+            budget.result(&output)?;
+            Ok(output)
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "dataflow/callback_tests.rs"]
+mod callback_tests;
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/dataflow/callback_tests.rs b/crates/rustack-stepfunctions-core/src/dataflow/callback_tests.rs
new file mode 100644
index 00000000..77611386
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/dataflow/callback_tests.rs
@@ -0,0 +1,397 @@
+//! Structural provenance, single source consumption and actual history DTO boundaries.
+
+use std::error::Error;
+
+use chrono::Utc;
+use proptest::prelude::*;
+use rstest::rstest;
+use rustack_stepfunctions_model::types::{
+    HistoryEvent, HistoryEventType, TaskScheduledEventDetails,
+};
+use serde_json::{Value, json};
+use uuid::{Builder, Uuid};
+
+use crate::{
+    AslError, CallbackParameters, CallbackToken, DataFlow, EvaluationContext, MAX_PAYLOAD_BYTES,
+    Payload, UuidSource,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+#[derive(Debug, Default)]
+struct Ids {
+    calls: u8,
+    fail: bool,
+}
+impl UuidSource for Ids {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        self.calls = self.calls.checked_add(1).ok_or(AslError::WorkLimit)?;
+        if self.fail {
+            return Err(AslError::WorkLimit);
+        }
+        Ok(Builder::from_random_bytes([self.calls; 16]).into_uuid())
+    }
+}
+fn secret() -> String {
+    "a".repeat(64)
+}
+fn token() -> CallbackToken {
+    secret().parse().unwrap()
+}
+fn original() -> Payload {
+    Payload::from_value(&json!({"n":21,"Task":{"Token":"business"},"extra":{"flag":true}})).unwrap()
+}
+fn context() -> EvaluationContext {
+    EvaluationContext::from_value(&json!({"Execution":{"Name":"Run"},"State":{"Name":"Call","RetryCount":2},"TaskLike":{"Token":"ordinary"}})).unwrap()
+}
+fn prepare(config: &Value) -> Result<CallbackParameters, AslError> {
+    DataFlow::compile(config)?.prepare_callback_with_source(
+        &original(),
+        &context(),
+        &token(),
+        &mut Ids::default(),
+    )
+}
+
+#[rstest]
+#[case("$", false, false)]
+#[case("$.n", false, false)]
+#[case("$['Task']['Token']", false, false)]
+#[case("$$.Task.Token", true, true)]
+#[case("$$['Task']['Token']", true, true)]
+#[case("$$.Task", true, true)]
+#[case("$$", true, true)]
+#[case("$$[*]", true, true)]
+#[case("$$[*].Token", true, true)]
+#[case("$$.Task[*]", true, true)]
+#[case("$$[*][*]", true, true)]
+#[case("$$.Task.Token[*]", false, false)]
+#[case("$$.Task[0:1]", false, false)]
+#[case("$$.Task[*][0:1]", false, false)]
+#[case("$$.TaskLike.Token", false, false)]
+#[case("$$['TaskLike'].Token", false, false)]
+#[case("$$.State[*]", false, false)]
+#[case("$$.Execution", false, false)]
+#[case("$$.Execution.Name", false, false)]
+fn test_should_classify_compiled_context_token_paths_ancestors_and_wildcards(
+    #[case] path: &str,
+    #[case] sensitive: bool,
+    #[case] contains_token: bool,
+) -> TestResult {
+    let pair = prepare(&json!({"Parameters":{"value.$":path}}))?;
+    assert_eq!(pair.history().redacted(), sensitive);
+    assert_eq!(
+        pair.outbound().value()["value"]
+            .to_string()
+            .contains(&secret()),
+        contains_token
+    );
+    if sensitive {
+        assert!(pair.history().payload().value()["value"].is_null());
+    } else {
+        assert_eq!(pair.history().payload().value(), pair.outbound().value());
+    }
+    Ok(())
+}
+#[rstest]
+#[case("States.Format('{}:{}', $$.Task.Token, States.UUID())", true, true, 1)]
+#[case("States.JsonToString($$.Task)", true, true, 0)]
+#[case("States.StringToJson(States.JsonToString($$.Task))", true, true, 0)]
+#[case(
+    "States.ArrayGetItem(States.Array($$.Task.Token, 'public'),1)",
+    true,
+    false,
+    0
+)]
+#[case("States.ArrayLength($$.Task[*])", true, false, 0)]
+#[case(
+    "States.ArrayContains(States.Array($$.Task.Token),'public')",
+    true,
+    false,
+    0
+)]
+#[case("States.ArrayPartition(States.Array($$.Task.Token),1)", true, true, 0)]
+#[case("States.StringSplit($$.Task.Token,'x')", true, true, 0)]
+#[case(
+    "States.MathAdd(States.ArrayLength(States.Array($$.Task.Token)),1)",
+    true,
+    false,
+    0
+)]
+#[case("States.JsonMerge($$.Task,$.extra,false)", true, true, 0)]
+#[case("States.UUID()", false, false, 1)]
+#[case("States.Format('literal:$$.Task.Token')", false, false, 0)]
+fn test_should_conservatively_propagate_sensitive_intrinsic_arguments_without_scanning_results(
+    #[case] expression: &str,
+    #[case] sensitive: bool,
+    #[case] contains_token: bool,
+    #[case] calls: u8,
+) -> TestResult {
+    let mut source = Ids::default();
+    let flow = DataFlow::compile(&json!({"Parameters":{"value.$":expression}}))?;
+    let pair = flow.prepare_callback_with_source(&original(), &context(), &token(), &mut source)?;
+    assert_eq!(source.calls, calls);
+    assert_eq!(pair.history().redacted(), sensitive);
+    assert_eq!(
+        pair.outbound().value()["value"]
+            .to_string()
+            .contains(&secret()),
+        contains_token
+    );
+    if sensitive {
+        assert!(pair.history().payload().value()["value"].is_null());
+    } else {
+        assert_eq!(pair.outbound().value(), pair.history().payload().value());
+    }
+    Ok(())
+}
+#[rstest]
+#[case(Some("$$.Task"), "$.Token", true)]
+#[case(Some("$$"), "$.Task.Token", true)]
+#[case(Some("$$"), "$.Execution.Name", true)]
+#[case(Some("$$.Execution"), "$.Name", false)]
+#[case(Some("$"), "$.n", false)]
+#[case(None, "$$.Task.Token", true)]
+fn test_should_propagate_sensitive_effective_input_into_data_references(
+    #[case] input: Option<&str>,
+    #[case] expression: &str,
+    #[case] sensitive: bool,
+) -> TestResult {
+    let pair = prepare(
+        &json!({"InputPath":input,"Parameters":{"value.$":expression,"id.$":"States.UUID()","literal":true}}),
+    )?;
+    assert_eq!(pair.history().redacted(), sensitive);
+    if sensitive {
+        assert!(pair.history().payload().value()["value"].is_null());
+    } else {
+        assert_eq!(
+            pair.history().payload().value()["value"],
+            pair.outbound().value()["value"]
+        );
+    }
+    assert_eq!(
+        pair.history().payload().value()["id"],
+        pair.outbound().value()["id"]
+    );
+    assert_eq!(pair.history().payload().value()["literal"], true);
+    Ok(())
+}
+#[rstest]
+#[case(Some("$$.Task"), true)]
+#[case(Some("$$.Task.Token"), true)]
+#[case(Some("$$"), true)]
+#[case(Some("$"), false)]
+#[case(None, false)]
+fn test_should_project_omitted_parameters_with_effective_input_provenance(
+    #[case] input: Option<&str>,
+    #[case] sensitive: bool,
+) -> TestResult {
+    let pair = prepare(&json!({"InputPath":input}))?;
+    assert_eq!(pair.history().redacted(), sensitive);
+    if sensitive {
+        assert!(pair.history().payload().value().is_null());
+    } else {
+        assert_eq!(pair.history().payload().value(), pair.outbound().value());
+    }
+    Ok(())
+}
+#[test]
+fn test_should_preserve_literal_and_business_values_equal_to_token_without_reinterpreting_text()
+-> TestResult {
+    let input = Payload::from_value(&json!({"same":secret()}))?;
+    let flow = DataFlow::compile(
+        &json!({"Parameters":{"fixed":secret(),"business.$":"$.same","text":"$$.Task.Token","actual.$":"$$.Task.Token"}}),
+    )?;
+    let pair =
+        flow.prepare_callback_with_source(&input, &context(), &token(), &mut Ids::default())?;
+    assert_eq!(pair.history().payload().value()["fixed"], secret());
+    assert_eq!(pair.history().payload().value()["business"], secret());
+    assert_eq!(pair.history().payload().value()["text"], "$$.Task.Token");
+    assert!(pair.history().payload().value()["actual"].is_null());
+    Ok(())
+}
+#[test]
+fn test_should_evaluate_nested_template_once_and_preserve_untainted_uuid_in_both_projections()
+-> TestResult {
+    let original = Payload::parse(b" { \"n\":21 } ")?;
+    let base = context();
+    let before = base.value().clone();
+    let mut source = Ids::default();
+    let flow = DataFlow::compile(
+        &json!({"Parameters":{"a.$":"States.UUID()","nested":[{"token.$":"$$.Task.Token","n.$":"$.n"},"$$.Task.Token"],"z.$":"States.Format('{}:{}',$$.Task.Token,States.UUID())"}}),
+    )?;
+    let pair = flow.prepare_callback_with_source(&original, &base, &token(), &mut source)?;
+    assert_eq!(source.calls, 2);
+    assert_eq!(
+        pair.outbound().value()["a"],
+        pair.history().payload().value()["a"]
+    );
+    assert!(Uuid::parse_str(pair.outbound().value()["a"].as_str().ok_or("UUID")?).is_ok());
+    assert!(pair.history().payload().value()["nested"][0]["token"].is_null());
+    assert_eq!(pair.history().payload().value()["nested"][0]["n"], 21);
+    assert_eq!(
+        pair.history().payload().value()["nested"][1],
+        "$$.Task.Token"
+    );
+    assert!(pair.history().payload().value()["z"].is_null());
+    assert_eq!(base.value(), &before);
+    assert_eq!(original.original_bytes(), b" { \"n\":21 } ");
+    for rendered in [
+        format!("{pair:?}"),
+        format!("{:?}", pair.history()),
+        format!("{base:?}"),
+    ] {
+        assert!(!rendered.contains(&secret()));
+    }
+    assert!(base.value().get("Task").is_none());
+    Ok(())
+}
+#[rstest]
+#[case(&json!({"Task":null}))]
+#[case(&json!({"Task":{}}))]
+#[case(&json!({"Task":{"Token":"old"}}))]
+#[case(&json!({"Task":"wrong"}))]
+#[case(&json!([]))]
+#[case(&json!(null))]
+fn test_should_reject_stale_or_nonobject_context_before_consuming_uuid_source(
+    #[case] value: &Value,
+) -> TestResult {
+    let base = EvaluationContext::from_value(value)?;
+    let mut source = Ids::default();
+    let flow = DataFlow::compile(
+        &json!({"Parameters":{"id.$":"States.UUID()","token.$":"$$.Task.Token"}}),
+    )?;
+    assert!(matches!(
+        flow.prepare_callback_with_source(&original(), &base, &token(), &mut source),
+        Err(AslError::InvalidCallbackContext)
+    ));
+    assert_eq!(source.calls, 0);
+    assert_eq!(base.value(), value);
+    Ok(())
+}
+#[test]
+fn test_should_keep_source_and_selection_failures_without_returning_partial_pair() -> TestResult {
+    let input = original();
+    let base = context();
+    let flow =
+        DataFlow::compile(&json!({"Parameters":{"a.$":"States.UUID()","z.$":"$$.Task.Token"}}))?;
+    let mut source = Ids {
+        calls: 0,
+        fail: true,
+    };
+    assert!(matches!(
+        flow.prepare_callback_with_source(&input, &base, &token(), &mut source),
+        Err(AslError::WorkLimit)
+    ));
+    assert_eq!(source.calls, 1);
+    assert!(matches!(
+        prepare(&json!({"Parameters":{"missing.$":"$.missing"}})),
+        Err(AslError::Missing)
+    ));
+    assert!(base.value().get("Task").is_none());
+    Ok(())
+}
+#[test]
+fn test_should_enforce_outbound_limit_even_when_history_would_be_small() -> TestResult {
+    let input = Payload::from_value(&json!({"body":"x".repeat(MAX_PAYLOAD_BYTES-20)}))?;
+    let flow = DataFlow::compile(
+        &json!({"Parameters":{"value.$":"States.Format('{}{}',$$.Task.Token,$.body)"}}),
+    )?;
+    assert!(matches!(
+        flow.prepare_callback_with_source(&input, &context(), &token(), &mut Ids::default()),
+        Err(AslError::DataLimit)
+    ));
+    Ok(())
+}
+#[test]
+fn test_should_bound_history_redaction_expansion_independently_of_valid_outbound() -> TestResult {
+    let overhead = serde_json::to_vec(&json!({"body":"","n":1}))?.len();
+    for (spare, success) in [(0, false), (3, true)] {
+        let body = "x".repeat(MAX_PAYLOAD_BYTES - overhead - spare);
+        let flow = DataFlow::compile(
+            &json!({"Parameters":{"body":body,"n.$":"States.ArrayLength(States.Array($$.Task.Token))"}}),
+        )?;
+        let result = flow.prepare_callback_with_source(
+            &original(),
+            &context(),
+            &token(),
+            &mut Ids::default(),
+        );
+        if success {
+            let pair = result?;
+            assert_eq!(
+                pair.outbound().original_bytes().len(),
+                MAX_PAYLOAD_BYTES - 3
+            );
+            assert_eq!(
+                pair.history().payload().original_bytes().len(),
+                MAX_PAYLOAD_BYTES
+            );
+            assert!(pair.history().payload().value()["n"].is_null());
+        } else {
+            assert!(matches!(result, Err(AslError::DataLimit)));
+        }
+    }
+    Ok(())
+}
+#[test]
+fn test_should_serialize_null_redacted_parameters_through_the_official_history_model() -> TestResult
+{
+    let pair = prepare(
+        &json!({"Parameters":{"FunctionName":"Worker","Payload":{"token.$":"$$.Task.Token","n.$":"$.n"}}}),
+    )?;
+    let details = TaskScheduledEventDetails::builder()
+        .parameters(String::from_utf8(
+            pair.history().payload().original_bytes().to_vec(),
+        )?)
+        .region("us-east-1".into())
+        .resource("invoke.waitForTaskToken".into())
+        .resource_type("lambda".into())
+        .build();
+    let mut event = HistoryEvent::builder()
+        .id(1)
+        .r#type(HistoryEventType::TaskScheduled)
+        .timestamp(Utc::now())
+        .build();
+    event.task_scheduled_event_details = Some(details);
+    let encoded = serde_json::to_string(&event)?;
+    assert!(!encoded.contains(&secret()));
+    let projected: Value = serde_json::from_str(&encoded)?;
+    let fields = projected["taskScheduledEventDetails"]
+        .as_object()
+        .ok_or("event details")?;
+    assert_eq!(fields.len(), 4);
+    assert!(!fields.contains_key("truncated"));
+    assert!(!fields.contains_key("parametersDetails"));
+    let params: Value = serde_json::from_str(fields["parameters"].as_str().ok_or("parameters")?)?;
+    assert_eq!(
+        params,
+        json!({"FunctionName":"Worker","Payload":{"token":null,"n":21}})
+    );
+    let decoded: HistoryEvent = serde_json::from_str(&encoded)?;
+    assert_eq!(decoded.r#type, HistoryEventType::TaskScheduled);
+    Ok(())
+}
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_never_emit_injected_token_from_successful_compiled_context_path_projection(
+        segments in prop::collection::vec(0_u8..7,0..5), context_root in any::<bool>(), bytes in any::<[u8;32]>()
+    ){
+        let text=hex::encode(bytes);let credential:CallbackToken=text.parse().unwrap();
+        let mut path=if context_root {"$$".to_owned()}else{"$".to_owned()};
+        for segment in segments{path.push_str(match segment{0=>".Task",1=>"['Token']",2=>".Execution",3=>"[*]",4=>"[0]",5=>"[0:1]",_=>".Other"});}
+        let flow=DataFlow::compile(&json!({"Parameters":{"value.$":path}})).unwrap();
+        if let Ok(pair)=flow.prepare_callback_with_source(&original(),&context(),&credential,&mut Ids::default()){
+            prop_assert!(!pair.history().payload().value().to_string().contains(&text));
+            if pair.outbound().value().to_string().contains(&text){prop_assert!(pair.history().redacted());}
+        }
+    }
+    #[test]
+    fn test_should_preserve_arbitrary_untainted_business_fields_and_same_uuid_result(n in any::<i64>(), label in "[a-z]{0,32}"){
+        let input=Payload::from_value(&json!({"n":n,"label":label})).unwrap();let mut source=Ids::default();
+        let flow=DataFlow::compile(&json!({"Parameters":{"n.$":"$.n","label.$":"$.label","id.$":"States.UUID()","token.$":"$$.Task.Token"}})).unwrap();
+        let pair=flow.prepare_callback_with_source(&input,&context(),&token(),&mut source).unwrap();
+        prop_assert_eq!(source.calls,1);prop_assert_eq!(&pair.history().payload().value()["n"],&json!(n));prop_assert_eq!(&pair.history().payload().value()["label"],&input.value()["label"]);
+        prop_assert_eq!(&pair.outbound().value()["id"],&pair.history().payload().value()["id"]);prop_assert!(pair.history().payload().value()["token"].is_null());
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/dataflow/tests.rs b/crates/rustack-stepfunctions-core/src/dataflow/tests.rs
new file mode 100644
index 00000000..4e63fdef
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/dataflow/tests.rs
@@ -0,0 +1,182 @@
+use std::error::Error;
+
+use proptest::prelude::*;
+use rstest::rstest;
+use serde_json::{Map, Value, json};
+
+use crate::{AslError, DataFlow, EvaluationContext, Payload};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+#[test]
+fn test_should_execute_all_four_independent_pipeline_catalog_cases() -> TestResult {
+    let catalog: Value = serde_json::from_str(include_str!(
+        "../../../../tests/workflows/semantic-cases.json"
+    ))?;
+    let mut count = 0;
+    for case in catalog["cases"].as_array().ok_or("missing catalog")? {
+        if case["kind"] != "pipeline" {
+            continue;
+        }
+        let mut config = Map::new();
+        for (source, target) in [
+            ("inputPath", "InputPath"),
+            ("parameters", "Parameters"),
+            ("resultSelector", "ResultSelector"),
+            ("resultPath", "ResultPath"),
+            ("outputPath", "OutputPath"),
+        ] {
+            if let Some(value) = case.get(source) {
+                config.insert(target.to_owned(), value.clone());
+            }
+        }
+        let flow = DataFlow::compile(&Value::Object(config))?;
+        let input = Payload::from_value(&case["input"])?;
+        let context = EvaluationContext::from(&input);
+        assert_eq!(
+            flow.prepare(&input, &context)?.value(),
+            &case["expectedTaskInput"]
+        );
+        let result = Payload::from_value(&case["rawResult"])?;
+        assert_eq!(
+            flow.finish(&input, &result, &context)?.value(),
+            &case["expected"],
+            "{}",
+            case["id"]
+        );
+        assert_eq!(input.value(), &case["input"]);
+        count += 1;
+    }
+    assert_eq!(count, 4);
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({"Unknown":true}))]
+#[case(json!({"Type":"Pass"}))]
+#[case(json!([]))]
+#[case(json!({"InputPath":1}))]
+#[case(json!({"OutputPath":false}))]
+#[case(json!({"ResultPath":1}))]
+#[case(json!({"ResultPath":"$$.State"}))]
+#[case(json!({"Parameters":null}))]
+#[case(json!({"ResultSelector":[]}))]
+fn test_should_reject_invalid_dataflow_fields_without_defaulting(#[case] config: Value) {
+    assert!(DataFlow::compile(&config).is_err());
+}
+
+#[test]
+fn test_should_distinguish_json_null_from_null_path_and_preserve_original_raw_bytes() -> TestResult
+{
+    let null = Payload::parse(b" null ")?;
+    let context = EvaluationContext::from(&null);
+    let default = DataFlow::parse(b"{}")?;
+    assert!(default.prepare(&null, &context)?.value().is_null());
+    let empty = DataFlow::parse(br#"{"InputPath":null}"#)?;
+    assert_eq!(empty.prepare(&null, &context)?.value(), &json!({}));
+    assert_eq!(null.original_bytes(), b" null ");
+    let original = Payload::parse(br#" { "keep":1,"request":{"n":2} } "#)?;
+    let bytes = original.original_bytes().to_vec();
+    let flow=DataFlow::parse(br#"{"InputPath":"$.request","Parameters":{"n.$":"States.MathAdd($.n,1)"},"ResultSelector":{"answer.$":"$.raw"},"ResultPath":"$.result","OutputPath":"$.result"}"#)?;
+    let context = EvaluationContext::from(&original);
+    assert_eq!(flow.prepare(&original, &context)?.value(), &json!({"n":3}));
+    assert_eq!(
+        flow.finish(&original, &Payload::parse(br#"{"raw":9}"#)?, &context)?
+            .value(),
+        &json!({"answer":9})
+    );
+    assert_eq!(original.original_bytes(), bytes);
+    assert_eq!(format!("{flow:?}"), "DataFlow(<redacted>)");
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_intermediate_limits_before_later_discarding_operations() -> TestResult {
+    let input = Payload::from_value(&json!({"x":"a".repeat(140_000)}))?;
+    let result = Payload::from_value(&json!({"x":"b".repeat(140_000)}))?;
+    let context = EvaluationContext::from(&input);
+    let merge = DataFlow::compile(&json!({"ResultPath":"$.result","OutputPath":null}))?;
+    assert!(matches!(
+        merge.finish(&input, &result, &context),
+        Err(AslError::DataLimit)
+    ));
+    let selector = DataFlow::compile(
+        &json!({"ResultSelector":{"a.$":"$.x","b.$":"$.x"},"ResultPath":null,"OutputPath":null}),
+    )?;
+    assert!(matches!(
+        selector.finish(&input, &result, &context),
+        Err(AslError::DataLimit)
+    ));
+    let parameters =
+        DataFlow::compile(&json!({"Parameters":{"a.$":"$.x","b.$":"$.x"},"OutputPath":null}))?;
+    assert!(matches!(
+        parameters.prepare(&input, &context),
+        Err(AslError::DataLimit)
+    ));
+    let invalid = DataFlow::compile(&json!({"ResultPath":"$.missing[0]","OutputPath":null}))?;
+    assert!(matches!(
+        invalid.finish(&input, &result, &context),
+        Err(AslError::Merge)
+    ));
+    assert!(DataFlow::parse(br#"{"InputPath":null,"InputPath":"$"}"#).is_err());
+    Ok(())
+}
+
+#[test]
+fn test_should_keep_default_and_explicit_root_path_materialization_equivalent() -> TestResult {
+    let raw = format!("[{}]", vec!["1e9"; 30_000].join(","));
+    let input = Payload::parse(raw.as_bytes())?;
+    let context = EvaluationContext::from(&input);
+    for config in [json!({}), json!({"InputPath":"$"})] {
+        assert!(matches!(
+            DataFlow::compile(&config)?.prepare(&input, &context),
+            Err(AslError::DataLimit)
+        ));
+    }
+    assert_eq!(
+        DataFlow::compile(&json!({"InputPath":null}))?
+            .prepare(&input, &context)?
+            .value(),
+        &json!({})
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_share_result_phase_budget_between_selector_and_output_path() -> TestResult {
+    let original = Payload::parse(b"null")?;
+    let result = Payload::from_value(&json!(vec![0; 6000]))?;
+    let context = EvaluationContext::from(&original);
+    let selector = json!({"ResultSelector":{"all.$":"$[*]"}});
+    assert_eq!(
+        DataFlow::compile(&selector)?
+            .finish(&original, &result, &context)?
+            .value()["all"]
+            .as_array()
+            .ok_or("missing array")?
+            .len(),
+        6000
+    );
+    let both = json!({"ResultSelector":{"all.$":"$[*]"},"OutputPath":"$.all[*]"});
+    assert!(matches!(
+        DataFlow::compile(&both)?.finish(&original, &result, &context),
+        Err(AslError::WorkLimit)
+    ));
+    assert!(matches!(
+        DataFlow::compile(&json!({"InputPath":"$.absent"}))?.prepare(&original, &context),
+        Err(AslError::Missing)
+    ));
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_preserve_original_under_discarded_results(n in any::<i64>(), result in any::<i64>()) {
+        let original=Payload::from_value(&json!({"n":n})).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let result=Payload::from_value(&json!(result)).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let flow=DataFlow::compile(&json!({"ResultPath":null})).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let output=flow.finish(&original,&result,&EvaluationContext::from(&original)).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(output.value(),original.value());
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/callback.rs b/crates/rustack-stepfunctions-core/src/engine/callback.rs
new file mode 100644
index 00000000..12fee260
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/callback.rs
@@ -0,0 +1,140 @@
+//! Credential-free callback instructions, materialized only after token registration.
+
+use std::{
+    fmt,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use chrono::{DateTime, Utc};
+use rustack_stepfunctions_model::types::HistoryEvent;
+
+use super::history::events;
+use crate::{
+    AslError, AttemptId, CallbackHistory, CallbackInvocationMetadata, CallbackToken,
+    CompiledMachine, EvaluationContext, Integration, Payload, StateId, StateView, TaskDispatch,
+    UuidSource,
+};
+
+#[derive(Debug, Clone)]
+pub(super) struct CallbackIdentity {
+    pub(super) attempt: AttemptId,
+    pub(super) state: StateId,
+    pub(super) deadline: Instant,
+    pub(super) timeout: Option<u32>,
+    pub(super) heartbeat: Option<Duration>,
+}
+/// One immutable callback attempt awaiting its exact registered token.
+///
+/// This effect contains no credential and performs no registration or invocation.
+/// Its owner must check current frame/generation/control/deadline, register the
+/// token, charge retained work, then commit typed history before business issuance.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct CallbackDispatch {
+    pub(super) identity: CallbackIdentity,
+    pub(super) machine: Arc<CompiledMachine>,
+    pub(super) input: Payload,
+    pub(super) context: EvaluationContext,
+}
+impl fmt::Debug for CallbackDispatch {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackDispatch(<redacted>)")
+    }
+}
+macro_rules! read {
+    ($name:ident,$out:ty,$s:ident=>$body:expr,$doc:literal) => {
+        #[doc=$doc]
+        #[doc=concat!("\n```\n# fn inspect(effect:&rustack_stepfunctions_core::CallbackDispatch){let value=effect.",stringify!($name),"();}\n```")]
+        #[must_use] pub fn $name(&self)->$out {let $s=self;$body}
+    };
+}
+impl CallbackDispatch {
+    read!(attempt,AttemptId,s=>s.identity.attempt,"Read the assigned generation before token registration.");
+    read!(state,StateId,s=>s.identity.state,"Read the state in the captured lexical machine.");
+    read!(deadline,Instant,s=>s.identity.deadline,"Read the original absolute Task/execution minimum deadline.");
+    read!(timeout_seconds,Option<u32>,s=>s.identity.timeout,"Read explicit resolved timeout seconds for history; omission stays omitted.");
+    read!(heartbeat,Option<Duration>,s=>s.identity.heartbeat,"Read the optional validated heartbeat interval; no timer starts here.");
+    read!(machine,&Arc<CompiledMachine>,s=>&s.machine,"Read the exact artifact captured before token registration.");
+    /// Project required scheduled parameters exclusively from typed safe history.
+    ///
+    /// # Errors
+    /// Returns typed encoding/instruction errors; no credential source is serialized.
+    ///
+    /// ```
+    /// # fn event(e:&rustack_stepfunctions_core::CallbackDispatch,h:&rustack_stepfunctions_core::CallbackHistory){let event=e.scheduled_event(h,chrono::Utc::now());}
+    /// ```
+    pub fn scheduled_event(
+        &self,
+        history: &CallbackHistory,
+        wall: DateTime<Utc>,
+    ) -> Result<HistoryEvent, AslError> {
+        events::scheduled_callback(
+            &self.machine,
+            self.state(),
+            history,
+            self.timeout_seconds().map(i64::from),
+            self.heartbeat()
+                .map(|value| i64::try_from(value.as_secs()).map_err(|_| AslError::InvalidExecution))
+                .transpose()?,
+            wall,
+        )
+    }
+    /// Project actual invocation metadata, marking the omitted function body truncated.
+    ///
+    /// # Errors
+    /// Returns typed bounded metadata/event encoding errors.
+    ///
+    /// ```
+    /// # fn event(e:&rustack_stepfunctions_core::CallbackDispatch,m:&rustack_stepfunctions_core::CallbackInvocationMetadata){let event=e.submitted_event(m,chrono::Utc::now());}
+    /// ```
+    pub fn submitted_event(
+        &self,
+        metadata: &CallbackInvocationMetadata,
+        wall: DateTime<Utc>,
+    ) -> Result<HistoryEvent, AslError> {
+        events::task_submitted(&self.machine, self.state(), &metadata.payload()?, wall)
+    }
+    /// Materialize one outbound invocation and separately typed history together.
+    ///
+    /// The caller supplies the exact token registered for this frame/generation.
+    /// This pure method does not prove registration, current ownership or time;
+    /// the async owner must fence these before/after bounded CPU work. Repeating
+    /// preparation cannot authorize another invocation or history publication.
+    ///
+    /// # Errors
+    /// Preserves typed template/context/quota/entropy failures with no partial
+    /// output. The effect's captured original input/context remain unchanged.
+    ///
+    /// ```
+    /// # fn prepare(e:&rustack_stepfunctions_core::CallbackDispatch,t:&rustack_stepfunctions_core::CallbackToken){let values=e.prepare_with_source(t,&mut rustack_stepfunctions_core::SystemUuidSource::default());}
+    /// ```
+    pub fn prepare_with_source<S: UuidSource + ?Sized>(
+        &self,
+        token: &CallbackToken,
+        source: &mut S,
+    ) -> Result<(TaskDispatch, CallbackHistory), AslError> {
+        let StateView::Task {
+            flow,
+            resource: Integration::LambdaCallback(_),
+            ..
+        } = self.machine.state(self.identity.state)?
+        else {
+            return Err(AslError::InvalidStateId);
+        };
+        let prepared =
+            flow.prepare_callback_with_source(&self.input, &self.context, token, source)?;
+        Ok((
+            TaskDispatch {
+                attempt: self.identity.attempt,
+                state: self.identity.state,
+                parameters: prepared.outbound,
+                deadline: self.identity.deadline,
+            },
+            prepared.history,
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/engine/callback/tests.rs b/crates/rustack-stepfunctions-core/src/engine/callback/tests.rs
new file mode 100644
index 00000000..33f0b8cc
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/callback/tests.rs
@@ -0,0 +1,603 @@
+//! Independent callback instruction/effect and generated-history expectations.
+
+use std::{collections::BTreeSet, time::SystemTime};
+
+use chrono::Utc;
+use rstest::rstest;
+use serde_json::{Value, json};
+use uuid::Uuid;
+
+use super::*;
+use crate::{
+    AslCompiler, ClockSample, DriverStep, ExecutionDriver, ExecutionLimits, ExecutionOutcome,
+    ExecutionSource, FrameCapacity, FrameLimits, FrameScheduler, FrameUpdate, StateSupport,
+    TaskFailure, TaskSupport, TenantScope,
+};
+
+#[derive(Default)]
+struct Source {
+    uuids: usize,
+    fail: bool,
+}
+impl UuidSource for Source {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        self.uuids += 1;
+        if self.fail {
+            return Err(AslError::InvalidExecution);
+        }
+        Ok(Uuid::parse_str("00000000-0000-4000-8000-000000000001").unwrap())
+    }
+}
+impl ExecutionSource for Source {
+    fn random_u64(&mut self) -> Result<u64, AslError> {
+        Ok(0)
+    }
+}
+fn definition(extra: Value) -> Value {
+    let mut state = json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","Parameters":{"FunctionName":"Worker","Payload":{"n.$":"$.n","token.$":"$$.Task.Token","retry.$":"$$.State.RetryCount","uuid.$":"States.UUID()"}},"End":true});
+    let Value::Object(extra) = extra else {
+        panic!("object fixture");
+    };
+    state.as_object_mut().unwrap().extend(extra);
+    json!({"StartAt":"Call","States":{"Call":state}})
+}
+fn compile(definition: &Value) -> Arc<CompiledMachine> {
+    AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_state_support(StateSupport::Structured)
+        .with_callback_support(true)
+        .compile(&serde_json::to_vec(definition).unwrap())
+        .unwrap()
+        .machine()
+        .clone()
+}
+fn clock(base: Instant, seconds: u64) -> ClockSample {
+    ClockSample::new(base + Duration::from_secs(seconds), Utc::now())
+}
+fn driver(definition: &Value, input: &Value) -> (ExecutionDriver, Instant) {
+    let base = Instant::now();
+    (
+        ExecutionDriver::for_structured_owner(
+            compile(definition),
+            Payload::from_value(input).unwrap(),
+            EvaluationContext::from_value(
+                &json!({"Execution":{"Id":"actual-parent-context","Input":input}}),
+            )
+            .unwrap(),
+            clock(base, 0),
+            ExecutionLimits::new(Duration::from_secs(100), 1000).unwrap(),
+        )
+        .unwrap(),
+        base,
+    )
+}
+fn effect(
+    driver: &mut ExecutionDriver,
+    base: Instant,
+    seconds: u64,
+    source: &mut Source,
+) -> CallbackDispatch {
+    for _ in 0..10 {
+        if let DriverStep::Callback(effect) = driver.advance(clock(base, seconds), source).step() {
+            return effect.clone();
+        }
+    }
+    panic!("expected deferred callback")
+}
+#[test]
+fn test_should_require_explicit_callback_and_lambda_compiler_capabilities() {
+    let bytes = serde_json::to_vec(&definition(json!({}))).unwrap();
+    for (support, callback, expected) in [
+        (TaskSupport::Lambda, false, "RUSTACK_PROFILE_UNAVAILABLE"),
+        (TaskSupport::Disabled, true, "RUSTACK_DEPENDENCY_DISABLED"),
+    ] {
+        let error = AslCompiler::new(TenantScope::default(), support)
+            .with_callback_support(callback)
+            .compile(&bytes)
+            .unwrap_err();
+        assert_eq!(error.diagnostic().code(), expected);
+    }
+    assert!(compile(&definition(json!({}))).uses_callbacks());
+    for resource in [
+        "arn:aws-cn:states:::lambda:invoke.waitForTaskToken",
+        "arn:aws:states:::lambda:invoke.sync",
+        "arn:aws:states:::sqs:sendMessage.waitForTaskToken",
+    ] {
+        let mut source = definition(json!({}));
+        source["States"]["Call"]["Resource"] = json!(resource);
+        assert!(
+            AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+                .with_callback_support(true)
+                .compile(&serde_json::to_vec(&source).unwrap())
+                .is_err()
+        );
+    }
+}
+#[rstest]
+#[case(json!({"HeartbeatSeconds":0}))]
+#[case(json!({"HeartbeatSeconds":-1}))]
+#[case(json!({"HeartbeatSeconds":1.5}))]
+#[case(json!({"HeartbeatSeconds":100_000_000}))]
+#[case(json!({"HeartbeatSeconds":99_999_999}))]
+#[case(json!({"HeartbeatSeconds":true}))]
+#[case(json!({"HeartbeatSeconds":"5"}))]
+#[case(json!({"HeartbeatSeconds":5,"HeartbeatSecondsPath":"$.hb"}))]
+#[case(json!({"HeartbeatSecondsPath":5}))]
+#[case(json!({"HeartbeatSecondsPath":"$.hb[*]"}))]
+#[case(json!({"HeartbeatSeconds":5,"TimeoutSeconds":5}))]
+#[case(json!({"HeartbeatSeconds":6,"TimeoutSeconds":5}))]
+#[case(json!({"Parameters":{"FunctionName":"Worker","InvocationType":"Event"}}))]
+fn test_should_reject_invalid_callback_intervals_and_async_invocation(#[case] extra: Value) {
+    let source = definition(extra);
+    assert!(
+        AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+            .with_callback_support(true)
+            .compile(&serde_json::to_vec(&source).unwrap())
+            .is_err()
+    );
+}
+#[rstest]
+#[case("arn:aws:states:::lambda:invoke")]
+#[case("arn:aws:lambda:us-east-1:000000000000:function:Worker")]
+#[case("arn:aws:states:::states:startExecution.sync")]
+fn test_should_keep_heartbeat_unavailable_on_other_integrations(#[case] resource: &str) {
+    let mut source = definition(json!({"HeartbeatSeconds":5}));
+    source["States"]["Call"]["Resource"] = json!(resource);
+    let error = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_callback_support(true)
+        .with_child_support(true)
+        .compile(&serde_json::to_vec(&source).unwrap())
+        .unwrap_err();
+    assert_eq!(error.diagnostic().code(), "RUSTACK_PROFILE_UNAVAILABLE");
+}
+#[test]
+fn test_should_assign_attempt_and_original_input_intervals_before_evaluating_parameters_once() {
+    let source = definition(
+        json!({"InputPath":"$.payload","HeartbeatSecondsPath":"$.hb","TimeoutSecondsPath":"$.total"}),
+    );
+    let input = json!({"payload":{"n":21},"hb":10,"total":30,"untouched":"marker"});
+    let (mut driver, base) = driver(&source, &input);
+    let mut entropy = Source::default();
+    let deferred = effect(&mut driver, base, 0, &mut entropy);
+    assert_eq!(entropy.uuids, 0);
+    assert_eq!(deferred.deadline(), base + Duration::from_secs(30));
+    assert_eq!(deferred.timeout_seconds(), Some(30));
+    assert_eq!(deferred.heartbeat(), Some(Duration::from_secs(10)));
+    let token: CallbackToken = "a".repeat(64).parse().unwrap();
+    let (actual, history) = deferred.prepare_with_source(&token, &mut entropy).unwrap();
+    assert_eq!(entropy.uuids, 1);
+    assert_eq!(actual.attempt(), deferred.attempt());
+    assert_eq!(actual.state(), deferred.state());
+    assert_eq!(actual.deadline(), deferred.deadline());
+    assert_eq!(actual.parameters().value()["Payload"]["n"], 21);
+    assert_eq!(
+        actual.parameters().value()["Payload"]["token"],
+        token.expose()
+    );
+    assert_eq!(actual.parameters().value()["Payload"]["retry"], 0);
+    assert!(history.payload().value()["Payload"]["token"].is_null());
+    assert_eq!(
+        actual.parameters().value()["Payload"]["uuid"],
+        history.payload().value()["Payload"]["uuid"]
+    );
+    assert_eq!(driver.input().value(), &input);
+    assert!(deferred.context.value().get("Task").is_none());
+    assert!(!format!("{deferred:?}{history:?}{actual:?}").contains(token.expose()));
+}
+#[rstest]
+#[case(json!({"HeartbeatSeconds":40,"TimeoutSeconds":60}),Some(40),Some(60))]
+#[case(json!({"HeartbeatSeconds":99_999_998}),Some(99_999_998),None)]
+#[case(json!({}),None,None)]
+fn test_should_preserve_omission_and_compare_heartbeat_to_explicit_timeout_not_remaining_parent(
+    #[case] extra: Value,
+    #[case] heartbeat: Option<u64>,
+    #[case] timeout: Option<u32>,
+) {
+    let (mut driver, base) = driver(&definition(extra), &json!({"n":21}));
+    driver.deadline = base + Duration::from_secs(20);
+    let effect = effect(&mut driver, base, 0, &mut Source::default());
+    assert_eq!(effect.deadline(), base + Duration::from_secs(20));
+    assert_eq!(effect.timeout_seconds(), timeout);
+    assert_eq!(effect.heartbeat(), heartbeat.map(Duration::from_secs));
+}
+#[rstest]
+#[case(json!({"hb":0,"total":30}))]
+#[case(json!({"hb":-1,"total":30}))]
+#[case(json!({"hb":1.5,"total":30}))]
+#[case(json!({"hb":"5","total":30}))]
+#[case(json!({"hb":100_000_000,"total":30}))]
+#[case(json!({"hb":30,"total":30}))]
+#[case(json!({"hb":31,"total":30}))]
+#[case(json!({"total":30}))]
+#[case(json!({"hb":5,"total":null}))]
+fn test_should_fail_invalid_dynamic_intervals_before_allocating_an_attempt_or_template_work(
+    #[case] input: Value,
+) {
+    let (mut driver, base) = driver(
+        &definition(json!({"HeartbeatSecondsPath":"$.hb","TimeoutSecondsPath":"$.total"})),
+        &input,
+    );
+    let mut entropy = Source::default();
+    let result = driver.advance(clock(base, 0), &mut entropy);
+    assert!(
+        matches!(result.step(),DriverStep::Settled(terminal) if matches!(terminal.as_ref(),ExecutionOutcome::Failed(_)))
+    );
+    assert_eq!(driver.generation, 0);
+    assert_eq!(entropy.uuids, 0);
+}
+#[test]
+fn test_should_preserve_typed_preparation_errors_without_partial_values_or_mutating_driver() {
+    let (mut driver, base) = driver(&definition(json!({})), &json!({"n":21}));
+    let effect = effect(&mut driver, base, 0, &mut Source::default());
+    let token: CallbackToken = "a".repeat(64).parse().unwrap();
+    let mut entropy = Source {
+        fail: true,
+        ..Source::default()
+    };
+    assert!(matches!(
+        effect.prepare_with_source(&token, &mut entropy),
+        Err(AslError::InvalidExecution)
+    ));
+    assert_eq!(entropy.uuids, 1);
+    assert!(effect.context.value().get("Task").is_none());
+    assert!(driver.outcome().is_none());
+    let (_, history) = effect
+        .prepare_with_source(&token, &mut Source::default())
+        .unwrap();
+    assert!(history.redacted());
+}
+#[test]
+fn test_should_bind_callback_history_to_official_scheduled_and_truncated_submitted_schemas() {
+    let (mut driver, base) = driver(
+        &definition(json!({"TimeoutSeconds":30,"HeartbeatSeconds":10})),
+        &json!({"n":21}),
+    );
+    let effect = effect(&mut driver, base, 0, &mut Source::default());
+    let token: CallbackToken = "a".repeat(64).parse().unwrap();
+    let (actual, history) = effect
+        .prepare_with_source(&token, &mut Source::default())
+        .unwrap();
+    assert!(
+        events::scheduled(
+            effect.machine(),
+            effect.state(),
+            actual.parameters(),
+            Some(30),
+            Utc::now()
+        )
+        .is_err()
+    );
+    let scheduled = effect.scheduled_event(&history, Utc::now()).unwrap();
+    let wire = serde_json::to_value(&scheduled).unwrap();
+    assert_eq!(wire["type"], "TaskScheduled");
+    assert_eq!(
+        wire["taskScheduledEventDetails"]["resource"],
+        "invoke.waitForTaskToken"
+    );
+    assert_eq!(wire["taskScheduledEventDetails"]["timeoutInSeconds"], 30);
+    assert_eq!(wire["taskScheduledEventDetails"]["heartbeatInSeconds"], 10);
+    assert!(
+        wire["taskScheduledEventDetails"]
+            .get("parametersDetails")
+            .is_none()
+    );
+    assert!(!wire.to_string().contains(token.expose()));
+    let meta = CallbackInvocationMetadata::new(Uuid::new_v4(), "$LATEST").unwrap();
+    let submitted =
+        serde_json::to_value(effect.submitted_event(&meta, Utc::now()).unwrap()).unwrap();
+    assert_eq!(submitted["type"], "TaskSubmitted");
+    assert_eq!(
+        submitted["taskSubmittedEventDetails"]["outputDetails"]["truncated"],
+        true
+    );
+    let output: Value = serde_json::from_str(
+        submitted["taskSubmittedEventDetails"]["output"]
+            .as_str()
+            .unwrap(),
+    )
+    .unwrap();
+    assert!(output.get("Payload").is_none());
+    assert_eq!(
+        output["SdkResponseMetadata"]["RequestId"],
+        meta.request_id().to_string()
+    );
+}
+#[test]
+fn test_should_reuse_recovery_and_result_flow_with_fresh_callback_attempts_and_stale_rejection() {
+    let source = definition(
+        json!({"Retry":[{"ErrorEquals":["Busy"],"IntervalSeconds":1,"MaxAttempts":1}],"ResultSelector":{"selected.$":"$.value"},"ResultPath":"$.result","OutputPath":"$.result"}),
+    );
+    let (mut driver, base) = driver(&source, &json!({"n":21}));
+    let mut entropy = Source::default();
+    let first = effect(&mut driver, base, 0, &mut entropy);
+    let update = driver.complete(
+        first.attempt(),
+        Err(TaskFailure::new("Busy", None).unwrap()),
+        clock(base, 0),
+        &mut entropy,
+    );
+    assert!(matches!(update.step(), DriverStep::Park(_)));
+    let second = effect(&mut driver, base, 1, &mut entropy);
+    assert_ne!(first.attempt(), second.attempt());
+    let token: CallbackToken = "b".repeat(64).parse().unwrap();
+    let (actual, _) = second.prepare_with_source(&token, &mut entropy).unwrap();
+    assert_eq!(actual.parameters().value()["Payload"]["retry"], 1);
+    let _ = driver.complete(
+        first.attempt(),
+        Ok(Payload::parse(b"false").unwrap()),
+        clock(base, 1),
+        &mut entropy,
+    );
+    assert!(driver.outcome().is_none());
+    let _ = driver.complete(
+        second.attempt(),
+        Ok(Payload::parse(br#"{"value":42}"#).unwrap()),
+        clock(base, 1),
+        &mut entropy,
+    );
+    assert!(
+        matches!(driver.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(value) if value.value()==&json!({"selected":42}))
+    );
+    let _ = driver.complete(
+        second.attempt(),
+        Ok(Payload::parse(b"null").unwrap()),
+        clock(base, 1),
+        &mut entropy,
+    );
+    assert_eq!(entropy.uuids, 1);
+}
+#[test]
+fn test_should_charge_and_retire_distinct_callback_frames_with_equal_local_generations() {
+    let branch = definition(json!({}));
+    let source = json!({"StartAt":"Both","States":{"Both":{"Type":"Parallel","Branches":[branch.clone(),branch],"End":true}}});
+    let (driver, base) = driver(&source, &json!({"n":21}));
+    let capacity = Arc::new(FrameCapacity::default());
+    let mut frames = FrameScheduler::new(driver, capacity.clone(), FrameLimits::default()).unwrap();
+    let mut entropy = Source::default();
+    let mut calls = Vec::new();
+    for _ in 0..50 {
+        if let FrameUpdate::Transition(t) = frames.advance(clock(base, 0), &mut entropy) {
+            if matches!(t.step(), DriverStep::Callback(_)) {
+                calls.push(t.call().unwrap());
+            }
+        }
+        if calls.len() == 2 {
+            break;
+        }
+    }
+    assert_eq!(calls.len(), 2);
+    assert_eq!(calls[0].attempt(), calls[1].attempt());
+    assert_ne!(calls[0].frame(), calls[1].frame());
+    assert!(capacity.available_frames() < 4096);
+    assert_eq!(entropy.uuids, 0);
+    for (index, call) in calls.iter().enumerate().rev() {
+        frames
+            .complete(
+                *call,
+                Ok(Payload::from_value(&json!(index)).unwrap()),
+                clock(base, 0),
+                &mut entropy,
+            )
+            .unwrap();
+        frames.retired(*call).unwrap();
+    }
+    for _ in 0..100 {
+        let _ = frames.advance(clock(base, 0), &mut entropy);
+        if frames.outcome().is_some() {
+            break;
+        }
+    }
+    assert!(
+        matches!(frames.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(output) if output.value()==&json!([0,1]))
+    );
+}
+#[test]
+fn test_should_cancel_every_deferred_call_on_stop_and_wait_for_explicit_retirement() {
+    let (driver, base) = driver(&definition(json!({})), &json!({"n":21}));
+    let mut frames = FrameScheduler::new(
+        driver,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )
+    .unwrap();
+    let mut entropy = Source::default();
+    let call = loop {
+        if let FrameUpdate::Transition(t) = frames.advance(clock(base, 0), &mut entropy) {
+            if let Some(call) = t.call() {
+                break call;
+            }
+        }
+    };
+    let mut cancelled = BTreeSet::new();
+    if let FrameUpdate::Cancel(call) =
+        frames.stop(TaskFailure::new("Stopped", None).unwrap(), clock(base, 0))
+    {
+        cancelled.insert(call);
+    }
+    for _ in 0..20 {
+        if let FrameUpdate::Cancel(call) = frames.advance(clock(base, 0), &mut entropy) {
+            cancelled.insert(call);
+        }
+    }
+    assert_eq!(cancelled, BTreeSet::from([call]));
+    frames.retired(call).unwrap();
+    assert!(matches!(
+        frames.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+}
+#[test]
+fn test_should_reject_sequential_driver_admission_even_for_nested_callback_dependence() {
+    let branch = definition(json!({}));
+    for source in [
+        branch.clone(),
+        json!({"StartAt":"Both","States":{"Both":{"Type":"Parallel","Branches":[branch],"End":true}}}),
+    ] {
+        let machine = compile(&source);
+        assert!(machine.uses_callbacks());
+        assert!(machine.uses_lambda());
+        let payload = Payload::parse(b"{}").unwrap();
+        assert!(matches!(
+            ExecutionDriver::new(
+                machine,
+                payload.clone(),
+                EvaluationContext::from(&payload),
+                ClockSample::new(Instant::now(), SystemTime::now().into()),
+                ExecutionLimits::default()
+            ),
+            Err(AslError::StructuredExecutionRequired)
+        ));
+    }
+}
+
+#[rstest]
+#[case(json!({"HeartbeatSeconds":10,"TimeoutSeconds":30}),json!({"n":21}),Some(10))]
+#[case(json!({"HeartbeatSecondsPath":"$.hb","TimeoutSecondsPath":"$.total"}),json!({"n":21,"hb":15,"total":30}),Some(15))]
+#[case(json!({}),json!({"n":21}),None)]
+fn test_should_project_literal_dynamic_and_omitted_heartbeat_metadata(
+    #[case] extra: Value,
+    #[case] input: Value,
+    #[case] expected: Option<i64>,
+) {
+    let (mut driver, base) = driver(&definition(extra), &input);
+    let effect = effect(&mut driver, base, 0, &mut Source::default());
+    let token: CallbackToken = "a".repeat(64).parse().unwrap();
+    let (_, history) = effect
+        .prepare_with_source(&token, &mut Source::default())
+        .unwrap();
+    let wire = serde_json::to_value(effect.scheduled_event(&history, Utc::now()).unwrap()).unwrap();
+    assert_eq!(
+        wire["taskScheduledEventDetails"]
+            .get("heartbeatInSeconds")
+            .and_then(Value::as_i64),
+        expected
+    );
+    if expected.is_none() {
+        assert!(
+            wire["taskScheduledEventDetails"]
+                .get("heartbeatInSeconds")
+                .is_none()
+        );
+    }
+}
+#[test]
+fn test_should_recover_callback_failure_through_original_input_catch_and_ignore_late_success() {
+    let mut source = definition(
+        json!({"Catch":[{"ErrorEquals":["ExternalFailure"],"ResultPath":"$.failure","Next":"Done"}]}),
+    );
+    source["States"]["Done"] = json!({"Type":"Succeed"});
+    let (mut driver, base) = driver(&source, &json!({"n":21,"keep":"original"}));
+    let mut entropy = Source::default();
+    let effect = effect(&mut driver, base, 0, &mut entropy);
+    let _ = driver.complete(
+        effect.attempt(),
+        Err(TaskFailure::new("ExternalFailure", Some("cause")).unwrap()),
+        clock(base, 0),
+        &mut entropy,
+    );
+    let _ = driver.complete(
+        effect.attempt(),
+        Ok(Payload::parse(b"false").unwrap()),
+        clock(base, 0),
+        &mut entropy,
+    );
+    let _ = driver.advance(clock(base, 0), &mut entropy);
+    assert!(
+        matches!(driver.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!({"n":21,"keep":"original","failure":{"Error":"ExternalFailure","Cause":"cause"}}))
+    );
+}
+#[test]
+fn test_should_keep_absolute_task_timeout_and_discard_late_callback_result() {
+    let (mut driver, base) = driver(&definition(json!({"TimeoutSeconds":5})), &json!({"n":21}));
+    let mut entropy = Source::default();
+    let effect = effect(&mut driver, base, 0, &mut entropy);
+    let result = driver.complete(
+        effect.attempt(),
+        Ok(Payload::parse(b"true").unwrap()),
+        clock(base, 5),
+        &mut entropy,
+    );
+    assert_eq!(result.cancellation(), Some(effect.attempt()));
+    assert!(
+        matches!(driver.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Timeout"))
+    );
+    assert_eq!(entropy.uuids, 0);
+}
+
+mod admission;
+
+#[rstest]
+#[case(json!({"HeartbeatSeconds":5,"TimeoutSecondsPath":"$.total"}),json!({"total":6}),true)]
+#[case(json!({"HeartbeatSeconds":5,"TimeoutSecondsPath":"$.total"}),json!({"total":5}),false)]
+#[case(json!({"HeartbeatSecondsPath":"$.hb","TimeoutSeconds":6}),json!({"hb":5}),true)]
+#[case(json!({"HeartbeatSecondsPath":"$.hb","TimeoutSeconds":5}),json!({"hb":5}),false)]
+#[case(json!({"HeartbeatSecondsPath":"$.hb"}),json!({"hb":99_999_999}),false)]
+fn test_should_check_mixed_static_dynamic_interval_relation_and_omitted_validation_ceiling(
+    #[case] extra: Value,
+    #[case] input: Value,
+    #[case] valid: bool,
+) {
+    let (mut driver, base) = driver(&definition(extra), &input);
+    let mut entropy = Source::default();
+    let step = driver.advance(clock(base, 0), &mut entropy);
+    assert_eq!(matches!(step.step(), DriverStep::Callback(_)), valid);
+    assert_eq!(entropy.uuids, 0);
+    if !valid {
+        assert!(matches!(
+            driver.outcome().unwrap().as_ref(),
+            ExecutionOutcome::Failed(_)
+        ));
+        assert_eq!(driver.generation, 0);
+    }
+}
+#[test]
+fn test_should_prepare_map_callback_items_lazily_and_preserve_item_result_order() {
+    let source = json!({"StartAt":"Items","States":{"Items":{"Type":"Map","ItemSelector":{"n.$":"$$.Map.Item.Value"},"ItemProcessor":definition(json!({})),"End":true}}});
+    let (driver, base) = driver(&source, &json!([21, 22]));
+    let mut frames = FrameScheduler::new(
+        driver,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )
+    .unwrap();
+    let mut entropy = Source::default();
+    let mut effects = Vec::new();
+    for _ in 0..50 {
+        if let FrameUpdate::Transition(t) = frames.advance(clock(base, 0), &mut entropy) {
+            if let DriverStep::Callback(effect) = t.step() {
+                effects.push((t.call().unwrap(), effect.clone()));
+            }
+        }
+        if effects.len() == 2 {
+            break;
+        }
+    }
+    assert_eq!(effects.len(), 2);
+    assert_eq!(entropy.uuids, 0);
+    for (call, effect) in effects.iter().rev() {
+        let token: CallbackToken = "a".repeat(64).parse().unwrap();
+        let (dispatch, history) = effect.prepare_with_source(&token, &mut entropy).unwrap();
+        assert!(history.payload().value()["Payload"]["token"].is_null());
+        let n = dispatch.parameters().value()["Payload"]["n"]
+            .as_u64()
+            .unwrap();
+        frames
+            .complete(
+                *call,
+                Ok(Payload::from_value(&json!(n * 2)).unwrap()),
+                clock(base, 0),
+                &mut entropy,
+            )
+            .unwrap();
+        frames.retired(*call).unwrap();
+    }
+    for _ in 0..100 {
+        let _ = frames.advance(clock(base, 0), &mut entropy);
+        if frames.outcome().is_some() {
+            break;
+        }
+    }
+    assert_eq!(entropy.uuids, 2);
+    assert!(
+        matches!(frames.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!([42,44]))
+    );
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/callback/tests/admission.rs b/crates/rustack-stepfunctions-core/src/engine/callback/tests/admission.rs
new file mode 100644
index 00000000..3c5d7ea4
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/callback/tests/admission.rs
@@ -0,0 +1,102 @@
+//! Reject executable publication until its actual callback owner is installed.
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+use super::*;
+use crate::{
+    ExecutionError, ExecutionSupervisor, HistoryLimits, LambdaTaskCommand, LambdaTaskPort,
+    PreparedDefinition, Registry, RegistryCommand, RegistryError, RegistryLimits, RegistryResult,
+    RoleArn, RuntimeLimits, Tags, TaskCall,
+};
+
+#[derive(Debug, Default)]
+struct Port(AtomicUsize);
+impl LambdaTaskPort for Port {
+    fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        self.0.fetch_add(1, Ordering::SeqCst);
+        Err(TaskFailure::service_exception())
+    }
+}
+#[tokio::test]
+async fn test_should_reject_callback_runtime_and_registry_admission_before_any_issuance() {
+    let port = Arc::new(Port::default());
+    let mut runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        Some(port.clone()),
+    )
+    .unwrap();
+    let source = definition(json!({}));
+    let (driver, _) = driver(&source, &json!({"n":21}));
+    assert!(matches!(
+        runtime.start(driver.clone()),
+        Err(ExecutionError::Unavailable)
+    ));
+    assert!(matches!(
+        runtime.start_structured(driver),
+        Err(ExecutionError::Unavailable)
+    ));
+    let (registry, mut owner) = Registry::new_with_state_support(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+        StateSupport::Structured,
+    )
+    .unwrap();
+    let role: RoleArn = "arn:aws:iam::000000000000:role/Test".parse().unwrap();
+    for compiled in [
+        compile(&source),
+        compile(
+            &json!({"StartAt":"M","States":{"M":{"Type":"Map","ItemProcessor":source,"End":true}}}),
+        ),
+    ] {
+        assert!(matches!(
+            registry.submit(RegistryCommand::Create(
+                "Rejected".parse().unwrap(),
+                PreparedDefinition::new(compiled),
+                role.clone(),
+                Tags::default()
+            )),
+            Err(RegistryError::Validation)
+        ));
+    }
+    let until = tokio::time::Instant::now() + Duration::from_secs(5);
+    let RegistryResult::Machine(original) = registry
+        .submit(RegistryCommand::Create(
+            "Present".parse().unwrap(),
+            PreparedDefinition::new(compile(
+                &json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}}),
+            )),
+            role,
+            Tags::default(),
+        ))
+        .unwrap()
+        .wait(until)
+        .await
+        .unwrap()
+    else {
+        panic!("machine");
+    };
+    assert!(matches!(
+        registry.submit(RegistryCommand::Update(
+            original.arn().clone(),
+            Some(PreparedDefinition::new(compile(&source))),
+            None
+        )),
+        Err(RegistryError::Validation)
+    ));
+    let RegistryResult::Machine(after) = registry
+        .submit(RegistryCommand::Machine(original.arn().clone()))
+        .unwrap()
+        .wait(until)
+        .await
+        .unwrap()
+    else {
+        panic!("machine");
+    };
+    assert_eq!(original.revision().id(), after.revision().id());
+    assert_eq!(port.0.load(Ordering::SeqCst), 0);
+    owner.shutdown(until).await.unwrap();
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/fanout.rs b/crates/rustack-stepfunctions-core/src/engine/fanout.rs
new file mode 100644
index 00000000..c27eb3f2
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/fanout.rs
@@ -0,0 +1,394 @@
+//! Lazy immutable structured effects; the resource owner schedules and joins them.
+
+use std::{fmt, num::NonZeroUsize, sync::Arc, time::Instant};
+
+use serde_json::{Value, json};
+use thiserror::Error;
+
+use super::{
+    AttemptId, DriverStep, ExecutionDriver, ExecutionFailure, ExecutionSource, Phase,
+    types::FailureOrigin,
+};
+use crate::{
+    AslError, CompiledMachine, EvaluationContext, MapConcurrency, Payload, StateId, StateView,
+    TaskFailure, UuidSource, payload::encode,
+};
+
+const MAX_ITEMS: usize = 10_000;
+const INLINE_LIMIT: u8 = 40;
+
+#[derive(Debug, Clone)]
+enum Inputs {
+    Parallel,
+    Map(Payload),
+}
+
+/// Captured round input, context and lazy indexed branch descriptors.
+///
+/// This value does not own asynchronous calls or certify cleanup. The resource
+/// owner must enforce frame/transition/result-retention budgets independently.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct FanoutPlan {
+    machine: Arc<CompiledMachine>,
+    state: StateId,
+    attempt: AttemptId,
+    effective: Payload,
+    context: EvaluationContext,
+    base: EvaluationContext,
+    inputs: Inputs,
+    count: usize,
+    concurrency: NonZeroUsize,
+    deadline: Instant,
+}
+impl fmt::Debug for FanoutPlan {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("FanoutPlan(<redacted>)")
+    }
+}
+
+/// One lazy child's immutable machine, raw input and inherited base context.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct FanoutBranch {
+    machine: Arc<CompiledMachine>,
+    input: Payload,
+    context: EvaluationContext,
+}
+impl fmt::Debug for FanoutBranch {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("FanoutBranch(<redacted>)")
+    }
+}
+impl FanoutBranch {
+    /// Read this child's lexical machine; it is not a registrable root revision.
+    ///
+    /// ```
+    /// # fn inspect(branch: &rustack_stepfunctions_core::FanoutBranch) { let machine = branch.machine(); }
+    /// ```
+    #[must_use]
+    pub fn machine(&self) -> &Arc<CompiledMachine> {
+        &self.machine
+    }
+
+    /// Read the exact raw input selected for this branch or iteration.
+    ///
+    /// ```
+    /// # fn inspect(branch: &rustack_stepfunctions_core::FanoutBranch) { let input = branch.input(); }
+    /// ```
+    #[must_use]
+    pub fn input(&self) -> &Payload {
+        &self.input
+    }
+
+    /// Read inherited execution metadata, with no implicit Map.Item context.
+    ///
+    /// ```
+    /// # fn inspect(branch: &rustack_stepfunctions_core::FanoutBranch) { let context = branch.context(); }
+    /// ```
+    #[must_use]
+    pub fn context(&self) -> &EvaluationContext {
+        &self.context
+    }
+}
+
+/// A classified child terminal failure retaining its original typed source.
+#[derive(Error)]
+#[error("child workflow evaluation failed")]
+#[non_exhaustive]
+pub struct PropagatedFailure {
+    pub(super) failure: ExecutionFailure,
+    #[source]
+    pub(super) source: Arc<AslError>,
+}
+impl fmt::Debug for PropagatedFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("PropagatedFailure(<redacted>)")
+    }
+}
+impl PropagatedFailure {
+    /// Read the child's original bounded terminal classification and fields.
+    ///
+    /// ```
+    /// # fn inspect(failure:&rustack_stepfunctions_core::PropagatedFailure) { let details=failure.details(); }
+    /// ```
+    #[must_use]
+    pub fn details(&self) -> &ExecutionFailure {
+        &self.failure
+    }
+}
+
+/// A failed round, preserving typed interpreter errors separately from branch failures.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum FanoutFailure {
+    /// An uncaught branch failure after the owner joins cancelled siblings.
+    #[error("structured branch failed")]
+    Branch(ExecutionFailure),
+    /// A selector or aggregate failure after the same cleanup boundary.
+    #[error("structured evaluation failed")]
+    Evaluation(#[source] Arc<AslError>),
+    /// A child interpreter failure whose classification must not be recomputed.
+    #[error("structured child evaluation failed")]
+    Propagated(#[source] PropagatedFailure),
+    /// A local safety failure that bypasses business recovery.
+    #[error("structured safety limit exceeded")]
+    Unrecoverable(ExecutionFailure),
+}
+impl fmt::Debug for FanoutFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("FanoutFailure(<redacted>)")
+    }
+}
+impl From<AslError> for FanoutFailure {
+    fn from(error: AslError) -> Self {
+        Self::Evaluation(Arc::new(error))
+    }
+}
+impl From<TaskFailure> for FanoutFailure {
+    fn from(failure: TaskFailure) -> Self {
+        failure.0.into()
+    }
+}
+impl From<ExecutionFailure> for FanoutFailure {
+    fn from(failure: ExecutionFailure) -> Self {
+        match &failure.origin {
+            FailureOrigin::Business => Self::Branch(failure),
+            FailureOrigin::Evaluation(source) => {
+                let source = source.clone();
+                Self::Propagated(PropagatedFailure { failure, source })
+            }
+            FailureOrigin::Safety => Self::Unrecoverable(failure),
+        }
+    }
+}
+
+impl FanoutPlan {
+    /// Read the round generation required by `complete_fanout`.
+    ///
+    /// ```
+    /// # fn inspect(plan: &rustack_stepfunctions_core::FanoutPlan) { let attempt = plan.attempt(); }
+    /// ```
+    #[must_use]
+    pub fn attempt(&self) -> AttemptId {
+        self.attempt
+    }
+
+    /// Read the bounded total number of indexed children in this round.
+    ///
+    /// ```
+    /// # fn inspect(plan: &rustack_stepfunctions_core::FanoutPlan) { let count = plan.item_count(); }
+    /// ```
+    #[must_use]
+    pub fn item_count(&self) -> usize {
+        self.count
+    }
+
+    /// Read the normalized concurrency ceiling, before shared frame/task limits.
+    ///
+    /// ```
+    /// # fn inspect(plan: &rustack_stepfunctions_core::FanoutPlan) { let limit = plan.max_concurrency(); }
+    /// ```
+    #[must_use]
+    pub fn max_concurrency(&self) -> NonZeroUsize {
+        self.concurrency
+    }
+
+    /// Read the original absolute execution deadline; children must inherit it.
+    ///
+    /// ```
+    /// # fn inspect(plan: &rustack_stepfunctions_core::FanoutPlan) { let deadline = plan.deadline(); }
+    /// ```
+    #[must_use]
+    pub fn deadline(&self) -> Instant {
+        self.deadline
+    }
+
+    /// Prepare exactly one child by definition/item index, with lazy UUID sourcing.
+    ///
+    /// Async owners run this potentially entropy-bearing evaluation in a bounded
+    /// retained worker. Child execution must share the root deadline and budget.
+    ///
+    /// # Errors
+    /// Rejects invalid indices, selection/context failures and payload limits.
+    ///
+    /// ```
+    /// # fn child(plan: &rustack_stepfunctions_core::FanoutPlan) {
+    /// let child = plan.branch(0, &mut rustack_stepfunctions_core::SystemUuidSource::default());
+    /// # }
+    /// ```
+    pub fn branch<S: UuidSource + ?Sized>(
+        &self,
+        index: usize,
+        source: &mut S,
+    ) -> Result<FanoutBranch, AslError> {
+        if index >= self.count {
+            return Err(AslError::InvalidFanoutResult);
+        }
+        let (machine, input) = match (self.machine.state(self.state)?, &self.inputs) {
+            (StateView::Parallel { branches, .. }, Inputs::Parallel) => (
+                branches.get(index).ok_or(AslError::InvalidStateId)?.clone(),
+                self.effective.clone(),
+            ),
+            (
+                StateView::Map {
+                    processor,
+                    selector,
+                    ..
+                },
+                Inputs::Map(items),
+            ) => {
+                let item = items
+                    .value()
+                    .as_array()
+                    .and_then(|values| values.get(index))
+                    .ok_or(AslError::InvalidStateId)?;
+                let input = if let Some(selector) = selector {
+                    let mut context = self.context.value().clone();
+                    context
+                        .as_object_mut()
+                        .ok_or(AslError::InvalidExecution)?
+                        .insert(
+                            "Map".into(),
+                            json!({"Item":{"Index":index,"Value":item,"Source":"STATE_DATA"}}),
+                        );
+                    selector.evaluate_with_source(
+                        &self.effective,
+                        &EvaluationContext::from_value(&context)?,
+                        source,
+                    )?
+                } else {
+                    Payload::from_value(item)?
+                };
+                (processor.clone(), input)
+            }
+            _ => return Err(AslError::InvalidStateId),
+        };
+        Ok(FanoutBranch {
+            machine,
+            input,
+            context: self.base.clone(),
+        })
+    }
+
+    /// Encode exactly one output per child, ordering independently of completion.
+    ///
+    /// Input outputs must already have been charged to the owner's shared retained
+    /// result budget. The bounded writer rejects oversized aggregate materialization.
+    ///
+    /// # Errors
+    /// Rejects missing/duplicate/out-of-range indices and aggregate payload limits.
+    ///
+    /// ```
+    /// # fn collect(plan: &rustack_stepfunctions_core::FanoutPlan, outputs: &[(usize, rustack_stepfunctions_core::Payload)]) {
+    /// let result = plan.collect(outputs);
+    /// # }
+    /// ```
+    pub fn collect(&self, outputs: &[(usize, Payload)]) -> Result<Payload, AslError> {
+        if outputs.len() != self.count {
+            return Err(AslError::InvalidFanoutResult);
+        }
+        let mut ordered = vec![None; self.count];
+        for (index, output) in outputs {
+            let slot = ordered
+                .get_mut(*index)
+                .ok_or(AslError::InvalidFanoutResult)?;
+            if slot.is_some() {
+                return Err(AslError::InvalidFanoutResult);
+            }
+            *slot = Some(output.value());
+        }
+        let values = ordered
+            .into_iter()
+            .collect::<Option<Vec<_>>>()
+            .ok_or(AslError::InvalidFanoutResult)?;
+        Payload::from_bytes(encode(&values)?)
+    }
+}
+
+impl ExecutionDriver {
+    pub(super) fn fanout<S: ExecutionSource + ?Sized>(
+        &mut self,
+        source: &mut S,
+    ) -> Result<DriverStep, AslError> {
+        let machine = self.machine.clone();
+        let (effective, inputs, count, concurrency) = match machine.state(self.state)? {
+            StateView::Parallel { flow, branches, .. } => (
+                flow.prepare_with_source(&self.input, &self.context, source)?,
+                Inputs::Parallel,
+                branches.len(),
+                branches.len(),
+            ),
+            StateView::Map {
+                flow,
+                items,
+                concurrency,
+                ..
+            } => {
+                let effective = flow.prepare_with_source(&self.input, &self.context, source)?;
+                let selected = items
+                    .lookup(&effective, &self.context)
+                    .ok_or(AslError::Missing)?;
+                let count = selected
+                    .as_array()
+                    .filter(|items| items.len() <= MAX_ITEMS)
+                    .ok_or(AslError::InvalidMap)?
+                    .len();
+                let items = Payload::from_value(selected)?;
+                let concurrency = match concurrency {
+                    MapConcurrency::Limit(limit) => usize::from(limit.get()),
+                    MapConcurrency::Path(path) => {
+                        let number = path
+                            .lookup(&effective, &self.context)
+                            .and_then(Value::as_u64)
+                            .filter(|n| *n <= u64::from(INLINE_LIMIT))
+                            .ok_or(AslError::InvalidMap)?;
+                        if number == 0 {
+                            usize::from(INLINE_LIMIT)
+                        } else {
+                            usize::try_from(number).map_err(|_| AslError::InvalidMap)?
+                        }
+                    }
+                };
+                (effective, Inputs::Map(items), count, concurrency)
+            }
+            _ => return Err(AslError::InvalidStateId),
+        };
+        self.fanout_started = Some(count);
+        if count == 0 {
+            return self.finish_result(Payload::parse(b"[]"), source);
+        }
+        let base = if self.base.value().get("Map").is_some() {
+            let mut base = self.base.value().clone();
+            base.as_object_mut()
+                .ok_or(AslError::InvalidExecution)?
+                .remove("Map");
+            EvaluationContext::from_value(&base)?
+        } else {
+            self.base.clone()
+        };
+        self.generation = self
+            .generation
+            .checked_add(1)
+            .ok_or(AslError::InvalidExecution)?;
+        let attempt = AttemptId(self.generation);
+        let concurrency = NonZeroUsize::new(concurrency).ok_or(AslError::InvalidMap)?;
+        let plan = FanoutPlan {
+            machine,
+            state: self.state,
+            attempt,
+            effective,
+            context: self.context.clone(),
+            base,
+            inputs,
+            count,
+            concurrency,
+            deadline: self.deadline,
+        };
+        self.phase = Phase::Joining { attempt, count };
+        Ok(DriverStep::FanOut(plan))
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/engine/fanout/tests.rs b/crates/rustack-stepfunctions-core/src/engine/fanout/tests.rs
new file mode 100644
index 00000000..1bfae84b
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/fanout/tests.rs
@@ -0,0 +1,725 @@
+//! Explicit-clock structured frame semantics; no asynchronous owner is faked.
+
+use std::{
+    error::Error,
+    time::{Duration, Instant},
+};
+
+use chrono::Utc;
+use proptest::prelude::*;
+use rstest::rstest;
+use serde_json::{Value, json};
+use uuid::{Builder, Uuid};
+
+use crate::{
+    AslCompiler, AslError, ClockSample, DriverStep, EvaluationContext, ExecutionDriver,
+    ExecutionError, ExecutionFailure, ExecutionLimits, ExecutionOutcome, ExecutionSource,
+    ExecutionSupervisor, FanoutFailure, FanoutPlan, HistoryLimits, MAX_PAYLOAD_BYTES, Payload,
+    RuntimeLimits, StateSupport, TaskFailure, TaskSupport, TenantScope, UuidSource,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+#[derive(Default)]
+struct Source {
+    uuids: u64,
+    draws: usize,
+}
+impl UuidSource for Source {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        self.uuids += 1;
+        let mut bytes = [0_u8; 16];
+        bytes
+            .get_mut(8..)
+            .ok_or(AslError::InvalidExecution)?
+            .copy_from_slice(&self.uuids.to_be_bytes());
+        Ok(Builder::from_random_bytes(bytes).into_uuid())
+    }
+}
+impl ExecutionSource for Source {
+    fn random_u64(&mut self) -> Result<u64, AslError> {
+        self.draws += 1;
+        Ok(u64::MAX)
+    }
+}
+fn now() -> ClockSample {
+    ClockSample::new(Instant::now(), Utc::now())
+}
+fn after(start: ClockSample, seconds: u32) -> ClockSample {
+    ClockSample::new(
+        start.monotonic + Duration::from_secs(u64::from(seconds)),
+        start.wall + chrono::Duration::seconds(i64::from(seconds)),
+    )
+}
+fn definition(state: Value) -> Value {
+    let mut definition = json!({"StartAt":"Run","States":{}});
+    definition["States"]["Run"] = state;
+    definition
+}
+fn leaf() -> Value {
+    definition(json!({"Type":"Succeed"}))
+}
+fn map() -> Value {
+    definition(json!({"Type":"Map","ItemProcessor":leaf(),"End":true}))
+}
+fn parallel(count: usize) -> Value {
+    definition(json!({"Type":"Parallel","Branches":vec![leaf();count],"End":true}))
+}
+fn driver(
+    definition: &Value,
+    input: &Value,
+    base: &Value,
+    start: ClockSample,
+) -> Result<ExecutionDriver, Box<dyn Error>> {
+    let compiled = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_state_support(StateSupport::Structured)
+        .compile(&serde_json::to_vec(definition)?)?;
+    Ok(ExecutionDriver::for_structured_owner(
+        compiled.machine().clone(),
+        Payload::from_value(input)?,
+        EvaluationContext::from_value(base)?,
+        start,
+        ExecutionLimits::new(Duration::from_secs(60), 1000)?,
+    )?)
+}
+fn plan(
+    driver: &mut ExecutionDriver,
+    now: ClockSample,
+    source: &mut Source,
+) -> Result<FanoutPlan, Box<dyn Error>> {
+    let DriverStep::FanOut(plan) = driver.advance(now, source).step else {
+        return Err("expected FanOut".into());
+    };
+    Ok(plan)
+}
+fn output(driver: &ExecutionDriver) -> Result<&Value, Box<dyn Error>> {
+    let Some(outcome) = driver.outcome() else {
+        return Err("missing outcome".into());
+    };
+    let ExecutionOutcome::Succeeded(payload) = outcome.as_ref() else {
+        return Err("expected success".into());
+    };
+    Ok(payload.value())
+}
+fn failure(driver: &ExecutionDriver) -> Result<&ExecutionFailure, Box<dyn Error>> {
+    let Some(outcome) = driver.outcome() else {
+        return Err("missing outcome".into());
+    };
+    let ExecutionOutcome::Failed(failure) = outcome.as_ref() else {
+        return Err("expected failure".into());
+    };
+    Ok(failure)
+}
+
+#[test]
+fn test_should_prepare_parallel_inputs_and_merge_ordered_results_into_original_input() -> TestResult
+{
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = parallel(3);
+    definition["States"]["Run"]["InputPath"] = json!("$.selected");
+    definition["States"]["Run"]["Parameters"] = json!({"n.$":"States.MathAdd($.n,1)"});
+    definition["States"]["Run"]["ResultSelector"] = json!({"first.$":"$[0]","last.$":"$[2]"});
+    definition["States"]["Run"]["ResultPath"] = json!("$.joined");
+    let mut driver = driver(
+        &definition,
+        &json!({"selected":{"n":4},"keep":true}),
+        &json!({"Execution":{"Id":"root"}}),
+        start,
+    )?;
+    let plan = plan(&mut driver, start, &mut source)?;
+    assert_eq!(plan.item_count(), 3);
+    assert_eq!(plan.max_concurrency().get(), 3);
+    assert_eq!(plan.deadline(), driver.deadline());
+    for index in 0..3 {
+        let child = plan.branch(index, &mut source)?;
+        assert_eq!(child.input().value(), &json!({"n":5}));
+        assert_eq!(child.context().value(), &json!({"Execution":{"Id":"root"}}));
+        assert_eq!(child.machine().state_name(child.machine().start())?, "Run");
+    }
+    let joined = plan.collect(&[
+        (2, Payload::parse(b"30")?),
+        (0, Payload::parse(b"10")?),
+        (1, Payload::parse(b"20")?),
+    ])?;
+    let _ = driver.complete_fanout(plan.attempt(), Ok(joined), start, &mut source);
+    assert_eq!(
+        output(&driver)?,
+        &json!({"selected":{"n":4},"keep":true,"joined":{"first":10,"last":30}})
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case("ItemProcessor", "ItemSelector")]
+#[case("Iterator", "Parameters")]
+#[case("ItemProcessor", "Parameters")]
+#[case("Iterator", "ItemSelector")]
+fn test_should_select_items_lazily_with_enclosing_state_context_and_scoped_metadata(
+    #[case] processor_key: &str,
+    #[case] selector_key: &str,
+) -> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut state = json!({"Type":"Map","InputPath":"$.batch","ItemsPath":"$.items","MaxConcurrencyPath":"$.limit","End":true});
+    state[processor_key] = leaf();
+    state[selector_key] = json!({"item.$":"$$.Map.Item.Value","index.$":"$$.Map.Item.Index","source.$":"$$.Map.Item.Source","label.$":"$.label","state.$":"$$.State.Name","retry.$":"$$.State.RetryCount","uuid.$":"States.UUID()"});
+    let mut driver = driver(
+        &definition(state),
+        &json!({"batch":{"items":[null,7],"limit":1,"label":"selected"},"limit":41}),
+        &json!({"Execution":{"Id":"root"},"Map":{"Item":{"Index":999}}}),
+        start,
+    )?;
+    let plan = plan(&mut driver, start, &mut source)?;
+    assert_eq!(source.uuids, 0);
+    assert_eq!(plan.item_count(), 2);
+    assert_eq!(plan.max_concurrency().get(), 1);
+    let first = plan.branch(0, &mut source)?;
+    assert_eq!(source.uuids, 1);
+    let second = plan.branch(1, &mut source)?;
+    assert_eq!(source.uuids, 2);
+    assert_eq!(first.input().value().get("item"), Some(&Value::Null));
+    assert_eq!(second.input().value().get("item"), Some(&json!(7)));
+    assert_eq!(second.input().value().get("index"), Some(&json!(1)));
+    assert_eq!(
+        second.input().value().get("source"),
+        Some(&json!("STATE_DATA"))
+    );
+    assert_eq!(
+        second.input().value().get("label"),
+        Some(&json!("selected"))
+    );
+    assert_eq!(second.input().value().get("state"), Some(&json!("Run")));
+    assert_eq!(second.input().value().get("retry"), Some(&json!(0)));
+    assert_ne!(
+        first.input().value().get("uuid"),
+        second.input().value().get("uuid")
+    );
+    assert_eq!(first.context().value(), &json!({"Execution":{"Id":"root"}}));
+    assert_eq!(second.context().value(), first.context().value());
+    Ok(())
+}
+
+#[test]
+fn test_should_preserve_default_null_item_and_hide_map_namespace_from_processor_states()
+-> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = map();
+    definition["States"]["Run"]["ItemProcessor"] = self::definition(
+        json!({"Type":"Pass","Parameters":{"bad.$":"$$.Map.Item.Index"},"End":true}),
+    );
+    let mut driver = driver(&definition, &json!([null]), &json!({}), start)?;
+    let plan = plan(&mut driver, start, &mut source)?;
+    let branch = plan.branch(0, &mut source)?;
+    assert!(branch.input().value().is_null());
+    let mut child = ExecutionDriver::new(
+        branch.machine().clone(),
+        branch.input().clone(),
+        branch.context().clone(),
+        start,
+        ExecutionLimits::default(),
+    )?;
+    child.deadline = plan.deadline();
+    let _ = child.advance(start, &mut source);
+    assert_eq!(failure(&child)?.error(), Some("States.Runtime"));
+    Ok(())
+}
+
+#[test]
+fn test_should_finish_empty_map_without_child_or_selector_evaluation_and_apply_output_pipeline()
+-> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = map();
+    definition["States"]["Run"]["ItemsPath"] = json!("$.items");
+    definition["States"]["Run"]["ItemSelector"] =
+        json!({"uuid.$":"States.UUID()","missing.$":"$.absent"});
+    definition["States"]["Run"]["ResultSelector"] = json!({"count.$":"States.ArrayLength($)"});
+    definition["States"]["Run"]["ResultPath"] = json!("$.result");
+    definition["States"]["Run"]["OutputPath"] = json!("$.result");
+    let mut driver = driver(
+        &definition,
+        &json!({"items":[],"keep":true}),
+        &json!({}),
+        start,
+    )?;
+    let step = driver.advance(start, &mut source);
+    assert!(matches!(step.step, DriverStep::Settled(_)));
+    assert_eq!(source.uuids, 0);
+    assert_eq!(output(&driver)?, &json!({"count":0}));
+    Ok(())
+}
+
+#[rstest]
+#[case(json!(-1))]
+#[case(json!(1.5))]
+#[case(json!(1.0))]
+#[case(json!(41))]
+#[case(json!(null))]
+#[case(json!("1"))]
+#[case(json!(true))]
+#[case(json!({}))]
+fn test_should_reject_invalid_dynamic_concurrency_even_for_empty_map(
+    #[case] limit: Value,
+) -> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = map();
+    definition["States"]["Run"]["ItemsPath"] = json!("$.items");
+    definition["States"]["Run"]["MaxConcurrencyPath"] = json!("$.limit");
+    let mut driver = driver(
+        &definition,
+        &json!({"items":[],"limit":limit}),
+        &json!({}),
+        start,
+    )?;
+    let _ = driver.advance(start, &mut source);
+    assert_eq!(failure(&driver)?.error(), Some("States.Runtime"));
+    assert!(matches!(driver.diagnostic(), Some(AslError::InvalidMap)));
+    Ok(())
+}
+
+#[rstest]
+#[case(0, 40)]
+#[case(1, 1)]
+#[case(40, 40)]
+fn test_should_resolve_valid_dynamic_concurrency_from_effective_input(
+    #[case] limit: u8,
+    #[case] expected: usize,
+) -> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = map();
+    definition["States"]["Run"]["InputPath"] = json!("$.batch");
+    definition["States"]["Run"]["ItemsPath"] = json!("$.items");
+    definition["States"]["Run"]["MaxConcurrencyPath"] = json!("$.limit");
+    let mut driver = driver(
+        &definition,
+        &json!({"batch":{"items":[1],"limit":limit},"limit":41}),
+        &json!({}),
+        start,
+    )?;
+    assert_eq!(
+        plan(&mut driver, start, &mut source)?
+            .max_concurrency()
+            .get(),
+        expected
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case(json!(null))]
+#[case(json!({}))]
+#[case(json!(1))]
+fn test_should_reject_nonarray_map_input_without_spawning_descriptors(
+    #[case] input: Value,
+) -> TestResult {
+    let start = now();
+    let mut driver = driver(&map(), &input, &json!({}), start)?;
+    let _ = driver.advance(start, &mut Source::default());
+    assert_eq!(failure(&driver)?.error(), Some("States.Runtime"));
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_exact_item_limit_and_missing_reference_failure() -> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut exact = driver(&map(), &json!(vec![0; 10_000]), &json!({}), start)?;
+    let plan = plan(&mut exact, start, &mut source)?;
+    assert_eq!(plan.item_count(), 10_000);
+    assert!(matches!(
+        plan.branch(10_000, &mut source),
+        Err(AslError::InvalidFanoutResult)
+    ));
+    let mut over = driver(&map(), &json!(vec![0; 10_001]), &json!({}), start)?;
+    let _ = over.advance(start, &mut source);
+    assert_eq!(failure(&over)?.error(), Some("States.Runtime"));
+    let mut definition = map();
+    definition["States"]["Run"]["ItemsPath"] = json!("$.missing");
+    let mut missing = driver(&definition, &json!({}), &json!({}), start)?;
+    let _ = missing.advance(start, &mut source);
+    assert!(matches!(missing.diagnostic(), Some(AslError::Missing)));
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_aggregate_before_materializing_and_reject_invalid_index_sets() -> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut driver = driver(&parallel(1), &json!({}), &json!({}), start)?;
+    let plan = plan(&mut driver, start, &mut source)?;
+    let exact = Payload::from_value(&json!("x".repeat(MAX_PAYLOAD_BYTES - 4)))?;
+    assert_eq!(
+        plan.collect(&[(0, exact)])?.original_bytes().len(),
+        MAX_PAYLOAD_BYTES
+    );
+    let over = Payload::from_value(&json!("x".repeat(MAX_PAYLOAD_BYTES - 3)))?;
+    assert!(matches!(
+        plan.collect(&[(0, over)]),
+        Err(AslError::DataLimit)
+    ));
+    assert!(matches!(
+        plan.collect(&[]),
+        Err(AslError::InvalidFanoutResult)
+    ));
+    assert!(matches!(
+        plan.collect(&[(1, Payload::parse(b"null")?)]),
+        Err(AslError::InvalidFanoutResult)
+    ));
+    let mut driver = self::driver(&parallel(2), &json!({}), &json!({}), start)?;
+    let plan = self::plan(&mut driver, start, &mut source)?;
+    assert!(matches!(
+        plan.collect(&[(0, Payload::parse(b"1")?), (0, Payload::parse(b"2")?)]),
+        Err(AslError::InvalidFanoutResult)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_retry_whole_map_with_fresh_generation_context_and_unchanged_deadline() -> TestResult
+{
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = map();
+    definition["States"]["Run"]["ItemsPath"] = json!("$.items");
+    definition["States"]["Run"]["ItemSelector"] =
+        json!({"retry.$":"$$.State.RetryCount","entered.$":"$$.State.EnteredTime","n.$":"$.n"});
+    definition["States"]["Run"]["Retry"] =
+        json!([{"ErrorEquals":["Oops"],"IntervalSeconds":1,"MaxAttempts":1}]);
+    let raw = json!({"items":[7],"n":9});
+    let mut driver = driver(&definition, &raw, &json!({}), start)?;
+    let old = plan(&mut driver, start, &mut source)?;
+    let old_child = old.branch(0, &mut source)?;
+    let deadline = driver.deadline();
+    let update = driver.complete_fanout(
+        old.attempt(),
+        Err(TaskFailure::new("Oops", None)?.into()),
+        start,
+        &mut source,
+    );
+    assert!(matches!(update.step,DriverStep::Park(until) if until==after(start,1).monotonic));
+    assert_eq!(driver.input().value(), &raw);
+    assert_eq!(driver.retry_count(), 1);
+    assert!(matches!(
+        driver.advance(after(start, 1), &mut source).step,
+        DriverStep::Continue
+    ));
+    let fresh = plan(&mut driver, after(start, 1), &mut source)?;
+    let fresh_child = fresh.branch(0, &mut source)?;
+    assert_ne!(old.attempt(), fresh.attempt());
+    assert_eq!(fresh.deadline(), deadline);
+    assert_eq!(fresh_child.input().value().get("retry"), Some(&json!(1)));
+    assert_eq!(
+        old_child.input().value().get("entered"),
+        fresh_child.input().value().get("entered")
+    );
+    assert_eq!(fresh_child.input().value().get("n"), Some(&json!(9)));
+    let _ = driver.complete_fanout(
+        old.attempt(),
+        Ok(Payload::parse(b"[0]")?),
+        after(start, 1),
+        &mut source,
+    );
+    assert!(driver.outcome().is_none());
+    let _ = driver.complete(
+        fresh.attempt(),
+        Ok(Payload::parse(b"[99]")?),
+        after(start, 1),
+        &mut source,
+    );
+    assert!(driver.outcome().is_none());
+    let _ = driver.complete_fanout(
+        fresh.attempt(),
+        Ok(Payload::parse(b"[2]")?),
+        after(start, 1),
+        &mut source,
+    );
+    assert_eq!(output(&driver)?, &json!([2]));
+    let _ = driver.complete_fanout(
+        fresh.attempt(),
+        Ok(Payload::parse(b"[3]")?),
+        after(start, 1),
+        &mut source,
+    );
+    assert_eq!(output(&driver)?, &json!([2]));
+    Ok(())
+}
+
+#[test]
+fn test_should_not_apply_fanout_completion_to_lambda_attempt() -> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut driver = driver(
+        &definition(json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","End":true})),
+        &json!({}),
+        &json!({}),
+        start,
+    )?;
+    let DriverStep::Dispatch(call) = driver.advance(start, &mut source).step else {
+        return Err("missing Task effect".into());
+    };
+    let _ = driver.complete_fanout(
+        call.attempt(),
+        Ok(Payload::parse(b"[]")?),
+        start,
+        &mut source,
+    );
+    assert!(driver.outcome().is_none());
+    let _ = driver.complete(
+        call.attempt(),
+        Ok(Payload::parse(b"7")?),
+        start,
+        &mut source,
+    );
+    assert_eq!(output(&driver)?, &json!(7));
+    Ok(())
+}
+
+#[rstest]
+#[case(json!(null))]
+#[case(json!([]))]
+#[case(json!([1,2]))]
+fn test_should_fail_invalid_join_shape_as_internal_owner_error(#[case] value: Value) -> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut driver = driver(&parallel(1), &json!({}), &json!({}), start)?;
+    let plan = plan(&mut driver, start, &mut source)?;
+    let _ = driver.complete_fanout(
+        plan.attempt(),
+        Ok(Payload::from_value(&value)?),
+        start,
+        &mut source,
+    );
+    assert_eq!(failure(&driver)?.error(), Some("Rustack.InternalError"));
+    assert!(matches!(
+        driver.diagnostic(),
+        Some(AslError::InvalidFanoutResult)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_timeout_or_stop_pending_round_once_and_retain_cancellation_obligation() -> TestResult
+{
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = parallel(1);
+    definition["TimeoutSeconds"] = json!(2);
+    let mut expired = driver(&definition, &json!({}), &json!({}), start)?;
+    let plan = plan(&mut expired, start, &mut source)?;
+    assert_eq!(plan.deadline(), after(start, 2).monotonic);
+    assert!(
+        matches!(expired.advance(after(start,1),&mut source).step,DriverStep::Park(until) if until==plan.deadline())
+    );
+    let update = expired.complete_fanout(
+        plan.attempt(),
+        Ok(Payload::parse(b"[1]")?),
+        after(start, 2),
+        &mut source,
+    );
+    assert_eq!(update.cancellation(), Some(plan.attempt()));
+    assert!(matches!(
+        expired.outcome().map(AsRef::as_ref),
+        Some(ExecutionOutcome::TimedOut)
+    ));
+    let mut stopped = driver(&definition, &json!({}), &json!({}), start)?;
+    let plan = self::plan(&mut stopped, start, &mut source)?;
+    let update = stopped.stop(TaskFailure::new("Stopped", None)?, start);
+    assert_eq!(update.cancellation(), Some(plan.attempt()));
+    let _ = stopped.complete_fanout(
+        plan.attempt(),
+        Ok(Payload::parse(b"[2]")?),
+        start,
+        &mut source,
+    );
+    assert!(matches!(
+        stopped.outcome().map(AsRef::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    assert!(
+        stopped
+            .stop(TaskFailure::new("Second", None)?, start)
+            .cancellation()
+            .is_none()
+    );
+    Ok(())
+}
+
+fn catching(name: &str) -> Value {
+    json!({"StartAt":"Run","States":{"Run":{"Type":"Parallel","Branches":[leaf()],"Catch":[{"ErrorEquals":[name],"ResultPath":"$.caught","Next":"Recovered"}],"End":true},"Recovered":{"Type":"Succeed"}}})
+}
+#[test]
+fn test_should_recover_typed_data_limit_merge_raw_input_and_keep_fatal_runtime_uncatchable()
+-> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let raw = json!({"keep":true});
+    let mut recoverable = driver(
+        &catching("States.DataLimitExceeded"),
+        &raw,
+        &json!({}),
+        start,
+    )?;
+    let plan = plan(&mut recoverable, start, &mut source)?;
+    let _ = recoverable.complete_fanout(
+        plan.attempt(),
+        Err(AslError::DataLimit.into()),
+        start,
+        &mut source,
+    );
+    let _ = recoverable.advance(start, &mut source);
+    assert_eq!(output(&recoverable)?.get("keep"), Some(&json!(true)));
+    assert_eq!(
+        output(&recoverable)?
+            .get("caught")
+            .and_then(|v| v.get("Error")),
+        Some(&json!("States.DataLimitExceeded"))
+    );
+    assert!(matches!(
+        recoverable.diagnostic(),
+        Some(AslError::DataLimit)
+    ));
+    let mut fatal = driver(&catching("States.ALL"), &raw, &json!({}), start)?;
+    let plan = self::plan(&mut fatal, start, &mut source)?;
+    let _ = fatal.complete_fanout(
+        plan.attempt(),
+        Err(AslError::Missing.into()),
+        start,
+        &mut source,
+    );
+    assert_eq!(failure(&fatal)?.error(), Some("States.Runtime"));
+    assert!(matches!(fatal.diagnostic(), Some(AslError::Missing)));
+    Ok(())
+}
+
+#[test]
+fn test_should_match_omitted_branch_error_without_rewriting_unhandled_failure_fields() -> TestResult
+{
+    let start = now();
+    let mut source = Source::default();
+    let mut handled = driver(
+        &catching("States.TaskFailed"),
+        &json!({}),
+        &json!({}),
+        start,
+    )?;
+    let plan = plan(&mut handled, start, &mut source)?;
+    let _ = handled.complete_fanout(
+        plan.attempt(),
+        Err(FanoutFailure::Branch(ExecutionFailure::fields(None, None))),
+        start,
+        &mut source,
+    );
+    let _ = handled.advance(start, &mut source);
+    assert_eq!(output(&handled)?, &json!({"caught":{}}));
+    let mut unhandled = driver(&parallel(1), &json!({}), &json!({}), start)?;
+    let plan = self::plan(&mut unhandled, start, &mut source)?;
+    let _ = unhandled.complete_fanout(
+        plan.attempt(),
+        Err(FanoutFailure::Branch(ExecutionFailure::fields(
+            None,
+            Some("secret-cause".into()),
+        ))),
+        start,
+        &mut source,
+    );
+    assert_eq!(failure(&unhandled)?.error(), None);
+    assert_eq!(failure(&unhandled)?.cause(), Some("secret-cause"));
+    assert!(!format!("{unhandled:?}").contains("secret-cause"));
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_reject_structured_effect_driver_before_supervisor_admission() -> TestResult {
+    let start = now();
+    let driver = driver(&parallel(1), &json!({}), &json!({}), start)?;
+    let mut owner = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    assert!(matches!(
+        owner.start(driver),
+        Err(ExecutionError::Unavailable)
+    ));
+    owner
+        .drain(tokio::time::Instant::now() + Duration::from_secs(1))
+        .await?;
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(128))]
+    #[test]
+    fn test_should_collect_reversed_completion_order_by_item_index(count in 1_usize..80) {
+        let start=now(); let mut source=Source::default();
+        let mut driver=driver(&map(),&json!(vec![0;count]),&json!({}),start).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let plan=plan(&mut driver,start,&mut source).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let outputs=(0..count).rev().map(|index| Payload::from_value(&json!(index)).map(|value|(index,value))).collect::<Result<Vec<_>,_>>().map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let collected=plan.collect(&outputs).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(collected.value(),&json!((0..count).collect::<Vec<_>>()));
+    }
+}
+
+#[test]
+fn test_should_report_lazy_selector_errors_and_internal_failures_without_business_replay()
+-> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = catching("States.ALL");
+    definition["States"]["Run"] = json!({"Type":"Map","ItemProcessor":leaf(),"ItemSelector":{"bad.$":"$.absent"},"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Recovered"}],"End":true});
+    let mut driver = driver(&definition, &json!([1]), &json!({}), start)?;
+    let plan = plan(&mut driver, start, &mut source)?;
+    let error = plan
+        .branch(0, &mut source)
+        .err()
+        .ok_or("missing selector failure")?;
+    assert!(matches!(error, AslError::Missing));
+    let _ = driver.complete_fanout(plan.attempt(), Err(error.into()), start, &mut source);
+    assert_eq!(failure(&driver)?.error(), Some("States.Runtime"));
+    assert!(matches!(driver.diagnostic(), Some(AslError::Missing)));
+    let mut internal = self::driver(&catching("States.ALL"), &json!({}), &json!({}), start)?;
+    let plan = self::plan(&mut internal, start, &mut source)?;
+    let _ = internal.complete_fanout(
+        plan.attempt(),
+        Err(AslError::InvalidStateId.into()),
+        start,
+        &mut source,
+    );
+    assert_eq!(failure(&internal)?.error(), Some("Rustack.InternalError"));
+    assert!(matches!(
+        internal.diagnostic(),
+        Some(AslError::InvalidStateId)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_round_retry_without_remaining_transitions_before_entropy_or_count_mutation()
+-> TestResult {
+    let start = now();
+    let mut source = Source::default();
+    let mut definition = parallel(1);
+    definition["States"]["Run"]["Retry"] =
+        json!([{"ErrorEquals":["Oops"],"JitterStrategy":"FULL"}]);
+    let mut driver = driver(&definition, &json!({}), &json!({}), start)?;
+    driver.remaining = 1;
+    let plan = plan(&mut driver, start, &mut source)?;
+    let _ = driver.complete_fanout(
+        plan.attempt(),
+        Err(TaskFailure::new("Oops", None)?.into()),
+        start,
+        &mut source,
+    );
+    assert_eq!(
+        failure(&driver)?.error(),
+        Some("Rustack.TransitionLimitExceeded")
+    );
+    assert_eq!(driver.retry_count(), 0);
+    assert_eq!(source.draws, 0);
+    assert_eq!(source.uuids, 0);
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/history/events.rs b/crates/rustack-stepfunctions-core/src/engine/history/events.rs
new file mode 100644
index 00000000..909fe979
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/history/events.rs
@@ -0,0 +1,355 @@
+//! Official sequential history DTO construction; no source text in diagnostics.
+
+use std::str;
+
+use chrono::{DateTime, Utc};
+use rustack_stepfunctions_model::types::{
+    ExecutionAbortedEventDetails, ExecutionFailedEventDetails, ExecutionStartedEventDetails,
+    ExecutionSucceededEventDetails, ExecutionTimedOutEventDetails, HistoryEvent,
+    HistoryEventExecutionDataDetails, HistoryEventType, LambdaFunctionFailedEventDetails,
+    LambdaFunctionScheduleFailedEventDetails, LambdaFunctionScheduledEventDetails,
+    LambdaFunctionSucceededEventDetails, LambdaFunctionTimedOutEventDetails,
+    StateEnteredEventDetails, StateExitedEventDetails, TaskFailedEventDetails,
+    TaskScheduledEventDetails, TaskStartFailedEventDetails, TaskStartedEventDetails,
+    TaskSubmittedEventDetails, TaskSucceededEventDetails, TaskTimedOutEventDetails,
+};
+
+use crate::{
+    AslError, CallbackHistory, CompiledMachine, ExecutionOutcome, Integration, Payload, StateId,
+    StateView, TaskFailure,
+};
+
+pub(crate) fn event(kind: HistoryEventType, wall: DateTime<Utc>) -> HistoryEvent {
+    HistoryEvent::builder()
+        .id(0)
+        .timestamp(wall)
+        .r#type(kind)
+        .build()
+}
+fn text(payload: &Payload) -> Result<String, AslError> {
+    str::from_utf8(payload.original_bytes())
+        .map(str::to_owned)
+        .map_err(|_| AslError::InvalidExecution)
+}
+fn details() -> HistoryEventExecutionDataDetails {
+    let mut d = HistoryEventExecutionDataDetails::default();
+    d.truncated = Some(false);
+    d
+}
+pub(crate) fn started(input: &Payload, wall: DateTime<Utc>) -> Result<HistoryEvent, AslError> {
+    let mut e = event(HistoryEventType::ExecutionStarted, wall);
+    let mut d = ExecutionStartedEventDetails::default();
+    d.input = Some(text(input)?);
+    d.input_details = Some(details());
+    e.execution_started_event_details = Some(d);
+    Ok(e)
+}
+pub(crate) fn entered(
+    machine: &CompiledMachine,
+    state: StateId,
+    input: &Payload,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    let kind = match machine.state(state)? {
+        StateView::Pass { .. } => HistoryEventType::PassStateEntered,
+        StateView::Task { .. } => HistoryEventType::TaskStateEntered,
+        StateView::Wait { .. } => HistoryEventType::WaitStateEntered,
+        StateView::Choice { .. } => HistoryEventType::ChoiceStateEntered,
+        StateView::Succeed { .. } => HistoryEventType::SucceedStateEntered,
+        StateView::Fail { .. } => HistoryEventType::FailStateEntered,
+        StateView::Parallel { .. } => HistoryEventType::ParallelStateEntered,
+        StateView::Map { .. } => HistoryEventType::MapStateEntered,
+    };
+    let mut e = event(kind, wall);
+    let mut d = StateEnteredEventDetails::default();
+    d.name = machine.state_name(state)?.into();
+    d.input = Some(text(input)?);
+    d.input_details = Some(details());
+    e.state_entered_event_details = Some(d);
+    Ok(e)
+}
+pub(crate) fn exited(
+    machine: &CompiledMachine,
+    state: StateId,
+    output: &Payload,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    let kind = match machine.state(state)? {
+        StateView::Pass { .. } => HistoryEventType::PassStateExited,
+        StateView::Task { .. } => HistoryEventType::TaskStateExited,
+        StateView::Wait { .. } => HistoryEventType::WaitStateExited,
+        StateView::Choice { .. } => HistoryEventType::ChoiceStateExited,
+        StateView::Succeed { .. } => HistoryEventType::SucceedStateExited,
+        StateView::Fail { .. } => return Err(AslError::InvalidStateId),
+        StateView::Parallel { .. } => HistoryEventType::ParallelStateExited,
+        StateView::Map { .. } => HistoryEventType::MapStateExited,
+    };
+    let mut e = event(kind, wall);
+    let mut d = StateExitedEventDetails::default();
+    d.name = machine.state_name(state)?.into();
+    d.output = Some(text(output)?);
+    d.output_details = Some(details());
+    e.state_exited_event_details = Some(d);
+    Ok(e)
+}
+fn resource(machine: &CompiledMachine, state: StateId) -> Result<&Integration, AslError> {
+    match machine.state(state)? {
+        StateView::Task { resource, .. } => Ok(resource),
+        _ => Err(AslError::InvalidStateId),
+    }
+}
+fn metadata(resource: &Integration) -> (&'static str, &'static str) {
+    match resource {
+        Integration::StartExecution(pattern) => (pattern.action(), "states"),
+        Integration::LambdaCallback(_) => ("invoke.waitForTaskToken", "lambda"),
+        Integration::LambdaInvoke | Integration::DirectLambda(_) => ("invoke", "lambda"),
+    }
+}
+pub(crate) fn task_submitted(
+    machine: &CompiledMachine,
+    state: StateId,
+    output: &Payload,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    let integration = resource(machine, state)?;
+    if !matches!(integration, Integration::StartExecution(pattern) if pattern.owned())
+        && !matches!(integration, Integration::LambdaCallback(_))
+    {
+        return Err(AslError::InvalidStateId);
+    }
+    let mut e = event(HistoryEventType::TaskSubmitted, wall);
+    let mut d = TaskSubmittedEventDetails::default();
+    d.resource = metadata(integration).0.into();
+    d.resource_type = metadata(integration).1.into();
+    d.output = Some(text(output)?);
+    let mut output_details = details();
+    output_details.truncated = Some(matches!(integration, Integration::LambdaCallback(_)));
+    d.output_details = Some(output_details);
+    e.task_submitted_event_details = Some(d);
+    Ok(e)
+}
+pub(crate) fn scheduled(
+    machine: &CompiledMachine,
+    state: StateId,
+    input: &Payload,
+    timeout: Option<i64>,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    match resource(machine, state)? {
+        Integration::DirectLambda(arn) => {
+            let mut e = event(HistoryEventType::LambdaFunctionScheduled, wall);
+            let mut d = LambdaFunctionScheduledEventDetails::default();
+            d.input = Some(text(input)?);
+            d.input_details = Some(details());
+            d.resource = arn.as_str().into();
+            d.timeout_in_seconds = timeout;
+            e.lambda_function_scheduled_event_details = Some(d);
+            Ok(e)
+        }
+        integration @ (Integration::LambdaInvoke | Integration::StartExecution(_)) => {
+            task_scheduled(machine, integration, input, timeout, None, wall)
+        }
+        Integration::LambdaCallback(_) => Err(AslError::InvalidExecution),
+    }
+}
+pub(crate) fn scheduled_callback(
+    machine: &CompiledMachine,
+    state: StateId,
+    history: &CallbackHistory,
+    timeout: Option<i64>,
+    heartbeat: Option<i64>,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    let integration = resource(machine, state)?;
+    if !matches!(integration, Integration::LambdaCallback(_)) {
+        return Err(AslError::InvalidStateId);
+    }
+    task_scheduled(
+        machine,
+        integration,
+        history.payload(),
+        timeout,
+        heartbeat,
+        wall,
+    )
+}
+fn task_scheduled(
+    machine: &CompiledMachine,
+    integration: &Integration,
+    input: &Payload,
+    timeout: Option<i64>,
+    heartbeat: Option<i64>,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    let mut e = event(HistoryEventType::TaskScheduled, wall);
+    e.task_scheduled_event_details = Some(
+        TaskScheduledEventDetails::builder()
+            .parameters(text(input)?)
+            .region(machine.scope().region().into())
+            .resource(metadata(integration).0.into())
+            .resource_type(metadata(integration).1.into())
+            .timeout_in_seconds(timeout)
+            .heartbeat_in_seconds(heartbeat)
+            .build(),
+    );
+    Ok(e)
+}
+pub(crate) fn task_started(
+    machine: &CompiledMachine,
+    state: StateId,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    match resource(machine, state)? {
+        Integration::DirectLambda(_) => Ok(event(HistoryEventType::LambdaFunctionStarted, wall)),
+        integration @ (Integration::LambdaInvoke
+        | Integration::LambdaCallback(_)
+        | Integration::StartExecution(_)) => {
+            let mut e = event(HistoryEventType::TaskStarted, wall);
+            let mut d = TaskStartedEventDetails::default();
+            d.resource = metadata(integration).0.into();
+            d.resource_type = metadata(integration).1.into();
+            e.task_started_event_details = Some(d);
+            Ok(e)
+        }
+    }
+}
+pub(crate) fn task_success(
+    machine: &CompiledMachine,
+    state: StateId,
+    output: &Payload,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    match resource(machine, state)? {
+        Integration::DirectLambda(_) => {
+            let mut e = event(HistoryEventType::LambdaFunctionSucceeded, wall);
+            let mut d = LambdaFunctionSucceededEventDetails::default();
+            d.output = Some(text(output)?);
+            d.output_details = Some(details());
+            e.lambda_function_succeeded_event_details = Some(d);
+            Ok(e)
+        }
+        integration @ (Integration::LambdaInvoke
+        | Integration::LambdaCallback(_)
+        | Integration::StartExecution(_)) => {
+            let mut e = event(HistoryEventType::TaskSucceeded, wall);
+            let mut d = TaskSucceededEventDetails::default();
+            d.output = Some(text(output)?);
+            d.output_details = Some(details());
+            d.resource = metadata(integration).0.into();
+            d.resource_type = metadata(integration).1.into();
+            e.task_succeeded_event_details = Some(d);
+            Ok(e)
+        }
+    }
+}
+#[derive(Clone, Copy)]
+pub(crate) enum TaskFailureKind {
+    Failed,
+    TimedOut,
+    Admission,
+}
+pub(crate) fn task_failure(
+    machine: &CompiledMachine,
+    state: StateId,
+    failure: &TaskFailure,
+    kind: TaskFailureKind,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    let integration = resource(machine, state)?;
+    macro_rules! failure {
+        ($event:ident,$field:ident,$details:ident) => {{
+            let mut e = event(HistoryEventType::$event, wall);
+            let mut d = $details::default();
+            d.error.clone_from(&failure.0.error);
+            d.cause.clone_from(&failure.0.cause);
+            e.$field = Some(d);
+            e
+        }};
+        (optimized $event:ident,$field:ident,$details:ident) => {{
+            let mut e = failure!($event, $field, $details);
+            if let Some(d) = &mut e.$field {
+                d.resource = metadata(integration).0.into();
+                d.resource_type = metadata(integration).1.into();
+            }
+            e
+        }};
+    }
+    Ok(match (integration, kind) {
+        (Integration::DirectLambda(_), TaskFailureKind::Failed) => failure!(
+            LambdaFunctionFailed,
+            lambda_function_failed_event_details,
+            LambdaFunctionFailedEventDetails
+        ),
+        (Integration::DirectLambda(_), TaskFailureKind::TimedOut) => failure!(
+            LambdaFunctionTimedOut,
+            lambda_function_timed_out_event_details,
+            LambdaFunctionTimedOutEventDetails
+        ),
+        (Integration::DirectLambda(_), TaskFailureKind::Admission) => failure!(
+            LambdaFunctionScheduleFailed,
+            lambda_function_schedule_failed_event_details,
+            LambdaFunctionScheduleFailedEventDetails
+        ),
+        (
+            Integration::LambdaInvoke
+            | Integration::LambdaCallback(_)
+            | Integration::StartExecution(_),
+            TaskFailureKind::Failed,
+        ) => {
+            failure!(optimized TaskFailed,task_failed_event_details,TaskFailedEventDetails)
+        }
+        (
+            Integration::LambdaInvoke
+            | Integration::LambdaCallback(_)
+            | Integration::StartExecution(_),
+            TaskFailureKind::TimedOut,
+        ) => {
+            failure!(optimized TaskTimedOut,task_timed_out_event_details,TaskTimedOutEventDetails)
+        }
+        (
+            Integration::LambdaInvoke
+            | Integration::LambdaCallback(_)
+            | Integration::StartExecution(_),
+            TaskFailureKind::Admission,
+        ) => {
+            failure!(optimized TaskStartFailed,task_start_failed_event_details,TaskStartFailedEventDetails)
+        }
+    })
+}
+pub(crate) fn terminal(
+    outcome: &ExecutionOutcome,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, AslError> {
+    let e = match outcome {
+        ExecutionOutcome::Succeeded(output) => {
+            let mut e = event(HistoryEventType::ExecutionSucceeded, wall);
+            let mut d = ExecutionSucceededEventDetails::default();
+            d.output = Some(text(output)?);
+            d.output_details = Some(details());
+            e.execution_succeeded_event_details = Some(d);
+            e
+        }
+        ExecutionOutcome::Failed(f) => {
+            let mut e = event(HistoryEventType::ExecutionFailed, wall);
+            let mut d = ExecutionFailedEventDetails::default();
+            d.error.clone_from(&f.error);
+            d.cause.clone_from(&f.cause);
+            e.execution_failed_event_details = Some(d);
+            e
+        }
+        ExecutionOutcome::Aborted(f) => {
+            let mut e = event(HistoryEventType::ExecutionAborted, wall);
+            let mut d = ExecutionAbortedEventDetails::default();
+            d.error.clone_from(&f.0.error);
+            d.cause.clone_from(&f.0.cause);
+            e.execution_aborted_event_details = Some(d);
+            e
+        }
+        ExecutionOutcome::TimedOut => {
+            let mut e = event(HistoryEventType::ExecutionTimedOut, wall);
+            e.execution_timed_out_event_details = Some(ExecutionTimedOutEventDetails::default());
+            e
+        }
+    };
+    Ok(e)
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/history/mod.rs b/crates/rustack-stepfunctions-core/src/engine/history/mod.rs
new file mode 100644
index 00000000..9303ea7f
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/history/mod.rs
@@ -0,0 +1,480 @@
+//! Persistent bounded official history; retained views retain their global charge.
+
+use std::{
+    fmt,
+    mem::size_of,
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+};
+
+use rustack_stepfunctions_model::types::HistoryEvent;
+
+use super::runtime::ExecutionError;
+use crate::payload::encode_with_limit;
+
+pub(super) mod events;
+mod projection;
+#[cfg(test)]
+mod tests;
+
+const FIXED_OVERHEAD: usize = 1024;
+const TERMINAL_RESERVE: usize = 4096 + size_of::<StoredEvent>() + FIXED_OVERHEAD;
+const EVENT_BYTES: usize = 2 * 1024 * 1024;
+const PAGE_BYTES: usize = 4 * 1024 * 1024;
+const PAGE_EVENTS: usize = 64;
+
+pub(crate) fn snapshot_charge(
+    events: impl Iterator<Item = usize>,
+    terminal: bool,
+) -> Result<usize, ExecutionError> {
+    let mut events = events.peekable();
+    let mut bytes = TERMINAL_RESERVE;
+    while let Some(encoded) = events.next() {
+        let charge = encoded
+            .checked_add(size_of::<StoredEvent>())
+            .and_then(|value| value.checked_add(FIXED_OVERHEAD))
+            .ok_or(ExecutionError::Capacity)?;
+        let charge = if terminal && events.peek().is_none() {
+            charge.saturating_sub(TERMINAL_RESERVE)
+        } else {
+            charge
+        };
+        bytes = bytes.checked_add(charge).ok_or(ExecutionError::Capacity)?;
+    }
+    Ok(bytes)
+}
+
+/// Local per-execution history limits with one reserved termination event.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct HistoryLimits {
+    events: u32,
+    bytes: usize,
+}
+impl HistoryLimits {
+    /// Validate2..=25,000 events and1..=256MiB including terminal capacity.
+    ///
+    /// # Errors
+    /// Rejects out-of-range values.
+    ///
+    /// ```
+    /// let limits=rustack_stepfunctions_core::HistoryLimits::new(25_000,32*1024*1024)?;
+    /// # Ok::<(),rustack_stepfunctions_core::ExecutionError>(())
+    /// ```
+    pub fn new(events: u32, bytes: usize) -> Result<Self, ExecutionError> {
+        if !(2..=25_000).contains(&events) || !(1024 * 1024..=256 * 1024 * 1024).contains(&bytes) {
+            return Err(ExecutionError::Invalid);
+        }
+        Ok(Self { events, bytes })
+    }
+}
+impl Default for HistoryLimits {
+    fn default() -> Self {
+        Self {
+            events: 25_000,
+            bytes: 32 * 1024 * 1024,
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(super) struct HistoryCapacity {
+    used: AtomicUsize,
+    limit: usize,
+}
+impl HistoryCapacity {
+    pub(super) fn new(
+        limit: usize,
+        per_execution: HistoryLimits,
+    ) -> Result<Arc<Self>, ExecutionError> {
+        if !(8 * 1024 * 1024..=4_usize * 1024 * 1024 * 1024).contains(&limit)
+            || limit < per_execution.bytes
+        {
+            return Err(ExecutionError::Invalid);
+        }
+        Ok(Arc::new(Self {
+            used: AtomicUsize::new(0),
+            limit,
+        }))
+    }
+    fn reserve(self: &Arc<Self>, bytes: usize) -> Result<Charge, ExecutionError> {
+        self.used
+            .try_update(Ordering::AcqRel, Ordering::Acquire, |used| {
+                used.checked_add(bytes).filter(|next| *next <= self.limit)
+            })
+            .map_err(|_| ExecutionError::Capacity)?;
+        Ok(Charge {
+            capacity: self.clone(),
+            bytes,
+        })
+    }
+    pub(super) fn used(&self) -> usize {
+        self.used.load(Ordering::Acquire)
+    }
+}
+struct Charge {
+    capacity: Arc<HistoryCapacity>,
+    bytes: usize,
+}
+impl Drop for Charge {
+    fn drop(&mut self) {
+        self.capacity.used.fetch_sub(self.bytes, Ordering::AcqRel);
+    }
+}
+impl fmt::Debug for Charge {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("HistoryCharge")
+            .field("bytes", &self.bytes)
+            .finish_non_exhaustive()
+    }
+}
+#[derive(Debug)]
+pub(super) struct TerminalReserve {
+    _charge: Charge,
+}
+impl TerminalReserve {
+    pub(super) fn new(capacity: &Arc<HistoryCapacity>) -> Result<Arc<Self>, ExecutionError> {
+        Ok(Arc::new(Self {
+            _charge: capacity.reserve(TERMINAL_RESERVE)?,
+        }))
+    }
+}
+#[derive(Debug)]
+struct StoredEvent {
+    event: HistoryEvent,
+    encoded: usize,
+    _charge: EventCharge,
+}
+#[derive(Debug)]
+enum EventCharge {
+    Ordinary {
+        _charge: Charge,
+    },
+    Terminal {
+        _reserve: Arc<TerminalReserve>,
+        _extra: Option<Charge>,
+    },
+}
+#[derive(Debug)]
+struct HistoryChunk {
+    previous: Option<Arc<Self>>,
+    events: Vec<Arc<StoredEvent>>,
+}
+
+/// Immutable stable history boundary; append shares prior pages and business data.
+#[derive(Clone, Default)]
+#[non_exhaustive]
+pub struct ExecutionHistory {
+    head: Option<Arc<HistoryChunk>>,
+    count: u32,
+    charged: usize,
+}
+impl fmt::Debug for ExecutionHistory {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ExecutionHistory")
+            .field("count", &self.count)
+            .field("charged", &self.charged)
+            .finish_non_exhaustive()
+    }
+}
+/// A complete bounded page; pagination source is this history's fixed high water.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct HistoryPage {
+    events: Vec<HistoryEvent>,
+    next: Option<u32>,
+}
+impl HistoryPage {
+    /// Read complete official DTOs in the selected traversal order.
+    ///
+    /// ```
+    /// # fn inspect(page:&rustack_stepfunctions_core::HistoryPage) { let events=page.events(); }
+    /// ```
+    #[must_use]
+    pub fn events(&self) -> &[HistoryEvent] {
+        &self.events
+    }
+    /// Read the next inclusive ID, if this captured boundary has more records.
+    ///
+    /// ```
+    /// # fn inspect(page:&rustack_stepfunctions_core::HistoryPage) { let next=page.next_id(); }
+    /// ```
+    #[must_use]
+    pub fn next_id(&self) -> Option<u32> {
+        self.next
+    }
+}
+impl ExecutionHistory {
+    /// Read the captured number of events.
+    ///
+    /// ```
+    /// assert_eq!(rustack_stepfunctions_core::ExecutionHistory::default().len(),0);
+    /// ```
+    #[must_use]
+    pub fn len(&self) -> u32 {
+        self.count
+    }
+    /// Test whether this view contains no events.
+    ///
+    /// ```
+    /// assert!(rustack_stepfunctions_core::ExecutionHistory::default().is_empty());
+    /// ```
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.count == 0
+    }
+    /// Read global/per-execution charged bytes, including reserved terminal space.
+    ///
+    /// ```
+    /// assert_eq!(rustack_stepfunctions_core::ExecutionHistory::default().charged_bytes(),0);
+    /// ```
+    #[must_use]
+    pub fn charged_bytes(&self) -> usize {
+        self.charged
+    }
+    /// Read at most1,000 records with a4MiB complete-JSON page allowance.
+    ///
+    /// `first` is an inclusive ID in1..=len+1. Data-disabled projection removes
+    /// input/output and parameter-bearing scheduled details; linkage stays intact.
+    /// This is not an authenticated API pagination token.
+    ///
+    /// # Errors
+    /// Rejects invalid bounds or an impossible event encoding invariant.
+    ///
+    /// ```
+    /// let page=rustack_stepfunctions_core::ExecutionHistory::default().page(1,100,false)?;
+    /// assert!(page.events().is_empty());
+    /// # Ok::<(),rustack_stepfunctions_core::ExecutionError>(())
+    /// ```
+    pub fn page(
+        &self,
+        first: u32,
+        limit: usize,
+        include_data: bool,
+    ) -> Result<HistoryPage, ExecutionError> {
+        self.page_ordered(first, limit, include_data, false)
+    }
+    /// Read a descending complete page from this captured high-water boundary.
+    ///
+    /// # Errors
+    /// Rejects last outside1..len, except empty history accepts0; limit is1..1000.
+    ///
+    /// ```
+    /// let page=rustack_stepfunctions_core::ExecutionHistory::default().page_reverse(0,100,false)?;
+    /// assert!(page.events().is_empty());
+    /// # Ok::<(),rustack_stepfunctions_core::ExecutionError>(())
+    /// ```
+    pub fn page_reverse(
+        &self,
+        last: u32,
+        limit: usize,
+        include_data: bool,
+    ) -> Result<HistoryPage, ExecutionError> {
+        self.page_ordered(last, limit, include_data, true)
+    }
+    fn page_ordered(
+        &self,
+        first: u32,
+        limit: usize,
+        include_data: bool,
+        reverse: bool,
+    ) -> Result<HistoryPage, ExecutionError> {
+        let valid = if reverse {
+            (self.count == 0 && first == 0) || (first > 0 && first <= self.count)
+        } else {
+            first > 0 && first <= self.count.saturating_add(1)
+        };
+        if !valid || !(1..=1000).contains(&limit) {
+            return Err(ExecutionError::Invalid);
+        }
+        let mut records = Vec::new();
+        let mut head = self.head.as_deref();
+        while let Some(chunk) = head {
+            records.extend(chunk.events.iter().rev());
+            head = chunk.previous.as_deref();
+        }
+        if !reverse {
+            records.reverse();
+        }
+        let mut events = Vec::new();
+        let mut bytes = 256_usize;
+        let mut next = None;
+        for record in records.into_iter().filter(|r| {
+            if reverse {
+                r.event.id <= i64::from(first)
+            } else {
+                r.event.id >= i64::from(first)
+            }
+        }) {
+            if events.len() >= limit {
+                next = u32::try_from(record.event.id).ok();
+                break;
+            }
+            if include_data && bytes.saturating_add(record.encoded + 1) > PAGE_BYTES {
+                next = u32::try_from(record.event.id).ok();
+                break;
+            }
+            let mut event = record.event.clone();
+            let encoded = if include_data {
+                record.encoded
+            } else {
+                projection::omit_data(&mut event);
+                encode_with_limit(&event, EVENT_BYTES)
+                    .map_err(ExecutionError::from)?
+                    .len()
+            };
+            if bytes.saturating_add(encoded + 1) > PAGE_BYTES {
+                next = u32::try_from(record.event.id).ok();
+                break;
+            }
+            bytes = bytes.saturating_add(encoded + 1);
+            events.push(event);
+        }
+        Ok(HistoryPage { events, next })
+    }
+    pub(crate) fn snapshot_events(
+        &self,
+    ) -> Result<impl Iterator<Item = &HistoryEvent>, ExecutionError> {
+        let count = usize::try_from(self.count).map_err(|_| ExecutionError::Invalid)?;
+        let mut chunks = Vec::new();
+        chunks
+            .try_reserve_exact(count.div_ceil(PAGE_EVENTS))
+            .map_err(|_| ExecutionError::Capacity)?;
+        let mut head = self.head.as_deref();
+        let mut actual = 0_usize;
+        while let Some(chunk) = head {
+            actual = actual
+                .checked_add(chunk.events.len())
+                .ok_or(ExecutionError::Invalid)?;
+            chunks.push(chunk);
+            head = chunk.previous.as_deref();
+        }
+        if actual != count {
+            return Err(ExecutionError::Invalid);
+        }
+        Ok(chunks
+            .into_iter()
+            .rev()
+            .flat_map(|chunk| chunk.events.iter().map(|stored| &stored.event)))
+    }
+    fn push(&mut self, event: Arc<StoredEvent>) {
+        let (previous, mut events) = match &self.head {
+            Some(head) if head.events.len() < PAGE_EVENTS => {
+                (head.previous.clone(), head.events.clone())
+            }
+            _ => (self.head.clone(), Vec::new()),
+        };
+        events.push(event);
+        self.head = Some(Arc::new(HistoryChunk { previous, events }));
+        self.count = self.count.saturating_add(1);
+    }
+}
+#[derive(Debug)]
+pub(super) struct Journal {
+    pub(super) view: ExecutionHistory,
+    limits: HistoryLimits,
+    capacity: Arc<HistoryCapacity>,
+    reserve: Arc<TerminalReserve>,
+}
+impl Journal {
+    pub(super) fn new(
+        limits: HistoryLimits,
+        capacity: Arc<HistoryCapacity>,
+        reserve: Arc<TerminalReserve>,
+    ) -> Self {
+        Self {
+            view: ExecutionHistory {
+                charged: TERMINAL_RESERVE,
+                ..ExecutionHistory::default()
+            },
+            limits,
+            capacity,
+            reserve,
+        }
+    }
+    pub(super) fn resume(
+        view: ExecutionHistory,
+        limits: HistoryLimits,
+        capacity: Arc<HistoryCapacity>,
+        reserve: Arc<TerminalReserve>,
+    ) -> Self {
+        Self {
+            view,
+            limits,
+            capacity,
+            reserve,
+        }
+    }
+    pub(super) fn append(
+        &mut self,
+        event: HistoryEvent,
+        terminal: bool,
+    ) -> Result<(), ExecutionError> {
+        let previous = if self.view.count == 1 && event.state_entered_event_details.is_some() {
+            0
+        } else {
+            self.view.count
+        };
+        self.append_causal(event, previous, terminal)
+    }
+    pub(super) fn append_causal(
+        &mut self,
+        mut event: HistoryEvent,
+        previous: u32,
+        terminal: bool,
+    ) -> Result<(), ExecutionError> {
+        if previous > self.view.count {
+            return Err(ExecutionError::Invalid);
+        }
+        let max_count = if terminal {
+            self.limits.events
+        } else {
+            self.limits.events.saturating_sub(1)
+        };
+        if self.view.count >= max_count {
+            return Err(ExecutionError::Capacity);
+        }
+        event.id = i64::from(self.view.count.saturating_add(1));
+        event.previous_event_id = Some(i64::from(previous));
+        let encoded = encode_with_limit(&event, EVENT_BYTES)
+            .map_err(ExecutionError::from)?
+            .len();
+        let charge = encoded
+            .saturating_add(size_of::<StoredEvent>())
+            .saturating_add(FIXED_OVERHEAD);
+        let charge = if terminal {
+            let extra = charge.saturating_sub(TERMINAL_RESERVE);
+            if self.view.charged.saturating_add(extra) > self.limits.bytes {
+                return Err(ExecutionError::Capacity);
+            }
+            let extra = if extra > 0 {
+                Some(self.capacity.reserve(extra)?)
+            } else {
+                None
+            };
+            self.view.charged = self
+                .view
+                .charged
+                .saturating_add(charge.saturating_sub(TERMINAL_RESERVE));
+            EventCharge::Terminal {
+                _reserve: self.reserve.clone(),
+                _extra: extra,
+            }
+        } else {
+            if self.view.charged.saturating_add(charge) > self.limits.bytes {
+                return Err(ExecutionError::Capacity);
+            }
+            let reserved = self.capacity.reserve(charge)?;
+            self.view.charged = self.view.charged.saturating_add(charge);
+            EventCharge::Ordinary { _charge: reserved }
+        };
+        self.view.push(Arc::new(StoredEvent {
+            event,
+            encoded,
+            _charge: charge,
+        }));
+        Ok(())
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/history/projection.rs b/crates/rustack-stepfunctions-core/src/engine/history/projection.rs
new file mode 100644
index 00000000..07d4bbbf
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/history/projection.rs
@@ -0,0 +1,41 @@
+//! Data omission keeps event identity/type/causality unchanged.
+
+use rustack_stepfunctions_model::types::HistoryEvent;
+
+pub(super) fn omit_data(event: &mut HistoryEvent) {
+    if let Some(d) = &mut event.execution_started_event_details {
+        d.input = None;
+        d.input_details = None;
+    }
+    if let Some(d) = &mut event.execution_succeeded_event_details {
+        d.output = None;
+        d.output_details = None;
+    }
+    if let Some(d) = &mut event.state_entered_event_details {
+        d.input = None;
+        d.input_details = None;
+    }
+    if let Some(d) = &mut event.state_exited_event_details {
+        d.output = None;
+        d.output_details = None;
+    }
+    if let Some(d) = &mut event.lambda_function_scheduled_event_details {
+        d.input = None;
+        d.input_details = None;
+    }
+    if let Some(d) = &mut event.lambda_function_succeeded_event_details {
+        d.output = None;
+        d.output_details = None;
+    }
+    if let Some(d) = &mut event.task_succeeded_event_details {
+        d.output = None;
+        d.output_details = None;
+    }
+    if let Some(d) = &mut event.task_submitted_event_details {
+        d.output = None;
+        d.output_details = None;
+    }
+    // Parameters is required within the Smithy details type. Omit that optional
+    // details object as a whole instead of fabricating a replacement JSON value.
+    event.task_scheduled_event_details = None;
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/history/tests.rs b/crates/rustack-stepfunctions-core/src/engine/history/tests.rs
new file mode 100644
index 00000000..375b106a
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/history/tests.rs
@@ -0,0 +1,271 @@
+//! Persistent-view/quota/accounting boundaries, independent of execution scheduling.
+
+use chrono::Utc;
+use rustack_stepfunctions_model::types::{
+    HistoryEvent, HistoryEventType, StateEnteredEventDetails,
+};
+
+use super::*;
+use crate::{ExecutionOutcome, Payload};
+
+fn event() -> HistoryEvent {
+    HistoryEvent::builder()
+        .id(0)
+        .r#type(HistoryEventType::PassStateEntered)
+        .timestamp(Utc::now())
+        .build()
+}
+fn journal(events: u32, bytes: usize) -> (Journal, Arc<HistoryCapacity>) {
+    let limits = HistoryLimits::new(events, bytes).unwrap();
+    let capacity = HistoryCapacity::new(256 * 1024 * 1024, limits).unwrap();
+    let reserve = TerminalReserve::new(&capacity).unwrap();
+    (Journal::new(limits, capacity.clone(), reserve), capacity)
+}
+
+#[test]
+fn test_should_preserve_aws_root_entry_zero_without_resetting_later_predecessors() {
+    let (mut journal, _) = journal(10, 1024 * 1024);
+    let payload = Payload::parse(b"{}").unwrap();
+    journal
+        .append(events::started(&payload, Utc::now()).unwrap(), false)
+        .unwrap();
+    for name in ["first", "second"] {
+        let mut entered = event();
+        let mut details = StateEnteredEventDetails::default();
+        details.name = name.into();
+        entered.state_entered_event_details = Some(details);
+        journal.append(entered, false).unwrap();
+    }
+    let page = journal.view.page(1, 100, true).unwrap();
+    assert_eq!(
+        page.events()
+            .iter()
+            .map(|event| (event.id, event.previous_event_id))
+            .collect::<Vec<_>>(),
+        [(1, Some(0)), (2, Some(0)), (3, Some(2))]
+    );
+}
+#[test]
+fn test_should_bound_history_configuration_and_page_arguments() {
+    for (events, bytes) in [
+        (1, 1024 * 1024),
+        (25_001, 1024 * 1024),
+        (2, 1024 * 1024 - 1),
+        (2, 256 * 1024 * 1024 + 1),
+    ] {
+        assert!(HistoryLimits::new(events, bytes).is_err());
+    }
+    assert!(HistoryCapacity::new(7 * 1024 * 1024, HistoryLimits::default()).is_err());
+    assert!(HistoryCapacity::new(8 * 1024 * 1024, HistoryLimits::default()).is_err());
+    let history = ExecutionHistory::default();
+    for (first, limit) in [(0, 1), (2, 1), (1, 0), (1, 1001)] {
+        assert!(history.page(first, limit, true).is_err());
+    }
+}
+#[test]
+fn test_should_share_stable_pages_and_release_accounting_after_last_view() {
+    let (mut journal, capacity) = journal(100, 1024 * 1024);
+    for _ in 0..65 {
+        journal.append(event(), false).unwrap();
+    }
+    let old = journal.view.clone();
+    let charged = capacity.used();
+    for _ in 0..2 {
+        journal.append(event(), false).unwrap();
+    }
+    assert_eq!(old.len(), 65);
+    assert_eq!(journal.view.len(), 67);
+    let first = old.page(1, 64, true).unwrap();
+    assert_eq!(first.events().len(), 64);
+    assert_eq!(first.next_id(), Some(65));
+    let second = old.page(first.next_id().unwrap(), 64, true).unwrap();
+    assert_eq!(second.events().len(), 1);
+    assert_eq!(second.events()[0].id, 65);
+    assert_eq!(second.next_id(), None);
+    drop(journal);
+    assert_eq!(capacity.used(), charged - TERMINAL_RESERVE);
+    drop(old);
+    assert_eq!(capacity.used(), 0);
+}
+#[test]
+fn test_should_keep_one_event_and_fixed_bytes_for_termination() {
+    let (mut journal, capacity) = journal(2, 1024 * 1024);
+    journal.append(event(), false).unwrap();
+    let charged = capacity.used();
+    assert!(matches!(
+        journal.append(event(), false),
+        Err(ExecutionError::Capacity)
+    ));
+    assert_eq!(capacity.used(), charged);
+    let outcome = ExecutionOutcome::TimedOut;
+    let terminal = events::terminal(&outcome, Utc::now()).unwrap();
+    journal.append(terminal, true).unwrap();
+    assert_eq!(journal.view.len(), 2);
+    assert_eq!(capacity.used(), charged);
+    drop(journal);
+    assert_eq!(capacity.used(), 0);
+}
+#[test]
+fn test_should_bound_complete_encoded_pages_without_truncating_individual_events() {
+    let (mut journal, _) = journal(100, 32 * 1024 * 1024);
+    let payload = Payload::from_value(&serde_json::json!("\0".repeat(40_000))).unwrap();
+    for _ in 0..20 {
+        journal
+            .append(events::started(&payload, Utc::now()).unwrap(), false)
+            .unwrap();
+    }
+    let page = journal.view.page(1, 1000, true).unwrap();
+    assert!(!page.events().is_empty());
+    assert!(page.events().len() < 20);
+    assert!(page.next_id().is_some());
+    assert!(serde_json::to_vec(page.events()).unwrap().len() < PAGE_BYTES);
+    let omitted = journal.view.page(1, 1000, false).unwrap();
+    assert_eq!(omitted.events().len(), 20);
+    assert_eq!(omitted.next_id(), None);
+    assert!(
+        !serde_json::to_string(omitted.events())
+            .unwrap()
+            .contains("u0000")
+    );
+}
+#[test]
+fn test_should_reject_global_exhaustion_without_changing_journal_or_charges() {
+    let limits = HistoryLimits::new(25_000, 1024 * 1024).unwrap();
+    let capacity = HistoryCapacity::new(8 * 1024 * 1024, limits).unwrap();
+    let reserve = TerminalReserve::new(&capacity).unwrap();
+    let mut journal = Journal::new(limits, capacity.clone(), reserve);
+    let held = capacity.reserve(capacity.limit - capacity.used()).unwrap();
+    let before = capacity.used();
+    assert!(matches!(
+        journal.append(event(), false),
+        Err(ExecutionError::Capacity)
+    ));
+    assert_eq!(journal.view.len(), 0);
+    assert_eq!(capacity.used(), before);
+    journal
+        .append(
+            events::terminal(&ExecutionOutcome::TimedOut, Utc::now()).unwrap(),
+            true,
+        )
+        .unwrap();
+    assert_eq!(capacity.used(), before);
+    drop(held);
+    drop(journal);
+    assert_eq!(capacity.used(), 0);
+}
+#[test]
+fn test_should_fill_and_drop_exact_twenty_five_thousand_events_without_recursion_overflow() {
+    let (mut journal, capacity) = journal(25_000, 256 * 1024 * 1024);
+    for _ in 0..24_999 {
+        journal.append(event(), false).unwrap();
+    }
+    assert!(matches!(
+        journal.append(event(), false),
+        Err(ExecutionError::Capacity)
+    ));
+    journal
+        .append(
+            events::terminal(&ExecutionOutcome::TimedOut, Utc::now()).unwrap(),
+            true,
+        )
+        .unwrap();
+    assert_eq!(journal.view.len(), 25_000);
+    assert_eq!(
+        journal.view.page(25_000, 1, true).unwrap().events()[0].id,
+        25_000
+    );
+    drop(journal);
+    assert_eq!(capacity.used(), 0);
+}
+
+#[test]
+fn test_should_reverse_fixed_history_without_changing_causal_ids_or_splitting_events() {
+    let (mut journal, _) = journal(100, 32 * 1024 * 1024);
+    let payload = Payload::from_value(&serde_json::json!("\0".repeat(40_000))).unwrap();
+    for _ in 0..20 {
+        journal
+            .append(events::started(&payload, Utc::now()).unwrap(), false)
+            .unwrap();
+    }
+    let old = journal.view.clone();
+    journal.append(event(), false).unwrap();
+    let first = old.page_reverse(20, 1000, true).unwrap();
+    assert!(first.events().len() < 20);
+    assert!(serde_json::to_vec(first.events()).unwrap().len() < PAGE_BYTES);
+    assert_eq!(first.events().first().unwrap().id, 20);
+    let next = old
+        .page_reverse(first.next_id().unwrap(), 1000, true)
+        .unwrap();
+    assert_eq!(first.events().len() + next.events().len(), 20);
+    assert_eq!(next.events().last().unwrap().id, 1);
+    assert_eq!(next.next_id(), None);
+    let omitted = old.page_reverse(20, 1000, false).unwrap();
+    assert_eq!(omitted.events().len(), 20);
+    assert!(
+        !serde_json::to_string(omitted.events())
+            .unwrap()
+            .contains("u0000")
+    );
+    assert!(old.page_reverse(0, 1, true).is_err());
+    assert!(old.page_reverse(21, 1, true).is_err());
+    assert!(old.page_reverse(20, 0, true).is_err());
+    assert!(
+        ExecutionHistory::default()
+            .page_reverse(0, 1, false)
+            .unwrap()
+            .events()
+            .is_empty()
+    );
+}
+
+#[test]
+fn test_should_reject_future_causal_predecessor_before_mutating_history_or_charges() {
+    let (mut journal, capacity) = journal(4, 1024 * 1024);
+    journal.append_causal(event(), 0, false).unwrap();
+    let charged = capacity.used();
+    let bytes = journal.view.charged;
+    assert!(matches!(
+        journal.append_causal(event(), 2, false),
+        Err(ExecutionError::Invalid)
+    ));
+    assert_eq!(journal.view.len(), 1);
+    assert_eq!(journal.view.charged, bytes);
+    assert_eq!(capacity.used(), charged);
+    journal.append_causal(event(), 1, false).unwrap();
+    journal.append_causal(event(), 1, false).unwrap();
+    assert!(matches!(
+        journal.append_causal(event(), 2, false),
+        Err(ExecutionError::Capacity)
+    ));
+    journal
+        .append_causal(
+            events::terminal(&ExecutionOutcome::TimedOut, Utc::now()).unwrap(),
+            3,
+            true,
+        )
+        .unwrap();
+    let forward = journal.view.page(1, 100, true).unwrap();
+    let reverse = journal.view.page_reverse(4, 100, false).unwrap();
+    let expected = [(1, Some(0)), (2, Some(1)), (3, Some(1)), (4, Some(3))];
+    assert_eq!(
+        forward
+            .events()
+            .iter()
+            .map(|event| (event.id, event.previous_event_id))
+            .collect::<Vec<_>>(),
+        expected
+    );
+    assert_eq!(
+        reverse
+            .events()
+            .iter()
+            .rev()
+            .map(|event| (event.id, event.previous_event_id))
+            .collect::<Vec<_>>(),
+        expected
+    );
+    drop(forward);
+    drop(reverse);
+    drop(journal);
+    assert_eq!(capacity.used(), 0);
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/mod.rs b/crates/rustack-stepfunctions-core/src/engine/mod.rs
new file mode 100644
index 00000000..fcea2178
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/mod.rs
@@ -0,0 +1,621 @@
+//! Deterministic frame transitions with explicit external effects.
+//!
+//! No resource is spawned or dropped here. The owning actor must retain accepted
+//! invocations, process cancellation obligations and journal AWS history before
+//! publishing read views. This driver alone does not install an execution API.
+
+use std::{
+    fmt, mem,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use chrono::{DateTime, SecondsFormat, Utc};
+use serde_json::{Value, json};
+use types::FailureOrigin;
+
+use crate::{
+    AslError, CompiledMachine, EvaluationContext, Payload, StateId, StateView, Transition,
+};
+
+mod callback;
+mod fanout;
+mod history;
+mod recovery;
+mod runtime;
+mod scheduler;
+mod states;
+#[cfg(test)]
+mod tests;
+mod types;
+
+pub use callback::CallbackDispatch;
+pub use fanout::{FanoutBranch, FanoutFailure, FanoutPlan, PropagatedFailure};
+pub(crate) use runtime::HistoryRestorer;
+pub use scheduler::{
+    FrameCallId, FrameCapacity, FrameError, FrameId, FrameLease, FrameLimits, FrameParent,
+    FrameScheduler, FrameTransition, FrameUpdate,
+};
+pub use types::{
+    AttemptId, ClockSample, DriverStep, DriverUpdate, ExecutionFailure, ExecutionLimits,
+    ExecutionOutcome, ExecutionSource, TaskDispatch, TaskFailure,
+};
+
+#[derive(Debug, Clone)]
+enum Phase {
+    Ready {
+        entry: bool,
+    },
+    Calling {
+        attempt: AttemptId,
+        deadline: Instant,
+    },
+    Joining {
+        attempt: AttemptId,
+        count: usize,
+    },
+    Waiting {
+        until: Instant,
+        continuation: Continuation,
+    },
+    Terminal(Arc<ExecutionOutcome>),
+}
+#[derive(Debug, Clone)]
+enum Continuation {
+    Retry,
+    Wait { output: Payload, next: Transition },
+}
+
+/// One captured lexical machine's frame interpreter, with no resource owner.
+#[non_exhaustive]
+#[derive(Clone)]
+pub struct ExecutionDriver {
+    machine: Arc<CompiledMachine>,
+    started: bool,
+    input: Payload,
+    base: EvaluationContext,
+    context: EvaluationContext,
+    state: StateId,
+    phase: Phase,
+    deadline: Instant,
+    observed: Instant,
+    entered: DateTime<Utc>,
+    generation: u64,
+    retries: Vec<u32>,
+    retry_count: u32,
+    remaining: u32,
+    diagnostic: Option<Arc<AslError>>,
+    fanout_started: Option<usize>,
+}
+impl fmt::Debug for ExecutionDriver {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ExecutionDriver")
+            .field("phase", &self.phase)
+            .field("retry_count", &self.retry_count)
+            .finish_non_exhaustive()
+    }
+}
+impl ExecutionDriver {
+    /// Capture immutable machine/input/context and compute the absolute deadline.
+    ///
+    /// The base context must be an object. Registry-owned Execution and
+    /// `StateMachine` fields remain unchanged; this driver owns its State fields.
+    ///
+    /// # Errors
+    /// Rejects structured artifacts, nonobject context or an unrepresentable deadline.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{AslCompiler,Payload,EvaluationContext,ClockSample,ExecutionDriver,ExecutionLimits};
+    /// use std::time::Instant;
+    /// let artifact=AslCompiler::default().compile(br#"{"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}}"#)?;
+    /// let input=Payload::parse(b"{}")?;
+    /// let context=EvaluationContext::from(&input);
+    /// let now=ClockSample::new(Instant::now(),chrono::Utc::now());
+    /// let driver=ExecutionDriver::new(artifact.machine().clone(),input,context,now,ExecutionLimits::default())?;
+    /// # Ok::<(),Box<dyn std::error::Error>>(())
+    /// ```
+    pub fn new(
+        machine: Arc<CompiledMachine>,
+        input: Payload,
+        base: EvaluationContext,
+        started: ClockSample,
+        limits: ExecutionLimits,
+    ) -> Result<Self, AslError> {
+        if machine.requires_structured_execution() || machine.uses_callbacks() {
+            return Err(AslError::StructuredExecutionRequired);
+        }
+        Self::for_structured_owner(machine, input, base, started, limits)
+    }
+
+    /// Build a pure frame interpreter for an owner implementing `FanOut` effects.
+    ///
+    /// This constructor performs no scheduling or IO. The current sequential
+    /// supervisor rejects structured artifacts; enabling these effects alone
+    /// cannot enable the service's structured execution profile.
+    ///
+    /// # Errors
+    /// Rejects invalid context or an unrepresentable absolute deadline.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{AslCompiler, ClockSample, EvaluationContext, ExecutionDriver, ExecutionLimits, Payload};
+    /// let compiled = AslCompiler::default().compile(br#"{"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}}"#)?;
+    /// let input = Payload::parse(b"{}")?;
+    /// let driver = ExecutionDriver::for_structured_owner(compiled.machine().clone(), input.clone(), EvaluationContext::from(&input), ClockSample::new(std::time::Instant::now(), chrono::Utc::now()), ExecutionLimits::default())?;
+    /// # Ok::<(), Box<dyn std::error::Error>>(())
+    /// ```
+    pub fn for_structured_owner(
+        machine: Arc<CompiledMachine>,
+        input: Payload,
+        base: EvaluationContext,
+        started: ClockSample,
+        limits: ExecutionLimits,
+    ) -> Result<Self, AslError> {
+        if !base.value().is_object() {
+            return Err(AslError::InvalidExecution);
+        }
+        let duration = machine.timeout_seconds().map_or(limits.duration, |s| {
+            limits.duration.min(Duration::from_secs(u64::from(s.get())))
+        });
+        let deadline = started
+            .monotonic
+            .checked_add(duration)
+            .ok_or(AslError::InvalidExecution)?;
+        Self::frame(machine, input, base, started, deadline, limits.transitions)
+    }
+    fn frame(
+        machine: Arc<CompiledMachine>,
+        input: Payload,
+        base: EvaluationContext,
+        started: ClockSample,
+        deadline: Instant,
+        remaining: u32,
+    ) -> Result<Self, AslError> {
+        if !base.value().is_object() || started.monotonic >= deadline {
+            return Err(AslError::InvalidExecution);
+        }
+        Ok(Self {
+            state: machine.start(),
+            started: false,
+            machine,
+            input,
+            context: base.clone(),
+            base,
+            phase: Phase::Ready { entry: true },
+            deadline,
+            observed: started.monotonic,
+            entered: started.wall,
+            generation: 0,
+            retries: Vec::new(),
+            retry_count: 0,
+            remaining,
+            diagnostic: None,
+            fanout_started: None,
+        })
+    }
+
+    /// Drive at most one state/attempt transition, without reading clocks or IO.
+    ///
+    /// ```
+    /// # fn tick(driver:&mut rustack_stepfunctions_core::ExecutionDriver, now:rustack_stepfunctions_core::ClockSample) {
+    /// let update=driver.advance(now,&mut rustack_stepfunctions_core::SystemUuidSource::default());
+    /// let next=update.step();
+    /// # }
+    /// ```
+    pub fn advance<S: ExecutionSource + ?Sized>(
+        &mut self,
+        now: ClockSample,
+        source: &mut S,
+    ) -> DriverUpdate {
+        self.started = true;
+        if let Some(update) = self.guard(now) {
+            return update;
+        }
+        match mem::replace(&mut self.phase, Phase::Ready { entry: false }) {
+            Phase::Ready { entry } => self.ready(entry, now, source),
+            Phase::Calling { attempt, deadline } => {
+                if now.monotonic >= deadline {
+                    let step = self.recover(
+                        ExecutionFailure::fields(Some("States.Timeout".into()), None),
+                        now,
+                        source,
+                    );
+                    DriverUpdate {
+                        step,
+                        cancel: Some(attempt),
+                    }
+                } else {
+                    self.phase = Phase::Calling { attempt, deadline };
+                    update(DriverStep::Park(deadline))
+                }
+            }
+            Phase::Joining { attempt, count } => {
+                self.phase = Phase::Joining { attempt, count };
+                update(DriverStep::Park(self.deadline))
+            }
+            Phase::Waiting {
+                until,
+                continuation,
+            } => {
+                if now.monotonic < until {
+                    self.phase = Phase::Waiting {
+                        until,
+                        continuation,
+                    };
+                    update(DriverStep::Park(until.min(self.deadline)))
+                } else {
+                    match continuation {
+                        Continuation::Retry => update(DriverStep::Continue),
+                        Continuation::Wait { output, next } => update(self.transfer(output, next)),
+                    }
+                }
+            }
+            Phase::Terminal(outcome) => {
+                self.phase = Phase::Terminal(outcome.clone());
+                update(DriverStep::Settled(outcome))
+            }
+        }
+    }
+
+    /// Apply only the current attempt's result; stale/duplicate results are inert.
+    ///
+    /// At/after a deadline, timeout wins even when this result was ready earlier.
+    /// A cancellation obligation is not proof that external cleanup has settled.
+    ///
+    /// ```
+    /// # fn finish(driver:&mut rustack_stepfunctions_core::ExecutionDriver, call:&rustack_stepfunctions_core::TaskDispatch, now:rustack_stepfunctions_core::ClockSample, output:rustack_stepfunctions_core::Payload) {
+    /// let update=driver.complete(call.attempt(),Ok(output),now,&mut rustack_stepfunctions_core::SystemUuidSource::default());
+    /// # }
+    /// ```
+    pub fn complete<S: ExecutionSource + ?Sized>(
+        &mut self,
+        attempt: AttemptId,
+        result: Result<Payload, TaskFailure>,
+        now: ClockSample,
+        source: &mut S,
+    ) -> DriverUpdate {
+        self.started = true;
+        if let Some(update) = self.guard(now) {
+            return update;
+        }
+        let Phase::Calling {
+            attempt: current,
+            deadline,
+        } = &self.phase
+        else {
+            return self.current_update();
+        };
+        if *current != attempt {
+            return self.current_update();
+        }
+        if now.monotonic >= *deadline {
+            return self.advance(now, source);
+        }
+        self.phase = Phase::Ready { entry: false };
+        update(match result {
+            Err(failure) => match &failure.0.origin {
+                FailureOrigin::Business => self.recover(failure.0, now, source),
+                FailureOrigin::Evaluation(_) => self.propagate_failure(failure.0, now, source),
+                FailureOrigin::Safety => self.settle(ExecutionOutcome::Failed(failure.0)),
+            },
+            Ok(result) => match self.finish_result(Ok(result), source) {
+                Ok(step) => step,
+                Err(error) => self.evaluation_failure(error, now, source, true),
+            },
+        })
+    }
+
+    /// Join the current round only after its owner has joined cancelled siblings.
+    ///
+    /// Stale, duplicate and Lambda-attempt results cannot settle this round.
+    /// Deadline/Stop always preserve the independent cancellation obligation.
+    ///
+    /// ```
+    /// # fn join(driver: &mut rustack_stepfunctions_core::ExecutionDriver, plan: &rustack_stepfunctions_core::FanoutPlan, result: Result<rustack_stepfunctions_core::Payload, rustack_stepfunctions_core::FanoutFailure>, now: rustack_stepfunctions_core::ClockSample) {
+    /// let update = driver.complete_fanout(plan.attempt(), result, now, &mut rustack_stepfunctions_core::SystemUuidSource::default());
+    /// # }
+    /// ```
+    pub fn complete_fanout<S: ExecutionSource + ?Sized>(
+        &mut self,
+        attempt: AttemptId,
+        result: Result<Payload, FanoutFailure>,
+        now: ClockSample,
+        source: &mut S,
+    ) -> DriverUpdate {
+        self.started = true;
+        if let Some(update) = self.guard(now) {
+            return update;
+        }
+        let Phase::Joining {
+            attempt: current,
+            count,
+        } = self.phase
+        else {
+            return self.current_update();
+        };
+        if current != attempt {
+            return self.current_update();
+        }
+        self.phase = Phase::Ready { entry: false };
+        let step = match result {
+            Err(FanoutFailure::Branch(failure)) => match &failure.origin {
+                FailureOrigin::Business => self.recover(failure, now, source),
+                FailureOrigin::Evaluation(_) => self.propagate_failure(failure, now, source),
+                FailureOrigin::Safety => self.settle(ExecutionOutcome::Failed(failure)),
+            },
+            Err(FanoutFailure::Propagated(failure)) => {
+                self.propagate_failure(failure.failure, now, source)
+            }
+            Err(FanoutFailure::Evaluation(error)) => {
+                self.evaluation_failure_shared(error, now, source, true)
+            }
+            Err(FanoutFailure::Unrecoverable(failure)) => {
+                self.settle(ExecutionOutcome::Failed(failure))
+            }
+            Ok(result) => {
+                let result = if result
+                    .value()
+                    .as_array()
+                    .is_some_and(|values| values.len() == count)
+                {
+                    Ok(result)
+                } else {
+                    Err(AslError::InvalidFanoutResult)
+                };
+                match self.finish_result(result, source) {
+                    Ok(step) => step,
+                    Err(error) => self.evaluation_failure(error, now, source, true),
+                }
+            }
+        };
+        update(step)
+    }
+
+    fn finish_result<S: ExecutionSource + ?Sized>(
+        &mut self,
+        result: Result<Payload, AslError>,
+        source: &mut S,
+    ) -> Result<DriverStep, AslError> {
+        let result = result?;
+        let machine = self.machine.clone();
+        let (StateView::Task { flow, next, .. }
+        | StateView::Parallel { flow, next, .. }
+        | StateView::Map { flow, next, .. }) = machine.state(self.state)?
+        else {
+            return Err(AslError::InvalidStateId);
+        };
+        let output = flow.finish_with_source(&self.input, &result, &self.context, source)?;
+        Ok(self.transfer(output, next))
+    }
+
+    /// Abort once, bypassing user recovery; elapsed overall deadlines still win.
+    ///
+    /// ```
+    /// # fn stop(driver:&mut rustack_stepfunctions_core::ExecutionDriver, now:rustack_stepfunctions_core::ClockSample) -> Result<(),rustack_stepfunctions_core::AslError> {
+    /// let reason=rustack_stepfunctions_core::TaskFailure::new("Rustack.Shutdown",None)?;
+    /// let update=driver.stop(reason,now);
+    /// # Ok(()) }
+    /// ```
+    pub fn stop(&mut self, reason: TaskFailure, now: ClockSample) -> DriverUpdate {
+        self.started = true;
+        if let Some(update) = self.guard(now) {
+            return update;
+        }
+        let cancel = self.active();
+        let step = self.settle(ExecutionOutcome::Aborted(reason));
+        DriverUpdate { step, cancel }
+    }
+
+    /// Read the captured machine; dispatched state IDs refer only to this artifact.
+    ///
+    /// ```
+    /// # fn inspect(d:&rustack_stepfunctions_core::ExecutionDriver) { let machine=d.machine(); }
+    /// ```
+    #[must_use]
+    pub fn machine(&self) -> &Arc<CompiledMachine> {
+        &self.machine
+    }
+    /// Read the current state's original input, retained across all its retries.
+    ///
+    /// ```
+    /// # fn inspect(d:&rustack_stepfunctions_core::ExecutionDriver) { let raw=d.input(); }
+    /// ```
+    #[must_use]
+    pub fn input(&self) -> &Payload {
+        &self.input
+    }
+    /// Read the current state index for observation/history projection.
+    ///
+    /// ```
+    /// # fn inspect(d:&rustack_stepfunctions_core::ExecutionDriver) { let state=d.state(); }
+    /// ```
+    #[must_use]
+    pub fn state(&self) -> StateId {
+        self.state
+    }
+    /// Read the total retries scheduled in the current state visit.
+    ///
+    /// ```
+    /// # fn inspect(d:&rustack_stepfunctions_core::ExecutionDriver) { let retries=d.retry_count(); }
+    /// ```
+    #[must_use]
+    pub fn retry_count(&self) -> u32 {
+        self.retry_count
+    }
+    /// Read the immutable execution deadline.
+    ///
+    /// ```
+    /// # fn inspect(d:&rustack_stepfunctions_core::ExecutionDriver) { let deadline=d.deadline(); }
+    /// ```
+    #[must_use]
+    pub fn deadline(&self) -> Instant {
+        self.deadline
+    }
+    /// Read the most recent typed interpreter/source failure without public data.
+    ///
+    /// ```
+    /// # fn inspect(d:&rustack_stepfunctions_core::ExecutionDriver) { let diagnostic=d.diagnostic(); }
+    /// ```
+    #[must_use]
+    pub fn diagnostic(&self) -> Option<&AslError> {
+        self.diagnostic.as_deref()
+    }
+    /// Read the stable terminal outcome, if any; cleanup is independently owned.
+    ///
+    /// ```
+    /// # fn inspect(d:&rustack_stepfunctions_core::ExecutionDriver) { let outcome=d.outcome(); }
+    /// ```
+    #[must_use]
+    pub fn outcome(&self) -> Option<&Arc<ExecutionOutcome>> {
+        match &self.phase {
+            Phase::Terminal(outcome) => Some(outcome),
+            _ => None,
+        }
+    }
+
+    fn guard(&mut self, now: ClockSample) -> Option<DriverUpdate> {
+        if let Phase::Terminal(outcome) = &self.phase {
+            return Some(update(DriverStep::Settled(outcome.clone())));
+        }
+        if now.monotonic < self.observed {
+            let cancel = self.active();
+            let error = Arc::new(AslError::InvalidExecution);
+            self.diagnostic = Some(error.clone());
+            let mut failure =
+                ExecutionFailure::named("Rustack.InternalError", "Monotonic clock regressed");
+            failure.origin = FailureOrigin::Evaluation(error);
+            let step = self.settle(ExecutionOutcome::Failed(failure));
+            return Some(DriverUpdate { step, cancel });
+        }
+        self.observed = now.monotonic;
+        if now.monotonic >= self.deadline {
+            let cancel = self.active();
+            let step = self.settle(ExecutionOutcome::TimedOut);
+            return Some(DriverUpdate { step, cancel });
+        }
+        None
+    }
+    fn current_update(&self) -> DriverUpdate {
+        update(match &self.phase {
+            Phase::Calling { deadline, .. } => DriverStep::Park(*deadline),
+            Phase::Joining { .. } => DriverStep::Park(self.deadline),
+            Phase::Waiting { until, .. } => DriverStep::Park((*until).min(self.deadline)),
+            Phase::Ready { .. } => DriverStep::Continue,
+            Phase::Terminal(outcome) => DriverStep::Settled(outcome.clone()),
+        })
+    }
+    fn active(&self) -> Option<AttemptId> {
+        match self.phase {
+            Phase::Calling { attempt, .. } | Phase::Joining { attempt, .. } => Some(attempt),
+            _ => None,
+        }
+    }
+    fn settle(&mut self, outcome: ExecutionOutcome) -> DriverStep {
+        let outcome = Arc::new(outcome);
+        self.phase = Phase::Terminal(outcome.clone());
+        DriverStep::Settled(outcome)
+    }
+    fn transfer(&mut self, output: Payload, next: Transition) -> DriverStep {
+        match next {
+            Transition::End => self.settle(ExecutionOutcome::Succeeded(output)),
+            Transition::Next(state) => {
+                self.input = output;
+                self.state = state;
+                self.phase = Phase::Ready { entry: true };
+                DriverStep::Continue
+            }
+        }
+    }
+    fn refresh_context(&mut self) -> Result<(), AslError> {
+        let mut value: Value = self.base.value().clone();
+        let object = value.as_object_mut().ok_or(AslError::InvalidExecution)?;
+        object.insert("State".into(),json!({"Name":self.machine.state_name(self.state)?,
+            "EnteredTime":self.entered.to_rfc3339_opts(SecondsFormat::Nanos,true),"RetryCount":self.retry_count}));
+        self.context = EvaluationContext::from_value(&value)?;
+        Ok(())
+    }
+    fn ready<S: ExecutionSource + ?Sized>(
+        &mut self,
+        entry: bool,
+        now: ClockSample,
+        source: &mut S,
+    ) -> DriverUpdate {
+        if self.remaining == 0 {
+            return update(self.transition_limit());
+        }
+        self.remaining = self.remaining.saturating_sub(1);
+        if entry {
+            self.entered = now.wall;
+            self.retry_count = 0;
+            self.retries.clear();
+        }
+        let step = match self
+            .refresh_context()
+            .and_then(|()| self.execute(now, source))
+        {
+            Ok(step) => step,
+            Err(error) => {
+                let task = matches!(
+                    self.machine.state(self.state),
+                    Ok(StateView::Task { .. } | StateView::Parallel { .. } | StateView::Map { .. })
+                );
+                self.evaluation_failure(error, now, source, task)
+            }
+        };
+        update(step)
+    }
+    fn transition_limit(&mut self) -> DriverStep {
+        self.settle(ExecutionOutcome::Failed(ExecutionFailure::safety(
+            "Rustack.TransitionLimitExceeded",
+            "Execution transition limit exceeded",
+        )))
+    }
+    fn evaluation_failure<S: ExecutionSource + ?Sized>(
+        &mut self,
+        error: AslError,
+        now: ClockSample,
+        source: &mut S,
+        recover: bool,
+    ) -> DriverStep {
+        self.evaluation_failure_shared(Arc::new(error), now, source, recover)
+    }
+    fn propagate_failure<S: ExecutionSource + ?Sized>(
+        &mut self,
+        failure: ExecutionFailure,
+        now: ClockSample,
+        source: &mut S,
+    ) -> DriverStep {
+        if let FailureOrigin::Evaluation(error) = &failure.origin {
+            self.diagnostic = Some(error.clone());
+        }
+        if failure.error() == Some("States.DataLimitExceeded") {
+            self.recover(failure, now, source)
+        } else {
+            self.settle(ExecutionOutcome::Failed(failure))
+        }
+    }
+    fn evaluation_failure_shared<S: ExecutionSource + ?Sized>(
+        &mut self,
+        error: Arc<AslError>,
+        now: ClockSample,
+        source: &mut S,
+        recover: bool,
+    ) -> DriverStep {
+        let failure = ExecutionFailure::evaluation(error.clone());
+        let limit = failure.error() == Some("States.DataLimitExceeded");
+        self.diagnostic = Some(error);
+        if recover && limit {
+            self.recover(failure, now, source)
+        } else {
+            self.settle(ExecutionOutcome::Failed(failure))
+        }
+    }
+}
+fn update(step: DriverStep) -> DriverUpdate {
+    DriverUpdate { step, cancel: None }
+}
+
+pub use history::{ExecutionHistory, HistoryLimits, HistoryPage};
+pub use runtime::{
+    CleanupState, ExecutionError, ExecutionHandle, ExecutionSupervisor, ExecutionView,
+    RuntimeLimits,
+};
diff --git a/crates/rustack-stepfunctions-core/src/engine/recovery.rs b/crates/rustack-stepfunctions-core/src/engine/recovery.rs
new file mode 100644
index 00000000..b4db583b
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/recovery.rs
@@ -0,0 +1,165 @@
+//! First-matching policy selection, bounded backoff and unbiased jitter.
+
+use std::{
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use serde_json::{Map, Value};
+
+use super::{
+    ClockSample, Continuation, DriverStep, ExecutionDriver, ExecutionFailure, ExecutionOutcome,
+    ExecutionSource, Phase, types::FailureOrigin,
+};
+use crate::{AslError, CatchResult, Jitter, Payload, RetryTiming, StateId, StateView, Transition};
+
+enum Recovery {
+    Retry { index: usize, until: Instant },
+    Catch { output: Payload, next: StateId },
+    Fail,
+    Limit,
+}
+impl ExecutionDriver {
+    pub(super) fn recover<S: ExecutionSource + ?Sized>(
+        &mut self,
+        failure: ExecutionFailure,
+        now: ClockSample,
+        source: &mut S,
+    ) -> DriverStep {
+        match self.recovery_plan(&failure, now, source) {
+            Ok(Recovery::Retry { index, until }) => {
+                let Some(count) = self.retries.get_mut(index) else {
+                    return self.evaluation_failure(AslError::InvalidStateId, now, source, false);
+                };
+                *count = count.saturating_add(1);
+                self.retry_count = self.retry_count.saturating_add(1);
+                self.phase = Phase::Waiting {
+                    until,
+                    continuation: Continuation::Retry,
+                };
+                DriverStep::Park(until)
+            }
+            Ok(Recovery::Catch { output, next }) => self.transfer(output, Transition::Next(next)),
+            Ok(Recovery::Limit) => self.transition_limit(),
+            Ok(Recovery::Fail) => self.settle(ExecutionOutcome::Failed(failure)),
+            Err(
+                error @ (AslError::Merge
+                | AslError::DataLimit
+                | AslError::Json(_)
+                | AslError::Encoding(_)),
+            ) => {
+                // A failing catcher merge is an interpreter failure, never a
+                // second pass through this same recovery policy.
+                self.evaluation_failure(error, now, source, false)
+            }
+            Err(error) => {
+                // Recovery entropy/invariant failures are internal, not user errors.
+                let source = Arc::new(error);
+                self.diagnostic = Some(source.clone());
+                let mut failure =
+                    ExecutionFailure::named("Rustack.InternalError", "Task recovery failed");
+                failure.origin = FailureOrigin::Evaluation(source);
+                self.settle(ExecutionOutcome::Failed(failure))
+            }
+        }
+    }
+    fn recovery_plan<S: ExecutionSource + ?Sized>(
+        &mut self,
+        failure: &ExecutionFailure,
+        now: ClockSample,
+        source: &mut S,
+    ) -> Result<Recovery, AslError> {
+        let machine = self.machine.clone();
+        let (StateView::Task { recovery, .. }
+        | StateView::Parallel { recovery, .. }
+        | StateView::Map { recovery, .. }) = machine.state(self.state)?
+        else {
+            return Err(AslError::InvalidStateId);
+        };
+        self.retries.resize(recovery.retries().len(), 0);
+        let name = failure.error().unwrap_or("States.TaskFailed");
+        for (index, retrier) in recovery.retries().iter().enumerate() {
+            if !retrier.matches(name) {
+                continue;
+            }
+            let count = *self.retries.get(index).ok_or(AslError::InvalidStateId)?;
+            if count < retrier.max_attempts() {
+                if self.remaining == 0 {
+                    return Ok(Recovery::Limit);
+                }
+                let remaining = self.deadline.saturating_duration_since(now.monotonic);
+                let delay = backoff(retrier.timing(), count, remaining, source)?;
+                return Ok(Recovery::Retry {
+                    index,
+                    until: now
+                        .monotonic
+                        .checked_add(delay)
+                        .ok_or(AslError::InvalidExecution)?,
+                });
+            }
+            break;
+        }
+        for catcher in recovery.catches() {
+            if !catcher.matches(name) {
+                continue;
+            }
+            let mut object = Map::new();
+            if let Some(error) = failure.error() {
+                object.insert("Error".into(), Value::String(error.into()));
+            }
+            if let Some(cause) = failure.cause() {
+                object.insert("Cause".into(), Value::String(cause.into()));
+            }
+            let error = Payload::from_value(&Value::Object(object))?;
+            let output = match catcher.result_path() {
+                CatchResult::Replace => error,
+                CatchResult::Discard => self.input.clone(),
+                CatchResult::Path(path) => path.merge(&self.input, &error)?,
+            };
+            return Ok(Recovery::Catch {
+                output,
+                next: catcher.next(),
+            });
+        }
+        Ok(Recovery::Fail)
+    }
+}
+
+fn backoff<S: ExecutionSource + ?Sized>(
+    timing: &RetryTiming,
+    prior: u32,
+    remaining: Duration,
+    source: &mut S,
+) -> Result<Duration, AslError> {
+    let cap = timing.max_delay_seconds().map_or(remaining, |s| {
+        remaining.min(Duration::from_secs(u64::from(s.get())))
+    });
+    let seconds =
+        f64::from(timing.interval_seconds().get()) * timing.backoff_rate().powf(f64::from(prior));
+    let delay = if !seconds.is_finite() || seconds >= cap.as_secs_f64() {
+        cap
+    } else {
+        Duration::try_from_secs_f64(seconds)
+            .map_err(|_| AslError::InvalidExecution)?
+            .min(cap)
+    };
+    if timing.jitter() == Jitter::None {
+        return Ok(delay);
+    }
+    jitter(delay, source)
+}
+fn jitter<S: ExecutionSource + ?Sized>(
+    cap: Duration,
+    source: &mut S,
+) -> Result<Duration, AslError> {
+    let cap = u64::try_from(cap.as_nanos()).map_err(|_| AslError::InvalidExecution)?;
+    let width = cap.checked_add(1).ok_or(AslError::InvalidExecution)?;
+    let threshold = width.wrapping_neg() % width;
+    for _ in 0..128 {
+        let draw = source.random_u64()?;
+        if draw >= threshold {
+            return Ok(Duration::from_nanos(draw % width));
+        }
+    }
+    Err(AslError::WorkLimit)
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/actor.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/actor.rs
new file mode 100644
index 00000000..7a5cc0a6
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/actor.rs
@@ -0,0 +1,590 @@
+//! One sequential execution owner, including retired-call cleanup lifetime.
+
+use std::sync::Arc;
+
+use chrono::{DateTime, Utc};
+use rustack_stepfunctions_model::types::HistoryEvent;
+use serde_json::Value;
+use tokio::{
+    sync::{OwnedSemaphorePermit, watch},
+    task::{JoinError, JoinSet, yield_now},
+    time::{Instant, sleep_until},
+};
+
+use super::{
+    super::{
+        ClockSample, DriverStep, Phase,
+        history::{
+            Journal,
+            events::{self, TaskFailureKind},
+        },
+    },
+    CleanupState, DispatchLease, ExecutionError, ExecutionView, Shared,
+    evaluate::{Evaluated, Operation},
+    shutdown_reason,
+};
+use crate::{
+    AslError, ExecutionDriver, ExecutionFailure, ExecutionOutcome, LambdaTaskCommand, Payload,
+    StateView, TaskCall, TaskDispatch, TaskEvent, TaskFailure, TaskSettlement, TaskTimeout,
+};
+
+#[derive(Debug)]
+pub(super) struct OwnedCall {
+    pub(super) call: TaskCall,
+    pub(super) lease: Arc<DispatchLease>,
+}
+#[derive(Debug)]
+struct CurrentCall {
+    owned: OwnedCall,
+    started: bool,
+}
+#[derive(Debug)]
+struct Resources {
+    active: Option<CurrentCall>,
+    retired: JoinSet<Result<Arc<DispatchLease>, OwnedCall>>,
+    quarantined: Vec<OwnedCall>,
+    leases: Vec<Arc<DispatchLease>>,
+    workers: JoinSet<Evaluated>,
+}
+#[derive(Debug)]
+struct Context {
+    journal: Journal,
+    view: watch::Sender<Arc<ExecutionView>>,
+    stop: watch::Receiver<Option<TaskFailure>>,
+    ledger: watch::Sender<Arc<Vec<Arc<DispatchLease>>>>,
+}
+#[derive(Debug)]
+pub(super) struct Actor {
+    pub(super) driver: ExecutionDriver,
+    context: Context,
+    resources: Resources,
+    shared: Arc<Shared>,
+    pending: Option<Operation>,
+}
+#[derive(Debug)]
+pub(super) struct RunExit {
+    pub(super) quarantined: Vec<OwnedCall>,
+    pub(super) uncertain: bool,
+}
+impl Actor {
+    pub(super) fn new(
+        driver: ExecutionDriver,
+        journal: Journal,
+        view: watch::Sender<Arc<ExecutionView>>,
+        stop: watch::Receiver<Option<TaskFailure>>,
+        ledger: watch::Sender<Arc<Vec<Arc<DispatchLease>>>>,
+        shared: Arc<Shared>,
+    ) -> Self {
+        Self {
+            driver,
+            context: Context {
+                journal,
+                view,
+                stop,
+                ledger,
+            },
+            resources: Resources {
+                active: None,
+                retired: JoinSet::new(),
+                quarantined: Vec::new(),
+                leases: Vec::new(),
+                workers: JoinSet::new(),
+            },
+            shared,
+            pending: None,
+        }
+    }
+    #[tracing::instrument(name = "stepfunctions.execution", skip_all)]
+    pub(super) async fn run(mut self) -> RunExit {
+        let mut ticks = 0_u8;
+        loop {
+            self.reap_cleanups();
+            if self.driver.outcome().is_some() {
+                break;
+            }
+            let operation = if let Some(pending) = self.pending.take() {
+                Some(pending)
+            } else {
+                self.next_operation().await
+            };
+            if let Some(operation) = operation {
+                match self.evaluate(operation).await {
+                    Ok(Some(DriverStep::Dispatch(dispatch))) => self.dispatch(dispatch).await,
+                    Ok(_) => {}
+                    Err(error) => self.fail(error),
+                }
+            }
+            ticks = ticks.saturating_add(1);
+            if ticks >= 64 {
+                yield_now().await;
+                ticks = 0;
+            }
+        }
+        self.retire_active();
+        let publication_failed = self.publish_terminal().is_err();
+        // CPU futures remain supervised even when Stop/deadline won earlier.
+        while let Some(result) = self.resources.workers.join_next().await {
+            if result.is_err() {
+                tracing::error!("Workflow evaluation worker failed during drain");
+            }
+        }
+        while let Some(result) = self.resources.retired.join_next().await {
+            self.cleanup_result(result);
+        }
+        let uncertain = publication_failed || !self.resources.leases.is_empty();
+        let cleanup = if uncertain {
+            CleanupState::Quarantined
+        } else {
+            CleanupState::Clean
+        };
+        self.publish_cleanup(cleanup);
+        RunExit {
+            quarantined: self.resources.quarantined,
+            uncertain,
+        }
+    }
+    fn sample() -> ClockSample {
+        ClockSample::new(Instant::now().into_std(), Utc::now())
+    }
+    fn stopped(&self) -> Option<TaskFailure> {
+        self.context.stop.borrow().clone()
+    }
+    fn apply_control(&mut self) -> bool {
+        if self.driver.outcome().is_some() {
+            return true;
+        }
+        let now = Self::sample();
+        let reason = self.stopped().or_else(|| {
+            self.context
+                .stop
+                .has_changed()
+                .is_err()
+                .then(shutdown_reason)
+        });
+        if let Some(reason) = reason {
+            let _ = self.driver.stop(reason, now);
+            self.retire_active();
+            return true;
+        }
+        if now.monotonic >= self.driver.deadline {
+            let _ = self.driver.guard(now);
+            self.retire_active();
+            return true;
+        }
+        false
+    }
+    async fn next_operation(&mut self) -> Option<Operation> {
+        loop {
+            if self.apply_control() {
+                return None;
+            }
+            match &self.driver.phase {
+                Phase::Ready { .. } => return Some(Operation::Advance),
+                Phase::Terminal(_) => return None,
+                Phase::Joining { .. } => {
+                    self.fail(ExecutionError::Unavailable);
+                    return None;
+                }
+                Phase::Waiting { until, .. } => {
+                    let until = Instant::from_std((*until).min(self.driver.deadline));
+                    tokio::select! {
+                        biased;
+                        _=self.context.stop.changed()=>{},
+                        ()=sleep_until(until)=>return Some(Operation::Advance),
+                        result=self.resources.retired.join_next(),if !self.resources.retired.is_empty()=>if let Some(result)=result {self.cleanup_result(result);},
+                    }
+                }
+                Phase::Calling { attempt, deadline } => {
+                    let attempt = *attempt;
+                    let deadline = *deadline;
+                    if Instant::now().into_std() >= deadline {
+                        if Instant::now().into_std() < self.driver.deadline {
+                            let failure = TaskFailure(ExecutionFailure::fields(
+                                Some("States.Timeout".into()),
+                                None,
+                            ));
+                            if !self.record(events::task_failure(
+                                self.driver.machine(),
+                                self.driver.state,
+                                &failure,
+                                TaskFailureKind::TimedOut,
+                                Utc::now(),
+                            )) {
+                                return None;
+                            }
+                        }
+                        self.retire_active();
+                        return Some(Operation::Advance);
+                    }
+                    let Some(active) = &mut self.resources.active else {
+                        self.fail(ExecutionError::Unavailable);
+                        return None;
+                    };
+                    tokio::select! {
+                                           biased;
+                                           _=self.context.stop.changed()=>{},
+                                           ()=sleep_until(Instant::from_std(deadline))=>{},
+                                           result=self.resources.retired.join_next(),if !self.resources.retired.is_empty()=>if let Some(result)=result {self.cleanup_result(result);},
+                                           event=active.owned.call.next()=>{
+                                               if self.apply_control() {return None;}
+                                               let observed=Self::sample();
+                                               if observed.monotonic>=deadline {continue;}
+                                               match event {
+                                                   Ok(TaskEvent::Started)=>{if let Some(active)=&mut self.resources.active {active.started=true;}
+                    if !self.record(events::task_started(self.driver.machine(),self.driver.state,observed.wall)) {return None;}},
+                                                   Ok(TaskEvent::Submitted(_))=>{self.fail(ExecutionError::Unavailable);},
+                                                   Ok(TaskEvent::Completed(result))=>{
+                                                       if !self.record_result(&result,observed.wall) {return None;}
+                                                       self.retire_active();return Some(Operation::Complete {attempt,result,observed});
+                                                   }
+                                                   Err(_)=>{
+                                                       let result=Err(TaskFailure(ExecutionFailure::named("Lambda.ServiceException","Lambda task owner lost")));
+                                                       if !self.record_result(&result,observed.wall) {return None;}
+                                                       self.retire_active();return Some(Operation::Complete {attempt,result,observed});
+                                                   }
+                                               }
+                                           }
+                                       }
+                }
+            }
+        }
+    }
+    fn record_result(
+        &mut self,
+        result: &Result<Payload, TaskFailure>,
+        wall: DateTime<Utc>,
+    ) -> bool {
+        let started = self
+            .resources
+            .active
+            .as_ref()
+            .is_some_and(|active| active.started);
+        if result.is_ok() && !started {
+            self.fail(ExecutionError::Unavailable);
+            return false;
+        }
+        let kind = if started {
+            TaskFailureKind::Failed
+        } else {
+            TaskFailureKind::Admission
+        };
+        let event = match result {
+            Ok(output) => {
+                events::task_success(self.driver.machine(), self.driver.state, output, wall)
+            }
+            Err(failure) => events::task_failure(
+                self.driver.machine(),
+                self.driver.state,
+                failure,
+                kind,
+                wall,
+            ),
+        };
+        self.record(event)
+    }
+    pub(super) fn record(&mut self, event: Result<HistoryEvent, AslError>) -> bool {
+        match event
+            .map_err(ExecutionError::from)
+            .and_then(|event| self.context.journal.append(event, false))
+        {
+            Ok(()) => {
+                self.publish_running();
+                true
+            }
+            Err(error) => {
+                self.fail(error);
+                false
+            }
+        }
+    }
+    pub(super) fn fail(&mut self, error: ExecutionError) {
+        let outcome = if matches!(error, ExecutionError::Capacity) {
+            ExecutionOutcome::Failed(ExecutionFailure::named(
+                "States.HistoryLimitExceeded",
+                "Execution history limit exceeded",
+            ))
+        } else {
+            ExecutionOutcome::Failed(ExecutionFailure::named(
+                "Rustack.InternalError",
+                "Execution owner failed",
+            ))
+        };
+        if self.driver.outcome().is_none() {
+            self.driver.phase = Phase::Terminal(Arc::new(outcome));
+        }
+        self.record_diagnostic(Arc::new(error));
+        self.retire_active();
+    }
+    fn record_diagnostic(&self, error: Arc<ExecutionError>) {
+        let mut view = self.context.view.borrow().as_ref().clone();
+        view.diagnostic = Some(error);
+        self.context.view.send_replace(Arc::new(view));
+    }
+    pub(super) async fn dispatch(&mut self, dispatch: TaskDispatch) {
+        let timeout = match self.driver.machine.state(self.driver.state) {
+            Ok(StateView::Task { timeout, .. }) => match timeout {
+                TaskTimeout::Omitted => None,
+                TaskTimeout::Seconds(v) => Some(i64::from(v.get())),
+                TaskTimeout::Path(path) => path
+                    .lookup(&self.driver.input, &self.driver.context)
+                    .and_then(Value::as_i64),
+            },
+            _ => None,
+        };
+        if !self.record(events::scheduled(
+            self.driver.machine(),
+            dispatch.state(),
+            dispatch.parameters(),
+            timeout,
+            Utc::now(),
+        )) {
+            return;
+        }
+        let acquired = loop {
+            if self.apply_control() {
+                return;
+            }
+            if Instant::now().into_std() >= dispatch.deadline() {
+                // No call was issued; the driver still owns this attempt's timer.
+                return;
+            }
+            tokio::select! {
+                biased;
+                _=self.context.stop.changed()=>{},
+                ()=sleep_until(Instant::from_std(dispatch.deadline()))=>return,
+                result=self.resources.retired.join_next(),if !self.resources.retired.is_empty()=>if let Some(result)=result {self.cleanup_result(result);},
+                permit=self.shared.pools.dispatch.clone().acquire_owned()=>break permit,
+            }
+        };
+        let Ok(permit) = acquired else {
+            self.fail(ExecutionError::Unavailable);
+            return;
+        };
+        if self.apply_control() || Instant::now().into_std() >= dispatch.deadline() {
+            return;
+        }
+        let lease = Arc::new(DispatchLease {
+            _permit: Some(permit),
+            _frame: None,
+            _data: None,
+        });
+        self.resources.leases.push(lease.clone());
+        self.sync_ledger();
+        let command = LambdaTaskCommand::new(self.driver.machine.clone(), dispatch.clone());
+        let result = self.shared.port.as_ref().map_or_else(
+            || {
+                Err(TaskFailure(ExecutionFailure::named(
+                    "Lambda.ServiceException",
+                    "Lambda adapter unavailable",
+                )))
+            },
+            |port| port.start(command),
+        );
+        match result {
+            Ok(call) => {
+                self.resources.active = Some(CurrentCall {
+                    owned: OwnedCall { call, lease },
+                    started: false,
+                });
+            }
+            Err(failure) => {
+                self.release_lease(&lease);
+                let observed = Self::sample();
+                if self.apply_control() || observed.monotonic >= dispatch.deadline() {
+                    return;
+                }
+                if !self.record(events::task_failure(
+                    self.driver.machine(),
+                    dispatch.state(),
+                    &failure,
+                    TaskFailureKind::Admission,
+                    observed.wall,
+                )) {
+                    return;
+                }
+                // Drive admission failures through the same checkpoint/evaluation path.
+                self.pending = Some(Operation::Complete {
+                    attempt: dispatch.attempt(),
+                    result: Err(failure),
+                    observed,
+                });
+            }
+        }
+    }
+    fn retire_active(&mut self) {
+        if let Some(active) = self.resources.active.take() {
+            if active.owned.call.settlement() == TaskSettlement::Quarantined {
+                self.publish_cleanup(CleanupState::Quarantined);
+            }
+            active.owned.call.cancel();
+            let owned = active.owned;
+            self.resources.retired.spawn(async move {
+                let mut owned = owned;
+                if owned.call.settled().await.is_ok() {
+                    Ok(owned.lease.clone())
+                } else {
+                    Err(owned)
+                }
+            });
+        }
+    }
+    fn sync_ledger(&self) {
+        self.context
+            .ledger
+            .send_replace(Arc::new(self.resources.leases.clone()));
+    }
+    fn release_lease(&mut self, lease: &Arc<DispatchLease>) {
+        self.resources
+            .leases
+            .retain(|current| !Arc::ptr_eq(current, lease));
+        self.sync_ledger();
+    }
+    fn cleanup_result(&mut self, result: Result<Result<Arc<DispatchLease>, OwnedCall>, JoinError>) {
+        match result {
+            Ok(Ok(lease)) => self.release_lease(&lease),
+            Ok(Err(owned)) => {
+                self.resources.quarantined.push(owned);
+                self.publish_cleanup(CleanupState::Quarantined);
+            }
+            Err(error) => {
+                self.record_diagnostic(Arc::new(ExecutionError::Worker(error)));
+                tracing::error!("Workflow cleanup worker failed; dispatch capacity retained");
+                self.publish_cleanup(CleanupState::Quarantined);
+            }
+        }
+    }
+    fn reap_cleanups(&mut self) {
+        while let Some(result) = self.resources.retired.try_join_next() {
+            self.cleanup_result(result);
+        }
+    }
+    fn publish_running(&self) {
+        let old = self.context.view.borrow().clone();
+        self.context.view.send_replace(Arc::new(ExecutionView {
+            history: self.context.journal.view.clone(),
+            outcome: old.outcome.clone(),
+            stopped: old.stopped,
+            cleanup: old.cleanup,
+            diagnostic: old.diagnostic.clone(),
+        }));
+    }
+    fn publish_cleanup(&self, cleanup: CleanupState) {
+        let mut view = self.context.view.borrow().as_ref().clone();
+        view.cleanup = cleanup;
+        self.context.view.send_replace(Arc::new(view));
+    }
+    fn publish_terminal(&mut self) -> Result<(), ExecutionError> {
+        let Some(outcome) = self.driver.outcome().cloned() else {
+            return Err(ExecutionError::Unavailable);
+        };
+        let wall = Utc::now();
+        let first = events::terminal(&outcome, wall)
+            .map_err(ExecutionError::from)
+            .and_then(|event| self.context.journal.append(event, true));
+        let outcome = if let Err(error) = first {
+            let name = if matches!(error, ExecutionError::Capacity) {
+                "States.HistoryLimitExceeded"
+            } else {
+                "Rustack.InternalError"
+            };
+            let outcome = Arc::new(ExecutionOutcome::Failed(ExecutionFailure::named(
+                name,
+                "Terminal history could not be retained",
+            )));
+            let event = events::terminal(&outcome, wall).map_err(ExecutionError::from)?;
+            self.context.journal.append(event, true)?;
+            self.driver.phase = Phase::Terminal(outcome.clone());
+            outcome
+        } else {
+            outcome
+        };
+        let cleanup = if self.context.view.borrow().cleanup == CleanupState::Quarantined {
+            CleanupState::Quarantined
+        } else {
+            CleanupState::Pending
+        };
+        let diagnostic = self
+            .driver
+            .diagnostic
+            .as_ref()
+            .map(|e| Arc::new(ExecutionError::Evaluation(e.clone())))
+            .or_else(|| self.context.view.borrow().diagnostic.clone());
+        self.context.view.send_replace(Arc::new(ExecutionView {
+            history: self.context.journal.view.clone(),
+            outcome: Some(outcome),
+            stopped: Some(wall),
+            cleanup,
+            diagnostic,
+        }));
+        Ok(())
+    }
+    pub(super) async fn evaluation_permit(&mut self) -> Option<OwnedSemaphorePermit> {
+        loop {
+            if self.apply_control() {
+                return None;
+            }
+            tokio::select! {
+                biased;
+                _=self.context.stop.changed()=>{},
+                ()=sleep_until(Instant::from_std(self.driver.deadline))=>{},
+                permit=self.shared.pools.cpu.clone().acquire_owned()=>return permit.ok(),
+            }
+        }
+    }
+    #[cfg(test)]
+    pub(super) fn worker_hook(&self) -> Option<Arc<super::tests::WorkerHook>> {
+        self.shared.worker_hook.clone()
+    }
+    pub(super) fn start_worker(&mut self, worker: impl FnOnce() -> Evaluated + Send + 'static) {
+        self.resources.workers.spawn_blocking(worker);
+    }
+    pub(super) async fn evaluated(&mut self) -> Result<Option<Evaluated>, ExecutionError> {
+        loop {
+            if self.apply_control() {
+                return Ok(None);
+            }
+            tokio::select! {
+                biased;
+                _=self.context.stop.changed()=>{},
+                ()=sleep_until(Instant::from_std(self.driver.deadline))=>{},
+                result=self.resources.workers.join_next()=>return match result {Some(Ok(result))=>Ok(Some(result)),Some(Err(error))=>Err(ExecutionError::Worker(error)),None=>Err(ExecutionError::Unavailable)},
+            }
+        }
+    }
+    pub(super) fn commit(&mut self, evaluated: Evaluated) -> Option<DriverStep> {
+        if self.apply_control() {
+            return None;
+        }
+        let before_state = self.driver.state;
+        if matches!(self.driver.phase, Phase::Ready { entry: true })
+            && !self.record(events::entered(
+                self.driver.machine(),
+                before_state,
+                &self.driver.input,
+                evaluated.sample.wall,
+            ))
+        {
+            return None;
+        }
+        let exit = match &evaluated.proposed.phase {
+            Phase::Ready { entry: true } => Some(evaluated.proposed.input.clone()),
+            Phase::Terminal(outcome) => match outcome.as_ref() {
+                ExecutionOutcome::Succeeded(output) => Some(output.clone()),
+                _ => None,
+            },
+            _ => None,
+        };
+        if let Some(output) = exit {
+            if !self.record(events::exited(
+                self.driver.machine(),
+                before_state,
+                &output,
+                Utc::now(),
+            )) {
+                return None;
+            }
+        }
+        self.driver = evaluated.proposed;
+        Some(evaluated.step)
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/error.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/error.rs
new file mode 100644
index 00000000..819cef27
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/error.rs
@@ -0,0 +1,52 @@
+//! Typed redacted runtime/control failures.
+
+use std::{fmt, sync::Arc};
+
+use thiserror::Error;
+use tokio::task::JoinError;
+
+use crate::{AslError, CallbackError, FrameError};
+
+/// Runtime admission/control/history errors without payloads or panic text.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum ExecutionError {
+    /// A retained callback protocol or ownership source failed.
+    #[error("workflow callback owner failed")]
+    Callback(#[source] Arc<CallbackError>),
+    /// A structured frame protocol or ownership invariant failed.
+    #[error("structured workflow frame failed")]
+    Frame(#[source] FrameError),
+    /// Invalid trusted runtime/history settings or page arguments.
+    #[error("invalid workflow runtime configuration or page")]
+    Invalid,
+    /// Start requires an active Tokio runtime and an accepting supervisor.
+    #[error("workflow supervisor unavailable")]
+    Unavailable,
+    /// A bounded admission/history capacity cannot be reserved.
+    #[error("workflow capacity exhausted")]
+    Capacity,
+    /// The observer's absolute deadline expired; ownership remains unchanged.
+    #[error("workflow observation deadline exceeded")]
+    Deadline,
+    /// External cleanup or worker lifetime is uncertain.
+    #[error("workflow cleanup quarantined")]
+    Quarantined,
+    /// An interpreter/encoding failure, retained as a typed source.
+    #[error("workflow runtime evaluation failed")]
+    Evaluation(#[source] Arc<AslError>),
+    /// A supervised worker panicked or was unexpectedly cancelled.
+    #[error("workflow worker failed")]
+    Worker(#[source] JoinError),
+}
+impl fmt::Debug for ExecutionError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+
+impl From<AslError> for ExecutionError {
+    fn from(source: AslError) -> Self {
+        Self::Evaluation(Arc::new(source))
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/evaluate.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/evaluate.rs
new file mode 100644
index 00000000..d5985bf1
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/evaluate.rs
@@ -0,0 +1,70 @@
+//! CPU proposals never own resource effects; the actor commits after control checks.
+
+use chrono::Utc;
+use tokio::time::Instant;
+
+use super::{
+    super::{ClockSample, DriverStep},
+    ExecutionError,
+    actor::Actor,
+};
+use crate::{AttemptId, ExecutionDriver, Payload, SystemUuidSource, TaskFailure};
+
+#[derive(Debug)]
+pub(super) enum Operation {
+    Advance,
+    Complete {
+        attempt: AttemptId,
+        result: Result<Payload, TaskFailure>,
+        observed: ClockSample,
+    },
+}
+#[derive(Debug)]
+pub(super) struct Evaluated {
+    pub(super) proposed: ExecutionDriver,
+    pub(super) step: DriverStep,
+    pub(super) sample: ClockSample,
+}
+impl Actor {
+    pub(super) async fn evaluate(
+        &mut self,
+        operation: Operation,
+    ) -> Result<Option<DriverStep>, ExecutionError> {
+        let Some(permit) = self.evaluation_permit().await else {
+            return Ok(None);
+        };
+        let mut proposed = self.driver.clone();
+        #[cfg(test)]
+        let hook = self.worker_hook();
+        self.start_worker(move || {
+            #[cfg(test)]
+            if let Some(hook) = &hook {
+                hook.run(true);
+            }
+            let _permit = permit;
+            let sample = ClockSample::new(Instant::now().into_std(), Utc::now());
+            let mut source = SystemUuidSource::default();
+            let update = match operation {
+                Operation::Advance => proposed.advance(sample, &mut source),
+                Operation::Complete {
+                    attempt,
+                    result,
+                    observed,
+                } => proposed.complete(attempt, result, observed, &mut source),
+            };
+            #[cfg(test)]
+            if let Some(hook) = &hook {
+                hook.run(false);
+            }
+            Evaluated {
+                proposed,
+                step: update.step,
+                sample,
+            }
+        });
+        Ok(self
+            .evaluated()
+            .await?
+            .and_then(|result| self.commit(result)))
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/mod.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/mod.rs
new file mode 100644
index 00000000..8a97b279
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/mod.rs
@@ -0,0 +1,631 @@
+//! Bounded registry-owned execution and cleanup supervision.
+
+use std::{collections::HashMap, future::pending, mem::take, sync::Arc};
+
+use chrono::Utc;
+use tokio::{
+    runtime::Handle,
+    sync::{OwnedSemaphorePermit, Semaphore, oneshot, watch},
+    task::{Id, JoinError, JoinSet},
+    time::{Instant, timeout_at},
+};
+
+use super::history::{HistoryCapacity, HistoryLimits, Journal, TerminalReserve, events};
+use crate::{
+    CallbackRegistry, ChildExecutionPort, ExecutionDriver, ExecutionFailure, ExecutionSnapshot,
+    FrameCapacity, FrameLease, FrameLimits, FrameScheduler, LambdaTaskPort, Payload, RoleArn,
+    TaskFailure, TenantScope,
+};
+
+mod actor;
+mod error;
+mod evaluate;
+mod restore;
+mod structured;
+#[cfg(test)]
+mod tests;
+mod types;
+
+use actor::{Actor, OwnedCall, RunExit};
+pub use error::ExecutionError;
+pub(crate) use restore::HistoryRestorer;
+pub use types::{CleanupState, ExecutionHandle, ExecutionView, RuntimeLimits};
+
+use super::scheduler::TaskBytes;
+
+#[derive(Debug)]
+struct Pools {
+    open_limit: usize,
+    open: Arc<Semaphore>,
+    dispatch: Arc<Semaphore>,
+    cpu: Arc<Semaphore>,
+}
+#[derive(Debug)]
+struct Shared {
+    #[cfg(test)]
+    worker_hook: Option<Arc<tests::WorkerHook>>,
+    #[cfg(test)]
+    child_cpu_panic: bool,
+    #[cfg(test)]
+    callback_hook: Option<Arc<tests::WorkerHook>>,
+    pools: Pools,
+    port: Option<Arc<dyn LambdaTaskPort>>,
+    history: HistorySettings,
+    frames: FrameSettings,
+    callbacks: Option<CallbackRegistry>,
+}
+#[derive(Debug)]
+struct FrameSettings {
+    capacity: Arc<FrameCapacity>,
+    limits: FrameLimits,
+}
+#[derive(Debug)]
+struct HistorySettings {
+    limits: HistoryLimits,
+    capacity: Arc<HistoryCapacity>,
+}
+#[derive(Debug)]
+struct Slot {
+    stop: watch::Sender<Option<TaskFailure>>,
+    view: watch::Sender<Arc<ExecutionView>>,
+    reserve: Arc<TerminalReserve>,
+    leases: watch::Receiver<Arc<Vec<Arc<DispatchLease>>>>,
+    _permit: OwnedSemaphorePermit,
+    _root_frame: Arc<FrameLease>,
+}
+#[derive(Debug)]
+struct DispatchLease {
+    _data: Option<TaskBytes>,
+    _permit: Option<OwnedSemaphorePermit>,
+    _frame: Option<Arc<FrameLease>>,
+}
+#[derive(Debug)]
+struct Retained {
+    _slot: Slot,
+    _calls: Vec<OwnedCall>,
+}
+#[derive(Debug, Default)]
+struct OwnerState {
+    accepting: bool,
+    started: bool,
+    jobs: JoinSet<RunExit>,
+    slots: HashMap<Id, Slot>,
+    quarantine: Vec<Retained>,
+}
+
+#[derive(Debug)]
+pub(crate) struct Registered {
+    pub(crate) handle: ExecutionHandle,
+    pub(crate) parent: Option<oneshot::Sender<ExecutionSnapshot>>,
+}
+
+/// Actor-owned supervisor; the registry must reap jobs and drain before shutdown.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct ExecutionSupervisor {
+    shared: Arc<Shared>,
+    state: OwnerState,
+}
+impl ExecutionSupervisor {
+    pub(crate) fn snapshot_restorer(&self) -> HistoryRestorer {
+        HistoryRestorer {
+            lambda: self.shared.port.is_some(),
+            fresh: !self.state.started && self.state.accepting,
+            limits: self.shared.history.limits,
+            capacity: self.shared.history.capacity.clone(),
+        }
+    }
+    pub(crate) fn lambda_support(&self) -> bool {
+        self.shared.port.is_some()
+    }
+    pub(crate) fn open_limit(&self) -> usize {
+        self.shared.pools.open_limit
+    }
+    /// Install the real token registry before this owner accepts any execution.
+    ///
+    /// # Errors
+    /// Requires a live callback root and installed Lambda port; rejects duplicate,
+    /// reconfigured or shared ownership, including after completed work.
+    /// Registry composition additionally validates the installed trusted scope.
+    ///
+    /// ```no_run
+    /// # fn install(owner:&mut rustack_stepfunctions_core::ExecutionSupervisor,registry:rustack_stepfunctions_core::CallbackRegistry){let result=owner.install_callbacks(registry);}
+    /// ```
+    pub fn install_callbacks(&mut self, callbacks: CallbackRegistry) -> Result<(), ExecutionError> {
+        if !callbacks.status().ready {
+            return Err(ExecutionError::Unavailable);
+        }
+        if self.state.started || !self.state.accepting {
+            return Err(ExecutionError::Invalid);
+        }
+        let shared = Arc::get_mut(&mut self.shared).ok_or(ExecutionError::Unavailable)?;
+        if shared.port.is_none() {
+            return Err(ExecutionError::Unavailable);
+        }
+        if shared.callbacks.is_some() {
+            return Err(ExecutionError::Invalid);
+        }
+        shared.callbacks = Some(callbacks);
+        Ok(())
+    }
+    pub(crate) fn callback_scope(&self) -> Option<&TenantScope> {
+        self.shared.callbacks.as_ref().map(CallbackRegistry::scope)
+    }
+    pub(crate) fn callbacks(&self) -> Option<CallbackRegistry> {
+        self.shared.callbacks.clone()
+    }
+    /// Construct bounded pools/history accounting without spawning or enabling APIs.
+    ///
+    /// # Errors
+    /// Rejects global history outside8MiB..=4GiB or below the per-execution cap.
+    ///
+    /// ```
+    /// let owner=rustack_stepfunctions_core::ExecutionSupervisor::new(
+    ///     rustack_stepfunctions_core::RuntimeLimits::default(),
+    ///     rustack_stepfunctions_core::HistoryLimits::default(),256*1024*1024,None)?;
+    /// # Ok::<(),rustack_stepfunctions_core::ExecutionError>(())
+    /// ```
+    pub fn new(
+        limits: RuntimeLimits,
+        history: HistoryLimits,
+        total_history: usize,
+        port: Option<Arc<dyn LambdaTaskPort>>,
+    ) -> Result<Self, ExecutionError> {
+        Self::new_with_frames(
+            limits,
+            history,
+            total_history,
+            port,
+            Arc::new(FrameCapacity::default()),
+            FrameLimits::default(),
+        )
+    }
+    /// Construct the resource owner with validated shared/local frame budgets.
+    ///
+    /// # Errors
+    /// Returns the same runtime/history configuration errors as `new`.
+    ///
+    /// ```
+    /// let owner=rustack_stepfunctions_core::ExecutionSupervisor::new_with_frames(rustack_stepfunctions_core::RuntimeLimits::default(),rustack_stepfunctions_core::HistoryLimits::default(),256*1024*1024,None,std::sync::Arc::new(rustack_stepfunctions_core::FrameCapacity::default()),rustack_stepfunctions_core::FrameLimits::default())?;
+    /// # Ok::<(),rustack_stepfunctions_core::ExecutionError>(())
+    /// ```
+    pub fn new_with_frames(
+        limits: RuntimeLimits,
+        history: HistoryLimits,
+        total_history: usize,
+        port: Option<Arc<dyn LambdaTaskPort>>,
+        frame_capacity: Arc<FrameCapacity>,
+        frame_limits: FrameLimits,
+    ) -> Result<Self, ExecutionError> {
+        let capacity = HistoryCapacity::new(total_history, history)?;
+        Ok(Self {
+            shared: Arc::new(Shared {
+                #[cfg(test)]
+                worker_hook: None,
+                #[cfg(test)]
+                child_cpu_panic: false,
+                #[cfg(test)]
+                callback_hook: None,
+                pools: Pools {
+                    open_limit: limits.open,
+                    open: Arc::new(Semaphore::new(limits.open)),
+                    dispatch: Arc::new(Semaphore::new(limits.dispatch)),
+                    cpu: Arc::new(Semaphore::new(limits.cpu)),
+                },
+                port,
+                callbacks: None,
+                frames: FrameSettings {
+                    capacity: frame_capacity,
+                    limits: frame_limits,
+                },
+                history: HistorySettings {
+                    limits: history,
+                    capacity,
+                },
+            }),
+            state: OwnerState {
+                accepting: true,
+                ..OwnerState::default()
+            },
+        })
+    }
+    /// Transfer a driver to the supervisor, independent of all observing callers.
+    ///
+    /// # Errors
+    /// Rejects unavailable runtime/closed owner, missing adapter or admission/history
+    /// exhaustion before registration; no invocation occurs on rejection.
+    ///
+    /// ```no_run
+    /// # fn start(owner:&mut rustack_stepfunctions_core::ExecutionSupervisor,driver:rustack_stepfunctions_core::ExecutionDriver) {
+    /// let handle=owner.start(driver);
+    /// # }
+    /// ```
+    pub fn start(&mut self, driver: ExecutionDriver) -> Result<ExecutionHandle, ExecutionError> {
+        self.start_owned(driver, false, None, None)
+            .map(|registered| registered.handle)
+    }
+    /// Start an execution with the installed structured frame/resource owner.
+    ///
+    /// The default API compiler remains independently gated until service acceptance.
+    ///
+    /// # Errors
+    /// Rejects missing adapters, exhausted frame/history/open capacity or a closed owner.
+    ///
+    /// ```no_run
+    /// # fn start(owner:&mut rustack_stepfunctions_core::ExecutionSupervisor,driver:rustack_stepfunctions_core::ExecutionDriver) { let handle=owner.start_structured(driver); }
+    /// ```
+    pub fn start_structured(
+        &mut self,
+        driver: ExecutionDriver,
+    ) -> Result<ExecutionHandle, ExecutionError> {
+        self.start_owned(driver, true, None, None)
+            .map(|registered| registered.handle)
+    }
+    /// Capture registry role metadata before publishing the initial history view.
+    pub(crate) fn start_registered(
+        &mut self,
+        driver: ExecutionDriver,
+        structured: bool,
+        port: ChildExecutionPort,
+        role: &RoleArn,
+    ) -> Result<Registered, ExecutionError> {
+        self.start_owned(driver, structured, Some(port), Some(role))
+    }
+    fn start_owned(
+        &mut self,
+        driver: ExecutionDriver,
+        structured: bool,
+        child_port: Option<ChildExecutionPort>,
+        role: Option<&RoleArn>,
+    ) -> Result<Registered, ExecutionError> {
+        if !self.state.accepting || Handle::try_current().is_err() {
+            return Err(ExecutionError::Unavailable);
+        }
+        self.reap_ready();
+        if driver.started
+            || (driver.machine().uses_callbacks()
+                && (!structured || child_port.is_none() || self.shared.callbacks.is_none()))
+            || (!structured && driver.machine().requires_structured_execution())
+            || (driver.machine().uses_children() && (!structured || child_port.is_none()))
+            || (self.shared.port.is_none() && driver.machine().uses_lambda())
+        {
+            return Err(ExecutionError::Unavailable);
+        }
+        let permit = self
+            .shared
+            .pools
+            .open
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| ExecutionError::Capacity)?;
+        let deadline = Instant::from_std(driver.deadline());
+        let mut graph = self.graph(&driver, structured)?;
+        let root_frame = if let Some(graph) = &graph {
+            graph.root_lease().ok_or(ExecutionError::Invalid)?
+        } else {
+            FrameLease::root(&self.shared.frames.capacity, self.shared.frames.limits)
+                .map_err(|_| ExecutionError::Capacity)?
+        };
+        let (journal, reserve) = self.initial_history(driver.input(), role)?;
+        let (view, reader) = watch::channel(Arc::new(ExecutionView {
+            history: journal.view.clone(),
+            outcome: None,
+            stopped: None,
+            cleanup: CleanupState::Pending,
+            diagnostic: None,
+        }));
+        let (stop, cancelled) = watch::channel(None);
+        let (leases, ledger) = watch::channel(Arc::new(Vec::new()));
+        let (parent, registration) =
+            if driver.machine().uses_children() || driver.machine().uses_callbacks() {
+                let (sender, receiver) = oneshot::channel();
+                (Some(sender), child_port.map(|port| (port, receiver)))
+            } else {
+                (None, None)
+            };
+        let task = if let Some(graph) = graph.take() {
+            self.state.jobs.spawn(
+                structured::Actor::new(
+                    graph,
+                    deadline,
+                    journal,
+                    view.clone(),
+                    cancelled,
+                    leases,
+                    self.shared.clone(),
+                )
+                .with_child_registration(registration)
+                .run(),
+            )
+        } else {
+            self.state.jobs.spawn(
+                Actor::new(
+                    driver,
+                    journal,
+                    view.clone(),
+                    cancelled,
+                    leases,
+                    self.shared.clone(),
+                )
+                .run(),
+            )
+        };
+        self.state.started = true;
+        self.state.slots.insert(
+            task.id(),
+            Slot {
+                stop: stop.clone(),
+                view,
+                reserve,
+                leases: ledger,
+                _permit: permit,
+                _root_frame: root_frame,
+            },
+        );
+        Ok(Registered {
+            handle: ExecutionHandle { stop, view: reader },
+            parent,
+        })
+    }
+    fn initial_history(
+        &self,
+        input: &Payload,
+        role: Option<&RoleArn>,
+    ) -> Result<(Journal, Arc<TerminalReserve>), ExecutionError> {
+        let reserve = TerminalReserve::new(&self.shared.history.capacity)?;
+        let mut journal = Journal::new(
+            self.shared.history.limits,
+            self.shared.history.capacity.clone(),
+            reserve.clone(),
+        );
+        let mut started = events::started(input, Utc::now()).map_err(ExecutionError::from)?;
+        if let (Some(role), Some(details)) =
+            (role, started.execution_started_event_details.as_mut())
+        {
+            details.role_arn = Some(role.as_str().to_owned());
+        }
+        journal.append(started, false)?;
+        Ok((journal, reserve))
+    }
+    fn graph(
+        &self,
+        driver: &ExecutionDriver,
+        structured: bool,
+    ) -> Result<Option<FrameScheduler>, ExecutionError> {
+        if structured {
+            FrameScheduler::new(
+                driver.clone(),
+                self.shared.frames.capacity.clone(),
+                self.shared.frames.limits,
+            )
+            .map(Some)
+            .map_err(|_| ExecutionError::Capacity)
+        } else {
+            Ok(None)
+        }
+    }
+    /// Reap already completed jobs without waiting; retained quarantine stays charged.
+    ///
+    /// ```
+    /// # fn reap(owner:&mut rustack_stepfunctions_core::ExecutionSupervisor) { owner.reap_ready(); }
+    /// ```
+    pub fn reap_ready(&mut self) {
+        while let Some(result) = self.state.jobs.try_join_next_with_id() {
+            self.finish(result);
+        }
+    }
+    /// Join one job; callers may cancel the waiter and resume the same supervisor.
+    ///
+    /// ```no_run
+    /// # async fn reap(owner:&mut rustack_stepfunctions_core::ExecutionSupervisor) { owner.reap_next().await; }
+    /// ```
+    pub async fn reap_next(&mut self) {
+        if let Some(result) = self.state.jobs.join_next_with_id().await {
+            self.finish(result);
+        }
+    }
+    /// Reject starts and request shutdown once; repeated calls preserve Stop reasons.
+    ///
+    /// ```
+    /// # fn close(owner:&mut rustack_stepfunctions_core::ExecutionSupervisor) { owner.close(); }
+    /// ```
+    pub fn close(&mut self) {
+        self.state.accepting = false;
+        for slot in self.state.slots.values() {
+            slot.stop.send_if_modified(|stop| {
+                if stop.is_some() {
+                    false
+                } else {
+                    *stop = Some(shutdown_reason());
+                    true
+                }
+            });
+        }
+    }
+    /// Close and join through one absolute deadline; expiry retains every job/slot.
+    ///
+    /// # Errors
+    /// Returns Deadline while jobs remain live, or Quarantined after uncertain exit.
+    ///
+    /// ```no_run
+    /// # async fn drain(owner:&mut rustack_stepfunctions_core::ExecutionSupervisor,deadline:tokio::time::Instant) {
+    /// let result=owner.drain(deadline).await;
+    /// # }
+    /// ```
+    #[tracing::instrument(name="stepfunctions.drain",skip(self),fields(owned=self.owned_executions()))]
+    pub async fn drain(&mut self, deadline: Instant) -> Result<(), ExecutionError> {
+        self.close();
+        while !self.state.jobs.is_empty() {
+            timeout_at(deadline, self.reap_next())
+                .await
+                .map_err(|_| ExecutionError::Deadline)?;
+        }
+        if self.state.quarantine.is_empty() {
+            Ok(())
+        } else {
+            Err(ExecutionError::Quarantined)
+        }
+    }
+    /// Read cleanup supervisor health independently of admission capacity.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::ExecutionSupervisor){let ready=owner.is_ready();}
+    /// ```
+    #[must_use]
+    pub fn is_ready(&self) -> bool {
+        self.state.accepting
+            && self.state.quarantine.is_empty()
+            && self
+                .shared
+                .callbacks
+                .as_ref()
+                .is_none_or(|registry| registry.status().ready)
+    }
+    /// Read all unsettled jobs/quarantine slots; terminal observers do not release them.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::ExecutionSupervisor) { let active=owner.owned_executions(); }
+    /// ```
+    #[must_use]
+    pub fn owned_executions(&self) -> usize {
+        self.state.slots.len() + self.state.quarantine.len()
+    }
+    /// Read retained global history bytes, including views held by observers.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::ExecutionSupervisor) { let bytes=owner.history_bytes(); }
+    /// ```
+    #[must_use]
+    pub fn history_bytes(&self) -> usize {
+        self.shared.history.capacity.used()
+    }
+    fn finish(&mut self, result: Result<(Id, RunExit), JoinError>) {
+        finish_owned(&mut self.state, &self.shared, result);
+    }
+}
+fn finish_owned(state: &mut OwnerState, shared: &Shared, result: Result<(Id, RunExit), JoinError>) {
+    match result {
+        Ok((id, exit)) => {
+            if let Some(slot) = state.slots.remove(&id) {
+                if exit.uncertain {
+                    publish_owner_failure(&slot, shared, None);
+                    state.quarantine.push(Retained {
+                        _slot: slot,
+                        _calls: exit.quarantined,
+                    });
+                } else {
+                    drop(slot);
+                }
+            }
+        }
+        Err(error) => {
+            if let Some(slot) = state.slots.remove(&error.id()) {
+                tracing::error!(
+                    dispatches = slot.leases.borrow().len(),
+                    "Workflow execution actor failed; retaining its capacity"
+                );
+                publish_owner_failure(&slot, shared, Some(Arc::new(ExecutionError::Worker(error))));
+                state.quarantine.push(Retained {
+                    _slot: slot,
+                    _calls: Vec::new(),
+                });
+            }
+        }
+    }
+}
+
+fn shutdown_reason() -> TaskFailure {
+    TaskFailure(ExecutionFailure::named(
+        "Rustack.Shutdown",
+        "Workflow supervisor is shutting down",
+    ))
+}
+fn publish_owner_failure(slot: &Slot, shared: &Shared, diagnostic: Option<Arc<ExecutionError>>) {
+    let old = slot.view.borrow().clone();
+    if old.outcome.is_some() {
+        let mut view = old.as_ref().clone();
+        view.cleanup = CleanupState::Quarantined;
+        if diagnostic.is_some() {
+            view.diagnostic = diagnostic;
+        }
+        slot.view.send_replace(Arc::new(view));
+        return;
+    }
+    let outcome = types::internal_outcome();
+    let wall = Utc::now();
+    let mut journal = Journal::resume(
+        old.history.clone(),
+        shared.history.limits,
+        shared.history.capacity.clone(),
+        slot.reserve.clone(),
+    );
+    if let Ok(event) = events::terminal(&outcome, wall) {
+        if journal.append(event, true).is_ok() {
+            slot.view.send_replace(Arc::new(ExecutionView {
+                history: journal.view,
+                outcome: Some(outcome),
+                stopped: Some(wall),
+                cleanup: CleanupState::Quarantined,
+                diagnostic: diagnostic.or_else(|| old.diagnostic.clone()),
+            }));
+        }
+    }
+}
+
+#[derive(Debug)]
+struct FallbackOwner {
+    state: OwnerState,
+    shared: Arc<Shared>,
+}
+impl FallbackOwner {
+    async fn drain(mut self) {
+        while let Some(result) = self.state.jobs.join_next_with_id().await {
+            finish_owned(&mut self.state, &self.shared, result);
+        }
+        if !self.state.quarantine.is_empty() {
+            tracing::error!(
+                executions = self.state.quarantine.len(),
+                "Dropped workflow supervisor retains quarantined resources"
+            );
+            pending::<()>().await;
+        }
+    }
+}
+impl Drop for FallbackOwner {
+    fn drop(&mut self) {
+        if self.state.jobs.is_empty()
+            && self.state.slots.is_empty()
+            && self.state.quarantine.is_empty()
+        {
+            return;
+        }
+        // Covers cancellation before first poll, panic, and runtime shutdown.
+        // The unresolved graph must outlive the executor that stopped polling it.
+        let state = take(&mut self.state);
+        tracing::error!(
+            executions = state.slots.len() + state.quarantine.len(),
+            "Workflow fallback lost its runtime; ownership quarantined for process lifetime"
+        );
+        let _retained = Box::leak(Box::new((self.shared.clone(), state)));
+    }
+}
+impl Drop for ExecutionSupervisor {
+    fn drop(&mut self) {
+        if self.state.jobs.is_empty() && self.state.quarantine.is_empty() {
+            return;
+        }
+        self.close();
+        let retained = FallbackOwner {
+            state: take(&mut self.state),
+            shared: self.shared.clone(),
+        };
+        if let Ok(runtime) = Handle::try_current() {
+            // Intentional detached fallback owner. Its Drop guard preserves the
+            // bounded graph even if this future never polls or is cancelled.
+            let fallback = runtime.spawn(retained.drain());
+            drop(fallback);
+        } else {
+            drop(retained);
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/restore.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/restore.rs
new file mode 100644
index 00000000..defb3cb7
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/restore.rs
@@ -0,0 +1,92 @@
+//! Pure charged terminal-view reconstruction; never starts a runtime job.
+
+use std::sync::Arc;
+
+use chrono::{DateTime, Utc};
+use rustack_stepfunctions_model::types::HistoryEvent;
+use tokio::sync::watch;
+
+use super::{CleanupState, ExecutionError, ExecutionHandle, ExecutionView};
+use crate::{
+    ExecutionFailure, ExecutionOutcome, TaskFailure,
+    engine::history::{
+        HistoryCapacity, HistoryLimits, Journal, TerminalReserve, events, snapshot_charge,
+    },
+};
+
+#[derive(Debug, Clone)]
+pub(crate) struct HistoryRestorer {
+    pub(crate) lambda: bool,
+    pub(crate) fresh: bool,
+    pub(super) limits: HistoryLimits,
+    pub(super) capacity: Arc<HistoryCapacity>,
+}
+impl HistoryRestorer {
+    pub(crate) fn used(&self) -> usize {
+        self.capacity.used()
+    }
+    pub(crate) fn estimate(
+        events: impl Iterator<Item = usize>,
+        terminal: bool,
+    ) -> Result<usize, ExecutionError> {
+        snapshot_charge(events, terminal)
+    }
+    pub(crate) fn validate_terminal(
+        event: &HistoryEvent,
+        outcome: &ExecutionOutcome,
+        stopped: DateTime<Utc>,
+    ) -> Result<(), ExecutionError> {
+        if event.timestamp != stopped {
+            return Err(ExecutionError::Invalid);
+        }
+        let mut expected = events::terminal(outcome, stopped)?;
+        expected.id = event.id;
+        expected.previous_event_id = event.previous_event_id;
+        let expected = serde_json::to_vec(&expected).map_err(|_| ExecutionError::Invalid)?;
+        let actual = serde_json::to_vec(event).map_err(|_| ExecutionError::Invalid)?;
+        if expected != actual {
+            return Err(ExecutionError::Invalid);
+        }
+        Ok(())
+    }
+    pub(crate) fn terminal(
+        &self,
+        events: Vec<HistoryEvent>,
+        outcome: Option<ExecutionOutcome>,
+        stopped: Option<DateTime<Utc>>,
+        wall: DateTime<Utc>,
+    ) -> Result<ExecutionHandle, ExecutionError> {
+        let interrupted = outcome.is_none();
+        let (outcome, stopped) = match (outcome, stopped) {
+            (Some(outcome), Some(stopped)) => (outcome, stopped),
+            (None, None) => (
+                ExecutionOutcome::Aborted(TaskFailure(ExecutionFailure::named(
+                    "Rustack.ExecutionInterrupted",
+                    "Execution interrupted by local snapshot restore",
+                ))),
+                wall,
+            ),
+            _ => return Err(ExecutionError::Invalid),
+        };
+        let reserve = TerminalReserve::new(&self.capacity)?;
+        let mut journal = Journal::new(self.limits, self.capacity.clone(), reserve);
+        let mut events = events.into_iter().peekable();
+        while let Some(event) = events.next() {
+            let previous = u32::try_from(event.previous_event_id.ok_or(ExecutionError::Invalid)?)
+                .map_err(|_| ExecutionError::Invalid)?;
+            journal.append_causal(event, previous, !interrupted && events.peek().is_none())?;
+        }
+        if interrupted {
+            journal.append(events::terminal(&outcome, wall)?, true)?;
+        }
+        let (_, view) = watch::channel(Arc::new(ExecutionView {
+            history: journal.view,
+            outcome: Some(Arc::new(outcome)),
+            stopped: Some(stopped),
+            cleanup: CleanupState::Clean,
+            diagnostic: None,
+        }));
+        let (stop, _) = watch::channel(None);
+        Ok(ExecutionHandle { stop, view })
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback.rs
new file mode 100644
index 00000000..da2b0839
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback.rs
@@ -0,0 +1,163 @@
+//! Registered token/history/physical-call ownership for deferred callback effects.
+
+use std::sync::Arc;
+
+use chrono::Utc;
+use tokio::{
+    sync::{mpsc, oneshot},
+    time::Instant,
+};
+
+use super::{Actor, DispatchLease, ExecutionError, Instruction, Message, Progress, Shared};
+use crate::{
+    CallbackDispatch, CallbackError, CallbackHistory, CallbackRegistry, ExecutionFailure,
+    ExecutionSnapshot, FrameCallId, MAX_PAYLOAD_BYTES, TaskCall, TaskFailure,
+    engine::scheduler::TaskDataBudget,
+};
+
+mod owner;
+mod progress;
+mod worker;
+
+const PROTOCOL_BYTES: usize = 65_536;
+const PREPARATION_OVERHEAD: usize = 256;
+const RESULT_BYTES: usize = MAX_PAYLOAD_BYTES + PROTOCOL_BYTES;
+const PREPARATION_BYTES: usize = 2 * MAX_PAYLOAD_BYTES + PREPARATION_OVERHEAD;
+#[derive(Debug)]
+struct Context {
+    id: FrameCallId,
+    effect: CallbackDispatch,
+    binding: (CallbackRegistry, ExecutionSnapshot),
+    shared: Arc<Shared>,
+    sender: mpsc::Sender<Message>,
+}
+impl Actor {
+    pub(super) fn start_callback(
+        &mut self,
+        id: FrameCallId,
+        effect: CallbackDispatch,
+    ) -> Result<(), ExecutionError> {
+        let binding = (
+            self.shared
+                .callbacks
+                .clone()
+                .ok_or(ExecutionError::Unavailable)?,
+            self.parent.clone().ok_or(ExecutionError::Unavailable)?,
+        );
+        let graph = self.graph.as_ref().ok_or(ExecutionError::Invalid)?;
+        let frame = graph.lease(id.frame()).ok_or(ExecutionError::Invalid)?;
+        let budget = graph.task_data_budget();
+        let (data, admitted) = match budget.reserve(RESULT_BYTES) {
+            Ok(data) => (Some(data), true),
+            Err(_) => (None, false),
+        };
+        let lease = Arc::new(DispatchLease {
+            _permit: None,
+            _frame: Some(frame),
+            _data: data,
+        });
+        self.leases.push(lease.clone());
+        self.sync_ledger();
+        let (call, responder) = TaskCall::channel();
+        let machine = effect.machine().clone();
+        if admitted {
+            self.callback_jobs.spawn(worker::run(
+                Context {
+                    id,
+                    effect: effect.clone(),
+                    binding,
+                    shared: self.shared.clone(),
+                    sender: self.sender.clone(),
+                },
+                responder,
+                lease.clone(),
+                budget,
+            ));
+        } else {
+            responder.finish(Err(limit_failure()));
+        }
+        self.accepted_instruction(id, machine, Instruction::Callback(effect), call, lease);
+        Ok(())
+    }
+    pub(super) fn callback_scheduled(
+        &mut self,
+        id: FrameCallId,
+        history: &CallbackHistory,
+        ack: oneshot::Sender<bool>,
+    ) {
+        self.control();
+        let current = self.current(id);
+        let allowed = !self.published
+            && current
+            && self.calls.get(&id).is_some_and(|call| {
+                !call.cancelled
+                    && !call.result_seen
+                    && call.progress == Progress::Preparing
+                    && Instant::now().into_std() < call.dispatch.deadline()
+            });
+        if !allowed {
+            let _ = ack.send(false);
+            return;
+        }
+        let result =
+            self.calls
+                .get(&id)
+                .ok_or(ExecutionError::Invalid)
+                .and_then(|call| match &call.dispatch {
+                    Instruction::Callback(effect) => effect
+                        .scheduled_event(history, Utc::now())
+                        .map_err(ExecutionError::from),
+                    Instruction::Task(_) => Err(ExecutionError::Invalid),
+                });
+        match result.and_then(|event| self.history.event(id.frame(), Ok(event))) {
+            Ok(()) => {
+                if let Some(call) = self.calls.get_mut(&id) {
+                    call.progress = Progress::Pending;
+                }
+                self.publish_running();
+                self.control();
+                let allowed = !self.published
+                    && self.calls.get(&id).is_some_and(|call| {
+                        !call.cancelled && Instant::now().into_std() < call.dispatch.deadline()
+                    });
+                let _ = ack.send(allowed);
+            }
+            Err(error) => {
+                let _ = ack.send(false);
+                self.fail(error);
+            }
+        }
+    }
+}
+fn limit_failure() -> TaskFailure {
+    TaskFailure::safety(
+        "Rustack.ResultLimitExceeded",
+        "Callback data budget exhausted",
+    )
+}
+fn callback_limit_failure() -> TaskFailure {
+    TaskFailure::safety(
+        "Rustack.CallbackLimitExceeded",
+        "Callback token capacity exhausted",
+    )
+}
+fn timeout_failure() -> TaskFailure {
+    TaskFailure(ExecutionFailure::fields(
+        Some("States.Timeout".into()),
+        None,
+    ))
+}
+
+fn unknown(error: &CallbackError) -> bool {
+    match error {
+        CallbackError::Cached(source) => unknown(source),
+        CallbackError::TaskTimedOut
+        | CallbackError::Deadline
+        | CallbackError::Capacity
+        | CallbackError::Data(_) => false,
+        _ => true,
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/owner.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/owner.rs
new file mode 100644
index 00000000..c15967d8
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/owner.rs
@@ -0,0 +1,214 @@
+//! Unique retained receipts; panic/drop never asserts cleanup or releases charges.
+
+use std::sync::Arc;
+
+use tokio::{
+    sync::{OwnedSemaphorePermit, watch},
+    task::{JoinHandle, spawn_blocking},
+    time::{Instant, sleep_until},
+};
+
+use super::{
+    CallbackError, Context, DispatchLease, PREPARATION_BYTES, PREPARATION_OVERHEAD, TaskDataBudget,
+    limit_failure, unknown,
+};
+use crate::{
+    AslError, CallbackHistory, CallbackMint, CallbackOutcome, CallbackTask, CallbackToken,
+    SystemUuidSource, TaskCall, TaskDispatch, TaskFailure, TaskSettlement,
+    engine::scheduler::TaskBytes,
+};
+
+#[derive(Debug)]
+pub(super) struct Prepared {
+    pub(super) dispatch: TaskDispatch,
+    pub(super) history: CallbackHistory,
+    pub(super) charge: TaskBytes,
+}
+#[derive(Debug, Default)]
+pub(super) struct TokenWork {
+    pub(super) mint: Option<CallbackMint>,
+    pub(super) task: Option<CallbackTask>,
+    pub(super) cpu: Option<JoinHandle<Result<Prepared, AslError>>>,
+}
+#[derive(Debug, Default)]
+pub(super) struct Physical {
+    pub(super) call: Option<TaskCall>,
+    pub(super) charge: Option<TaskBytes>,
+    pub(super) permit: Option<OwnedSemaphorePermit>,
+    pub(super) completed: bool,
+}
+#[derive(Debug)]
+pub(super) struct Receipts {
+    pub(super) token: TokenWork,
+    pub(super) physical: Physical,
+    pub(super) lease: Arc<DispatchLease>,
+}
+#[derive(Debug)]
+pub(super) struct Owner(pub(super) Option<Box<Receipts>>);
+impl Drop for Owner {
+    fn drop(&mut self) {
+        if let Some(receipts) = self.0.take() {
+            receipts.cancel();
+            // The root port/token actors retain accepted IO independently. Keep
+            // these exact receipts, physical permit and frame/data charges too.
+            let _retained = Box::leak(receipts);
+        }
+    }
+}
+impl Receipts {
+    fn cancel(&self) {
+        if let Some(mint) = &self.token.mint {
+            mint.revoke();
+        }
+        if let Some(task) = &self.token.task {
+            task.revoke();
+        }
+        if let Some(call) = &self.physical.call {
+            call.cancel();
+        }
+    }
+    pub(super) fn release_clean(&mut self) {
+        if self
+            .physical
+            .call
+            .as_ref()
+            .is_some_and(|call| call.settlement() == TaskSettlement::Clean)
+        {
+            self.physical.charge = None;
+            self.physical.permit = None;
+        }
+    }
+}
+impl Owner {
+    pub(super) fn new(lease: Arc<DispatchLease>) -> Self {
+        Self(Some(Box::new(Receipts {
+            token: TokenWork::default(),
+            physical: Physical::default(),
+            lease,
+        })))
+    }
+    pub(super) fn receipts(&mut self) -> Result<&mut Receipts, CallbackError> {
+        self.0.as_deref_mut().ok_or(CallbackError::OwnerLost)
+    }
+    pub(super) fn cancel(&self) {
+        if let Some(receipts) = &self.0 {
+            receipts.cancel();
+        }
+    }
+    pub(super) fn clean(&mut self) {
+        self.0 = None;
+    }
+    pub(super) async fn prepare(
+        &mut self,
+        context: &Context,
+        budget: &TaskDataBudget,
+        cancel: &mut watch::Receiver<bool>,
+    ) -> Result<Result<Prepared, TaskFailure>, CallbackError> {
+        let deadline = Instant::from_std(context.effect.deadline());
+        if super::progress::stopped(cancel, deadline) {
+            return Err(CallbackError::TaskTimedOut);
+        }
+        let permit = tokio::select! {biased;_=cancel.changed()=>return Err(CallbackError::TaskTimedOut),()=sleep_until(deadline)=>return Err(CallbackError::TaskTimedOut),permit=context.shared.pools.cpu.clone().acquire_owned()=>permit.map_err(|_|CallbackError::Unavailable)?,};
+        if super::progress::stopped(cancel, deadline) {
+            return Err(CallbackError::TaskTimedOut);
+        }
+        let Ok(charge) = budget.reserve(PREPARATION_BYTES) else {
+            return Ok(Err(limit_failure()));
+        };
+        let effect = context.effect.clone();
+        let receipts = self.receipts()?;
+        let token: CallbackToken = receipts
+            .token
+            .task
+            .as_ref()
+            .ok_or(CallbackError::OwnerLost)?
+            .token()
+            .expose()
+            .parse()?;
+        let lease = receipts.lease.clone();
+        #[cfg(test)]
+        let hook = context.shared.callback_hook.clone();
+        receipts.token.cpu = Some(spawn_blocking(move || {
+            let _permit = permit;
+            let _lease = lease;
+            #[cfg(test)]
+            if let Some(hook) = &hook {
+                hook.run(true);
+            }
+            let (dispatch, history) =
+                effect.prepare_with_source(&token, &mut SystemUuidSource::default())?;
+            let bytes = dispatch
+                .parameters()
+                .original_bytes()
+                .len()
+                .checked_add(history.payload().original_bytes().len())
+                .and_then(|value| value.checked_add(PREPARATION_OVERHEAD))
+                .ok_or(AslError::DataLimit)?;
+            let charge = charge
+                .shrink(bytes)
+                .map_err(|_| AslError::InvalidExecution)?;
+            #[cfg(test)]
+            if let Some(hook) = &hook {
+                hook.run(false);
+            }
+            Ok(Prepared {
+                dispatch,
+                history,
+                charge,
+            })
+        }));
+        let job = receipts
+            .token
+            .cpu
+            .as_mut()
+            .ok_or(CallbackError::OwnerLost)?;
+        let joined = tokio::select! {biased;_=cancel.changed()=>{if let Some(task)=&receipts.token.task{task.revoke();}job.await},()=sleep_until(deadline)=>{if let Some(task)=&receipts.token.task{task.revoke();}job.await},result=&mut *job=>result,};
+        receipts.token.cpu = None;
+        let value = joined.map_err(CallbackError::Worker)?;
+        Ok(value.map_err(TaskFailure::evaluation))
+    }
+    pub(super) async fn cleanup(&mut self) -> Result<(), CallbackError> {
+        self.cancel();
+        let receipts = self.receipts()?;
+        let token = receipts.token.cleanup().await;
+        let physical = if let Some(call) = receipts.physical.call.as_mut() {
+            call.cancel();
+            call.settled().await.map_err(|_| CallbackError::OwnerLost)
+        } else {
+            Ok(())
+        };
+        if physical.is_ok() {
+            receipts.physical = Physical::default();
+        }
+        token.and(physical)
+    }
+}
+
+impl TokenWork {
+    async fn cleanup(&mut self) -> Result<(), CallbackError> {
+        if let Some(job) = self.cpu.as_mut() {
+            let result = job.await;
+            self.cpu = None;
+            let _result = result.map_err(CallbackError::Worker)?;
+        }
+        if let Some(mint) = self.mint.as_mut() {
+            let result = mint.resolve().await;
+            if result.as_ref().is_err_and(unknown) {
+                return result;
+            }
+            let mint = self.mint.take().ok_or(CallbackError::OwnerLost)?;
+            if result.is_ok() {
+                self.task = Some(mint.into_task()?);
+            }
+        }
+        if let Some(task) = self.task.as_mut() {
+            task.revoke();
+            let terminal = task.resolved().await?;
+            if matches!(terminal.as_ref(), CallbackOutcome::Unavailable) {
+                return Err(CallbackError::Unavailable);
+            }
+            self.task = None;
+        }
+        Ok(())
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/progress.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/progress.rs
new file mode 100644
index 00000000..129c13f0
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/progress.rs
@@ -0,0 +1,133 @@
+//! Drive report/result and independent physical settlement without dropping either.
+
+use std::{future::pending, sync::Arc};
+
+use tokio::{
+    sync::watch,
+    time::{Instant, sleep_until},
+};
+
+use super::{CallbackError, Context, owner::Owner};
+use crate::{
+    CallbackInvocation, CallbackOutcome, CallbackTask, TaskCall, TaskChannelError, TaskEvent,
+    TaskResponder, TaskSettlement,
+};
+
+#[derive(Debug, Clone, Copy)]
+pub(super) enum Stage {
+    Invocation,
+    Callback,
+}
+#[derive(Debug)]
+pub(super) enum Observed {
+    Invocation(Arc<CallbackInvocation>),
+    Callback(Arc<CallbackOutcome>),
+}
+enum Wake {
+    Task(Result<Observed, CallbackError>),
+    Progress(Result<TaskEvent, TaskChannelError>),
+    Settlement(Result<(), watch::error::RecvError>),
+    Cancel,
+}
+async fn event(call: &mut Option<TaskCall>) -> Result<TaskEvent, TaskChannelError> {
+    match call {
+        Some(call) => call.next().await,
+        None => pending().await,
+    }
+}
+async fn settlement(
+    receiver: &mut Option<watch::Receiver<TaskSettlement>>,
+) -> Result<(), watch::error::RecvError> {
+    match receiver {
+        Some(receiver) => receiver.changed().await,
+        None => pending().await,
+    }
+}
+async fn task(
+    task: &mut CallbackTask,
+    stage: Stage,
+    deadline: Instant,
+) -> Result<Observed, CallbackError> {
+    match stage {
+        Stage::Invocation => task
+            .wait_invocation(deadline)
+            .await
+            .map(Observed::Invocation),
+        Stage::Callback => task.resolved().await.map(Observed::Callback),
+    }
+}
+pub(super) fn stopped(cancel: &watch::Receiver<bool>, deadline: Instant) -> bool {
+    *cancel.borrow() || cancel.has_changed().is_err() || Instant::now() >= deadline
+}
+pub(super) async fn observe(
+    owner: &mut Owner,
+    context: &Context,
+    stage: Stage,
+    responder: &mut TaskResponder,
+    cancel: &mut watch::Receiver<bool>,
+) -> Result<Observed, CallbackError> {
+    let deadline = Instant::from_std(context.effect.deadline());
+    let mut settled = owner
+        .receipts()?
+        .physical
+        .call
+        .as_ref()
+        .map(TaskCall::settlement_receiver);
+    loop {
+        if stopped(cancel, deadline) {
+            owner.cancel();
+            return Err(CallbackError::TaskTimedOut);
+        }
+        let receipts = owner.receipts()?;
+        receipts.release_clean();
+        let active = receipts.physical.call.is_some();
+        let task_owner = receipts
+            .token
+            .task
+            .as_mut()
+            .ok_or(CallbackError::OwnerLost)?;
+        let wake = tokio::select! {
+            biased;
+            _=cancel.changed()=>Wake::Cancel,
+            ()=sleep_until(deadline)=>Wake::Cancel,
+            result=event(&mut receipts.physical.call),if active&&!receipts.physical.completed=>Wake::Progress(result),
+            result=task(task_owner,stage,deadline)=>Wake::Task(result),
+            result=settlement(&mut settled),if active&&receipts.physical.call.as_ref().is_some_and(|call|call.settlement()!=TaskSettlement::Clean)=>Wake::Settlement(result),
+        };
+        if stopped(cancel, deadline) {
+            owner.cancel();
+            return Err(CallbackError::TaskTimedOut);
+        }
+        match wake {
+            Wake::Cancel => {
+                owner.cancel();
+                return Err(CallbackError::TaskTimedOut);
+            }
+            Wake::Progress(Ok(TaskEvent::Started)) => {
+                responder.started().map_err(|_| CallbackError::Progress)?;
+            }
+            Wake::Progress(Ok(TaskEvent::Completed(_))) => {
+                owner.receipts()?.physical.completed = true;
+            }
+            Wake::Task(Err(CallbackError::TaskTimedOut | CallbackError::Deadline))
+            | Wake::Progress(Ok(TaskEvent::Submitted(_)) | Err(_)) => {
+                return Err(CallbackError::OwnerLost);
+            }
+            Wake::Task(result) => return result,
+            Wake::Settlement(Ok(())) => {}
+            Wake::Settlement(Err(_)) => {
+                owner.receipts()?.release_clean();
+                if owner
+                    .receipts()?
+                    .physical
+                    .call
+                    .as_ref()
+                    .is_some_and(|call| call.settlement() != TaskSettlement::Clean)
+                {
+                    return Err(CallbackError::OwnerLost);
+                }
+                settled = None;
+            }
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/tests.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/tests.rs
new file mode 100644
index 00000000..cbddc0ec
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/tests.rs
@@ -0,0 +1,182 @@
+//! Barrier proofs for callback result charges above frame/event retirement.
+
+use chrono::Utc;
+use serde_json::json;
+use tokio::{sync::watch, time::Instant};
+
+use super::*;
+use crate::{
+    AslCompiler, ClockSample, DriverStep, EvaluationContext, ExecutionDriver, ExecutionLimits,
+    ExecutionSupervisor, ExecutionView, FrameCapacity, FrameLimits, FrameScheduler, FrameUpdate,
+    HistoryLimits, Payload, RuntimeLimits, StateSupport, SystemUuidSource, TaskSupport,
+    TenantScope,
+    engine::{
+        history::{Journal, TerminalReserve},
+        runtime::{
+            CleanupState,
+            structured::{Call, Completion},
+        },
+    },
+};
+
+fn graph(
+    bytes: usize,
+) -> (
+    FrameScheduler,
+    FrameCallId,
+    CallbackDispatch,
+    ClockSample,
+    Arc<FrameCapacity>,
+) {
+    let source = json!({"StartAt":"Both","States":{"Both":{"Type":"Parallel","Branches":[{"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","End":true}}}],"End":true}}});
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_callback_support(true)
+        .with_state_support(StateSupport::Structured)
+        .compile(&serde_json::to_vec(&source).unwrap())
+        .unwrap()
+        .machine()
+        .clone();
+    let now = ClockSample::new(Instant::now().into_std(), Utc::now());
+    let driver = ExecutionDriver::for_structured_owner(
+        machine,
+        Payload::parse(b"{}").unwrap(),
+        EvaluationContext::from_value(&json!({})).unwrap(),
+        now,
+        ExecutionLimits::default(),
+    )
+    .unwrap();
+    let capacity = Arc::new(FrameCapacity::new(8, bytes).unwrap());
+    let mut graph = FrameScheduler::new(
+        driver,
+        capacity.clone(),
+        FrameLimits::new(8, bytes).unwrap(),
+    )
+    .unwrap();
+    for _ in 0..20 {
+        if let FrameUpdate::Transition(t) = graph.advance(now, &mut SystemUuidSource::default()) {
+            if let DriverStep::Callback(effect) = t.step() {
+                return (graph, t.call().unwrap(), effect.clone(), now, capacity);
+            }
+        }
+    }
+    panic!("callback effect")
+}
+#[tokio::test]
+async fn test_should_keep_callback_bytes_through_retired_child_until_result_notification_is_consumed()
+ {
+    let (mut graph, id, effect, now, capacity) = graph(600_000);
+    let budget = graph.task_data_budget();
+    let lease = Arc::new(DispatchLease {
+        _permit: None,
+        _frame: graph.lease(id.frame()),
+        _data: Some(budget.reserve(RESULT_BYTES).unwrap()),
+    });
+    let _ = graph
+        .complete(
+            id,
+            Ok(Payload::from_value(&json!("x".repeat(120_000))).unwrap()),
+            now,
+            &mut SystemUuidSource::default(),
+        )
+        .unwrap();
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )
+    .unwrap();
+    let history = Journal::new(
+        HistoryLimits::default(),
+        runtime.shared.history.capacity.clone(),
+        TerminalReserve::new(&runtime.shared.history.capacity).unwrap(),
+    );
+    let (view, _reader) = watch::channel(Arc::new(ExecutionView {
+        history: history.view.clone(),
+        outcome: None,
+        stopped: None,
+        cleanup: CleanupState::Pending,
+        diagnostic: None,
+    }));
+    let (_stop, stopped) = watch::channel(None);
+    let (ledger, _ledger) = watch::channel(Arc::new(Vec::<Arc<DispatchLease>>::new()));
+    let mut actor = Actor::new(
+        graph,
+        Instant::from_std(effect.deadline()),
+        history,
+        view,
+        stopped,
+        ledger,
+        runtime.shared.clone(),
+    );
+    let (call, responder) = TaskCall::channel();
+    let cancel = call.cancellation_sender();
+    responder.finish(Err(TaskFailure::service_exception()));
+    drop(call);
+    actor.leases.push(lease.clone());
+    actor.sync_ledger();
+    actor.calls.insert(
+        id,
+        Call {
+            cancel,
+            lease,
+            machine: effect.machine().clone(),
+            dispatch: Instruction::Callback(effect),
+            progress: Progress::Submitted,
+            result_seen: true,
+            cancelled: false,
+            settled: Some(true),
+        },
+    );
+    actor.acks.insert(id);
+    actor.reconcile();
+    assert!(actor.calls.contains_key(&id));
+    assert!(budget.reserve(RESULT_BYTES).is_err());
+    let mut delivered = false;
+    for _ in 0..20 {
+        let update = actor
+            .graph
+            .as_mut()
+            .unwrap()
+            .advance(now, &mut SystemUuidSource::default());
+        if matches!(update,FrameUpdate::ChildFinished{child,..} if child==id.frame()) {
+            delivered = true;
+            drop(update);
+            break;
+        }
+    }
+    assert!(delivered);
+    actor.reconcile();
+    assert!(!actor.calls.contains_key(&id));
+    let admission = budget.reserve(RESULT_BYTES).unwrap();
+    drop(admission);
+    drop(actor);
+    drop(runtime);
+    assert_eq!(capacity.available_frames(), 8);
+}
+#[tokio::test]
+async fn test_should_charge_queued_business_payload_even_after_scheduler_and_other_lease_owners_drop()
+ {
+    let (graph, id, _, _, _) = graph(RESULT_BYTES + 4096);
+    let budget = graph.task_data_budget();
+    let lease = Arc::new(DispatchLease {
+        _permit: None,
+        _frame: graph.lease(id.frame()),
+        _data: Some(budget.reserve(RESULT_BYTES).unwrap()),
+    });
+    let (sender, mut receiver) = mpsc::channel(1);
+    sender
+        .send(Message::Completed(
+            id,
+            Completion {
+                result: Ok(Payload::from_value(&json!("x".repeat(120_000))).unwrap()),
+                _lease: Some(lease),
+            },
+        ))
+        .await
+        .unwrap();
+    drop(graph);
+    assert!(budget.reserve(RESULT_BYTES).is_err());
+    drop(receiver.recv().await.unwrap());
+    let _admitted = budget.reserve(RESULT_BYTES).unwrap();
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/worker.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/worker.rs
new file mode 100644
index 00000000..8aa339c1
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/callback/worker.rs
@@ -0,0 +1,202 @@
+//! Joined callback registration/preparation/issuance and terminal/cleanup sequence.
+
+use std::sync::Arc;
+
+use tokio::{
+    sync::{oneshot, watch},
+    time::{Instant, sleep_until},
+};
+
+use super::{
+    CallbackError, Context, DispatchLease, ExecutionError, Message, TaskDataBudget, TaskFailure,
+    callback_limit_failure,
+    owner::{Owner, Prepared},
+    progress::{self, Observed, Stage},
+    timeout_failure, unknown,
+};
+use crate::{
+    CallbackAttempt, CallbackOutcome, CallbackTimeout, LambdaTaskCommand, Payload, TaskResponder,
+};
+
+pub(super) async fn run(
+    context: Context,
+    mut responder: TaskResponder,
+    lease: Arc<DispatchLease>,
+    budget: TaskDataBudget,
+) {
+    let mut owner = Owner::new(lease);
+    let result = execute(&mut owner, &context, &mut responder, &budget).await;
+    let result = match result {
+        Ok(result) => result,
+        Err(error) if !unknown(&error) => Err(match error {
+            CallbackError::Data(error) => TaskFailure::evaluation(error),
+            error if capacity(&error) => callback_limit_failure(),
+            _ => timeout_failure(),
+        }),
+        Err(error) => {
+            owner.cancel();
+            let _ = context
+                .sender
+                .send(Message::Fatal(ExecutionError::Callback(Arc::new(error))))
+                .await;
+            Err(TaskFailure::service_exception())
+        }
+    };
+    let completion = responder.complete(result);
+    match owner.cleanup().await {
+        Ok(()) => {
+            owner.clean();
+            completion.settle();
+        }
+        Err(error) => {
+            let _ = context
+                .sender
+                .send(Message::Fatal(ExecutionError::Callback(Arc::new(error))))
+                .await;
+        }
+    }
+}
+
+async fn execute(
+    owner: &mut Owner,
+    context: &Context,
+    responder: &mut TaskResponder,
+    budget: &TaskDataBudget,
+) -> Result<Result<Payload, TaskFailure>, CallbackError> {
+    let deadline = Instant::from_std(context.effect.deadline());
+    let mut cancel = responder.cancellation();
+    if progress::stopped(&cancel, deadline) {
+        return Err(CallbackError::TaskTimedOut);
+    }
+    let (registry, parent) = &context.binding;
+    owner.receipts()?.token.mint = Some(registry.register(CallbackAttempt::new(
+        parent,
+        context.id,
+        deadline,
+        context.effect.heartbeat(),
+    )?)?);
+    let mint = owner
+        .receipts()?
+        .token
+        .mint
+        .as_mut()
+        .ok_or(CallbackError::OwnerLost)?;
+    let accepted = tokio::select! {biased;_=cancel.changed()=>{mint.revoke();mint.resolve().await},()=sleep_until(deadline)=>{mint.revoke();mint.resolve().await},result=mint.resolve()=>result,};
+    if let Err(error) = accepted {
+        if !unknown(&error) {
+            owner.receipts()?.token.mint = None;
+        }
+        return Err(error);
+    }
+    let mint = owner
+        .receipts()?
+        .token
+        .mint
+        .take()
+        .ok_or(CallbackError::OwnerLost)?;
+    owner.receipts()?.token.task = Some(mint.into_task()?);
+    if progress::stopped(&cancel, deadline) {
+        return Err(CallbackError::TaskTimedOut);
+    }
+    let prepared = match owner.prepare(context, budget, &mut cancel).await? {
+        Ok(prepared) => prepared,
+        Err(failure) => return Ok(Err(failure)),
+    };
+    if let Err(failure) = issue(owner, context, prepared, &mut cancel).await? {
+        return Ok(Err(failure));
+    }
+    let report =
+        match progress::observe(owner, context, Stage::Invocation, responder, &mut cancel).await? {
+            Observed::Invocation(report) => report,
+            Observed::Callback(_) => return Err(CallbackError::Progress),
+        };
+    if let Some(failure) = report.failure() {
+        return Ok(Err(failure.clone()));
+    }
+    let metadata = report.metadata().ok_or(CallbackError::Progress)?;
+    responder
+        .submitted(metadata.payload()?)
+        .map_err(|_| CallbackError::Progress)?;
+    let outcome =
+        match progress::observe(owner, context, Stage::Callback, responder, &mut cancel).await? {
+            Observed::Callback(outcome) => outcome,
+            Observed::Invocation(_) => return Err(CallbackError::Progress),
+        };
+    match outcome.as_ref() {
+        CallbackOutcome::Succeeded(output) => Ok(Ok(output.clone())),
+        CallbackOutcome::Failed(failure) | CallbackOutcome::InvocationFailed(failure) => {
+            Ok(Err(failure.clone()))
+        }
+        CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat) => Ok(Err(TaskFailure::new(
+            "States.HeartbeatTimeout",
+            Some("Callback heartbeat deadline exceeded"),
+        )?)),
+        CallbackOutcome::TimedOut(CallbackTimeout::Task) => Ok(Err(timeout_failure())),
+        CallbackOutcome::Revoked => Err(CallbackError::OwnerLost),
+        CallbackOutcome::Unavailable => Err(CallbackError::Unavailable),
+        CallbackOutcome::Invoking | CallbackOutcome::Waiting { .. } => Err(CallbackError::Progress),
+    }
+}
+async fn issue(
+    owner: &mut Owner,
+    context: &Context,
+    prepared: Prepared,
+    cancel: &mut watch::Receiver<bool>,
+) -> Result<Result<(), TaskFailure>, CallbackError> {
+    let deadline = Instant::from_std(context.effect.deadline());
+    let Prepared {
+        dispatch,
+        history,
+        charge,
+    } = prepared;
+    owner.receipts()?.physical.charge = Some(charge);
+    if progress::stopped(cancel, deadline) {
+        return Err(CallbackError::TaskTimedOut);
+    }
+    let (ack, mut acknowledged) = oneshot::channel();
+    let scheduled = Message::CallbackScheduled(context.id, history, ack);
+    tokio::select! {biased;_=cancel.changed()=>return Err(CallbackError::TaskTimedOut),()=sleep_until(deadline)=>return Err(CallbackError::TaskTimedOut),result=context.sender.send(scheduled)=>result.map_err(|_|CallbackError::OwnerLost)?,};
+    let allowed = tokio::select! {biased;_=cancel.changed()=>return Err(CallbackError::TaskTimedOut),()=sleep_until(deadline)=>return Err(CallbackError::TaskTimedOut),result=&mut acknowledged=>result.map_err(|_|CallbackError::OwnerLost)?,};
+    if !allowed || progress::stopped(cancel, deadline) {
+        return Err(CallbackError::TaskTimedOut);
+    }
+    let permit = tokio::select! {biased;_=cancel.changed()=>return Err(CallbackError::TaskTimedOut),()=sleep_until(deadline)=>return Err(CallbackError::TaskTimedOut),permit=context.shared.pools.dispatch.clone().acquire_owned()=>permit.map_err(|_|CallbackError::Unavailable)?,};
+    owner.receipts()?.physical.permit = Some(permit);
+    if progress::stopped(cancel, deadline) {
+        return Err(CallbackError::TaskTimedOut);
+    }
+    let task = owner
+        .receipts()?
+        .token
+        .task
+        .as_mut()
+        .ok_or(CallbackError::OwnerLost)?;
+    let command = LambdaTaskCommand::observed_callback(
+        context.effect.machine().clone(),
+        dispatch,
+        context.id,
+        task.take_invocation_reporter()?,
+    )?;
+    let call = context
+        .shared
+        .port
+        .as_ref()
+        .ok_or(CallbackError::Unavailable)?
+        .start(command);
+    match call {
+        Ok(call) => owner.receipts()?.physical.call = Some(call),
+        Err(failure) => {
+            // Prequeue rejection is known; report it through the outer business path.
+            return Ok(Err(failure));
+        }
+    }
+    Ok(Ok(()))
+}
+
+fn capacity(error: &CallbackError) -> bool {
+    match error {
+        CallbackError::Cached(error) => capacity(error),
+        CallbackError::Capacity => true,
+        _ => false,
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/child.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/child.rs
new file mode 100644
index 00000000..d17b38a2
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/child.rs
@@ -0,0 +1,366 @@
+//! Retained child protocol and CPU receipts; no Lambda dispatch permit is acquired.
+
+use std::sync::Arc;
+
+use tokio::{
+    sync::{mpsc, oneshot, watch},
+    task::{JoinHandle, spawn_blocking},
+    time::{Instant, sleep_until},
+};
+
+use super::{Actor, DispatchLease, ExecutionError, Message, Shared};
+use crate::{
+    ChildError, ChildExecution, ChildExecutionPort, ChildParent, ChildPattern,
+    ChildStartParameters, ChildSubmission, ExecutionSnapshot, FrameCallId, LambdaTaskCommand,
+    Payload, TaskCall, TaskFailure, TaskResponder,
+};
+
+#[derive(Debug)]
+pub(super) enum Binding {
+    Pending(ChildExecutionPort, oneshot::Receiver<ExecutionSnapshot>),
+    Ready(ChildExecutionPort, ChildParent),
+}
+impl Actor {
+    pub(in crate::engine::runtime) fn with_child_registration(
+        mut self,
+        registration: Option<(ChildExecutionPort, oneshot::Receiver<ExecutionSnapshot>)>,
+    ) -> Self {
+        self.children = registration.map(|(port, receiver)| Binding::Pending(port, receiver));
+        self
+    }
+    pub(super) fn start_child(
+        &mut self,
+        id: FrameCallId,
+        command: LambdaTaskCommand,
+        pattern: ChildPattern,
+        lease: Arc<DispatchLease>,
+    ) {
+        let Some(Binding::Ready(port, parent)) = &self.children else {
+            self.fail(super::ExecutionError::Unavailable);
+            return;
+        };
+        let binding = (port.clone(), parent.clone());
+        let machine = command.machine().clone();
+        let dispatch = command.dispatch().clone();
+        let (call, responder) = TaskCall::channel();
+        self.child_jobs.spawn(run(
+            binding,
+            command,
+            pattern,
+            responder,
+            lease.clone(),
+            self.shared.clone(),
+            self.sender.clone(),
+        ));
+        self.accepted(id, machine, dispatch, call, lease);
+    }
+    pub(super) async fn register_children(&mut self) {
+        let Some(Binding::Pending(port, mut receiver)) = self.children.take() else {
+            return;
+        };
+        self.control();
+        if self.forced.is_some() {
+            return;
+        }
+        let result = tokio::select! {
+            biased;
+            _ = self.stop.changed() => { self.control(); return; },
+            () = sleep_until(self.deadline) => { self.control(); return; },
+            result = &mut receiver => result,
+        };
+        match result {
+            Ok(parent) => {
+                self.children = Some(Binding::Ready(port, parent.child_parent()));
+                self.parent = Some(parent);
+            }
+            Err(_) => self.fail(super::ExecutionError::Unavailable),
+        }
+    }
+}
+
+#[derive(Debug)]
+enum CpuValue {
+    Parsed(Result<ChildStartParameters, ChildError>),
+    Mapped(Result<Result<Payload, TaskFailure>, ChildError>),
+}
+#[derive(Debug)]
+struct Receipts {
+    submission: Option<ChildSubmission>,
+    child: Option<ChildExecution>,
+    cpu: Option<JoinHandle<CpuValue>>,
+    lease: Arc<DispatchLease>,
+    failure: Option<ExecutionError>,
+    cancellation: watch::Receiver<bool>,
+    deadline: Instant,
+}
+#[derive(Debug)]
+struct Owner(Option<Box<Receipts>>);
+impl Drop for Owner {
+    fn drop(&mut self) {
+        if let Some(receipts) = self.0.take() {
+            if let Some(submission) = &receipts.submission {
+                submission.cancel();
+            }
+            if let Some(child) = &receipts.child {
+                child.cancel();
+            }
+            // A lost worker cannot prove issuance or physical cleanup. The registry
+            // still owns relations; retain the exact receipts and frame charge too.
+            let _retained = Box::leak(receipts);
+        }
+    }
+}
+impl Owner {
+    fn receipts(&mut self) -> Result<&mut Receipts, ChildError> {
+        self.0.as_deref_mut().ok_or(ChildError::OwnerLost)
+    }
+    async fn cpu(
+        &mut self,
+        shared: &Shared,
+        work: impl FnOnce() -> CpuValue + Send + 'static,
+    ) -> Result<CpuValue, ChildError> {
+        let receipts = self.receipts()?;
+        let mut cancel = receipts.cancellation.clone();
+        let permit = if cancelled(&cancel, receipts.deadline) {
+            None
+        } else {
+            tokio::select! {
+                biased;
+                _ = cancel.changed() => None,
+                () = sleep_until(receipts.deadline) => None,
+                permit = shared.pools.cpu.clone().acquire_owned() => Some(permit.map_err(|_| ChildError::Unavailable)?),
+            }
+        };
+        let Some(permit) = permit else {
+            if let Some(child) = &receipts.child {
+                child.cancel();
+            }
+            return Err(ChildError::Cancelled);
+        };
+        let lease = receipts.lease.clone();
+        #[cfg(test)]
+        let panic = shared.child_cpu_panic;
+        receipts.cpu = Some(spawn_blocking(move || {
+            let _permit = permit;
+            let _lease = lease;
+            #[cfg(test)]
+            assert!(!panic, "controlled child CPU failure");
+            work()
+        }));
+        let job = receipts.cpu.as_mut().ok_or(ChildError::OwnerLost)?;
+        let value = tokio::select! {
+            biased;
+            _ = cancel.changed() => {
+                if let Some(child) = &receipts.child { child.cancel(); }
+                job.await
+            },
+            () = sleep_until(receipts.deadline) => {
+                if let Some(child) = &receipts.child { child.cancel(); }
+                job.await
+            },
+            value = &mut *job => value,
+        };
+        // A panic leaves the completed join receipt retained for quarantine.
+        let value = match value {
+            Ok(value) => value,
+            Err(error) => {
+                receipts.failure = Some(ExecutionError::Worker(error));
+                return Err(ChildError::OwnerLost);
+            }
+        };
+        receipts.cpu = None;
+        Ok(value)
+    }
+    async fn mapped(
+        &mut self,
+        shared: &Shared,
+        start: bool,
+    ) -> Result<Result<Payload, TaskFailure>, ChildError> {
+        let mapper = self
+            .receipts()?
+            .child
+            .as_ref()
+            .ok_or(ChildError::OwnerLost)?
+            .mapper(start);
+        match self.cpu(shared, move || CpuValue::Mapped(mapper())).await? {
+            CpuValue::Mapped(result) => result,
+            CpuValue::Parsed(_) => Err(ChildError::OwnerLost),
+        }
+    }
+    fn clean(&mut self) {
+        self.0 = None;
+    }
+}
+fn unknown(error: &ChildError) -> bool {
+    match error {
+        ChildError::Admission(error) => unknown(error),
+        ChildError::OwnerLost => true,
+        _ => false,
+    }
+}
+fn cancelled(cancel: &watch::Receiver<bool>, deadline: Instant) -> bool {
+    *cancel.borrow() || cancel.has_changed().is_err() || Instant::now() >= deadline
+}
+
+pub(super) async fn run(
+    binding: (ChildExecutionPort, ChildParent),
+    command: LambdaTaskCommand,
+    pattern: ChildPattern,
+    mut responder: TaskResponder,
+    lease: Arc<DispatchLease>,
+    shared: Arc<Shared>,
+    sender: mpsc::Sender<Message>,
+) {
+    let mut owner = Owner(Some(Box::new(Receipts {
+        submission: None,
+        child: None,
+        cpu: None,
+        lease,
+        failure: None,
+        cancellation: responder.cancellation(),
+        deadline: Instant::from_std(command.dispatch().deadline()),
+    })));
+    let mut result = execute(
+        &mut owner,
+        binding,
+        command,
+        pattern,
+        &mut responder,
+        &shared,
+    )
+    .await;
+    if result.as_ref().is_err_and(|error| !unknown(error)) {
+        if let Some(child) = owner.0.as_mut().and_then(|r| r.child.as_mut()) {
+            if pattern.owned() {
+                child.cancel();
+                if let Err(error) = child.settled().await {
+                    result = Err(error);
+                } else if let Some(receipts) = owner.0.as_mut() {
+                    receipts.child = None;
+                }
+            } else if let Some(receipts) = owner.0.as_mut() {
+                receipts.child = None;
+            }
+        }
+    }
+    match result {
+        Ok(result) => {
+            let completion = responder.complete(result);
+            let cleanup = if let Some(child) = owner.0.as_mut().and_then(|r| r.child.as_mut()) {
+                child.settled().await
+            } else {
+                Ok(())
+            };
+            if cleanup.is_ok() {
+                owner.clean();
+                completion.settle();
+            }
+        }
+        Err(error)
+            if !unknown(&error)
+                && owner.0.as_ref().is_some_and(|r| {
+                    r.submission.is_none() && r.child.is_none() && r.cpu.is_none()
+                }) =>
+        {
+            owner.clean();
+            responder.finish(Err(error.failure()));
+        }
+        Err(error) => {
+            if let Some(failure) = owner.0.as_mut().and_then(|r| r.failure.take()) {
+                let _ = sender.send(Message::Fatal(failure)).await;
+            }
+            // Close both channels so the result watcher records uncertainty instead
+            // of waiting forever on a fabricated live completion capability.
+            drop(responder.quarantine(error.failure()));
+        }
+    }
+}
+async fn execute(
+    owner: &mut Owner,
+    (port, parent): (ChildExecutionPort, ChildParent),
+    command: LambdaTaskCommand,
+    pattern: ChildPattern,
+    responder: &mut TaskResponder,
+    shared: &Shared,
+) -> Result<Result<Payload, TaskFailure>, ChildError> {
+    let deadline = Instant::from_std(command.dispatch().deadline());
+    let mut cancel = responder.cancellation();
+    if cancelled(&cancel, deadline) {
+        return Err(ChildError::Cancelled);
+    }
+    let scope = command.machine().scope().clone();
+    let parameters = command.dispatch().parameters().clone();
+    let args = match owner
+        .cpu(shared, move || {
+            CpuValue::Parsed(ChildStartParameters::parse(&scope, &parameters))
+        })
+        .await?
+    {
+        CpuValue::Parsed(result) => result?,
+        CpuValue::Mapped(_) => return Err(ChildError::OwnerLost),
+    };
+    if cancelled(&cancel, deadline) {
+        return Err(ChildError::Cancelled);
+    }
+    owner.receipts()?.submission = Some(port.start(parent, args, pattern, deadline)?);
+    let submission = owner
+        .receipts()?
+        .submission
+        .as_mut()
+        .ok_or(ChildError::OwnerLost)?;
+    let admitted = tokio::select! {
+        biased;
+        _ = cancel.changed() => { submission.cancel(); submission.resolve().await },
+        () = sleep_until(deadline) => { submission.cancel(); submission.resolve().await },
+        result = submission.resolve() => result,
+    };
+    if let Err(error) = admitted {
+        if !unknown(&error) {
+            owner.receipts()?.submission = None;
+        }
+        return Err(error);
+    }
+    let submission = owner
+        .receipts()?
+        .submission
+        .take()
+        .ok_or(ChildError::OwnerLost)?;
+    owner.receipts()?.child = Some(submission.into_execution()?);
+    responder.started().map_err(|_| ChildError::OwnerLost)?;
+    let start = owner
+        .mapped(shared, true)
+        .await?
+        .map_err(|_| ChildError::Invalid)?;
+    if !pattern.owned() {
+        // Registry acceptance detached this child. Its global owner keeps running.
+        owner.receipts()?.child = None;
+        return Ok(Ok(start));
+    }
+    responder
+        .submitted(start)
+        .map_err(|_| ChildError::OwnerLost)?;
+    let child = owner
+        .receipts()?
+        .child
+        .as_mut()
+        .ok_or(ChildError::OwnerLost)?;
+    let terminal = if cancelled(&cancel, deadline) {
+        child.cancel();
+        false
+    } else {
+        tokio::select! {
+            biased;
+            _ = cancel.changed() => { child.cancel(); false },
+            () = sleep_until(deadline) => { child.cancel(); false },
+            result = child.wait(deadline) => {
+                if result.is_err() { child.cancel(); }
+                result.is_ok()
+            },
+        }
+    };
+    if !terminal {
+        // Control won; retain cleanup and capture the eventual aborted outcome.
+        child.settled().await?;
+    }
+    owner.mapped(shared, false).await
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/history.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/history.rs
new file mode 100644
index 00000000..84901de5
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/history.rs
@@ -0,0 +1,379 @@
+//! Per-frame causal cursors and typed structured lifecycle projection.
+
+use std::{collections::BTreeMap, sync::Arc};
+
+use chrono::{DateTime, Utc};
+use rustack_stepfunctions_model::types::{
+    HistoryEvent, HistoryEventType, MapIterationEventDetails, MapStateStartedEventDetails,
+};
+
+use crate::{
+    AslError, CompiledMachine, ExecutionOutcome, FrameId, FrameParent, FrameScheduler,
+    FrameTransition, StateId, StateView, TaskFailure,
+    engine::{
+        history::{Journal, events},
+        runtime::ExecutionError,
+    },
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Kind {
+    Plain,
+    Map,
+    Parallel,
+    Task,
+    Wait,
+}
+#[derive(Debug)]
+struct Cursor {
+    machine: Arc<CompiledMachine>,
+    state: StateId,
+    last: u32,
+    round: Option<u32>,
+    next_iteration: Option<u32>,
+    kind: Kind,
+    active: bool,
+    parent: Option<FrameParent>,
+}
+#[derive(Debug)]
+pub(super) struct CausalHistory {
+    pub(super) journal: Journal,
+    frames: BTreeMap<FrameId, Cursor>,
+    root: Option<FrameId>,
+}
+impl CausalHistory {
+    pub(super) fn new(journal: Journal) -> Self {
+        Self {
+            journal,
+            frames: BTreeMap::new(),
+            root: None,
+        }
+    }
+    fn append(&mut self, id: FrameId, event: HistoryEvent) -> Result<(), ExecutionError> {
+        let previous = self.frames.get(&id).ok_or(ExecutionError::Invalid)?.last;
+        self.append_from(id, event, previous)
+    }
+    fn append_from(
+        &mut self,
+        id: FrameId,
+        event: HistoryEvent,
+        previous: u32,
+    ) -> Result<(), ExecutionError> {
+        let cursor = self.frames.get_mut(&id).ok_or(ExecutionError::Invalid)?;
+        self.journal.append_causal(event, previous, false)?;
+        cursor.last = self.journal.view.len();
+        Ok(())
+    }
+    pub(super) fn event(
+        &mut self,
+        id: FrameId,
+        event: Result<HistoryEvent, AslError>,
+    ) -> Result<(), ExecutionError> {
+        self.append(id, event.map_err(ExecutionError::from)?)
+    }
+    pub(super) fn transition(
+        &mut self,
+        t: &FrameTransition,
+        wall: DateTime<Utc>,
+    ) -> Result<(), ExecutionError> {
+        if !self.frames.contains_key(&t.frame()) {
+            if t.parent().is_some() {
+                return Err(ExecutionError::Invalid);
+            }
+            self.root = Some(t.frame());
+            self.frames.insert(
+                t.frame(),
+                Cursor {
+                    machine: t.machine().clone(),
+                    state: t.state(),
+                    last: 0,
+                    round: None,
+                    next_iteration: None,
+                    kind: Kind::Plain,
+                    active: false,
+                    parent: None,
+                },
+            );
+        }
+        if let Some(input) = t.entered() {
+            let cursor = self
+                .frames
+                .get_mut(&t.frame())
+                .ok_or(ExecutionError::Invalid)?;
+            cursor.machine = t.machine().clone();
+            cursor.state = t.state();
+            cursor.round = None;
+            cursor.next_iteration = None;
+            cursor.active = true;
+            cursor.kind = match t.machine().state(t.state())? {
+                StateView::Map { .. } => Kind::Map,
+                StateView::Parallel { .. } => Kind::Parallel,
+                StateView::Task { .. } => Kind::Task,
+                StateView::Wait { .. } => Kind::Wait,
+                _ => Kind::Plain,
+            };
+            self.event(
+                t.frame(),
+                events::entered(t.machine(), t.state(), input, wall),
+            )?;
+        }
+        if let Some(call) = t.timed_out_call() {
+            let failure = TaskFailure::new("States.Timeout", None)?;
+            self.event(
+                call.frame(),
+                events::task_failure(
+                    t.machine(),
+                    t.state(),
+                    &failure,
+                    events::TaskFailureKind::TimedOut,
+                    wall,
+                ),
+            )?;
+        }
+        if let Some(count) = t.fanout_started {
+            self.round_started(t.frame(), count, wall)?;
+        }
+        let mut successful_round_predecessor = None;
+        if let Some(success) = t.round_finished {
+            let kind = self
+                .frames
+                .get(&t.frame())
+                .ok_or(ExecutionError::Invalid)?
+                .kind;
+            let event = match (kind, success) {
+                (Kind::Map, true) => HistoryEventType::MapStateSucceeded,
+                (Kind::Map, false) => HistoryEventType::MapStateFailed,
+                (Kind::Parallel, true) => HistoryEventType::ParallelStateSucceeded,
+                (Kind::Parallel, false) => HistoryEventType::ParallelStateFailed,
+                _ => return Err(ExecutionError::Invalid),
+            };
+            if success {
+                successful_round_predecessor = Some(
+                    self.frames
+                        .get(&t.frame())
+                        .ok_or(ExecutionError::Invalid)?
+                        .last,
+                );
+            }
+            self.append(t.frame(), events::event(event, wall))?;
+        }
+        if let Some(output) = t.exited() {
+            let event = events::exited(t.machine(), t.state(), output, wall)?;
+            if let Some(previous) = successful_round_predecessor {
+                self.append_from(t.frame(), event, previous)?;
+            } else {
+                self.append(t.frame(), event)?;
+            }
+        }
+        if t.exited().is_some() {
+            if let Some(cursor) = self.frames.get_mut(&t.frame()) {
+                cursor.active = false;
+            }
+        }
+        Ok(())
+    }
+    fn round_started(
+        &mut self,
+        id: FrameId,
+        count: usize,
+        wall: DateTime<Utc>,
+    ) -> Result<(), ExecutionError> {
+        let kind = self.frames.get(&id).ok_or(ExecutionError::Invalid)?.kind;
+        let mut event = events::event(
+            if kind == Kind::Map {
+                HistoryEventType::MapStateStarted
+            } else {
+                HistoryEventType::ParallelStateStarted
+            },
+            wall,
+        );
+        if kind == Kind::Map {
+            let mut details = MapStateStartedEventDetails::default();
+            details.length = Some(i32::try_from(count).map_err(|_| ExecutionError::Invalid)?);
+            event.map_state_started_event_details = Some(details);
+        }
+        self.append(id, event)?;
+        let cursor = self.frames.get_mut(&id).ok_or(ExecutionError::Invalid)?;
+        cursor.round = Some(cursor.last);
+        cursor.next_iteration = Some(cursor.last);
+        Ok(())
+    }
+    pub(super) fn child_started(
+        &mut self,
+        id: FrameId,
+        parent: FrameParent,
+        graph: &FrameScheduler,
+        wall: DateTime<Utc>,
+    ) -> Result<(), ExecutionError> {
+        let parent_cursor = self
+            .frames
+            .get(&parent.frame())
+            .ok_or(ExecutionError::Invalid)?;
+        let map = parent_cursor.kind == Kind::Map;
+        let previous = if map {
+            parent_cursor.next_iteration
+        } else {
+            parent_cursor.round
+        }
+        .ok_or(ExecutionError::Invalid)?;
+        let name = parent_cursor
+            .machine
+            .state_name(parent_cursor.state)?
+            .to_owned();
+        let child = graph.driver(id).ok_or(ExecutionError::Invalid)?;
+        self.frames.insert(
+            id,
+            Cursor {
+                machine: child.machine().clone(),
+                state: child.state(),
+                last: previous,
+                round: None,
+                next_iteration: None,
+                kind: Kind::Plain,
+                active: false,
+                parent: Some(parent),
+            },
+        );
+        if map {
+            self.append(
+                id,
+                iteration(
+                    HistoryEventType::MapIterationStarted,
+                    &name,
+                    parent.index(),
+                    wall,
+                )?,
+            )?;
+        }
+        Ok(())
+    }
+    pub(super) fn child_finished(
+        &mut self,
+        id: FrameId,
+        parent: FrameParent,
+        outcome: &ExecutionOutcome,
+        wall: DateTime<Utc>,
+    ) -> Result<(), ExecutionError> {
+        if !self.frames.contains_key(&id) {
+            return Ok(());
+        }
+        if matches!(outcome, ExecutionOutcome::Aborted(_)) {
+            self.abort_state(id, wall)?;
+        }
+        let owner = self
+            .frames
+            .get(&parent.frame())
+            .ok_or(ExecutionError::Invalid)?;
+        let kind = owner.kind;
+        let name = owner.machine.state_name(owner.state)?.to_owned();
+        let processor_last = self.frames.get(&id).ok_or(ExecutionError::Invalid)?.last;
+        if kind == Kind::Map {
+            let event = match outcome {
+                ExecutionOutcome::Succeeded(_) => HistoryEventType::MapIterationSucceeded,
+                ExecutionOutcome::Failed(_) => HistoryEventType::MapIterationFailed,
+                _ => HistoryEventType::MapIterationAborted,
+            };
+            self.append(id, iteration(event, &name, parent.index(), wall)?)?;
+        }
+        let child = self.frames.remove(&id).ok_or(ExecutionError::Invalid)?;
+        let owner = self
+            .frames
+            .get_mut(&parent.frame())
+            .ok_or(ExecutionError::Invalid)?;
+        owner.last = child.last;
+        if kind == Kind::Map {
+            owner.next_iteration = Some(processor_last);
+        }
+        Ok(())
+    }
+    fn abort_state(&mut self, id: FrameId, wall: DateTime<Utc>) -> Result<(), ExecutionError> {
+        let cursor = self.frames.get(&id).ok_or(ExecutionError::Invalid)?;
+        if !cursor.active {
+            return Ok(());
+        }
+        let event = match cursor.kind {
+            Kind::Map => Some(HistoryEventType::MapStateAborted),
+            Kind::Parallel => Some(HistoryEventType::ParallelStateAborted),
+            Kind::Task => Some(HistoryEventType::TaskStateAborted),
+            Kind::Wait => Some(HistoryEventType::WaitStateAborted),
+            Kind::Plain => None,
+        };
+        if let Some(event) = event {
+            self.append(id, events::event(event, wall))?;
+        }
+        if let Some(cursor) = self.frames.get_mut(&id) {
+            cursor.active = false;
+        }
+        Ok(())
+    }
+    pub(super) fn abort(&mut self, wall: DateTime<Utc>) -> Result<(), ExecutionError> {
+        let ids = self.frames.keys().rev().copied().collect::<Vec<_>>();
+        for id in ids {
+            self.abort_state(id, wall)?;
+            let parent = self.frames.get(&id).and_then(|cursor| cursor.parent);
+            if let Some(parent) = parent {
+                let owner = self
+                    .frames
+                    .get(&parent.frame())
+                    .ok_or(ExecutionError::Invalid)?;
+                let name = owner.machine.state_name(owner.state)?.to_owned();
+                if owner.kind == Kind::Map {
+                    self.append(
+                        id,
+                        iteration(
+                            HistoryEventType::MapIterationAborted,
+                            &name,
+                            parent.index(),
+                            wall,
+                        )?,
+                    )?;
+                }
+                let last = self.frames.get(&id).ok_or(ExecutionError::Invalid)?.last;
+                self.frames
+                    .get_mut(&parent.frame())
+                    .ok_or(ExecutionError::Invalid)?
+                    .last = last;
+            }
+        }
+        Ok(())
+    }
+    pub(super) fn terminal(
+        &mut self,
+        outcome: &ExecutionOutcome,
+        wall: DateTime<Utc>,
+    ) -> Result<(), ExecutionError> {
+        let previous = self
+            .root
+            .and_then(|id| self.frames.get(&id).map(|cursor| cursor.last))
+            .unwrap_or(1);
+        self.journal
+            .append_causal(events::terminal(outcome, wall)?, previous, true)
+    }
+}
+fn iteration(
+    kind: HistoryEventType,
+    name: &str,
+    index: usize,
+    wall: DateTime<Utc>,
+) -> Result<HistoryEvent, ExecutionError> {
+    let mut event = events::event(kind, wall);
+    let mut details = MapIterationEventDetails::default();
+    details.name = Some(name.into());
+    details.index = Some(i32::try_from(index).map_err(|_| ExecutionError::Invalid)?);
+    match &event.r#type {
+        HistoryEventType::MapIterationStarted => {
+            event.map_iteration_started_event_details = Some(details);
+        }
+        HistoryEventType::MapIterationSucceeded => {
+            event.map_iteration_succeeded_event_details = Some(details);
+        }
+        HistoryEventType::MapIterationFailed => {
+            event.map_iteration_failed_event_details = Some(details);
+        }
+        HistoryEventType::MapIterationAborted => {
+            event.map_iteration_aborted_event_details = Some(details);
+        }
+        _ => return Err(ExecutionError::Invalid),
+    }
+    Ok(event)
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/mod.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/mod.rs
new file mode 100644
index 00000000..dec1e896
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/mod.rs
@@ -0,0 +1,1021 @@
+//! Asynchronous resource ownership around the unique structured frame scheduler.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    sync::Arc,
+    time::Instant as MonotonicInstant,
+};
+
+use chrono::{DateTime, Utc};
+use serde_json::Value;
+use tokio::{
+    sync::{OwnedSemaphorePermit, mpsc, oneshot, watch},
+    task::{Id, JoinError, JoinSet, yield_now},
+    time::{Instant, sleep_until},
+};
+
+use super::{
+    CleanupState, DispatchLease, ExecutionError, ExecutionView, Shared,
+    actor::{OwnedCall, RunExit},
+    shutdown_reason,
+};
+use crate::{
+    CallbackDispatch, CallbackHistory, ChildPattern, ClockSample, CompiledMachine, DriverStep,
+    ExecutionFailure, ExecutionOutcome, ExecutionSnapshot, FrameCallId, FrameError, FrameLease,
+    FrameScheduler, FrameTransition, FrameUpdate, Integration, LambdaTaskCommand, Payload, StateId,
+    StateView, SystemUuidSource, TaskCall, TaskDispatch, TaskFailure, TaskTimeout,
+    engine::{
+        Phase,
+        history::{
+            Journal,
+            events::{self, TaskFailureKind},
+        },
+        types::FailureOrigin,
+    },
+};
+
+mod callback;
+mod child;
+mod history;
+mod resource;
+use history::CausalHistory;
+
+#[derive(Debug)]
+enum Message {
+    CallbackScheduled(FrameCallId, CallbackHistory, oneshot::Sender<bool>),
+    Started(FrameCallId),
+    Submitted(FrameCallId, Output),
+    Completed(FrameCallId, Completion),
+    Quarantined(FrameCallId),
+    Fatal(ExecutionError),
+}
+#[derive(Debug)]
+struct Completion {
+    result: Result<Payload, TaskFailure>,
+    _lease: Option<Arc<DispatchLease>>,
+}
+#[derive(Debug)]
+struct Output {
+    payload: Payload,
+    _lease: Arc<DispatchLease>,
+}
+#[derive(Debug)]
+struct WatchExit {
+    id: FrameCallId,
+    owned: OwnedCall,
+    clean: bool,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Progress {
+    Preparing,
+    Pending,
+    Started,
+    Submitted,
+}
+#[derive(Debug)]
+enum Instruction {
+    Task(TaskDispatch),
+    Callback(CallbackDispatch),
+}
+impl Instruction {
+    fn state(&self) -> StateId {
+        match self {
+            Self::Task(t) => t.state(),
+            Self::Callback(t) => t.state(),
+        }
+    }
+    fn deadline(&self) -> MonotonicInstant {
+        match self {
+            Self::Task(t) => t.deadline(),
+            Self::Callback(t) => t.deadline(),
+        }
+    }
+    fn callback(&self) -> bool {
+        matches!(self, Self::Callback(_))
+    }
+}
+#[derive(Debug)]
+struct Call {
+    cancel: watch::Sender<bool>,
+    lease: Arc<DispatchLease>,
+    machine: Arc<CompiledMachine>,
+    dispatch: Instruction,
+    progress: Progress,
+    result_seen: bool,
+    cancelled: bool,
+    settled: Option<bool>,
+}
+#[derive(Debug)]
+struct Pending {
+    expired: bool,
+    command: LambdaTaskCommand,
+    frame: Arc<FrameLease>,
+}
+#[derive(Debug)]
+enum Operation {
+    Advance,
+    Complete(FrameCallId, Completion, ClockSample),
+}
+#[derive(Debug)]
+struct Evaluated {
+    graph: FrameScheduler,
+    update: Result<Option<FrameUpdate>, FrameError>,
+    sample: ClockSample,
+}
+#[derive(Debug)]
+pub(super) struct Actor {
+    graph: Option<FrameScheduler>,
+    deadline: Instant,
+    history: CausalHistory,
+    view: watch::Sender<Arc<ExecutionView>>,
+    stop: watch::Receiver<Option<TaskFailure>>,
+    ledger: watch::Sender<Arc<Vec<Arc<DispatchLease>>>>,
+    shared: Arc<Shared>,
+    calls: BTreeMap<FrameCallId, Call>,
+    pending: BTreeMap<FrameCallId, Pending>,
+    acks: BTreeSet<FrameCallId>,
+    leases: Vec<Arc<DispatchLease>>,
+    quarantine: Vec<OwnedCall>,
+    watch_ids: BTreeMap<Id, FrameCallId>,
+    workers: JoinSet<Evaluated>,
+    watchers: JoinSet<WatchExit>,
+    child_jobs: JoinSet<()>,
+    callback_jobs: JoinSet<()>,
+    children: Option<child::Binding>,
+    parent: Option<ExecutionSnapshot>,
+    sender: mpsc::Sender<Message>,
+    receiver: mpsc::Receiver<Message>,
+    forced: Option<Arc<ExecutionOutcome>>,
+    committed: Option<Arc<ExecutionOutcome>>,
+    published: bool,
+    uncertain: bool,
+    park: Option<(Instant, bool)>,
+    reserved: Option<OwnedSemaphorePermit>,
+}
+impl Actor {
+    pub(super) fn new(
+        graph: FrameScheduler,
+        deadline: Instant,
+        journal: Journal,
+        view: watch::Sender<Arc<ExecutionView>>,
+        stop: watch::Receiver<Option<TaskFailure>>,
+        ledger: watch::Sender<Arc<Vec<Arc<DispatchLease>>>>,
+        shared: Arc<Shared>,
+    ) -> Self {
+        let (sender, receiver) = mpsc::channel(64);
+        Self {
+            graph: Some(graph),
+            deadline,
+            history: CausalHistory::new(journal),
+            view,
+            stop,
+            ledger,
+            shared,
+            calls: BTreeMap::new(),
+            pending: BTreeMap::new(),
+            acks: BTreeSet::new(),
+            leases: Vec::new(),
+            quarantine: Vec::new(),
+            watch_ids: BTreeMap::new(),
+            workers: JoinSet::new(),
+            watchers: JoinSet::new(),
+            child_jobs: JoinSet::new(),
+            callback_jobs: JoinSet::new(),
+            children: None,
+            parent: None,
+            sender,
+            receiver,
+            forced: None,
+            committed: None,
+            published: false,
+            uncertain: false,
+            park: None,
+            reserved: None,
+        }
+    }
+    fn sample() -> ClockSample {
+        ClockSample::new(Instant::now().into_std(), Utc::now())
+    }
+    fn control(&mut self) {
+        if self.published || self.forced.is_some() || self.committed.is_some() {
+            return;
+        }
+        let outcome = if Instant::now() >= self.deadline {
+            Some(ExecutionOutcome::TimedOut)
+        } else {
+            self.stop
+                .borrow()
+                .clone()
+                .or_else(|| self.stop.has_changed().is_err().then(shutdown_reason))
+                .map(ExecutionOutcome::Aborted)
+        };
+        if let Some(outcome) = outcome {
+            self.force(Arc::new(outcome));
+        }
+    }
+    fn force(&mut self, mut outcome: Arc<ExecutionOutcome>) {
+        if self.published {
+            return;
+        }
+        self.forced = Some(outcome.clone());
+        self.reserved = None;
+        self.pending.clear();
+        for call in self.calls.values_mut() {
+            call.cancel.send_replace(true);
+            call.cancelled = true;
+        }
+        if let Some(graph) = &mut self.graph {
+            graph.supersede_uncommitted(outcome.clone());
+        }
+        if let Err(error) = self.history.abort(Utc::now()) {
+            let name = if matches!(error, ExecutionError::Capacity) {
+                "States.HistoryLimitExceeded"
+            } else {
+                "Rustack.InternalError"
+            };
+            let mut view = self.view.borrow().as_ref().clone();
+            view.diagnostic = Some(Arc::new(error));
+            self.view.send_replace(Arc::new(view));
+            outcome = Arc::new(ExecutionOutcome::Failed(ExecutionFailure::safety(
+                name,
+                "Abort history could not be retained",
+            )));
+            self.forced = Some(outcome.clone());
+            if let Some(graph) = &mut self.graph {
+                graph.supersede_uncommitted(outcome.clone());
+            }
+        }
+        self.publish_terminal(outcome);
+        self.park = None;
+    }
+    fn fail(&mut self, error: ExecutionError) {
+        let mut view = self.view.borrow().as_ref().clone();
+        if view.diagnostic.is_none() {
+            view.diagnostic = Some(Arc::new(error));
+        }
+        self.view.send_replace(Arc::new(view));
+        let name = if matches!(
+            self.view.borrow().diagnostic.as_deref(),
+            Some(ExecutionError::Capacity)
+        ) {
+            "States.HistoryLimitExceeded"
+        } else {
+            "Rustack.InternalError"
+        };
+        self.force(Arc::new(ExecutionOutcome::Failed(
+            ExecutionFailure::safety(name, "Structured execution owner failed"),
+        )));
+    }
+    fn publish_running(&self) {
+        let mut view = self.view.borrow().as_ref().clone();
+        view.history = self.history.journal.view.clone();
+        self.view.send_replace(Arc::new(view));
+    }
+    fn publish_terminal(&mut self, mut outcome: Arc<ExecutionOutcome>) {
+        if self.published {
+            return;
+        }
+        let wall = Utc::now();
+        if self.history.terminal(&outcome, wall).is_err() {
+            outcome = Arc::new(ExecutionOutcome::Failed(ExecutionFailure::safety(
+                "States.HistoryLimitExceeded",
+                "Terminal history could not be retained",
+            )));
+            if self.history.terminal(&outcome, wall).is_err() {
+                self.uncertain = true;
+                return;
+            }
+        }
+        let mut view = self.view.borrow().as_ref().clone();
+        view.history = self.history.journal.view.clone();
+        view.outcome = Some(outcome);
+        view.stopped = Some(wall);
+        self.view.send_replace(Arc::new(view));
+        self.published = true;
+    }
+    fn cleanup(&self, state: CleanupState) {
+        let mut view = self.view.borrow().as_ref().clone();
+        view.cleanup = state;
+        self.view.send_replace(Arc::new(view));
+    }
+    fn sync_ledger(&self) {
+        self.ledger.send_replace(Arc::new(self.leases.clone()));
+    }
+    fn release(&mut self, lease: &Arc<DispatchLease>) {
+        self.leases.retain(|item| !Arc::ptr_eq(item, lease));
+        self.sync_ledger();
+    }
+    fn reconcile(&mut self) {
+        let Some(graph) = &mut self.graph else {
+            if self.workers.is_empty() && self.forced.is_some() {
+                let ids = self.acks.iter().copied().collect::<Vec<_>>();
+                for id in ids {
+                    self.acks.remove(&id);
+                    if let Some(call) = self.calls.remove(&id) {
+                        self.release(&call.lease);
+                    }
+                }
+            }
+            return;
+        };
+        let ids = self.acks.iter().copied().collect::<Vec<_>>();
+        let mut released = Vec::new();
+        for id in ids {
+            match graph.retired(id) {
+                Ok(changed) => {
+                    if changed {
+                        self.park = None;
+                    }
+                    if self
+                        .calls
+                        .get(&id)
+                        .is_some_and(|call| call.dispatch.callback())
+                        && graph.retains_result_notification(id.frame())
+                    {
+                        continue;
+                    }
+                    self.acks.remove(&id);
+                    if let Some(call) = self.calls.remove(&id) {
+                        released.push(call.lease);
+                    }
+                }
+                Err(FrameError::Event) => {}
+                Err(error) => {
+                    self.fail(ExecutionError::Frame(error));
+                    return;
+                }
+            }
+        }
+        for lease in released {
+            self.release(&lease);
+        }
+    }
+    fn joined(&mut self, result: Result<(Id, WatchExit), JoinError>) {
+        match result {
+            Ok((task, exit)) => {
+                self.watch_ids.remove(&task);
+                if let Some(call) = self.calls.get_mut(&exit.id) {
+                    call.settled = Some(exit.clean);
+                    if exit.clean && (call.result_seen || call.cancelled || self.published) {
+                        self.acks.insert(exit.id);
+                    }
+                }
+                if !exit.clean {
+                    self.quarantine.push(exit.owned);
+                    self.cleanup(CleanupState::Quarantined);
+                    self.uncertain = true;
+                }
+            }
+            Err(error) => {
+                if let Some(id) = self.watch_ids.remove(&error.id()) {
+                    if let Some(call) = self.calls.get_mut(&id) {
+                        call.settled = Some(false);
+                    }
+                }
+                self.uncertain = true;
+                self.fail(ExecutionError::Worker(error));
+            }
+        }
+        self.reconcile();
+    }
+    async fn worker(&mut self, operation: Operation) -> bool {
+        self.control();
+        if self.forced.is_some() {
+            return false;
+        }
+        let permit = loop {
+            let task_deadline = self.next_deadline();
+            tokio::select! {biased;_=self.stop.changed()=>{self.control();if self.forced.is_some(){return false;}},()=sleep_until(self.deadline)=>{self.control();return false;},()=sleep_until(task_deadline)=>{self.expired();},permit=self.shared.pools.cpu.clone().acquire_owned()=>break permit}
+        };
+        let Ok(permit) = permit else {
+            self.fail(ExecutionError::Unavailable);
+            return false;
+        };
+        self.control();
+        if self.forced.is_some() {
+            return false;
+        }
+        let Some(mut graph) = self.graph.take() else {
+            self.fail(ExecutionError::Unavailable);
+            return false;
+        };
+        #[cfg(test)]
+        let hook = self.shared.worker_hook.clone();
+        self.park = None;
+        self.workers.spawn_blocking(move || {
+            let _permit = permit;
+            #[cfg(test)]
+            if let Some(hook) = &hook {
+                hook.run(true);
+            }
+            let sample = Self::sample();
+            let mut source = SystemUuidSource::default();
+            let update = match operation {
+                Operation::Advance => Ok(Some(graph.advance(sample, &mut source))),
+                Operation::Complete(call, completion, observed) => graph
+                    .complete(call, completion.result, observed, &mut source)
+                    .map(|result| result.map(|t| FrameUpdate::Transition(Box::new(t)))),
+            };
+            #[cfg(test)]
+            if let Some(hook) = &hook {
+                hook.run(false);
+            }
+            Evaluated {
+                graph,
+                update,
+                sample,
+            }
+        });
+        true
+    }
+    fn evaluated(&mut self, result: Result<Evaluated, JoinError>) {
+        match result {
+            Ok(mut result) => {
+                self.control();
+                if let Some(outcome) = &self.forced {
+                    result.graph.supersede_uncommitted(outcome.clone());
+                    result.update = Ok(None);
+                }
+                self.graph = Some(result.graph);
+                match result.update {
+                    Ok(Some(update)) => {
+                        if let Err(error) = self.update(update, result.sample.wall) {
+                            self.fail(error);
+                        }
+                    }
+                    Ok(None) => {}
+                    Err(error) => self.fail(ExecutionError::Frame(error)),
+                }
+                self.reconcile();
+                if self.forced.is_none() && self.committed.is_none() {
+                    self.committed = self
+                        .graph
+                        .as_ref()
+                        .and_then(|graph| graph.outcome().cloned());
+                    if self.committed.is_some() {
+                        self.park = None;
+                    }
+                }
+            }
+            Err(error) => {
+                self.fail(ExecutionError::Worker(error));
+                self.park = Some((self.deadline, false));
+            }
+        }
+    }
+    fn schedule(&mut self, t: &FrameTransition, wall: DateTime<Utc>) -> Result<(), ExecutionError> {
+        if let DriverStep::Callback(effect) = t.step() {
+            return self.start_callback(t.call().ok_or(ExecutionError::Invalid)?, effect.clone());
+        }
+        if let DriverStep::Dispatch(dispatch) = t.step() {
+            let id = t.call().ok_or(ExecutionError::Invalid)?;
+            let graph = self.graph.as_ref().ok_or(ExecutionError::Invalid)?;
+            let driver = graph.driver(id.frame()).ok_or(ExecutionError::Invalid)?;
+            let timeout = match driver.machine.state(driver.state)? {
+                StateView::Task { timeout, .. } => match timeout {
+                    TaskTimeout::Omitted => None,
+                    TaskTimeout::Seconds(value) => Some(i64::from(value.get())),
+                    TaskTimeout::Path(path) => path
+                        .lookup(&driver.input, &driver.context)
+                        .and_then(Value::as_i64),
+                },
+                _ => None,
+            };
+            self.history.event(
+                id.frame(),
+                events::scheduled(
+                    t.machine(),
+                    dispatch.state(),
+                    dispatch.parameters(),
+                    timeout,
+                    wall,
+                ),
+            )?;
+            let frame = graph.lease(id.frame()).ok_or(ExecutionError::Invalid)?;
+            self.pending.insert(
+                id,
+                Pending {
+                    expired: false,
+                    command: LambdaTaskCommand::new(t.machine().clone(), dispatch.clone()),
+                    frame,
+                },
+            );
+        }
+
+        Ok(())
+    }
+    fn update(&mut self, update: FrameUpdate, wall: DateTime<Utc>) -> Result<(), ExecutionError> {
+        match update {
+            FrameUpdate::Transition(t) => {
+                if self.published {
+                    return Ok(());
+                }
+                self.history.transition(&t, wall)?;
+
+                self.schedule(&t, wall)?;
+                self.park = None;
+                self.publish_running();
+            }
+            FrameUpdate::ChildStarted { child, parent } => {
+                if !self.published {
+                    self.history.child_started(
+                        child,
+                        parent,
+                        self.graph.as_ref().ok_or(ExecutionError::Invalid)?,
+                        wall,
+                    )?;
+                    self.publish_running();
+                }
+                self.park = None;
+            }
+            FrameUpdate::ChildFinished {
+                child,
+                parent,
+                outcome,
+            } => {
+                if !self.published {
+                    self.history.child_finished(child, parent, &outcome, wall)?;
+                    self.publish_running();
+                }
+                self.park = None;
+            }
+            FrameUpdate::Cancel(id) => {
+                if let Some(call) = self.calls.get_mut(&id) {
+                    call.cancel.send_replace(true);
+                    call.cancelled = true;
+                    if call.settled == Some(true) {
+                        self.acks.insert(id);
+                    }
+                } else {
+                    self.pending.remove(&id);
+                    self.acks.insert(id);
+                }
+                self.reconcile();
+                self.park = None;
+            }
+            FrameUpdate::Park {
+                until,
+                global_capacity,
+            } => self.park = Some((Instant::from_std(until), global_capacity)),
+            FrameUpdate::Yield => self.park = None,
+            FrameUpdate::Settled(outcome) => {
+                if !self.published
+                    && matches!(
+                        outcome.as_ref(),
+                        ExecutionOutcome::Failed(failure)
+                            if matches!(failure.origin, FailureOrigin::Safety)
+                    )
+                {
+                    self.history.abort(wall)?;
+                }
+                self.publish_terminal(outcome);
+                self.park = Some((self.deadline, false));
+            }
+        }
+        Ok(())
+    }
+}
+
+impl Actor {
+    fn current(&self, id: FrameCallId) -> bool {
+        self.graph
+            .as_ref()
+            .and_then(|graph| graph.driver(id.frame()))
+            .is_some_and(|driver| {
+                matches!(driver.phase, Phase::Calling { attempt, .. } if attempt == id.attempt())
+            })
+    }
+    fn submitted(&mut self, id: FrameCallId, output: &Payload) {
+        let current = self.current(id);
+        if let Some(call) = self.calls.get_mut(&id) {
+            if call.progress != Progress::Started || call.result_seen {
+                self.fail(ExecutionError::Unavailable);
+                return;
+            }
+            call.progress = Progress::Submitted;
+            if !self.published
+                && current
+                && !call.cancelled
+                && Instant::now().into_std() < call.dispatch.deadline()
+            {
+                if let Err(error) = self.history.event(
+                    id.frame(),
+                    events::task_submitted(
+                        &call.machine,
+                        call.dispatch.state(),
+                        output,
+                        Utc::now(),
+                    ),
+                ) {
+                    self.fail(error);
+                } else {
+                    self.publish_running();
+                }
+            }
+        }
+    }
+    async fn message(&mut self, message: Message) {
+        self.control();
+        match message {
+            Message::CallbackScheduled(id, history, ack) => {
+                self.callback_scheduled(id, &history, ack);
+            }
+            Message::Fatal(error) => self.fail(error),
+            Message::Quarantined(id) => {
+                if self.calls.contains_key(&id) {
+                    self.cleanup(CleanupState::Quarantined);
+                }
+            }
+            Message::Started(id) => {
+                let current = self.current(id);
+                if let Some(call) = self.calls.get_mut(&id) {
+                    if call.progress != Progress::Pending {
+                        self.fail(ExecutionError::Unavailable);
+                        return;
+                    }
+                    call.progress = Progress::Started;
+                    if !self.published
+                        && current
+                        && !call.cancelled
+                        && Instant::now().into_std() < call.dispatch.deadline()
+                    {
+                        let result = self.history.event(
+                            id.frame(),
+                            events::task_started(&call.machine, call.dispatch.state(), Utc::now()),
+                        );
+                        if let Err(error) = result {
+                            self.fail(error);
+                        } else {
+                            self.publish_running();
+                        }
+                    }
+                }
+            }
+            Message::Submitted(id, output) => self.submitted(id, &output.payload),
+            Message::Completed(id, completion) => self.completed(id, completion).await,
+        }
+    }
+    async fn completed(&mut self, id: FrameCallId, completion: Completion) {
+        let result = &completion.result;
+        let observed = Self::sample();
+        let current = self.current(id);
+        let Some(call) = self.calls.get_mut(&id) else {
+            return;
+        };
+        if call.result_seen {
+            return;
+        }
+        call.result_seen = true;
+        if call.settled == Some(true) {
+            self.acks.insert(id);
+        }
+        if self.published || !current {
+            self.reconcile();
+            return;
+        }
+        if result.is_ok() && matches!(call.progress, Progress::Preparing | Progress::Pending) {
+            self.fail(ExecutionError::Unavailable);
+            return;
+        }
+        if observed.monotonic < call.dispatch.deadline() {
+            let event = match result {
+                Ok(output) => events::task_success(
+                    &call.machine,
+                    call.dispatch.state(),
+                    output,
+                    observed.wall,
+                ),
+                Err(failure) => events::task_failure(
+                    &call.machine,
+                    call.dispatch.state(),
+                    failure,
+                    if matches!(call.progress, Progress::Preparing | Progress::Pending) {
+                        TaskFailureKind::Admission
+                    } else if call.dispatch.callback()
+                        && matches!(
+                            failure.details().error(),
+                            Some("States.HeartbeatTimeout" | "States.Timeout")
+                        )
+                    {
+                        TaskFailureKind::TimedOut
+                    } else {
+                        TaskFailureKind::Failed
+                    },
+                    observed.wall,
+                ),
+            };
+            if let Err(error) = self.history.event(id.frame(), event) {
+                self.fail(error);
+                return;
+            }
+            self.publish_running();
+        }
+        self.park = None;
+        self.worker(Operation::Complete(id, completion, observed))
+            .await;
+    }
+    async fn dispatch(&mut self) {
+        self.control();
+        if self.published {
+            return;
+        }
+        let Some(id) = self
+            .pending
+            .iter()
+            .find_map(|(id, pending)| child_pattern(&pending.command).map(|_| *id))
+            .or_else(|| self.pending.keys().next().copied())
+        else {
+            return;
+        };
+        if self.pending.get(&id).is_some_and(|pending| {
+            Instant::now().into_std() >= pending.command.dispatch().deadline()
+        }) {
+            self.park = None;
+            return;
+        }
+        let is_child = self
+            .pending
+            .get(&id)
+            .and_then(|p| child_pattern(&p.command))
+            .is_some();
+        let permit = if is_child {
+            self.reserved = None;
+            None
+        } else if let Some(permit) = self.reserved.take() {
+            Some(permit)
+        } else {
+            let Ok(permit) = self.shared.pools.dispatch.clone().try_acquire_owned() else {
+                return;
+            };
+            Some(permit)
+        };
+        self.control();
+        if self.published {
+            return;
+        }
+        let Some(pending) = self.pending.remove(&id) else {
+            return;
+        };
+        if Instant::now().into_std() >= pending.command.dispatch().deadline() {
+            self.pending.insert(id, pending);
+            self.park = None;
+            return;
+        }
+        let lease = Arc::new(DispatchLease {
+            _permit: permit,
+            _frame: Some(pending.frame),
+            _data: None,
+        });
+        self.leases.push(lease.clone());
+        self.sync_ledger();
+        let machine = pending.command.machine().clone();
+        let dispatch = pending.command.dispatch().clone();
+        if let Some(pattern) = child_pattern(&pending.command) {
+            self.start_child(id, pending.command, pattern, lease);
+            return;
+        }
+        let result = self.shared.port.as_ref().map_or_else(
+            || Err(TaskFailure::service_exception()),
+            |port| port.start(pending.command),
+        );
+        match result {
+            Ok(call) => {
+                self.accepted(id, machine, dispatch, call, lease);
+            }
+            Err(failure) => {
+                self.release(&lease);
+                self.rejected(id, machine, dispatch, failure).await;
+            }
+        }
+    }
+    async fn rejected(
+        &mut self,
+        id: FrameCallId,
+        machine: Arc<CompiledMachine>,
+        dispatch: TaskDispatch,
+        failure: TaskFailure,
+    ) {
+        let observed = Self::sample();
+        self.control();
+        if self.published {
+            return;
+        }
+        if observed.monotonic >= dispatch.deadline() {
+            self.acks.insert(id);
+            self.park = None;
+            return;
+        }
+        if let Err(error) = self.history.event(
+            id.frame(),
+            events::task_failure(
+                &machine,
+                dispatch.state(),
+                &failure,
+                TaskFailureKind::Admission,
+                observed.wall,
+            ),
+        ) {
+            self.fail(error);
+            return;
+        }
+        self.publish_running();
+        self.acks.insert(id);
+        self.worker(Operation::Complete(
+            id,
+            Completion {
+                result: Err(failure),
+                _lease: None,
+            },
+            observed,
+        ))
+        .await;
+    }
+    fn accepted(
+        &mut self,
+        id: FrameCallId,
+        machine: Arc<CompiledMachine>,
+        dispatch: TaskDispatch,
+        call: TaskCall,
+        lease: Arc<DispatchLease>,
+    ) {
+        self.accepted_instruction(id, machine, Instruction::Task(dispatch), call, lease);
+    }
+    fn accepted_instruction(
+        &mut self,
+        id: FrameCallId,
+        machine: Arc<CompiledMachine>,
+        dispatch: Instruction,
+        call: TaskCall,
+        lease: Arc<DispatchLease>,
+    ) {
+        let cancel = call.cancellation_sender();
+        let cancelled = cancel.subscribe();
+        let child = matches!(
+            machine.state(dispatch.state()),
+            Ok(StateView::Task {
+                resource: Integration::StartExecution(_) | Integration::LambdaCallback(_),
+                ..
+            })
+        );
+        self.calls.insert(
+            id,
+            Call {
+                cancel,
+                lease: lease.clone(),
+                machine,
+                progress: if dispatch.callback() {
+                    Progress::Preparing
+                } else {
+                    Progress::Pending
+                },
+                dispatch,
+                result_seen: false,
+                cancelled: false,
+                settled: None,
+            },
+        );
+        let task = self.watchers.spawn(resource::run(
+            id,
+            OwnedCall { call, lease },
+            cancelled,
+            self.sender.clone(),
+            child,
+        ));
+        self.watch_ids.insert(task.id(), id);
+    }
+    fn expired(&mut self) {
+        let now = Instant::now().into_std();
+        for call in self.calls.values_mut() {
+            if !call.result_seen && !call.cancelled && now >= call.dispatch.deadline() {
+                call.cancel.send_replace(true);
+                call.cancelled = true;
+                self.park = None;
+            }
+        }
+        for pending in self.pending.values_mut() {
+            if !pending.expired && now >= pending.command.dispatch().deadline() {
+                pending.expired = true;
+                self.park = None;
+            }
+        }
+    }
+    fn next_deadline(&self) -> Instant {
+        self.calls
+            .values()
+            .filter(|call| !call.result_seen && !call.cancelled)
+            .map(|call| Instant::from_std(call.dispatch.deadline()))
+            .chain(
+                self.pending
+                    .values()
+                    .filter(|pending| !pending.expired)
+                    .map(|pending| Instant::from_std(pending.command.dispatch().deadline())),
+            )
+            .fold(self.deadline, Instant::min)
+    }
+    fn done(&self) -> bool {
+        self.published
+            && self.workers.is_empty()
+            && self.watchers.is_empty()
+            && self.child_jobs.is_empty()
+            && self.callback_jobs.is_empty()
+            && self.pending.is_empty()
+            && self.calls.values().all(|call| call.settled == Some(false))
+            && self.park.is_some()
+    }
+    pub(super) async fn run(mut self) -> RunExit {
+        self.register_children().await;
+        let mut ticks = 0_u8;
+        loop {
+            ticks = ticks.saturating_add(1);
+            if ticks >= 64 {
+                yield_now().await;
+                ticks = 0;
+            }
+            self.control();
+            self.expired();
+            self.reconcile();
+            while let Some(result) = self.callback_jobs.try_join_next() {
+                if let Err(error) = result {
+                    self.uncertain = true;
+                    self.fail(ExecutionError::Worker(error));
+                }
+            }
+            while let Some(result) = self.child_jobs.try_join_next() {
+                if let Err(error) = result {
+                    self.uncertain = true;
+                    self.fail(ExecutionError::Worker(error));
+                }
+            }
+            while let Some(result) = self.watchers.try_join_next_with_id() {
+                self.joined(result);
+            }
+            if self.done() {
+                break;
+            }
+            if self.workers.is_empty() {
+                if self.published || self.committed.is_some() {
+                    if let Some(graph) = &mut self.graph {
+                        let update =
+                            graph.advance(Self::sample(), &mut SystemUuidSource::default());
+                        if let Err(error) = self.update(update, Utc::now()) {
+                            self.fail(error);
+                        }
+                    }
+                    if self.park.is_none() {
+                        continue;
+                    }
+                } else {
+                    if let Ok(message) = self.receiver.try_recv() {
+                        self.message(message).await;
+                        continue;
+                    }
+                    self.dispatch().await;
+                    if self.workers.is_empty() && self.park.is_none() {
+                        self.worker(Operation::Advance).await;
+                        continue;
+                    }
+                }
+            }
+            if self.done() {
+                break;
+            }
+            let until = self
+                .park
+                .map_or(self.deadline, |(until, _)| until)
+                .min(self.next_deadline());
+            let global = self.park.is_some_and(|(_, global)| global);
+            tokio::select! {
+                biased;
+                _=self.stop.changed(),if !self.published=>self.control(),
+                ()=sleep_until(until),if !self.published=>{self.control();self.expired();self.park=None;},
+                result=self.workers.join_next(),if !self.workers.is_empty()=>if let Some(result)=result{self.evaluated(result);},
+                result=self.callback_jobs.join_next(),if !self.callback_jobs.is_empty()=>if let Some(Err(error))=result{self.uncertain=true;self.fail(ExecutionError::Worker(error));},
+                result=self.child_jobs.join_next(),if !self.child_jobs.is_empty()=>if let Some(Err(error))=result{self.uncertain=true;self.fail(ExecutionError::Worker(error));},
+                result=self.watchers.join_next_with_id(),if !self.watchers.is_empty()=>if let Some(result)=result{self.joined(result);},
+                message=self.receiver.recv(),if self.workers.is_empty()=>if let Some(message)=message{self.message(message).await;},
+                permit=self.shared.pools.dispatch.clone().acquire_owned(),if !self.published&&self.workers.is_empty()&&self.pending.values().any(|p| child_pattern(&p.command).is_none())&&self.reserved.is_none()=>{match permit{Ok(permit)=>self.reserved=Some(permit),Err(_)=>self.fail(ExecutionError::Unavailable)}},
+                result=self.shared.frames.capacity.wait_for_capacity(until),if !self.published&&self.workers.is_empty()&&global=>{if result.is_ok(){self.park=None;}},
+            }
+        }
+        let uncertain = self.uncertain || !self.leases.is_empty();
+        self.cleanup(if uncertain {
+            CleanupState::Quarantined
+        } else {
+            CleanupState::Clean
+        });
+        RunExit {
+            quarantined: self.quarantine,
+            uncertain,
+        }
+    }
+}
+
+fn child_pattern(command: &LambdaTaskCommand) -> Option<ChildPattern> {
+    match command.machine().state(command.dispatch().state()).ok()? {
+        StateView::Task {
+            resource: Integration::StartExecution(pattern),
+            ..
+        } => Some(*pattern),
+        _ => None,
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/structured/resource.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/resource.rs
new file mode 100644
index 00000000..9f6a416c
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/structured/resource.rs
@@ -0,0 +1,68 @@
+//! One bounded watcher per accepted physical call, retained through cleanup.
+
+use tokio::sync::{mpsc, watch};
+
+use super::{Completion, Message, Output, WatchExit};
+use crate::{
+    FrameCallId, TaskEvent, TaskFailure, TaskSettlement, engine::runtime::actor::OwnedCall,
+};
+
+pub(super) async fn run(
+    id: FrameCallId,
+    mut owned: OwnedCall,
+    mut cancelled: watch::Receiver<bool>,
+    sender: mpsc::Sender<Message>,
+    child: bool,
+) -> WatchExit {
+    loop {
+        if *cancelled.borrow() {
+            break;
+        }
+        let event =
+            tokio::select! {biased;_ = cancelled.changed()=>break,event=owned.call.next()=>event};
+        let (message, done) = match event {
+            Ok(TaskEvent::Started) => (Message::Started(id), false),
+            Ok(TaskEvent::Submitted(output)) => (
+                Message::Submitted(
+                    id,
+                    Output {
+                        payload: output,
+                        _lease: owned.lease.clone(),
+                    },
+                ),
+                false,
+            ),
+            Ok(TaskEvent::Completed(result)) => (
+                Message::Completed(
+                    id,
+                    Completion {
+                        result,
+                        _lease: Some(owned.lease.clone()),
+                    },
+                ),
+                true,
+            ),
+            Err(_) if child => (Message::Fatal(super::ExecutionError::Unavailable), true),
+            Err(_) => (
+                Message::Completed(
+                    id,
+                    Completion {
+                        result: Err(TaskFailure::service_exception()),
+                        _lease: Some(owned.lease.clone()),
+                    },
+                ),
+                true,
+            ),
+        };
+        let sent = tokio::select! {biased;_=cancelled.changed()=>false,result=sender.send(message)=>result.is_ok()};
+        if !sent || done {
+            break;
+        }
+    }
+    owned.call.cancel();
+    if owned.call.settlement() == TaskSettlement::Quarantined {
+        let _ = sender.try_send(Message::Quarantined(id));
+    }
+    let clean = owned.call.settled().await.is_ok();
+    WatchExit { id, owned, clean }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/tests.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/tests.rs
new file mode 100644
index 00000000..7017c04b
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/tests.rs
@@ -0,0 +1,1028 @@
+//! Async ownership/history fixtures using explicit channel-backed task admission.
+
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use chrono::Utc;
+use serde_json::{Value, json};
+use tokio::{
+    sync::mpsc,
+    time::{Instant, timeout},
+};
+
+use super::{CleanupState, ExecutionError, ExecutionSupervisor};
+use crate::{
+    AslCompiler, ClockSample, EvaluationContext, ExecutionDriver, ExecutionLimits,
+    ExecutionOutcome, HistoryLimits, LambdaTaskCommand, LambdaTaskPort, Payload, RuntimeLimits,
+    TaskCall, TaskFailure, TaskResponder, TaskSupport, TenantScope,
+};
+
+#[derive(Debug)]
+struct Port {
+    sender: mpsc::Sender<(LambdaTaskCommand, TaskResponder)>,
+    starts: AtomicUsize,
+    panic: bool,
+}
+impl LambdaTaskPort for Port {
+    fn start(&self, command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        self.starts.fetch_add(1, Ordering::SeqCst);
+        assert!(!self.panic, "controlled actor failure");
+        let (call, owner) = TaskCall::channel();
+        self.sender
+            .try_send((command, owner))
+            .map_err(|_| TaskFailure::new("Lambda.TooManyRequestsException", None).unwrap())?;
+        Ok(call)
+    }
+}
+fn fixture(
+    open: usize,
+    dispatch: usize,
+    history: HistoryLimits,
+) -> (
+    ExecutionSupervisor,
+    mpsc::Receiver<(LambdaTaskCommand, TaskResponder)>,
+    Arc<Port>,
+) {
+    let (sender, receiver) = mpsc::channel(32);
+    let port = Arc::new(Port {
+        sender,
+        starts: AtomicUsize::new(0),
+        panic: false,
+    });
+    let owner = ExecutionSupervisor::new(
+        RuntimeLimits::new(open, dispatch, 2).unwrap(),
+        history,
+        256 * 1024 * 1024,
+        Some(port.clone()),
+    )
+    .unwrap();
+    (owner, receiver, port)
+}
+fn driver(definition: &Value, input: &Value) -> ExecutionDriver {
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(&serde_json::to_vec(definition).unwrap())
+        .unwrap()
+        .machine()
+        .clone();
+    let input = Payload::from_value(input).unwrap();
+    let context = EvaluationContext::from_value(
+        &json!({"Execution":{"Input":input.value(),"Id":"execution-fixture"}}),
+    )
+    .unwrap();
+    ExecutionDriver::new(
+        machine,
+        input,
+        context,
+        ClockSample::new(Instant::now().into_std(), Utc::now()),
+        ExecutionLimits::new(Duration::from_secs(60), 100_000).unwrap(),
+    )
+    .unwrap()
+}
+fn task() -> Value {
+    json!({"StartAt":"Work","States":{"Work":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}})
+}
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+async fn next(
+    receiver: &mut mpsc::Receiver<(LambdaTaskCommand, TaskResponder)>,
+) -> (LambdaTaskCommand, TaskResponder) {
+    timeout(Duration::from_secs(5), receiver.recv())
+        .await
+        .unwrap()
+        .unwrap()
+}
+fn kinds(view: &super::ExecutionView) -> Vec<String> {
+    view.history()
+        .page(1, 1000, true)
+        .unwrap()
+        .events()
+        .iter()
+        .map(|e| e.r#type.as_str().into())
+        .collect()
+}
+
+#[tokio::test]
+async fn test_should_execute_pure_states_and_publish_terminal_history_atomically() {
+    let (mut owner, _, _) = fixture(2, 2, HistoryLimits::default());
+    let definition = json!({"StartAt":"P","States":{"P":{"Type":"Pass","Result":{"n":7},"Next":"W"},"W":{"Type":"Wait","Seconds":0,"Next":"C"},"C":{"Type":"Choice","Choices":[{"Variable":"$.n","NumericEquals":7,"Next":"Done"}],"Default":"Failed"},"Done":{"Type":"Succeed"},"Failed":{"Type":"Fail"}}});
+    let mut handle = owner
+        .start(driver(&definition, &json!({"secret":"marker"})))
+        .unwrap();
+    let initial = handle.snapshot();
+    assert!(initial.outcome().is_none());
+    assert_eq!(initial.history().len(), 1);
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!({"n":7}))
+    );
+    assert_eq!(
+        kinds(&view),
+        [
+            "ExecutionStarted",
+            "PassStateEntered",
+            "PassStateExited",
+            "WaitStateEntered",
+            "WaitStateExited",
+            "ChoiceStateEntered",
+            "ChoiceStateExited",
+            "SucceedStateEntered",
+            "SucceedStateExited",
+            "ExecutionSucceeded"
+        ]
+    );
+    let events = view.history().page(1, 100, true).unwrap();
+    for (index, event) in events.events().iter().enumerate() {
+        assert_eq!(event.id, i64::try_from(index + 1).unwrap());
+        let previous = if index == 1 {
+            0
+        } else {
+            i64::try_from(index).unwrap()
+        };
+        assert_eq!(event.previous_event_id, Some(previous));
+    }
+    assert_eq!(initial.history().len(), 1);
+    owner.drain(deadline()).await.unwrap();
+    assert_eq!(handle.snapshot().cleanup(), CleanupState::Clean);
+}
+
+#[tokio::test]
+async fn test_should_execute_actual_channel_admission_and_fast_started_completion() {
+    let (mut owner, mut calls, _) = fixture(2, 2, HistoryLimits::default());
+    let mut handle = owner.start(driver(&task(), &json!({"n":3}))).unwrap();
+    let (command, mut response) = next(&mut calls).await;
+    assert_eq!(command.dispatch().parameters().value(), &json!({"n":3}));
+    response.started().unwrap();
+    response.finish(Ok(Payload::from_value(&json!({"computed":9})).unwrap()));
+    let view = handle.wait(deadline()).await.unwrap();
+    assert_eq!(
+        kinds(&view),
+        [
+            "ExecutionStarted",
+            "TaskStateEntered",
+            "LambdaFunctionScheduled",
+            "LambdaFunctionStarted",
+            "LambdaFunctionSucceeded",
+            "TaskStateExited",
+            "ExecutionSucceeded"
+        ]
+    );
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_preserve_call_ownership_after_observer_drop() {
+    let (mut owner, mut calls, port) = fixture(1, 1, HistoryLimits::default());
+    let handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let mut observer = handle.clone();
+    drop(handle);
+    let (_, mut response) = next(&mut calls).await;
+    assert!(!*response.cancellation().borrow());
+    response.started().unwrap();
+    response.finish(Ok(Payload::parse(b"5").unwrap()));
+    let view = observer.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Succeeded(_)
+    ));
+    assert_eq!(port.starts.load(Ordering::SeqCst), 1);
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_publish_stop_then_retain_slot_and_cleanup_through_waiter_expiry() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+        .await
+        .unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    assert_eq!(
+        kinds(&view).last().map(String::as_str),
+        Some("ExecutionAborted")
+    );
+    assert!(*response.cancellation().borrow());
+    assert_eq!(owner.owned_executions(), 1);
+    assert!(matches!(
+        owner.start(driver(&task(), &json!({}))),
+        Err(ExecutionError::Capacity)
+    ));
+    assert!(matches!(
+        owner
+            .drain(Instant::now() + Duration::from_millis(20))
+            .await,
+        Err(ExecutionError::Deadline)
+    ));
+    assert_eq!(owner.owned_executions(), 1);
+    response.finish(Err(TaskFailure::new("Cancelled", None).unwrap()));
+    owner.drain(deadline()).await.unwrap();
+    assert_eq!(owner.owned_executions(), 0);
+    assert_eq!(handle.snapshot().cleanup(), CleanupState::Clean);
+    assert_eq!(kinds(&handle.snapshot()), kinds(&view));
+}
+
+#[tokio::test]
+async fn test_should_retry_uncertain_result_while_retaining_prior_cleanup_capacity() {
+    let (mut owner, mut calls, port) = fixture(2, 2, HistoryLimits::default());
+    let mut definition = task();
+    definition["States"]["Work"]["Retry"] =
+        json!([{"ErrorEquals":["Lambda.ServiceException"],"IntervalSeconds":1,"MaxAttempts":1}]);
+    let mut handle = owner.start(driver(&definition, &json!({"n":2}))).unwrap();
+    let (first, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    let retained = response
+        .quarantine(TaskFailure::new("Lambda.ServiceException", Some("unknown result")).unwrap());
+    let (second, mut response) = next(&mut calls).await;
+    assert_ne!(first.dispatch().attempt(), second.dispatch().attempt());
+    assert_eq!(second.dispatch().parameters().value(), &json!({"n":2}));
+    response.started().unwrap();
+    response.finish(Ok(Payload::parse(b"4").unwrap()));
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Succeeded(_)
+    ));
+    assert!(owner.shared.pools.dispatch.available_permits() < 2);
+    assert_eq!(handle.snapshot().cleanup(), CleanupState::Quarantined);
+    assert!(matches!(
+        owner
+            .drain(Instant::now() + Duration::from_millis(20))
+            .await,
+        Err(ExecutionError::Deadline)
+    ));
+    retained.settle();
+    owner.drain(deadline()).await.unwrap();
+    assert_eq!(owner.shared.pools.dispatch.available_permits(), 2);
+    assert_eq!(port.starts.load(Ordering::SeqCst), 2);
+    let names = kinds(&handle.snapshot());
+    assert_eq!(names.iter().filter(|k| *k == "TaskStateEntered").count(), 1);
+    assert_eq!(
+        names
+            .iter()
+            .filter(|k| *k == "LambdaFunctionScheduled")
+            .count(),
+        2
+    );
+    assert!(!names.iter().any(|k| k.contains("Retry")));
+}
+
+#[tokio::test]
+async fn test_should_retain_lost_cleanup_and_reject_clean_drain() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let (_, response) = next(&mut calls).await;
+    drop(response);
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Failed(_)
+    ));
+    assert!(matches!(
+        owner.drain(deadline()).await,
+        Err(ExecutionError::Quarantined)
+    ));
+    assert_eq!(handle.snapshot().cleanup(), CleanupState::Quarantined);
+    assert_eq!(owner.owned_executions(), 1);
+    assert_eq!(owner.shared.pools.dispatch.available_permits(), 0);
+    // The test explicitly drops the root only after proving retained ownership;
+    // production's Drop fallback retains this bounded quarantine graph.
+}
+
+#[tokio::test]
+async fn test_should_timeout_wait_and_call_without_accepting_late_success() {
+    let (mut owner, mut calls, _) = fixture(2, 2, HistoryLimits::default());
+    let mut definition = task();
+    definition["TimeoutSeconds"] = json!(1);
+    let mut handle = owner.start(driver(&definition, &json!({}))).unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::TimedOut
+    ));
+    assert!(*response.cancellation().borrow());
+    let before = kinds(&view);
+    assert_eq!(before.last().map(String::as_str), Some("ExecutionTimedOut"));
+    response.finish(Ok(Payload::parse(b"99").unwrap()));
+    owner.drain(deadline()).await.unwrap();
+    assert_eq!(kinds(&handle.snapshot()), before);
+    let (mut owner, _, _) = fixture(1, 1, HistoryLimits::default());
+    let definition = json!({"TimeoutSeconds":1,"StartAt":"Wait","States":{"Wait":{"Type":"Wait","Seconds":50,"End":true}}});
+    let mut handle = owner.start(driver(&definition, &json!({}))).unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::TimedOut
+    ));
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_catch_task_timeout_and_keep_cancelled_call_until_clean() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let mut definition = task();
+    definition["States"]["Work"]["TimeoutSeconds"] = json!(1);
+    definition["States"]["Work"]["Catch"] =
+        json!([{"ErrorEquals":["States.Timeout"],"Next":"Recovered"}]);
+    definition["States"]["Recovered"] = json!({"Type":"Succeed"});
+    let mut handle = owner.start(driver(&definition, &json!({}))).unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Succeeded(_)
+    ));
+    assert!(kinds(&view).iter().any(|k| k == "LambdaFunctionTimedOut"));
+    let page = view.history().page(1, 100, true).unwrap();
+    let details = page
+        .events()
+        .iter()
+        .find_map(|event| event.lambda_function_timed_out_event_details.as_ref())
+        .unwrap();
+    assert_eq!(details.error.as_deref(), Some("States.Timeout"));
+    assert!(details.cause.is_none());
+    let ExecutionOutcome::Succeeded(output) = view.outcome().unwrap().as_ref() else {
+        panic!("expected caught timeout");
+    };
+    assert_eq!(output.value(), &json!({"Error":"States.Timeout"}));
+    assert!(*response.cancellation().borrow());
+    response.finish(Ok(Payload::parse(b"true").unwrap()));
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_timeout_while_waiting_for_dispatch_without_issuing_a_call() {
+    let (mut owner, mut calls, port) = fixture(2, 1, HistoryLimits::default());
+    let mut first = owner.start(driver(&task(), &json!({}))).unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    let mut definition = task();
+    definition["States"]["Work"]["TimeoutSeconds"] = json!(1);
+    let mut waiting = owner.start(driver(&definition, &json!({}))).unwrap();
+    let view = waiting.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Timeout"))
+    );
+    assert_eq!(port.starts.load(Ordering::SeqCst), 1);
+    assert!(calls.try_recv().is_err());
+    let _ = first
+        .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+        .await
+        .unwrap();
+    response.finish(Err(TaskFailure::new("Cancelled", None).unwrap()));
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_stop_while_waiting_for_evaluation_capacity() {
+    let (mut owner, _, port) = fixture(1, 1, HistoryLimits::default());
+    let held = owner
+        .shared
+        .pools
+        .cpu
+        .clone()
+        .acquire_many_owned(2)
+        .await
+        .unwrap();
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+        .await
+        .unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    assert_eq!(view.history().len(), 2);
+    assert_eq!(port.starts.load(Ordering::SeqCst), 0);
+    drop(held);
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_supervise_actor_panic_without_releasing_dispatch_ownership() {
+    let (sender, _receiver) = mpsc::channel(1);
+    let port = Arc::new(Port {
+        sender,
+        starts: AtomicUsize::new(0),
+        panic: true,
+    });
+    let mut owner = ExecutionSupervisor::new(
+        RuntimeLimits::new(1, 1, 1).unwrap(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        Some(port),
+    )
+    .unwrap();
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    timeout(Duration::from_secs(5), owner.reap_next())
+        .await
+        .unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.InternalError"))
+    );
+    assert_eq!(
+        kinds(&view).last().map(String::as_str),
+        Some("ExecutionFailed")
+    );
+    assert_eq!(owner.shared.pools.dispatch.available_permits(), 0);
+    assert_eq!(owner.owned_executions(), 1);
+    assert!(matches!(
+        owner.drain(deadline()).await,
+        Err(ExecutionError::Quarantined)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_reserve_terminal_history_and_avoid_invocation_on_history_exhaustion() {
+    let (mut owner, _, port) = fixture(1, 1, HistoryLimits::new(3, 1024 * 1024).unwrap());
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.HistoryLimitExceeded"))
+    );
+    assert_eq!(
+        kinds(&view),
+        ["ExecutionStarted", "TaskStateEntered", "ExecutionFailed"]
+    );
+    assert_eq!(port.starts.load(Ordering::SeqCst), 0);
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_replace_unretainable_success_with_reserved_failure_event() {
+    let (mut owner, _, _) = fixture(1, 1, HistoryLimits::new(25_000, 1024 * 1024).unwrap());
+    let definition = json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}});
+    let mut handle = owner
+        .start(driver(&definition, &json!("\0".repeat(40_000))))
+        .unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.HistoryLimitExceeded"))
+    );
+    let names = kinds(&view);
+    assert_eq!(names.last().map(String::as_str), Some("ExecutionFailed"));
+    assert!(!names.iter().any(|k| k == "ExecutionSucceeded"));
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_preserve_original_history_and_omit_input_output_parameters_in_projection() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let definition = json!({"StartAt":"Work","States":{"Work":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"Worker","Payload.$":"$"},"End":true}}});
+    let mut handle = owner
+        .start(driver(&definition, &json!({"secret":"projection-marker"})))
+        .unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    response.finish(Ok(Payload::from_value(
+        &json!({"Payload":{"secret":"projection-marker"}}),
+    )
+    .unwrap()));
+    let view = handle.wait(deadline()).await.unwrap();
+    let full = view.history().page(1, 100, true).unwrap();
+    let omitted = view.history().page(1, 100, false).unwrap();
+    assert!(
+        serde_json::to_string(full.events())
+            .unwrap()
+            .contains("projection-marker")
+    );
+    assert!(
+        !serde_json::to_string(omitted.events())
+            .unwrap()
+            .contains("projection-marker")
+    );
+    assert_eq!(
+        full.events().iter().map(|e| e.id).collect::<Vec<_>>(),
+        omitted.events().iter().map(|e| e.id).collect::<Vec<_>>()
+    );
+    assert_eq!(
+        full.events()
+            .iter()
+            .map(|e| e.previous_event_id)
+            .collect::<Vec<_>>(),
+        omitted
+            .events()
+            .iter()
+            .map(|e| e.previous_event_id)
+            .collect::<Vec<_>>()
+    );
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_retain_history_budget_until_last_observer_view_is_dropped() {
+    let (mut owner, _, _) = fixture(1, 1, HistoryLimits::default());
+    let definition = json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}});
+    let mut handle = owner.start(driver(&definition, &json!({"n":1}))).unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    owner.reap_next().await;
+    assert!(owner.history_bytes() > 0);
+    drop(handle);
+    assert!(owner.history_bytes() > 0);
+    drop(view);
+    assert_eq!(owner.history_bytes(), 0);
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_finish_pure_loop_stop_without_starving_control() {
+    let (mut owner, _, _) = fixture(1, 1, HistoryLimits::default());
+    let definition = json!({"StartAt":"Loop","States":{"Loop":{"Type":"Choice","Choices":[{"Variable":"$","BooleanEquals":true,"Next":"Loop"}],"Default":"Done"},"Done":{"Type":"Succeed"}}});
+    let mut handle = owner.start(driver(&definition, &json!(true))).unwrap();
+    for _ in 0..5 {
+        tokio::task::yield_now().await;
+    }
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+        .await
+        .unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_transfer_drop_to_fallback_cleanup_owner() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    drop(owner);
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    assert!(*response.cancellation().borrow());
+    response.finish(Err(TaskFailure::new("Cancelled", None).unwrap()));
+    timeout(Duration::from_secs(5), async {
+        while handle.snapshot().cleanup() != CleanupState::Clean {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await
+    .unwrap();
+}
+
+#[test]
+fn test_should_keep_fallback_ownership_when_its_runtime_shuts_down() {
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(2)
+        .enable_all()
+        .build()
+        .unwrap();
+    let (shared, response) = runtime.block_on(async {
+        let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+        let shared = owner.shared.clone();
+        let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+        let (_, mut response) = next(&mut calls).await;
+        response.started().unwrap();
+        drop(owner);
+        let view = handle.wait(deadline()).await.unwrap();
+        assert!(matches!(
+            view.outcome().unwrap().as_ref(),
+            ExecutionOutcome::Aborted(_)
+        ));
+        (shared, response)
+    });
+    runtime.shutdown_timeout(Duration::from_millis(100));
+    assert_eq!(shared.pools.open.available_permits(), 0);
+    assert_eq!(shared.pools.dispatch.available_permits(), 0);
+    assert!(shared.history.capacity.used() > 0);
+    // The adapter receipt outlives the stopped execution runtime. There is no
+    // executor left to prove joined cleanup; process-lifetime quarantine is correct.
+    response.finish(Err(TaskFailure::new("Cancelled", None).unwrap()));
+    assert_eq!(shared.pools.dispatch.available_permits(), 0);
+}
+
+#[derive(Debug)]
+struct RejectPort {
+    stop: Option<tokio::sync::watch::Sender<Option<TaskFailure>>>,
+    delay: Duration,
+}
+impl LambdaTaskPort for RejectPort {
+    fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        if let Some(stop) = &self.stop {
+            stop.send_replace(Some(TaskFailure::new("Stopped", None).unwrap()));
+        }
+        if !self.delay.is_zero() {
+            std::thread::sleep(self.delay);
+        }
+        Err(TaskFailure::new("Lambda.ServiceException", Some("admission rejected")).unwrap())
+    }
+}
+async fn rejected_admission(stop_now: bool) -> Arc<super::ExecutionView> {
+    use super::{
+        super::{
+            Phase,
+            history::{Journal, TerminalReserve, events},
+        },
+        actor::Actor,
+    };
+    let (stop, cancelled) = tokio::sync::watch::channel(None);
+    let port = Arc::new(RejectPort {
+        stop: stop_now.then_some(stop.clone()),
+        delay: if stop_now {
+            Duration::ZERO
+        } else {
+            Duration::from_millis(10)
+        },
+    });
+    let owner = ExecutionSupervisor::new(
+        RuntimeLimits::new(1, 1, 1).unwrap(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        Some(port),
+    )
+    .unwrap();
+    let mut driver = driver(&task(), &json!({}));
+    let update = driver.advance(
+        ClockSample::new(Instant::now().into_std(), Utc::now()),
+        &mut crate::SystemUuidSource::default(),
+    );
+    let crate::DriverStep::Dispatch(mut dispatch) = update.step else {
+        panic!("expected dispatch")
+    };
+    if !stop_now {
+        dispatch.deadline = Instant::now().into_std() + Duration::from_millis(2);
+        if let Phase::Calling { deadline, .. } = &mut driver.phase {
+            *deadline = dispatch.deadline;
+        }
+    }
+    let reserve = TerminalReserve::new(&owner.shared.history.capacity).unwrap();
+    let mut journal = Journal::new(
+        owner.shared.history.limits,
+        owner.shared.history.capacity.clone(),
+        reserve,
+    );
+    journal
+        .append(events::started(driver.input(), Utc::now()).unwrap(), false)
+        .unwrap();
+    journal
+        .append(
+            events::entered(driver.machine(), driver.state(), driver.input(), Utc::now()).unwrap(),
+            false,
+        )
+        .unwrap();
+    let (view, reader) = tokio::sync::watch::channel(Arc::new(super::ExecutionView {
+        history: journal.view.clone(),
+        outcome: None,
+        stopped: None,
+        cleanup: CleanupState::Pending,
+        diagnostic: None,
+    }));
+    let (ledger, _reader) = tokio::sync::watch::channel(Arc::new(Vec::new()));
+    let mut actor = Actor::new(
+        driver,
+        journal,
+        view,
+        cancelled,
+        ledger,
+        owner.shared.clone(),
+    );
+    actor.dispatch(dispatch).await;
+    actor.run().await;
+    reader.borrow().clone()
+}
+#[tokio::test]
+async fn test_should_recheck_stop_after_synchronous_admission_rejection() {
+    let view = rejected_admission(true).await;
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    let names = kinds(&view);
+    assert!(!names.iter().any(|k| k == "LambdaFunctionScheduleFailed"));
+    assert_eq!(names.last().map(String::as_str), Some("ExecutionAborted"));
+}
+#[tokio::test]
+async fn test_should_recheck_deadline_after_synchronous_admission_rejection() {
+    let view = rejected_admission(false).await;
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Timeout"))
+    );
+    let names = kinds(&view);
+    assert!(!names.iter().any(|k| k == "LambdaFunctionScheduleFailed"));
+    assert!(names.iter().any(|k| k == "LambdaFunctionTimedOut"));
+}
+
+#[derive(Debug)]
+pub(super) struct WorkerHook {
+    entered: tokio::sync::Notify,
+    released: std::sync::atomic::AtomicBool,
+    skip: AtomicUsize,
+    panic: bool,
+    before: bool,
+}
+impl WorkerHook {
+    fn install(
+        owner: &mut ExecutionSupervisor,
+        skip: usize,
+        panic: bool,
+        before: bool,
+    ) -> WorkerGate {
+        let hook = Arc::new(Self {
+            entered: tokio::sync::Notify::new(),
+            released: std::sync::atomic::AtomicBool::new(false),
+            skip: AtomicUsize::new(skip),
+            panic,
+            before,
+        });
+        Arc::get_mut(&mut owner.shared).unwrap().worker_hook = Some(hook.clone());
+        WorkerGate { hook }
+    }
+    pub(super) fn run(&self, before: bool) {
+        if self.before != before
+            || self
+                .skip
+                .try_update(Ordering::AcqRel, Ordering::Acquire, |skip| {
+                    skip.checked_sub(1)
+                })
+                .is_ok()
+        {
+            return;
+        }
+        self.entered.notify_one();
+        while !self.released.load(Ordering::Acquire) {
+            std::thread::park_timeout(Duration::from_millis(1));
+        }
+        assert!(!self.panic, "controlled CPU worker failure");
+    }
+    fn release(&self) {
+        self.released.store(true, Ordering::Release);
+    }
+}
+#[derive(Debug)]
+struct WorkerGate {
+    hook: Arc<WorkerHook>,
+}
+impl std::ops::Deref for WorkerGate {
+    type Target = WorkerHook;
+    fn deref(&self) -> &Self::Target {
+        &self.hook
+    }
+}
+impl Drop for WorkerGate {
+    fn drop(&mut self) {
+        self.hook.release();
+    }
+}
+#[tokio::test]
+async fn test_should_publish_stop_while_cpu_worker_remains_owned_and_unjoined() {
+    let (mut owner, _, port) = fixture(1, 1, HistoryLimits::default());
+    let gate = WorkerHook::install(&mut owner, 0, false, true);
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    timeout(Duration::from_secs(5), gate.entered.notified())
+        .await
+        .unwrap();
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+        .await
+        .unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    assert_eq!(port.starts.load(Ordering::SeqCst), 0);
+    assert_eq!(owner.shared.pools.cpu.available_permits(), 1);
+    assert!(matches!(
+        owner
+            .drain(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(ExecutionError::Deadline)
+    ));
+    gate.release();
+    owner.drain(deadline()).await.unwrap();
+    assert_eq!(owner.shared.pools.cpu.available_permits(), 2);
+}
+#[tokio::test]
+async fn test_should_reject_prepared_dispatch_after_overall_deadline_before_cpu_return() {
+    let (mut owner, _, port) = fixture(1, 1, HistoryLimits::default());
+    let gate = WorkerHook::install(&mut owner, 0, false, false);
+    let mut definition = task();
+    definition["TimeoutSeconds"] = json!(1);
+    let mut handle = owner.start(driver(&definition, &json!({}))).unwrap();
+    timeout(Duration::from_secs(5), gate.entered.notified())
+        .await
+        .unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::TimedOut
+    ));
+    assert_eq!(port.starts.load(Ordering::SeqCst), 0);
+    assert_eq!(kinds(&view), ["ExecutionStarted", "ExecutionTimedOut"]);
+    gate.release();
+    owner.drain(deadline()).await.unwrap();
+    assert_eq!(kinds(&handle.snapshot()), kinds(&view));
+}
+#[tokio::test]
+async fn test_should_not_publish_success_when_execution_expires_during_result_processing() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let gate = WorkerHook::install(&mut owner, 1, false, false);
+    let mut definition = task();
+    definition["TimeoutSeconds"] = json!(1);
+    let mut handle = owner.start(driver(&definition, &json!({}))).unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    response.started().unwrap();
+    response.finish(Ok(Payload::parse(b"true").unwrap()));
+    timeout(Duration::from_secs(5), gate.entered.notified())
+        .await
+        .unwrap();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::TimedOut
+    ));
+    let names = kinds(&view);
+    assert!(
+        !names
+            .iter()
+            .any(|k| k == "ExecutionSucceeded" || k == "TaskStateExited")
+    );
+    assert!(names.iter().any(|k| k == "LambdaFunctionSucceeded"));
+    gate.release();
+    owner.drain(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_keep_cpu_panic_source_and_fail_without_replaying_business_work() {
+    use std::error::Error;
+    let (mut owner, _, port) = fixture(1, 1, HistoryLimits::default());
+    let gate = WorkerHook::install(&mut owner, 0, true, true);
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    timeout(Duration::from_secs(5), gate.entered.notified())
+        .await
+        .unwrap();
+    gate.release();
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.InternalError"))
+    );
+    assert!(matches!(view.diagnostic(), Some(ExecutionError::Worker(_))));
+    assert!(view.diagnostic().unwrap().source().is_some());
+    assert_eq!(port.starts.load(Ordering::SeqCst), 0);
+    assert!(!format!("{view:?}").contains("controlled CPU"));
+    owner.drain(deadline()).await.unwrap();
+}
+
+#[test]
+fn test_should_reject_invalid_runtime_limits_and_start_without_tokio() {
+    for (open, dispatch, cpu) in [
+        (0, 1, 1),
+        (4097, 1, 1),
+        (1, 0, 1),
+        (1, 1025, 1),
+        (1, 1, 0),
+        (1, 1, 129),
+    ] {
+        assert!(RuntimeLimits::new(open, dispatch, cpu).is_err());
+    }
+    let mut owner = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )
+    .unwrap();
+    let definition = json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}});
+    assert!(matches!(
+        owner.start(driver(&definition, &json!({}))),
+        Err(ExecutionError::Unavailable)
+    ));
+    assert_eq!(owner.owned_executions(), 0);
+    assert_eq!(owner.history_bytes(), 0);
+}
+#[tokio::test]
+async fn test_should_support_pure_execution_without_lambda_and_reject_unsupported_start() {
+    let mut owner = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )
+    .unwrap();
+    let definition = json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}});
+    assert!(matches!(
+        owner.start(driver(&task(), &json!({}))),
+        Err(ExecutionError::Unavailable)
+    ));
+    let mut used = driver(&definition, &json!({}));
+    let _ = used.advance(
+        ClockSample::new(Instant::now().into_std(), Utc::now()),
+        &mut crate::SystemUuidSource::default(),
+    );
+    assert!(matches!(
+        owner.start(used),
+        Err(ExecutionError::Unavailable)
+    ));
+    let mut handle = owner.start(driver(&definition, &json!({}))).unwrap();
+    handle.wait(deadline()).await.unwrap();
+    owner.drain(deadline()).await.unwrap();
+    assert!(matches!(
+        owner.start(driver(&definition, &json!({}))),
+        Err(ExecutionError::Unavailable)
+    ));
+}
+#[tokio::test]
+async fn test_should_not_cancel_work_when_observation_deadline_expires() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let (_, mut response) = next(&mut calls).await;
+    assert!(matches!(
+        handle.wait(Instant::now()).await,
+        Err(ExecutionError::Deadline)
+    ));
+    assert!(!*response.cancellation().borrow());
+    response.started().unwrap();
+    response.finish(Ok(Payload::parse(b"1").unwrap()));
+    let view = handle.wait(deadline()).await.unwrap();
+    let repeated = handle
+        .stop(TaskFailure::new("Stopped", None).unwrap(), deadline())
+        .await
+        .unwrap();
+    assert!(Arc::ptr_eq(
+        view.outcome().unwrap(),
+        repeated.outcome().unwrap()
+    ));
+    assert_eq!(view.stop_date(), repeated.stop_date());
+    owner.drain(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_charge_retained_terminal_histories_against_global_admission() {
+    let mut owner = ExecutionSupervisor::new(
+        RuntimeLimits::new(1, 1, 1).unwrap(),
+        HistoryLimits::new(25_000, 1024 * 1024).unwrap(),
+        8 * 1024 * 1024,
+        None,
+    )
+    .unwrap();
+    let definition = json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}});
+    let mut views = Vec::new();
+    let mut exhausted = false;
+    for _ in 0..32 {
+        match owner.start(driver(&definition, &json!("\0".repeat(40_000)))) {
+            Ok(mut handle) => {
+                let view = handle.wait(deadline()).await.unwrap();
+                owner.reap_next().await;
+                views.push(view);
+            }
+            Err(ExecutionError::Capacity) => {
+                exhausted = true;
+                break;
+            }
+            Err(other) => panic!("unexpected {other:?}"),
+        }
+    }
+    assert!(exhausted);
+    assert!(!views.is_empty());
+    assert_eq!(owner.owned_executions(), 0);
+    assert!(owner.history_bytes() <= 8 * 1024 * 1024);
+    drop(views);
+    assert_eq!(owner.history_bytes(), 0);
+    owner.drain(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_reject_unstarted_success_without_fabricating_start_history() {
+    let (mut owner, mut calls, _) = fixture(1, 1, HistoryLimits::default());
+    let mut handle = owner.start(driver(&task(), &json!({}))).unwrap();
+    let (_, response) = next(&mut calls).await;
+    response.finish(Ok(Payload::parse(b"true").unwrap()));
+    let view = handle.wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.InternalError"))
+    );
+    let names = kinds(&view);
+    assert!(
+        !names
+            .iter()
+            .any(|k| k == "LambdaFunctionStarted" || k == "LambdaFunctionSucceeded")
+    );
+    owner.drain(deadline()).await.unwrap();
+}
+
+mod structured;
+
+impl ExecutionSupervisor {
+    pub(crate) fn inject_child_cpu_panic(&mut self) {
+        Arc::get_mut(&mut self.shared).unwrap().child_cpu_panic = true;
+    }
+}
+
+mod callback;
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/tests/callback.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/tests/callback.rs
new file mode 100644
index 00000000..e89e7e2d
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/tests/callback.rs
@@ -0,0 +1,1015 @@
+//! Actual registry/actor callback executions over a bounded controlled observed port.
+
+use rustack_stepfunctions_model::types::HistoryEventType;
+use tokio::time::{advance, pause, resume, sleep, timeout_at};
+use uuid::Uuid;
+
+use super::*;
+use crate::{
+    CallbackCommand, CallbackError, CallbackInvocationMetadata, CallbackLimits, CallbackRegistry,
+    CallbackSupervisor, ExecutionSnapshot, FrameCapacity, FrameLimits, PreparedDefinition,
+    Registry, RegistryCommand, RegistryError, RegistryLimits, RegistryResult, RegistrySupervisor,
+    StateMachineArn, StateSupport, Tags,
+};
+
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+fn definition(extra: Value) -> Value {
+    let mut task = json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","Parameters":{"FunctionName":"Worker","Payload":{"token.$":"$$.Task.Token","n.$":"$.n","retry.$":"$$.State.RetryCount"}},"End":true});
+    let Value::Object(extra) = extra else {
+        panic!("fixture object");
+    };
+    task.as_object_mut().unwrap().extend(extra);
+    json!({"StartAt":"Call","States":{"Call":task}})
+}
+struct Fixture {
+    registry: Registry,
+    owner: RegistrySupervisor,
+    callbacks: (CallbackRegistry, CallbackSupervisor),
+    calls: (
+        mpsc::Receiver<(LambdaTaskCommand, TaskResponder)>,
+        Arc<Port>,
+    ),
+    frames: Arc<FrameCapacity>,
+}
+impl Fixture {
+    fn new(history: HistoryLimits, limits: FrameLimits) -> Self {
+        Self::configured(history, limits, None, false, CallbackLimits::default())
+    }
+    fn configured(
+        history: HistoryLimits,
+        limits: FrameLimits,
+        hook: Option<Arc<WorkerHook>>,
+        panic_port: bool,
+        callback_limits: CallbackLimits,
+    ) -> Self {
+        let (callback, callback_owner) =
+            CallbackRegistry::new(TenantScope::default(), callback_limits).unwrap();
+        let (sender, receiver) = mpsc::channel(32);
+        let port = Arc::new(Port {
+            sender,
+            starts: AtomicUsize::new(0),
+            panic: panic_port,
+        });
+        let frames = Arc::new(FrameCapacity::default());
+        let mut runtime = ExecutionSupervisor::new_with_frames(
+            RuntimeLimits::new(8, 1, 2).unwrap(),
+            history,
+            256 * 1024 * 1024,
+            Some(port.clone()),
+            frames.clone(),
+            limits,
+        )
+        .unwrap();
+        Arc::get_mut(&mut runtime.shared).unwrap().callback_hook = hook;
+        runtime.install_callbacks(callback.clone()).unwrap();
+        let (registry, owner) = Registry::new_with_state_support(
+            TenantScope::default(),
+            RegistryLimits::default(),
+            runtime,
+            ExecutionLimits::new(Duration::from_secs(60), 10000).unwrap(),
+            StateSupport::Structured,
+        )
+        .unwrap();
+        assert!(registry.callback_support());
+        Self {
+            registry,
+            owner,
+            callbacks: (callback, callback_owner),
+            calls: (receiver, port),
+            frames,
+        }
+    }
+    async fn create(&self, name: &str, source: &Value) -> StateMachineArn {
+        let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+            .with_state_support(StateSupport::Structured)
+            .with_callback_support(true)
+            .with_child_support(true)
+            .compile(&serde_json::to_vec(source).unwrap())
+            .unwrap()
+            .machine()
+            .clone();
+        let RegistryResult::Machine(snapshot) = self
+            .registry
+            .submit(RegistryCommand::Create(
+                name.parse().unwrap(),
+                PreparedDefinition::new(machine),
+                "arn:aws:iam::000000000000:role/Test".parse().unwrap(),
+                Tags::default(),
+            ))
+            .unwrap()
+            .wait(deadline())
+            .await
+            .unwrap()
+        else {
+            panic!("machine");
+        };
+        snapshot.arn().clone()
+    }
+    async fn start(&self, machine: &StateMachineArn, name: &str) -> ExecutionSnapshot {
+        let RegistryResult::Execution(snapshot) = self
+            .registry
+            .submit(RegistryCommand::Start(
+                machine.clone(),
+                Some(name.parse().unwrap()),
+                Payload::parse(br#"{"n":21,"keep":"original"}"#).unwrap(),
+                None,
+            ))
+            .unwrap()
+            .wait(deadline())
+            .await
+            .unwrap()
+        else {
+            panic!("execution");
+        };
+        snapshot
+    }
+    async fn next(&mut self) -> (LambdaTaskCommand, TaskResponder) {
+        timeout_at(deadline(), self.calls.0.recv())
+            .await
+            .unwrap()
+            .unwrap()
+    }
+    async fn action(&self, command: CallbackCommand) -> Result<(), CallbackError> {
+        self.callbacks
+            .0
+            .submit(&TenantScope::default(), command)?
+            .wait(deadline())
+            .await
+    }
+    async fn close(&mut self) {
+        let a = self.owner.shutdown(deadline()).await;
+        let b = self.callbacks.1.shutdown(deadline()).await;
+        assert!(a.is_ok(), "registry cleanup: {a:?}");
+        assert!(b.is_ok(), "callback cleanup: {b:?}");
+        assert_eq!(self.frames.available_frames(), 4096);
+    }
+}
+fn token(command: &LambdaTaskCommand) -> String {
+    command.dispatch().parameters().value()["Payload"]["token"]
+        .as_str()
+        .unwrap()
+        .to_owned()
+}
+fn report(
+    command: &mut LambdaTaskCommand,
+    responder: &mut TaskResponder,
+    result: Result<(), TaskFailure>,
+) -> CallbackInvocationMetadata {
+    responder.started().unwrap();
+    let metadata = CallbackInvocationMetadata::new(Uuid::new_v4(), "$LATEST").unwrap();
+    let mut reporter = command.take_callback_reporter().unwrap().unwrap();
+    reporter
+        .complete_at(result.map(|()| metadata.clone()), Instant::now())
+        .unwrap();
+    metadata
+}
+async fn submitted(snapshot: &ExecutionSnapshot) {
+    timeout_at(deadline(), async {
+        loop {
+            if snapshot
+                .handle()
+                .snapshot()
+                .history()
+                .page(1, 1000, true)
+                .unwrap()
+                .events()
+                .iter()
+                .any(|event| event.r#type == HistoryEventType::TaskSubmitted)
+            {
+                return;
+            }
+            sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+    .unwrap();
+}
+#[rstest::rstest]
+#[case(true)]
+#[case(false)]
+#[tokio::test]
+async fn test_should_execute_registered_callback_before_or_after_real_report_and_keep_causal_safe_history(
+    #[case] early: bool,
+) {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let machine=f.create("Callback",&definition(json!({"ResultSelector":{"chosen.$":"$.external"},"ResultPath":"$.result","OutputPath":"$.result"}))).await;
+    let execution = f.start(&machine, "run").await;
+    let (mut command, mut responder) = f.next().await;
+    let token = token(&command);
+    let scheduled = execution.handle().snapshot();
+    assert_eq!(
+        scheduled
+            .history()
+            .page(1, 1000, true)
+            .unwrap()
+            .events()
+            .last()
+            .unwrap()
+            .r#type,
+        HistoryEventType::TaskScheduled
+    );
+    assert!(
+        !serde_json::to_string(scheduled.history().page(1, 1000, true).unwrap().events())
+            .unwrap()
+            .contains(&token)
+    );
+    if early {
+        f.action(CallbackCommand::success(token.parse().unwrap(), br#"{"external":42}"#).unwrap())
+            .await
+            .unwrap();
+    }
+    assert!(execution.handle().snapshot().outcome().is_none());
+    let metadata = report(&mut command, &mut responder, Ok(()));
+    responder.finish(Ok(metadata.payload().unwrap()));
+    if !early {
+        submitted(&execution).await;
+        f.action(CallbackCommand::success(token.parse().unwrap(), br#"{"external":42}"#).unwrap())
+            .await
+            .unwrap();
+    }
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!({"chosen":42}))
+    );
+    let page = view.history().page(1, 1000, true).unwrap();
+    let events = page.events();
+    let kinds = events
+        .iter()
+        .map(|event| event.r#type.clone())
+        .collect::<Vec<_>>();
+    assert_eq!(
+        kinds,
+        vec![
+            HistoryEventType::ExecutionStarted,
+            HistoryEventType::TaskStateEntered,
+            HistoryEventType::TaskScheduled,
+            HistoryEventType::TaskStarted,
+            HistoryEventType::TaskSubmitted,
+            HistoryEventType::TaskSucceeded,
+            HistoryEventType::TaskStateExited,
+            HistoryEventType::ExecutionSucceeded
+        ]
+    );
+    assert!(
+        events
+            .windows(2)
+            .skip(1)
+            .all(|pair| pair[1].previous_event_id == Some(pair[0].id))
+    );
+    assert_eq!(
+        events.get(1).and_then(|event| event.previous_event_id),
+        Some(0)
+    );
+    assert_eq!(
+        events[4]
+            .task_submitted_event_details
+            .as_ref()
+            .unwrap()
+            .output_details
+            .as_ref()
+            .unwrap()
+            .truncated,
+        Some(true)
+    );
+    assert!(!serde_json::to_string(events).unwrap().contains(&token));
+    assert!(
+        f.action(CallbackCommand::heartbeat(token.parse().unwrap()))
+            .await
+            .is_err()
+    );
+    drop(command);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_keep_function_failure_over_successful_provisional_callback() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "run").await;
+    let (mut command, mut responder) = f.next().await;
+    let token = token(&command);
+    f.action(CallbackCommand::success(token.parse().unwrap(), b"true").unwrap())
+        .await
+        .unwrap();
+    let failure = TaskFailure::new("FunctionFailure", None).unwrap();
+    report(&mut command, &mut responder, Err(failure.clone()));
+    responder.finish(Err(failure));
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("FunctionFailure"))
+    );
+    assert!(
+        !view
+            .history()
+            .page(1, 1000, true)
+            .unwrap()
+            .events()
+            .iter()
+            .any(|event| event.r#type == HistoryEventType::TaskSubmitted)
+    );
+    drop(command);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_release_one_dispatch_slot_while_external_callback_waits() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let callback = f.create("Callback", &definition(json!({}))).await;
+    let first = f.start(&callback, "waiting").await;
+    let (mut command, mut responder) = f.next().await;
+    let first_token = token(&command);
+    let metadata = report(&mut command, &mut responder, Ok(()));
+    responder.finish(Ok(metadata.payload().unwrap()));
+    submitted(&first).await;
+    let second = f.start(&callback, "second").await;
+    let (mut command2, mut responder2) = f.next().await;
+    assert!(first.handle().snapshot().outcome().is_none());
+    let second_token = token(&command2);
+    let metadata = report(&mut command2, &mut responder2, Ok(()));
+    responder2.finish(Ok(metadata.payload().unwrap()));
+    for token in [first_token, second_token] {
+        f.action(CallbackCommand::success(token.parse().unwrap(), b"true").unwrap())
+            .await
+            .unwrap();
+    }
+    first.handle().wait(deadline()).await.unwrap();
+    second.handle().wait(deadline()).await.unwrap();
+    drop((command, command2));
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_preserve_selected_callback_result_through_quarantine_and_resumed_cleanup() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "run").await;
+    let (mut command, mut responder) = f.next().await;
+    let secret = token(&command);
+    report(&mut command, &mut responder, Ok(()));
+    f.action(CallbackCommand::success(secret.parse().unwrap(), b"42").unwrap())
+        .await
+        .unwrap();
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!(42))
+    );
+    assert_eq!(view.cleanup(), CleanupState::Pending);
+    let retained = responder.quarantine(TaskFailure::service_exception());
+    assert!(
+        timeout(
+            Duration::from_millis(5),
+            execution.handle().wait_cleanup(deadline())
+        )
+        .await
+        .is_err()
+    );
+    retained.settle();
+    execution.handle().wait_cleanup(deadline()).await.unwrap();
+    assert!(
+        matches!(execution.handle().snapshot().outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!(42))
+    );
+    drop(command);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_revoke_and_join_actual_call_on_stop_before_retiring_the_frame() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "run").await;
+    let (command, mut responder) = f.next().await;
+    let token = token(&command);
+    responder.started().unwrap();
+    let mut cancelled = responder.cancellation();
+    execution
+        .handle()
+        .request_stop(TaskFailure::new("Stopped", None).unwrap());
+    cancelled.wait_for(|v| *v).await.unwrap();
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(matches!(
+        view.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Aborted(_)
+    ));
+    assert_eq!(view.cleanup(), CleanupState::Pending);
+    assert!(
+        f.action(CallbackCommand::success(token.parse().unwrap(), b"true").unwrap())
+            .await
+            .is_err()
+    );
+    responder.finish(Err(TaskFailure::service_exception()));
+    execution.handle().wait_cleanup(deadline()).await.unwrap();
+    drop(command);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_reject_callback_data_capacity_before_token_registration_or_invocation() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::new(8, 4096).unwrap());
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "run").await;
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.ResultLimitExceeded"))
+    );
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 0);
+    assert_eq!(f.callbacks.0.status().live, 0);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_fail_history_before_any_callback_business_issuance() {
+    let mut f = Fixture::new(
+        HistoryLimits::new(3, 1024 * 1024).unwrap(),
+        FrameLimits::default(),
+    );
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "run").await;
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.HistoryLimitExceeded"))
+    );
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 0);
+    f.close().await;
+}
+
+#[tokio::test]
+async fn test_should_fail_unreported_owner_loss_without_retry_or_catch_and_retain_physical_cleanup()
+{
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let mut source = definition(
+        json!({"Retry":[{"ErrorEquals":["States.ALL"],"IntervalSeconds":1,"MaxAttempts":1}],"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Recovered"}]}),
+    );
+    source["States"]["Recovered"] = json!({"Type":"Succeed"});
+    let machine = f.create("Callback", &source).await;
+    let execution = f.start(&machine, "lost").await;
+    let (mut command, mut responder) = f.next().await;
+    responder.started().unwrap();
+    drop(command.take_callback_reporter().unwrap().unwrap());
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.InternalError"))
+    );
+    assert!(
+        matches!(view.diagnostic(),Some(ExecutionError::Callback(source)) if matches!(source.as_ref(),CallbackError::OwnerLost))
+    );
+    assert_eq!(view.cleanup(), CleanupState::Pending);
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 1);
+    assert!(matches!(
+        f.owner
+            .shutdown(Instant::now() + Duration::from_millis(5))
+            .await,
+        Err(RegistryError::Deadline)
+    ));
+    responder.finish(Err(TaskFailure::service_exception()));
+    execution.handle().wait_cleanup(deadline()).await.unwrap();
+    drop(command);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_retain_unknown_closed_port_settlement_in_quarantine() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "lost").await;
+    let (mut command, mut responder) = f.next().await;
+    responder.started().unwrap();
+    drop(command.take_callback_reporter().unwrap().unwrap());
+    drop(responder);
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.InternalError"))
+    );
+    assert!(matches!(
+        execution.handle().wait_cleanup(deadline()).await,
+        Err(ExecutionError::Quarantined)
+    ));
+    let failure = f.owner.shutdown(deadline()).await.unwrap_err();
+    assert!(matches!(
+        registry_error(&failure),
+        RegistryError::Execution(ExecutionError::Quarantined)
+    ));
+    f.callbacks.1.shutdown(deadline()).await.unwrap();
+    assert!(f.frames.available_frames() < 4096);
+}
+#[tokio::test]
+async fn test_should_preserve_preparation_evaluation_failure_instead_of_catching_it_as_business_error()
+ {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let mut source = definition(
+        json!({"Parameters":{"FunctionName":"Worker","Payload":{"token.$":"$$.Task.Token","missing.$":"$.absent"}},"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Recovered"}]}),
+    );
+    source["States"]["Recovered"] = json!({"Type":"Succeed"});
+    let machine = f.create("Callback", &source).await;
+    let execution = f.start(&machine, "bad").await;
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Runtime"))
+    );
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 0);
+    assert!(
+        !view
+            .history()
+            .page(1, 1000, true)
+            .unwrap()
+            .events()
+            .iter()
+            .any(|event| event.r#type == HistoryEventType::TaskScheduled)
+    );
+    f.close().await;
+}
+fn hook(panic: bool, before: bool) -> WorkerGate {
+    WorkerGate {
+        hook: Arc::new(WorkerHook {
+            entered: tokio::sync::Notify::new(),
+            released: std::sync::atomic::AtomicBool::new(false),
+            skip: AtomicUsize::new(0),
+            panic,
+            before,
+        }),
+    }
+}
+#[tokio::test]
+async fn test_should_join_held_callback_preparation_after_shutdown_observation_expires_without_issuance()
+ {
+    let gate = hook(false, false);
+    let mut f = Fixture::configured(
+        HistoryLimits::default(),
+        FrameLimits::default(),
+        Some(gate.hook.clone()),
+        false,
+        CallbackLimits::default(),
+    );
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "held").await;
+    timeout(Duration::from_secs(5), gate.entered.notified())
+        .await
+        .unwrap();
+    execution
+        .handle()
+        .request_stop(TaskFailure::new("Stopped", None).unwrap());
+    execution.handle().wait(deadline()).await.unwrap();
+    assert!(matches!(
+        f.owner
+            .shutdown(Instant::now() + Duration::from_millis(5))
+            .await,
+        Err(RegistryError::Deadline)
+    ));
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 0);
+    assert!(f.frames.available_frames() < 4096);
+    gate.release();
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_keep_callback_preparation_panic_source_and_clean_only_proven_unissued_work() {
+    let gate = hook(true, true);
+    let mut f = Fixture::configured(
+        HistoryLimits::default(),
+        FrameLimits::default(),
+        Some(gate.hook.clone()),
+        false,
+        CallbackLimits::default(),
+    );
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "panic").await;
+    timeout(Duration::from_secs(5), gate.entered.notified())
+        .await
+        .unwrap();
+    gate.release();
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.diagnostic(),Some(ExecutionError::Callback(source)) if matches!(source.as_ref(),CallbackError::Worker(_)))
+    );
+    assert!(!format!("{view:?}").contains("controlled CPU"));
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 0);
+    execution.handle().wait_cleanup(deadline()).await.unwrap();
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_retain_callback_frame_data_and_dispatch_on_port_worker_panic() {
+    let mut f = Fixture::configured(
+        HistoryLimits::default(),
+        FrameLimits::default(),
+        None,
+        true,
+        CallbackLimits::default(),
+    );
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "panic").await;
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.InternalError"))
+    );
+    assert!(matches!(
+        execution.handle().wait_cleanup(deadline()).await,
+        Err(ExecutionError::Quarantined)
+    ));
+    assert!(f.owner.shutdown(deadline()).await.is_err());
+    f.callbacks.1.shutdown(deadline()).await.unwrap();
+    assert!(f.frames.available_frames() < 4096);
+}
+
+fn registry_error(error: &RegistryError) -> &RegistryError {
+    match error {
+        RegistryError::Owner(error) => registry_error(error),
+        _ => error,
+    }
+}
+
+#[tokio::test]
+async fn test_should_retry_external_failure_with_new_token_and_captured_retry_context() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let machine = f
+        .create(
+            "Callback",
+            &definition(
+                json!({"Retry":[{"ErrorEquals":["Busy"],"IntervalSeconds":1,"MaxAttempts":1}]}),
+            ),
+        )
+        .await;
+    let execution = f.start(&machine, "retry").await;
+    let (mut first, mut responder) = f.next().await;
+    let old = token(&first);
+    let metadata = report(&mut first, &mut responder, Ok(()));
+    responder.finish(Ok(metadata.payload().unwrap()));
+    submitted(&execution).await;
+    f.action(
+        CallbackCommand::failure(
+            old.parse().unwrap(),
+            Some("Busy".into()),
+            Some("retry".into()),
+        )
+        .unwrap(),
+    )
+    .await
+    .unwrap();
+    let (mut second, mut responder) = f.next().await;
+    let fresh = token(&second);
+    assert_ne!(old, fresh);
+    assert_eq!(
+        second.dispatch().parameters().value()["Payload"]["retry"],
+        1
+    );
+    assert!(matches!(
+        callback_error(
+            &f.action(CallbackCommand::success(old.parse().unwrap(), b"false").unwrap())
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    let metadata = report(&mut second, &mut responder, Ok(()));
+    responder.finish(Ok(metadata.payload().unwrap()));
+    f.action(CallbackCommand::success(fresh.parse().unwrap(), b"42").unwrap())
+        .await
+        .unwrap();
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!(42))
+    );
+    let page = view.history().page(1, 1000, true).unwrap();
+    let text = serde_json::to_string(page.events()).unwrap();
+    assert!(!text.contains(&old) && !text.contains(&fresh));
+    assert_eq!(
+        page.events()
+            .iter()
+            .filter(|event| event.r#type == HistoryEventType::TaskScheduled)
+            .count(),
+        2
+    );
+    drop((first, second));
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_reset_heartbeat_and_recover_its_expiry_with_timed_out_history() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let mut source = definition(
+        json!({"HeartbeatSeconds":2,"TimeoutSeconds":30,"Catch":[{"ErrorEquals":["States.HeartbeatTimeout"],"Next":"Recovered"}]}),
+    );
+    source["States"]["Recovered"] = json!({"Type":"Pass","Result":{"recovered":true},"End":true});
+    let machine = f.create("Callback", &source).await;
+    let execution = f.start(&machine, "heartbeat").await;
+    let (mut command, mut responder) = f.next().await;
+    let secret = token(&command);
+    let metadata = report(&mut command, &mut responder, Ok(()));
+    responder.finish(Ok(metadata.payload().unwrap()));
+    submitted(&execution).await;
+    pause();
+    advance(Duration::from_secs(1)).await;
+    f.action(CallbackCommand::heartbeat(secret.parse().unwrap()))
+        .await
+        .unwrap();
+    advance(Duration::from_secs(1)).await;
+    assert!(execution.handle().snapshot().outcome().is_none());
+    advance(Duration::from_secs(1)).await;
+    resume();
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!({"recovered":true}))
+    );
+    let page = view.history().page(1, 1000, true).unwrap();
+    assert!(page.events().iter().any(|e| {
+        e.task_timed_out_event_details
+            .as_ref()
+            .is_some_and(|d| d.error.as_deref() == Some("States.HeartbeatTimeout"))
+    }));
+    drop(command);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_enforce_absolute_task_timeout_during_invocation_and_join_late_cleanup() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let machine = f
+        .create("Callback", &definition(json!({"TimeoutSeconds":2})))
+        .await;
+    let execution = f.start(&machine, "timeout").await;
+    let (command, mut responder) = f.next().await;
+    responder.started().unwrap();
+    let secret = token(&command);
+    pause();
+    advance(Duration::from_secs(2)).await;
+    resume();
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("States.Timeout"))
+    );
+    assert_eq!(view.cleanup(), CleanupState::Pending);
+    assert!(
+        f.action(CallbackCommand::heartbeat(secret.parse().unwrap()))
+            .await
+            .is_err()
+    );
+    responder.finish(Err(TaskFailure::service_exception()));
+    execution.handle().wait_cleanup(deadline()).await.unwrap();
+    drop(command);
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_cancel_callback_sibling_and_join_physical_cleanup_before_parallel_catch() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let source = json!({"StartAt":"Both","States":{"Both":{"Type":"Parallel","Branches":[definition(json!({})),definition(json!({}))],"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Recovered"}],"End":true},"Recovered":{"Type":"Pass","Result":{"recovered":true},"End":true}}});
+    let machine = f.create("Callback", &source).await;
+    let execution = f.start(&machine, "siblings").await;
+    let (mut first, mut responder) = f.next().await;
+    let failed = token(&first);
+    let metadata = report(&mut first, &mut responder, Ok(()));
+    responder.finish(Ok(metadata.payload().unwrap()));
+    let (second, mut responder) = f.next().await;
+    let cancelled_token = token(&second);
+    responder.started().unwrap();
+    let mut cancelled = responder.cancellation();
+    f.action(
+        CallbackCommand::failure(failed.parse().unwrap(), Some("Failure".into()), None).unwrap(),
+    )
+    .await
+    .unwrap();
+    timeout_at(deadline(), cancelled.wait_for(|v| *v))
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(
+        timeout(
+            Duration::from_millis(5),
+            execution.handle().wait(deadline())
+        )
+        .await
+        .is_err()
+    );
+    assert!(execution.handle().snapshot().outcome().is_none());
+    assert!(
+        f.action(CallbackCommand::success(cancelled_token.parse().unwrap(), b"true").unwrap())
+            .await
+            .is_err()
+    );
+    responder.finish(Err(TaskFailure::service_exception()));
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!({"recovered":true}))
+    );
+    drop((first, second));
+    f.close().await;
+}
+#[tokio::test]
+async fn test_should_complete_registered_map_callbacks_out_of_order_with_stable_results() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let source = json!({"StartAt":"Items","States":{"Items":{"Type":"Map","ItemsPath":"$.items","ItemSelector":{"n.$":"$$.Map.Item.Value"},"ItemProcessor":definition(json!({})),"End":true}}});
+    let machine = f.create("Callback", &source).await;
+    let RegistryResult::Execution(execution) = f
+        .registry
+        .submit(RegistryCommand::Start(
+            machine,
+            Some("map".parse().unwrap()),
+            Payload::parse(br#"{"items":[21,22,23]}"#).unwrap(),
+            None,
+        ))
+        .unwrap()
+        .wait(deadline())
+        .await
+        .unwrap()
+    else {
+        panic!("execution");
+    };
+    let mut completions = Vec::new();
+    for _ in 0..3 {
+        let (mut command, mut responder) = f.next().await;
+        let n = command.dispatch().parameters().value()["Payload"]["n"]
+            .as_u64()
+            .unwrap();
+        let secret = token(&command);
+        let metadata = report(&mut command, &mut responder, Ok(()));
+        responder.finish(Ok(metadata.payload().unwrap()));
+        completions.push((secret, n));
+    }
+    for (secret, n) in completions.iter().rev() {
+        f.action(
+            CallbackCommand::success(
+                secret.parse().unwrap(),
+                &serde_json::to_vec(&json!(n * 2)).unwrap(),
+            )
+            .unwrap(),
+        )
+        .await
+        .unwrap();
+    }
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Succeeded(p) if p.value()==&json!([42,44,46]))
+    );
+    let text = serde_json::to_string(view.history().page(1, 1000, true).unwrap().events()).unwrap();
+    assert!(completions.iter().all(|(secret, _)| !text.contains(secret)));
+    f.close().await;
+}
+fn callback_error(error: &CallbackError) -> &CallbackError {
+    match error {
+        CallbackError::Cached(error) => callback_error(error),
+        _ => error,
+    }
+}
+
+#[tokio::test]
+async fn test_should_require_real_port_committed_registration_and_matching_callback_scope() {
+    let (callback, mut callback_owner) =
+        CallbackRegistry::new(TenantScope::default(), CallbackLimits::default()).unwrap();
+    let mut pure = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )
+    .unwrap();
+    assert!(matches!(
+        pure.install_callbacks(callback.clone()),
+        Err(ExecutionError::Unavailable)
+    ));
+    assert!(pure.callback_scope().is_none());
+    pure.drain(deadline()).await.unwrap();
+    let (mut runtime, _, port) = fixture(8, 1, HistoryLimits::default());
+    runtime.install_callbacks(callback.clone()).unwrap();
+    let source = definition(json!({}));
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_callback_support(true)
+        .compile(&serde_json::to_vec(&source).unwrap())
+        .unwrap()
+        .machine()
+        .clone();
+    let input = Payload::parse(br#"{"n":21}"#).unwrap();
+    let driver = ExecutionDriver::for_structured_owner(
+        machine,
+        input.clone(),
+        EvaluationContext::from(&input),
+        ClockSample::new(Instant::now().into_std(), Utc::now()),
+        ExecutionLimits::default(),
+    )
+    .unwrap();
+    assert!(matches!(
+        runtime.start_structured(driver),
+        Err(ExecutionError::Unavailable)
+    ));
+    let foreign = TenantScope::new("aws", "us-west-2", "000000000000").unwrap();
+    assert!(matches!(
+        Registry::new(
+            foreign,
+            RegistryLimits::default(),
+            runtime,
+            ExecutionLimits::default()
+        ),
+        Err(RegistryError::Validation)
+    ));
+    assert_eq!(port.starts.load(Ordering::SeqCst), 0);
+    assert_eq!(callback.status().retained, 0);
+    callback_owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_seal_callback_configuration_after_completed_work_and_reflect_root_health() {
+    let (callback, mut callback_owner) =
+        CallbackRegistry::new(TenantScope::default(), CallbackLimits::default()).unwrap();
+    let (mut runtime, _, _) = fixture(8, 1, HistoryLimits::default());
+    let mut handle = runtime
+        .start(driver(
+            &json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}}),
+            &json!({}),
+        ))
+        .unwrap();
+    handle.wait_cleanup(deadline()).await.unwrap();
+    runtime.reap_ready();
+    assert!(matches!(
+        runtime.install_callbacks(callback.clone()),
+        Err(ExecutionError::Invalid)
+    ));
+    assert!(runtime.callback_scope().is_none());
+    runtime.drain(deadline()).await.unwrap();
+    let (mut bound, _, _) = fixture(8, 1, HistoryLimits::default());
+    bound.install_callbacks(callback.clone()).unwrap();
+    assert!(matches!(
+        bound.install_callbacks(callback.clone()),
+        Err(ExecutionError::Invalid)
+    ));
+    assert!(bound.is_ready());
+    callback_owner.shutdown(deadline()).await.unwrap();
+    assert!(!bound.is_ready());
+    bound.drain(deadline()).await.unwrap();
+    let (mut fresh, _, _) = fixture(8, 1, HistoryLimits::default());
+    assert!(matches!(
+        fresh.install_callbacks(callback),
+        Err(ExecutionError::Unavailable)
+    ));
+    assert!(fresh.callback_scope().is_none());
+    fresh.drain(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_bound_preparation_bytes_after_mint_and_revoke_without_issuing() {
+    let mut f = Fixture::new(
+        HistoryLimits::default(),
+        FrameLimits::new(8, crate::MAX_PAYLOAD_BYTES + 65_536 + 4096).unwrap(),
+    );
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let execution = f.start(&machine, "quota").await;
+    let view = execution.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.ResultLimitExceeded"))
+    );
+    execution.handle().wait_cleanup(deadline()).await.unwrap();
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 0);
+    assert_eq!(f.callbacks.0.status().live, 0);
+    assert_eq!(f.callbacks.0.status().retained, 1);
+    f.close().await;
+}
+
+#[tokio::test]
+async fn test_should_retire_proved_physical_call_even_when_callback_root_cleanup_is_unknown() {
+    let mut f = Fixture::new(HistoryLimits::default(), FrameLimits::default());
+    let callback = f.create("Callback", &definition(json!({}))).await;
+    let ordinary=f.create("Ordinary",&json!({"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"Worker"},"End":true}}})).await;
+    let first = f.start(&callback, "first").await;
+    let (mut command, mut responder) = f.next().await;
+    let metadata = report(&mut command, &mut responder, Ok(()));
+    submitted(&first).await;
+    f.callbacks.1.shutdown(deadline()).await.unwrap();
+    let view = first.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.InternalError"))
+    );
+    assert_eq!(view.cleanup(), CleanupState::Pending);
+    let second = f.start(&ordinary, "second").await;
+    assert!(
+        timeout(Duration::from_millis(5), f.calls.0.recv())
+            .await
+            .is_err()
+    );
+    responder.finish(Ok(metadata.payload().unwrap()));
+    let (_, mut normal) = f.next().await;
+    normal.started().unwrap();
+    normal.finish(Ok(Payload::parse(b"true").unwrap()));
+    second.handle().wait(deadline()).await.unwrap();
+    assert!(matches!(
+        first.handle().wait_cleanup(deadline()).await,
+        Err(ExecutionError::Quarantined)
+    ));
+    assert!(f.owner.shutdown(deadline()).await.is_err());
+}
+
+#[tokio::test]
+async fn test_should_classify_token_capacity_separately_without_revoking_an_existing_waiter() {
+    let limits = CallbackLimits::new(1, 8, 8, 1, Duration::from_secs(60)).unwrap();
+    let mut f = Fixture::configured(
+        HistoryLimits::default(),
+        FrameLimits::default(),
+        None,
+        false,
+        limits,
+    );
+    let machine = f.create("Callback", &definition(json!({}))).await;
+    let first = f.start(&machine, "waiting").await;
+    let (mut command, mut responder) = f.next().await;
+    let secret = token(&command);
+    let metadata = report(&mut command, &mut responder, Ok(()));
+    responder.finish(Ok(metadata.payload().unwrap()));
+    submitted(&first).await;
+    let second = f.start(&machine, "over-capacity").await;
+    let view = second.handle().wait(deadline()).await.unwrap();
+    assert!(
+        matches!(view.outcome().unwrap().as_ref(),ExecutionOutcome::Failed(f) if f.error()==Some("Rustack.CallbackLimitExceeded"))
+    );
+    assert_eq!(f.calls.1.starts.load(Ordering::SeqCst), 1);
+    assert!(first.handle().snapshot().outcome().is_none());
+    f.action(CallbackCommand::success(secret.parse().unwrap(), b"42").unwrap())
+        .await
+        .unwrap();
+    first.handle().wait(deadline()).await.unwrap();
+    drop(command);
+    f.close().await;
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/tests/structured.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/tests/structured.rs
new file mode 100644
index 00000000..8d423a08
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/tests/structured.rs
@@ -0,0 +1,549 @@
+//! Actual asynchronous task-port admission and causal frame history.
+
+use std::{error::Error, time::Duration};
+
+use chrono::Utc;
+use rustack_stepfunctions_model::types::HistoryEventType;
+use serde_json::{Value, json};
+use tokio::time::{Instant, timeout};
+
+use super::{deadline, fixture, next, task};
+use crate::{
+    AslCompiler, ClockSample, EvaluationContext, ExecutionDriver, ExecutionLimits,
+    ExecutionOutcome, Payload, StateSupport, TaskFailure, TaskSupport, TenantScope,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+fn driver(value: &Value, input: &Value) -> Result<ExecutionDriver, Box<dyn Error>> {
+    let compiled = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_state_support(StateSupport::Structured)
+        .compile(&serde_json::to_vec(value)?)?;
+    let input = Payload::from_value(input)?;
+    Ok(ExecutionDriver::for_structured_owner(
+        compiled.machine().clone(),
+        input.clone(),
+        EvaluationContext::from_value(
+            &json!({"Execution":{"Input":input.value(),"Id":"structured"}}),
+        )?,
+        ClockSample::new(Instant::now().into_std(), Utc::now()),
+        ExecutionLimits::new(Duration::from_secs(60), 10_000)?,
+    )?)
+}
+fn parallel() -> Value {
+    json!({"StartAt":"Parallel","States":{"Parallel":{"Type":"Parallel","Branches":[task(),task()],"End":true}}})
+}
+
+#[tokio::test]
+async fn test_should_start_overlapping_calls_and_preserve_parallel_result_and_causal_order()
+-> TestResult {
+    let (mut owner, mut calls, _) = fixture(2, 2, crate::HistoryLimits::default());
+    let mut handle = owner.start_structured(driver(&parallel(), &json!({"input":1}))?)?;
+    let (_, mut first) = next(&mut calls).await;
+    let (_, mut second) = next(&mut calls).await;
+    first.started()?;
+    second.started()?;
+    second.finish(Ok(Payload::parse(b"2")?));
+    first.finish(Ok(Payload::parse(b"1")?));
+    let view = handle.wait(deadline()).await?;
+    let Some(outcome) = view.outcome() else {
+        return Err("missing outcome".into());
+    };
+    let ExecutionOutcome::Succeeded(output) = outcome.as_ref() else {
+        return Err(format!("unexpected outcome {outcome:?}").into());
+    };
+    assert_eq!(output.value(), &json!([1, 2]));
+    let page = view.history().page(1, 100, true)?;
+    let events = page.events();
+    let branch_entries = events
+        .iter()
+        .filter(|e| {
+            e.r#type == rustack_stepfunctions_model::types::HistoryEventType::TaskStateEntered
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(branch_entries.len(), 2);
+    assert_eq!(
+        branch_entries
+            .first()
+            .ok_or("first branch")?
+            .previous_event_id,
+        branch_entries
+            .get(1)
+            .ok_or("second branch")?
+            .previous_event_id
+    );
+    assert!(events.iter().any(|e| {
+        e.id > 3
+            && e.previous_event_id
+                .is_some_and(|previous| previous < e.id - 1)
+    }));
+    owner.drain(deadline()).await?;
+    assert_eq!(owner.shared.frames.capacity.available_frames(), 4096);
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_run_nested_map_and_empty_map_with_actual_actor_history() -> TestResult {
+    let (mut owner, mut calls, _) = fixture(2, 2, crate::HistoryLimits::default());
+    let value = json!({"StartAt":"Map","States":{"Map":{"Type":"Map","MaxConcurrency":2,"ItemProcessor":task(),"End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!([10, 20]))?)?;
+    let (first, mut first_response) = next(&mut calls).await;
+    let (second, mut second_response) = next(&mut calls).await;
+    first_response.started()?;
+    second_response.started()?;
+    assert_eq!(first.dispatch().parameters().value(), &json!(10));
+    assert_eq!(second.dispatch().parameters().value(), &json!(20));
+    second_response.finish(Ok(Payload::parse(b"40")?));
+    first_response.finish(Ok(Payload::parse(b"20")?));
+    let view = handle.wait(deadline()).await?;
+    let ExecutionOutcome::Succeeded(output) = view.outcome().ok_or("outcome")?.as_ref() else {
+        return Err("expected success".into());
+    };
+    assert_eq!(output.value(), &json!([20, 40]));
+    let events = view.history().page(1, 100, true)?;
+    assert_eq!(
+        events
+            .events()
+            .iter()
+            .filter(|e| e.map_iteration_started_event_details.is_some())
+            .count(),
+        2
+    );
+    let mut empty = owner.start_structured(driver(&value, &json!([]))?)?;
+    let view = empty.wait(deadline()).await?;
+    let ExecutionOutcome::Succeeded(output) = view.outcome().ok_or("outcome")?.as_ref() else {
+        return Err("expected empty success".into());
+    };
+    assert_eq!(output.value(), &json!([]));
+    assert!(
+        timeout(Duration::from_millis(10), calls.recv())
+            .await
+            .is_err()
+    );
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_stop_parallel_calls_and_join_cleanup_independently_of_terminal_publication()
+-> TestResult {
+    let (mut owner, mut calls, _) = fixture(1, 2, crate::HistoryLimits::default());
+    let mut handle = owner.start_structured(driver(&parallel(), &json!({}))?)?;
+    let (_, mut first) = next(&mut calls).await;
+    let (_, mut second) = next(&mut calls).await;
+    first.started()?;
+    second.started()?;
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None)?, deadline())
+        .await?;
+    assert!(matches!(
+        view.outcome().map(AsRef::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    assert!(*first.cancellation().borrow());
+    assert!(*second.cancellation().borrow());
+    assert!(matches!(
+        owner
+            .drain(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(crate::ExecutionError::Deadline)
+    ));
+    first.finish(Err(TaskFailure::new("Cancelled", None)?));
+    second.finish(Err(TaskFailure::new("Cancelled", None)?));
+    owner.drain(deadline()).await?;
+    assert_eq!(owner.shared.frames.capacity.available_frames(), 4096);
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_preserve_nested_failure_catch_after_descendant_cleanup() -> TestResult {
+    let (mut owner, mut calls, _) = fixture(1, 3, crate::HistoryLimits::default());
+    let map =
+        json!({"StartAt":"Map","States":{"Map":{"Type":"Map","ItemProcessor":task(),"End":true}}});
+    let mut value = parallel();
+    value["States"]["Parallel"]["Branches"] = json!([task(), map]);
+    value["States"]["Parallel"]["Catch"] = json!([{"ErrorEquals":["Oops"],"Next":"Handled"}]);
+    value["States"]["Handled"] = json!({"Type":"Pass","Result":"caught","End":true});
+    let mut handle = owner.start_structured(driver(&value, &json!([1, 2]))?)?;
+    let (_, mut failed) = next(&mut calls).await;
+    let (_, mut first) = next(&mut calls).await;
+    let (_, mut second) = next(&mut calls).await;
+    failed.started()?;
+    first.started()?;
+    second.started()?;
+    failed.finish(Err(TaskFailure::new("Oops", None)?));
+    timeout(Duration::from_secs(5), async {
+        while !*first.cancellation().borrow() || !*second.cancellation().borrow() {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?;
+    assert!(handle.snapshot().outcome().is_none());
+    first.finish(Err(TaskFailure::new("Cancelled", None)?));
+    second.finish(Err(TaskFailure::new("Cancelled", None)?));
+    let view = handle.wait(deadline()).await?;
+    let ExecutionOutcome::Succeeded(output) = view.outcome().ok_or("outcome")?.as_ref() else {
+        return Err("nested catch lost original failure".into());
+    };
+    assert_eq!(output.value(), &json!("caught"));
+    let history = view.history().page(1, 100, true)?;
+    assert_eq!(
+        history
+            .events()
+            .iter()
+            .filter(|event| event.map_iteration_aborted_event_details.is_some())
+            .count(),
+        2
+    );
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_abort_every_committed_map_iteration_before_root_terminal() -> TestResult {
+    let (mut owner, mut calls, _) = fixture(1, 2, crate::HistoryLimits::default());
+    let value =
+        json!({"StartAt":"Map","States":{"Map":{"Type":"Map","ItemProcessor":task(),"End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!([1, 2]))?)?;
+    let (_, mut first) = next(&mut calls).await;
+    let (_, mut second) = next(&mut calls).await;
+    first.started()?;
+    second.started()?;
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None)?, deadline())
+        .await?;
+    let page = view.history().page(1, 100, true)?;
+    let started = page
+        .events()
+        .iter()
+        .filter_map(|event| {
+            event
+                .map_iteration_started_event_details
+                .as_ref()
+                .and_then(|details| details.index)
+        })
+        .collect::<std::collections::BTreeSet<_>>();
+    let aborted = page
+        .events()
+        .iter()
+        .filter_map(|event| {
+            event
+                .map_iteration_aborted_event_details
+                .as_ref()
+                .and_then(|details| details.index)
+        })
+        .collect::<std::collections::BTreeSet<_>>();
+    assert_eq!(started, aborted);
+    assert_eq!(aborted.len(), 2);
+    first.finish(Err(TaskFailure::new("Cancelled", None)?));
+    second.finish(Err(TaskFailure::new("Cancelled", None)?));
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_not_abort_exited_state_or_publish_discarded_next_state() -> TestResult {
+    let (mut owner, mut calls, _) = fixture(1, 1, crate::HistoryLimits::default());
+    let gate = super::WorkerHook::install(&mut owner, 3, false, false);
+    let value = json!({"StartAt":"Work","States":{"Work":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","Next":"Next"},"Next":{"Type":"Pass","End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!({}))?)?;
+    let (_, mut response) = next(&mut calls).await;
+    response.started()?;
+    response.finish(Ok(Payload::parse(b"1")?));
+    timeout(Duration::from_secs(5), gate.entered.notified()).await?;
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None)?, deadline())
+        .await?;
+    let page = view.history().page(1, 100, true)?;
+    assert!(page.events().iter().any(|event| event.r#type
+        == rustack_stepfunctions_model::types::HistoryEventType::TaskStateExited));
+    assert!(!page.events().iter().any(|event| event.r#type
+        == rustack_stepfunctions_model::types::HistoryEventType::TaskStateAborted));
+    assert!(!page.events().iter().any(|event| {
+        event
+            .state_entered_event_details
+            .as_ref()
+            .is_some_and(|details| details.name == "Next")
+    }));
+    gate.release();
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_join_completed_cpu_work_after_pending_task_deadline_expires() -> TestResult {
+    let (mut owner, mut calls, _) = fixture(1, 1, crate::HistoryLimits::default());
+    let held = owner.shared.pools.dispatch.clone().acquire_owned().await?;
+    let gate = super::WorkerHook::install(&mut owner, 1, false, false);
+    let value = json!({"StartAt":"Work","States":{"Work":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","TimeoutSeconds":1,"Catch":[{"ErrorEquals":["States.Timeout"],"Next":"Done"}],"End":true},"Done":{"Type":"Pass","Result":"caught","End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!({}))?)?;
+    timeout(Duration::from_secs(5), gate.entered.notified()).await?;
+    tokio::time::sleep(Duration::from_millis(1100)).await;
+    gate.release();
+    let view = handle.wait(deadline()).await?;
+    let ExecutionOutcome::Succeeded(output) = view.outcome().ok_or("outcome")?.as_ref() else {
+        return Err("Task timeout became overall timeout".into());
+    };
+    assert_eq!(output.value(), &json!("caught"));
+    assert!(
+        timeout(Duration::from_millis(10), calls.recv())
+            .await
+            .is_err()
+    );
+    drop(held);
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_publish_stop_and_retain_root_lease_while_cpu_work_is_uncommitted() -> TestResult
+{
+    let (mut owner, mut calls, _) = fixture(1, 1, crate::HistoryLimits::default());
+    let gate = super::WorkerHook::install(&mut owner, 0, false, false);
+    let mut handle = owner.start_structured(driver(&parallel(), &json!({}))?)?;
+    timeout(Duration::from_secs(5), gate.entered.notified()).await?;
+    let view = handle
+        .stop(TaskFailure::new("Stopped", None)?, deadline())
+        .await?;
+    assert!(matches!(
+        view.outcome().map(AsRef::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    assert!(owner.shared.frames.capacity.available_frames() < 4096);
+    assert!(matches!(
+        owner
+            .drain(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(crate::ExecutionError::Deadline)
+    ));
+    gate.release();
+    owner.drain(deadline()).await?;
+    assert_eq!(owner.shared.frames.capacity.available_frames(), 4096);
+    assert!(
+        timeout(Duration::from_millis(10), calls.recv())
+            .await
+            .is_err()
+    );
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_should_suppress_late_admission_history_and_keep_task_timeout() -> TestResult {
+    let port = std::sync::Arc::new(super::RejectPort {
+        stop: None,
+        delay: Duration::from_millis(1100),
+    });
+    let mut owner = crate::ExecutionSupervisor::new(
+        crate::RuntimeLimits::new(1, 1, 1)?,
+        crate::HistoryLimits::default(),
+        256 * 1024 * 1024,
+        Some(port),
+    )?;
+    let value = json!({"StartAt":"Work","States":{"Work":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","TimeoutSeconds":1,"End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!({}))?)?;
+    let view = handle.wait(deadline()).await?;
+    let ExecutionOutcome::Failed(failure) = view.outcome().ok_or("outcome")?.as_ref() else {
+        return Err("expected Task timeout".into());
+    };
+    assert_eq!(failure.error(), Some("States.Timeout"));
+    let page = view.history().page(1, 100, true)?;
+    assert!(!page.events().iter().any(|event| matches!(
+        event.r#type,
+        rustack_stepfunctions_model::types::HistoryEventType::LambdaFunctionScheduleFailed
+            | rustack_stepfunctions_model::types::HistoryEventType::LambdaFunctionStartFailed
+    )));
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_retain_ancestor_frame_capacity_after_actor_abort_with_accepted_calls()
+-> TestResult {
+    let (mut owner, mut calls, _) = fixture(1, 2, crate::HistoryLimits::default());
+    let mut handle = owner.start_structured(driver(&parallel(), &json!({}))?)?;
+    let (_, mut first) = next(&mut calls).await;
+    let (_, mut second) = next(&mut calls).await;
+    first.started()?;
+    second.started()?;
+    owner.state.jobs.abort_all();
+    owner.reap_next().await;
+    let view = handle.wait(deadline()).await?;
+    assert!(matches!(
+        view.outcome().map(AsRef::as_ref),
+        Some(ExecutionOutcome::Failed(_))
+    ));
+    assert!(matches!(
+        owner.drain(deadline()).await,
+        Err(crate::ExecutionError::Quarantined)
+    ));
+    assert_eq!(owner.shared.pools.dispatch.available_permits(), 0);
+    assert!(owner.shared.frames.capacity.available_frames() <= 4093);
+    assert!(*first.cancellation().borrow());
+    assert!(*second.cancellation().borrow());
+    first.finish(Err(TaskFailure::new("Cancelled", None)?));
+    second.finish(Err(TaskFailure::new("Cancelled", None)?));
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_link_serial_map_admission_and_success_exit_to_aws_predecessors() -> TestResult
+{
+    let (mut owner, _, _) = fixture(1, 1, crate::HistoryLimits::default());
+    let value = json!({"StartAt":"M","States":{"M":{"Type":"Map","MaxConcurrency":1,
+        "Iterator":{"ProcessorConfig":{"Mode":"INLINE"},"StartAt":"P","States":{"P":{"Type":"Pass","End":true}}},"End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!([1, 2]))?)?;
+    let view = handle.wait(deadline()).await?;
+    let page = view.history().page(1, 100, true)?;
+    let links = page
+        .events()
+        .iter()
+        .map(|event| (event.r#type.as_str(), event.previous_event_id))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        links,
+        vec![
+            ("ExecutionStarted", Some(0)),
+            ("MapStateEntered", Some(0)),
+            ("MapStateStarted", Some(2)),
+            ("MapIterationStarted", Some(3)),
+            ("PassStateEntered", Some(4)),
+            ("PassStateExited", Some(5)),
+            ("MapIterationSucceeded", Some(6)),
+            ("MapIterationStarted", Some(6)),
+            ("PassStateEntered", Some(8)),
+            ("PassStateExited", Some(9)),
+            ("MapIterationSucceeded", Some(10)),
+            ("MapStateSucceeded", Some(11)),
+            ("MapStateExited", Some(11)),
+            ("ExecutionSucceeded", Some(13)),
+        ]
+    );
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_publish_only_the_exhausted_parallel_failure_during_retry() -> TestResult {
+    let (mut owner, _, _) = fixture(1, 1, crate::HistoryLimits::default());
+    let value = json!({"StartAt":"P","States":{"P":{"Type":"Parallel","Branches":[
+        {"StartAt":"F","States":{"F":{"Type":"Fail","Error":"Oops"}}}
+        ],"Retry":[{"ErrorEquals":["Oops"],"MaxAttempts":2,"IntervalSeconds":1,"BackoffRate":1}],"End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!({}))?)?;
+    let view = handle.wait(deadline()).await?;
+    let page = view.history().page(1, 100, true)?;
+    let links = page
+        .events()
+        .iter()
+        .map(|event| (event.r#type.as_str(), event.previous_event_id))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        links,
+        vec![
+            ("ExecutionStarted", Some(0)),
+            ("ParallelStateEntered", Some(0)),
+            ("ParallelStateStarted", Some(2)),
+            ("FailStateEntered", Some(3)),
+            ("ParallelStateStarted", Some(4)),
+            ("FailStateEntered", Some(5)),
+            ("ParallelStateStarted", Some(6)),
+            ("FailStateEntered", Some(7)),
+            ("ParallelStateFailed", Some(8)),
+            ("ExecutionFailed", Some(9)),
+        ]
+    );
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_link_new_map_admission_to_completed_processor_without_chaining_live_siblings()
+-> TestResult {
+    let (mut owner, mut calls, _) = fixture(1, 2, crate::HistoryLimits::default());
+    let value = json!({"StartAt":"M","States":{"M":{"Type":"Map","MaxConcurrency":2,"ItemProcessor":task(),"End":true}}});
+    let mut handle = owner.start_structured(driver(&value, &json!([1, 2, 3]))?)?;
+    let (_, mut first) = next(&mut calls).await;
+    let (_, mut second) = next(&mut calls).await;
+    first.started()?;
+    second.started()?;
+    second.finish(Ok(Payload::parse(b"2")?));
+    let (_, mut third) = next(&mut calls).await;
+    third.started()?;
+    third.finish(Ok(Payload::parse(b"3")?));
+    first.finish(Ok(Payload::parse(b"1")?));
+    let view = handle.wait(deadline()).await?;
+    let page = view.history().page(1, 100, true)?;
+    let events = page.events();
+    let starts = events
+        .iter()
+        .filter(|event| event.map_iteration_started_event_details.is_some())
+        .collect::<Vec<_>>();
+    assert_eq!(starts.len(), 3);
+    assert_eq!(
+        starts.first().ok_or("first start")?.previous_event_id,
+        Some(3)
+    );
+    assert_eq!(
+        starts.get(1).ok_or("second start")?.previous_event_id,
+        Some(3)
+    );
+    let completed = events
+        .iter()
+        .find(|event| {
+            event
+                .map_iteration_succeeded_event_details
+                .as_ref()
+                .is_some_and(|details| details.index == Some(1))
+        })
+        .ok_or("completed iteration")?;
+    assert_eq!(
+        starts.get(2).ok_or("third start")?.previous_event_id,
+        completed.previous_event_id
+    );
+    let success = events
+        .iter()
+        .find(|event| event.r#type == HistoryEventType::MapStateSucceeded)
+        .ok_or("Map success")?;
+    let exit = events
+        .iter()
+        .find(|event| event.r#type == HistoryEventType::MapStateExited)
+        .ok_or("Map exit")?;
+    assert_eq!(success.previous_event_id, exit.previous_event_id);
+    assert!(
+        matches!(view.outcome().map(AsRef::as_ref),Some(ExecutionOutcome::Succeeded(output)) if output.value() == &json!([1,2,3]))
+    );
+    owner.drain(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_retain_round_success_when_result_selection_fails_without_state_exit()
+-> TestResult {
+    for kind in ["Map", "Parallel"] {
+        let (mut owner, _, _) = fixture(1, 1, crate::HistoryLimits::default());
+        let leaf = json!({"StartAt":"P","States":{"P":{"Type":"Pass","End":true}}});
+        let mut state = json!({"Type":kind,"End":true,"ResultSelector":{"missing.$":"$.absent"}});
+        if kind == "Map" {
+            state["ItemProcessor"] = leaf;
+        } else {
+            state["Branches"] = json!([leaf]);
+        }
+        let value = json!({"StartAt":"R","States":{"R":state}});
+        let mut handle = owner.start_structured(driver(&value, &json!([1]))?)?;
+        let view = handle.wait(deadline()).await?;
+        let page = view.history().page(1, 100, true)?;
+        let events = page.events();
+        let terminal = events.last().ok_or("terminal")?;
+        assert_eq!(terminal.r#type, HistoryEventType::ExecutionFailed);
+        let predecessor = events
+            .iter()
+            .find(|event| Some(event.id) == terminal.previous_event_id)
+            .ok_or("terminal predecessor")?;
+        assert_eq!(predecessor.r#type.as_str(), format!("{kind}StateSucceeded"));
+        assert!(
+            !events
+                .iter()
+                .any(|event| event.r#type.as_str() == format!("{kind}StateExited"))
+        );
+        owner.drain(deadline()).await?;
+    }
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/runtime/types.rs b/crates/rustack-stepfunctions-core/src/engine/runtime/types.rs
new file mode 100644
index 00000000..e77dfda4
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/runtime/types.rs
@@ -0,0 +1,257 @@
+//! Validated runtime limits and immutable control/read handles.
+
+use std::sync::Arc;
+
+use chrono::{DateTime, Utc};
+use tokio::{
+    sync::watch,
+    time::{Instant, timeout_at},
+};
+
+use super::{super::history::ExecutionHistory, ExecutionError};
+use crate::{ExecutionFailure, ExecutionOutcome, TaskFailure};
+
+/// Shared runtime admission ceilings, supplied by validated operator configuration.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct RuntimeLimits {
+    pub(super) open: usize,
+    pub(super) dispatch: usize,
+    pub(super) cpu: usize,
+}
+impl RuntimeLimits {
+    /// Validate open executions1..=4,096, dispatches1..=1,024 and workers1..=128.
+    ///
+    /// # Errors
+    /// Rejects zero or excessive capacities.
+    ///
+    /// ```
+    /// let limits=rustack_stepfunctions_core::RuntimeLimits::new(128,32,8)?;
+    /// # Ok::<(),rustack_stepfunctions_core::ExecutionError>(())
+    /// ```
+    pub fn new(open: usize, dispatch: usize, cpu: usize) -> Result<Self, ExecutionError> {
+        if !(1..=4096).contains(&open)
+            || !(1..=1024).contains(&dispatch)
+            || !(1..=128).contains(&cpu)
+        {
+            return Err(ExecutionError::Invalid);
+        }
+        Ok(Self {
+            open,
+            dispatch,
+            cpu,
+        })
+    }
+}
+impl Default for RuntimeLimits {
+    fn default() -> Self {
+        Self {
+            open: 128,
+            dispatch: 32,
+            cpu: 8,
+        }
+    }
+}
+/// Cleanup lifetime remains independent of the business execution outcome.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum CleanupState {
+    /// Actor/calls are still owned and joining.
+    Pending,
+    /// All execution resources are confirmed settled.
+    Clean,
+    /// An uncertain call or worker retains its capacity and ownership.
+    Quarantined,
+}
+/// Atomically published history/outcome/cleanup boundary.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct ExecutionView {
+    pub(super) history: ExecutionHistory,
+    pub(super) outcome: Option<Arc<ExecutionOutcome>>,
+    pub(super) stopped: Option<DateTime<Utc>>,
+    pub(super) cleanup: CleanupState,
+    pub(super) diagnostic: Option<Arc<ExecutionError>>,
+}
+impl ExecutionView {
+    /// Read an internal typed source; Debug and public wire errors remain redacted.
+    ///
+    /// ```
+    /// # fn inspect(view:&rustack_stepfunctions_core::ExecutionView) { let source=view.diagnostic(); }
+    /// ```
+    #[must_use]
+    pub fn diagnostic(&self) -> Option<&ExecutionError> {
+        self.diagnostic.as_deref()
+    }
+    /// Read a stable history boundary that already includes any terminal outcome.
+    ///
+    /// ```
+    /// # fn inspect(view:&rustack_stepfunctions_core::ExecutionView) { let history=view.history(); }
+    /// ```
+    #[must_use]
+    pub fn history(&self) -> &ExecutionHistory {
+        &self.history
+    }
+    /// Read the single settled outcome, if present.
+    ///
+    /// ```
+    /// # fn inspect(view:&rustack_stepfunctions_core::ExecutionView) { let outcome=view.outcome(); }
+    /// ```
+    #[must_use]
+    pub fn outcome(&self) -> Option<&Arc<ExecutionOutcome>> {
+        self.outcome.as_ref()
+    }
+    /// Read committed termination time; subsequent cleanup cannot rewrite it.
+    ///
+    /// ```
+    /// # fn inspect(view:&rustack_stepfunctions_core::ExecutionView) { let stopped=view.stop_date(); }
+    /// ```
+    #[must_use]
+    pub fn stop_date(&self) -> Option<DateTime<Utc>> {
+        self.stopped
+    }
+    /// Inspect cleanup independently of execution success/failure.
+    ///
+    /// ```
+    /// # fn inspect(view:&rustack_stepfunctions_core::ExecutionView) { let cleanup=view.cleanup(); }
+    /// ```
+    #[must_use]
+    pub fn cleanup(&self) -> CleanupState {
+        self.cleanup
+    }
+}
+/// Cloneable observer/control handle; dropping it never cancels accepted work.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct ExecutionHandle {
+    pub(super) stop: watch::Sender<Option<TaskFailure>>,
+    pub(super) view: watch::Receiver<Arc<ExecutionView>>,
+}
+impl ExecutionHandle {
+    /// Capture one coherent history/outcome/read boundary.
+    ///
+    /// ```
+    /// # fn inspect(handle:&rustack_stepfunctions_core::ExecutionHandle) { let view=handle.snapshot(); }
+    /// ```
+    #[must_use]
+    pub fn snapshot(&self) -> Arc<ExecutionView> {
+        self.view.borrow().clone()
+    }
+    /// Request Stop once on its independent lane; first reason wins.
+    ///
+    /// ```
+    /// # fn stop(handle:&rustack_stepfunctions_core::ExecutionHandle)->Result<(),rustack_stepfunctions_core::AslError> {
+    /// handle.request_stop(rustack_stepfunctions_core::TaskFailure::new("Stopped",None)?);
+    /// # Ok(()) }
+    /// ```
+    pub fn request_stop(&self, reason: TaskFailure) {
+        if self.snapshot().outcome.is_some() {
+            return;
+        }
+        let mut reason = Some(reason);
+        self.stop.send_if_modified(|pending| {
+            if pending.is_some() {
+                false
+            } else {
+                *pending = reason.take();
+                true
+            }
+        });
+    }
+    /// Await committed termination within an observer deadline, preserving ownership.
+    ///
+    /// # Errors
+    /// Returns Deadline or Unavailable; never cancels or restarts the execution.
+    ///
+    /// ```no_run
+    /// # async fn join(h:&mut rustack_stepfunctions_core::ExecutionHandle) {
+    /// let view=h.wait(tokio::time::Instant::now()+std::time::Duration::from_secs(10)).await;
+    /// # }
+    /// ```
+    pub async fn wait(&mut self, deadline: Instant) -> Result<Arc<ExecutionView>, ExecutionError> {
+        self.wait_view(deadline, false).await
+    }
+    /// Await confirmed cleanup independently of committed business termination.
+    ///
+    /// # Errors
+    /// Returns Deadline, Quarantined or Unavailable without cancelling ownership.
+    ///
+    /// ```no_run
+    /// # async fn join(h:&mut rustack_stepfunctions_core::ExecutionHandle,d:tokio::time::Instant){let result=h.wait_cleanup(d).await;}
+    /// ```
+    pub async fn wait_cleanup(
+        &mut self,
+        deadline: Instant,
+    ) -> Result<Arc<ExecutionView>, ExecutionError> {
+        self.wait_view(deadline, true).await
+    }
+    pub(crate) async fn settled(&mut self) -> Result<Arc<ExecutionView>, ExecutionError> {
+        loop {
+            let view = self.snapshot();
+            if view.cleanup == CleanupState::Clean {
+                return Ok(view);
+            }
+            self.view
+                .changed()
+                .await
+                .map_err(|_| ExecutionError::Unavailable)?;
+        }
+    }
+    async fn wait_view(
+        &mut self,
+        deadline: Instant,
+        cleanup: bool,
+    ) -> Result<Arc<ExecutionView>, ExecutionError> {
+        if Instant::now() >= deadline {
+            return Err(ExecutionError::Deadline);
+        }
+        let wait = async {
+            loop {
+                let view = self.snapshot();
+                if cleanup && view.cleanup == CleanupState::Quarantined {
+                    return Err(ExecutionError::Quarantined);
+                }
+                if (cleanup && view.cleanup == CleanupState::Clean)
+                    || (!cleanup && view.outcome.is_some())
+                {
+                    return Ok::<Arc<ExecutionView>, ExecutionError>(view);
+                }
+                self.view
+                    .changed()
+                    .await
+                    .map_err(|_| ExecutionError::Unavailable)?;
+            }
+        };
+        let view = timeout_at(deadline, wait)
+            .await
+            .map_err(|_| ExecutionError::Deadline)??;
+        if Instant::now() >= deadline {
+            return Err(ExecutionError::Deadline);
+        }
+        Ok(view)
+    }
+    /// Request Stop and await its single committed terminal result.
+    ///
+    /// # Errors
+    /// Returns observation deadline/unavailability without undoing the request.
+    ///
+    /// ```no_run
+    /// # async fn stop(h:&mut rustack_stepfunctions_core::ExecutionHandle,r:rustack_stepfunctions_core::TaskFailure,d:tokio::time::Instant) {
+    /// let view=h.stop(r,d).await;
+    /// # }
+    /// ```
+    pub async fn stop(
+        &mut self,
+        reason: TaskFailure,
+        deadline: Instant,
+    ) -> Result<Arc<ExecutionView>, ExecutionError> {
+        self.request_stop(reason);
+        self.wait(deadline).await
+    }
+}
+pub(super) fn internal_outcome() -> Arc<ExecutionOutcome> {
+    Arc::new(ExecutionOutcome::Failed(ExecutionFailure::named(
+        "Rustack.InternalError",
+        "Execution owner failed",
+    )))
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/scheduler/budget.rs b/crates/rustack-stepfunctions-core/src/engine/scheduler/budget.rs
new file mode 100644
index 00000000..f666d0d4
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/scheduler/budget.rs
@@ -0,0 +1,232 @@
+//! Global/local frame and aggregate-slot admission; permit drops signal capacity.
+
+use std::sync::Arc;
+
+use tokio::{
+    sync::{Notify, OwnedSemaphorePermit, Semaphore},
+    time::{Instant, timeout_at},
+};
+
+use super::{FrameScheduler, types::FrameError};
+
+/// Validated local frame and aggregate-result slot ceilings.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct FrameLimits {
+    pub(super) frames: usize,
+    pub(super) results: usize,
+}
+impl FrameLimits {
+    /// Validate1..512 frames and4KiB..128MiB aggregate-slot resource bytes.
+    ///
+    /// # Errors
+    /// Returns Invalid for out-of-range capacities.
+    ///
+    /// ```
+    /// let limits=rustack_stepfunctions_core::FrameLimits::new(512,32*1024*1024)?;
+    /// # Ok::<(),rustack_stepfunctions_core::FrameError>(())
+    /// ```
+    pub fn new(frames: usize, results: usize) -> Result<Self, FrameError> {
+        if !(1..=512).contains(&frames) || !(4096..=128 * 1024 * 1024).contains(&results) {
+            return Err(FrameError::Invalid);
+        }
+        Ok(Self { frames, results })
+    }
+}
+impl Default for FrameLimits {
+    fn default() -> Self {
+        Self {
+            frames: 512,
+            results: 32 * 1024 * 1024,
+        }
+    }
+}
+
+/// Shared global frame and intermediate aggregate-slot budgets for all executions.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct FrameCapacity {
+    pub(super) frames: Arc<Semaphore>,
+    pub(super) results: Arc<Semaphore>,
+    changed: Notify,
+}
+impl FrameCapacity {
+    /// Validate1..4,096 frames and4KiB..1GiB global aggregate-slot bytes.
+    ///
+    /// # Errors
+    /// Returns Invalid for out-of-range values.
+    ///
+    /// ```
+    /// let capacity=rustack_stepfunctions_core::FrameCapacity::new(4096,256*1024*1024)?;
+    /// # Ok::<(),rustack_stepfunctions_core::FrameError>(())
+    /// ```
+    pub fn new(frames: usize, results: usize) -> Result<Self, FrameError> {
+        if !(1..=4096).contains(&frames)
+            || !(4096..=1024 * 1024 * 1024).contains(&results)
+            || results > Semaphore::MAX_PERMITS
+        {
+            return Err(FrameError::Invalid);
+        }
+        Ok(Self {
+            frames: Arc::new(Semaphore::new(frames)),
+            results: Arc::new(Semaphore::new(results)),
+            changed: Notify::new(),
+        })
+    }
+    /// Read currently unreserved frame slots; callers must still try admission.
+    ///
+    /// ```
+    /// let capacity=rustack_stepfunctions_core::FrameCapacity::default();
+    /// assert_eq!(capacity.available_frames(),4096);
+    /// ```
+    #[must_use]
+    pub fn available_frames(&self) -> usize {
+        self.frames.available_permits()
+    }
+
+    /// Wait for a potentially available global slot without reserving it.
+    ///
+    /// # Errors
+    /// Returns Deadline on observer expiry; no execution or resource is cancelled.
+    ///
+    /// ```no_run
+    /// # async fn wait(capacity:&rustack_stepfunctions_core::FrameCapacity) {
+    /// let result=capacity.wait_for_capacity(tokio::time::Instant::now()+std::time::Duration::from_secs(1)).await;
+    /// # }
+    /// ```
+    pub async fn wait_for_capacity(&self, deadline: Instant) -> Result<(), FrameError> {
+        loop {
+            let changed = self.changed.notified();
+            tokio::pin!(changed);
+            changed.as_mut().enable();
+            if Instant::now() >= deadline {
+                return Err(FrameError::Deadline);
+            }
+            if self.available_frames() > 0 {
+                return Ok(());
+            }
+            timeout_at(deadline, changed)
+                .await
+                .map_err(|_| FrameError::Deadline)?;
+        }
+    }
+}
+impl Default for FrameCapacity {
+    fn default() -> Self {
+        Self {
+            frames: Arc::new(Semaphore::new(4096)),
+            results: Arc::new(Semaphore::new(256 * 1024 * 1024)),
+            changed: Notify::new(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Blocked {
+    Local,
+    Global,
+}
+#[derive(Debug)]
+pub(super) struct Slot {
+    global: Option<OwnedSemaphorePermit>,
+    local: Option<OwnedSemaphorePermit>,
+    capacity: Arc<FrameCapacity>,
+}
+impl Slot {
+    pub(super) fn acquire(
+        capacity: &Arc<FrameCapacity>,
+        local: &Arc<Semaphore>,
+    ) -> Result<Self, Blocked> {
+        let local = local
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| Blocked::Local)?;
+        let global = capacity
+            .frames
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| Blocked::Global)?;
+        Ok(Self {
+            global: Some(global),
+            local: Some(local),
+            capacity: capacity.clone(),
+        })
+    }
+}
+impl Drop for Slot {
+    fn drop(&mut self) {
+        drop(self.global.take());
+        drop(self.local.take());
+        self.capacity.changed.notify_waiters();
+    }
+}
+
+/// An immutable charged frame slot retaining its complete ancestor lineage.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct FrameLease {
+    _slot: Slot,
+    _parent: Option<Arc<FrameLease>>,
+}
+impl FrameLease {
+    pub(super) fn child(slot: Slot, parent: Option<Arc<Self>>) -> Arc<Self> {
+        Arc::new(Self {
+            _slot: slot,
+            _parent: parent,
+        })
+    }
+    pub(crate) fn root(
+        capacity: &Arc<FrameCapacity>,
+        limits: FrameLimits,
+    ) -> Result<Arc<Self>, FrameError> {
+        let local = Arc::new(Semaphore::new(limits.frames));
+        Slot::acquire(capacity, &local)
+            .map(|slot| Self::child(slot, None))
+            .map_err(|_| FrameError::Capacity)
+    }
+}
+
+/// Cloned admission view of the same global/local intermediate byte pools.
+#[derive(Debug, Clone)]
+pub(crate) struct TaskDataBudget {
+    global: Arc<Semaphore>,
+    local: Arc<Semaphore>,
+}
+/// Unique encoded-byte charge retained above accepted callback/CPU work.
+#[derive(Debug)]
+pub(crate) struct TaskBytes {
+    global: OwnedSemaphorePermit,
+    local: OwnedSemaphorePermit,
+}
+impl TaskDataBudget {
+    pub(crate) fn reserve(&self, bytes: usize) -> Result<TaskBytes, FrameError> {
+        let weight = u32::try_from(bytes).map_err(|_| FrameError::Capacity)?;
+        let global = self
+            .global
+            .clone()
+            .try_acquire_many_owned(weight)
+            .map_err(|_| FrameError::Capacity)?;
+        let local = self
+            .local
+            .clone()
+            .try_acquire_many_owned(weight)
+            .map_err(|_| FrameError::Capacity)?;
+        Ok(TaskBytes { global, local })
+    }
+}
+impl TaskBytes {
+    pub(crate) fn shrink(mut self, bytes: usize) -> Result<Self, FrameError> {
+        let weight = bytes;
+        let global = self.global.split(weight).ok_or(FrameError::Invalid)?;
+        let local = self.local.split(weight).ok_or(FrameError::Invalid)?;
+        Ok(Self { global, local })
+    }
+}
+impl FrameScheduler {
+    pub(crate) fn task_data_budget(&self) -> TaskDataBudget {
+        TaskDataBudget {
+            global: self.capacity.results.clone(),
+            local: self.local_results.clone(),
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/scheduler/control.rs b/crates/rustack-stepfunctions-core/src/engine/scheduler/control.rs
new file mode 100644
index 00000000..6a37d66a
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/scheduler/control.rs
@@ -0,0 +1,277 @@
+//! Root control and explicit call-retirement ownership.
+
+use std::{cmp::Reverse, collections::BTreeSet, sync::Arc};
+
+use super::{
+    CallState, FrameCallId, FrameError, FrameId, FrameScheduler, FrameUpdate, Notice, Notification,
+    ROOT,
+};
+use crate::{
+    AslError, AttemptId, ClockSample, ExecutionFailure, ExecutionOutcome, TaskFailure,
+    engine::{Phase, types::FailureOrigin},
+};
+
+impl FrameScheduler {
+    pub(super) fn observe(&mut self, now: ClockSample) {
+        if self.outcome.is_some() {
+            return;
+        }
+        if now.monotonic < self.observed {
+            let mut failure =
+                ExecutionFailure::named("Rustack.InternalError", "Monotonic clock regressed");
+            failure.origin = FailureOrigin::Evaluation(Arc::new(AslError::InvalidExecution));
+            self.terminate(Arc::new(ExecutionOutcome::Failed(failure)));
+        } else {
+            self.observed = now.monotonic;
+            if now.monotonic >= self.deadline {
+                self.terminate(Arc::new(ExecutionOutcome::TimedOut));
+            }
+        }
+    }
+    /// Stop once, retaining all calls and emitting their retirement obligations.
+    ///
+    /// ```
+    /// # fn stop(owner:&mut rustack_stepfunctions_core::FrameScheduler,reason:rustack_stepfunctions_core::TaskFailure,now:rustack_stepfunctions_core::ClockSample) {
+    /// let update=owner.stop(reason,now);
+    /// # }
+    /// ```
+    pub fn stop(&mut self, reason: TaskFailure, now: ClockSample) -> FrameUpdate {
+        self.observe(now);
+        if self.outcome.is_none() {
+            self.terminate(Arc::new(ExecutionOutcome::Aborted(reason)));
+        }
+        self.terminal_update()
+    }
+    pub(super) fn terminate(&mut self, outcome: Arc<ExecutionOutcome>) {
+        if self.outcome.is_some() {
+            return;
+        }
+        let success = matches!(outcome.as_ref(), ExecutionOutcome::Succeeded(_));
+
+        self.ready.clear();
+        self.queued.clear();
+        self.blocked.clear();
+        let mut calls = Vec::new();
+        let mut notices = Vec::new();
+        for (id, frame) in &mut self.frames {
+            frame.cancelling = true;
+            frame.round = None;
+            if *id == ROOT {
+                frame.driver.phase = Phase::Terminal(outcome.clone());
+            } else if !success {
+                frame.driver.phase = Phase::Terminal(Arc::new(ExecutionOutcome::Aborted(
+                    TaskFailure(ExecutionFailure::named(
+                        "Rustack.ParentCancelled",
+                        "Enclosing frame cancelled",
+                    )),
+                )));
+            }
+            if frame.notification == Notification::Waiting {
+                if let Some(parent) = frame.parent {
+                    if let Some(outcome) = frame.driver.outcome().cloned() {
+                        notices.push(Notice {
+                            child: *id,
+                            parent,
+                            outcome,
+                        });
+                        frame.notification = Notification::Queued;
+                    }
+                }
+            }
+            calls.extend(frame.calls.keys().map(|attempt| FrameCallId {
+                frame: *id,
+                attempt: *attempt,
+            }));
+        }
+        notices.sort_by_key(|notice| Reverse(notice.child));
+        self.pending.extend(notices);
+        self.outcome = Some(outcome);
+        for call in calls {
+            self.cancel(call);
+        }
+        let ids = self.frames.keys().copied().collect::<Vec<_>>();
+        for id in ids {
+            self.prune(id);
+        }
+    }
+    pub(super) fn cancel(&mut self, call: FrameCallId) {
+        if let Some(state) = self
+            .frames
+            .get_mut(&call.frame)
+            .and_then(|f| f.calls.get_mut(&call.attempt))
+        {
+            if *state == CallState::Active {
+                *state = CallState::CancelQueued;
+                self.cancels.push_back(call);
+            }
+        }
+    }
+    pub(super) fn next_cancel(&mut self) -> Option<FrameCallId> {
+        while let Some(call) = self.cancels.pop_front() {
+            if let Some(state) = self
+                .frames
+                .get_mut(&call.frame)
+                .and_then(|f| f.calls.get_mut(&call.attempt))
+            {
+                if *state == CallState::CancelQueued {
+                    *state = CallState::CancelIssued;
+                    return Some(call);
+                }
+            }
+        }
+        None
+    }
+    pub(super) fn pop_notice(&mut self) -> Option<FrameUpdate> {
+        let Notice {
+            child,
+            parent,
+            outcome,
+        } = self.pending.pop_front()?;
+        if let Some(frame) = self.frames.get_mut(&child) {
+            frame.notification = Notification::Emitted;
+        }
+        self.prune(child);
+        Some(FrameUpdate::ChildFinished {
+            child,
+            parent,
+            outcome,
+        })
+    }
+    pub(super) fn terminal_update(&mut self) -> FrameUpdate {
+        if let Some(call) = self.next_cancel() {
+            return FrameUpdate::Cancel(call);
+        }
+        if let Some(update) = self.pop_notice() {
+            return update;
+        }
+        self.outcome.as_ref().map_or(FrameUpdate::Yield, |outcome| {
+            FrameUpdate::Settled(outcome.clone())
+        })
+    }
+    /// Acknowledge a requested retirement only after external ownership is settled.
+    ///
+    /// # Errors
+    /// Returns Event for an active call without a prior completion/cancellation.
+    /// Stale or repeated acknowledgements return false and change nothing.
+    ///
+    /// ```
+    /// # fn retire(owner:&mut rustack_stepfunctions_core::FrameScheduler,call:rustack_stepfunctions_core::FrameCallId) {
+    /// let changed=owner.retired(call);
+    /// # }
+    /// ```
+    pub fn retired(&mut self, call: FrameCallId) -> Result<bool, FrameError> {
+        let Some(frame) = self.frames.get_mut(&call.frame) else {
+            return Ok(false);
+        };
+        let Some(state) = frame.calls.get(&call.attempt) else {
+            return Ok(false);
+        };
+        if *state == CallState::Active {
+            return Err(FrameError::Event);
+        }
+        frame.calls.remove(&call.attempt);
+        self.calls = self.calls.checked_sub(1).ok_or(FrameError::Invalid)?;
+        self.prune(call.frame);
+        let blocked = self.blocked.keys().copied().collect::<Vec<_>>();
+        for id in blocked {
+            self.enqueue(id, false);
+        }
+        Ok(true)
+    }
+    pub(super) fn prune(&mut self, id: FrameId) {
+        let mut current = Some(id);
+        while let Some(id) = current.take() {
+            let removable = self.frames.get(&id).is_some_and(|frame| {
+                frame.driver.outcome().is_some()
+                    && frame.notification != Notification::Queued
+                    && (frame.notification == Notification::Emitted
+                        || frame.cancelling
+                        || id == ROOT && self.outcome.is_some())
+                    && frame.calls.is_empty()
+                    && frame.children.is_empty()
+            });
+            if !removable {
+                break;
+            }
+            if let Some(frame) = self.frames.remove(&id) {
+                self.queued.remove(&id);
+                self.blocked.remove(&id);
+                if let Some(parent) = frame.parent {
+                    if let Some(owner) = self.frames.get_mut(&parent.frame) {
+                        owner.children.remove(&id);
+                    }
+                    self.enqueue(parent.frame, false);
+                    current = Some(parent.frame);
+                }
+            }
+        }
+    }
+    pub(super) fn cancel_round(
+        &mut self,
+        parent: FrameId,
+        round: AttemptId,
+        ignore: Option<FrameId>,
+    ) {
+        let mut pending = self.frames.get(&parent).map_or_else(Vec::new, |owner| {
+            owner
+                .children
+                .iter()
+                .filter(|child| {
+                    self.frames
+                        .get(child)
+                        .and_then(|f| f.parent)
+                        .is_some_and(|link| link.round == round)
+                })
+                .copied()
+                .collect()
+        });
+        let mut visited = BTreeSet::new();
+        let mut notices = Vec::new();
+        while let Some(id) = pending.pop() {
+            if !visited.insert(id) {
+                continue;
+            }
+            let calls = if let Some(frame) = self.frames.get_mut(&id) {
+                pending.extend(frame.children.iter().copied());
+                frame.cancelling = Some(id) != ignore;
+                frame.round = None;
+                if frame.driver.outcome().is_none() {
+                    frame.driver.phase = Phase::Terminal(Arc::new(ExecutionOutcome::Aborted(
+                        TaskFailure(ExecutionFailure::named(
+                            "Rustack.ParentCancelled",
+                            "Enclosing frame cancelled",
+                        )),
+                    )));
+                }
+                if frame.cancelling && frame.notification == Notification::Waiting {
+                    if let Some(parent) = frame.parent {
+                        if let Some(outcome) = frame.driver.outcome().cloned() {
+                            notices.push(Notice {
+                                child: id,
+                                parent,
+                                outcome,
+                            });
+                            frame.notification = Notification::Queued;
+                        }
+                    }
+                }
+                frame
+                    .calls
+                    .keys()
+                    .map(|attempt| FrameCallId {
+                        frame: id,
+                        attempt: *attempt,
+                    })
+                    .collect::<Vec<_>>()
+            } else {
+                Vec::new()
+            };
+            for call in calls {
+                self.cancel(call);
+            }
+            self.prune(id);
+        }
+        notices.sort_by_key(|notice| Reverse(notice.child));
+        self.pending.extend(notices);
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/scheduler/drive.rs b/crates/rustack-stepfunctions-core/src/engine/scheduler/drive.rs
new file mode 100644
index 00000000..a523899b
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/scheduler/drive.rs
@@ -0,0 +1,308 @@
+//! Fair bounded ready traversal and one-frame interpreter mutation.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use super::{
+    Blocked, CallState, FailureOrigin, FrameCallId, FrameError, FrameId, FrameScheduler,
+    FrameTransition, FrameUpdate, MAX_CALLS, Notification, ROOT, Round, SCAN_LIMIT,
+};
+use crate::{
+    AttemptId, ClockSample, DriverStep, ExecutionOutcome, ExecutionSource, FanoutFailure, Payload,
+    StateView, TaskFailure,
+    engine::{Continuation, Phase},
+};
+
+#[derive(Debug)]
+pub(super) enum Operation {
+    Advance,
+    Complete {
+        attempt: AttemptId,
+        result: Result<Payload, TaskFailure>,
+    },
+    Join(Result<Payload, FanoutFailure>),
+}
+impl FrameScheduler {
+    /// Advance at most one frame/admission/notification, without IO or clock reads.
+    ///
+    /// Callers yield on Yield and observe resource/timer/capacity events on Park.
+    ///
+    /// ```
+    /// # fn tick(owner:&mut rustack_stepfunctions_core::FrameScheduler,now:rustack_stepfunctions_core::ClockSample) {
+    /// let update=owner.advance(now,&mut rustack_stepfunctions_core::SystemUuidSource::default());
+    /// # }
+    /// ```
+    pub fn advance<S: ExecutionSource + ?Sized>(
+        &mut self,
+        now: ClockSample,
+        source: &mut S,
+    ) -> FrameUpdate {
+        self.observe(now);
+        if let Some(call) = self.next_cancel() {
+            return FrameUpdate::Cancel(call);
+        }
+        if let Some(update) = self.pop_notice() {
+            return update;
+        }
+        if self.outcome.is_some() {
+            return self.terminal_update();
+        }
+        let due = self
+            .frames
+            .iter()
+            .filter_map(|(id, frame)| match frame.driver.phase {
+                Phase::Calling { deadline, .. } if now.monotonic >= deadline => Some(*id),
+                Phase::Waiting { until, .. } if now.monotonic >= until => Some(*id),
+                _ => None,
+            })
+            .collect::<Vec<_>>();
+        for id in due {
+            self.enqueue(id, false);
+        }
+        let blocked = self.blocked.keys().copied().collect::<Vec<_>>();
+        for id in blocked {
+            self.enqueue(id, false);
+        }
+        for _ in 0..SCAN_LIMIT {
+            let Some(id) = self.ready.pop_front() else {
+                break;
+            };
+            self.queued.remove(&id);
+            let Some(frame) = self.frames.get(&id) else {
+                continue;
+            };
+            if frame.cancelling {
+                self.prune(id);
+                continue;
+            }
+            if frame.driver.outcome().is_some() && frame.notification == Notification::Waiting {
+                return self.finished(id);
+            }
+            if frame.round.is_some() {
+                if let Some(update) = self.round(id, now, source) {
+                    return update;
+                }
+            } else if matches!(
+                frame.driver.phase,
+                Phase::Ready { .. } | Phase::Calling { .. } | Phase::Waiting { .. }
+            ) {
+                return self.perform(id, Operation::Advance, now, source);
+            }
+        }
+        if self.outcome.is_some() {
+            return self.terminal_update();
+        }
+        if !self.ready.is_empty() {
+            return FrameUpdate::Yield;
+        }
+        let has_progress = self.calls > 0
+            || self.frames.values().any(|frame| {
+                matches!(
+                    frame.driver.phase,
+                    Phase::Calling { .. } | Phase::Waiting { .. }
+                )
+            });
+        if !self.blocked.is_empty() && !has_progress {
+            self.safety("Rustack.FrameLimitExceeded");
+            return self.terminal_update();
+        }
+        let until =
+            self.frames
+                .values()
+                .fold(self.deadline, |until, frame| match frame.driver.phase {
+                    Phase::Calling { deadline, .. } => until.min(deadline),
+                    Phase::Waiting { until: wake, .. } => until.min(wake),
+                    _ => until,
+                });
+        FrameUpdate::Park {
+            until,
+            global_capacity: self
+                .blocked
+                .values()
+                .any(|reason| *reason == Blocked::Global),
+        }
+    }
+    /// Apply a Task result only to its current frame and generation.
+    ///
+    /// # Errors
+    /// Returns Invalid only for a scheduler invariant; stale/duplicate events are inert.
+    ///
+    /// ```
+    /// # fn complete(owner:&mut rustack_stepfunctions_core::FrameScheduler,call:rustack_stepfunctions_core::FrameCallId,result:Result<rustack_stepfunctions_core::Payload,rustack_stepfunctions_core::TaskFailure>,now:rustack_stepfunctions_core::ClockSample) {
+    /// let transition=owner.complete(call,result,now,&mut rustack_stepfunctions_core::SystemUuidSource::default());
+    /// # }
+    /// ```
+    pub fn complete<S: ExecutionSource + ?Sized>(
+        &mut self,
+        call: FrameCallId,
+        result: Result<Payload, TaskFailure>,
+        now: ClockSample,
+        source: &mut S,
+    ) -> Result<Option<FrameTransition>, FrameError> {
+        self.observe(now);
+        if self.outcome.is_some() {
+            return Ok(None);
+        }
+        let current=self.frames.get(&call.frame).is_some_and(|frame|!frame.cancelling && frame.calls.get(&call.attempt)==Some(&CallState::Active) && matches!(frame.driver.phase,Phase::Calling { attempt,.. } if attempt==call.attempt));
+        if !current {
+            return Ok(None);
+        }
+        self.cancel(call);
+        match self.perform(
+            call.frame,
+            Operation::Complete {
+                attempt: call.attempt,
+                result,
+            },
+            now,
+            source,
+        ) {
+            FrameUpdate::Transition(transition) => Ok(Some(*transition)),
+            _ if self.outcome.is_some() => Ok(None),
+            _ => Err(FrameError::Invalid),
+        }
+    }
+    pub(super) fn perform<S: ExecutionSource + ?Sized>(
+        &mut self,
+        id: FrameId,
+        operation: Operation,
+        now: ClockSample,
+        source: &mut S,
+    ) -> FrameUpdate {
+        let Some(frame) = self.frames.get_mut(&id) else {
+            self.internal();
+            return self.terminal_update();
+        };
+        let state = frame.driver.state;
+        let machine = frame.driver.machine.clone();
+        let parent = frame.parent;
+        let entered = matches!(frame.driver.phase, Phase::Ready { entry: true })
+            .then(|| frame.driver.input.clone());
+        let timed_out = match frame.driver.phase {
+            Phase::Calling { attempt, deadline } if now.monotonic >= deadline => {
+                Some(FrameCallId { frame: id, attempt })
+            }
+            _ => None,
+        };
+        frame.driver.remaining = self.remaining;
+        frame.driver.fanout_started = None;
+        let preparing = matches!(frame.driver.phase, Phase::Ready { .. })
+            && matches!(
+                machine.state(state),
+                Ok(StateView::Map { .. } | StateView::Parallel { .. })
+            );
+        let round_finished = match &operation {
+            Operation::Join(result) => Some(result.is_ok()),
+            _ => None,
+        };
+        let update = match operation {
+            Operation::Advance => frame.driver.advance(now, source),
+            Operation::Complete { attempt, result } => {
+                frame.driver.complete(attempt, result, now, source)
+            }
+            Operation::Join(result) => {
+                let Phase::Joining { attempt, .. } = frame.driver.phase else {
+                    self.internal();
+                    return self.terminal_update();
+                };
+                frame.driver.complete_fanout(attempt, result, now, source)
+            }
+        };
+        self.remaining = frame.driver.remaining;
+        let fanout_started = frame.driver.fanout_started;
+        let round_finished =
+            round_finished.or(fanout_started.filter(|count| *count == 0).map(|_| true));
+        let round_finished = round_finished.or(if preparing && fanout_started.is_none() {
+            Some(false)
+        } else {
+            None
+        });
+        let round_finished = round_finished.filter(|success| {
+            *success
+                || !matches!(
+                    frame.driver.phase,
+                    Phase::Waiting {
+                        continuation: Continuation::Retry,
+                        ..
+                    }
+                )
+        });
+        let exited = match &frame.driver.phase {
+            Phase::Ready { entry: true } => Some(frame.driver.input.clone()),
+            Phase::Terminal(outcome) => match outcome.as_ref() {
+                ExecutionOutcome::Succeeded(output) => Some(output.clone()),
+                _ => None,
+            },
+            _ => None,
+        };
+        let terminal = frame.driver.outcome().cloned();
+        if let Some(attempt) = update.cancel {
+            self.cancel(FrameCallId { frame: id, attempt });
+        }
+        if !self.capture_effect(id, &update.step) {
+            return self.terminal_update();
+        }
+        if let Some(outcome) = terminal {
+            self.settle_frame(id, parent, outcome);
+        } else if self.frames.get(&id).is_some_and(|frame| {
+            matches!(
+                frame.driver.phase,
+                Phase::Ready { .. } | Phase::Joining { .. }
+            )
+        }) {
+            self.enqueue(id, false);
+        }
+        FrameUpdate::Transition(Box::new(FrameTransition {
+            frame: id,
+            parent,
+            machine,
+            state,
+            entered,
+            exited,
+            timed_out,
+            step: update.step,
+            fanout_started,
+            round_finished,
+        }))
+    }
+    fn capture_effect(&mut self, id: FrameId, step: &DriverStep) -> bool {
+        if let Some(attempt) = step.task_attempt() {
+            if self.calls >= MAX_CALLS {
+                self.safety("Rustack.TaskOwnershipLimitExceeded");
+                return false;
+            }
+            if let Some(frame) = self.frames.get_mut(&id) {
+                frame.calls.insert(attempt, CallState::Active);
+                self.calls += 1;
+            }
+        }
+        if let DriverStep::FanOut(plan) = step {
+            if let Some(frame) = self.frames.get_mut(&id) {
+                frame.round = Some(Round {
+                    plan: plan.clone(),
+                    next: 0,
+                    running: BTreeSet::new(),
+                    outputs: BTreeMap::new(),
+                    bytes: 2,
+                    failure: None,
+                });
+            }
+        }
+        true
+    }
+    fn settle_frame(
+        &mut self,
+        id: FrameId,
+        parent: Option<super::FrameParent>,
+        outcome: std::sync::Arc<ExecutionOutcome>,
+    ) {
+        let safety = matches!(outcome.as_ref(),ExecutionOutcome::Failed(failure) if matches!(failure.origin,FailureOrigin::Safety));
+        if id == ROOT || safety {
+            self.terminate(outcome);
+        } else {
+            if let (Some(parent), ExecutionOutcome::Failed(failure)) = (parent, outcome.as_ref()) {
+                self.fail_round_from(parent.frame, failure.clone().into(), Some(id));
+            }
+            self.enqueue(id, true);
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/scheduler/lifecycle.rs b/crates/rustack-stepfunctions-core/src/engine/scheduler/lifecycle.rs
new file mode 100644
index 00000000..3201e59c
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/scheduler/lifecycle.rs
@@ -0,0 +1,253 @@
+//! Lazy admission, indexed results and failure cleanup barriers.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use super::{
+    Frame, FrameId, FrameLease, FrameParent, FrameScheduler, FrameUpdate, Notification,
+    RESULT_OVERHEAD, ResultSlot, Round, budget::Slot, drive::Operation,
+};
+use crate::{
+    AslError, ClockSample, ExecutionDriver, ExecutionOutcome, ExecutionSource, FanoutFailure,
+    MAX_PAYLOAD_BYTES, Payload, payload::encode,
+};
+
+#[derive(Debug)]
+enum StoreError {
+    Evaluation(AslError),
+    Capacity,
+}
+
+impl FrameScheduler {
+    pub(super) fn round<S: ExecutionSource + ?Sized>(
+        &mut self,
+        id: FrameId,
+        now: ClockSample,
+        source: &mut S,
+    ) -> Option<FrameUpdate> {
+        let owner = self.frames.get(&id)?;
+        let round = owner.round.as_ref()?;
+        let attempt = round.plan.attempt();
+        let waiting = owner.children.iter().any(|child| {
+            self.frames
+                .get(child)
+                .and_then(|f| f.parent)
+                .is_some_and(|parent| parent.round == attempt)
+        });
+        if round.failure.is_some() && waiting {
+            return None;
+        }
+        if round.failure.is_some() || round.outputs.len() == round.plan.item_count() {
+            let round = self.frames.get_mut(&id)?.round.take()?;
+            self.blocked.remove(&id);
+            return Some(self.join_round(id, round, now, source));
+        }
+        if round.next >= round.plan.item_count()
+            || round.running.len() >= round.plan.max_concurrency().get()
+        {
+            return None;
+        }
+        let index = round.next;
+        let plan = round.plan.clone();
+        let slot = match Slot::acquire(&self.capacity, &self.local_frames) {
+            Ok(slot) => slot,
+            Err(reason) => {
+                self.blocked.insert(id, reason);
+                return None;
+            }
+        };
+        self.blocked.remove(&id);
+        let branch = match plan.branch(index, source) {
+            Ok(branch) => branch,
+            Err(error) => {
+                self.fail_round(id, error.into());
+                return Some(FrameUpdate::Yield);
+            }
+        };
+        let driver = match ExecutionDriver::frame(
+            branch.machine().clone(),
+            branch.input().clone(),
+            branch.context().clone(),
+            now,
+            plan.deadline(),
+            self.remaining,
+        ) {
+            Ok(driver) => driver,
+            Err(error) => {
+                self.fail_round(id, error.into());
+                return Some(FrameUpdate::Yield);
+            }
+        };
+        let child = FrameId(self.next);
+        let Some(next) = self.next.checked_add(1) else {
+            self.internal();
+            return Some(self.terminal_update());
+        };
+        self.next = next;
+        let parent = FrameParent {
+            frame: id,
+            round: attempt,
+            index,
+        };
+        let Some(owner) = self.frames.get_mut(&id) else {
+            self.internal();
+            return Some(self.terminal_update());
+        };
+        let Some(round) = owner.round.as_mut() else {
+            self.internal();
+            return Some(self.terminal_update());
+        };
+        round.next = round.next.saturating_add(1);
+        round.running.insert(child);
+        owner.children.insert(child);
+        let lineage = owner.lease.clone();
+        self.frames.insert(
+            child,
+            Frame {
+                driver,
+                parent: Some(parent),
+                children: BTreeSet::new(),
+                round: None,
+                calls: BTreeMap::new(),
+                notification: Notification::Waiting,
+                cancelling: false,
+                lease: FrameLease::child(slot, Some(lineage)),
+            },
+        );
+        self.enqueue(id, false);
+        self.enqueue(child, true);
+        Some(FrameUpdate::ChildStarted { child, parent })
+    }
+    fn join_round<S: ExecutionSource + ?Sized>(
+        &mut self,
+        id: FrameId,
+        round: Round,
+        now: ClockSample,
+        source: &mut S,
+    ) -> FrameUpdate {
+        let result = if let Some(failure) = round.failure {
+            Err(failure)
+        } else {
+            let outputs = round
+                .outputs
+                .iter()
+                .map(|(index, slot)| (*index, slot.payload.clone()))
+                .collect::<Vec<_>>();
+            round.plan.collect(&outputs).map_err(FanoutFailure::from)
+        };
+        self.perform(id, Operation::Join(result), now, source)
+    }
+    pub(super) fn fail_round(&mut self, id: FrameId, failure: FanoutFailure) {
+        self.fail_round_from(id, failure, None);
+    }
+    pub(super) fn fail_round_from(
+        &mut self,
+        id: FrameId,
+        failure: FanoutFailure,
+        ignore: Option<FrameId>,
+    ) {
+        let attempt = if let Some(round) = self.frames.get_mut(&id).and_then(|f| f.round.as_mut()) {
+            if round.failure.is_some() {
+                return;
+            }
+            round.failure = Some(failure);
+            round.outputs.clear();
+            round.plan.attempt()
+        } else {
+            self.internal();
+            return;
+        };
+        self.blocked.remove(&id);
+        self.cancel_round(id, attempt, ignore);
+        self.enqueue(id, false);
+    }
+    pub(super) fn finished(&mut self, id: FrameId) -> FrameUpdate {
+        let Some(frame) = self.frames.get_mut(&id) else {
+            self.internal();
+            return self.terminal_update();
+        };
+        let Some(parent) = frame.parent else {
+            self.internal();
+            return self.terminal_update();
+        };
+        let Some(outcome) = frame.driver.outcome().cloned() else {
+            self.internal();
+            return self.terminal_update();
+        };
+        frame.notification = Notification::Emitted;
+        let current = self
+            .frames
+            .get_mut(&parent.frame)
+            .and_then(|f| f.round.as_mut());
+        let Some(round) = current else {
+            self.internal();
+            return self.terminal_update();
+        };
+        if round.plan.attempt() != parent.round || !round.running.remove(&id) {
+            self.internal();
+            return self.terminal_update();
+        }
+        match outcome.as_ref() {
+            ExecutionOutcome::Succeeded(output) => match self.store(parent, output) {
+                Ok(()) => {}
+                Err(StoreError::Evaluation(error)) => self.fail_round(parent.frame, error.into()),
+                Err(StoreError::Capacity) => self.safety("Rustack.ResultLimitExceeded"),
+            },
+            ExecutionOutcome::Failed(failure) => {
+                self.fail_round(parent.frame, failure.clone().into());
+            }
+            _ => self.internal(),
+        }
+        self.prune(id);
+        self.enqueue(parent.frame, false);
+        FrameUpdate::ChildFinished {
+            child: id,
+            parent,
+            outcome,
+        }
+    }
+    fn store(&mut self, parent: FrameParent, payload: &Payload) -> Result<(), StoreError> {
+        let compact = encode(payload.value()).map_err(StoreError::Evaluation)?;
+        let round = self
+            .frames
+            .get_mut(&parent.frame)
+            .and_then(|frame| frame.round.as_mut())
+            .ok_or(StoreError::Evaluation(AslError::InvalidStateId))?;
+        if round.outputs.contains_key(&parent.index) || parent.index >= round.plan.item_count() {
+            return Err(StoreError::Evaluation(AslError::InvalidFanoutResult));
+        }
+        let bytes = round
+            .bytes
+            .checked_add(compact.len())
+            .and_then(|n| n.checked_add(usize::from(!round.outputs.is_empty())))
+            .filter(|n| *n <= MAX_PAYLOAD_BYTES)
+            .ok_or(StoreError::Evaluation(AslError::DataLimit))?;
+        let weight = payload
+            .original_bytes()
+            .len()
+            .checked_add(compact.len())
+            .and_then(|n| n.checked_add(RESULT_OVERHEAD))
+            .and_then(|n| u32::try_from(n).ok())
+            .ok_or(StoreError::Capacity)?;
+        let local = self
+            .local_results
+            .clone()
+            .try_acquire_many_owned(weight)
+            .map_err(|_| StoreError::Capacity)?;
+        let global = self
+            .capacity
+            .results
+            .clone()
+            .try_acquire_many_owned(weight)
+            .map_err(|_| StoreError::Capacity)?;
+        round.bytes = bytes;
+        round.outputs.insert(
+            parent.index,
+            ResultSlot {
+                payload: payload.clone(),
+                _global: global,
+                _local: local,
+            },
+        );
+        Ok(())
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/scheduler/mod.rs b/crates/rustack-stepfunctions-core/src/engine/scheduler/mod.rs
new file mode 100644
index 00000000..d450a171
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/scheduler/mod.rs
@@ -0,0 +1,237 @@
+//! Bounded synchronous ownership of a complete execution's lexical frame tree.
+
+use std::{
+    collections::{BTreeMap, BTreeSet, VecDeque},
+    sync::Arc,
+    time::Instant,
+};
+
+use tokio::sync::{OwnedSemaphorePermit, Semaphore};
+
+use super::types::FailureOrigin;
+use crate::{
+    AslError, AttemptId, ExecutionDriver, ExecutionFailure, ExecutionOutcome, FanoutFailure,
+    FanoutPlan, Payload,
+};
+
+mod budget;
+mod control;
+mod drive;
+mod lifecycle;
+#[cfg(test)]
+mod tests;
+mod types;
+
+use budget::{Blocked, Slot};
+pub use budget::{FrameCapacity, FrameLease, FrameLimits};
+pub(crate) use budget::{TaskBytes, TaskDataBudget};
+pub use types::{FrameCallId, FrameError, FrameId, FrameParent, FrameTransition, FrameUpdate};
+
+const ROOT: FrameId = FrameId(0);
+const MAX_CALLS: usize = 1024;
+const SCAN_LIMIT: usize = 64;
+const RESULT_OVERHEAD: usize = 128;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum CallState {
+    Active,
+    CancelQueued,
+    CancelIssued,
+}
+#[derive(Debug)]
+struct ResultSlot {
+    payload: Payload,
+    _global: OwnedSemaphorePermit,
+    _local: OwnedSemaphorePermit,
+}
+#[derive(Debug)]
+struct Round {
+    plan: FanoutPlan,
+    next: usize,
+    running: BTreeSet<FrameId>,
+    outputs: BTreeMap<usize, ResultSlot>,
+    bytes: usize,
+    failure: Option<FanoutFailure>,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Notification {
+    Waiting,
+    Queued,
+    Emitted,
+}
+#[derive(Debug)]
+struct Notice {
+    child: FrameId,
+    parent: FrameParent,
+    outcome: Arc<ExecutionOutcome>,
+}
+#[derive(Debug)]
+struct Frame {
+    driver: ExecutionDriver,
+    parent: Option<FrameParent>,
+    children: BTreeSet<FrameId>,
+    round: Option<Round>,
+    calls: BTreeMap<AttemptId, CallState>,
+    notification: Notification,
+    cancelling: bool,
+    lease: Arc<FrameLease>,
+}
+
+/// One execution's bounded frame tree; the caller independently owns IO resources.
+///
+/// Retain this owner across observation timeouts. It emits effects only; callers
+/// must join accepted calls and acknowledge retirement before releasing ownership.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct FrameScheduler {
+    frames: BTreeMap<FrameId, Frame>,
+    ready: VecDeque<FrameId>,
+    queued: BTreeSet<FrameId>,
+    blocked: BTreeMap<FrameId, Blocked>,
+    cancels: VecDeque<FrameCallId>,
+    pending: VecDeque<Notice>,
+    capacity: Arc<FrameCapacity>,
+    local_frames: Arc<Semaphore>,
+    local_results: Arc<Semaphore>,
+    deadline: Instant,
+    observed: Instant,
+    remaining: u32,
+    next: u64,
+    calls: usize,
+    outcome: Option<Arc<ExecutionOutcome>>,
+}
+impl FrameScheduler {
+    pub(crate) fn retains_result_notification(&self, frame: FrameId) -> bool {
+        self.pending.iter().any(|notice| notice.child == frame)
+            || self.frames.get(&frame).is_some_and(|frame| {
+                frame.parent.is_some()
+                    && frame.driver.outcome().is_some()
+                    && frame.notification != Notification::Emitted
+            })
+    }
+    /// Admit an unstarted root driver without spawning or issuing a call.
+    ///
+    /// # Errors
+    /// Returns Invalid for a started driver, or Capacity before root registration.
+    ///
+    /// ```
+    /// # fn admit(driver:rustack_stepfunctions_core::ExecutionDriver) {
+    /// let owner=rustack_stepfunctions_core::FrameScheduler::new(driver,std::sync::Arc::new(rustack_stepfunctions_core::FrameCapacity::default()),rustack_stepfunctions_core::FrameLimits::default());
+    /// # }
+    /// ```
+    pub fn new(
+        driver: ExecutionDriver,
+        capacity: Arc<FrameCapacity>,
+        limits: FrameLimits,
+    ) -> Result<Self, FrameError> {
+        if driver.started {
+            return Err(FrameError::Invalid);
+        }
+        let local_frames = Arc::new(Semaphore::new(limits.frames));
+        let slot = Slot::acquire(&capacity, &local_frames).map_err(|_| FrameError::Capacity)?;
+        let deadline = driver.deadline;
+        let observed = driver.observed;
+        let remaining = driver.remaining;
+        let frame = Frame {
+            driver,
+            parent: None,
+            children: BTreeSet::new(),
+            round: None,
+            calls: BTreeMap::new(),
+            notification: Notification::Waiting,
+            cancelling: false,
+            lease: FrameLease::child(slot, None),
+        };
+        Ok(Self {
+            frames: BTreeMap::from([(ROOT, frame)]),
+            ready: VecDeque::from([ROOT]),
+            queued: BTreeSet::from([ROOT]),
+            blocked: BTreeMap::new(),
+            cancels: VecDeque::new(),
+            pending: VecDeque::new(),
+            capacity,
+            local_frames,
+            local_results: Arc::new(Semaphore::new(limits.results)),
+            deadline,
+            observed,
+            remaining,
+            next: 1,
+            calls: 0,
+            outcome: None,
+        })
+    }
+    /// Retain a frame and all ancestors before issuing accepted external work.
+    ///
+    /// ```
+    /// # fn retain(owner:&rustack_stepfunctions_core::FrameScheduler,id:rustack_stepfunctions_core::FrameId) { let lease=owner.lease(id); }
+    /// ```
+    #[must_use]
+    pub fn lease(&self, id: FrameId) -> Option<Arc<FrameLease>> {
+        self.frames.get(&id).map(|frame| frame.lease.clone())
+    }
+    pub(crate) fn root_lease(&self) -> Option<Arc<FrameLease>> {
+        self.lease(ROOT)
+    }
+    pub(crate) fn supersede_uncommitted(&mut self, outcome: Arc<ExecutionOutcome>) {
+        self.outcome = None;
+        self.terminate(outcome);
+    }
+    /// Read a live/retiring frame without mutating its interpreter.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::FrameScheduler,id:rustack_stepfunctions_core::FrameId) { let driver=owner.driver(id); }
+    /// ```
+    #[must_use]
+    pub fn driver(&self, id: FrameId) -> Option<&ExecutionDriver> {
+        self.frames.get(&id).map(|frame| &frame.driver)
+    }
+    /// Read the stable root outcome, independently of resource retirement.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::FrameScheduler) { let outcome=owner.outcome(); }
+    /// ```
+    #[must_use]
+    pub fn outcome(&self) -> Option<&Arc<ExecutionOutcome>> {
+        self.outcome.as_ref()
+    }
+    /// Whether root termination and every descendant/call retirement are complete.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::FrameScheduler) { let clean=owner.cleanup_ready(); }
+    /// ```
+    #[must_use]
+    pub fn cleanup_ready(&self) -> bool {
+        self.outcome.is_some() && self.frames.is_empty() && self.pending.is_empty()
+    }
+    /// Read charged frame count, including terminal frames awaiting call retirement.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::FrameScheduler) { let count=owner.frame_count(); }
+    /// ```
+    #[must_use]
+    pub fn frame_count(&self) -> usize {
+        self.frames.len()
+    }
+
+    fn enqueue(&mut self, id: FrameId, front: bool) {
+        if self.frames.get(&id).is_some_and(|f| !f.cancelling) && self.queued.insert(id) {
+            if front {
+                self.ready.push_front(id);
+            } else {
+                self.ready.push_back(id);
+            }
+        }
+    }
+    fn internal(&mut self) {
+        let source = Arc::new(AslError::InvalidStateId);
+        let mut failure =
+            ExecutionFailure::named("Rustack.InternalError", "Frame owner invariant failed");
+        failure.origin = FailureOrigin::Evaluation(source);
+        self.terminate(Arc::new(ExecutionOutcome::Failed(failure)));
+    }
+    fn safety(&mut self, name: &str) {
+        self.terminate(Arc::new(ExecutionOutcome::Failed(
+            ExecutionFailure::safety(name, "Execution frame budget exhausted"),
+        )));
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/scheduler/tests.rs b/crates/rustack-stepfunctions-core/src/engine/scheduler/tests.rs
new file mode 100644
index 00000000..b16ba14d
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/scheduler/tests.rs
@@ -0,0 +1,792 @@
+//! Explicit-clock traversal and acknowledged resource-retirement regressions.
+
+use std::{
+    error::Error,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use chrono::Utc;
+use proptest::prelude::*;
+use rstest::rstest;
+use serde_json::{Value, json};
+use uuid::Uuid;
+
+use super::{
+    FailureOrigin, FrameCapacity, FrameError, FrameLimits, FrameScheduler, FrameUpdate, ROOT,
+};
+use crate::{
+    AslCompiler, AslError, ClockSample, DriverStep, EvaluationContext, ExecutionDriver,
+    ExecutionLimits, ExecutionOutcome, ExecutionSource, FrameCallId, Payload, StateSupport,
+    SystemUuidSource, TaskDispatch, TaskFailure, TaskSupport, TenantScope, UuidSource,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+type Call = (FrameCallId, TaskDispatch);
+fn now() -> ClockSample {
+    ClockSample::new(Instant::now(), Utc::now())
+}
+fn after(start: ClockSample, millis: u32) -> ClockSample {
+    ClockSample::new(
+        start.monotonic + Duration::from_millis(u64::from(millis)),
+        start.wall + chrono::Duration::milliseconds(i64::from(millis)),
+    )
+}
+fn definition(state: Value) -> Value {
+    let mut result = json!({"StartAt":"Run","States":{}});
+    result["States"]["Run"] = state;
+    result
+}
+fn succeed() -> Value {
+    definition(json!({"Type":"Succeed"}))
+}
+fn task() -> Value {
+    definition(
+        json!({"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:worker","End":true}),
+    )
+}
+fn parallel(branches: Vec<Value>) -> Value {
+    let mut state = json!({"Type":"Parallel","End":true});
+    state["Branches"] = Value::Array(branches);
+    definition(state)
+}
+fn map(concurrency: u8) -> Value {
+    definition(
+        json!({"Type":"Map","ItemProcessor":task(),"MaxConcurrency":concurrency,"ItemSelector":{"index.$":"$$.Map.Item.Index","value.$":"$$.Map.Item.Value"},"End":true}),
+    )
+}
+fn driver(
+    value: &Value,
+    input: &Value,
+    start: ClockSample,
+) -> Result<ExecutionDriver, Box<dyn Error>> {
+    let compiled = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_state_support(StateSupport::Structured)
+        .compile(&serde_json::to_vec(value)?)?;
+    Ok(ExecutionDriver::for_structured_owner(
+        compiled.machine().clone(),
+        Payload::from_value(input)?,
+        EvaluationContext::from_value(&json!({"Execution":{"Id":"root"}}))?,
+        start,
+        ExecutionLimits::new(Duration::from_secs(60), 100_000)?,
+    )?)
+}
+fn owner(
+    value: &Value,
+    input: &Value,
+    start: ClockSample,
+) -> Result<FrameScheduler, Box<dyn Error>> {
+    Ok(FrameScheduler::new(
+        driver(value, input, start)?,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )?)
+}
+fn pump(
+    tree: &mut FrameScheduler,
+    start: ClockSample,
+    retire: bool,
+) -> Result<Vec<Call>, Box<dyn Error>> {
+    let mut calls = Vec::new();
+    let mut source = SystemUuidSource::default();
+    for _ in 0..50_000 {
+        match tree.advance(start, &mut source) {
+            FrameUpdate::Transition(t) => {
+                if let DriverStep::Dispatch(dispatch) = t.step() {
+                    calls.push((t.call().ok_or("missing call identity")?, dispatch.clone()));
+                }
+            }
+            FrameUpdate::Cancel(call) => {
+                if retire {
+                    tree.retired(call)?;
+                }
+            }
+            FrameUpdate::Park { .. } | FrameUpdate::Settled(_) => return Ok(calls),
+            _ => {}
+        }
+    }
+    Err("scheduler did not park/settle within bounded fixture steps".into())
+}
+fn complete(
+    tree: &mut FrameScheduler,
+    call: FrameCallId,
+    value: &Value,
+    start: ClockSample,
+) -> TestResult {
+    assert!(
+        tree.complete(
+            call,
+            Ok(Payload::from_value(value)?),
+            start,
+            &mut SystemUuidSource::default()
+        )?
+        .is_some()
+    );
+    Ok(())
+}
+fn output(tree: &FrameScheduler) -> Result<&Value, Box<dyn Error>> {
+    let Some(result) = tree.outcome() else {
+        return Err("missing root outcome".into());
+    };
+    let ExecutionOutcome::Succeeded(value) = result.as_ref() else {
+        return Err("expected success".into());
+    };
+    Ok(value.value())
+}
+fn error(tree: &FrameScheduler) -> Result<Option<&str>, Box<dyn Error>> {
+    let Some(result) = tree.outcome() else {
+        return Err("missing root outcome".into());
+    };
+    let ExecutionOutcome::Failed(failure) = result.as_ref() else {
+        return Err("expected failure".into());
+    };
+    Ok(failure.error())
+}
+
+#[test]
+fn test_should_run_nested_map_parallel_and_order_outputs_independently_of_completion() -> TestResult
+{
+    let start = now();
+    let mut inner = map(2);
+    inner["States"]["Run"]["ItemProcessor"] = parallel(vec![
+        definition(json!({"Type":"Succeed","InputPath":"$.value"})),
+        definition(json!({"Type":"Succeed","InputPath":"$.value"})),
+    ]);
+    let mut tree = owner(&inner, &json!([1, 2, 3]), start)?;
+    assert!(pump(&mut tree, start, true)?.is_empty());
+    assert_eq!(output(&tree)?, &json!([[1, 1], [2, 2], [3, 3]]));
+    assert!(tree.cleanup_ready());
+    assert_eq!(tree.frame_count(), 0);
+    Ok(())
+}
+
+#[test]
+fn test_should_keep_successful_calls_owned_while_admitting_later_iterations() -> TestResult {
+    let start = now();
+    let capacity = Arc::new(FrameCapacity::new(8, 1024 * 1024)?);
+    let mut tree = FrameScheduler::new(
+        driver(&map(2), &json!([5, 6, 7]), start)?,
+        capacity.clone(),
+        FrameLimits::default(),
+    )?;
+    let initial = pump(&mut tree, start, false)?;
+    assert_eq!(initial.len(), 2);
+    assert_eq!(
+        initial
+            .first()
+            .ok_or("missing first")?
+            .1
+            .parameters()
+            .value()
+            .get("index"),
+        Some(&json!(0))
+    );
+    let first = initial.first().ok_or("missing first")?.0;
+    let second = initial.get(1).ok_or("missing second")?.0;
+    assert_eq!(first.attempt(), second.attempt());
+    assert_ne!(first.frame(), second.frame());
+    complete(&mut tree, second, &json!(60), start)?;
+    let later = pump(&mut tree, start, false)?;
+    assert_eq!(later.len(), 1);
+    assert_eq!(
+        later
+            .first()
+            .ok_or("missing third")?
+            .1
+            .parameters()
+            .value()
+            .get("index"),
+        Some(&json!(2))
+    );
+    let third = later.first().ok_or("missing third")?.0;
+    complete(&mut tree, third, &json!(70), start)?;
+    complete(&mut tree, first, &json!(50), start)?;
+    pump(&mut tree, start, false)?;
+    assert_eq!(output(&tree)?, &json!([50, 60, 70]));
+    assert!(!tree.cleanup_ready());
+    assert_eq!(tree.frame_count(), 4);
+    for call in [first, second, third] {
+        assert!(tree.retired(call)?);
+        assert!(!tree.retired(call)?);
+    }
+    assert!(tree.cleanup_ready());
+    assert_eq!(capacity.available_frames(), 8);
+    assert!(
+        tree.complete(
+            second,
+            Ok(Payload::parse(b"99")?),
+            start,
+            &mut SystemUuidSource::default()
+        )?
+        .is_none()
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_wait_for_failed_round_sibling_retirement_before_retrying_fresh_frames() -> TestResult
+{
+    let start = now();
+    let mut value = parallel(vec![task(), task()]);
+    value["States"]["Run"]["Retry"] =
+        json!([{"ErrorEquals":["Oops"],"IntervalSeconds":1,"MaxAttempts":1}]);
+    let mut tree = owner(&value, &json!({}), start)?;
+    let old = pump(&mut tree, start, false)?;
+    assert_eq!(old.len(), 2);
+    let first = old.first().ok_or("first")?.0;
+    let second = old.get(1).ok_or("second")?.0;
+    let _ = tree.complete(
+        first,
+        Err(TaskFailure::new("Oops", None)?),
+        start,
+        &mut SystemUuidSource::default(),
+    )?;
+    assert!(pump(&mut tree, start, false)?.is_empty());
+    assert!(tree.retired(first)?);
+    assert!(pump(&mut tree, after(start, 500), false)?.is_empty());
+    assert!(tree.outcome().is_none());
+    assert_eq!(tree.driver(ROOT).ok_or("root")?.retry_count(), 0);
+    assert!(tree.retired(second)?);
+    assert!(pump(&mut tree, after(start, 500), false)?.is_empty());
+    assert_eq!(tree.driver(ROOT).ok_or("root")?.retry_count(), 1);
+    let fresh = pump(&mut tree, after(start, 1500), false)?;
+    assert_eq!(fresh.len(), 2);
+    assert!(
+        fresh
+            .iter()
+            .all(|(call, _)| call.frame() != first.frame() && call.frame() != second.frame())
+    );
+    assert!(
+        tree.complete(
+            second,
+            Ok(Payload::parse(b"999")?),
+            after(start, 1500),
+            &mut SystemUuidSource::default()
+        )?
+        .is_none()
+    );
+    for (call, _) in &fresh {
+        complete(&mut tree, *call, &json!(2), after(start, 1500))?;
+    }
+    pump(&mut tree, after(start, 1500), true)?;
+    assert_eq!(output(&tree)?, &json!([2, 2]));
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_active_retirement_and_invalidate_every_nested_call_on_stop() -> TestResult {
+    let start = now();
+    let value = parallel(vec![map(2), map(2)]);
+    let mut tree = owner(&value, &json!([1, 2]), start)?;
+    let calls = pump(&mut tree, start, false)?;
+    assert_eq!(calls.len(), 4);
+    assert!(matches!(
+        tree.retired(calls.first().ok_or("first")?.0),
+        Err(FrameError::Event)
+    ));
+    let update = tree.stop(TaskFailure::new("Stopped", Some("requested"))?, start);
+    let mut cancels = Vec::new();
+    if let FrameUpdate::Cancel(call) = update {
+        cancels.push(call);
+    }
+    for _ in 0..100 {
+        match tree.advance(start, &mut SystemUuidSource::default()) {
+            FrameUpdate::Cancel(call) => cancels.push(call),
+            FrameUpdate::Settled(_) => break,
+            _ => {}
+        }
+    }
+    assert_eq!(cancels.len(), 4);
+    assert!(!tree.cleanup_ready());
+    for (call, _) in calls {
+        assert!(
+            tree.complete(
+                call,
+                Ok(Payload::parse(b"1")?),
+                start,
+                &mut SystemUuidSource::default()
+            )?
+            .is_none()
+        );
+        assert!(tree.retired(call)?);
+    }
+    assert!(tree.cleanup_ready());
+    assert!(matches!(
+        tree.outcome().map(AsRef::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_pin_first_observed_failure_and_emit_cancelled_child_notifications_before_recovery()
+-> TestResult {
+    let start = now();
+    let mut value = parallel(vec![task(), task()]);
+    value["States"]["Run"]["Catch"] = json!([{"ErrorEquals":["States.ALL"],"Next":"Handled"}]);
+    value["States"]["Handled"] = json!({"Type":"Succeed"});
+    let mut tree = owner(&value, &json!({}), start)?;
+    let calls = pump(&mut tree, start, false)?;
+    let first = calls.first().ok_or("first")?.0;
+    let second = calls.get(1).ok_or("second")?.0;
+    let _ = tree.complete(
+        first,
+        Err(TaskFailure::new("First", None)?),
+        start,
+        &mut SystemUuidSource::default(),
+    )?;
+    assert!(
+        tree.complete(
+            second,
+            Err(TaskFailure::new("Second", None)?),
+            start,
+            &mut SystemUuidSource::default()
+        )?
+        .is_none()
+    );
+    let mut cancelled = false;
+    for _ in 0..100 {
+        match tree.advance(start, &mut SystemUuidSource::default()) {
+            FrameUpdate::Cancel(call) => {
+                tree.retired(call)?;
+            }
+            FrameUpdate::ChildFinished { child, outcome, .. } if child == second.frame() => {
+                assert!(matches!(outcome.as_ref(), ExecutionOutcome::Aborted(_)));
+                cancelled = true;
+            }
+            FrameUpdate::Settled(_) => break,
+            _ => {}
+        }
+    }
+    assert!(cancelled);
+    assert_eq!(output(&tree)?.get("Error"), Some(&json!("First")));
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_inherit_exact_subsecond_deadline_and_prioritize_root_expiry() -> TestResult {
+    let start = now();
+    let mut value = parallel(vec![task()]);
+    value["TimeoutSeconds"] = json!(1);
+    let mut tree = owner(&value, &json!({}), start)?;
+    let calls = pump(&mut tree, after(start, 900), false)?;
+    let (call, dispatch) = calls.first().ok_or("missing call")?;
+    assert_eq!(dispatch.deadline(), after(start, 1000).monotonic);
+    assert_eq!(
+        tree.driver(call.frame()).ok_or("child")?.deadline(),
+        dispatch.deadline()
+    );
+    assert!(
+        tree.complete(
+            *call,
+            Ok(Payload::parse(b"1")?),
+            after(start, 1000),
+            &mut SystemUuidSource::default()
+        )?
+        .is_none()
+    );
+    assert!(matches!(
+        tree.outcome().map(AsRef::as_ref),
+        Some(ExecutionOutcome::TimedOut)
+    ));
+    pump(&mut tree, after(start, 1000), true)?;
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_fail_join_only_frame_exhaustion_without_business_retry_or_deadlock() -> TestResult {
+    let start = now();
+    let value = parallel(vec![parallel(vec![succeed()])]);
+    let capacity = Arc::new(FrameCapacity::default());
+    let mut tree = FrameScheduler::new(
+        driver(&value, &json!({}), start)?,
+        capacity.clone(),
+        FrameLimits::new(2, 4096)?,
+    )?;
+    pump(&mut tree, start, true)?;
+    assert_eq!(error(&tree)?, Some("Rustack.FrameLimitExceeded"));
+    assert!(tree.cleanup_ready());
+    assert_eq!(capacity.available_frames(), 4096);
+    Ok(())
+}
+
+#[test]
+fn test_should_park_capacity_pressure_while_an_existing_task_can_free_slots() -> TestResult {
+    let start = now();
+    let capacity = Arc::new(FrameCapacity::new(3, 1024 * 1024)?);
+    let mut tree = FrameScheduler::new(
+        driver(&map(2), &json!([1, 2, 3]), start)?,
+        capacity,
+        FrameLimits::new(3, 1024 * 1024)?,
+    )?;
+    let calls = pump(&mut tree, start, false)?;
+    assert_eq!(calls.len(), 2);
+    let first = calls.first().ok_or("first")?.0;
+    complete(&mut tree, first, &json!(10), start)?;
+    assert!(pump(&mut tree, start, false)?.is_empty());
+    assert!(tree.outcome().is_none());
+    tree.retired(first)?;
+    assert_eq!(pump(&mut tree, start, false)?.len(), 1);
+    Ok(())
+}
+
+#[rstest]
+#[case(true)]
+#[case(false)]
+fn test_should_charge_global_and_local_result_slots_before_retention(
+    #[case] local: bool,
+) -> TestResult {
+    let start = now();
+    let global = if local { 1024 * 1024 } else { 4096 };
+    let local_bytes = if local { 4096 } else { 1024 * 1024 };
+    let mut tree = FrameScheduler::new(
+        driver(&parallel(vec![succeed()]), &json!("x".repeat(3000)), start)?,
+        Arc::new(FrameCapacity::new(8, global)?),
+        FrameLimits::new(8, local_bytes)?,
+    )?;
+    pump(&mut tree, start, true)?;
+    assert_eq!(error(&tree)?, Some("Rustack.ResultLimitExceeded"));
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_recover_aggregate_data_limit_only_after_successful_sibling_retirement() -> TestResult
+{
+    let start = now();
+    let mut value = parallel(vec![task(), task()]);
+    value["States"]["Run"]["Catch"] =
+        json!([{"ErrorEquals":["States.DataLimitExceeded"],"Next":"Handled"}]);
+    value["States"]["Handled"] = json!({"Type":"Pass","Result":"recovered","End":true});
+    let mut tree = owner(&value, &json!({}), start)?;
+    let calls = pump(&mut tree, start, false)?;
+    for (call, _) in &calls {
+        complete(&mut tree, *call, &json!("x".repeat(131_071)), start)?;
+    }
+    pump(&mut tree, start, false)?;
+    assert!(tree.outcome().is_none());
+    for (call, _) in calls {
+        tree.retired(call)?;
+    }
+    pump(&mut tree, start, true)?;
+    assert_eq!(output(&tree)?, &json!("recovered"));
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_keep_terminal_business_origin_after_a_handled_evaluation_diagnostic() -> TestResult {
+    let start = now();
+    let branch = json!({"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:worker","Parameters":{"x":"x".repeat(262_144)},"Catch":[{"ErrorEquals":["States.DataLimitExceeded"],"Next":"Fail"}],"End":true},"Fail":{"Type":"Fail","Error":"BusinessFailure"}}});
+    let mut value = parallel(vec![branch]);
+    value["States"]["Run"]["Catch"] = json!([{"ErrorEquals":["BusinessFailure"],"Next":"Handled"}]);
+    value["States"]["Handled"] = json!({"Type":"Succeed"});
+    let mut tree = owner(&value, &json!({}), start)?;
+    assert!(pump(&mut tree, start, true)?.is_empty());
+    assert_eq!(output(&tree)?.get("Error"), Some(&json!("BusinessFailure")));
+    Ok(())
+}
+
+#[derive(Debug)]
+struct BrokenSource;
+impl UuidSource for BrokenSource {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        Err(AslError::InvalidStateId)
+    }
+}
+impl ExecutionSource for BrokenSource {
+    fn random_u64(&mut self) -> Result<u64, AslError> {
+        Err(AslError::InvalidStateId)
+    }
+}
+#[test]
+fn test_should_preserve_typed_child_internal_failure_across_nested_rounds() -> TestResult {
+    let start = now();
+    let branch =
+        definition(json!({"Type":"Pass","Parameters":{"uuid.$":"States.UUID()"},"End":true}));
+    let mut value = parallel(vec![parallel(vec![branch])]);
+    value["States"]["Run"]["Catch"] = json!([{"ErrorEquals":["States.ALL"],"Next":"Handled"}]);
+    value["States"]["Handled"] = json!({"Type":"Succeed"});
+    let mut tree = owner(&value, &json!({}), start)?;
+    for _ in 0..100 {
+        if matches!(
+            tree.advance(start, &mut BrokenSource),
+            FrameUpdate::Settled(_)
+        ) {
+            break;
+        }
+    }
+    assert_eq!(error(&tree)?, Some("Rustack.InternalError"));
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_share_root_transition_budget_across_all_frames() -> TestResult {
+    let start = now();
+    let mut root = driver(&parallel(vec![succeed(), succeed()]), &json!({}), start)?;
+    root.remaining = 2;
+    let mut tree = FrameScheduler::new(
+        root,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )?;
+    pump(&mut tree, start, true)?;
+    assert_eq!(error(&tree)?, Some("Rustack.TransitionLimitExceeded"));
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_wake_capacity_observer_after_releasing_the_actual_slot() -> TestResult {
+    let start = now();
+    let capacity = Arc::new(FrameCapacity::new(1, 4096)?);
+    let mut tree = FrameScheduler::new(
+        driver(&succeed(), &json!({}), start)?,
+        capacity.clone(),
+        FrameLimits::default(),
+    )?;
+    assert_eq!(capacity.available_frames(), 0);
+    let wait = capacity.wait_for_capacity(tokio::time::Instant::now() + Duration::from_secs(1));
+    let release = async {
+        tokio::task::yield_now().await;
+        pump(&mut tree, start, true)
+    };
+    let (observed, released) = tokio::join!(wait, release);
+    observed?;
+    released?;
+    assert_eq!(capacity.available_frames(), 1);
+    assert!(matches!(
+        capacity
+            .wait_for_capacity(tokio::time::Instant::now())
+            .await,
+        Err(FrameError::Deadline)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_root_admission_before_ownership_and_restore_budget_on_clean_finish()
+-> TestResult {
+    let start = now();
+    let capacity = Arc::new(FrameCapacity::new(1, 4096)?);
+    let mut first = FrameScheduler::new(
+        driver(&succeed(), &json!({}), start)?,
+        capacity.clone(),
+        FrameLimits::default(),
+    )?;
+    assert!(matches!(
+        FrameScheduler::new(
+            driver(&succeed(), &json!({}), start)?,
+            capacity.clone(),
+            FrameLimits::default()
+        ),
+        Err(FrameError::Capacity)
+    ));
+    pump(&mut first, start, true)?;
+    let mut second = FrameScheduler::new(
+        driver(&succeed(), &json!({}), start)?,
+        capacity,
+        FrameLimits::default(),
+    )?;
+    pump(&mut second, start, true)?;
+    assert!(second.cleanup_ready());
+    Ok(())
+}
+
+proptest! {
+ #![proptest_config(ProptestConfig::with_cases(64))]
+ #[test]
+ fn test_should_preserve_results_for_bounded_nested_map_parallel_trees(width in 1_usize..4,depth in 1_usize..5) {
+  let start=now();let mut machine=succeed();let mut input=json!(7);let mut expected=json!(7);
+  for level in 0..depth {
+   if level%2==0 {machine=definition(json!({"Type":"Map","ItemProcessor":machine,"End":true}));input=json!(vec![input;width]);}
+   else {machine=parallel(vec![machine;width]);}
+   expected=json!(vec![expected;width]);
+  }
+  let mut tree=owner(&machine,&input,start).map_err(|e|TestCaseError::fail(e.to_string()))?;
+  pump(&mut tree,start,true).map_err(|e|TestCaseError::fail(e.to_string()))?;
+  prop_assert_eq!(output(&tree).map_err(|e|TestCaseError::fail(e.to_string()))?,&expected);prop_assert!(tree.cleanup_ready());
+ }
+}
+
+#[test]
+fn test_should_hold_frame_charges_until_queued_success_notification_is_emitted() -> TestResult {
+    let start = now();
+    let capacity = Arc::new(FrameCapacity::new(3, 1024 * 1024)?);
+    let mut tree = FrameScheduler::new(
+        driver(&parallel(vec![task(), task()]), &json!({}), start)?,
+        capacity.clone(),
+        FrameLimits::default(),
+    )?;
+    let calls = pump(&mut tree, start, false)?;
+    let success = calls.first().ok_or("success")?.0;
+    let failed = calls.get(1).ok_or("failure")?.0;
+    complete(&mut tree, success, &json!("held".repeat(1000)), start)?;
+    let _ = tree.complete(
+        failed,
+        Err(TaskFailure::new("Oops", None)?),
+        start,
+        &mut SystemUuidSource::default(),
+    )?;
+    tree.retired(success)?;
+    tree.retired(failed)?;
+    assert!(!tree.pending.is_empty());
+    assert_eq!(capacity.available_frames(), 0);
+    assert_eq!(tree.frame_count(), 3);
+    let update = tree.advance(start, &mut SystemUuidSource::default());
+    let FrameUpdate::ChildFinished { child, outcome, .. } = update else {
+        return Err("expected retained notification".into());
+    };
+    assert_eq!(child, success.frame());
+    assert!(matches!(outcome.as_ref(), ExecutionOutcome::Succeeded(_)));
+    assert_eq!(capacity.available_frames(), 1);
+    pump(&mut tree, start, true)?;
+    assert_eq!(error(&tree)?, Some("Oops"));
+    assert!(tree.cleanup_ready());
+    assert_eq!(capacity.available_frames(), 3);
+    Ok(())
+}
+
+#[derive(Debug)]
+struct WorkSource;
+impl UuidSource for WorkSource {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        Err(AslError::WorkLimit)
+    }
+}
+impl ExecutionSource for WorkSource {
+    fn random_u64(&mut self) -> Result<u64, AslError> {
+        Err(AslError::WorkLimit)
+    }
+}
+#[test]
+fn test_should_preserve_recovery_failure_classification_cause_and_source_across_nested_rounds()
+-> TestResult {
+    let start = now();
+    let mut branch = task();
+    branch["States"]["Run"]["Retry"] = json!([{"ErrorEquals":["Oops"],"JitterStrategy":"FULL"}]);
+    let mut tree = owner(&parallel(vec![parallel(vec![branch])]), &json!({}), start)?;
+    let calls = pump(&mut tree, start, false)?;
+    let call = calls.first().ok_or("call")?.0;
+    let _ = tree.complete(
+        call,
+        Err(TaskFailure::new("Oops", None)?),
+        start,
+        &mut WorkSource,
+    )?;
+    pump(&mut tree, start, true)?;
+    assert_eq!(error(&tree)?, Some("Rustack.InternalError"));
+    let Some(outcome) = tree.outcome() else {
+        return Err("outcome".into());
+    };
+    let ExecutionOutcome::Failed(failure) = outcome.as_ref() else {
+        return Err("failure".into());
+    };
+    assert_eq!(failure.cause(), Some("Task recovery failed"));
+    assert!(
+        matches!(&failure.origin,FailureOrigin::Evaluation(source) if matches!(source.as_ref(),AslError::WorkLimit))
+    );
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_wake_wait_frames_and_report_task_timeout_without_releasing_its_call() -> TestResult {
+    let start = now();
+    let mut branch = task();
+    branch["States"]["Run"]["TimeoutSeconds"] = json!(1);
+    branch["States"]["Run"]["Catch"] = json!([{"ErrorEquals":["States.Timeout"],"Next":"Done"}]);
+    branch["States"]["Done"] = json!({"Type":"Pass","Result":"caught","End":true});
+    let mut tree = owner(&parallel(vec![branch]), &json!({}), start)?;
+    let calls = pump(&mut tree, start, false)?;
+    let call = calls.first().ok_or("call")?.0;
+    let later = after(start, 1000);
+    let mut timed_out = false;
+    for _ in 0..100 {
+        if let FrameUpdate::Transition(t) = tree.advance(later, &mut SystemUuidSource::default()) {
+            if t.timed_out_call() == Some(call) {
+                timed_out = true;
+                break;
+            }
+        }
+    }
+    assert!(timed_out);
+    pump(&mut tree, later, false)?;
+    assert_eq!(output(&tree)?, &json!(["caught"]));
+    assert!(!tree.cleanup_ready());
+    tree.retired(call)?;
+    assert!(tree.cleanup_ready());
+    let mut waiting = owner(
+        &parallel(vec![definition(
+            json!({"Type":"Wait","Seconds":1,"End":true}),
+        )]),
+        &json!(7),
+        start,
+    )?;
+    assert!(pump(&mut waiting, start, true)?.is_empty());
+    assert!(waiting.outcome().is_none());
+    pump(&mut waiting, later, true)?;
+    assert_eq!(output(&waiting)?, &json!([7]));
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_unretired_task_attempts_and_retain_all_prior_calls_on_exhaustion() -> TestResult
+{
+    let start = now();
+    let value = json!({"StartAt":"Run","States":{"Run":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:worker","Next":"Choice"},"Choice":{"Type":"Choice","Choices":[{"Variable":"$.again","BooleanEquals":true,"Next":"Run"}],"Default":"Done"},"Done":{"Type":"Succeed"}}});
+    let mut tree = owner(&value, &json!({}), start)?;
+    let mut owned = Vec::new();
+    for _ in 0..1024 {
+        let calls = pump(&mut tree, start, false)?;
+        assert_eq!(calls.len(), 1);
+        let call = calls.first().ok_or("call")?.0;
+        complete(&mut tree, call, &json!({"again":true}), start)?;
+        owned.push(call);
+    }
+    assert!(pump(&mut tree, start, false)?.is_empty());
+    assert_eq!(error(&tree)?, Some("Rustack.TaskOwnershipLimitExceeded"));
+    assert!(!tree.cleanup_ready());
+    for call in owned {
+        assert!(tree.retired(call)?);
+    }
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
+
+#[test]
+fn test_should_reject_invalid_frame_configuration_and_clock_regression() -> TestResult {
+    for (frames, bytes) in [
+        (0, 4096),
+        (513, 4096),
+        (1, 4095),
+        (1, 128 * 1024 * 1024 + 1),
+    ] {
+        assert!(matches!(
+            FrameLimits::new(frames, bytes),
+            Err(FrameError::Invalid)
+        ));
+    }
+    for (frames, bytes) in [
+        (0, 4096),
+        (4097, 4096),
+        (1, 4095),
+        (1, 1024 * 1024 * 1024 + 1),
+    ] {
+        assert!(matches!(
+            FrameCapacity::new(frames, bytes),
+            Err(FrameError::Invalid)
+        ));
+    }
+    let start = now();
+    let mut tree = owner(&parallel(vec![task()]), &json!({}), start)?;
+    pump(&mut tree, after(start, 10), false)?;
+    pump(&mut tree, start, true)?;
+    assert_eq!(error(&tree)?, Some("Rustack.InternalError"));
+    assert!(tree.cleanup_ready());
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/scheduler/types.rs b/crates/rustack-stepfunctions-core/src/engine/scheduler/types.rs
new file mode 100644
index 00000000..d5142534
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/scheduler/types.rs
@@ -0,0 +1,146 @@
+//! Opaque frame identities and typed actor/history effects.
+
+use std::{fmt, sync::Arc, time::Instant};
+
+use thiserror::Error;
+
+use crate::{AslError, AttemptId, CompiledMachine, DriverStep, ExecutionOutcome, Payload, StateId};
+
+macro_rules! get {
+    ($owner:ident,$name:ident,$out:ty,$s:ident=>$body:expr,$doc:literal) => {
+        #[doc=$doc]
+        #[doc=concat!("\n```\n# fn inspect(value: &rustack_stepfunctions_core::",stringify!($owner),") { let _=value.",stringify!($name),"(); }\n```")]
+        #[must_use] pub fn $name(&self)->$out { let $s=self; $body }
+    };
+}
+
+/// Monotonic scheduler-local identity, never reused for another child or retry.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[non_exhaustive]
+pub struct FrameId(pub(super) u64);
+
+/// A call identity includes its frame as well as its interpreter-local generation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[non_exhaustive]
+pub struct FrameCallId {
+    pub(super) frame: FrameId,
+    pub(super) attempt: AttemptId,
+}
+impl FrameCallId {
+    get!(FrameCallId,frame,FrameId,s=>s.frame,"Read the frame that owns this call.");
+    get!(FrameCallId,attempt,AttemptId,s=>s.attempt,"Read its frame-local attempt.");
+}
+
+/// Immutable causal linkage to the enclosing fanout round.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct FrameParent {
+    pub(super) frame: FrameId,
+    pub(super) round: AttemptId,
+    pub(super) index: usize,
+}
+impl FrameParent {
+    get!(FrameParent,frame,FrameId,s=>s.frame,"Read the enclosing frame.");
+    get!(FrameParent,round,AttemptId,s=>s.round,"Read the enclosing round generation.");
+    get!(FrameParent,index,usize,s=>s.index,"Read the definition/item result index.");
+}
+
+/// One interpreter transition, retaining the immutable information for causal history.
+#[non_exhaustive]
+pub struct FrameTransition {
+    pub(super) frame: FrameId,
+    pub(super) parent: Option<FrameParent>,
+    pub(super) machine: Arc<CompiledMachine>,
+    pub(super) state: StateId,
+    pub(super) entered: Option<Payload>,
+    pub(super) exited: Option<Payload>,
+    pub(super) timed_out: Option<FrameCallId>,
+    pub(super) step: DriverStep,
+    pub(crate) fanout_started: Option<usize>,
+    pub(crate) round_finished: Option<bool>,
+}
+impl fmt::Debug for FrameTransition {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("FrameTransition(<redacted>)")
+    }
+}
+impl FrameTransition {
+    get!(FrameTransition,frame,FrameId,s=>s.frame,"Read the frame that made this transition.");
+    get!(FrameTransition,parent,Option<FrameParent>,s=>s.parent,"Read its enclosing round linkage, if any.");
+    get!(FrameTransition,machine,&Arc<CompiledMachine>,s=>&s.machine,"Read the lexical instruction scope.");
+    get!(FrameTransition,state,StateId,s=>s.state,"Read the state before this transition.");
+    get!(FrameTransition,entered,Option<&Payload>,s=>s.entered.as_ref(),"Read raw input only when this step enters a new state.");
+    get!(FrameTransition,exited,Option<&Payload>,s=>s.exited.as_ref(),"Read output when this step exits a state successfully or through Catch.");
+    get!(FrameTransition,timed_out_call,Option<FrameCallId>,s=>s.timed_out,"Read a Task timeout requiring a history failure event.");
+    get!(FrameTransition,step,&DriverStep,s=>&s.step,"Read the interpreter effect; the scheduler owns any fanout plan.");
+    /// Read the complete call identity when the effect dispatches a Task.
+    ///
+    /// ```
+    /// # fn inspect(transition: &rustack_stepfunctions_core::FrameTransition) { let call=transition.call(); }
+    /// ```
+    #[must_use]
+    pub fn call(&self) -> Option<FrameCallId> {
+        self.step.task_attempt().map(|attempt| FrameCallId {
+            frame: self.frame,
+            attempt,
+        })
+    }
+}
+
+/// Bounded frame-tree updates consumed by the asynchronous resource/history owner.
+#[derive(Debug)]
+#[non_exhaustive]
+pub enum FrameUpdate {
+    /// Commit history before issuing its Task effect; fanout is already scheduler-owned.
+    Transition(Box<FrameTransition>),
+    /// One child was admitted; its first state has not yet run.
+    ChildStarted {
+        /// New non-reused identity.
+        child: FrameId,
+        /// Enclosing round and result index.
+        parent: FrameParent,
+    },
+    /// One child's business outcome was notified exactly once.
+    ChildFinished {
+        /// Completed child identity, possibly still awaiting resource retirement.
+        child: FrameId,
+        /// Enclosing round and result index.
+        parent: FrameParent,
+        /// Immutable business result.
+        outcome: Arc<ExecutionOutcome>,
+    },
+    /// Retire this resource; acknowledge only after its ownership is known settled.
+    Cancel(FrameCallId),
+    /// No local work can advance before a resource/timer/capacity event.
+    Park {
+        /// Earliest local timer, bounded by the root deadline.
+        until: Instant,
+        /// Also observe global frame-capacity release when true.
+        global_capacity: bool,
+    },
+    /// Yield after bounded queue scanning; try again without sleeping for IO.
+    Yield,
+    /// Stable root business result; cleanup readiness is an independent query.
+    Settled(Arc<ExecutionOutcome>),
+}
+
+/// Configuration/admission/protocol errors; business failures are scheduler outcomes.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum FrameError {
+    /// Invalid ceilings, already-started driver or invalid local identity.
+    #[error("invalid workflow frame configuration")]
+    Invalid,
+    /// The root could not reserve bounded frame admission.
+    #[error("workflow frame capacity exhausted")]
+    Capacity,
+    /// An active call was acknowledged without requesting retirement.
+    #[error("invalid workflow frame retirement event")]
+    Event,
+    /// Capacity observation timed out without altering ownership.
+    #[error("workflow frame observation deadline exceeded")]
+    Deadline,
+    /// A typed interpreter invariant or validated input failed.
+    #[error("workflow frame evaluation failed")]
+    Evaluation(#[from] AslError),
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/states.rs b/crates/rustack-stepfunctions-core/src/engine/states.rs
new file mode 100644
index 00000000..461bd307
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/states.rs
@@ -0,0 +1,202 @@
+//! Compiled frame instructions; no resource lifetime is hidden in evaluation.
+
+use std::time::{Duration, Instant};
+
+use serde_json::Value;
+
+use super::{
+    AttemptId, CallbackDispatch, ClockSample, Continuation, DriverStep, ExecutionDriver,
+    ExecutionFailure, ExecutionOutcome, ExecutionSource, Phase, TaskDispatch,
+    callback::CallbackIdentity,
+};
+use crate::{
+    AslError, DataFlow, FailureView, Integration, Payload, StateView, TaskTimeout, Transition,
+    compiler::TASK_SECONDS_LIMIT,
+};
+
+impl ExecutionDriver {
+    pub(super) fn execute<S: ExecutionSource + ?Sized>(
+        &mut self,
+        now: ClockSample,
+        source: &mut S,
+    ) -> Result<DriverStep, AslError> {
+        let machine = self.machine.clone();
+        match machine.state(self.state)? {
+            StateView::Parallel { .. } | StateView::Map { .. } => self.fanout(source),
+            StateView::Pass { flow, result, next } => {
+                let prepared = flow.prepare_with_source(&self.input, &self.context, source)?;
+                let result = result
+                    .map(Payload::from_value)
+                    .transpose()?
+                    .unwrap_or(prepared);
+                let output =
+                    flow.finish_with_source(&self.input, &result, &self.context, source)?;
+                Ok(self.transfer(output, next))
+            }
+            StateView::Succeed { flow } => {
+                let prepared = flow.prepare_with_source(&self.input, &self.context, source)?;
+                let output =
+                    flow.finish_with_source(&self.input, &prepared, &self.context, source)?;
+                Ok(self.settle(ExecutionOutcome::Succeeded(output)))
+            }
+            StateView::Fail { error, cause } => {
+                let error = self.failure_field(error, 256, source)?;
+                let cause = self.failure_field(cause, 32_768, source)?;
+                Ok(
+                    self.settle(ExecutionOutcome::Failed(ExecutionFailure::fields(
+                        error, cause,
+                    ))),
+                )
+            }
+            StateView::Choice {
+                flow,
+                branches,
+                default,
+            } => {
+                let prepared = flow.prepare_with_source(&self.input, &self.context, source)?;
+                let mut selected = None;
+                for (predicate, target) in branches {
+                    if predicate.evaluate(&prepared, &self.context)? {
+                        selected = Some(*target);
+                        break;
+                    }
+                }
+                let Some(target) = selected.or(default) else {
+                    return Ok(
+                        self.settle(ExecutionOutcome::Failed(ExecutionFailure::named(
+                            "States.NoChoiceMatched",
+                            "No Choice rule or default matched",
+                        ))),
+                    );
+                };
+                let output =
+                    flow.finish_with_source(&self.input, &prepared, &self.context, source)?;
+                Ok(self.transfer(output, Transition::Next(target)))
+            }
+            StateView::Wait {
+                flow,
+                source: wait,
+                next,
+            } => {
+                let prepared = flow.prepare_with_source(&self.input, &self.context, source)?;
+                let duration = wait.resolve(&prepared, &self.context, now.wall)?;
+                let output =
+                    flow.finish_with_source(&self.input, &prepared, &self.context, source)?;
+                if duration.is_zero() {
+                    return Ok(self.transfer(output, next));
+                }
+                let until = now
+                    .monotonic
+                    .checked_add(
+                        duration.min(self.deadline.saturating_duration_since(now.monotonic)),
+                    )
+                    .ok_or(AslError::InvalidExecution)?;
+                self.phase = Phase::Waiting {
+                    until,
+                    continuation: Continuation::Wait { output, next },
+                };
+                Ok(DriverStep::Park(until))
+            }
+            StateView::Task {
+                flow,
+                timeout,
+                resource,
+                ..
+            } => self.task(flow, timeout, resource, now, source),
+        }
+    }
+    fn task<S: ExecutionSource + ?Sized>(
+        &mut self,
+        flow: &DataFlow,
+        timeout: &TaskTimeout,
+        resource: &Integration,
+        now: ClockSample,
+        source: &mut S,
+    ) -> Result<DriverStep, AslError> {
+        let seconds = self.task_seconds(timeout)?;
+        let deadline = self.task_deadline(seconds, now.monotonic)?;
+        let heartbeat = if let Integration::LambdaCallback(heartbeat) = resource {
+            let heartbeat = self.task_seconds(heartbeat)?;
+            if heartbeat.is_some_and(|h| h >= seconds.unwrap_or(TASK_SECONDS_LIMIT)) {
+                return Err(AslError::WaitValue);
+            }
+            heartbeat.map(|s| Duration::from_secs(u64::from(s)))
+        } else {
+            None
+        };
+        // Callback templates require a real registered token. Ordinary
+        // Tasks retain their existing eager single-evaluation behavior.
+        let parameters = if matches!(resource, Integration::LambdaCallback(_)) {
+            None
+        } else {
+            Some(flow.prepare_with_source(&self.input, &self.context, source)?)
+        };
+        self.generation = self
+            .generation
+            .checked_add(1)
+            .ok_or(AslError::InvalidExecution)?;
+        let attempt = AttemptId(self.generation);
+        self.phase = Phase::Calling { attempt, deadline };
+        Ok(match parameters {
+            Some(parameters) => DriverStep::Dispatch(TaskDispatch {
+                attempt,
+                state: self.state,
+                parameters,
+                deadline,
+            }),
+            None => DriverStep::Callback(CallbackDispatch {
+                identity: CallbackIdentity {
+                    attempt,
+                    state: self.state,
+                    deadline,
+                    timeout: seconds,
+                    heartbeat,
+                },
+                machine: self.machine.clone(),
+                input: self.input.clone(),
+                context: self.context.clone(),
+            }),
+        })
+    }
+    fn failure_field<S: ExecutionSource + ?Sized>(
+        &self,
+        field: FailureView<'_>,
+        max: usize,
+        source: &mut S,
+    ) -> Result<Option<String>, AslError> {
+        let value = match field {
+            FailureView::Omitted => return Ok(None),
+            FailureView::Literal(value) => return Ok(Some(value.into())),
+            FailureView::Dynamic(expression) => {
+                expression.evaluate_with_source(&self.input, &self.context, source)?
+            }
+        };
+        let text = value.value().as_str().ok_or(AslError::InvalidFailure)?;
+        if text.len() > max {
+            return Err(AslError::InvalidFailure);
+        }
+        Ok(Some(text.into()))
+    }
+    fn task_seconds(&self, timeout: &TaskTimeout) -> Result<Option<u32>, AslError> {
+        match timeout {
+            TaskTimeout::Omitted => Ok(None),
+            TaskTimeout::Seconds(seconds) => Ok(Some(seconds.get())),
+            TaskTimeout::Path(path) => {
+                let value = path
+                    .lookup(&self.input, &self.context)
+                    .and_then(Value::as_u64)
+                    .filter(|s| (1..=u64::from(TASK_SECONDS_LIMIT)).contains(s))
+                    .ok_or(AslError::WaitValue)?;
+                Ok(Some(u32::try_from(value).map_err(|_| AslError::WaitValue)?))
+            }
+        }
+    }
+    fn task_deadline(&self, seconds: Option<u32>, now: Instant) -> Result<Instant, AslError> {
+        let Some(seconds) = seconds else {
+            return Ok(self.deadline);
+        };
+        let remaining = self.deadline.saturating_duration_since(now);
+        now.checked_add(Duration::from_secs(u64::from(seconds)).min(remaining))
+            .ok_or(AslError::InvalidExecution)
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/tests.rs b/crates/rustack-stepfunctions-core/src/engine/tests.rs
new file mode 100644
index 00000000..9c9b3ffe
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/tests.rs
@@ -0,0 +1,837 @@
+//! Explicit-clock execution fixtures; no fake service is installed in production.
+
+use std::{
+    collections::VecDeque,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use chrono::{DateTime, Utc};
+use rstest::rstest;
+use serde_json::{Value, json};
+use uuid::Uuid;
+
+use crate::{
+    AslCompiler, AslError, ClockSample, DriverStep, EvaluationContext, ExecutionDriver,
+    ExecutionLimits, ExecutionOutcome, ExecutionSource, Payload, SystemUuidSource, TaskDispatch,
+    TaskFailure, TaskSupport, TenantScope, UuidSource,
+};
+
+#[derive(Default)]
+struct Source {
+    draws: VecDeque<u64>,
+    count: usize,
+}
+impl UuidSource for Source {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        Ok(Uuid::from_bytes([
+            0, 0, 0, 0, 0, 0, 0x40, 0, 0x80, 0, 0, 0, 0, 0, 0, 1,
+        ]))
+    }
+}
+impl ExecutionSource for Source {
+    fn random_u64(&mut self) -> Result<u64, AslError> {
+        self.count += 1;
+        Ok(self.draws.pop_front().unwrap_or(u64::MAX))
+    }
+}
+fn now(base: Instant, seconds: u64) -> ClockSample {
+    ClockSample::new(
+        base + Duration::from_secs(seconds),
+        DateTime::parse_from_rfc3339("2026-10-26T00:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc)
+            + chrono::Duration::seconds(seconds.try_into().unwrap()),
+    )
+}
+fn driver(definition: &Value, input: &Value) -> (ExecutionDriver, Instant) {
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(&serde_json::to_vec(definition).unwrap())
+        .unwrap()
+        .machine()
+        .clone();
+    let context=EvaluationContext::from_value(&json!({"Execution":{"Input":input,"Id":"execution-test"},"StateMachine":{"Id":"machine-test"}})).unwrap();
+    let base = Instant::now();
+    (
+        ExecutionDriver::new(
+            machine,
+            Payload::from_value(input).unwrap(),
+            context,
+            now(base, 0),
+            ExecutionLimits::new(Duration::from_secs(100), 100).unwrap(),
+        )
+        .unwrap(),
+        base,
+    )
+}
+fn task(extra: &Value) -> Value {
+    let mut state = json!({"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true});
+    state
+        .as_object_mut()
+        .unwrap()
+        .extend(extra.as_object().unwrap().clone());
+    json!({"StartAt":"Work","States":{"Work":state,"Caught":{"Type":"Succeed"}}})
+}
+fn dispatch(d: &mut ExecutionDriver, base: Instant, seconds: u64) -> TaskDispatch {
+    match d.advance(now(base, seconds), &mut Source::default()).step {
+        DriverStep::Dispatch(call) => call,
+        step => panic!("expected dispatch, got {step:?}"),
+    }
+}
+fn failure(d: &ExecutionDriver) -> &str {
+    match d.outcome().unwrap().as_ref() {
+        ExecutionOutcome::Failed(failure) => failure.error().unwrap_or("<omitted>"),
+        outcome => panic!("expected failure, got {outcome:?}"),
+    }
+}
+fn output(d: &ExecutionDriver) -> &Value {
+    match d.outcome().unwrap().as_ref() {
+        ExecutionOutcome::Succeeded(output) => output.value(),
+        outcome => panic!("expected success, got {outcome:?}"),
+    }
+}
+fn fail_task(
+    d: &mut ExecutionDriver,
+    call: &TaskDispatch,
+    base: Instant,
+    seconds: u64,
+    error: &str,
+) -> crate::DriverUpdate {
+    d.complete(
+        call.attempt(),
+        Err(TaskFailure::new(error, Some("reason")).unwrap()),
+        now(base, seconds),
+        &mut Source::default(),
+    )
+}
+fn wake(d: &mut ExecutionDriver, base: Instant, seconds: u64) {
+    assert!(matches!(
+        d.advance(now(base, seconds), &mut Source::default()).step,
+        DriverStep::Continue
+    ));
+}
+
+#[test]
+fn test_should_reject_invalid_driver_settings_and_context() {
+    for (duration, transitions) in [(0, 1), (31_536_001, 1), (1, 0), (1, 1_000_001)] {
+        assert!(matches!(
+            ExecutionLimits::new(Duration::from_secs(duration), transitions),
+            Err(AslError::InvalidExecution)
+        ));
+    }
+    let (d, base) = driver(
+        &json!({"StartAt":"Done","States":{"Done":{"Type":"Succeed"}}}),
+        &json!({}),
+    );
+    let scalar = Payload::parse(b"null").unwrap();
+    assert!(matches!(
+        ExecutionDriver::new(
+            d.machine().clone(),
+            scalar.clone(),
+            EvaluationContext::from(&scalar),
+            now(base, 0),
+            ExecutionLimits::default()
+        ),
+        Err(AslError::InvalidExecution)
+    ));
+    assert!(ExecutionLimits::new(Duration::from_hours(8760), 1_000_000).is_ok());
+}
+
+#[test]
+fn test_should_execute_pass_against_original_input_and_succeed_paths() {
+    let (mut d, base) = driver(
+        &json!({"StartAt":"Prepare","States":{
+            "Prepare":{"Type":"Pass","InputPath":"$.data","Parameters":{"value.$":"$.n","name.$":"$$.State.Name"},"ResultPath":"$.answer","Next":"Done"},
+            "Done":{"Type":"Succeed","InputPath":"$.answer","OutputPath":"$.value"}
+        }}),
+        &json!({"data":{"n":7},"keep":true}),
+    );
+    wake(&mut d, base, 0);
+    assert_eq!(
+        d.input().value(),
+        &json!({"data":{"n":7},"keep":true,"answer":{"value":7,"name":"Prepare"}})
+    );
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(output(&d), &json!(7));
+}
+
+#[test]
+fn test_should_use_static_pass_result_and_null_paths() {
+    let (mut d, base) = driver(
+        &json!({"StartAt":"P","States":{"P":{"Type":"Pass","InputPath":null,"Result":{"answer":42},"OutputPath":"$.answer","End":true}}}),
+        &json!([1, 2]),
+    );
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(output(&d), &json!(42));
+}
+
+#[test]
+fn test_should_evaluate_choice_on_effective_input_and_preserve_branch_order() {
+    let (mut d, base) = driver(
+        &json!({"StartAt":"Choose","States":{
+            "Choose":{"Type":"Choice","InputPath":"$.data","OutputPath":"$.n","Choices":[{"Variable":"$.n","NumericEquals":2,"Next":"Done"},{"Variable":"$.missing","NumericEquals":1,"Next":"Fail"}],"Default":"Fail"},
+            "Done":{"Type":"Succeed"},"Fail":{"Type":"Fail"}
+        }}),
+        &json!({"data":{"n":2},"keep":true}),
+    );
+    wake(&mut d, base, 0);
+    assert_eq!(d.input().value(), &json!(2));
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(output(&d), &json!(2));
+}
+
+#[rstest]
+#[case(false, "States.NoChoiceMatched")]
+#[case(true, "States.Runtime")]
+fn test_should_fail_unmatched_or_unevaluable_choice(#[case] missing: bool, #[case] error: &str) {
+    let variable = if missing { "$.missing" } else { "$.n" };
+    let (mut d, base) = driver(
+        &json!({"StartAt":"C","States":{"C":{"Type":"Choice","Choices":[{"Variable":variable,"NumericEquals":2,"Next":"Done"}]},"Done":{"Type":"Succeed"}}}),
+        &json!({"n":1}),
+    );
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(failure(&d), error);
+}
+
+#[rstest]
+#[case(json!({}),None,None)]
+#[case(json!({"Error":"","Cause":"literal"}),Some(""),Some("literal"))]
+#[case(json!({"ErrorPath":"$.error","CausePath":"States.Format('item {}', $.n)"}),Some("BusinessError"),Some("item 3"))]
+fn test_should_preserve_fail_omission_and_dynamic_string_fields(
+    #[case] fields: Value,
+    #[case] error: Option<&str>,
+    #[case] cause: Option<&str>,
+) {
+    let mut state = json!({"Type":"Fail"});
+    state
+        .as_object_mut()
+        .unwrap()
+        .extend(fields.as_object().unwrap().clone());
+    let (mut d, base) = driver(
+        &json!({"StartAt":"F","States":{"F":state}}),
+        &json!({"error":"BusinessError","n":3}),
+    );
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    match d.outcome().unwrap().as_ref() {
+        ExecutionOutcome::Failed(f) => {
+            assert_eq!(f.error(), error);
+            assert_eq!(f.cause(), cause);
+        }
+        other => panic!("unexpected {other:?}"),
+    }
+}
+
+#[rstest]
+#[case(json!(3))]
+#[case(json!("x".repeat(257)))]
+fn test_should_reject_invalid_dynamic_fail_values(#[case] value: Value) {
+    let (mut d, base) = driver(
+        &json!({"StartAt":"F","States":{"F":{"Type":"Fail","ErrorPath":"$.error"}}}),
+        &json!({"error":value}),
+    );
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(failure(&d), "States.Runtime");
+    assert!(matches!(d.diagnostic(), Some(AslError::InvalidFailure)));
+}
+
+#[rstest]
+#[case(json!({"Seconds":3}))]
+#[case(json!({"SecondsPath":"$.seconds"}))]
+#[case(json!({"Timestamp":"2026-10-26T00:00:03.999Z"}))]
+#[case(json!({"TimestampPath":"$.date"}))]
+fn test_should_park_wait_once_despite_wall_clock_jumps(#[case] source: Value) {
+    let mut state = json!({"Type":"Wait","InputPath":"$.data","OutputPath":"$.seconds","End":true});
+    state
+        .as_object_mut()
+        .unwrap()
+        .extend(source.as_object().unwrap().clone());
+    let (mut d, base) = driver(
+        &json!({"StartAt":"W","States":{"W":state}}),
+        &json!({"data":{"seconds":3,"date":"2026-10-26T00:00:03Z"}}),
+    );
+    assert!(
+        matches!(d.advance(now(base,0),&mut Source::default()).step,DriverStep::Park(t) if t==base+Duration::from_secs(3))
+    );
+    let mut jumped = now(base, 1);
+    jumped.wall += chrono::Duration::days(30);
+    assert!(
+        matches!(d.advance(jumped,&mut Source::default()).step,DriverStep::Park(t) if t==base+Duration::from_secs(3))
+    );
+    let mut back = now(base, 3);
+    back.wall -= chrono::Duration::days(30);
+    let _ = d.advance(back, &mut Source::default());
+    assert_eq!(output(&d), &json!(3));
+}
+
+#[test]
+fn test_should_finish_zero_wait_immediately_and_bound_long_wait_by_execution_deadline() {
+    let (mut zero, base) = driver(
+        &json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":0,"End":true}}}),
+        &json!(true),
+    );
+    let _ = zero.advance(now(base, 0), &mut Source::default());
+    assert_eq!(output(&zero), &json!(true));
+    let (mut long, base) = driver(
+        &json!({"TimeoutSeconds":2,"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":30,"End":true}}}),
+        &json!({}),
+    );
+    assert!(
+        matches!(long.advance(now(base,0),&mut Source::default()).step,DriverStep::Park(t) if t==base+Duration::from_secs(2))
+    );
+    let _ = long.advance(now(base, 2), &mut Source::default());
+    assert!(matches!(
+        long.outcome().unwrap().as_ref(),
+        ExecutionOutcome::TimedOut
+    ));
+}
+
+#[test]
+fn test_should_prepare_task_and_merge_selected_result_into_raw_input() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"InputPath":"$.data","Parameters":{"sent.$":"$.n"},"ResultSelector":{"picked.$":"$.value"},"ResultPath":"$.result"}),
+        ),
+        &json!({"data":{"n":7},"keep":true}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    assert_eq!(call.parameters().value(), &json!({"sent":7}));
+    let _ = d.complete(
+        call.attempt(),
+        Ok(Payload::from_value(&json!({"value":8})).unwrap()),
+        now(base, 1),
+        &mut Source::default(),
+    );
+    assert_eq!(
+        output(&d),
+        &json!({"data":{"n":7},"keep":true,"result":{"picked":8}})
+    );
+}
+
+#[test]
+fn test_should_resolve_timeout_path_from_raw_input_before_parameters() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"InputPath":"$.data","Parameters":{"timeout":90},"TimeoutSecondsPath":"$.timeout"}),
+        ),
+        &json!({"timeout":2,"data":{"timeout":70}}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    assert_eq!(call.parameters().value(), &json!({"timeout":90}));
+    assert_eq!(call.deadline(), base + Duration::from_secs(2));
+}
+
+#[rstest]
+#[case(json!(0))]
+#[case(json!(-1))]
+#[case(json!(1.0))]
+#[case(json!(100_000_000))]
+#[case(json!("2"))]
+#[case(Value::Null)]
+fn test_should_reject_dynamic_timeout_values_before_dispatch(#[case] value: Value) {
+    let (mut d, base) = driver(
+        &task(&json!({"TimeoutSecondsPath":"$.timeout"})),
+        &json!({"timeout":value}),
+    );
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(failure(&d), "States.Runtime");
+}
+
+#[test]
+fn test_should_retry_with_original_input_fresh_attempt_and_preserved_entry_time() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"Parameters":{"n.$":"$.n","retry.$":"$$.State.RetryCount","time.$":"$$.State.EnteredTime","uuid.$":"States.UUID()"},"Retry":[{"ErrorEquals":["Oops"],"MaxAttempts":1}]}),
+        ),
+        &json!({"n":7}),
+    );
+    let first = dispatch(&mut d, base, 0);
+    assert_eq!(first.parameters().value().get("retry"), Some(&json!(0)));
+    let result = fail_task(&mut d, &first, base, 1, "Oops");
+    assert!(matches!(result.step,DriverStep::Park(t) if t==base+Duration::from_secs(2)));
+    assert_eq!(d.retry_count(), 1);
+    wake(&mut d, base, 2);
+    let second = dispatch(&mut d, base, 2);
+    assert_ne!(first.attempt(), second.attempt());
+    assert_eq!(second.parameters().value().get("retry"), Some(&json!(1)));
+    assert_eq!(
+        first.parameters().value().get("time"),
+        second.parameters().value().get("time")
+    );
+    assert_eq!(d.input().value(), &json!({"n":7}));
+    let stale = d.complete(
+        first.attempt(),
+        Ok(Payload::parse(b"0").unwrap()),
+        now(base, 2),
+        &mut Source::default(),
+    );
+    assert!(matches!(stale.step, DriverStep::Park(_)));
+    assert!(d.outcome().is_none());
+    let _ = d.complete(
+        second.attempt(),
+        Ok(Payload::parse(b"9").unwrap()),
+        now(base, 3),
+        &mut Source::default(),
+    );
+    assert_eq!(output(&d), &json!(9));
+}
+
+#[test]
+fn test_should_track_retries_per_matcher_and_not_fall_through_exhausted_first_match() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"Retry":[{"ErrorEquals":["A"],"MaxAttempts":1},{"ErrorEquals":["B"],"MaxAttempts":1},{"ErrorEquals":["States.ALL"],"MaxAttempts":5}],"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Caught","ResultPath":"$.failure"}]}),
+        ),
+        &json!({"keep":true}),
+    );
+    let first = dispatch(&mut d, base, 0);
+    let _ = fail_task(&mut d, &first, base, 0, "A");
+    wake(&mut d, base, 1);
+    let second = dispatch(&mut d, base, 1);
+    let _ = fail_task(&mut d, &second, base, 1, "B");
+    wake(&mut d, base, 2);
+    let third = dispatch(&mut d, base, 2);
+    let _ = fail_task(&mut d, &third, base, 2, "A");
+    assert_eq!(
+        d.input().value(),
+        &json!({"keep":true,"failure":{"Error":"A","Cause":"reason"}})
+    );
+    let _ = d.advance(now(base, 2), &mut Source::default());
+    assert_eq!(d.retry_count(), 0);
+    assert!(matches!(
+        d.outcome().unwrap().as_ref(),
+        ExecutionOutcome::Succeeded(_)
+    ));
+}
+
+#[rstest]
+#[case(Value::Null,json!({"keep":true}))]
+#[case(json!("$"),json!({"Error":"Oops","Cause":"reason"}))]
+#[case(json!("$.error"),json!({"keep":true,"error":{"Error":"Oops","Cause":"reason"}}))]
+fn test_should_apply_catch_result_path_after_zero_retry(
+    #[case] path: Value,
+    #[case] expected: Value,
+) {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"Retry":[{"ErrorEquals":["Oops"],"MaxAttempts":0},{"ErrorEquals":["States.ALL"]}],"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Caught","ResultPath":path}]}),
+        ),
+        &json!({"keep":true}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    let _ = fail_task(&mut d, &call, base, 0, "Oops");
+    assert_eq!(d.input().value(), &expected);
+}
+
+#[test]
+fn test_should_use_capped_exponential_backoff_and_saturate_huge_rate() {
+    for (rate, second) in [(3.0, 4), (1e308, 4)] {
+        let (mut d, base) = driver(
+            &task(
+                &json!({"Retry":[{"ErrorEquals":["Oops"],"IntervalSeconds":2,"BackoffRate":rate,"MaxDelaySeconds":4,"MaxAttempts":2}]}),
+            ),
+            &json!({}),
+        );
+        let first = dispatch(&mut d, base, 0);
+        assert!(
+            matches!(fail_task(&mut d,&first,base,0,"Oops").step,DriverStep::Park(t) if t==base+Duration::from_secs(2))
+        );
+        wake(&mut d, base, 2);
+        let second_call = dispatch(&mut d, base, 2);
+        assert!(
+            matches!(fail_task(&mut d,&second_call,base,2,"Oops").step,DriverStep::Park(t) if t==base+Duration::from_secs(2+second))
+        );
+    }
+}
+
+#[test]
+fn test_should_sample_full_jitter_with_bounded_unbiased_rejection() {
+    let (mut d, base) = driver(
+        &task(&json!({"Retry":[{"ErrorEquals":["Oops"],"JitterStrategy":"FULL"}]})),
+        &json!({}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    let mut source = Source {
+        draws: VecDeque::from([0, u64::MAX]),
+        count: 0,
+    };
+    let update = d.complete(
+        call.attempt(),
+        Err(TaskFailure::new("Oops", None).unwrap()),
+        now(base, 0),
+        &mut source,
+    );
+    let expected = Duration::from_nanos(u64::MAX % 1_000_000_001);
+    assert!(matches!(update.step,DriverStep::Park(t) if t==base+expected));
+    assert_eq!(source.count, 2);
+    let (mut d, base) = driver(
+        &task(&json!({"Retry":[{"ErrorEquals":["Oops"],"JitterStrategy":"FULL"}]})),
+        &json!({}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    let mut source = Source {
+        draws: VecDeque::from(vec![0; 128]),
+        count: 0,
+    };
+    let _ = d.complete(
+        call.attempt(),
+        Err(TaskFailure::new("Oops", None).unwrap()),
+        now(base, 0),
+        &mut source,
+    );
+    assert_eq!(source.count, 128);
+    assert_eq!(failure(&d), "Rustack.InternalError");
+}
+
+#[test]
+fn test_should_not_resume_retry_at_overall_deadline() {
+    let mut definition = task(&json!({"Retry":[{"ErrorEquals":["Oops"],"IntervalSeconds":99}]}));
+    definition["TimeoutSeconds"] = json!(3);
+    let (mut d, base) = driver(&definition, &json!({}));
+    let call = dispatch(&mut d, base, 0);
+    assert!(
+        matches!(fail_task(&mut d,&call,base,1,"Oops").step,DriverStep::Park(t) if t==base+Duration::from_secs(3))
+    );
+    let _ = d.advance(now(base, 3), &mut Source::default());
+    assert!(matches!(
+        d.outcome().unwrap().as_ref(),
+        ExecutionOutcome::TimedOut
+    ));
+}
+
+#[test]
+fn test_should_cancel_exact_task_deadline_once_and_recover_timeout() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"TimeoutSeconds":2,"Catch":[{"ErrorEquals":["States.Timeout"],"Next":"Caught"}]}),
+        ),
+        &json!({}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    let result = d.complete(
+        call.attempt(),
+        Ok(Payload::parse(b"true").unwrap()),
+        now(base, 2),
+        &mut Source::default(),
+    );
+    assert_eq!(result.cancellation(), Some(call.attempt()));
+    assert!(matches!(result.step, DriverStep::Continue));
+    let duplicate = d.complete(
+        call.attempt(),
+        Ok(Payload::parse(b"false").unwrap()),
+        now(base, 2),
+        &mut Source::default(),
+    );
+    assert_eq!(duplicate.cancellation(), None);
+    let _ = d.advance(now(base, 2), &mut Source::default());
+    assert_eq!(output(&d).get("Error"), Some(&json!("States.Timeout")));
+}
+
+#[test]
+fn test_should_prioritize_execution_deadline_over_task_result_and_stop() {
+    for stop in [false, true] {
+        let mut definition = task(
+            &json!({"TimeoutSeconds":2,"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Caught"}]}),
+        );
+        definition["TimeoutSeconds"] = json!(2);
+        let (mut d, base) = driver(&definition, &json!({}));
+        let call = dispatch(&mut d, base, 0);
+        let update = if stop {
+            d.stop(TaskFailure::new("Stopped", None).unwrap(), now(base, 2))
+        } else {
+            d.complete(
+                call.attempt(),
+                Ok(Payload::parse(b"1").unwrap()),
+                now(base, 2),
+                &mut Source::default(),
+            )
+        };
+        assert_eq!(update.cancellation(), Some(call.attempt()));
+        assert!(matches!(
+            d.outcome().unwrap().as_ref(),
+            ExecutionOutcome::TimedOut
+        ));
+    }
+}
+
+#[test]
+fn test_should_settle_stop_once_ignore_late_completion_and_preserve_terminal_arc() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"Retry":[{"ErrorEquals":["States.ALL"]}],"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Caught"}]}),
+        ),
+        &json!({}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    let stopped = d.stop(
+        TaskFailure::new("Stopped", Some("cancel")).unwrap(),
+        now(base, 1),
+    );
+    assert_eq!(stopped.cancellation(), Some(call.attempt()));
+    let outcome = d.outcome().unwrap().clone();
+    assert!(matches!(outcome.as_ref(), ExecutionOutcome::Aborted(_)));
+    let result = d.complete(
+        call.attempt(),
+        Ok(Payload::parse(b"true").unwrap()),
+        now(base, 2),
+        &mut Source::default(),
+    );
+    assert_eq!(result.cancellation(), None);
+    let _ = d.stop(TaskFailure::new("Other", None).unwrap(), now(base, 0));
+    assert!(Arc::ptr_eq(&outcome, d.outcome().unwrap()));
+}
+
+#[test]
+fn test_should_ignore_duplicate_success_and_fail_clock_regression_with_cleanup_obligation() {
+    let (mut d, base) = driver(&task(&json!({})), &json!({}));
+    let call = dispatch(&mut d, base, 1);
+    let update = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(update.cancellation(), Some(call.attempt()));
+    assert_eq!(failure(&d), "Rustack.InternalError");
+    let (mut d, base) = driver(&task(&json!({})), &json!({}));
+    let call = dispatch(&mut d, base, 0);
+    let _ = d.complete(
+        call.attempt(),
+        Ok(Payload::parse(b"1").unwrap()),
+        now(base, 1),
+        &mut Source::default(),
+    );
+    let _ = fail_task(&mut d, &call, base, 2, "Oops");
+    assert_eq!(output(&d), &json!(1));
+}
+
+#[test]
+fn test_should_not_catch_runtime_or_wildcard_data_limit_but_allow_explicit_data_limit() {
+    for (error, catch_name, handled) in [
+        ("States.Runtime", "States.Runtime", false),
+        ("States.DataLimitExceeded", "States.ALL", false),
+        ("States.DataLimitExceeded", "States.DataLimitExceeded", true),
+    ] {
+        let (mut d, base) = driver(
+            &task(&json!({"Catch":[{"ErrorEquals":[catch_name],"Next":"Caught"}]})),
+            &json!({}),
+        );
+        let call = dispatch(&mut d, base, 0);
+        let _ = fail_task(&mut d, &call, base, 0, error);
+        assert_eq!(d.outcome().is_none(), handled);
+        if !handled {
+            assert_eq!(failure(&d), error);
+        }
+    }
+}
+
+#[test]
+fn test_should_fail_tight_loop_with_transition_limit_and_allow_exact_budget() {
+    let (mut d, base) = driver(
+        &json!({"StartAt":"Loop","States":{"Loop":{"Type":"Choice","Choices":[{"Variable":"$","BooleanEquals":true,"Next":"Loop"}],"Default":"Done"},"Done":{"Type":"Succeed"}}}),
+        &json!(true),
+    );
+    d.remaining = 3;
+    for _ in 0..3 {
+        wake(&mut d, base, 0);
+    }
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(failure(&d), "Rustack.TransitionLimitExceeded");
+    let (mut d, base) = driver(
+        &json!({"StartAt":"P","States":{"P":{"Type":"Pass","Next":"Done"},"Done":{"Type":"Succeed"}}}),
+        &json!(true),
+    );
+    d.remaining = 2;
+    wake(&mut d, base, 0);
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    assert_eq!(output(&d), &json!(true));
+}
+
+#[test]
+fn test_should_validate_failure_bounds_and_redact_sensitive_driver_data() {
+    assert!(TaskFailure::new("", None).is_err());
+    assert!(TaskFailure::new("x\ny", None).is_err());
+    assert!(TaskFailure::new(&"x".repeat(257), None).is_err());
+    assert!(TaskFailure::new("Error", Some(&"x".repeat(32_769))).is_err());
+    let (mut d, base) = driver(&task(&json!({})), &json!({"secret":"sensitive-marker"}));
+    let call = dispatch(&mut d, base, 0);
+    assert!(!format!("{call:?} {d:?}").contains("sensitive-marker"));
+    let _ = fail_task(&mut d, &call, base, 1, "sensitive-marker");
+    assert!(!format!("{d:?}").contains("sensitive-marker"));
+}
+
+#[test]
+fn test_should_support_real_system_source_for_nonblocking_pure_callers() {
+    let source = &mut SystemUuidSource::default();
+    let _ = source.random_u64().unwrap();
+}
+
+#[test]
+fn test_should_fail_exhausted_retry_budget_before_scheduling_a_timer() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"Retry":[{"ErrorEquals":["Oops"],"IntervalSeconds":99,"JitterStrategy":"FULL"}]}),
+        ),
+        &json!({}),
+    );
+    d.remaining = 1;
+    let call = dispatch(&mut d, base, 0);
+    let mut source = Source::default();
+    let result = d.complete(
+        call.attempt(),
+        Err(TaskFailure::new("Oops", None).unwrap()),
+        now(base, 1),
+        &mut source,
+    );
+    assert!(matches!(result.step, DriverStep::Settled(_)));
+    assert_eq!(failure(&d), "Rustack.TransitionLimitExceeded");
+    assert_eq!(d.retry_count(), 0);
+    assert_eq!(source.count, 0);
+}
+
+#[test]
+fn test_should_classify_failed_catch_merge_as_runtime_without_retrying_recovery() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"Catch":[{"ErrorEquals":["States.ALL"],"ResultPath":"$.scalar.child","Next":"Caught"}]}),
+        ),
+        &json!({"scalar":1}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    let _ = fail_task(&mut d, &call, base, 0, "Oops");
+    assert_eq!(failure(&d), "States.Runtime");
+    assert!(matches!(d.diagnostic(), Some(AslError::Merge)));
+}
+
+#[test]
+fn test_should_recover_explicit_result_and_parameter_data_limits() {
+    for field in ["Parameters", "ResultSelector"] {
+        let mut extra = json!({"Catch":[{"ErrorEquals":["States.DataLimitExceeded"],"ResultPath":null,"Next":"Caught"}]});
+        // The source template fits1MiB, but the expanded payload exceeds256KiB.
+        extra[field] = json!({"large":"x".repeat(131_073),"more":"x".repeat(131_073)});
+        let (mut d, base) = driver(&task(&extra), &json!({"keep":true}));
+        let first = d.advance(now(base, 0), &mut Source::default());
+        if field == "ResultSelector" {
+            let DriverStep::Dispatch(call) = first.step else {
+                panic!("expected Task")
+            };
+            let _ = d.complete(
+                call.attempt(),
+                Ok(Payload::parse(b"{}").unwrap()),
+                now(base, 0),
+                &mut Source::default(),
+            );
+        } else {
+            assert!(matches!(first.step, DriverStep::Continue));
+        }
+        assert!(matches!(d.diagnostic(), Some(AslError::DataLimit)));
+        let _ = d.advance(now(base, 0), &mut Source::default());
+        assert_eq!(output(&d), &json!({"keep":true}));
+    }
+}
+
+#[test]
+fn test_should_fail_uncatchable_result_selection_errors() {
+    let (mut d, base) = driver(
+        &task(
+            &json!({"ResultSelector":{"missing.$":"$.missing"},"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Caught"}]}),
+        ),
+        &json!({}),
+    );
+    let call = dispatch(&mut d, base, 0);
+    let _ = d.complete(
+        call.attempt(),
+        Ok(Payload::parse(b"{}").unwrap()),
+        now(base, 0),
+        &mut Source::default(),
+    );
+    assert_eq!(failure(&d), "States.Runtime");
+    assert!(matches!(d.diagnostic(), Some(AslError::Missing)));
+}
+
+#[test]
+fn test_should_capture_new_entry_time_and_reset_retry_state_after_catch() {
+    let (mut d, base) = driver(
+        &json!({"StartAt":"First","States":{
+            "First":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","Parameters":{"time.$":"$$.State.EnteredTime"},"Retry":[{"ErrorEquals":["Oops"],"MaxAttempts":1}],"Catch":[{"ErrorEquals":["Oops"],"ResultPath":null,"Next":"Second"}],"End":true},
+            "Second":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","Parameters":{"time.$":"$$.State.EnteredTime","count.$":"$$.State.RetryCount"},"End":true}
+        }}),
+        &json!({}),
+    );
+    let first = dispatch(&mut d, base, 0);
+    let _ = fail_task(&mut d, &first, base, 0, "Oops");
+    wake(&mut d, base, 1);
+    let retry = dispatch(&mut d, base, 1);
+    let _ = fail_task(&mut d, &retry, base, 1, "Oops");
+    let next = dispatch(&mut d, base, 2);
+    assert_ne!(
+        first.parameters().value().get("time"),
+        next.parameters().value().get("time")
+    );
+    assert_eq!(next.parameters().value().get("count"), Some(&json!(0)));
+    assert_ne!(next.attempt(), retry.attempt());
+}
+
+proptest::proptest! {
+    #![proptest_config(proptest::test_runner::Config::with_cases(512))]
+    #[test]
+    fn test_should_keep_one_terminal_outcome_under_arbitrary_control_order(ops in proptest::collection::vec((0_u8..5,0_u64..120),1..128)) {
+        let (mut d,base)=driver(&task(&json!({"TimeoutSeconds":3,"Retry":[{"ErrorEquals":["Oops"],"MaxAttempts":3}],"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Caught"}]})),&json!({"secret":"not-in-debug"}));
+        let call=dispatch(&mut d,base,0);
+        let mut terminal=None;
+        let mut source=Source::default();
+        for (op,time) in ops {
+            let sample=now(base,time);
+            let update=match op {
+                0=>d.advance(sample,&mut source),
+                1=>d.complete(call.attempt(),Ok(Payload::parse(b"true").unwrap()),sample,&mut source),
+                2=>d.complete(call.attempt(),Err(TaskFailure::new("Oops",None).unwrap()),sample,&mut source),
+                _=>d.stop(TaskFailure::new("Stopped",None).unwrap(),sample),
+            };
+            if let Some(outcome)=&terminal {
+                proptest::prop_assert!(matches!(update.step,DriverStep::Settled(_)));
+                proptest::prop_assert_eq!(update.cancellation(),None);
+                proptest::prop_assert!(Arc::ptr_eq(outcome,d.outcome().unwrap()));
+            } else if let Some(outcome)=d.outcome() { terminal=Some(outcome.clone()); }
+            let debug=format!("{update:?} {d:?}");
+            proptest::prop_assert!(!debug.contains("not-in-debug"));
+        }
+    }
+}
+
+#[test]
+fn test_should_keep_typed_encoding_failure_internal_and_bypass_business_recovery() {
+    use std::error::Error;
+    let (mut d, base) = driver(
+        &task(
+            &json!({"Retry":[{"ErrorEquals":["States.ALL"]}],"Catch":[{"ErrorEquals":["States.ALL"],"Next":"Caught"}]}),
+        ),
+        &json!({}),
+    );
+    let encoding = serde_json::from_str::<Value>("{").unwrap_err();
+    let step = d.evaluation_failure(
+        AslError::Encoding(encoding),
+        now(base, 0),
+        &mut Source::default(),
+        true,
+    );
+    assert!(matches!(step, DriverStep::Settled(_)));
+    assert_eq!(failure(&d), "Rustack.InternalError");
+    assert!(matches!(d.diagnostic(), Some(AslError::Encoding(_))));
+    assert!(d.diagnostic().unwrap().source().is_some());
+    assert_eq!(d.retry_count(), 0);
+}
+
+#[rstest]
+#[case(262_142, true)]
+#[case(262_143, false)]
+#[case(262_145, false)]
+fn test_should_apply_encoded_payload_limit_to_compiled_pass_string_result(
+    #[case] length: usize,
+    #[case] accepted: bool,
+) {
+    let (mut d, base) = driver(
+        &json!({"StartAt":"P","States":{"P":{"Type":"Pass","Result":"x".repeat(length),"End":true}}}),
+        &json!({}),
+    );
+    let _ = d.advance(now(base, 0), &mut Source::default());
+    if accepted {
+        assert_eq!(output(&d).as_str().unwrap().len(), length);
+    } else {
+        assert_eq!(failure(&d), "States.DataLimitExceeded");
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/engine/types.rs b/crates/rustack-stepfunctions-core/src/engine/types.rs
new file mode 100644
index 00000000..42268f25
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/engine/types.rs
@@ -0,0 +1,379 @@
+//! Validated execution settings and redacted effect/outcome types.
+
+use std::{
+    fmt,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use chrono::{DateTime, Utc};
+use rustack_core::json::JsonError;
+
+use crate::{
+    AslError, CallbackDispatch, FanoutPlan, Payload, StateId, SystemUuidSource, UuidSource,
+};
+
+/// One paired wall/monotonic observation supplied by the execution owner.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct ClockSample {
+    pub(crate) monotonic: Instant,
+    pub(crate) wall: DateTime<Utc>,
+}
+impl ClockSample {
+    /// Pair clock observations; subsequent samples must not regress monotonically.
+    ///
+    /// ```
+    /// let sample=rustack_stepfunctions_core::ClockSample::new(std::time::Instant::now(),chrono::Utc::now());
+    /// ```
+    #[must_use]
+    pub fn new(monotonic: Instant, wall: DateTime<Utc>) -> Self {
+        Self { monotonic, wall }
+    }
+}
+
+/// Validated local duration and transition ceilings, independent of AWS history.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct ExecutionLimits {
+    pub(crate) duration: Duration,
+    pub(crate) transitions: u32,
+}
+impl ExecutionLimits {
+    /// Validate positive duration up to365 days and1..=1,000,000 transitions.
+    ///
+    /// # Errors
+    /// Rejects zero, excessive or subsecond-only duration settings.
+    ///
+    /// ```
+    /// let limits=rustack_stepfunctions_core::ExecutionLimits::new(std::time::Duration::from_secs(60),1000)?;
+    /// # Ok::<(),rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn new(duration: Duration, transitions: u32) -> Result<Self, AslError> {
+        if duration < Duration::from_secs(1)
+            || duration > Duration::from_hours(8760)
+            || !(1..=1_000_000).contains(&transitions)
+        {
+            return Err(AslError::InvalidExecution);
+        }
+        Ok(Self {
+            duration,
+            transitions,
+        })
+    }
+}
+impl Default for ExecutionLimits {
+    fn default() -> Self {
+        Self {
+            duration: Duration::from_secs(3600),
+            transitions: 100_000,
+        }
+    }
+}
+
+/// Opaque attempt identity; meaningful only within its owning execution driver.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+#[non_exhaustive]
+pub struct AttemptId(pub(crate) u64);
+
+#[derive(Debug, Clone)]
+pub(crate) enum FailureOrigin {
+    Business,
+    Evaluation(Arc<AslError>),
+    Safety,
+}
+
+/// Bounded failure fields, preserving omission in a Fail state's terminal record.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ExecutionFailure {
+    pub(crate) error: Option<String>,
+    pub(crate) cause: Option<String>,
+    pub(crate) origin: FailureOrigin,
+}
+impl fmt::Debug for ExecutionFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ExecutionFailure(<redacted>)")
+    }
+}
+impl ExecutionFailure {
+    /// Read the supplied error field, including a supplied empty string.
+    ///
+    /// ```
+    /// # fn inspect(f:&rustack_stepfunctions_core::ExecutionFailure) { let error=f.error(); }
+    /// ```
+    #[must_use]
+    pub fn error(&self) -> Option<&str> {
+        self.error.as_deref()
+    }
+    /// Read the optional bounded cause.
+    ///
+    /// ```
+    /// # fn inspect(f:&rustack_stepfunctions_core::ExecutionFailure) { let cause=f.cause(); }
+    /// ```
+    #[must_use]
+    pub fn cause(&self) -> Option<&str> {
+        self.cause.as_deref()
+    }
+    pub(crate) fn evaluation(error: Arc<AslError>) -> Self {
+        let name = match error.as_ref() {
+            AslError::DataLimit
+            | AslError::Json(JsonError::Bytes | JsonError::String | JsonError::Key) => {
+                "States.DataLimitExceeded"
+            }
+            AslError::Entropy(_)
+            | AslError::Encoding(_)
+            | AslError::Allocation(_)
+            | AslError::InvalidStateId
+            | AslError::InvalidFanoutResult
+            | AslError::InvalidExecution => "Rustack.InternalError",
+            _ => "States.Runtime",
+        };
+        let mut failure = Self::named(name, "State evaluation failed");
+        failure.origin = FailureOrigin::Evaluation(error);
+        failure
+    }
+    pub(crate) fn fields(error: Option<String>, cause: Option<String>) -> Self {
+        Self {
+            error,
+            cause,
+            origin: FailureOrigin::Business,
+        }
+    }
+    pub(crate) fn safety(error: &str, cause: &str) -> Self {
+        Self {
+            error: Some(error.into()),
+            cause: Some(cause.into()),
+            origin: FailureOrigin::Safety,
+        }
+    }
+    pub(crate) fn named(error: &str, cause: &str) -> Self {
+        Self {
+            error: Some(error.into()),
+            cause: Some(cause.into()),
+            origin: FailureOrigin::Business,
+        }
+    }
+}
+
+/// A validated external Task failure, distinct from an omitted Fail field.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct TaskFailure(pub(crate) ExecutionFailure);
+impl fmt::Debug for TaskFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("TaskFailure(<redacted>)")
+    }
+}
+impl TaskFailure {
+    pub(crate) fn evaluation(error: AslError) -> Self {
+        Self(ExecutionFailure::evaluation(Arc::new(error)))
+    }
+    pub(crate) fn safety(name: &str, cause: &str) -> Self {
+        Self(ExecutionFailure::safety(name, cause))
+    }
+
+    /// Read bounded failure fields without exposing mutable construction.
+    ///
+    /// ```
+    /// let failure=rustack_stepfunctions_core::TaskFailure::new("BusinessError",None)?;
+    /// assert_eq!(failure.details().error(),Some("BusinessError"));
+    /// # Ok::<(),rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn details(&self) -> &ExecutionFailure {
+        &self.0
+    }
+    /// Build a bounded standard service failure for task-port admission/ownership.
+    ///
+    /// ```
+    /// let failure=rustack_stepfunctions_core::TaskFailure::service_exception();
+    /// ```
+    #[must_use]
+    pub fn service_exception() -> Self {
+        Self(ExecutionFailure::named(
+            "Lambda.ServiceException",
+            "Lambda task service unavailable",
+        ))
+    }
+    /// Build a bounded standard concurrency rejection without fallible user fields.
+    ///
+    /// ```
+    /// let failure=rustack_stepfunctions_core::TaskFailure::throttled();
+    /// ```
+    #[must_use]
+    pub fn throttled() -> Self {
+        Self(ExecutionFailure::named(
+            "Lambda.TooManyRequestsException",
+            "Lambda task capacity exhausted",
+        ))
+    }
+    /// Validate a nonempty256-byte/control-free name and optional32,768-byte cause.
+    ///
+    /// # Errors
+    /// Rejects invalid names or oversized fields; never truncates caller data.
+    ///
+    /// ```
+    /// let failure=rustack_stepfunctions_core::TaskFailure::new("ExampleError",Some("failed"))?;
+    /// # Ok::<(),rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn new(error: &str, cause: Option<&str>) -> Result<Self, AslError> {
+        if error.is_empty()
+            || error.len() > 256
+            || error.chars().any(char::is_control)
+            || cause.is_some_and(|c| c.len() > 32_768)
+        {
+            return Err(AslError::InvalidFailure);
+        }
+        Ok(Self(ExecutionFailure {
+            error: Some(error.into()),
+            cause: cause.map(str::to_owned),
+            origin: FailureOrigin::Business,
+        }))
+    }
+}
+
+/// Stable terminal outcome; cloning its Arc does not duplicate payload trees.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub enum ExecutionOutcome {
+    /// Successful final transformed payload.
+    Succeeded(Payload),
+    /// Failed state, resource or interpreter.
+    Failed(ExecutionFailure),
+    /// Absolute execution deadline; cannot be recovered by a Task Catch.
+    TimedOut,
+    /// Explicit Stop or parent/shutdown cancellation.
+    Aborted(TaskFailure),
+}
+
+/// Parameters and deadline for exactly one external Task attempt.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct TaskDispatch {
+    pub(crate) attempt: AttemptId,
+    pub(crate) state: StateId,
+    pub(crate) parameters: Payload,
+    pub(crate) deadline: Instant,
+}
+impl TaskDispatch {
+    /// Read the execution-local generation used to reject late results.
+    ///
+    /// ```
+    /// # fn inspect(call:&rustack_stepfunctions_core::TaskDispatch) { let id=call.attempt(); }
+    /// ```
+    #[must_use]
+    pub fn attempt(&self) -> AttemptId {
+        self.attempt
+    }
+    /// Read the state index in the driver's captured machine.
+    ///
+    /// ```
+    /// # fn inspect(call:&rustack_stepfunctions_core::TaskDispatch) { let state=call.state(); }
+    /// ```
+    #[must_use]
+    pub fn state(&self) -> StateId {
+        self.state
+    }
+    /// Read evaluated parameters; aliases remain unresolved until dispatch.
+    ///
+    /// ```
+    /// # fn inspect(call:&rustack_stepfunctions_core::TaskDispatch) { let input=call.parameters(); }
+    /// ```
+    #[must_use]
+    pub fn parameters(&self) -> &Payload {
+        &self.parameters
+    }
+    /// Read the minimum Task/execution monotonic deadline.
+    ///
+    /// ```
+    /// # fn inspect(call:&rustack_stepfunctions_core::TaskDispatch) { let deadline=call.deadline(); }
+    /// ```
+    #[must_use]
+    pub fn deadline(&self) -> Instant {
+        self.deadline
+    }
+}
+
+/// Effect returned by a bounded driver operation; it performs no IO itself.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub enum DriverStep {
+    /// Another pure transition can be driven; yield after at most64 per actor tick.
+    Continue,
+    /// Start exactly once and retain the accepted call under supervisor ownership.
+    Dispatch(TaskDispatch),
+    /// Register a token for this identity before materializing invocation/history.
+    Callback(CallbackDispatch),
+    /// Admit indexed children lazily, then join this generation after cleanup.
+    FanOut(FanoutPlan),
+    /// Arm a monotonic wakeup (also returned while waiting for a Task result).
+    Park(Instant),
+    /// An immutable outcome; does not certify resource cleanup or history commit.
+    Settled(Arc<ExecutionOutcome>),
+}
+
+impl DriverStep {
+    pub(crate) fn task_attempt(&self) -> Option<AttemptId> {
+        match self {
+            Self::Dispatch(dispatch) => Some(dispatch.attempt()),
+            Self::Callback(dispatch) => Some(dispatch.attempt()),
+            _ => None,
+        }
+    }
+}
+
+/// A transition and its independent cleanup obligation.
+///
+/// The owner must process cancellation before allowing another dispatch. A
+/// terminal outcome never releases ownership of an uncertain external call.
+#[must_use = "process the step and retain/cancel any outstanding resource"]
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct DriverUpdate {
+    pub(crate) step: DriverStep,
+    pub(crate) cancel: Option<AttemptId>,
+}
+impl DriverUpdate {
+    /// Read the next transition or external effect.
+    ///
+    /// ```
+    /// # fn inspect(update:&rustack_stepfunctions_core::DriverUpdate) { let step=update.step(); }
+    /// ```
+    #[must_use]
+    pub fn step(&self) -> &DriverStep {
+        &self.step
+    }
+    /// Read the invalidated call or round whose cleanup the owner must supervise.
+    ///
+    /// ```
+    /// # fn inspect(update:&rustack_stepfunctions_core::DriverUpdate) { let call=update.cancellation(); }
+    /// ```
+    #[must_use]
+    pub fn cancellation(&self) -> Option<AttemptId> {
+        self.cancel
+    }
+}
+
+/// Uniform entropy supplied explicitly, keeping potentially blocking OS IO out
+/// of an async scheduler. UUID evaluation uses the same retained worker/source.
+pub trait ExecutionSource: UuidSource {
+    /// Produce an unbiased uniform64-bit word.
+    ///
+    /// # Errors
+    /// Propagates entropy acquisition failure without deterministic fallback.
+    ///
+    /// ```
+    /// # fn sample(source:&mut impl rustack_stepfunctions_core::ExecutionSource) -> Result<(),rustack_stepfunctions_core::AslError> {
+    /// let draw=source.random_u64()?;
+    /// # Ok(()) }
+    /// ```
+    fn random_u64(&mut self) -> Result<u64, AslError>;
+}
+impl ExecutionSource for SystemUuidSource {
+    fn random_u64(&mut self) -> Result<u64, AslError> {
+        let mut bytes = [0_u8; 8];
+        getrandom::fill(&mut bytes).map_err(AslError::Entropy)?;
+        Ok(u64::from_le_bytes(bytes))
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/error.rs b/crates/rustack-stepfunctions-core/src/error.rs
new file mode 100644
index 00000000..28265f6e
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/error.rs
@@ -0,0 +1,100 @@
+//! Redacted semantic failures with typed source ownership.
+
+use std::{collections::TryReserveError, fmt};
+
+use getrandom::Error as EntropyError;
+use rustack_core::json::JsonError;
+use thiserror::Error;
+
+/// Bounded ASL data failures; messages never contain input or path text.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum AslError {
+    /// Callback preparation requires an object without stale reserved Task context.
+    #[error("invalid callback preparation context")]
+    InvalidCallbackContext,
+    /// Inline Map input or dynamically selected concurrency violates the profile.
+    #[error("invalid Inline Map input or concurrency")]
+    InvalidMap,
+    /// A structured owner supplied an invalid child index or joined result.
+    #[error("invalid structured frame result")]
+    InvalidFanoutResult,
+    /// The artifact requires an execution owner unavailable in this driver.
+    #[error("ASL artifact requires structured execution support")]
+    StructuredExecutionRequired,
+    /// Invalid execution settings, context or clock sample.
+    #[error("invalid ASL execution configuration")]
+    InvalidExecution,
+    /// External failure fields violate the bounded Task contract.
+    #[error("invalid ASL Task failure")]
+    InvalidFailure,
+    /// Invalid configured tenant identity.
+    #[error("invalid workflow tenant scope")]
+    InvalidScope,
+    /// A state ID is outside the referenced compiled machine.
+    #[error("invalid compiled state identity")]
+    InvalidStateId,
+    /// Invalid template shape, normalized-key collision or compiled limit.
+    #[error("invalid ASL payload template")]
+    InvalidTemplate,
+    /// Unknown data-flow fields or invalid field types.
+    #[error("invalid ASL data flow")]
+    InvalidDataFlow,
+    /// Unsupported or invalid intrinsic syntax/arity.
+    #[error("invalid ASL expression")]
+    InvalidExpression,
+    /// An intrinsic encountered an invalid value, type or format.
+    #[error("invalid ASL intrinsic value")]
+    IntrinsicValue,
+    /// The operating system could not supply secure UUID entropy.
+    #[error("ASL UUID entropy unavailable")]
+    Entropy(#[source] EntropyError),
+    /// Bounded storage could not be reserved.
+    #[error("ASL allocation failed")]
+    Allocation(#[source] TryReserveError),
+    /// Unsupported or ambiguous static Wait source definition.
+    #[error("invalid ASL Wait source")]
+    InvalidWait,
+    /// A dynamic Wait value has an invalid type, date or supported range.
+    #[error("invalid ASL Wait value")]
+    WaitValue,
+    /// Unsupported, ambiguous or invalid Choice predicate definition.
+    #[error("invalid ASL Choice predicate")]
+    InvalidPredicate,
+    /// Numeric comparison exceeds the local binary64 interoperability range.
+    #[error("ASL numeric comparison outside supported range")]
+    NumericRange,
+    /// The path is invalid or exceeds the compiled-profile limits.
+    #[error("invalid ASL path")]
+    InvalidPath,
+    /// A selection operator is not a reference path.
+    #[error("invalid ASL reference path")]
+    InvalidReference,
+    /// Result paths cannot write into the context object.
+    #[error("invalid ASL result target")]
+    InvalidResultTarget,
+    /// A singular path could not select a value.
+    #[error("ASL path selected no value")]
+    Missing,
+    /// A merge traversed a scalar or an absent/out-of-range array element.
+    #[error("ASL result path cannot be applied")]
+    Merge,
+    /// Expansion exceeds the allowed bounded evaluation work.
+    #[error("ASL evaluation work limit exceeded")]
+    WorkLimit,
+    /// Materialized data exceeds the payload byte allowance.
+    #[error("ASL payload byte limit exceeded")]
+    DataLimit,
+    /// Input or constructed data violates bounded JSON validation.
+    #[error("invalid bounded ASL JSON")]
+    Json(#[from] JsonError),
+    /// A bounded serializer failed; retain its source without projecting it.
+    #[error("ASL payload encoding failed")]
+    Encoding(#[source] serde_json::Error),
+}
+
+impl fmt::Debug for AslError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/expression.rs b/crates/rustack-stepfunctions-core/src/expression.rs
new file mode 100644
index 00000000..cc82a15c
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/expression.rs
@@ -0,0 +1,250 @@
+//! Compiled expressions with explicit UUID sourcing and shared evaluation budgets.
+
+use std::{fmt, str::FromStr};
+
+use getrandom::fill;
+use uuid::{Builder, Uuid};
+
+use crate::{AslError, EvaluationContext, Path, Payload};
+
+mod eval;
+mod format;
+mod parser;
+
+use format::Format;
+
+/// Typed UUID source for deterministic/failure tests and scheduler-safe injection.
+pub trait UuidSource {
+    /// Produce one securely sourced version4 UUID in production.
+    ///
+    /// # Errors
+    /// Returns entropy/admission failure; never silently substitutes a fixed ID.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{SystemUuidSource, UuidSource};
+    /// let id=SystemUuidSource::default().next_uuid()?;
+    /// assert_eq!(id.get_version_num(),4);
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    fn next_uuid(&mut self) -> Result<Uuid, AslError>;
+}
+
+/// Fallible system entropy adapter; callers own any required blocking isolation.
+#[derive(Debug, Default)]
+#[non_exhaustive]
+pub struct SystemUuidSource;
+
+impl UuidSource for SystemUuidSource {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        let mut random = [0_u8; 16];
+        fill(&mut random).map_err(AslError::Entropy)?;
+        Ok(Builder::from_random_bytes(random).into_uuid())
+    }
+}
+
+/// Immutable compiled path or allowlisted intrinsic, with redacted diagnostics.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct Expression(Node);
+
+#[derive(Clone)]
+enum Node {
+    Path(Path),
+    Literal(Payload),
+    Call {
+        function: Function,
+        args: Vec<Node>,
+        format: Option<Format>,
+    },
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Function {
+    Format,
+    StringToJson,
+    JsonToString,
+    Array,
+    ArrayLength,
+    ArrayGetItem,
+    ArrayContains,
+    ArrayPartition,
+    StringSplit,
+    MathAdd,
+    Uuid,
+    JsonMerge,
+}
+
+impl Function {
+    fn parse(name: &str) -> Result<Self, AslError> {
+        match name {
+            "States.Format" => Ok(Self::Format),
+            "States.StringToJson" => Ok(Self::StringToJson),
+            "States.JsonToString" => Ok(Self::JsonToString),
+            "States.Array" => Ok(Self::Array),
+            "States.ArrayLength" => Ok(Self::ArrayLength),
+            "States.ArrayGetItem" => Ok(Self::ArrayGetItem),
+            "States.ArrayContains" => Ok(Self::ArrayContains),
+            "States.ArrayPartition" => Ok(Self::ArrayPartition),
+            "States.StringSplit" => Ok(Self::StringSplit),
+            "States.MathAdd" => Ok(Self::MathAdd),
+            "States.UUID" => Ok(Self::Uuid),
+            "States.JsonMerge" => Ok(Self::JsonMerge),
+            _ => Err(AslError::InvalidExpression),
+        }
+    }
+
+    fn arity(self, count: usize) -> bool {
+        match self {
+            Self::Format => (1..=128).contains(&count),
+            Self::Array => count <= 128,
+            Self::StringToJson | Self::JsonToString | Self::ArrayLength => count == 1,
+            Self::ArrayGetItem
+            | Self::ArrayContains
+            | Self::ArrayPartition
+            | Self::StringSplit
+            | Self::MathAdd => count == 2,
+            Self::Uuid => count == 0,
+            Self::JsonMerge => count == 3,
+        }
+    }
+}
+
+impl fmt::Debug for Expression {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Expression(<redacted>)")
+    }
+}
+
+impl FromStr for Expression {
+    type Err = AslError;
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        parser::compile(text).map(Self)
+    }
+}
+
+impl Expression {
+    /// Evaluate with fallible OS entropy if a UUID call is reached.
+    ///
+    /// The OS may wait for entropy during early boot. Async execution owners use
+    /// `evaluate_with_source` with pre-acquired IDs or a bounded blocking worker.
+    ///
+    /// # Errors
+    /// Returns missing/type/format, resource-limit or entropy failure.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Expression,Payload,EvaluationContext};
+    /// let data=Payload::parse(br#"{"n":2}"#)?;
+    /// let expression:Expression="States.MathAdd($.n, 3)".parse()?;
+    /// assert_eq!(expression.evaluate(&data,&EvaluationContext::from(&data))?.value(),&serde_json::json!(5));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn evaluate(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+    ) -> Result<Payload, AslError> {
+        self.evaluate_with_source(data, context, &mut SystemUuidSource)
+    }
+
+    /// Evaluate using an explicit UUID port under one shared set of budgets.
+    ///
+    /// # Errors
+    /// Returns evaluation failures and rejects injected non-version4 UUIDs.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Expression,Payload,EvaluationContext,SystemUuidSource};
+    /// let data=Payload::parse(b"null")?;
+    /// let expression:Expression="States.Array()".parse()?;
+    /// let result=expression.evaluate_with_source(&data,&EvaluationContext::from(&data),&mut SystemUuidSource::default())?;
+    /// assert_eq!(result.value(),&serde_json::json!([]));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn evaluate_with_source<S: UuidSource + ?Sized>(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+        source: &mut S,
+    ) -> Result<Payload, AslError> {
+        eval::node(&self.0, data, context, source, &mut Budget::new())
+    }
+
+    pub(crate) fn evaluate_scoped<S: UuidSource + ?Sized>(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+        source: &mut S,
+        budget: &mut Budget,
+    ) -> Result<Payload, AslError> {
+        eval::node(&self.0, data, context, source, budget)
+    }
+
+    pub(crate) fn callback_sensitive(&self, input_sensitive: bool) -> bool {
+        fn sensitive(node: &Node, input_sensitive: bool) -> bool {
+            match node {
+                Node::Path(path) => path.callback_sensitive(input_sensitive),
+                Node::Literal(_) => false,
+                Node::Call { args, .. } => args.iter().any(|arg| sensitive(arg, input_sensitive)),
+            }
+        }
+        sensitive(&self.0, input_sensitive)
+    }
+
+    pub(crate) fn node_count(&self) -> usize {
+        fn count(node: &Node) -> usize {
+            match node {
+                Node::Call { args, .. } => args
+                    .iter()
+                    .fold(1_usize, |sum, node| sum.saturating_add(count(node))),
+                Node::Path(_) | Node::Literal(_) => 1,
+            }
+        }
+        count(&self.0)
+    }
+}
+
+pub(crate) struct Budget {
+    units: usize,
+    text: usize,
+    materialized: usize,
+}
+impl Budget {
+    pub(crate) fn new() -> Self {
+        Self {
+            units: 10_000,
+            text: 4 * 1024 * 1024,
+            materialized: 4 * 1024 * 1024,
+        }
+    }
+    pub(crate) fn work(&mut self, count: usize) -> Result<(), AslError> {
+        self.units = self.units.checked_sub(count).ok_or(AslError::WorkLimit)?;
+        Ok(())
+    }
+    fn text(&mut self, count: usize) -> Result<(), AslError> {
+        self.text = self.text.checked_sub(count).ok_or(AslError::WorkLimit)?;
+        Ok(())
+    }
+    pub(crate) fn result(&mut self, result: &Payload) -> Result<(), AslError> {
+        self.materialized = self
+            .materialized
+            .checked_sub(result.original_bytes().len())
+            .ok_or(AslError::WorkLimit)?;
+        Ok(())
+    }
+
+    pub(crate) fn path(
+        &mut self,
+        path: &Path,
+        data: &Payload,
+        context: &EvaluationContext,
+    ) -> Result<Payload, AslError> {
+        self.work(1)?;
+        let result = path
+            .select_with_work(data, context, &mut self.units)?
+            .to_payload()?;
+        self.result(&result)?;
+        Ok(result)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/expression/eval.rs b/crates/rustack-stepfunctions-core/src/expression/eval.rs
new file mode 100644
index 00000000..290b8c78
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/expression/eval.rs
@@ -0,0 +1,296 @@
+//! Bounded intrinsic evaluation with borrowed collection output views.
+
+use std::{
+    cmp::Ordering,
+    collections::{BTreeMap, BTreeSet},
+    num::NonZeroUsize,
+};
+
+use serde::Serialize;
+use serde_json::Value;
+use uuid::{Variant, Version};
+
+use super::{Budget, Function, Node, UuidSource, format::Format};
+use crate::{AslError, EvaluationContext, Payload, choice::number, payload::encode};
+
+pub(super) fn node<S: UuidSource + ?Sized>(
+    expression: &Node,
+    data: &Payload,
+    context: &EvaluationContext,
+    source: &mut S,
+    budget: &mut Budget,
+) -> Result<Payload, AslError> {
+    budget.work(1)?;
+    let result = match expression {
+        Node::Literal(value) => value.clone(),
+        Node::Path(path) => path
+            .select_with_work(data, context, &mut budget.units)?
+            .to_payload()?,
+        Node::Call {
+            function,
+            args,
+            format,
+        } => {
+            let args = args
+                .iter()
+                .map(|arg| node(arg, data, context, source, budget))
+                .collect::<Result<Vec<_>, _>>()?;
+            call(*function, &args, format.as_ref(), source, budget)?
+        }
+    };
+    budget.result(&result)?;
+    Ok(result)
+}
+
+fn arg(args: &[Payload], index: usize) -> Result<&Value, AslError> {
+    args.get(index)
+        .map(Payload::value)
+        .ok_or(AslError::IntrinsicValue)
+}
+
+fn output<T: Serialize + ?Sized>(value: &T) -> Result<Payload, AslError> {
+    Payload::from_bytes(encode(value)?)
+}
+
+fn parse_json(text: &str, budget: &mut Budget) -> Result<Payload, AslError> {
+    budget.text(text.len())?;
+    if text
+        .bytes()
+        .all(|byte| matches!(byte, b' ' | b'\t' | b'\r' | b'\n'))
+    {
+        return Payload::parse(b"null");
+    }
+    budget.text(text.len())?;
+    let parsed = Payload::parse(text.as_bytes())?;
+    budget.text(text.len())?;
+    let bytes = text.as_bytes();
+    let mut normalized = Vec::with_capacity(bytes.len());
+    let mut quoted = false;
+    let mut escaped = false;
+    for (index, byte) in bytes.iter().copied().enumerate() {
+        if quoted {
+            if escaped {
+                escaped = false;
+            } else if byte == b'\\' {
+                escaped = true;
+            } else if byte == b'"' {
+                quoted = false;
+            }
+        } else if byte == b'"' {
+            quoted = true;
+        } else if byte == b'-'
+            && (index == 0
+                || bytes.get(index.saturating_sub(1)).is_some_and(|previous| {
+                    matches!(previous, b' ' | b'\t' | b'\r' | b'\n' | b',' | b'[' | b':')
+                }))
+            && bytes.get(index.saturating_add(1)) == Some(&b'0')
+            && bytes.get(index.saturating_add(2)).is_none_or(|next| {
+                matches!(next, b' ' | b'\t' | b'\r' | b'\n' | b',' | b']' | b'}')
+            })
+        {
+            continue;
+        }
+        normalized.push(byte);
+    }
+    if normalized.len() == bytes.len() {
+        return Ok(parsed);
+    }
+    drop(parsed);
+    budget.text(normalized.len())?;
+    Payload::parse(&normalized)
+}
+
+fn call<S: UuidSource + ?Sized>(
+    function: Function,
+    args: &[Payload],
+    format: Option<&Format>,
+    source: &mut S,
+    budget: &mut Budget,
+) -> Result<Payload, AslError> {
+    match function {
+        Function::Format => {
+            let (first, rest) = args.split_first().ok_or(AslError::IntrinsicValue)?;
+            if let Some(format) = format {
+                format.render(rest, budget)
+            } else {
+                let text = first.value().as_str().ok_or(AslError::IntrinsicValue)?;
+                budget.text(text.len())?;
+                Format::compile(text, rest.len())
+                    .map_err(|_| AslError::IntrinsicValue)?
+                    .render(rest, budget)
+            }
+        }
+        Function::StringToJson => {
+            let text = arg(args, 0)?.as_str().ok_or(AslError::IntrinsicValue)?;
+            parse_json(text, budget)
+        }
+        Function::JsonToString => {
+            let encoded = encode(arg(args, 0)?)?;
+            budget.text(encoded.len())?;
+            let text = String::from_utf8(encoded.to_vec()).map_err(|_| AslError::IntrinsicValue)?;
+            Payload::from_value(&Value::String(text))
+        }
+        Function::Array => output(&args.iter().map(Payload::value).collect::<Vec<_>>()),
+        Function::ArrayLength => output(
+            &arg(args, 0)?
+                .as_array()
+                .ok_or(AslError::IntrinsicValue)?
+                .len(),
+        ),
+        Function::ArrayGetItem => {
+            let values = arg(args, 0)?.as_array().ok_or(AslError::IntrinsicValue)?;
+            let index = arg(args, 1)?
+                .as_u64()
+                .and_then(|n| usize::try_from(n).ok())
+                .ok_or(AslError::IntrinsicValue)?;
+            output(values.get(index).ok_or(AslError::IntrinsicValue)?)
+        }
+        Function::ArrayContains => {
+            let values = arg(args, 0)?.as_array().ok_or(AslError::IntrinsicValue)?;
+            let needle = arg(args, 1)?;
+            let mut found = false;
+            for value in values {
+                if equal(value, needle, budget)? {
+                    found = true;
+                    break;
+                }
+            }
+            output(&found)
+        }
+        Function::ArrayPartition => {
+            let values = arg(args, 0)?.as_array().ok_or(AslError::IntrinsicValue)?;
+            let size = usize::try_from(rounded(arg(args, 1)?)?)
+                .ok()
+                .and_then(NonZeroUsize::new)
+                .ok_or(AslError::IntrinsicValue)?;
+            budget.work(values.len())?;
+            output(&values.chunks(size.get()).collect::<Vec<_>>())
+        }
+        Function::StringSplit => split(args, budget),
+        Function::MathAdd => {
+            let left = rounded(arg(args, 0)?)?;
+            let right = rounded(arg(args, 1)?)?;
+            output(&left.checked_add(right).ok_or(AslError::IntrinsicValue)?)
+        }
+        Function::Uuid => {
+            let id = source.next_uuid()?;
+            if id.get_version() != Some(Version::Random) || id.get_variant() != Variant::RFC4122 {
+                return Err(AslError::IntrinsicValue);
+            }
+            output(&id.to_string())
+        }
+        Function::JsonMerge => {
+            let left = arg(args, 0)?.as_object().ok_or(AslError::IntrinsicValue)?;
+            let right = arg(args, 1)?.as_object().ok_or(AslError::IntrinsicValue)?;
+            if arg(args, 2)? != &Value::Bool(false) {
+                return Err(AslError::IntrinsicValue);
+            }
+            budget.work(left.len().saturating_add(right.len()))?;
+            let mut merged = BTreeMap::new();
+            for (key, value) in left.iter().chain(right) {
+                budget.text(key.len())?;
+                merged.insert(key, value);
+            }
+            output(&merged)
+        }
+    }
+}
+
+fn split(args: &[Payload], budget: &mut Budget) -> Result<Payload, AslError> {
+    let text = arg(args, 0)?.as_str().ok_or(AslError::IntrinsicValue)?;
+    let separators = arg(args, 1)?.as_str().ok_or(AslError::IntrinsicValue)?;
+    budget.text(text.len().saturating_add(separators.len()))?;
+    let mut delimiters = BTreeSet::new();
+    for ch in separators.chars() {
+        budget.work(1)?;
+        delimiters.insert(ch);
+        if delimiters.len() > 1024 {
+            return Err(AslError::WorkLimit);
+        }
+    }
+    let mut parts = Vec::new();
+    for part in text
+        .split(|ch| delimiters.contains(&ch))
+        .filter(|s| !s.is_empty())
+    {
+        budget.work(1)?;
+        parts.push(part);
+    }
+    output(&parts)
+}
+
+fn rounded(value: &Value) -> Result<i32, AslError> {
+    let value = value
+        .as_f64()
+        .filter(|n| n.is_finite())
+        .ok_or(AslError::IntrinsicValue)?;
+    let floor = value.floor();
+    let rounded = if value - floor >= 0.5 {
+        floor + 1.0
+    } else {
+        floor
+    };
+    if rounded < f64::from(i32::MIN) || rounded > f64::from(i32::MAX) {
+        return Err(AslError::IntrinsicValue);
+    }
+    rounded
+        .to_string()
+        .parse()
+        .map_err(|_| AslError::IntrinsicValue)
+}
+
+fn equal<'a>(left: &'a Value, right: &'a Value, budget: &mut Budget) -> Result<bool, AslError> {
+    let mut stack = vec![(left, right)];
+    while let Some((left, right)) = stack.pop() {
+        budget.work(1)?;
+        match (left, right) {
+            (Value::Null, Value::Null) => {}
+            (Value::Bool(a), Value::Bool(b)) if a == b => {}
+            (Value::String(a), Value::String(b)) => {
+                budget.text(a.len().saturating_add(b.len()))?;
+                if a != b {
+                    return Ok(false);
+                }
+            }
+            (Value::Number(a), Value::Number(b)) => {
+                if a.is_f64() || b.is_f64() {
+                    if !number(left)?
+                        .zip(number(right)?)
+                        .is_some_and(|(a, b)| a.partial_cmp(&b).is_some_and(Ordering::is_eq))
+                    {
+                        return Ok(false);
+                    }
+                } else if a != b {
+                    return Ok(false);
+                }
+            }
+            (Value::Array(a), Value::Array(b)) => {
+                if a.len() != b.len() {
+                    return Ok(false);
+                }
+                if stack.len().saturating_add(a.len()) > budget.units {
+                    return Err(AslError::WorkLimit);
+                }
+                stack.extend(a.iter().zip(b));
+            }
+            (Value::Object(a), Value::Object(b)) => {
+                if a.len() != b.len() {
+                    return Ok(false);
+                }
+                for (key, value) in a {
+                    budget.work(1)?;
+                    budget.text(key.len())?;
+                    let Some(other) = b.get(key) else {
+                        return Ok(false);
+                    };
+                    if stack.len() >= budget.units {
+                        return Err(AslError::WorkLimit);
+                    }
+                    stack.push((value, other));
+                }
+            }
+            _ => return Ok(false),
+        }
+    }
+    Ok(true)
+}
diff --git a/crates/rustack-stepfunctions-core/src/expression/format.rs b/crates/rustack-stepfunctions-core/src/expression/format.rs
new file mode 100644
index 00000000..d74a92cd
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/expression/format.rs
@@ -0,0 +1,136 @@
+//! Escape-aware bounded AWS value formatting, independent of host formatters.
+
+use std::{mem::take, str::from_utf8};
+
+use serde_json::Value;
+
+use super::Budget;
+use crate::{AslError, MAX_PAYLOAD_BYTES, Payload, payload::encode};
+
+#[derive(Clone)]
+pub(super) struct Format(Vec<Part>);
+#[derive(Clone)]
+enum Part {
+    Text(String),
+    Slot,
+}
+
+impl Format {
+    pub(super) fn compile(text: &str, slots: usize) -> Result<Self, AslError> {
+        let mut parts = Vec::new();
+        let mut literal = String::new();
+        let mut chars = text.chars();
+        let mut count = 0_usize;
+        while let Some(ch) = chars.next() {
+            match ch {
+                '\\' => match chars.next() {
+                    Some(ch @ ('\'' | '{' | '}' | '\\')) => literal.push(ch),
+                    _ => return Err(AslError::InvalidExpression),
+                },
+                '{' => {
+                    if chars.next() != Some('}') {
+                        return Err(AslError::InvalidExpression);
+                    }
+                    count = count.checked_add(1).ok_or(AslError::InvalidExpression)?;
+                    if count > slots {
+                        return Err(AslError::InvalidExpression);
+                    }
+                    if !literal.is_empty() {
+                        parts.push(Part::Text(take(&mut literal)));
+                    }
+                    parts.push(Part::Slot);
+                }
+                '}' => return Err(AslError::InvalidExpression),
+                ch => literal.push(ch),
+            }
+        }
+        if count != slots {
+            return Err(AslError::InvalidExpression);
+        }
+        if !literal.is_empty() {
+            parts.push(Part::Text(literal));
+        }
+        Ok(Self(parts))
+    }
+
+    pub(super) fn render(
+        &self,
+        args: &[Payload],
+        budget: &mut Budget,
+    ) -> Result<Payload, AslError> {
+        let mut args = args.iter();
+        let mut output = String::new();
+        for part in &self.0 {
+            budget.work(1)?;
+            match part {
+                Part::Text(text) => {
+                    budget.text(text.len())?;
+                    append(&mut output, text)?;
+                }
+                Part::Slot => {
+                    let value = args.next().ok_or(AslError::IntrinsicValue)?.value();
+                    render_value(&mut output, value, budget)?;
+                }
+            }
+        }
+        if args.next().is_some() {
+            return Err(AslError::IntrinsicValue);
+        }
+        Payload::from_value(&Value::String(output))
+    }
+}
+
+fn render_value(output: &mut String, value: &Value, budget: &mut Budget) -> Result<(), AslError> {
+    budget.work(1)?;
+    match value {
+        Value::String(text) => emit(output, text, budget),
+        Value::Null | Value::Bool(_) | Value::Number(_) => {
+            let encoded = encode(value)?;
+            emit(
+                output,
+                from_utf8(&encoded).map_err(|_| AslError::IntrinsicValue)?,
+                budget,
+            )
+        }
+        Value::Array(values) => {
+            emit(output, "[", budget)?;
+            for (index, value) in values.iter().enumerate() {
+                if index != 0 {
+                    emit(output, ", ", budget)?;
+                }
+                render_value(output, value, budget)?;
+            }
+            emit(output, "]", budget)
+        }
+        Value::Object(values) => {
+            budget.work(values.len())?;
+            let mut entries = values.iter().collect::<Vec<_>>();
+            entries.sort_unstable_by_key(|(key, _)| *key);
+            emit(output, "{", budget)?;
+            for (index, (key, value)) in entries.into_iter().enumerate() {
+                if index != 0 {
+                    emit(output, ", ", budget)?;
+                }
+                emit(output, key, budget)?;
+                emit(output, "=", budget)?;
+                render_value(output, value, budget)?;
+            }
+            emit(output, "}", budget)
+        }
+    }
+}
+fn emit(output: &mut String, text: &str, budget: &mut Budget) -> Result<(), AslError> {
+    budget.text(text.len())?;
+    append(output, text)
+}
+
+fn append(output: &mut String, text: &str) -> Result<(), AslError> {
+    if output.len().saturating_add(text.len()) > MAX_PAYLOAD_BYTES {
+        return Err(AslError::DataLimit);
+    }
+    output
+        .try_reserve(text.len())
+        .map_err(AslError::Allocation)?;
+    output.push_str(text);
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/expression/parser.rs b/crates/rustack-stepfunctions-core/src/expression/parser.rs
new file mode 100644
index 00000000..832aec2c
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/expression/parser.rs
@@ -0,0 +1,189 @@
+//! Fully consumed bounded expression grammar; no input-bearing diagnostics.
+
+use serde_json::{Value, from_str};
+use winnow::{
+    ModalResult, Parser,
+    token::{any, take_while},
+};
+
+use super::{Function, Node, format::Format};
+use crate::{AslError, Path, Payload};
+
+pub(super) fn compile(text: &str) -> Result<Node, AslError> {
+    if text.is_empty() || text.len() > 4096 || text.trim() != text {
+        return Err(AslError::InvalidExpression);
+    }
+    if text.starts_with('$') {
+        return text.parse::<Path>().map(Node::Path);
+    }
+    let mut input = text;
+    let node = call(&mut input, 0, &mut 1024)?;
+    if !input.is_empty() {
+        return Err(AslError::InvalidExpression);
+    }
+    Ok(node)
+}
+
+fn consume(input: &mut &str, mut token: &'static str) -> Result<(), AslError> {
+    let parsed: ModalResult<&str> = token.parse_next(input);
+    parsed.map(|_| ()).map_err(|_| AslError::InvalidExpression)
+}
+
+fn space(input: &mut &str) -> Result<(), AslError> {
+    let parsed: ModalResult<&str> =
+        take_while(0.., |ch: char| matches!(ch, ' ' | '\t' | '\r' | '\n')).parse_next(input);
+    parsed.map(|_| ()).map_err(|_| AslError::InvalidExpression)
+}
+
+fn unit(remaining: &mut usize) -> Result<(), AslError> {
+    *remaining = remaining
+        .checked_sub(1)
+        .ok_or(AslError::InvalidExpression)?;
+    Ok(())
+}
+
+fn call(input: &mut &str, depth: usize, remaining: &mut usize) -> Result<Node, AslError> {
+    if depth >= 10 {
+        return Err(AslError::InvalidExpression);
+    }
+    unit(remaining)?;
+    let name: ModalResult<&str> = take_while(1.., |ch: char| {
+        ch.is_ascii_alphanumeric() || matches!(ch, '.' | '_')
+    })
+    .parse_next(input);
+    let function = Function::parse(name.map_err(|_| AslError::InvalidExpression)?)?;
+    consume(input, "(")?;
+    space(input)?;
+    let mut args = Vec::new();
+    let mut format_text = None;
+    if !input.starts_with(')') {
+        loop {
+            if args.len() >= 128 {
+                return Err(AslError::InvalidExpression);
+            }
+            let is_format = function == Function::Format && args.is_empty();
+            let (arg, raw) = argument(input, depth.saturating_add(1), remaining)?;
+            if is_format {
+                format_text = raw;
+            }
+            args.push(arg);
+            space(input)?;
+            if input.starts_with(')') {
+                break;
+            }
+            consume(input, ",")?;
+            space(input)?;
+        }
+    }
+    consume(input, ")")?;
+    if !function.arity(args.len()) {
+        return Err(AslError::InvalidExpression);
+    }
+    if function == Function::JsonMerge {
+        if let Some(Node::Literal(value)) = args.get(2) {
+            if value.value() != &Value::Bool(false) {
+                return Err(AslError::InvalidExpression);
+            }
+        }
+    }
+    let format = format_text
+        .map(|text| Format::compile(&text, args.len().saturating_sub(1)))
+        .transpose()?;
+    Ok(Node::Call {
+        function,
+        args,
+        format,
+    })
+}
+
+fn argument(
+    input: &mut &str,
+    depth: usize,
+    remaining: &mut usize,
+) -> Result<(Node, Option<String>), AslError> {
+    if input.starts_with("States.") {
+        return call(input, depth, remaining).map(|node| (node, None));
+    }
+    unit(remaining)?;
+    if input.starts_with('\'') {
+        let (value, raw) = string(input)?;
+        return Ok((
+            Node::Literal(Payload::from_value(&Value::String(value))?),
+            Some(raw),
+        ));
+    }
+    let token = argument_token(input)?;
+    if token.starts_with('$') {
+        return token.parse().map(|path| (Node::Path(path), None));
+    }
+    if token.is_empty() || token.len() > 128 {
+        return Err(AslError::InvalidExpression);
+    }
+    let value: Value = from_str(token).map_err(|_| AslError::InvalidExpression)?;
+    if !matches!(value, Value::Number(_) | Value::Bool(_) | Value::Null) {
+        return Err(AslError::InvalidExpression);
+    }
+    Ok((Node::Literal(Payload::from_value(&value)?), None))
+}
+
+fn argument_token<'a>(input: &mut &'a str) -> Result<&'a str, AslError> {
+    let source = *input;
+    let mut brackets = 0_usize;
+    let mut quoted = false;
+    let mut escaped = false;
+    let mut end = source.len();
+    for (index, ch) in source.char_indices() {
+        if quoted {
+            if escaped {
+                escaped = false;
+            } else if ch == '\\' {
+                escaped = true;
+            } else if ch == '\'' {
+                quoted = false;
+            }
+        } else {
+            match ch {
+                '\'' => quoted = true,
+                '[' => brackets = brackets.checked_add(1).ok_or(AslError::InvalidExpression)?,
+                ']' => brackets = brackets.checked_sub(1).ok_or(AslError::InvalidExpression)?,
+                ',' | ')' if brackets == 0 => {
+                    end = index;
+                    break;
+                }
+                _ => {}
+            }
+        }
+    }
+    if quoted || brackets != 0 {
+        return Err(AslError::InvalidExpression);
+    }
+    let token = source.get(..end).ok_or(AslError::InvalidExpression)?;
+    *input = source.get(end..).ok_or(AslError::InvalidExpression)?;
+    Ok(token.trim_end_matches([' ', '\t', '\r', '\n']))
+}
+
+fn string(input: &mut &str) -> Result<(String, String), AslError> {
+    consume(input, "'")?;
+    let mut value = String::new();
+    let mut raw = String::new();
+    loop {
+        let parsed: ModalResult<char> = any.parse_next(input);
+        match parsed.map_err(|_| AslError::InvalidExpression)? {
+            '\'' => return Ok((value, raw)),
+            '\\' => {
+                let parsed: ModalResult<char> = any.parse_next(input);
+                let ch = parsed.map_err(|_| AslError::InvalidExpression)?;
+                if !matches!(ch, '\'' | '\\' | '{' | '}') {
+                    return Err(AslError::InvalidExpression);
+                }
+                raw.push('\\');
+                raw.push(ch);
+                value.push(ch);
+            }
+            ch => {
+                raw.push(ch);
+                value.push(ch);
+            }
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/expression/tests.rs b/crates/rustack-stepfunctions-core/src/expression/tests.rs
new file mode 100644
index 00000000..ca1d60ca
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/expression/tests.rs
@@ -0,0 +1,587 @@
+use std::{collections::BTreeSet, error::Error};
+
+use proptest::prelude::*;
+use rstest::rstest;
+use rustack_core::json::JsonError;
+use serde_json::{Map, Value, json};
+use uuid::{Builder, Uuid, Variant, Version};
+
+use super::Budget;
+use crate::{AslError, EvaluationContext, Expression, Payload, SystemUuidSource, UuidSource};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+#[derive(Default)]
+struct Fixed(u8);
+impl UuidSource for Fixed {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        self.0 = self.0.checked_add(1).ok_or(AslError::WorkLimit)?;
+        Ok(Builder::from_random_bytes([self.0; 16]).into_uuid())
+    }
+}
+
+fn evaluate(expression: &str, input: &Value) -> Result<Payload, AslError> {
+    let expression: Expression = expression.parse()?;
+    let data = Payload::from_value(input)?;
+    expression.evaluate_with_source(
+        &data,
+        &EvaluationContext::from(&data),
+        &mut Fixed::default(),
+    )
+}
+
+#[test]
+fn test_should_execute_all_twelve_independent_intrinsic_catalog_cases() -> TestResult {
+    let catalog: Value = serde_json::from_str(include_str!(
+        "../../../../tests/workflows/semantic-cases.json"
+    ))?;
+    let mut count = 0;
+    for case in catalog["cases"].as_array().ok_or("missing cases")? {
+        if case["kind"] != "intrinsic" {
+            continue;
+        }
+        let result = evaluate(
+            case["expression"].as_str().ok_or("missing expression")?,
+            &case["input"],
+        )?;
+        if case.get("expectedPattern").is_some() {
+            let id = Uuid::parse_str(result.value().as_str().ok_or("not UUID")?)?;
+            assert_eq!(id.get_version(), Some(Version::Random));
+            assert_eq!(id.get_variant(), Variant::RFC4122);
+        } else {
+            assert_eq!(result.value(), &case["expected"], "{}", case["id"]);
+        }
+        count += 1;
+    }
+    assert_eq!(count, 12);
+    Ok(())
+}
+
+#[rstest]
+#[case("States.Array()",json!(null),json!([]))]
+#[case("States.Array(true, false, null, -1, 1.25e1)",json!({}),json!([true,false,null,-1,12.5]))]
+#[case(r"States.Array('\'', '\\', '\{', '\}')",json!({}),json!(["'","\\","{","}"]))]
+#[case(r"States.Format('it\'s {}', 'fine')",json!({}),json!("it's fine"))]
+#[case(r"States.Format('\{\} {}', 'x')",json!({}),json!("{} x"))]
+#[case(r"States.Format('\\{}', 'x')",json!({}),json!("\\x"))]
+#[case(r"States.Format(States.Format('\{\}'), 'x')",json!({}),json!("x"))]
+#[case("States.Format('{}:{}:{}:{}', true, null, 3, 'text')",json!({}),json!("true:null:3:text"))]
+#[case("States.Format($.format, $.x)",json!({"format":"\\{ {} \\}","x":"yes"}),json!("{ yes }"))]
+#[case("States.Array(States.ArrayLength($.x), States.ArrayGetItem($.x, 1))",json!({"x":[1,2]}),json!([2,2]))]
+#[case("States.ArrayContains($.x, 1.0)",json!({"x":[1]}),json!(true))]
+#[case("States.ArrayContains($.x, $.y)",json!({"x":[{"a":[null,2.0]}],"y":{"a":[null,2]}}),json!(true))]
+#[case("States.ArrayContains($.x, $.y)",json!({"x":[{"a":2}],"y":{"b":2}}),json!(false))]
+#[case("States.ArrayPartition($.x, 1.5)",json!({"x":[1,2,3]}),json!([[1,2],[3]]))]
+#[case("States.ArrayPartition($.x, 1)",json!({"x":[]}),json!([]))]
+#[case("States.ArrayPartition($.x, 2147483647)",json!({"x":[1]}),json!([[1]]))]
+#[case("States.StringSplit($.x, ',')",json!({"x":",a,,b,"}),json!(["a","b"]))]
+#[case("States.StringSplit($.x, '')",json!({"x":"ab"}),json!(["ab"]))]
+#[case("States.StringSplit($.x, '')",json!({"x":""}),json!([]))]
+#[case("States.StringSplit($.x, '中🙂')",json!({"x":"中a🙂b中"}),json!(["a","b"]))]
+#[case(r#"States.StringToJson('\{"n":1\}')"#,json!({}),json!({"n":1}))]
+#[case("States.StringSplit($.x, '\n')",json!({"x":"one\ntwo"}),json!(["one","two"]))]
+#[case("States.Array('\0')",json!({}),json!(["\0"]))]
+#[case("States.JsonMerge($.a, $.b, $.deep)",json!({"a":{"x":{"left":1},"keep":2},"b":{"x":{"right":3}},"deep":false}),json!({"x":{"right":3},"keep":2}))]
+fn test_should_preserve_selected_intrinsic_value_and_escape_semantics(
+    #[case] expression: &str,
+    #[case] data: Value,
+    #[case] expected: Value,
+) -> TestResult {
+    assert_eq!(evaluate(expression, &data)?.value(), &expected);
+    Ok(())
+}
+
+#[test]
+fn test_should_pin_historical_aws_half_rounding_and_split_edges() -> TestResult {
+    for (left, right, result) in [
+        (1.49, 1.50, 3),
+        (1.50, 1.51, 4),
+        (-1.49, -1.50, -2),
+        (-1.50, -1.51, -3),
+        (0.5, 0.0, 1),
+        (2.5, 0.0, 3),
+        (-0.5, 0.5, 1),
+        (-0.5, 0.0, 0),
+        (-1.5, 0.0, -1),
+        (-2.5, 0.0, -2),
+    ] {
+        assert_eq!(
+            evaluate("States.MathAdd($.a, $.b)", &json!({"a":left,"b":right}))?.value(),
+            &json!(result)
+        );
+    }
+    for (input, delimiters, expected) in [
+        (" ", ",", vec![" "]),
+        (" , ", ",", vec![" ", " "]),
+        (", , ,", ",", vec![" ", " "]),
+        (",,,,", ",", vec![]),
+        (
+            "This.is+a,test=string",
+            ".+,=",
+            vec!["This", "is", "a", "test", "string"],
+        ),
+        (
+            "split on T and \nnew line",
+            "T\n",
+            vec!["split on ", " and ", "new line"],
+        ),
+    ] {
+        assert_eq!(
+            evaluate(
+                "States.StringSplit($.a, $.b)",
+                &json!({"a":input,"b":delimiters})
+            )?
+            .value(),
+            &json!(expected)
+        );
+    }
+    assert_eq!(
+        evaluate(
+            "States.MathAdd($.x, 0)",
+            &json!({"x":0.499_999_999_999_999_94})
+        )?
+        .value(),
+        &json!(0)
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case("")]
+#[case("'literal'")]
+#[case("true")]
+#[case(" States.Array()")]
+#[case("States.Array() ")]
+#[case("States.Array ()")]
+#[case("States.Unknown()")]
+#[case("States.MathRandom(0,1)")]
+#[case("States.Array(,)")]
+#[case("States.Array(1,)")]
+#[case("States.Array(1 2)")]
+#[case("States.Array([])")]
+#[case("States.Array({})")]
+#[case("States.Array(+1)")]
+#[case("States.Array(1e999)")]
+#[case(r"States.Array('\n')")]
+#[case("States.Array('unterminated)")]
+#[case("States.ArrayLength()")]
+#[case("States.MathAdd(1)")]
+#[case("States.UUID(1)")]
+#[case("States.JsonMerge($.a,$.b,true)")]
+#[case("States.Format('{}')")]
+#[case("States.Format('{x}', 1)")]
+#[case("States.Format('}', 1)")]
+#[case("States.Format('{}', 1, 2)")]
+#[case("States.Array($.x['bad)")]
+fn test_should_reject_malformed_unsupported_or_ambiguous_expression_syntax(#[case] text: &str) {
+    assert!(text.parse::<Expression>().is_err(), "{text}");
+}
+
+#[rstest]
+#[case("States.ArrayLength(1)")]
+#[case("States.ArrayGetItem(1, 0)")]
+#[case("States.ArrayGetItem($.a, -1)")]
+#[case("States.ArrayGetItem($.a, 1.0)")]
+#[case("States.ArrayGetItem($.a, 1)")]
+#[case("States.ArrayPartition($.a, 0)")]
+#[case("States.ArrayPartition($.a, -1)")]
+#[case("States.ArrayPartition($.a, 0.49)")]
+#[case("States.MathAdd('1', 0)")]
+#[case("States.MathAdd(2147483647, 1)")]
+#[case("States.MathAdd(-2147483648, -1)")]
+#[case("States.MathAdd(2147483648, 0)")]
+#[case("States.StringSplit(1, ',')")]
+#[case("States.JsonMerge($.a, $.a, false)")]
+fn test_should_return_typed_intrinsic_value_failures(#[case] text: &str) {
+    assert!(
+        matches!(
+            evaluate(text, &json!({"a":[1]})),
+            Err(AslError::IntrinsicValue)
+        ),
+        "{text}"
+    );
+}
+
+#[test]
+fn test_should_preserve_context_and_quoted_argument_paths() -> TestResult {
+    let data = Payload::from_value(&json!({"a,b)":1,"quote'key":2}))?;
+    let context = EvaluationContext::from_value(&json!({"Execution":{"Name":"run"}}))?;
+    let expression: Expression =
+        r"States.Array($['a,b)'], $['quote\'key'], $$.Execution.Name)".parse()?;
+    assert_eq!(
+        expression
+            .evaluate_with_source(&data, &context, &mut Fixed::default())?
+            .value(),
+        &json!([1, 2, "run"])
+    );
+    assert!(matches!(
+        evaluate("States.Array($.missing)", &json!({})),
+        Err(AslError::Missing)
+    ));
+    assert!(matches!(
+        evaluate("States.Format($.format)", &json!({"format":"{"})),
+        Err(AslError::IntrinsicValue)
+    ));
+    assert!(matches!(
+        evaluate(
+            "States.StringToJson($.text)",
+            &json!({"text":"{\"a\":1,\"a\":2}"})
+        ),
+        Err(AslError::Json(JsonError::Duplicate))
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_expression_bytes_argument_count_and_call_nesting() -> TestResult {
+    let fixed = "States.Array('')".len();
+    let exact = format!("States.Array('{}')", "x".repeat(4096 - fixed));
+    assert_eq!(exact.len(), 4096);
+    exact.parse::<Expression>()?;
+    assert!(format!("{exact}x").parse::<Expression>().is_err());
+    format!("States.Array({})", vec!["0"; 128].join(",")).parse::<Expression>()?;
+    assert!(
+        format!("States.Array({})", vec!["0"; 129].join(","))
+            .parse::<Expression>()
+            .is_err()
+    );
+    assert!(
+        format!("States.Array({})", "1".repeat(129))
+            .parse::<Expression>()
+            .is_err()
+    );
+    let mut nested = "$.x".to_owned();
+    for _ in 0..10 {
+        nested = format!("States.Array({nested})");
+    }
+    evaluate(&nested, &json!({"x":1}))?;
+    assert!(
+        format!("States.Array({nested})")
+            .parse::<Expression>()
+            .is_err()
+    );
+    let full = format!("States.Array({})", vec!["0"; 127].join(","));
+    let short = format!("States.Array({})", vec!["0"; 126].join(","));
+    let mut groups = vec![full.clone(); 7];
+    groups.push(short);
+    let exact_nodes = format!("States.Array({})", groups.join(","));
+    assert!(exact_nodes.len() < 4096);
+    evaluate(&exact_nodes, &json!(null))?;
+    groups.pop();
+    groups.push(full);
+    assert!(matches!(
+        format!("States.Array({})", groups.join(",")).parse::<Expression>(),
+        Err(AslError::InvalidExpression)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_output_and_share_path_data_and_materialization_budgets() -> TestResult {
+    assert!(matches!(
+        evaluate(
+            "States.Format('{}{}', $.x, $.x)",
+            &json!({"x":"a".repeat(140_000)})
+        ),
+        Err(AslError::DataLimit)
+    ));
+    assert!(matches!(
+        evaluate(
+            "States.JsonToString($.x)",
+            &json!({"x":"\"".repeat(130_000)})
+        ),
+        Err(AslError::DataLimit)
+    ));
+    let many = format!("States.Array({})", vec!["$.x"; 128].join(","));
+    assert!(matches!(
+        evaluate(&many, &json!({"x":"a".repeat(100_000)})),
+        Err(AslError::WorkLimit)
+    ));
+    assert_eq!(
+        evaluate("States.ArrayLength($[*])", &json!(vec![0; 9997]))?.value(),
+        &json!(9997)
+    );
+    assert!(matches!(
+        evaluate("States.ArrayLength($[*])", &json!(vec![0; 9998])),
+        Err(AslError::WorkLimit)
+    ));
+    assert!(matches!(
+        evaluate(
+            "States.ArrayContains($.a, $.x)",
+            &json!({"a":vec!["a";100],"x":"a".repeat(100_000)})
+        ),
+        Err(AslError::WorkLimit)
+    ));
+    let too_many: String = (0x1000..0x1401).filter_map(char::from_u32).collect();
+    assert!(matches!(
+        evaluate(
+            "States.StringSplit('x', $.delim)",
+            &json!({"delim":too_many})
+        ),
+        Err(AslError::WorkLimit)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_keep_large_integer_equality_exact_and_reject_float_aliases() -> TestResult {
+    assert_eq!(
+        evaluate(
+            "States.ArrayContains($.a, $.x)",
+            &json!({"a":[u64::MAX],"x":u64::MAX})
+        )?
+        .value(),
+        &json!(true)
+    );
+    assert_eq!(
+        evaluate(
+            "States.ArrayContains($.a, $.x)",
+            &json!({"a":[u64::MAX],"x":u64::MAX-1})
+        )?
+        .value(),
+        &json!(false)
+    );
+    let data = Payload::parse(br#"{"a":[9007199254740992],"x":9007199254740993.0}"#)?;
+    let expression: Expression = "States.ArrayContains($.a, $.x)".parse()?;
+    assert!(matches!(
+        expression.evaluate(&data, &EvaluationContext::from(&data)),
+        Err(AslError::NumericRange)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_charge_duplicate_delimiters_and_failed_object_key_scans() -> TestResult {
+    assert!(matches!(
+        evaluate(
+            "States.StringSplit('x', $.separators)",
+            &json!({"separators":"a".repeat(20_000)})
+        ),
+        Err(AslError::WorkLimit)
+    ));
+    let mut candidate = Map::new();
+    for index in 0..199 {
+        candidate.insert(format!("k{index:03}"), json!(0));
+    }
+    let mut needle = candidate.clone();
+    candidate.insert("z".into(), json!(0));
+    needle.insert("zz".into(), json!(0));
+    let small = json!({"items":[candidate],"needle":needle});
+    assert_eq!(
+        evaluate("States.ArrayContains($.items, $.needle)", &small)?.value(),
+        &json!(false)
+    );
+    let repeated = json!({"items":vec![candidate;100],"needle":needle});
+    assert!(matches!(
+        evaluate("States.ArrayContains($.items, $.needle)", &repeated),
+        Err(AslError::WorkLimit)
+    ));
+    Ok(())
+}
+
+struct Fails;
+impl UuidSource for Fails {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        Err(AslError::Entropy(getrandom::Error::UNSUPPORTED))
+    }
+}
+struct InvalidId;
+impl UuidSource for InvalidId {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        Ok(Uuid::nil())
+    }
+}
+
+#[test]
+fn test_should_use_typed_uuid_sources_and_retain_redacted_entropy_failure() -> TestResult {
+    let expression: Expression = "States.UUID()".parse()?;
+    let data = Payload::parse(b"null")?;
+    let context = EvaluationContext::from(&data);
+    let mut system = SystemUuidSource;
+    let mut ids = BTreeSet::new();
+    for _ in 0..8 {
+        let id = system.next_uuid()?;
+        assert_eq!(id.get_version(), Some(Version::Random));
+        ids.insert(id);
+    }
+    assert_eq!(ids.len(), 8);
+    let fixed = expression.evaluate_with_source(&data, &context, &mut Fixed::default())?;
+    assert_eq!(
+        fixed.value(),
+        &json!(Builder::from_random_bytes([1; 16]).into_uuid().to_string())
+    );
+    let error = expression
+        .evaluate_with_source(&data, &context, &mut Fails)
+        .err()
+        .ok_or("missing failure")?;
+    assert!(error.source().is_some());
+    assert_eq!(format!("{error:?}"), "ASL UUID entropy unavailable");
+    assert!(matches!(
+        expression.evaluate_with_source(&data, &context, &mut InvalidId),
+        Err(AslError::IntrinsicValue)
+    ));
+    assert_eq!(
+        format!("{:?}", "States.Array('private')".parse::<Expression>()?),
+        "Expression(<redacted>)"
+    );
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_parse_arbitrary_utf8_expressions_without_panicking(text in ".{0,4200}") { let _=text.parse::<Expression>(); }
+
+    #[test]
+    fn test_should_preserve_checked_integer_addition(a in -1_000_000_i32..1_000_000,b in -1_000_000_i32..1_000_000) {
+        let result=evaluate("States.MathAdd($.a,$.b)",&json!({"a":a,"b":b})).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(result.value(),&json!(a+b));
+    }
+}
+
+#[rstest]
+#[case("-0", json!(0))]
+#[case(" [ -0, {\"x\": -0, \"-0\": \"-0\"} ] ", json!([0,{"x":0,"-0":"-0"}]))]
+#[case(r#"{"escaped":"\\\"-0","unicode":"🙂-0","n":-0}"#, json!({"escaped":"\\\"-0","unicode":"🙂-0","n":0}))]
+#[case("[-0.0,-0e0,-1,0]", json!([-0.0,-0.0,-1,0]))]
+fn test_should_normalize_only_complete_unquoted_negative_integer_zero_tokens(
+    #[case] source: &str,
+    #[case] expected: Value,
+) -> TestResult {
+    let result = evaluate("States.StringToJson($.text)", &json!({"text":source}))?;
+    assert_eq!(result.value(), &expected);
+    Ok(())
+}
+
+#[rstest]
+#[case("-00")]
+#[case("[-0,]")]
+#[case("{\"x\":-0,\"x\":0}")]
+#[case("\u{00a0}")]
+#[case("\u{2003}")]
+fn test_should_reject_invalid_json_before_negative_zero_normalization(#[case] source: &str) {
+    assert!(evaluate("States.StringToJson($.text)", &json!({"text":source})).is_err());
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_preserve_arbitrary_quoted_text_while_normalizing_integer_zero(text in ".{0,128}") {
+        let quoted = serde_json::to_string(&text).map_err(|error|TestCaseError::fail(error.to_string()))?;
+        let source = format!("[{quoted},-0,-0.0]");
+        let result = evaluate("States.StringToJson($.text)",&json!({"text":source})).map_err(|error|TestCaseError::fail(error.to_string()))?;
+        prop_assert_eq!(result.value(),&json!([text,0,-0.0]));
+    }
+}
+
+#[rstest]
+#[case("1e-0")]
+#[case("-0e-0")]
+#[case("[-0.0,1e-0,\"-0\"]")]
+fn test_should_preserve_original_zero_exponent_and_string_spellings(
+    #[case] source: &str,
+) -> TestResult {
+    let result = evaluate("States.StringToJson($.text)", &json!({"text":source}))?;
+    assert_eq!(result.original_bytes(), source.as_bytes());
+    Ok(())
+}
+
+#[test]
+fn test_should_charge_the_conditional_normalized_json_reparse() -> TestResult {
+    let expression: Expression = "States.StringToJson($.text)".parse()?;
+    let data = Payload::from_value(&json!({"text":"-0"}))?;
+    let context = EvaluationContext::from(&data);
+    for (text, accepted) in [(6, false), (7, true)] {
+        let mut budget = Budget {
+            text,
+            ..Budget::new()
+        };
+        let result =
+            expression.evaluate_scoped(&data, &context, &mut Fixed::default(), &mut budget);
+        if accepted {
+            assert_eq!(result?.value(), &json!(0));
+        } else {
+            assert!(matches!(result, Err(AslError::WorkLimit)));
+        }
+    }
+    Ok(())
+}
+
+#[rstest]
+#[case("", Value::Null)]
+#[case(" \t\r\n", Value::Null)]
+#[case("{\"a\":1}", json!({"a":1}))]
+fn test_should_accept_observed_empty_json_inputs_and_normal_documents(
+    #[case] source: &str,
+    #[case] expected: Value,
+) -> TestResult {
+    assert_eq!(
+        evaluate("States.StringToJson($.text)", &json!({"text":source}))?.value(),
+        &expected
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({"z":[true,null,{"name":"hello"}],"a":"🙂"}),"{a=🙂, z=[true, null, {name=hello}]}")]
+#[case(json!([1,"a",{},[]]),"[1, a, {}, []]")]
+#[case(json!({"quoted key":"\"x\""}),"{quoted key=\"x\"}")]
+fn test_should_format_observed_recursive_map_and_array_values(
+    #[case] value: Value,
+    #[case] expected: &str,
+) -> TestResult {
+    assert_eq!(
+        evaluate("States.Format('{}', $.value)", &json!({"value":value}))?.value(),
+        &json!(expected)
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_allow_literal_braces_without_reinterpreting_format_template_escapes() -> TestResult {
+    assert_eq!(
+        evaluate(r#"States.StringToJson('{"a":1}')"#, &json!({}))?.value(),
+        &json!({"a":1})
+    );
+    assert_eq!(
+        evaluate("States.Array('unescaped{')", &json!({}))?.value(),
+        &json!(["unescaped{"])
+    );
+    assert_eq!(
+        evaluate(r"States.Format('\{ {} \}', 'value}')", &json!({}))?.value(),
+        &json!("{ value} }")
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_collection_format_work_and_expanded_output() -> TestResult {
+    assert!(matches!(
+        evaluate(
+            "States.Format('{}', $.value)",
+            &json!({"value":vec![0;10_000]})
+        ),
+        Err(AslError::WorkLimit)
+    ));
+    let value = json!({"value":"x".repeat(140_000)});
+    assert!(matches!(
+        evaluate("States.Format('{}{}', $.value, $.value)", &value),
+        Err(AslError::DataLimit)
+    ));
+    let expression: Expression = "States.StringToJson($.text)".parse()?;
+    let data = Payload::from_value(&json!({"text":" \n"}))?;
+    let mut budget = Budget {
+        text: 1,
+        ..Budget::new()
+    };
+    assert!(matches!(
+        expression.evaluate_scoped(
+            &data,
+            &EvaluationContext::from(&data),
+            &mut Fixed::default(),
+            &mut budget
+        ),
+        Err(AslError::WorkLimit)
+    ));
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/lib.rs b/crates/rustack-stepfunctions-core/src/lib.rs
new file mode 100644
index 00000000..347aee8e
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/lib.rs
@@ -0,0 +1,63 @@
+//! Bounded ASL compilation and supervised local workflow execution.
+//!
+//! Immutable payloads and scoped IR feed actor-owned execution/history. Concrete
+//! task ports keep Lambda/runtime ownership outside this crate; there is no SDK,
+//! Lambda-core, Docker or HTTP dependency. The actor-owned registry exposes validated domain
+//! commands; HTTP preparation, pagination and main-service composition remain the embedding
+//! application's responsibility.
+
+#![forbid(unsafe_code)]
+
+mod callback_parameters;
+mod choice;
+mod compiler;
+mod dataflow;
+mod engine;
+mod error;
+mod expression;
+mod path;
+mod payload;
+mod registry;
+mod task;
+mod template;
+mod wait;
+
+pub use callback_parameters::{CallbackHistory, CallbackParameters};
+pub use choice::Predicate;
+pub use compiler::{
+    AslCompiler, CatchResult, Catcher, Compilation, CompileError, CompiledMachine, Diagnostic,
+    DiagnosticSeverity, FailureView, FunctionArn, Integration, Jitter, MapConcurrency,
+    RecoveryPolicy, Retrier, RetryTiming, StateId, StateSupport, StateView, TaskSupport,
+    TaskTimeout, TenantScope, Transition,
+};
+pub use dataflow::DataFlow;
+pub use engine::{
+    AttemptId, CallbackDispatch, CleanupState, ClockSample, DriverStep, DriverUpdate,
+    ExecutionDriver, ExecutionError, ExecutionFailure, ExecutionHandle, ExecutionHistory,
+    ExecutionLimits, ExecutionOutcome, ExecutionSource, ExecutionSupervisor, ExecutionView,
+    FanoutBranch, FanoutFailure, FanoutPlan, FrameCallId, FrameCapacity, FrameError, FrameId,
+    FrameLease, FrameLimits, FrameParent, FrameScheduler, FrameTransition, FrameUpdate,
+    HistoryLimits, HistoryPage, PropagatedFailure, RuntimeLimits, TaskDispatch, TaskFailure,
+};
+pub use error::AslError;
+pub use expression::{Expression, SystemUuidSource, UuidSource};
+pub use path::{MatchKind, Path, PathMatches, ReferencePath, ResultPath};
+pub use payload::{EvaluationContext, MAX_PAYLOAD_BYTES, Payload};
+pub use registry::{
+    CallbackAck, CallbackAttempt, CallbackCommand, CallbackError, CallbackInvocation,
+    CallbackInvocationMetadata, CallbackInvocationReporter, CallbackLimits, CallbackMint,
+    CallbackOutcome, CallbackRegistry, CallbackStatus, CallbackSupervisor, CallbackTask,
+    CallbackTimeout, CallbackToken, ChildError, ChildExecution, ChildExecutionPort, ChildParent,
+    ChildPattern, ChildStartParameters, ChildSubmission, DefinitionRevision, ExecutionArn,
+    ExecutionName, ExecutionSnapshot, MachineSnapshot, MachineStatus, PreparedDefinition,
+    PreparedSnapshot, Registry, RegistryCapacities, RegistryCommand, RegistryError,
+    RegistryHistories, RegistryLimits, RegistryMetadata, RegistryReceipt, RegistryResult,
+    RegistrySnapshot, RegistryStatus, RegistrySupervisor, RoleArn, SnapshotLimits, StateMachineArn,
+    StateMachineName, StopReason, Tags,
+};
+pub use task::{
+    LambdaTaskCommand, LambdaTaskPort, QuarantinedTask, TaskCall, TaskChannelError, TaskEvent,
+    TaskResponder, TaskSettlement,
+};
+pub use template::Template;
+pub use wait::WaitSource;
diff --git a/crates/rustack-stepfunctions-core/src/path.rs b/crates/rustack-stepfunctions-core/src/path.rs
new file mode 100644
index 00000000..b57df19e
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/path.rs
@@ -0,0 +1,507 @@
+//! Compiled bounded `JSONPath` subset, borrowed selection and result merging.
+
+use std::{fmt, str::FromStr};
+
+use serde_json::{Map, Value};
+use winnow::{
+    ModalResult, Parser,
+    token::{any, take_while},
+};
+
+use crate::{AslError, EvaluationContext, Payload, payload::encode};
+
+const MAX_PATH_BYTES: usize = 1024;
+const MAX_SEGMENTS: usize = 128;
+const MAX_WORK: usize = 10_000;
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Root {
+    Data,
+    Context,
+}
+
+#[derive(Clone)]
+enum Segment {
+    Member(String),
+    Index(usize),
+    Wildcard,
+    Slice { start: usize, end: Option<usize> },
+}
+
+/// Immutable compiled path, with no runtime reparsing or unsupported operators.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct Path {
+    root: Root,
+    segments: Vec<Segment>,
+    selection: bool,
+}
+
+impl fmt::Debug for Path {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Path(<redacted>)")
+    }
+}
+
+impl FromStr for Path {
+    type Err = AslError;
+
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        if text.is_empty() || text.len() > MAX_PATH_BYTES {
+            return Err(AslError::InvalidPath);
+        }
+        let mut input = text;
+        literal(&mut input, "$")?;
+        let root = if input.starts_with('$') {
+            literal(&mut input, "$")?;
+            Root::Context
+        } else {
+            Root::Data
+        };
+        let mut segments = Vec::new();
+        let mut selection = false;
+        while !input.is_empty() {
+            if segments.len() >= MAX_SEGMENTS {
+                return Err(AslError::InvalidPath);
+            }
+            let segment = if input.starts_with('.') {
+                literal(&mut input, ".")?;
+                let first: ModalResult<&str> =
+                    take_while(1, identifier_first).parse_next(&mut input);
+                let first = first.map_err(|_| AslError::InvalidPath)?;
+                let rest: ModalResult<&str> =
+                    take_while(0.., identifier_rest).parse_next(&mut input);
+                let rest = rest.map_err(|_| AslError::InvalidPath)?;
+                Segment::Member(format!("{first}{rest}"))
+            } else {
+                bracket(&mut input)?
+            };
+            selection |= matches!(segment, Segment::Wildcard | Segment::Slice { .. });
+            segments.push(segment);
+        }
+        Ok(Self {
+            root,
+            segments,
+            selection,
+        })
+    }
+}
+
+fn identifier_first(value: char) -> bool {
+    value == '_' || value.is_ascii_alphabetic() || (!value.is_ascii() && !value.is_control())
+}
+
+fn identifier_rest(value: char) -> bool {
+    identifier_first(value) || value.is_ascii_digit()
+}
+
+fn literal(input: &mut &str, mut token: &'static str) -> Result<(), AslError> {
+    let parsed: ModalResult<&str> = token.parse_next(input);
+    parsed.map(|_| ()).map_err(|_| AslError::InvalidPath)
+}
+
+fn number(input: &mut &str) -> Result<Option<usize>, AslError> {
+    let parsed: ModalResult<&str> = take_while(0.., |c: char| c.is_ascii_digit()).parse_next(input);
+    let text = parsed.map_err(|_| AslError::InvalidPath)?;
+    if text.is_empty() {
+        Ok(None)
+    } else {
+        text.parse().map(Some).map_err(|_| AslError::InvalidPath)
+    }
+}
+
+fn quoted(input: &mut &str) -> Result<String, AslError> {
+    literal(input, "'")?;
+    let mut key = String::new();
+    loop {
+        let parsed: ModalResult<char> = any.parse_next(input);
+        match parsed.map_err(|_| AslError::InvalidPath)? {
+            '\'' => return Ok(key),
+            '\\' => {
+                let escaped: ModalResult<char> = any.parse_next(input);
+                match escaped.map_err(|_| AslError::InvalidPath)? {
+                    value @ ('\'' | '\\') => key.push(value),
+                    _ => return Err(AslError::InvalidPath),
+                }
+            }
+            value if value.is_control() => return Err(AslError::InvalidPath),
+            value => key.push(value),
+        }
+    }
+}
+
+fn bracket(input: &mut &str) -> Result<Segment, AslError> {
+    literal(input, "[")?;
+    let segment = if input.starts_with('\'') {
+        Segment::Member(quoted(input)?)
+    } else if input.starts_with('*') {
+        literal(input, "*")?;
+        Segment::Wildcard
+    } else {
+        let lower = number(input)?;
+        if input.starts_with(':') {
+            literal(input, ":")?;
+            Segment::Slice {
+                start: lower.unwrap_or(0),
+                end: number(input)?,
+            }
+        } else {
+            Segment::Index(lower.ok_or(AslError::InvalidPath)?)
+        }
+    };
+    literal(input, "]")?;
+    Ok(segment)
+}
+
+/// Shape of a path result; JSON null is still a single selected value.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum MatchKind {
+    /// No value matched a singular traversal.
+    Missing,
+    /// Exactly one value was selected without selection operators.
+    Single,
+    /// Wildcard/slice semantics, including zero or one selected value.
+    Selection,
+}
+
+/// Borrowed immutable matches, constructible only through a bounded path.
+#[non_exhaustive]
+pub struct PathMatches<'a> {
+    kind: MatchKind,
+    values: Vec<&'a Value>,
+}
+
+impl fmt::Debug for PathMatches<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("PathMatches")
+            .field("kind", &self.kind)
+            .finish_non_exhaustive()
+    }
+}
+
+impl PathMatches<'_> {
+    /// Inspect cardinality semantics without exposing business data.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Path, Payload, MatchKind};
+    /// let data = Payload::parse(b"null")?;
+    /// let context = rustack_stepfunctions_core::EvaluationContext::from(&data);
+    /// let result = "$".parse::<Path>()?.select(&data, &context)?;
+    /// assert_eq!(result.kind(), MatchKind::Single);
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn kind(&self) -> MatchKind {
+        self.kind
+    }
+
+    /// Read a singular match; missing and selection results return None.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Path, Payload};
+    /// let data = Payload::parse(b"null")?;
+    /// assert!("$".parse::<Path>()?.select(&data, &rustack_stepfunctions_core::EvaluationContext::from(&data))?.single().is_some());
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn single(&self) -> Option<&Value> {
+        if self.kind == MatchKind::Single {
+            self.values.first().copied()
+        } else {
+            None
+        }
+    }
+
+    /// Materialize a complete bounded result; selections always become arrays.
+    ///
+    /// # Errors
+    /// Rejects missing matches, excessive encoded data or constructed depth.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Path, Payload};
+    /// let data = Payload::parse(b"[7]")?;
+    /// let result = "$[*]".parse::<Path>()?.select(&data, &rustack_stepfunctions_core::EvaluationContext::from(&data))?.to_payload()?;
+    /// assert_eq!(result.original_bytes(), b"[7]");
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn to_payload(&self) -> Result<Payload, AslError> {
+        let bytes = match self.kind {
+            MatchKind::Missing => return Err(AslError::Missing),
+            MatchKind::Single => encode(self.values.first().ok_or(AslError::Missing)?)?,
+            MatchKind::Selection => encode(&self.values)?,
+        };
+        Payload::from_bytes(bytes)
+    }
+}
+
+impl Path {
+    /// Evaluate compiled segments against immutable data and context roots.
+    ///
+    /// # Errors
+    /// Rejects evaluation beyond10,000 visited candidates/selected members.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Path, Payload};
+    /// let data = Payload::parse(br#"{"items":[{"n":3}]}"#)?;
+    /// let path: Path = "$.items[*].n".parse()?;
+    /// assert_eq!(path.select(&data, &rustack_stepfunctions_core::EvaluationContext::from(&data))?.to_payload()?.value(), &serde_json::json!([3]));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn select<'a>(
+        &self,
+        data: &'a Payload,
+        context: &'a EvaluationContext,
+    ) -> Result<PathMatches<'a>, AslError> {
+        let mut remaining = MAX_WORK;
+        self.select_with_work(data, context, &mut remaining)
+    }
+
+    pub(crate) fn callback_sensitive(&self, input_sensitive: bool) -> bool {
+        // Task/Token are object members, and the injected token is a scalar
+        // String. This path profile cannot traverse a scalar after that address.
+        if self.root == Root::Data {
+            return input_sensitive;
+        }
+        if self.segments.len() > 2 {
+            return false;
+        }
+        self.segments
+            .iter()
+            .zip(["Task", "Token"])
+            .all(|(segment, expected)| match segment {
+                Segment::Member(member) => member == expected,
+                Segment::Wildcard => true,
+                Segment::Index(_) | Segment::Slice { .. } => false,
+            })
+    }
+
+    pub(crate) fn select_with_work<'a>(
+        &self,
+        data: &'a Payload,
+        context: &'a EvaluationContext,
+        remaining: &mut usize,
+    ) -> Result<PathMatches<'a>, AslError> {
+        let root = match self.root {
+            Root::Data => data.value(),
+            Root::Context => context.value(),
+        };
+        let mut values = vec![root];
+        for segment in &self.segments {
+            let mut next = Vec::new();
+            for value in values {
+                spend(remaining, 1)?;
+                select_segment(segment, value, &mut next, remaining)?;
+            }
+            values = next;
+        }
+        let kind = if self.selection {
+            MatchKind::Selection
+        } else if values.is_empty() {
+            MatchKind::Missing
+        } else {
+            MatchKind::Single
+        };
+        Ok(PathMatches { kind, values })
+    }
+}
+
+fn spend(remaining: &mut usize, amount: usize) -> Result<(), AslError> {
+    *remaining = remaining.checked_sub(amount).ok_or(AslError::WorkLimit)?;
+    Ok(())
+}
+
+fn select_segment<'a>(
+    segment: &Segment,
+    value: &'a Value,
+    next: &mut Vec<&'a Value>,
+    remaining: &mut usize,
+) -> Result<(), AslError> {
+    match segment {
+        Segment::Member(key) => {
+            if let Some(value) = value.as_object().and_then(|object| object.get(key)) {
+                next.push(value);
+            }
+        }
+        Segment::Index(index) => {
+            if let Some(value) = value.as_array().and_then(|array| array.get(*index)) {
+                next.push(value);
+            }
+        }
+        Segment::Wildcard => match value {
+            Value::Array(values) => {
+                spend(remaining, values.len())?;
+                next.extend(values);
+            }
+            Value::Object(values) => {
+                spend(remaining, values.len())?;
+                let mut ordered: Vec<_> = values.iter().collect();
+                ordered.sort_unstable_by_key(|(key, _)| *key);
+                next.extend(ordered.into_iter().map(|(_, value)| value));
+            }
+            _ => {}
+        },
+        Segment::Slice { start, end } => {
+            if let Some(values) = value.as_array() {
+                let lower = (*start).min(values.len());
+                let upper = end.unwrap_or(values.len()).min(values.len());
+                if upper > lower {
+                    spend(remaining, upper.saturating_sub(lower))?;
+                    next.extend(values.get(lower..upper).ok_or(AslError::InvalidPath)?);
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Compiled singular reference into either immutable root.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ReferencePath(Path);
+
+impl fmt::Debug for ReferencePath {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ReferencePath(<redacted>)")
+    }
+}
+
+impl TryFrom<Path> for ReferencePath {
+    type Error = AslError;
+    fn try_from(path: Path) -> Result<Self, Self::Error> {
+        if path.selection {
+            Err(AslError::InvalidReference)
+        } else {
+            Ok(Self(path))
+        }
+    }
+}
+
+impl FromStr for ReferencePath {
+    type Err = AslError;
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        Self::try_from(text.parse::<Path>()?)
+    }
+}
+
+impl ReferencePath {
+    /// Look up a singular reference; missing/container mismatch returns None.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{ReferencePath, Payload};
+    /// let data = Payload::parse(br#"{"n":null}"#)?;
+    /// assert!("$.n".parse::<ReferencePath>()?.lookup(&data, &rustack_stepfunctions_core::EvaluationContext::from(&data)).is_some());
+    /// assert!("$.absent".parse::<ReferencePath>()?.lookup(&data, &rustack_stepfunctions_core::EvaluationContext::from(&data)).is_none());
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn lookup<'a>(
+        &self,
+        data: &'a Payload,
+        context: &'a EvaluationContext,
+    ) -> Option<&'a Value> {
+        let mut value = match self.0.root {
+            Root::Data => data.value(),
+            Root::Context => context.value(),
+        };
+        for segment in &self.0.segments {
+            value = match segment {
+                Segment::Member(key) => value.as_object()?.get(key)?,
+                Segment::Index(index) => value.as_array()?.get(*index)?,
+                Segment::Wildcard | Segment::Slice { .. } => return None,
+            };
+        }
+        Some(value)
+    }
+}
+
+/// Data-root reference validated for result writes; context writes are rejected.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ResultPath(ReferencePath);
+
+impl fmt::Debug for ResultPath {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ResultPath(<redacted>)")
+    }
+}
+
+impl TryFrom<ReferencePath> for ResultPath {
+    type Error = AslError;
+    fn try_from(path: ReferencePath) -> Result<Self, Self::Error> {
+        if path.0.root == Root::Context {
+            Err(AslError::InvalidResultTarget)
+        } else {
+            Ok(Self(path))
+        }
+    }
+}
+
+impl FromStr for ResultPath {
+    type Err = AslError;
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        Self::try_from(text.parse::<ReferencePath>()?)
+    }
+}
+
+impl ResultPath {
+    /// Merge into original state input without mutating either input on failure.
+    ///
+    /// # Errors
+    /// Rejects scalar traversal, absent/out-of-range array slots and output limits.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{ResultPath, Payload};
+    /// let state = Payload::parse(br#"{"n":1}"#)?;
+    /// let result = Payload::parse(b"2")?;
+    /// let output = "$.nested.value".parse::<ResultPath>()?.merge(&state, &result)?;
+    /// assert_eq!(output.value()["nested"]["value"], 2);
+    /// assert_eq!(state.value(), &serde_json::json!({"n":1}));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn merge(&self, original: &Payload, result: &Payload) -> Result<Payload, AslError> {
+        if self.0.0.segments.is_empty() {
+            return Ok(result.clone());
+        }
+        let mut output = original.value().clone();
+        let mut destination = &mut output;
+        let mut segments = self.0.0.segments.iter().peekable();
+        while let Some(segment) = segments.next() {
+            let last = segments.peek().is_none();
+            destination = match segment {
+                Segment::Member(key) => {
+                    let object = destination.as_object_mut().ok_or(AslError::Merge)?;
+                    if last {
+                        object.insert(key.clone(), result.value().clone());
+                        break;
+                    }
+                    if !object.contains_key(key) {
+                        if !matches!(segments.peek(), Some(Segment::Member(_))) {
+                            return Err(AslError::Merge);
+                        }
+                        object.insert(key.clone(), Value::Object(Map::new()));
+                    }
+                    object.get_mut(key).ok_or(AslError::Merge)?
+                }
+                Segment::Index(index) => {
+                    let slot = destination
+                        .as_array_mut()
+                        .and_then(|values| values.get_mut(*index))
+                        .ok_or(AslError::Merge)?;
+                    if last {
+                        *slot = result.value().clone();
+                        break;
+                    }
+                    slot
+                }
+                Segment::Wildcard | Segment::Slice { .. } => {
+                    return Err(AslError::InvalidResultTarget);
+                }
+            };
+        }
+        Payload::from_value(&output)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/path/tests.rs b/crates/rustack-stepfunctions-core/src/path/tests.rs
new file mode 100644
index 00000000..ffc8cd57
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/path/tests.rs
@@ -0,0 +1,342 @@
+use std::{error::Error, str::FromStr};
+
+use proptest::prelude::*;
+use rstest::rstest;
+use rustack_core::json::JsonError;
+use serde_json::{Value, json};
+
+use crate::{
+    AslError, EvaluationContext, MAX_PAYLOAD_BYTES, MatchKind, Path, Payload, ReferencePath,
+    ResultPath,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+#[test]
+fn test_should_execute_independent_catalog_path_cases() -> TestResult {
+    let catalog: Value = serde_json::from_str(include_str!(
+        "../../../../tests/workflows/semantic-cases.json"
+    ))?;
+    let mut count = 0;
+    for case in catalog["cases"].as_array().ok_or("missing cases")? {
+        if case["kind"] != "path" {
+            continue;
+        }
+        let input = Payload::from_value(&case["input"])?;
+        let context =
+            EvaluationContext::from_value(&case.get("context").cloned().unwrap_or(json!({})))?;
+        let path: Path = case["path"].as_str().ok_or("missing path")?.parse()?;
+        let matches = path.select(&input, &context)?;
+        if case.get("expectedError").is_some() {
+            assert_eq!(matches.kind(), MatchKind::Missing);
+            assert!(matches!(matches.to_payload(), Err(AslError::Missing)));
+        } else {
+            assert_eq!(
+                matches.to_payload()?.value(),
+                &case["expected"],
+                "{}",
+                case["id"]
+            );
+        }
+        count += 1;
+    }
+    assert_eq!(count, 7);
+    Ok(())
+}
+
+#[rstest]
+#[case("$")]
+#[case("$$")]
+#[case("$.a_b0")]
+#[case("$.商品.价格")]
+#[case("$['']")]
+#[case("$['a\\'b']")]
+#[case("$['a\\\\b']")]
+#[case("$[0001]")]
+#[case("$[:]")]
+#[case("$[:2]")]
+#[case("$[2:]")]
+#[case("$[2:0]")]
+#[case("$[*][*]")]
+fn test_should_compile_the_explicit_path_subset(#[case] text: &str) -> TestResult {
+    let path: Path = text.parse()?;
+    assert_eq!(format!("{path:?}"), "Path(<redacted>)");
+    Ok(())
+}
+
+#[rstest]
+#[case("")]
+#[case(" ")]
+#[case("x")]
+#[case("$$$")]
+#[case("$.0a")]
+#[case("$.a-b")]
+#[case("$.a.")]
+#[case("$..a")]
+#[case("$.*")]
+#[case("$[]")]
+#[case("$[-1]")]
+#[case("$[+1]")]
+#[case("$[1,2]")]
+#[case("$[1:2:1]")]
+#[case("$[ 1]")]
+#[case("$[?(@.x)]")]
+#[case("$[\"a\"]")]
+#[case("$['unterminated]")]
+#[case("$['bad\\q']")]
+#[case("$['bad\n']")]
+#[case("$['a']junk")]
+#[case("$[999999999999999999999999999999999]")]
+fn test_should_reject_unsupported_or_hostile_path_syntax(#[case] text: &str) {
+    assert!(matches!(Path::from_str(text), Err(AslError::InvalidPath)));
+}
+
+#[test]
+fn test_should_enforce_exact_path_bytes_and_segment_counts() -> TestResult {
+    let maximum = format!("$['{}']", "k".repeat(1019));
+    assert_eq!(maximum.len(), 1024);
+    maximum.parse::<Path>()?;
+    assert!(matches!(
+        format!("{maximum}x").parse::<Path>(),
+        Err(AslError::InvalidPath)
+    ));
+    format!("${}", ".a".repeat(128)).parse::<Path>()?;
+    assert!(matches!(
+        format!("${}", ".a".repeat(129)).parse::<Path>(),
+        Err(AslError::InvalidPath)
+    ));
+    Ok(())
+}
+
+#[rstest]
+#[case("$[*][*]", json!([[1,2],[],[3]]), json!([1,2,3]))]
+#[case("$[*].n", json!([{"n":1},{},{"n":null}]), json!([1,null]))]
+#[case("$[*]", json!({"z":3,"a":1,"m":2}), json!([1,2,3]))]
+#[case("$[1:]", json!([0,1,2]), json!([1,2]))]
+#[case("$[:2]", json!([0,1,2]), json!([0,1]))]
+#[case("$[1:999]", json!([0,1,2]), json!([1,2]))]
+#[case("$[999:]", json!([0,1,2]), json!([]))]
+#[case("$[2:1]", json!([0,1,2]), json!([]))]
+#[case("$[*]", json!(null), json!([]))]
+#[case("$.missing[*]", json!({}), json!([]))]
+fn test_should_preserve_deterministic_selection_semantics(
+    #[case] text: &str,
+    #[case] input: Value,
+    #[case] expected: Value,
+) -> TestResult {
+    let data = Payload::from_value(&input)?;
+    let context = EvaluationContext::from(&data);
+    let result = text.parse::<Path>()?.select(&data, &context)?;
+    assert_eq!(result.kind(), MatchKind::Selection);
+    assert!(result.single().is_none());
+    assert_eq!(result.to_payload()?.value(), &expected);
+    Ok(())
+}
+
+#[test]
+fn test_should_distinguish_missing_null_context_and_wrong_container() -> TestResult {
+    let data = Payload::parse(br#"{"n":null,"a":[],"x":3}"#)?;
+    let context = EvaluationContext::from_value(&json!({"n":"context"}))?;
+    let null = "$.n".parse::<Path>()?.select(&data, &context)?;
+    assert_eq!(null.kind(), MatchKind::Single);
+    assert_eq!(null.single(), Some(&Value::Null));
+    assert_eq!(
+        "$$.n".parse::<ReferencePath>()?.lookup(&data, &context),
+        Some(&json!("context"))
+    );
+    for text in ["$.absent", "$.a[0]", "$.x.n", "$.a.n", "$.n.n", "$[0]"] {
+        assert_eq!(
+            text.parse::<Path>()?.select(&data, &context)?.kind(),
+            MatchKind::Missing
+        );
+        assert!(
+            text.parse::<ReferencePath>()?
+                .lookup(&data, &context)
+                .is_none()
+        );
+    }
+    Ok(())
+}
+
+#[test]
+fn test_should_prove_reference_and_result_root_invariants() -> TestResult {
+    for path in ["$[*]", "$[0:2]", "$$.x[*]"] {
+        assert!(matches!(
+            path.parse::<ReferencePath>(),
+            Err(AslError::InvalidReference)
+        ));
+    }
+    "$$.x".parse::<ReferencePath>()?;
+    assert!(matches!(
+        "$$.x".parse::<ResultPath>(),
+        Err(AslError::InvalidResultTarget)
+    ));
+    assert_eq!(
+        format!("{:?}", "$.secret".parse::<ReferencePath>()?),
+        "ReferencePath(<redacted>)"
+    );
+    assert_eq!(
+        format!("{:?}", "$.secret".parse::<ResultPath>()?),
+        "ResultPath(<redacted>)"
+    );
+    Ok(())
+}
+
+#[rstest]
+#[case("$", json!({"a":1}), json!(7))]
+#[case("$.a.b", json!({}), json!({"a":{"b":7}}))]
+#[case("$.a", json!({"a":null}), json!({"a":7}))]
+#[case("$[1].a", json!([0,{}]), json!([0,{"a":7}]))]
+#[case("$[0]", json!([1]), json!([7]))]
+#[case("$['odd.key']", json!({"old":1}), json!({"old":1,"odd.key":7}))]
+fn test_should_merge_only_valid_object_and_existing_array_targets(
+    #[case] path: &str,
+    #[case] input: Value,
+    #[case] expected: Value,
+) -> TestResult {
+    let original = Payload::from_value(&input)?;
+    let result = Payload::parse(b"7")?;
+    let output = path.parse::<ResultPath>()?.merge(&original, &result)?;
+    assert_eq!(output.value(), &expected);
+    assert_eq!(original.value(), &input);
+    Ok(())
+}
+
+#[rstest]
+#[case("$.a.b", json!({"a":null}))]
+#[case("$.a.b", json!({"a":1}))]
+#[case("$.a[0]", json!({}))]
+#[case("$[0]", json!([]))]
+#[case("$[1]", json!([0]))]
+#[case("$.x", json!(null))]
+#[case("$.x", json!([]))]
+#[case("$[0]", json!({"0":1}))]
+fn test_should_reject_invalid_merges_without_mutating_original(
+    #[case] path: &str,
+    #[case] input: Value,
+) -> TestResult {
+    let original = Payload::from_value(&input)?;
+    let result = Payload::parse(b"7")?;
+    assert!(matches!(
+        path.parse::<ResultPath>()?.merge(&original, &result),
+        Err(AslError::Merge)
+    ));
+    assert_eq!(original.value(), &input);
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_path_work_and_merged_output() -> TestResult {
+    let exact = Payload::from_value(&json!(vec![0; 9999]))?;
+    let path: Path = "$[*]".parse()?;
+    path.select(&exact, &EvaluationContext::from(&exact))?
+        .to_payload()?;
+    let excess = Payload::from_value(&json!(vec![0; 10_000]))?;
+    assert!(matches!(
+        path.select(&excess, &EvaluationContext::from(&excess)),
+        Err(AslError::WorkLimit)
+    ));
+    let large = Payload::from_value(&json!({"large":"v".repeat(150_000)}))?;
+    let result = Payload::from_value(&json!("x".repeat(150_000)))?;
+    assert!(matches!(
+        "$.result".parse::<ResultPath>()?.merge(&large, &result),
+        Err(AslError::DataLimit)
+    ));
+    assert!(large.value().get("result").is_none());
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_selection_materialization_before_cloning_or_encoding_large_data() -> TestResult
+{
+    let source = Payload::from_value(&json!([[["x".repeat(262_136)]]]))?;
+    assert_eq!(source.original_bytes().len(), MAX_PAYLOAD_BYTES);
+    let selected = "$[*]"
+        .parse::<Path>()?
+        .select(&source, &EvaluationContext::from(&source))?
+        .to_payload()?;
+    assert_eq!(selected.original_bytes().len(), MAX_PAYLOAD_BYTES);
+    assert_eq!(selected.value(), source.value());
+    let flattened = "$[*][*]"
+        .parse::<Path>()?
+        .select(&source, &EvaluationContext::from(&source))?
+        .to_payload()?;
+    assert_eq!(flattened.original_bytes().len(), MAX_PAYLOAD_BYTES - 2);
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_payload_bytes_depth_members_duplicates_and_encoding() -> TestResult {
+    let raw = format!("\"{}\"", "x".repeat(MAX_PAYLOAD_BYTES - 2));
+    let data = Payload::parse(raw.as_bytes())?;
+    assert_eq!(data.original_bytes().len(), MAX_PAYLOAD_BYTES);
+    assert!(matches!(
+        Payload::parse(format!("{raw} ").as_bytes()),
+        Err(AslError::Json(JsonError::Bytes))
+    ));
+    assert!(matches!(
+        Payload::parse(br#"{"a":1,"\u0061":2}"#),
+        Err(AslError::Json(JsonError::Duplicate))
+    ));
+    assert!(Payload::parse(b"").is_err());
+    let depth64 = format!("{}0{}", "[".repeat(64), "]".repeat(64));
+    Payload::parse(depth64.as_bytes())?;
+    assert!(matches!(
+        Payload::parse(format!("[{depth64}]").as_bytes()),
+        Err(AslError::Json(JsonError::Depth))
+    ));
+    let mut nested = json!(0);
+    for _ in 0..65 {
+        nested = json!([nested]);
+    }
+    assert!(matches!(
+        Payload::from_value(&nested),
+        Err(AslError::Json(JsonError::Depth))
+    ));
+    assert!(matches!(
+        Payload::from_value(&json!(vec![0; 65_537])),
+        Err(AslError::Json(JsonError::Members))
+    ));
+    assert!(matches!(
+        Payload::from_value(&json!("\u{0}".repeat(50_000))),
+        Err(AslError::DataLimit)
+    ));
+    assert!(matches!(
+        Payload::from_value(&json!("x".repeat(MAX_PAYLOAD_BYTES + 1))),
+        Err(AslError::Json(JsonError::String))
+    ));
+    assert_eq!(format!("{data:?}"), "Payload(<redacted>)");
+    let source = Payload::parse(b"  null\n")?;
+    assert_eq!(source.clone().original_bytes(), b"  null\n");
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_parse_arbitrary_utf8_without_panics(text in ".{0,1200}") {
+        let _ = text.parse::<Path>();
+        let _ = text.parse::<ReferencePath>();
+        let _ = text.parse::<ResultPath>();
+    }
+
+    #[test]
+    fn test_should_round_trip_quoted_keys(key in "[^\\p{Cc}]{0,80}", number in any::<i64>()) {
+        let escaped = key.replace('\\', "\\\\").replace('\'', "\\'");
+        let text = format!("$['{escaped}']");
+        let path = text.parse::<ReferencePath>().map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let data = Payload::from_value(&json!({key:number})).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let context = EvaluationContext::from(&data);
+        prop_assert_eq!(path.lookup(&data, &context), Some(&json!(number)));
+    }
+
+    #[test]
+    fn test_should_preserve_original_when_merging_object_member(input in any::<i64>(), result in any::<i64>()) {
+        let original = Payload::from_value(&json!({"input":input})).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let value = Payload::from_value(&json!(result)).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let path = "$.result".parse::<ResultPath>().map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let output = path.merge(&original, &value).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(original.value(), &json!({"input":input}));
+        prop_assert_eq!(output.value(), &json!({"input":input,"result":result}));
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/payload.rs b/crates/rustack-stepfunctions-core/src/payload.rs
new file mode 100644
index 00000000..f37ce05e
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/payload.rs
@@ -0,0 +1,381 @@
+//! Validated immutable JSON and bounded output materialization.
+
+use std::{fmt, io, sync::Arc};
+
+use bytes::Bytes;
+use rustack_core::json::{JsonError, JsonLimits, from_slice};
+use secrecy::zeroize::Zeroize;
+use serde::Serialize;
+use serde_json::{Value, json};
+
+use crate::{AslError, CallbackToken};
+
+/// Maximum original or materialized UTF-8 JSON payload size.
+pub const MAX_PAYLOAD_BYTES: usize = 262_144;
+const MAX_DEPTH: usize = 64;
+const MAX_MEMBERS: usize = 65_536;
+
+const PAYLOAD_LIMITS: TreeLimits = TreeLimits {
+    bytes: MAX_PAYLOAD_BYTES,
+    depth: MAX_DEPTH,
+    members: MAX_MEMBERS,
+};
+
+const CONTEXT_LIMITS: TreeLimits = TreeLimits {
+    bytes: 4 * 1024 * 1024,
+    depth: 68,
+    members: 2 * MAX_MEMBERS + 512,
+};
+
+#[derive(Clone, Copy)]
+struct TreeLimits {
+    bytes: usize,
+    depth: usize,
+    members: usize,
+}
+
+/// Immutable bounded JSON, retaining original bytes for execution idempotency.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct Payload {
+    value: Arc<Value>,
+    bytes: Bytes,
+}
+
+impl fmt::Debug for Payload {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Payload(<redacted>)")
+    }
+}
+
+impl Payload {
+    /// Validate JSON before constructing an immutable parsed tree.
+    ///
+    /// # Errors
+    /// Rejects duplicate keys, invalid JSON and byte/depth/member/string limits.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::Payload;
+    /// let input = Payload::parse(br#" {"n":null} "#)?;
+    /// assert_eq!(input.original_bytes(), br#" {"n":null} "#);
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn parse(input: &[u8]) -> Result<Self, AslError> {
+        if input.len() > MAX_PAYLOAD_BYTES {
+            return Err(JsonError::Bytes.into());
+        }
+        Self::from_bytes(Bytes::copy_from_slice(input))
+    }
+
+    /// Validate a constructed tree before bounded compact serialization.
+    ///
+    /// # Errors
+    /// Rejects excessive structure, strings or serialized byte size.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::Payload;
+    /// let output = Payload::from_value(&serde_json::json!({"ok": true}))?;
+    /// assert_eq!(output.value()["ok"], true);
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn from_value(value: &Value) -> Result<Self, AslError> {
+        validate_value(value, PAYLOAD_LIMITS)?;
+        let bytes = encode(value)?;
+        Ok(Self {
+            value: Arc::new(value.clone()),
+            bytes,
+        })
+    }
+
+    /// Inspect the immutable parsed value; mutations require a new validation.
+    ///
+    /// ```
+    /// let input = rustack_stepfunctions_core::Payload::parse(b"null")?;
+    /// assert!(input.value().is_null());
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn value(&self) -> &Value {
+        &self.value
+    }
+
+    /// Read the exact source bytes, including whitespace when parsed from text.
+    ///
+    /// ```
+    /// let input = rustack_stepfunctions_core::Payload::parse(b" 1 ")?;
+    /// assert_eq!(input.original_bytes(), b" 1 ");
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn original_bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    pub(crate) fn from_bytes(bytes: Bytes) -> Result<Self, AslError> {
+        let limits = JsonLimits::new(
+            MAX_PAYLOAD_BYTES,
+            MAX_DEPTH,
+            MAX_MEMBERS,
+            MAX_PAYLOAD_BYTES,
+            MAX_PAYLOAD_BYTES,
+        )?;
+        let value = from_slice(&bytes, limits)?;
+        Ok(Self {
+            value: Arc::new(value),
+            bytes,
+        })
+    }
+}
+
+/// Immutable internal ASL context with headroom for embedded business payloads.
+///
+/// Context is bounded to4MiB,68 container levels and131,584 members. Selected
+/// output still passes through the independent256KiB/depth64 payload boundary.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct EvaluationContext {
+    value: ContextStorage,
+}
+#[derive(Clone)]
+enum ContextStorage {
+    Plain(Arc<Value>),
+    Sensitive(Arc<SensitiveContext>),
+}
+struct SensitiveContext {
+    value: Value,
+}
+impl fmt::Debug for ContextStorage {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ContextStorage(<redacted>)")
+    }
+}
+impl fmt::Debug for SensitiveContext {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SensitiveContext(<redacted>)")
+    }
+}
+impl SensitiveContext {
+    fn clear_token(&mut self) {
+        if let Some(Value::String(token)) = self
+            .value
+            .get_mut("Task")
+            .and_then(|task| task.get_mut("Token"))
+        {
+            token.zeroize();
+        }
+    }
+}
+impl Drop for SensitiveContext {
+    fn drop(&mut self) {
+        self.clear_token();
+    }
+}
+
+impl fmt::Debug for EvaluationContext {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("EvaluationContext(<redacted>)")
+    }
+}
+
+impl From<&Payload> for EvaluationContext {
+    fn from(payload: &Payload) -> Self {
+        Self {
+            value: ContextStorage::Plain(payload.value.clone()),
+        }
+    }
+}
+
+impl EvaluationContext {
+    /// Validate an internal context before cloning its tree.
+    ///
+    /// Borrowing prevents recursive destruction of rejected caller-owned trees.
+    /// The typed engine owns schema/scope; callback preparation owns scoped Task.Token.
+    ///
+    /// # Errors
+    /// Rejects the internal context's independent byte/depth/member/string limits.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::EvaluationContext;
+    /// let context = EvaluationContext::from_value(&serde_json::json!({
+    ///     "Execution": {"Input": {"message":"hello"}}
+    /// }))?;
+    /// assert!(context.value().get("Execution").is_some());
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn from_value(value: &Value) -> Result<Self, AslError> {
+        validate_value(value, CONTEXT_LIMITS)?;
+        encode_with_limit(value, CONTEXT_LIMITS.bytes)?;
+        Ok(Self {
+            value: ContextStorage::Plain(Arc::new(value.clone())),
+        })
+    }
+
+    /// Inspect the immutable context; Debug remains redacted.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{EvaluationContext, Payload};
+    /// let input = Payload::parse(b"{}")?;
+    /// assert!(EvaluationContext::from(&input).value().is_object());
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn value(&self) -> &Value {
+        match &self.value {
+            ContextStorage::Plain(value) => value,
+            ContextStorage::Sensitive(value) => &value.value,
+        }
+    }
+
+    pub(crate) fn for_callback(&self, token: &CallbackToken) -> Result<Self, AslError> {
+        let fields = self
+            .value()
+            .as_object()
+            .ok_or(AslError::InvalidCallbackContext)?;
+        if fields.contains_key("Task") {
+            return Err(AslError::InvalidCallbackContext);
+        }
+        // Measure only the nonsensitive base. The token is validated ASCII hex;
+        // this fixed envelope needs no escaping and is never serialized for size.
+        let extra = b"\"Task\":{\"Token\":\"\"}"
+            .len()
+            .checked_add(token.expose().len())
+            .and_then(|size| size.checked_add(usize::from(!fields.is_empty())))
+            .ok_or(AslError::DataLimit)?;
+        let size = encode_with_limit(self.value(), CONTEXT_LIMITS.bytes)?.len();
+        if size.checked_add(extra).ok_or(AslError::DataLimit)? > CONTEXT_LIMITS.bytes {
+            return Err(AslError::DataLimit);
+        }
+        let mut value = fields.clone();
+        value.insert("Task".into(), json!({"Token":token.expose()}));
+        let sensitive = SensitiveContext {
+            value: Value::Object(value),
+        };
+        validate_value(&sensitive.value, CONTEXT_LIMITS)?;
+        Ok(Self {
+            value: ContextStorage::Sensitive(Arc::new(sensitive)),
+        })
+    }
+}
+
+fn validate_value(value: &Value, limits: TreeLimits) -> Result<(), AslError> {
+    let mut stack = vec![(value, 0_usize)];
+    let mut remaining = limits.members;
+    while let Some((value, depth)) = stack.pop() {
+        let children = match value {
+            Value::Array(values) => {
+                check_container(depth, values.len(), &mut remaining, limits.depth)?;
+                stack.extend(values.iter().map(|value| (value, depth.saturating_add(1))));
+                continue;
+            }
+            Value::Object(values) => {
+                check_container(depth, values.len(), &mut remaining, limits.depth)?;
+                for key in values.keys() {
+                    check_string(key)?;
+                }
+                values.values()
+            }
+            Value::String(value) => {
+                check_string(value)?;
+                continue;
+            }
+            _ => continue,
+        };
+        stack.extend(children.map(|value| (value, depth.saturating_add(1))));
+    }
+    Ok(())
+}
+
+pub(crate) fn validate_component(value: &Value) -> Result<(), AslError> {
+    validate_value(
+        value,
+        TreeLimits {
+            bytes: 1024 * 1024,
+            depth: 64,
+            members: 4096,
+        },
+    )?;
+    encode_with_limit(value, 1024 * 1024)?;
+    Ok(())
+}
+
+fn check_container(
+    depth: usize,
+    length: usize,
+    remaining: &mut usize,
+    max_depth: usize,
+) -> Result<(), AslError> {
+    if depth >= max_depth {
+        return Err(JsonError::Depth.into());
+    }
+    *remaining = remaining.checked_sub(length).ok_or(JsonError::Members)?;
+    Ok(())
+}
+
+fn check_string(value: &str) -> Result<(), AslError> {
+    if value.len() > MAX_PAYLOAD_BYTES {
+        Err(JsonError::String.into())
+    } else {
+        Ok(())
+    }
+}
+
+pub(crate) fn encode<T: Serialize + ?Sized>(value: &T) -> Result<Bytes, AslError> {
+    encode_with_limit(value, MAX_PAYLOAD_BYTES)
+}
+
+pub(crate) fn encode_with_limit<T: Serialize + ?Sized>(
+    value: &T,
+    limit: usize,
+) -> Result<Bytes, AslError> {
+    let mut writer = LimitedWriter {
+        bytes: Vec::new(),
+        full: false,
+        limit,
+    };
+    if let Err(error) = serde_json::to_writer(&mut writer, value) {
+        return if writer.full {
+            Err(AslError::DataLimit)
+        } else {
+            Err(AslError::Encoding(error))
+        };
+    }
+    Ok(Bytes::from(writer.bytes))
+}
+
+#[cfg(test)]
+mod tests;
+
+struct LimitedWriter {
+    bytes: Vec<u8>,
+    full: bool,
+    limit: usize,
+}
+
+impl io::Write for LimitedWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let needed = self.bytes.len().saturating_add(bytes.len());
+        if needed > self.limit {
+            self.full = true;
+            return Err(io::Error::other("bounded ASL output exhausted"));
+        }
+        if needed > self.bytes.capacity() {
+            let capacity = needed
+                .max(self.bytes.capacity().saturating_mul(2))
+                .clamp(64, self.limit);
+            self.bytes
+                .try_reserve_exact(capacity.saturating_sub(self.bytes.len()))
+                .map_err(|_| io::Error::other("bounded ASL allocation failed"))?;
+        }
+        self.bytes.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+pub(crate) fn parse_component(input: &[u8]) -> Result<Value, AslError> {
+    let limits = JsonLimits::new(1024 * 1024, 64, 4096, 262_144, 262_144)?;
+    from_slice(input, limits).map_err(AslError::Json)
+}
diff --git a/crates/rustack-stepfunctions-core/src/payload/tests.rs b/crates/rustack-stepfunctions-core/src/payload/tests.rs
new file mode 100644
index 00000000..ed779562
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/payload/tests.rs
@@ -0,0 +1,260 @@
+use std::error::Error;
+
+use rustack_core::json::JsonError;
+use serde_json::{Value, json};
+
+use crate::{AslError, EvaluationContext, MAX_PAYLOAD_BYTES, Path, Payload};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+#[test]
+fn test_should_reject_borrowed_extreme_depth_without_recursive_owned_teardown() {
+    let mut value = Value::Null;
+    for _ in 0..50_000 {
+        value = Value::Array(vec![value]);
+    }
+    let payload = Payload::from_value(&value);
+    let context = EvaluationContext::from_value(&value);
+    // The caller retains and safely disposes its own rejected tree.
+    let mut owned = vec![value];
+    while let Some(value) = owned.pop() {
+        if let Value::Array(mut children) = value {
+            owned.append(&mut children);
+        }
+    }
+    assert!(matches!(payload, Err(AslError::Json(JsonError::Depth))));
+    assert!(matches!(context, Err(AslError::Json(JsonError::Depth))));
+}
+
+#[test]
+fn test_should_embed_maximum_payload_bytes_without_reducing_output_limit() -> TestResult {
+    let payload = Payload::parse(format!("\"{}\"", "x".repeat(MAX_PAYLOAD_BYTES - 2)).as_bytes())?;
+    let context = EvaluationContext::from_value(&json!({
+        "Execution":{"Input":payload.value(),"Name":"run","Id":"execution-id"},
+        "StateMachine":{"Name":"machine"},"State":{"Name":"current"}
+    }))?;
+    let path: Path = "$$.Execution.Input".parse()?;
+    let result = path.select(&payload, &context)?.to_payload()?;
+    assert_eq!(result.original_bytes().len(), MAX_PAYLOAD_BYTES);
+    assert_eq!(result.value(), payload.value());
+    assert!(matches!(
+        "$$".parse::<Path>()?
+            .select(&payload, &context)?
+            .to_payload(),
+        Err(AslError::DataLimit)
+    ));
+    assert_eq!(format!("{context:?}"), "EvaluationContext(<redacted>)");
+    Ok(())
+}
+
+#[test]
+fn test_should_embed_maximum_payload_depth_and_member_count_with_metadata() -> TestResult {
+    let raw = format!("{}0{}", "[".repeat(64), "]".repeat(64));
+    let deep = Payload::parse(raw.as_bytes())?;
+    let context = EvaluationContext::from_value(&json!({"Execution":{"Input":deep.value()}}))?;
+    let selected = "$$.Execution.Input"
+        .parse::<Path>()?
+        .select(&deep, &context)?
+        .to_payload()?;
+    assert_eq!(selected.value(), deep.value());
+    assert!(matches!(
+        "$$".parse::<Path>()?.select(&deep, &context)?.to_payload(),
+        Err(AslError::Json(JsonError::Depth))
+    ));
+    let wide = Payload::from_value(&json!(vec![0; 65_536]))?;
+    let context = EvaluationContext::from_value(&json!({
+        "Execution":{"Input":wide.value()},
+        "Map":{"Item":{"Value":wide.value(),"Index":0,"Source":"STATE_DATA"}}
+    }))?;
+    assert_eq!(
+        "$$.Execution.Input"
+            .parse::<Path>()?
+            .select(&wide, &context)?
+            .to_payload()?
+            .value(),
+        wide.value()
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_independent_context_byte_depth_member_and_string_limits() {
+    let value = json!(vec!["x".repeat(MAX_PAYLOAD_BYTES); 16]);
+    assert!(matches!(
+        EvaluationContext::from_value(&value),
+        Err(AslError::DataLimit)
+    ));
+    let mut value = Value::Null;
+    for _ in 0..68 {
+        value = json!([value]);
+    }
+    assert!(EvaluationContext::from_value(&value).is_ok());
+    assert!(matches!(
+        EvaluationContext::from_value(&json!([value])),
+        Err(AslError::Json(JsonError::Depth))
+    ));
+    assert!(matches!(
+        EvaluationContext::from_value(&json!(vec![0; 131_585])),
+        Err(AslError::Json(JsonError::Members))
+    ));
+    assert!(matches!(
+        EvaluationContext::from_value(&json!("x".repeat(MAX_PAYLOAD_BYTES + 1))),
+        Err(AslError::Json(JsonError::String))
+    ));
+}
+
+#[test]
+fn test_should_allow_numeric_normalization_expansion_inside_internal_context() -> TestResult {
+    let input = format!("[{}]", vec!["1e9"; 65_535].join(","));
+    assert_eq!(input.len(), 262_141);
+    let input = Payload::parse(input.as_bytes())?;
+    let item = Payload::parse(format!("\"{}\"", "x".repeat(MAX_PAYLOAD_BYTES - 2)).as_bytes())?;
+    let context_value = json!({
+        "Execution":{"Input":input.value()},
+        "Map":{"Item":{"Value":item.value(),"Index":0,"Source":"STATE_DATA"}}
+    });
+    assert!(serde_json::to_vec(&context_value)?.len() > 1024 * 1024);
+    let context = EvaluationContext::from_value(&context_value)?;
+    assert_eq!(
+        "$$.Map.Item.Value"
+            .parse::<Path>()?
+            .select(&input, &context)?
+            .to_payload()?
+            .value(),
+        item.value()
+    );
+    EvaluationContext::from_value(&json!({
+        "Execution":{"Input":input.value()},
+        "Map":{"Item":{"Value":input.value(),"Index":0}}
+    }))?;
+    assert!(matches!(
+        "$$.Execution.Input"
+            .parse::<Path>()?
+            .select(&item, &context)?
+            .to_payload(),
+        Err(AslError::DataLimit)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_bound_exact_internal_context_encoding_bytes() -> TestResult {
+    let mut parts = vec![Value::String("x".repeat(262_141)); 16];
+    parts.pop();
+    parts.push(Value::String("x".repeat(262_140)));
+    let exact = Value::Array(parts);
+    assert_eq!(serde_json::to_vec(&exact)?.len(), 4 * 1024 * 1024);
+    EvaluationContext::from_value(&exact)?;
+    let mut excess = exact;
+    if let Some(Value::String(last)) = excess.as_array_mut().and_then(|array| array.last_mut()) {
+        last.push('x');
+    }
+    assert!(matches!(
+        EvaluationContext::from_value(&excess),
+        Err(AslError::DataLimit)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_share_ordinary_context_and_keep_sensitive_storage_until_last_arc_drop() -> TestResult
+{
+    use super::ContextStorage;
+    use crate::CallbackToken;
+
+    let input = Payload::parse(br#"{"n":21}"#)?;
+    let base = EvaluationContext::from(&input);
+    let ContextStorage::Plain(shared) = &base.value else {
+        return Err("ordinary context storage".into());
+    };
+    assert!(std::sync::Arc::ptr_eq(shared, &input.value));
+    let token: CallbackToken = "a".repeat(64).parse()?;
+    let scoped = base.for_callback(&token)?;
+    let clone = scoped.clone();
+    let weak = match &scoped.value {
+        ContextStorage::Sensitive(value) => {
+            assert_eq!(std::sync::Arc::strong_count(value), 2);
+            std::sync::Arc::downgrade(value)
+        }
+        ContextStorage::Plain(_) => return Err("sensitive context storage".into()),
+    };
+    drop(scoped);
+    assert!(weak.upgrade().is_some());
+    assert_eq!(clone.value()["n"], 21);
+    assert!(base.value().get("Task").is_none());
+    for rendered in [format!("{clone:?}"), format!("{:?}", clone.value)] {
+        assert!(!rendered.contains(token.expose()));
+    }
+    drop(clone);
+    assert!(weak.upgrade().is_none());
+    Ok(())
+}
+#[test]
+fn test_should_zeroize_only_the_injected_token_string_and_preserve_business_context() {
+    use super::SensitiveContext;
+
+    let mut sensitive = SensitiveContext {
+        value: json!({"Task":{"Token":"a".repeat(64)},"Execution":{"Name":"Run"}}),
+    };
+    sensitive.clear_token();
+    assert_eq!(sensitive.value["Task"]["Token"], "");
+    assert_eq!(sensitive.value["Execution"]["Name"], "Run");
+    sensitive.clear_token();
+    assert_eq!(sensitive.value["Task"]["Token"], "");
+}
+#[test]
+fn test_should_check_exact_callback_context_byte_headroom_without_serializing_secret_in_constructor()
+-> TestResult {
+    use super::CONTEXT_LIMITS;
+    use crate::CallbackToken;
+
+    let token: CallbackToken = "a".repeat(64).parse()?;
+    let empty = EvaluationContext::from_value(&json!({}))?;
+    assert_eq!(
+        serde_json::to_vec(empty.for_callback(&token)?.value())?.len(),
+        serde_json::to_vec(&json!({"Task":{"Token":token.expose()}}))?.len()
+    );
+    let extra = serde_json::to_vec(&json!({"Task":{"Token":token.expose()}}))?.len() - 1;
+    for offset in [0, 1] {
+        let target = CONTEXT_LIMITS.bytes - extra + offset;
+        let mut fields = serde_json::Map::new();
+        for index in 0..15 {
+            fields.insert(
+                format!("field{index}"),
+                json!("x".repeat(MAX_PAYLOAD_BYTES)),
+            );
+        }
+        fields.insert("last".into(), json!(""));
+        let overhead = serde_json::to_vec(&fields)?.len();
+        fields.insert("last".into(), json!("x".repeat(target - overhead)));
+        let base = EvaluationContext::from_value(&Value::Object(fields))?;
+        let result = base.for_callback(&token);
+        if offset == 0 {
+            assert_eq!(
+                serde_json::to_vec(result?.value())?.len(),
+                CONTEXT_LIMITS.bytes
+            );
+        } else {
+            assert!(matches!(result, Err(AslError::DataLimit)));
+        }
+        assert!(base.value().get("Task").is_none());
+    }
+    Ok(())
+}
+#[test]
+fn test_should_reject_injected_context_member_exhaustion_without_mutating_valid_base() -> TestResult
+{
+    use super::CONTEXT_LIMITS;
+    use crate::CallbackToken;
+
+    let base = EvaluationContext::from_value(
+        &json!({"values":vec![Value::Null;CONTEXT_LIMITS.members-1]}),
+    )?;
+    let token: CallbackToken = "a".repeat(64).parse()?;
+    assert!(matches!(
+        base.for_callback(&token),
+        Err(AslError::Json(JsonError::Members))
+    ));
+    assert!(base.value().get("Task").is_none());
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/actor.rs b/crates/rustack-stepfunctions-core/src/registry/actor.rs
new file mode 100644
index 00000000..5cdef733
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/actor.rs
@@ -0,0 +1,1029 @@
+//! One linearization lane with retained execution/revision/name ownership.
+
+use std::{
+    collections::{BTreeMap, BTreeSet, VecDeque},
+    fmt,
+    future::pending,
+    mem::take,
+    sync::Arc,
+    time::Duration,
+};
+
+use chrono::{DateTime, SecondsFormat, Utc};
+use serde_json::json;
+use tokio::{
+    sync::{Semaphore, mpsc, watch},
+    task::JoinSet,
+    time::{Instant, MissedTickBehavior, interval},
+};
+
+use super::{
+    DefinitionRevision, Envelope, ExecutionArn, ExecutionName, ExecutionSnapshot, MachineSnapshot,
+    MachineStatus, Operation, PreparedDefinition, Profile, RegistryCommand, RegistryError,
+    RegistryLimits, RegistryResult, RegistryStatus, Reply, RoleArn, StateMachineArn, TenantScope,
+    child::{
+        ChildError, Lineage, Request,
+        owner::{Inbox as ChildInbox, Owner as ChildOwner},
+    },
+    retention::Retention,
+    snapshot::{CapturedExecution, SealedRegistry},
+    types::{ExecutionIdentity, ExecutionRecord, MachineIdentity, RevisionData, TagAllocation},
+};
+use crate::{
+    CleanupState, ClockSample, EvaluationContext, ExecutionDriver, ExecutionError, ExecutionLimits,
+    ExecutionSupervisor, Payload, StateSupport, SystemUuidSource, UuidSource,
+};
+
+mod child;
+
+const NAME_RETENTION: Duration = Duration::from_hours(2160);
+struct Resources {
+    scope: TenantScope,
+    states: StateSupport,
+    limits: RegistryLimits,
+    machines: BTreeMap<String, MachineSnapshot>,
+    revisions: Arc<Semaphore>,
+    tag_versions: Arc<Semaphore>,
+}
+pub(super) struct Entry {
+    pub(super) record: Arc<ExecutionRecord>,
+    pub(super) retention: Retention,
+}
+struct Executions {
+    records: BTreeMap<String, Entry>,
+    claims: BTreeMap<String, Retention>,
+    capacity: Arc<Semaphore>,
+    limits: ExecutionLimits,
+}
+struct Io {
+    sealed: watch::Sender<Option<Arc<SealedRegistry>>>,
+    children: mpsc::Receiver<Request>,
+    receiver: mpsc::Receiver<Envelope>,
+    closing: watch::Sender<bool>,
+    status: watch::Sender<RegistryStatus>,
+    pending: Option<Envelope>,
+    ready: VecDeque<String>,
+    #[cfg(test)]
+    entropy_hook: Option<clock_tests::EntropyHook>,
+}
+struct State {
+    children: ChildOwner,
+    resources: Resources,
+    executions: Executions,
+    runtime: ExecutionSupervisor,
+    io: Io,
+    entropy: JoinSet<Result<VecDeque<String>, RegistryError>>,
+}
+pub(super) struct Owner {
+    state: Option<State>,
+    capture: Option<SealedRegistry>,
+}
+impl Owner {
+    pub(super) fn new(
+        scope: TenantScope,
+        limits: RegistryLimits,
+        runtime: ExecutionSupervisor,
+        profile: Profile,
+        channels: (mpsc::Receiver<Envelope>, ChildInbox),
+        closing: watch::Sender<bool>,
+        status: watch::Sender<RegistryStatus>,
+    ) -> Self {
+        let (
+            receiver,
+            ChildInbox {
+                requests: children,
+                registry,
+            },
+        ) = channels;
+        let sealed = registry.sealed.clone();
+        Self {
+            capture: None,
+            state: Some(State {
+                children: ChildOwner::new(registry.clone()),
+                resources: Resources {
+                    scope,
+                    states: profile.states,
+                    limits,
+                    machines: BTreeMap::new(),
+                    revisions: registry.restore.pools.revisions.clone(),
+                    tag_versions: registry.restore.pools.tags.clone(),
+                },
+                executions: Executions {
+                    records: BTreeMap::new(),
+                    claims: BTreeMap::new(),
+                    capacity: registry.restore.pools.records.clone(),
+                    limits: profile.execution,
+                },
+                runtime,
+                io: Io {
+                    sealed,
+                    children,
+                    receiver,
+                    closing,
+                    status,
+                    pending: None,
+                    ready: VecDeque::new(),
+                    #[cfg(test)]
+                    entropy_hook: None,
+                },
+                entropy: JoinSet::new(),
+            }),
+        }
+    }
+    pub(super) async fn run(mut self, stop: watch::Receiver<bool>) -> Result<(), RegistryError> {
+        let result = match self.state.as_mut() {
+            Some(state) => state.run(stop).await,
+            None => Err(RegistryError::Unavailable),
+        };
+        result?;
+        let state = self.state.as_mut().ok_or(RegistryError::Unavailable)?;
+        self.capture = Some(state.seal()?);
+        let sealed = state.io.sealed.clone();
+        // Finish all potentially panicking owner/port destruction before publish.
+        drop(self.state.take());
+        let capture = self.capture.take().ok_or(RegistryError::Unavailable)?;
+        sealed.send_replace(Some(Arc::new(capture)));
+        Ok(())
+    }
+}
+impl Drop for Owner {
+    fn drop(&mut self) {
+        if let Some(capture) = self.capture.take() {
+            // A post-drain destructor panic still forbids releasing retained ownership.
+            let _retained = Box::leak(Box::new(capture));
+        }
+        if let Some(mut state) = self.state.take() {
+            state.io.closing.send_replace(true);
+            state.runtime.close();
+            state.io.children.close();
+            while let Ok(request) = state.io.children.try_recv() {
+                let _sent = request.reply.send(Err(ChildError::Unavailable));
+            }
+            state.io.receiver.close();
+            while let Ok(envelope) = state.io.receiver.try_recv() {
+                reply(envelope, Err(RegistryError::Unavailable));
+            }
+            // A root panic/unpolled future/runtime loss is not physical cleanup.
+            // Preserve the bounded complete graph, including all permits/receipts.
+            let _retained = Box::leak(Box::new(state));
+        }
+    }
+}
+fn reply(envelope: Envelope, result: Result<RegistryResult, RegistryError>) {
+    let _sent = envelope.reply.send(Reply {
+        result,
+        permit: envelope.permit,
+    });
+}
+fn uuid() -> Result<String, RegistryError> {
+    Ok(SystemUuidSource::default().next_uuid()?.to_string())
+}
+enum Incoming {
+    Command(Option<Envelope>),
+    Child(Option<Request>),
+}
+impl fmt::Debug for Incoming {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryIncoming(<redacted>)")
+    }
+}
+async fn receive(
+    commands: &mut mpsc::Receiver<Envelope>,
+    children: &mut mpsc::Receiver<Request>,
+    prefer_child: bool,
+    commands_open: bool,
+    children_open: bool,
+) -> Incoming {
+    if !commands_open && !children_open {
+        return pending().await;
+    }
+    if prefer_child {
+        tokio::select! {biased;
+            request=children.recv(),if children_open=>Incoming::Child(request),
+            command=commands.recv(),if commands_open=>Incoming::Command(command),
+        }
+    } else {
+        tokio::select! {biased;
+            command=commands.recv(),if commands_open=>Incoming::Command(command),
+            request=children.recv(),if children_open=>Incoming::Child(request),
+        }
+    }
+}
+impl State {
+    async fn run(&mut self, mut stop: watch::Receiver<bool>) -> Result<(), RegistryError> {
+        let mut commands_open = true;
+        let mut children_open = true;
+        let mut prefer_child = false;
+        let mut timer = interval(Duration::from_secs(1));
+        timer.set_missed_tick_behavior(MissedTickBehavior::Skip);
+        loop {
+            if *stop.borrow() || stop.has_changed().is_err() {
+                break;
+            }
+            tokio::select! {biased;
+                _=stop.changed()=>{},
+                ()=self.children.registry.child_wake.notified()=>self.maintain(Instant::now()),
+                input=receive(&mut self.io.receiver,&mut self.io.children,prefer_child,commands_open,children_open)=>match input {
+                    Incoming::Command(envelope)=>{prefer_child=true;match envelope {Some(envelope)=>self.dispatch(envelope).await,None=>commands_open=false}},
+                    Incoming::Child(request)=>{prefer_child=false;match request {Some(request)=>self.dispatch_child(request).await,None=>children_open=false}},
+                },
+                _=timer.tick()=>self.maintain(Instant::now()),
+            }
+        }
+        self.io.closing.send_replace(true);
+        self.close_child_intake();
+        self.io.receiver.close();
+        while let Some(envelope) = self.io.receiver.recv().await {
+            self.dispatch(envelope).await;
+        }
+        loop {
+            let deadline = Instant::now()
+                .checked_add(Duration::from_secs(30))
+                .ok_or(RegistryError::Validation)?;
+            match self.runtime.drain(deadline).await {
+                Ok(()) => return Ok(()),
+                Err(ExecutionError::Deadline) => {}
+                Err(error) => return Err(error.into()),
+            }
+        }
+    }
+    fn seal(&mut self) -> Result<SealedRegistry, RegistryError> {
+        let clock = ClockSample::new(Instant::now().into_std(), Utc::now());
+        self.seal_at(clock)
+    }
+    fn seal_at(&mut self, clock: ClockSample) -> Result<SealedRegistry, RegistryError> {
+        self.maintain(Instant::from_std(clock.monotonic));
+        if self.io.sealed.borrow().is_some() || self.runtime.owned_executions() != 0 {
+            return Err(RegistryError::Unavailable);
+        }
+        if self
+            .executions
+            .claims
+            .values()
+            .any(|retention| retention.running())
+        {
+            return Err(RegistryError::Unavailable);
+        }
+        let mut executions = Vec::new();
+        executions
+            .try_reserve_exact(self.executions.records.len())
+            .map_err(|_| RegistryError::Capacity)?;
+        for (arn, entry) in &self.executions.records {
+            let view = entry.record.handle.snapshot();
+            let retention = entry.retention;
+            let name = self
+                .executions
+                .claims
+                .get(arn)
+                .ok_or(RegistryError::Unavailable)?;
+            let cut = Instant::from_std(clock.monotonic);
+            if view.outcome().is_none()
+                || view.stop_date().is_none()
+                || view.cleanup() != CleanupState::Clean
+                || retention.running()
+                || name.running()
+                || retention.remaining(cut)? > name.remaining(cut)?
+            {
+                return Err(RegistryError::Unavailable);
+            }
+            executions.push(CapturedExecution {
+                record: entry.record.clone(),
+                view,
+                retention,
+            });
+        }
+        Ok(SealedRegistry {
+            scope: self.resources.scope.clone(),
+            states: self.resources.states,
+            lambda: self.runtime.lambda_support(),
+            callbacks: self.runtime.callback_scope().is_some(),
+            clock,
+            machines: take(&mut self.resources.machines),
+            executions,
+            names: take(&mut self.executions.claims),
+        })
+    }
+    #[tracing::instrument(name = "stepfunctions.registry.command", skip_all)]
+    async fn dispatch(&mut self, envelope: Envelope) {
+        let needs_entropy = matches!(
+            envelope.command,
+            Operation::Business(
+                RegistryCommand::Create(..)
+                    | RegistryCommand::Update(..)
+                    | RegistryCommand::Start(_, None, _, _)
+            )
+        );
+        self.io.pending = Some(envelope);
+        self.io.ready.clear();
+        let prepared = if needs_entropy {
+            #[cfg(test)]
+            let hook = self.io.entropy_hook.take();
+            self.entropy.spawn_blocking(move || {
+                #[cfg(test)]
+                if let Some(hook) = hook {
+                    let _notified = hook.entered.send(());
+                    let _released = hook.gate.recv();
+                }
+                Ok(VecDeque::from([uuid()?, uuid()?]))
+            });
+            self.await_entropy().await
+        } else {
+            Ok(())
+        };
+        if let Some(envelope) = self.io.pending.take() {
+            self.maintain(Instant::now());
+            let Envelope {
+                command,
+                reply: observer,
+                permit,
+            } = envelope;
+            let result = prepared.and_then(|()| match command {
+                Operation::Business(command) => {
+                    command.check(
+                        &self.resources.scope,
+                        self.resources.states,
+                        self.runtime.callback_scope().is_some(),
+                    )?;
+                    self.command(&command)
+                }
+                Operation::Restore(prepared) => {
+                    if !self.resources.machines.is_empty()
+                        || !self.executions.records.is_empty()
+                        || !self.executions.claims.is_empty()
+                        || self.runtime.owned_executions() != 0
+                    {
+                        return Err(RegistryError::Unavailable);
+                    }
+                    let graph = prepared.install(&self.children.registry)?;
+                    self.resources.machines = graph.machines;
+                    self.executions.records = graph.records;
+                    self.executions.claims = graph.names;
+                    Ok(RegistryResult::Restored)
+                }
+            });
+            self.maintain(Instant::now());
+            let _sent = observer.send(Reply { result, permit });
+        }
+    }
+    fn close_child_intake(&mut self) {
+        self.io.children.close();
+        while let Ok(request) = self.io.children.try_recv() {
+            let _sent = request.reply.send(Err(ChildError::Unavailable));
+        }
+    }
+    async fn await_entropy(&mut self) -> Result<(), RegistryError> {
+        let mut closing = self.io.closing.subscribe();
+        let mut maintenance = interval(Duration::from_secs(1));
+        maintenance.set_missed_tick_behavior(MissedTickBehavior::Skip);
+        let mut closed = false;
+        loop {
+            if !closed && *closing.borrow_and_update() {
+                self.runtime.close();
+                self.close_child_intake();
+                self.maintain(Instant::now());
+                closed = true;
+            }
+            tokio::select! { biased;
+                _=closing.changed()=>{},
+                ()=self.children.registry.child_wake.notified()=>self.maintain(Instant::now()),
+                _=maintenance.tick()=>self.maintain(Instant::now()),
+                joined=self.entropy.join_next()=>return match joined {
+                    Some(Ok(Ok(values)))=>{self.io.ready=values;Ok(())},
+                    Some(Ok(Err(error)))=>Err(error),
+                    Some(Err(error))=>Err(RegistryError::Worker(error)),
+                    None=>Err(RegistryError::Unavailable),
+                },
+            }
+        }
+    }
+    fn next_uuid(&mut self) -> Result<String, RegistryError> {
+        self.io.ready.pop_front().ok_or(RegistryError::Unavailable)
+    }
+    fn command(&mut self, command: &RegistryCommand) -> Result<RegistryResult, RegistryError> {
+        match command {
+            RegistryCommand::Create(name, definition, role, tags) => {
+                self.create(name, definition, role, tags)
+            }
+            RegistryCommand::Update(arn, definition, role) => {
+                let current = self.resources.active(arn)?.clone();
+                let definition = definition.clone().unwrap_or_else(|| PreparedDefinition {
+                    machine: current.revision.data.machine.clone(),
+                    hash: current.revision.data.hash,
+                });
+                let revision_id = self.next_uuid()?;
+                let now = Utc::now();
+                let revision = self.resources.revision(
+                    definition,
+                    role.clone()
+                        .unwrap_or_else(|| current.revision.data.role.clone()),
+                    revision_id,
+                    now,
+                )?;
+                let snapshot = MachineSnapshot {
+                    revision,
+                    updated: now,
+                    ..current
+                };
+                self.resources
+                    .machines
+                    .insert(arn.as_str().into(), snapshot.clone());
+                Ok(RegistryResult::Machine(snapshot))
+            }
+            RegistryCommand::Delete(arn) => {
+                self.resources
+                    .machines
+                    .get_mut(arn.as_str())
+                    .ok_or(RegistryError::MachineMissing)?
+                    .status = MachineStatus::Deleting;
+                Ok(RegistryResult::Deleted)
+            }
+            RegistryCommand::Machine(arn) => Ok(RegistryResult::Machine(
+                self.resources
+                    .machines
+                    .get(arn.as_str())
+                    .ok_or(RegistryError::MachineMissing)?
+                    .clone(),
+            )),
+            RegistryCommand::Machines => {
+                let mut machines: Vec<_> = self.resources.machines.values().cloned().collect();
+                machines.sort_by(|a, b| {
+                    a.creation_date()
+                        .cmp(&b.creation_date())
+                        .then_with(|| a.arn().as_str().cmp(b.arn().as_str()))
+                });
+                Ok(RegistryResult::Machines(machines))
+            }
+            RegistryCommand::Start(arn, name, input, trace) => self.start(
+                arn,
+                name.as_ref(),
+                input,
+                trace.as_deref(),
+                Lineage::default(),
+            ),
+            RegistryCommand::Execution(arn) => {
+                Ok(RegistryResult::Execution(self.snapshot(arn.as_str())?))
+            }
+            RegistryCommand::Stop(arn, reason) => {
+                let snapshot = self.snapshot(arn.as_str())?;
+                snapshot.record.handle.request_stop(reason.0.clone());
+                Ok(RegistryResult::Execution(snapshot))
+            }
+            RegistryCommand::Executions(arn) => self.list_executions(arn),
+            RegistryCommand::Tag(arn, tags) | RegistryCommand::Untag(arn, tags) => {
+                let current = self
+                    .resources
+                    .machines
+                    .get_mut(arn.as_str())
+                    .ok_or(RegistryError::MachineMissing)?;
+                let value = if matches!(command, RegistryCommand::Tag(..)) {
+                    current.tags.value.merge(tags)?
+                } else {
+                    current.tags.value.remove(tags)
+                };
+                let permit = self
+                    .resources
+                    .tag_versions
+                    .clone()
+                    .try_acquire_owned()
+                    .map_err(|_| RegistryError::Capacity)?;
+                current.tags = Arc::new(TagAllocation {
+                    value,
+                    _permit: permit,
+                });
+                Ok(RegistryResult::Tags(current.tags.value.clone()))
+            }
+        }
+    }
+    fn list_executions(&self, arn: &StateMachineArn) -> Result<RegistryResult, RegistryError> {
+        if !self.resources.machines.contains_key(arn.as_str()) {
+            return Err(RegistryError::MachineMissing);
+        }
+
+        let mut executions: Vec<_> = self
+            .executions
+            .records
+            .values()
+            .filter(|entry| entry.record.identity.arn.machine().as_str() == arn.as_str())
+            .map(|entry| ExecutionSnapshot {
+                record: entry.record.clone(),
+                view: entry.record.handle.snapshot(),
+            })
+            .collect();
+        executions.sort_by(|a, b| {
+            b.start_date()
+                .cmp(&a.start_date())
+                .then_with(|| a.arn().as_str().cmp(b.arn().as_str()))
+        });
+        Ok(RegistryResult::Executions(executions))
+    }
+    fn create(
+        &mut self,
+        name: &super::StateMachineName,
+        definition: &PreparedDefinition,
+        role: &RoleArn,
+        tags: &super::Tags,
+    ) -> Result<RegistryResult, RegistryError> {
+        let arn = StateMachineArn::new(&self.resources.scope, name.clone())?;
+        if let Some(existing) = self.resources.machines.get(arn.as_str()) {
+            if existing.status == MachineStatus::Deleting {
+                return Err(RegistryError::Deleting);
+            }
+            if existing.revision.machine().original_bytes() == definition.machine.original_bytes() {
+                return Ok(RegistryResult::Machine(existing.clone()));
+            }
+            return Err(RegistryError::MachineExists);
+        }
+        if self.resources.machines.len() >= self.resources.limits.capacities.machines {
+            return Err(RegistryError::Capacity);
+        }
+        let revision_id = self.next_uuid()?;
+        let resource_id = self.next_uuid()?;
+        let now = Utc::now();
+        let revision =
+            self.resources
+                .revision(definition.clone(), role.clone(), revision_id, now)?;
+        let snapshot = MachineSnapshot {
+            identity: Arc::new(MachineIdentity {
+                arn: arn.clone(),
+                resource: resource_id,
+                created: now,
+            }),
+            updated: now,
+            status: MachineStatus::Active,
+            revision,
+            tags: Arc::new(TagAllocation {
+                value: tags.clone(),
+                _permit: self
+                    .resources
+                    .tag_versions
+                    .clone()
+                    .try_acquire_owned()
+                    .map_err(|_| RegistryError::Capacity)?,
+            }),
+        };
+        self.resources
+            .machines
+            .insert(arn.as_str().into(), snapshot.clone());
+        Ok(RegistryResult::Machine(snapshot))
+    }
+    fn snapshot(&self, arn: &str) -> Result<ExecutionSnapshot, RegistryError> {
+        let entry = self
+            .executions
+            .records
+            .get(arn)
+            .ok_or(RegistryError::ExecutionMissing)?;
+        Ok(ExecutionSnapshot {
+            record: entry.record.clone(),
+            view: entry.record.handle.snapshot(),
+        })
+    }
+    fn start(
+        &mut self,
+        arn: &StateMachineArn,
+        name: Option<&ExecutionName>,
+        input: &Payload,
+        trace: Option<&str>,
+        lineage: Lineage,
+    ) -> Result<RegistryResult, RegistryError> {
+        let machine = self.resources.active(arn)?.clone();
+        let name = match name {
+            Some(name) => name.clone(),
+            None => self.next_uuid()?.parse()?,
+        };
+        let arn = ExecutionArn::new(arn.clone(), name)?;
+        if self.executions.claims.contains_key(arn.as_str()) {
+            if let Ok(snapshot) = self.snapshot(arn.as_str()) {
+                if snapshot.view.outcome().is_none()
+                    && snapshot.input().original_bytes() == input.original_bytes()
+                {
+                    return Ok(RegistryResult::Execution(snapshot));
+                }
+            }
+            return Err(RegistryError::ExecutionExists);
+        }
+        if self.executions.claims.len() >= self.resources.limits.capacities.names {
+            return Err(RegistryError::Capacity);
+        }
+        let permit = self
+            .executions
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| RegistryError::Capacity)?;
+        let now = Utc::now();
+        let context = EvaluationContext::from_value(
+            &json!({"Execution":{"Id":arn.as_str(),"Name":arn.name().as_str(),"Input":input.value(),"RoleArn":machine.revision.role().as_str(),"StartTime":now.to_rfc3339_opts(SecondsFormat::Millis,true)},"StateMachine":{"Id":machine.arn().as_str(),"Name":machine.arn().name().as_str()}}),
+        )?;
+        let structured = machine.revision.machine().requires_structured_execution()
+            || machine.revision.machine().uses_children()
+            || machine.revision.machine().uses_callbacks();
+        let construct = if structured {
+            ExecutionDriver::for_structured_owner
+        } else {
+            ExecutionDriver::new
+        };
+        let driver = construct(
+            machine.revision.machine().clone(),
+            input.clone(),
+            context,
+            ClockSample::new(Instant::now().into_std(), now),
+            self.executions.limits,
+        )?;
+        let absolute_deadline = driver.deadline();
+        // No await between runtime registration and the atomic record/name commit.
+        let registered = self.runtime.start_registered(
+            driver,
+            structured,
+            super::child::port(&self.children.registry),
+            machine.revision.role(),
+        )?;
+        let handle = registered.handle;
+        let view = handle.snapshot();
+        let record = Arc::new(ExecutionRecord {
+            lineage,
+            deadline: Some(absolute_deadline),
+            identity: ExecutionIdentity {
+                arn: arn.clone(),
+                machine: machine.identity,
+                started: now,
+                trace: trace.map(str::to_owned),
+            },
+            input: input.clone(),
+            revision: machine.revision,
+            handle,
+            _permit: permit,
+        });
+        self.executions
+            .claims
+            .insert(arn.as_str().into(), Retention::Running);
+        self.executions.records.insert(
+            arn.as_str().into(),
+            Entry {
+                record: record.clone(),
+                retention: Retention::Running,
+            },
+        );
+        let snapshot = ExecutionSnapshot { record, view };
+        if let Some(parent) = registered.parent {
+            let _ = parent.send(snapshot.clone());
+        }
+        Ok(RegistryResult::Execution(snapshot))
+    }
+    fn maintain(&mut self, now: Instant) {
+        self.children.maintain(now);
+        self.runtime.reap_ready();
+        self.io.status.send_replace(RegistryStatus {
+            ready: self.runtime.is_ready(),
+            owned_executions: self.runtime.owned_executions(),
+        });
+        for (arn, entry) in &mut self.executions.records {
+            if entry.retention.running() && entry.record.handle.snapshot().outcome().is_some() {
+                entry.retention = Retention::ClosedAt {
+                    at: now,
+                    ttl: self.resources.limits.retention,
+                };
+                if let Some(retention) = self.executions.claims.get_mut(arn) {
+                    *retention = Retention::ClosedAt {
+                        at: now,
+                        ttl: NAME_RETENTION,
+                    };
+                }
+            }
+        }
+        self.executions.records.retain(|_, entry| {
+            !entry.retention.expired(now)
+                || entry.record.handle.snapshot().cleanup() != CleanupState::Clean
+        });
+        let records = &self.executions.records;
+        self.executions.claims.retain(|arn, retention| {
+            !retention.expired(now)
+                || records.get(arn).is_some_and(|entry| {
+                    entry.record.handle.snapshot().cleanup() != CleanupState::Clean
+                })
+        });
+        let running: BTreeSet<_> = self
+            .executions
+            .records
+            .values()
+            .filter(|entry| entry.record.handle.snapshot().outcome().is_none())
+            .map(|entry| entry.record.identity.machine.resource.as_str())
+            .collect();
+        self.resources.machines.retain(|_, machine| {
+            machine.status == MachineStatus::Active
+                || running.contains(machine.identity.resource.as_str())
+        });
+    }
+}
+impl Resources {
+    fn active(&self, arn: &StateMachineArn) -> Result<&MachineSnapshot, RegistryError> {
+        let machine = self
+            .machines
+            .get(arn.as_str())
+            .ok_or(RegistryError::MachineMissing)?;
+        if machine.status == MachineStatus::Deleting {
+            Err(RegistryError::Deleting)
+        } else {
+            Ok(machine)
+        }
+    }
+    fn revision(
+        &self,
+        definition: PreparedDefinition,
+        role: RoleArn,
+        id: String,
+        published: DateTime<Utc>,
+    ) -> Result<Arc<DefinitionRevision>, RegistryError> {
+        let permit = self
+            .revisions
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| RegistryError::Capacity)?;
+        Ok(Arc::new(DefinitionRevision {
+            data: RevisionData {
+                id,
+                machine: definition.machine,
+                role,
+                hash: definition.hash,
+                published,
+            },
+            _permit: permit,
+        }))
+    }
+}
+
+#[cfg(test)]
+mod clock_tests {
+    mod children;
+    mod snapshot;
+    use std::{
+        future::{Future, poll_fn},
+        task::Poll,
+    };
+
+    use super::{
+        super::{Admission, RegistryCapacities, Tags, admission},
+        *,
+    };
+    use crate::{
+        AslCompiler, HistoryLimits, LambdaTaskCommand, LambdaTaskPort, RuntimeLimits, TaskCall,
+        TaskFailure, TaskResponder, TaskSupport,
+    };
+
+    pub(super) struct EntropyHook {
+        pub(super) entered: tokio::sync::oneshot::Sender<()>,
+        pub(super) gate: std::sync::mpsc::Receiver<()>,
+    }
+    fn definition() -> PreparedDefinition {
+        PreparedDefinition::new(
+            AslCompiler::default()
+                .compile(br#"{"StartAt":"D","States":{"D":{"Type":"Succeed"}}}"#)
+                .unwrap()
+                .machine()
+                .clone(),
+        )
+    }
+    fn owner(capacities: RegistryCapacities, port: Option<Arc<dyn LambdaTaskPort>>) -> Owner {
+        let runtime = ExecutionSupervisor::new(
+            RuntimeLimits::default(),
+            HistoryLimits::default(),
+            256 * 1024 * 1024,
+            port,
+        )
+        .unwrap();
+        let limits = RegistryLimits::new(capacities, Duration::from_secs(60), 8).unwrap();
+        let Admission { shared, channels } = admission(
+            TenantScope::default(),
+            limits,
+            StateSupport::Sequential,
+            runtime.open_limit(),
+            None,
+            runtime.snapshot_restorer(),
+        );
+        Owner::new(
+            TenantScope::default(),
+            limits,
+            runtime,
+            Profile::default(),
+            channels,
+            shared.closing.clone(),
+            shared.status.clone(),
+        )
+    }
+    fn create(state: &mut State, definition: PreparedDefinition) -> StateMachineArn {
+        state.io.ready = VecDeque::from([uuid().unwrap(), uuid().unwrap()]);
+        let RegistryResult::Machine(machine) = state
+            .command(&RegistryCommand::Create(
+                "Machine".parse().unwrap(),
+                definition,
+                "arn:aws:iam::000000000000:role/Worker".parse().unwrap(),
+                Tags::default(),
+            ))
+            .unwrap()
+        else {
+            panic!("machine")
+        };
+        machine.arn().clone()
+    }
+    fn start(
+        state: &mut State,
+        arn: &StateMachineArn,
+        name: &str,
+    ) -> Result<ExecutionSnapshot, RegistryError> {
+        let RegistryResult::Execution(snapshot) = state.start(
+            arn,
+            Some(&name.parse().unwrap()),
+            &Payload::parse(b"{}").unwrap(),
+            None,
+            Lineage::default(),
+        )?
+        else {
+            panic!("execution")
+        };
+        Ok(snapshot)
+    }
+    async fn settled(snapshot: &ExecutionSnapshot) {
+        let mut handle = snapshot.handle();
+        handle
+            .wait(Instant::now() + Duration::from_secs(5))
+            .await
+            .unwrap();
+        // Read terminal publication is independent of the final cleanup publication.
+        let end = Instant::now() + Duration::from_secs(5);
+        while handle.snapshot().cleanup() != CleanupState::Clean {
+            assert!(Instant::now() < end);
+            tokio::task::yield_now().await;
+        }
+    }
+    #[tokio::test]
+    async fn test_should_expire_records_independently_of_names_and_retained_snapshot_slots() {
+        let mut owner = owner(RegistryCapacities::new(1, 4, 1, 4).unwrap(), None);
+        let mut state = owner.state.take().unwrap();
+        let arn = create(&mut state, definition());
+        let old = start(&mut state, &arn, "old").unwrap();
+        settled(&old).await;
+        let closed = Instant::now();
+        state.maintain(closed);
+        state.maintain(closed + Duration::from_secs(60));
+        assert!(state.executions.records.is_empty());
+        assert!(state.executions.claims.contains_key(old.arn().as_str()));
+        assert!(matches!(
+            start(&mut state, &arn, "old"),
+            Err(RegistryError::ExecutionExists)
+        ));
+        assert!(matches!(
+            start(&mut state, &arn, "new"),
+            Err(RegistryError::Capacity)
+        ));
+        drop(old);
+        let new = start(&mut state, &arn, "new").unwrap();
+        settled(&new).await;
+        state.maintain(closed + Duration::from_secs(61));
+        drop(new);
+        state.maintain(closed + NAME_RETENTION + Duration::from_secs(61));
+        assert!(state.executions.claims.is_empty());
+        let reused = start(&mut state, &arn, "old").unwrap();
+        settled(&reused).await;
+        state
+            .runtime
+            .drain(Instant::now() + Duration::from_secs(5))
+            .await
+            .unwrap();
+    }
+    #[tokio::test]
+    async fn test_should_reject_name_capacity_without_evicting_an_unexpired_closed_name() {
+        let mut owner = owner(RegistryCapacities::new(1, 4, 4, 1).unwrap(), None);
+        let mut state = owner.state.take().unwrap();
+        let arn = create(&mut state, definition());
+        let old = start(&mut state, &arn, "old").unwrap();
+        settled(&old).await;
+        let closed = Instant::now();
+        state.maintain(closed);
+        drop(old);
+        state.maintain(closed + Duration::from_secs(120));
+        assert!(state.executions.records.is_empty());
+        assert!(matches!(
+            start(&mut state, &arn, "new"),
+            Err(RegistryError::Capacity)
+        ));
+        assert!(matches!(
+            start(&mut state, &arn, "old"),
+            Err(RegistryError::ExecutionExists)
+        ));
+        state.maintain(closed + NAME_RETENTION);
+        let reused = start(&mut state, &arn, "old").unwrap();
+        settled(&reused).await;
+        state
+            .runtime
+            .drain(Instant::now() + Duration::from_secs(5))
+            .await
+            .unwrap();
+    }
+    #[derive(Debug)]
+    struct Port(mpsc::Sender<TaskResponder>);
+    impl LambdaTaskPort for Port {
+        fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+            let (call, owner) = TaskCall::channel();
+            self.0
+                .try_send(owner)
+                .map_err(|_| TaskFailure::throttled())?;
+            Ok(call)
+        }
+    }
+    #[tokio::test]
+    async fn test_should_retain_revision_record_and_name_beyond_all_ttls_until_cleanup_is_clean() {
+        let (tx, mut rx) = mpsc::channel(1);
+        let mut owner = owner(
+            RegistryCapacities::new(1, 1, 1, 1).unwrap(),
+            Some(Arc::new(Port(tx))),
+        );
+        let mut state = owner.state.take().unwrap();
+        let prepared=PreparedDefinition::new(AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#).unwrap().machine().clone());
+        let arn = create(&mut state, prepared);
+        let execution = start(&mut state, &arn, "uncertain").unwrap();
+        let mut handle = execution.handle();
+        let responder = tokio::time::timeout(Duration::from_secs(5), rx.recv())
+            .await
+            .unwrap()
+            .unwrap();
+        let receipt = responder.quarantine(TaskFailure::service_exception());
+        handle
+            .wait(Instant::now() + Duration::from_secs(5))
+            .await
+            .unwrap();
+        drop(execution);
+        let closed = Instant::now();
+        state.maintain(closed);
+        state
+            .command(&RegistryCommand::Delete(arn.clone()))
+            .unwrap();
+        state.maintain(closed + NAME_RETENTION + Duration::from_secs(1));
+        assert!(state.resources.machines.is_empty());
+        assert_eq!(state.executions.records.len(), 1);
+        assert_eq!(state.executions.claims.len(), 1);
+        assert_eq!(state.resources.revisions.available_permits(), 0);
+        assert_eq!(state.executions.capacity.available_permits(), 0);
+        receipt.settle();
+        let end = Instant::now() + Duration::from_secs(5);
+        while handle.snapshot().cleanup() != CleanupState::Clean {
+            assert!(Instant::now() < end);
+            tokio::task::yield_now().await;
+        }
+        state.maintain(closed + NAME_RETENTION + Duration::from_secs(2));
+        assert!(state.executions.records.is_empty());
+        assert!(state.executions.claims.is_empty());
+        assert_eq!(state.resources.revisions.available_permits(), 1);
+        assert_eq!(state.executions.capacity.available_permits(), 1);
+        state.runtime.drain(end).await.unwrap();
+    }
+    #[tokio::test]
+    async fn test_should_retain_pending_command_and_entropy_worker_across_root_abort() {
+        let mut owner = owner(RegistryCapacities::default(), None);
+        let (sender, receiver) = mpsc::channel(1);
+        let (closing, stop) = watch::channel(false);
+        let (entered, ready) = tokio::sync::oneshot::channel();
+        let (release, gate) = std::sync::mpsc::channel();
+        let state = owner.state.as_mut().unwrap();
+        state.io.receiver = receiver;
+        state.io.closing = closing.clone();
+        state.io.entropy_hook = Some(EntropyHook { entered, gate });
+        let capacity = Arc::new(Semaphore::new(1));
+        let (reply, mut observed) = tokio::sync::oneshot::channel();
+        let envelope = Envelope {
+            command: Operation::Business(RegistryCommand::Create(
+                "Machine".parse().unwrap(),
+                definition(),
+                "arn:aws:iam::000000000000:role/Worker".parse().unwrap(),
+                Tags::default(),
+            )),
+            reply,
+            permit: capacity.clone().try_acquire_owned().unwrap(),
+        };
+        assert!(sender.try_send(envelope).is_ok());
+        let root = tokio::spawn(owner.run(stop));
+        ready.await.unwrap();
+        root.abort();
+        assert!(root.await.unwrap_err().is_cancelled());
+        assert!(*closing.borrow());
+        assert_eq!(capacity.available_permits(), 0);
+        assert!(observed.try_recv().is_err());
+        drop(release); // Receiver disconnection releases even if any assertion unwinds.
+        assert_eq!(capacity.available_permits(), 0);
+    }
+    #[tokio::test]
+    async fn test_should_keep_registry_owner_live_after_last_command_sender_is_dropped() {
+        let mut owner = owner(RegistryCapacities::default(), None);
+        let mut state = owner.state.take().unwrap();
+        // The helper's only command sender was dropped when it returned.
+        let closing = state.io.closing.clone();
+        let stop = closing.subscribe();
+        let mut run = Box::pin(state.run(stop));
+        poll_fn(|cx| {
+            assert!(matches!(run.as_mut().poll(cx), Poll::Pending));
+            Poll::Ready(())
+        })
+        .await;
+        assert!(!*closing.borrow());
+        closing.send_replace(true);
+        run.await.unwrap();
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/actor/child.rs b/crates/rustack-stepfunctions-core/src/registry/actor/child.rs
new file mode 100644
index 00000000..2eefb8b2
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/actor/child.rs
@@ -0,0 +1,120 @@
+//! Atomic retained child start, watch capture and owned relation publication.
+
+use std::{collections::VecDeque, sync::Arc};
+
+use tokio::time::Instant;
+
+use super::{State, uuid};
+use crate::{
+    ExecutionArn, ExecutionSnapshot, RegistryResult,
+    registry::child::{ChildError, ChildExecution, Lineage, Request, owner::Entry as ChildEntry},
+};
+
+impl State {
+    pub(super) async fn dispatch_child(&mut self, request: Request) {
+        self.children.pending = Some(request);
+        self.io.ready.clear();
+        let needs_entropy = self
+            .children
+            .pending
+            .as_ref()
+            .is_some_and(|request| request.context.parameters.name.is_none());
+        let prepared = if needs_entropy {
+            self.entropy
+                .spawn_blocking(|| Ok(VecDeque::from([uuid()?, uuid()?])));
+            self.await_entropy().await.map_err(ChildError::from)
+        } else {
+            Ok(())
+        };
+        self.maintain(Instant::now());
+        let result = prepared.and_then(|()| self.start_child());
+        if let Some(request) = self.children.pending.take() {
+            let result = result.map(|snapshot| {
+                if request.context.pattern.owned() {
+                    self.children.entries.insert(
+                        self.children.next,
+                        ChildEntry {
+                            parent: request.context.parent.record.clone(),
+                            child: snapshot.clone(),
+                            control: request.control.clone(),
+                            deadline: request.context.deadline,
+                            _permit: request.permit,
+                        },
+                    );
+                }
+                ChildExecution {
+                    snapshot,
+                    control: request.control,
+                    pattern: request.context.pattern,
+                }
+            });
+            let _sent = request.reply.send(result);
+        }
+        self.maintain(Instant::now());
+    }
+    fn pending_child(&self) -> Result<&Request, ChildError> {
+        if *self.io.closing.borrow() {
+            return Err(ChildError::Unavailable);
+        }
+        let pending = self
+            .children
+            .pending
+            .as_ref()
+            .ok_or(ChildError::Unavailable)?;
+        if pending.control.cancelled() {
+            return Err(ChildError::Cancelled);
+        }
+        if Instant::now() >= pending.context.deadline {
+            return Err(ChildError::Deadline);
+        }
+        let parent = &pending.context.parent.record;
+        let registered = self
+            .executions
+            .records
+            .get(parent.identity.arn.as_str())
+            .ok_or(ChildError::Parent)?;
+        if !Arc::ptr_eq(parent, &registered.record) || parent.handle.snapshot().outcome().is_some()
+        {
+            return Err(ChildError::Parent);
+        }
+        Ok(pending)
+    }
+    fn start_child(&mut self) -> Result<ExecutionSnapshot, ChildError> {
+        let pending = self.pending_child()?;
+        let parent = &pending.context.parent.record;
+        let lineage = Lineage::descendant(parent)?;
+        let machine = pending.context.parameters.machine.clone();
+        let input = pending.context.parameters.input.clone();
+        let pattern = pending.context.pattern;
+        let name = pending.context.parameters.name.clone();
+        let name = match name {
+            Some(name) => name,
+            None => self.next_uuid()?.parse()?,
+        };
+        let arn = ExecutionArn::new(machine.clone(), name.clone())?;
+        let pending = self
+            .children
+            .pending
+            .as_ref()
+            .ok_or(ChildError::Unavailable)?;
+        self.children.check_cycle(
+            pending.context.parent.record.as_ref(),
+            arn.as_str(),
+            pattern,
+            lineage.0.len(),
+        )?;
+        self.children.next = self
+            .children
+            .next
+            .checked_add(1)
+            .ok_or(ChildError::Capacity)?;
+        // Graph validation is bounded CPU work; refresh independently changing
+        // parent/control/deadline observations at the registration boundary.
+        self.pending_child()?;
+        let result = self.start(&machine, Some(&name), &input, None, lineage)?;
+        match result {
+            RegistryResult::Execution(snapshot) => Ok(snapshot),
+            _ => Err(ChildError::Unavailable),
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/actor/clock_tests/children.rs b/crates/rustack-stepfunctions-core/src/registry/actor/clock_tests/children.rs
new file mode 100644
index 00000000..a08a3fed
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/actor/clock_tests/children.rs
@@ -0,0 +1,159 @@
+//! Cancellation/deadline/close remain live while unrelated entropy work is gated.
+
+use std::error::Error;
+
+use super::*;
+use crate::{ChildError, ChildPattern, ChildStartParameters, Registry};
+
+type TestResult = Result<(), Box<dyn Error>>;
+fn setup() -> Result<(Owner, Registry, ExecutionSnapshot), Box<dyn Error>> {
+    let mut owned = owner(RegistryCapacities::default(), None);
+    let state = owned.state.as_mut().ok_or("state")?;
+    let prepared = PreparedDefinition::new(
+        AslCompiler::default()
+            .compile(br#"{"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":60,"End":true}}}"#)?
+            .machine()
+            .clone(),
+    );
+    let machine = create(state, prepared);
+    let parent = start(state, &machine, "parent")?;
+    let registry = Registry {
+        shared: state.children.registry.clone(),
+    };
+    Ok((owned, registry, parent))
+}
+fn arguments(
+    parent: &ExecutionSnapshot,
+    name: &str,
+) -> Result<ChildStartParameters, Box<dyn Error>> {
+    Ok(ChildStartParameters::parse(
+        &TenantScope::default(),
+        &Payload::from_value(
+            &json!({"StateMachineArn":parent.arn().machine().as_str(),"Name":name,"Input":{}}),
+        )?,
+    )?)
+}
+#[tokio::test]
+async fn test_should_serve_owned_child_control_deadline_and_close_before_entropy_is_released()
+-> TestResult {
+    for mode in ["cancel", "deadline", "close"] {
+        let (mut owned, registry, parent) = setup()?;
+        let (entered, entered_wait) = tokio::sync::oneshot::channel();
+        let (release, gate) = std::sync::mpsc::channel();
+        let state = owned.state.as_mut().ok_or("state")?;
+        state.io.entropy_hook = Some(EntropyHook { entered, gate });
+        let stop = state.io.closing.subscribe();
+        let join = tokio::spawn(owned.run(stop));
+        let absolute =
+            Instant::now() + Duration::from_secs(if mode == "deadline" { 1 } else { 10 });
+        let mut submission = registry.child_port().start(
+            parent.child_parent(),
+            arguments(&parent, "child")?,
+            ChildPattern::Sync2,
+            absolute,
+        )?;
+        submission
+            .admitted(Instant::now() + Duration::from_secs(5))
+            .await?;
+        let mut child = submission.into_execution()?;
+        let mut update = registry.submit(RegistryCommand::Update(
+            parent.arn().machine().clone(),
+            None,
+            Some("arn:aws:iam::000000000000:role/New".parse()?),
+        ))?;
+        tokio::time::timeout(Duration::from_secs(5), entered_wait).await??;
+        match mode {
+            "cancel" => child.cancel(),
+            "close" => {
+                registry.shared.closing.send_replace(true);
+            }
+            _ => {}
+        }
+        let view = child.wait(Instant::now() + Duration::from_secs(3)).await?;
+        assert!(matches!(
+            view.outcome().map(Arc::as_ref),
+            Some(crate::ExecutionOutcome::Aborted(_))
+        ));
+        child
+            .wait_cleanup(Instant::now() + Duration::from_secs(3))
+            .await?;
+        assert!(
+            !join.is_finished(),
+            "entropy join was lost while handling child controls"
+        );
+        release.send(())?;
+        update.wait(Instant::now() + Duration::from_secs(5)).await?;
+        registry.shared.closing.send_replace(true);
+        tokio::time::timeout(Duration::from_secs(5), join).await???;
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_bound_child_lane_burst_with_an_ordinary_read_already_accepted() -> TestResult {
+    let (owned, registry, parent) = setup()?;
+    let mut owned = owned;
+    let mut first = registry.child_port().start(
+        parent.child_parent(),
+        arguments(&parent, "first")?,
+        ChildPattern::RequestResponse,
+        Instant::now() + Duration::from_secs(10),
+    )?;
+    let second = registry.child_port().start(
+        parent.child_parent(),
+        arguments(&parent, "second")?,
+        ChildPattern::RequestResponse,
+        Instant::now() + Duration::from_secs(10),
+    )?;
+    let mut ordinary = registry.submit(RegistryCommand::Machines)?;
+    let state = owned.state.as_mut().ok_or("state")?;
+    let Incoming::Child(Some(request)) = receive(
+        &mut state.io.receiver,
+        &mut state.io.children,
+        true,
+        true,
+        true,
+    )
+    .await
+    else {
+        return Err("child preference did not take one turn".into());
+    };
+    drop(request);
+    let third = registry.child_port().start(
+        parent.child_parent(),
+        arguments(&parent, "third")?,
+        ChildPattern::RequestResponse,
+        Instant::now() + Duration::from_secs(10),
+    )?;
+    let state = owned.state.as_mut().ok_or("state")?;
+    assert!(!state.io.children.is_empty());
+    let Incoming::Command(Some(envelope)) = receive(
+        &mut state.io.receiver,
+        &mut state.io.children,
+        false,
+        true,
+        true,
+    )
+    .await
+    else {
+        return Err("ready child stream starved ordinary intake".into());
+    };
+    reply(envelope, Ok(RegistryResult::Machines(Vec::new())));
+    assert!(matches!(
+        ordinary
+            .wait(Instant::now() + Duration::from_secs(1))
+            .await?,
+        RegistryResult::Machines(_)
+    ));
+    let failure = first
+        .admitted(Instant::now() + Duration::from_secs(1))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(failure,ChildError::Admission(source) if matches!(source.as_ref(),ChildError::OwnerLost))
+    );
+    registry.shared.closing.send_replace(true);
+    let stop = registry.shared.closing.subscribe();
+    owned.run(stop).await?;
+    drop((second, third));
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/actor/clock_tests/snapshot.rs b/crates/rustack-stepfunctions-core/src/registry/actor/clock_tests/snapshot.rs
new file mode 100644
index 00000000..12e20843
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/actor/clock_tests/snapshot.rs
@@ -0,0 +1,140 @@
+//! One paired clock cut controls both maintenance and durable TTL projection.
+
+use std::{error::Error, sync::Arc, time::Duration};
+
+use chrono::{TimeDelta, Utc};
+use serde_json::{Value, json};
+use tokio::time::{Instant, advance};
+
+use super::{create, definition, owner, settled, start};
+use crate::{
+    ClockSample, LambdaTaskCommand, LambdaTaskPort, RegistryCapacities, SnapshotLimits, TaskCall,
+    TaskFailure,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+#[tokio::test(start_paused = true)]
+async fn test_should_project_fractional_ttls_from_the_same_cut_despite_delayed_sealing()
+-> TestResult {
+    let mut root = owner(RegistryCapacities::default(), None);
+    let mut state = root.state.take().ok_or("missing test state")?;
+    let arn = create(&mut state, definition());
+    let execution = start(&mut state, &arn, "clock")?;
+    settled(&execution).await;
+    state
+        .runtime
+        .drain(Instant::now() + Duration::from_secs(5))
+        .await?;
+    let retention = Duration::from_nanos(60_123_456_789);
+    state.resources.limits.retention = retention;
+    let wall = Utc::now()
+        .checked_add_signed(TimeDelta::minutes(1))
+        .ok_or("invalid test clock")?;
+    let clock = ClockSample::new(Instant::now().into_std(), wall);
+    state.maintain(Instant::from_std(clock.monotonic));
+    advance(Duration::from_secs(10)).await;
+    let capture = state.seal_at(clock)?;
+    let archive = serde_json::to_value(capture.export(SnapshotLimits::default())?)?;
+    assert_eq!(
+        archive.get("capturedAt"),
+        Some(&serde_json::to_value(wall)?)
+    );
+    let record_expiry = wall
+        .checked_add_signed(TimeDelta::from_std(retention)?)
+        .ok_or("invalid test expiry")?;
+    let name_expiry = wall
+        .checked_add_signed(TimeDelta::hours(2160))
+        .ok_or("invalid name expiry")?;
+    assert_eq!(
+        archive.pointer("/executions/0/expiresAt"),
+        Some(&serde_json::to_value(record_expiry)?)
+    );
+    assert_eq!(
+        archive.pointer("/names/0/expiresAt"),
+        Some(&serde_json::to_value(name_expiry)?)
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_export_name_reservation_after_independent_record_expiry() -> TestResult {
+    let mut root = owner(RegistryCapacities::default(), None);
+    let mut state = root.state.take().ok_or("missing test state")?;
+    let arn = create(&mut state, definition());
+    let execution = start(&mut state, &arn, "retained-name")?;
+    settled(&execution).await;
+    state
+        .runtime
+        .drain(Instant::now() + Duration::from_secs(5))
+        .await?;
+    let closed = Instant::now();
+    let wall = Utc::now();
+    state.maintain(closed);
+    let capture = state.seal_at(ClockSample::new(
+        (closed + Duration::from_secs(61)).into_std(),
+        wall + TimeDelta::seconds(61),
+    ))?;
+    let archive = serde_json::to_value(capture.export(SnapshotLimits::default())?)?;
+    assert_eq!(archive.get("executions"), Some(&json!([])));
+    assert_eq!(
+        archive.pointer("/names/0/arn"),
+        Some(&json!(execution.arn().as_str()))
+    );
+    assert_eq!(
+        archive.pointer("/names/0/expiresAt"),
+        Some(&serde_json::to_value(wall + TimeDelta::hours(2160))?)
+    );
+    assert_eq!(
+        archive
+            .get("resources")
+            .and_then(Value::as_array)
+            .map(Vec::len),
+        Some(1)
+    );
+    Ok(())
+}
+
+#[derive(Debug)]
+struct PanicAfterDrain;
+impl LambdaTaskPort for PanicAfterDrain {
+    fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        Err(TaskFailure::service_exception())
+    }
+}
+impl Drop for PanicAfterDrain {
+    fn drop(&mut self) {
+        panic!("injected drained port destruction failure");
+    }
+}
+
+#[tokio::test]
+async fn test_should_keep_allocation_permits_charged_when_drained_state_destruction_panics()
+-> TestResult {
+    let mut root = owner(
+        RegistryCapacities::default(),
+        Some(Arc::new(PanicAfterDrain)),
+    );
+    let state = root.state.as_mut().ok_or("missing owner state")?;
+    let arn = create(state, definition());
+    let execution = start(state, &arn, "retained-permits")?;
+    settled(&execution).await;
+    let revision = Arc::downgrade(execution.revision());
+    let record = Arc::downgrade(&execution.record);
+    let revisions = state.resources.revisions.clone();
+    let records = state.executions.capacity.clone();
+    let revision_count = revisions.available_permits();
+    let record_count = records.available_permits();
+    let shared = state.children.registry.clone();
+    let closing = shared.closing.clone();
+    drop(execution);
+    closing.send_replace(true);
+    let result = tokio::spawn(root.run(closing.subscribe())).await;
+    assert!(result.is_err());
+    assert!(shared.sealed.borrow().is_none());
+    assert!(revision.upgrade().is_some());
+    assert!(record.upgrade().is_some());
+    assert_eq!(revisions.available_permits(), revision_count);
+    assert_eq!(records.available_permits(), record_count);
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/actor.rs b/crates/rustack-stepfunctions-core/src/registry/callback/actor.rs
new file mode 100644
index 00000000..223f11a8
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/actor.rs
@@ -0,0 +1,537 @@
+//! Unique hash-only callback table, retained entropy and removable timer entries.
+
+use std::{
+    collections::{BTreeMap, BTreeSet, HashMap},
+    sync::Arc,
+    time::Duration,
+};
+
+use tokio::{
+    sync::{OwnedSemaphorePermit, mpsc, watch},
+    task::{JoinError, JoinSet, yield_now},
+    time::{Instant, MissedTickBehavior, interval, sleep_until},
+};
+
+use super::{
+    AckReply, Action, CallbackAttempt, CallbackError, CallbackInvocation,
+    CallbackInvocationReporter, CallbackLimits, CallbackOutcome, CallbackStatus, CallbackTask,
+    CallbackTimeout, CallbackToken, Control, InvocationIdentity, MintReply, MintRequest, Request,
+    Shared, TokenHash,
+};
+use crate::{FrameCallId, Payload, TaskFailure};
+
+type Completion = Result<Payload, TaskFailure>;
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
+struct AttemptKey {
+    execution: String,
+    call: FrameCallId,
+}
+impl AttemptKey {
+    fn of(attempt: &CallbackAttempt) -> Self {
+        Self {
+            execution: attempt.parent.arn().as_str().into(),
+            call: attempt.call,
+        }
+    }
+}
+#[derive(Debug)]
+enum Progress {
+    Invoking(Option<Provisional>),
+    Waiting(Option<Instant>),
+    Closed,
+}
+#[derive(Debug)]
+struct Provisional {
+    result: Completion,
+    received: Instant,
+}
+#[derive(Debug)]
+struct Entry {
+    digest: TokenHash,
+    attempt: CallbackAttempt,
+    control: Arc<Control>,
+    invoked: Option<watch::Receiver<Option<Arc<CallbackInvocation>>>>,
+    view: Option<watch::Sender<Arc<CallbackOutcome>>>,
+    progress: Progress,
+    live: Option<OwnedSemaphorePermit>,
+    _retained: OwnedSemaphorePermit,
+    timer: Option<Instant>,
+    retire: Option<Instant>,
+}
+impl Entry {
+    fn close(&mut self, outcome: CallbackOutcome) {
+        if !matches!(self.progress, Progress::Closed) {
+            self.progress = Progress::Closed;
+            self.control.revoke();
+            self.live = None;
+            self.invoked = None;
+            if let Some(view) = self.view.take() {
+                view.send_replace(Arc::new(outcome));
+            }
+        }
+    }
+    fn refresh(&mut self, now: Instant) -> Result<(), CallbackError> {
+        if matches!(self.progress, Progress::Closed) {
+            return Ok(());
+        }
+        if now >= self.attempt.deadline {
+            self.close(CallbackOutcome::TimedOut(CallbackTimeout::Task));
+        } else if self.control.revoked()
+            || self.attempt.parent.handle().snapshot().outcome().is_some()
+        {
+            self.close(CallbackOutcome::Revoked);
+        } else if matches!(self.progress,Progress::Waiting(Some(until)) if now>=until) {
+            self.close(CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat));
+        } else if matches!(self.progress, Progress::Invoking(_)) {
+            let invoked = self.invoked.as_mut().ok_or(CallbackError::Progress)?;
+            let report = invoked.borrow_and_update().clone();
+            let owner_lost = invoked.has_changed().is_err();
+            match report.as_deref() {
+                Some(CallbackInvocation {
+                    outcome: Err(failure),
+                    ..
+                }) => self.close(CallbackOutcome::InvocationFailed(failure.clone())),
+                Some(CallbackInvocation {
+                    outcome: Ok(_),
+                    observed,
+                }) => {
+                    let Progress::Invoking(provisional) = &mut self.progress else {
+                        return Err(CallbackError::Progress);
+                    };
+                    let provisional = provisional.take();
+                    let heartbeat = self
+                        .attempt
+                        .heartbeat
+                        .map(|period| {
+                            observed
+                                .checked_add(period)
+                                .ok_or(CallbackError::Validation)
+                        })
+                        .transpose()?
+                        .map(|until| until.min(self.attempt.deadline));
+                    if let Some(Provisional { result, received }) = provisional {
+                        if heartbeat.is_some_and(|until| received >= until) {
+                            self.close(CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat));
+                        } else {
+                            self.complete(result);
+                        }
+                    } else if heartbeat.is_some_and(|until| now >= until) {
+                        self.close(CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat));
+                    } else {
+                        self.progress = Progress::Waiting(heartbeat);
+                        self.view
+                            .as_ref()
+                            .ok_or(CallbackError::Progress)?
+                            .send_replace(Arc::new(CallbackOutcome::Waiting {
+                                heartbeat_deadline: heartbeat,
+                            }));
+                    }
+                }
+                None if owner_lost => self.close(CallbackOutcome::Revoked),
+                None => {}
+            }
+        }
+        Ok(())
+    }
+    fn complete(&mut self, result: Completion) {
+        self.close(match result {
+            Ok(output) => CallbackOutcome::Succeeded(output),
+            Err(failure) => CallbackOutcome::Failed(failure),
+        });
+    }
+    fn mutate(&mut self, action: Action, now: Instant) -> Result<(), CallbackError> {
+        self.refresh(now)?;
+        match (&mut self.progress, action) {
+            (Progress::Closed | Progress::Invoking(Some(_)), _) => Err(CallbackError::TaskTimedOut),
+            (Progress::Invoking(provisional), Action::Complete(result)) => {
+                *provisional = Some(Provisional {
+                    result,
+                    received: now,
+                });
+                Ok(())
+            }
+            (Progress::Waiting(_), Action::Complete(result)) => {
+                self.complete(result);
+                Ok(())
+            }
+            (Progress::Invoking(None), Action::Heartbeat) => Ok(()),
+            (Progress::Waiting(heartbeat), Action::Heartbeat) => {
+                *heartbeat = self
+                    .attempt
+                    .heartbeat
+                    .map(|period| now.checked_add(period).ok_or(CallbackError::Validation))
+                    .transpose()?
+                    .map(|until| until.min(self.attempt.deadline));
+                self.view
+                    .as_ref()
+                    .ok_or(CallbackError::Progress)?
+                    .send_replace(Arc::new(CallbackOutcome::Waiting {
+                        heartbeat_deadline: *heartbeat,
+                    }));
+                Ok(())
+            }
+        }
+    }
+    fn next(&self) -> Option<Instant> {
+        match self.progress {
+            Progress::Closed => self.retire,
+            Progress::Invoking(_) => Some(self.attempt.deadline),
+            Progress::Waiting(heartbeat) => {
+                Some(heartbeat.map_or(self.attempt.deadline, |until| {
+                    until.min(self.attempt.deadline)
+                }))
+            }
+        }
+    }
+}
+#[derive(Debug)]
+struct Minted {
+    id: u64,
+    request: Box<MintRequest>,
+    token: Result<CallbackToken, CallbackError>,
+}
+#[derive(Debug)]
+struct State {
+    shared: Arc<Shared>,
+    limits: CallbackLimits,
+    receiver: mpsc::Receiver<Request>,
+    status: watch::Sender<CallbackStatus>,
+    entries: BTreeMap<u64, Entry>,
+    hashes: HashMap<TokenHash, u64>,
+    attempts: BTreeMap<AttemptKey, u64>,
+    active: BTreeSet<u64>,
+    timers: BTreeSet<(Instant, u64)>,
+    workers: JoinSet<Minted>,
+    next: u64,
+    closing: bool,
+}
+#[derive(Debug)]
+pub(super) struct Owner {
+    state: Option<Box<State>>,
+}
+impl Owner {
+    pub(super) fn new(
+        shared: Arc<Shared>,
+        limits: CallbackLimits,
+        receiver: mpsc::Receiver<Request>,
+        status: watch::Sender<CallbackStatus>,
+    ) -> Self {
+        Self {
+            state: Some(Box::new(State {
+                shared,
+                limits,
+                receiver,
+                status,
+                entries: BTreeMap::new(),
+                hashes: HashMap::new(),
+                attempts: BTreeMap::new(),
+                active: BTreeSet::new(),
+                timers: BTreeSet::new(),
+                workers: JoinSet::new(),
+                next: 0,
+                closing: false,
+            })),
+        }
+    }
+    pub(super) async fn run(mut self, stop: watch::Receiver<bool>) -> Result<(), CallbackError> {
+        let result = match self.state.as_mut() {
+            Some(state) => state.run(stop).await,
+            None => Err(CallbackError::Unavailable),
+        };
+        if result.is_ok() {
+            drop(self.state.take());
+        }
+        result
+    }
+}
+impl Drop for Owner {
+    fn drop(&mut self) {
+        if let Some(mut state) = self.state.take() {
+            state.close();
+            let _retained = Box::leak(state);
+        }
+    }
+}
+fn rejected(request: MintRequest, error: CallbackError) {
+    let _sent = request.reply.send(MintReply {
+        result: Err(Arc::new(error)),
+        _permit: request.reservations.command,
+    });
+}
+fn reject(request: Request) {
+    match request {
+        #[cfg(test)]
+        Request::Inspect(_) | Request::Panic => {}
+        Request::Mint(request) => rejected(*request, CallbackError::Unavailable),
+        Request::Api(request) => {
+            let _sent = request.reply.send(AckReply {
+                result: Err(Arc::new(CallbackError::Unavailable)),
+                _permit: request.permit,
+            });
+        }
+    }
+}
+impl State {
+    fn publish(&self) {
+        self.status.send_replace(CallbackStatus {
+            ready: !self.closing,
+            live: self.active.len(),
+            retained: self.entries.len(),
+        });
+    }
+    fn close(&mut self) {
+        if self.closing {
+            return;
+        }
+        self.closing = true;
+        self.shared.closing.send_replace(true);
+        self.receiver.close();
+        while let Ok(request) = self.receiver.try_recv() {
+            reject(request);
+        }
+        for entry in self.entries.values_mut() {
+            entry.close(CallbackOutcome::Unavailable);
+        }
+        self.active.clear();
+        self.publish();
+    }
+    fn schedule(&mut self, id: u64) {
+        if let Some(entry) = self.entries.get_mut(&id) {
+            if let Some(until) = entry.timer.take() {
+                self.timers.remove(&(until, id));
+            }
+            entry.timer = entry.next();
+            if let Some(until) = entry.timer {
+                self.timers.insert((until, id));
+            }
+            if matches!(entry.progress, Progress::Closed) {
+                self.active.remove(&id);
+            }
+        }
+    }
+    fn refresh(&mut self, id: u64, now: Instant) -> Result<(), CallbackError> {
+        if let Some(entry) = self.entries.get_mut(&id) {
+            entry.refresh(now)?;
+        }
+        self.schedule(id);
+        Ok(())
+    }
+    fn controls(&mut self, now: Instant) -> Result<(), CallbackError> {
+        let ids: Vec<_> = self.active.iter().copied().collect();
+        for id in ids {
+            self.refresh(id, now)?;
+        }
+        Ok(())
+    }
+    fn retention(&mut self, now: Instant) -> Result<(), CallbackError> {
+        let mut changed = Vec::new();
+        for (id, entry) in &mut self.entries {
+            if matches!(entry.progress, Progress::Closed)
+                && entry.retire.is_none()
+                && entry.attempt.parent.handle().snapshot().outcome().is_some()
+            {
+                entry.retire = Some(
+                    now.checked_add(self.limits.retention)
+                        .ok_or(CallbackError::Validation)?,
+                );
+                changed.push(*id);
+            }
+        }
+        for id in changed {
+            self.schedule(id);
+        }
+        Ok(())
+    }
+    fn timers(&mut self, now: Instant) -> Result<(), CallbackError> {
+        while let Some((until, id)) = self.timers.first().copied() {
+            if until > now {
+                break;
+            }
+            self.timers.remove(&(until, id));
+            if let Some(entry) = self.entries.get_mut(&id) {
+                entry.timer = None;
+            }
+            let retire = self.entries.get(&id).is_some_and(|entry| {
+                matches!(entry.progress, Progress::Closed)
+                    && entry.retire.is_some_and(|until| now >= until)
+            });
+            if retire {
+                if let Some(entry) = self.entries.remove(&id) {
+                    self.hashes.remove(&entry.digest);
+                    self.attempts.remove(&AttemptKey::of(&entry.attempt));
+                }
+            } else {
+                self.refresh(id, now)?;
+            }
+        }
+        Ok(())
+    }
+    fn mint(&mut self, request: Box<MintRequest>) {
+        let error = if self.closing {
+            Some(CallbackError::Unavailable)
+        } else if request.control.revoked() {
+            Some(CallbackError::TaskTimedOut)
+        } else if let Err(error) = request.attempt.live(Instant::now()) {
+            Some(error)
+        } else if self.workers.len() >= self.limits.workers {
+            Some(CallbackError::Capacity)
+        } else if self
+            .attempts
+            .contains_key(&AttemptKey::of(&request.attempt))
+        {
+            Some(CallbackError::AttemptExists)
+        } else {
+            None
+        };
+        if let Some(error) = error {
+            rejected(*request, error);
+            return;
+        }
+        let Some(id) = self.next.checked_add(1) else {
+            rejected(*request, CallbackError::Capacity);
+            return;
+        };
+        self.next = id;
+        self.attempts.insert(AttemptKey::of(&request.attempt), id);
+        #[cfg(test)]
+        let hook = self.shared.entropy_hook.get().cloned();
+        self.workers.spawn_blocking(move || {
+            #[cfg(test)]
+            if let Some(hook) = hook {
+                hook.run();
+            }
+            Minted {
+                id,
+                request,
+                token: CallbackToken::generate(),
+            }
+        });
+    }
+    fn minted(&mut self, result: Result<Minted, JoinError>) -> Result<(), CallbackError> {
+        let Minted { id, request, token } = result.map_err(CallbackError::Worker)?;
+        let token = match token {
+            Ok(token) => token,
+            Err(error) => {
+                self.attempts.remove(&AttemptKey::of(&request.attempt));
+                rejected(*request, error);
+                return Ok(());
+            }
+        };
+        let reject = if self.closing {
+            Some(CallbackError::Unavailable)
+        } else if request.control.revoked() {
+            Some(CallbackError::TaskTimedOut)
+        } else {
+            request.attempt.live(Instant::now()).err()
+        };
+        if let Some(error) = reject {
+            self.attempts.remove(&AttemptKey::of(&request.attempt));
+            rejected(*request, error);
+            return Ok(());
+        }
+        let digest = token.digest();
+        if self.hashes.contains_key(&digest) {
+            self.attempts.remove(&AttemptKey::of(&request.attempt));
+            rejected(*request, CallbackError::Capacity);
+            return Ok(());
+        }
+        let (view, reader) = watch::channel(Arc::new(CallbackOutcome::Invoking));
+        let task = CallbackTask {
+            token,
+            control: request.control.clone(),
+            reporter: Some(CallbackInvocationReporter::new(
+                InvocationIdentity {
+                    scope: request.attempt.parent.revision().machine().scope().clone(),
+                    call: request.attempt.call,
+                    deadline: request.attempt.deadline,
+                    issued: Instant::now(),
+                },
+                request.control.clone(),
+                request.invocation,
+            )),
+            invocation: request.invoked.clone(),
+            view: reader,
+            deadline: request.attempt.deadline,
+        };
+        self.hashes.insert(digest, id);
+        self.active.insert(id);
+        self.entries.insert(
+            id,
+            Entry {
+                digest,
+                attempt: request.attempt,
+                control: request.control,
+                invoked: Some(request.invoked),
+                view: Some(view),
+                progress: Progress::Invoking(None),
+                live: Some(request.reservations.live),
+                _retained: request.reservations.retained,
+                timer: None,
+                retire: None,
+            },
+        );
+        self.schedule(id);
+        let _sent = request.reply.send(MintReply {
+            result: Ok(task),
+            _permit: request.reservations.command,
+        });
+        Ok(())
+    }
+    fn api(&mut self, request: super::ApiRequest) {
+        let result = (|| {
+            let id = self
+                .hashes
+                .get(&request.digest)
+                .copied()
+                .ok_or(CallbackError::InvalidToken)?;
+            let entry = self
+                .entries
+                .get_mut(&id)
+                .ok_or(CallbackError::InvalidToken)?;
+            let result = entry.mutate(request.action, Instant::now());
+            self.schedule(id);
+            result
+        })();
+        let _sent = request.reply.send(AckReply {
+            result: result.map_err(Arc::new),
+            _permit: request.permit,
+        });
+    }
+    async fn run(&mut self, mut stop: watch::Receiver<bool>) -> Result<(), CallbackError> {
+        let mut maintenance = interval(Duration::from_secs(1));
+        maintenance.set_missed_tick_behavior(MissedTickBehavior::Skip);
+        let mut ticks = 0_u8;
+        loop {
+            if *stop.borrow() || stop.has_changed().is_err() {
+                self.close();
+            }
+            while let Some(result) = self.workers.try_join_next() {
+                self.minted(result)?;
+            }
+            let now = Instant::now();
+            self.timers(now)?;
+            self.publish();
+            if self.closing && self.workers.is_empty() {
+                return Ok(());
+            }
+            ticks = ticks.saturating_add(1);
+            if ticks >= 64 {
+                yield_now().await;
+                ticks = 0;
+            }
+            let until = self
+                .timers
+                .first()
+                .map_or_else(|| now + Duration::from_secs(3600), |(until, _)| *until);
+            tokio::select! {
+                biased;
+                _=stop.changed(),if !self.closing=>self.close(),
+                ()=self.shared.wake.notified(),if !self.closing=>self.controls(Instant::now())?,
+                ()=sleep_until(until),if !self.closing=>self.timers(Instant::now())?,
+                _=maintenance.tick(),if !self.closing=>{let now=Instant::now();self.controls(now)?;self.retention(now)?;},
+                result=self.workers.join_next(),if !self.workers.is_empty()=>if let Some(result)=result{self.minted(result)?;},
+                request=self.receiver.recv(),if !self.closing=>match request{#[cfg(test)] Some(Request::Inspect(reply))=>{let _sent=reply.send((self.entries.len(),self.active.len(),self.timers.len()));},#[cfg(test)] Some(Request::Panic)=>panic!("controlled callback root failure"),Some(Request::Mint(request))=>self.mint(request),Some(Request::Api(request))=>self.api(request),None=>self.close()},
+            }
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/invocation.rs b/crates/rustack-stepfunctions-core/src/registry/callback/invocation.rs
new file mode 100644
index 00000000..68a326b2
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/invocation.rs
@@ -0,0 +1,255 @@
+//! Unique real-invocation reporting and bounded metadata, separate from cleanup.
+
+use std::{fmt, num::NonZeroU64, sync::Arc};
+
+use serde_json::json;
+use tokio::{sync::watch, time::Instant};
+use uuid::{Uuid, Variant};
+
+use super::{CallbackError, Control};
+use crate::{AslError, FrameCallId, Payload, TaskFailure, TenantScope, registry::domain};
+
+/// Safe synchronous invocation metadata; never stores the function business body.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct CallbackInvocationMetadata {
+    request_id: Uuid,
+    version: Version,
+}
+#[derive(Debug, Clone, Copy)]
+enum Version {
+    Latest,
+    Published(NonZeroU64),
+}
+impl fmt::Debug for CallbackInvocationMetadata {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackInvocationMetadata(<redacted>)")
+    }
+}
+impl CallbackInvocationMetadata {
+    /// Capture an actual version4 request ID and actual executed version.
+    ///
+    /// # Errors
+    /// Rejects non-v4 IDs and versions other than `$LATEST` or canonical positive
+    /// u64 decimal versions. It never substitutes invented metadata.
+    ///
+    /// ```
+    /// # fn capture(id:uuid::Uuid){let metadata=rustack_stepfunctions_core::CallbackInvocationMetadata::new(id,"$LATEST");}
+    /// ```
+    pub fn new(request_id: Uuid, executed_version: &str) -> Result<Self, CallbackError> {
+        if request_id.get_version_num() != 4 || request_id.get_variant() != Variant::RFC4122 {
+            return Err(CallbackError::Validation);
+        }
+        let version = if executed_version == "$LATEST" {
+            Version::Latest
+        } else {
+            if executed_version.is_empty()
+                || executed_version.len() > 20
+                || executed_version.starts_with('0')
+                || !executed_version.bytes().all(|b| b.is_ascii_digit())
+            {
+                return Err(CallbackError::Validation);
+            }
+            Version::Published(
+                executed_version
+                    .parse()
+                    .map_err(|_| CallbackError::Validation)?,
+            )
+        };
+        Ok(Self {
+            request_id,
+            version,
+        })
+    }
+    /// Read the actual invocation identity.
+    ///
+    /// ```
+    /// # fn inspect(m:&rustack_stepfunctions_core::CallbackInvocationMetadata){let id=m.request_id();}
+    /// ```
+    #[must_use]
+    pub fn request_id(&self) -> Uuid {
+        self.request_id
+    }
+    /// Read the actual canonical executed version.
+    ///
+    /// ```
+    /// # fn inspect(m:&rustack_stepfunctions_core::CallbackInvocationMetadata){let version=m.executed_version();}
+    /// ```
+    #[must_use]
+    pub fn executed_version(&self) -> String {
+        match self.version {
+            Version::Latest => "$LATEST".into(),
+            Version::Published(version) => version.to_string(),
+        }
+    }
+    /// Materialize the bounded metadata-only optimized invocation envelope.
+    ///
+    /// # Errors
+    /// Preserves typed bounded JSON/encoding failure without a business Payload.
+    ///
+    /// ```
+    /// # fn encode(m:&rustack_stepfunctions_core::CallbackInvocationMetadata){let output=m.payload();}
+    /// ```
+    pub fn payload(&self) -> Result<Payload, AslError> {
+        Payload::from_value(
+            &json!({"StatusCode":200,"ExecutedVersion":self.executed_version(),"SdkHttpMetadata":{"HttpStatusCode":200},"SdkResponseMetadata":{"RequestId":self.request_id.to_string()}}),
+        )
+    }
+}
+/// One immutable actual return observation, independent of external callback result.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct CallbackInvocation {
+    pub(super) outcome: Result<Option<CallbackInvocationMetadata>, TaskFailure>,
+    pub(super) observed: Instant,
+}
+impl fmt::Debug for CallbackInvocation {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackInvocation(<redacted>)")
+    }
+}
+impl CallbackInvocation {
+    /// Read the captured monotonic actual-return observation.
+    ///
+    /// ```
+    /// # fn inspect(r:&rustack_stepfunctions_core::CallbackInvocation){let observed=r.observed();}
+    /// ```
+    #[must_use]
+    pub fn observed(&self) -> Instant {
+        self.observed
+    }
+    /// Whether the synchronous invocation succeeded, regardless of callback state.
+    ///
+    /// ```
+    /// # fn inspect(r:&rustack_stepfunctions_core::CallbackInvocation){let success=r.succeeded();}
+    /// ```
+    #[must_use]
+    pub fn succeeded(&self) -> bool {
+        self.outcome.is_ok()
+    }
+    /// Read actual metadata; direct foundation unit reports may omit it.
+    ///
+    /// ```
+    /// # fn inspect(r:&rustack_stepfunctions_core::CallbackInvocation){let metadata=r.metadata();}
+    /// ```
+    #[must_use]
+    pub fn metadata(&self) -> Option<&CallbackInvocationMetadata> {
+        self.outcome.as_ref().ok().and_then(Option::as_ref)
+    }
+    /// Read a bounded synchronous invocation failure, if any.
+    ///
+    /// ```
+    /// # fn inspect(r:&rustack_stepfunctions_core::CallbackInvocation){let failure=r.failure();}
+    /// ```
+    #[must_use]
+    pub fn failure(&self) -> Option<&TaskFailure> {
+        self.outcome.as_ref().err()
+    }
+}
+#[derive(Debug)]
+pub(super) struct InvocationIdentity {
+    pub(super) scope: TenantScope,
+    pub(super) call: FrameCallId,
+    pub(super) deadline: Instant,
+    pub(super) issued: Instant,
+}
+/// Noncloneable completion capability transferred to the real invocation owner.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct CallbackInvocationReporter {
+    identity: InvocationIdentity,
+    control: Arc<Control>,
+    invocation: watch::Sender<Option<Arc<CallbackInvocation>>>,
+    pub(super) reported: bool,
+}
+impl CallbackInvocationReporter {
+    pub(super) fn new(
+        identity: InvocationIdentity,
+        control: Arc<Control>,
+        invocation: watch::Sender<Option<Arc<CallbackInvocation>>>,
+    ) -> Self {
+        Self {
+            identity,
+            control,
+            invocation,
+            reported: false,
+        }
+    }
+    pub(crate) fn bind(
+        &self,
+        scope: &TenantScope,
+        call: FrameCallId,
+    ) -> Result<Instant, CallbackError> {
+        self.check_live()?;
+        if !domain::same_scope(&self.identity.scope, scope) || self.identity.call != call {
+            return Err(CallbackError::Validation);
+        }
+        Ok(self.identity.deadline)
+    }
+    /// Refresh report/deadline/revocation control before real invocation issuance.
+    ///
+    /// # Errors
+    /// Rejects duplicate progress and expired/revoked ownership.
+    ///
+    /// ```
+    /// # fn check(r:&rustack_stepfunctions_core::CallbackInvocationReporter){let result=r.check_live();}
+    /// ```
+    pub fn check_live(&self) -> Result<(), CallbackError> {
+        if self.reported {
+            return Err(CallbackError::Progress);
+        }
+        if self.control.revoked() || Instant::now() >= self.identity.deadline {
+            return Err(CallbackError::TaskTimedOut);
+        }
+        Ok(())
+    }
+    /// Publish one captured actual return before physical cleanup is observed.
+    ///
+    /// # Errors
+    /// Rejects duplicate/closed/expired reports and observations before token
+    /// registration or in the future. Invalid reports never reactivate a token.
+    ///
+    /// ```
+    /// # fn report(r:&mut rustack_stepfunctions_core::CallbackInvocationReporter,m:rustack_stepfunctions_core::CallbackInvocationMetadata){let result=r.complete_at(Ok(m),tokio::time::Instant::now());}
+    /// ```
+    pub fn complete_at(
+        &mut self,
+        result: Result<CallbackInvocationMetadata, TaskFailure>,
+        observed: Instant,
+    ) -> Result<(), CallbackError> {
+        self.publish(result.map(Some), observed)
+    }
+    pub(super) fn complete_unit(
+        &mut self,
+        result: Result<(), TaskFailure>,
+    ) -> Result<(), CallbackError> {
+        self.publish(result.map(|()| None), Instant::now())
+    }
+    fn publish(
+        &mut self,
+        outcome: Result<Option<CallbackInvocationMetadata>, TaskFailure>,
+        observed: Instant,
+    ) -> Result<(), CallbackError> {
+        self.check_live()?;
+        let now = Instant::now();
+        if observed < self.identity.issued || observed > now {
+            return Err(CallbackError::Validation);
+        }
+        // The post-validation fence also covers time spent validating metadata.
+        if now >= self.identity.deadline || self.control.revoked() {
+            return Err(CallbackError::TaskTimedOut);
+        }
+        self.reported = true;
+        self.invocation
+            .send_replace(Some(Arc::new(CallbackInvocation { outcome, observed })));
+        self.control.wake.notify_one();
+        Ok(())
+    }
+}
+impl Drop for CallbackInvocationReporter {
+    fn drop(&mut self) {
+        if !self.reported {
+            self.control.revoke();
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/mod.rs b/crates/rustack-stepfunctions-core/src/registry/callback/mod.rs
new file mode 100644
index 00000000..483ea7f7
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/mod.rs
@@ -0,0 +1,338 @@
+//! Bounded callback token ownership, provisional completion and exact timers.
+
+use std::{
+    fmt,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+};
+
+use tokio::{
+    runtime::Handle,
+    sync::{Notify, OwnedSemaphorePermit, Semaphore, mpsc, oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+
+use super::domain;
+use crate::TenantScope;
+
+mod actor;
+mod invocation;
+mod receipts;
+#[cfg(test)]
+mod tests;
+mod token;
+mod types;
+
+use invocation::InvocationIdentity;
+pub use invocation::{CallbackInvocation, CallbackInvocationMetadata, CallbackInvocationReporter};
+pub use receipts::{CallbackAck, CallbackMint, CallbackTask};
+pub use token::CallbackToken;
+use token::TokenHash;
+use types::Action;
+pub use types::{
+    CallbackAttempt, CallbackCommand, CallbackError, CallbackLimits, CallbackOutcome,
+    CallbackStatus, CallbackTimeout,
+};
+
+#[derive(Debug)]
+struct Control {
+    revoked: AtomicBool,
+    wake: Arc<Notify>,
+}
+impl Control {
+    fn revoke(&self) {
+        if !self.revoked.swap(true, Ordering::AcqRel) {
+            self.wake.notify_one();
+        }
+    }
+    fn revoked(&self) -> bool {
+        self.revoked.load(Ordering::Acquire)
+    }
+}
+#[derive(Debug)]
+struct Reservations {
+    live: OwnedSemaphorePermit,
+    retained: OwnedSemaphorePermit,
+    command: OwnedSemaphorePermit,
+}
+#[derive(Debug)]
+struct MintRequest {
+    attempt: CallbackAttempt,
+    control: Arc<Control>,
+    invocation: watch::Sender<Option<Arc<CallbackInvocation>>>,
+    invoked: watch::Receiver<Option<Arc<CallbackInvocation>>>,
+    reply: oneshot::Sender<MintReply>,
+    reservations: Reservations,
+}
+#[derive(Debug)]
+struct MintReply {
+    result: Result<CallbackTask, Arc<CallbackError>>,
+    _permit: OwnedSemaphorePermit,
+}
+#[derive(Debug)]
+struct AckReply {
+    result: Result<(), Arc<CallbackError>>,
+    _permit: OwnedSemaphorePermit,
+}
+#[derive(Debug)]
+struct ApiRequest {
+    digest: TokenHash,
+    action: Action,
+    reply: oneshot::Sender<AckReply>,
+    permit: OwnedSemaphorePermit,
+}
+#[derive(Debug)]
+enum Request {
+    #[cfg(test)]
+    Inspect(oneshot::Sender<(usize, usize, usize)>),
+    #[cfg(test)]
+    Panic,
+    Mint(Box<MintRequest>),
+    Api(ApiRequest),
+}
+#[derive(Debug)]
+struct Shared {
+    #[cfg(test)]
+    entropy_hook: std::sync::OnceLock<Arc<tests::EntropyHook>>,
+    scope: TenantScope,
+    sender: mpsc::Sender<Request>,
+    live: Arc<Semaphore>,
+    retained: Arc<Semaphore>,
+    commands: Arc<Semaphore>,
+    closing: watch::Sender<bool>,
+    wake: Arc<Notify>,
+    status: watch::Receiver<CallbackStatus>,
+}
+/// Scoped bounded callback admission; accepted mutations outlive API observers.
+#[derive(Clone, Debug)]
+#[non_exhaustive]
+pub struct CallbackRegistry {
+    shared: Arc<Shared>,
+}
+impl CallbackRegistry {
+    pub(crate) fn scope(&self) -> &TenantScope {
+        &self.shared.scope
+    }
+    /// Start the unique callback actor with bounded entropy workers and commands.
+    ///
+    /// # Errors
+    /// Requires an active Tokio runtime; trusted scope/limits are prevalidated.
+    ///
+    /// ```no_run
+    /// # async fn start()->Result<(),rustack_stepfunctions_core::CallbackError>{
+    /// let (callbacks,mut owner)=rustack_stepfunctions_core::CallbackRegistry::new(Default::default(),Default::default())?;
+    /// owner.shutdown(tokio::time::Instant::now()+std::time::Duration::from_secs(5)).await?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        scope: TenantScope,
+        limits: CallbackLimits,
+    ) -> Result<(Self, CallbackSupervisor), CallbackError> {
+        if Handle::try_current().is_err() {
+            return Err(CallbackError::Unavailable);
+        }
+        let (sender, receiver) = mpsc::channel(limits.commands);
+        let (closing, stop) = watch::channel(false);
+        let (status, reader) = watch::channel(CallbackStatus {
+            ready: true,
+            live: 0,
+            retained: 0,
+        });
+        let shared = Arc::new(Shared {
+            #[cfg(test)]
+            entropy_hook: std::sync::OnceLock::new(),
+            scope,
+            sender,
+            live: Arc::new(Semaphore::new(limits.live)),
+            retained: Arc::new(Semaphore::new(limits.retained)),
+            commands: Arc::new(Semaphore::new(limits.commands)),
+            closing: closing.clone(),
+            wake: Arc::new(Notify::new()),
+            status: reader,
+        });
+        let state = actor::Owner::new(shared.clone(), limits, receiver, status);
+        let join = tokio::spawn(state.run(stop));
+        Ok((
+            Self { shared },
+            CallbackSupervisor {
+                closing,
+                join: Some(join),
+                result: None,
+            },
+        ))
+    }
+    /// Reserve all bounded ownership before queuing one trusted mint attempt.
+    ///
+    /// An error before return means no mint request was accepted.
+    ///
+    /// # Errors
+    /// Rejects foreign/closed parents, expired deadlines and exhausted/closed lanes.
+    ///
+    /// ```no_run
+    /// # fn register(r:&rustack_stepfunctions_core::CallbackRegistry,a:rustack_stepfunctions_core::CallbackAttempt){let receipt=r.register(a);}
+    /// ```
+    pub fn register(&self, attempt: CallbackAttempt) -> Result<CallbackMint, CallbackError> {
+        self.accepting()?;
+        if !attempt.scoped(&self.shared.scope) {
+            return Err(CallbackError::Validation);
+        }
+        attempt.live(Instant::now())?;
+        let reservations = Reservations {
+            command: self.command_permit()?,
+            live: self
+                .shared
+                .live
+                .clone()
+                .try_acquire_owned()
+                .map_err(|_| CallbackError::Capacity)?,
+            retained: self
+                .shared
+                .retained
+                .clone()
+                .try_acquire_owned()
+                .map_err(|_| CallbackError::Capacity)?,
+        };
+        let control = Arc::new(Control {
+            revoked: AtomicBool::new(false),
+            wake: self.shared.wake.clone(),
+        });
+        let (invocation, invoked) = watch::channel(None);
+        let (reply, receiver) = oneshot::channel();
+        self.send(Request::Mint(Box::new(MintRequest {
+            attempt,
+            control: control.clone(),
+            invocation,
+            invoked,
+            reply,
+            reservations,
+        })))?;
+        Ok(CallbackMint::new(receiver, control))
+    }
+    /// Accept one prepared mutation using trusted authenticated caller scope.
+    ///
+    /// Dropping the acknowledgment waiter never undoes this accepted action.
+    ///
+    /// # Errors
+    /// Rejects foreign scope, exhausted command capacity or closed ownership.
+    ///
+    /// ```no_run
+    /// # fn submit(r:&rustack_stepfunctions_core::CallbackRegistry,c:rustack_stepfunctions_core::CallbackCommand){let receipt=r.submit(&Default::default(),c);}
+    /// ```
+    pub fn submit(
+        &self,
+        scope: &TenantScope,
+        command: CallbackCommand,
+    ) -> Result<CallbackAck, CallbackError> {
+        if !domain::same_scope(scope, &self.shared.scope) {
+            return Err(CallbackError::InvalidToken);
+        }
+        self.accepting()?;
+        let permit = self.command_permit()?;
+        let digest = command.token.digest();
+        let (reply, receiver) = oneshot::channel();
+        self.send(Request::Api(ApiRequest {
+            digest,
+            action: command.action,
+            reply,
+            permit,
+        }))?;
+        Ok(CallbackAck::new(receiver))
+    }
+    /// Capture root health and issued live/retained counts without credentials.
+    ///
+    /// ```
+    /// # fn inspect(r:&rustack_stepfunctions_core::CallbackRegistry){let status=r.status();}
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> CallbackStatus {
+        let mut status = *self.shared.status.borrow();
+        status.ready &= !*self.shared.closing.borrow() && self.shared.status.has_changed().is_ok();
+        status
+    }
+    fn accepting(&self) -> Result<(), CallbackError> {
+        if self.status().ready {
+            Ok(())
+        } else {
+            Err(CallbackError::Unavailable)
+        }
+    }
+    fn command_permit(&self) -> Result<OwnedSemaphorePermit, CallbackError> {
+        self.shared
+            .commands
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| CallbackError::Capacity)
+    }
+    fn send(&self, request: Request) -> Result<(), CallbackError> {
+        self.shared
+            .sender
+            .try_send(request)
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => CallbackError::Capacity,
+                mpsc::error::TrySendError::Closed(_) => CallbackError::Unavailable,
+            })
+    }
+}
+/// Unique joined callback root controller; Drop closes without aborting workers.
+#[non_exhaustive]
+pub struct CallbackSupervisor {
+    closing: watch::Sender<bool>,
+    join: Option<JoinHandle<Result<(), CallbackError>>>,
+    result: Option<Result<(), Arc<CallbackError>>>,
+}
+impl fmt::Debug for CallbackSupervisor {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackSupervisor(<redacted>)")
+    }
+}
+impl CallbackSupervisor {
+    /// Reject new work and request root drain exactly once.
+    ///
+    /// ```
+    /// # fn close(owner:&rustack_stepfunctions_core::CallbackSupervisor){owner.close();}
+    /// ```
+    pub fn close(&self) {
+        self.closing.send_replace(true);
+    }
+    /// Join the same root through an observer deadline without aborting entropy.
+    ///
+    /// # Errors
+    /// Returns Deadline while the join is retained, or a cached fatal worker error.
+    ///
+    /// ```no_run
+    /// # async fn close(owner:&mut rustack_stepfunctions_core::CallbackSupervisor,deadline:tokio::time::Instant){let result=owner.shutdown(deadline).await;}
+    /// ```
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), CallbackError> {
+        self.close();
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        if self.result.is_none() {
+            let join = self.join.as_mut().ok_or(CallbackError::Unavailable)?;
+            let result = timeout_at(deadline, join)
+                .await
+                .map_err(|_| CallbackError::Deadline)?;
+            self.join = None;
+            self.result = Some(match result {
+                Ok(result) => result.map_err(Arc::new),
+                Err(error) => Err(Arc::new(CallbackError::Worker(error))),
+            });
+        }
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        match self.result.as_ref() {
+            Some(Ok(())) => Ok(()),
+            Some(Err(error)) => Err(CallbackError::Cached(error.clone())),
+            None => Err(CallbackError::Unavailable),
+        }
+    }
+}
+impl Drop for CallbackSupervisor {
+    fn drop(&mut self) {
+        self.close();
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/receipts.rs b/crates/rustack-stepfunctions-core/src/registry/callback/receipts.rs
new file mode 100644
index 00000000..63039546
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/receipts.rs
@@ -0,0 +1,344 @@
+//! Unique Task controls and cancellation-safe cached admission/API observations.
+
+use std::sync::Arc;
+
+use tokio::{
+    sync::{oneshot, watch},
+    time::{Instant, timeout_at},
+};
+
+use super::{
+    AckReply, CallbackError, CallbackInvocation, CallbackInvocationReporter, CallbackOutcome,
+    CallbackToken, Control, MintReply,
+};
+use crate::TaskFailure;
+
+/// One retained trusted mint request; dropping it revokes even before acceptance.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct CallbackMint {
+    receiver: Option<oneshot::Receiver<MintReply>>,
+    reply: Option<MintReply>,
+    loss: Option<Arc<CallbackError>>,
+    control: Arc<Control>,
+    armed: bool,
+}
+impl CallbackMint {
+    pub(super) fn new(receiver: oneshot::Receiver<MintReply>, control: Arc<Control>) -> Self {
+        Self {
+            receiver: Some(receiver),
+            reply: None,
+            loss: None,
+            control,
+            armed: true,
+        }
+    }
+    /// Observe the same minted token owner, caching even a late-ready response.
+    ///
+    /// # Errors
+    /// Returns typed mint failure, observer Deadline or unknown `OwnerLost`.
+    ///
+    /// ```no_run
+    /// # async fn observe(m:&mut rustack_stepfunctions_core::CallbackMint,d:tokio::time::Instant){let task=m.admitted(d).await;}
+    /// ```
+    pub async fn admitted(&mut self, deadline: Instant) -> Result<&CallbackTask, CallbackError> {
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        let result = timeout_at(deadline, self.resolve())
+            .await
+            .map_err(|_| CallbackError::Deadline)?;
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        result?;
+        match self.reply.as_ref().map(|reply| &reply.result) {
+            Some(Ok(task)) => Ok(task),
+            _ => Err(CallbackError::OwnerLost),
+        }
+    }
+    pub(crate) async fn resolve(&mut self) -> Result<(), CallbackError> {
+        if self.reply.is_none() && self.loss.is_none() {
+            let result = self
+                .receiver
+                .as_mut()
+                .ok_or(CallbackError::OwnerLost)?
+                .await;
+            self.receiver = None;
+            match result {
+                Ok(reply) => self.reply = Some(reply),
+                Err(_) => self.loss = Some(Arc::new(CallbackError::OwnerLost)),
+            }
+        }
+        if let Some(loss) = &self.loss {
+            return Err(CallbackError::Cached(loss.clone()));
+        }
+        match self.reply.as_ref().map(|reply| &reply.result) {
+            Some(Ok(_)) => Ok(()),
+            Some(Err(error)) => Err(CallbackError::Cached(error.clone())),
+            None => Err(CallbackError::OwnerLost),
+        }
+    }
+
+    /// Transfer the cached unique Task owner, without revoking on mint Drop.
+    ///
+    /// # Errors
+    /// Requires a cached successful admission, including a late-ready success.
+    ///
+    /// ```no_run
+    /// # fn transfer(m:rustack_stepfunctions_core::CallbackMint){let task=m.into_task();}
+    /// ```
+    pub fn into_task(mut self) -> Result<CallbackTask, CallbackError> {
+        if let Some(loss) = &self.loss {
+            return Err(CallbackError::Cached(loss.clone()));
+        }
+        let task = self
+            .reply
+            .take()
+            .ok_or(CallbackError::OwnerLost)?
+            .result
+            .map_err(CallbackError::Cached)?;
+        self.armed = false;
+        Ok(task)
+    }
+    /// Revoke the accepted/pending attempt independently of command saturation.
+    ///
+    /// ```
+    /// # fn cancel(m:&rustack_stepfunctions_core::CallbackMint){m.revoke();}
+    /// ```
+    pub fn revoke(&self) {
+        self.control.revoke();
+    }
+}
+impl Drop for CallbackMint {
+    fn drop(&mut self) {
+        if self.armed {
+            self.control.revoke();
+        }
+    }
+}
+/// Resumable API acknowledgment; observer loss never undoes its accepted action.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct CallbackAck {
+    receiver: Option<oneshot::Receiver<AckReply>>,
+    reply: Option<AckReply>,
+    loss: Option<Arc<CallbackError>>,
+}
+impl CallbackAck {
+    pub(super) fn new(receiver: oneshot::Receiver<AckReply>) -> Self {
+        Self {
+            receiver: Some(receiver),
+            reply: None,
+            loss: None,
+        }
+    }
+    /// Await/cache one action result without resending it on observation timeout.
+    ///
+    /// # Errors
+    /// Returns protocol/admission failure, observer Deadline or `OwnerLost`.
+    ///
+    /// ```no_run
+    /// # async fn observe(r:&mut rustack_stepfunctions_core::CallbackAck,d:tokio::time::Instant){let result=r.wait(d).await;}
+    /// ```
+    pub async fn wait(&mut self, deadline: Instant) -> Result<(), CallbackError> {
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        if self.reply.is_none() && self.loss.is_none() {
+            let result = timeout_at(
+                deadline,
+                self.receiver.as_mut().ok_or(CallbackError::OwnerLost)?,
+            )
+            .await
+            .map_err(|_| CallbackError::Deadline)?;
+            self.receiver = None;
+            match result {
+                Ok(reply) => self.reply = Some(reply),
+                Err(_) => self.loss = Some(Arc::new(CallbackError::OwnerLost)),
+            }
+        }
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        if let Some(loss) = &self.loss {
+            return Err(CallbackError::Cached(loss.clone()));
+        }
+        match self.reply.as_ref().map(|reply| &reply.result) {
+            Some(Ok(())) => Ok(()),
+            Some(Err(error)) => Err(CallbackError::Cached(error.clone())),
+            None => Err(CallbackError::OwnerLost),
+        }
+    }
+}
+/// Unique invocation gate, credential and independent business-result observer.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct CallbackTask {
+    pub(super) token: CallbackToken,
+    pub(super) control: Arc<Control>,
+    pub(super) reporter: Option<CallbackInvocationReporter>,
+    pub(super) invocation: watch::Receiver<Option<Arc<CallbackInvocation>>>,
+    pub(super) view: watch::Receiver<Arc<CallbackOutcome>>,
+    pub(super) deadline: Instant,
+}
+impl CallbackTask {
+    /// Borrow the secret only for intentional context/outbound credential access.
+    ///
+    /// ```
+    /// # fn send(task:&rustack_stepfunctions_core::CallbackTask){let token=task.token();}
+    /// ```
+    #[must_use]
+    pub fn token(&self) -> &CallbackToken {
+        &self.token
+    }
+    /// Capture one coherent invocation/callback business state.
+    ///
+    /// ```
+    /// # fn inspect(task:&rustack_stepfunctions_core::CallbackTask){let state=task.snapshot();}
+    /// ```
+    #[must_use]
+    pub fn snapshot(&self) -> Arc<CallbackOutcome> {
+        self.view.borrow().clone()
+    }
+    /// Report synchronous invocation outcome once; no business Lambda payload.
+    ///
+    /// # Errors
+    /// Rejects duplicate invocation reports, expired/revoked tasks and root loss.
+    ///
+    /// ```
+    /// # fn report(task:&mut rustack_stepfunctions_core::CallbackTask){let result=task.invocation_complete(Ok(()));}
+    /// ```
+    pub fn invocation_complete(
+        &mut self,
+        result: Result<(), TaskFailure>,
+    ) -> Result<(), CallbackError> {
+        self.reporter_live()?;
+        self.reporter
+            .as_mut()
+            .ok_or(CallbackError::Progress)?
+            .complete_unit(result)
+    }
+    fn reporter_live(&self) -> Result<(), CallbackError> {
+        if self
+            .reporter
+            .as_ref()
+            .is_none_or(|reporter| reporter.reported)
+        {
+            return Err(CallbackError::Progress);
+        }
+        if matches!(self.snapshot().as_ref(), CallbackOutcome::Unavailable) {
+            return Err(CallbackError::Unavailable);
+        }
+        if self.snapshot().is_terminal()
+            || Instant::now() >= self.deadline
+            || self.control.revoked()
+        {
+            return Err(CallbackError::TaskTimedOut);
+        }
+        Ok(())
+    }
+    /// Transfer the unique invocation report capability to its real provider owner.
+    ///
+    /// # Errors
+    /// Rejects duplicate/delegated progress, expired/revoked tasks or root loss.
+    ///
+    /// ```
+    /// # fn delegate(t:&mut rustack_stepfunctions_core::CallbackTask){let reporter=t.take_invocation_reporter();}
+    /// ```
+    pub fn take_invocation_reporter(
+        &mut self,
+    ) -> Result<CallbackInvocationReporter, CallbackError> {
+        self.reporter_live()?;
+        self.reporter.take().ok_or(CallbackError::Progress)
+    }
+    /// Capture the actual return report independently of callback/cleanup state.
+    ///
+    /// ```
+    /// # fn inspect(t:&rustack_stepfunctions_core::CallbackTask){let report=t.invocation();}
+    /// ```
+    #[must_use]
+    pub fn invocation(&self) -> Option<Arc<CallbackInvocation>> {
+        self.invocation.borrow().clone()
+    }
+    /// Observe the same invocation return without resending or consuming cleanup.
+    ///
+    /// # Errors
+    /// Returns observer Deadline, known task closure, root Unavailable or `OwnerLost`.
+    ///
+    /// ```no_run
+    /// # async fn observe(t:&mut rustack_stepfunctions_core::CallbackTask,d:tokio::time::Instant){let report=t.wait_invocation(d).await;}
+    /// ```
+    pub async fn wait_invocation(
+        &mut self,
+        deadline: Instant,
+    ) -> Result<Arc<CallbackInvocation>, CallbackError> {
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        let result = timeout_at(deadline, async {
+            loop {
+                if let Some(report) = self.invocation() { return Ok(report); }
+                match self.snapshot().as_ref() {
+                    CallbackOutcome::Unavailable => return Err(CallbackError::Unavailable),
+                    CallbackOutcome::TimedOut(_) | CallbackOutcome::Revoked => return Err(CallbackError::TaskTimedOut),
+                    _ => {},
+                }
+                tokio::select! {
+                    biased;
+                    result = self.invocation.changed() => result.map_err(|_| CallbackError::OwnerLost)?,
+                    result = self.view.changed() => result.map_err(|_| CallbackError::OwnerLost)?,
+                }
+            }
+        }).await.map_err(|_| CallbackError::Deadline)?;
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        result
+    }
+    /// Revoke immediately through independent monotonic control and Notify.
+    ///
+    /// ```
+    /// # fn cancel(task:&rustack_stepfunctions_core::CallbackTask){task.revoke();}
+    /// ```
+    pub fn revoke(&self) {
+        self.control.revoke();
+    }
+    /// Await a terminal business state; observer expiry never cancels ownership.
+    ///
+    /// # Errors
+    /// Returns Deadline or `OwnerLost` without resending or revoking the callback.
+    ///
+    /// ```no_run
+    /// # async fn observe(task:&mut rustack_stepfunctions_core::CallbackTask,d:tokio::time::Instant){let result=task.wait(d).await;}
+    /// ```
+    pub async fn wait(&mut self, deadline: Instant) -> Result<Arc<CallbackOutcome>, CallbackError> {
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        let result = timeout_at(deadline, self.resolved())
+            .await
+            .map_err(|_| CallbackError::Deadline)?;
+        if Instant::now() >= deadline {
+            return Err(CallbackError::Deadline);
+        }
+        result
+    }
+    pub(crate) async fn resolved(&mut self) -> Result<Arc<CallbackOutcome>, CallbackError> {
+        loop {
+            let view = self.snapshot();
+            if view.is_terminal() {
+                return Ok(view);
+            }
+            self.view
+                .changed()
+                .await
+                .map_err(|_| CallbackError::OwnerLost)?;
+        }
+    }
+}
+impl Drop for CallbackTask {
+    fn drop(&mut self) {
+        self.revoke();
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/tests.rs b/crates/rustack-stepfunctions-core/src/registry/callback/tests.rs
new file mode 100644
index 00000000..79bcf14a
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/tests.rs
@@ -0,0 +1,1127 @@
+//! Actual captured execution ownership and explicit-clock callback protocol tests.
+
+use std::{
+    error::Error,
+    future::{Future, poll_fn},
+    str::FromStr,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    task::Poll,
+    time::Duration,
+};
+
+use chrono::Utc;
+use rstest::rstest;
+use serde_json::json;
+use tokio::{
+    sync::{Notify, Semaphore},
+    time::{Instant, advance, pause, resume, timeout},
+};
+
+use super::*;
+use crate::{
+    AslCompiler, ClockSample, DataFlow, DriverStep, EvaluationContext, ExecutionDriver,
+    ExecutionLimits, ExecutionSnapshot, ExecutionSupervisor, FrameCallId, FrameCapacity,
+    FrameLimits, FrameScheduler, FrameUpdate, HistoryLimits, Payload, PreparedDefinition, Registry,
+    RegistryCommand, RegistryLimits, RegistryResult, RegistrySupervisor, RuntimeLimits,
+    SystemUuidSource, Tags, TaskFailure, TaskSupport,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+#[derive(Debug)]
+pub(super) struct EntropyHook {
+    entered: Notify,
+    released: AtomicBool,
+    panic: bool,
+}
+impl EntropyHook {
+    fn new(panic: bool) -> Arc<Self> {
+        Arc::new(Self {
+            entered: Notify::new(),
+            released: AtomicBool::new(false),
+            panic,
+        })
+    }
+    pub(super) fn run(&self) {
+        self.entered.notify_one();
+        while !self.released.load(Ordering::Acquire) {
+            std::thread::park_timeout(Duration::from_millis(1));
+        }
+        assert!(!self.panic, "controlled callback entropy panic");
+    }
+    fn release(&self) {
+        self.released.store(true, Ordering::Release);
+    }
+}
+#[derive(Debug)]
+struct Gate(Arc<EntropyHook>);
+impl Drop for Gate {
+    fn drop(&mut self) {
+        self.0.release();
+    }
+}
+struct Fixture {
+    callbacks: CallbackRegistry,
+    owner: CallbackSupervisor,
+    registry: Registry,
+    registry_owner: RegistrySupervisor,
+    parent: ExecutionSnapshot,
+    calls: Vec<FrameCallId>,
+}
+impl Fixture {
+    async fn new(limits: CallbackLimits) -> Result<Self, Box<dyn Error>> {
+        let runtime = ExecutionSupervisor::new(
+            RuntimeLimits::default(),
+            HistoryLimits::default(),
+            256 * 1024 * 1024,
+            None,
+        )?;
+        let (registry, registry_owner) = Registry::new(
+            TenantScope::default(),
+            RegistryLimits::default(),
+            runtime,
+            ExecutionLimits::default(),
+        )?;
+        let definition = AslCompiler::default().compile(
+            br#"{"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":3600,"End":true}}}"#,
+        )?;
+        let RegistryResult::Machine(machine) = registry
+            .submit(RegistryCommand::Create(
+                "Parent".parse()?,
+                PreparedDefinition::new(definition.machine().clone()),
+                "arn:aws:iam::000000000000:role/Worker".parse()?,
+                Tags::default(),
+            ))?
+            .wait(deadline())
+            .await?
+        else {
+            return Err("parent machine".into());
+        };
+        let RegistryResult::Execution(parent) = registry
+            .submit(RegistryCommand::Start(
+                machine.arn().clone(),
+                Some("Run".parse()?),
+                Payload::parse(b"{}")?,
+                None,
+            ))?
+            .wait(deadline())
+            .await?
+        else {
+            return Err("parent execution".into());
+        };
+        let (callbacks, owner) = CallbackRegistry::new(TenantScope::default(), limits)?;
+        Ok(Self {
+            callbacks,
+            owner,
+            registry,
+            registry_owner,
+            parent,
+            calls: calls()?,
+        })
+    }
+    fn attempt(
+        &self,
+        index: usize,
+        seconds: u64,
+        heartbeat: Option<u64>,
+    ) -> Result<CallbackAttempt, CallbackError> {
+        CallbackAttempt::new(
+            &self.parent,
+            *self.calls.get(index).ok_or(CallbackError::Validation)?,
+            Instant::now() + Duration::from_secs(seconds),
+            heartbeat.map(Duration::from_secs),
+        )
+    }
+    async fn task(
+        &self,
+        index: usize,
+        seconds: u64,
+        heartbeat: Option<u64>,
+    ) -> Result<CallbackTask, Box<dyn Error>> {
+        let mut mint = self
+            .callbacks
+            .register(self.attempt(index, seconds, heartbeat)?)?;
+        mint.admitted(deadline()).await?;
+        Ok(mint.into_task()?)
+    }
+    async fn close(&mut self) -> TestResult {
+        let a = self.owner.shutdown(deadline()).await;
+        let b = self.registry_owner.shutdown(deadline()).await;
+        a?;
+        b?;
+        Ok(())
+    }
+}
+fn calls() -> Result<Vec<FrameCallId>, Box<dyn Error>> {
+    let definition = json!({"StartAt":"A","States":{"A":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","Next":"B"},"B":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}});
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(&serde_json::to_vec(&definition)?)?
+        .machine()
+        .clone();
+    let now = ClockSample::new(Instant::now().into_std(), Utc::now());
+    let driver = ExecutionDriver::for_structured_owner(
+        machine,
+        Payload::parse(b"{}")?,
+        EvaluationContext::from_value(&json!({}))?,
+        now,
+        ExecutionLimits::default(),
+    )?;
+    let mut frames = FrameScheduler::new(
+        driver,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )?;
+    let mut calls = Vec::new();
+    let mut source = SystemUuidSource::default();
+    for _ in 0..100 {
+        if let FrameUpdate::Transition(t) = frames.advance(now, &mut source) {
+            if matches!(t.step(), DriverStep::Dispatch(_)) {
+                let call = t.call().ok_or("call identity")?;
+                calls.push(call);
+                frames.complete(call, Ok(Payload::parse(b"null")?), now, &mut source)?;
+                frames.retired(call)?;
+            }
+        }
+        if calls.len() == 2 {
+            return Ok(calls);
+        }
+    }
+    Err("missing actual frame attempts".into())
+}
+fn token(task: &CallbackTask) -> CallbackToken {
+    task.token().expose().parse().unwrap()
+}
+fn underlying(error: &CallbackError) -> &CallbackError {
+    match error {
+        CallbackError::Cached(error) => underlying(error),
+        other => other,
+    }
+}
+async fn action(
+    registry: &CallbackRegistry,
+    command: CallbackCommand,
+) -> Result<(), CallbackError> {
+    registry
+        .submit(&TenantScope::default(), command)?
+        .wait(deadline())
+        .await
+}
+async fn activated(task: &mut CallbackTask) -> TestResult {
+    timeout(
+        Duration::from_secs(5),
+        task.view
+            .wait_for(|v| matches!(v.as_ref(), CallbackOutcome::Waiting { .. })),
+    )
+    .await??;
+    Ok(())
+}
+async fn inspect(registry: &CallbackRegistry) -> Result<(usize, usize, usize), Box<dyn Error>> {
+    let (sender, receiver) = oneshot::channel();
+    registry
+        .shared
+        .sender
+        .send(Request::Inspect(sender))
+        .await?;
+    Ok(timeout(Duration::from_secs(5), receiver).await??)
+}
+
+#[rstest]
+#[case(false, false)]
+#[case(false, true)]
+#[case(true, false)]
+#[case(true, true)]
+#[tokio::test]
+async fn test_should_commit_early_or_late_success_and_failure_only_after_invocation_success(
+    #[case] early: bool,
+    #[case] failure: bool,
+) -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    if !early {
+        task.invocation_complete(Ok(()))?;
+        activated(&mut task).await?;
+    }
+    let command = if failure {
+        CallbackCommand::failure(
+            token(&task),
+            Some("BusinessFailure".into()),
+            Some(String::new()),
+        )?
+    } else {
+        CallbackCommand::success(token(&task), b" { \"answer\":42 } ")?
+    };
+    action(&f.callbacks, command).await?;
+    if early {
+        assert!(matches!(
+            task.snapshot().as_ref(),
+            CallbackOutcome::Invoking
+        ));
+        task.invocation_complete(Ok(()))?;
+    }
+    let outcome = task.wait(deadline()).await?;
+    match outcome.as_ref() {
+        CallbackOutcome::Succeeded(output) if !failure => {
+            assert_eq!(output.original_bytes(), b" { \"answer\":42 } ");
+        }
+        CallbackOutcome::Failed(failure) => {
+            assert_eq!(failure.details().error(), Some("BusinessFailure"));
+            assert_eq!(failure.details().cause(), Some(""));
+        }
+        other => return Err(format!("unexpected outcome: {other:?}").into()),
+    }
+    assert!(matches!(
+        underlying(
+            &action(
+                &f.callbacks,
+                CallbackCommand::success(token(&task), b"true")?
+            )
+            .await
+            .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(token(&task)))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_discard_early_callback_when_lambda_invocation_fails() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    action(&f.callbacks, CallbackCommand::success(token(&task), b"42")?).await?;
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(token(&task)))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    task.invocation_complete(Err(TaskFailure::new(
+        "Lambda.ServiceException",
+        Some("invoke failed"),
+    )?))?;
+    assert!(
+        matches!(task.wait(deadline()).await?.as_ref(),CallbackOutcome::InvocationFailed(f) if f.details().error()==Some("Lambda.ServiceException"))
+    );
+    assert!(matches!(
+        task.invocation_complete(Ok(())),
+        Err(CallbackError::Progress)
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_start_heartbeat_only_after_successful_invocation_and_replace_one_timer()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, Some(2)).await?;
+    pause();
+    advance(Duration::from_secs(5)).await;
+    action(&f.callbacks, CallbackCommand::heartbeat(token(&task))).await?;
+    assert!(matches!(
+        task.snapshot().as_ref(),
+        CallbackOutcome::Invoking
+    ));
+    task.invocation_complete(Ok(()))?;
+    activated(&mut task).await?;
+    advance(Duration::from_secs(1)).await;
+    for _ in 0..200 {
+        advance(Duration::from_millis(1)).await;
+        action(&f.callbacks, CallbackCommand::heartbeat(token(&task))).await?;
+    }
+    assert_eq!(inspect(&f.callbacks).await?, (1, 1, 1));
+    advance(Duration::from_secs(2)).await;
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat)
+    ));
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(token(&task)))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_preserve_absolute_task_deadline_under_heartbeats_and_early_callback()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 3, Some(10)).await?;
+    pause();
+    task.invocation_complete(Ok(()))?;
+    activated(&mut task).await?;
+    for _ in 0..2 {
+        advance(Duration::from_secs(1)).await;
+        action(&f.callbacks, CallbackCommand::heartbeat(token(&task))).await?;
+    }
+    advance(Duration::from_secs(1)).await;
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::TimedOut(CallbackTimeout::Task)
+    ));
+    resume();
+    let mut early = f.task(1, 2, None).await?;
+    pause();
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&early), b"true")?,
+    )
+    .await?;
+    advance(Duration::from_secs(2)).await;
+    assert!(matches!(
+        early.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::TimedOut(CallbackTimeout::Task)
+    ));
+    assert!(matches!(
+        early.invocation_complete(Ok(())),
+        Err(CallbackError::TaskTimedOut)
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_have_no_heartbeat_timer_when_unconfigured() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 100, None).await?;
+    pause();
+    task.invocation_complete(Ok(()))?;
+    activated(&mut task).await?;
+    advance(Duration::from_secs(50)).await;
+    action(&f.callbacks, CallbackCommand::heartbeat(token(&task))).await?;
+    assert!(matches!(
+        task.snapshot().as_ref(),
+        CallbackOutcome::Waiting {
+            heartbeat_deadline: None
+        }
+    ));
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&task), b"null")?,
+    )
+    .await?;
+    assert!(
+        matches!(task.wait(deadline()).await?.as_ref(),CallbackOutcome::Succeeded(v) if v.value().is_null())
+    );
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_revoke_independently_of_saturated_acknowledgment_capacity() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::new(2, 4, 1, 1, Duration::from_secs(60))?).await?;
+    let mut task = f.task(0, 60, None).await?;
+    let ack = f.callbacks.submit(
+        &TenantScope::default(),
+        CallbackCommand::heartbeat(token(&task)),
+    )?;
+    assert!(matches!(
+        f.callbacks.submit(
+            &TenantScope::default(),
+            CallbackCommand::heartbeat(token(&task))
+        ),
+        Err(CallbackError::Capacity)
+    ));
+    task.revoke();
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    assert!(matches!(
+        f.callbacks.submit(
+            &TenantScope::default(),
+            CallbackCommand::heartbeat(token(&task))
+        ),
+        Err(CallbackError::Capacity)
+    ));
+    drop(ack);
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(token(&task)))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_revoke_on_parent_stop_and_isolate_old_generation_from_new_attempt()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut old = f.task(0, 60, None).await?;
+    assert!(matches!(
+        underlying(&{
+            let mut mint = f.callbacks.register(f.attempt(0, 60, None)?)?;
+            mint.admitted(deadline()).await.unwrap_err()
+        }),
+        CallbackError::AttemptExists
+    ));
+    let mut next = f.task(1, 60, None).await?;
+    assert_eq!(f.calls[0].frame(), f.calls[1].frame());
+    assert_ne!(f.calls[0].attempt(), f.calls[1].attempt());
+    old.revoke();
+    assert!(matches!(
+        old.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    assert!(matches!(
+        underlying(
+            &action(
+                &f.callbacks,
+                CallbackCommand::success(token(&old), b"true")?
+            )
+            .await
+            .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    assert!(matches!(
+        next.snapshot().as_ref(),
+        CallbackOutcome::Invoking
+    ));
+    f.parent
+        .handle()
+        .request_stop(TaskFailure::new("Stopped", None)?);
+    f.parent.handle().wait(deadline()).await?;
+    assert!(matches!(
+        next.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    assert!(matches!(
+        f.attempt(0, 60, None),
+        Err(CallbackError::TaskTimedOut)
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_classify_forged_foreign_consumed_and_malformed_tokens_without_exposure()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    let foreign = TenantScope::new("aws", "us-west-2", "000000000000")?;
+    assert!(matches!(
+        f.callbacks
+            .submit(&foreign, CallbackCommand::heartbeat(token(&task))),
+        Err(CallbackError::InvalidToken)
+    ));
+    let unknown = CallbackToken::from_str(&"0".repeat(64))?;
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(unknown))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::InvalidToken
+    ));
+    for value in [
+        String::new(),
+        "a".repeat(63),
+        "A".repeat(64),
+        "g".repeat(64),
+        "a".repeat(2049),
+    ] {
+        assert!(matches!(
+            value.parse::<CallbackToken>(),
+            Err(CallbackError::InvalidToken)
+        ));
+    }
+    let raw = task.token().expose().to_owned();
+    assert_eq!(raw.len(), 64);
+    assert!(
+        raw.bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+    );
+    let command = CallbackCommand::success(token(&task), b"true")?;
+    for rendered in [
+        format!("{task:?}"),
+        format!("{:?}", f.callbacks),
+        format!("{:?}", task.token()),
+        format!("{command:?}"),
+        format!("{:?}", task.token().digest()),
+    ] {
+        assert!(!rendered.contains(&raw));
+    }
+    task.revoke();
+    task.wait(deadline()).await?;
+    assert!(matches!(
+        f.callbacks
+            .submit(&foreign, CallbackCommand::heartbeat(token(&task))),
+        Err(CallbackError::InvalidToken)
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_continue_accepted_callback_after_ack_waiter_loss_and_task_observer_expiry()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    assert!(matches!(
+        task.wait(Instant::now()).await,
+        Err(CallbackError::Deadline)
+    ));
+    task.invocation_complete(Ok(()))?;
+    drop(f.callbacks.submit(
+        &TenantScope::default(),
+        CallbackCommand::success(token(&task), b"42")?,
+    )?);
+    assert!(
+        matches!(task.wait(deadline()).await?.as_ref(),CallbackOutcome::Succeeded(v) if v.value()==&json!(42))
+    );
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_keep_closed_classification_until_parent_execution_retention_expires()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::new(1, 1, 4, 1, Duration::from_secs(2))?).await?;
+    let mut task = f.task(0, 60, None).await?;
+    task.invocation_complete(Ok(()))?;
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&task), b"true")?,
+    )
+    .await?;
+    task.wait(deadline()).await?;
+    assert!(matches!(
+        f.callbacks.register(f.attempt(1, 60, None)?),
+        Err(CallbackError::Capacity)
+    ));
+    let RegistryResult::Execution(next_parent) = f
+        .registry
+        .submit(RegistryCommand::Start(
+            f.parent.arn().machine().clone(),
+            Some("Next".parse()?),
+            Payload::parse(b"{}")?,
+            None,
+        ))?
+        .wait(deadline())
+        .await?
+    else {
+        return Err("next parent".into());
+    };
+    pause();
+    advance(Duration::from_secs(100)).await;
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(token(&task)))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    assert_eq!(inspect(&f.callbacks).await?, (1, 0, 0));
+    f.parent
+        .handle()
+        .request_stop(TaskFailure::new("Stopped", None)?);
+    f.parent.handle().wait(deadline()).await?;
+    for _ in 0..3 {
+        advance(Duration::from_secs(1)).await;
+        if inspect(&f.callbacks).await?.2 == 1 {
+            break;
+        }
+    }
+    assert_eq!(inspect(&f.callbacks).await?, (1, 0, 1));
+    advance(Duration::from_secs(2)).await;
+    assert_eq!(inspect(&f.callbacks).await?, (0, 0, 0));
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(token(&task)))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::InvalidToken
+    ));
+    resume();
+    let mut mint = f.callbacks.register(CallbackAttempt::new(
+        &next_parent,
+        f.calls[0],
+        Instant::now() + Duration::from_secs(60),
+        None,
+    )?)?;
+    mint.admitted(deadline()).await?;
+    let replacement = mint.into_task()?;
+    assert!(matches!(
+        replacement.snapshot().as_ref(),
+        CallbackOutcome::Invoking
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_retain_entropy_join_and_process_live_control_during_shutdown_timeout()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    let hook = EntropyHook::new(false);
+    let _gate = Gate(hook.clone());
+    f.callbacks.shared.entropy_hook.set(hook.clone()).unwrap();
+    let mut mint = f.callbacks.register(f.attempt(1, 60, None)?)?;
+    timeout(Duration::from_secs(5), hook.entered.notified()).await?;
+    task.revoke();
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    assert!(matches!(
+        f.owner
+            .shutdown(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(CallbackError::Deadline)
+    ));
+    assert!(!f.callbacks.status().ready);
+    hook.release();
+    f.owner.shutdown(deadline()).await?;
+    assert!(matches!(
+        underlying(&mint.admitted(deadline()).await.unwrap_err()),
+        CallbackError::Unavailable
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_revoke_lost_mint_observer_before_entropy_finishes_without_issuing_token()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let hook = EntropyHook::new(false);
+    let _gate = Gate(hook.clone());
+    f.callbacks.shared.entropy_hook.set(hook.clone()).unwrap();
+    let mint = f.callbacks.register(f.attempt(0, 60, None)?)?;
+    timeout(Duration::from_secs(5), hook.entered.notified()).await?;
+    drop(mint);
+    hook.release();
+    timeout(Duration::from_secs(5), async {
+        loop {
+            if f.callbacks.shared.live.available_permits() == 4096 {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?;
+    assert_eq!(inspect(&f.callbacks).await?, (0, 0, 0));
+    f.close().await
+}
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_publish_unavailable_and_preserve_fatal_root_or_entropy_source(
+    #[case] entropy: bool,
+) -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    let mut pending = None;
+    let gate = if entropy {
+        let hook = EntropyHook::new(true);
+        f.callbacks.shared.entropy_hook.set(hook.clone()).unwrap();
+        pending = Some(f.callbacks.register(f.attempt(1, 60, None)?)?);
+        timeout(Duration::from_secs(5), hook.entered.notified()).await?;
+        hook.release();
+        Some(Gate(hook))
+    } else {
+        f.callbacks.shared.sender.send(Request::Panic).await?;
+        None
+    };
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Unavailable
+    ));
+    let error = f.owner.shutdown(deadline()).await.unwrap_err();
+    assert!(matches!(underlying(&error),CallbackError::Worker(source) if source.is_panic()));
+    if let Some(mut mint) = pending {
+        assert!(matches!(
+            underlying(&mint.admitted(deadline()).await.unwrap_err()),
+            CallbackError::OwnerLost
+        ));
+    }
+    assert!(!f.callbacks.status().ready);
+    drop(gate);
+    f.registry_owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[test]
+fn test_should_validate_limits_output_failure_heartbeat_and_missing_runtime() {
+    for limits in [
+        (0, 1, 1, 1),
+        (2, 1, 1, 1),
+        (1, 1, 0, 1),
+        (1, 1, 1, 0),
+        (65_537, 100_000, 1, 1),
+        (1, 1_000_001, 1, 1),
+    ] {
+        assert!(
+            CallbackLimits::new(
+                limits.0,
+                limits.1,
+                limits.2,
+                limits.3,
+                Duration::from_secs(1)
+            )
+            .is_err()
+        );
+    }
+    assert!(matches!(
+        CallbackRegistry::new(TenantScope::default(), CallbackLimits::default()),
+        Err(CallbackError::Unavailable)
+    ));
+    let secret = "a".repeat(64);
+    for bytes in [b"invalid".to_vec(), vec![b' '; 262_145]] {
+        assert!(CallbackCommand::success(secret.parse().unwrap(), &bytes).is_err());
+    }
+    assert!(
+        CallbackCommand::failure(secret.parse().unwrap(), Some("x".repeat(257)), None).is_err()
+    );
+    assert!(
+        CallbackCommand::failure(secret.parse().unwrap(), None, Some("x".repeat(32_769))).is_err()
+    );
+}
+
+#[tokio::test]
+async fn test_should_release_terminal_payload_ownership_while_retaining_closed_token_classification()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    let old = token(&task);
+    task.invocation_complete(Ok(()))?;
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&task), b"{\"data\":42}")?,
+    )
+    .await?;
+    let outcome = task.wait(deadline()).await?;
+    let weak = Arc::downgrade(&outcome);
+    drop(outcome);
+    drop(task);
+    assert_eq!(inspect(&f.callbacks).await?.0, 1);
+    assert!(
+        weak.upgrade().is_none(),
+        "tombstone retained completed business output"
+    );
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(old))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    f.close().await
+}
+
+fn manual_task(control: Arc<Control>) -> CallbackTask {
+    let (sender, invocation) = watch::channel(None);
+    let (_view, reader) = watch::channel(Arc::new(CallbackOutcome::Invoking));
+    let deadline = Instant::now() + Duration::from_secs(300);
+    let reporter = CallbackInvocationReporter::new(
+        InvocationIdentity {
+            scope: TenantScope::default(),
+            call: calls().unwrap()[0],
+            deadline,
+            issued: Instant::now(),
+        },
+        control.clone(),
+        sender,
+    );
+    CallbackTask {
+        token: "a".repeat(64).parse().unwrap(),
+        control,
+        reporter: Some(reporter),
+        invocation,
+        view: reader,
+        deadline,
+    }
+}
+
+fn control() -> Arc<Control> {
+    Arc::new(Control {
+        revoked: AtomicBool::new(false),
+        wake: Arc::new(Notify::new()),
+    })
+}
+fn permit() -> tokio::sync::OwnedSemaphorePermit {
+    Arc::new(Semaphore::new(1)).try_acquire_owned().unwrap()
+}
+async fn pending_once<F: Future>(future: std::pin::Pin<&mut F>) {
+    let mut future = future;
+    poll_fn(|cx| {
+        assert!(future.as_mut().poll(cx).is_pending());
+        Poll::Ready(())
+    })
+    .await;
+}
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(2)]
+#[tokio::test]
+async fn test_should_cache_late_ready_mint_success_error_and_owner_loss_before_observer_fence(
+    #[case] kind: u8,
+) -> TestResult {
+    let control = control();
+    let (sender, receiver) = oneshot::channel();
+    let mut mint = CallbackMint::new(receiver, control.clone());
+    pause();
+    let mut observe = Box::pin(mint.admitted(Instant::now() + Duration::from_secs(1)));
+    pending_once(observe.as_mut()).await;
+    match kind {
+        0 => {
+            sender
+                .send(MintReply {
+                    result: Ok(manual_task(control)),
+                    _permit: permit(),
+                })
+                .unwrap();
+        }
+        1 => {
+            sender
+                .send(MintReply {
+                    result: Err(Arc::new(CallbackError::Capacity)),
+                    _permit: permit(),
+                })
+                .unwrap();
+        }
+        _ => drop(sender),
+    }
+    advance(Duration::from_secs(2)).await;
+    assert!(matches!(observe.await, Err(CallbackError::Deadline)));
+    if kind == 0 {
+        mint.admitted(deadline()).await?;
+        let task = mint.into_task()?;
+        assert_eq!(task.token().expose().len(), 64);
+    } else {
+        let error = mint.admitted(deadline()).await.unwrap_err();
+        assert!(matches!(
+            (kind, underlying(&error)),
+            (1, CallbackError::Capacity) | (2, CallbackError::OwnerLost)
+        ));
+    }
+    Ok(())
+}
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_cache_late_ready_api_error_and_owner_loss_without_resending(
+    #[case] lost: bool,
+) -> TestResult {
+    let (sender, receiver) = oneshot::channel();
+    let mut ack = CallbackAck::new(receiver);
+    pause();
+    let mut observe = Box::pin(ack.wait(Instant::now() + Duration::from_secs(1)));
+    pending_once(observe.as_mut()).await;
+    if lost {
+        drop(sender);
+    } else {
+        sender
+            .send(AckReply {
+                result: Err(Arc::new(CallbackError::TaskTimedOut)),
+                _permit: permit(),
+            })
+            .unwrap();
+    }
+    advance(Duration::from_secs(2)).await;
+    assert!(matches!(observe.await, Err(CallbackError::Deadline)));
+    let error = ack.wait(deadline()).await.unwrap_err();
+    assert!(matches!(
+        (lost, underlying(&error)),
+        (true, CallbackError::OwnerLost) | (false, CallbackError::TaskTimedOut)
+    ));
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_validate_captured_parent_scope_heartbeat_and_task_deadline_clamp() -> TestResult
+{
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    for heartbeat in [
+        Duration::ZERO,
+        Duration::from_millis(500),
+        Duration::from_secs(100_000_000),
+    ] {
+        assert!(matches!(
+            CallbackAttempt::new(&f.parent, f.calls[0], deadline(), Some(heartbeat)),
+            Err(CallbackError::Validation)
+        ));
+    }
+    let attempt = f.attempt(0, 1_000_000, None)?;
+    assert_eq!(
+        attempt.deadline,
+        Instant::from_std(f.parent.record.deadline.ok_or("missing live deadline")?)
+    );
+    let (foreign, mut owner) = CallbackRegistry::new(
+        TenantScope::new("aws", "us-west-2", "000000000000")?,
+        CallbackLimits::default(),
+    )?;
+    assert!(matches!(
+        foreign.register(attempt),
+        Err(CallbackError::Validation)
+    ));
+    owner.shutdown(deadline()).await?;
+    let first = f.task(0, 60, None).await?;
+    let second = f.task(1, 60, None).await?;
+    assert_ne!(first.token().digest(), second.token().digest());
+    f.close().await
+}
+
+#[rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_fence_late_ready_task_result_and_owner_loss_without_revoking(
+    #[case] lost: bool,
+) -> TestResult {
+    let control = control();
+    let mut task = manual_task(control.clone());
+    let (sender, reader) = watch::channel(Arc::new(CallbackOutcome::Invoking));
+    task.view = reader;
+    pause();
+    let mut observe = Box::pin(task.wait(Instant::now() + Duration::from_secs(1)));
+    pending_once(observe.as_mut()).await;
+    if lost {
+        drop(sender);
+    } else {
+        sender.send_replace(Arc::new(CallbackOutcome::Succeeded(Payload::parse(
+            b"true",
+        )?)));
+    }
+    advance(Duration::from_secs(2)).await;
+    assert!(matches!(observe.await, Err(CallbackError::Deadline)));
+    assert!(!control.revoked());
+    if lost {
+        assert!(matches!(
+            task.wait(deadline()).await,
+            Err(CallbackError::OwnerLost)
+        ));
+    } else {
+        assert!(matches!(
+            task.wait(deadline()).await?.as_ref(),
+            CallbackOutcome::Succeeded(_)
+        ));
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_preserve_mint_after_observer_expiry_and_bound_live_entropy_jobs() -> TestResult
+{
+    let mut f = Fixture::new(CallbackLimits::new(2, 4, 4, 1, Duration::from_secs(60))?).await?;
+    let hook = EntropyHook::new(false);
+    let _gate = Gate(hook.clone());
+    f.callbacks.shared.entropy_hook.set(hook.clone()).unwrap();
+    let mut mint = f.callbacks.register(f.attempt(0, 60, None)?)?;
+    timeout(Duration::from_secs(5), hook.entered.notified()).await?;
+    assert!(matches!(
+        mint.admitted(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(CallbackError::Deadline)
+    ));
+    let mut excess = f.callbacks.register(f.attempt(1, 60, None)?)?;
+    assert!(matches!(
+        underlying(&excess.admitted(deadline()).await.unwrap_err()),
+        CallbackError::Capacity
+    ));
+    drop(excess);
+    hook.release();
+    mint.admitted(deadline()).await?;
+    let mut task = mint.into_task()?;
+    task.invocation_complete(Ok(()))?;
+    action(&f.callbacks, CallbackCommand::success(token(&task), b"42")?).await?;
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Succeeded(_)
+    ));
+    f.close().await
+}
+
+#[tokio::test]
+async fn test_should_drain_unique_root_after_controller_drop_without_aborting_receipts()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    drop(f.owner);
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Unavailable
+    ));
+    timeout(Duration::from_secs(5), async {
+        while f.callbacks.shared.status.has_changed().is_ok() {
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?;
+    assert!(!f.callbacks.status().ready);
+    f.registry_owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[test]
+fn test_should_preserve_unavailable_receipts_and_typed_root_failure_after_runtime_loss()
+-> TestResult {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()?;
+    let (mut f, mut task) = runtime.block_on(async {
+        let f = Fixture::new(CallbackLimits::default()).await?;
+        let task = f.task(0, 60, None).await?;
+        Ok::<_, Box<dyn Error>>((f, task))
+    })?;
+    drop(runtime);
+    let observer = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()?;
+    observer.block_on(async {
+        assert!(matches!(
+            task.wait(deadline()).await?.as_ref(),
+            CallbackOutcome::Unavailable
+        ));
+        assert!(!f.callbacks.status().ready);
+        let error = f.owner.shutdown(deadline()).await.unwrap_err();
+        assert!(
+            matches!(underlying(&error),CallbackError::Worker(source) if source.is_cancelled())
+        );
+        assert!(f.registry_owner.shutdown(deadline()).await.is_err());
+        Ok::<_, Box<dyn Error>>(())
+    })
+}
+
+#[tokio::test]
+async fn test_should_prepare_real_registered_token_once_with_separate_safe_history() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 60, None).await?;
+    let original = Payload::parse(b"{\"n\":21}")?;
+    let base = EvaluationContext::from_value(&json!({"Execution":{"Name":"Run"}}))?;
+    let flow = DataFlow::compile(
+        &json!({"Parameters":{"FunctionName":"Worker","Payload":{"token.$":"$$.Task.Token","n.$":"$.n"}}}),
+    )?;
+    let parameters = flow.prepare_callback_with_source(
+        &original,
+        &base,
+        task.token(),
+        &mut SystemUuidSource::default(),
+    )?;
+    let exposed: CallbackToken = parameters.outbound().value()["Payload"]["token"]
+        .as_str()
+        .ok_or("outbound token")?
+        .parse()?;
+    assert_eq!(exposed.digest(), task.token().digest());
+    assert!(parameters.history().payload().value()["Payload"]["token"].is_null());
+    assert_eq!(parameters.history().payload().value()["Payload"]["n"], 21);
+    assert!(matches!(
+        task.snapshot().as_ref(),
+        CallbackOutcome::Invoking
+    ));
+    assert!(base.value().get("Task").is_none());
+    task.revoke();
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    f.close().await
+}
+
+mod observed;
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/tests/observed.rs b/crates/rustack-stepfunctions-core/src/registry/callback/tests/observed.rs
new file mode 100644
index 00000000..9cf34f63
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/tests/observed.rs
@@ -0,0 +1,482 @@
+//! Unique reporting, timestamp fences and explicit command composition.
+
+use uuid::Uuid;
+
+use super::*;
+use crate::{LambdaTaskCommand, TaskDispatch};
+
+fn metadata() -> CallbackInvocationMetadata {
+    CallbackInvocationMetadata::new(Uuid::new_v4(), "$LATEST").unwrap()
+}
+#[rstest]
+#[case("$LATEST", true)]
+#[case("1", true)]
+#[case("18446744073709551615", true)]
+#[case("18446744073709551616", false)]
+#[case("01", false)]
+#[case("0", false)]
+#[case("-1", false)]
+#[case("1.0", false)]
+#[case("", false)]
+#[case("alias", false)]
+#[case("１", false)]
+#[case("1\n", false)]
+fn test_should_validate_actual_version_and_exclude_business_payload(
+    #[case] version: &str,
+    #[case] valid: bool,
+) {
+    let id = Uuid::new_v4();
+    let result = CallbackInvocationMetadata::new(id, version);
+    assert_eq!(result.is_ok(), valid);
+    if let Ok(value) = result {
+        assert_eq!(value.request_id(), id);
+        assert_eq!(value.executed_version(), version);
+        let payload = value.payload().unwrap();
+        assert_eq!(
+            payload.value(),
+            &json!({"StatusCode":200,"ExecutedVersion":version,"SdkHttpMetadata":{"HttpStatusCode":200},"SdkResponseMetadata":{"RequestId":id.to_string()}})
+        );
+        assert!(!format!("{value:?}").contains(&id.to_string()));
+    }
+    assert!(CallbackInvocationMetadata::new(Uuid::nil(), version).is_err());
+    let mut bytes = *id.as_bytes();
+    bytes[8] = 0;
+    assert!(CallbackInvocationMetadata::new(Uuid::from_bytes(bytes), version).is_err());
+}
+#[tokio::test]
+async fn test_should_transfer_one_reporter_and_observe_report_after_callback_completion()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, Some(20)).await?;
+    let secret = task.token().expose().to_owned();
+    let mut reporter = task.take_invocation_reporter()?;
+    assert!(matches!(
+        task.take_invocation_reporter(),
+        Err(CallbackError::Progress)
+    ));
+    assert!(matches!(
+        task.invocation_complete(Ok(())),
+        Err(CallbackError::Progress)
+    ));
+    assert_eq!(
+        reporter.bind(&TenantScope::default(), f.calls[0])?,
+        task.deadline
+    );
+    assert!(matches!(
+        reporter.bind(&TenantScope::default(), f.calls[1]),
+        Err(CallbackError::Validation)
+    ));
+    assert!(matches!(
+        reporter.bind(
+            &TenantScope::new("aws", "us-west-2", "000000000000")?,
+            f.calls[0]
+        ),
+        Err(CallbackError::Validation)
+    ));
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&task), b"{\"selected\":42}")?,
+    )
+    .await?;
+    assert!(matches!(
+        task.snapshot().as_ref(),
+        CallbackOutcome::Invoking
+    ));
+    let meta = metadata();
+    let id = meta.request_id();
+    let observed = Instant::now();
+    reporter.complete_at(Ok(meta), observed)?;
+    assert!(matches!(
+        reporter.complete_at(Ok(metadata()), observed),
+        Err(CallbackError::Progress)
+    ));
+    drop(reporter);
+    let outcome = task.wait(deadline()).await?;
+    assert!(
+        matches!(outcome.as_ref(), CallbackOutcome::Succeeded(p) if p.value()==&json!({"selected":42}))
+    );
+    let report = task.wait_invocation(deadline()).await?;
+    assert_eq!(report.metadata().ok_or("metadata")?.request_id(), id);
+    assert_eq!(report.observed(), observed);
+    assert!(Arc::ptr_eq(
+        &report,
+        &task.wait_invocation(deadline()).await?
+    ));
+    assert!(!format!("{report:?}{task:?}").contains(&secret));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_revoke_an_unreported_delegated_owner_but_keep_reported_waiting() -> TestResult
+{
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut first = f.task(0, 300, None).await?;
+    drop(first.take_invocation_reporter()?);
+    assert!(matches!(
+        first.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    let mut second = f.task(1, 300, None).await?;
+    let mut reporter = second.take_invocation_reporter()?;
+    reporter.complete_at(Ok(metadata()), Instant::now())?;
+    drop(reporter);
+    activated(&mut second).await?;
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&second), b"true")?,
+    )
+    .await?;
+    assert!(matches!(
+        second.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Succeeded(_)
+    ));
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_anchor_heartbeat_before_delayed_report_mapping() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, Some(10)).await?;
+    let mut reporter = task.take_invocation_reporter()?;
+    pause();
+    let observed = Instant::now();
+    advance(Duration::from_secs(11)).await;
+    reporter.complete_at(Ok(metadata()), observed)?;
+    let report = task.wait_invocation(deadline()).await?;
+    assert_eq!(report.observed(), observed);
+    let outcome = task.wait(deadline()).await?;
+    assert!(matches!(
+        outcome.as_ref(),
+        CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat)
+    ));
+    resume();
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_reject_invalid_report_times_expired_and_revoked_control() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, None).await?;
+    let mut reporter = task.take_invocation_reporter()?;
+    assert!(matches!(
+        reporter.complete_at(Ok(metadata()), Instant::now() + Duration::from_secs(10)),
+        Err(CallbackError::Validation)
+    ));
+    assert!(matches!(
+        reporter.complete_at(Ok(metadata()), Instant::now() - Duration::from_secs(60)),
+        Err(CallbackError::Validation)
+    ));
+    assert!(task.invocation().is_none());
+    task.revoke();
+    assert!(matches!(
+        reporter.complete_at(Ok(metadata()), Instant::now()),
+        Err(CallbackError::TaskTimedOut)
+    ));
+    let mut task = f.task(1, 30, None).await?;
+    let mut reporter = task.take_invocation_reporter()?;
+    pause();
+    let observed = Instant::now();
+    advance(Duration::from_secs(31)).await;
+    assert!(matches!(
+        reporter.complete_at(Ok(metadata()), observed),
+        Err(CallbackError::TaskTimedOut)
+    ));
+    assert!(task.invocation().is_none());
+    resume();
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_keep_invocation_failure_over_early_success() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, None).await?;
+    let mut reporter = task.take_invocation_reporter()?;
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&task), b"true")?,
+    )
+    .await?;
+    reporter.complete_at(Err(TaskFailure::new("TestError", None)?), Instant::now())?;
+    assert_eq!(
+        task.wait_invocation(deadline())
+            .await?
+            .failure()
+            .ok_or("failure")?
+            .details()
+            .error(),
+        Some("TestError")
+    );
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::InvocationFailed(_)
+    ));
+    f.close().await
+}
+fn command(
+    task: &mut CallbackTask,
+    call: FrameCallId,
+    optimized: bool,
+) -> Result<LambdaTaskCommand, CallbackError> {
+    let resource = if optimized {
+        "arn:aws:states:::lambda:invoke"
+    } else {
+        "arn:aws:lambda:us-east-1:000000000000:function:Worker"
+    };
+    let source =
+        json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":resource,"End":true}}});
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(&serde_json::to_vec(&source).unwrap())
+        .unwrap()
+        .machine()
+        .clone();
+    let dispatch = TaskDispatch {
+        attempt: call.attempt(),
+        state: machine.start(),
+        parameters: Payload::parse(br#"{"FunctionName":"Worker"}"#).unwrap(),
+        deadline: (Instant::now() + Duration::from_secs(600)).into_std(),
+    };
+    LambdaTaskCommand::observed_callback(machine, dispatch, call, task.take_invocation_reporter()?)
+}
+#[tokio::test]
+async fn test_should_keep_observed_mode_after_one_shot_transfer_and_clamp_deadline() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, None).await?;
+    let mut command = command(&mut task, f.calls[0], true)?;
+    assert!(command.is_observed_callback());
+    assert_eq!(command.dispatch().deadline(), task.deadline.into_std());
+    let reporter = command.take_callback_reporter()?.ok_or("reporter")?;
+    assert!(command.is_observed_callback());
+    assert!(matches!(
+        command.take_callback_reporter(),
+        Err(CallbackError::Progress)
+    ));
+    drop(reporter);
+    f.close().await
+}
+#[rstest]
+#[case(false, false)]
+#[case(true, true)]
+#[tokio::test]
+async fn test_should_reject_wrong_command_resource_or_attempt(
+    #[case] optimized: bool,
+    #[case] mismatch: bool,
+) -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, None).await?;
+    assert!(matches!(
+        command(&mut task, f.calls[usize::from(mismatch)], optimized),
+        Err(CallbackError::Validation)
+    ));
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    f.close().await
+}
+
+#[rstest]
+#[case(0, true)]
+#[case(9, true)]
+#[case(10, false)]
+#[case(11, false)]
+#[tokio::test]
+async fn test_should_fence_provisional_callback_by_captured_heartbeat_during_delayed_report(
+    #[case] seconds: u64,
+    #[case] succeeds: bool,
+) -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, Some(10)).await?;
+    let mut reporter = task.take_invocation_reporter()?;
+    pause();
+    let observed = Instant::now();
+    advance(Duration::from_secs(seconds)).await;
+    action(
+        &f.callbacks,
+        CallbackCommand::success(token(&task), b"true")?,
+    )
+    .await?;
+    advance(Duration::from_secs(12 - seconds)).await;
+    reporter.complete_at(Ok(metadata()), observed)?;
+    let outcome = task.wait(deadline()).await?;
+    assert_eq!(
+        matches!(outcome.as_ref(), CallbackOutcome::Succeeded(_)),
+        succeeds
+    );
+    if !succeeds {
+        assert!(matches!(
+            outcome.as_ref(),
+            CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat)
+        ));
+    }
+    resume();
+    f.close().await
+}
+#[tokio::test]
+async fn test_should_keep_preactivation_heartbeat_noop_during_delayed_report() -> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, Some(10)).await?;
+    let mut reporter = task.take_invocation_reporter()?;
+    pause();
+    let observed = Instant::now();
+    advance(Duration::from_secs(9)).await;
+    action(&f.callbacks, CallbackCommand::heartbeat(token(&task))).await?;
+    advance(Duration::from_secs(2)).await;
+    reporter.complete_at(Ok(metadata()), observed)?;
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::TimedOut(CallbackTimeout::Heartbeat)
+    ));
+    resume();
+    f.close().await
+}
+
+#[rstest]
+#[case(0)]
+#[case(1)]
+#[case(2)]
+#[tokio::test]
+async fn test_should_fence_late_ready_invocation_success_failure_and_owner_loss_without_resending(
+    #[case] kind: u8,
+) -> TestResult {
+    let mut task = manual_task(control());
+    let (view, reader) = watch::channel(Arc::new(CallbackOutcome::Invoking));
+    task.view = reader;
+    let mut reporter = Some(task.take_invocation_reporter()?);
+    pause();
+    let observed = Instant::now();
+    let until = observed + Duration::from_secs(1);
+    {
+        let wait = task.wait_invocation(until);
+        tokio::pin!(wait);
+        pending_once(wait.as_mut()).await;
+        if kind == 2 {
+            drop(reporter.take());
+        } else {
+            let result = if kind == 0 {
+                Ok(metadata())
+            } else {
+                Err(TaskFailure::new("RealFailure", None)?)
+            };
+            reporter
+                .as_mut()
+                .ok_or("reporter")?
+                .complete_at(result, observed)?;
+        }
+        advance(Duration::from_secs(1)).await;
+        assert!(matches!(wait.await, Err(CallbackError::Deadline)));
+    }
+    let next = task.wait_invocation(deadline()).await;
+    if kind == 2 {
+        assert!(matches!(next, Err(CallbackError::OwnerLost)));
+    } else {
+        let report = next?;
+        assert_eq!(report.succeeded(), kind == 0);
+        assert_eq!(report.observed(), observed);
+    }
+    drop(view);
+    resume();
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_release_report_payload_when_its_real_observers_and_reporter_leave()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, None).await?;
+    let mut reporter = task.take_invocation_reporter()?;
+    reporter.complete_at(
+        Err(TaskFailure::new("Failure", Some("bounded cause"))?),
+        Instant::now(),
+    )?;
+    let report = task.wait_invocation(deadline()).await?;
+    let weak = Arc::downgrade(&report);
+    task.wait(deadline()).await?;
+    let old = token(&task);
+    drop(report);
+    drop(reporter);
+    drop(task);
+    assert!(weak.upgrade().is_none());
+    assert!(matches!(
+        underlying(
+            &action(&f.callbacks, CallbackCommand::heartbeat(old))
+                .await
+                .unwrap_err()
+        ),
+        CallbackError::TaskTimedOut
+    ));
+    f.close().await
+}
+
+#[tokio::test]
+async fn test_should_reject_dispatch_generation_mismatch_even_with_the_right_reporter_call()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let mut task = f.task(0, 300, None).await?;
+    let machine=AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","End":true}}}"#)?.machine().clone();
+    let dispatch = TaskDispatch {
+        attempt: f.calls[1].attempt(),
+        state: machine.start(),
+        parameters: Payload::parse(b"{}")?,
+        deadline: deadline().into_std(),
+    };
+    assert!(matches!(
+        LambdaTaskCommand::observed_callback(
+            machine,
+            dispatch,
+            f.calls[0],
+            task.take_invocation_reporter()?
+        ),
+        Err(CallbackError::Validation)
+    ));
+    assert!(matches!(
+        task.wait(deadline()).await?.as_ref(),
+        CallbackOutcome::Revoked
+    ));
+    f.close().await
+}
+
+#[tokio::test]
+async fn test_should_register_a_real_deferred_effect_heartbeat_above_one_year_and_clamp_its_timer()
+-> TestResult {
+    let mut f = Fixture::new(CallbackLimits::default()).await?;
+    let machine=AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).with_callback_support(true).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::lambda:invoke.waitForTaskToken","HeartbeatSeconds":99999998,"Parameters":{"FunctionName":"Worker","Payload":{"token.$":"$$.Task.Token"}},"End":true}}}"#)?.machine().clone();
+    let now = ClockSample::new(Instant::now().into_std(), Utc::now());
+    let driver = ExecutionDriver::for_structured_owner(
+        machine,
+        Payload::parse(b"{}")?,
+        EvaluationContext::from_value(&json!({}))?,
+        now,
+        ExecutionLimits::default(),
+    )?;
+    let mut frames = FrameScheduler::new(
+        driver,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )?;
+    let (effect, call) = loop {
+        if let FrameUpdate::Transition(t) = frames.advance(now, &mut SystemUuidSource::default()) {
+            if let DriverStep::Callback(effect) = t.step() {
+                break (effect.clone(), t.call().ok_or("call")?);
+            }
+        }
+    };
+    let heartbeat = effect.heartbeat().ok_or("heartbeat")?;
+    assert!(heartbeat > Duration::from_hours(8760));
+    let mut mint = f.callbacks.register(CallbackAttempt::new(
+        &f.parent,
+        call,
+        Instant::from_std(effect.deadline()),
+        Some(heartbeat),
+    )?)?;
+    mint.admitted(deadline()).await?;
+    let mut task = mint.into_task()?;
+    let (actual, history) =
+        effect.prepare_with_source(task.token(), &mut SystemUuidSource::default())?;
+    assert_eq!(
+        actual.parameters().value()["Payload"]["token"],
+        task.token().expose()
+    );
+    assert!(history.payload().value()["Payload"]["token"].is_null());
+    task.invocation_complete(Ok(()))?;
+    activated(&mut task).await?;
+    assert!(
+        matches!(task.snapshot().as_ref(),CallbackOutcome::Waiting{heartbeat_deadline:Some(until)} if *until==task.deadline)
+    );
+    task.revoke();
+    f.close().await
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/token.rs b/crates/rustack-stepfunctions-core/src/registry/callback/token.rs
new file mode 100644
index 00000000..54493e72
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/token.rs
@@ -0,0 +1,114 @@
+//! Secret-wrapped opaque tokens and hash-only constant-time equality keys.
+
+use std::{
+    fmt,
+    hash::{Hash, Hasher},
+    str::FromStr,
+};
+
+use secrecy::{ExposeSecret, SecretString, zeroize::Zeroizing};
+use sha2::{Digest, Sha256};
+use subtle::ConstantTimeEq;
+
+use super::CallbackError;
+
+/// Local opaque callback credential, deliberately nonserializable and noncloneable.
+#[non_exhaustive]
+pub struct CallbackToken(SecretString);
+impl fmt::Debug for CallbackToken {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackToken(<redacted>)")
+    }
+}
+impl FromStr for CallbackToken {
+    type Err = CallbackError;
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        validate(value)?;
+        Ok(Self(SecretString::from(value)))
+    }
+}
+impl TryFrom<String> for CallbackToken {
+    type Error = CallbackError;
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        validate(&value)?;
+        Ok(Self(SecretString::from(value)))
+    }
+}
+fn validate(value: &str) -> Result<(), CallbackError> {
+    if value.len() > 2048
+        || value.len() != 64
+        || !value
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+    {
+        return Err(CallbackError::InvalidToken);
+    }
+    Ok(())
+}
+impl CallbackToken {
+    /// Expose only when building outbound Task context or a callback request.
+    ///
+    /// ```
+    /// # fn send(token:&rustack_stepfunctions_core::CallbackToken) { let secret=token.expose(); }
+    /// ```
+    #[must_use]
+    pub fn expose(&self) -> &str {
+        self.0.expose_secret()
+    }
+
+    pub(super) fn generate() -> Result<Self, CallbackError> {
+        let mut bytes = Zeroizing::new([0_u8; 32]);
+        getrandom::fill(bytes.as_mut()).map_err(CallbackError::Entropy)?;
+        Ok(Self(SecretString::from(hex::encode(bytes.as_ref()))))
+    }
+    pub(super) fn digest(&self) -> TokenHash {
+        TokenHash(Sha256::digest(self.expose().as_bytes()).into())
+    }
+}
+#[derive(Clone, Copy)]
+pub(super) struct TokenHash([u8; 32]);
+impl Hash for TokenHash {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.0.hash(state);
+    }
+}
+impl PartialEq for TokenHash {
+    fn eq(&self, other: &Self) -> bool {
+        bool::from(self.0.ct_eq(&other.0))
+    }
+}
+impl Eq for TokenHash {}
+impl fmt::Debug for TokenHash {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("TokenHash(<redacted>)")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_should_move_owned_token_storage_into_redacted_secret() {
+        let value = "a".repeat(64);
+        let pointer = value.as_ptr();
+        let token = CallbackToken::try_from(value).unwrap();
+        assert_eq!(token.expose().as_ptr(), pointer);
+        assert_eq!(token.expose(), "a".repeat(64));
+        assert!(!format!("{token:?}").contains(token.expose()));
+    }
+
+    #[rstest::rstest]
+    #[case(String::new())]
+    #[case("a".repeat(63))]
+    #[case("A".repeat(64))]
+    #[case("a".repeat(65))]
+    #[case("f".repeat(2049))]
+    #[test]
+    fn test_should_reject_invalid_owned_credential(#[case] value: String) {
+        assert!(matches!(
+            CallbackToken::try_from(value),
+            Err(CallbackError::InvalidToken)
+        ));
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/callback/types.rs b/crates/rustack-stepfunctions-core/src/registry/callback/types.rs
new file mode 100644
index 00000000..741396c1
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/callback/types.rs
@@ -0,0 +1,321 @@
+//! Validated callback identity, settings, public command and read boundaries.
+
+use std::{fmt, sync::Arc, time::Duration};
+
+use thiserror::Error;
+use tokio::{task::JoinError, time::Instant};
+
+use super::CallbackToken;
+use crate::{
+    AslError, ExecutionSnapshot, FrameCallId, Payload, StopReason, TaskFailure, TenantScope,
+    compiler::TASK_SECONDS_LIMIT, registry::domain,
+};
+
+/// Static, redacted callback lifecycle/admission errors with retained sources.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum CallbackError {
+    /// Unknown, malformed or foreign-scope credential.
+    #[error("invalid callback token")]
+    InvalidToken,
+    /// A known token has expired, been consumed or been revoked.
+    #[error("callback task is closed or timed out")]
+    TaskTimedOut,
+    /// Invalid trusted limits, identity or heartbeat interval.
+    #[error("invalid callback configuration or attempt")]
+    Validation,
+    /// This captured execution/frame/generation already minted a token.
+    #[error("callback attempt already registered")]
+    AttemptExists,
+    /// No bounded ownership/queue reservation is available.
+    #[error("callback capacity exhausted")]
+    Capacity,
+    /// No accepting root owner is available.
+    #[error("callback owner unavailable")]
+    Unavailable,
+    /// An observer expired; accepted work remains owned.
+    #[error("callback observation deadline exceeded")]
+    Deadline,
+    /// A reply owner disappeared without proving its result.
+    #[error("callback reply owner lost")]
+    OwnerLost,
+    /// Unique Task owner attempted to report invocation completion twice.
+    #[error("invalid callback invocation progress")]
+    Progress,
+    /// Invalid/oversized output JSON or bounded callback data.
+    #[error("invalid callback output or failure data")]
+    Data(
+        #[from]
+        #[source]
+        AslError,
+    ),
+    /// Operating system entropy failed; no token was published.
+    #[error("callback entropy failed")]
+    Entropy(#[source] getrandom::Error),
+    /// A retained worker panicked or was unexpectedly cancelled.
+    #[error("callback worker failed")]
+    Worker(#[source] JoinError),
+    /// Retained cached admission or shutdown failure.
+    #[error("callback owner operation failed")]
+    Cached(#[source] Arc<CallbackError>),
+}
+impl fmt::Debug for CallbackError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+/// Validated actor capacities and execution-relative classification retention.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct CallbackLimits {
+    pub(super) live: usize,
+    pub(super) retained: usize,
+    pub(super) commands: usize,
+    pub(super) workers: usize,
+    pub(super) retention: Duration,
+}
+impl CallbackLimits {
+    /// Validate live1..65,536, retained live..1,000,000, commands1..100,000,
+    /// workers1..128 and retention1s..90d.
+    ///
+    /// # Errors
+    /// Rejects zero, excessive or inconsistent limits.
+    ///
+    /// ```
+    /// let limits=rustack_stepfunctions_core::CallbackLimits::new(4096,100000,1024,8,std::time::Duration::from_secs(86400))?;
+    /// # Ok::<(),rustack_stepfunctions_core::CallbackError>(())
+    /// ```
+    pub fn new(
+        live: usize,
+        retained: usize,
+        commands: usize,
+        workers: usize,
+        retention: Duration,
+    ) -> Result<Self, CallbackError> {
+        if !(1..=65_536).contains(&live)
+            || !(live..=1_000_000).contains(&retained)
+            || !(1..=100_000).contains(&commands)
+            || !(1..=128).contains(&workers)
+            || !(Duration::from_secs(1)..=Duration::from_hours(2160)).contains(&retention)
+        {
+            return Err(CallbackError::Validation);
+        }
+        Ok(Self {
+            live,
+            retained,
+            commands,
+            workers,
+            retention,
+        })
+    }
+}
+impl Default for CallbackLimits {
+    fn default() -> Self {
+        Self {
+            live: 4096,
+            retained: 100_000,
+            commands: 1024,
+            workers: 8,
+            retention: Duration::from_hours(24),
+        }
+    }
+}
+/// Captured trusted parent/frame/generation and absolute Task timing.
+#[non_exhaustive]
+pub struct CallbackAttempt {
+    pub(super) parent: ExecutionSnapshot,
+    pub(super) call: FrameCallId,
+    pub(super) deadline: Instant,
+    pub(super) heartbeat: Option<Duration>,
+}
+impl fmt::Debug for CallbackAttempt {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackAttempt(<redacted>)")
+    }
+}
+impl CallbackAttempt {
+    /// Capture an exact registered execution and opaque current frame attempt.
+    ///
+    /// The consuming execution owner must supply its own current call identity.
+    ///
+    /// # Errors
+    /// Rejects closed parents, expired deadlines and nonpositive/nonintegral
+    /// heartbeat seconds or intervals exceeding99,999,999 seconds.
+    ///
+    /// ```no_run
+    /// # fn register(parent:&rustack_stepfunctions_core::ExecutionSnapshot,call:rustack_stepfunctions_core::FrameCallId,deadline:tokio::time::Instant){
+    /// let attempt=rustack_stepfunctions_core::CallbackAttempt::new(parent,call,deadline,None);
+    /// # }
+    /// ```
+    pub fn new(
+        parent: &ExecutionSnapshot,
+        call: FrameCallId,
+        deadline: Instant,
+        heartbeat: Option<Duration>,
+    ) -> Result<Self, CallbackError> {
+        if heartbeat.is_some_and(|value| {
+            value.subsec_nanos() != 0
+                || !(1..=u64::from(TASK_SECONDS_LIMIT)).contains(&value.as_secs())
+        }) {
+            return Err(CallbackError::Validation);
+        }
+        let result = Self {
+            parent: parent.clone(),
+            call,
+            deadline: deadline.min(Instant::from_std(
+                parent.record.deadline.ok_or(CallbackError::TaskTimedOut)?,
+            )),
+            heartbeat,
+        };
+        result.live(Instant::now())?;
+        Ok(result)
+    }
+    pub(super) fn live(&self, now: Instant) -> Result<(), CallbackError> {
+        if now >= self.deadline || self.parent.handle().snapshot().outcome().is_some() {
+            Err(CallbackError::TaskTimedOut)
+        } else {
+            Ok(())
+        }
+    }
+    pub(super) fn scoped(&self, scope: &TenantScope) -> bool {
+        domain::same_scope(self.parent.revision().machine().scope(), scope)
+    }
+}
+/// Distinct expiry reasons for ASL Task and heartbeat error mapping.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum CallbackTimeout {
+    /// Absolute Task deadline, including synchronous invocation.
+    Task,
+    /// Heartbeat window after successful invocation.
+    Heartbeat,
+}
+/// Coherent callback business boundary; observing it never confirms Lambda cleanup.
+#[derive(Clone)]
+#[non_exhaustive]
+pub enum CallbackOutcome {
+    /// The synchronous invocation has not completed successfully yet.
+    Invoking,
+    /// Awaiting a callback; no heartbeat timer is represented by None.
+    Waiting {
+        /// Current bounded heartbeat deadline.
+        heartbeat_deadline: Option<Instant>,
+    },
+    /// Exactly one external success committed after successful invocation.
+    Succeeded(Payload),
+    /// External failure committed after successful invocation.
+    Failed(TaskFailure),
+    /// Synchronous invocation failed; any provisional callback was discarded.
+    InvocationFailed(TaskFailure),
+    /// Absolute/heartbeat deadline expired.
+    TimedOut(CallbackTimeout),
+    /// Unique Task owner or parent revoked the attempt.
+    Revoked,
+    /// Registry root disappeared or closed before successful completion.
+    Unavailable,
+}
+impl fmt::Debug for CallbackOutcome {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::Invoking => "CallbackOutcome::Invoking",
+            Self::Waiting { .. } => "CallbackOutcome::Waiting",
+            Self::Succeeded(_) => "CallbackOutcome::Succeeded(<redacted>)",
+            Self::Failed(_) => "CallbackOutcome::Failed(<redacted>)",
+            Self::InvocationFailed(_) => "CallbackOutcome::InvocationFailed(<redacted>)",
+            Self::TimedOut(_) => "CallbackOutcome::TimedOut",
+            Self::Revoked => "CallbackOutcome::Revoked",
+            Self::Unavailable => "CallbackOutcome::Unavailable",
+        })
+    }
+}
+impl CallbackOutcome {
+    /// Whether this immutable observation has a terminal business decision.
+    ///
+    /// ```
+    /// assert!(rustack_stepfunctions_core::CallbackOutcome::Revoked.is_terminal());
+    /// ```
+    #[must_use]
+    pub fn is_terminal(&self) -> bool {
+        !matches!(self, Self::Invoking | Self::Waiting { .. })
+    }
+}
+#[derive(Debug)]
+pub(super) enum Action {
+    Complete(Result<Payload, TaskFailure>),
+    Heartbeat,
+}
+/// Fully prepared callback mutation, with nonserializable credential ownership.
+#[non_exhaustive]
+pub struct CallbackCommand {
+    pub(super) token: CallbackToken,
+    pub(super) action: Action,
+}
+impl fmt::Debug for CallbackCommand {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("CallbackCommand(<redacted>)")
+    }
+}
+impl CallbackCommand {
+    /// Parse JSON output without double encoding; use bounded CPU admission.
+    ///
+    /// # Errors
+    /// Rejects invalid JSON or payload limits.
+    ///
+    /// ```
+    /// # fn prepare(token:rustack_stepfunctions_core::CallbackToken)->Result<(),rustack_stepfunctions_core::CallbackError>{
+    /// let command=rustack_stepfunctions_core::CallbackCommand::success(token,b"{\"answer\":42}")?;
+    /// # Ok(()) }
+    /// ```
+    pub fn success(token: CallbackToken, output: &[u8]) -> Result<Self, CallbackError> {
+        Ok(Self {
+            token,
+            action: Action::Complete(Ok(Payload::parse(output)?)),
+        })
+    }
+    /// Preserve omitted/empty failure fields after validating byte ceilings.
+    ///
+    /// # Errors
+    /// Rejects error above256 bytes or cause above32,768 bytes.
+    ///
+    /// ```
+    /// # fn prepare(token:rustack_stepfunctions_core::CallbackToken)->Result<(),rustack_stepfunctions_core::CallbackError>{
+    /// let command=rustack_stepfunctions_core::CallbackCommand::failure(token,None,Some(String::new()))?;
+    /// # Ok(()) }
+    /// ```
+    pub fn failure(
+        token: CallbackToken,
+        error: Option<String>,
+        cause: Option<String>,
+    ) -> Result<Self, CallbackError> {
+        let failure = StopReason::new(error, cause)
+            .map_err(|_| CallbackError::Validation)?
+            .0;
+        Ok(Self {
+            token,
+            action: Action::Complete(Err(failure)),
+        })
+    }
+    /// Prepare a heartbeat; the registry enforces timing/closed classification.
+    ///
+    /// ```
+    /// # fn prepare(token:rustack_stepfunctions_core::CallbackToken){let command=rustack_stepfunctions_core::CallbackCommand::heartbeat(token);}
+    /// ```
+    #[must_use]
+    pub fn heartbeat(token: CallbackToken) -> Self {
+        Self {
+            token,
+            action: Action::Heartbeat,
+        }
+    }
+}
+/// Public actor health/counts; no credential, payload or execution identity.
+#[derive(Debug, Clone, Copy, Default)]
+#[non_exhaustive]
+pub struct CallbackStatus {
+    /// Root accepts commands and has no known fatal failure.
+    pub ready: bool,
+    /// Issued, unsettled callback attempts.
+    pub live: usize,
+    /// Active plus closed classification reservations in the table.
+    pub retained: usize,
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/child/envelope.rs b/crates/rustack-stepfunctions-core/src/registry/child/envelope.rs
new file mode 100644
index 00000000..b616438b
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/child/envelope.rs
@@ -0,0 +1,101 @@
+//! Bounded optimized envelopes, distinct from HTTP epoch-seconds DTOs.
+
+use serde_json::{Value, json};
+
+use super::{ChildError, ChildExecution, ChildPattern};
+use crate::{ExecutionOutcome, ExecutionSnapshot, Payload, TaskFailure};
+
+impl ChildExecution {
+    /// Map the observed child to a bounded optimized Task result without IO.
+    ///
+    /// Embedding async owners run this potentially payload-bearing work under
+    /// retained CPU admission. This does not confirm physical cleanup.
+    ///
+    /// # Errors
+    /// Returns Pending, quota/JSON failure, or an unsuccessful child Task result.
+    ///
+    /// ```no_run
+    /// # fn result(c:&rustack_stepfunctions_core::ChildExecution){let result=c.result();}
+    /// ```
+    pub fn result(&self) -> Result<Result<Payload, TaskFailure>, ChildError> {
+        map(&self.snapshot, self.pattern)
+    }
+    pub(crate) fn mapper(
+        &self,
+        start: bool,
+    ) -> impl FnOnce() -> Result<Result<Payload, TaskFailure>, ChildError> + Send + 'static {
+        let snapshot = self.snapshot.clone();
+        let pattern = if start {
+            ChildPattern::RequestResponse
+        } else {
+            self.pattern
+        };
+        move || map(&snapshot, pattern)
+    }
+}
+fn map(
+    snapshot: &ExecutionSnapshot,
+    pattern: ChildPattern,
+) -> Result<Result<Payload, TaskFailure>, ChildError> {
+    let strings = match pattern {
+        ChildPattern::RequestResponse => {
+            return Ok(Ok(Payload::from_value(&json!({
+                "ExecutionArn":snapshot.arn().as_str(),
+                "StartDate":snapshot.start_date().timestamp_millis(),
+            }))?));
+        }
+        ChildPattern::Sync => true,
+        ChildPattern::Sync2 => false,
+    };
+    let outcome = snapshot.view().outcome().ok_or(ChildError::Pending)?;
+    let output = match outcome.as_ref() {
+        ExecutionOutcome::Succeeded(output) => output,
+        other => return Ok(Err(failed(snapshot.arn().as_str(), other)?)),
+    };
+    let (input, output) = if strings {
+        (
+            Value::String(text(snapshot.input())?),
+            Value::String(text(output)?),
+        )
+    } else {
+        (snapshot.input().value().clone(), output.value().clone())
+    };
+    let stopped = snapshot.view().stop_date().ok_or(ChildError::Invalid)?;
+    Ok(Ok(Payload::from_value(&json!({
+        "ExecutionArn":snapshot.arn().as_str(),
+        "StateMachineArn":snapshot.arn().machine().as_str(),
+        "Name":snapshot.arn().name().as_str(),
+        "Status":"SUCCEEDED", "Input":input, "Output":output,
+        "InputDetails":{"Included":true}, "OutputDetails":{"Included":true},
+        "StartDate":snapshot.start_date().timestamp_millis(),
+        "StopDate":stopped.timestamp_millis(),
+    }))?))
+}
+fn text(payload: &Payload) -> Result<String, ChildError> {
+    String::from_utf8(payload.original_bytes().to_vec()).map_err(|_| ChildError::Invalid)
+}
+fn failed(arn: &str, outcome: &ExecutionOutcome) -> Result<TaskFailure, ChildError> {
+    let (status, error, cause) = match outcome {
+        ExecutionOutcome::Failed(failure) => ("FAILED", failure.error(), failure.cause()),
+        ExecutionOutcome::TimedOut => ("TIMED_OUT", None, None),
+        ExecutionOutcome::Aborted(failure) => (
+            "ABORTED",
+            failure.details().error(),
+            failure.details().cause(),
+        ),
+        ExecutionOutcome::Succeeded(_) => return Err(ChildError::Invalid),
+    };
+    let truncated = cause.is_some_and(|cause| cause.len() > 4096);
+    let cause = cause
+        .map(|cause| {
+            let mut end = cause.len().min(4096);
+            while !cause.is_char_boundary(end) {
+                end = end.saturating_sub(1);
+            }
+            cause.get(..end).ok_or(ChildError::Invalid)
+        })
+        .transpose()?;
+    let details =
+        json!({"ExecutionArn":arn,"Status":status,"Error":error,"Cause":cause,"CauseTruncated":truncated}).to_string();
+    Ok(TaskFailure::new("States.TaskFailed", Some(&details))?)
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/child/mod.rs b/crates/rustack-stepfunctions-core/src/registry/child/mod.rs
new file mode 100644
index 00000000..386a5881
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/child/mod.rs
@@ -0,0 +1,477 @@
+//! Bounded atomic child admission; weak registry linkage and retained cleanup.
+
+use std::{
+    fmt,
+    sync::{
+        Arc, Weak,
+        atomic::{AtomicBool, Ordering},
+    },
+};
+
+use rustack_core::json::JsonError;
+use thiserror::Error;
+use tokio::{
+    sync::{Notify, OwnedSemaphorePermit, mpsc, oneshot},
+    time::{Instant, timeout_at},
+};
+
+use super::{
+    ExecutionArn, ExecutionName, ExecutionSnapshot, Registry, RegistryError, Shared,
+    StateMachineArn, types::ExecutionRecord,
+};
+pub use crate::compiler::ChildPattern;
+use crate::{AslError, ExecutionError, ExecutionFailure, ExecutionView, Payload, TaskFailure};
+
+mod envelope;
+pub(super) mod owner;
+mod parameters;
+
+/// Typed child admission/observation failures; public text is static and redacted.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum ChildError {
+    /// Malformed evaluated parameters or an invalid captured state.
+    #[error("invalid child execution parameters")]
+    Invalid,
+    /// Parent capability is foreign or no longer RUNNING.
+    #[error("child execution parent unavailable")]
+    Parent,
+    /// The bounded depth or independent child-call pool is exhausted.
+    #[error("child execution capacity exhausted")]
+    Capacity,
+    /// An owned dependency would join itself or form a graph cycle.
+    #[error("cyclic child execution dependency")]
+    Cycle,
+    /// The caller cancelled before issuance.
+    #[error("child execution admission cancelled")]
+    Cancelled,
+    /// Observer expiry never cancels accepted work.
+    #[error("child execution observation expired")]
+    Deadline,
+    /// Closed admission rejected the request before issuance.
+    #[error("child execution admission unavailable")]
+    Unavailable,
+    /// Lost reply ownership cannot prove whether a child was issued.
+    #[error("child execution reply owner lost")]
+    OwnerLost,
+    /// A job result requires observed child termination.
+    #[error("child execution is not terminal")]
+    Pending,
+    /// Registry rejection with a retained typed source.
+    #[error("child execution registration failed")]
+    Registry(
+        #[from]
+        #[source]
+        RegistryError,
+    ),
+    /// Cached admission failure, retained across late/expired observations.
+    #[error("child execution admission failed")]
+    Admission(#[source] Arc<ChildError>),
+    /// Invalid JSON, serialization or bounded data failure.
+    #[error("child execution data failed")]
+    Data(
+        #[from]
+        #[source]
+        AslError,
+    ),
+    /// Execution observation/cleanup source.
+    #[error("child execution observation failed")]
+    Execution(
+        #[from]
+        #[source]
+        ExecutionError,
+    ),
+}
+impl fmt::Debug for ChildError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl ChildError {
+    /// Map admission/data failure to its bounded optimized Task error.
+    ///
+    /// ```
+    /// assert_eq!(rustack_stepfunctions_core::ChildError::Capacity.failure().details().error(),Some("StepFunctions.ExecutionLimitExceeded"));
+    /// ```
+    #[must_use]
+    pub fn failure(&self) -> TaskFailure {
+        let name = match self {
+            Self::Admission(source) => return source.failure(),
+            Self::Data(
+                AslError::DataLimit
+                | AslError::Json(JsonError::Bytes | JsonError::String | JsonError::Key),
+            ) => "States.DataLimitExceeded",
+            Self::Invalid
+            | Self::Cycle
+            | Self::Registry(RegistryError::Validation)
+            | Self::Data(_) => "States.Runtime",
+            Self::Capacity
+            | Self::Registry(
+                RegistryError::Capacity | RegistryError::Execution(ExecutionError::Capacity),
+            ) => "StepFunctions.ExecutionLimitExceeded",
+            Self::Registry(RegistryError::MachineMissing) => {
+                "StepFunctions.StateMachineDoesNotExist"
+            }
+            Self::Registry(RegistryError::ExecutionExists) => {
+                "StepFunctions.ExecutionAlreadyExists"
+            }
+            Self::Registry(RegistryError::Deleting) => "StepFunctions.StateMachineDeleting",
+            _ => "StepFunctions.ServiceException",
+        };
+        TaskFailure(ExecutionFailure::named(
+            name,
+            "Child execution request failed",
+        ))
+    }
+}
+/// Fully validated optimized parameters; fields cannot be constructed unchecked.
+#[non_exhaustive]
+pub struct ChildStartParameters {
+    pub(super) machine: StateMachineArn,
+    pub(super) name: Option<ExecutionName>,
+    pub(super) input: Payload,
+}
+impl fmt::Debug for ChildStartParameters {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ChildStartParameters(<redacted>)")
+    }
+}
+/// Opaque exact parent-record capability; cloning retains its registry charge.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ChildParent {
+    pub(super) record: Arc<ExecutionRecord>,
+}
+impl fmt::Debug for ChildParent {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ChildParent(<redacted>)")
+    }
+}
+impl ExecutionSnapshot {
+    /// Capture an opaque capability; admission rechecks identity and liveness.
+    ///
+    /// ```
+    /// # fn inspect(s:&rustack_stepfunctions_core::ExecutionSnapshot){let parent=s.child_parent();}
+    /// ```
+    #[must_use]
+    pub fn child_parent(&self) -> ChildParent {
+        ChildParent {
+            record: self.record.clone(),
+        }
+    }
+    /// Read nesting depth, with external Start executions at zero.
+    ///
+    /// ```
+    /// # fn inspect(s:&rustack_stepfunctions_core::ExecutionSnapshot){let depth=s.nesting_depth();}
+    /// ```
+    #[must_use]
+    pub fn nesting_depth(&self) -> usize {
+        self.record.lineage.0.len()
+    }
+    /// Read the original creating parent, independent of later idempotent joins.
+    ///
+    /// ```
+    /// # fn inspect(s:&rustack_stepfunctions_core::ExecutionSnapshot){let parent=s.parent_execution_arn();}
+    /// ```
+    #[must_use]
+    pub fn parent_execution_arn(&self) -> Option<&ExecutionArn> {
+        self.record.lineage.0.last()
+    }
+}
+#[derive(Debug, Default)]
+pub(super) struct Lineage(pub(super) Vec<ExecutionArn>);
+impl Lineage {
+    pub(super) fn descendant(parent: &ExecutionRecord) -> Result<Self, ChildError> {
+        if parent.lineage.0.len() >= 16 {
+            return Err(ChildError::Capacity);
+        }
+        let mut lineage = parent.lineage.0.clone();
+        lineage.push(parent.identity.arn.clone());
+        Ok(Self(lineage))
+    }
+}
+#[derive(Debug)]
+pub(super) struct Control {
+    cancelled: AtomicBool,
+    wake: Arc<Notify>,
+}
+impl Control {
+    pub(super) fn cancel(&self) {
+        if !self.cancelled.swap(true, Ordering::AcqRel) {
+            self.wake.notify_one();
+        }
+    }
+    pub(super) fn cancelled(&self) -> bool {
+        self.cancelled.load(Ordering::Acquire)
+    }
+}
+#[derive(Debug)]
+pub(super) struct Context {
+    pub(super) parent: ChildParent,
+    pub(super) parameters: ChildStartParameters,
+    pub(super) pattern: ChildPattern,
+    pub(super) deadline: Instant,
+}
+#[derive(Debug)]
+pub(super) struct Request {
+    pub(super) context: Context,
+    pub(super) control: Arc<Control>,
+    pub(super) reply: oneshot::Sender<Result<ChildExecution, ChildError>>,
+    pub(super) permit: OwnedSemaphorePermit,
+}
+/// Weak registry admission handle; no service calls or HTTP loopback.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ChildExecutionPort {
+    registry: Weak<Shared>,
+}
+impl fmt::Debug for ChildExecutionPort {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ChildExecutionPort(<redacted>)")
+    }
+}
+impl Registry {
+    /// Read the concrete weak child port without retaining a registry cycle.
+    ///
+    /// ```
+    /// # fn inspect(r:&rustack_stepfunctions_core::Registry){let port=r.child_port();}
+    /// ```
+    #[must_use]
+    pub fn child_port(&self) -> ChildExecutionPort {
+        port(&self.shared)
+    }
+}
+pub(super) fn port(shared: &Arc<Shared>) -> ChildExecutionPort {
+    ChildExecutionPort {
+        registry: Arc::downgrade(shared),
+    }
+}
+impl ChildExecutionPort {
+    /// Synchronously transfer one owned start before waiting for admission.
+    ///
+    /// # Errors
+    /// Rejects closed ownership, deadline, scope or independent call saturation.
+    ///
+    /// ```no_run
+    /// # fn start(p:&rustack_stepfunctions_core::ChildExecutionPort,parent:rustack_stepfunctions_core::ChildParent,args:rustack_stepfunctions_core::ChildStartParameters) {
+    /// let receipt=p.start(parent,args,rustack_stepfunctions_core::ChildPattern::Sync2,tokio::time::Instant::now()+std::time::Duration::from_secs(30));
+    /// # }
+    /// ```
+    pub fn start(
+        &self,
+        parent: ChildParent,
+        parameters: ChildStartParameters,
+        pattern: ChildPattern,
+        deadline: Instant,
+    ) -> Result<ChildSubmission, ChildError> {
+        let shared = self.registry.upgrade().ok_or(ChildError::Unavailable)?;
+        if *shared.closing.borrow() {
+            return Err(ChildError::Unavailable);
+        }
+        parameters.machine.check(&shared.scope)?;
+        let deadline = deadline.min(Instant::from_std(
+            parent.record.deadline.ok_or(ChildError::Invalid)?,
+        ));
+        if Instant::now() >= deadline {
+            return Err(ChildError::Deadline);
+        }
+        let permit = shared
+            .child_capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| ChildError::Capacity)?;
+        let control = Arc::new(Control {
+            cancelled: AtomicBool::new(false),
+            wake: shared.child_wake.clone(),
+        });
+        let (reply, receiver) = oneshot::channel();
+        let request = Request {
+            context: Context {
+                parent,
+                parameters,
+                pattern,
+                deadline,
+            },
+            control: control.clone(),
+            reply,
+            permit,
+        };
+        shared
+            .child_sender
+            .try_send(request)
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => ChildError::Capacity,
+                mpsc::error::TrySendError::Closed(_) => ChildError::Unavailable,
+            })?;
+        Ok(ChildSubmission {
+            receiver: Some(receiver),
+            accepted: None,
+            control,
+            armed: true,
+        })
+    }
+}
+/// Retained start receipt; Drop requests owned cancellation even before acceptance.
+#[non_exhaustive]
+pub struct ChildSubmission {
+    receiver: Option<oneshot::Receiver<Result<ChildExecution, ChildError>>>,
+    accepted: Option<Result<ChildExecution, Arc<ChildError>>>,
+    control: Arc<Control>,
+    armed: bool,
+}
+impl fmt::Debug for ChildSubmission {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ChildSubmission(<redacted>)")
+    }
+}
+impl ChildSubmission {
+    /// Observe the same acceptance once; timeout/cancel retains its receiver.
+    ///
+    /// # Errors
+    /// Returns a typed admission failure, deadline or closed receipt.
+    ///
+    /// ```no_run
+    /// # async fn observe(s:&mut rustack_stepfunctions_core::ChildSubmission,d:tokio::time::Instant){let result=s.admitted(d).await;}
+    /// ```
+    pub async fn admitted(&mut self, deadline: Instant) -> Result<&ChildExecution, ChildError> {
+        if Instant::now() >= deadline {
+            return Err(ChildError::Deadline);
+        }
+        let _observation = timeout_at(deadline, self.resolve())
+            .await
+            .map_err(|_| ChildError::Deadline)?;
+        if Instant::now() >= deadline {
+            return Err(ChildError::Deadline);
+        }
+        match self.accepted.as_ref() {
+            Some(Ok(child)) => Ok(child),
+            Some(Err(source)) => Err(ChildError::Admission(source.clone())),
+            None => Err(ChildError::Unavailable),
+        }
+    }
+
+    pub(crate) async fn resolve(&mut self) -> Result<(), ChildError> {
+        if self.accepted.is_none() {
+            let receiver = self.receiver.as_mut().ok_or(ChildError::Unavailable)?;
+            let response = receiver.await;
+            self.receiver = None;
+            self.accepted = Some(
+                response
+                    .map_err(|_| ChildError::OwnerLost)
+                    .and_then(|result| result)
+                    .map_err(Arc::new),
+            );
+        }
+        match self.accepted.as_ref() {
+            Some(Ok(_)) => Ok(()),
+            Some(Err(source)) => Err(ChildError::Admission(source.clone())),
+            None => Err(ChildError::Unavailable),
+        }
+    }
+
+    /// Transfer the accepted unique cancellation owner without signalling Drop.
+    ///
+    /// # Errors
+    /// Requires a cached acceptance, including one retained after a late observer
+    /// expired; returns a cached rejection or Unavailable otherwise.
+    ///
+    /// ```no_run
+    /// # fn take(s:rustack_stepfunctions_core::ChildSubmission){let child=s.into_execution();}
+    /// ```
+    pub fn into_execution(mut self) -> Result<ChildExecution, ChildError> {
+        let child = self
+            .accepted
+            .take()
+            .ok_or(ChildError::Unavailable)?
+            .map_err(ChildError::Admission)?;
+        self.armed = false;
+        Ok(child)
+    }
+    /// Request cancellation; accepted detached starts remain independent.
+    ///
+    /// ```
+    /// # fn cancel(s:&rustack_stepfunctions_core::ChildSubmission){s.cancel();}
+    /// ```
+    pub fn cancel(&self) {
+        self.control.cancel();
+    }
+}
+impl Drop for ChildSubmission {
+    fn drop(&mut self) {
+        if self.armed {
+            self.control.cancel();
+        }
+    }
+}
+/// Unique owned-child cancellation capability and independent read observations.
+#[non_exhaustive]
+pub struct ChildExecution {
+    pub(super) snapshot: ExecutionSnapshot,
+    pub(super) control: Arc<Control>,
+    pub(super) pattern: ChildPattern,
+}
+impl fmt::Debug for ChildExecution {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ChildExecution(<redacted>)")
+    }
+}
+impl ChildExecution {
+    /// Read the latest captured child business/cleanup observation.
+    ///
+    /// ```
+    /// # fn inspect(c:&rustack_stepfunctions_core::ChildExecution){let snapshot=c.snapshot();}
+    /// ```
+    #[must_use]
+    pub fn snapshot(&self) -> &ExecutionSnapshot {
+        &self.snapshot
+    }
+    /// Observe termination, preserving ownership when this observer expires.
+    ///
+    /// # Errors
+    /// Returns the observer deadline or retained execution error.
+    ///
+    /// ```no_run
+    /// # async fn observe(c:&mut rustack_stepfunctions_core::ChildExecution,d:tokio::time::Instant){let result=c.wait(d).await;}
+    /// ```
+    pub async fn wait(&mut self, deadline: Instant) -> Result<Arc<ExecutionView>, ChildError> {
+        self.snapshot = self.snapshot.wait(deadline).await?;
+        Ok(self.snapshot.view.clone())
+    }
+    /// Observe physical cleanup independently of the terminal business result.
+    ///
+    /// # Errors
+    /// Deadline/uncertainty keeps the same owned child and receipt live.
+    ///
+    /// ```no_run
+    /// # async fn observe(c:&mut rustack_stepfunctions_core::ChildExecution,d:tokio::time::Instant){let result=c.wait_cleanup(d).await;}
+    /// ```
+    pub async fn wait_cleanup(
+        &mut self,
+        deadline: Instant,
+    ) -> Result<Arc<ExecutionView>, ChildError> {
+        let mut handle = self.snapshot.handle();
+        let view = handle.wait_cleanup(deadline).await?;
+        self.snapshot.view = view.clone();
+        Ok(view)
+    }
+    pub(crate) async fn settled(&mut self) -> Result<(), ChildError> {
+        let view = self.snapshot.handle().settled().await?;
+        self.snapshot.view = view;
+        Ok(())
+    }
+    /// Request cancellation of an owned relationship, never a detached child.
+    ///
+    /// ```
+    /// # fn cancel(c:&rustack_stepfunctions_core::ChildExecution){c.cancel();}
+    /// ```
+    pub fn cancel(&self) {
+        if self.pattern.owned() {
+            self.control.cancel();
+        }
+    }
+}
+impl Drop for ChildExecution {
+    fn drop(&mut self) {
+        self.cancel();
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/child/owner.rs b/crates/rustack-stepfunctions-core/src/registry/child/owner.rs
new file mode 100644
index 00000000..482e6bde
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/child/owner.rs
@@ -0,0 +1,167 @@
+//! Registry-retained child relations and bounded cancellation graph traversal.
+
+use std::{
+    collections::{BTreeMap, BTreeSet, VecDeque},
+    sync::Arc,
+};
+
+use tokio::{
+    sync::{OwnedSemaphorePermit, mpsc},
+    time::Instant,
+};
+
+use super::{
+    super::{Shared, types::ExecutionRecord},
+    ChildError, ChildPattern, Control, Request,
+};
+use crate::{CleanupState, ExecutionFailure, ExecutionSnapshot, TaskFailure};
+
+#[derive(Debug)]
+pub(in crate::registry) struct Inbox {
+    pub(in crate::registry) requests: mpsc::Receiver<Request>,
+    pub(in crate::registry) registry: Arc<Shared>,
+}
+#[derive(Debug)]
+pub(in crate::registry) struct Entry {
+    pub(in crate::registry) parent: Arc<ExecutionRecord>,
+    pub(in crate::registry) child: ExecutionSnapshot,
+    pub(in crate::registry) control: Arc<Control>,
+    pub(in crate::registry) deadline: Instant,
+    pub(in crate::registry) _permit: OwnedSemaphorePermit,
+}
+#[derive(Debug)]
+pub(in crate::registry) struct Owner {
+    pub(in crate::registry) pending: Option<Request>,
+    pub(in crate::registry) entries: BTreeMap<u64, Entry>,
+    pub(in crate::registry) next: u64,
+    pub(in crate::registry) registry: Arc<Shared>,
+}
+impl Owner {
+    pub(in crate::registry) fn new(registry: Arc<Shared>) -> Self {
+        Self {
+            pending: None,
+            entries: BTreeMap::new(),
+            next: 0,
+            registry,
+        }
+    }
+    pub(in crate::registry) fn check_cycle(
+        &self,
+        parent: &ExecutionRecord,
+        child: &str,
+        pattern: ChildPattern,
+        depth: usize,
+    ) -> Result<(), ChildError> {
+        if !pattern.owned() {
+            return Ok(());
+        }
+        let mut graph: BTreeMap<&str, Vec<&str>> = BTreeMap::new();
+        let mut levels = BTreeMap::new();
+        for entry in self.entries.values() {
+            graph
+                .entry(entry.parent.identity.arn.as_str())
+                .or_default()
+                .push(entry.child.arn().as_str());
+            levels
+                .entry(entry.parent.identity.arn.as_str())
+                .or_insert(entry.parent.lineage.0.len());
+            levels
+                .entry(entry.child.arn().as_str())
+                .or_insert(entry.child.nesting_depth());
+        }
+        let mut seen = BTreeSet::new();
+        let mut queue = VecDeque::from([child]);
+        while let Some(current) = queue.pop_front() {
+            if current == parent.identity.arn.as_str() {
+                return Err(ChildError::Cycle);
+            }
+            if !seen.insert(current) {
+                continue;
+            }
+            if let Some(children) = graph.get(current) {
+                queue.extend(children);
+            }
+        }
+        graph
+            .entry(parent.identity.arn.as_str())
+            .or_default()
+            .push(child);
+        levels
+            .entry(parent.identity.arn.as_str())
+            .or_insert(parent.lineage.0.len());
+        levels.entry(child).or_insert(depth);
+        let mut incoming: BTreeMap<&str, usize> = levels.keys().map(|key| (*key, 0)).collect();
+        for children in graph.values() {
+            for child in children {
+                let count = incoming.get_mut(child).ok_or(ChildError::Invalid)?;
+                *count = count.checked_add(1).ok_or(ChildError::Capacity)?;
+            }
+        }
+        let mut queue: VecDeque<&str> = incoming
+            .iter()
+            .filter_map(|(key, count)| (*count == 0).then_some(*key))
+            .collect();
+        let mut visited = 0_usize;
+        while let Some(current) = queue.pop_front() {
+            visited = visited.checked_add(1).ok_or(ChildError::Capacity)?;
+            let level = levels.get(current).copied().ok_or(ChildError::Invalid)?;
+            if level > 16 {
+                return Err(ChildError::Capacity);
+            }
+            if let Some(children) = graph.get(current) {
+                for child in children {
+                    let next = level.checked_add(1).ok_or(ChildError::Capacity)?;
+                    let value = levels.get_mut(child).ok_or(ChildError::Invalid)?;
+                    *value = (*value).max(next);
+                    let count = incoming.get_mut(child).ok_or(ChildError::Invalid)?;
+                    *count = count.checked_sub(1).ok_or(ChildError::Invalid)?;
+                    if *count == 0 {
+                        queue.push_back(child);
+                    }
+                }
+            }
+        }
+        if visited != incoming.len() {
+            return Err(ChildError::Cycle);
+        }
+        Ok(())
+    }
+    pub(in crate::registry) fn maintain(&mut self, now: Instant) {
+        {
+            let mut graph: BTreeMap<&str, Vec<u64>> = BTreeMap::new();
+            let mut queue = VecDeque::new();
+            for (id, entry) in &self.entries {
+                graph
+                    .entry(entry.parent.identity.arn.as_str())
+                    .or_default()
+                    .push(*id);
+                if entry.control.cancelled()
+                    || now >= entry.deadline
+                    || entry.parent.handle.snapshot().outcome().is_some()
+                {
+                    queue.push_back(*id);
+                }
+            }
+            let mut seen = BTreeSet::new();
+            while let Some(id) = queue.pop_front() {
+                if !seen.insert(id) {
+                    continue;
+                }
+                if let Some(entry) = self.entries.get(&id) {
+                    entry
+                        .child
+                        .handle()
+                        .request_stop(TaskFailure(ExecutionFailure::named(
+                            "Rustack.ParentCancelled",
+                            "Owned child execution cancelled",
+                        )));
+                    if let Some(children) = graph.get(entry.child.arn().as_str()) {
+                        queue.extend(children);
+                    }
+                }
+            }
+        }
+        self.entries
+            .retain(|_, entry| entry.child.handle().snapshot().cleanup() != CleanupState::Clean);
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/child/parameters.rs b/crates/rustack-stepfunctions-core/src/registry/child/parameters.rs
new file mode 100644
index 00000000..4c7e5381
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/child/parameters.rs
@@ -0,0 +1,67 @@
+//! Validated optimized child-start parameters, preserving serialized Input bytes.
+
+use serde_json::Value;
+
+use super::{ChildError, ChildStartParameters};
+use crate::{Payload, TenantScope};
+
+impl ChildStartParameters {
+    /// Validate the exact optimized fields before registry admission.
+    ///
+    /// # Errors
+    /// Rejects unknown fields, invalid scope/name/JSON or excessive payload data.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{ChildStartParameters,Payload,TenantScope};
+    /// let parameters=Payload::parse(br#"{"StateMachineArn":"arn:aws:states:us-east-1:000000000000:stateMachine:Child","Input":"null"}"#)?;
+    /// let validated=ChildStartParameters::parse(&TenantScope::default(),&parameters)?;
+    /// assert_eq!(validated.input().original_bytes(),b"null");
+    /// # Ok::<(),Box<dyn std::error::Error>>(())
+    /// ```
+    pub fn parse(scope: &TenantScope, parameters: &Payload) -> Result<Self, ChildError> {
+        let fields = parameters.value().as_object().ok_or(ChildError::Invalid)?;
+        if fields.len() > 3
+            || fields
+                .keys()
+                .any(|key| !matches!(key.as_str(), "StateMachineArn" | "Input" | "Name"))
+        {
+            return Err(ChildError::Invalid);
+        }
+        let machine = fields
+            .get("StateMachineArn")
+            .and_then(Value::as_str)
+            .ok_or(ChildError::Invalid)?
+            .parse()?;
+        let name = fields
+            .get("Name")
+            .map(|value| {
+                value
+                    .as_str()
+                    .ok_or(ChildError::Invalid)?
+                    .parse()
+                    .map_err(ChildError::from)
+            })
+            .transpose()?;
+        let input = match fields.get("Input") {
+            None | Some(Value::Null) => Payload::parse(b"{}")?,
+            Some(Value::String(raw)) => Payload::parse(raw.as_bytes())?,
+            Some(value) => Payload::from_value(value)?,
+        };
+        let result = Self {
+            machine,
+            name,
+            input,
+        };
+        result.machine.check(scope)?;
+        Ok(result)
+    }
+    /// Read the validated child input, including exact original serialized bytes.
+    ///
+    /// ```
+    /// # fn inspect(p:&rustack_stepfunctions_core::ChildStartParameters){let input=p.input();}
+    /// ```
+    #[must_use]
+    pub fn input(&self) -> &Payload {
+        &self.input
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/domain.rs b/crates/rustack-stepfunctions-core/src/registry/domain.rs
new file mode 100644
index 00000000..069d5f5d
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/domain.rs
@@ -0,0 +1,398 @@
+//! Validated identities and bounded atomic tag mutations.
+
+use std::{collections::BTreeMap, str::FromStr};
+
+use regex::RegexBuilder;
+
+use super::RegistryError;
+use crate::TenantScope;
+
+macro_rules! redacted {
+    ($name:ident) => {
+        impl std::fmt::Debug for $name {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                f.write_str(concat!(stringify!($name), "(<redacted>)"))
+            }
+        }
+    };
+}
+pub(super) use redacted;
+macro_rules! names {
+    ($($name:ident),*) => {$(
+        /// Validated ASCII workflow identifier, one to eighty bytes.
+        #[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
+        #[non_exhaustive]
+        pub struct $name(String);
+        redacted!($name);
+        impl FromStr for $name {
+            type Err=RegistryError;
+            fn from_str(value:&str)->Result<Self,Self::Err> {
+                if value.is_empty() || value.len()>80 || !value.bytes().all(|c| c.is_ascii_alphanumeric() || matches!(c,b'_'|b'-')) {return Err(RegistryError::Validation);}
+                Ok(Self(value.into()))
+            }
+        }
+        impl TryFrom<&str> for $name {
+            type Error=RegistryError;
+            fn try_from(value:&str)->Result<Self,Self::Error>{value.parse()}
+        }
+        impl $name {
+            /// Read the validated identifier without diagnostic formatting.
+            ///
+            /// ```
+            #[doc=concat!("let name:rustack_stepfunctions_core::",stringify!($name),"=\"example\".parse()?;\nassert_eq!(name.as_str(),\"example\");\n# Ok::<(),rustack_stepfunctions_core::RegistryError>(())")]
+            /// ```
+            #[must_use] pub fn as_str(&self)->&str {&self.0}
+        }
+    )*};
+}
+names!(StateMachineName, ExecutionName);
+
+/// Whole, unqualified, scoped state machine ARN.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct StateMachineArn {
+    text: String,
+    scope: TenantScope,
+    name: StateMachineName,
+}
+redacted!(StateMachineArn);
+impl StateMachineArn {
+    /// Construct a whole ARN from validated operator scope and name.
+    ///
+    /// # Errors
+    /// Rejects a resulting ARN above256 bytes.
+    ///
+    /// ```
+    /// let arn=rustack_stepfunctions_core::StateMachineArn::new(&Default::default(),"example".parse()?)?;
+    /// assert!(arn.as_str().ends_with(":stateMachine:example"));
+    /// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+    /// ```
+    pub fn new(scope: &TenantScope, name: StateMachineName) -> Result<Self, RegistryError> {
+        let text = format!(
+            "arn:{}:states:{}:{}:stateMachine:{}",
+            scope.partition(),
+            scope.region(),
+            scope.account(),
+            name.as_str()
+        );
+        if text.len() > 256 {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self {
+            text,
+            scope: scope.clone(),
+            name,
+        })
+    }
+    /// Inspect the canonical complete ARN.
+    ///
+    /// ```
+    /// # fn inspect(arn:&rustack_stepfunctions_core::StateMachineArn) { let text=arn.as_str(); }
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.text
+    }
+    /// Inspect the validated name.
+    ///
+    /// ```
+    /// # fn inspect(arn:&rustack_stepfunctions_core::StateMachineArn) { let name=arn.name(); }
+    /// ```
+    #[must_use]
+    pub fn name(&self) -> &StateMachineName {
+        &self.name
+    }
+    pub(crate) fn check(&self, scope: &TenantScope) -> Result<(), RegistryError> {
+        if same_scope(&self.scope, scope) {
+            Ok(())
+        } else {
+            Err(RegistryError::Validation)
+        }
+    }
+}
+impl FromStr for StateMachineArn {
+    type Err = RegistryError;
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        if text.len() > 256 {
+            return Err(RegistryError::Validation);
+        }
+        let mut parts = text.split(':');
+        let (
+            Some("arn"),
+            Some(partition),
+            Some("states"),
+            Some(region),
+            Some(account),
+            Some("stateMachine"),
+            Some(name),
+            None,
+        ) = (
+            parts.next(),
+            parts.next(),
+            parts.next(),
+            parts.next(),
+            parts.next(),
+            parts.next(),
+            parts.next(),
+            parts.next(),
+        )
+        else {
+            return Err(RegistryError::Validation);
+        };
+        Self::new(
+            &TenantScope::new(partition, region, account)?,
+            name.parse()?,
+        )
+    }
+}
+/// Whole unqualified execution ARN, including its machine identity path.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ExecutionArn {
+    text: String,
+    machine: StateMachineArn,
+    name: ExecutionName,
+}
+redacted!(ExecutionArn);
+impl ExecutionArn {
+    /// Construct a whole execution ARN.
+    ///
+    /// # Errors
+    /// Rejects a resulting ARN above256 bytes.
+    ///
+    /// ```
+    /// let machine="arn:aws:states:us-east-1:000000000000:stateMachine:example".parse()?;
+    /// let execution=rustack_stepfunctions_core::ExecutionArn::new(machine,"run".parse()?)?;
+    /// assert!(execution.as_str().ends_with(":execution:example:run"));
+    /// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+    /// ```
+    pub fn new(machine: StateMachineArn, name: ExecutionName) -> Result<Self, RegistryError> {
+        let text = format!(
+            "arn:{}:states:{}:{}:execution:{}:{}",
+            machine.scope.partition(),
+            machine.scope.region(),
+            machine.scope.account(),
+            machine.name.as_str(),
+            name.as_str()
+        );
+        if text.len() > 256 {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self {
+            text,
+            machine,
+            name,
+        })
+    }
+    /// Read the complete ARN.
+    ///
+    /// ```
+    /// # fn inspect(arn:&rustack_stepfunctions_core::ExecutionArn) { let text=arn.as_str(); }
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.text
+    }
+    /// Read the owning machine ARN.
+    ///
+    /// ```
+    /// # fn inspect(arn:&rustack_stepfunctions_core::ExecutionArn) { let machine=arn.machine(); }
+    /// ```
+    #[must_use]
+    pub fn machine(&self) -> &StateMachineArn {
+        &self.machine
+    }
+    /// Read the execution name.
+    ///
+    /// ```
+    /// # fn inspect(arn:&rustack_stepfunctions_core::ExecutionArn) { let name=arn.name(); }
+    /// ```
+    #[must_use]
+    pub fn name(&self) -> &ExecutionName {
+        &self.name
+    }
+}
+impl FromStr for ExecutionArn {
+    type Err = RegistryError;
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        if text.len() > 256 {
+            return Err(RegistryError::Validation);
+        }
+        let mut p = text.split(':');
+        let (
+            Some("arn"),
+            Some(partition),
+            Some("states"),
+            Some(region),
+            Some(account),
+            Some("execution"),
+            Some(machine),
+            Some(name),
+            None,
+        ) = (
+            p.next(),
+            p.next(),
+            p.next(),
+            p.next(),
+            p.next(),
+            p.next(),
+            p.next(),
+            p.next(),
+            p.next(),
+        )
+        else {
+            return Err(RegistryError::Validation);
+        };
+        Self::new(
+            StateMachineArn::new(
+                &TenantScope::new(partition, region, account)?,
+                machine.parse()?,
+            )?,
+            name.parse()?,
+        )
+    }
+}
+pub(super) fn same_scope(a: &TenantScope, b: &TenantScope) -> bool {
+    a.partition() == b.partition() && a.region() == b.region() && a.account() == b.account()
+}
+
+/// Structurally validated IAM execution-role metadata; never an IAM grant.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct RoleArn {
+    text: String,
+    partition: String,
+    account: String,
+}
+redacted!(RoleArn);
+impl FromStr for RoleArn {
+    type Err = RegistryError;
+    fn from_str(text: &str) -> Result<Self, Self::Err> {
+        if text.len() > 256 {
+            return Err(RegistryError::Validation);
+        }
+        let mut p = text.splitn(6, ':');
+        let (Some("arn"), Some(partition), Some("iam"), Some(""), Some(account), Some(resource)) =
+            (p.next(), p.next(), p.next(), p.next(), p.next(), p.next())
+        else {
+            return Err(RegistryError::Validation);
+        };
+        TenantScope::new(partition, "us-east-1", account)?;
+        let role = resource
+            .strip_prefix("role/")
+            .ok_or(RegistryError::Validation)?;
+        if role
+            .split('/')
+            .any(|part| part.is_empty() || !part.bytes().all(|b| matches!(b, 0x21..=0x7e)))
+        {
+            return Err(RegistryError::Validation);
+        }
+        let name = role.rsplit('/').next().ok_or(RegistryError::Validation)?;
+        if name.len() > 64
+            || !name
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || b"_+=,.@-".contains(&b))
+        {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self {
+            text: text.into(),
+            partition: partition.into(),
+            account: account.into(),
+        })
+    }
+}
+impl RoleArn {
+    /// Read validated metadata; logging remains the caller's trust boundary.
+    ///
+    /// ```
+    /// let role:rustack_stepfunctions_core::RoleArn="arn:aws:iam::000000000000:role/example".parse()?;
+    /// assert!(role.as_str().ends_with("role/example"));
+    /// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+    /// ```
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.text
+    }
+    pub(super) fn check(&self, scope: &TenantScope) -> Result<(), RegistryError> {
+        if self.partition == scope.partition() && self.account == scope.account() {
+            Ok(())
+        } else {
+            Err(RegistryError::Validation)
+        }
+    }
+}
+/// Validated, bounded, uniquely keyed tags; mutation is atomic.
+#[derive(Clone, Default)]
+#[non_exhaustive]
+pub struct Tags(BTreeMap<String, String>);
+redacted!(Tags);
+impl Tags {
+    /// Validate the entire mutation before constructing it.
+    ///
+    /// # Errors
+    /// Rejects duplicate/reserved keys, invalid characters, byte/count limits.
+    ///
+    /// ```
+    /// let tags=rustack_stepfunctions_core::Tags::new(vec![("team".into(),"engine".into())])?;
+    /// assert_eq!(tags.values().len(),1);
+    /// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+    /// ```
+    pub fn new(values: Vec<(String, String)>) -> Result<Self, RegistryError> {
+        if values.len() > 50 {
+            return Err(RegistryError::Validation);
+        }
+        let regex = RegexBuilder::new(r"\A[\p{L}\p{Z}\p{N}_.:/=+@\-]*\z")
+            .size_limit(1024 * 1024)
+            .dfa_size_limit(1024 * 1024)
+            .build()
+            .map_err(RegistryError::Regex)?;
+        let mut out = BTreeMap::new();
+        for (key, value) in values {
+            check_key(&key)?;
+            if value.len() > 256
+                || !regex.is_match(&key)
+                || !regex.is_match(&value)
+                || out.insert(key, value).is_some()
+            {
+                return Err(RegistryError::Validation);
+            }
+        }
+        Ok(Self(out))
+    }
+    /// Read the bounded tag map.
+    ///
+    /// ```
+    /// let tags=rustack_stepfunctions_core::Tags::default();
+    /// assert!(tags.values().is_empty());
+    /// ```
+    #[must_use]
+    pub fn values(&self) -> &BTreeMap<String, String> {
+        &self.0
+    }
+    pub(super) fn merge(&self, other: &Self) -> Result<Self, RegistryError> {
+        let mut out = self.0.clone();
+        out.extend(other.0.clone());
+        if out.len() > 50 {
+            return Err(RegistryError::TagLimit);
+        }
+        Ok(Self(out))
+    }
+    pub(super) fn remove(&self, keys: &Self) -> Self {
+        let mut out = self.0.clone();
+        for key in keys.0.keys() {
+            out.remove(key);
+        }
+        Self(out)
+    }
+}
+fn check_key(key: &str) -> Result<(), RegistryError> {
+    if key.is_empty()
+        || key.len() > 128
+        || key.get(..4).is_some_and(|v| v.eq_ignore_ascii_case("aws:"))
+    {
+        Err(RegistryError::Validation)
+    } else {
+        Ok(())
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/error.rs b/crates/rustack-stepfunctions-core/src/registry/error.rs
new file mode 100644
index 00000000..3a3550e5
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/error.rs
@@ -0,0 +1,72 @@
+//! Typed static registry failures with retained redacted sources.
+
+use std::{fmt, sync::Arc};
+
+use thiserror::Error;
+use tokio::task::JoinError;
+
+use crate::{AslError, ExecutionError};
+
+/// Domain, admission and lifecycle failures; no payload-bearing public text.
+#[derive(Error)]
+#[non_exhaustive]
+pub enum RegistryError {
+    /// Invalid scope, metadata, identifier, arguments or trusted limits.
+    #[error("invalid workflow registry input")]
+    Validation,
+    /// Atomic tag mutation would exceed the fifty-tag quota.
+    #[error("too many workflow resource tags")]
+    TagLimit,
+    /// No such current mutable state machine.
+    #[error("state machine does not exist")]
+    MachineMissing,
+    /// A conflicting same-name state machine already exists.
+    #[error("state machine already exists")]
+    MachineExists,
+    /// Starts/updates are forbidden during deletion.
+    #[error("state machine is deleting")]
+    Deleting,
+    /// No retained execution record is available.
+    #[error("execution does not exist")]
+    ExecutionMissing,
+    /// Execution ARN is already reserved with incompatible input or closed.
+    #[error("execution already exists")]
+    ExecutionExists,
+    /// A bounded allocation cannot be reserved without evicting live ownership.
+    #[error("workflow registry capacity exhausted")]
+    Capacity,
+    /// No accepting/live registry owner is available.
+    #[error("workflow registry unavailable")]
+    Unavailable,
+    /// Observer deadline expired; accepted ownership is unchanged.
+    #[error("workflow registry observation expired")]
+    Deadline,
+    /// Interpreter/context/entropy conversion failure.
+    #[error("workflow registry preparation failed")]
+    Evaluation(
+        #[from]
+        #[source]
+        AslError,
+    ),
+    /// Execution registration or cleanup failure.
+    #[error("workflow execution owner failed")]
+    Execution(
+        #[from]
+        #[source]
+        ExecutionError,
+    ),
+    /// Static Unicode tag parser failed to initialize.
+    #[error("workflow tag validator failed")]
+    Regex(#[source] regex::Error),
+    /// Unique actor failed; unresolved allocations remain retained.
+    #[error("workflow registry worker failed")]
+    Worker(#[source] JoinError),
+    /// Cached unique-owner failure.
+    #[error("workflow registry shutdown failed")]
+    Owner(#[source] Arc<RegistryError>),
+}
+impl fmt::Debug for RegistryError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/mod.rs b/crates/rustack-stepfunctions-core/src/registry/mod.rs
new file mode 100644
index 00000000..88477c20
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/mod.rs
@@ -0,0 +1,625 @@
+//! Retained actor-owned resource revisions, execution names and immutable reads.
+//!
+//! Accept compiled/validated inputs, independent of HTTP. The embedding API must
+//! own bounded preparation and pagination. No command waiter owns execution life.
+
+use std::{fmt, sync::Arc};
+
+use tokio::{
+    runtime::Handle,
+    sync::{Notify, OwnedSemaphorePermit, Semaphore, mpsc, oneshot, watch},
+    task::JoinHandle,
+    time::{Instant, timeout_at},
+};
+
+use crate::{
+    CompiledMachine, ExecutionLimits, ExecutionSupervisor, Payload, StateSupport, TenantScope,
+    engine::HistoryRestorer,
+};
+
+mod actor;
+mod callback;
+mod child;
+mod domain;
+mod error;
+mod retention;
+mod snapshot;
+#[cfg(test)]
+mod tests;
+mod types;
+
+pub use callback::{
+    CallbackAck, CallbackAttempt, CallbackCommand, CallbackError, CallbackInvocation,
+    CallbackInvocationMetadata, CallbackInvocationReporter, CallbackLimits, CallbackMint,
+    CallbackOutcome, CallbackRegistry, CallbackStatus, CallbackSupervisor, CallbackTask,
+    CallbackTimeout, CallbackToken,
+};
+use child::owner::Inbox as ChildInbox;
+pub use child::{
+    ChildError, ChildExecution, ChildExecutionPort, ChildParent, ChildPattern,
+    ChildStartParameters, ChildSubmission,
+};
+pub use domain::{ExecutionArn, ExecutionName, RoleArn, StateMachineArn, StateMachineName, Tags};
+pub use error::RegistryError;
+pub use snapshot::{
+    PreparedSnapshot, RegistryHistories, RegistryMetadata, RegistrySnapshot, SnapshotLimits,
+};
+pub use types::{
+    DefinitionRevision, ExecutionSnapshot, MachineSnapshot, MachineStatus, PreparedDefinition,
+    RegistryCapacities, RegistryLimits, StopReason,
+};
+
+/// Validated domain operations; preparing wire DTOs remains the API adapter's job.
+#[non_exhaustive]
+pub enum RegistryCommand {
+    /// Create under the supported effective STANDARD/OFF profile.
+    Create(StateMachineName, PreparedDefinition, RoleArn, Tags),
+    /// Publish a new revision, changing definition and/or role.
+    Update(StateMachineArn, Option<PreparedDefinition>, Option<RoleArn>),
+    /// Enter deletion, preserving already accepted executions.
+    Delete(StateMachineArn),
+    /// Read the current mutable resource.
+    Machine(StateMachineArn),
+    /// Capture all current machines in deterministic order.
+    Machines,
+    /// Start or replay an identical raw-input RUNNING execution.
+    Start(
+        StateMachineArn,
+        Option<ExecutionName>,
+        Payload,
+        Option<String>,
+    ),
+    /// Read captured identity/revision and one atomic execution view.
+    Execution(ExecutionArn),
+    /// Retain a Stop signal even after the reply observer is dropped.
+    Stop(ExecutionArn, StopReason),
+    /// Capture retained executions for this ARN, including prior incarnations.
+    Executions(StateMachineArn),
+    /// Atomically add/replace tags after all validation.
+    Tag(StateMachineArn, Tags),
+    /// Atomically remove keys; values in the validated Tags map are ignored.
+    Untag(StateMachineArn, Tags),
+}
+impl fmt::Debug for RegistryCommand {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryCommand(<redacted>)")
+    }
+}
+/// One immutable command result, captured by the registry owner.
+#[non_exhaustive]
+pub enum RegistryResult {
+    /// A fully prepared startup replacement committed atomically.
+    Restored,
+    /// Current resource capture.
+    Machine(MachineSnapshot),
+    /// Current execution capture.
+    Execution(ExecutionSnapshot),
+    /// Stable resource-list boundary for a later pagination owner.
+    Machines(Vec<MachineSnapshot>),
+    /// Stable execution-list boundary for a later pagination owner.
+    Executions(Vec<ExecutionSnapshot>),
+    /// Mutable deletion accepted.
+    Deleted,
+    /// Updated bounded tags.
+    Tags(Tags),
+}
+impl fmt::Debug for RegistryResult {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryResult(<redacted>)")
+    }
+}
+enum Operation {
+    Business(RegistryCommand),
+    Restore(PreparedSnapshot),
+}
+impl fmt::Debug for Operation {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryOperation(<redacted>)")
+    }
+}
+struct Envelope {
+    command: Operation,
+    reply: oneshot::Sender<Reply>,
+    permit: OwnedSemaphorePermit,
+}
+struct Reply {
+    result: Result<RegistryResult, RegistryError>,
+    permit: OwnedSemaphorePermit,
+}
+#[derive(Debug, Clone, Copy, Default)]
+struct Profile {
+    execution: ExecutionLimits,
+    states: StateSupport,
+}
+struct Shared {
+    restore: snapshot::RestoreAdmission,
+    sealed: watch::Sender<Option<Arc<snapshot::SealedRegistry>>>,
+    child_sender: mpsc::Sender<child::Request>,
+    child_capacity: Arc<Semaphore>,
+    child_wake: Arc<Notify>,
+    scope: TenantScope,
+    states: StateSupport,
+    callbacks: Option<CallbackRegistry>,
+    sender: mpsc::Sender<Envelope>,
+    capacity: Arc<Semaphore>,
+    closing: watch::Sender<bool>,
+    status: watch::Sender<RegistryStatus>,
+}
+impl fmt::Debug for Shared {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryShared(<redacted>)")
+    }
+}
+#[derive(Debug)]
+struct Admission {
+    shared: Arc<Shared>,
+    channels: (mpsc::Receiver<Envelope>, ChildInbox),
+}
+fn admission(
+    scope: TenantScope,
+    limits: RegistryLimits,
+    support: StateSupport,
+    child_limit: usize,
+    callbacks: Option<CallbackRegistry>,
+    history: HistoryRestorer,
+) -> Admission {
+    let (sender, receiver) = mpsc::channel(limits.commands);
+    let (child_sender, children) = mpsc::channel(child_limit);
+    let (closing, _) = watch::channel(false);
+    let (status, _) = watch::channel(RegistryStatus {
+        ready: true,
+        owned_executions: 0,
+    });
+    let (sealed, _) = watch::channel(None);
+    let shared = Arc::new(Shared {
+        restore: snapshot::RestoreAdmission::new(limits, history),
+        sealed,
+        child_sender,
+        child_capacity: Arc::new(Semaphore::new(child_limit)),
+        child_wake: Arc::new(Notify::new()),
+        scope,
+        states: support,
+        callbacks,
+        sender,
+        capacity: Arc::new(Semaphore::new(limits.commands)),
+        closing,
+        status,
+    });
+    Admission {
+        channels: (
+            receiver,
+            ChildInbox {
+                requests: children,
+                registry: shared.clone(),
+            },
+        ),
+        shared,
+    }
+}
+/// Admission-independent registry supervisor observation.
+#[derive(Debug, Clone, Copy, Default)]
+#[non_exhaustive]
+pub struct RegistryStatus {
+    /// False after close/root loss or quarantined execution cleanup.
+    pub ready: bool,
+    /// All live or quarantined execution owners, including terminal cleanup.
+    pub owned_executions: usize,
+}
+/// Cloneable bounded command handle; caller loss never rolls back acceptance.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct Registry {
+    shared: Arc<Shared>,
+}
+/// Resumable observer of one accepted command; no mutation can be replayed.
+#[non_exhaustive]
+pub struct RegistryReceipt {
+    receiver: Option<oneshot::Receiver<Reply>>,
+}
+impl fmt::Debug for RegistryReceipt {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RegistryReceipt(<redacted>)")
+    }
+}
+impl RegistryReceipt {
+    /// Await the same reply, preserving its receiver on observation timeout.
+    ///
+    /// # Errors
+    /// Returns a domain failure, Deadline or Unavailable/consumed receipt.
+    ///
+    /// ```no_run
+    /// # async fn observe(receipt:&mut rustack_stepfunctions_core::RegistryReceipt,deadline:tokio::time::Instant) { let result=receipt.wait(deadline).await; }
+    /// ```
+    pub async fn wait(&mut self, deadline: Instant) -> Result<RegistryResult, RegistryError> {
+        if Instant::now() >= deadline {
+            return Err(RegistryError::Deadline);
+        }
+        let receiver = self.receiver.as_mut().ok_or(RegistryError::Unavailable)?;
+        let reply = timeout_at(deadline, receiver)
+            .await
+            .map_err(|_| RegistryError::Deadline)?;
+        // Closure also consumes a oneshot: never repoll its completed receiver.
+        self.receiver = None;
+        let reply = reply.map_err(|_| RegistryError::Unavailable)?;
+        // A committed command remains committed even if this observer is late.
+        let result = reply.result;
+        drop(reply.permit);
+        result
+    }
+}
+impl Registry {
+    /// Spawn one bounded owner around an existing real execution supervisor.
+    ///
+    /// # Errors
+    /// Requires an active Tokio runtime. All limits are already validated.
+    ///
+    /// ```no_run
+    /// # fn run(runtime:rustack_stepfunctions_core::ExecutionSupervisor)->Result<(),rustack_stepfunctions_core::RegistryError>{
+    /// let (registry,owner)=rustack_stepfunctions_core::Registry::new(Default::default(),Default::default(),runtime,Default::default())?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new(
+        scope: TenantScope,
+        limits: RegistryLimits,
+        runtime: ExecutionSupervisor,
+        execution: ExecutionLimits,
+    ) -> Result<(Self, RegistrySupervisor), RegistryError> {
+        Self::new_with_state_support(scope, limits, runtime, execution, StateSupport::Sequential)
+    }
+    /// Compose the registry with an immutable installed state-instruction profile.
+    ///
+    /// The API must use `state_support()` when compiling definitions.
+    ///
+    /// # Errors
+    /// Requires an active Tokio runtime; all supplied limits are validated.
+    ///
+    /// ```no_run
+    /// # fn compose(runtime:rustack_stepfunctions_core::ExecutionSupervisor)->Result<(),rustack_stepfunctions_core::RegistryError>{
+    /// let (registry,owner)=rustack_stepfunctions_core::Registry::new_with_state_support(Default::default(),Default::default(),runtime,Default::default(),rustack_stepfunctions_core::StateSupport::Structured)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn new_with_state_support(
+        scope: TenantScope,
+        limits: RegistryLimits,
+        runtime: ExecutionSupervisor,
+        execution: ExecutionLimits,
+        support: StateSupport,
+    ) -> Result<(Self, RegistrySupervisor), RegistryError> {
+        Handle::try_current().map_err(|_| RegistryError::Unavailable)?;
+        if runtime
+            .callback_scope()
+            .is_some_and(|installed| !domain::same_scope(installed, &scope))
+        {
+            return Err(RegistryError::Validation);
+        }
+        let callbacks = runtime.callbacks();
+        let Admission { shared, channels } = admission(
+            scope.clone(),
+            limits,
+            support,
+            runtime.open_limit(),
+            callbacks,
+            runtime.snapshot_restorer(),
+        );
+        let closing = shared.closing.clone();
+        let stop = closing.subscribe();
+        let status = shared.status.clone();
+        // Install Drop protection before spawn: an unpolled root still owns data.
+        let owner = actor::Owner::new(
+            scope,
+            limits,
+            runtime,
+            Profile {
+                execution,
+                states: support,
+            },
+            channels,
+            closing.clone(),
+            status,
+        );
+        let join = tokio::spawn(owner.run(stop));
+        Ok((
+            Self { shared },
+            RegistrySupervisor {
+                closing,
+                join: Some(join),
+                result: None,
+            },
+        ))
+    }
+    /// Export the exact retained cut after successful joined registry shutdown.
+    ///
+    /// Run this synchronous payload copy under the embedding caller's bounded
+    /// CPU owner. This does not certify callback/bridge/provider shutdown.
+    ///
+    /// # Errors
+    /// Rejects a live, closing or failed root, inconsistent state, or copy-budget
+    /// exhaustion. Failure preserves the same capture and never dispatches work.
+    ///
+    /// ```no_run
+    /// # fn export(registry:&rustack_stepfunctions_core::Registry){let snapshot=registry.export_snapshot(Default::default());}
+    /// ```
+    pub fn export_snapshot(
+        &self,
+        limits: SnapshotLimits,
+    ) -> Result<RegistrySnapshot, RegistryError> {
+        let capture = self
+            .shared
+            .sealed
+            .borrow()
+            .clone()
+            .ok_or(RegistryError::Unavailable)?;
+        capture.export(limits)
+    }
+    /// Read readiness/owned execution counts without using command admission.
+    ///
+    /// ```
+    /// # fn inspect(registry:&rustack_stepfunctions_core::Registry){let state=registry.status();}
+    /// ```
+    #[must_use]
+    pub fn status(&self) -> RegistryStatus {
+        let mut status = *self.shared.status.borrow();
+        status.ready &= !*self.shared.closing.borrow() && !self.shared.restore.preparing();
+        status
+    }
+    /// Wait for retained execution owners to settle through a grace cutoff.
+    ///
+    /// This does not close intake; the caller must first join external API intake.
+    ///
+    /// # Errors
+    /// Returns Deadline while executions remain, or Unavailable after root failure.
+    ///
+    /// ```no_run
+    /// # async fn grace(registry:&rustack_stepfunctions_core::Registry,deadline:tokio::time::Instant){let result=registry.wait_idle(deadline).await;}
+    /// ```
+    pub async fn wait_idle(&self, deadline: Instant) -> Result<(), RegistryError> {
+        let mut status = self.shared.status.subscribe();
+        let mut closing = self.shared.closing.subscribe();
+        loop {
+            let value = *status.borrow_and_update();
+            if !value.ready || *self.shared.closing.borrow() {
+                return Err(RegistryError::Unavailable);
+            }
+            if value.owned_executions == 0 {
+                return Ok(());
+            }
+            timeout_at(deadline, async {
+                tokio::select! {
+                    result = status.changed() => result,
+                    result = closing.changed() => result,
+                }
+            })
+            .await
+            .map_err(|_| RegistryError::Deadline)?
+            .map_err(|_| RegistryError::Unavailable)?;
+        }
+    }
+    /// Read the immutable trusted scope of this registry.
+    ///
+    /// ```
+    /// # fn inspect(registry:&rustack_stepfunctions_core::Registry){let scope=registry.scope();}
+    /// ```
+    #[must_use]
+    pub fn scope(&self) -> &TenantScope {
+        &self.shared.scope
+    }
+    /// Read the immutable installed instruction profile for compilation.
+    ///
+    /// ```
+    /// # fn inspect(registry:&rustack_stepfunctions_core::Registry){let states=registry.state_support();}
+    /// ```
+    #[must_use]
+    pub fn state_support(&self) -> StateSupport {
+        self.shared.states
+    }
+    /// Read callback compilation support from the installed execution owner.
+    ///
+    /// ```
+    /// # fn inspect(registry:&rustack_stepfunctions_core::Registry){let enabled=registry.callback_support();}
+    /// ```
+    #[must_use]
+    pub fn callback_support(&self) -> bool {
+        self.shared.callbacks.is_some()
+    }
+    /// Submit to the execution owner's exact scoped callback registry once.
+    ///
+    /// Accepted actions survive a dropped or expired acknowledgment observer.
+    /// This uses independent callback admission, not the metadata command lane.
+    ///
+    /// # Errors
+    /// Rejects missing/closed ownership, exhausted capacity or invalid tokens.
+    ///
+    /// ```no_run
+    /// # fn submit(registry:&rustack_stepfunctions_core::Registry,command:rustack_stepfunctions_core::CallbackCommand){
+    /// let acknowledgment=registry.submit_callback(command);
+    /// # }
+    /// ```
+    pub fn submit_callback(&self, command: CallbackCommand) -> Result<CallbackAck, CallbackError> {
+        if !self.status().ready {
+            return Err(CallbackError::Unavailable);
+        }
+        self.shared
+            .callbacks
+            .as_ref()
+            .ok_or(CallbackError::Unavailable)?
+            .submit(&self.shared.scope, command)
+    }
+    /// Validate and synchronously transfer one command to retained ownership.
+    ///
+    /// # Errors
+    /// Rejects scope/metadata, closed ownership or saturated command admission.
+    /// An error means no command was accepted.
+    ///
+    /// ```no_run
+    /// # fn submit(registry:&rustack_stepfunctions_core::Registry)->Result<(),rustack_stepfunctions_core::RegistryError>{
+    /// let receipt=registry.submit(rustack_stepfunctions_core::RegistryCommand::Machines)?;
+    /// # Ok(()) }
+    /// ```
+    pub fn submit(&self, command: RegistryCommand) -> Result<RegistryReceipt, RegistryError> {
+        command.check(
+            &self.shared.scope,
+            self.shared.states,
+            self.callback_support(),
+        )?;
+        self.shared.restore.business()?;
+        self.submit_operation(Operation::Business(command))
+    }
+    fn submit_operation(&self, command: Operation) -> Result<RegistryReceipt, RegistryError> {
+        if *self.shared.closing.borrow() {
+            return Err(RegistryError::Unavailable);
+        }
+        let permit = self
+            .shared
+            .capacity
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| RegistryError::Capacity)?;
+        let (reply, receiver) = oneshot::channel();
+        self.shared
+            .sender
+            .try_send(Envelope {
+                command,
+                reply,
+                permit,
+            })
+            .map_err(|error| match error {
+                mpsc::error::TrySendError::Full(_) => RegistryError::Capacity,
+                mpsc::error::TrySendError::Closed(_) => RegistryError::Unavailable,
+            })?;
+        Ok(RegistryReceipt {
+            receiver: Some(receiver),
+        })
+    }
+    /// Signal Stop and observe termination outside the actor command lane.
+    ///
+    /// # Errors
+    /// Rejects oversized fields, missing execution, admission or observer expiry.
+    /// Stop is retained after observer loss and preserves omitted/empty fields.
+    ///
+    /// ```no_run
+    /// # async fn stop(registry:&rustack_stepfunctions_core::Registry,arn:rustack_stepfunctions_core::ExecutionArn,deadline:tokio::time::Instant) { let outcome=registry.stop(arn,None,None,deadline).await; }
+    /// ```
+    pub async fn stop(
+        &self,
+        arn: ExecutionArn,
+        error: Option<String>,
+        cause: Option<String>,
+        deadline: Instant,
+    ) -> Result<ExecutionSnapshot, RegistryError> {
+        let reason = StopReason::new(error, cause)?;
+        let mut receipt = self.submit(RegistryCommand::Stop(arn, reason))?;
+        let RegistryResult::Execution(mut snapshot) = receipt.wait(deadline).await? else {
+            return Err(RegistryError::Unavailable);
+        };
+        let mut handle = snapshot.handle();
+        snapshot.view = handle.wait(deadline).await?;
+        Ok(snapshot)
+    }
+}
+impl RegistryCommand {
+    fn check(
+        &self,
+        scope: &TenantScope,
+        states: StateSupport,
+        callbacks: bool,
+    ) -> Result<(), RegistryError> {
+        let check_machine = |machine: &CompiledMachine| {
+            if machine.is_root_definition()
+                && (callbacks || !machine.uses_callbacks())
+                && domain::same_scope(machine.scope(), scope)
+                && (states == StateSupport::Structured || !machine.requires_structured_execution())
+            {
+                Ok(())
+            } else {
+                Err(RegistryError::Validation)
+            }
+        };
+        match self {
+            Self::Create(_, definition, role, _) => {
+                check_machine(&definition.machine)?;
+                role.check(scope)
+            }
+            Self::Update(arn, definition, role) => {
+                arn.check(scope)?;
+                if definition.is_none() && role.is_none() {
+                    return Err(RegistryError::Validation);
+                }
+                if let Some(d) = definition {
+                    check_machine(&d.machine)?;
+                }
+                if let Some(r) = role {
+                    r.check(scope)?;
+                }
+                Ok(())
+            }
+            Self::Delete(arn)
+            | Self::Machine(arn)
+            | Self::Executions(arn)
+            | Self::Tag(arn, _)
+            | Self::Untag(arn, _) => arn.check(scope),
+            Self::Start(arn, _, _, trace) => {
+                arn.check(scope)?;
+                if trace
+                    .as_ref()
+                    .is_some_and(|v| v.len() > 256 || !v.is_ascii())
+                {
+                    return Err(RegistryError::Validation);
+                }
+                Ok(())
+            }
+            Self::Execution(arn) | Self::Stop(arn, _) => arn.machine().check(scope),
+            Self::Machines => Ok(()),
+        }
+    }
+}
+/// Unique shutdown controller; observation timeout retains the exact root join.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct RegistrySupervisor {
+    closing: watch::Sender<bool>,
+    join: Option<JoinHandle<Result<(), RegistryError>>>,
+    result: Option<Result<(), Arc<RegistryError>>>,
+}
+impl RegistrySupervisor {
+    /// Reject new commands and request joined shutdown once.
+    ///
+    /// ```
+    /// # fn close(owner:&rustack_stepfunctions_core::RegistrySupervisor){owner.close();}
+    /// ```
+    pub fn close(&self) {
+        self.closing.send_replace(true);
+    }
+    /// Observe joined shutdown through one absolute deadline; resumes the same join.
+    ///
+    /// # Errors
+    /// Returns Deadline without dropping the root, or cached worker/cleanup failure.
+    ///
+    /// ```no_run
+    /// # async fn join(owner:&mut rustack_stepfunctions_core::RegistrySupervisor,deadline:tokio::time::Instant){let result=owner.shutdown(deadline).await;}
+    /// ```
+    #[tracing::instrument(name = "stepfunctions.registry.shutdown", skip_all)]
+    pub async fn shutdown(&mut self, deadline: Instant) -> Result<(), RegistryError> {
+        self.close();
+        if self.result.is_none() {
+            let join = self.join.as_mut().ok_or(RegistryError::Unavailable)?;
+            let result = timeout_at(deadline, join)
+                .await
+                .map_err(|_| RegistryError::Deadline)?;
+            self.join = None;
+            self.result = Some(match result {
+                Ok(result) => result.map_err(Arc::new),
+                Err(error) => Err(Arc::new(RegistryError::Worker(error))),
+            });
+        }
+        match self.result.as_ref() {
+            Some(Ok(())) => Ok(()),
+            Some(Err(error)) => Err(RegistryError::Owner(error.clone())),
+            None => Err(RegistryError::Unavailable),
+        }
+    }
+}
+impl Drop for RegistrySupervisor {
+    fn drop(&mut self) {
+        self.close(); /* Root owns drain after controller loss; never abort or replay it. */
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/retention.rs b/crates/rustack-stepfunctions-core/src/registry/retention.rs
new file mode 100644
index 00000000..7ee84d7f
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/retention.rs
@@ -0,0 +1,36 @@
+//! Explicit live, completion-relative and imported retention lifetimes.
+
+use std::time::Duration;
+
+use tokio::time::Instant;
+
+use super::RegistryError;
+
+#[derive(Debug, Clone, Copy)]
+pub(super) enum Retention {
+    Running,
+    ClosedAt { at: Instant, ttl: Duration },
+    Until(Instant),
+}
+impl Retention {
+    pub(super) fn running(self) -> bool {
+        matches!(self, Self::Running)
+    }
+    pub(super) fn expired(self, now: Instant) -> bool {
+        match self {
+            Self::Running => false,
+            Self::ClosedAt { at, ttl } => now.saturating_duration_since(at) >= ttl,
+            Self::Until(deadline) => now >= deadline,
+        }
+    }
+    pub(super) fn remaining(self, now: Instant) -> Result<Duration, RegistryError> {
+        match self {
+            Self::Running => Err(RegistryError::Unavailable),
+            Self::ClosedAt { at, ttl } => Ok(ttl.saturating_sub(
+                now.checked_duration_since(at)
+                    .ok_or(RegistryError::Validation)?,
+            )),
+            Self::Until(deadline) => Ok(deadline.saturating_duration_since(now)),
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot.rs
new file mode 100644
index 00000000..2c103c49
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot.rs
@@ -0,0 +1,631 @@
+//! Data-only export of one immutable post-cleanup registry cut.
+
+use std::{collections::BTreeMap, fmt, str, sync::Arc};
+
+use chrono::{DateTime, TimeDelta, Utc};
+use serde::{Deserialize, Serialize};
+use tokio::time::Instant;
+
+use super::{
+    DefinitionRevision, MachineSnapshot, MachineStatus, RegistryError, StateSupport,
+    domain::redacted,
+    retention::Retention,
+    types::{ExecutionRecord, MachineIdentity},
+};
+use crate::{
+    ClockSample, ExecutionFailure, ExecutionHistory, ExecutionOutcome, ExecutionView, TenantScope,
+};
+
+mod archive;
+mod decode;
+pub use archive::{RegistryHistories, RegistryMetadata};
+mod restore;
+
+pub(super) use restore::Admission as RestoreAdmission;
+pub use restore::PreparedSnapshot;
+
+const METADATA_BYTES: usize = 4096;
+const NAME_BYTES: usize = 512;
+
+/// Validated conservative source-copy budget for one registry snapshot export.
+///
+/// The embedding encoder separately caps actual serialized bytes. The allowance
+/// is1byte..=1GiB; the default is512MiB. Export fails before copying payloads when
+/// the conservative estimate exceeds it.
+///
+/// ```
+/// let limits=rustack_stepfunctions_core::SnapshotLimits::try_from(8*1024*1024)?;
+/// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+/// ```
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct SnapshotLimits {
+    bytes: usize,
+}
+impl TryFrom<usize> for SnapshotLimits {
+    type Error = RegistryError;
+    fn try_from(bytes: usize) -> Result<Self, Self::Error> {
+        if !(1..=1024 * 1024 * 1024).contains(&bytes) {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self { bytes })
+    }
+}
+impl Default for SnapshotLimits {
+    fn default() -> Self {
+        Self {
+            bytes: 512 * 1024 * 1024,
+        }
+    }
+}
+
+/// Versioned durable document for sealed export and bounded startup decoding.
+///
+/// Deserialization does not grant domain validity: use `Registry::prepare_snapshot`
+/// before committing it. Decode with a bounded redacting adapter. Intentional
+/// definition/input/output/history payloads are available only through serialization;
+/// Debug is redacted and no live handles or credentials are stored.
+///
+/// ```no_run
+/// # fn export(registry:&rustack_stepfunctions_core::Registry)->Result<(),Box<dyn std::error::Error>> {
+/// let snapshot=registry.export_snapshot(Default::default())?;
+/// let bytes=serde_json::to_vec(&snapshot)?;
+/// # Ok(()) }
+/// ```
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct RegistrySnapshot {
+    schema_version: u32,
+    profile_version: u32,
+    scope: ScopeRow,
+    state_support: ProfileStates,
+    lambda_support: bool,
+    callback_support: bool,
+    #[serde(deserialize_with = "decode::time")]
+    captured_at: DateTime<Utc>,
+    #[serde(deserialize_with = "decode::rows::<_, _, 4096>")]
+    resources: Vec<ResourceRow>,
+    #[serde(deserialize_with = "decode::rows::<_, _, 4096>")]
+    revisions: Vec<RevisionRow>,
+    #[serde(deserialize_with = "decode::rows::<_, _, 4096>")]
+    machines: Vec<MachineRow>,
+    #[serde(deserialize_with = "decode::rows::<_, _, 100000>")]
+    executions: Vec<ExecutionRow>,
+    #[serde(deserialize_with = "decode::rows::<_, _, 1000000>")]
+    names: Vec<NameRow>,
+}
+redacted!(RegistrySnapshot);
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+enum ProfileStates {
+    Sequential,
+    Structured,
+}
+impl From<StateSupport> for ProfileStates {
+    fn from(value: StateSupport) -> Self {
+        match value {
+            StateSupport::Sequential => Self::Sequential,
+            StateSupport::Structured => Self::Structured,
+        }
+    }
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+enum Availability {
+    Active,
+    Deleting,
+}
+impl From<MachineStatus> for Availability {
+    fn from(value: MachineStatus) -> Self {
+        match value {
+            MachineStatus::Active => Self::Active,
+            MachineStatus::Deleting => Self::Deleting,
+        }
+    }
+}
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct HistoryRow {
+    #[serde(deserialize_with = "decode::time")]
+    timestamp: DateTime<Utc>,
+    #[serde(deserialize_with = "decode::text::<_, 2097152>")]
+    event_json: String,
+}
+redacted!(HistoryRow);
+
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ScopeRow {
+    #[serde(deserialize_with = "decode::text::<_, 16>")]
+    partition: String,
+    #[serde(deserialize_with = "decode::text::<_, 64>")]
+    region: String,
+    #[serde(deserialize_with = "decode::text::<_, 12>")]
+    account: String,
+}
+redacted!(ScopeRow);
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ResourceRow {
+    #[serde(deserialize_with = "decode::text::<_, 36>")]
+    resource_id: String,
+    #[serde(deserialize_with = "decode::text::<_, 256>")]
+    arn: String,
+    #[serde(deserialize_with = "decode::time")]
+    created_at: DateTime<Utc>,
+}
+redacted!(ResourceRow);
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct RevisionRow {
+    #[serde(deserialize_with = "decode::text::<_, 36>")]
+    revision_id: String,
+    #[serde(deserialize_with = "decode::text::<_, 36>")]
+    resource_id: String,
+    #[serde(deserialize_with = "decode::text::<_, 1048576>")]
+    definition: String,
+    source_hash: [u8; 32],
+    #[serde(deserialize_with = "decode::text::<_, 2048>")]
+    role_arn: String,
+    #[serde(deserialize_with = "decode::time")]
+    published_at: DateTime<Utc>,
+}
+redacted!(RevisionRow);
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct MachineRow {
+    #[serde(deserialize_with = "decode::text::<_, 36>")]
+    resource_id: String,
+    #[serde(deserialize_with = "decode::text::<_, 36>")]
+    revision_id: String,
+    status: Availability,
+    #[serde(deserialize_with = "decode::time")]
+    updated_at: DateTime<Utc>,
+    #[serde(deserialize_with = "decode::tags")]
+    tags: BTreeMap<String, String>,
+}
+redacted!(MachineRow);
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ExecutionRow {
+    #[serde(deserialize_with = "decode::text::<_, 256>")]
+    arn: String,
+    #[serde(deserialize_with = "decode::text::<_, 36>")]
+    resource_id: String,
+    #[serde(deserialize_with = "decode::text::<_, 36>")]
+    revision_id: String,
+    #[serde(deserialize_with = "decode::text::<_, 262144>")]
+    input: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(default, deserialize_with = "decode::optional_text::<_, 256>")]
+    trace_header: Option<String>,
+    #[serde(deserialize_with = "decode::time")]
+    started_at: DateTime<Utc>,
+    #[serde(
+        default,
+        deserialize_with = "decode::optional_time",
+        skip_serializing_if = "Option::is_none"
+    )]
+    stopped_at: Option<DateTime<Utc>>,
+    #[serde(
+        default,
+        deserialize_with = "decode::optional_time",
+        skip_serializing_if = "Option::is_none"
+    )]
+    expires_at: Option<DateTime<Utc>>,
+    outcome: Outcome,
+    #[serde(deserialize_with = "decode::rows::<_, _, 25000>")]
+    history: Vec<HistoryRow>,
+}
+redacted!(ExecutionRow);
+#[derive(Serialize, Deserialize)]
+#[serde(
+    deny_unknown_fields,
+    tag = "status",
+    rename_all = "SCREAMING_SNAKE_CASE",
+    rename_all_fields = "camelCase"
+)]
+enum Outcome {
+    Running {},
+    Succeeded {
+        #[serde(deserialize_with = "decode::text::<_, 262144>")]
+        output: String,
+    },
+    Failed {
+        #[serde(skip_serializing_if = "Option::is_none")]
+        #[serde(default, deserialize_with = "decode::optional_text::<_, 256>")]
+        error: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        #[serde(default, deserialize_with = "decode::optional_text::<_, 32768>")]
+        cause: Option<String>,
+    },
+    TimedOut {},
+    Aborted {
+        #[serde(skip_serializing_if = "Option::is_none")]
+        #[serde(default, deserialize_with = "decode::optional_text::<_, 256>")]
+        error: Option<String>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        #[serde(default, deserialize_with = "decode::optional_text::<_, 32768>")]
+        cause: Option<String>,
+    },
+}
+redacted!(Outcome);
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct NameRow {
+    #[serde(deserialize_with = "decode::text::<_, 256>")]
+    arn: String,
+    #[serde(
+        default,
+        deserialize_with = "decode::optional_time",
+        skip_serializing_if = "Option::is_none"
+    )]
+    expires_at: Option<DateTime<Utc>>,
+}
+redacted!(NameRow);
+
+pub(super) struct CapturedExecution {
+    pub(super) record: Arc<ExecutionRecord>,
+    pub(super) view: Arc<ExecutionView>,
+    pub(super) retention: Retention,
+}
+redacted!(CapturedExecution);
+/// In-memory ownership only; serialized DTOs never contain these handles.
+pub(super) struct SealedRegistry {
+    pub(super) scope: TenantScope,
+    pub(super) states: StateSupport,
+    pub(super) lambda: bool,
+    pub(super) callbacks: bool,
+    pub(super) clock: ClockSample,
+    pub(super) machines: BTreeMap<String, MachineSnapshot>,
+    pub(super) executions: Vec<CapturedExecution>,
+    pub(super) names: BTreeMap<String, Retention>,
+}
+redacted!(SealedRegistry);
+
+struct Budget {
+    remaining: usize,
+}
+redacted!(Budget);
+impl Budget {
+    fn charge(&mut self, bytes: usize) -> Result<(), RegistryError> {
+        self.remaining = self
+            .remaining
+            .checked_sub(bytes)
+            .ok_or(RegistryError::Capacity)?;
+        Ok(())
+    }
+    fn failure(&mut self, failure: &ExecutionFailure) -> Result<(), RegistryError> {
+        self.charge(failure.error().map_or(0, str::len))?;
+        self.charge(failure.cause().map_or(0, str::len))
+    }
+}
+struct Plan<'a> {
+    resources: BTreeMap<&'a str, &'a Arc<MachineIdentity>>,
+    revisions: BTreeMap<&'a str, (&'a str, &'a Arc<DefinitionRevision>)>,
+    budget: Budget,
+}
+impl fmt::Debug for Plan<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SnapshotPlan(<redacted>)")
+    }
+}
+impl<'a> Plan<'a> {
+    fn identity(&mut self, identity: &'a Arc<MachineIdentity>) -> Result<(), RegistryError> {
+        if let Some(existing) = self.resources.get(identity.resource.as_str()) {
+            if !Arc::ptr_eq(existing, identity) {
+                return Err(RegistryError::Validation);
+            }
+            return Ok(());
+        }
+        self.budget.charge(METADATA_BYTES)?;
+        self.resources.insert(&identity.resource, identity);
+        Ok(())
+    }
+    fn revision(
+        &mut self,
+        resource: &'a str,
+        revision: &'a Arc<DefinitionRevision>,
+    ) -> Result<(), RegistryError> {
+        if let Some((identity, existing)) = self.revisions.get(revision.id()) {
+            if *identity != resource || !Arc::ptr_eq(existing, revision) {
+                return Err(RegistryError::Validation);
+            }
+            return Ok(());
+        }
+        self.budget.charge(METADATA_BYTES)?;
+        self.budget
+            .charge(revision.machine().original_bytes().len())?;
+        self.budget.charge(revision.role().as_str().len())?;
+        self.revisions.insert(revision.id(), (resource, revision));
+        Ok(())
+    }
+    fn new(source: &'a SealedRegistry, limits: SnapshotLimits) -> Result<Self, RegistryError> {
+        let mut plan = Self {
+            resources: BTreeMap::new(),
+            revisions: BTreeMap::new(),
+            budget: Budget {
+                remaining: limits.bytes,
+            },
+        };
+        plan.budget.charge(METADATA_BYTES)?;
+        plan.budget.charge(source.scope.partition().len())?;
+        plan.budget.charge(source.scope.region().len())?;
+        plan.budget.charge(source.scope.account().len())?;
+        for machine in source.machines.values() {
+            plan.identity(&machine.identity)?;
+            plan.revision(machine.resource_id(), &machine.revision)?;
+            plan.budget.charge(METADATA_BYTES)?;
+            for (key, value) in machine.tags().values() {
+                plan.budget.charge(key.len())?;
+                plan.budget.charge(value.len())?;
+            }
+        }
+        for execution in &source.executions {
+            let record = &execution.record;
+            plan.identity(&record.identity.machine)?;
+            plan.revision(&record.identity.machine.resource, &record.revision)?;
+            plan.budget.charge(METADATA_BYTES)?;
+            plan.budget.charge(record.input.original_bytes().len())?;
+            plan.budget
+                .charge(record.identity.trace.as_ref().map_or(0, String::len))?;
+            plan.budget
+                .charge(execution.view.history().charged_bytes())?;
+            match execution.view.outcome().map(Arc::as_ref) {
+                Some(ExecutionOutcome::Succeeded(output)) => {
+                    plan.budget.charge(output.original_bytes().len())?;
+                }
+                Some(ExecutionOutcome::Failed(failure)) => plan.budget.failure(failure)?,
+                Some(ExecutionOutcome::Aborted(failure)) => {
+                    plan.budget.failure(failure.details())?;
+                }
+                Some(ExecutionOutcome::TimedOut) => {}
+                None => return Err(RegistryError::Unavailable),
+            }
+        }
+        plan.budget.charge(
+            source
+                .names
+                .len()
+                .checked_mul(NAME_BYTES)
+                .ok_or(RegistryError::Capacity)?,
+        )?;
+        Ok(plan)
+    }
+}
+fn text(bytes: &[u8]) -> Result<String, RegistryError> {
+    str::from_utf8(bytes)
+        .map(str::to_owned)
+        .map_err(|_| RegistryError::Validation)
+}
+fn outcome(view: &ExecutionView) -> Result<Outcome, RegistryError> {
+    Ok(
+        match view
+            .outcome()
+            .map(Arc::as_ref)
+            .ok_or(RegistryError::Unavailable)?
+        {
+            ExecutionOutcome::Succeeded(output) => Outcome::Succeeded {
+                output: text(output.original_bytes())?,
+            },
+            ExecutionOutcome::Failed(failure) => Outcome::Failed {
+                error: failure.error().map(str::to_owned),
+                cause: failure.cause().map(str::to_owned),
+            },
+            ExecutionOutcome::TimedOut => Outcome::TimedOut {},
+            ExecutionOutcome::Aborted(failure) => Outcome::Aborted {
+                error: failure.details().error().map(str::to_owned),
+                cause: failure.details().cause().map(str::to_owned),
+            },
+        },
+    )
+}
+fn history(source: &ExecutionHistory) -> Result<Vec<HistoryRow>, RegistryError> {
+    let count = usize::try_from(source.len()).map_err(|_| RegistryError::Validation)?;
+    let mut history = Vec::new();
+    history
+        .try_reserve_exact(count)
+        .map_err(|_| RegistryError::Capacity)?;
+    for event in source.snapshot_events()? {
+        history.push(HistoryRow {
+            timestamp: event.timestamp,
+            event_json: serde_json::to_string(event).map_err(|_| RegistryError::Validation)?,
+        });
+    }
+    Ok(history)
+}
+impl SealedRegistry {
+    fn expiry(&self, retention: Retention) -> Result<DateTime<Utc>, RegistryError> {
+        let remaining =
+            TimeDelta::from_std(retention.remaining(Instant::from_std(self.clock.monotonic))?)
+                .map_err(|_| RegistryError::Validation)?;
+        self.clock
+            .wall
+            .checked_add_signed(remaining)
+            .ok_or(RegistryError::Validation)
+    }
+    pub(super) fn export(&self, limits: SnapshotLimits) -> Result<RegistrySnapshot, RegistryError> {
+        let plan = Plan::new(self, limits)?;
+        let resources = plan
+            .resources
+            .values()
+            .map(|identity| ResourceRow {
+                resource_id: identity.resource.clone(),
+                arn: identity.arn.as_str().into(),
+                created_at: identity.created,
+            })
+            .collect();
+        let revisions = plan
+            .revisions
+            .values()
+            .map(|(resource, revision)| {
+                Ok(RevisionRow {
+                    revision_id: revision.id().into(),
+                    resource_id: (*resource).into(),
+                    definition: text(revision.machine().original_bytes())?,
+                    source_hash: *revision.source_hash(),
+                    role_arn: revision.role().as_str().into(),
+                    published_at: revision.publication_date(),
+                })
+            })
+            .collect::<Result<_, RegistryError>>()?;
+        let machines = self
+            .machines
+            .values()
+            .map(|machine| MachineRow {
+                resource_id: machine.resource_id().into(),
+                revision_id: machine.revision().id().into(),
+                status: machine.status().into(),
+                updated_at: machine.update_date(),
+                tags: machine.tags().values().clone(),
+            })
+            .collect();
+        let executions = self
+            .executions
+            .iter()
+            .map(|execution| {
+                let record = &execution.record;
+                Ok(ExecutionRow {
+                    arn: record.identity.arn.as_str().into(),
+                    resource_id: record.identity.machine.resource.clone(),
+                    revision_id: record.revision.id().into(),
+                    input: text(record.input.original_bytes())?,
+                    trace_header: record.identity.trace.clone(),
+                    started_at: record.identity.started,
+                    stopped_at: Some(
+                        execution
+                            .view
+                            .stop_date()
+                            .ok_or(RegistryError::Unavailable)?,
+                    ),
+                    expires_at: Some(self.expiry(execution.retention)?),
+                    outcome: outcome(&execution.view)?,
+                    history: history(execution.view.history())?,
+                })
+            })
+            .collect::<Result<_, RegistryError>>()?;
+        let names = self
+            .names
+            .iter()
+            .map(|(arn, closed)| {
+                Ok(NameRow {
+                    arn: arn.clone(),
+                    expires_at: Some(self.expiry(*closed)?),
+                })
+            })
+            .collect::<Result<_, RegistryError>>()?;
+        Ok(RegistrySnapshot {
+            schema_version: 1,
+            profile_version: 1,
+            scope: ScopeRow {
+                partition: self.scope.partition().into(),
+                region: self.scope.region().into(),
+                account: self.scope.account().into(),
+            },
+            state_support: self.states.into(),
+            lambda_support: self.lambda,
+            callback_support: self.callbacks,
+            captured_at: self.clock.wall,
+            resources,
+            revisions,
+            machines,
+            executions,
+            names,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{collections::BTreeMap, error::Error, sync::Arc, time::Duration};
+
+    use chrono::DateTime;
+    use rstest::rstest;
+    use rustack_stepfunctions_model::types::{HistoryEvent, HistoryEventType};
+    use tokio::time::Instant;
+
+    use super::{Budget, HistoryRow, Plan};
+    use crate::registry::{
+        RegistryError, RegistryLimits,
+        tests::{machine, registry},
+        types::MachineIdentity,
+    };
+
+    #[tokio::test]
+    async fn test_should_reject_inconsistent_identity_and_revision_bindings_before_copying()
+    -> Result<(), Box<dyn Error>> {
+        let (registry, mut owner) = registry(RegistryLimits::default(), None);
+        let machine = machine(&registry, 42, false).await;
+        let mut plan = Plan {
+            resources: BTreeMap::new(),
+            revisions: BTreeMap::new(),
+            budget: Budget {
+                remaining: 1024 * 1024,
+            },
+        };
+        plan.identity(&machine.identity)?;
+        let remaining = plan.budget.remaining;
+        plan.identity(&machine.identity)?;
+        assert_eq!(remaining, plan.budget.remaining);
+        let collision = Arc::new(MachineIdentity {
+            arn: machine.arn().clone(),
+            resource: machine.resource_id().into(),
+            created: machine.creation_date(),
+        });
+        assert!(matches!(
+            plan.identity(&collision),
+            Err(RegistryError::Validation)
+        ));
+        plan.revision(machine.resource_id(), machine.revision())?;
+        assert!(matches!(
+            plan.revision("different-resource", machine.revision()),
+            Err(RegistryError::Validation)
+        ));
+        owner
+            .shutdown(Instant::now() + Duration::from_secs(5))
+            .await?;
+        Ok(())
+    }
+
+    #[rstest]
+    #[case(123, 123_456_789)]
+    #[case(-1,123_456_789)]
+    fn test_should_preserve_nanosecond_history_through_real_cbor(
+        #[case] seconds: i64,
+        #[case] nanos: u32,
+    ) -> Result<(), Box<dyn Error>> {
+        let timestamp = DateTime::from_timestamp(seconds, nanos).ok_or("invalid test timestamp")?;
+        let event = HistoryEvent::builder()
+            .id(7)
+            .previous_event_id(Some(3))
+            .timestamp(timestamp)
+            .r#type(HistoryEventType::TaskStateEntered)
+            .build();
+        let mut direct = Vec::new();
+        ciborium::into_writer(&event, &mut direct)?;
+        assert!(ciborium::from_reader::<HistoryEvent, _>(direct.as_slice()).is_err());
+        let json = serde_json::to_string(&event)?;
+        let public: HistoryEvent = serde_json::from_str(&json)?;
+        assert_ne!(public.timestamp, timestamp);
+        let wrapper = HistoryRow {
+            timestamp,
+            event_json: json,
+        };
+        let mut bytes = Vec::new();
+        ciborium::into_writer(&wrapper, &mut bytes)?;
+        let decoded: HistoryRow = ciborium::from_reader(bytes.as_slice())?;
+        assert_eq!(decoded.timestamp, timestamp);
+        let mut restored: HistoryEvent = serde_json::from_str(&decoded.event_json)?;
+        restored.timestamp = decoded.timestamp;
+        assert_eq!(restored.timestamp, timestamp);
+        assert_eq!(restored.id, event.id);
+        assert_eq!(restored.previous_event_id, event.previous_event_id);
+        assert_eq!(
+            serde_json::to_string(&restored)?,
+            serde_json::to_string(&event)?
+        );
+        Ok(())
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/archive.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/archive.rs
new file mode 100644
index 00000000..6e50a963
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/archive.rs
@@ -0,0 +1,243 @@
+//! Move-only service archive parts; joining never grants runtime validity.
+
+use std::{collections::BTreeMap, mem};
+
+use serde::{Deserialize, Serialize};
+
+use super::{HistoryRow, RegistrySnapshot, decode};
+use crate::registry::{RegistryError, domain::redacted};
+
+/// Data-only schema1 registry metadata with histories in a separate keyed part.
+///
+/// Decode under the embedding's bounded redacting adapter. The inner document
+/// retains the original source/identity/payload bounds and redacted Debug.
+///
+/// ```no_run
+/// # fn split(document:rustack_stepfunctions_core::RegistrySnapshot)->Result<(),rustack_stepfunctions_core::RegistryError>{
+/// let (metadata, histories) = document.into_archive_parts()?;
+/// # Ok(()) }
+/// ```
+#[derive(Serialize, Deserialize)]
+#[serde(transparent)]
+#[non_exhaustive]
+pub struct RegistryMetadata(RegistrySnapshot);
+redacted!(RegistryMetadata);
+
+/// Versioned bounded keyed histories for a registry's service data archive.
+///
+/// No compiled state, credential, live handle or monotonic time is serialized.
+///
+/// ```no_run
+/// # fn join(metadata:rustack_stepfunctions_core::RegistryMetadata,histories:rustack_stepfunctions_core::RegistryHistories)->Result<(),rustack_stepfunctions_core::RegistryError>{
+/// let document=rustack_stepfunctions_core::RegistrySnapshot::from_archive_parts(metadata,histories)?;
+/// # Ok(()) }
+/// ```
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[non_exhaustive]
+pub struct RegistryHistories {
+    schema_version: u32,
+    #[serde(deserialize_with = "decode::rows::<_, _, 100000>")]
+    histories: Vec<ExecutionHistory>,
+}
+redacted!(RegistryHistories);
+
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct ExecutionHistory {
+    #[serde(deserialize_with = "decode::text::<_, 256>")]
+    arn: String,
+    #[serde(deserialize_with = "decode::rows::<_, _, 25000>")]
+    history: Vec<HistoryRow>,
+}
+redacted!(ExecutionHistory);
+
+impl RegistrySnapshot {
+    /// Move durable histories into a separately encoded service data part.
+    ///
+    /// This preserves the original schema1 metadata shape with empty histories.
+    /// The embedding owns bounded CPU/encoding and source-copy admission.
+    ///
+    /// # Errors
+    /// Rejects allocation failure; no partial parts escape.
+    ///
+    /// ```no_run
+    /// # fn split(document:rustack_stepfunctions_core::RegistrySnapshot){let parts=document.into_archive_parts();}
+    /// ```
+    pub fn into_archive_parts(
+        mut self,
+    ) -> Result<(RegistryMetadata, RegistryHistories), RegistryError> {
+        let mut histories = Vec::new();
+        histories
+            .try_reserve_exact(self.executions.len())
+            .map_err(|_| RegistryError::Capacity)?;
+        for execution in &mut self.executions {
+            let mut arn = String::new();
+            arn.try_reserve_exact(execution.arn.len())
+                .map_err(|_| RegistryError::Capacity)?;
+            arn.push_str(&execution.arn);
+            histories.push(ExecutionHistory {
+                arn,
+                history: mem::take(&mut execution.history),
+            });
+        }
+        Ok((
+            RegistryMetadata(self),
+            RegistryHistories {
+                schema_version: 1,
+                histories,
+            },
+        ))
+    }
+    /// Join one exact keyed history part before full registry preparation.
+    ///
+    /// This establishes cross-part shape only. The resulting document still
+    /// requires `Registry::prepare_snapshot` for domain/profile/quota validity.
+    ///
+    /// # Errors
+    /// Rejects unknown history schema, nonempty metadata histories, missing,
+    /// duplicate, orphan or ambiguous execution history bindings.
+    ///
+    /// ```no_run
+    /// # fn join(metadata:rustack_stepfunctions_core::RegistryMetadata,histories:rustack_stepfunctions_core::RegistryHistories){let document=rustack_stepfunctions_core::RegistrySnapshot::from_archive_parts(metadata,histories);}
+    /// ```
+    pub fn from_archive_parts(
+        metadata: RegistryMetadata,
+        histories: RegistryHistories,
+    ) -> Result<Self, RegistryError> {
+        let RegistryMetadata(mut document) = metadata;
+        if histories.schema_version != 1 || histories.histories.len() != document.executions.len() {
+            return Err(RegistryError::Validation);
+        }
+        let mut rows = BTreeMap::new();
+        for row in histories.histories {
+            if rows.insert(row.arn, row.history).is_some() {
+                return Err(RegistryError::Validation);
+            }
+        }
+        for execution in &mut document.executions {
+            if !execution.history.is_empty() {
+                return Err(RegistryError::Validation);
+            }
+            execution.history = rows
+                .remove(&execution.arn)
+                .ok_or(RegistryError::Validation)?;
+        }
+        if !rows.is_empty() {
+            return Err(RegistryError::Validation);
+        }
+        Ok(document)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::error::Error;
+
+    use rstest::rstest;
+    use serde::de::DeserializeOwned;
+    use serde_json::{Value, json};
+
+    use super::*;
+    use crate::{
+        RegistryCommand, RegistryLimits, RegistryResult, SnapshotLimits,
+        registry::tests::{deadline, machine, observe, registry, result, start},
+    };
+
+    type TestResult = Result<(), Box<dyn Error>>;
+    async fn document(empty: bool) -> Result<RegistrySnapshot, Box<dyn Error>> {
+        let (source, mut owner) = registry(RegistryLimits::default(), None);
+        if !empty {
+            machine(&source, 7, false).await;
+            observe(start(&source, "stored", " {\"raw\":1}\n").await?).await;
+            observe(start(&source, "other", "{}").await?).await;
+        }
+        owner.shutdown(deadline()).await?;
+        Ok(source.export_snapshot(SnapshotLimits::default())?)
+    }
+    fn cbor<T: Serialize + DeserializeOwned>(value: &T) -> Result<T, Box<dyn Error>> {
+        let mut bytes = Vec::new();
+        ciborium::into_writer(value, &mut bytes)?;
+        Ok(ciborium::from_reader(bytes.as_slice())?)
+    }
+    #[rstest]
+    #[case(false)]
+    #[case(true)]
+    #[tokio::test]
+    async fn test_should_round_trip_real_split_parts_and_restore(
+        #[case] empty: bool,
+    ) -> TestResult {
+        let document = document(empty).await?;
+        let expected = serde_json::to_value(&document)?;
+        let (metadata, histories) = document.into_archive_parts()?;
+        assert!(
+            metadata
+                .0
+                .executions
+                .iter()
+                .all(|execution| execution.history.is_empty())
+        );
+        let joined = RegistrySnapshot::from_archive_parts(cbor(&metadata)?, cbor(&histories)?)?;
+        assert_eq!(serde_json::to_value(&joined)?, expected);
+        let (target, mut owner) = registry(RegistryLimits::default(), None);
+        let prepared = target.prepare_snapshot(joined, SnapshotLimits::default())?;
+        assert!(matches!(
+            target.restore_snapshot(prepared)?.wait(deadline()).await?,
+            RegistryResult::Restored
+        ));
+        let RegistryResult::Machines(machines) = result(&target, RegistryCommand::Machines).await?
+        else {
+            return Err("missing restored list".into());
+        };
+        assert_eq!(machines.len(), usize::from(!empty));
+        owner.shutdown(deadline()).await?;
+        Ok(())
+    }
+    #[rstest]
+    #[case("schema")]
+    #[case("missing")]
+    #[case("orphan")]
+    #[case("duplicate")]
+    #[case("inline-history")]
+    #[tokio::test]
+    async fn test_should_reject_ambiguous_or_incomplete_parts(
+        #[case] corruption: &str,
+    ) -> TestResult {
+        let (metadata, histories) = document(false).await?.into_archive_parts()?;
+        let mut metadata = serde_json::to_value(metadata)?;
+        let mut histories = serde_json::to_value(histories)?;
+        match corruption {
+            "schema" => histories["schemaVersion"] = json!(2),
+            "missing" => histories["histories"] = json!([]),
+            "orphan" => {
+                histories["histories"][0]["arn"] =
+                    json!("arn:aws:states:us-east-1:000000000000:execution:Machine:orphan");
+            }
+            "duplicate" => {
+                let row = histories
+                    .pointer("/histories/0")
+                    .cloned()
+                    .ok_or("missing history")?;
+                histories
+                    .get_mut("histories")
+                    .and_then(Value::as_array_mut)
+                    .ok_or("missing rows")?
+                    .get_mut(1)
+                    .ok_or("missing second history")?
+                    .clone_from(&row);
+            }
+            "inline-history" => {
+                metadata["executions"][0]["history"] = histories["histories"][0]["history"].clone();
+            }
+            _ => return Err("unknown case".into()),
+        }
+        assert!(
+            RegistrySnapshot::from_archive_parts(
+                serde_json::from_value(metadata)?,
+                serde_json::from_value(histories)?
+            )
+            .is_err()
+        );
+        Ok(())
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/decode.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/decode.rs
new file mode 100644
index 00000000..09a4c545
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/decode.rs
@@ -0,0 +1,120 @@
+//! Absolute DTO bounds; domain validity is established by restore preparation.
+
+use std::{collections::BTreeMap, fmt, marker::PhantomData};
+
+use chrono::{DateTime, SecondsFormat, Utc};
+use serde::{
+    Deserialize, Deserializer,
+    de::{Error, IgnoredAny, MapAccess, SeqAccess, Visitor},
+};
+
+pub(super) struct Text<const MAX: usize>(pub(super) String);
+impl<const MAX: usize> fmt::Debug for Text<MAX> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("SnapshotText(<redacted>)")
+    }
+}
+impl<'de, const MAX: usize> Deserialize<'de> for Text<MAX> {
+    fn deserialize<D: Deserializer<'de>>(decoder: D) -> Result<Self, D::Error> {
+        text::<D, MAX>(decoder).map(Self)
+    }
+}
+pub(super) fn text<'de, D: Deserializer<'de>, const MAX: usize>(
+    decoder: D,
+) -> Result<String, D::Error> {
+    let value = String::deserialize(decoder)?;
+    if value.len() > MAX {
+        return Err(D::Error::custom("snapshot text limit exceeded"));
+    }
+    Ok(value)
+}
+pub(super) fn optional_text<'de, D: Deserializer<'de>, const MAX: usize>(
+    decoder: D,
+) -> Result<Option<String>, D::Error> {
+    Option::<Text<MAX>>::deserialize(decoder).map(|value| value.map(|value| value.0))
+}
+pub(super) fn time<'de, D: Deserializer<'de>>(decoder: D) -> Result<DateTime<Utc>, D::Error> {
+    instant::<D::Error>(&Text::<64>::deserialize(decoder)?.0)
+}
+fn instant<E: Error>(text: &str) -> Result<DateTime<Utc>, E> {
+    let value: DateTime<Utc> = text
+        .parse()
+        .map_err(|_| E::custom("invalid snapshot instant"))?;
+    if value.timestamp_subsec_nanos() >= 1_000_000_000
+        || value.to_rfc3339_opts(SecondsFormat::AutoSi, true) != text
+    {
+        return Err(E::custom("noncanonical snapshot instant"));
+    }
+    Ok(value)
+}
+pub(super) fn optional_time<'de, D: Deserializer<'de>>(
+    decoder: D,
+) -> Result<Option<DateTime<Utc>>, D::Error> {
+    Option::<Text<64>>::deserialize(decoder)?
+        .map(|text| instant::<D::Error>(&text.0))
+        .transpose()
+}
+#[derive(Debug)]
+struct Rows<T, const MAX: usize>(PhantomData<T>);
+impl<'de, T: Deserialize<'de>, const MAX: usize> Visitor<'de> for Rows<T, MAX> {
+    type Value = Vec<T>;
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("bounded snapshot rows")
+    }
+    fn visit_seq<A: SeqAccess<'de>>(self, mut sequence: A) -> Result<Self::Value, A::Error> {
+        if sequence.size_hint().is_some_and(|count| count > MAX) {
+            return Err(A::Error::custom("snapshot row limit exceeded"));
+        }
+        let mut rows = Vec::new();
+        rows.try_reserve_exact(sequence.size_hint().unwrap_or(0).min(1024))
+            .map_err(|_| A::Error::custom("snapshot allocation failed"))?;
+        loop {
+            if rows.len() == MAX {
+                if sequence.next_element::<IgnoredAny>()?.is_some() {
+                    return Err(A::Error::custom("snapshot row limit exceeded"));
+                }
+                return Ok(rows);
+            }
+            let Some(row) = sequence.next_element()? else {
+                return Ok(rows);
+            };
+            rows.try_reserve(1)
+                .map_err(|_| A::Error::custom("snapshot allocation failed"))?;
+            rows.push(row);
+        }
+    }
+}
+pub(super) fn rows<'de, D: Deserializer<'de>, T: Deserialize<'de>, const MAX: usize>(
+    decoder: D,
+) -> Result<Vec<T>, D::Error> {
+    decoder.deserialize_seq(Rows::<T, MAX>(PhantomData))
+}
+#[derive(Debug)]
+struct Tags;
+impl<'de> Visitor<'de> for Tags {
+    type Value = BTreeMap<String, String>;
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("bounded snapshot tags")
+    }
+    fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<Self::Value, A::Error> {
+        if map.size_hint().is_some_and(|count| count > 50) {
+            return Err(A::Error::custom("snapshot tag limit exceeded"));
+        }
+        let mut tags = BTreeMap::new();
+        while let Some(key) = map.next_key::<Text<128>>()? {
+            if tags.len() >= 50 {
+                return Err(A::Error::custom("snapshot tag limit exceeded"));
+            }
+            let value = map.next_value::<Text<256>>()?;
+            if tags.insert(key.0, value.0).is_some() {
+                return Err(A::Error::custom("duplicate snapshot tag"));
+            }
+        }
+        Ok(tags)
+    }
+}
+pub(super) fn tags<'de, D: Deserializer<'de>>(
+    decoder: D,
+) -> Result<BTreeMap<String, String>, D::Error> {
+    decoder.deserialize_map(Tags)
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore.rs
new file mode 100644
index 00000000..8779331e
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore.rs
@@ -0,0 +1,195 @@
+//! Exclusive startup preparation and fully charged actor replacement graphs.
+
+use std::{
+    collections::BTreeMap,
+    sync::{
+        Arc,
+        atomic::{AtomicU8, Ordering},
+    },
+};
+
+use tokio::sync::Semaphore;
+
+use super::{
+    super::{
+        Registry, RegistryError, RegistryLimits, RegistryReceipt, Shared, domain::redacted,
+        types::MachineSnapshot,
+    },
+    RegistrySnapshot, SnapshotLimits,
+};
+use crate::engine::HistoryRestorer;
+
+mod history;
+mod validate;
+
+use super::{
+    super::{Operation, actor::Entry, retention::Retention},
+    ProfileStates,
+};
+
+const OPEN: u8 = 0;
+const PREPARING: u8 = 1;
+const SERVING: u8 = 2;
+
+#[derive(Debug)]
+pub(in crate::registry) struct Pools {
+    pub(in crate::registry) revisions: Arc<Semaphore>,
+    pub(in crate::registry) tags: Arc<Semaphore>,
+    pub(in crate::registry) records: Arc<Semaphore>,
+}
+pub(in crate::registry) struct Admission {
+    pub(in crate::registry) pools: Pools,
+    pub(in crate::registry) history: HistoryRestorer,
+    pub(in crate::registry) limits: RegistryLimits,
+    phase: AtomicU8,
+}
+redacted!(Admission);
+impl Admission {
+    pub(in crate::registry) fn new(limits: RegistryLimits, history: HistoryRestorer) -> Self {
+        Self {
+            pools: Pools {
+                revisions: Arc::new(Semaphore::new(limits.capacities.revisions)),
+                tags: Arc::new(Semaphore::new(limits.capacities.revisions)),
+                records: Arc::new(Semaphore::new(limits.capacities.records)),
+            },
+            history,
+            limits,
+            phase: AtomicU8::new(OPEN),
+        }
+    }
+    pub(in crate::registry) fn business(&self) -> Result<(), RegistryError> {
+        match self
+            .phase
+            .compare_exchange(OPEN, SERVING, Ordering::AcqRel, Ordering::Acquire)
+        {
+            Ok(_) | Err(SERVING) => Ok(()),
+            _ => Err(RegistryError::Unavailable),
+        }
+    }
+    pub(in crate::registry) fn preparing(&self) -> bool {
+        self.phase.load(Ordering::Acquire) == PREPARING
+    }
+}
+struct Lease {
+    registry: Arc<Shared>,
+}
+redacted!(Lease);
+impl Lease {
+    fn claim(registry: Arc<Shared>) -> Result<Self, RegistryError> {
+        if *registry.closing.borrow()
+            || !registry.restore.history.fresh
+            || registry.restore.history.used() != 0
+        {
+            return Err(RegistryError::Unavailable);
+        }
+        registry
+            .restore
+            .phase
+            .compare_exchange(OPEN, PREPARING, Ordering::AcqRel, Ordering::Acquire)
+            .map_err(|_| RegistryError::Unavailable)?;
+        Ok(Self { registry })
+    }
+    fn committed(&self) {
+        self.registry
+            .restore
+            .phase
+            .store(SERVING, Ordering::Release);
+    }
+}
+impl Drop for Lease {
+    fn drop(&mut self) {
+        let _released = self.registry.restore.phase.compare_exchange(
+            PREPARING,
+            OPEN,
+            Ordering::AcqRel,
+            Ordering::Acquire,
+        );
+    }
+}
+
+pub(in crate::registry) struct Staged {
+    pub(in crate::registry) machines: BTreeMap<String, MachineSnapshot>,
+    pub(in crate::registry) records: BTreeMap<String, Entry>,
+    pub(in crate::registry) names: BTreeMap<String, Retention>,
+}
+redacted!(Staged);
+
+/// Fully validated, compiled and quota-charged startup replacement for one Registry.
+///
+/// The graph is declared before its lease so dropping it releases charges before
+/// reopening startup admission. This value cannot be cloned or serialized.
+///
+/// ```no_run
+/// # fn restore(registry:&rustack_stepfunctions_core::Registry,document:rustack_stepfunctions_core::RegistrySnapshot)->Result<(),rustack_stepfunctions_core::RegistryError>{
+/// let prepared=registry.prepare_snapshot(document,Default::default())?;
+/// let receipt=registry.restore_snapshot(prepared)?;
+/// # Ok(()) }
+/// ```
+#[non_exhaustive]
+pub struct PreparedSnapshot {
+    graph: Staged,
+    lease: Lease,
+}
+redacted!(PreparedSnapshot);
+impl PreparedSnapshot {
+    pub(in crate::registry) fn install(
+        self,
+        registry: &Arc<Shared>,
+    ) -> Result<Staged, RegistryError> {
+        if *registry.closing.borrow()
+            || !Arc::ptr_eq(registry, &self.lease.registry)
+            || !registry.restore.preparing()
+        {
+            return Err(RegistryError::Unavailable);
+        }
+        self.lease.committed();
+        Ok(self.graph)
+    }
+}
+impl Registry {
+    /// Validate/compile a bounded archive and reserve an exclusive startup graph.
+    ///
+    /// Call under the embedding caller's retained bounded CPU owner. Decode the
+    /// document with a bounded redacting adapter first; serde is not domain validity.
+    ///
+    /// # Errors
+    /// Rejects non-fresh/closed ownership, malformed or incompatible data, invalid
+    /// source/hash/history/references/expiry, and any copy/live quota exhaustion.
+    /// Failure leaves the namespace unchanged and releases the preparation lease.
+    ///
+    /// ```no_run
+    /// # fn prepare(registry:&rustack_stepfunctions_core::Registry,document:rustack_stepfunctions_core::RegistrySnapshot){let prepared=registry.prepare_snapshot(document,Default::default());}
+    /// ```
+    pub fn prepare_snapshot(
+        &self,
+        document: RegistrySnapshot,
+        limits: SnapshotLimits,
+    ) -> Result<PreparedSnapshot, RegistryError> {
+        let lease = Lease::claim(self.shared.clone())?;
+        let graph = validate::prepare(document, &self.shared, limits)?;
+        Ok(PreparedSnapshot { graph, lease })
+    }
+    /// Transfer a prepared exact-instance startup replacement to the actor once.
+    ///
+    /// The returned receipt observes the same accepted commit after caller loss.
+    ///
+    /// # Errors
+    /// Rejects foreign, closed or saturated admission without submitting a graph.
+    /// No prepared graph can be replayed or installed after business admission.
+    ///
+    /// ```no_run
+    /// # fn submit(registry:&rustack_stepfunctions_core::Registry,prepared:rustack_stepfunctions_core::PreparedSnapshot){let receipt=registry.restore_snapshot(prepared);}
+    /// ```
+    pub fn restore_snapshot(
+        &self,
+        prepared: PreparedSnapshot,
+    ) -> Result<RegistryReceipt, RegistryError> {
+        if !Arc::ptr_eq(&self.shared, &prepared.lease.registry) {
+            return Err(RegistryError::Validation);
+        }
+        self.submit_operation(Operation::Restore(prepared))
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/history.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/history.rs
new file mode 100644
index 00000000..bc2c8e55
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/history.rs
@@ -0,0 +1,420 @@
+//! Validate lossless official history data without granting runtime capability.
+
+use std::{collections::BTreeSet, fmt};
+
+use chrono::{DateTime, Utc};
+use rustack_core::json::{JsonLimits, validate};
+use rustack_stepfunctions_model::types::{HistoryEvent, HistoryEventType};
+use serde::{
+    Deserialize, Deserializer,
+    de::{Error, IgnoredAny, MapAccess, Visitor},
+};
+use serde_json::value::RawValue;
+
+use super::{
+    super::{HistoryRow, decode::Text},
+    ProfileStates, RegistryError,
+};
+use crate::{
+    ExecutionOutcome, FunctionArn, Payload, TenantScope, compiler::TASK_SECONDS_LIMIT,
+    engine::HistoryRestorer,
+};
+
+#[derive(Debug)]
+struct Details {
+    fields: BTreeSet<String>,
+    timeout: Option<i64>,
+    heartbeat: Option<i64>,
+    input_truncated: Option<bool>,
+    output_truncated: Option<bool>,
+    resource_type: Option<String>,
+    resource: Option<String>,
+    region: Option<String>,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct DataDetails {
+    truncated: bool,
+}
+#[derive(Debug)]
+struct DetailVisitor;
+impl<'de> Visitor<'de> for DetailVisitor {
+    type Value = Details;
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("bounded history details")
+    }
+    fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<Self::Value, A::Error> {
+        let mut result = Details {
+            fields: BTreeSet::new(),
+            timeout: None,
+            heartbeat: None,
+            input_truncated: None,
+            output_truncated: None,
+            resource_type: None,
+            resource: None,
+            region: None,
+        };
+        while let Some(key) = map.next_key::<String>()? {
+            if !result.fields.insert(key.clone()) {
+                return Err(A::Error::custom("duplicate history detail"));
+            }
+            match key.as_str() {
+                "input" | "output" | "parameters" => {
+                    if let Some(text) = map.next_value::<Option<Text<262_144>>>()? {
+                        Payload::parse(text.0.as_bytes())
+                            .map_err(|_| A::Error::custom("invalid history payload"))?;
+                    }
+                }
+                "error" => {
+                    map.next_value::<Option<Text<256>>>()?;
+                }
+                "cause" => {
+                    map.next_value::<Option<Text<32768>>>()?;
+                }
+                "name" => {
+                    map.next_value::<Option<Text<128>>>()?;
+                }
+                "roleArn" => {
+                    map.next_value::<Option<Text<2048>>>()?;
+                }
+                "resource" => {
+                    result.resource = map.next_value::<Option<Text<2048>>>()?.map(|value| value.0);
+                }
+                "resourceType" => {
+                    result.resource_type =
+                        map.next_value::<Option<Text<64>>>()?.map(|value| value.0);
+                }
+                "region" => {
+                    result.region = map.next_value::<Option<Text<64>>>()?.map(|value| value.0);
+                }
+                "index" | "length" => {
+                    if map
+                        .next_value::<Option<i64>>()?
+                        .is_some_and(|value| !(0..=1_000_000).contains(&value))
+                    {
+                        return Err(A::Error::custom("invalid history count"));
+                    }
+                }
+                "timeoutInSeconds" | "heartbeatInSeconds" => {
+                    let value = map.next_value::<Option<i64>>()?;
+                    if value
+                        .is_some_and(|value| !(1..=i64::from(TASK_SECONDS_LIMIT)).contains(&value))
+                    {
+                        return Err(A::Error::custom("invalid history timeout"));
+                    }
+                    if key == "timeoutInSeconds" {
+                        result.timeout = value;
+                    } else {
+                        result.heartbeat = value;
+                    }
+                }
+                "inputDetails" | "outputDetails" => {
+                    let details = map.next_value::<DataDetails>()?;
+                    if key == "inputDetails" {
+                        result.input_truncated = Some(details.truncated);
+                    } else {
+                        result.output_truncated = Some(details.truncated);
+                    }
+                }
+                _ => return Err(A::Error::custom("unsupported history detail field")),
+            }
+        }
+        Ok(result)
+    }
+}
+impl<'de> Deserialize<'de> for Details {
+    fn deserialize<D: Deserializer<'de>>(decoder: D) -> Result<Self, D::Error> {
+        decoder.deserialize_map(DetailVisitor)
+    }
+}
+#[derive(Debug)]
+struct Shape {
+    timestamp: Box<RawValue>,
+    detail: Option<(String, Details)>,
+}
+#[derive(Debug)]
+struct ShapeVisitor;
+impl<'de> Visitor<'de> for ShapeVisitor {
+    type Value = Shape;
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("one official history event")
+    }
+    fn visit_map<A: MapAccess<'de>>(self, mut map: A) -> Result<Self::Value, A::Error> {
+        let mut timestamp = None;
+        let mut detail = None;
+        while let Some(key) = map.next_key::<String>()? {
+            if key == "timestamp" {
+                if timestamp.is_some() {
+                    return Err(A::Error::custom("duplicate history timestamp"));
+                }
+                timestamp = Some(map.next_value()?);
+            } else if key.ends_with("EventDetails") {
+                if detail.is_some() {
+                    return Err(A::Error::custom("contradictory history details"));
+                }
+                detail = Some((key, map.next_value()?));
+            } else if matches!(key.as_str(), "id" | "previousEventId" | "type") {
+                map.next_value::<IgnoredAny>()?;
+            } else {
+                return Err(A::Error::custom("unsupported history event field"));
+            }
+        }
+        Ok(Shape {
+            timestamp: timestamp.ok_or_else(|| A::Error::custom("missing history timestamp"))?,
+            detail,
+        })
+    }
+}
+impl<'de> Deserialize<'de> for Shape {
+    fn deserialize<D: Deserializer<'de>>(decoder: D) -> Result<Self, D::Error> {
+        decoder.deserialize_map(ShapeVisitor)
+    }
+}
+fn projected_time(timestamp: DateTime<Utc>) -> Result<Box<RawValue>, RegistryError> {
+    let event = HistoryEvent::builder()
+        .id(0)
+        .timestamp(timestamp)
+        .r#type(HistoryEventType::ExecutionStarted)
+        .build();
+    let encoded = serde_json::to_vec(&event).map_err(|_| RegistryError::Validation)?;
+    let shape: Shape = serde_json::from_slice(&encoded).map_err(|_| RegistryError::Validation)?;
+    Ok(shape.timestamp)
+}
+fn detail(kind: &str) -> Result<Option<&'static str>, RegistryError> {
+    let name = match kind {
+        "ExecutionStarted" => "executionStartedEventDetails",
+        "ExecutionSucceeded" => "executionSucceededEventDetails",
+        "ExecutionFailed" => "executionFailedEventDetails",
+        "ExecutionTimedOut" => "executionTimedOutEventDetails",
+        "ExecutionAborted" => "executionAbortedEventDetails",
+        "PassStateEntered"
+        | "TaskStateEntered"
+        | "WaitStateEntered"
+        | "ChoiceStateEntered"
+        | "SucceedStateEntered"
+        | "FailStateEntered"
+        | "ParallelStateEntered"
+        | "MapStateEntered" => "stateEnteredEventDetails",
+        "PassStateExited"
+        | "TaskStateExited"
+        | "WaitStateExited"
+        | "ChoiceStateExited"
+        | "SucceedStateExited"
+        | "ParallelStateExited"
+        | "MapStateExited" => "stateExitedEventDetails",
+        "LambdaFunctionScheduled" => "lambdaFunctionScheduledEventDetails",
+        "LambdaFunctionSucceeded" => "lambdaFunctionSucceededEventDetails",
+        "LambdaFunctionFailed" => "lambdaFunctionFailedEventDetails",
+        "LambdaFunctionTimedOut" => "lambdaFunctionTimedOutEventDetails",
+        "LambdaFunctionScheduleFailed" => "lambdaFunctionScheduleFailedEventDetails",
+        "TaskScheduled" => "taskScheduledEventDetails",
+        "TaskStarted" => "taskStartedEventDetails",
+        "TaskSubmitted" => "taskSubmittedEventDetails",
+        "TaskSucceeded" => "taskSucceededEventDetails",
+        "TaskFailed" => "taskFailedEventDetails",
+        "TaskTimedOut" => "taskTimedOutEventDetails",
+        "TaskStartFailed" => "taskStartFailedEventDetails",
+        "MapStateStarted" => "mapStateStartedEventDetails",
+        "MapIterationStarted" => "mapIterationStartedEventDetails",
+        "MapIterationSucceeded" => "mapIterationSucceededEventDetails",
+        "MapIterationFailed" => "mapIterationFailedEventDetails",
+        "MapIterationAborted" => "mapIterationAbortedEventDetails",
+        "LambdaFunctionStarted"
+        | "ParallelStateStarted"
+        | "ParallelStateSucceeded"
+        | "ParallelStateFailed"
+        | "ParallelStateAborted"
+        | "MapStateSucceeded"
+        | "MapStateFailed"
+        | "MapStateAborted"
+        | "TaskStateAborted"
+        | "WaitStateAborted" => return Ok(None),
+        _ => return Err(RegistryError::Validation),
+    };
+    Ok(Some(name))
+}
+fn terminal(kind: &str) -> bool {
+    matches!(
+        kind,
+        "ExecutionSucceeded" | "ExecutionFailed" | "ExecutionTimedOut" | "ExecutionAborted"
+    )
+}
+#[derive(Debug)]
+pub(super) struct Profile<'a> {
+    pub(super) states: ProfileStates,
+    pub(super) lambda: bool,
+    pub(super) callbacks: bool,
+    pub(super) scope: &'a TenantScope,
+}
+fn fields(detail: &str) -> &'static [&'static str] {
+    match detail {
+        "executionStartedEventDetails" => &["input", "inputDetails", "roleArn"],
+        "executionSucceededEventDetails" | "lambdaFunctionSucceededEventDetails" => {
+            &["output", "outputDetails"]
+        }
+        "stateEnteredEventDetails" => &["name", "input", "inputDetails"],
+        "stateExitedEventDetails" => &["name", "output", "outputDetails"],
+        "lambdaFunctionScheduledEventDetails" => {
+            &["resource", "input", "inputDetails", "timeoutInSeconds"]
+        }
+        "taskScheduledEventDetails" => &[
+            "resourceType",
+            "resource",
+            "region",
+            "parameters",
+            "timeoutInSeconds",
+            "heartbeatInSeconds",
+        ],
+        "taskStartedEventDetails" => &["resourceType", "resource"],
+        "taskSubmittedEventDetails" | "taskSucceededEventDetails" => {
+            &["resourceType", "resource", "output", "outputDetails"]
+        }
+        "taskFailedEventDetails" | "taskTimedOutEventDetails" | "taskStartFailedEventDetails" => {
+            &["resourceType", "resource", "error", "cause"]
+        }
+        "mapStateStartedEventDetails" => &["length"],
+        "mapIterationStartedEventDetails"
+        | "mapIterationSucceededEventDetails"
+        | "mapIterationFailedEventDetails"
+        | "mapIterationAbortedEventDetails" => &["name", "index"],
+        _ => &["error", "cause"],
+    }
+}
+fn check_profile(kind: &str, shape: &Shape, profile: &Profile<'_>) -> Result<(), RegistryError> {
+    if ((kind.starts_with("Map") || kind.starts_with("Parallel"))
+        && matches!(profile.states, ProfileStates::Sequential))
+        || (kind.starts_with("LambdaFunction") && !profile.lambda)
+    {
+        return Err(RegistryError::Validation);
+    }
+    if detail(kind)? != shape.detail.as_ref().map(|(name, _)| name.as_str()) {
+        return Err(RegistryError::Validation);
+    }
+    if let Some((name, data)) = &shape.detail {
+        if data
+            .fields
+            .iter()
+            .any(|field| !fields(name).contains(&field.as_str()))
+        {
+            return Err(RegistryError::Validation);
+        }
+        if kind == "LambdaFunctionScheduled" {
+            FunctionArn::try_from((
+                data.resource.as_deref().ok_or(RegistryError::Validation)?,
+                profile.scope,
+            ))
+            .map_err(|_| RegistryError::Validation)?;
+        }
+        let callback = data.resource_type.as_deref() == Some("lambda")
+            && data.resource.as_deref() == Some("invoke.waitForTaskToken");
+        if data.input_truncated == Some(true)
+            || data
+                .output_truncated
+                .is_some_and(|value| value != (callback && kind == "TaskSubmitted"))
+            || data.heartbeat.is_some_and(|value| {
+                !callback || value >= data.timeout.unwrap_or(i64::from(TASK_SECONDS_LIMIT))
+            })
+        {
+            return Err(RegistryError::Validation);
+        }
+        if data
+            .region
+            .as_ref()
+            .is_some_and(|value| value != profile.scope.region())
+        {
+            return Err(RegistryError::Validation);
+        }
+        if let Some(resource_type) = &data.resource_type {
+            let resource = data.resource.as_deref().ok_or(RegistryError::Validation)?;
+            let valid = match resource_type.as_str() {
+                "lambda" => {
+                    profile.lambda
+                        && (resource == "invoke"
+                            || (resource == "invoke.waitForTaskToken" && profile.callbacks))
+                }
+                "states" => matches!(
+                    resource,
+                    "startExecution" | "startExecution.sync" | "startExecution.sync:2"
+                ),
+                _ => false,
+            };
+            if !valid {
+                return Err(RegistryError::Validation);
+            }
+        }
+    }
+    Ok(())
+}
+pub(super) fn validate_rows(
+    rows: Vec<HistoryRow>,
+    input: &str,
+    outcome: Option<&ExecutionOutcome>,
+    stopped: Option<DateTime<Utc>>,
+    profile: &Profile<'_>,
+) -> Result<Vec<HistoryEvent>, RegistryError> {
+    if rows.is_empty() || (outcome.is_some() && rows.len() < 2) {
+        return Err(RegistryError::Validation);
+    }
+    let mut events = Vec::new();
+    events
+        .try_reserve_exact(rows.len())
+        .map_err(|_| RegistryError::Capacity)?;
+    let count = rows.len();
+    for (index, row) in rows.into_iter().enumerate() {
+        if row.timestamp.timestamp_subsec_nanos() >= 1_000_000_000 {
+            return Err(RegistryError::Validation);
+        }
+        validate(
+            row.event_json.as_bytes(),
+            JsonLimits::new(2 * 1024 * 1024, 32, 65536, 1024 * 1024, 256)
+                .map_err(|_| RegistryError::Validation)?,
+        )
+        .map_err(|_| RegistryError::Validation)?;
+        let shape: Shape =
+            serde_json::from_str(&row.event_json).map_err(|_| RegistryError::Validation)?;
+        if shape.timestamp.get() != projected_time(row.timestamp)?.get() {
+            return Err(RegistryError::Validation);
+        }
+        let mut event: HistoryEvent =
+            serde_json::from_str(&row.event_json).map_err(|_| RegistryError::Validation)?;
+        event.timestamp = row.timestamp;
+        check_profile(event.r#type.as_str(), &shape, profile)?;
+        let id = i64::try_from(index.checked_add(1).ok_or(RegistryError::Validation)?)
+            .map_err(|_| RegistryError::Validation)?;
+        if event.id != id
+            || !event
+                .previous_event_id
+                .is_some_and(|prior| prior >= 0 && prior < id)
+        {
+            return Err(RegistryError::Validation);
+        }
+        if index == 0 {
+            if event.r#type.as_str() != "ExecutionStarted"
+                || event.previous_event_id != Some(0)
+                || event
+                    .execution_started_event_details
+                    .as_ref()
+                    .and_then(|details| details.input.as_deref())
+                    != Some(input)
+            {
+                return Err(RegistryError::Validation);
+            }
+        } else if event.r#type.as_str() == "ExecutionStarted" {
+            return Err(RegistryError::Validation);
+        }
+        if terminal(event.r#type.as_str()) != (index + 1 == count && outcome.is_some()) {
+            return Err(RegistryError::Validation);
+        }
+        events.push(event);
+    }
+    match (outcome, stopped) {
+        (Some(outcome), Some(stopped)) => HistoryRestorer::validate_terminal(
+            events.last().ok_or(RegistryError::Validation)?,
+            outcome,
+            stopped,
+        )?,
+        (None, None) => {}
+        _ => return Err(RegistryError::Validation),
+    }
+    Ok(events)
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests.rs
new file mode 100644
index 00000000..81a08107
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests.rs
@@ -0,0 +1,88 @@
+//! A prepared graph becomes visible once, without executing archived work.
+
+use std::error::Error;
+
+use serde_json::{Value, json};
+
+use super::super::{RegistrySnapshot, SnapshotLimits};
+use crate::{
+    ExecutionOutcome, Registry, RegistryCommand, RegistryLimits, RegistryResult,
+    registry::tests::{arn, deadline, machine, observe, registry, result, start},
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+async fn document() -> Result<RegistrySnapshot, Box<dyn Error>> {
+    let (source, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&source, 7, false).await;
+    observe(start(&source, "stored", " {\"n\":1}\n").await?).await;
+    owner.shutdown(deadline()).await?;
+    Ok(source.export_snapshot(SnapshotLimits::default())?)
+}
+async fn restored(registry: &Registry, snapshot: RegistrySnapshot) -> TestResult {
+    let prepared = registry.prepare_snapshot(snapshot, SnapshotLimits::default())?;
+    assert!(!registry.status().ready);
+    let mut receipt = registry.restore_snapshot(prepared)?;
+    assert!(matches!(
+        receipt.wait(deadline()).await?,
+        RegistryResult::Restored
+    ));
+    assert!(registry.status().ready);
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_round_trip_real_cbor_and_continue_with_a_new_execution() -> TestResult {
+    let snapshot = document().await?;
+    let before = serde_json::to_value(&snapshot)?;
+    let mut bytes = Vec::new();
+    ciborium::into_writer(&snapshot, &mut bytes)?;
+    let decoded: RegistrySnapshot = ciborium::from_reader(bytes.as_slice())?;
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    restored(&target, decoded).await?;
+    let saved_arn = before
+        .pointer("/executions/0/arn")
+        .and_then(Value::as_str)
+        .ok_or("missing saved ARN")?
+        .parse()?;
+    let RegistryResult::Execution(saved) =
+        result(&target, RegistryCommand::Execution(saved_arn)).await?
+    else {
+        return Err("missing restored execution".into());
+    };
+    assert_eq!(saved.input().original_bytes(), b" {\"n\":1}\n");
+    assert!(saved.record.deadline.is_none());
+    let new = observe(start(&target, "new", "{}").await?).await;
+    for execution in [&new, &saved] {
+        assert!(
+            matches!(execution.view().outcome().map(AsRef::as_ref), Some(ExecutionOutcome::Succeeded(payload)) if payload.value() == &json!(7))
+        );
+    }
+    assert!(matches!(
+        result(&target, RegistryCommand::Machine(arn())).await?,
+        RegistryResult::Machine(_)
+    ));
+    owner.shutdown(deadline()).await?;
+    let after = serde_json::to_value(target.export_snapshot(SnapshotLimits::default())?)?;
+    let old = after
+        .get("executions")
+        .and_then(Value::as_array)
+        .ok_or("missing restored rows")?
+        .iter()
+        .find(|row| row.get("arn") == before.pointer("/executions/0/arn"))
+        .ok_or("missing saved row")?;
+    assert_eq!(old.get("history"), before.pointer("/executions/0/history"));
+    assert_eq!(
+        old.get("outcome"),
+        Some(&json!({"status":"SUCCEEDED","output":"7"}))
+    );
+    Ok(())
+}
+
+#[path = "tests/admission.rs"]
+mod admission;
+#[path = "tests/retention.rs"]
+mod retention;
+#[path = "tests/validation.rs"]
+mod validation;
+
+#[path = "tests/history.rs"]
+mod history;
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/admission.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/admission.rs
new file mode 100644
index 00000000..92833773
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/admission.rs
@@ -0,0 +1,283 @@
+//! Startup lease, exact owner and retained accepted commit contracts.
+
+use std::{sync::Arc, time::Duration};
+
+use chrono::Utc;
+use tokio::{
+    task::yield_now,
+    time::{Instant, timeout_at},
+};
+
+use super::*;
+use crate::{
+    AslCompiler, CallbackAttempt, CallbackError, ChildError, ChildPattern, ChildStartParameters,
+    ClockSample, DriverStep, EvaluationContext, ExecutionDriver, ExecutionLimits, FrameCapacity,
+    FrameLimits, FrameScheduler, FrameUpdate, Payload, RegistryCapacities, RegistryError,
+    SystemUuidSource, TaskSupport, TenantScope,
+    registry::tests::{definition, role},
+};
+
+#[tokio::test]
+async fn test_should_release_prepared_quotas_before_reopening_startup() -> TestResult {
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    let revisions = target.shared.restore.pools.revisions.available_permits();
+    let records = target.shared.restore.pools.records.available_permits();
+    let tags = target.shared.restore.pools.tags.available_permits();
+    let prepared = target.prepare_snapshot(document().await?, SnapshotLimits::default())?;
+    assert!(!target.status().ready);
+    assert!(target.shared.restore.history.used() > 0);
+    assert_eq!(
+        target.shared.restore.pools.revisions.available_permits(),
+        revisions - 1
+    );
+    assert_eq!(
+        target.shared.restore.pools.records.available_permits(),
+        records - 1
+    );
+    assert_eq!(
+        target.shared.restore.pools.tags.available_permits(),
+        tags - 1
+    );
+    assert!(matches!(
+        target.submit(RegistryCommand::Machines),
+        Err(RegistryError::Unavailable)
+    ));
+    assert!(matches!(
+        target.prepare_snapshot(document().await?, SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    drop(prepared);
+    assert!(target.status().ready);
+    assert_eq!(target.shared.restore.history.used(), 0);
+    assert_eq!(
+        target.shared.restore.pools.revisions.available_permits(),
+        revisions
+    );
+    assert_eq!(
+        target.shared.restore.pools.records.available_permits(),
+        records
+    );
+    assert_eq!(target.shared.restore.pools.tags.available_permits(), tags);
+    restored(&target, document().await?).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_reject_foreign_preparation_and_release_its_source_lease() -> TestResult {
+    let (first, mut one) = registry(RegistryLimits::default(), None);
+    let (second, mut two) = registry(RegistryLimits::default(), None);
+    let prepared = first.prepare_snapshot(document().await?, SnapshotLimits::default())?;
+    assert!(matches!(
+        second.restore_snapshot(prepared),
+        Err(RegistryError::Validation)
+    ));
+    assert!(first.status().ready);
+    assert_eq!(first.shared.restore.history.used(), 0);
+    restored(&first, document().await?).await?;
+    restored(&second, document().await?).await?;
+    one.shutdown(deadline()).await?;
+    two.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_keep_startup_open_for_invalid_domain_but_close_after_valid_business()
+-> TestResult {
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    let foreign = "arn:aws:states:us-west-2:000000000000:stateMachine:Machine".parse()?;
+    assert!(target.submit(RegistryCommand::Machine(foreign)).is_err());
+    let prepared = target.prepare_snapshot(document().await?, SnapshotLimits::default())?;
+    drop(prepared);
+    assert!(
+        matches!(result(&target, RegistryCommand::Machines).await?, RegistryResult::Machines(rows) if rows.is_empty())
+    );
+    assert!(matches!(
+        target.prepare_snapshot(document().await?, SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_commit_after_receipt_loss_and_prevent_second_restore() -> TestResult {
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    let prepared = target.prepare_snapshot(document().await?, SnapshotLimits::default())?;
+    drop(target.restore_snapshot(prepared)?);
+    // Receipt loss releases observation only; this actor read is ordered after commit.
+    timeout_at(deadline(), async {
+        while !target.status().ready {
+            yield_now().await;
+        }
+    })
+    .await?;
+    assert!(matches!(
+        result(&target, RegistryCommand::Machine(arn())).await?,
+        RegistryResult::Machine(_)
+    ));
+    assert!(matches!(
+        target.prepare_snapshot(document().await?, SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_release_rejected_closed_or_saturated_preparation() -> TestResult {
+    for close in [false, true] {
+        let (target, mut owner) = registry(RegistryLimits::default(), None);
+        let prepared = target.prepare_snapshot(document().await?, SnapshotLimits::default())?;
+        let permit = target.shared.capacity.clone().try_acquire_many_owned(128)?;
+        if close {
+            owner.shutdown(deadline()).await?;
+        }
+        assert!(target.restore_snapshot(prepared).is_err());
+        assert_eq!(target.shared.restore.history.used(), 0);
+        assert!(!target.shared.restore.preparing());
+        drop(permit);
+        if !close {
+            restored(&target, document().await?).await?;
+            owner.shutdown(deadline()).await?;
+        }
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_hold_imported_revision_charge_through_caller_snapshot() -> TestResult {
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    restored(&target, document().await?).await?;
+    let RegistryResult::Machine(saved) = result(&target, RegistryCommand::Machine(arn())).await?
+    else {
+        return Err("missing machine".into());
+    };
+    let before = target.shared.restore.pools.revisions.available_permits();
+    result(&target, RegistryCommand::Update(arn(), None, Some(role()))).await?;
+    assert_eq!(
+        target.shared.restore.pools.revisions.available_permits(),
+        before - 1
+    );
+    // The old execution and this read view still retain the old revision.
+    assert_eq!(saved.revision().id().len(), 36);
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_rollback_partially_charged_replacement_on_quota_exhaustion() -> TestResult {
+    let (source, mut source_owner) = registry(RegistryLimits::default(), None);
+    machine(&source, 1, false).await;
+    observe(start(&source, "one", "{}").await?).await;
+    result(
+        &source,
+        RegistryCommand::Update(arn(), Some(definition(2, false)), None),
+    )
+    .await?;
+    observe(start(&source, "two", "{}").await?).await;
+    source_owner.shutdown(deadline()).await?;
+    let value = serde_json::to_value(source.export_snapshot(SnapshotLimits::default())?)?;
+    for capacities in [
+        RegistryCapacities::new(1, 1, 2, 2)?,
+        RegistryCapacities::new(1, 2, 1, 2)?,
+        RegistryCapacities::new(1, 2, 2, 1)?,
+    ] {
+        let limits = RegistryLimits::new(capacities, Duration::from_secs(60), 128)?;
+        let (target, mut owner) = registry(limits, None);
+        let before = [
+            target.shared.restore.pools.revisions.available_permits(),
+            target.shared.restore.pools.tags.available_permits(),
+            target.shared.restore.pools.records.available_permits(),
+        ];
+        assert!(matches!(
+            target.prepare_snapshot(
+                serde_json::from_value(value.clone())?,
+                SnapshotLimits::default()
+            ),
+            Err(RegistryError::Capacity)
+        ));
+        assert!(target.status().ready);
+        assert_eq!(target.shared.restore.history.used(), 0);
+        assert_eq!(
+            [
+                target.shared.restore.pools.revisions.available_permits(),
+                target.shared.restore.pools.tags.available_permits(),
+                target.shared.restore.pools.records.available_permits()
+            ],
+            before
+        );
+        restored(&target, document().await?).await?;
+        owner.shutdown(deadline()).await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_reject_restored_records_as_callback_and_child_parents() -> TestResult {
+    let snapshot = document().await?;
+    let execution = snapshot
+        .executions
+        .first()
+        .ok_or("missing execution")?
+        .arn
+        .parse()?;
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    restored(&target, snapshot).await?;
+    let RegistryResult::Execution(parent) =
+        result(&target, RegistryCommand::Execution(execution)).await?
+    else {
+        return Err("missing parent".into());
+    };
+    let parameters = ChildStartParameters::parse(
+        &TenantScope::default(),
+        &Payload::parse(
+            br#"{"StateMachineArn":"arn:aws:states:us-east-1:000000000000:stateMachine:Machine"}"#,
+        )?,
+    )?;
+    assert!(matches!(
+        target.child_port().start(
+            parent.child_parent(),
+            parameters,
+            ChildPattern::Sync2,
+            deadline()
+        ),
+        Err(ChildError::Invalid)
+    ));
+    let machine = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#)?.machine().clone();
+    let now = ClockSample::new(Instant::now().into_std(), Utc::now());
+    let driver = ExecutionDriver::for_structured_owner(
+        machine,
+        Payload::parse(b"{}")?,
+        EvaluationContext::from_value(&json!({}))?,
+        now,
+        ExecutionLimits::default(),
+    )?;
+    let mut frames = FrameScheduler::new(
+        driver,
+        Arc::new(FrameCapacity::default()),
+        FrameLimits::default(),
+    )?;
+    let mut source = SystemUuidSource::default();
+    let mut call = None;
+    for _ in 0..10 {
+        if let FrameUpdate::Transition(transition) = frames.advance(now, &mut source) {
+            if matches!(transition.step(), DriverStep::Dispatch(_)) {
+                call = transition.call();
+                break;
+            }
+        }
+    }
+    assert!(matches!(
+        CallbackAttempt::new(
+            &parent,
+            call.ok_or("missing call identity")?,
+            deadline(),
+            None
+        ),
+        Err(CallbackError::TaskTimedOut)
+    ));
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/history.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/history.rs
new file mode 100644
index 00000000..9007bbe2
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/history.rs
@@ -0,0 +1,335 @@
+//! Full causal history, immutable old incarnations and selected state profiles.
+
+use std::time::Duration;
+
+use super::*;
+use crate::{
+    AslCompiler, ExecutionLimits, ExecutionSupervisor, HistoryLimits, Payload, PreparedDefinition,
+    RuntimeLimits, StateSupport, Tags, TenantScope,
+    registry::{
+        snapshot::Outcome,
+        tests::{definition, role},
+    },
+};
+
+async fn exported_source(
+    definition: Value,
+    structured: bool,
+) -> Result<RegistrySnapshot, Box<dyn Error>> {
+    let support = if structured {
+        StateSupport::Structured
+    } else {
+        StateSupport::Sequential
+    };
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    let (source, mut owner) = Registry::new_with_state_support(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+        support,
+    )?;
+    let prepared = PreparedDefinition::new(
+        AslCompiler::default()
+            .with_state_support(support)
+            .compile(&serde_json::to_vec(&definition)?)?
+            .machine()
+            .clone(),
+    );
+    result(
+        &source,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    observe(
+        start(
+            &source,
+            "stored",
+            if structured { "[1,2]" } else { "{\"n\":0}" },
+        )
+        .await?,
+    )
+    .await;
+    owner.shutdown(deadline()).await?;
+    Ok(source.export_snapshot(SnapshotLimits::default())?)
+}
+#[tokio::test]
+async fn test_should_restore_full_history_beyond_api_pages_with_nanosecond_instants() -> TestResult
+{
+    let definition = json!({"StartAt":"P","States":{"P":{"Type":"Pass","Parameters":{"n.$":"States.MathAdd($.n,1)"},"Next":"C"},"C":{"Type":"Choice","Choices":[{"Variable":"$.n","NumericLessThan":600,"Next":"P"}],"Default":"D"},"D":{"Type":"Succeed"}}});
+    let snapshot = exported_source(definition, false).await?;
+    let expected = serde_json::to_value(&snapshot)?;
+    assert!(
+        snapshot
+            .executions
+            .first()
+            .ok_or("missing history")?
+            .history
+            .len()
+            > 1000
+    );
+    assert!(
+        snapshot
+            .executions
+            .first()
+            .ok_or("missing history")?
+            .history
+            .iter()
+            .any(|row| row.timestamp.timestamp_subsec_nanos() % 1_000_000 != 0)
+    );
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    restored(&target, snapshot).await?;
+    owner.shutdown(deadline()).await?;
+    let actual = serde_json::to_value(target.export_snapshot(SnapshotLimits::default())?)?;
+    assert_eq!(
+        actual.pointer("/executions/0/history"),
+        expected.pointer("/executions/0/history")
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_round_trip_structured_map_and_parallel_and_reject_weaker_target() -> TestResult
+{
+    let definition = json!({"StartAt":"P","States":{"P":{"Type":"Parallel","Branches":[{"StartAt":"M","States":{"M":{"Type":"Map","ItemsPath":"$","ItemProcessor":{"StartAt":"V","States":{"V":{"Type":"Pass","End":true}}},"End":true}}},{"StartAt":"D","States":{"D":{"Type":"Succeed"}}}],"End":true}}});
+    let snapshot = exported_source(definition, true).await?;
+    let stored = snapshot
+        .executions
+        .first()
+        .ok_or("missing structured execution")?;
+    assert!(matches!(stored.outcome, Outcome::Succeeded { .. }));
+    assert_eq!(
+        stored
+            .history
+            .iter()
+            .filter(|event| event.event_json.contains("MapIterationSucceeded"))
+            .count(),
+        2
+    );
+    let expected = serde_json::to_value(&snapshot)?;
+    let (weak, mut weak_owner) = registry(RegistryLimits::default(), None);
+    assert!(
+        weak.prepare_snapshot(snapshot, SnapshotLimits::default())
+            .is_err()
+    );
+    weak_owner.shutdown(deadline()).await?;
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    let (target, mut owner) = Registry::new_with_state_support(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+        StateSupport::Structured,
+    )?;
+    restored(&target, serde_json::from_value(expected.clone())?).await?;
+    owner.shutdown(deadline()).await?;
+    let actual = serde_json::to_value(target.export_snapshot(SnapshotLimits::default())?)?;
+    assert_eq!(
+        actual.pointer("/executions/0/history"),
+        expected.pointer("/executions/0/history")
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_preserve_recreated_identities_captured_source_roles_tags_and_trace()
+-> TestResult {
+    let (source, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&source, 1, false).await;
+    observe(start(&source, "old", "{}").await?).await;
+    result(&source, RegistryCommand::Delete(arn())).await?;
+    let RegistryResult::Machine(current) = result(
+        &source,
+        RegistryCommand::Create(
+            "Machine".parse()?,
+            definition(2, false),
+            "arn:aws:iam::000000000000:role/Updated".parse()?,
+            Tags::new(vec![("Team".into(), "测试".into())])?,
+        ),
+    )
+    .await?
+    else {
+        return Err("missing recreated machine".into());
+    };
+    let RegistryResult::Execution(new) = result(
+        &source,
+        RegistryCommand::Start(
+            arn(),
+            Some("current".parse()?),
+            Payload::parse(b" {\"raw\":1}\n")?,
+            Some("Root=trace\n".into()),
+        ),
+    )
+    .await?
+    else {
+        return Err("missing new execution".into());
+    };
+    observe(new).await;
+    owner.shutdown(deadline()).await?;
+    let snapshot = source.export_snapshot(SnapshotLimits::default())?;
+    let mut expected = serde_json::to_value(&snapshot)?;
+    assert_eq!(snapshot.resources.len(), 2);
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    restored(&target, snapshot).await?;
+    let RegistryResult::Machine(saved) = result(&target, RegistryCommand::Machine(arn())).await?
+    else {
+        return Err("missing restored current machine".into());
+    };
+    assert_eq!(saved.resource_id(), current.resource_id());
+    assert_eq!(
+        saved.revision().machine().original_bytes(),
+        current.revision().machine().original_bytes()
+    );
+    assert_eq!(
+        saved.revision().role().as_str(),
+        current.revision().role().as_str()
+    );
+    assert_eq!(saved.tags().values(), current.tags().values());
+    owner.shutdown(deadline()).await?;
+    let mut actual = serde_json::to_value(target.export_snapshot(SnapshotLimits::default())?)?;
+    // UTC expiry is projected from the current paired clock; event/identity instants remain exact.
+    for document in [&mut actual, &mut expected] {
+        for execution in document
+            .get_mut("executions")
+            .and_then(Value::as_array_mut)
+            .ok_or("missing executions")?
+        {
+            execution
+                .as_object_mut()
+                .ok_or("invalid execution")?
+                .remove("expiresAt");
+        }
+    }
+    for key in ["resources", "revisions", "machines", "executions"] {
+        assert_eq!(actual.get(key), expected.get(key));
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_reject_history_limit_without_retaining_partial_charges() -> TestResult {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::new(2, 1024 * 1024)?,
+        8 * 1024 * 1024,
+        None,
+    )?;
+    let (target, mut owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+    )?;
+    assert!(
+        target
+            .prepare_snapshot(document().await?, SnapshotLimits::default())
+            .is_err()
+    );
+    assert_eq!(target.shared.restore.history.used(), 0);
+    assert!(target.status().ready);
+    let mut interrupted = document().await?;
+    let row = interrupted
+        .executions
+        .first_mut()
+        .ok_or("missing execution")?;
+    row.history.pop();
+    row.outcome = Outcome::Running {};
+    row.stopped_at = None;
+    row.expires_at = None;
+    interrupted
+        .names
+        .first_mut()
+        .ok_or("missing name")?
+        .expires_at = None;
+    assert!(
+        target
+            .prepare_snapshot(interrupted, SnapshotLimits::default())
+            .is_err()
+    );
+    assert_eq!(target.shared.restore.history.used(), 0);
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_restore_failure_abort_and_timeout_outcomes_with_exact_terminal_history()
+-> TestResult {
+    for kind in ["failed", "aborted", "timed-out"] {
+        let limits = ExecutionLimits::new(Duration::from_secs(1), 100)?;
+        let runtime = ExecutionSupervisor::new(
+            RuntimeLimits::default(),
+            HistoryLimits::default(),
+            256 * 1024 * 1024,
+            None,
+        )?;
+        let (source, mut owner) = Registry::new(
+            TenantScope::default(),
+            RegistryLimits::default(),
+            runtime,
+            limits,
+        )?;
+        let value = if kind == "failed" {
+            json!({"StartAt":"F","States":{"F":{"Type":"Fail","Error":"","Cause":"explicit cause"}}})
+        } else {
+            json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":60,"End":true}}})
+        };
+        let prepared = PreparedDefinition::new(
+            AslCompiler::default()
+                .compile(&serde_json::to_vec(&value)?)?
+                .machine()
+                .clone(),
+        );
+        result(
+            &source,
+            RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+        )
+        .await?;
+        let execution = start(&source, "stored", "{}").await?;
+        if kind == "aborted" {
+            source
+                .stop(
+                    execution.arn().clone(),
+                    None,
+                    Some(String::new()),
+                    deadline(),
+                )
+                .await?;
+        }
+        observe(execution).await;
+        owner.shutdown(deadline()).await?;
+        let snapshot = source.export_snapshot(SnapshotLimits::default())?;
+        let expected = serde_json::to_value(&snapshot)?;
+        let expected_status = match kind {
+            "failed" => "FAILED",
+            "aborted" => "ABORTED",
+            _ => "TIMED_OUT",
+        };
+        assert_eq!(
+            expected.pointer("/executions/0/outcome/status"),
+            Some(&json!(expected_status))
+        );
+        let (target, mut owner) = registry(RegistryLimits::default(), None);
+        restored(&target, snapshot).await?;
+        owner.shutdown(deadline()).await?;
+        let actual = serde_json::to_value(target.export_snapshot(SnapshotLimits::default())?)?;
+        assert_eq!(
+            actual.pointer("/executions/0/outcome"),
+            expected.pointer("/executions/0/outcome")
+        );
+        assert_eq!(
+            actual.pointer("/executions/0/history"),
+            expected.pointer("/executions/0/history")
+        );
+    }
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/retention.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/retention.rs
new file mode 100644
index 00000000..1bb4d7dc
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/retention.rs
@@ -0,0 +1,182 @@
+//! Imported absolute retention and interrupted execution classification.
+
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use chrono::{DateTime, TimeDelta, Utc};
+use tokio::time::advance;
+
+use super::*;
+use crate::{
+    AslCompiler, ExecutionArn, LambdaTaskCommand, LambdaTaskPort, Payload, PreparedDefinition,
+    RegistryCapacities, RegistryError, Tags, TaskCall, TaskFailure, TaskSupport, TenantScope,
+    registry::{snapshot::Outcome, tests::role},
+};
+
+fn set_expiry(data: &mut Value, kind: &str, time: DateTime<Utc>) -> TestResult {
+    *data
+        .pointer_mut(&format!("/{kind}/0/expiresAt"))
+        .ok_or("missing expiry")? = json!(time);
+    Ok(())
+}
+fn saved_arn(data: &Value) -> Result<ExecutionArn, Box<dyn Error>> {
+    Ok(data
+        .pointer("/executions/0/arn")
+        .and_then(Value::as_str)
+        .ok_or("missing ARN")?
+        .parse()?)
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_preserve_imported_retention_across_changed_target_settings() -> TestResult {
+    for retention in [60, 172_800] {
+        let mut data = serde_json::to_value(document().await?)?;
+        set_expiry(&mut data, "executions", Utc::now() + TimeDelta::seconds(10))?;
+        set_expiry(&mut data, "names", Utc::now() + TimeDelta::seconds(30))?;
+        let arn = saved_arn(&data)?;
+        let limits = RegistryLimits::new(
+            RegistryCapacities::default(),
+            Duration::from_secs(retention),
+            128,
+        )?;
+        let (target, mut owner) = registry(limits, None);
+        restored(&target, serde_json::from_value(data)?).await?;
+        advance(Duration::from_secs(20)).await;
+        assert!(matches!(
+            result(&target, RegistryCommand::Execution(arn.clone())).await,
+            Err(RegistryError::ExecutionMissing)
+        ));
+        assert!(matches!(
+            start(&target, "stored", "{}").await,
+            Err(RegistryError::ExecutionExists)
+        ));
+        advance(Duration::from_secs(20)).await;
+        observe(start(&target, "stored", "{}").await?).await;
+        owner.shutdown(deadline()).await?;
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_validate_expired_rows_before_pruning_and_keep_unexpired_name() -> TestResult {
+    let mut data = serde_json::to_value(document().await?)?;
+    let now = Utc::now();
+    *data.get_mut("capturedAt").ok_or("missing capture")? = json!(now - TimeDelta::hours(2));
+    set_expiry(&mut data, "executions", now - TimeDelta::hours(1))?;
+    set_expiry(&mut data, "names", now + TimeDelta::hours(1))?;
+    let arn = saved_arn(&data)?;
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    let mut corrupt = data.clone();
+    *corrupt
+        .pointer_mut("/revisions/0/sourceHash")
+        .ok_or("missing hash")? = json!(vec![0; 32]);
+    assert!(
+        target
+            .prepare_snapshot(serde_json::from_value(corrupt)?, SnapshotLimits::default())
+            .is_err()
+    );
+    restored(&target, serde_json::from_value(data)?).await?;
+    assert!(matches!(
+        result(&target, RegistryCommand::Execution(arn)).await,
+        Err(RegistryError::ExecutionMissing)
+    ));
+    assert!(matches!(
+        start(&target, "stored", "{}").await,
+        Err(RegistryError::ExecutionExists)
+    ));
+    owner.shutdown(deadline()).await?;
+    let saved = serde_json::to_value(target.export_snapshot(SnapshotLimits::default())?)?;
+    assert_eq!(saved.get("executions"), Some(&json!([])));
+    assert_eq!(
+        saved.get("names").and_then(Value::as_array).map(Vec::len),
+        Some(1)
+    );
+    Ok(())
+}
+
+#[derive(Debug, Default)]
+pub(super) struct CountingPort(AtomicUsize);
+impl LambdaTaskPort for CountingPort {
+    fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        self.0.fetch_add(1, Ordering::SeqCst);
+        let (call, responder) = TaskCall::channel();
+        responder.finish(Ok(
+            Payload::parse(b"42").map_err(|_| TaskFailure::throttled())?
+        ));
+        Ok(call)
+    }
+}
+#[tokio::test]
+async fn test_should_abort_interrupted_snapshot_without_replaying_lambda() -> TestResult {
+    let port = Arc::new(CountingPort::default());
+    let (source, mut source_owner) = registry(RegistryLimits::default(), Some(port.clone()));
+    let definition = PreparedDefinition::new(AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#)?.machine().clone());
+    result(
+        &source,
+        RegistryCommand::Create("Machine".parse()?, definition, role(), Tags::default()),
+    )
+    .await?;
+    observe(start(&source, "stored", "{}").await?).await;
+    source_owner.shutdown(deadline()).await?;
+    assert_eq!(port.0.load(Ordering::SeqCst), 1);
+    let mut snapshot = source.export_snapshot(SnapshotLimits::default())?;
+    let row = snapshot.executions.first_mut().ok_or("missing execution")?;
+    row.outcome = Outcome::Running {};
+    row.stopped_at = None;
+    row.expires_at = None;
+    row.history.pop();
+    snapshot.names.first_mut().ok_or("missing name")?.expires_at = None;
+    let arn = row.arn.parse()?;
+    let (target, mut owner) = registry(RegistryLimits::default(), Some(port.clone()));
+    restored(&target, snapshot).await?;
+    let RegistryResult::Execution(saved) = result(&target, RegistryCommand::Execution(arn)).await?
+    else {
+        return Err("missing restored execution".into());
+    };
+    assert!(
+        matches!(saved.view().outcome().map(AsRef::as_ref), Some(ExecutionOutcome::Aborted(failure)) if failure.details().error() == Some("Rustack.ExecutionInterrupted"))
+    );
+    assert!(saved.record.deadline.is_none());
+    assert_eq!(port.0.load(Ordering::SeqCst), 1);
+    observe(start(&target, "new", "{}").await?).await;
+    assert_eq!(port.0.load(Ordering::SeqCst), 2);
+    owner.shutdown(deadline()).await?;
+    let captured = serde_json::to_value(target.export_snapshot(SnapshotLimits::default())?)?;
+    assert_eq!(
+        captured.pointer("/executions/1/outcome/error"),
+        Some(&json!("Rustack.ExecutionInterrupted"))
+    );
+    Ok(())
+}
+
+pub(super) async fn lambda_document(optimized: bool) -> Result<RegistrySnapshot, Box<dyn Error>> {
+    let port = Arc::new(CountingPort::default());
+    let (source, mut owner) = registry(RegistryLimits::default(), Some(port));
+    let state = if optimized {
+        json!({"Type":"Task","Resource":"arn:aws:states:::lambda:invoke","Parameters":{"FunctionName":"Worker","Payload":{}},"TimeoutSeconds":30,"End":true})
+    } else {
+        json!({"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","TimeoutSeconds":30,"End":true})
+    };
+    let prepared = PreparedDefinition::new(
+        AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+            .compile(&serde_json::to_vec(
+                &json!({"StartAt":"T","States":{"T":state}}),
+            )?)?
+            .machine()
+            .clone(),
+    );
+    result(
+        &source,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    observe(start(&source, "stored", "{}").await?).await;
+    owner.shutdown(deadline()).await?;
+    Ok(source.export_snapshot(SnapshotLimits::default())?)
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/validation.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/validation.rs
new file mode 100644
index 00000000..74d20b2a
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/tests/validation.rs
@@ -0,0 +1,404 @@
+//! Reject complete malformed archives without publishing or retaining allocations.
+
+use std::{str, sync::Arc};
+
+use chrono::{DateTime, TimeDelta, Utc};
+use rstest::rstest;
+
+use super::*;
+use crate::{
+    RegistryError,
+    registry::{
+        snapshot::{Outcome, decode},
+        tests::definition,
+    },
+};
+
+fn replace(value: &mut Value, path: &str, new: Value) -> TestResult {
+    *value.pointer_mut(path).ok_or("missing test field")? = new;
+    Ok(())
+}
+fn event(value: &mut Value, index: usize, change: impl FnOnce(&mut Value)) -> TestResult {
+    let path = format!("/executions/0/history/{index}/eventJson");
+    let slot = value.pointer_mut(&path).ok_or("missing event")?;
+    let mut data: Value = serde_json::from_str(slot.as_str().ok_or("missing JSON")?)?;
+    change(&mut data);
+    *slot = Value::String(serde_json::to_string(&data)?);
+    Ok(())
+}
+
+#[rstest]
+#[case("schema")]
+#[case("profile")]
+#[case("scope")]
+#[case("future")]
+#[case("callback")]
+#[case("uuid")]
+#[case("hash")]
+#[case("reference")]
+#[case("role")]
+#[case("duplicate-resource")]
+#[case("missing-name")]
+#[case("orphan-name")]
+#[case("name-too-long")]
+#[case("name-at-capture")]
+#[case("record-after-name")]
+#[case("terminal-running")]
+#[case("running-with-terminal")]
+#[case("history-id")]
+#[case("history-link")]
+#[case("history-input")]
+#[case("history-terminal")]
+#[case("history-timestamp")]
+#[case("unsupported-assignment")]
+#[case("unsupported-credentials")]
+#[case("unsupported-alias")]
+#[case("unsupported-version")]
+#[case("unsupported-truncation")]
+#[case("wrong-detail-field")]
+#[tokio::test]
+async fn test_should_reject_archive_corruption_atomically(#[case] corruption: &str) -> TestResult {
+    let mut data = serde_json::to_value(document().await?)?;
+    let captured = data.get("capturedAt").cloned().ok_or("missing capture")?;
+    match corruption {
+        "schema" => replace(&mut data, "/schemaVersion", json!(2))?,
+        "profile" => replace(&mut data, "/profileVersion", json!(2))?,
+        "scope" => replace(&mut data, "/scope/account", json!("111111111111"))?,
+        "future" => replace(
+            &mut data,
+            "/capturedAt",
+            json!(Utc::now() + TimeDelta::days(1)),
+        )?,
+        "callback" => replace(&mut data, "/callbackSupport", json!(true))?,
+        "uuid" => replace(
+            &mut data,
+            "/resources/0/resourceId",
+            json!("00000000-0000-0000-0000-000000000000"),
+        )?,
+        "hash" => replace(&mut data, "/revisions/0/sourceHash", json!(vec![0; 32]))?,
+        "reference" => replace(
+            &mut data,
+            "/executions/0/revisionId",
+            json!("877c106f-0c19-41c1-8bee-742f6032c101"),
+        )?,
+        "role" => replace(
+            &mut data,
+            "/revisions/0/roleArn",
+            json!("arn:aws:iam::111111111111:role/Worker"),
+        )?,
+        "duplicate-resource" => {
+            let row = data
+                .pointer("/resources/0")
+                .cloned()
+                .ok_or("missing resource")?;
+            data.get_mut("resources")
+                .and_then(Value::as_array_mut)
+                .ok_or("missing resources")?
+                .push(row);
+        }
+        "missing-name" => replace(&mut data, "/names", json!([]))?,
+        "orphan-name" => replace(
+            &mut data,
+            "/names",
+            json!([{"arn":"arn:aws:states:us-east-1:000000000000:execution:Machine:orphan"}]),
+        )?,
+        "name-too-long" => replace(
+            &mut data,
+            "/names/0/expiresAt",
+            json!(Utc::now() + TimeDelta::days(91)),
+        )?,
+        "name-at-capture" => replace(&mut data, "/names/0/expiresAt", captured)?,
+        "record-after-name" => replace(
+            &mut data,
+            "/names/0/expiresAt",
+            json!(Utc::now() + TimeDelta::hours(1)),
+        )?,
+        "terminal-running" => replace(
+            &mut data,
+            "/executions/0/outcome",
+            json!({"status":"RUNNING"}),
+        )?,
+        "running-with-terminal" => {
+            replace(
+                &mut data,
+                "/executions/0/outcome",
+                json!({"status":"RUNNING"}),
+            )?;
+            let row = data
+                .pointer_mut("/executions/0")
+                .and_then(Value::as_object_mut)
+                .ok_or("missing execution")?;
+            row.remove("stoppedAt");
+            row.remove("expiresAt");
+            data.pointer_mut("/names/0")
+                .and_then(Value::as_object_mut)
+                .ok_or("missing name")?
+                .remove("expiresAt");
+        }
+        "history-id" => event(&mut data, 1, |row| row["id"] = json!(9))?,
+        "history-link" => event(&mut data, 1, |row| row["previousEventId"] = json!(2))?,
+        "history-input" => event(&mut data, 0, |row| {
+            row["executionStartedEventDetails"]["input"] = json!("{}");
+        })?,
+        "history-terminal" => replace(&mut data, "/executions/0/outcome/output", json!("8"))?,
+        "history-timestamp" => event(&mut data, 0, |row| row["timestamp"] = json!(0))?,
+        "unsupported-assignment" => event(&mut data, 2, |row| {
+            row["stateExitedEventDetails"]["assignedVariables"] =
+                json!({"secret":"x".repeat(2048)});
+        })?,
+        "unsupported-credentials" => event(&mut data, 0, |row| {
+            row["executionStartedEventDetails"]["taskCredentials"] =
+                json!({"roleArn":"x".repeat(2049)});
+        })?,
+        "unsupported-alias" => event(&mut data, 0, |row| {
+            row["executionStartedEventDetails"]["stateMachineAliasArn"] = json!("x".repeat(2049));
+        })?,
+        "unsupported-version" => event(&mut data, 0, |row| {
+            row["executionStartedEventDetails"]["stateMachineVersionArn"] = json!("x".repeat(2049));
+        })?,
+        "unsupported-truncation" => event(&mut data, 0, |row| {
+            row["executionStartedEventDetails"]["inputDetails"]["extra"] = json!(true);
+        })?,
+        "wrong-detail-field" => event(&mut data, 1, |row| {
+            row["stateEnteredEventDetails"]["resource"] = json!("ignored");
+        })?,
+        _ => return Err("unknown case".into()),
+    }
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    // Some violations are rejected by bounded DTO decode, the rest by preparation.
+    let rejected = match serde_json::from_value::<RegistrySnapshot>(data) {
+        Ok(snapshot) => target
+            .prepare_snapshot(snapshot, SnapshotLimits::default())
+            .is_err(),
+        Err(_) => true,
+    };
+    assert!(rejected, "accepted corruption: {corruption}");
+    assert!(target.status().ready);
+    assert_eq!(target.shared.restore.history.used(), 0);
+    restored(&target, document().await?).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[rstest]
+#[case("/scope/partition", 17)]
+#[case("/resources/0/arn", 257)]
+#[case("/revisions/0/definition", 1_048_577)]
+#[case("/revisions/0/roleArn", 2049)]
+#[case("/executions/0/input", 262_145)]
+#[case("/executions/0/traceHeader", 257)]
+#[case("/executions/0/outcome/output", 262_145)]
+#[case("/executions/0/history/0/eventJson", 2_097_153)]
+#[tokio::test]
+async fn test_should_bound_snapshot_text_during_decode(
+    #[case] path: &str,
+    #[case] length: usize,
+) -> TestResult {
+    let mut data = serde_json::to_value(document().await?)?;
+    if path.ends_with("traceHeader") {
+        data.pointer_mut("/executions/0")
+            .and_then(Value::as_object_mut)
+            .ok_or("missing execution")?
+            .insert("traceHeader".into(), json!(""));
+    }
+    replace(&mut data, path, json!("x".repeat(length)))?;
+    assert!(serde_json::from_value::<RegistrySnapshot>(data).is_err());
+    Ok(())
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+struct InstantRow {
+    #[serde(deserialize_with = "decode::time")]
+    required: DateTime<Utc>,
+    #[serde(default, deserialize_with = "decode::optional_time")]
+    optional: Option<DateTime<Utc>>,
+}
+#[rstest]
+#[case("2026-10-25T01:02:03Z")]
+#[case("2026-10-25T01:02:03.123456789Z")]
+#[case("1960-01-01T00:00:00.000000001Z")]
+#[case("+12345-01-01T00:00:00Z")]
+#[case("-0001-01-01T00:00:00Z")]
+fn test_should_round_trip_exact_canonical_instant_cbor(#[case] text: &str) -> TestResult {
+    let row: InstantRow = serde_json::from_value(json!({"required":text,"optional":text}))?;
+    let mut bytes = Vec::new();
+    ciborium::into_writer(&row, &mut bytes)?;
+    let decoded: InstantRow = ciborium::from_reader(bytes.as_slice())?;
+    assert_eq!(row.required, decoded.required);
+    assert_eq!(row.optional, decoded.optional);
+    assert_eq!(
+        serde_json::to_value(decoded)?.get("required"),
+        Some(&json!(text))
+    );
+    Ok(())
+}
+#[rstest]
+#[case("2026-10-25T01:02:03.1234567891Z")]
+#[case("2026-10-25T01:02:03.123456789000000000000000000000000000000000000000000000000Z")]
+#[case("2026-10-25T01:02:03.1230Z")]
+#[case("2026-10-25T01:02:03+00:00")]
+#[case("2016-12-31T23:59:60Z")]
+fn test_should_reject_lossy_or_noncanonical_required_and_optional_instants(#[case] text: &str) {
+    for data in [
+        json!({"required":text}),
+        json!({"required":"2026-10-25T01:02:03Z","optional":text}),
+    ] {
+        assert!(serde_json::from_value::<InstantRow>(data).is_err());
+    }
+}
+
+#[tokio::test]
+async fn test_should_reject_copy_budget_without_closing_startup() -> TestResult {
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    assert!(matches!(
+        target.prepare_snapshot(document().await?, SnapshotLimits::try_from(1)?),
+        Err(RegistryError::Capacity)
+    ));
+    restored(&target, document().await?).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({"status":"RUNNING","output":"null"}))]
+#[case(json!({"status":"TIMED_OUT","error":"foreign"}))]
+#[case(json!({"status":"SUCCEEDED","output":"null","error":"foreign"}))]
+#[case(json!({"status":"FAILED","output":"null"}))]
+fn test_should_reject_contradictory_outcome_fields(#[case] value: Value) {
+    assert!(serde_json::from_value::<Outcome>(value).is_err());
+}
+
+#[rstest]
+#[case(false, "credentials")]
+#[case(true, "credentials")]
+#[case(false, "resource")]
+#[case(false, "foreign")]
+#[case(false, "timeout")]
+#[case(true, "timeout")]
+#[case(true, "heartbeat")]
+#[case(true, "noncallback-heartbeat")]
+#[tokio::test]
+async fn test_should_reject_broad_task_fields_and_invalid_scoped_lambda_resources(
+    #[case] optimized: bool,
+    #[case] corruption: &str,
+) -> TestResult {
+    let mut data = serde_json::to_value(retention::lambda_document(optimized).await?)?;
+    let detail = if optimized {
+        "taskScheduledEventDetails"
+    } else {
+        "lambdaFunctionScheduledEventDetails"
+    };
+    event(&mut data, 2, |row| {
+        let fields = &mut row[detail];
+        match corruption {
+            "credentials" => fields["taskCredentials"] = json!({"roleArn":"x".repeat(2049)}),
+            "resource" => fields["resource"] = json!("not-an-arn"),
+            "foreign" => {
+                fields["resource"] = json!("arn:aws:lambda:us-west-2:000000000000:function:Worker");
+            }
+            "timeout" => fields["timeoutInSeconds"] = json!(0),
+            "heartbeat" => fields["heartbeatInSeconds"] = json!(0),
+            "noncallback-heartbeat" => fields["heartbeatInSeconds"] = json!(2),
+            _ => {}
+        }
+    })?;
+    let (target, mut owner) = registry(
+        RegistryLimits::default(),
+        Some(Arc::new(retention::CountingPort::default())),
+    );
+    assert!(
+        target
+            .prepare_snapshot(serde_json::from_value(data)?, SnapshotLimits::default())
+            .is_err()
+    );
+    assert_eq!(target.shared.restore.history.used(), 0);
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_validate_source_profile_even_when_target_is_stronger() -> TestResult {
+    let (target, mut owner) = registry(
+        RegistryLimits::default(),
+        Some(Arc::new(retention::CountingPort::default())),
+    );
+    let mut data = serde_json::to_value(retention::lambda_document(false).await?)?;
+    replace(&mut data, "/lambdaSupport", json!(false))?;
+    assert!(
+        target
+            .prepare_snapshot(serde_json::from_value(data)?, SnapshotLimits::default())
+            .is_err()
+    );
+    restored(&target, document().await?).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_bound_snapshot_collections_and_reject_unknown_fields_during_decode()
+-> TestResult {
+    let data = serde_json::to_value(document().await?)?;
+    let mut excess = data.clone();
+    let row = data
+        .pointer("/resources/0")
+        .cloned()
+        .ok_or("missing resource")?;
+    replace(&mut excess, "/resources", json!(vec![row; 4097]))?;
+    assert!(serde_json::from_value::<RegistrySnapshot>(excess).is_err());
+    let mut unknown = data.clone();
+    unknown
+        .as_object_mut()
+        .ok_or("invalid root")?
+        .insert("secretField".into(), json!("private"));
+    assert!(serde_json::from_value::<RegistrySnapshot>(unknown).is_err());
+    // Embedding adapters redact serde diagnostics; domain debug never prints archive data.
+    assert!(!format!("{:?}", document().await?).contains("stored"));
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_validate_history_against_source_profile_independently_of_definition()
+-> TestResult {
+    let mut snapshot = retention::lambda_document(false).await?;
+    snapshot.lambda_support = false;
+    let pure = definition(42, false);
+    let revision = snapshot.revisions.first_mut().ok_or("missing revision")?;
+    revision.definition = str::from_utf8(pure.machine.original_bytes())?.to_owned();
+    revision.source_hash = pure.hash;
+    let (target, mut owner) = registry(
+        RegistryLimits::default(),
+        Some(Arc::new(retention::CountingPort::default())),
+    );
+    assert!(
+        target
+            .prepare_snapshot(snapshot, SnapshotLimits::default())
+            .is_err()
+    );
+    assert!(target.status().ready);
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_bound_name_only_expiry_and_reject_duplicate_tags() -> TestResult {
+    let mut snapshot = document().await?;
+    snapshot.resources.clear();
+    snapshot.revisions.clear();
+    snapshot.machines.clear();
+    snapshot.executions.clear();
+    snapshot.names.first_mut().ok_or("missing name")?.expires_at =
+        Some(snapshot.captured_at + TimeDelta::days(91));
+    let (target, mut owner) = registry(RegistryLimits::default(), None);
+    assert!(
+        target
+            .prepare_snapshot(snapshot, SnapshotLimits::default())
+            .is_err()
+    );
+    let encoded = serde_json::to_string(&document().await?)?;
+    let duplicate = encoded.replace("\"tags\":{}", "\"tags\":{\"Team\":\"A\",\"Team\":\"B\"}");
+    assert_ne!(encoded, duplicate);
+    assert!(serde_json::from_str::<RegistrySnapshot>(&duplicate).is_err());
+    restored(&target, document().await?).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/validate.rs b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/validate.rs
new file mode 100644
index 00000000..4daa009e
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/snapshot/restore/validate.rs
@@ -0,0 +1,656 @@
+//! Complete archive validation and pure quota-reserved replacement construction.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    str,
+    sync::Arc,
+    time::Duration,
+};
+
+use chrono::{DateTime, TimeDelta, Utc};
+use rustack_stepfunctions_model::types::HistoryEvent;
+use tokio::time::Instant;
+use uuid::{Uuid, Variant};
+
+use super::{
+    super::{
+        super::{
+            DefinitionRevision, ExecutionArn, MachineSnapshot, MachineStatus, PreparedDefinition,
+            RegistryError, RoleArn, Shared, StateMachineArn, Tags,
+            actor::Entry,
+            child::Lineage,
+            domain::{redacted, same_scope},
+            retention::Retention,
+            types::{
+                ExecutionIdentity, ExecutionRecord, MachineIdentity, RevisionData, TagAllocation,
+            },
+        },
+        Availability, Budget, ExecutionRow, METADATA_BYTES, MachineRow, NAME_BYTES, NameRow,
+        Outcome, ProfileStates, RegistrySnapshot, ResourceRow, RevisionRow, SnapshotLimits,
+    },
+    Staged,
+    history::{Profile as HistoryProfile, validate_rows},
+};
+use crate::{
+    AslCompiler, ClockSample, ExecutionFailure, ExecutionOutcome, Payload, StateSupport,
+    TaskFailure, TaskSupport, TenantScope, engine::HistoryRestorer,
+};
+
+const NAME_RETENTION: Duration = Duration::from_hours(2160);
+struct Context {
+    scope: TenantScope,
+    states: ProfileStates,
+    lambda: bool,
+    callbacks: bool,
+    captured: DateTime<Utc>,
+}
+redacted!(Context);
+struct RevisionInput {
+    resource: String,
+    definition: PreparedDefinition,
+    role: RoleArn,
+    published: DateTime<Utc>,
+}
+redacted!(RevisionInput);
+struct MachineInput {
+    resource: String,
+    revision: String,
+    updated: DateTime<Utc>,
+    tags: Tags,
+    active: bool,
+}
+redacted!(MachineInput);
+struct ExecutionInput {
+    identity: ExecutionIdentity,
+    revision: String,
+    input: Payload,
+    stopped: Option<DateTime<Utc>>,
+    expires: Option<DateTime<Utc>>,
+    outcome: Option<ExecutionOutcome>,
+    history: Vec<HistoryEvent>,
+}
+redacted!(ExecutionInput);
+struct Validated {
+    context: Context,
+    resources: BTreeMap<String, Arc<MachineIdentity>>,
+    revisions: BTreeMap<String, RevisionInput>,
+    machines: Vec<MachineInput>,
+    executions: Vec<ExecutionInput>,
+    names: BTreeMap<String, Option<DateTime<Utc>>>,
+}
+redacted!(Validated);
+fn time(value: DateTime<Utc>) -> Result<(), RegistryError> {
+    if value.timestamp_subsec_nanos() >= 1_000_000_000 {
+        return Err(RegistryError::Validation);
+    }
+    Ok(())
+}
+fn expiry(value: DateTime<Utc>, captured: DateTime<Utc>) -> Result<(), RegistryError> {
+    time(value)?;
+    let maximum = captured
+        .checked_add_signed(TimeDelta::hours(2160))
+        .ok_or(RegistryError::Validation)?;
+    if value <= captured || value > maximum {
+        return Err(RegistryError::Validation);
+    }
+    Ok(())
+}
+fn identifier(value: &str) -> Result<(), RegistryError> {
+    let parsed = Uuid::parse_str(value).map_err(|_| RegistryError::Validation)?;
+    if parsed.get_version_num() != 4
+        || parsed.get_variant() != Variant::RFC4122
+        || parsed.to_string() != value
+    {
+        return Err(RegistryError::Validation);
+    }
+    Ok(())
+}
+fn budget(document: &RegistrySnapshot, limits: SnapshotLimits) -> Result<(), RegistryError> {
+    let mut budget = Budget {
+        remaining: limits.bytes,
+    };
+    budget.charge(METADATA_BYTES)?;
+    budget.charge(document.scope.partition.len())?;
+    budget.charge(document.scope.region.len())?;
+    budget.charge(document.scope.account.len())?;
+    for count in [
+        document.resources.len(),
+        document.revisions.len(),
+        document.machines.len(),
+        document.executions.len(),
+    ] {
+        budget.charge(
+            count
+                .checked_mul(METADATA_BYTES)
+                .ok_or(RegistryError::Capacity)?,
+        )?;
+    }
+    budget.charge(
+        document
+            .names
+            .len()
+            .checked_mul(NAME_BYTES)
+            .ok_or(RegistryError::Capacity)?,
+    )?;
+    for revision in &document.revisions {
+        budget.charge(revision.definition.len())?;
+        budget.charge(revision.role_arn.len())?;
+    }
+    for machine in &document.machines {
+        for (key, value) in &machine.tags {
+            budget.charge(key.len())?;
+            budget.charge(value.len())?;
+        }
+    }
+    for execution in &document.executions {
+        budget.charge(execution.input.len())?;
+        budget.charge(execution.trace_header.as_ref().map_or(0, String::len))?;
+        match &execution.outcome {
+            Outcome::Succeeded { output } => budget.charge(output.len())?,
+            Outcome::Failed { error, cause } | Outcome::Aborted { error, cause } => {
+                budget.charge(error.as_ref().map_or(0, String::len))?;
+                budget.charge(cause.as_ref().map_or(0, String::len))?;
+            }
+            Outcome::Running {} | Outcome::TimedOut {} => {}
+        }
+        budget.charge(HistoryRestorer::estimate(
+            execution.history.iter().map(|event| event.event_json.len()),
+            !matches!(execution.outcome, Outcome::Running {}),
+        )?)?;
+    }
+    Ok(())
+}
+impl Context {
+    fn new(document: &RegistrySnapshot, shared: &Shared) -> Result<Self, RegistryError> {
+        if document.schema_version != 1
+            || document.profile_version != 1
+            || (document.callback_support && !document.lambda_support)
+        {
+            return Err(RegistryError::Validation);
+        }
+        let scope = TenantScope::new(
+            &document.scope.partition,
+            &document.scope.region,
+            &document.scope.account,
+        )?;
+        if !same_scope(&scope, &shared.scope) {
+            return Err(RegistryError::Validation);
+        }
+        time(document.captured_at)?;
+        if document.captured_at > Utc::now() {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self {
+            scope,
+            states: document.state_support,
+            lambda: document.lambda_support,
+            callbacks: document.callback_support,
+            captured: document.captured_at,
+        })
+    }
+    fn compatible(&self, shared: &Shared) -> Result<(), RegistryError> {
+        if (matches!(self.states, ProfileStates::Structured)
+            && shared.states != StateSupport::Structured)
+            || (self.lambda && !shared.restore.history.lambda)
+            || (self.callbacks && shared.callbacks.is_none())
+        {
+            return Err(RegistryError::Validation);
+        }
+        Ok(())
+    }
+    fn compiler(&self) -> AslCompiler {
+        AslCompiler::new(
+            self.scope.clone(),
+            if self.lambda {
+                TaskSupport::Lambda
+            } else {
+                TaskSupport::Disabled
+            },
+        )
+        .with_state_support(match self.states {
+            ProfileStates::Sequential => StateSupport::Sequential,
+            ProfileStates::Structured => StateSupport::Structured,
+        })
+        .with_child_support(true)
+        .with_callback_support(self.callbacks)
+    }
+}
+fn resources(
+    rows: Vec<ResourceRow>,
+    context: &Context,
+) -> Result<BTreeMap<String, Arc<MachineIdentity>>, RegistryError> {
+    let mut resources = BTreeMap::new();
+    for row in rows {
+        identifier(&row.resource_id)?;
+        time(row.created_at)?;
+        let arn: StateMachineArn = row.arn.parse()?;
+        arn.check(&context.scope)?;
+        let identity = Arc::new(MachineIdentity {
+            arn,
+            resource: row.resource_id.clone(),
+            created: row.created_at,
+        });
+        if resources.insert(row.resource_id, identity).is_some() {
+            return Err(RegistryError::Validation);
+        }
+    }
+    Ok(resources)
+}
+fn revisions(
+    rows: Vec<RevisionRow>,
+    context: &Context,
+    resources: &BTreeMap<String, Arc<MachineIdentity>>,
+) -> Result<BTreeMap<String, RevisionInput>, RegistryError> {
+    let compiler = context.compiler();
+    let mut revisions = BTreeMap::new();
+    for row in rows {
+        identifier(&row.revision_id)?;
+        time(row.published_at)?;
+        if !resources.contains_key(&row.resource_id) {
+            return Err(RegistryError::Validation);
+        }
+        let role: RoleArn = row.role_arn.parse()?;
+        role.check(&context.scope)?;
+        let definition = PreparedDefinition::new(
+            compiler
+                .compile(row.definition.as_bytes())
+                .map_err(|_| RegistryError::Validation)?
+                .machine()
+                .clone(),
+        );
+        if definition.hash != row.source_hash {
+            return Err(RegistryError::Validation);
+        }
+        if revisions
+            .insert(
+                row.revision_id,
+                RevisionInput {
+                    resource: row.resource_id,
+                    definition,
+                    role,
+                    published: row.published_at,
+                },
+            )
+            .is_some()
+        {
+            return Err(RegistryError::Validation);
+        }
+    }
+    Ok(revisions)
+}
+fn names(
+    rows: Vec<NameRow>,
+    context: &Context,
+) -> Result<BTreeMap<String, Option<DateTime<Utc>>>, RegistryError> {
+    let mut names = BTreeMap::new();
+    for row in rows {
+        let arn: ExecutionArn = row.arn.parse()?;
+        arn.machine().check(&context.scope)?;
+        if let Some(value) = row.expires_at {
+            expiry(value, context.captured)?;
+        }
+        if names.insert(arn.as_str().into(), row.expires_at).is_some() {
+            return Err(RegistryError::Validation);
+        }
+    }
+    Ok(names)
+}
+fn machines(
+    rows: Vec<MachineRow>,
+    resources: &BTreeMap<String, Arc<MachineIdentity>>,
+    revisions: &BTreeMap<String, RevisionInput>,
+) -> Result<Vec<MachineInput>, RegistryError> {
+    let mut machines = Vec::new();
+    let mut arns = BTreeSet::new();
+    for row in rows {
+        time(row.updated_at)?;
+        let resource = resources
+            .get(&row.resource_id)
+            .ok_or(RegistryError::Validation)?;
+        let revision = revisions
+            .get(&row.revision_id)
+            .ok_or(RegistryError::Validation)?;
+        if revision.resource != row.resource_id
+            || revision.published != row.updated_at
+            || !arns.insert(resource.arn.as_str())
+        {
+            return Err(RegistryError::Validation);
+        }
+        let tags = if row.tags.is_empty() {
+            Tags::default()
+        } else {
+            Tags::new(row.tags.into_iter().collect())?
+        };
+        machines.push(MachineInput {
+            resource: row.resource_id,
+            revision: row.revision_id,
+            updated: row.updated_at,
+            tags,
+            active: matches!(row.status, Availability::Active),
+        });
+    }
+    Ok(machines)
+}
+fn outcome(value: Outcome) -> Result<Option<ExecutionOutcome>, RegistryError> {
+    Ok(match value {
+        Outcome::Running {} => None,
+        Outcome::Succeeded { output } => Some(ExecutionOutcome::Succeeded(Payload::parse(
+            output.as_bytes(),
+        )?)),
+        Outcome::Failed { error, cause } => Some(ExecutionOutcome::Failed(
+            ExecutionFailure::fields(error, cause),
+        )),
+        Outcome::Aborted { error, cause } => Some(ExecutionOutcome::Aborted(TaskFailure(
+            ExecutionFailure::fields(error, cause),
+        ))),
+        Outcome::TimedOut {} => Some(ExecutionOutcome::TimedOut),
+    })
+}
+fn executions(
+    rows: Vec<ExecutionRow>,
+    context: &Context,
+    resources: &BTreeMap<String, Arc<MachineIdentity>>,
+    revisions: &BTreeMap<String, RevisionInput>,
+    names: &BTreeMap<String, Option<DateTime<Utc>>>,
+) -> Result<Vec<ExecutionInput>, RegistryError> {
+    let profile = HistoryProfile {
+        states: context.states,
+        lambda: context.lambda,
+        callbacks: context.callbacks,
+        scope: &context.scope,
+    };
+    let mut executions = Vec::new();
+    let mut arns = BTreeSet::new();
+    let mut pending_names = BTreeSet::new();
+    for row in rows {
+        time(row.started_at)?;
+        if let Some(stopped) = row.stopped_at {
+            time(stopped)?;
+        }
+        let resource = resources
+            .get(&row.resource_id)
+            .ok_or(RegistryError::Validation)?;
+        let revision = revisions
+            .get(&row.revision_id)
+            .ok_or(RegistryError::Validation)?;
+        let arn: ExecutionArn = row.arn.parse()?;
+        if revision.resource != row.resource_id
+            || arn.machine().as_str() != resource.arn.as_str()
+            || !arns.insert(arn.as_str().to_owned())
+        {
+            return Err(RegistryError::Validation);
+        }
+        let name = names.get(arn.as_str()).ok_or(RegistryError::Validation)?;
+        let result = outcome(row.outcome)?;
+        match (result.is_some(), row.stopped_at, row.expires_at, *name) {
+            (true, Some(_), Some(record), Some(name)) => {
+                expiry(record, context.captured)?;
+                if record > name {
+                    return Err(RegistryError::Validation);
+                }
+            }
+            (false, None, None, None) => {
+                pending_names.insert(arn.as_str().to_owned());
+            }
+            _ => return Err(RegistryError::Validation),
+        }
+        let input = Payload::parse(row.input.as_bytes())?;
+        if row
+            .trace_header
+            .as_ref()
+            .is_some_and(|value| !value.is_ascii())
+        {
+            return Err(RegistryError::Validation);
+        }
+        let history = validate_rows(
+            row.history,
+            &row.input,
+            result.as_ref(),
+            row.stopped_at,
+            &profile,
+        )?;
+        if history
+            .first()
+            .and_then(|event| event.execution_started_event_details.as_ref())
+            .and_then(|details| details.role_arn.as_deref())
+            .is_some_and(|role| role != revision.role.as_str())
+        {
+            return Err(RegistryError::Validation);
+        }
+        executions.push(ExecutionInput {
+            identity: ExecutionIdentity {
+                arn,
+                machine: resource.clone(),
+                started: row.started_at,
+                trace: row.trace_header,
+            },
+            revision: row.revision_id,
+            input,
+            stopped: row.stopped_at,
+            expires: row.expires_at,
+            outcome: result,
+            history,
+        });
+    }
+    if names
+        .iter()
+        .any(|(arn, expiry)| expiry.is_none() && !pending_names.contains(arn))
+    {
+        return Err(RegistryError::Validation);
+    }
+    Ok(executions)
+}
+fn references(data: &Validated) -> Result<(), RegistryError> {
+    let mut resources = BTreeSet::new();
+    let mut revisions = BTreeSet::new();
+    for machine in &data.machines {
+        resources.insert(machine.resource.as_str());
+        revisions.insert(machine.revision.as_str());
+    }
+    for execution in &data.executions {
+        resources.insert(execution.identity.machine.resource.as_str());
+        revisions.insert(execution.revision.as_str());
+    }
+    if resources.len() != data.resources.len() || revisions.len() != data.revisions.len() {
+        return Err(RegistryError::Validation);
+    }
+    Ok(())
+}
+fn until(value: DateTime<Utc>, clock: ClockSample) -> Result<Retention, RegistryError> {
+    let remaining = value
+        .signed_duration_since(clock.wall)
+        .to_std()
+        .map_err(|_| RegistryError::Validation)?;
+    Ok(Retention::Until(
+        Instant::from_std(clock.monotonic)
+            .checked_add(remaining)
+            .ok_or(RegistryError::Validation)?,
+    ))
+}
+fn after(value: Duration, clock: ClockSample) -> Result<Retention, RegistryError> {
+    Ok(Retention::Until(
+        Instant::from_std(clock.monotonic)
+            .checked_add(value)
+            .ok_or(RegistryError::Validation)?,
+    ))
+}
+fn stage_revisions(
+    rows: BTreeMap<String, RevisionInput>,
+    needed: &BTreeSet<&str>,
+    shared: &Shared,
+) -> Result<BTreeMap<String, Arc<DefinitionRevision>>, RegistryError> {
+    let mut revisions = BTreeMap::new();
+    for (id, row) in rows {
+        if needed.contains(id.as_str()) {
+            let permit = shared
+                .restore
+                .pools
+                .revisions
+                .clone()
+                .try_acquire_owned()
+                .map_err(|_| RegistryError::Capacity)?;
+            revisions.insert(
+                id.clone(),
+                Arc::new(DefinitionRevision {
+                    data: RevisionData {
+                        id,
+                        machine: row.definition.machine,
+                        role: row.role,
+                        hash: row.definition.hash,
+                        published: row.published,
+                    },
+                    _permit: permit,
+                }),
+            );
+        }
+    }
+    Ok(revisions)
+}
+fn stage_names(
+    rows: BTreeMap<String, Option<DateTime<Utc>>>,
+    shared: &Shared,
+    clock: ClockSample,
+) -> Result<BTreeMap<String, Retention>, RegistryError> {
+    let mut names = BTreeMap::new();
+    for (arn, expiry) in rows {
+        let retention = match expiry {
+            Some(expiry) if expiry > clock.wall => until(expiry, clock)?,
+            Some(_) => continue,
+            None => after(NAME_RETENTION, clock)?,
+        };
+        if names.len() >= shared.restore.limits.capacities.names {
+            return Err(RegistryError::Capacity);
+        }
+        names.insert(arn, retention);
+    }
+    Ok(names)
+}
+impl Validated {
+    fn stage(self, shared: &Shared) -> Result<Staged, RegistryError> {
+        let clock = ClockSample::new(Instant::now().into_std(), Utc::now());
+        if self.context.captured > clock.wall {
+            return Err(RegistryError::Validation);
+        }
+        let executions: Vec<_> = self
+            .executions
+            .into_iter()
+            .filter(|entry| entry.expires.is_none_or(|expiry| expiry > clock.wall))
+            .collect();
+        let machines: Vec<_> = self
+            .machines
+            .into_iter()
+            .filter(|entry| entry.active)
+            .collect();
+        let mut needed = BTreeSet::new();
+        for entry in &executions {
+            needed.insert(entry.revision.as_str());
+        }
+        for entry in &machines {
+            needed.insert(entry.revision.as_str());
+        }
+        if machines.len() > shared.restore.limits.capacities.machines {
+            return Err(RegistryError::Capacity);
+        }
+        let revisions = stage_revisions(self.revisions, &needed, shared)?;
+        let mut staged = Staged {
+            machines: BTreeMap::new(),
+            records: BTreeMap::new(),
+            names: BTreeMap::new(),
+        };
+        for row in machines {
+            let identity = self
+                .resources
+                .get(&row.resource)
+                .ok_or(RegistryError::Validation)?
+                .clone();
+            let permit = shared
+                .restore
+                .pools
+                .tags
+                .clone()
+                .try_acquire_owned()
+                .map_err(|_| RegistryError::Capacity)?;
+            staged.machines.insert(
+                identity.arn.as_str().into(),
+                MachineSnapshot {
+                    identity,
+                    updated: row.updated,
+                    status: MachineStatus::Active,
+                    revision: revisions
+                        .get(&row.revision)
+                        .ok_or(RegistryError::Validation)?
+                        .clone(),
+                    tags: Arc::new(TagAllocation {
+                        value: row.tags,
+                        _permit: permit,
+                    }),
+                },
+            );
+        }
+        staged.names = stage_names(self.names, shared, clock)?;
+        for row in executions {
+            let retention = match row.expires {
+                Some(expiry) => until(expiry, clock)?,
+                None => after(shared.restore.limits.retention, clock)?,
+            };
+            let permit = shared
+                .restore
+                .pools
+                .records
+                .clone()
+                .try_acquire_owned()
+                .map_err(|_| RegistryError::Capacity)?;
+            let handle = shared.restore.history.terminal(
+                row.history,
+                row.outcome,
+                row.stopped,
+                clock.wall,
+            )?;
+            let arn = row.identity.arn.as_str().to_owned();
+            let record = Arc::new(ExecutionRecord {
+                lineage: Lineage::default(),
+                deadline: None,
+                identity: row.identity,
+                input: row.input,
+                revision: revisions
+                    .get(&row.revision)
+                    .ok_or(RegistryError::Validation)?
+                    .clone(),
+                handle,
+                _permit: permit,
+            });
+            staged.records.insert(arn, Entry { record, retention });
+        }
+        Ok(staged)
+    }
+}
+pub(super) fn prepare(
+    document: RegistrySnapshot,
+    shared: &Shared,
+    limits: SnapshotLimits,
+) -> Result<Staged, RegistryError> {
+    budget(&document, limits)?;
+    let context = Context::new(&document, shared)?;
+    context.compatible(shared)?;
+    let resources = resources(document.resources, &context)?;
+    let revisions = revisions(document.revisions, &context, &resources)?;
+    let names = names(document.names, &context)?;
+    let machines = machines(document.machines, &resources, &revisions)?;
+    let executions = executions(
+        document.executions,
+        &context,
+        &resources,
+        &revisions,
+        &names,
+    )?;
+    let data = Validated {
+        context,
+        resources,
+        revisions,
+        machines,
+        executions,
+        names,
+    };
+    references(&data)?;
+    data.stage(shared)
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/tests.rs b/crates/rustack-stepfunctions-core/src/registry/tests.rs
new file mode 100644
index 00000000..38865c65
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/tests.rs
@@ -0,0 +1,1007 @@
+//! Domain and actual registry/execution lifecycle regressions.
+
+use std::{error::Error, sync::Arc, time::Duration};
+
+use proptest::prelude::*;
+use rstest::rstest;
+use serde_json::json;
+use tokio::{
+    sync::mpsc,
+    time::{Instant, timeout},
+};
+
+use super::*;
+use crate::{
+    AslCompiler, ExecutionError, ExecutionOutcome, FrameCapacity, FrameLimits, HistoryLimits,
+    LambdaTaskCommand, LambdaTaskPort, RuntimeLimits, StateSupport, StateView, TaskCall,
+    TaskFailure, TaskResponder, TaskSupport,
+};
+
+#[path = "tests/children.rs"]
+mod children;
+#[path = "tests/nested.rs"]
+mod nested;
+#[path = "tests/snapshot.rs"]
+mod snapshot;
+
+pub(super) fn deadline() -> Instant {
+    Instant::now() + Duration::from_secs(5)
+}
+pub(super) fn role() -> RoleArn {
+    "arn:aws:iam::000000000000:role/service-role/Worker"
+        .parse()
+        .unwrap()
+}
+pub(super) fn arn() -> StateMachineArn {
+    "arn:aws:states:us-east-1:000000000000:stateMachine:Machine"
+        .parse()
+        .unwrap()
+}
+pub(super) fn definition(value: i64, wait: bool) -> PreparedDefinition {
+    let states = if wait {
+        json!({"StartAt":"Wait","States":{"Wait":{"Type":"Wait","Seconds":60,"Next":"Done"},"Done":{"Type":"Pass","Result":value,"End":true}}})
+    } else {
+        json!({"StartAt":"Done","States":{"Done":{"Type":"Pass","Result":value,"End":true}}})
+    };
+    PreparedDefinition::new(
+        AslCompiler::default()
+            .compile(&serde_json::to_vec(&states).unwrap())
+            .unwrap()
+            .machine()
+            .clone(),
+    )
+}
+pub(super) fn registry(
+    limits: RegistryLimits,
+    port: Option<Arc<dyn LambdaTaskPort>>,
+) -> (Registry, RegistrySupervisor) {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        port,
+    )
+    .unwrap();
+    Registry::new(
+        TenantScope::default(),
+        limits,
+        runtime,
+        ExecutionLimits::default(),
+    )
+    .unwrap()
+}
+pub(super) async fn result(
+    reg: &Registry,
+    command: RegistryCommand,
+) -> Result<RegistryResult, RegistryError> {
+    reg.submit(command)?.wait(deadline()).await
+}
+pub(super) async fn machine(reg: &Registry, value: i64, wait: bool) -> MachineSnapshot {
+    match result(
+        reg,
+        RegistryCommand::Create(
+            "Machine".parse().unwrap(),
+            definition(value, wait),
+            role(),
+            Tags::default(),
+        ),
+    )
+    .await
+    .unwrap()
+    {
+        RegistryResult::Machine(machine) => machine,
+        _ => panic!("expected machine"),
+    }
+}
+pub(super) async fn start(
+    reg: &Registry,
+    name: &str,
+    input: &str,
+) -> Result<ExecutionSnapshot, RegistryError> {
+    match result(
+        reg,
+        RegistryCommand::Start(
+            arn(),
+            Some(name.parse().unwrap()),
+            Payload::parse(input.as_bytes()).unwrap(),
+            None,
+        ),
+    )
+    .await?
+    {
+        RegistryResult::Execution(execution) => Ok(execution),
+        _ => Err(RegistryError::Unavailable),
+    }
+}
+pub(super) async fn observe(mut snapshot: ExecutionSnapshot) -> ExecutionSnapshot {
+    snapshot.view = snapshot.handle().wait(deadline()).await.unwrap();
+    snapshot
+}
+#[rstest]
+#[case("")]
+#[case("a b")]
+#[case("a:b")]
+#[case("中文")]
+#[case("a/b")]
+#[case("a\n")]
+fn test_should_reject_invalid_domain_names(#[case] value: &str) {
+    assert!(value.parse::<StateMachineName>().is_err());
+    assert!(value.parse::<ExecutionName>().is_err());
+}
+#[rstest]
+#[case("arn:aws:states:us-east-1:000000000000:stateMachine:M:alias")]
+#[case("arn:aws:states:us-east-1:000000000000:execution:M:N")]
+#[case("arn:aws:s3:us-east-1:000000000000:stateMachine:M")]
+#[case("arn:aws:states:us-east-1:0:stateMachine:M")]
+fn test_should_reject_wrong_machine_arn_shapes(#[case] value: &str) {
+    assert!(value.parse::<StateMachineArn>().is_err());
+}
+#[rstest]
+#[case("arn:aws:iam:us-east-1:000000000000:role/Worker")]
+#[case("arn:aws:lambda::000000000000:role/Worker")]
+#[case("arn:aws:iam::000000000000:user/Worker")]
+#[case("arn:aws:iam::000000000000:role//Worker")]
+#[case("arn:aws:iam::000000000000:role/a b/Worker")]
+#[case("arn:aws:iam::000000000000:role/Worker:bad")]
+fn test_should_reject_invalid_role_arns(#[case] value: &str) {
+    assert!(value.parse::<RoleArn>().is_err());
+}
+#[test]
+fn test_should_bound_arns_names_roles_and_tags_and_redact_debug() {
+    assert!("a".repeat(80).parse::<StateMachineName>().is_ok());
+    assert!("a".repeat(81).parse::<StateMachineName>().is_err());
+    let execution = ExecutionArn::new(arn(), "run".parse().unwrap()).unwrap();
+    let reparsed: ExecutionArn = execution.as_str().parse().unwrap();
+    assert_eq!(reparsed.as_str(), execution.as_str());
+    assert!(
+        format!("{}:v", execution.as_str())
+            .parse::<ExecutionArn>()
+            .is_err()
+    );
+    let unicode = Tags::new(vec![("团队".into(), "數值 １２".into())]).unwrap();
+    assert_eq!(unicode.values().len(), 1);
+    for values in [
+        vec![("aws:key".into(), String::new())],
+        vec![("AWS:key".into(), String::new())],
+        vec![("a".into(), "x".into()), ("a".into(), "y".into())],
+        vec![("a".into(), "\n".into())],
+        vec![("a".repeat(129), String::new())],
+        vec![("a".into(), "v".repeat(257))],
+    ] {
+        assert!(Tags::new(values).is_err());
+    }
+    assert!(
+        Tags::new(
+            (0..51)
+                .map(|n| (format!("key{n}"), String::new()))
+                .collect()
+        )
+        .is_err()
+    );
+    assert!(format!("{:?}{:?}{:?}{:?}", arn(), execution, role(), unicode).contains("redacted"));
+    assert!(!format!("{:?}{:?}{:?}", arn(), role(), unicode).contains(":stateMachine:Machine"));
+}
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_round_trip_generated_names_and_scoped_arns(machine in "[A-Za-z0-9_-]{1,80}",name in "[A-Za-z0-9_-]{1,80}"){
+        let arn=StateMachineArn::new(&TenantScope::default(),machine.parse().unwrap()).unwrap();
+        let parsed=arn.as_str().parse::<StateMachineArn>().unwrap();
+        prop_assert_eq!(parsed.as_str(),arn.as_str());
+        let execution=ExecutionArn::new(arn,name.parse().unwrap()).unwrap();
+        let parsed=execution.as_str().parse::<ExecutionArn>().unwrap();
+        prop_assert_eq!(parsed.name().as_str(),name);
+    }
+}
+#[tokio::test]
+async fn test_should_preserve_create_idempotency_role_tags_and_update_revision_isolation() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let first = machine(&reg, 1, true).await;
+    let mut execution = start(&reg, "run", " {\"n\":1} ").await.unwrap();
+    let other_role: RoleArn = "arn:aws:iam::000000000000:role/Other".parse().unwrap();
+    let tags = Tags::new(vec![("key".into(), "ignored".into())]).unwrap();
+    let RegistryResult::Machine(repeated) = result(
+        &reg,
+        RegistryCommand::Create(
+            "Machine".parse().unwrap(),
+            definition(1, true),
+            other_role.clone(),
+            tags,
+        ),
+    )
+    .await
+    .unwrap() else {
+        panic!("machine")
+    };
+    assert_eq!(first.revision().id(), repeated.revision().id());
+    assert_eq!(
+        first.revision().role().as_str(),
+        repeated.revision().role().as_str()
+    );
+    assert!(repeated.tags().values().is_empty());
+    assert!(matches!(
+        result(
+            &reg,
+            RegistryCommand::Create(
+                "Machine".parse().unwrap(),
+                definition(9, false),
+                role(),
+                Tags::default()
+            )
+        )
+        .await,
+        Err(RegistryError::MachineExists)
+    ));
+    let RegistryResult::Machine(second) = result(
+        &reg,
+        RegistryCommand::Update(arn(), Some(definition(2, false)), Some(other_role.clone())),
+    )
+    .await
+    .unwrap() else {
+        panic!("machine")
+    };
+    assert_ne!(first.revision().id(), second.revision().id());
+    assert_eq!(execution.revision().id(), first.revision().id());
+    let replay = start(&reg, "run", " {\"n\":1} ").await.unwrap();
+    assert_eq!(replay.start_date(), execution.start_date());
+    assert_eq!(replay.revision().id(), first.revision().id());
+    assert!(matches!(
+        start(&reg, "run", "{\"n\":1}").await,
+        Err(RegistryError::ExecutionExists)
+    ));
+    let new = observe(start(&reg, "new", "{}").await.unwrap()).await;
+    assert!(
+        matches!(new.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(p)) if p.value()==&json!(2))
+    );
+    for (record, expected_role) in [(&execution, role()), (&new, other_role)] {
+        let page = record.view().history().page(1, 100, true).unwrap();
+        assert_eq!(
+            page.events()
+                .first()
+                .and_then(|event| event.execution_started_event_details.as_ref())
+                .and_then(|details| details.role_arn.as_deref()),
+            Some(expected_role.as_str())
+        );
+    }
+    execution.view = reg
+        .stop(execution.arn().clone(), None, None, deadline())
+        .await
+        .unwrap()
+        .view;
+    assert!(matches!(
+        start(&reg, "run", " {\"n\":1} ").await,
+        Err(RegistryError::ExecutionExists)
+    ));
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_linearize_concurrent_running_names_and_preserve_accepted_commands() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&reg, 1, true).await;
+    let mut receipts = Vec::new();
+    for _ in 0..16 {
+        receipts.push(
+            reg.submit(RegistryCommand::Start(
+                arn(),
+                Some("same".parse().unwrap()),
+                Payload::parse(b"{}").unwrap(),
+                None,
+            ))
+            .unwrap(),
+        );
+    }
+    let mut start_date = None;
+    for receipt in &mut receipts {
+        let RegistryResult::Execution(e) = receipt.wait(deadline()).await.unwrap() else {
+            panic!("execution")
+        };
+        if let Some(time) = start_date {
+            assert_eq!(e.start_date(), time);
+        }
+        start_date = Some(e.start_date());
+    }
+    let dropped = reg
+        .submit(RegistryCommand::Tag(
+            arn(),
+            Tags::new(vec![("committed".into(), "yes".into())]).unwrap(),
+        ))
+        .unwrap();
+    drop(dropped);
+    let RegistryResult::Machine(m) = result(&reg, RegistryCommand::Machine(arn())).await.unwrap()
+    else {
+        panic!("machine")
+    };
+    assert_eq!(
+        m.tags().values().get("committed").map(String::as_str),
+        Some("yes")
+    );
+    let RegistryResult::Executions(list) = result(&reg, RegistryCommand::Executions(arn()))
+        .await
+        .unwrap()
+    else {
+        panic!("list")
+    };
+    assert_eq!(list.len(), 1);
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_delete_after_last_business_completion_and_preserve_recreated_arn_names() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let old = machine(&reg, 1, true).await;
+    let execution = start(&reg, "old", "{}").await.unwrap();
+    result(&reg, RegistryCommand::Delete(arn())).await.unwrap();
+    result(&reg, RegistryCommand::Delete(arn())).await.unwrap();
+    assert!(matches!(
+        start(&reg, "rejected", "{}").await,
+        Err(RegistryError::Deleting)
+    ));
+    assert!(matches!(
+        result(
+            &reg,
+            RegistryCommand::Update(arn(), Some(definition(2, false)), None)
+        )
+        .await,
+        Err(RegistryError::Deleting)
+    ));
+    let stopped = reg
+        .stop(execution.arn().clone(), None, None, deadline())
+        .await
+        .unwrap();
+    assert_eq!(stopped.revision().id(), old.revision().id());
+    assert!(matches!(
+        result(&reg, RegistryCommand::Machine(arn())).await,
+        Err(RegistryError::MachineMissing)
+    ));
+    assert!(matches!(
+        result(&reg, RegistryCommand::Delete(arn())).await,
+        Err(RegistryError::MachineMissing)
+    ));
+    let recreated = machine(&reg, 2, false).await;
+    assert_ne!(old.resource_id(), recreated.resource_id());
+    assert!(matches!(
+        start(&reg, "old", "{}").await,
+        Err(RegistryError::ExecutionExists)
+    ));
+    let RegistryResult::Execution(captured) =
+        result(&reg, RegistryCommand::Execution(execution.arn().clone()))
+            .await
+            .unwrap()
+    else {
+        panic!("execution")
+    };
+    assert_eq!(captured.resource_id(), old.resource_id());
+    assert_eq!(captured.revision().id(), old.revision().id());
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_preserve_optional_empty_stop_fields_and_terminal_history() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&reg, 1, true).await;
+    for (name, error, cause) in [
+        ("omitted", None, None),
+        ("empty", Some(String::new()), Some(String::new())),
+    ] {
+        let execution = start(&reg, name, "{}").await.unwrap();
+        let stopped = reg
+            .stop(
+                execution.arn().clone(),
+                error.clone(),
+                cause.clone(),
+                deadline(),
+            )
+            .await
+            .unwrap();
+        let Some(ExecutionOutcome::Aborted(failure)) = stopped.view().outcome().map(Arc::as_ref)
+        else {
+            panic!("aborted")
+        };
+        assert_eq!(failure.details().error(), error.as_deref());
+        assert_eq!(failure.details().cause(), cause.as_deref());
+        let repeated = reg
+            .stop(
+                execution.arn().clone(),
+                Some("ignored".into()),
+                None,
+                deadline(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(stopped.view().stop_date(), repeated.view().stop_date());
+        assert!(Arc::ptr_eq(
+            stopped.view().outcome().unwrap(),
+            repeated.view().outcome().unwrap()
+        ));
+        let page = stopped.view().history().page(1, 100, true).unwrap();
+        assert_eq!(
+            page.events().last().unwrap().r#type.as_str(),
+            "ExecutionAborted"
+        );
+    }
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_keep_revisions_charged_until_last_snapshot_and_apply_tags_atomically() {
+    let caps = RegistryCapacities::new(1, 2, 8, 8).unwrap();
+    let limits = RegistryLimits::new(caps, Duration::from_secs(60), 8).unwrap();
+    let (reg, mut owner) = registry(limits, None);
+    let first = machine(&reg, 1, false).await;
+    result(
+        &reg,
+        RegistryCommand::Update(arn(), Some(definition(2, false)), None),
+    )
+    .await
+    .unwrap();
+    assert!(matches!(
+        result(
+            &reg,
+            RegistryCommand::Update(arn(), Some(definition(3, false)), None)
+        )
+        .await,
+        Err(RegistryError::Capacity)
+    ));
+    drop(first);
+    result(
+        &reg,
+        RegistryCommand::Update(arn(), Some(definition(3, false)), None),
+    )
+    .await
+    .unwrap();
+    let fifty = Tags::new((0..50).map(|n| (format!("key{n}"), "v".into())).collect()).unwrap();
+    result(&reg, RegistryCommand::Tag(arn(), fifty))
+        .await
+        .unwrap();
+    assert!(matches!(
+        result(
+            &reg,
+            RegistryCommand::Tag(
+                arn(),
+                Tags::new(vec![("extra".into(), "v".into())]).unwrap()
+            )
+        )
+        .await,
+        Err(RegistryError::TagLimit)
+    ));
+    let RegistryResult::Machine(capture) =
+        result(&reg, RegistryCommand::Machine(arn())).await.unwrap()
+    else {
+        panic!("machine")
+    };
+    assert_eq!(capture.tags().values().len(), 50);
+    result(
+        &reg,
+        RegistryCommand::Untag(
+            arn(),
+            Tags::new(vec![("key0".into(), String::new())]).unwrap(),
+        ),
+    )
+    .await
+    .unwrap();
+    assert_eq!(capture.tags().values().len(), 50);
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_reject_scope_trace_and_registration_before_publishing_names() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&reg, 1, false).await;
+    let wrong: StateMachineArn = "arn:aws:states:us-west-2:000000000000:stateMachine:Machine"
+        .parse()
+        .unwrap();
+    assert!(matches!(
+        reg.submit(RegistryCommand::Machine(wrong)),
+        Err(RegistryError::Validation)
+    ));
+    assert!(matches!(
+        reg.submit(RegistryCommand::Start(
+            arn(),
+            None,
+            Payload::parse(b"{}").unwrap(),
+            Some("中".into())
+        )),
+        Err(RegistryError::Validation)
+    ));
+    let task=PreparedDefinition::new(AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#).unwrap().machine().clone());
+    result(&reg, RegistryCommand::Update(arn(), Some(task), None))
+        .await
+        .unwrap();
+    assert!(matches!(
+        start(&reg, "free", "{}").await,
+        Err(RegistryError::Execution(ExecutionError::Unavailable))
+    ));
+    result(
+        &reg,
+        RegistryCommand::Update(arn(), Some(definition(1, false)), None),
+    )
+    .await
+    .unwrap();
+    observe(start(&reg, "free", "{}").await.unwrap()).await;
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_hold_command_capacity_until_reply_observation_and_resume_receipt() {
+    let limits =
+        RegistryLimits::new(RegistryCapacities::default(), Duration::from_secs(60), 1).unwrap();
+    let (reg, mut owner) = registry(limits, None);
+    let mut receipt = reg.submit(RegistryCommand::Machines).unwrap();
+    assert!(matches!(
+        receipt.wait(Instant::now()).await,
+        Err(RegistryError::Deadline)
+    ));
+    assert!(matches!(
+        reg.submit(RegistryCommand::Machines),
+        Err(RegistryError::Capacity)
+    ));
+    assert!(matches!(
+        receipt.wait(deadline()).await.unwrap(),
+        RegistryResult::Machines(_)
+    ));
+    assert!(matches!(
+        receipt.wait(deadline()).await,
+        Err(RegistryError::Unavailable)
+    ));
+    result(&reg, RegistryCommand::Machines).await.unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[derive(Debug)]
+struct Port(mpsc::Sender<TaskResponder>);
+impl LambdaTaskPort for Port {
+    fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        let (call, owner) = TaskCall::channel();
+        self.0
+            .try_send(owner)
+            .map_err(|_| TaskFailure::throttled())?;
+        Ok(call)
+    }
+}
+#[tokio::test]
+async fn test_should_resume_same_shutdown_while_actual_task_receipt_remains_owned() {
+    let (tx, mut rx) = mpsc::channel(1);
+    let (reg, mut owner) = registry(RegistryLimits::default(), Some(Arc::new(Port(tx))));
+    let prepared=PreparedDefinition::new(AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#).unwrap().machine().clone());
+    result(
+        &reg,
+        RegistryCommand::Create(
+            "Machine".parse().unwrap(),
+            prepared,
+            role(),
+            Tags::default(),
+        ),
+    )
+    .await
+    .unwrap();
+    start(&reg, "run", "{}").await.unwrap();
+    let responder = timeout(Duration::from_secs(5), rx.recv())
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_millis(5))
+            .await,
+        Err(RegistryError::Deadline)
+    ));
+    assert!(matches!(
+        reg.submit(RegistryCommand::Machines),
+        Err(RegistryError::Unavailable)
+    ));
+    responder.finish(Ok(Payload::parse(b"{}").unwrap()));
+    owner.shutdown(deadline()).await.unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_preserve_root_allocations_after_abnormal_owner_abort() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let capture = machine(&reg, 1, false).await;
+    let revision = Arc::downgrade(capture.revision());
+    drop(capture);
+    owner.join.as_ref().unwrap().abort();
+    assert!(owner.shutdown(deadline()).await.is_err());
+    assert!(revision.upgrade().is_some());
+    assert!(matches!(
+        reg.submit(RegistryCommand::Machines),
+        Err(RegistryError::Unavailable)
+    ));
+}
+
+#[tokio::test]
+async fn test_should_keep_accepted_stop_after_lost_reply_and_preserve_context_metadata() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let machine = machine(&reg, 1, true).await;
+    let execution = start(&reg, "stop-lost", "{}").await.unwrap();
+    let receipt = reg
+        .submit(RegistryCommand::Stop(
+            execution.arn().clone(),
+            StopReason::new(Some("caller-stop".into()), None).unwrap(),
+        ))
+        .unwrap();
+    drop(receipt);
+    let stopped = observe(execution).await;
+    assert!(
+        matches!(stopped.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Aborted(f)) if f.details().error()==Some("caller-stop"))
+    );
+    let custom=PreparedDefinition::new(AslCompiler::default().compile(br#"{"StartAt":"P","States":{"P":{"Type":"Pass","Parameters":{"execution.$":"$$.Execution.Id","name.$":"$$.Execution.Name","machine.$":"$$.StateMachine.Id","role.$":"$$.Execution.RoleArn","input.$":"$$.Execution.Input"},"End":true}}}"#).unwrap().machine().clone());
+    result(&reg, RegistryCommand::Update(arn(), Some(custom), None))
+        .await
+        .unwrap();
+    let context = observe(start(&reg, "context", "{\"n\":7}").await.unwrap()).await;
+    let Some(ExecutionOutcome::Succeeded(payload)) = context.view().outcome().map(Arc::as_ref)
+    else {
+        panic!("output")
+    };
+    assert_eq!(
+        payload.value(),
+        &json!({"execution":context.arn().as_str(),"name":"context","machine":machine.arn().as_str(),"role":role().as_str(),"input":{"n":7}})
+    );
+    owner.shutdown(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_require_present_machine_for_list_but_keep_deleted_execution_reads() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    assert!(matches!(
+        result(&reg, RegistryCommand::Executions(arn())).await,
+        Err(RegistryError::MachineMissing)
+    ));
+    machine(&reg, 1, false).await;
+    let old = observe(start(&reg, "old", "{}").await.unwrap()).await;
+    result(&reg, RegistryCommand::Delete(arn())).await.unwrap();
+    assert!(matches!(
+        result(&reg, RegistryCommand::Executions(arn())).await,
+        Err(RegistryError::MachineMissing)
+    ));
+    assert!(matches!(
+        result(&reg, RegistryCommand::Execution(old.arn().clone()))
+            .await
+            .unwrap(),
+        RegistryResult::Execution(_)
+    ));
+    machine(&reg, 2, false).await;
+    let RegistryResult::Executions(list) = result(&reg, RegistryCommand::Executions(arn()))
+        .await
+        .unwrap()
+    else {
+        panic!("list")
+    };
+    assert_eq!(list.len(), 1);
+    assert_eq!(list.first().unwrap().resource_id(), old.resource_id());
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_bound_retained_tag_versions_without_copying_each_snapshot() {
+    let caps = RegistryCapacities::new(1, 2, 8, 8).unwrap();
+    let limits = RegistryLimits::new(caps, Duration::from_secs(60), 8).unwrap();
+    let (reg, mut owner) = registry(limits, None);
+    let old = machine(&reg, 1, false).await;
+    let tags = |value: &str| Tags::new(vec![("key".into(), value.into())]).unwrap();
+    result(&reg, RegistryCommand::Tag(arn(), tags("v2")))
+        .await
+        .unwrap();
+    assert!(matches!(
+        result(&reg, RegistryCommand::Tag(arn(), tags("v3"))).await,
+        Err(RegistryError::Capacity)
+    ));
+    assert!(old.tags().values().is_empty());
+    drop(old);
+    result(&reg, RegistryCommand::Tag(arn(), tags("v3")))
+        .await
+        .unwrap();
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[tokio::test]
+async fn test_should_signal_active_execution_when_registry_root_is_aborted() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&reg, 1, true).await;
+    let execution = start(&reg, "cancel-root", "{}").await.unwrap();
+    owner.join.as_ref().unwrap().abort();
+    assert!(owner.shutdown(deadline()).await.is_err());
+    let stopped = observe(execution).await;
+    assert!(matches!(
+        stopped.view().outcome().map(Arc::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+}
+
+#[tokio::test]
+async fn test_should_publish_role_only_revision_and_compare_exact_definition_source() {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let first = machine(&reg, 1, false).await;
+    let other: RoleArn = "arn:aws:iam::000000000000:role/Other".parse().unwrap();
+    let RegistryResult::Machine(updated) = result(
+        &reg,
+        RegistryCommand::Update(arn(), None, Some(other.clone())),
+    )
+    .await
+    .unwrap() else {
+        panic!("machine")
+    };
+    assert_ne!(first.revision().id(), updated.revision().id());
+    assert_eq!(
+        first.revision().source_hash(),
+        updated.revision().source_hash()
+    );
+    assert_eq!(updated.revision().role().as_str(), other.as_str());
+    assert_ne!(first.revision().role().as_str(), other.as_str());
+    let source = serde_json::to_vec_pretty(
+        &serde_json::from_slice::<serde_json::Value>(first.revision().machine().original_bytes())
+            .unwrap(),
+    )
+    .unwrap();
+    let prepared = PreparedDefinition::new(
+        AslCompiler::default()
+            .compile(&source)
+            .unwrap()
+            .machine()
+            .clone(),
+    );
+    assert!(matches!(
+        result(
+            &reg,
+            RegistryCommand::Create(
+                "Machine".parse().unwrap(),
+                prepared,
+                role(),
+                Tags::default()
+            )
+        )
+        .await,
+        Err(RegistryError::MachineExists)
+    ));
+    let wrong: RoleArn = "arn:aws:iam::111111111111:role/Other".parse().unwrap();
+    assert!(matches!(
+        reg.submit(RegistryCommand::Update(arn(), None, Some(wrong))),
+        Err(RegistryError::Validation)
+    ));
+    let prepared = PreparedDefinition::new(
+        AslCompiler::new(
+            TenantScope::new("aws", "us-west-2", "000000000000").unwrap(),
+            TaskSupport::Disabled,
+        )
+        .compile(first.revision().machine().original_bytes())
+        .unwrap()
+        .machine()
+        .clone(),
+    );
+    assert!(matches!(
+        reg.submit(RegistryCommand::Update(arn(), Some(prepared), None)),
+        Err(RegistryError::Validation)
+    ));
+    owner.shutdown(deadline()).await.unwrap();
+}
+#[test]
+fn test_should_bound_operator_admission_limits_and_combined_execution_arn_length() {
+    for values in [
+        (0, 1, 1, 1),
+        (1, 0, 1, 1),
+        (1, 1, 0, 1),
+        (1, 1, 1, 0),
+        (4097, 1, 1, 1),
+        (1, 4097, 1, 1),
+        (1, 1, 100_001, 1),
+        (1, 1, 1, 1_000_001),
+    ] {
+        assert!(RegistryCapacities::new(values.0, values.1, values.2, values.3).is_err());
+    }
+    for (seconds, commands) in [(59, 1), (90 * 86400 + 1, 1), (60, 0), (60, 1025)] {
+        assert!(
+            RegistryLimits::new(
+                RegistryCapacities::default(),
+                Duration::from_secs(seconds),
+                commands
+            )
+            .is_err()
+        );
+    }
+    let scope = TenantScope::new("aws", &"a".repeat(64), "000000000000").unwrap();
+    let machine = StateMachineArn::new(&scope, "m".repeat(80).parse().unwrap()).unwrap();
+    assert!(ExecutionArn::new(machine, "n".repeat(80).parse().unwrap()).is_err());
+}
+
+#[tokio::test]
+async fn test_should_return_typed_failure_on_repeated_observation_of_closed_reply_lane() {
+    let (sender, receiver) = oneshot::channel::<Reply>();
+    drop(sender);
+    let mut receipt = RegistryReceipt {
+        receiver: Some(receiver),
+    };
+    for _ in 0..2 {
+        assert!(matches!(
+            receipt.wait(deadline()).await,
+            Err(RegistryError::Unavailable)
+        ));
+    }
+}
+
+#[tokio::test]
+async fn test_should_finish_accepted_task_after_all_registry_command_handles_are_dropped() {
+    let (tx, mut rx) = mpsc::channel(1);
+    let (reg, mut owner) = registry(RegistryLimits::default(), Some(Arc::new(Port(tx))));
+    let prepared=PreparedDefinition::new(AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#).unwrap().machine().clone());
+    result(
+        &reg,
+        RegistryCommand::Create(
+            "Machine".parse().unwrap(),
+            prepared,
+            role(),
+            Tags::default(),
+        ),
+    )
+    .await
+    .unwrap();
+    let snapshot = start(&reg, "caller-independent", "{}").await.unwrap();
+    let mut responder = timeout(Duration::from_secs(5), rx.recv())
+        .await
+        .unwrap()
+        .unwrap();
+    responder.started().unwrap();
+    drop(reg);
+    tokio::task::yield_now().await;
+    assert!(!*owner.closing.borrow());
+    responder.finish(Ok(Payload::parse(b"42").unwrap()));
+    let finished = observe(snapshot).await;
+    assert!(
+        matches!(finished.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(p)) if p.value()==&json!(42))
+    );
+    owner.shutdown(deadline()).await.unwrap();
+}
+
+#[tokio::test]
+async fn test_should_reject_nested_artifact_promotion_during_create_and_update()
+-> Result<(), Box<dyn Error>> {
+    let compiler = AslCompiler::default().with_state_support(StateSupport::Structured);
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let first = machine(&reg, 1, false).await;
+    for state in [
+        json!({"Type":"Parallel","Branches":[{"StartAt":"Child","States":{"Child":{"Type":"Succeed"}}}],"End":true}),
+        json!({"Type":"Map","ItemProcessor":{"StartAt":"Child","States":{"Child":{"Type":"Succeed"}}},"End":true}),
+    ] {
+        let root = compiler.compile(&serde_json::to_vec(
+            &json!({"StartAt":"Run","States":{"Run":state}}),
+        )?)?;
+        assert!(root.machine().is_root_definition());
+        let child = match root.machine().state(root.machine().start())? {
+            StateView::Parallel { branches, .. } => {
+                branches.first().ok_or("missing branch")?.clone()
+            }
+            StateView::Map { processor, .. } => processor.clone(),
+            _ => return Err("missing structured state".into()),
+        };
+        assert!(!child.is_root_definition());
+        assert!(!child.requires_structured_execution());
+        assert_eq!(child.original_bytes(), root.machine().original_bytes());
+        let prepared = PreparedDefinition::new(child);
+        assert!(matches!(
+            reg.submit(RegistryCommand::Create(
+                "Injected".parse()?,
+                prepared.clone(),
+                role(),
+                Tags::default(),
+            )),
+            Err(RegistryError::Validation)
+        ));
+        assert!(matches!(
+            reg.submit(RegistryCommand::Update(arn(), Some(prepared), None)),
+            Err(RegistryError::Validation)
+        ));
+    }
+    assert!(matches!(
+        result(
+            &reg,
+            RegistryCommand::Machine(
+                "arn:aws:states:us-east-1:000000000000:stateMachine:Injected".parse()?
+            )
+        )
+        .await,
+        Err(RegistryError::MachineMissing)
+    ));
+    let RegistryResult::Machine(current) = result(&reg, RegistryCommand::Machine(arn())).await?
+    else {
+        return Err("missing current machine".into());
+    };
+    assert_eq!(current.revision().id(), first.revision().id());
+    assert!(Arc::ptr_eq(current.revision(), first.revision()));
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_bind_structured_publication_and_start_to_installed_profile()
+-> Result<(), Box<dyn Error>> {
+    let compiled = AslCompiler::default().with_state_support(StateSupport::Structured)
+        .compile(br#"{"StartAt":"P","States":{"P":{"Type":"Parallel","Branches":[{"StartAt":"D","States":{"D":{"Type":"Pass","Result":1,"End":true}}},{"StartAt":"D","States":{"D":{"Type":"Pass","Result":2,"End":true}}}],"End":true}}}"#)?;
+    let prepared = PreparedDefinition::new(compiled.machine().clone());
+    let (sequential, mut old_owner) = registry(RegistryLimits::default(), None);
+    assert_eq!(sequential.state_support(), StateSupport::Sequential);
+    assert!(matches!(
+        sequential.submit(RegistryCommand::Create(
+            "Machine".parse()?,
+            prepared.clone(),
+            role(),
+            Tags::default()
+        )),
+        Err(RegistryError::Validation)
+    ));
+    machine(&sequential, 7, false).await;
+    assert!(matches!(
+        sequential.submit(RegistryCommand::Update(arn(), Some(prepared.clone()), None)),
+        Err(RegistryError::Validation)
+    ));
+    let old = start(&sequential, "unchanged", "{}").await?;
+    let old = observe(old).await;
+    assert!(
+        matches!(old.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(value)) if value.value()==&json!(7))
+    );
+    old_owner.shutdown(deadline()).await?;
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    let (structured, mut owner) = Registry::new_with_state_support(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+        StateSupport::Structured,
+    )?;
+    assert_eq!(structured.state_support(), StateSupport::Structured);
+    result(
+        &structured,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    let completed = observe(start(&structured, "structured", "{}").await?).await;
+    assert!(
+        matches!(completed.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(value)) if value.value()==&json!([1,2]))
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_rollback_record_and_name_when_shared_root_frame_admission_is_full()
+-> Result<(), Box<dyn Error>> {
+    let capacity = Arc::new(FrameCapacity::new(1, 1024 * 1024)?);
+    let runtime = ExecutionSupervisor::new_with_frames(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+        capacity.clone(),
+        FrameLimits::new(1, 1024 * 1024)?,
+    )?;
+    let (reg, mut owner) = Registry::new_with_state_support(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+        StateSupport::Structured,
+    )?;
+    machine(&reg, 1, true).await;
+    let first = start(&reg, "first", "{}").await?;
+    assert_eq!(capacity.available_frames(), 0);
+    result(
+        &reg,
+        RegistryCommand::Update(arn(), Some(definition(7, false)), None),
+    )
+    .await?;
+    assert!(matches!(
+        start(&reg, "retry-same-name", "{}").await,
+        Err(RegistryError::Execution(ExecutionError::Capacity))
+    ));
+    let RegistryResult::Executions(records) =
+        result(&reg, RegistryCommand::Executions(arn())).await?
+    else {
+        return Err("missing records".into());
+    };
+    assert_eq!(records.len(), 1);
+    reg.stop(first.arn().clone(), None, None, deadline())
+        .await?;
+    reg.wait_idle(deadline()).await?;
+    let completed = observe(start(&reg, "retry-same-name", "{}").await?).await;
+    assert!(
+        matches!(completed.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(value)) if value.value()==&json!(7))
+    );
+    owner.shutdown(deadline()).await?;
+    assert_eq!(capacity.available_frames(), 1);
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/tests/children.rs b/crates/rustack-stepfunctions-core/src/registry/tests/children.rs
new file mode 100644
index 00000000..d8e5594f
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/tests/children.rs
@@ -0,0 +1,869 @@
+//! Child port contracts through the actual registry/runtime, independent of ASL routing.
+
+use std::{
+    future::{Future, poll_fn},
+    task::Poll,
+};
+
+use rustack_core::json::JsonError;
+
+use super::*;
+use crate::{
+    AslError, ChildError, ChildExecution, ChildPattern, ChildStartParameters, ChildSubmission,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+fn wait() -> serde_json::Value {
+    json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":60,"End":true}}})
+}
+async fn publish(
+    reg: &Registry,
+    name: &str,
+    definition: serde_json::Value,
+) -> Result<StateMachineArn, Box<dyn Error>> {
+    let prepared = PreparedDefinition::new(
+        AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+            .compile(&serde_json::to_vec(&definition)?)?
+            .machine()
+            .clone(),
+    );
+    let RegistryResult::Machine(machine) = result(
+        reg,
+        RegistryCommand::Create(name.parse()?, prepared, role(), Tags::default()),
+    )
+    .await?
+    else {
+        return Err("machine".into());
+    };
+    Ok(machine.arn().clone())
+}
+fn parameters(
+    machine: &StateMachineArn,
+    name: Option<&str>,
+    input: serde_json::Value,
+) -> Result<ChildStartParameters, Box<dyn Error>> {
+    let mut value = json!({"StateMachineArn":machine.as_str()});
+    value
+        .as_object_mut()
+        .ok_or("parameters")?
+        .insert("Input".into(), input);
+    if let Some(name) = name {
+        value["Name"] = json!(name);
+    }
+    Ok(ChildStartParameters::parse(
+        &TenantScope::default(),
+        &Payload::from_value(&value)?,
+    )?)
+}
+async fn accepted(mut submission: ChildSubmission) -> Result<ChildExecution, Box<dyn Error>> {
+    submission.admitted(deadline()).await?;
+    Ok(submission.into_execution()?)
+}
+async fn make_parent(reg: &Registry) -> Result<ExecutionSnapshot, Box<dyn Error>> {
+    machine(reg, 1, true).await;
+    Ok(start(reg, "parent", "{}").await?)
+}
+async fn committed_child(
+    reg: &Registry,
+    machine: &StateMachineArn,
+) -> Result<ExecutionSnapshot, Box<dyn Error>> {
+    timeout(Duration::from_secs(5), async {
+        loop {
+            let RegistryResult::Executions(records) =
+                result(reg, RegistryCommand::Executions(machine.clone())).await?
+            else {
+                return Err("records".into());
+            };
+            if let Some(child) = records.first() {
+                return Ok(child.clone());
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?
+}
+fn underlying(error: &ChildError) -> &ChildError {
+    match error {
+        ChildError::Admission(source) => underlying(source),
+        other => other,
+    }
+}
+
+#[test]
+fn test_should_validate_child_parameters_input_normalization_and_runtime_failure_mapping()
+-> TestResult {
+    let scope = TenantScope::default();
+    let machine = arn();
+    for (input, raw) in [
+        (json!(null), "{}"),
+        (json!("null"), "null"),
+        (json!(" { \"n\":7 } "), " { \"n\":7 } "),
+        (json!([1, null]), "[1,null]"),
+        (json!(false), "false"),
+    ] {
+        assert_eq!(
+            parameters(&machine, None, input)?.input().original_bytes(),
+            raw.as_bytes()
+        );
+    }
+    let omitted = ChildStartParameters::parse(
+        &scope,
+        &Payload::from_value(&json!({"StateMachineArn":machine.as_str()}))?,
+    )?;
+    assert_eq!(omitted.input().original_bytes(), b"{}");
+    for value in [
+        json!({"StateMachineArn":"bad"}),
+        json!({"StateMachineArn":"arn:aws:states:us-west-2:000000000000:stateMachine:Child"}),
+        json!({"StateMachineArn":machine.as_str(),"Name":"invalid:name"}),
+        json!({"StateMachineArn":machine.as_str(),"Name":null}),
+        json!({"StateMachineArn":machine.as_str(),"Input":"invalid-json"}),
+        json!({"StateMachineArn":machine.as_str(),"Unknown":true}),
+    ] {
+        let error = ChildStartParameters::parse(&scope, &Payload::from_value(&value)?).unwrap_err();
+        assert_eq!(error.failure().details().error(), Some("States.Runtime"));
+    }
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_capture_fast_child_once_and_map_exact_optimized_envelope_profiles()
+-> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let parent = make_parent(&reg).await?;
+    let machine = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}}),
+    )
+    .await?;
+    for pattern in [
+        ChildPattern::RequestResponse,
+        ChildPattern::Sync,
+        ChildPattern::Sync2,
+    ] {
+        let child = reg.child_port().start(
+            parent.child_parent(),
+            parameters(&machine, None, json!(" { \"n\":7 } "))?,
+            pattern,
+            deadline(),
+        )?;
+        let mut child = accepted(child).await?;
+        child.wait(deadline()).await?;
+        let result = child
+            .result()?
+            .map_err(|failure| format!("unexpected failure {failure:?}"))?;
+        assert!(
+            result.value()["StartDate"]
+                .as_i64()
+                .is_some_and(|time| (chrono::Utc::now().timestamp_millis() - time).abs() < 60_000)
+        );
+        assert_eq!(
+            result.value()["ExecutionArn"],
+            child.snapshot().arn().as_str()
+        );
+        assert_eq!(child.snapshot().nesting_depth(), 1);
+        assert_eq!(
+            child
+                .snapshot()
+                .parent_execution_arn()
+                .map(ExecutionArn::as_str),
+            Some(parent.arn().as_str())
+        );
+        if pattern == ChildPattern::RequestResponse {
+            assert_eq!(result.value().as_object().ok_or("object")?.len(), 2);
+        } else {
+            assert_eq!(result.value()["Status"], "SUCCEEDED");
+            assert_eq!(result.value()["InputDetails"]["Included"], true);
+            assert_eq!(result.value()["OutputDetails"]["Included"], true);
+            assert!(result.value()["StopDate"].as_i64() >= result.value()["StartDate"].as_i64());
+            if pattern == ChildPattern::Sync {
+                assert_eq!(result.value()["Input"], " { \"n\":7 } ");
+                assert_eq!(
+                    serde_json::from_str::<serde_json::Value>(
+                        result.value()["Output"].as_str().ok_or("output")?
+                    )?,
+                    json!({"n":7})
+                );
+            } else {
+                assert_eq!(result.value()["Input"], json!({"n":7}));
+                assert_eq!(result.value()["Output"], json!({"n":7}));
+            }
+        }
+        child.wait_cleanup(deadline()).await?;
+    }
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_preserve_admission_after_cancelled_waiter_and_late_ready_observer()
+-> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let parent = make_parent(&reg).await?;
+    let child_machine = publish(&reg, "Child", wait()).await?;
+    tokio::time::pause();
+    let mut submission = reg.child_port().start(
+        parent.child_parent(),
+        parameters(&child_machine, Some("once"), json!({}))?,
+        ChildPattern::Sync2,
+        deadline(),
+    )?;
+    assert!(matches!(
+        submission.admitted(Instant::now()).await,
+        Err(ChildError::Deadline)
+    ));
+    let observer = Instant::now() + Duration::from_secs(1);
+    {
+        let mut waiter = Box::pin(submission.admitted(observer));
+        assert!(poll_fn(|cx| Poll::Ready(matches!(waiter.as_mut().poll(cx), Poll::Pending))).await);
+    }
+    let mut waiter = Box::pin(submission.admitted(observer));
+    assert!(poll_fn(|cx| Poll::Ready(matches!(waiter.as_mut().poll(cx), Poll::Pending))).await);
+    committed_child(&reg, &child_machine).await?;
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert!(matches!(waiter.await, Err(ChildError::Deadline)));
+    submission.admitted(deadline()).await?;
+    assert!(matches!(
+        submission.admitted(Instant::now()).await,
+        Err(ChildError::Deadline)
+    ));
+    let mut child = submission.into_execution()?;
+    child.cancel();
+    child.wait_cleanup(deadline()).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_cancel_unissued_start_without_claiming_name_and_cancel_after_lost_reply()
+-> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let parent = make_parent(&reg).await?;
+    let machine = publish(&reg, "Child", wait()).await?;
+    let mut unissued = reg.child_port().start(
+        parent.child_parent(),
+        parameters(&machine, Some("once"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?;
+    unissued.cancel();
+    let failure = unissued.admitted(deadline()).await.unwrap_err();
+    assert!(matches!(underlying(&failure), ChildError::Cancelled));
+    let submission = reg.child_port().start(
+        parent.child_parent(),
+        parameters(&machine, Some("once"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?;
+    let record = committed_child(&reg, &machine).await?;
+    drop(submission);
+    let complete = record.wait(deadline()).await?;
+    assert!(matches!(
+        complete.view().outcome().map(Arc::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_leave_accepted_detached_child_alive_after_parent_stop_and_handle_drop()
+-> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let parent = make_parent(&reg).await?;
+    let machine = publish(&reg, "Child", wait()).await?;
+    let child = accepted(reg.child_port().start(
+        parent.child_parent(),
+        parameters(&machine, None, json!({}))?,
+        ChildPattern::RequestResponse,
+        deadline(),
+    )?)
+    .await?;
+    let child_arn = child.snapshot().arn().clone();
+    child.cancel();
+    drop(child);
+    reg.stop(parent.arn().clone(), None, None, deadline())
+        .await?;
+    let RegistryResult::Execution(snapshot) =
+        result(&reg, RegistryCommand::Execution(child_arn)).await?
+    else {
+        return Err("child".into());
+    };
+    assert!(snapshot.handle().snapshot().outcome().is_none());
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_reject_foreign_and_closed_parent_capabilities_before_start() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let parent = make_parent(&reg).await?;
+    let machine = publish(&reg, "Child", wait()).await?;
+    let (other, mut other_owner) = registry(RegistryLimits::default(), None);
+    let foreign = make_parent(&other).await?;
+    for capability in [foreign.child_parent(), {
+        reg.stop(parent.arn().clone(), None, None, deadline())
+            .await?;
+        parent.child_parent()
+    }] {
+        let mut submission = reg.child_port().start(
+            capability,
+            parameters(&machine, None, json!({}))?,
+            ChildPattern::Sync,
+            deadline(),
+        )?;
+        let error = submission.admitted(deadline()).await.unwrap_err();
+        assert!(matches!(underlying(&error), ChildError::Parent));
+    }
+    let RegistryResult::Executions(records) =
+        result(&reg, RegistryCommand::Executions(machine)).await?
+    else {
+        return Err("records".into());
+    };
+    assert!(records.is_empty());
+    other_owner.shutdown(deadline()).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_reject_idempotent_owned_cycles_and_preserve_original_lineage() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let parent = make_parent(&reg).await?;
+    let mut self_join = reg.child_port().start(
+        parent.child_parent(),
+        parameters(&arn(), Some("parent"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?;
+    let error = self_join.admitted(deadline()).await.unwrap_err();
+    assert!(matches!(underlying(&error), ChildError::Cycle));
+    let mut child = accepted(reg.child_port().start(
+        parent.child_parent(),
+        parameters(&arn(), Some("child"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    let mut ancestor = reg.child_port().start(
+        child.snapshot().child_parent(),
+        parameters(&arn(), Some("parent"), json!({}))?,
+        ChildPattern::Sync2,
+        deadline(),
+    )?;
+    let error = ancestor.admitted(deadline()).await.unwrap_err();
+    assert!(matches!(underlying(&error), ChildError::Cycle));
+    let replay = accepted(reg.child_port().start(
+        parent.child_parent(),
+        parameters(&arn(), Some("child"), json!({}))?,
+        ChildPattern::RequestResponse,
+        deadline(),
+    )?)
+    .await?;
+    assert_eq!(
+        replay.snapshot().arn().as_str(),
+        child.snapshot().arn().as_str()
+    );
+    assert_eq!(replay.snapshot().nesting_depth(), 1);
+    child.cancel();
+    child.wait_cleanup(deadline()).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_bound_new_child_lineage_at_exact_sixteen_levels() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    let mut current = root;
+    let mut children = Vec::new();
+    for level in 1..=16 {
+        let child = accepted(reg.child_port().start(
+            current.child_parent(),
+            parameters(&arn(), Some(&format!("depth-{level}")), json!({}))?,
+            ChildPattern::Sync2,
+            deadline(),
+        )?)
+        .await?;
+        assert_eq!(child.snapshot().nesting_depth(), level);
+        assert_eq!(
+            child
+                .snapshot()
+                .parent_execution_arn()
+                .map(ExecutionArn::as_str),
+            Some(current.arn().as_str())
+        );
+        current = child.snapshot().clone();
+        children.push(child);
+    }
+    let mut too_deep = reg.child_port().start(
+        current.child_parent(),
+        parameters(&arn(), Some("depth-17"), json!({}))?,
+        ChildPattern::Sync2,
+        deadline(),
+    )?;
+    assert_eq!(
+        too_deep
+            .admitted(deadline())
+            .await
+            .unwrap_err()
+            .failure()
+            .details()
+            .error(),
+        Some("StepFunctions.ExecutionLimitExceeded")
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_bound_active_join_depth_even_when_all_children_were_external_roots()
+-> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&reg, 1, true).await;
+    let mut roots = Vec::new();
+    for level in 0..=17 {
+        roots.push(start(&reg, &format!("root-{level}"), "{}").await?);
+    }
+    let mut children = Vec::new();
+    for level in 0..16 {
+        let parent = roots.get(level).ok_or("parent")?;
+        let child = accepted(reg.child_port().start(
+            parent.child_parent(),
+            parameters(&arn(), Some(&format!("root-{}", level + 1)), json!({}))?,
+            ChildPattern::Sync,
+            deadline(),
+        )?)
+        .await?;
+        assert_eq!(child.snapshot().nesting_depth(), 0);
+        children.push(child);
+    }
+    let mut too_deep = reg.child_port().start(
+        roots.get(16).ok_or("parent")?.child_parent(),
+        parameters(&arn(), Some("root-17"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?;
+    assert_eq!(
+        too_deep
+            .admitted(deadline())
+            .await
+            .unwrap_err()
+            .failure()
+            .details()
+            .error(),
+        Some("StepFunctions.ExecutionLimitExceeded")
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_retain_owned_child_cleanup_and_cancel_descendants_without_dispatch_reservation()
+-> TestResult {
+    let (sender, mut receiver) = mpsc::channel(4);
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::new(32, 1, 4)?,
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        Some(Arc::new(Port(sender))),
+    )?;
+    let (reg, mut owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+    )?;
+    let root = make_parent(&reg).await?;
+    let child_machine = publish(&reg, "Child", wait()).await?;
+    let leaf_machine=publish(&reg,"Leaf",json!({"StartAt":"Call","States":{"Call":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}})).await?;
+    let mut child = accepted(reg.child_port().start(
+        root.child_parent(),
+        parameters(&child_machine, None, json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    let mut leaf = accepted(reg.child_port().start(
+        child.snapshot().child_parent(),
+        parameters(&leaf_machine, None, json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    let mut responder = timeout(Duration::from_secs(5), receiver.recv())
+        .await?
+        .ok_or("call")?;
+    responder.started()?;
+    reg.stop(root.arn().clone(), None, None, deadline()).await?;
+    let mut cancellation = responder.cancellation();
+    timeout(Duration::from_secs(3), async {
+        while !*cancellation.borrow_and_update() {
+            cancellation.changed().await?;
+        }
+        Ok::<_, Box<dyn Error>>(())
+    })
+    .await??;
+    assert!(matches!(
+        child.wait(deadline()).await?.outcome().map(Arc::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    assert!(matches!(
+        leaf.wait(deadline()).await?.outcome().map(Arc::as_ref),
+        Some(ExecutionOutcome::Aborted(_))
+    ));
+    assert!(matches!(
+        leaf.wait_cleanup(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(ChildError::Execution(ExecutionError::Deadline))
+    ));
+    child.wait_cleanup(deadline()).await?;
+    result(&reg, RegistryCommand::Machines).await?;
+    let charged = reg.shared.child_capacity.available_permits();
+    assert_eq!(charged, 31);
+    drop(leaf);
+    result(&reg, RegistryCommand::Machines).await?;
+    assert_eq!(reg.shared.child_capacity.available_permits(), charged);
+    responder.finish(Ok(Payload::parse(b"null")?));
+    timeout(Duration::from_secs(3), async {
+        while reg.shared.child_capacity.available_permits() != 32 {
+            tokio::time::sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_bound_child_calls_separately_and_rollback_exhausted_open_start() -> TestResult
+{
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::new(2, 1, 2)?,
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    let limits = RegistryLimits::new(RegistryCapacities::default(), Duration::from_secs(60), 1)?;
+    let (reg, mut owner) = Registry::new(
+        TenantScope::default(),
+        limits,
+        runtime,
+        ExecutionLimits::default(),
+    )?;
+    let root = make_parent(&reg).await?;
+    let child_machine = publish(&reg, "Child", wait()).await?;
+    let mut child = accepted(reg.child_port().start(
+        root.child_parent(),
+        parameters(&child_machine, Some("child"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    let mut full = reg.child_port().start(
+        root.child_parent(),
+        parameters(&child_machine, Some("later"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?;
+    assert_eq!(
+        full.admitted(deadline())
+            .await
+            .unwrap_err()
+            .failure()
+            .details()
+            .error(),
+        Some("StepFunctions.ExecutionLimitExceeded")
+    );
+    let replay = accepted(reg.child_port().start(
+        root.child_parent(),
+        parameters(&child_machine, Some("child"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    assert_eq!(reg.shared.child_capacity.available_permits(), 0);
+    assert!(matches!(
+        reg.child_port().start(
+            root.child_parent(),
+            parameters(&child_machine, Some("saturated"), json!({}))?,
+            ChildPattern::Sync,
+            deadline()
+        ),
+        Err(ChildError::Capacity)
+    ));
+    result(&reg, RegistryCommand::Machines).await?;
+    child.cancel();
+    child.wait_cleanup(deadline()).await?;
+    drop(replay);
+    timeout(Duration::from_secs(3), async {
+        while reg.shared.child_capacity.available_permits() != 2 {
+            tokio::time::sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await?;
+    let later = accepted(reg.child_port().start(
+        root.child_parent(),
+        parameters(&child_machine, Some("later"), json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    drop(later);
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_map_failed_or_timed_out_child_and_bound_unicode_failure_cause() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    for (name, definition, input, status) in [
+        (
+            "Failure",
+            json!({"StartAt":"F","States":{"F":{"Type":"Fail","Error":"BusinessFailure","CausePath":"$.cause"}}}),
+            json!({"cause":"\0中".repeat(2000)}),
+            "FAILED",
+        ),
+        (
+            "Timed",
+            json!({"TimeoutSeconds":1,"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":60,"End":true}}}),
+            json!({}),
+            "TIMED_OUT",
+        ),
+    ] {
+        let machine = publish(&reg, name, definition).await?;
+        let mut child = accepted(reg.child_port().start(
+            root.child_parent(),
+            parameters(&machine, None, input)?,
+            ChildPattern::Sync2,
+            deadline(),
+        )?)
+        .await?;
+        child.wait(deadline()).await?;
+        let failure = child.result()?.unwrap_err();
+        assert_eq!(failure.details().error(), Some("States.TaskFailed"));
+        let text = failure.details().cause().ok_or("cause")?;
+        assert!(text.len() <= 32768);
+        let cause: serde_json::Value = serde_json::from_str(text)?;
+        assert_eq!(cause["Status"], status);
+        assert_eq!(cause["ExecutionArn"], child.snapshot().arn().as_str());
+        if status == "FAILED" {
+            assert_eq!(cause["Error"], "BusinessFailure");
+            assert_eq!(cause["CauseTruncated"], true);
+            assert!(cause["Cause"].as_str().ok_or("cause")?.len() <= 4096);
+        }
+        child.wait_cleanup(deadline()).await?;
+    }
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_enforce_combined_optimized_envelope_payload_limit() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    let machine = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}}),
+    )
+    .await?;
+    let mut child = accepted(reg.child_port().start(
+        root.child_parent(),
+        parameters(&machine, None, json!({"large":"x".repeat(140_000)}))?,
+        ChildPattern::Sync2,
+        deadline(),
+    )?)
+    .await?;
+    child.wait(deadline()).await?;
+    assert_eq!(
+        child.result().unwrap_err().failure().details().error(),
+        Some("States.DataLimitExceeded")
+    );
+    child.wait_cleanup(deadline()).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_keep_weak_child_port_usable_without_public_registry_and_close_without_cycle()
+-> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    let machine = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Succeed"}}}),
+    )
+    .await?;
+    let port = reg.child_port();
+    drop(reg);
+    let mut child = accepted(port.start(
+        root.child_parent(),
+        parameters(&machine, None, json!({}))?,
+        ChildPattern::Sync2,
+        deadline(),
+    )?)
+    .await?;
+    child.wait(deadline()).await?;
+    child.wait_cleanup(deadline()).await?;
+    owner.shutdown(deadline()).await?;
+    assert!(matches!(
+        port.start(
+            root.child_parent(),
+            parameters(&machine, None, json!({}))?,
+            ChildPattern::Sync,
+            deadline()
+        ),
+        Err(ChildError::Unavailable)
+    ));
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_preserve_null_scalar_and_array_input_types_in_sync_results() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    let machine = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}}),
+    )
+    .await?;
+    for (input, expected) in [
+        (json!(null), json!({})),
+        (json!("null"), json!(null)),
+        (json!([1, null]), json!([1, null])),
+        (json!(false), json!(false)),
+    ] {
+        for pattern in [ChildPattern::Sync, ChildPattern::Sync2] {
+            let mut child = accepted(reg.child_port().start(
+                root.child_parent(),
+                parameters(&machine, None, input.clone())?,
+                pattern,
+                deadline(),
+            )?)
+            .await?;
+            child.wait(deadline()).await?;
+            let output = child
+                .result()?
+                .map_err(|failure| format!("unexpected failure {failure:?}"))?;
+            let value = &output.value()["Input"];
+            let value = if pattern == ChildPattern::Sync {
+                serde_json::from_str(value.as_str().ok_or("serialized input")?)?
+            } else {
+                value.clone()
+            };
+            assert_eq!(value, expected);
+            child.wait_cleanup(deadline()).await?;
+        }
+    }
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_cache_late_ready_admission_error_without_losing_its_typed_result() -> TestResult
+{
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    let target = "arn:aws:states:us-east-1:000000000000:stateMachine:Missing".parse()?;
+    tokio::time::pause();
+    let observe = Instant::now() + Duration::from_secs(1);
+    let mut submission = reg.child_port().start(
+        root.child_parent(),
+        parameters(&target, Some("missing"), json!({}))?,
+        ChildPattern::Sync2,
+        deadline(),
+    )?;
+    let mut waiter = Box::pin(submission.admitted(observe));
+    assert!(poll_fn(|cx| Poll::Ready(matches!(waiter.as_mut().poll(cx), Poll::Pending))).await);
+    while reg.shared.child_capacity.available_permits() != 128 {
+        tokio::task::yield_now().await;
+    }
+    tokio::time::advance(Duration::from_secs(2)).await;
+    assert!(matches!(waiter.await, Err(ChildError::Deadline)));
+    let error = submission.admitted(deadline()).await.unwrap_err();
+    assert_eq!(
+        error.failure().details().error(),
+        Some("StepFunctions.StateMachineDoesNotExist")
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_not_cancel_new_child_attempt_when_old_completed_owner_is_dropped() -> TestResult
+{
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    let fast = publish(
+        &reg,
+        "Fast",
+        json!({"StartAt":"D","States":{"D":{"Type":"Pass","Result":1,"End":true}}}),
+    )
+    .await?;
+    let slow = publish(&reg, "Slow", wait()).await?;
+    let mut first = accepted(reg.child_port().start(
+        root.child_parent(),
+        parameters(&fast, None, json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    first.wait(deadline()).await?;
+    first.wait_cleanup(deadline()).await?;
+    let mut second = accepted(reg.child_port().start(
+        root.child_parent(),
+        parameters(&slow, None, json!({}))?,
+        ChildPattern::Sync,
+        deadline(),
+    )?)
+    .await?;
+    first.cancel();
+    drop(first);
+    result(&reg, RegistryCommand::Machines).await?;
+    assert!(matches!(
+        second
+            .wait(Instant::now() + Duration::from_millis(10))
+            .await,
+        Err(ChildError::Execution(ExecutionError::Deadline))
+    ));
+    second.cancel();
+    second.wait_cleanup(deadline()).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_observe_fast_child_termination_even_before_start_receipt_is_consumed()
+-> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let root = make_parent(&reg).await?;
+    let machine = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Pass","Result":42,"End":true}}}),
+    )
+    .await?;
+    let mut submission = reg.child_port().start(
+        root.child_parent(),
+        parameters(&machine, Some("fast"), json!({}))?,
+        ChildPattern::Sync2,
+        deadline(),
+    )?;
+    let record = committed_child(&reg, &machine).await?;
+    let completed = record.wait(deadline()).await?;
+    assert!(
+        matches!(completed.view().outcome().map(Arc::as_ref),Some(ExecutionOutcome::Succeeded(value)) if value.value()==&json!(42))
+    );
+    submission.admitted(deadline()).await?;
+    let mut child = submission.into_execution()?;
+    child.wait(deadline()).await?;
+    let result = child.result()?.map_err(|_| "child failed")?;
+    assert_eq!(result.value()["Output"], 42);
+    child.wait_cleanup(deadline()).await?;
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[test]
+fn test_should_preserve_byte_string_and_key_quota_error_classification() {
+    for error in [JsonError::Bytes, JsonError::String, JsonError::Key] {
+        assert_eq!(
+            ChildError::Data(AslError::Json(error))
+                .failure()
+                .details()
+                .error(),
+            Some("States.DataLimitExceeded")
+        );
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/tests/nested.rs b/crates/rustack-stepfunctions-core/src/registry/tests/nested.rs
new file mode 100644
index 00000000..464e0016
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/tests/nested.rs
@@ -0,0 +1,498 @@
+//! Actual ASL child integration through registry and retained frame owners.
+
+use rustack_stepfunctions_model::types::HistoryEventType;
+
+use super::*;
+use crate::{ClockSample, EvaluationContext, ExecutionDriver};
+
+type TestResult = Result<(), Box<dyn Error>>;
+fn nested_registry(
+    open: usize,
+    port: Option<Arc<dyn LambdaTaskPort>>,
+) -> (Registry, RegistrySupervisor) {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::new(open, 1, 1).unwrap(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        port,
+    )
+    .unwrap();
+    Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+    )
+    .unwrap()
+}
+async fn publish(
+    reg: &Registry,
+    name: &str,
+    definition: serde_json::Value,
+) -> Result<StateMachineArn, Box<dyn Error>> {
+    let artifact = AslCompiler::new(TenantScope::default(), TaskSupport::Lambda)
+        .with_child_support(true)
+        .compile(&serde_json::to_vec(&definition)?)?;
+    let RegistryResult::Machine(machine) = result(
+        reg,
+        RegistryCommand::Create(
+            name.parse()?,
+            PreparedDefinition::new(artifact.machine().clone()),
+            role(),
+            Tags::default(),
+        ),
+    )
+    .await?
+    else {
+        return Err("machine".into());
+    };
+    Ok(machine.arn().clone())
+}
+fn parent(child: &StateMachineArn, suffix: &str, input: serde_json::Value) -> serde_json::Value {
+    let mut definition = json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":format!("arn:aws:states:::states:startExecution{suffix}"),"Parameters":{"StateMachineArn":child.as_str()},"End":true}}});
+    definition["States"]["T"]["Parameters"]["Input"] = input;
+    definition
+}
+
+async fn launch(
+    reg: &Registry,
+    arn: &StateMachineArn,
+) -> Result<ExecutionSnapshot, Box<dyn Error>> {
+    let RegistryResult::Execution(execution) = result(
+        reg,
+        RegistryCommand::Start(arn.clone(), None, Payload::parse(b"{}")?, None),
+    )
+    .await?
+    else {
+        return Err("execution".into());
+    };
+    Ok(execution)
+}
+async fn finish(
+    execution: &ExecutionSnapshot,
+) -> Result<Arc<crate::ExecutionView>, Box<dyn Error>> {
+    Ok(execution.handle().wait_cleanup(deadline()).await?)
+}
+fn succeeded(view: &crate::ExecutionView) -> Result<&Payload, Box<dyn Error>> {
+    match view.outcome().map(Arc::as_ref) {
+        Some(ExecutionOutcome::Succeeded(value)) => Ok(value),
+        other => Err(format!("expected success, got {other:?}").into()),
+    }
+}
+async fn child_record(
+    reg: &Registry,
+    child: &StateMachineArn,
+) -> Result<ExecutionSnapshot, Box<dyn Error>> {
+    timeout(Duration::from_secs(5), async {
+        loop {
+            if let RegistryResult::Executions(records) =
+                result(reg, RegistryCommand::Executions(child.clone())).await?
+            {
+                if let Some(record) = records.first() {
+                    return Ok(record.clone());
+                }
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?
+}
+#[rstest]
+#[case("")]
+#[case(".sync")]
+#[case(".sync:2")]
+#[tokio::test]
+async fn test_should_execute_nested_asl_and_project_actual_causal_history(
+    #[case] suffix: &str,
+) -> TestResult {
+    let (reg, mut owner) = nested_registry(8, None);
+    let child = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}}),
+    )
+    .await?;
+    let machine = publish(
+        &reg,
+        "Parent",
+        parent(&child, suffix, json!(" { \"answer\":42 } ")),
+    )
+    .await?;
+    let execution = launch(&reg, &machine).await?;
+    let view = finish(&execution).await?;
+    let output = succeeded(&view)?.value();
+    let record = child_record(&reg, &child).await?;
+    assert_eq!(output["ExecutionArn"], record.arn().as_str());
+    assert_eq!(output["StartDate"], record.start_date().timestamp_millis());
+    if suffix == ".sync" {
+        assert_eq!(output["Input"], " { \"answer\":42 } ");
+        assert_eq!(output["Output"], "{\"answer\":42}");
+    }
+    if suffix == ".sync:2" {
+        assert_eq!(output["Input"], json!({"answer":42}));
+        assert_eq!(output["Output"], json!({"answer":42}));
+    }
+    let page = view.history().page(1, 100, true)?;
+    let kinds: Vec<_> = page.events().iter().map(|e| e.r#type.clone()).collect();
+    let mut expected = vec![
+        HistoryEventType::ExecutionStarted,
+        HistoryEventType::TaskStateEntered,
+        HistoryEventType::TaskScheduled,
+        HistoryEventType::TaskStarted,
+    ];
+    if !suffix.is_empty() {
+        expected.push(HistoryEventType::TaskSubmitted);
+    }
+    expected.extend([
+        HistoryEventType::TaskSucceeded,
+        HistoryEventType::TaskStateExited,
+        HistoryEventType::ExecutionSucceeded,
+    ]);
+    assert_eq!(kinds, expected);
+    for (index, event) in page.events().iter().enumerate() {
+        assert_eq!(event.id, i64::try_from(index + 1)?);
+        let previous = if index == 1 { 0 } else { i64::try_from(index)? };
+        assert_eq!(event.previous_event_id, Some(previous));
+        if let Some(details) = &event.execution_started_event_details {
+            assert_eq!(details.role_arn.as_deref(), Some(role().as_str()));
+        }
+        if let Some(d) = &event.task_submitted_event_details {
+            assert_eq!(d.resource_type, "states");
+            assert_eq!(d.resource, format!("startExecution{suffix}"));
+            let accepted: serde_json::Value =
+                serde_json::from_str(d.output.as_deref().ok_or("submitted")?)?;
+            assert_eq!(accepted["ExecutionArn"], record.arn().as_str());
+        }
+    }
+    for event in view.history().page(1, 100, false)?.events() {
+        if let Some(d) = &event.task_submitted_event_details {
+            assert!(d.output.is_none() && d.output_details.is_none());
+        }
+    }
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_run_child_lambda_with_only_one_global_dispatch_slot() -> TestResult {
+    let (tx, mut rx) = mpsc::channel(1);
+    let (reg, mut owner) = nested_registry(8, Some(Arc::new(Port(tx))));
+    let child = publish(&reg, "Child", json!({"StartAt":"L","States":{"L":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}})).await?;
+    let machine = publish(&reg, "Parent", parent(&child, ".sync:2", json!({"n":21}))).await?;
+    let execution = launch(&reg, &machine).await?;
+    let mut responder = timeout(Duration::from_secs(5), rx.recv())
+        .await?
+        .ok_or("child lambda not dispatched")?;
+    responder.started()?;
+    responder.finish(Ok(Payload::parse(b"42")?));
+    let view = finish(&execution).await?;
+    assert_eq!(succeeded(&view)?.value()["Output"], 42);
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[rstest]
+#[case("")]
+#[case(".sync")]
+#[case(".sync:2")]
+#[tokio::test]
+async fn test_should_detach_start_but_cancel_and_join_owned_child_on_parent_stop(
+    #[case] suffix: &str,
+) -> TestResult {
+    let (reg, mut owner) = nested_registry(8, None);
+    let child = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"W","States":{"W":{"Type":"Wait","Seconds":3600,"End":true}}}),
+    )
+    .await?;
+    let mut definition = parent(&child, suffix, json!({}));
+    definition["States"]["T"]
+        .as_object_mut()
+        .ok_or("Task")?
+        .remove("End");
+    definition["States"]["T"]["Next"] = json!("W");
+    definition["States"]["W"] = json!({"Type":"Wait","Seconds":3600,"End":true});
+    let machine = publish(&reg, "Parent", definition).await?;
+    let execution = launch(&reg, &machine).await?;
+    let record = child_record(&reg, &child).await?;
+    execution
+        .handle()
+        .request_stop(TaskFailure::new("Stopped", None)?);
+    finish(&execution).await?;
+    if suffix.is_empty() {
+        assert!(record.handle().snapshot().outcome().is_none());
+    } else {
+        assert!(matches!(
+            finish(&record).await?.outcome().map(Arc::as_ref),
+            Some(ExecutionOutcome::Aborted(_))
+        ));
+    }
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_fail_nested_open_capacity_without_deadlock_or_child_name_claim() -> TestResult
+{
+    let (reg, mut owner) = nested_registry(1, None);
+    let child = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Succeed"}}}),
+    )
+    .await?;
+    let machine = publish(&reg, "Parent", parent(&child, ".sync:2", json!({}))).await?;
+    let execution = launch(&reg, &machine).await?;
+    let view = finish(&execution).await?;
+    assert!(
+        matches!(view.outcome().map(Arc::as_ref), Some(ExecutionOutcome::Failed(f)) if f.error() == Some("StepFunctions.ExecutionLimitExceeded"))
+    );
+    assert!(
+        matches!(result(&reg, RegistryCommand::Executions(child)).await?, RegistryResult::Executions(v) if v.is_empty())
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[rstest]
+#[case(json!(null), json!({}))]
+#[case(json!("null"), json!(null))]
+#[case(json!([1,2]), json!([1,2]))]
+#[tokio::test]
+async fn test_should_preserve_nested_input_normalization(
+    #[case] input: serde_json::Value,
+    #[case] expected: serde_json::Value,
+) -> TestResult {
+    let (reg, mut owner) = nested_registry(8, None);
+    let child = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Pass","End":true}}}),
+    )
+    .await?;
+    let machine = publish(&reg, "Parent", parent(&child, ".sync:2", input)).await?;
+    assert_eq!(
+        succeeded(finish(&launch(&reg, &machine).await?).await?.as_ref())?.value()["Output"],
+        expected
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_map_child_failure_and_runtime_dynamic_parameter_errors() -> TestResult {
+    let (reg, mut owner) = nested_registry(8, None);
+    let child = publish(&reg, "Child", json!({"StartAt":"F","States":{"F":{"Type":"Fail","Error":"ChildFailure","Cause":"reason"}}})).await?;
+    for (index, definition, expected) in [
+        (0, parent(&child, ".sync:2", json!({})), "States.TaskFailed"),
+        (
+            1,
+            json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::states:startExecution.sync:2","Parameters":{"StateMachineArn.$":"$.missing"},"End":true}}}),
+            "States.Runtime",
+        ),
+        (
+            2,
+            json!({"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:states:::states:startExecution.sync:2","Parameters":{"StateMachineArn.$":"$$.Execution.Name"},"End":true}}}),
+            "States.Runtime",
+        ),
+    ] {
+        let machine = publish(&reg, &format!("Parent{index}"), definition).await?;
+        let view = finish(&launch(&reg, &machine).await?).await?;
+        assert!(
+            matches!(view.outcome().map(Arc::as_ref), Some(ExecutionOutcome::Failed(f)) if f.error() == Some(expected)),
+            "{view:?}"
+        );
+    }
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_keep_observed_child_success_when_cleanup_outlives_parent_task_deadline()
+-> TestResult {
+    let (tx, mut rx) = mpsc::channel(1);
+    let (reg, mut owner) = nested_registry(8, Some(Arc::new(Port(tx))));
+    let child = publish(&reg, "Child", json!({"StartAt":"L","States":{"L":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}})).await?;
+    let mut definition = parent(&child, ".sync:2", json!({}));
+    definition["States"]["T"]["TimeoutSeconds"] = json!(1);
+    let machine = publish(&reg, "Parent", definition).await?;
+    let execution = launch(&reg, &machine).await?;
+    let mut responder = timeout(Duration::from_secs(5), rx.recv())
+        .await?
+        .ok_or("child call")?;
+    responder.started()?;
+    let pending = responder.complete(Ok(Payload::parse(b"42")?));
+    let record = child_record(&reg, &child).await?;
+    assert!(matches!(
+        record
+            .handle()
+            .wait(deadline())
+            .await?
+            .outcome()
+            .map(Arc::as_ref),
+        Some(ExecutionOutcome::Succeeded(_))
+    ));
+    timeout(Duration::from_secs(1), async {
+        loop {
+            if execution
+                .handle()
+                .snapshot()
+                .history()
+                .page(1, 100, true)
+                .unwrap()
+                .events()
+                .iter()
+                .any(|e| e.r#type == HistoryEventType::TaskSucceeded)
+            {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+    })
+    .await?;
+    tokio::time::sleep(Duration::from_millis(1200)).await;
+    assert!(
+        execution
+            .handle()
+            .wait_cleanup(Instant::now() + Duration::from_millis(10))
+            .await
+            .is_err()
+    );
+    pending.settle();
+    assert_eq!(
+        succeeded(finish(&execution).await?.as_ref())?.value()["Output"],
+        42
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_fail_child_cpu_panic_fatally_without_retry_and_retain_typed_source()
+-> TestResult {
+    let mut runtime = ExecutionSupervisor::new(
+        RuntimeLimits::new(8, 1, 1)?,
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    runtime.inject_child_cpu_panic();
+    let (reg, mut owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::default(),
+    )?;
+    let child = publish(
+        &reg,
+        "Child",
+        json!({"StartAt":"D","States":{"D":{"Type":"Succeed"}}}),
+    )
+    .await?;
+    let mut definition = parent(&child, ".sync:2", json!({}));
+    definition["States"]["T"]["Retry"] =
+        json!([{"ErrorEquals":["States.ALL"],"IntervalSeconds":1,"MaxAttempts":2}]);
+    definition["States"]["T"]["Catch"] = json!([{"ErrorEquals":["States.ALL"],"Next":"D"}]);
+    definition["States"]["D"] = json!({"Type":"Succeed"});
+    let machine = publish(&reg, "Parent", definition).await?;
+    let execution = launch(&reg, &machine).await?;
+    let view = execution.handle().wait(deadline()).await?;
+    assert!(
+        matches!(view.outcome().map(Arc::as_ref),Some(ExecutionOutcome::Failed(f)) if f.error()==Some("Rustack.InternalError"))
+    );
+    assert!(matches!(view.diagnostic(),Some(ExecutionError::Worker(source)) if source.is_panic()));
+    assert_eq!(
+        view.history()
+            .page(1, 100, true)?
+            .events()
+            .iter()
+            .filter(|e| e.r#type == HistoryEventType::TaskScheduled)
+            .count(),
+        1
+    );
+    assert!(owner.shutdown(deadline()).await.is_err());
+    Ok(())
+}
+#[tokio::test]
+async fn test_should_enforce_depth_on_recursive_asl_child_execution() -> TestResult {
+    let (reg, mut owner) = nested_registry(32, None);
+    let expected: StateMachineArn =
+        "arn:aws:states:us-east-1:000000000000:stateMachine:Recursive".parse()?;
+    let machine = publish(&reg, "Recursive", parent(&expected, ".sync:2", json!({}))).await?;
+    let execution = launch(&reg, &machine).await?;
+    let view = finish(&execution).await?;
+    assert!(
+        matches!(view.outcome().map(Arc::as_ref),Some(ExecutionOutcome::Failed(f)) if f.error()==Some("States.TaskFailed"))
+    );
+    let RegistryResult::Executions(records) =
+        result(&reg, RegistryCommand::Executions(machine)).await?
+    else {
+        return Err("records".into());
+    };
+    assert_eq!(records.len(), 17);
+    assert_eq!(
+        records.iter().map(ExecutionSnapshot::nesting_depth).max(),
+        Some(16)
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_cancel_child_at_parent_task_timeout_and_wait_for_physical_cleanup()
+-> TestResult {
+    let (tx, mut rx) = mpsc::channel(1);
+    let (reg, mut owner) = nested_registry(8, Some(Arc::new(Port(tx))));
+    let child = publish(&reg, "Child", json!({"StartAt":"L","States":{"L":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}})).await?;
+    let mut definition = parent(&child, ".sync:2", json!({}));
+    definition["States"]["T"]["TimeoutSeconds"] = json!(1);
+    let machine = publish(&reg, "Parent", definition).await?;
+    let execution = launch(&reg, &machine).await?;
+    let mut responder = timeout(Duration::from_secs(5), rx.recv())
+        .await?
+        .ok_or("child call")?;
+    responder.started()?;
+    let mut cancel = responder.cancellation();
+    timeout(Duration::from_secs(3), cancel.wait_for(|cancel| *cancel)).await??;
+    assert!(
+        execution
+            .handle()
+            .wait_cleanup(Instant::now() + Duration::from_millis(10))
+            .await
+            .is_err()
+    );
+    responder.finish(Err(TaskFailure::service_exception()));
+    let view = finish(&execution).await?;
+    assert!(
+        matches!(view.outcome().map(Arc::as_ref), Some(ExecutionOutcome::Failed(f)) if f.error()==Some("States.Timeout"))
+    );
+    owner.shutdown(deadline()).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_reject_unregistered_child_machine_without_issuing_work() -> TestResult {
+    let machine = AslCompiler::default()
+        .with_child_support(true)
+        .compile(&serde_json::to_vec(&parent(&arn(), ".sync:2", json!({})))?)?
+        .machine()
+        .clone();
+    let driver = ExecutionDriver::for_structured_owner(
+        machine,
+        Payload::parse(b"{}")?,
+        EvaluationContext::from_value(&json!({}))?,
+        ClockSample::new(Instant::now().into_std(), chrono::Utc::now()),
+        ExecutionLimits::default(),
+    )?;
+    let mut runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    assert!(matches!(
+        runtime.start_structured(driver.clone()),
+        Err(ExecutionError::Unavailable)
+    ));
+    assert!(matches!(
+        runtime.start(driver),
+        Err(ExecutionError::Unavailable)
+    ));
+    runtime.drain(deadline()).await?;
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/tests/snapshot.rs b/crates/rustack-stepfunctions-core/src/registry/tests/snapshot.rs
new file mode 100644
index 00000000..55baabf1
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/tests/snapshot.rs
@@ -0,0 +1,499 @@
+//! Durable export follows physical cleanup, not business termination or observers.
+
+use std::{
+    error::Error,
+    future::{Future, poll_fn},
+    str,
+    sync::Arc,
+    task::Poll,
+    time::Duration,
+};
+
+use rstest::rstest;
+use serde_json::{Value, json};
+use tokio::{
+    sync::mpsc,
+    time::{Instant, timeout_at},
+};
+
+use super::{Port, arn, deadline, definition, machine, observe, registry, result, role, start};
+use crate::{
+    AslCompiler, CleanupState, ExecutionLimits, ExecutionSupervisor, HistoryLimits,
+    LambdaTaskCommand, LambdaTaskPort, Payload, PreparedDefinition, Registry, RegistryCapacities,
+    RegistryCommand, RegistryError, RegistryLimits, RoleArn, RuntimeLimits, SnapshotLimits, Tags,
+    TaskCall, TaskFailure, TaskSupport, TenantScope,
+};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+fn rows<'a>(value: &'a Value, table: &str) -> Result<&'a [Value], Box<dyn Error>> {
+    value
+        .get(table)
+        .and_then(Value::as_array)
+        .map(Vec::as_slice)
+        .ok_or_else(|| "missing snapshot rows".into())
+}
+fn row<'a>(
+    value: &'a Value,
+    table: &str,
+    field: &str,
+    id: &str,
+) -> Result<&'a Value, Box<dyn Error>> {
+    rows(value, table)?
+        .iter()
+        .find(|row| row.get(field).and_then(Value::as_str) == Some(id))
+        .ok_or_else(|| "missing snapshot row".into())
+}
+fn exported(registry: &Registry) -> Result<Value, Box<dyn Error>> {
+    Ok(serde_json::to_value(
+        registry.export_snapshot(SnapshotLimits::default())?,
+    )?)
+}
+
+#[rstest]
+#[case(0, false)]
+#[case(1, true)]
+#[case(1024*1024*1024, true)]
+#[case(1024*1024*1024+1, false)]
+fn test_should_validate_snapshot_source_copy_budget(#[case] bytes: usize, #[case] valid: bool) {
+    assert_eq!(SnapshotLimits::try_from(bytes).is_ok(), valid);
+}
+
+#[tokio::test]
+async fn test_should_export_only_the_sealed_deterministic_cut_after_controller_loss() -> TestResult
+{
+    let (reg, owner) = registry(RegistryLimits::default(), None);
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    machine(&reg, 42, false).await;
+    let execution = observe(start(&reg, "done", "{} ").await?).await;
+    let mut sealed = reg.shared.sealed.subscribe();
+    drop(owner);
+    let _capture = timeout_at(deadline(), sealed.wait_for(Option::is_some)).await??;
+    let first = exported(&reg)?;
+    tokio::task::yield_now().await;
+    let second = exported(&reg)?;
+    assert_eq!(first, second);
+    assert_eq!(first.get("schemaVersion"), Some(&json!(1)));
+    assert_eq!(first.get("profileVersion"), Some(&json!(1)));
+    assert_eq!(first.get("stateSupport"), Some(&json!("sequential")));
+    assert_eq!(first.get("lambdaSupport"), Some(&json!(false)));
+    assert_eq!(first.get("callbackSupport"), Some(&json!(false)));
+    let saved = row(&first, "executions", "arn", execution.arn().as_str())?;
+    assert_eq!(saved.get("input"), Some(&json!("{} ")));
+    assert_eq!(saved.pointer("/outcome/status"), Some(&json!("SUCCEEDED")));
+    assert_eq!(saved.pointer("/outcome/output"), Some(&json!("42")));
+    assert!(saved.get("traceHeader").is_none());
+    assert_eq!(
+        format!("{:?}", reg.export_snapshot(SnapshotLimits::default())?),
+        "RegistrySnapshot(<redacted>)"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_keep_original_allocations_until_last_sealed_handle_is_dropped() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let machine = machine(&reg, 7, false).await;
+    let execution = observe(start(&reg, "held", "{}").await?).await;
+    let revision = Arc::downgrade(machine.revision());
+    let record = Arc::downgrade(&execution.record);
+    drop(machine);
+    drop(execution);
+    owner.shutdown(deadline()).await?;
+    let snapshot = reg.export_snapshot(SnapshotLimits::default())?;
+    drop(owner);
+    assert!(revision.upgrade().is_some());
+    assert!(record.upgrade().is_some());
+    drop(reg);
+    assert!(revision.upgrade().is_none());
+    assert!(record.upgrade().is_none());
+    assert_eq!(
+        rows(&serde_json::to_value(snapshot)?, "executions")?.len(),
+        1
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_preserve_old_revisions_identities_roles_tags_and_exact_inputs() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let old = machine(&reg, 1, true).await;
+    let old_source = str::from_utf8(old.revision().machine().original_bytes())?.to_owned();
+    let old_run = start(&reg, "a-old", " \n{ \"n\": 7 }\n ").await?;
+    let new_role: RoleArn = "arn:aws:iam::000000000000:role/NewRole".parse()?;
+    result(
+        &reg,
+        RegistryCommand::Update(arn(), Some(definition(2, false)), Some(new_role.clone())),
+    )
+    .await?;
+    let new_run = observe(start(&reg, "b-new", "{}").await?).await;
+    reg.stop(old_run.arn().clone(), None, Some(String::new()), deadline())
+        .await?;
+    result(&reg, RegistryCommand::Delete(arn())).await?;
+    let recreated = machine(&reg, 3, false).await;
+    result(
+        &reg,
+        RegistryCommand::Tag(arn(), Tags::new(vec![("team".into(), "archive".into())])?),
+    )
+    .await?;
+    owner.shutdown(deadline()).await?;
+    let archive = exported(&reg)?;
+    assert_eq!(rows(&archive, "resources")?.len(), 2);
+    assert_eq!(rows(&archive, "revisions")?.len(), 3);
+    assert_eq!(rows(&archive, "machines")?.len(), 1);
+    let captured = row(&archive, "executions", "arn", old_run.arn().as_str())?;
+    assert_eq!(captured.get("resourceId"), Some(&json!(old.resource_id())));
+    assert_eq!(
+        captured.get("revisionId"),
+        Some(&json!(old.revision().id()))
+    );
+    assert_eq!(captured.get("input"), Some(&json!(" \n{ \"n\": 7 }\n ")));
+    assert!(captured.pointer("/outcome/error").is_none());
+    assert_eq!(captured.pointer("/outcome/cause"), Some(&json!("")));
+    let old_revision = row(&archive, "revisions", "revisionId", old.revision().id())?;
+    assert_eq!(old_revision.get("definition"), Some(&json!(old_source)));
+    assert_eq!(
+        old_revision.get("sourceHash"),
+        Some(&json!(old.revision().source_hash()))
+    );
+    assert_eq!(
+        old_revision.get("roleArn"),
+        Some(&json!(old.revision().role().as_str()))
+    );
+    let second_revision = row(&archive, "revisions", "revisionId", new_run.revision().id())?;
+    assert_eq!(
+        second_revision.get("roleArn"),
+        Some(&json!(new_role.as_str()))
+    );
+    let current = row(&archive, "machines", "resourceId", recreated.resource_id())?;
+    assert_eq!(current.pointer("/tags/team"), Some(&json!("archive")));
+    assert_eq!(current.get("status"), Some(&json!("active")));
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_enforce_exact_conservative_budget_before_copy_and_allow_retry() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let machine = machine(&reg, 42, false).await;
+    let execution = observe(start(&reg, "budget", "{}").await?).await;
+    owner.shutdown(deadline()).await?;
+    let bytes = 5 * 4096
+        + reg.scope().partition().len()
+        + reg.scope().region().len()
+        + reg.scope().account().len()
+        + machine.revision().machine().original_bytes().len()
+        + machine.revision().role().as_str().len()
+        + 2
+        + 2
+        + execution.handle().snapshot().history().charged_bytes()
+        + 512;
+    let before = serde_json::to_vec(&reg.export_snapshot(SnapshotLimits::try_from(bytes)?)?)?;
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::try_from(bytes - 1)?),
+        Err(RegistryError::Capacity)
+    ));
+    assert_eq!(
+        before,
+        serde_json::to_vec(&reg.export_snapshot(SnapshotLimits::try_from(bytes)?)?)?
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_not_seal_terminal_business_history_while_physical_cleanup_is_pending()
+-> TestResult {
+    let (tx, mut rx) = mpsc::channel(1);
+    let limits = RegistryLimits::new(RegistryCapacities::default(), Duration::from_secs(60), 1)?;
+    let (reg, mut owner) = registry(limits, Some(Arc::new(Port(tx))));
+    let prepared=PreparedDefinition::new(AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#)?.machine().clone());
+    result(
+        &reg,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    let execution = start(&reg, "physical", "{}").await?;
+    let responder = timeout_at(deadline(), rx.recv())
+        .await?
+        .ok_or("missing actual task owner")?;
+    let held = reg.submit(RegistryCommand::Machines)?;
+    assert!(matches!(
+        reg.submit(RegistryCommand::Machines),
+        Err(RegistryError::Capacity)
+    ));
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_millis(5))
+            .await,
+        Err(RegistryError::Deadline)
+    ));
+    let mut observer = Box::pin(owner.shutdown(deadline()));
+    poll_fn(|context| {
+        assert!(matches!(observer.as_mut().poll(context), Poll::Pending));
+        Poll::Ready(())
+    })
+    .await;
+    drop(observer);
+    let view = execution.handle().wait(deadline()).await?;
+    assert!(view.outcome().is_some());
+    assert_ne!(view.cleanup(), CleanupState::Clean);
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    responder.finish(Ok(Payload::parse(b"{}")?));
+    owner.shutdown(deadline()).await?;
+    assert_eq!(rows(&exported(&reg)?, "executions")?.len(), 1);
+    drop(held);
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_export_every_history_event_beyond_api_page_boundaries() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let prepared=PreparedDefinition::new(AslCompiler::default().compile(br#"{"StartAt":"P","States":{"P":{"Type":"Pass","Parameters":{"n.$":"States.MathAdd($.n,1)"},"Next":"C"},"C":{"Type":"Choice","Choices":[{"Variable":"$.n","NumericLessThan":600,"Next":"P"}],"Default":"D"},"D":{"Type":"Succeed"}}}"#)?.machine().clone());
+    result(
+        &reg,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    let execution = observe(start(&reg, "many", "{\"n\":0}").await?).await;
+    owner.shutdown(deadline()).await?;
+    let view = execution.handle().snapshot();
+    assert!(view.history().len() > 1000);
+    assert!(view.history().page(1, 1000, true)?.next_id().is_some());
+    let archive = exported(&reg)?;
+    let saved = row(&archive, "executions", "arn", execution.arn().as_str())?
+        .get("history")
+        .and_then(Value::as_array)
+        .ok_or("missing full history")?;
+    assert_eq!(saved.len(), usize::try_from(view.history().len())?);
+    for (saved, event) in saved.iter().zip(view.history().snapshot_events()?) {
+        assert_eq!(
+            saved.get("eventJson"),
+            Some(&json!(serde_json::to_string(event)?))
+        );
+        assert_eq!(
+            saved.get("timestamp"),
+            Some(&serde_json::to_value(event.timestamp)?)
+        );
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_never_export_a_failed_or_aborted_root() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&reg, 42, false).await;
+    owner.join.as_ref().ok_or("missing registry root")?.abort();
+    assert!(owner.shutdown(deadline()).await.is_err());
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    Ok(())
+}
+
+#[derive(Debug)]
+struct PanickingDrop;
+impl LambdaTaskPort for PanickingDrop {
+    fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        Err(TaskFailure::service_exception())
+    }
+}
+impl Drop for PanickingDrop {
+    fn drop(&mut self) {
+        panic!("injected port destruction failure");
+    }
+}
+
+#[tokio::test]
+async fn test_should_not_publish_a_cut_before_drained_owner_destruction_succeeds() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), Some(Arc::new(PanickingDrop)));
+    let machine = machine(&reg, 42, false).await;
+    let execution = observe(start(&reg, "drop-panic", "{}").await?).await;
+    let revision = Arc::downgrade(machine.revision());
+    let record = Arc::downgrade(&execution.record);
+    drop(machine);
+    drop(execution);
+    assert!(owner.shutdown(deadline()).await.is_err());
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    assert!(revision.upgrade().is_some());
+    assert!(record.upgrade().is_some());
+    Ok(())
+}
+
+#[rstest]
+#[case(r#"{"StartAt":"F","States":{"F":{"Type":"Fail"}}}"#,json!({"status":"FAILED"}))]
+#[case(r#"{"StartAt":"F","States":{"F":{"Type":"Fail","Error":"","Cause":""}}}"#,json!({"status":"FAILED","error":"","cause":""}))]
+#[tokio::test]
+async fn test_should_preserve_failed_outcome_omission_and_empty_fields(
+    #[case] source: &str,
+    #[case] expected: Value,
+) -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    let prepared = PreparedDefinition::new(
+        AslCompiler::default()
+            .compile(source.as_bytes())?
+            .machine()
+            .clone(),
+    );
+    result(
+        &reg,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    let execution = observe(start(&reg, "failed", "{}").await?).await;
+    owner.shutdown(deadline()).await?;
+    assert_eq!(
+        row(
+            &exported(&reg)?,
+            "executions",
+            "arn",
+            execution.arn().as_str()
+        )?
+        .get("outcome"),
+        Some(&expected)
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_export_absolute_timeout_without_inventing_error_fields() -> TestResult {
+    let runtime = ExecutionSupervisor::new(
+        RuntimeLimits::default(),
+        HistoryLimits::default(),
+        256 * 1024 * 1024,
+        None,
+    )?;
+    let (reg, mut owner) = Registry::new(
+        TenantScope::default(),
+        RegistryLimits::default(),
+        runtime,
+        ExecutionLimits::new(Duration::from_secs(1), 100)?,
+    )?;
+    machine(&reg, 42, true).await;
+    let execution = observe(start(&reg, "timed-out", "{}").await?).await;
+    owner.shutdown(deadline()).await?;
+    assert_eq!(
+        row(
+            &exported(&reg)?,
+            "executions",
+            "arn",
+            execution.arn().as_str()
+        )?
+        .get("outcome"),
+        Some(&json!({"status":"TIMED_OUT"}))
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_preserve_empty_stop_failure_fields() -> TestResult {
+    let (reg, mut owner) = registry(RegistryLimits::default(), None);
+    machine(&reg, 42, true).await;
+    let execution = start(&reg, "empty-stop", "{}").await?;
+    reg.stop(
+        execution.arn().clone(),
+        Some(String::new()),
+        Some(String::new()),
+        deadline(),
+    )
+    .await?;
+    owner.shutdown(deadline()).await?;
+    assert_eq!(
+        row(
+            &exported(&reg)?,
+            "executions",
+            "arn",
+            execution.arn().as_str()
+        )?
+        .get("outcome"),
+        Some(&json!({"status":"ABORTED","error":"","cause":""}))
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_seal_only_after_uncertain_physical_receipt_confirms_clean() -> TestResult {
+    let (tx, mut rx) = mpsc::channel(1);
+    let (reg, mut owner) = registry(RegistryLimits::default(), Some(Arc::new(Port(tx))));
+    let prepared=PreparedDefinition::new(AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#)?.machine().clone());
+    result(
+        &reg,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    let execution = start(&reg, "quarantined", "{}").await?;
+    let responder = timeout_at(deadline(), rx.recv())
+        .await?
+        .ok_or("missing actual task owner")?;
+    let receipt = responder.quarantine(TaskFailure::service_exception());
+    execution.handle().wait(deadline()).await?;
+    assert!(matches!(
+        owner
+            .shutdown(Instant::now() + Duration::from_millis(5))
+            .await,
+        Err(RegistryError::Deadline)
+    ));
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    receipt.settle();
+    owner.shutdown(deadline()).await?;
+    assert_eq!(rows(&exported(&reg)?, "executions")?.len(), 1);
+    Ok(())
+}
+
+#[derive(Debug)]
+struct PanickingStart(mpsc::Sender<()>);
+impl LambdaTaskPort for PanickingStart {
+    fn start(&self, _command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure> {
+        let _sent = self.0.try_send(());
+        panic!("injected actor start failure");
+    }
+}
+
+#[tokio::test]
+async fn test_should_not_seal_permanently_quarantined_actor_ownership() -> TestResult {
+    let (tx, mut rx) = mpsc::channel(1);
+    let (reg, mut owner) = registry(
+        RegistryLimits::default(),
+        Some(Arc::new(PanickingStart(tx))),
+    );
+    let prepared=PreparedDefinition::new(AslCompiler::new(TenantScope::default(),TaskSupport::Lambda).compile(br#"{"StartAt":"T","States":{"T":{"Type":"Task","Resource":"arn:aws:lambda:us-east-1:000000000000:function:Worker","End":true}}}"#)?.machine().clone());
+    result(
+        &reg,
+        RegistryCommand::Create("Machine".parse()?, prepared, role(), Tags::default()),
+    )
+    .await?;
+    let execution = start(&reg, "actor-quarantine", "{}").await?;
+    timeout_at(deadline(), rx.recv())
+        .await?
+        .ok_or("actor did not enter injected failure")?;
+    assert!(owner.shutdown(deadline()).await.is_err());
+    assert_eq!(
+        execution.handle().snapshot().cleanup(),
+        CleanupState::Quarantined
+    );
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    assert!(owner.shutdown(deadline()).await.is_err());
+    assert!(matches!(
+        reg.export_snapshot(SnapshotLimits::default()),
+        Err(RegistryError::Unavailable)
+    ));
+    Ok(())
+}
diff --git a/crates/rustack-stepfunctions-core/src/registry/types.rs b/crates/rustack-stepfunctions-core/src/registry/types.rs
new file mode 100644
index 00000000..8d7d30c5
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/registry/types.rs
@@ -0,0 +1,290 @@
+//! Immutable shared revisions and captured high-water read views.
+
+use std::{
+    sync::Arc,
+    time::{Duration, Instant as StdInstant},
+};
+
+use chrono::{DateTime, Utc};
+use sha2::{Digest, Sha256};
+use tokio::{sync::OwnedSemaphorePermit, time::Instant};
+
+use super::{
+    ExecutionArn, RegistryError, RoleArn, StateMachineArn, Tags, child::Lineage, domain::redacted,
+};
+use crate::{
+    CompiledMachine, ExecutionError, ExecutionFailure, ExecutionHandle, ExecutionView, Payload,
+    TaskFailure,
+};
+
+macro_rules! get {
+    ($owner:ident,$name:ident,$out:ty,$value:ident=>$body:expr,$doc:literal)=>{
+        #[doc=$doc]
+        #[doc=concat!("\n```\n# fn inspect(value:&rustack_stepfunctions_core::",stringify!($owner),"){ let _=value.",stringify!($name),"(); }\n```")]
+        #[must_use]pub fn $name(&self)->$out {let $value=self;$body}
+    };
+}
+/// Global live/retained allocation counts, including caller-owned read snapshots.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct RegistryCapacities {
+    pub(super) machines: usize,
+    pub(super) revisions: usize,
+    pub(super) records: usize,
+    pub(super) names: usize,
+}
+impl RegistryCapacities {
+    /// Validate machine/revision1..4,096, records1..100,000 and names1..1,000,000.
+    ///
+    /// # Errors
+    /// Rejects zero or excessive caps.
+    ///
+    /// ```
+    /// let caps=rustack_stepfunctions_core::RegistryCapacities::new(256,1024,10000,100000)?;
+    /// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+    /// ```
+    pub fn new(
+        machines: usize,
+        revisions: usize,
+        records: usize,
+        names: usize,
+    ) -> Result<Self, RegistryError> {
+        if !(1..=4096).contains(&machines)
+            || !(1..=4096).contains(&revisions)
+            || !(1..=100_000).contains(&records)
+            || !(1..=1_000_000).contains(&names)
+        {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self {
+            machines,
+            revisions,
+            records,
+            names,
+        })
+    }
+}
+impl Default for RegistryCapacities {
+    fn default() -> Self {
+        Self {
+            machines: 256,
+            revisions: 1024,
+            records: 10_000,
+            names: 100_000,
+        }
+    }
+}
+/// Validated registry allocation, retention and accepted-command ceilings.
+#[derive(Debug, Clone, Copy)]
+#[non_exhaustive]
+pub struct RegistryLimits {
+    pub(super) capacities: RegistryCapacities,
+    pub(super) retention: Duration,
+    pub(super) commands: usize,
+}
+impl RegistryLimits {
+    /// Configure record retention60s..90days and accepted commands1..1,024.
+    ///
+    /// # Errors
+    /// Rejects out-of-range retention or command capacity.
+    ///
+    /// ```
+    /// let limits=rustack_stepfunctions_core::RegistryLimits::new(Default::default(),std::time::Duration::from_hours(24),128)?;
+    /// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+    /// ```
+    pub fn new(
+        capacities: RegistryCapacities,
+        retention: Duration,
+        commands: usize,
+    ) -> Result<Self, RegistryError> {
+        if !(Duration::from_secs(60)..=Duration::from_hours(2160)).contains(&retention)
+            || !(1..=1024).contains(&commands)
+        {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self {
+            capacities,
+            retention,
+            commands,
+        })
+    }
+}
+impl Default for RegistryLimits {
+    fn default() -> Self {
+        Self {
+            capacities: RegistryCapacities::default(),
+            retention: Duration::from_hours(24),
+            commands: 128,
+        }
+    }
+}
+#[derive(Clone)]
+pub(super) struct RevisionData {
+    pub(super) id: String,
+    pub(super) machine: Arc<CompiledMachine>,
+    pub(super) role: RoleArn,
+    pub(super) hash: [u8; 32],
+    pub(super) published: DateTime<Utc>,
+}
+redacted!(RevisionData);
+/// Immutable revision; its admission slot stays charged through the last Arc.
+#[non_exhaustive]
+pub struct DefinitionRevision {
+    pub(super) data: RevisionData,
+    pub(super) _permit: OwnedSemaphorePermit,
+}
+redacted!(DefinitionRevision);
+impl DefinitionRevision {
+    get!(DefinitionRevision,publication_date,DateTime<Utc>,s=>s.data.published,"Read the publication date captured by this revision.");
+    get!(DefinitionRevision,id,&str,s=>&s.data.id,"Read the immutable secure revision UUID.");
+    get!(DefinitionRevision,machine,&Arc<CompiledMachine>,s=>&s.data.machine,"Read compiled IR and exact source bytes.");
+    get!(DefinitionRevision,role,&RoleArn,s=>&s.data.role,"Read captured role metadata.");
+    get!(DefinitionRevision,source_hash,&[u8;32],s=>&s.data.hash,"Read SHA-256 of the original source bytes.");
+}
+#[derive(Clone)]
+pub(super) struct MachineIdentity {
+    pub(super) arn: StateMachineArn,
+    pub(super) resource: String,
+    pub(super) created: DateTime<Utc>,
+}
+redacted!(MachineIdentity);
+/// Mutable resource availability; existing execution revisions are independent.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum MachineStatus {
+    /// Starts and updates are accepted.
+    Active,
+    /// Accepted executions finish before mutable metadata is removed.
+    Deleting,
+}
+pub(super) struct TagAllocation {
+    pub(super) value: Tags,
+    pub(super) _permit: OwnedSemaphorePermit,
+}
+redacted!(TagAllocation);
+/// Stable resource read capture; later updates cannot change this value.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct MachineSnapshot {
+    pub(super) identity: Arc<MachineIdentity>,
+    pub(super) updated: DateTime<Utc>,
+    pub(super) status: MachineStatus,
+    pub(super) revision: Arc<DefinitionRevision>,
+    pub(super) tags: Arc<TagAllocation>,
+}
+redacted!(MachineSnapshot);
+impl MachineSnapshot {
+    get!(MachineSnapshot,arn,&StateMachineArn,s=>&s.identity.arn,"Read the scoped resource ARN.");
+    get!(MachineSnapshot,resource_id,&str,s=>&s.identity.resource,"Read the unique incarnation UUID, distinct across recreation.");
+    get!(MachineSnapshot,creation_date,DateTime<Utc>,s=>s.identity.created,"Read original resource creation time.");
+    get!(MachineSnapshot,update_date,DateTime<Utc>,s=>s.updated,"Read this revision's publication time.");
+    get!(MachineSnapshot,status,MachineStatus,s=>s.status,"Read this snapshot's lifecycle phase.");
+    get!(MachineSnapshot,revision,&Arc<DefinitionRevision>,s=>&s.revision,"Read the captured immutable revision.");
+    get!(MachineSnapshot,tags,&Tags,s=>&s.tags.value,"Read this snapshot's atomic tags.");
+}
+#[derive(Clone)]
+pub(super) struct ExecutionIdentity {
+    pub(super) arn: ExecutionArn,
+    pub(super) machine: Arc<MachineIdentity>,
+    pub(super) started: DateTime<Utc>,
+    pub(super) trace: Option<String>,
+}
+redacted!(ExecutionIdentity);
+pub(super) struct ExecutionRecord {
+    pub(super) lineage: Lineage,
+    pub(super) deadline: Option<StdInstant>,
+    pub(super) identity: ExecutionIdentity,
+    pub(super) input: Payload,
+    pub(super) revision: Arc<DefinitionRevision>,
+    pub(super) handle: ExecutionHandle,
+    pub(super) _permit: OwnedSemaphorePermit,
+}
+redacted!(ExecutionRecord);
+/// Captured execution identity/revision plus one atomic engine read boundary.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct ExecutionSnapshot {
+    pub(super) record: Arc<ExecutionRecord>,
+    pub(super) view: Arc<ExecutionView>,
+}
+redacted!(ExecutionSnapshot);
+impl ExecutionSnapshot {
+    /// Observe termination while preserving captured identity and revision.
+    ///
+    /// # Errors
+    /// Returns the execution observer deadline/owner error without cancellation.
+    ///
+    /// ```no_run
+    /// # async fn inspect(snapshot:&rustack_stepfunctions_core::ExecutionSnapshot,deadline:tokio::time::Instant){let result=snapshot.wait(deadline).await;}
+    /// ```
+    pub async fn wait(&self, deadline: Instant) -> Result<Self, ExecutionError> {
+        let mut handle = self.handle();
+        let view = handle.wait(deadline).await?;
+        Ok(Self {
+            record: self.record.clone(),
+            view,
+        })
+    }
+    get!(ExecutionSnapshot,arn,&ExecutionArn,s=>&s.record.identity.arn,"Read the scoped execution ARN.");
+    get!(ExecutionSnapshot,resource_id,&str,s=>&s.record.identity.machine.resource,"Read the captured machine incarnation UUID.");
+    get!(ExecutionSnapshot,start_date,DateTime<Utc>,s=>s.record.identity.started,"Read original start acceptance time.");
+    get!(ExecutionSnapshot,trace_header,Option<&str>,s=>s.record.identity.trace.as_deref(),"Read optional original trace metadata.");
+    get!(ExecutionSnapshot,input,&Payload,s=>&s.record.input,"Read parsed input and its exact original bytes.");
+    get!(ExecutionSnapshot,revision,&Arc<DefinitionRevision>,s=>&s.record.revision,"Read the revision captured at Start, even after deletion.");
+    get!(ExecutionSnapshot,view,&Arc<ExecutionView>,s=>&s.view,"Read the immutable atomic history/outcome capture.");
+    get!(ExecutionSnapshot,handle,ExecutionHandle,s=>s.record.handle.clone(),"Create an independent observer/control handle; dropping it does not cancel.");
+}
+
+/// Precomputed source fingerprint and compiled IR, prepared under caller CPU admission.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct PreparedDefinition {
+    pub(super) machine: Arc<CompiledMachine>,
+    pub(super) hash: [u8; 32],
+}
+redacted!(PreparedDefinition);
+impl PreparedDefinition {
+    /// Fingerprint an already validated bounded definition.
+    ///
+    /// Registry admission rejects nested scope artifacts; their source bytes
+    /// identify the enclosing root definition, not a standalone revision.
+    ///
+    /// Async callers run compilation and this synchronous preparation under their
+    /// retained bounded CPU owner before submitting a registry command.
+    ///
+    /// ```
+    /// let compiled=rustack_stepfunctions_core::AslCompiler::default().compile(br#"{"StartAt":"D","States":{"D":{"Type":"Succeed"}}}"#)?;
+    /// let prepared=rustack_stepfunctions_core::PreparedDefinition::new(compiled.machine().clone());
+    /// # Ok::<(),rustack_stepfunctions_core::CompileError>(())
+    /// ```
+    #[must_use]
+    pub fn new(machine: Arc<CompiledMachine>) -> Self {
+        let hash = Sha256::digest(machine.original_bytes()).into();
+        Self { machine, hash }
+    }
+}
+
+/// Validated external Stop fields, retaining omission separately from empty strings.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct StopReason(pub(super) TaskFailure);
+redacted!(StopReason);
+impl StopReason {
+    /// Validate optional Stop error/cause without interpreting them as matchers.
+    ///
+    /// # Errors
+    /// Rejects error above256 bytes or cause above32,768 bytes.
+    ///
+    /// ```
+    /// let reason=rustack_stepfunctions_core::StopReason::new(None,Some(String::new()))?;
+    /// # Ok::<(),rustack_stepfunctions_core::RegistryError>(())
+    /// ```
+    pub fn new(error: Option<String>, cause: Option<String>) -> Result<Self, RegistryError> {
+        if error.as_ref().is_some_and(|v| v.len() > 256)
+            || cause.as_ref().is_some_and(|v| v.len() > 32768)
+        {
+            return Err(RegistryError::Validation);
+        }
+        Ok(Self(TaskFailure(ExecutionFailure::fields(error, cause))))
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/task.rs b/crates/rustack-stepfunctions-core/src/task.rs
new file mode 100644
index 00000000..cb331290
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/task.rs
@@ -0,0 +1,471 @@
+//! Object-safe bounded task admission and independent result/cleanup receipts.
+//!
+//! Admission is synchronous: an adapter must transfer its start future to a
+//! retained manager before returning a call. Concrete waits need no async-trait.
+//! Dropping a call only signals cancellation; adapter ownership is independent.
+
+use std::{fmt, sync::Arc};
+
+use thiserror::Error;
+use tokio::sync::{mpsc, watch};
+
+use crate::{
+    CallbackError, CallbackInvocationReporter, CompiledMachine, FrameCallId, Integration, Payload,
+    StateView, TaskDispatch, TaskFailure,
+};
+
+/// Immutable captured instruction and evaluated parameters for one attempt.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct LambdaTaskCommand {
+    machine: Arc<CompiledMachine>,
+    dispatch: TaskDispatch,
+    mode: LambdaTaskMode,
+}
+#[derive(Debug)]
+enum LambdaTaskMode {
+    Response,
+    Observed(Option<CallbackInvocationReporter>),
+}
+impl LambdaTaskCommand {
+    pub(crate) fn new(machine: Arc<CompiledMachine>, dispatch: TaskDispatch) -> Self {
+        Self {
+            machine,
+            dispatch,
+            mode: LambdaTaskMode::Response,
+        }
+    }
+    /// Bind one real optimized invocation to its unique callback attempt.
+    ///
+    /// # Errors
+    /// Rejects another scope/frame/generation, a nonoptimized Task or expired control.
+    ///
+    /// ```
+    /// # fn bind(m:std::sync::Arc<rustack_stepfunctions_core::CompiledMachine>,d:rustack_stepfunctions_core::TaskDispatch,c:rustack_stepfunctions_core::FrameCallId,r:rustack_stepfunctions_core::CallbackInvocationReporter){let command=rustack_stepfunctions_core::LambdaTaskCommand::observed_callback(m,d,c,r);}
+    /// ```
+    pub fn observed_callback(
+        machine: Arc<CompiledMachine>,
+        mut dispatch: TaskDispatch,
+        call: FrameCallId,
+        reporter: CallbackInvocationReporter,
+    ) -> Result<Self, CallbackError> {
+        let deadline = reporter.bind(machine.scope(), call)?;
+        if dispatch.attempt() != call.attempt()
+            || !matches!(
+                machine.state(dispatch.state()),
+                Ok(StateView::Task {
+                    resource: Integration::LambdaInvoke | Integration::LambdaCallback(_),
+                    ..
+                })
+            )
+        {
+            return Err(CallbackError::Validation);
+        }
+        dispatch.deadline = dispatch.deadline.min(deadline.into_std());
+        Ok(Self {
+            machine,
+            dispatch,
+            mode: LambdaTaskMode::Observed(Some(reporter)),
+        })
+    }
+    /// Identify explicit callback observation even after its reporter transfers.
+    ///
+    /// ```
+    /// # fn inspect(c:&rustack_stepfunctions_core::LambdaTaskCommand){let callback=c.is_observed_callback();}
+    /// ```
+    #[must_use]
+    pub fn is_observed_callback(&self) -> bool {
+        matches!(self.mode, LambdaTaskMode::Observed(_))
+    }
+    /// Transfer the real invocation report capability once, after validating a plan.
+    ///
+    /// # Errors
+    /// Rejects consumed, expired or revoked callback control. Ordinary commands
+    /// return `None` and keep their response mapping.
+    ///
+    /// ```
+    /// # fn take(c:&mut rustack_stepfunctions_core::LambdaTaskCommand){let reporter=c.take_callback_reporter();}
+    /// ```
+    pub fn take_callback_reporter(
+        &mut self,
+    ) -> Result<Option<CallbackInvocationReporter>, CallbackError> {
+        match &mut self.mode {
+            LambdaTaskMode::Response => Ok(None),
+            LambdaTaskMode::Observed(reporter) => {
+                reporter
+                    .as_ref()
+                    .ok_or(CallbackError::Progress)?
+                    .check_live()?;
+                Ok(Some(reporter.take().ok_or(CallbackError::Progress)?))
+            }
+        }
+    }
+    /// Read the captured artifact; the dispatch's state ID belongs to this machine.
+    ///
+    /// ```
+    /// # fn inspect(c:&rustack_stepfunctions_core::LambdaTaskCommand) { let ir=c.machine(); }
+    /// ```
+    #[must_use]
+    pub fn machine(&self) -> &Arc<CompiledMachine> {
+        &self.machine
+    }
+    /// Read parameters, attempt identity and the absolute admission/call deadline.
+    ///
+    /// ```
+    /// # fn inspect(c:&rustack_stepfunctions_core::LambdaTaskCommand) { let attempt=c.dispatch().attempt(); }
+    /// ```
+    #[must_use]
+    pub fn dispatch(&self) -> &TaskDispatch {
+        &self.dispatch
+    }
+}
+
+/// Adapter installed by the composition root, never a fake production fallback.
+pub trait LambdaTaskPort: fmt::Debug + Send + Sync {
+    /// Admit exactly one call without blocking or losing ownership of its start.
+    ///
+    /// The adapter must check the command deadline before accepting/issuing work,
+    /// retain accepted start/cleanup futures, and never retry a business call.
+    ///
+    /// # Errors
+    /// Returns a bounded service/admission failure before transferring a call.
+    ///
+    /// ```
+    /// # fn admit(p:&dyn rustack_stepfunctions_core::LambdaTaskPort,c:rustack_stepfunctions_core::LambdaTaskCommand) {
+    /// let call=p.start(c);
+    /// # }
+    /// ```
+    fn start(&self, command: LambdaTaskCommand) -> Result<TaskCall, TaskFailure>;
+}
+
+/// Cleanup truth, separate from delivery of the business result.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum TaskSettlement {
+    /// Still owned; no cleanup proof.
+    Pending,
+    /// Resource cleanup is confirmed by its retained adapter owner.
+    Clean,
+    /// An uncertain resource remains owned and charged.
+    Quarantined,
+}
+/// At most one start and one result per call; no payload is printed by Debug.
+#[derive(Debug)]
+#[non_exhaustive]
+pub enum TaskEvent {
+    /// The adapter actually admitted the underlying invocation.
+    Started,
+    /// A real accepted nested job identity, before its terminal result.
+    Submitted(Payload),
+    /// A business result; consult settlement separately before releasing capacity.
+    Completed(Result<Payload, TaskFailure>),
+}
+/// Static call-channel/lifecycle failures; closed channels never imply cleanup.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum TaskChannelError {
+    /// The adapter terminated without the promised event/settlement.
+    #[error("Lambda task owner lost")]
+    OwnerLost,
+    /// Adapter attempted an invalid or duplicate progress transition.
+    #[error("invalid Lambda task progress")]
+    InvalidProgress,
+}
+
+/// The execution owner's cancellable result/settlement receipt.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct TaskCall {
+    events: mpsc::Receiver<TaskEvent>,
+    cancellation: watch::Sender<bool>,
+    settlement: watch::Receiver<TaskSettlement>,
+}
+/// The adapter's completion capability; keep beside the actual invocation handle.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct TaskResponder {
+    events: mpsc::Sender<TaskEvent>,
+    cancellation: watch::Receiver<bool>,
+    settlement: watch::Sender<TaskSettlement>,
+    started: bool,
+    submitted: bool,
+}
+/// Adapter-owned uncertain cleanup capability; Drop never fabricates settlement.
+#[derive(Debug)]
+#[non_exhaustive]
+pub struct QuarantinedTask(TaskResponder);
+
+#[derive(Debug)]
+pub(crate) struct TaskCompletion(TaskResponder);
+impl TaskCompletion {
+    pub(crate) fn settle(self) {
+        self.0.settlement.send_replace(TaskSettlement::Clean);
+    }
+}
+
+impl TaskCall {
+    /// Create bounded channels before admission; the adapter owns the responder.
+    ///
+    /// ```
+    /// let (call,owner)=rustack_stepfunctions_core::TaskCall::channel();
+    /// assert_eq!(call.settlement(),rustack_stepfunctions_core::TaskSettlement::Pending);
+    /// ```
+    #[must_use]
+    pub fn channel() -> (Self, TaskResponder) {
+        let (events, receiver) = mpsc::channel(4);
+        let (cancellation, cancelled) = watch::channel(false);
+        let (settlement, settled) = watch::channel(TaskSettlement::Pending);
+        (
+            Self {
+                events: receiver,
+                cancellation,
+                settlement: settled,
+            },
+            TaskResponder {
+                events,
+                cancellation: cancelled,
+                settlement,
+                started: false,
+                submitted: false,
+            },
+        )
+    }
+    /// Receive progress/result without spawning or aborting the adapter's worker.
+    ///
+    /// # Errors
+    /// Returns `OwnerLost` if the adapter closes without another event.
+    ///
+    /// ```no_run
+    /// # async fn next(call:&mut rustack_stepfunctions_core::TaskCall) {
+    /// let event=call.next().await;
+    /// # }
+    /// ```
+    pub async fn next(&mut self) -> Result<TaskEvent, TaskChannelError> {
+        self.events.recv().await.ok_or(TaskChannelError::OwnerLost)
+    }
+    pub(crate) fn settlement_receiver(&self) -> watch::Receiver<TaskSettlement> {
+        self.settlement.clone()
+    }
+    pub(crate) fn cancellation_sender(&self) -> watch::Sender<bool> {
+        self.cancellation.clone()
+    }
+
+    /// Signal cancellation while preserving the settlement receipt.
+    ///
+    /// ```
+    /// let (call,owner)=rustack_stepfunctions_core::TaskCall::channel();
+    /// call.cancel();
+    /// ```
+    pub fn cancel(&self) {
+        self.cancellation.send_replace(true);
+    }
+    /// Read cleanup truth; channel closure is never mapped to Clean.
+    ///
+    /// ```
+    /// let (call,owner)=rustack_stepfunctions_core::TaskCall::channel();
+    /// assert_ne!(call.settlement(),rustack_stepfunctions_core::TaskSettlement::Clean);
+    /// ```
+    #[must_use]
+    pub fn settlement(&self) -> TaskSettlement {
+        *self.settlement.borrow()
+    }
+    /// Await Clean; cancelling this waiter preserves the same receipt and owner.
+    ///
+    /// # Errors
+    /// Returns `OwnerLost` if the owner disappears before confirming cleanup.
+    ///
+    /// ```no_run
+    /// # async fn join(call:&mut rustack_stepfunctions_core::TaskCall) {
+    /// let cleanup=call.settled().await;
+    /// # }
+    /// ```
+    pub async fn settled(&mut self) -> Result<(), TaskChannelError> {
+        self.settlement
+            .wait_for(|state| *state == TaskSettlement::Clean)
+            .await
+            .map(|_| ())
+            .map_err(|_| TaskChannelError::OwnerLost)
+    }
+}
+impl Drop for TaskCall {
+    fn drop(&mut self) {
+        self.cancel();
+    }
+}
+impl TaskResponder {
+    /// Subscribe to cancellation without transferring actual resource ownership.
+    ///
+    /// ```
+    /// let (call,owner)=rustack_stepfunctions_core::TaskCall::channel();
+    /// let cancellation=owner.cancellation();
+    /// call.cancel();
+    /// assert!(*cancellation.borrow());
+    /// ```
+    #[must_use]
+    pub fn cancellation(&self) -> watch::Receiver<bool> {
+        self.cancellation.clone()
+    }
+    /// Report actual underlying invocation start once; a lost observer is harmless.
+    ///
+    /// # Errors
+    /// Rejects duplicate starts or impossible bounded-channel overflow.
+    ///
+    /// ```
+    /// let (call,mut owner)=rustack_stepfunctions_core::TaskCall::channel();
+    /// owner.started()?;
+    /// # Ok::<(),rustack_stepfunctions_core::TaskChannelError>(())
+    /// ```
+    pub fn started(&mut self) -> Result<(), TaskChannelError> {
+        if self.started {
+            return Err(TaskChannelError::InvalidProgress);
+        }
+        self.started = true;
+        match self.events.try_send(TaskEvent::Started) {
+            Ok(()) | Err(mpsc::error::TrySendError::Closed(_)) => Ok(()),
+            Err(mpsc::error::TrySendError::Full(_)) => Err(TaskChannelError::InvalidProgress),
+        }
+    }
+    /// Publish one actual accepted job envelope after Started.
+    ///
+    /// # Errors
+    /// Rejects duplicate, out-of-order or overflowing progress.
+    ///
+    /// ```
+    /// let (_, mut owner) = rustack_stepfunctions_core::TaskCall::channel();
+    /// owner.started()?;
+    /// owner.submitted(rustack_stepfunctions_core::Payload::parse(b"{}")?)?;
+    /// # Ok::<(),Box<dyn std::error::Error>>(())
+    /// ```
+    pub fn submitted(&mut self, output: Payload) -> Result<(), TaskChannelError> {
+        if !self.started || self.submitted {
+            return Err(TaskChannelError::InvalidProgress);
+        }
+        self.submitted = true;
+        match self.events.try_send(TaskEvent::Submitted(output)) {
+            Ok(()) | Err(mpsc::error::TrySendError::Closed(_)) => Ok(()),
+            Err(mpsc::error::TrySendError::Full(_)) => Err(TaskChannelError::InvalidProgress),
+        }
+    }
+    pub(crate) fn complete(self, result: Result<Payload, TaskFailure>) -> TaskCompletion {
+        let _ = self.events.try_send(TaskEvent::Completed(result));
+        TaskCompletion(self)
+    }
+    /// Confirm cleanup and deliver one result, even if its observer has departed.
+    ///
+    /// Only the adapter that has joined the real resource may call this method.
+    ///
+    /// ```
+    /// let (call,owner)=rustack_stepfunctions_core::TaskCall::channel();
+    /// owner.finish(Ok(rustack_stepfunctions_core::Payload::parse(b"true")?));
+    /// assert_eq!(call.settlement(),rustack_stepfunctions_core::TaskSettlement::Clean);
+    /// # Ok::<(),rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn finish(self, result: Result<Payload, TaskFailure>) {
+        self.settlement.send_replace(TaskSettlement::Clean);
+        let _ = self.events.try_send(TaskEvent::Completed(result));
+    }
+    /// Deliver an uncertain business failure and retain cleanup ownership.
+    ///
+    /// Store the returned receipt beside the resource until actual joined cleanup.
+    ///
+    /// ```
+    /// let (call,owner)=rustack_stepfunctions_core::TaskCall::channel();
+    /// let failure=rustack_stepfunctions_core::TaskFailure::new("Lambda.ServiceException",None)?;
+    /// let retained=owner.quarantine(failure);
+    /// assert_eq!(call.settlement(),rustack_stepfunctions_core::TaskSettlement::Quarantined);
+    /// # Ok::<(),rustack_stepfunctions_core::AslError>(())
+    /// ```
+    #[must_use]
+    pub fn quarantine(self, failure: TaskFailure) -> QuarantinedTask {
+        self.settlement.send_replace(TaskSettlement::Quarantined);
+        let _ = self.events.try_send(TaskEvent::Completed(Err(failure)));
+        QuarantinedTask(self)
+    }
+}
+impl QuarantinedTask {
+    /// Read cancellation while uncertain cleanup remains owned.
+    ///
+    /// ```
+    /// # fn inspect(owner:&rustack_stepfunctions_core::QuarantinedTask) { let stop=owner.cancellation(); }
+    /// ```
+    #[must_use]
+    pub fn cancellation(&self) -> watch::Receiver<bool> {
+        self.0.cancellation()
+    }
+    /// Confirm actual joined cleanup without redelivering a business result.
+    ///
+    /// ```
+    /// # fn joined(owner:rustack_stepfunctions_core::QuarantinedTask) { owner.settle(); }
+    /// ```
+    pub fn settle(self) {
+        self.0.settlement.send_replace(TaskSettlement::Clean);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use tokio::time::{Instant, timeout};
+
+    use super::*;
+    #[tokio::test]
+    async fn test_should_preserve_started_and_result_order_with_fast_completion() {
+        let (mut call, mut owner) = TaskCall::channel();
+        owner.started().unwrap();
+        assert!(owner.started().is_err());
+        owner.finish(Ok(Payload::parse(b"true").unwrap()));
+        assert!(matches!(call.next().await, Ok(TaskEvent::Started)));
+        assert!(matches!(call.next().await, Ok(TaskEvent::Completed(Ok(_)))));
+        call.settled().await.unwrap();
+    }
+    #[tokio::test]
+    async fn test_should_resume_same_cleanup_receipt_after_waiter_timeout() {
+        let (mut call, owner) = TaskCall::channel();
+        let cancelled = owner.cancellation();
+        call.cancel();
+        assert!(*cancelled.borrow());
+        let pending = owner.quarantine(TaskFailure::new("Lambda.ServiceException", None).unwrap());
+        assert!(
+            timeout(Duration::from_millis(10), call.settled())
+                .await
+                .is_err()
+        );
+        pending.settle();
+        call.settled().await.unwrap();
+        assert!(matches!(
+            call.next().await,
+            Ok(TaskEvent::Completed(Err(_)))
+        ));
+    }
+    #[tokio::test]
+    async fn test_should_not_treat_closed_channels_as_clean_settlement() {
+        let (mut call, owner) = TaskCall::channel();
+        drop(owner);
+        assert!(matches!(
+            call.next().await,
+            Err(TaskChannelError::OwnerLost)
+        ));
+        assert!(matches!(
+            call.settled().await,
+            Err(TaskChannelError::OwnerLost)
+        ));
+        assert_eq!(call.settlement(), TaskSettlement::Pending);
+        let (call, owner) = TaskCall::channel();
+        let cancelled = owner.cancellation();
+        drop(call);
+        assert!(*cancelled.borrow());
+    }
+    #[tokio::test]
+    async fn test_should_keep_quarantine_after_owner_receipt_is_lost() {
+        let (mut call, owner) = TaskCall::channel();
+        let retained = owner.quarantine(TaskFailure::new("Lambda.ServiceException", None).unwrap());
+        drop(retained);
+        assert!(matches!(
+            call.settled().await,
+            Err(TaskChannelError::OwnerLost)
+        ));
+        assert_eq!(call.settlement(), TaskSettlement::Quarantined);
+        assert!(Instant::now().elapsed() < Duration::from_secs(1));
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/template.rs b/crates/rustack-stepfunctions-core/src/template.rs
new file mode 100644
index 00000000..ffab469b
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/template.rs
@@ -0,0 +1,312 @@
+//! Compiled collision-free templates and bounded borrowed output preparation.
+
+use std::{collections::BTreeMap, fmt};
+
+use serde::{
+    Serialize, Serializer,
+    ser::{SerializeMap, SerializeSeq},
+};
+use serde_json::Value;
+
+use crate::{
+    AslError, CallbackHistory, CallbackParameters, EvaluationContext, Expression, Payload,
+    SystemUuidSource, UuidSource,
+    expression::Budget,
+    payload::{encode, parse_component, validate_component},
+};
+
+/// Immutable compiled object template for Parameters/ResultSelector.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct Template(Node);
+
+#[derive(Clone)]
+enum Node {
+    Object(Vec<(String, Node)>),
+    Array(Vec<Node>),
+    Literal(Value),
+    Dynamic(Expression),
+}
+
+enum Prepared<'a> {
+    Object(Vec<(&'a str, Self)>),
+    Array(Vec<Self>),
+    Literal(&'a Value),
+    Dynamic { value: Payload, sensitive: bool },
+}
+
+impl fmt::Debug for Template {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Template(<redacted>)")
+    }
+}
+
+impl Template {
+    /// Validate source JSON and compile an object template.
+    ///
+    /// # Errors
+    /// Rejects duplicate fields, schema/compiled limits and invalid expressions.
+    ///
+    /// ```
+    /// let template=rustack_stepfunctions_core::Template::parse(br#"{"value.$":"$.n"}"#)?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn parse(input: &[u8]) -> Result<Self, AslError> {
+        Self::compile(&parse_component(input)?)
+    }
+
+    /// Compile a borrowed tree, rejecting collisions after one `.$` removal.
+    ///
+    /// # Errors
+    /// Rejects nonobject roots, invalid fields, more than32 container levels or
+    ///4,096 combined template/expression nodes.
+    ///
+    /// ```
+    /// let template=rustack_stepfunctions_core::Template::compile(&serde_json::json!({"n.$":"States.MathAdd($.n,1)"}))?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn compile(value: &Value) -> Result<Self, AslError> {
+        validate_component(value)?;
+        if !value.is_object() {
+            return Err(AslError::InvalidTemplate);
+        }
+        Ok(Self(compile(value, 0, &mut 4096)?))
+    }
+
+    /// Evaluate a template using fallible system UUID sourcing when needed.
+    ///
+    /// Async owners isolate entropy acquisition as documented by Expression.
+    ///
+    /// # Errors
+    /// Returns expression, payload or shared resource-budget failures.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Template,Payload,EvaluationContext};
+    /// let input=Payload::parse(br#"{"n":4}"#)?;
+    /// let template=Template::parse(br#"{"value.$":"$.n"}"#)?;
+    /// assert_eq!(template.evaluate(&input,&EvaluationContext::from(&input))?.value(),&serde_json::json!({"value":4}));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn evaluate(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+    ) -> Result<Payload, AslError> {
+        self.evaluate_with_source(data, context, &mut SystemUuidSource)
+    }
+
+    /// Evaluate all dynamic fields under one shared budget and UUID source.
+    ///
+    /// # Errors
+    /// Returns typed data/expression/source failures without partial output.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{Template,Payload,EvaluationContext,SystemUuidSource};
+    /// let input=Payload::parse(b"null")?;
+    /// let template=Template::parse(b"{}")?;
+    /// let output=template.evaluate_with_source(&input,&EvaluationContext::from(&input),&mut SystemUuidSource::default())?;
+    /// assert!(output.value().is_object());
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn evaluate_with_source<S: UuidSource + ?Sized>(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+        source: &mut S,
+    ) -> Result<Payload, AslError> {
+        self.evaluate_scoped(data, context, source, &mut Budget::new())
+    }
+
+    pub(crate) fn node_count(&self) -> usize {
+        fn count(node: &Node) -> usize {
+            match node {
+                Node::Literal(_) => 1,
+                Node::Dynamic(expression) => 1_usize.saturating_add(expression.node_count()),
+                Node::Object(fields) => fields
+                    .iter()
+                    .fold(1_usize, |n, (_, node)| n.saturating_add(count(node))),
+                Node::Array(values) => values
+                    .iter()
+                    .fold(1_usize, |n, node| n.saturating_add(count(node))),
+            }
+        }
+        count(&self.0)
+    }
+
+    pub(crate) fn evaluate_scoped<S: UuidSource + ?Sized>(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+        source: &mut S,
+        budget: &mut Budget,
+    ) -> Result<Payload, AslError> {
+        let prepared = prepare(&self.0, data, context, source, budget, None)?;
+        let result = Payload::from_bytes(encode(&prepared)?)?;
+        budget.result(&result)?;
+        Ok(result)
+    }
+    pub(crate) fn evaluate_callback<S: UuidSource + ?Sized>(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+        source: &mut S,
+        budget: &mut Budget,
+        input_sensitive: bool,
+    ) -> Result<CallbackParameters, AslError> {
+        let prepared = prepare(
+            &self.0,
+            data,
+            context,
+            source,
+            budget,
+            Some(input_sensitive),
+        )?;
+        let outbound = Payload::from_bytes(encode(&prepared)?)?;
+        budget.result(&outbound)?;
+        let redacted = prepared.sensitive();
+        let history = if redacted {
+            Payload::from_bytes(encode(&Projection {
+                node: &prepared,
+                history: true,
+            })?)?
+        } else {
+            outbound.clone()
+        };
+        budget.result(&history)?;
+        Ok(CallbackParameters {
+            outbound,
+            history: CallbackHistory {
+                payload: history,
+                redacted,
+            },
+        })
+    }
+}
+
+fn compile(value: &Value, depth: usize, remaining: &mut usize) -> Result<Node, AslError> {
+    *remaining = remaining.checked_sub(1).ok_or(AslError::InvalidTemplate)?;
+    if (value.is_object() || value.is_array()) && depth >= 32 {
+        return Err(AslError::InvalidTemplate);
+    }
+    match value {
+        Value::Object(fields) => {
+            let mut result = BTreeMap::new();
+            for (key, value) in fields {
+                let (name, dynamic) = key
+                    .strip_suffix(".$")
+                    .map_or((key.as_str(), false), |name| (name, true));
+                if result.contains_key(name) {
+                    return Err(AslError::InvalidTemplate);
+                }
+                let node = if dynamic {
+                    *remaining = remaining.checked_sub(1).ok_or(AslError::InvalidTemplate)?;
+                    let expression: Expression =
+                        value.as_str().ok_or(AslError::InvalidTemplate)?.parse()?;
+                    *remaining = remaining
+                        .checked_sub(expression.node_count())
+                        .ok_or(AslError::InvalidTemplate)?;
+                    Node::Dynamic(expression)
+                } else {
+                    compile(value, depth.saturating_add(1), remaining)?
+                };
+                result.insert(name.to_owned(), node);
+            }
+            Ok(Node::Object(result.into_iter().collect()))
+        }
+        Value::Array(values) => values
+            .iter()
+            .map(|value| compile(value, depth.saturating_add(1), remaining))
+            .collect::<Result<Vec<_>, _>>()
+            .map(Node::Array),
+        value => Ok(Node::Literal(value.clone())),
+    }
+}
+
+fn prepare<'a, S: UuidSource + ?Sized>(
+    node: &'a Node,
+    data: &Payload,
+    context: &EvaluationContext,
+    source: &mut S,
+    budget: &mut Budget,
+    input_sensitive: Option<bool>,
+) -> Result<Prepared<'a>, AslError> {
+    budget.work(1)?;
+    match node {
+        Node::Literal(value) => Ok(Prepared::Literal(value)),
+        Node::Dynamic(expression) => expression
+            .evaluate_scoped(data, context, source, budget)
+            .map(|value| Prepared::Dynamic {
+                value,
+                sensitive: input_sensitive
+                    .is_some_and(|input| expression.callback_sensitive(input)),
+            }),
+        Node::Object(fields) => fields
+            .iter()
+            .map(|(key, value)| {
+                prepare(value, data, context, source, budget, input_sensitive)
+                    .map(|value| (key.as_str(), value))
+            })
+            .collect::<Result<Vec<_>, _>>()
+            .map(Prepared::Object),
+        Node::Array(values) => values
+            .iter()
+            .map(|value| prepare(value, data, context, source, budget, input_sensitive))
+            .collect::<Result<Vec<_>, _>>()
+            .map(Prepared::Array),
+    }
+}
+
+struct Projection<'node, 'template> {
+    node: &'node Prepared<'template>,
+    history: bool,
+}
+impl Prepared<'_> {
+    fn sensitive(&self) -> bool {
+        match self {
+            Self::Dynamic { sensitive, .. } => *sensitive,
+            Self::Object(fields) => fields.iter().any(|(_, node)| node.sensitive()),
+            Self::Array(nodes) => nodes.iter().any(Self::sensitive),
+            Self::Literal(_) => false,
+        }
+    }
+    fn serialize_projection<S: Serializer>(
+        &self,
+        serializer: S,
+        history: bool,
+    ) -> Result<S::Ok, S::Error> {
+        match self {
+            Self::Literal(value) => value.serialize(serializer),
+            Self::Dynamic {
+                sensitive: true, ..
+            } if history => serializer.serialize_none(),
+            Self::Dynamic { value, .. } => value.value().serialize(serializer),
+            Self::Object(fields) => {
+                let mut output = serializer.serialize_map(Some(fields.len()))?;
+                for (key, node) in fields {
+                    output.serialize_entry(key, &Projection { node, history })?;
+                }
+                output.end()
+            }
+            Self::Array(nodes) => {
+                let mut output = serializer.serialize_seq(Some(nodes.len()))?;
+                for node in nodes {
+                    output.serialize_element(&Projection { node, history })?;
+                }
+                output.end()
+            }
+        }
+    }
+}
+impl Serialize for Prepared<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        self.serialize_projection(serializer, false)
+    }
+}
+impl Serialize for Projection<'_, '_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        self.node.serialize_projection(serializer, self.history)
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/template/tests.rs b/crates/rustack-stepfunctions-core/src/template/tests.rs
new file mode 100644
index 00000000..e019b67c
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/template/tests.rs
@@ -0,0 +1,183 @@
+use std::error::Error;
+
+use proptest::prelude::*;
+use rstest::rstest;
+use serde_json::{Map, Value, json};
+use uuid::{Builder, Uuid};
+
+use crate::{AslError, EvaluationContext, Payload, Template, UuidSource};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+#[derive(Default)]
+struct Ids(u8);
+impl UuidSource for Ids {
+    fn next_uuid(&mut self) -> Result<Uuid, AslError> {
+        self.0 = self.0.checked_add(1).ok_or(AslError::WorkLimit)?;
+        Ok(Builder::from_random_bytes([self.0; 16]).into_uuid())
+    }
+}
+
+#[test]
+fn test_should_expand_nested_arrays_context_and_intrinsics_without_reinterpreting_literals()
+-> TestResult {
+    let original = Payload::from_value(&json!({"n":3}))?;
+    let context = EvaluationContext::from_value(&json!({"Execution":{"Name":"run"}}))?;
+    let template = Template::compile(&json!({
+        "literal":"$.n","code":"States.UUID()",
+        "nested":[{"n.$":"States.MathAdd($.n,1)","run.$":"$$.Execution.Name"},"$.n"],
+        "name.$.$":"$.n","a0":1,"a.$":"$.n","a-":2
+    }))?;
+    let output = template.evaluate(&original, &context)?;
+    assert_eq!(
+        output.value(),
+        &json!({"literal":"$.n","code":"States.UUID()","nested":[{"n":4,"run":"run"},"$.n"],"name.$":3,"a0":1,"a":3,"a-":2})
+    );
+    assert!(
+        output
+            .original_bytes()
+            .starts_with(br#"{"a":3,"a-":2,"a0":1"#)
+    );
+    assert_eq!(original.value(), &json!({"n":3}));
+    assert_eq!(format!("{template:?}"), "Template(<redacted>)");
+    Ok(())
+}
+
+#[rstest]
+#[case(json!([]))]
+#[case(json!(null))]
+#[case(json!({"a":1,"a.$":"$.x"}))]
+#[case(json!({"nested":[{"a":1,"a.$":"$.x"}]}))]
+#[case(json!({"a.$":null}))]
+#[case(json!({"a.$":1}))]
+#[case(json!({"a.$":"literal"}))]
+fn test_should_reject_invalid_template_roots_dynamic_values_and_normalized_collisions(
+    #[case] value: Value,
+) {
+    assert!(Template::compile(&value).is_err());
+}
+
+#[test]
+fn test_should_apply_one_shared_source_to_all_dynamic_fields() -> TestResult {
+    let template = Template::compile(&json!({"b.$":"States.UUID()","a.$":"States.UUID()"}))?;
+    let input = Payload::parse(b"null")?;
+    let mut ids = Ids::default();
+    let output =
+        template.evaluate_with_source(&input, &EvaluationContext::from(&input), &mut ids)?;
+    assert_eq!(ids.0, 2);
+    assert_eq!(
+        output.value()["a"],
+        json!(Builder::from_random_bytes([1; 16]).into_uuid().to_string())
+    );
+    assert_eq!(
+        output.value()["b"],
+        json!(Builder::from_random_bytes([2; 16]).into_uuid().to_string())
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_stream_oversized_constant_and_dynamic_results_before_owning_output() -> TestResult {
+    let input = Payload::from_value(&json!({"x":"a".repeat(140_000)}))?;
+    let context = EvaluationContext::from(&input);
+    let dynamic = Template::compile(&json!({"a.$":"$.x","b.$":"$.x"}))?;
+    assert!(matches!(
+        dynamic.evaluate(&input, &context),
+        Err(AslError::DataLimit)
+    ));
+    let constants = Template::compile(&json!({"a":"a".repeat(150_000),"b":"b".repeat(150_000)}))?;
+    assert!(matches!(
+        constants.evaluate(&input, &context),
+        Err(AslError::DataLimit)
+    ));
+    assert_eq!(
+        input.value()["x"].as_str().ok_or("missing x")?.len(),
+        140_000
+    );
+    Ok(())
+}
+
+#[test]
+fn test_should_share_work_across_fields_and_charge_embedded_expression_nodes() -> TestResult {
+    let input = Payload::from_value(&json!({"items":vec![0;6000]}))?;
+    let context = EvaluationContext::from(&input);
+    let one = Template::compile(&json!({"a.$":"States.ArrayLength($.items[*])"}))?;
+    assert_eq!(one.evaluate(&input, &context)?.value(), &json!({"a":6000}));
+    let two = Template::compile(
+        &json!({"a.$":"States.ArrayLength($.items[*])","b.$":"States.ArrayLength($.items[*])"}),
+    )?;
+    assert!(matches!(
+        two.evaluate(&input, &context),
+        Err(AslError::WorkLimit)
+    ));
+    let group = format!("States.Array({})", vec!["0"; 127].join(","));
+    let four = format!("States.Array({})", vec![group; 8].join(","));
+    // This expression has1,025 nodes and is independently invalid.
+    assert!(Template::compile(&json!({"a.$":four})).is_err());
+    let expression = format!("States.Array({})", vec!["0"; 128].join(","));
+    let mut fields = Map::new();
+    for index in 0..32 {
+        fields.insert(format!("k{index}.$"), json!(expression));
+    }
+    assert!(matches!(
+        Template::compile(&Value::Object(fields)),
+        Err(AslError::InvalidTemplate)
+    ));
+    let mut exact = Map::new();
+    for index in 0..31 {
+        exact.insert(format!("k{index}.$"), json!(expression));
+    }
+    exact.insert(
+        "last.$".into(),
+        json!(format!("States.Array({})", vec!["0"; 63].join(","))),
+    );
+    let valid = Template::compile(&Value::Object(exact.clone()))?;
+    valid.evaluate(&input, &context)?;
+    exact.insert(
+        "last.$".into(),
+        json!(format!("States.Array({})", vec!["0"; 64].join(","))),
+    );
+    assert!(matches!(
+        Template::compile(&Value::Object(exact)),
+        Err(AslError::InvalidTemplate)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_enforce_template_depth_and_reject_borrowed_extreme_trees_safely() -> TestResult {
+    let mut nested = Value::Null;
+    for _ in 0..31 {
+        nested = json!([nested]);
+    }
+    Template::compile(&json!({"value":nested}))?;
+    assert!(matches!(
+        Template::compile(&json!({"value":[nested]})),
+        Err(AslError::InvalidTemplate)
+    ));
+    let mut tree = Value::Null;
+    for _ in 0..50_000 {
+        tree = Value::Array(vec![tree]);
+    }
+    let rejected = Template::compile(&tree);
+    let mut owned = vec![tree];
+    while let Some(value) = owned.pop() {
+        if let Value::Array(mut values) = value {
+            owned.append(&mut values);
+        }
+    }
+    assert!(rejected.is_err());
+    assert!(Template::parse(br#"{"a":1,"a":2}"#).is_err());
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_strip_exactly_one_dynamic_suffix_for_arbitrary_business_keys(name in ".{0,20}", n in -1_000_000_i32..1_000_000) {
+        let template=Template::compile(&json!({format!("{name}.$"):"States.MathAdd($.n,1)"})).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let input=Payload::from_value(&json!({"n":n})).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        let output=template.evaluate(&input,&EvaluationContext::from(&input)).map_err(|e|TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(output.value(),&json!({name:n+1}));
+    }
+}
diff --git a/crates/rustack-stepfunctions-core/src/wait.rs b/crates/rustack-stepfunctions-core/src/wait.rs
new file mode 100644
index 00000000..cfe746ad
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/wait.rs
@@ -0,0 +1,161 @@
+//! Pure Wait source resolution; monotonic timers remain execution-actor-owned.
+
+use std::{fmt, time::Duration};
+
+use chrono::{DateTime, Timelike, Utc};
+use serde_json::Value;
+
+use crate::{
+    AslError, EvaluationContext, Payload, ReferencePath,
+    payload::{parse_component, validate_component},
+};
+
+const MAX_WAIT_SECONDS: u64 = 365 * 24 * 60 * 60;
+
+/// Compiled source for a single STANDARD Wait state, without transition fields.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct WaitSource(Source);
+
+#[derive(Clone)]
+enum Source {
+    Seconds(Duration),
+    SecondsPath(ReferencePath),
+    Timestamp(DateTime<Utc>),
+    TimestampPath(ReferencePath),
+}
+
+impl fmt::Debug for WaitSource {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("WaitSource(<redacted>)")
+    }
+}
+
+impl WaitSource {
+    /// Preflight source JSON and compile exactly one Wait source member.
+    ///
+    /// # Errors
+    /// Rejects duplicates/unknown fields, invalid static values and source limits.
+    ///
+    /// ```
+    /// let source = rustack_stepfunctions_core::WaitSource::parse(br#"{"Seconds":5}"#)?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn parse(input: &[u8]) -> Result<Self, AslError> {
+        let value = parse_component(input)?;
+        Self::compile(&value)
+    }
+
+    /// Compile a borrowed tree before owning any path or timestamp.
+    ///
+    /// # Errors
+    /// Rejects ambiguous/missing sources and unsupported static seconds/dates.
+    ///
+    /// ```
+    /// let source = rustack_stepfunctions_core::WaitSource::compile(
+    ///     &serde_json::json!({"SecondsPath":"$.delay"})
+    /// )?;
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn compile(value: &Value) -> Result<Self, AslError> {
+        validate_component(value)?;
+        let object = value
+            .as_object()
+            .filter(|v| v.len() == 1)
+            .ok_or(AslError::InvalidWait)?;
+        let (field, value) = object.iter().next().ok_or(AslError::InvalidWait)?;
+        let source = match field.as_str() {
+            "Seconds" => Source::Seconds(seconds(value).ok_or(AslError::InvalidWait)?),
+            "Timestamp" => Source::Timestamp(
+                value
+                    .as_str()
+                    .and_then(timestamp)
+                    .ok_or(AslError::InvalidWait)?,
+            ),
+            "SecondsPath" => {
+                Source::SecondsPath(value.as_str().ok_or(AslError::InvalidWait)?.parse()?)
+            }
+            "TimestampPath" => {
+                Source::TimestampPath(value.as_str().ok_or(AslError::InvalidWait)?.parse()?)
+            }
+            _ => return Err(AslError::InvalidWait),
+        };
+        Ok(Self(source))
+    }
+
+    /// Resolve once using the actor's supplied wall-time sample; never sleeps.
+    ///
+    /// The actor adds the returned relative duration to its paired monotonic
+    /// sample with checked arithmetic and retains independent execution expiry.
+    ///
+    /// # Errors
+    /// Missing dynamic paths, invalid dynamic values and waits over365 days fail.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_core::{WaitSource,Payload,EvaluationContext};
+    /// let data=Payload::parse(b"{}")?;
+    /// let source=WaitSource::parse(br#"{"Seconds":5}"#)?;
+    /// assert_eq!(source.resolve(&data,&EvaluationContext::from(&data),chrono::Utc::now())?,
+    ///            std::time::Duration::from_secs(5));
+    /// # Ok::<(), rustack_stepfunctions_core::AslError>(())
+    /// ```
+    pub fn resolve(
+        &self,
+        data: &Payload,
+        context: &EvaluationContext,
+        now: DateTime<Utc>,
+    ) -> Result<Duration, AslError> {
+        let target = match &self.0 {
+            Source::Seconds(duration) => return Ok(*duration),
+            Source::SecondsPath(path) => {
+                return seconds(path.lookup(data, context).ok_or(AslError::Missing)?)
+                    .ok_or(AslError::WaitValue);
+            }
+            Source::Timestamp(target) => *target,
+            Source::TimestampPath(path) => path
+                .lookup(data, context)
+                .ok_or(AslError::Missing)?
+                .as_str()
+                .and_then(timestamp)
+                .ok_or(AslError::WaitValue)?,
+        };
+        if now.nanosecond() >= 1_000_000_000 {
+            return Err(AslError::WaitValue);
+        }
+        if target <= now {
+            return Ok(Duration::ZERO);
+        }
+        let duration = target
+            .signed_duration_since(now)
+            .to_std()
+            .map_err(|_| AslError::WaitValue)?;
+        if duration > Duration::from_secs(MAX_WAIT_SECONDS) {
+            Err(AslError::WaitValue)
+        } else {
+            Ok(duration)
+        }
+    }
+}
+
+fn seconds(value: &Value) -> Option<Duration> {
+    value
+        .as_u64()
+        .filter(|n| *n <= MAX_WAIT_SECONDS)
+        .map(Duration::from_secs)
+}
+
+fn timestamp(value: &str) -> Option<DateTime<Utc>> {
+    if value.as_bytes().get(10) != Some(&b'T') || value.ends_with('z') {
+        return None;
+    }
+    let parsed = DateTime::parse_from_rfc3339(value).ok()?;
+    if parsed.nanosecond() >= 1_000_000_000 {
+        return None;
+    }
+    parsed
+        .with_nanosecond(0)
+        .map(|date| date.with_timezone(&Utc))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-core/src/wait/tests.rs b/crates/rustack-stepfunctions-core/src/wait/tests.rs
new file mode 100644
index 00000000..2f83b262
--- /dev/null
+++ b/crates/rustack-stepfunctions-core/src/wait/tests.rs
@@ -0,0 +1,164 @@
+use std::{error::Error, time::Duration};
+
+use chrono::{DateTime, Utc};
+use proptest::prelude::*;
+use rstest::rstest;
+use rustack_core::json::JsonError;
+use serde_json::{Value, json};
+
+use crate::{AslError, EvaluationContext, Payload, WaitSource};
+
+type TestResult = Result<(), Box<dyn Error>>;
+
+fn now() -> Result<DateTime<Utc>, AslError> {
+    DateTime::from_timestamp(0, 0).ok_or(AslError::WaitValue)
+}
+
+#[rstest]
+#[case(json!({"Seconds":0}),json!({}),0)]
+#[case(json!({"Seconds":5}),json!({}),5)]
+#[case(json!({"Seconds":31_536_000}),json!({}),31_536_000)]
+#[case(json!({"SecondsPath":"$.delay"}),json!({"delay":7}),7)]
+#[case(json!({"Timestamp":"1970-01-01T00:00:05Z"}),json!({}),5)]
+#[case(json!({"Timestamp":"1970-01-01T00:00:05.999999999999Z"}),json!({}),5)]
+#[case(json!({"Timestamp":"1970-01-01T01:00:05+01:00"}),json!({}),5)]
+#[case(json!({"Timestamp":"1970-01-01T00:00:00Z"}),json!({}),0)]
+#[case(json!({"Timestamp":"1969-12-31T23:59:59Z"}),json!({}),0)]
+#[case(json!({"Timestamp":"1971-01-01T00:00:00Z"}),json!({}),31_536_000)]
+#[case(json!({"TimestampPath":"$.date"}),json!({"date":"1970-01-01T00:00:05Z"}),5)]
+fn test_should_resolve_all_wait_source_forms(
+    #[case] source: Value,
+    #[case] input: Value,
+    #[case] seconds: u64,
+) -> TestResult {
+    let source = WaitSource::compile(&source)?;
+    let input = Payload::from_value(&input)?;
+    assert_eq!(
+        source.resolve(&input, &EvaluationContext::from(&input), now()?)?,
+        Duration::from_secs(seconds)
+    );
+    assert_eq!(format!("{source:?}"), "WaitSource(<redacted>)");
+    Ok(())
+}
+
+#[rstest]
+#[case(json!({}))]
+#[case(json!(null))]
+#[case(json!({"Unknown":1}))]
+#[case(json!({"Seconds":1,"Timestamp":"1970-01-01T00:00:00Z"}))]
+#[case(json!({"Seconds":1,"Comment":"unknown component field"}))]
+#[case(json!({"Seconds":1.0}))]
+#[case(json!({"Seconds":-1}))]
+#[case(json!({"Seconds":true}))]
+#[case(json!({"Seconds":"1"}))]
+#[case(json!({"Seconds":31_536_001}))]
+#[case(json!({"Seconds":99_999_999}))]
+#[case(json!({"Timestamp":"1970-01-01"}))]
+#[case(json!({"Timestamp":"1970-01-01t00:00:00Z"}))]
+#[case(json!({"Timestamp":"1970-01-01T00:00:00z"}))]
+#[case(json!({"Timestamp":"2016-12-31T23:59:60Z"}))]
+#[case(json!({"Timestamp":"2020-02-30T00:00:00Z"}))]
+#[case(json!({"Timestamp":0}))]
+#[case(json!({"SecondsPath":0}))]
+fn test_should_reject_ambiguous_or_invalid_static_wait_sources(#[case] value: Value) {
+    assert!(matches!(
+        WaitSource::compile(&value),
+        Err(AslError::InvalidWait)
+    ));
+}
+
+#[rstest]
+#[case("SecondsPath",json!({"value":null}))]
+#[case("SecondsPath",json!({"value":"5"}))]
+#[case("SecondsPath",json!({"value":1.0}))]
+#[case("SecondsPath",json!({"value":-1}))]
+#[case("SecondsPath",json!({"value":31_536_001}))]
+#[case("TimestampPath",json!({"value":5}))]
+#[case("TimestampPath",json!({"value":"invalid"}))]
+#[case("TimestampPath",json!({"value":"1970-01-01t00:00:00Z"}))]
+#[case("TimestampPath",json!({"value":"1971-01-01T00:00:01Z"}))]
+fn test_should_fail_invalid_dynamic_values_without_defaulting(
+    #[case] field: &str,
+    #[case] input: Value,
+) -> TestResult {
+    let source = WaitSource::compile(&json!({field:"$.value"}))?;
+    let input = Payload::from_value(&input)?;
+    assert!(matches!(
+        source.resolve(&input, &EvaluationContext::from(&input), now()?),
+        Err(AslError::WaitValue)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_preserve_missing_reference_class_and_validate_paths() -> TestResult {
+    let input = Payload::parse(b"{}")?;
+    for field in ["SecondsPath", "TimestampPath"] {
+        let source = WaitSource::compile(&json!({field:"$.missing"}))?;
+        assert!(matches!(
+            source.resolve(&input, &EvaluationContext::from(&input), now()?),
+            Err(AslError::Missing)
+        ));
+        assert!(matches!(
+            WaitSource::compile(&json!({field:"$[*]"})),
+            Err(AslError::InvalidReference)
+        ));
+    }
+    let context = EvaluationContext::from_value(&json!({"State":{"delay":9}}))?;
+    let source = WaitSource::compile(&json!({"SecondsPath":"$$.State.delay"}))?;
+    assert_eq!(
+        source.resolve(&input, &context, now()?)?,
+        Duration::from_secs(9)
+    );
+    assert!(matches!(
+        WaitSource::parse(br#"{"Seconds":1,"Seconds":2}"#),
+        Err(AslError::Json(JsonError::Duplicate))
+    ));
+    assert!(matches!(
+        WaitSource::parse(br#"{"Seconds":1e0}"#),
+        Err(AslError::InvalidWait)
+    ));
+    Ok(())
+}
+
+#[test]
+fn test_should_truncate_only_the_target_preserving_current_fraction_and_supplied_clock()
+-> TestResult {
+    let source = WaitSource::parse(br#"{"Timestamp":"1970-01-01T00:00:10.999999999Z"}"#)?;
+    let input = Payload::parse(b"{}")?;
+    let context = EvaluationContext::from(&input);
+    let sample = DateTime::from_timestamp(9, 250_000_000).ok_or("invalid test clock")?;
+    assert_eq!(
+        source.resolve(&input, &context, sample)?,
+        Duration::from_millis(750)
+    );
+    let target_past = DateTime::from_timestamp(10, 1).ok_or("invalid test clock")?;
+    assert_eq!(
+        source.resolve(&input, &context, target_past)?,
+        Duration::ZERO
+    );
+    let overlong = WaitSource::parse(br#"{"Timestamp":"1971-01-01T00:00:01Z"}"#)?;
+    assert!(matches!(
+        overlong.resolve(&input, &context, now()?),
+        Err(AslError::WaitValue)
+    ));
+    // A new entry uses its new sample, without the component reading a clock.
+    assert_eq!(
+        source.resolve(&input, &context, now()?)?,
+        Duration::from_secs(10)
+    );
+    Ok(())
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(512))]
+    #[test]
+    fn test_should_resolve_static_and_dynamic_seconds_equivalently(seconds in 0_u64..=31_536_000) {
+        let input=Payload::from_value(&json!({"seconds":seconds})).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let context=EvaluationContext::from(&input);
+        let clock=now().map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let static_source=WaitSource::compile(&json!({"Seconds":seconds})).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        let dynamic_source=WaitSource::compile(&json!({"SecondsPath":"$.seconds"})).map_err(|e| TestCaseError::fail(e.to_string()))?;
+        prop_assert_eq!(static_source.resolve(&input,&context,clock).map_err(|e| TestCaseError::fail(e.to_string()))?,dynamic_source.resolve(&input,&context,clock).map_err(|e| TestCaseError::fail(e.to_string()))?);
+    }
+}
diff --git a/crates/rustack-stepfunctions-http/Cargo.toml b/crates/rustack-stepfunctions-http/Cargo.toml
new file mode 100644
index 00000000..5ef03a3a
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/Cargo.toml
@@ -0,0 +1,35 @@
+[package]
+name = "rustack-stepfunctions-http"
+description = "Bounded typed Step Functions AWS JSON1.0 HTTP transport"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+rustack-core = { workspace = true }
+rustack-auth = { workspace = true }
+rustack-stepfunctions-model = { workspace = true }
+async-trait = { workspace = true }
+bytes = { workspace = true }
+http = { workspace = true }
+http-body = { workspace = true }
+http-body-util = { workspace = true }
+hyper = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true }
+tracing = { workspace = true }
+uuid = { workspace = true }
+
+[dev-dependencies]
+rstest = { workspace = true }
+tokio = { workspace = true, features = ["test-util"] }
+chrono = { workspace = true }
+anyhow = { workspace = true }
+hyper-util = { workspace = true }
diff --git a/crates/rustack-stepfunctions-http/src/body.rs b/crates/rustack-stepfunctions-http/src/body.rs
new file mode 100644
index 00000000..30f01e90
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/body.rs
@@ -0,0 +1,120 @@
+//! Fully encoded response bytes with redacted diagnostics.
+
+use std::{
+    convert::Infallible,
+    fmt,
+    pin::Pin,
+    task::{Context, Poll},
+};
+
+use bytes::Bytes;
+use http_body::{Body, Frame, SizeHint};
+use http_body_util::Full;
+
+/// Bounded buffered response; Debug does not print its workflow data.
+#[non_exhaustive]
+pub struct StepFunctionsBody {
+    inner: Full<Bytes>,
+}
+impl fmt::Debug for StepFunctionsBody {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("StepFunctionsBody(<redacted>)")
+    }
+}
+impl StepFunctionsBody {
+    pub(crate) fn new(bytes: Bytes) -> Self {
+        Self {
+            inner: Full::new(bytes),
+        }
+    }
+}
+impl Body for StepFunctionsBody {
+    type Data = Bytes;
+    type Error = Infallible;
+    fn poll_frame(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Bytes>, Infallible>>> {
+        Pin::new(&mut self.get_mut().inner).poll_frame(cx)
+    }
+    fn size_hint(&self) -> SizeHint {
+        self.inner.size_hint()
+    }
+    fn is_end_stream(&self) -> bool {
+        self.inner.is_end_stream()
+    }
+}
+
+/// Ordinary JSON requests have no trailer semantics; never silently discard them.
+pub(crate) struct RequestBody<B> {
+    inner: Pin<Box<B>>,
+    finished: bool,
+}
+impl<B> RequestBody<B> {
+    pub(crate) fn new(inner: B) -> Self {
+        Self {
+            inner: Box::pin(inner),
+            finished: false,
+        }
+    }
+}
+impl<B> fmt::Debug for RequestBody<B> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RequestBody(<redacted>)")
+    }
+}
+#[derive(thiserror::Error)]
+pub(crate) enum InputError {
+    #[error("request trailer frames are unsupported")]
+    Trailers,
+    #[error("request source failed")]
+    Source(#[source] Box<dyn std::error::Error + Send + Sync>),
+}
+impl fmt::Debug for InputError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl<B> Body for RequestBody<B>
+where
+    B: Body<Data = Bytes>,
+    B::Error: std::error::Error + Send + Sync + 'static,
+{
+    type Data = Bytes;
+    type Error = InputError;
+    fn poll_frame(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Bytes>, InputError>>> {
+        let this = self.get_mut();
+        if this.finished {
+            return Poll::Ready(None);
+        }
+        match this.inner.as_mut().poll_frame(cx) {
+            Poll::Ready(Some(Ok(frame))) if !frame.is_data() => {
+                this.finished = true;
+                Poll::Ready(Some(Err(InputError::Trailers)))
+            }
+            Poll::Ready(Some(Err(error))) => {
+                this.finished = true;
+                Poll::Ready(Some(Err(InputError::Source(Box::new(error)))))
+            }
+            Poll::Ready(None) => {
+                this.finished = true;
+                Poll::Ready(None)
+            }
+            Poll::Ready(Some(Ok(frame))) => Poll::Ready(Some(Ok(frame))),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+    fn is_end_stream(&self) -> bool {
+        self.finished || self.inner.is_end_stream()
+    }
+    fn size_hint(&self) -> SizeHint {
+        if self.finished {
+            SizeHint::with_exact(0)
+        } else {
+            self.inner.size_hint()
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-http/src/context.rs b/crates/rustack-stepfunctions-http/src/context.rs
new file mode 100644
index 00000000..8c101b0a
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/context.rs
@@ -0,0 +1,179 @@
+//! Immutable operator scope and request provenance; no serialized trust claims.
+
+use std::{fmt, num::NonZeroU64, sync::Arc, time::Duration};
+
+use rustack_auth::{AuthMode, CredentialProvider};
+use rustack_core::http::BodyBudget;
+use tokio::time::Instant;
+use uuid::Uuid;
+
+use crate::HttpError;
+
+/// Validated partition/region/account configured by the runtime, not the caller.
+#[derive(Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct RequestScope {
+    partition: String,
+    region: String,
+    account: String,
+}
+impl fmt::Debug for RequestScope {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("RequestScope(<redacted>)")
+    }
+}
+impl RequestScope {
+    /// Validate an operator scope for shared HTTP/core use.
+    ///
+    /// # Errors
+    /// Rejects unsupported partitions, invalid region identifiers or non12-digit accounts.
+    ///
+    /// ```
+    /// let scope = rustack_stepfunctions_http::RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into())?;
+    /// assert_eq!(scope.region(), "us-east-1");
+    /// # Ok::<(), rustack_stepfunctions_http::HttpError>(())
+    /// ```
+    pub fn new(partition: String, region: String, account: String) -> Result<Self, HttpError> {
+        if !matches!(partition.as_str(), "aws" | "aws-cn" | "aws-us-gov")
+            || !(1..=64).contains(&region.len())
+            || !region
+                .as_bytes()
+                .first()
+                .is_some_and(u8::is_ascii_lowercase)
+            || !region
+                .as_bytes()
+                .last()
+                .is_some_and(u8::is_ascii_alphanumeric)
+            || !region
+                .bytes()
+                .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
+            || account.len() != 12
+            || !account.bytes().all(|byte| byte.is_ascii_digit())
+        {
+            return Err(HttpError::Configuration);
+        }
+        Ok(Self {
+            partition,
+            region,
+            account,
+        })
+    }
+    /// Configured AWS partition.
+    #[must_use]
+    pub fn partition(&self) -> &str {
+        &self.partition
+    }
+    /// Configured AWS region.
+    #[must_use]
+    pub fn region(&self) -> &str {
+        &self.region
+    }
+    /// Configured account identifier.
+    #[must_use]
+    pub fn account(&self) -> &str {
+        &self.account
+    }
+}
+
+/// Validated, explicitly selected authentication/body/deadline configuration.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct StepFunctionsHttpConfig {
+    pub(crate) scope: Arc<RequestScope>,
+    pub(crate) skip: bool,
+    pub(crate) credentials: Option<Arc<dyn CredentialProvider>>,
+    pub(crate) body: BodyBudget,
+    pub(crate) total: Duration,
+}
+impl fmt::Debug for StepFunctionsHttpConfig {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("StepFunctionsHttpConfig(<redacted>)")
+    }
+}
+impl StepFunctionsHttpConfig {
+    /// Construct explicit local-development or strict authentication policy.
+    ///
+    /// # Errors
+    /// Strict mode requires a credential provider; scope and budgets must be valid.
+    ///
+    /// ```
+    /// use rustack_stepfunctions_http::{RequestScope, StepFunctionsHttpConfig};
+    /// let scope = RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into())?;
+    /// let config = StepFunctionsHttpConfig::new(scope, true, None)?;
+    /// # Ok::<(), rustack_stepfunctions_http::HttpError>(())
+    /// ```
+    pub fn new(
+        scope: RequestScope,
+        skip_signature_validation: bool,
+        credentials: Option<Arc<dyn CredentialProvider>>,
+    ) -> Result<Self, HttpError> {
+        AuthMode::resolve(skip_signature_validation, credentials.as_deref())
+            .map_err(|_| HttpError::Configuration)?;
+        let cap = NonZeroU64::new(2 * 1024 * 1024).ok_or(HttpError::Configuration)?;
+        Ok(Self {
+            scope: Arc::new(scope),
+            skip: skip_signature_validation,
+            credentials,
+            body: BodyBudget::control().capped(cap),
+            total: Duration::from_secs(rustack_core::settings::budgets().request_seconds),
+        })
+    }
+    /// Apply validated operator budgets without relaxing the2MiB request limit.
+    ///
+    /// # Errors
+    /// Total request duration must be positive and at most one hour.
+    ///
+    /// ```
+    /// # fn budget(config: rustack_stepfunctions_http::StepFunctionsHttpConfig) -> Result<(), rustack_stepfunctions_http::HttpError> {
+    /// let config = config.with_budgets(rustack_core::http::BodyBudget::control(), std::time::Duration::from_secs(30))?;
+    /// # Ok(()) }
+    /// ```
+    pub fn with_budgets(mut self, body: BodyBudget, total: Duration) -> Result<Self, HttpError> {
+        if total.is_zero() || total > Duration::from_secs(3600) {
+            return Err(HttpError::Configuration);
+        }
+        self.body = body.capped(NonZeroU64::new(2 * 1024 * 1024).ok_or(HttpError::Configuration)?);
+        self.total = total;
+        Ok(self)
+    }
+}
+
+/// Per-call deadline/provenance. Dropping this value does not cancel accepted work.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct RequestContext {
+    pub(crate) scope: Arc<RequestScope>,
+    pub(crate) id: Uuid,
+    pub(crate) deadline: Instant,
+    pub(crate) authenticated: bool,
+}
+impl fmt::Debug for RequestContext {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("RequestContext")
+            .field("request_id", &self.id)
+            .field("authenticated", &self.authenticated)
+            .finish_non_exhaustive()
+    }
+}
+impl RequestContext {
+    /// Trusted operator scope shared with the core adapter.
+    #[must_use]
+    pub fn scope(&self) -> &RequestScope {
+        &self.scope
+    }
+    /// Generated request correlation ID.
+    #[must_use]
+    pub fn request_id(&self) -> Uuid {
+        self.id
+    }
+    /// Absolute monotonic caller deadline, not the workflow's lifetime.
+    #[must_use]
+    pub fn deadline(&self) -> Instant {
+        self.deadline
+    }
+    /// Whether this request passed strict signature verification.
+    #[must_use]
+    pub fn authenticated(&self) -> bool {
+        self.authenticated
+    }
+}
diff --git a/crates/rustack-stepfunctions-http/src/error.rs b/crates/rustack-stepfunctions-http/src/error.rs
new file mode 100644
index 00000000..7f53c686
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/error.rs
@@ -0,0 +1,125 @@
+//! Typed sources and static transport diagnostics, independent of user payloads.
+
+use std::fmt;
+
+use http::StatusCode;
+use rustack_auth::AuthError;
+use rustack_core::{http::BodyReadError, json::JsonError};
+use rustack_stepfunctions_model::{StepFunctionsError, StepFunctionsErrorCode};
+
+/// HTTP boundary failures; Debug/Display never expose underlying input values.
+#[derive(thiserror::Error)]
+#[non_exhaustive]
+pub enum HttpError {
+    /// Invalid trusted scope, authentication configuration or budget.
+    #[error("invalid Step Functions HTTP configuration")]
+    Configuration,
+    /// Request method/path/headers are ambiguous or outside this protocol.
+    #[error("invalid Step Functions HTTP envelope")]
+    Envelope,
+    /// No known action exactly matches the target.
+    #[error("unknown Step Functions operation")]
+    UnknownOperation,
+    /// A modeled action is outside this transport profile.
+    #[error("unsupported Step Functions operation")]
+    UnsupportedOperation,
+    /// Authentication failed; the typed source is deliberately not displayed.
+    #[error("Step Functions authentication failed")]
+    Authentication(#[source] AuthError),
+    /// Source body bounds/IO failed without accepting partial bytes.
+    #[error("Step Functions body collection failed")]
+    Body(#[source] BodyReadError),
+    /// Bounded JSON preflight/schema failed.
+    #[error("invalid Step Functions request JSON")]
+    Json(#[source] JsonError),
+    /// An operation-specific input bound failed.
+    #[error("invalid Step Functions request field")]
+    Field(StepFunctionsErrorCode),
+    /// The caller's absolute deadline has elapsed.
+    #[error("Step Functions HTTP deadline exceeded")]
+    Deadline,
+    /// A typed handler rejected a request; diagnostics remain redacted.
+    #[error("Step Functions handler rejected request")]
+    Handler(#[source] StepFunctionsError),
+    /// An invalid/mismatched or oversized handler reply cannot become success.
+    #[error("invalid Step Functions handler response")]
+    Response,
+    /// Encoding failed; source may contain values and is never displayed.
+    #[error("Step Functions response encoding failed")]
+    Encoding(#[source] serde_json::Error),
+}
+impl fmt::Debug for HttpError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        fmt::Display::fmt(self, f)
+    }
+}
+impl HttpError {
+    pub(crate) fn wire(&self) -> (&'static str, &str, StatusCode) {
+        match self {
+            Self::Configuration | Self::Response | Self::Encoding(_) => (
+                "InternalFailure",
+                "Request processing failed",
+                StatusCode::INTERNAL_SERVER_ERROR,
+            ),
+            Self::Envelope => (
+                "ValidationException",
+                "Invalid HTTP request envelope",
+                StatusCode::BAD_REQUEST,
+            ),
+            Self::UnknownOperation => (
+                "UnknownOperationException",
+                "Unknown Step Functions operation",
+                StatusCode::NOT_FOUND,
+            ),
+            Self::UnsupportedOperation => (
+                "UnsupportedOperation",
+                "Operation is outside the supported Step Functions profile",
+                StatusCode::BAD_REQUEST,
+            ),
+            Self::Authentication(_) => (
+                "AccessDeniedException",
+                "Request authentication failed",
+                StatusCode::FORBIDDEN,
+            ),
+            Self::Body(error) => {
+                let code = match error {
+                    BodyReadError::TooLarge => "RequestEntityTooLargeException",
+                    BodyReadError::Deadline | BodyReadError::Idle => "RequestTimeoutException",
+                    _ => "MalformedHttpRequestException",
+                };
+                (
+                    code,
+                    "Request body could not be accepted",
+                    error.status_code(),
+                )
+            }
+            Self::Json(_) => (
+                "ValidationException",
+                "Invalid request JSON",
+                StatusCode::BAD_REQUEST,
+            ),
+            Self::Field(code) => (
+                code.as_str(),
+                "Invalid request field",
+                code.default_status_code(),
+            ),
+            Self::Deadline => (
+                "RequestTimeoutException",
+                "Request deadline exceeded",
+                StatusCode::REQUEST_TIMEOUT,
+            ),
+            Self::Handler(error)
+                if error.message.len() <= 1024
+                    && (error.status_code.is_client_error()
+                        || error.status_code.is_server_error()) =>
+            {
+                (error.error_type(), &error.message, error.status_code)
+            }
+            Self::Handler(_) => (
+                "InternalFailure",
+                "Invalid handler error",
+                StatusCode::INTERNAL_SERVER_ERROR,
+            ),
+        }
+    }
+}
diff --git a/crates/rustack-stepfunctions-http/src/lib.rs b/crates/rustack-stepfunctions-http/src/lib.rs
new file mode 100644
index 00000000..4446fae2
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/lib.rs
@@ -0,0 +1,27 @@
+//! Bounded AWS JSON1.0 transport for typed Step Functions handlers.
+//!
+//! Core owns registry/domain semantics and accepted command lifetime. This crate
+//! supplies no default handler and cannot advertise workflow execution by itself.
+//! The async-trait handler is deliberately object-safe for trusted runtime DI.
+//! The serving gateway owns bounded connection/request admission; this layer
+//! does not spawn request jobs or own accepted workflow execution lifetime.
+#![forbid(unsafe_code)]
+
+mod body;
+mod context;
+mod error;
+mod protocol;
+mod response;
+mod service;
+mod transport;
+mod validation;
+
+pub use body::StepFunctionsBody;
+pub use context::{RequestContext, RequestScope, StepFunctionsHttpConfig};
+pub use error::HttpError;
+pub use protocol::{CONTENT_TYPE, claims_request, resolve_operation};
+pub use service::{StepFunctionsHandler, StepFunctionsHttpService};
+pub use transport::{Request, Response};
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/rustack-stepfunctions-http/src/protocol.rs b/crates/rustack-stepfunctions-http/src/protocol.rs
new file mode 100644
index 00000000..1f56e841
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/protocol.rs
@@ -0,0 +1,131 @@
+//! Exact target-family claiming and bounded HTTP framing policy.
+
+use http::{
+    HeaderMap, Method,
+    header::{
+        AUTHORIZATION, CONTENT_ENCODING, CONTENT_LENGTH, CONTENT_TYPE as TYPE_HEADER, HOST,
+        TRANSFER_ENCODING,
+    },
+    request::Parts,
+};
+use rustack_stepfunctions_model::StepFunctionsOperation;
+
+use crate::HttpError;
+
+/// AWS JSON1.0 media type emitted by every transport response.
+pub const CONTENT_TYPE: &str = "application/x-amz-json-1.0";
+const PREFIX: &str = "AWSStepFunctions.";
+
+/// Claim a target family even when its action or framing will be rejected.
+///
+/// ```
+/// let mut headers=http::HeaderMap::new();
+/// headers.insert("x-amz-target",http::HeaderValue::from_static("AWSStepFunctions.Unknown"));
+/// assert!(rustack_stepfunctions_http::claims_request(&headers));
+/// ```
+#[must_use]
+pub fn claims_request(headers: &HeaderMap) -> bool {
+    headers.get_all("x-amz-target").iter().any(|value| {
+        value.as_bytes().starts_with(PREFIX.as_bytes()) || value.as_bytes() == b"AWSStepFunctions"
+    })
+}
+/// Resolve exactly one bounded target into a modeled action.
+///
+/// # Errors
+/// Returns envelope errors for ambiguity/non-ASCII/oversize or `UnknownOperation`.
+///
+/// ```
+/// let mut headers=http::HeaderMap::new();
+/// headers.insert("x-amz-target",http::HeaderValue::from_static("AWSStepFunctions.StartExecution"));
+/// let operation=rustack_stepfunctions_http::resolve_operation(&headers)?;
+/// assert_eq!(operation,rustack_stepfunctions_model::StepFunctionsOperation::StartExecution);
+/// # Ok::<(),rustack_stepfunctions_http::HttpError>(())
+/// ```
+pub fn resolve_operation(headers: &HeaderMap) -> Result<StepFunctionsOperation, HttpError> {
+    let target = single(headers, "x-amz-target", 256)?.ok_or(HttpError::Envelope)?;
+    let name = target
+        .strip_prefix(PREFIX)
+        .ok_or(HttpError::UnknownOperation)?;
+    StepFunctionsOperation::from_name(name).ok_or(HttpError::UnknownOperation)
+}
+fn single<'a>(
+    headers: &'a HeaderMap,
+    name: &str,
+    maximum: usize,
+) -> Result<Option<&'a str>, HttpError> {
+    let mut values = headers.get_all(name).iter();
+    let Some(value) = values.next() else {
+        return Ok(None);
+    };
+    if values.next().is_some() || value.as_bytes().len() > maximum || !value.as_bytes().is_ascii() {
+        return Err(HttpError::Envelope);
+    }
+    value.to_str().map(Some).map_err(|_| HttpError::Envelope)
+}
+pub(crate) fn envelope(parts: &Parts) -> Result<Option<usize>, HttpError> {
+    if parts.method != Method::POST || parts.uri.path() != "/" || parts.uri.query().is_some() {
+        return Err(HttpError::Envelope);
+    }
+    let mut bytes = 0_usize;
+    if parts.headers.len() > 64 {
+        return Err(HttpError::Envelope);
+    }
+    for (name, value) in &parts.headers {
+        if value.as_bytes().len() > 8192 {
+            return Err(HttpError::Envelope);
+        }
+        bytes = bytes
+            .checked_add(name.as_str().len())
+            .and_then(|count| count.checked_add(value.as_bytes().len()))
+            .ok_or(HttpError::Envelope)?;
+        if bytes > 32768 {
+            return Err(HttpError::Envelope);
+        }
+    }
+    single(&parts.headers, "x-amz-target", 256)?.ok_or(HttpError::Envelope)?;
+    let content = single(&parts.headers, TYPE_HEADER.as_str(), 256)?.ok_or(HttpError::Envelope)?;
+    let mut fields = content.split(';');
+    if !fields
+        .next()
+        .is_some_and(|media| media.trim().eq_ignore_ascii_case(CONTENT_TYPE))
+    {
+        return Err(HttpError::Envelope);
+    }
+    if let Some(charset) = fields.next() {
+        let charset = charset.trim();
+        if !(charset.eq_ignore_ascii_case("charset=utf-8")
+            || charset.eq_ignore_ascii_case("charset=\"utf-8\""))
+            || fields.next().is_some()
+        {
+            return Err(HttpError::Envelope);
+        }
+    }
+    if single(&parts.headers, CONTENT_ENCODING.as_str(), 64)?
+        .is_some_and(|value| !value.eq_ignore_ascii_case("identity"))
+    {
+        return Err(HttpError::Envelope);
+    }
+    for name in [
+        AUTHORIZATION.as_str(),
+        HOST.as_str(),
+        "x-amz-date",
+        "x-amz-security-token",
+        "x-amz-content-sha256",
+    ] {
+        single(&parts.headers, name, 8192)?;
+    }
+    let length = single(&parts.headers, CONTENT_LENGTH.as_str(), 20)?
+        .map(|value| {
+            if value.is_empty() || !value.bytes().all(|byte| byte.is_ascii_digit()) {
+                return Err(HttpError::Envelope);
+            }
+            value.parse::<usize>().map_err(|_| HttpError::Envelope)
+        })
+        .transpose()?;
+    if let Some(encoding) = single(&parts.headers, TRANSFER_ENCODING.as_str(), 64)? {
+        if length.is_some() || !encoding.eq_ignore_ascii_case("chunked") {
+            return Err(HttpError::Envelope);
+        }
+    }
+    Ok(length)
+}
diff --git a/crates/rustack-stepfunctions-http/src/response.rs b/crates/rustack-stepfunctions-http/src/response.rs
new file mode 100644
index 00000000..12ff4e93
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/response.rs
@@ -0,0 +1,132 @@
+//! Bounded complete encoding, exact operation replies and static error envelopes.
+
+use std::io::{self, Write};
+
+use bytes::Bytes;
+use http::{
+    HeaderValue, StatusCode,
+    header::{CONTENT_LENGTH, CONTENT_TYPE as TYPE_HEADER},
+};
+use serde::Serialize;
+use uuid::Uuid;
+
+use crate::{CONTENT_TYPE, HttpError, StepFunctionsBody, transport::Response};
+
+const LIMIT: usize = 8 * 1024 * 1024;
+struct Writer {
+    bytes: Vec<u8>,
+    failed: bool,
+}
+impl Write for Writer {
+    fn write(&mut self, data: &[u8]) -> io::Result<usize> {
+        let Some(length) = self
+            .bytes
+            .len()
+            .checked_add(data.len())
+            .filter(|length| *length <= LIMIT)
+        else {
+            self.failed = true;
+            return Err(io::Error::other("response byte limit exceeded"));
+        };
+        let capacity = self.bytes.capacity();
+        let target = length.max(capacity.saturating_mul(2).max(4096)).min(LIMIT);
+        if length > capacity
+            && self
+                .bytes
+                .try_reserve_exact(target - self.bytes.len())
+                .is_err()
+        {
+            self.failed = true;
+            return Err(io::Error::other("response allocation failed"));
+        }
+        self.bytes.extend_from_slice(data);
+        Ok(data.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+fn encode(
+    write: impl FnOnce(&mut Writer) -> Result<(), serde_json::Error>,
+) -> Result<Bytes, HttpError> {
+    let mut writer = Writer {
+        bytes: Vec::new(),
+        failed: false,
+    };
+    if let Err(error) = write(&mut writer) {
+        return Err(if writer.failed {
+            HttpError::Response
+        } else {
+            HttpError::Encoding(error)
+        });
+    }
+    Ok(Bytes::from(writer.bytes))
+}
+pub(crate) fn success(
+    value: &Response,
+    id: Uuid,
+) -> Result<http::Response<StepFunctionsBody>, HttpError> {
+    let bytes = match value {
+        Response::SendTaskSuccess(_)
+        | Response::SendTaskFailure(_)
+        | Response::SendTaskHeartbeat(_) => Bytes::new(),
+        _ => encode(|writer| value.encode(writer))?,
+    };
+    build(bytes, StatusCode::OK, id, None)
+}
+#[derive(Serialize)]
+struct ErrorEnvelope<'a> {
+    #[serde(rename = "__type")]
+    kind: &'a str,
+    message: &'a str,
+}
+pub(crate) fn failure(error: &HttpError, id: Uuid) -> http::Response<StepFunctionsBody> {
+    let (code, message, status) = error.wire();
+    tracing::debug!(error_code = code, "Step Functions request rejected");
+    let result = encode(|writer| {
+        serde_json::to_writer(
+            writer,
+            &ErrorEnvelope {
+                kind: code,
+                message,
+            },
+        )
+    })
+    .and_then(|bytes| build(bytes, status, id, Some(code)));
+    match result {
+        Ok(response) => response,
+        Err(_) => emergency(),
+    }
+}
+fn build(
+    bytes: Bytes,
+    status: StatusCode,
+    id: Uuid,
+    error: Option<&'static str>,
+) -> Result<http::Response<StepFunctionsBody>, HttpError> {
+    let length = bytes.len();
+    let mut response = http::Response::new(StepFunctionsBody::new(bytes));
+    *response.status_mut() = status;
+    let headers = response.headers_mut();
+    headers.insert(TYPE_HEADER, HeaderValue::from_static(CONTENT_TYPE));
+    headers.insert(CONTENT_LENGTH, HeaderValue::from(length));
+    headers.insert(
+        "x-amzn-requestid",
+        HeaderValue::try_from(id.to_string()).map_err(|_| HttpError::Response)?,
+    );
+    headers.insert("server", HeaderValue::from_static("Rustack"));
+    if let Some(code) = error {
+        headers.insert("x-amzn-errortype", HeaderValue::from_static(code));
+    }
+    Ok(response)
+}
+fn emergency() -> http::Response<StepFunctionsBody> {
+    let mut response = http::Response::new(StepFunctionsBody::new(Bytes::from_static(
+        br#"{"__type":"InternalFailure","message":"Request processing failed"}"#,
+    )));
+    *response.status_mut() = StatusCode::INTERNAL_SERVER_ERROR;
+    response
+        .headers_mut()
+        .insert(TYPE_HEADER, HeaderValue::from_static(CONTENT_TYPE));
+    response
+}
diff --git a/crates/rustack-stepfunctions-http/src/service.rs b/crates/rustack-stepfunctions-http/src/service.rs
new file mode 100644
index 00000000..2267704e
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/service.rs
@@ -0,0 +1,171 @@
+//! Owned per-request transport futures; accepted commands remain core-owned.
+
+use std::{convert::Infallible, error::Error, fmt, future::Future, pin::Pin, sync::Arc};
+
+use async_trait::async_trait;
+use bytes::Bytes;
+use http_body::Body;
+use hyper::body::Incoming;
+use rustack_auth::{AuthMode, hash_payload};
+use rustack_core::http::collect_body;
+use rustack_stepfunctions_model::StepFunctionsError;
+use tokio::time::{Instant, timeout_at};
+use tracing::Instrument;
+use uuid::Uuid;
+
+use crate::{
+    HttpError, Request, RequestContext, Response, StepFunctionsBody, StepFunctionsHttpConfig,
+    protocol, response,
+};
+
+/// Object-safe typed command boundary for the runtime's real core adapter.
+///
+/// async-trait is required because services retain `Arc<dyn StepFunctionsHandler>`.
+/// Accepted registry commands survive a dropped/timed-out HTTP future; handlers
+/// must not equate reply-channel closure with execution cancellation.
+#[async_trait]
+pub trait StepFunctionsHandler: Send + Sync + 'static {
+    /// Handle one decoded, bounded request under its caller deadline.
+    ///
+    /// # Errors
+    /// Return a typed domain/protocol error; never include tokens or input in diagnostics.
+    async fn handle(
+        &self,
+        context: RequestContext,
+        request: Request,
+    ) -> Result<Response, StepFunctionsError>;
+}
+
+/// Hyper service requiring an explicit real handler and validated configuration.
+#[derive(Clone)]
+#[non_exhaustive]
+pub struct StepFunctionsHttpService {
+    handler: Arc<dyn StepFunctionsHandler>,
+    config: Arc<StepFunctionsHttpConfig>,
+}
+impl fmt::Debug for StepFunctionsHttpService {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("StepFunctionsHttpService(<redacted>)")
+    }
+}
+impl StepFunctionsHttpService {
+    /// Compose transport with a trusted typed core adapter.
+    ///
+    /// ```no_run
+    /// # fn compose(handler: std::sync::Arc<dyn rustack_stepfunctions_http::StepFunctionsHandler>, config: rustack_stepfunctions_http::StepFunctionsHttpConfig) {
+    /// let service=rustack_stepfunctions_http::StepFunctionsHttpService::new(handler,config);
+    /// # }
+    /// ```
+    #[must_use]
+    pub fn new(handler: Arc<dyn StepFunctionsHandler>, config: StepFunctionsHttpConfig) -> Self {
+        Self {
+            handler,
+            config: Arc::new(config),
+        }
+    }
+    /// Process any bounded byte body; network serving uses the same path.
+    ///
+    /// ```no_run
+    /// # async fn serve(service: rustack_stepfunctions_http::StepFunctionsHttpService, request: http::Request<http_body_util::Full<bytes::Bytes>>) {
+    /// let response=service.handle(request).await;
+    /// # }
+    /// ```
+    pub async fn handle<B>(&self, request: http::Request<B>) -> http::Response<StepFunctionsBody>
+    where
+        B: Body<Data = Bytes> + Send + 'static,
+        B::Error: Error + Send + Sync + 'static,
+    {
+        let id = Uuid::new_v4();
+        let deadline = Instant::now() + self.config.total;
+        let span = tracing::info_span!("stepfunctions.request",request_id=%id);
+        let result = timeout_at(
+            deadline,
+            self.process(request, id, deadline).instrument(span),
+        )
+        .await;
+        match result {
+            Ok(Ok(response)) => response,
+            Ok(Err(error)) => response::failure(&error, id),
+            Err(_) => response::failure(&HttpError::Deadline, id),
+        }
+    }
+    async fn process<B>(
+        &self,
+        request: http::Request<B>,
+        id: Uuid,
+        deadline: Instant,
+    ) -> Result<http::Response<StepFunctionsBody>, HttpError>
+    where
+        B: Body<Data = Bytes> + Send + 'static,
+        B::Error: Error + Send + Sync + 'static,
+    {
+        let (parts, body) = request.into_parts();
+        let declared = protocol::envelope(&parts)?;
+        if declared.is_some_and(|length| {
+            u64::try_from(length).map_or(true, |length| length > self.config.body.max_bytes())
+        }) {
+            return Err(HttpError::Body(rustack_core::http::BodyReadError::TooLarge));
+        }
+        let bytes = collect_body(crate::body::RequestBody::new(body), self.config.body)
+            .await
+            .map_err(HttpError::Body)?;
+        if declared.is_some_and(|length| length != bytes.len()) {
+            return Err(HttpError::Envelope);
+        }
+        let authenticated = AuthMode::resolve(self.config.skip, self.config.credentials.as_deref())
+            .map_err(HttpError::Authentication)?
+            .verify(&parts, &hash_payload(&bytes))
+            .map_err(HttpError::Authentication)?;
+        if let Some(auth) = &authenticated {
+            if auth.service != "states"
+                || auth.region != self.config.scope.region()
+                || !auth
+                    .signed_headers
+                    .iter()
+                    .any(|name| name == "x-amz-target")
+            {
+                return Err(HttpError::Authentication(
+                    rustack_auth::AuthError::InvalidCredential,
+                ));
+            }
+        }
+        check(deadline)?;
+        let operation = protocol::resolve_operation(&parts.headers)?;
+        let request = Request::decode(operation, &bytes)?;
+        check(deadline)?;
+        let context = RequestContext {
+            scope: self.config.scope.clone(),
+            id,
+            deadline,
+            authenticated: authenticated.is_some(),
+        };
+        let reply = self
+            .handler
+            .handle(context, request)
+            .await
+            .map_err(HttpError::Handler)?;
+        check(deadline)?;
+        if reply.operation() != operation {
+            return Err(HttpError::Response);
+        }
+        let response = response::success(&reply, id)?;
+        check(deadline)?;
+        Ok(response)
+    }
+}
+fn check(deadline: Instant) -> Result<(), HttpError> {
+    if Instant::now() >= deadline {
+        Err(HttpError::Deadline)
+    } else {
+        Ok(())
+    }
+}
+impl hyper::service::Service<http::Request<Incoming>> for StepFunctionsHttpService {
+    type Response = http::Response<StepFunctionsBody>;
+    type Error = Infallible;
+    type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Infallible>> + Send>>;
+    fn call(&self, request: http::Request<Incoming>) -> Self::Future {
+        let service = self.clone();
+        Box::pin(async move { Ok(service.handle(request).await) })
+    }
+}
diff --git a/crates/rustack-stepfunctions-http/src/tests.rs b/crates/rustack-stepfunctions-http/src/tests.rs
new file mode 100644
index 00000000..3fac02c4
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/tests.rs
@@ -0,0 +1,616 @@
+use std::{
+    convert::Infallible,
+    future::pending,
+    pin::Pin,
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    task::{Context, Poll},
+    time::Duration,
+};
+
+use async_trait::async_trait;
+use bytes::Bytes;
+use http::{HeaderValue, StatusCode};
+use http_body::{Body, Frame};
+use http_body_util::{BodyExt, Full};
+use rustack_auth::{
+    StaticCredentialProvider,
+    canonical::build_canonical_request,
+    hash_payload,
+    sigv4::{build_string_to_sign, compute_signature, derive_signing_key},
+};
+use rustack_core::http::BodyBudget;
+use rustack_stepfunctions_model::{
+    StepFunctionsError, StepFunctionsErrorCode, StepFunctionsOperation as Op, output,
+};
+use serde_json::{Value, json};
+use tokio::{sync::mpsc, time::Instant};
+
+use crate::*;
+
+#[derive(Debug, Clone, Copy)]
+enum Mode {
+    Normal,
+    Mismatch,
+    Error,
+    Oversize,
+    Pending,
+    OversizeError,
+    SuccessError,
+}
+struct Handler {
+    count: AtomicUsize,
+    sender: mpsc::Sender<(RequestContext, Request)>,
+    mode: Mode,
+}
+#[async_trait]
+impl StepFunctionsHandler for Handler {
+    async fn handle(
+        &self,
+        context: RequestContext,
+        request: Request,
+    ) -> Result<Response, StepFunctionsError> {
+        self.count.fetch_add(1, Ordering::SeqCst);
+        let op = request.operation();
+        self.sender.try_send((context, request)).unwrap();
+        match self.mode {
+            Mode::Pending => pending().await,
+            Mode::Error => Err(StepFunctionsError::with_message(
+                StepFunctionsErrorCode::InvalidName,
+                "domain rejected",
+            )),
+            Mode::OversizeError => Err(StepFunctionsError::with_message(
+                StepFunctionsErrorCode::InvalidName,
+                "private".repeat(1024),
+            )),
+            Mode::SuccessError => {
+                let mut error = StepFunctionsError::new(StepFunctionsErrorCode::InvalidName);
+                error.status_code = StatusCode::OK;
+                Err(error)
+            }
+            Mode::Mismatch => Ok(output::DeleteStateMachineOutput::default().into()),
+            Mode::Oversize => {
+                let mut output = output::StartExecutionOutput::default();
+                output.execution_arn = "\"".repeat(8 * 1024 * 1024);
+                Ok(output.into())
+            }
+            Mode::Normal => Ok(reply(op)),
+        }
+    }
+}
+fn reply(op: Op) -> Response {
+    match op {
+        Op::CreateStateMachine => output::CreateStateMachineOutput::default().into(),
+        Op::UpdateStateMachine => output::UpdateStateMachineOutput::default().into(),
+        Op::DeleteStateMachine => output::DeleteStateMachineOutput::default().into(),
+        Op::DescribeStateMachine => output::DescribeStateMachineOutput::default().into(),
+        Op::ListStateMachines => output::ListStateMachinesOutput::default().into(),
+        Op::ListStateMachineVersions => output::ListStateMachineVersionsOutput::default().into(),
+        Op::ValidateStateMachineDefinition => {
+            output::ValidateStateMachineDefinitionOutput::default().into()
+        }
+        Op::StartExecution => {
+            let mut value = output::StartExecutionOutput::default();
+            value.start_date = chrono::DateTime::from_timestamp_millis(-1250).unwrap();
+            value.execution_arn =
+                "arn:aws:states:us-east-1:000000000000:execution:test:wire".into();
+            value.into()
+        }
+        Op::DescribeExecution => output::DescribeExecutionOutput::default().into(),
+        Op::ListExecutions => output::ListExecutionsOutput::default().into(),
+        Op::StopExecution => output::StopExecutionOutput::default().into(),
+        Op::GetExecutionHistory => output::GetExecutionHistoryOutput::default().into(),
+        Op::DescribeStateMachineForExecution => {
+            output::DescribeStateMachineForExecutionOutput::default().into()
+        }
+        Op::TagResource => output::TagResourceOutput::default().into(),
+        Op::UntagResource => output::UntagResourceOutput::default().into(),
+        Op::ListTagsForResource => output::ListTagsForResourceOutput::default().into(),
+        Op::SendTaskSuccess => output::SendTaskSuccessOutput::default().into(),
+        Op::SendTaskFailure => output::SendTaskFailureOutput::default().into(),
+        Op::SendTaskHeartbeat => output::SendTaskHeartbeatOutput::default().into(),
+        _ => panic!("unsupported fixture action"),
+    }
+}
+fn scope() -> RequestScope {
+    RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into()).unwrap()
+}
+fn fixture(
+    mode: Mode,
+    strict: bool,
+) -> (
+    StepFunctionsHttpService,
+    Arc<Handler>,
+    mpsc::Receiver<(RequestContext, Request)>,
+) {
+    let (sender, receiver) = mpsc::channel(64);
+    let handler = Arc::new(Handler {
+        count: AtomicUsize::new(0),
+        sender,
+        mode,
+    });
+    let credentials = Arc::new(StaticCredentialProvider::new(vec![(
+        "local-key".into(),
+        "local-secret".into(),
+    )]));
+    let config = StepFunctionsHttpConfig::new(scope(), !strict, Some(credentials)).unwrap();
+    (
+        StepFunctionsHttpService::new(handler.clone(), config),
+        handler,
+        receiver,
+    )
+}
+fn request(action: &str, body: impl Into<Bytes>) -> http::Request<Full<Bytes>> {
+    http::Request::builder()
+        .method("POST")
+        .uri("/")
+        .header("content-type", CONTENT_TYPE)
+        .header("x-amz-target", format!("AWSStepFunctions.{action}"))
+        .body(Full::new(body.into()))
+        .unwrap()
+}
+async fn data(response: http::Response<StepFunctionsBody>) -> Value {
+    let bytes = response.into_body().collect().await.unwrap().to_bytes();
+    if bytes.is_empty() {
+        Value::Null
+    } else {
+        serde_json::from_slice(&bytes).unwrap()
+    }
+}
+fn cases() -> Vec<(Op, Value)> {
+    vec![
+        (
+            Op::CreateStateMachine,
+            json!({"name":"machine","roleArn":"role","definition":"{}"}),
+        ),
+        (
+            Op::UpdateStateMachine,
+            json!({"stateMachineArn":"machine","definition":"{}"}),
+        ),
+        (Op::DeleteStateMachine, json!({"stateMachineArn":"machine"})),
+        (
+            Op::DescribeStateMachine,
+            json!({"stateMachineArn":"machine"}),
+        ),
+        (Op::ListStateMachines, json!({})),
+        (
+            Op::ListStateMachineVersions,
+            json!({"stateMachineArn":"machine"}),
+        ),
+        (
+            Op::ValidateStateMachineDefinition,
+            json!({"definition":"not-asl"}),
+        ),
+        (
+            Op::StartExecution,
+            json!({"stateMachineArn":"machine","input":"{ \"secret\": 7 }"}),
+        ),
+        (Op::DescribeExecution, json!({"executionArn":"execution"})),
+        (Op::ListExecutions, json!({"stateMachineArn":"machine"})),
+        (Op::StopExecution, json!({"executionArn":"execution"})),
+        (Op::GetExecutionHistory, json!({"executionArn":"execution"})),
+        (
+            Op::DescribeStateMachineForExecution,
+            json!({"executionArn":"execution"}),
+        ),
+        (
+            Op::TagResource,
+            json!({"resourceArn":"machine","tags":[{"key":"a","value":"b"}]}),
+        ),
+        (
+            Op::UntagResource,
+            json!({"resourceArn":"machine","tagKeys":["a"]}),
+        ),
+        (Op::ListTagsForResource, json!({"resourceArn":"machine"})),
+        (
+            Op::SendTaskSuccess,
+            json!({"taskToken":"secret-token","output":"null"}),
+        ),
+        (
+            Op::SendTaskFailure,
+            json!({"taskToken":"secret-token","error":"error","cause":"cause"}),
+        ),
+        (Op::SendTaskHeartbeat, json!({"taskToken":"secret-token"})),
+    ]
+}
+#[tokio::test]
+async fn test_should_dispatch_all_typed_actions_without_enum_wrappers_or_data_in_debug() {
+    let (service, handler, mut accepted) = fixture(Mode::Normal, false);
+    for (op, body) in cases() {
+        let response = service
+            .handle(request(op.as_str(), serde_json::to_vec(&body).unwrap()))
+            .await;
+        assert_eq!(response.status(), StatusCode::OK, "{op:?}");
+        assert_eq!(response.headers()["content-type"], CONTENT_TYPE);
+        assert!(!response.headers().contains_key("x-amzn-errortype"));
+        let id = response.headers()["x-amzn-requestid"]
+            .to_str()
+            .unwrap()
+            .parse::<uuid::Uuid>()
+            .unwrap();
+        let callback = matches!(
+            op,
+            Op::SendTaskSuccess | Op::SendTaskFailure | Op::SendTaskHeartbeat
+        );
+        if callback {
+            assert_eq!(response.headers()["content-length"], "0");
+        }
+        let decoded = data(response).await;
+        if callback {
+            assert_eq!(decoded, Value::Null);
+        }
+        if op == Op::StartExecution {
+            assert_eq!(decoded["startDate"], json!(-1.25));
+            assert!(!decoded.as_object().unwrap().contains_key("StartExecution"));
+        }
+        let (context, request) = accepted.recv().await.unwrap();
+        assert_eq!(context.request_id(), id);
+        assert_eq!(context.scope(), &scope());
+        assert!(!context.authenticated());
+        assert_eq!(request.operation(), op);
+        assert!(!format!("{request:?}").contains("secret"));
+        if let Request::StartExecution(value) = request {
+            assert_eq!(value.input.as_deref(), Some("{ \"secret\": 7 }"));
+        }
+    }
+    assert_eq!(handler.count.load(Ordering::SeqCst), 19);
+}
+#[tokio::test]
+async fn test_should_accept_empty_body_as_empty_json_and_reject_unknown_or_unsupported_actions() {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    assert_eq!(
+        service
+            .handle(request("ListStateMachines", Bytes::new()))
+            .await
+            .status(),
+        StatusCode::OK
+    );
+    let unknown = service.handle(request("MadeUp", b"{}".as_slice())).await;
+    assert_eq!(unknown.status(), StatusCode::NOT_FOUND);
+    assert_eq!(data(unknown).await["__type"], "UnknownOperationException");
+    let unsupported = service
+        .handle(request("StartSyncExecution", b"not-json".as_slice()))
+        .await;
+    assert_eq!(unsupported.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(data(unsupported).await["__type"], "UnsupportedOperation");
+    assert_eq!(handler.count.load(Ordering::SeqCst), 1);
+}
+#[rstest::rstest]
+#[case("method")]
+#[case("path")]
+#[case("query")]
+#[case("content_type")]
+#[case("duplicate_type")]
+#[case("duplicate_target")]
+#[case("duplicate_auth")]
+#[case("compression")]
+#[case("length_mismatch")]
+#[case("length_and_transfer")]
+#[case("header_count")]
+#[case("header_value")]
+#[tokio::test]
+async fn test_should_reject_ambiguous_envelopes_before_handler(#[case] problem: &str) {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    let mut request = request("ListStateMachines", b"{}".as_slice());
+    match problem {
+        "method" => *request.method_mut() = http::Method::GET,
+        "path" => *request.uri_mut() = "/other".parse().unwrap(),
+        "query" => *request.uri_mut() = "/?ignored=1".parse().unwrap(),
+        "content_type" => {
+            request.headers_mut().insert(
+                "content-type",
+                HeaderValue::from_static("application/x-amz-json-1.1"),
+            );
+        }
+        "duplicate_type" => {
+            request
+                .headers_mut()
+                .append("content-type", HeaderValue::from_static(CONTENT_TYPE));
+        }
+        "duplicate_target" => {
+            request.headers_mut().append(
+                "x-amz-target",
+                HeaderValue::from_static("AWSStepFunctions.DeleteStateMachine"),
+            );
+        }
+        "duplicate_auth" => {
+            request
+                .headers_mut()
+                .append("authorization", HeaderValue::from_static("one"));
+            request
+                .headers_mut()
+                .append("authorization", HeaderValue::from_static("two"));
+        }
+        "compression" => {
+            request
+                .headers_mut()
+                .insert("content-encoding", HeaderValue::from_static("gzip"));
+        }
+        "length_mismatch" => {
+            request
+                .headers_mut()
+                .insert("content-length", HeaderValue::from_static("0"));
+        }
+        "length_and_transfer" => {
+            request
+                .headers_mut()
+                .insert("content-length", HeaderValue::from_static("2"));
+            request
+                .headers_mut()
+                .insert("transfer-encoding", HeaderValue::from_static("chunked"));
+        }
+        "header_count" => {
+            for index in 0..65 {
+                request.headers_mut().insert(
+                    format!("x-extra-{index}")
+                        .parse::<http::HeaderName>()
+                        .unwrap(),
+                    HeaderValue::from_static("x"),
+                );
+            }
+        }
+        "header_value" => {
+            request
+                .headers_mut()
+                .insert("x-extra", HeaderValue::from_str(&"a".repeat(8193)).unwrap());
+        }
+        _ => panic!("fixture case"),
+    }
+    assert!(claims_request(request.headers()));
+    assert_eq!(
+        service.handle(request).await.status(),
+        StatusCode::BAD_REQUEST
+    );
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
+#[test]
+fn test_should_claim_any_matching_occurrence_but_not_other_services() {
+    let mut headers = http::HeaderMap::new();
+    headers.append(
+        "x-amz-target",
+        HeaderValue::from_static("AWSEvents.PutEvents"),
+    );
+    assert!(!claims_request(&headers));
+    headers.append(
+        "x-amz-target",
+        HeaderValue::from_static("AWSStepFunctions.Unknown"),
+    );
+    assert!(claims_request(&headers));
+    assert!(resolve_operation(&headers).is_err());
+    headers.clear();
+    headers.insert("x-amz-target", HeaderValue::from_static("AWSStepFunctions"));
+    assert!(claims_request(&headers));
+}
+#[rstest::rstest]
+#[case(b"{\"maxResults\":1,\"maxResults\":2}".as_slice())]
+#[case(b"{\"unknown\":1}".as_slice())]
+#[case(b"[]".as_slice())]
+#[case(b"{\"maxResults\":-1}".as_slice())]
+#[tokio::test]
+async fn test_should_reject_bad_shape_duplicates_unknown_fields_and_ranges(#[case] body: &[u8]) {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    assert_eq!(
+        service
+            .handle(request("ListStateMachines", Bytes::copy_from_slice(body)))
+            .await
+            .status(),
+        StatusCode::BAD_REQUEST
+    );
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
+#[rstest::rstest]
+#[case(Mode::Mismatch)]
+#[case(Mode::Oversize)]
+#[case(Mode::Error)]
+#[case(Mode::OversizeError)]
+#[case(Mode::SuccessError)]
+#[tokio::test]
+async fn test_should_bound_and_correlate_replies_and_preserve_domain_errors(#[case] mode: Mode) {
+    let (service, handler, _accepted) = fixture(mode, false);
+    let response = service
+        .handle(request(
+            "StartExecution",
+            b"{\"stateMachineArn\":\"machine\"}".as_slice(),
+        ))
+        .await;
+    let code = if matches!(mode, Mode::Error) {
+        "InvalidName"
+    } else {
+        "InternalFailure"
+    };
+    assert_eq!(response.headers()["x-amzn-errortype"], code);
+    assert_eq!(
+        response.status(),
+        if matches!(mode, Mode::Error) {
+            StatusCode::BAD_REQUEST
+        } else {
+            StatusCode::INTERNAL_SERVER_ERROR
+        }
+    );
+    assert_eq!(data(response).await["__type"], code);
+    assert_eq!(handler.count.load(Ordering::SeqCst), 1);
+}
+struct NeverBody {
+    polled: Arc<AtomicUsize>,
+}
+impl Body for NeverBody {
+    type Data = Bytes;
+    type Error = Infallible;
+    fn poll_frame(
+        self: Pin<&mut Self>,
+        _: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Bytes>, Infallible>>> {
+        self.polled.fetch_add(1, Ordering::SeqCst);
+        Poll::Pending
+    }
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_bound_slow_body_and_never_poll_oversized_declared_input() {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    let polled = Arc::new(AtomicUsize::new(0));
+    let (mut parts, _) = request("ListStateMachines", Bytes::new()).into_parts();
+    parts
+        .headers
+        .insert("content-length", HeaderValue::from(3 * 1024 * 1024));
+    let response = service
+        .handle(http::Request::from_parts(
+            parts,
+            NeverBody {
+                polled: polled.clone(),
+            },
+        ))
+        .await;
+    assert_eq!(response.status(), StatusCode::PAYLOAD_TOO_LARGE);
+    assert_eq!(polled.load(Ordering::SeqCst), 0);
+    let (parts, _) = request("ListStateMachines", Bytes::new()).into_parts();
+    let response = service
+        .handle(http::Request::from_parts(parts, NeverBody { polled }))
+        .await;
+    assert_eq!(response.status(), StatusCode::REQUEST_TIMEOUT);
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
+#[tokio::test]
+async fn test_should_cap_actual_body_bytes_without_trusting_length() {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    let response = service
+        .handle(request(
+            "ListStateMachines",
+            Bytes::from(vec![b'a'; 2 * 1024 * 1024 + 1]),
+        ))
+        .await;
+    assert_eq!(response.status(), StatusCode::PAYLOAD_TOO_LARGE);
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
+#[tokio::test(start_paused = true)]
+async fn test_should_timeout_only_the_waiter_after_a_typed_command_was_accepted() {
+    let (_original, handler, mut accepted) = fixture(Mode::Pending, false);
+    let config = StepFunctionsHttpConfig::new(scope(), true, None)
+        .unwrap()
+        .with_budgets(
+            BodyBudget::new(
+                2 * 1024 * 1024,
+                Duration::from_secs(5),
+                Duration::from_secs(2),
+            )
+            .unwrap(),
+            Duration::from_secs(1),
+        )
+        .unwrap();
+    let service = StepFunctionsHttpService::new(handler.clone(), config);
+    let before = Instant::now();
+    let response = service
+        .handle(request(
+            "StartExecution",
+            b"{\"stateMachineArn\":\"machine\"}".as_slice(),
+        ))
+        .await;
+    assert_eq!(response.status(), StatusCode::REQUEST_TIMEOUT);
+    assert!(Instant::now() >= before + Duration::from_secs(1));
+    let (context, request) = accepted.recv().await.unwrap();
+    assert_eq!(request.operation(), Op::StartExecution);
+    assert!(context.deadline() <= Instant::now());
+    assert_eq!(handler.count.load(Ordering::SeqCst), 1);
+}
+#[tokio::test]
+async fn test_should_leave_accepted_command_owned_when_http_caller_disappears() {
+    let (service, _handler, mut accepted) = fixture(Mode::Pending, false);
+    let task = tokio::spawn(async move {
+        service
+            .handle(request(
+                "StartExecution",
+                b"{\"stateMachineArn\":\"machine\"}".as_slice(),
+            ))
+            .await
+    });
+    let (context, request) = accepted.recv().await.unwrap();
+    task.abort();
+    assert!(task.await.unwrap_err().is_cancelled());
+    assert_eq!(request.operation(), Op::StartExecution);
+    assert!(!context.request_id().is_nil());
+}
+fn signed(
+    body: &[u8],
+    region: &str,
+    service: &str,
+    bind_target: bool,
+) -> http::Request<Full<Bytes>> {
+    let mut request = request("ListStateMachines", Bytes::copy_from_slice(body));
+    let timestamp = chrono::Utc::now().format("%Y%m%dT%H%M%SZ").to_string();
+    let date = &timestamp[..8];
+    request
+        .headers_mut()
+        .insert("host", HeaderValue::from_static("localhost"));
+    request
+        .headers_mut()
+        .insert("x-amz-date", HeaderValue::from_str(&timestamp).unwrap());
+    let mut names = vec!["content-type", "host", "x-amz-date"];
+    if bind_target {
+        names.push("x-amz-target");
+    }
+    let headers: Vec<_> = names
+        .iter()
+        .map(|name| (*name, request.headers()[*name].to_str().unwrap()))
+        .collect();
+    let canonical = build_canonical_request("POST", "/", "", &headers, &names, &hash_payload(body));
+    let scope = format!("{date}/{region}/{service}/aws4_request");
+    let string = build_string_to_sign(&timestamp, &scope, &hash_payload(canonical.as_bytes()));
+    let key = derive_signing_key("local-secret", date, region, service).unwrap();
+    let signature = compute_signature(&key, &string).unwrap();
+    request.headers_mut().insert(
+        "authorization",
+        HeaderValue::from_str(&format!(
+            "AWS4-HMAC-SHA256 Credential=local-key/{scope}, SignedHeaders={}, \
+             Signature={signature}",
+            names.join(";")
+        ))
+        .unwrap(),
+    );
+    request
+}
+#[tokio::test]
+async fn test_should_verify_original_payload_and_bind_service_region_and_action() {
+    let (service, handler, mut accepted) = fixture(Mode::Normal, true);
+    assert_eq!(
+        service
+            .handle(signed(b"{}", "us-east-1", "states", true))
+            .await
+            .status(),
+        StatusCode::OK
+    );
+    assert!(accepted.recv().await.unwrap().0.authenticated());
+    for (region, name, target) in [
+        ("us-west-2", "states", true),
+        ("us-east-1", "lambda", true),
+        ("us-east-1", "states", false),
+    ] {
+        let response = service.handle(signed(b"{}", region, name, target)).await;
+        assert_eq!(response.status(), StatusCode::FORBIDDEN);
+        assert_eq!(data(response).await["__type"], "AccessDeniedException");
+    }
+    let (mut parts, _) = signed(b"{}", "us-east-1", "states", true).into_parts();
+    parts.headers.remove("x-amz-content-sha256");
+    let response = service
+        .handle(http::Request::from_parts(
+            parts,
+            Full::new(Bytes::from_static(b"{\"maxResults\":1}")),
+        ))
+        .await;
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    assert_eq!(handler.count.load(Ordering::SeqCst), 1);
+}
+#[test]
+fn test_should_fail_closed_config_and_redact_scope_and_auth_sources() {
+    assert!(StepFunctionsHttpConfig::new(scope(), false, None).is_err());
+    assert!(RequestScope::new("other".into(), "us-east-1".into(), "000000000000".into()).is_err());
+    assert!(RequestScope::new("aws".into(), "-".into(), "000000000000".into()).is_err());
+    assert!(RequestScope::new("aws".into(), "us-east-1".into(), "0".into()).is_err());
+    let error = HttpError::Authentication(rustack_auth::AuthError::AccessKeyNotFound(
+        "secret-access-key".into(),
+    ));
+    assert!(!format!("{error:?} {error}").contains("secret"));
+    assert!(!format!("{:?}", scope()).contains("000000000000"));
+}
+
+mod bounds;
diff --git a/crates/rustack-stepfunctions-http/src/tests/bounds.rs b/crates/rustack-stepfunctions-http/src/tests/bounds.rs
new file mode 100644
index 00000000..6364c546
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/tests/bounds.rs
@@ -0,0 +1,255 @@
+use std::collections::VecDeque;
+
+use super::*;
+
+#[rstest::rstest]
+#[case("name")]
+#[case("name_charset")]
+#[case("arn")]
+#[case("definition")]
+#[case("execution_input")]
+#[case("empty_input")]
+#[case("output")]
+#[case("token")]
+#[case("next_token")]
+#[case("tags")]
+#[case("tag_key")]
+#[case("tag_value")]
+#[case("tag_keys")]
+#[case("cause")]
+#[case("error")]
+#[case("logging")]
+#[case("version")]
+#[case("encryption_period")]
+#[tokio::test]
+async fn test_should_bound_operation_fields_before_handler_entry(#[case] problem: &str) {
+    let (action, body, code) = match problem {
+        "name" => (
+            "StartExecution",
+            json!({"stateMachineArn":"machine","name":"a".repeat(81)}),
+            "InvalidName",
+        ),
+        "name_charset" => (
+            "StartExecution",
+            json!({"stateMachineArn":"machine","name":"bad name"}),
+            "InvalidName",
+        ),
+        "arn" => (
+            "DescribeExecution",
+            json!({"executionArn":"a".repeat(257)}),
+            "InvalidArn",
+        ),
+        "definition" => (
+            "ValidateStateMachineDefinition",
+            json!({"definition":"a".repeat(1024*1024+1)}),
+            "ValidationException",
+        ),
+        "execution_input" => (
+            "StartExecution",
+            json!({"stateMachineArn":"machine","input":serde_json::to_string(&"a".repeat(262_144)).unwrap()}),
+            "InvalidExecutionInput",
+        ),
+        "empty_input" => (
+            "StartExecution",
+            json!({"stateMachineArn":"machine","input":""}),
+            "InvalidExecutionInput",
+        ),
+        "output" => (
+            "SendTaskSuccess",
+            json!({"taskToken":"token","output":"not-json"}),
+            "InvalidOutput",
+        ),
+        "token" => (
+            "SendTaskHeartbeat",
+            json!({"taskToken":"é"}),
+            "InvalidToken",
+        ),
+        "next_token" => (
+            "ListStateMachines",
+            json!({"nextToken":"a".repeat(2049)}),
+            "InvalidToken",
+        ),
+        "tags" => (
+            "TagResource",
+            json!({"resourceArn":"machine","tags":vec![json!({"key":"a"});51]}),
+            "TooManyTags",
+        ),
+        "tag_key" => (
+            "TagResource",
+            json!({"resourceArn":"machine","tags":[{"key":"a".repeat(129)}]}),
+            "ValidationException",
+        ),
+        "tag_value" => (
+            "TagResource",
+            json!({"resourceArn":"machine","tags":[{"key":"a","value":"a".repeat(257)}]}),
+            "ValidationException",
+        ),
+        "tag_keys" => (
+            "UntagResource",
+            json!({"resourceArn":"machine","tagKeys":vec!["key";51]}),
+            "TooManyTags",
+        ),
+        "cause" => (
+            "StopExecution",
+            json!({"executionArn":"execution","cause":"a".repeat(32_769)}),
+            "ValidationException",
+        ),
+        "error" => (
+            "SendTaskFailure",
+            json!({"taskToken":"token","error":"a".repeat(257)}),
+            "ValidationException",
+        ),
+        "logging" => (
+            "CreateStateMachine",
+            json!({"name":"machine","roleArn":"role","definition":"{}","loggingConfiguration":{"destinations":[{},{}]}}),
+            "ValidationException",
+        ),
+        "version" => (
+            "UpdateStateMachine",
+            json!({"stateMachineArn":"machine","versionDescription":"a".repeat(257)}),
+            "ValidationException",
+        ),
+        "encryption_period" => (
+            "CreateStateMachine",
+            json!({"name":"machine","roleArn":"role","definition":"{}","encryptionConfiguration":{"type":"AWS_OWNED_KEY","kmsDataKeyReusePeriodSeconds":59}}),
+            "ValidationException",
+        ),
+        _ => panic!("fixture case"),
+    };
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    let response = service
+        .handle(request(action, serde_json::to_vec(&body).unwrap()))
+        .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(data(response).await["__type"], code);
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
+#[tokio::test]
+async fn test_should_accept_exact_byte_bounds_unicode_business_data_and_trace_ascii() {
+    let (service, handler, mut accepted) = fixture(Mode::Normal, false);
+    for trace in [
+        String::new(),
+        "Root=value; Parent=value".to_owned(),
+        "t".repeat(256),
+    ] {
+        let body = json!({"stateMachineArn":"a".repeat(256),"name":"a".repeat(80),"input":"null","traceHeader":trace});
+        assert_eq!(
+            service
+                .handle(request(
+                    "StartExecution",
+                    serde_json::to_vec(&body).unwrap()
+                ))
+                .await
+                .status(),
+            StatusCode::OK
+        );
+        let (_, request) = accepted.recv().await.unwrap();
+        let Request::StartExecution(value) = request else {
+            panic!("start fixture")
+        };
+        assert_eq!(value.trace_header, Some(trace));
+    }
+    let exact = serde_json::to_string(&"é".repeat(131_071)).unwrap();
+    assert_eq!(exact.len(), 262_144);
+    let body = json!({"stateMachineArn":"machine","input":exact});
+    assert_eq!(
+        service
+            .handle(request(
+                "StartExecution",
+                serde_json::to_vec(&body).unwrap()
+            ))
+            .await
+            .status(),
+        StatusCode::OK
+    );
+    accepted.recv().await.unwrap();
+    let body = json!({"definition":"a".repeat(1024*1024)});
+    assert_eq!(
+        service
+            .handle(request(
+                "ValidateStateMachineDefinition",
+                serde_json::to_vec(&body).unwrap()
+            ))
+            .await
+            .status(),
+        StatusCode::OK
+    );
+    assert_eq!(handler.count.load(Ordering::SeqCst), 5);
+}
+#[rstest::rstest]
+#[case("é".to_owned())]
+#[case("a".repeat(257))]
+#[tokio::test]
+async fn test_should_reject_non_ascii_or_oversized_trace_header(#[case] trace: String) {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    let body = json!({"stateMachineArn":"machine","traceHeader":trace});
+    assert_eq!(
+        service
+            .handle(request(
+                "StartExecution",
+                serde_json::to_vec(&body).unwrap()
+            ))
+            .await
+            .status(),
+        StatusCode::BAD_REQUEST
+    );
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
+#[rstest::rstest]
+#[case("+2")]
+#[case("-0")]
+#[case("")]
+#[tokio::test]
+async fn test_should_reject_non_decimal_content_length(#[case] length: &str) {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    let mut request = request("ListStateMachines", b"{}".as_slice());
+    request
+        .headers_mut()
+        .insert("content-length", HeaderValue::from_str(length).unwrap());
+    assert_eq!(
+        service.handle(request).await.status(),
+        StatusCode::BAD_REQUEST
+    );
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
+struct Frames {
+    frames: VecDeque<Frame<Bytes>>,
+}
+impl Body for Frames {
+    type Data = Bytes;
+    type Error = Infallible;
+    fn poll_frame(
+        self: Pin<&mut Self>,
+        _: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Bytes>, Infallible>>> {
+        Poll::Ready(self.get_mut().frames.pop_front().map(Ok))
+    }
+}
+#[rstest::rstest]
+#[case(false)]
+#[case(true)]
+#[tokio::test]
+async fn test_should_reject_all_trailers_before_handler_even_when_metadata_is_oversized(
+    #[case] oversized: bool,
+) {
+    let (service, handler, _accepted) = fixture(Mode::Normal, false);
+    let mut trailers = http::HeaderMap::new();
+    trailers.insert(
+        "x-trailer-secret",
+        HeaderValue::from_str(&"s".repeat(if oversized { 9000 } else { 1 })).unwrap(),
+    );
+    let (parts, _) = request("ListStateMachines", Bytes::new()).into_parts();
+    let body = Frames {
+        frames: VecDeque::from([
+            Frame::data(Bytes::from_static(b"{}")),
+            Frame::trailers(trailers),
+        ]),
+    };
+    let response = service.handle(http::Request::from_parts(parts, body)).await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(
+        data(response).await["__type"],
+        "MalformedHttpRequestException"
+    );
+    assert_eq!(handler.count.load(Ordering::SeqCst), 0);
+}
diff --git a/crates/rustack-stepfunctions-http/src/transport.rs b/crates/rustack-stepfunctions-http/src/transport.rs
new file mode 100644
index 00000000..5e23b3f1
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/transport.rs
@@ -0,0 +1,91 @@
+//! One allowlist defines typed requests, replies and operation correlation.
+
+use std::{fmt, io::Write};
+
+use rustack_core::json::{JsonLimits, from_slice};
+use rustack_stepfunctions_model::{StepFunctionsOperation, input, output};
+
+use crate::HttpError;
+
+macro_rules! operations {
+    ($($op:ident => $input:ident, $output:ident;)*) => {
+        /// Typed boundary requests; DTO contents stay out of diagnostics.
+        #[non_exhaustive]
+        pub enum Request {$(#[doc=concat!("Typed `",stringify!($op),"` input.")] $op(Box<input::$input>),)*}
+        /// Typed replies; only the contained DTO is encoded on the wire.
+        #[non_exhaustive]
+        pub enum Response {$(#[doc=concat!("Typed `",stringify!($op),"` output.")] $op(Box<output::$output>),)*}
+        impl Request {
+            /// Preflight/decode and bound a supported request before handler entry.
+            ///
+            /// # Errors
+            /// Rejects unsupported operations, invalid/ambiguous/oversized JSON and field bounds.
+            ///
+            /// ```
+            /// let request=rustack_stepfunctions_http::Request::decode(rustack_stepfunctions_model::StepFunctionsOperation::ListStateMachines,b"{}")?;
+            /// assert_eq!(request.operation(),rustack_stepfunctions_model::StepFunctionsOperation::ListStateMachines);
+            /// # Ok::<(),rustack_stepfunctions_http::HttpError>(())
+            /// ```
+            pub fn decode(operation:StepFunctionsOperation, bytes:&[u8])->Result<Self,HttpError> {
+                let limits=JsonLimits::new(2*1024*1024,16,4096,1024*1024,128).map_err(HttpError::Json)?;
+                let bytes=if bytes.is_empty(){b"{}".as_slice()}else{bytes};
+                let request=match operation {$(StepFunctionsOperation::$op=>Self::$op(Box::new(from_slice::<input::$input>(bytes,limits).map_err(HttpError::Json)?)),)* _=>return Err(HttpError::UnsupportedOperation)};
+                crate::validation::validate(&request)?; Ok(request)
+            }
+            /// Recheck bounds for a trusted typed request before domain preparation.
+            ///
+            /// # Errors
+            /// Rejects invalid byte/count limits, business JSON or wire fields.
+            ///
+            /// ```
+            /// let request=rustack_stepfunctions_http::Request::decode(rustack_stepfunctions_model::StepFunctionsOperation::ListStateMachines,b"{}")?;
+            /// request.validate()?;
+            /// # Ok::<(),rustack_stepfunctions_http::HttpError>(())
+            /// ```
+            pub fn validate(&self)->Result<(),HttpError>{crate::validation::validate(self)}
+            /// Exact modeled operation for this variant.
+            #[must_use] pub fn operation(&self)->StepFunctionsOperation {match self {$(Self::$op(_)=>StepFunctionsOperation::$op,)*}}
+        }
+        impl Response {
+            /// Exact modeled operation for correlation before serialization.
+            #[must_use] pub fn operation(&self)->StepFunctionsOperation {match self {$(Self::$op(_)=>StepFunctionsOperation::$op,)*}}
+            pub(crate) fn encode<W:Write>(&self,writer:W)->Result<(),serde_json::Error> {match self {$(Self::$op(value)=>serde_json::to_writer(writer,value),)*}}
+        }
+        $(impl From<output::$output> for Response {fn from(value:output::$output)->Self {Self::$op(Box::new(value))}})*
+    }
+}
+operations! {
+    CreateStateMachine=>CreateStateMachineInput,CreateStateMachineOutput;
+    UpdateStateMachine=>UpdateStateMachineInput,UpdateStateMachineOutput;
+    DeleteStateMachine=>DeleteStateMachineInput,DeleteStateMachineOutput;
+    DescribeStateMachine=>DescribeStateMachineInput,DescribeStateMachineOutput;
+    ListStateMachines=>ListStateMachinesInput,ListStateMachinesOutput;
+    ListStateMachineVersions=>ListStateMachineVersionsInput,ListStateMachineVersionsOutput;
+    ValidateStateMachineDefinition=>ValidateStateMachineDefinitionInput,ValidateStateMachineDefinitionOutput;
+    StartExecution=>StartExecutionInput,StartExecutionOutput;
+    DescribeExecution=>DescribeExecutionInput,DescribeExecutionOutput;
+    ListExecutions=>ListExecutionsInput,ListExecutionsOutput;
+    StopExecution=>StopExecutionInput,StopExecutionOutput;
+    GetExecutionHistory=>GetExecutionHistoryInput,GetExecutionHistoryOutput;
+    DescribeStateMachineForExecution=>DescribeStateMachineForExecutionInput,DescribeStateMachineForExecutionOutput;
+    TagResource=>TagResourceInput,TagResourceOutput;
+    UntagResource=>UntagResourceInput,UntagResourceOutput;
+    ListTagsForResource=>ListTagsForResourceInput,ListTagsForResourceOutput;
+    SendTaskSuccess=>SendTaskSuccessInput,SendTaskSuccessOutput;
+    SendTaskFailure=>SendTaskFailureInput,SendTaskFailureOutput;
+    SendTaskHeartbeat=>SendTaskHeartbeatInput,SendTaskHeartbeatOutput;
+}
+impl fmt::Debug for Request {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Request")
+            .field("operation", &self.operation())
+            .finish_non_exhaustive()
+    }
+}
+impl fmt::Debug for Response {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Response")
+            .field("operation", &self.operation())
+            .finish_non_exhaustive()
+    }
+}
diff --git a/crates/rustack-stepfunctions-http/src/validation.rs b/crates/rustack-stepfunctions-http/src/validation.rs
new file mode 100644
index 00000000..4740a1b8
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/src/validation.rs
@@ -0,0 +1,233 @@
+//! Wire byte/count bounds. Core retains ARN, role, ASL and capability semantics.
+
+use rustack_core::json::{JsonLimits, validate as json};
+use rustack_stepfunctions_model::{
+    StepFunctionsErrorCode as Code,
+    input::{CreateStateMachineInput, UpdateStateMachineInput},
+    types::{EncryptionConfiguration, LoggingConfiguration, Tag},
+};
+
+use crate::{HttpError, Request};
+
+pub(crate) fn validate(request: &Request) -> Result<(), HttpError> {
+    resource(request)?;
+    details(request)
+}
+fn resource(request: &Request) -> Result<(), HttpError> {
+    let arn = match request {
+        Request::CreateStateMachine(value) => Some(value.role_arn.as_str()),
+        Request::UpdateStateMachine(value) => Some(value.state_machine_arn.as_str()),
+        Request::DeleteStateMachine(value) => Some(value.state_machine_arn.as_str()),
+        Request::DescribeStateMachine(value) => Some(value.state_machine_arn.as_str()),
+        Request::ListStateMachineVersions(value) => Some(value.state_machine_arn.as_str()),
+        Request::StartExecution(value) => Some(value.state_machine_arn.as_str()),
+        Request::DescribeExecution(value) => Some(value.execution_arn.as_str()),
+        Request::StopExecution(value) => Some(value.execution_arn.as_str()),
+        Request::GetExecutionHistory(value) => Some(value.execution_arn.as_str()),
+        Request::DescribeStateMachineForExecution(value) => Some(value.execution_arn.as_str()),
+        Request::TagResource(value) => Some(value.resource_arn.as_str()),
+        Request::UntagResource(value) => Some(value.resource_arn.as_str()),
+        Request::ListTagsForResource(value) => Some(value.resource_arn.as_str()),
+        _ => None,
+    };
+    if let Some(arn) = arn {
+        identifier(arn, 256, Code::InvalidArn)?;
+    }
+    Ok(())
+}
+fn details(request: &Request) -> Result<(), HttpError> {
+    match request {
+        Request::CreateStateMachine(value) => create(value),
+        Request::UpdateStateMachine(value) => update(value),
+        Request::ValidateStateMachineDefinition(value) => {
+            text(&value.definition, 1024 * 1024, Code::ValidationException)?;
+            page(value.max_results, None, 100)
+        }
+        Request::ListStateMachineVersions(value) => {
+            optional_id(value.next_token.as_deref(), 1024, Code::InvalidToken)?;
+            page(value.max_results, None, 1000)
+        }
+        Request::ListStateMachines(value) => {
+            page(value.max_results, value.next_token.as_deref(), 1000)
+        }
+        Request::ListExecutions(value) => {
+            optional_id(value.state_machine_arn.as_deref(), 256, Code::InvalidArn)?;
+            optional_id(value.map_run_arn.as_deref(), 256, Code::InvalidArn)?;
+            page(value.max_results, value.next_token.as_deref(), 1000)
+        }
+        Request::GetExecutionHistory(value) => {
+            page(value.max_results, value.next_token.as_deref(), 1000)
+        }
+        Request::StartExecution(value) => {
+            if let Some(value) = &value.name {
+                name(value)?;
+            }
+            if let Some(value) = &value.input {
+                payload(value, Code::InvalidExecutionInput)?;
+            }
+            ascii_text(value.trace_header.as_deref(), 256)
+        }
+        Request::StopExecution(value) => failure(value.error.as_deref(), value.cause.as_deref()),
+        Request::TagResource(value) => tags(&value.tags),
+        Request::UntagResource(value) => {
+            if value.tag_keys.len() > 50 {
+                return Err(HttpError::Field(Code::TooManyTags));
+            }
+            for key in &value.tag_keys {
+                nonempty(key, 128, Code::ValidationException)?;
+            }
+            Ok(())
+        }
+        Request::SendTaskSuccess(value) => {
+            identifier(&value.task_token, 2048, Code::InvalidToken)?;
+            payload(&value.output, Code::InvalidOutput)
+        }
+        Request::SendTaskFailure(value) => {
+            identifier(&value.task_token, 2048, Code::InvalidToken)?;
+            failure(value.error.as_deref(), value.cause.as_deref())
+        }
+        Request::SendTaskHeartbeat(value) => {
+            identifier(&value.task_token, 2048, Code::InvalidToken)
+        }
+        _ => Ok(()),
+    }
+}
+fn create(value: &CreateStateMachineInput) -> Result<(), HttpError> {
+    text(&value.definition, 1024 * 1024, Code::ValidationException)?;
+    name(&value.name)?;
+    tags(&value.tags)?;
+    metadata(
+        value.logging_configuration.as_ref(),
+        value.encryption_configuration.as_ref(),
+        value.version_description.as_deref(),
+    )
+}
+fn update(value: &UpdateStateMachineInput) -> Result<(), HttpError> {
+    if let Some(value) = &value.definition {
+        text(value, 1024 * 1024, Code::ValidationException)?;
+    }
+    optional_id(value.role_arn.as_deref(), 256, Code::InvalidArn)?;
+    metadata(
+        value.logging_configuration.as_ref(),
+        value.encryption_configuration.as_ref(),
+        value.version_description.as_deref(),
+    )
+}
+fn metadata(
+    logging: Option<&LoggingConfiguration>,
+    encryption: Option<&EncryptionConfiguration>,
+    version: Option<&str>,
+) -> Result<(), HttpError> {
+    if let Some(logging) = logging {
+        if logging.destinations.len() > 1 {
+            return Err(HttpError::Field(Code::ValidationException));
+        }
+        for destination in &logging.destinations {
+            if let Some(group) = &destination.cloud_watch_logs_log_group {
+                optional_id(
+                    group.log_group_arn.as_deref(),
+                    256,
+                    Code::ValidationException,
+                )?;
+            }
+        }
+    }
+    if let Some(encryption) = encryption {
+        optional_id(
+            encryption.kms_key_id.as_deref(),
+            256,
+            Code::ValidationException,
+        )?;
+        if encryption
+            .kms_data_key_reuse_period_seconds
+            .is_some_and(|value| !(60..=900).contains(&value))
+        {
+            return Err(HttpError::Field(Code::ValidationException));
+        }
+    }
+    if let Some(version) = version {
+        text(version, 256, Code::ValidationException)?;
+    }
+    Ok(())
+}
+fn page(maximum: Option<i32>, token: Option<&str>, cap: i32) -> Result<(), HttpError> {
+    if maximum.is_some_and(|value| !(0..=cap).contains(&value)) {
+        return Err(HttpError::Field(Code::ValidationException));
+    }
+    optional_id(token, 2048, Code::InvalidToken)
+}
+fn tags(values: &[Tag]) -> Result<(), HttpError> {
+    if values.len() > 50 {
+        return Err(HttpError::Field(Code::TooManyTags));
+    }
+    for value in values {
+        let key = value
+            .key
+            .as_deref()
+            .ok_or(HttpError::Field(Code::ValidationException))?;
+        nonempty(key, 128, Code::ValidationException)?;
+        if let Some(value) = &value.value {
+            text(value, 256, Code::ValidationException)?;
+        }
+    }
+    Ok(())
+}
+fn name(value: &str) -> Result<(), HttpError> {
+    nonempty(value, 80, Code::InvalidName)?;
+    if !value
+        .bytes()
+        .all(|byte| byte.is_ascii_alphanumeric() || b"_-".contains(&byte))
+    {
+        return Err(HttpError::Field(Code::InvalidName));
+    }
+    Ok(())
+}
+fn failure(error: Option<&str>, cause: Option<&str>) -> Result<(), HttpError> {
+    if let Some(value) = error {
+        text(value, 256, Code::ValidationException)?;
+    }
+    if let Some(value) = cause {
+        text(value, 32768, Code::ValidationException)?;
+    }
+    Ok(())
+}
+fn optional_id(value: Option<&str>, max: usize, code: Code) -> Result<(), HttpError> {
+    if let Some(value) = value {
+        identifier(value, max, code)?;
+    }
+    Ok(())
+}
+fn identifier(value: &str, max: usize, code: Code) -> Result<(), HttpError> {
+    nonempty(value, max, code)?;
+    if !value.bytes().all(|byte| byte.is_ascii_graphic()) {
+        return Err(HttpError::Field(code));
+    }
+    Ok(())
+}
+fn nonempty(value: &str, max: usize, code: Code) -> Result<(), HttpError> {
+    if value.is_empty() {
+        Err(HttpError::Field(code))
+    } else {
+        text(value, max, code)
+    }
+}
+fn text(value: &str, max: usize, code: Code) -> Result<(), HttpError> {
+    if value.len() > max {
+        Err(HttpError::Field(code))
+    } else {
+        Ok(())
+    }
+}
+fn payload(value: &str, code: Code) -> Result<(), HttpError> {
+    nonempty(value, 262_144, code)?;
+    let limits = JsonLimits::new(262_144, 64, 65_536, 262_144, 262_144).map_err(HttpError::Json)?;
+    json(value.as_bytes(), limits).map_err(|_| HttpError::Field(code))
+}
+
+fn ascii_text(value: Option<&str>, maximum: usize) -> Result<(), HttpError> {
+    if value.is_some_and(|value| value.len() > maximum || !value.is_ascii()) {
+        Err(HttpError::Field(Code::ValidationException))
+    } else {
+        Ok(())
+    }
+}
diff --git a/crates/rustack-stepfunctions-http/tests/network.rs b/crates/rustack-stepfunctions-http/tests/network.rs
new file mode 100644
index 00000000..d694a0e3
--- /dev/null
+++ b/crates/rustack-stepfunctions-http/tests/network.rs
@@ -0,0 +1,281 @@
+//! Actual HTTP framing and ordinary SDK qualification of the transport only.
+#![forbid(unsafe_code)]
+
+use std::{
+    net::SocketAddr,
+    path::Path,
+    sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    },
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use async_trait::async_trait;
+use hyper::server::conn::http1;
+use hyper_util::rt::TokioIo;
+use rustack_auth::StaticCredentialProvider;
+use rustack_stepfunctions_http::{
+    Request, RequestContext, RequestScope, Response, StepFunctionsHandler, StepFunctionsHttpConfig,
+    StepFunctionsHttpService,
+};
+use rustack_stepfunctions_model::{StepFunctionsError, StepFunctionsErrorCode, output};
+use serde_json::Value;
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{TcpListener, TcpStream},
+    process::Command,
+    sync::watch,
+    task::{JoinHandle, JoinSet},
+    time::timeout,
+};
+
+#[derive(Default)]
+struct Fixture {
+    calls: AtomicUsize,
+    authenticated: AtomicUsize,
+}
+#[async_trait]
+impl StepFunctionsHandler for Fixture {
+    async fn handle(
+        &self,
+        context: RequestContext,
+        request: Request,
+    ) -> Result<Response, StepFunctionsError> {
+        self.calls.fetch_add(1, Ordering::SeqCst);
+        if context.authenticated() {
+            self.authenticated.fetch_add(1, Ordering::SeqCst);
+        }
+        match request {
+            Request::ListStateMachines(_) => Ok(output::ListStateMachinesOutput::default().into()),
+            Request::StartExecution(value) => {
+                assert_eq!(value.input.as_deref(), Some(" {\"n\":7}"));
+                assert_eq!(value.trace_header.as_deref(), Some(""));
+                let mut response = output::StartExecutionOutput::default();
+                response.execution_arn =
+                    "arn:aws:states:us-east-1:000000000000:execution:wire:execution".into();
+                response.start_date = chrono::DateTime::from_timestamp_millis(-1250).unwrap();
+                Ok(response.into())
+            }
+            Request::DescribeExecution(_) => Err(StepFunctionsError::with_message(
+                StepFunctionsErrorCode::ExecutionDoesNotExist,
+                "fixture missing",
+            )),
+            _ => Err(StepFunctionsError::new(
+                StepFunctionsErrorCode::UnsupportedOperation,
+            )),
+        }
+    }
+}
+struct Server {
+    address: SocketAddr,
+    stop: watch::Sender<bool>,
+    task: Option<JoinHandle<Result<()>>>,
+}
+impl Server {
+    async fn start(handler: Arc<Fixture>, strict: bool) -> Result<Self> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let address = listener.local_addr()?;
+        let scope = RequestScope::new("aws".into(), "us-east-1".into(), "000000000000".into())?;
+        let credentials = Arc::new(StaticCredentialProvider::new(vec![(
+            "local-key".into(),
+            "local-secret".into(),
+        )]));
+        let service = StepFunctionsHttpService::new(
+            handler,
+            StepFunctionsHttpConfig::new(scope, !strict, Some(credentials))?,
+        );
+        let (stop, mut stopped) = watch::channel(false);
+        let task = tokio::spawn(async move {
+            let mut connections = JoinSet::new();
+            let primary = loop {
+                tokio::select! {
+                    biased;
+                    _=stopped.changed()=>break Ok(()),
+                    joined=connections.join_next(),if !connections.is_empty()=>match joined {
+                        Some(Ok(Ok(()))) | None=>{},Some(Ok(Err(error)))=>break Err(error),Some(Err(error))=>break Err(error.into()),
+                    },
+                    accepted=listener.accept(),if connections.len()<8=>match accepted {
+                        Ok((socket,_))=>{let service=service.clone();connections.spawn(async move {
+                            timeout(Duration::from_secs(15),http1::Builder::new().serve_connection(TokioIo::new(socket),service)).await.context("connection deadline")?.context("HTTP connection")
+                        });},
+                        Err(error)=>break Err(error.into()),
+                    },
+                }
+            };
+            connections.abort_all();
+            let mut cleanup = Ok(());
+            while let Some(joined) = connections.join_next().await {
+                match joined {
+                    Ok(Ok(())) => {}
+                    Ok(Err(error)) => cleanup = Err(error),
+                    Err(error) if error.is_cancelled() => {}
+                    Err(error) => cleanup = Err(error.into()),
+                }
+            }
+            primary.and(cleanup)
+        });
+        Ok(Self {
+            address,
+            stop,
+            task: Some(task),
+        })
+    }
+    async fn shutdown(&mut self) -> Result<()> {
+        self.stop.send_replace(true);
+        let Some(mut task) = self.task.take() else {
+            return Ok(());
+        };
+        match timeout(Duration::from_secs(10), &mut task).await {
+            Ok(joined) => joined?,
+            Err(error) => {
+                // Keep the signaled root and its connection JoinSet alive.
+                // A waiter deadline is not permission to lose drain ownership.
+                self.task = Some(task);
+                Err(error.into())
+            }
+        }
+    }
+}
+impl Drop for Server {
+    fn drop(&mut self) {
+        self.stop.send_replace(true);
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn test_should_retain_server_join_ownership_after_cleanup_waiter_expiry() -> Result<()> {
+    let (stop, mut stopped) = watch::channel(false);
+    let (release, held) = tokio::sync::oneshot::channel();
+    let joined = Arc::new(AtomicUsize::new(0));
+    let completed = joined.clone();
+    let task = tokio::spawn(async move {
+        let mut connections = JoinSet::new();
+        connections.spawn(std::future::pending::<()>());
+        let _ = stopped.changed().await;
+        held.await.context("release drain")?;
+        connections.abort_all();
+        while connections.join_next().await.is_some() {}
+        completed.store(1, Ordering::SeqCst);
+        Ok(())
+    });
+    let id = task.id();
+    let mut server = Server {
+        address: "127.0.0.1:1".parse()?,
+        stop,
+        task: Some(task),
+    };
+    ensure!(
+        server.shutdown().await.is_err(),
+        "held drain did not expire"
+    );
+    ensure!(
+        server.task.as_ref().context("retained root")?.id() == id,
+        "root changed after timeout"
+    );
+    ensure!(
+        joined.load(Ordering::SeqCst) == 0,
+        "drain completed before release"
+    );
+    release
+        .send(())
+        .map_err(|()| anyhow::anyhow!("drain receiver lost"))?;
+    server.shutdown().await?;
+    ensure!(
+        joined.load(Ordering::SeqCst) == 1,
+        "connection handles were not joined"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_reject_actual_chunked_trailers_without_dispatching() -> Result<()> {
+    let handler = Arc::new(Fixture::default());
+    let mut server = Server::start(handler.clone(), false).await?;
+    let result = async {
+        let mut socket = TcpStream::connect(server.address).await?;
+        let request = format!(
+            "POST / HTTP/1.1\r\nHost: localhost\r\nContent-Type: \
+             application/x-amz-json-1.0\r\nX-Amz-Target: \
+             AWSStepFunctions.ListStateMachines\r\nTransfer-Encoding: chunked\r\nTrailer: \
+             x-opaque\r\nConnection: close\r\n\r\n2\r\n{{}}\r\n0\r\nx-opaque: {}\r\n\r\n",
+            "s".repeat(9000)
+        );
+        timeout(Duration::from_secs(5), socket.write_all(request.as_bytes())).await??;
+        let mut response = Vec::new();
+        timeout(
+            Duration::from_secs(5),
+            socket.take(65536).read_to_end(&mut response),
+        )
+        .await??;
+        let split = response
+            .windows(4)
+            .position(|bytes| bytes == b"\r\n\r\n")
+            .context("HTTP response headers")?;
+        ensure!(
+            response.starts_with(b"HTTP/1.1 400"),
+            "trailer did not receive400"
+        );
+        let value: Value = serde_json::from_slice(response.get(split + 4..).context("body")?)?;
+        ensure!(
+            value["__type"] == "MalformedHttpRequestException",
+            "wrong trailer error"
+        );
+        ensure!(
+            handler.calls.load(Ordering::SeqCst) == 0,
+            "trailers reached handler"
+        );
+        anyhow::Ok(())
+    }
+    .await;
+    let cleanup = server.shutdown().await;
+    result.and(cleanup)
+}
+#[tokio::test]
+#[ignore = "requires uv and pinned ordinary boto3 fixture"]
+async fn test_should_exchange_signed_boto3_requests_with_typed_transport() -> Result<()> {
+    let handler = Arc::new(Fixture::default());
+    let mut server = Server::start(handler.clone(), true).await?;
+    let result = async {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+        let mut command = Command::new("uv");
+        command
+            .args([
+                "run",
+                "--no-project",
+                "--python",
+                "3.13",
+                "--with-requirements",
+            ])
+            .arg(root.join("tests/workflows/requirements.txt"))
+            .arg("python")
+            .arg(root.join("tests/workflows/stepfunctions_http_sdk.py"))
+            .arg(format!("http://{}", server.address))
+            .env("AWS_EC2_METADATA_DISABLED", "true")
+            .env("NO_PROXY", "127.0.0.1,localhost")
+            .kill_on_drop(true);
+        let mut child = command.spawn().context("start pinned SDK")?;
+        let status = match timeout(Duration::from_secs(60), child.wait()).await {
+            Ok(status) => status?,
+            Err(error) => {
+                let _ = child.kill().await;
+                let _ = child.wait().await;
+                return Err(error.into());
+            }
+        };
+        ensure!(status.success(), "SDK fixture failed: {status}");
+        ensure!(
+            handler.calls.load(Ordering::SeqCst) == 3,
+            "wrong dispatch count"
+        );
+        ensure!(
+            handler.authenticated.load(Ordering::SeqCst) == 3,
+            "SDK calls not authenticated"
+        );
+        anyhow::Ok(())
+    }
+    .await;
+    let cleanup = server.shutdown().await;
+    result.and(cleanup)
+}
diff --git a/crates/rustack-stepfunctions-model/Cargo.toml b/crates/rustack-stepfunctions-model/Cargo.toml
new file mode 100644
index 00000000..2bf629a7
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "rustack-stepfunctions-model"
+description = "Generated Step Functions protocol model for Rustack"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true, features = ["raw_value"] }
+thiserror = { workspace = true }
+http = { workspace = true }
+chrono = { workspace = true }
+typed-builder = { workspace = true }
+
+[dev-dependencies]
+rstest = { workspace = true }
diff --git a/crates/rustack-stepfunctions-model/src/epoch_seconds.rs b/crates/rustack-stepfunctions-model/src/epoch_seconds.rs
new file mode 100644
index 00000000..c5f3db90
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/src/epoch_seconds.rs
@@ -0,0 +1,151 @@
+//! Generated JSON epoch-second adapters with exact decimal millisecond precision.
+
+use chrono::{DateTime, Utc};
+use serde::{
+    Deserialize, Deserializer, Serialize, Serializer, de::Error as DeError, ser::Error as SerError,
+};
+use serde_json::value::RawValue;
+
+const INVALID: &str = "invalid epoch-second timestamp";
+
+/// Serialize a required timestamp as a numeric JSON epoch value.
+///
+/// # Errors
+/// Rejects leap seconds, invalid numeric representation or serializer failures.
+pub fn serialize<S: Serializer>(value: &DateTime<Utc>, serializer: S) -> Result<S::Ok, S::Error> {
+    if value.timestamp_subsec_nanos() >= 1_000_000_000 {
+        return Err(S::Error::custom(INVALID));
+    }
+    let nanos = i128::from(value.timestamp())
+        .checked_mul(1_000_000_000)
+        .and_then(|seconds| seconds.checked_add(i128::from(value.timestamp_subsec_nanos())))
+        .ok_or_else(|| S::Error::custom(INVALID))?;
+    let millis = nanos / 1_000_000;
+    let sign = if millis < 0 { "-" } else { "" };
+    let magnitude = millis.unsigned_abs();
+    let seconds = magnitude / 1000;
+    let fraction = magnitude % 1000;
+    let number = if fraction == 0 {
+        format!("{sign}{seconds}")
+    } else {
+        format!("{sign}{seconds}.{fraction:03}")
+    };
+    RawValue::from_string(number)
+        .map_err(|_| S::Error::custom(INVALID))?
+        .serialize(serializer)
+}
+
+/// Deserialize a required JSON number, truncating submillisecond precision.
+///
+/// # Errors
+/// Rejects nonnumeric, oversized, out-of-range or invalid epoch values.
+pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<DateTime<Utc>, D::Error> {
+    let value = Box::<RawValue>::deserialize(deserializer)?;
+    parse(value.get()).ok_or_else(|| D::Error::custom(INVALID))
+}
+
+fn parse(raw: &str) -> Option<DateTime<Utc>> {
+    if raw.len() > 128 {
+        return None;
+    }
+    let (negative, raw) = raw
+        .strip_prefix('-')
+        .map_or((false, raw), |rest| (true, rest));
+    let (mantissa, exponent) = match raw.split_once(['e', 'E']) {
+        Some((value, exponent)) => {
+            let (negative, digits) = exponent.strip_prefix('-').map_or_else(
+                || (false, exponent.strip_prefix('+').unwrap_or(exponent)),
+                |digits| (true, digits),
+            );
+            if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+                return None;
+            }
+            let magnitude = digits.bytes().fold(0_i32, |value, digit| {
+                value
+                    .saturating_mul(10)
+                    .saturating_add(i32::from(digit - b'0'))
+                    .min(1024)
+            });
+            (value, if negative { -magnitude } else { magnitude })
+        }
+        None => (raw, 0),
+    };
+    let (whole, fraction) = mantissa.split_once('.').unwrap_or((mantissa, ""));
+    if whole.is_empty()
+        || !whole
+            .bytes()
+            .chain(fraction.bytes())
+            .all(|byte| byte.is_ascii_digit())
+    {
+        return None;
+    }
+    let digits: Vec<_> = whole.bytes().chain(fraction.bytes()).collect();
+    if digits.iter().all(|digit| *digit == b'0') {
+        return DateTime::from_timestamp_millis(0);
+    }
+    let keep = i32::try_from(whole.len())
+        .ok()?
+        .checked_add(exponent)?
+        .checked_add(3)?;
+    if keep <= 0 {
+        return DateTime::from_timestamp_millis(0);
+    }
+    // Leading zeroes must not make a small representable exponent look huge.
+    let leading = digits.iter().take_while(|digit| **digit == b'0').count();
+    let significant = keep.checked_sub(i32::try_from(leading).ok()?)?;
+    if significant <= 0 {
+        return DateTime::from_timestamp_millis(0);
+    }
+    if significant > 19 {
+        return None;
+    }
+    let mut millis = 0_i128;
+    let count = usize::try_from(significant).ok()?;
+    for offset in 0..count {
+        let digit = digits
+            .get(leading.checked_add(offset)?)
+            .copied()
+            .unwrap_or(b'0');
+        millis = millis
+            .checked_mul(10)?
+            .checked_add(i128::from(digit.checked_sub(b'0')?))?;
+    }
+    let signed = if negative {
+        millis.checked_neg()?
+    } else {
+        millis
+    };
+    DateTime::from_timestamp_millis(i64::try_from(signed).ok()?)
+}
+
+/// Optional JSON timestamp adapter; missing members also need serde default.
+pub mod option {
+    use std::borrow::Borrow;
+
+    use super::{DateTime, DeError, Deserialize, Deserializer, INVALID, RawValue, Serializer, Utc};
+
+    /// Serialize a timestamp or JSON null.
+    ///
+    /// # Errors
+    /// Returns the required adapter's validation/serialization errors.
+    pub fn serialize<S: Serializer, V: Borrow<Option<DateTime<Utc>>>>(
+        value: V,
+        serializer: S,
+    ) -> Result<S::Ok, S::Error> {
+        match value.borrow() {
+            Some(value) => super::serialize(value, serializer),
+            None => serializer.serialize_none(),
+        }
+    }
+    /// Deserialize a timestamp or JSON null.
+    ///
+    /// # Errors
+    /// Rejects invalid nonnull values with the required adapter's rules.
+    pub fn deserialize<'de, D: Deserializer<'de>>(
+        deserializer: D,
+    ) -> Result<Option<DateTime<Utc>>, D::Error> {
+        Option::<Box<RawValue>>::deserialize(deserializer)?
+            .map(|value| super::parse(value.get()).ok_or_else(|| D::Error::custom(INVALID)))
+            .transpose()
+    }
+}
diff --git a/crates/rustack-stepfunctions-model/src/error.rs b/crates/rustack-stepfunctions-model/src/error.rs
new file mode 100644
index 00000000..8e6c42ab
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/src/error.rs
@@ -0,0 +1,355 @@
+//! Auto-generated from AWS Step Functions Smithy model. DO NOT EDIT.
+//!
+//! Step Functions errors use JSON format with a `__type` field containing the
+//! short error type name (e.g., `ResourceNotFoundException`).
+
+use std::fmt;
+
+/// Well-known Step Functions error codes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
+#[non_exhaustive]
+pub enum StepFunctionsErrorCode {
+    /// `AccessDeniedException` error.
+    AccessDeniedException,
+    /// `ActivityAlreadyExists` error.
+    ActivityAlreadyExists,
+    /// `ActivityDoesNotExist` error.
+    ActivityDoesNotExist,
+    /// `ActivityLimitExceeded` error.
+    ActivityLimitExceeded,
+    /// `ActivityWorkerLimitExceeded` error.
+    ActivityWorkerLimitExceeded,
+    /// `ConflictException` error.
+    ConflictException,
+    /// `ExecutionAlreadyExists` error.
+    ExecutionAlreadyExists,
+    /// `ExecutionDoesNotExist` error.
+    ExecutionDoesNotExist,
+    /// `ExecutionLimitExceeded` error.
+    ExecutionLimitExceeded,
+    /// `ExecutionNotRedrivable` error.
+    ExecutionNotRedrivable,
+    /// `InternalFailure` error.
+    InternalFailure,
+    /// `InvalidArn` error.
+    InvalidArn,
+    /// `InvalidDefinition` error.
+    InvalidDefinition,
+    /// `InvalidEncryptionConfiguration` error.
+    InvalidEncryptionConfiguration,
+    /// `InvalidExecutionInput` error.
+    InvalidExecutionInput,
+    /// `InvalidLoggingConfiguration` error.
+    InvalidLoggingConfiguration,
+    /// `InvalidName` error.
+    InvalidName,
+    /// `InvalidOutput` error.
+    InvalidOutput,
+    /// `InvalidToken` error.
+    InvalidToken,
+    /// `InvalidTracingConfiguration` error.
+    InvalidTracingConfiguration,
+    /// `KmsAccessDeniedException` error.
+    KmsAccessDeniedException,
+    /// `KmsInvalidStateException` error.
+    KmsInvalidStateException,
+    /// `KmsThrottlingException` error.
+    KmsThrottlingException,
+    /// `MissingRequiredParameter` error.
+    MissingRequiredParameter,
+    /// `RequestTimeoutException` error.
+    RequestTimeoutException,
+    /// `ResourceNotFound` error.
+    ResourceNotFound,
+    /// `ServiceQuotaExceededException` error.
+    ServiceQuotaExceededException,
+    /// `ServiceUnavailable` error.
+    ServiceUnavailable,
+    /// `StateMachineAlreadyExists` error.
+    StateMachineAlreadyExists,
+    /// `StateMachineDeleting` error.
+    StateMachineDeleting,
+    /// `StateMachineDoesNotExist` error.
+    StateMachineDoesNotExist,
+    /// `StateMachineLimitExceeded` error.
+    StateMachineLimitExceeded,
+    /// `StateMachineTypeNotSupported` error.
+    StateMachineTypeNotSupported,
+    /// `TaskDoesNotExist` error.
+    TaskDoesNotExist,
+    /// `TaskTimedOut` error.
+    TaskTimedOut,
+    /// `ThrottlingException` error.
+    ThrottlingException,
+    /// `TooManyTags` error.
+    TooManyTags,
+    /// `UnknownOperationException` error.
+    UnknownOperationException,
+    /// `UnsupportedOperation` error.
+    UnsupportedOperation,
+    /// `ValidationException` error.
+    #[default]
+    ValidationException,
+}
+
+impl StepFunctionsErrorCode {
+    /// Returns the short error type string for the JSON `__type` field.
+    #[must_use]
+    pub fn error_type(&self) -> &'static str {
+        self.as_str()
+    }
+
+    /// Returns the short error code string.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::AccessDeniedException => "AccessDeniedException",
+            Self::ActivityAlreadyExists => "ActivityAlreadyExists",
+            Self::ActivityDoesNotExist => "ActivityDoesNotExist",
+            Self::ActivityLimitExceeded => "ActivityLimitExceeded",
+            Self::ActivityWorkerLimitExceeded => "ActivityWorkerLimitExceeded",
+            Self::ConflictException => "ConflictException",
+            Self::ExecutionAlreadyExists => "ExecutionAlreadyExists",
+            Self::ExecutionDoesNotExist => "ExecutionDoesNotExist",
+            Self::ExecutionLimitExceeded => "ExecutionLimitExceeded",
+            Self::ExecutionNotRedrivable => "ExecutionNotRedrivable",
+            Self::InternalFailure => "InternalFailure",
+            Self::InvalidArn => "InvalidArn",
+            Self::InvalidDefinition => "InvalidDefinition",
+            Self::InvalidEncryptionConfiguration => "InvalidEncryptionConfiguration",
+            Self::InvalidExecutionInput => "InvalidExecutionInput",
+            Self::InvalidLoggingConfiguration => "InvalidLoggingConfiguration",
+            Self::InvalidName => "InvalidName",
+            Self::InvalidOutput => "InvalidOutput",
+            Self::InvalidToken => "InvalidToken",
+            Self::InvalidTracingConfiguration => "InvalidTracingConfiguration",
+            Self::KmsAccessDeniedException => "KmsAccessDeniedException",
+            Self::KmsInvalidStateException => "KmsInvalidStateException",
+            Self::KmsThrottlingException => "KmsThrottlingException",
+            Self::MissingRequiredParameter => "MissingRequiredParameter",
+            Self::RequestTimeoutException => "RequestTimeoutException",
+            Self::ResourceNotFound => "ResourceNotFound",
+            Self::ServiceQuotaExceededException => "ServiceQuotaExceededException",
+            Self::ServiceUnavailable => "ServiceUnavailable",
+            Self::StateMachineAlreadyExists => "StateMachineAlreadyExists",
+            Self::StateMachineDeleting => "StateMachineDeleting",
+            Self::StateMachineDoesNotExist => "StateMachineDoesNotExist",
+            Self::StateMachineLimitExceeded => "StateMachineLimitExceeded",
+            Self::StateMachineTypeNotSupported => "StateMachineTypeNotSupported",
+            Self::TaskDoesNotExist => "TaskDoesNotExist",
+            Self::TaskTimedOut => "TaskTimedOut",
+            Self::ThrottlingException => "ThrottlingException",
+            Self::TooManyTags => "TooManyTags",
+            Self::UnknownOperationException => "UnknownOperationException",
+            Self::UnsupportedOperation => "UnsupportedOperation",
+            Self::ValidationException => "ValidationException",
+        }
+    }
+
+    /// Returns the default HTTP status code for this error.
+    #[must_use]
+    pub fn default_status_code(&self) -> http::StatusCode {
+        match self {
+            Self::ActivityAlreadyExists
+            | Self::ActivityDoesNotExist
+            | Self::ActivityLimitExceeded
+            | Self::ActivityWorkerLimitExceeded
+            | Self::ExecutionAlreadyExists
+            | Self::ExecutionDoesNotExist
+            | Self::ExecutionLimitExceeded
+            | Self::ExecutionNotRedrivable
+            | Self::InvalidArn
+            | Self::InvalidDefinition
+            | Self::InvalidEncryptionConfiguration
+            | Self::InvalidExecutionInput
+            | Self::InvalidLoggingConfiguration
+            | Self::InvalidName
+            | Self::InvalidOutput
+            | Self::InvalidToken
+            | Self::InvalidTracingConfiguration
+            | Self::KmsAccessDeniedException
+            | Self::KmsInvalidStateException
+            | Self::KmsThrottlingException
+            | Self::MissingRequiredParameter
+            | Self::StateMachineAlreadyExists
+            | Self::StateMachineDeleting
+            | Self::StateMachineDoesNotExist
+            | Self::StateMachineLimitExceeded
+            | Self::StateMachineTypeNotSupported
+            | Self::TaskDoesNotExist
+            | Self::TaskTimedOut
+            | Self::ThrottlingException
+            | Self::TooManyTags
+            | Self::UnsupportedOperation
+            | Self::ValidationException => http::StatusCode::BAD_REQUEST,
+            Self::ServiceQuotaExceededException => http::StatusCode::PAYMENT_REQUIRED,
+            Self::AccessDeniedException => http::StatusCode::FORBIDDEN,
+            Self::ResourceNotFound | Self::UnknownOperationException => http::StatusCode::NOT_FOUND,
+            Self::RequestTimeoutException => http::StatusCode::REQUEST_TIMEOUT,
+            Self::ConflictException => http::StatusCode::CONFLICT,
+            Self::InternalFailure => http::StatusCode::INTERNAL_SERVER_ERROR,
+            Self::ServiceUnavailable => http::StatusCode::SERVICE_UNAVAILABLE,
+        }
+    }
+}
+
+impl fmt::Display for StepFunctionsErrorCode {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl StepFunctionsErrorCode {
+    /// Default bounded protocol message.
+    #[must_use]
+    pub fn default_message(&self) -> &'static str {
+        match self {
+            Self::AccessDeniedException => "Request scope is not authorized",
+            Self::ActivityAlreadyExists => "ActivityAlreadyExists",
+            Self::ActivityDoesNotExist => "ActivityDoesNotExist",
+            Self::ActivityLimitExceeded => "ActivityLimitExceeded",
+            Self::ActivityWorkerLimitExceeded => "ActivityWorkerLimitExceeded",
+            Self::ConflictException => "ConflictException",
+            Self::ExecutionAlreadyExists => "ExecutionAlreadyExists",
+            Self::ExecutionDoesNotExist => "ExecutionDoesNotExist",
+            Self::ExecutionLimitExceeded => "ExecutionLimitExceeded",
+            Self::ExecutionNotRedrivable => "ExecutionNotRedrivable",
+            Self::InternalFailure => "Request processing failed",
+            Self::InvalidArn => "InvalidArn",
+            Self::InvalidDefinition => "InvalidDefinition",
+            Self::InvalidEncryptionConfiguration => "InvalidEncryptionConfiguration",
+            Self::InvalidExecutionInput => "InvalidExecutionInput",
+            Self::InvalidLoggingConfiguration => "InvalidLoggingConfiguration",
+            Self::InvalidName => "InvalidName",
+            Self::InvalidOutput => "InvalidOutput",
+            Self::InvalidToken => "InvalidToken",
+            Self::InvalidTracingConfiguration => "InvalidTracingConfiguration",
+            Self::KmsAccessDeniedException => "KmsAccessDeniedException",
+            Self::KmsInvalidStateException => "KmsInvalidStateException",
+            Self::KmsThrottlingException => "KmsThrottlingException",
+            Self::MissingRequiredParameter => "MissingRequiredParameter",
+            Self::RequestTimeoutException => "Request deadline exceeded",
+            Self::ResourceNotFound => "ResourceNotFound",
+            Self::ServiceQuotaExceededException => "ServiceQuotaExceededException",
+            Self::ServiceUnavailable => "Workflow API unavailable",
+            Self::StateMachineAlreadyExists => "StateMachineAlreadyExists",
+            Self::StateMachineDeleting => "StateMachineDeleting",
+            Self::StateMachineDoesNotExist => "StateMachineDoesNotExist",
+            Self::StateMachineLimitExceeded => "StateMachineLimitExceeded",
+            Self::StateMachineTypeNotSupported => "StateMachineTypeNotSupported",
+            Self::TaskDoesNotExist => "TaskDoesNotExist",
+            Self::TaskTimedOut => "TaskTimedOut",
+            Self::ThrottlingException => "Workflow API admission exhausted",
+            Self::TooManyTags => "TooManyTags",
+            Self::UnknownOperationException => "Unknown Step Functions operation",
+            Self::UnsupportedOperation => {
+                "Operation is outside the supported Step Functions profile"
+            }
+            Self::ValidationException => "ValidationException",
+        }
+    }
+}
+/// An Step Functions error response.
+#[non_exhaustive]
+pub struct StepFunctionsError {
+    /// The error code.
+    pub code: StepFunctionsErrorCode,
+    /// A human-readable error message.
+    pub message: String,
+    /// The HTTP status code.
+    pub status_code: http::StatusCode,
+    /// The underlying source error, if any.
+    pub source: Option<Box<dyn std::error::Error + Send + Sync>>,
+}
+
+impl fmt::Debug for StepFunctionsError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("StepFunctionsError(<redacted>)")
+    }
+}
+impl fmt::Display for StepFunctionsError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("StepFunctionsError(<redacted>)")
+    }
+}
+
+impl std::error::Error for StepFunctionsError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        self.source
+            .as_ref()
+            .map(|e| e.as_ref() as &(dyn std::error::Error + 'static))
+    }
+}
+
+impl StepFunctionsError {
+    /// Create a new `StepFunctionsError` from an error code.
+    #[must_use]
+    pub fn new(code: StepFunctionsErrorCode) -> Self {
+        Self {
+            status_code: code.default_status_code(),
+            message: code.default_message().to_owned(),
+            code,
+            source: None,
+        }
+    }
+
+    /// Create a new `StepFunctionsError` with a custom message.
+    #[must_use]
+    pub fn with_message(code: StepFunctionsErrorCode, message: impl Into<String>) -> Self {
+        Self {
+            status_code: code.default_status_code(),
+            message: message.into(),
+            code,
+            source: None,
+        }
+    }
+
+    /// Returns the `__type` string for the JSON error response.
+    #[must_use]
+    pub fn error_type(&self) -> &'static str {
+        self.code.error_type()
+    }
+
+    /// Validation error.
+    #[must_use]
+    pub fn validation(message: impl Into<String>) -> Self {
+        Self::with_message(StepFunctionsErrorCode::ValidationException, message)
+    }
+
+    /// Internal error.
+    #[must_use]
+    pub fn internal_error(message: impl Into<String>) -> Self {
+        Self::with_message(StepFunctionsErrorCode::InternalFailure, message)
+    }
+
+    /// Not implemented.
+    #[must_use]
+    pub fn not_implemented(operation: &str) -> Self {
+        Self::with_message(
+            StepFunctionsErrorCode::InternalFailure,
+            format!("Operation {operation} is not yet implemented"),
+        )
+    }
+}
+
+/// Create an `StepFunctionsError` from an error code.
+///
+/// # Examples
+///
+/// ```
+/// use rustack_stepfunctions_model::{stepfunctions_error, StepFunctionsErrorCode};
+/// let err = stepfunctions_error!(ValidationException);
+/// assert_eq!(err.code, StepFunctionsErrorCode::ValidationException);
+/// ```
+#[macro_export]
+macro_rules! stepfunctions_error {
+    ($code:ident) => {
+        $crate::error::StepFunctionsError::new($crate::error::StepFunctionsErrorCode::$code)
+    };
+    ($code:ident, $msg:expr) => {
+        $crate::error::StepFunctionsError::with_message(
+            $crate::error::StepFunctionsErrorCode::$code,
+            $msg,
+        )
+    };
+}
diff --git a/crates/rustack-stepfunctions-model/src/input.rs b/crates/rustack-stepfunctions-model/src/input.rs
new file mode 100644
index 00000000..63760247
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/src/input.rs
@@ -0,0 +1,852 @@
+//! Auto-generated from AWS Step Functions Smithy model. DO NOT EDIT.
+
+use serde::{Deserialize, Serialize};
+
+use crate::types::{
+    EncryptionConfiguration, ExecutionRedriveFilter, ExecutionStatus, IncludedData,
+    InspectionLevel, LoggingConfiguration, MockInput, RoutingConfigurationListItem,
+    StateMachineType, Tag, TestStateConfiguration, TracingConfiguration,
+    ValidateStateMachineDefinitionSeverity,
+};
+
+/// Step Functions `CreateActivityInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct CreateActivityInput {
+    /// The `encryptionConfiguration` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub encryption_configuration: Option<EncryptionConfiguration>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `tags` wire member.
+    #[serde(default)]
+    pub tags: Vec<Tag>,
+}
+
+impl std::fmt::Debug for CreateActivityInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CreateActivityInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `CreateStateMachineAliasInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct CreateStateMachineAliasInput {
+    /// The `description` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `routingConfiguration` wire member.
+    pub routing_configuration: Vec<RoutingConfigurationListItem>,
+}
+
+impl std::fmt::Debug for CreateStateMachineAliasInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CreateStateMachineAliasInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `CreateStateMachineInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct CreateStateMachineInput {
+    /// The `definition` wire member.
+    pub definition: String,
+    /// The `encryptionConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub encryption_configuration: Option<EncryptionConfiguration>,
+    /// The `loggingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub logging_configuration: Option<LoggingConfiguration>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `publish` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub publish: Option<bool>,
+    /// The `roleArn` wire member.
+    pub role_arn: String,
+    /// The `tags` wire member.
+    #[builder(default)]
+    #[serde(default)]
+    pub tags: Vec<Tag>,
+    /// The `tracingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tracing_configuration: Option<TracingConfiguration>,
+    /// The `type` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#type: Option<StateMachineType>,
+    /// The `versionDescription` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub version_description: Option<String>,
+}
+
+impl std::fmt::Debug for CreateStateMachineInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CreateStateMachineInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteActivityInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteActivityInput {
+    /// The `activityArn` wire member.
+    pub activity_arn: String,
+}
+
+impl std::fmt::Debug for DeleteActivityInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteActivityInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteStateMachineAliasInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteStateMachineAliasInput {
+    /// The `stateMachineAliasArn` wire member.
+    pub state_machine_alias_arn: String,
+}
+
+impl std::fmt::Debug for DeleteStateMachineAliasInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteStateMachineAliasInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteStateMachineInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteStateMachineInput {
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+}
+
+impl std::fmt::Debug for DeleteStateMachineInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteStateMachineInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteStateMachineVersionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteStateMachineVersionInput {
+    /// The `stateMachineVersionArn` wire member.
+    pub state_machine_version_arn: String,
+}
+
+impl std::fmt::Debug for DeleteStateMachineVersionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteStateMachineVersionInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeActivityInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DescribeActivityInput {
+    /// The `activityArn` wire member.
+    pub activity_arn: String,
+}
+
+impl std::fmt::Debug for DescribeActivityInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeActivityInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeExecutionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DescribeExecutionInput {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `includedData` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_data: Option<IncludedData>,
+}
+
+impl std::fmt::Debug for DescribeExecutionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeExecutionInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeMapRunInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DescribeMapRunInput {
+    /// The `mapRunArn` wire member.
+    pub map_run_arn: String,
+}
+
+impl std::fmt::Debug for DescribeMapRunInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeMapRunInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeStateMachineAliasInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DescribeStateMachineAliasInput {
+    /// The `stateMachineAliasArn` wire member.
+    pub state_machine_alias_arn: String,
+}
+
+impl std::fmt::Debug for DescribeStateMachineAliasInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeStateMachineAliasInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeStateMachineForExecutionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DescribeStateMachineForExecutionInput {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `includedData` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_data: Option<IncludedData>,
+}
+
+impl std::fmt::Debug for DescribeStateMachineForExecutionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeStateMachineForExecutionInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeStateMachineInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DescribeStateMachineInput {
+    /// The `includedData` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_data: Option<IncludedData>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+}
+
+impl std::fmt::Debug for DescribeStateMachineInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeStateMachineInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `GetActivityTaskInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct GetActivityTaskInput {
+    /// The `activityArn` wire member.
+    pub activity_arn: String,
+    /// The `workerName` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub worker_name: Option<String>,
+}
+
+impl std::fmt::Debug for GetActivityTaskInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("GetActivityTaskInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `GetExecutionHistoryInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct GetExecutionHistoryInput {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `includeExecutionData` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_execution_data: Option<bool>,
+    /// The `maxResults` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+    /// The `reverseOrder` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reverse_order: Option<bool>,
+}
+
+impl std::fmt::Debug for GetExecutionHistoryInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("GetExecutionHistoryInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListActivitiesInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListActivitiesInput {
+    /// The `maxResults` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+impl std::fmt::Debug for ListActivitiesInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListActivitiesInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListExecutionsInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct ListExecutionsInput {
+    /// The `mapRunArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_arn: Option<String>,
+    /// The `maxResults` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `nextToken` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+    /// The `redriveFilter` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_filter: Option<ExecutionRedriveFilter>,
+    /// The `stateMachineArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_arn: Option<String>,
+    /// The `statusFilter` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_filter: Option<ExecutionStatus>,
+}
+
+impl std::fmt::Debug for ListExecutionsInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListExecutionsInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListMapRunsInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListMapRunsInput {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `maxResults` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+impl std::fmt::Debug for ListMapRunsInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListMapRunsInput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListStateMachineAliasesInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListStateMachineAliasesInput {
+    /// The `maxResults` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+}
+
+impl std::fmt::Debug for ListStateMachineAliasesInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListStateMachineAliasesInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListStateMachineVersionsInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListStateMachineVersionsInput {
+    /// The `maxResults` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+}
+
+impl std::fmt::Debug for ListStateMachineVersionsInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListStateMachineVersionsInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListStateMachinesInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListStateMachinesInput {
+    /// The `maxResults` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+impl std::fmt::Debug for ListStateMachinesInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListStateMachinesInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListTagsForResourceInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListTagsForResourceInput {
+    /// The `resourceArn` wire member.
+    pub resource_arn: String,
+}
+
+impl std::fmt::Debug for ListTagsForResourceInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListTagsForResourceInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `PublishStateMachineVersionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct PublishStateMachineVersionInput {
+    /// The `description` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// The `revisionId` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revision_id: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+}
+
+impl std::fmt::Debug for PublishStateMachineVersionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("PublishStateMachineVersionInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `RedriveExecutionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct RedriveExecutionInput {
+    /// The `clientToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_token: Option<String>,
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+}
+
+impl std::fmt::Debug for RedriveExecutionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RedriveExecutionInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `SendTaskFailureInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct SendTaskFailureInput {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `taskToken` wire member.
+    pub task_token: String,
+}
+
+impl std::fmt::Debug for SendTaskFailureInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SendTaskFailureInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `SendTaskHeartbeatInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct SendTaskHeartbeatInput {
+    /// The `taskToken` wire member.
+    pub task_token: String,
+}
+
+impl std::fmt::Debug for SendTaskHeartbeatInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SendTaskHeartbeatInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `SendTaskSuccessInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct SendTaskSuccessInput {
+    /// The `output` wire member.
+    pub output: String,
+    /// The `taskToken` wire member.
+    pub task_token: String,
+}
+
+impl std::fmt::Debug for SendTaskSuccessInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SendTaskSuccessInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StartExecutionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StartExecutionInput {
+    /// The `input` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `name` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `traceHeader` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trace_header: Option<String>,
+}
+
+impl std::fmt::Debug for StartExecutionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StartExecutionInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StartSyncExecutionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StartSyncExecutionInput {
+    /// The `includedData` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_data: Option<IncludedData>,
+    /// The `input` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `name` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `traceHeader` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trace_header: Option<String>,
+}
+
+impl std::fmt::Debug for StartSyncExecutionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StartSyncExecutionInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StopExecutionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StopExecutionInput {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+}
+
+impl std::fmt::Debug for StopExecutionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StopExecutionInput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `TagResourceInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TagResourceInput {
+    /// The `resourceArn` wire member.
+    pub resource_arn: String,
+    /// The `tags` wire member.
+    pub tags: Vec<Tag>,
+}
+
+impl std::fmt::Debug for TagResourceInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TagResourceInput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `TestStateInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct TestStateInput {
+    /// The `context` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub context: Option<String>,
+    /// The `definition` wire member.
+    pub definition: String,
+    /// The `input` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `inspectionLevel` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub inspection_level: Option<InspectionLevel>,
+    /// The `mock` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mock: Option<MockInput>,
+    /// The `revealSecrets` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reveal_secrets: Option<bool>,
+    /// The `roleArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub role_arn: Option<String>,
+    /// The `stateConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_configuration: Option<TestStateConfiguration>,
+    /// The `stateName` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_name: Option<String>,
+    /// The `variables` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub variables: Option<String>,
+}
+
+impl std::fmt::Debug for TestStateInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TestStateInput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `UntagResourceInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct UntagResourceInput {
+    /// The `resourceArn` wire member.
+    pub resource_arn: String,
+    /// The `tagKeys` wire member.
+    pub tag_keys: Vec<String>,
+}
+
+impl std::fmt::Debug for UntagResourceInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UntagResourceInput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `UpdateMapRunInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct UpdateMapRunInput {
+    /// The `mapRunArn` wire member.
+    pub map_run_arn: String,
+    /// The `maxConcurrency` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_concurrency: Option<i32>,
+    /// The `toleratedFailureCount` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tolerated_failure_count: Option<i64>,
+    /// The `toleratedFailurePercentage` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tolerated_failure_percentage: Option<f32>,
+}
+
+impl std::fmt::Debug for UpdateMapRunInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UpdateMapRunInput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `UpdateStateMachineAliasInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct UpdateStateMachineAliasInput {
+    /// The `description` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// The `routingConfiguration` wire member.
+    #[serde(default)]
+    pub routing_configuration: Vec<RoutingConfigurationListItem>,
+    /// The `stateMachineAliasArn` wire member.
+    pub state_machine_alias_arn: String,
+}
+
+impl std::fmt::Debug for UpdateStateMachineAliasInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UpdateStateMachineAliasInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `UpdateStateMachineInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct UpdateStateMachineInput {
+    /// The `definition` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub definition: Option<String>,
+    /// The `encryptionConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub encryption_configuration: Option<EncryptionConfiguration>,
+    /// The `loggingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub logging_configuration: Option<LoggingConfiguration>,
+    /// The `publish` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub publish: Option<bool>,
+    /// The `roleArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub role_arn: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `tracingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tracing_configuration: Option<TracingConfiguration>,
+    /// The `versionDescription` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub version_description: Option<String>,
+}
+
+impl std::fmt::Debug for UpdateStateMachineInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UpdateStateMachineInput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ValidateStateMachineDefinitionInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ValidateStateMachineDefinitionInput {
+    /// The `definition` wire member.
+    pub definition: String,
+    /// The `maxResults` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    /// The `severity` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub severity: Option<ValidateStateMachineDefinitionSeverity>,
+    /// The `type` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub r#type: Option<StateMachineType>,
+}
+
+impl std::fmt::Debug for ValidateStateMachineDefinitionInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ValidateStateMachineDefinitionInput")
+            .finish_non_exhaustive()
+    }
+}
diff --git a/crates/rustack-stepfunctions-model/src/lib.rs b/crates/rustack-stepfunctions-model/src/lib.rs
new file mode 100644
index 00000000..782b711f
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/src/lib.rs
@@ -0,0 +1,18 @@
+//! Auto-generated from AWS Step Functions Smithy model. DO NOT EDIT.
+#![forbid(unsafe_code)]
+pub(crate) mod epoch_seconds;
+
+pub mod error;
+pub mod input;
+pub mod operations;
+pub mod output;
+pub mod types;
+/// JSON protocol target prefix.
+pub const TARGET_PREFIX: &str = "AWSStepFunctions";
+/// Whether the service config requests AWS Query-compatible errors.
+pub const AWS_QUERY_COMPATIBLE: bool = false;
+
+pub use error::{StepFunctionsError, StepFunctionsErrorCode};
+pub use operations::StepFunctionsOperation;
+
+// Generated: 37 operations, 16 enums, 63 shared structs, 37 input structs, 37 output structs
diff --git a/crates/rustack-stepfunctions-model/src/operations.rs b/crates/rustack-stepfunctions-model/src/operations.rs
new file mode 100644
index 00000000..37525787
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/src/operations.rs
@@ -0,0 +1,177 @@
+//! Auto-generated from AWS Step Functions Smithy model. DO NOT EDIT.
+
+/// All supported `StepFunctionsOperation` values.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum StepFunctionsOperation {
+    /// The `CreateActivity` operation.
+    CreateActivity,
+    /// The `CreateStateMachine` operation.
+    CreateStateMachine,
+    /// The `CreateStateMachineAlias` operation.
+    CreateStateMachineAlias,
+    /// The `DeleteActivity` operation.
+    DeleteActivity,
+    /// The `DeleteStateMachine` operation.
+    DeleteStateMachine,
+    /// The `DeleteStateMachineAlias` operation.
+    DeleteStateMachineAlias,
+    /// The `DeleteStateMachineVersion` operation.
+    DeleteStateMachineVersion,
+    /// The `DescribeActivity` operation.
+    DescribeActivity,
+    /// The `DescribeExecution` operation.
+    DescribeExecution,
+    /// The `DescribeMapRun` operation.
+    DescribeMapRun,
+    /// The `DescribeStateMachine` operation.
+    DescribeStateMachine,
+    /// The `DescribeStateMachineAlias` operation.
+    DescribeStateMachineAlias,
+    /// The `DescribeStateMachineForExecution` operation.
+    DescribeStateMachineForExecution,
+    /// The `GetActivityTask` operation.
+    GetActivityTask,
+    /// The `GetExecutionHistory` operation.
+    GetExecutionHistory,
+    /// The `ListActivities` operation.
+    ListActivities,
+    /// The `ListExecutions` operation.
+    ListExecutions,
+    /// The `ListMapRuns` operation.
+    ListMapRuns,
+    /// The `ListStateMachineAliases` operation.
+    ListStateMachineAliases,
+    /// The `ListStateMachines` operation.
+    ListStateMachines,
+    /// The `ListStateMachineVersions` operation.
+    ListStateMachineVersions,
+    /// The `ListTagsForResource` operation.
+    ListTagsForResource,
+    /// The `PublishStateMachineVersion` operation.
+    PublishStateMachineVersion,
+    /// The `RedriveExecution` operation.
+    RedriveExecution,
+    /// The `SendTaskFailure` operation.
+    SendTaskFailure,
+    /// The `SendTaskHeartbeat` operation.
+    SendTaskHeartbeat,
+    /// The `SendTaskSuccess` operation.
+    SendTaskSuccess,
+    /// The `StartExecution` operation.
+    StartExecution,
+    /// The `StartSyncExecution` operation.
+    StartSyncExecution,
+    /// The `StopExecution` operation.
+    StopExecution,
+    /// The `TagResource` operation.
+    TagResource,
+    /// The `TestState` operation.
+    TestState,
+    /// The `UntagResource` operation.
+    UntagResource,
+    /// The `UpdateMapRun` operation.
+    UpdateMapRun,
+    /// The `UpdateStateMachine` operation.
+    UpdateStateMachine,
+    /// The `UpdateStateMachineAlias` operation.
+    UpdateStateMachineAlias,
+    /// The `ValidateStateMachineDefinition` operation.
+    ValidateStateMachineDefinition,
+}
+
+impl StepFunctionsOperation {
+    /// Returns the AWS operation name string.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::CreateActivity => "CreateActivity",
+            Self::CreateStateMachine => "CreateStateMachine",
+            Self::CreateStateMachineAlias => "CreateStateMachineAlias",
+            Self::DeleteActivity => "DeleteActivity",
+            Self::DeleteStateMachine => "DeleteStateMachine",
+            Self::DeleteStateMachineAlias => "DeleteStateMachineAlias",
+            Self::DeleteStateMachineVersion => "DeleteStateMachineVersion",
+            Self::DescribeActivity => "DescribeActivity",
+            Self::DescribeExecution => "DescribeExecution",
+            Self::DescribeMapRun => "DescribeMapRun",
+            Self::DescribeStateMachine => "DescribeStateMachine",
+            Self::DescribeStateMachineAlias => "DescribeStateMachineAlias",
+            Self::DescribeStateMachineForExecution => "DescribeStateMachineForExecution",
+            Self::GetActivityTask => "GetActivityTask",
+            Self::GetExecutionHistory => "GetExecutionHistory",
+            Self::ListActivities => "ListActivities",
+            Self::ListExecutions => "ListExecutions",
+            Self::ListMapRuns => "ListMapRuns",
+            Self::ListStateMachineAliases => "ListStateMachineAliases",
+            Self::ListStateMachines => "ListStateMachines",
+            Self::ListStateMachineVersions => "ListStateMachineVersions",
+            Self::ListTagsForResource => "ListTagsForResource",
+            Self::PublishStateMachineVersion => "PublishStateMachineVersion",
+            Self::RedriveExecution => "RedriveExecution",
+            Self::SendTaskFailure => "SendTaskFailure",
+            Self::SendTaskHeartbeat => "SendTaskHeartbeat",
+            Self::SendTaskSuccess => "SendTaskSuccess",
+            Self::StartExecution => "StartExecution",
+            Self::StartSyncExecution => "StartSyncExecution",
+            Self::StopExecution => "StopExecution",
+            Self::TagResource => "TagResource",
+            Self::TestState => "TestState",
+            Self::UntagResource => "UntagResource",
+            Self::UpdateMapRun => "UpdateMapRun",
+            Self::UpdateStateMachine => "UpdateStateMachine",
+            Self::UpdateStateMachineAlias => "UpdateStateMachineAlias",
+            Self::ValidateStateMachineDefinition => "ValidateStateMachineDefinition",
+        }
+    }
+
+    /// Parse an operation name string into a `StepFunctionsOperation`.
+    #[must_use]
+    pub fn from_name(name: &str) -> Option<Self> {
+        match name {
+            "CreateActivity" => Some(Self::CreateActivity),
+            "CreateStateMachine" => Some(Self::CreateStateMachine),
+            "CreateStateMachineAlias" => Some(Self::CreateStateMachineAlias),
+            "DeleteActivity" => Some(Self::DeleteActivity),
+            "DeleteStateMachine" => Some(Self::DeleteStateMachine),
+            "DeleteStateMachineAlias" => Some(Self::DeleteStateMachineAlias),
+            "DeleteStateMachineVersion" => Some(Self::DeleteStateMachineVersion),
+            "DescribeActivity" => Some(Self::DescribeActivity),
+            "DescribeExecution" => Some(Self::DescribeExecution),
+            "DescribeMapRun" => Some(Self::DescribeMapRun),
+            "DescribeStateMachine" => Some(Self::DescribeStateMachine),
+            "DescribeStateMachineAlias" => Some(Self::DescribeStateMachineAlias),
+            "DescribeStateMachineForExecution" => Some(Self::DescribeStateMachineForExecution),
+            "GetActivityTask" => Some(Self::GetActivityTask),
+            "GetExecutionHistory" => Some(Self::GetExecutionHistory),
+            "ListActivities" => Some(Self::ListActivities),
+            "ListExecutions" => Some(Self::ListExecutions),
+            "ListMapRuns" => Some(Self::ListMapRuns),
+            "ListStateMachineAliases" => Some(Self::ListStateMachineAliases),
+            "ListStateMachines" => Some(Self::ListStateMachines),
+            "ListStateMachineVersions" => Some(Self::ListStateMachineVersions),
+            "ListTagsForResource" => Some(Self::ListTagsForResource),
+            "PublishStateMachineVersion" => Some(Self::PublishStateMachineVersion),
+            "RedriveExecution" => Some(Self::RedriveExecution),
+            "SendTaskFailure" => Some(Self::SendTaskFailure),
+            "SendTaskHeartbeat" => Some(Self::SendTaskHeartbeat),
+            "SendTaskSuccess" => Some(Self::SendTaskSuccess),
+            "StartExecution" => Some(Self::StartExecution),
+            "StartSyncExecution" => Some(Self::StartSyncExecution),
+            "StopExecution" => Some(Self::StopExecution),
+            "TagResource" => Some(Self::TagResource),
+            "TestState" => Some(Self::TestState),
+            "UntagResource" => Some(Self::UntagResource),
+            "UpdateMapRun" => Some(Self::UpdateMapRun),
+            "UpdateStateMachine" => Some(Self::UpdateStateMachine),
+            "UpdateStateMachineAlias" => Some(Self::UpdateStateMachineAlias),
+            "ValidateStateMachineDefinition" => Some(Self::ValidateStateMachineDefinition),
+            _ => None,
+        }
+    }
+}
+
+impl std::fmt::Display for StepFunctionsOperation {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
diff --git a/crates/rustack-stepfunctions-model/src/output.rs b/crates/rustack-stepfunctions-model/src/output.rs
new file mode 100644
index 00000000..e24d5dbe
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/src/output.rs
@@ -0,0 +1,926 @@
+//! Auto-generated from AWS Step Functions Smithy model. DO NOT EDIT.
+
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+
+use crate::types::{
+    ActivityListItem, BillingDetails, CloudWatchEventsExecutionDataDetails,
+    EncryptionConfiguration, ExecutionListItem, ExecutionRedriveStatus, ExecutionStatus,
+    HistoryEvent, InspectionData, LoggingConfiguration, MapRunExecutionCounts, MapRunItemCounts,
+    MapRunListItem, MapRunStatus, RoutingConfigurationListItem, StateMachineAliasListItem,
+    StateMachineListItem, StateMachineStatus, StateMachineType, StateMachineVersionListItem,
+    SyncExecutionStatus, Tag, TestExecutionStatus, TracingConfiguration,
+    ValidateStateMachineDefinitionDiagnostic, ValidateStateMachineDefinitionResultCode,
+};
+
+/// Step Functions `CreateActivityOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct CreateActivityOutput {
+    /// The `activityArn` wire member.
+    pub activity_arn: String,
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+}
+
+impl std::fmt::Debug for CreateActivityOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CreateActivityOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `CreateStateMachineAliasOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct CreateStateMachineAliasOutput {
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineAliasArn` wire member.
+    pub state_machine_alias_arn: String,
+}
+
+impl std::fmt::Debug for CreateStateMachineAliasOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CreateStateMachineAliasOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `CreateStateMachineOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct CreateStateMachineOutput {
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `stateMachineVersionArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_version_arn: Option<String>,
+}
+
+impl std::fmt::Debug for CreateStateMachineOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CreateStateMachineOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteActivityOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteActivityOutput {}
+
+impl std::fmt::Debug for DeleteActivityOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteActivityOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteStateMachineAliasOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteStateMachineAliasOutput {}
+
+impl std::fmt::Debug for DeleteStateMachineAliasOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteStateMachineAliasOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteStateMachineOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteStateMachineOutput {}
+
+impl std::fmt::Debug for DeleteStateMachineOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteStateMachineOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DeleteStateMachineVersionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DeleteStateMachineVersionOutput {}
+
+impl std::fmt::Debug for DeleteStateMachineVersionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DeleteStateMachineVersionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeActivityOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct DescribeActivityOutput {
+    /// The `activityArn` wire member.
+    pub activity_arn: String,
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `encryptionConfiguration` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub encryption_configuration: Option<EncryptionConfiguration>,
+    /// The `name` wire member.
+    pub name: String,
+}
+
+impl std::fmt::Debug for DescribeActivityOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeActivityOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeExecutionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct DescribeExecutionOutput {
+    /// The `cause` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `input` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `inputDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_details: Option<CloudWatchEventsExecutionDataDetails>,
+    /// The `mapRunArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_arn: Option<String>,
+    /// The `name` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// The `output` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<CloudWatchEventsExecutionDataDetails>,
+    /// The `redriveCount` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_count: Option<i32>,
+    /// The `redriveDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_date: Option<chrono::DateTime<chrono::Utc>>,
+    /// The `redriveStatus` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_status: Option<ExecutionRedriveStatus>,
+    /// The `redriveStatusReason` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_status_reason: Option<String>,
+    /// The `startDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub start_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineAliasArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_alias_arn: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `stateMachineVersionArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_version_arn: Option<String>,
+    /// The `status` wire member.
+    pub status: ExecutionStatus,
+    /// The `stopDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stop_date: Option<chrono::DateTime<chrono::Utc>>,
+    /// The `traceHeader` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trace_header: Option<String>,
+}
+
+impl std::fmt::Debug for DescribeExecutionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeExecutionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeMapRunOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct DescribeMapRunOutput {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `executionCounts` wire member.
+    pub execution_counts: MapRunExecutionCounts,
+    /// The `itemCounts` wire member.
+    pub item_counts: MapRunItemCounts,
+    /// The `mapRunArn` wire member.
+    pub map_run_arn: String,
+    /// The `maxConcurrency` wire member.
+    pub max_concurrency: i32,
+    /// The `redriveCount` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_count: Option<i32>,
+    /// The `redriveDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_date: Option<chrono::DateTime<chrono::Utc>>,
+    /// The `startDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub start_date: chrono::DateTime<chrono::Utc>,
+    /// The `status` wire member.
+    pub status: MapRunStatus,
+    /// The `stopDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stop_date: Option<chrono::DateTime<chrono::Utc>>,
+    /// The `toleratedFailureCount` wire member.
+    pub tolerated_failure_count: i64,
+    /// The `toleratedFailurePercentage` wire member.
+    pub tolerated_failure_percentage: f32,
+}
+
+impl std::fmt::Debug for DescribeMapRunOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeMapRunOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeStateMachineAliasOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct DescribeStateMachineAliasOutput {
+    /// The `creationDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub creation_date: Option<chrono::DateTime<chrono::Utc>>,
+    /// The `description` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// The `name` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// The `routingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(default)]
+    pub routing_configuration: Vec<RoutingConfigurationListItem>,
+    /// The `stateMachineAliasArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_alias_arn: Option<String>,
+    /// The `updateDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub update_date: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+impl std::fmt::Debug for DescribeStateMachineAliasOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeStateMachineAliasOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeStateMachineForExecutionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct DescribeStateMachineForExecutionOutput {
+    /// The `definition` wire member.
+    pub definition: String,
+    /// The `encryptionConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub encryption_configuration: Option<EncryptionConfiguration>,
+    /// The `label` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub label: Option<String>,
+    /// The `loggingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub logging_configuration: Option<LoggingConfiguration>,
+    /// The `mapRunArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_arn: Option<String>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `revisionId` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revision_id: Option<String>,
+    /// The `roleArn` wire member.
+    pub role_arn: String,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `tracingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tracing_configuration: Option<TracingConfiguration>,
+    /// The `updateDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub update_date: chrono::DateTime<chrono::Utc>,
+    /// The `variableReferences` wire member.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub variable_references: HashMap<String, Vec<String>>,
+}
+
+impl std::fmt::Debug for DescribeStateMachineForExecutionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeStateMachineForExecutionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `DescribeStateMachineOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct DescribeStateMachineOutput {
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `definition` wire member.
+    pub definition: String,
+    /// The `description` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// The `encryptionConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub encryption_configuration: Option<EncryptionConfiguration>,
+    /// The `label` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub label: Option<String>,
+    /// The `loggingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub logging_configuration: Option<LoggingConfiguration>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `revisionId` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revision_id: Option<String>,
+    /// The `roleArn` wire member.
+    pub role_arn: String,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `status` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<StateMachineStatus>,
+    /// The `tracingConfiguration` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tracing_configuration: Option<TracingConfiguration>,
+    /// The `type` wire member.
+    pub r#type: StateMachineType,
+    /// The `variableReferences` wire member.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub variable_references: HashMap<String, Vec<String>>,
+}
+
+impl std::fmt::Debug for DescribeStateMachineOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DescribeStateMachineOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `GetActivityTaskOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct GetActivityTaskOutput {
+    /// The `input` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `taskToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_token: Option<String>,
+}
+
+impl std::fmt::Debug for GetActivityTaskOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("GetActivityTaskOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `GetExecutionHistoryOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct GetExecutionHistoryOutput {
+    /// The `events` wire member.
+    pub events: Vec<HistoryEvent>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+impl std::fmt::Debug for GetExecutionHistoryOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("GetExecutionHistoryOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListActivitiesOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListActivitiesOutput {
+    /// The `activities` wire member.
+    pub activities: Vec<ActivityListItem>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+impl std::fmt::Debug for ListActivitiesOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListActivitiesOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListExecutionsOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListExecutionsOutput {
+    /// The `executions` wire member.
+    pub executions: Vec<ExecutionListItem>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+impl std::fmt::Debug for ListExecutionsOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListExecutionsOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListMapRunsOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListMapRunsOutput {
+    /// The `mapRuns` wire member.
+    pub map_runs: Vec<MapRunListItem>,
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+impl std::fmt::Debug for ListMapRunsOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListMapRunsOutput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListStateMachineAliasesOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListStateMachineAliasesOutput {
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+    /// The `stateMachineAliases` wire member.
+    pub state_machine_aliases: Vec<StateMachineAliasListItem>,
+}
+
+impl std::fmt::Debug for ListStateMachineAliasesOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListStateMachineAliasesOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListStateMachineVersionsOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListStateMachineVersionsOutput {
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+    /// The `stateMachineVersions` wire member.
+    pub state_machine_versions: Vec<StateMachineVersionListItem>,
+}
+
+impl std::fmt::Debug for ListStateMachineVersionsOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListStateMachineVersionsOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListStateMachinesOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListStateMachinesOutput {
+    /// The `nextToken` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+    /// The `stateMachines` wire member.
+    pub state_machines: Vec<StateMachineListItem>,
+}
+
+impl std::fmt::Debug for ListStateMachinesOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListStateMachinesOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ListTagsForResourceOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ListTagsForResourceOutput {
+    /// The `tags` wire member.
+    #[serde(default)]
+    pub tags: Vec<Tag>,
+}
+
+impl std::fmt::Debug for ListTagsForResourceOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ListTagsForResourceOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `PublishStateMachineVersionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct PublishStateMachineVersionOutput {
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineVersionArn` wire member.
+    pub state_machine_version_arn: String,
+}
+
+impl std::fmt::Debug for PublishStateMachineVersionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("PublishStateMachineVersionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `RedriveExecutionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct RedriveExecutionOutput {
+    /// The `redriveDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub redrive_date: chrono::DateTime<chrono::Utc>,
+}
+
+impl std::fmt::Debug for RedriveExecutionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RedriveExecutionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `SendTaskFailureOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct SendTaskFailureOutput {}
+
+impl std::fmt::Debug for SendTaskFailureOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SendTaskFailureOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `SendTaskHeartbeatOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct SendTaskHeartbeatOutput {}
+
+impl std::fmt::Debug for SendTaskHeartbeatOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SendTaskHeartbeatOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `SendTaskSuccessOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct SendTaskSuccessOutput {}
+
+impl std::fmt::Debug for SendTaskSuccessOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("SendTaskSuccessOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StartExecutionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StartExecutionOutput {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `startDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub start_date: chrono::DateTime<chrono::Utc>,
+}
+
+impl std::fmt::Debug for StartExecutionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StartExecutionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StartSyncExecutionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct StartSyncExecutionOutput {
+    /// The `billingDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub billing_details: Option<BillingDetails>,
+    /// The `cause` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `input` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `inputDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_details: Option<CloudWatchEventsExecutionDataDetails>,
+    /// The `name` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// The `output` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<CloudWatchEventsExecutionDataDetails>,
+    /// The `startDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub start_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_arn: Option<String>,
+    /// The `status` wire member.
+    pub status: SyncExecutionStatus,
+    /// The `stopDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub stop_date: chrono::DateTime<chrono::Utc>,
+    /// The `traceHeader` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trace_header: Option<String>,
+}
+
+impl std::fmt::Debug for StartSyncExecutionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StartSyncExecutionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StopExecutionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StopExecutionOutput {
+    /// The `stopDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub stop_date: chrono::DateTime<chrono::Utc>,
+}
+
+impl std::fmt::Debug for StopExecutionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StopExecutionOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TagResourceOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TagResourceOutput {}
+
+impl std::fmt::Debug for TagResourceOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TagResourceOutput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `TestStateOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct TestStateOutput {
+    /// The `cause` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `inspectionData` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub inspection_data: Option<InspectionData>,
+    /// The `nextState` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_state: Option<String>,
+    /// The `output` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `status` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<TestExecutionStatus>,
+}
+
+impl std::fmt::Debug for TestStateOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TestStateOutput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `UntagResourceOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct UntagResourceOutput {}
+
+impl std::fmt::Debug for UntagResourceOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UntagResourceOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `UpdateMapRunOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct UpdateMapRunOutput {}
+
+impl std::fmt::Debug for UpdateMapRunOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UpdateMapRunOutput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `UpdateStateMachineAliasOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct UpdateStateMachineAliasOutput {
+    /// The `updateDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub update_date: chrono::DateTime<chrono::Utc>,
+}
+
+impl std::fmt::Debug for UpdateStateMachineAliasOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UpdateStateMachineAliasOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `UpdateStateMachineOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct UpdateStateMachineOutput {
+    /// The `revisionId` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub revision_id: Option<String>,
+    /// The `stateMachineVersionArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_version_arn: Option<String>,
+    /// The `updateDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub update_date: chrono::DateTime<chrono::Utc>,
+}
+
+impl std::fmt::Debug for UpdateStateMachineOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UpdateStateMachineOutput")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ValidateStateMachineDefinitionOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ValidateStateMachineDefinitionOutput {
+    /// The `diagnostics` wire member.
+    pub diagnostics: Vec<ValidateStateMachineDefinitionDiagnostic>,
+    /// The `result` wire member.
+    pub result: ValidateStateMachineDefinitionResultCode,
+    /// The `truncated` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub truncated: Option<bool>,
+}
+
+impl std::fmt::Debug for ValidateStateMachineDefinitionOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ValidateStateMachineDefinitionOutput")
+            .finish_non_exhaustive()
+    }
+}
diff --git a/crates/rustack-stepfunctions-model/src/types.rs b/crates/rustack-stepfunctions-model/src/types.rs
new file mode 100644
index 00000000..4024d0d5
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/src/types.rs
@@ -0,0 +1,2572 @@
+//! Auto-generated from AWS Step Functions Smithy model. DO NOT EDIT.
+
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+
+/// Step Functions `EncryptionType` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum EncryptionType {
+    /// The `AWS_OWNED_KEY` wire variant.
+    #[default]
+    #[serde(rename = "AWS_OWNED_KEY")]
+    AwsOwnedKey,
+    /// The `CUSTOMER_MANAGED_KMS_KEY` wire variant.
+    #[serde(rename = "CUSTOMER_MANAGED_KMS_KEY")]
+    CustomerManagedKmsKey,
+}
+
+impl EncryptionType {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::AwsOwnedKey => "AWS_OWNED_KEY",
+            Self::CustomerManagedKmsKey => "CUSTOMER_MANAGED_KMS_KEY",
+        }
+    }
+}
+
+impl std::fmt::Display for EncryptionType {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for EncryptionType {
+    fn from(s: &str) -> Self {
+        match s {
+            "AWS_OWNED_KEY" => Self::AwsOwnedKey,
+            "CUSTOMER_MANAGED_KMS_KEY" => Self::CustomerManagedKmsKey,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `ExecutionRedriveFilter` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum ExecutionRedriveFilter {
+    /// The `NOT_REDRIVEN` wire variant.
+    #[default]
+    #[serde(rename = "NOT_REDRIVEN")]
+    NotRedriven,
+    /// The `REDRIVEN` wire variant.
+    #[serde(rename = "REDRIVEN")]
+    Redriven,
+}
+
+impl ExecutionRedriveFilter {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::NotRedriven => "NOT_REDRIVEN",
+            Self::Redriven => "REDRIVEN",
+        }
+    }
+}
+
+impl std::fmt::Display for ExecutionRedriveFilter {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for ExecutionRedriveFilter {
+    fn from(s: &str) -> Self {
+        match s {
+            "NOT_REDRIVEN" => Self::NotRedriven,
+            "REDRIVEN" => Self::Redriven,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `ExecutionRedriveStatus` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum ExecutionRedriveStatus {
+    /// The `NOT_REDRIVABLE` wire variant.
+    #[default]
+    #[serde(rename = "NOT_REDRIVABLE")]
+    NotRedrivable,
+    /// The `REDRIVABLE` wire variant.
+    #[serde(rename = "REDRIVABLE")]
+    Redrivable,
+    /// The `REDRIVABLE_BY_MAP_RUN` wire variant.
+    #[serde(rename = "REDRIVABLE_BY_MAP_RUN")]
+    RedrivableByMapRun,
+}
+
+impl ExecutionRedriveStatus {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::NotRedrivable => "NOT_REDRIVABLE",
+            Self::Redrivable => "REDRIVABLE",
+            Self::RedrivableByMapRun => "REDRIVABLE_BY_MAP_RUN",
+        }
+    }
+}
+
+impl std::fmt::Display for ExecutionRedriveStatus {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for ExecutionRedriveStatus {
+    fn from(s: &str) -> Self {
+        match s {
+            "NOT_REDRIVABLE" => Self::NotRedrivable,
+            "REDRIVABLE" => Self::Redrivable,
+            "REDRIVABLE_BY_MAP_RUN" => Self::RedrivableByMapRun,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `ExecutionStatus` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum ExecutionStatus {
+    /// The `ABORTED` wire variant.
+    #[default]
+    #[serde(rename = "ABORTED")]
+    Aborted,
+    /// The `FAILED` wire variant.
+    #[serde(rename = "FAILED")]
+    Failed,
+    /// The `PENDING_REDRIVE` wire variant.
+    #[serde(rename = "PENDING_REDRIVE")]
+    PendingRedrive,
+    /// The `RUNNING` wire variant.
+    #[serde(rename = "RUNNING")]
+    Running,
+    /// The `SUCCEEDED` wire variant.
+    #[serde(rename = "SUCCEEDED")]
+    Succeeded,
+    /// The `TIMED_OUT` wire variant.
+    #[serde(rename = "TIMED_OUT")]
+    TimedOut,
+}
+
+impl ExecutionStatus {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Aborted => "ABORTED",
+            Self::Failed => "FAILED",
+            Self::PendingRedrive => "PENDING_REDRIVE",
+            Self::Running => "RUNNING",
+            Self::Succeeded => "SUCCEEDED",
+            Self::TimedOut => "TIMED_OUT",
+        }
+    }
+}
+
+impl std::fmt::Display for ExecutionStatus {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for ExecutionStatus {
+    fn from(s: &str) -> Self {
+        match s {
+            "ABORTED" => Self::Aborted,
+            "FAILED" => Self::Failed,
+            "PENDING_REDRIVE" => Self::PendingRedrive,
+            "RUNNING" => Self::Running,
+            "SUCCEEDED" => Self::Succeeded,
+            "TIMED_OUT" => Self::TimedOut,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `HistoryEventType` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum HistoryEventType {
+    /// The `ActivityFailed` wire variant.
+    #[default]
+    ActivityFailed,
+    /// The `ActivityScheduleFailed` wire variant.
+    ActivityScheduleFailed,
+    /// The `ActivityScheduled` wire variant.
+    ActivityScheduled,
+    /// The `ActivityStarted` wire variant.
+    ActivityStarted,
+    /// The `ActivitySucceeded` wire variant.
+    ActivitySucceeded,
+    /// The `ActivityTimedOut` wire variant.
+    ActivityTimedOut,
+    /// The `ChoiceStateEntered` wire variant.
+    ChoiceStateEntered,
+    /// The `ChoiceStateExited` wire variant.
+    ChoiceStateExited,
+    /// The `EvaluationFailed` wire variant.
+    EvaluationFailed,
+    /// The `ExecutionAborted` wire variant.
+    ExecutionAborted,
+    /// The `ExecutionFailed` wire variant.
+    ExecutionFailed,
+    /// The `ExecutionRedriven` wire variant.
+    ExecutionRedriven,
+    /// The `ExecutionStarted` wire variant.
+    ExecutionStarted,
+    /// The `ExecutionSucceeded` wire variant.
+    ExecutionSucceeded,
+    /// The `ExecutionTimedOut` wire variant.
+    ExecutionTimedOut,
+    /// The `FailStateEntered` wire variant.
+    FailStateEntered,
+    /// The `LambdaFunctionFailed` wire variant.
+    LambdaFunctionFailed,
+    /// The `LambdaFunctionScheduleFailed` wire variant.
+    LambdaFunctionScheduleFailed,
+    /// The `LambdaFunctionScheduled` wire variant.
+    LambdaFunctionScheduled,
+    /// The `LambdaFunctionStartFailed` wire variant.
+    LambdaFunctionStartFailed,
+    /// The `LambdaFunctionStarted` wire variant.
+    LambdaFunctionStarted,
+    /// The `LambdaFunctionSucceeded` wire variant.
+    LambdaFunctionSucceeded,
+    /// The `LambdaFunctionTimedOut` wire variant.
+    LambdaFunctionTimedOut,
+    /// The `MapIterationAborted` wire variant.
+    MapIterationAborted,
+    /// The `MapIterationFailed` wire variant.
+    MapIterationFailed,
+    /// The `MapIterationStarted` wire variant.
+    MapIterationStarted,
+    /// The `MapIterationSucceeded` wire variant.
+    MapIterationSucceeded,
+    /// The `MapRunAborted` wire variant.
+    MapRunAborted,
+    /// The `MapRunFailed` wire variant.
+    MapRunFailed,
+    /// The `MapRunRedriven` wire variant.
+    MapRunRedriven,
+    /// The `MapRunStarted` wire variant.
+    MapRunStarted,
+    /// The `MapRunSucceeded` wire variant.
+    MapRunSucceeded,
+    /// The `MapStateAborted` wire variant.
+    MapStateAborted,
+    /// The `MapStateEntered` wire variant.
+    MapStateEntered,
+    /// The `MapStateExited` wire variant.
+    MapStateExited,
+    /// The `MapStateFailed` wire variant.
+    MapStateFailed,
+    /// The `MapStateStarted` wire variant.
+    MapStateStarted,
+    /// The `MapStateSucceeded` wire variant.
+    MapStateSucceeded,
+    /// The `ParallelStateAborted` wire variant.
+    ParallelStateAborted,
+    /// The `ParallelStateEntered` wire variant.
+    ParallelStateEntered,
+    /// The `ParallelStateExited` wire variant.
+    ParallelStateExited,
+    /// The `ParallelStateFailed` wire variant.
+    ParallelStateFailed,
+    /// The `ParallelStateStarted` wire variant.
+    ParallelStateStarted,
+    /// The `ParallelStateSucceeded` wire variant.
+    ParallelStateSucceeded,
+    /// The `PassStateEntered` wire variant.
+    PassStateEntered,
+    /// The `PassStateExited` wire variant.
+    PassStateExited,
+    /// The `SucceedStateEntered` wire variant.
+    SucceedStateEntered,
+    /// The `SucceedStateExited` wire variant.
+    SucceedStateExited,
+    /// The `TaskFailed` wire variant.
+    TaskFailed,
+    /// The `TaskScheduled` wire variant.
+    TaskScheduled,
+    /// The `TaskStartFailed` wire variant.
+    TaskStartFailed,
+    /// The `TaskStarted` wire variant.
+    TaskStarted,
+    /// The `TaskStateAborted` wire variant.
+    TaskStateAborted,
+    /// The `TaskStateEntered` wire variant.
+    TaskStateEntered,
+    /// The `TaskStateExited` wire variant.
+    TaskStateExited,
+    /// The `TaskSubmitFailed` wire variant.
+    TaskSubmitFailed,
+    /// The `TaskSubmitted` wire variant.
+    TaskSubmitted,
+    /// The `TaskSucceeded` wire variant.
+    TaskSucceeded,
+    /// The `TaskTimedOut` wire variant.
+    TaskTimedOut,
+    /// The `WaitStateAborted` wire variant.
+    WaitStateAborted,
+    /// The `WaitStateEntered` wire variant.
+    WaitStateEntered,
+    /// The `WaitStateExited` wire variant.
+    WaitStateExited,
+}
+
+impl HistoryEventType {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::ActivityFailed => "ActivityFailed",
+            Self::ActivityScheduleFailed => "ActivityScheduleFailed",
+            Self::ActivityScheduled => "ActivityScheduled",
+            Self::ActivityStarted => "ActivityStarted",
+            Self::ActivitySucceeded => "ActivitySucceeded",
+            Self::ActivityTimedOut => "ActivityTimedOut",
+            Self::ChoiceStateEntered => "ChoiceStateEntered",
+            Self::ChoiceStateExited => "ChoiceStateExited",
+            Self::EvaluationFailed => "EvaluationFailed",
+            Self::ExecutionAborted => "ExecutionAborted",
+            Self::ExecutionFailed => "ExecutionFailed",
+            Self::ExecutionRedriven => "ExecutionRedriven",
+            Self::ExecutionStarted => "ExecutionStarted",
+            Self::ExecutionSucceeded => "ExecutionSucceeded",
+            Self::ExecutionTimedOut => "ExecutionTimedOut",
+            Self::FailStateEntered => "FailStateEntered",
+            Self::LambdaFunctionFailed => "LambdaFunctionFailed",
+            Self::LambdaFunctionScheduleFailed => "LambdaFunctionScheduleFailed",
+            Self::LambdaFunctionScheduled => "LambdaFunctionScheduled",
+            Self::LambdaFunctionStartFailed => "LambdaFunctionStartFailed",
+            Self::LambdaFunctionStarted => "LambdaFunctionStarted",
+            Self::LambdaFunctionSucceeded => "LambdaFunctionSucceeded",
+            Self::LambdaFunctionTimedOut => "LambdaFunctionTimedOut",
+            Self::MapIterationAborted => "MapIterationAborted",
+            Self::MapIterationFailed => "MapIterationFailed",
+            Self::MapIterationStarted => "MapIterationStarted",
+            Self::MapIterationSucceeded => "MapIterationSucceeded",
+            Self::MapRunAborted => "MapRunAborted",
+            Self::MapRunFailed => "MapRunFailed",
+            Self::MapRunRedriven => "MapRunRedriven",
+            Self::MapRunStarted => "MapRunStarted",
+            Self::MapRunSucceeded => "MapRunSucceeded",
+            Self::MapStateAborted => "MapStateAborted",
+            Self::MapStateEntered => "MapStateEntered",
+            Self::MapStateExited => "MapStateExited",
+            Self::MapStateFailed => "MapStateFailed",
+            Self::MapStateStarted => "MapStateStarted",
+            Self::MapStateSucceeded => "MapStateSucceeded",
+            Self::ParallelStateAborted => "ParallelStateAborted",
+            Self::ParallelStateEntered => "ParallelStateEntered",
+            Self::ParallelStateExited => "ParallelStateExited",
+            Self::ParallelStateFailed => "ParallelStateFailed",
+            Self::ParallelStateStarted => "ParallelStateStarted",
+            Self::ParallelStateSucceeded => "ParallelStateSucceeded",
+            Self::PassStateEntered => "PassStateEntered",
+            Self::PassStateExited => "PassStateExited",
+            Self::SucceedStateEntered => "SucceedStateEntered",
+            Self::SucceedStateExited => "SucceedStateExited",
+            Self::TaskFailed => "TaskFailed",
+            Self::TaskScheduled => "TaskScheduled",
+            Self::TaskStartFailed => "TaskStartFailed",
+            Self::TaskStarted => "TaskStarted",
+            Self::TaskStateAborted => "TaskStateAborted",
+            Self::TaskStateEntered => "TaskStateEntered",
+            Self::TaskStateExited => "TaskStateExited",
+            Self::TaskSubmitFailed => "TaskSubmitFailed",
+            Self::TaskSubmitted => "TaskSubmitted",
+            Self::TaskSucceeded => "TaskSucceeded",
+            Self::TaskTimedOut => "TaskTimedOut",
+            Self::WaitStateAborted => "WaitStateAborted",
+            Self::WaitStateEntered => "WaitStateEntered",
+            Self::WaitStateExited => "WaitStateExited",
+        }
+    }
+}
+
+impl std::fmt::Display for HistoryEventType {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for HistoryEventType {
+    fn from(s: &str) -> Self {
+        match s {
+            "ActivityFailed" => Self::ActivityFailed,
+            "ActivityScheduleFailed" => Self::ActivityScheduleFailed,
+            "ActivityScheduled" => Self::ActivityScheduled,
+            "ActivityStarted" => Self::ActivityStarted,
+            "ActivitySucceeded" => Self::ActivitySucceeded,
+            "ActivityTimedOut" => Self::ActivityTimedOut,
+            "ChoiceStateEntered" => Self::ChoiceStateEntered,
+            "ChoiceStateExited" => Self::ChoiceStateExited,
+            "EvaluationFailed" => Self::EvaluationFailed,
+            "ExecutionAborted" => Self::ExecutionAborted,
+            "ExecutionFailed" => Self::ExecutionFailed,
+            "ExecutionRedriven" => Self::ExecutionRedriven,
+            "ExecutionStarted" => Self::ExecutionStarted,
+            "ExecutionSucceeded" => Self::ExecutionSucceeded,
+            "ExecutionTimedOut" => Self::ExecutionTimedOut,
+            "FailStateEntered" => Self::FailStateEntered,
+            "LambdaFunctionFailed" => Self::LambdaFunctionFailed,
+            "LambdaFunctionScheduleFailed" => Self::LambdaFunctionScheduleFailed,
+            "LambdaFunctionScheduled" => Self::LambdaFunctionScheduled,
+            "LambdaFunctionStartFailed" => Self::LambdaFunctionStartFailed,
+            "LambdaFunctionStarted" => Self::LambdaFunctionStarted,
+            "LambdaFunctionSucceeded" => Self::LambdaFunctionSucceeded,
+            "LambdaFunctionTimedOut" => Self::LambdaFunctionTimedOut,
+            "MapIterationAborted" => Self::MapIterationAborted,
+            "MapIterationFailed" => Self::MapIterationFailed,
+            "MapIterationStarted" => Self::MapIterationStarted,
+            "MapIterationSucceeded" => Self::MapIterationSucceeded,
+            "MapRunAborted" => Self::MapRunAborted,
+            "MapRunFailed" => Self::MapRunFailed,
+            "MapRunRedriven" => Self::MapRunRedriven,
+            "MapRunStarted" => Self::MapRunStarted,
+            "MapRunSucceeded" => Self::MapRunSucceeded,
+            "MapStateAborted" => Self::MapStateAborted,
+            "MapStateEntered" => Self::MapStateEntered,
+            "MapStateExited" => Self::MapStateExited,
+            "MapStateFailed" => Self::MapStateFailed,
+            "MapStateStarted" => Self::MapStateStarted,
+            "MapStateSucceeded" => Self::MapStateSucceeded,
+            "ParallelStateAborted" => Self::ParallelStateAborted,
+            "ParallelStateEntered" => Self::ParallelStateEntered,
+            "ParallelStateExited" => Self::ParallelStateExited,
+            "ParallelStateFailed" => Self::ParallelStateFailed,
+            "ParallelStateStarted" => Self::ParallelStateStarted,
+            "ParallelStateSucceeded" => Self::ParallelStateSucceeded,
+            "PassStateEntered" => Self::PassStateEntered,
+            "PassStateExited" => Self::PassStateExited,
+            "SucceedStateEntered" => Self::SucceedStateEntered,
+            "SucceedStateExited" => Self::SucceedStateExited,
+            "TaskFailed" => Self::TaskFailed,
+            "TaskScheduled" => Self::TaskScheduled,
+            "TaskStartFailed" => Self::TaskStartFailed,
+            "TaskStarted" => Self::TaskStarted,
+            "TaskStateAborted" => Self::TaskStateAborted,
+            "TaskStateEntered" => Self::TaskStateEntered,
+            "TaskStateExited" => Self::TaskStateExited,
+            "TaskSubmitFailed" => Self::TaskSubmitFailed,
+            "TaskSubmitted" => Self::TaskSubmitted,
+            "TaskSucceeded" => Self::TaskSucceeded,
+            "TaskTimedOut" => Self::TaskTimedOut,
+            "WaitStateAborted" => Self::WaitStateAborted,
+            "WaitStateEntered" => Self::WaitStateEntered,
+            "WaitStateExited" => Self::WaitStateExited,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `IncludedData` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum IncludedData {
+    /// The `ALL_DATA` wire variant.
+    #[default]
+    #[serde(rename = "ALL_DATA")]
+    AllData,
+    /// The `METADATA_ONLY` wire variant.
+    #[serde(rename = "METADATA_ONLY")]
+    MetadataOnly,
+}
+
+impl IncludedData {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::AllData => "ALL_DATA",
+            Self::MetadataOnly => "METADATA_ONLY",
+        }
+    }
+}
+
+impl std::fmt::Display for IncludedData {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for IncludedData {
+    fn from(s: &str) -> Self {
+        match s {
+            "ALL_DATA" => Self::AllData,
+            "METADATA_ONLY" => Self::MetadataOnly,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `InspectionLevel` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum InspectionLevel {
+    /// The `DEBUG` wire variant.
+    #[default]
+    #[serde(rename = "DEBUG")]
+    Debug,
+    /// The `INFO` wire variant.
+    #[serde(rename = "INFO")]
+    Info,
+    /// The `TRACE` wire variant.
+    #[serde(rename = "TRACE")]
+    Trace,
+}
+
+impl InspectionLevel {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Debug => "DEBUG",
+            Self::Info => "INFO",
+            Self::Trace => "TRACE",
+        }
+    }
+}
+
+impl std::fmt::Display for InspectionLevel {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for InspectionLevel {
+    fn from(s: &str) -> Self {
+        match s {
+            "DEBUG" => Self::Debug,
+            "INFO" => Self::Info,
+            "TRACE" => Self::Trace,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `LogLevel` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum LogLevel {
+    /// The `ALL` wire variant.
+    #[default]
+    #[serde(rename = "ALL")]
+    All,
+    /// The `ERROR` wire variant.
+    #[serde(rename = "ERROR")]
+    Error,
+    /// The `FATAL` wire variant.
+    #[serde(rename = "FATAL")]
+    Fatal,
+    /// The `OFF` wire variant.
+    #[serde(rename = "OFF")]
+    Off,
+}
+
+impl LogLevel {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::All => "ALL",
+            Self::Error => "ERROR",
+            Self::Fatal => "FATAL",
+            Self::Off => "OFF",
+        }
+    }
+}
+
+impl std::fmt::Display for LogLevel {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for LogLevel {
+    fn from(s: &str) -> Self {
+        match s {
+            "ALL" => Self::All,
+            "ERROR" => Self::Error,
+            "FATAL" => Self::Fatal,
+            "OFF" => Self::Off,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `MapRunStatus` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum MapRunStatus {
+    /// The `ABORTED` wire variant.
+    #[default]
+    #[serde(rename = "ABORTED")]
+    Aborted,
+    /// The `FAILED` wire variant.
+    #[serde(rename = "FAILED")]
+    Failed,
+    /// The `RUNNING` wire variant.
+    #[serde(rename = "RUNNING")]
+    Running,
+    /// The `SUCCEEDED` wire variant.
+    #[serde(rename = "SUCCEEDED")]
+    Succeeded,
+}
+
+impl MapRunStatus {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Aborted => "ABORTED",
+            Self::Failed => "FAILED",
+            Self::Running => "RUNNING",
+            Self::Succeeded => "SUCCEEDED",
+        }
+    }
+}
+
+impl std::fmt::Display for MapRunStatus {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for MapRunStatus {
+    fn from(s: &str) -> Self {
+        match s {
+            "ABORTED" => Self::Aborted,
+            "FAILED" => Self::Failed,
+            "RUNNING" => Self::Running,
+            "SUCCEEDED" => Self::Succeeded,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `MockResponseValidationMode` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum MockResponseValidationMode {
+    /// The `NONE` wire variant.
+    #[default]
+    #[serde(rename = "NONE")]
+    None,
+    /// The `PRESENT` wire variant.
+    #[serde(rename = "PRESENT")]
+    Present,
+    /// The `STRICT` wire variant.
+    #[serde(rename = "STRICT")]
+    Strict,
+}
+
+impl MockResponseValidationMode {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::None => "NONE",
+            Self::Present => "PRESENT",
+            Self::Strict => "STRICT",
+        }
+    }
+}
+
+impl std::fmt::Display for MockResponseValidationMode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for MockResponseValidationMode {
+    fn from(s: &str) -> Self {
+        match s {
+            "NONE" => Self::None,
+            "PRESENT" => Self::Present,
+            "STRICT" => Self::Strict,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `StateMachineStatus` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum StateMachineStatus {
+    /// The `ACTIVE` wire variant.
+    #[default]
+    #[serde(rename = "ACTIVE")]
+    Active,
+    /// The `DELETING` wire variant.
+    #[serde(rename = "DELETING")]
+    Deleting,
+}
+
+impl StateMachineStatus {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Active => "ACTIVE",
+            Self::Deleting => "DELETING",
+        }
+    }
+}
+
+impl std::fmt::Display for StateMachineStatus {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for StateMachineStatus {
+    fn from(s: &str) -> Self {
+        match s {
+            "ACTIVE" => Self::Active,
+            "DELETING" => Self::Deleting,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `StateMachineType` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum StateMachineType {
+    /// The `EXPRESS` wire variant.
+    #[default]
+    #[serde(rename = "EXPRESS")]
+    Express,
+    /// The `STANDARD` wire variant.
+    #[serde(rename = "STANDARD")]
+    Standard,
+}
+
+impl StateMachineType {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Express => "EXPRESS",
+            Self::Standard => "STANDARD",
+        }
+    }
+}
+
+impl std::fmt::Display for StateMachineType {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for StateMachineType {
+    fn from(s: &str) -> Self {
+        match s {
+            "EXPRESS" => Self::Express,
+            "STANDARD" => Self::Standard,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `SyncExecutionStatus` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum SyncExecutionStatus {
+    /// The `FAILED` wire variant.
+    #[default]
+    #[serde(rename = "FAILED")]
+    Failed,
+    /// The `SUCCEEDED` wire variant.
+    #[serde(rename = "SUCCEEDED")]
+    Succeeded,
+    /// The `TIMED_OUT` wire variant.
+    #[serde(rename = "TIMED_OUT")]
+    TimedOut,
+}
+
+impl SyncExecutionStatus {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Failed => "FAILED",
+            Self::Succeeded => "SUCCEEDED",
+            Self::TimedOut => "TIMED_OUT",
+        }
+    }
+}
+
+impl std::fmt::Display for SyncExecutionStatus {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for SyncExecutionStatus {
+    fn from(s: &str) -> Self {
+        match s {
+            "FAILED" => Self::Failed,
+            "SUCCEEDED" => Self::Succeeded,
+            "TIMED_OUT" => Self::TimedOut,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `TestExecutionStatus` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum TestExecutionStatus {
+    /// The `CAUGHT_ERROR` wire variant.
+    #[default]
+    #[serde(rename = "CAUGHT_ERROR")]
+    CaughtError,
+    /// The `FAILED` wire variant.
+    #[serde(rename = "FAILED")]
+    Failed,
+    /// The `RETRIABLE` wire variant.
+    #[serde(rename = "RETRIABLE")]
+    Retriable,
+    /// The `SUCCEEDED` wire variant.
+    #[serde(rename = "SUCCEEDED")]
+    Succeeded,
+}
+
+impl TestExecutionStatus {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::CaughtError => "CAUGHT_ERROR",
+            Self::Failed => "FAILED",
+            Self::Retriable => "RETRIABLE",
+            Self::Succeeded => "SUCCEEDED",
+        }
+    }
+}
+
+impl std::fmt::Display for TestExecutionStatus {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for TestExecutionStatus {
+    fn from(s: &str) -> Self {
+        match s {
+            "CAUGHT_ERROR" => Self::CaughtError,
+            "FAILED" => Self::Failed,
+            "RETRIABLE" => Self::Retriable,
+            "SUCCEEDED" => Self::Succeeded,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `ValidateStateMachineDefinitionResultCode` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum ValidateStateMachineDefinitionResultCode {
+    /// The `FAIL` wire variant.
+    #[default]
+    #[serde(rename = "FAIL")]
+    Fail,
+    /// The `OK` wire variant.
+    #[serde(rename = "OK")]
+    Ok,
+}
+
+impl ValidateStateMachineDefinitionResultCode {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Fail => "FAIL",
+            Self::Ok => "OK",
+        }
+    }
+}
+
+impl std::fmt::Display for ValidateStateMachineDefinitionResultCode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for ValidateStateMachineDefinitionResultCode {
+    fn from(s: &str) -> Self {
+        match s {
+            "FAIL" => Self::Fail,
+            "OK" => Self::Ok,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `ValidateStateMachineDefinitionSeverity` enum.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default, Serialize, Deserialize)]
+pub enum ValidateStateMachineDefinitionSeverity {
+    /// The `ERROR` wire variant.
+    #[default]
+    #[serde(rename = "ERROR")]
+    Error,
+    /// The `WARNING` wire variant.
+    #[serde(rename = "WARNING")]
+    Warning,
+}
+
+impl ValidateStateMachineDefinitionSeverity {
+    /// Returns the string value of this enum variant.
+    #[must_use]
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Error => "ERROR",
+            Self::Warning => "WARNING",
+        }
+    }
+}
+
+impl std::fmt::Display for ValidateStateMachineDefinitionSeverity {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+impl From<&str> for ValidateStateMachineDefinitionSeverity {
+    fn from(s: &str) -> Self {
+        match s {
+            "ERROR" => Self::Error,
+            "WARNING" => Self::Warning,
+            _ => Self::default(),
+        }
+    }
+}
+
+/// Step Functions `ActivityFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ActivityFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for ActivityFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ActivityFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ActivityListItem`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ActivityListItem {
+    /// The `activityArn` wire member.
+    pub activity_arn: String,
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `name` wire member.
+    pub name: String,
+}
+
+impl std::fmt::Debug for ActivityListItem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ActivityListItem").finish_non_exhaustive()
+    }
+}
+/// Step Functions `ActivityScheduleFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ActivityScheduleFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for ActivityScheduleFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ActivityScheduleFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ActivityScheduledEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ActivityScheduledEventDetails {
+    /// The `heartbeatInSeconds` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub heartbeat_in_seconds: Option<i64>,
+    /// The `input` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `inputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_details: Option<HistoryEventExecutionDataDetails>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `timeoutInSeconds` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout_in_seconds: Option<i64>,
+}
+
+impl std::fmt::Debug for ActivityScheduledEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ActivityScheduledEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ActivityStartedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ActivityStartedEventDetails {
+    /// The `workerName` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub worker_name: Option<String>,
+}
+
+impl std::fmt::Debug for ActivityStartedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ActivityStartedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ActivitySucceededEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ActivitySucceededEventDetails {
+    /// The `output` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<HistoryEventExecutionDataDetails>,
+}
+
+impl std::fmt::Debug for ActivitySucceededEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ActivitySucceededEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ActivityTimedOutEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ActivityTimedOutEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for ActivityTimedOutEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ActivityTimedOutEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `AssignedVariablesDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct AssignedVariablesDetails {
+    /// The `truncated` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub truncated: Option<bool>,
+}
+
+impl std::fmt::Debug for AssignedVariablesDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AssignedVariablesDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `BillingDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct BillingDetails {
+    /// The `billedDurationInMilliseconds` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub billed_duration_in_milliseconds: Option<i64>,
+    /// The `billedMemoryUsedInMB` wire member.
+    #[serde(rename = "billedMemoryUsedInMB")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub billed_memory_used_in_mb: Option<i64>,
+}
+
+impl std::fmt::Debug for BillingDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("BillingDetails").finish_non_exhaustive()
+    }
+}
+/// Step Functions `CloudWatchEventsExecutionDataDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct CloudWatchEventsExecutionDataDetails {
+    /// The `included` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included: Option<bool>,
+}
+
+impl std::fmt::Debug for CloudWatchEventsExecutionDataDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CloudWatchEventsExecutionDataDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `CloudWatchLogsLogGroup`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct CloudWatchLogsLogGroup {
+    /// The `logGroupArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub log_group_arn: Option<String>,
+}
+
+impl std::fmt::Debug for CloudWatchLogsLogGroup {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CloudWatchLogsLogGroup")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `EncryptionConfiguration`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct EncryptionConfiguration {
+    /// The `kmsDataKeyReusePeriodSeconds` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kms_data_key_reuse_period_seconds: Option<i32>,
+    /// The `kmsKeyId` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kms_key_id: Option<String>,
+    /// The `type` wire member.
+    pub r#type: EncryptionType,
+}
+
+impl std::fmt::Debug for EncryptionConfiguration {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("EncryptionConfiguration")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `EvaluationFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct EvaluationFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `location` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub location: Option<String>,
+    /// The `state` wire member.
+    pub state: String,
+}
+
+impl std::fmt::Debug for EvaluationFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("EvaluationFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ExecutionAbortedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ExecutionAbortedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for ExecutionAbortedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ExecutionAbortedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ExecutionFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ExecutionFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for ExecutionFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ExecutionFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ExecutionListItem`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct ExecutionListItem {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `itemCount` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub item_count: Option<i32>,
+    /// The `mapRunArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_arn: Option<String>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `redriveCount` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_count: Option<i32>,
+    /// The `redriveDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_date: Option<chrono::DateTime<chrono::Utc>>,
+    /// The `startDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub start_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineAliasArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_alias_arn: Option<String>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `stateMachineVersionArn` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_version_arn: Option<String>,
+    /// The `status` wire member.
+    pub status: ExecutionStatus,
+    /// The `stopDate` wire member.
+    #[builder(default)]
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stop_date: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+impl std::fmt::Debug for ExecutionListItem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ExecutionListItem").finish_non_exhaustive()
+    }
+}
+/// Step Functions `ExecutionRedrivenEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ExecutionRedrivenEventDetails {
+    /// The `redriveCount` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_count: Option<i32>,
+}
+
+impl std::fmt::Debug for ExecutionRedrivenEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ExecutionRedrivenEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ExecutionStartedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ExecutionStartedEventDetails {
+    /// The `input` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `inputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_details: Option<HistoryEventExecutionDataDetails>,
+    /// The `roleArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub role_arn: Option<String>,
+    /// The `stateMachineAliasArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_alias_arn: Option<String>,
+    /// The `stateMachineVersionArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_machine_version_arn: Option<String>,
+}
+
+impl std::fmt::Debug for ExecutionStartedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ExecutionStartedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ExecutionSucceededEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ExecutionSucceededEventDetails {
+    /// The `output` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<HistoryEventExecutionDataDetails>,
+}
+
+impl std::fmt::Debug for ExecutionSucceededEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ExecutionSucceededEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ExecutionTimedOutEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ExecutionTimedOutEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for ExecutionTimedOutEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ExecutionTimedOutEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `HistoryEvent`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct HistoryEvent {
+    /// The `activityFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub activity_failed_event_details: Option<ActivityFailedEventDetails>,
+    /// The `activityScheduleFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub activity_schedule_failed_event_details: Option<ActivityScheduleFailedEventDetails>,
+    /// The `activityScheduledEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub activity_scheduled_event_details: Option<ActivityScheduledEventDetails>,
+    /// The `activityStartedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub activity_started_event_details: Option<ActivityStartedEventDetails>,
+    /// The `activitySucceededEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub activity_succeeded_event_details: Option<ActivitySucceededEventDetails>,
+    /// The `activityTimedOutEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub activity_timed_out_event_details: Option<ActivityTimedOutEventDetails>,
+    /// The `evaluationFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub evaluation_failed_event_details: Option<EvaluationFailedEventDetails>,
+    /// The `executionAbortedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_aborted_event_details: Option<ExecutionAbortedEventDetails>,
+    /// The `executionFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_failed_event_details: Option<ExecutionFailedEventDetails>,
+    /// The `executionRedrivenEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_redriven_event_details: Option<ExecutionRedrivenEventDetails>,
+    /// The `executionStartedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_started_event_details: Option<ExecutionStartedEventDetails>,
+    /// The `executionSucceededEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_succeeded_event_details: Option<ExecutionSucceededEventDetails>,
+    /// The `executionTimedOutEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_timed_out_event_details: Option<ExecutionTimedOutEventDetails>,
+    /// The `id` wire member.
+    pub id: i64,
+    /// The `lambdaFunctionFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lambda_function_failed_event_details: Option<LambdaFunctionFailedEventDetails>,
+    /// The `lambdaFunctionScheduleFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lambda_function_schedule_failed_event_details:
+        Option<LambdaFunctionScheduleFailedEventDetails>,
+    /// The `lambdaFunctionScheduledEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lambda_function_scheduled_event_details: Option<LambdaFunctionScheduledEventDetails>,
+    /// The `lambdaFunctionStartFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lambda_function_start_failed_event_details: Option<LambdaFunctionStartFailedEventDetails>,
+    /// The `lambdaFunctionSucceededEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lambda_function_succeeded_event_details: Option<LambdaFunctionSucceededEventDetails>,
+    /// The `lambdaFunctionTimedOutEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub lambda_function_timed_out_event_details: Option<LambdaFunctionTimedOutEventDetails>,
+    /// The `mapIterationAbortedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_iteration_aborted_event_details: Option<MapIterationEventDetails>,
+    /// The `mapIterationFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_iteration_failed_event_details: Option<MapIterationEventDetails>,
+    /// The `mapIterationStartedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_iteration_started_event_details: Option<MapIterationEventDetails>,
+    /// The `mapIterationSucceededEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_iteration_succeeded_event_details: Option<MapIterationEventDetails>,
+    /// The `mapRunFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_failed_event_details: Option<MapRunFailedEventDetails>,
+    /// The `mapRunRedrivenEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_redriven_event_details: Option<MapRunRedrivenEventDetails>,
+    /// The `mapRunStartedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_started_event_details: Option<MapRunStartedEventDetails>,
+    /// The `mapStateStartedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_state_started_event_details: Option<MapStateStartedEventDetails>,
+    /// The `previousEventId` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub previous_event_id: Option<i64>,
+    /// The `stateEnteredEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_entered_event_details: Option<StateEnteredEventDetails>,
+    /// The `stateExitedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state_exited_event_details: Option<StateExitedEventDetails>,
+    /// The `taskFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_failed_event_details: Option<TaskFailedEventDetails>,
+    /// The `taskScheduledEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_scheduled_event_details: Option<TaskScheduledEventDetails>,
+    /// The `taskStartFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_start_failed_event_details: Option<TaskStartFailedEventDetails>,
+    /// The `taskStartedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_started_event_details: Option<TaskStartedEventDetails>,
+    /// The `taskSubmitFailedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_submit_failed_event_details: Option<TaskSubmitFailedEventDetails>,
+    /// The `taskSubmittedEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_submitted_event_details: Option<TaskSubmittedEventDetails>,
+    /// The `taskSucceededEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_succeeded_event_details: Option<TaskSucceededEventDetails>,
+    /// The `taskTimedOutEventDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_timed_out_event_details: Option<TaskTimedOutEventDetails>,
+    /// The `timestamp` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub timestamp: chrono::DateTime<chrono::Utc>,
+    /// The `type` wire member.
+    pub r#type: HistoryEventType,
+}
+
+impl std::fmt::Debug for HistoryEvent {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("HistoryEvent").finish_non_exhaustive()
+    }
+}
+/// Step Functions `HistoryEventExecutionDataDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct HistoryEventExecutionDataDetails {
+    /// The `truncated` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub truncated: Option<bool>,
+}
+
+impl std::fmt::Debug for HistoryEventExecutionDataDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("HistoryEventExecutionDataDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `InspectionData`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct InspectionData {
+    /// The `afterArguments` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_arguments: Option<String>,
+    /// The `afterInputPath` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_input_path: Option<String>,
+    /// The `afterItemBatcher` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_item_batcher: Option<String>,
+    /// The `afterItemSelector` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_item_selector: Option<String>,
+    /// The `afterItemsPath` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_items_path: Option<String>,
+    /// The `afterItemsPointer` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_items_pointer: Option<String>,
+    /// The `afterParameters` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_parameters: Option<String>,
+    /// The `afterResultPath` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_result_path: Option<String>,
+    /// The `afterResultSelector` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub after_result_selector: Option<String>,
+    /// The `errorDetails` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error_details: Option<InspectionErrorDetails>,
+    /// The `input` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `maxConcurrency` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_concurrency: Option<i32>,
+    /// The `request` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub request: Option<InspectionDataRequest>,
+    /// The `response` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub response: Option<InspectionDataResponse>,
+    /// The `result` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<String>,
+    /// The `toleratedFailureCount` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tolerated_failure_count: Option<i32>,
+    /// The `toleratedFailurePercentage` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tolerated_failure_percentage: Option<f32>,
+    /// The `variables` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub variables: Option<String>,
+}
+
+impl std::fmt::Debug for InspectionData {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("InspectionData").finish_non_exhaustive()
+    }
+}
+/// Step Functions `InspectionDataRequest`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct InspectionDataRequest {
+    /// The `body` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub body: Option<String>,
+    /// The `headers` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub headers: Option<String>,
+    /// The `method` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub method: Option<String>,
+    /// The `protocol` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub protocol: Option<String>,
+    /// The `url` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
+}
+
+impl std::fmt::Debug for InspectionDataRequest {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("InspectionDataRequest")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `InspectionDataResponse`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct InspectionDataResponse {
+    /// The `body` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub body: Option<String>,
+    /// The `headers` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub headers: Option<String>,
+    /// The `protocol` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub protocol: Option<String>,
+    /// The `statusCode` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_code: Option<String>,
+    /// The `statusMessage` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_message: Option<String>,
+}
+
+impl std::fmt::Debug for InspectionDataResponse {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("InspectionDataResponse")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `InspectionErrorDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct InspectionErrorDetails {
+    /// The `catchIndex` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub catch_index: Option<i32>,
+    /// The `retryBackoffIntervalSeconds` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub retry_backoff_interval_seconds: Option<i32>,
+    /// The `retryIndex` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub retry_index: Option<i32>,
+}
+
+impl std::fmt::Debug for InspectionErrorDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("InspectionErrorDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `LambdaFunctionFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LambdaFunctionFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for LambdaFunctionFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LambdaFunctionFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `LambdaFunctionScheduleFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LambdaFunctionScheduleFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for LambdaFunctionScheduleFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LambdaFunctionScheduleFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `LambdaFunctionScheduledEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LambdaFunctionScheduledEventDetails {
+    /// The `input` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `inputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_details: Option<HistoryEventExecutionDataDetails>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `taskCredentials` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_credentials: Option<TaskCredentials>,
+    /// The `timeoutInSeconds` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout_in_seconds: Option<i64>,
+}
+
+impl std::fmt::Debug for LambdaFunctionScheduledEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LambdaFunctionScheduledEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `LambdaFunctionStartFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LambdaFunctionStartFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for LambdaFunctionStartFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LambdaFunctionStartFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `LambdaFunctionSucceededEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LambdaFunctionSucceededEventDetails {
+    /// The `output` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<HistoryEventExecutionDataDetails>,
+}
+
+impl std::fmt::Debug for LambdaFunctionSucceededEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LambdaFunctionSucceededEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `LambdaFunctionTimedOutEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LambdaFunctionTimedOutEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for LambdaFunctionTimedOutEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LambdaFunctionTimedOutEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `LogDestination`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LogDestination {
+    /// The `cloudWatchLogsLogGroup` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cloud_watch_logs_log_group: Option<CloudWatchLogsLogGroup>,
+}
+
+impl std::fmt::Debug for LogDestination {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LogDestination").finish_non_exhaustive()
+    }
+}
+/// Step Functions `LoggingConfiguration`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct LoggingConfiguration {
+    /// The `destinations` wire member.
+    #[serde(default)]
+    pub destinations: Vec<LogDestination>,
+    /// The `includeExecutionData` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_execution_data: Option<bool>,
+    /// The `level` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub level: Option<LogLevel>,
+}
+
+impl std::fmt::Debug for LoggingConfiguration {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LoggingConfiguration")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapIterationEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MapIterationEventDetails {
+    /// The `index` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub index: Option<i32>,
+    /// The `name` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+}
+
+impl std::fmt::Debug for MapIterationEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapIterationEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapRunExecutionCounts`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct MapRunExecutionCounts {
+    /// The `aborted` wire member.
+    pub aborted: i64,
+    /// The `failed` wire member.
+    pub failed: i64,
+    /// The `failuresNotRedrivable` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failures_not_redrivable: Option<i64>,
+    /// The `pending` wire member.
+    pub pending: i64,
+    /// The `pendingRedrive` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pending_redrive: Option<i64>,
+    /// The `resultsWritten` wire member.
+    pub results_written: i64,
+    /// The `running` wire member.
+    pub running: i64,
+    /// The `succeeded` wire member.
+    pub succeeded: i64,
+    /// The `timedOut` wire member.
+    pub timed_out: i64,
+    /// The `total` wire member.
+    pub total: i64,
+}
+
+impl std::fmt::Debug for MapRunExecutionCounts {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapRunExecutionCounts")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapRunFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MapRunFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for MapRunFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapRunFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapRunItemCounts`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct MapRunItemCounts {
+    /// The `aborted` wire member.
+    pub aborted: i64,
+    /// The `failed` wire member.
+    pub failed: i64,
+    /// The `failuresNotRedrivable` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub failures_not_redrivable: Option<i64>,
+    /// The `pending` wire member.
+    pub pending: i64,
+    /// The `pendingRedrive` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub pending_redrive: Option<i64>,
+    /// The `resultsWritten` wire member.
+    pub results_written: i64,
+    /// The `running` wire member.
+    pub running: i64,
+    /// The `succeeded` wire member.
+    pub succeeded: i64,
+    /// The `timedOut` wire member.
+    pub timed_out: i64,
+    /// The `total` wire member.
+    pub total: i64,
+}
+
+impl std::fmt::Debug for MapRunItemCounts {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapRunItemCounts").finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapRunListItem`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MapRunListItem {
+    /// The `executionArn` wire member.
+    pub execution_arn: String,
+    /// The `mapRunArn` wire member.
+    pub map_run_arn: String,
+    /// The `startDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub start_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `stopDate` wire member.
+    #[serde(default, with = "crate::epoch_seconds::option")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stop_date: Option<chrono::DateTime<chrono::Utc>>,
+}
+
+impl std::fmt::Debug for MapRunListItem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapRunListItem").finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapRunRedrivenEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MapRunRedrivenEventDetails {
+    /// The `mapRunArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_arn: Option<String>,
+    /// The `redriveCount` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub redrive_count: Option<i32>,
+}
+
+impl std::fmt::Debug for MapRunRedrivenEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapRunRedrivenEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapRunStartedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MapRunStartedEventDetails {
+    /// The `mapRunArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_run_arn: Option<String>,
+}
+
+impl std::fmt::Debug for MapRunStartedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapRunStartedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `MapStateStartedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MapStateStartedEventDetails {
+    /// The `length` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub length: Option<i32>,
+}
+
+impl std::fmt::Debug for MapStateStartedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MapStateStartedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `MockErrorOutput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MockErrorOutput {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl std::fmt::Debug for MockErrorOutput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MockErrorOutput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `MockInput`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct MockInput {
+    /// The `errorOutput` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error_output: Option<MockErrorOutput>,
+    /// The `fieldValidationMode` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub field_validation_mode: Option<MockResponseValidationMode>,
+    /// The `result` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<String>,
+}
+
+impl std::fmt::Debug for MockInput {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MockInput").finish_non_exhaustive()
+    }
+}
+/// Step Functions `RoutingConfigurationListItem`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct RoutingConfigurationListItem {
+    /// The `stateMachineVersionArn` wire member.
+    pub state_machine_version_arn: String,
+    /// The `weight` wire member.
+    pub weight: i32,
+}
+
+impl std::fmt::Debug for RoutingConfigurationListItem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RoutingConfigurationListItem")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StateEnteredEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StateEnteredEventDetails {
+    /// The `input` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input: Option<String>,
+    /// The `inputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub input_details: Option<HistoryEventExecutionDataDetails>,
+    /// The `name` wire member.
+    pub name: String,
+}
+
+impl std::fmt::Debug for StateEnteredEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StateEnteredEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StateExitedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StateExitedEventDetails {
+    /// The `assignedVariables` wire member.
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub assigned_variables: HashMap<String, String>,
+    /// The `assignedVariablesDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub assigned_variables_details: Option<AssignedVariablesDetails>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `output` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<HistoryEventExecutionDataDetails>,
+}
+
+impl std::fmt::Debug for StateExitedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StateExitedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StateMachineAliasListItem`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StateMachineAliasListItem {
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineAliasArn` wire member.
+    pub state_machine_alias_arn: String,
+}
+
+impl std::fmt::Debug for StateMachineAliasListItem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StateMachineAliasListItem")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StateMachineListItem`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StateMachineListItem {
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `name` wire member.
+    pub name: String,
+    /// The `stateMachineArn` wire member.
+    pub state_machine_arn: String,
+    /// The `type` wire member.
+    pub r#type: StateMachineType,
+}
+
+impl std::fmt::Debug for StateMachineListItem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StateMachineListItem")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `StateMachineVersionListItem`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct StateMachineVersionListItem {
+    /// The `creationDate` wire member.
+    #[serde(with = "crate::epoch_seconds")]
+    pub creation_date: chrono::DateTime<chrono::Utc>,
+    /// The `stateMachineVersionArn` wire member.
+    pub state_machine_version_arn: String,
+}
+
+impl std::fmt::Debug for StateMachineVersionListItem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("StateMachineVersionListItem")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `Tag`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct Tag {
+    /// The `key` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub key: Option<String>,
+    /// The `value` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub value: Option<String>,
+}
+
+impl std::fmt::Debug for Tag {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Tag").finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskCredentials`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskCredentials {
+    /// The `roleArn` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub role_arn: Option<String>,
+}
+
+impl std::fmt::Debug for TaskCredentials {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskCredentials").finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+}
+
+impl std::fmt::Debug for TaskFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskScheduledEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+#[derive(typed_builder::TypedBuilder)]
+pub struct TaskScheduledEventDetails {
+    /// The `heartbeatInSeconds` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub heartbeat_in_seconds: Option<i64>,
+    /// The `parameters` wire member.
+    pub parameters: String,
+    /// The `region` wire member.
+    pub region: String,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+    /// The `taskCredentials` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub task_credentials: Option<TaskCredentials>,
+    /// The `timeoutInSeconds` wire member.
+    #[builder(default)]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timeout_in_seconds: Option<i64>,
+}
+
+impl std::fmt::Debug for TaskScheduledEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskScheduledEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskStartFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskStartFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+}
+
+impl std::fmt::Debug for TaskStartFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskStartFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskStartedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskStartedEventDetails {
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+}
+
+impl std::fmt::Debug for TaskStartedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskStartedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskSubmitFailedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskSubmitFailedEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+}
+
+impl std::fmt::Debug for TaskSubmitFailedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskSubmitFailedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskSubmittedEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskSubmittedEventDetails {
+    /// The `output` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<HistoryEventExecutionDataDetails>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+}
+
+impl std::fmt::Debug for TaskSubmittedEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskSubmittedEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskSucceededEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskSucceededEventDetails {
+    /// The `output` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output: Option<String>,
+    /// The `outputDetails` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub output_details: Option<HistoryEventExecutionDataDetails>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+}
+
+impl std::fmt::Debug for TaskSucceededEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskSucceededEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TaskTimedOutEventDetails`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TaskTimedOutEventDetails {
+    /// The `cause` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cause: Option<String>,
+    /// The `error` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// The `resource` wire member.
+    pub resource: String,
+    /// The `resourceType` wire member.
+    pub resource_type: String,
+}
+
+impl std::fmt::Debug for TaskTimedOutEventDetails {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TaskTimedOutEventDetails")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TestStateConfiguration`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TestStateConfiguration {
+    /// The `errorCausedByState` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error_caused_by_state: Option<String>,
+    /// The `mapItemReaderData` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_item_reader_data: Option<String>,
+    /// The `mapIterationFailureCount` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub map_iteration_failure_count: Option<i32>,
+    /// The `retrierRetryCount` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub retrier_retry_count: Option<i32>,
+}
+
+impl std::fmt::Debug for TestStateConfiguration {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TestStateConfiguration")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `TracingConfiguration`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct TracingConfiguration {
+    /// The `enabled` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+}
+
+impl std::fmt::Debug for TracingConfiguration {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TracingConfiguration")
+            .finish_non_exhaustive()
+    }
+}
+/// Step Functions `ValidateStateMachineDefinitionDiagnostic`.
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[non_exhaustive]
+#[serde(deny_unknown_fields)]
+pub struct ValidateStateMachineDefinitionDiagnostic {
+    /// The `code` wire member.
+    pub code: String,
+    /// The `location` wire member.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub location: Option<String>,
+    /// The `message` wire member.
+    pub message: String,
+    /// The `severity` wire member.
+    pub severity: ValidateStateMachineDefinitionSeverity,
+}
+
+impl std::fmt::Debug for ValidateStateMachineDefinitionDiagnostic {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ValidateStateMachineDefinitionDiagnostic")
+            .finish_non_exhaustive()
+    }
+}
diff --git a/crates/rustack-stepfunctions-model/tests/timestamps.rs b/crates/rustack-stepfunctions-model/tests/timestamps.rs
new file mode 100644
index 00000000..2ca02345
--- /dev/null
+++ b/crates/rustack-stepfunctions-model/tests/timestamps.rs
@@ -0,0 +1,212 @@
+//! Required/optional numeric wire timestamps from the actual generated model.
+
+use chrono::{DateTime, Utc};
+use rstest::rstest;
+use rustack_stepfunctions_model::{
+    StepFunctionsErrorCode,
+    output::{DescribeExecutionOutput, StartExecutionOutput},
+    types::{ExecutionStatus, HistoryEvent, HistoryEventType},
+};
+use serde_json::json;
+
+#[rstest]
+#[case("0", 0)]
+#[case("1", 1000)]
+#[case("1700000000.123", 1_700_000_000_123)]
+#[case("-0.25",-250)]
+#[case("-1.999",-1999)]
+#[case("-1.999999",-1999)]
+#[case("0.000999", 0)]
+#[case("-0.000999", 0)]
+#[case("1.23e2", 123_000)]
+#[case("123e-3", 123)]
+#[case("0.00123e3", 1230)]
+#[case("1e-100", 0)]
+#[case("-0e100", 0)]
+#[case("0e2147483648", 0)]
+#[case("-0e-2147483649", 0)]
+#[case("1e-2147483649", 0)]
+fn test_should_decode_and_roundtrip_generated_required_timestamp(
+    #[case] number: &str,
+    #[case] millis: i64,
+) {
+    let wire = format!(r#"{{"executionArn":"execution","startDate":{number}}}"#);
+    let decoded: StartExecutionOutput = serde_json::from_str(&wire).unwrap();
+    assert_eq!(decoded.start_date.timestamp_millis(), millis);
+    let serialized = serde_json::to_string(&decoded).unwrap();
+    assert!(!serialized.contains('Z'));
+    let roundtrip: StartExecutionOutput = serde_json::from_str(&serialized).unwrap();
+    assert_eq!(roundtrip.start_date, decoded.start_date);
+}
+#[rstest]
+#[case("null")]
+#[case("true")]
+#[case("[]")]
+#[case("{}")]
+#[case("\"1700000000\"")]
+#[case("\"2026-01-01T00:00:00Z\"")]
+#[case("1e100")]
+#[case("9223372036854775807")]
+#[case("-9223372036854775808")]
+#[case("NaN")]
+fn test_should_reject_invalid_required_timestamp(#[case] value: &str) {
+    let wire = format!(r#"{{"executionArn":"execution","startDate":{value}}}"#);
+    assert!(serde_json::from_str::<StartExecutionOutput>(&wire).is_err());
+}
+#[test]
+fn test_should_omit_optional_timestamp_and_accept_null_or_exponent_values() {
+    let output = DescribeExecutionOutput::builder()
+        .execution_arn("execution".into())
+        .state_machine_arn("machine".into())
+        .status(ExecutionStatus::Running)
+        .start_date(DateTime::from_timestamp_millis(-250).unwrap())
+        .build();
+    let serialized = serde_json::to_string(&output).unwrap();
+    assert!(!serialized.contains("stopDate"));
+    let mut value = serde_json::to_value(&output).unwrap();
+    value["stopDate"] = json!(null);
+    let decoded: DescribeExecutionOutput = serde_json::from_value(value.clone()).unwrap();
+    assert_eq!(decoded.stop_date, None);
+    value["stopDate"] = json!(-0.75);
+    let decoded: DescribeExecutionOutput = serde_json::from_value(value).unwrap();
+    assert_eq!(decoded.stop_date.unwrap().timestamp_millis(), -750);
+    let wire = serialized.trim_end_matches('}').to_owned() + ",\"stopDate\":-2.5e-1}";
+    assert_eq!(
+        serde_json::from_str::<DescribeExecutionOutput>(&wire)
+            .unwrap()
+            .stop_date
+            .unwrap()
+            .timestamp_millis(),
+        -250
+    );
+}
+#[test]
+fn test_should_serialize_exact_decimal_and_truncate_submillisecond_precision() {
+    let output = HistoryEvent::builder()
+        .id(1)
+        .timestamp(DateTime::from_timestamp(-2, 765_432_100).unwrap())
+        .r#type(HistoryEventType::ExecutionStarted)
+        .build();
+    let serialized = serde_json::to_string(&output).unwrap();
+    assert!(serialized.contains(r#""timestamp":-1.234"#));
+    let decoded: HistoryEvent = serde_json::from_str(&serialized).unwrap();
+    assert_eq!(decoded.timestamp.timestamp_millis(), -1234);
+}
+#[test]
+fn test_should_reject_leap_seconds_missing_required_fields_and_unknown_fields() {
+    let mut output = StartExecutionOutput::default();
+    output.start_date = DateTime::from_timestamp(59, 1_000_000_000).unwrap();
+    assert!(serde_json::to_string(&output).is_err());
+    assert!(
+        serde_json::from_str::<StartExecutionOutput>(r#"{"executionArn":"execution"}"#).is_err()
+    );
+    assert!(
+        serde_json::from_str::<StartExecutionOutput>(
+            r#"{"executionArn":"execution","startDate":0,"extra":0}"#
+        )
+        .is_err()
+    );
+}
+#[test]
+fn test_should_preserve_chrono_range_millisecond_boundaries_without_float_rounding() {
+    for value in [DateTime::<Utc>::MIN_UTC, DateTime::<Utc>::MAX_UTC] {
+        let mut output = StartExecutionOutput::default();
+        output.start_date = value;
+        let serialized = serde_json::to_string(&output).unwrap();
+        let decoded: StartExecutionOutput = serde_json::from_str(&serialized).unwrap();
+        let total = i128::from(value.timestamp()) * 1_000_000_000
+            + i128::from(value.timestamp_subsec_nanos());
+        assert_eq!(
+            i128::from(decoded.start_date.timestamp_millis()),
+            total / 1_000_000
+        );
+    }
+}
+#[test]
+fn test_should_reject_oversized_timestamp_lexeme_with_redacted_error() {
+    let wire = format!(
+        r#"{{"executionArn":"execution","startDate":0.{}}}"#,
+        "1".repeat(129)
+    );
+    let error = serde_json::from_str::<StartExecutionOutput>(&wire)
+        .unwrap_err()
+        .to_string();
+    assert!(error.contains("invalid epoch-second timestamp"));
+    assert!(!error.contains(&"1".repeat(20)));
+}
+
+#[test]
+fn test_should_accept_optional_oversized_exponents_only_when_value_normalizes_to_zero() {
+    for number in ["0e2147483648", "-0e-2147483649", "1e-2147483649"] {
+        let wire = format!(
+            r#"{{"executionArn":"execution","stateMachineArn":"machine","startDate":0,"status":"RUNNING","stopDate":{number}}}"#
+        );
+        let decoded: DescribeExecutionOutput = serde_json::from_str(&wire).unwrap();
+        assert_eq!(decoded.stop_date.unwrap().timestamp_millis(), 0);
+    }
+    let wire = r#"{"executionArn":"execution","startDate":1e2147483648}"#;
+    assert!(serde_json::from_str::<StartExecutionOutput>(wire).is_err());
+}
+#[test]
+fn test_should_redact_generated_inputs_nested_history_and_error_diagnostics() {
+    use std::error::Error;
+
+    use rustack_stepfunctions_model::{
+        StepFunctionsError, StepFunctionsErrorCode, input::SendTaskSuccessInput,
+        types::ExecutionStartedEventDetails,
+    };
+    let token = "secret-task-token";
+    let input: SendTaskSuccessInput =
+        serde_json::from_value(json!({"taskToken": token, "output": "secret-output"})).unwrap();
+    let debug = format!("{input:?}");
+    assert!(!debug.contains(token) && !debug.contains("secret-output"));
+    let nested: ExecutionStartedEventDetails =
+        serde_json::from_value(json!({"input":"secret-input"})).unwrap();
+    let event = HistoryEvent::builder()
+        .id(1)
+        .timestamp(DateTime::from_timestamp_millis(0).unwrap())
+        .r#type(HistoryEventType::ExecutionStarted)
+        .execution_started_event_details(Some(nested))
+        .build();
+    assert!(!format!("{event:?}").contains("secret-input"));
+    let mut error = StepFunctionsError::with_message(StepFunctionsErrorCode::InvalidToken, token);
+    error.source = Some(Box::new(std::io::Error::other("secret-source")));
+    assert_eq!(format!("{error:?}"), "StepFunctionsError(<redacted>)");
+    assert_eq!(error.to_string(), "StepFunctionsError(<redacted>)");
+    assert!(error.source().is_some());
+}
+#[test]
+fn test_should_require_present_collections_and_keep_supported_operation_names_exact() {
+    use rustack_stepfunctions_model::{
+        StepFunctionsError, StepFunctionsErrorCode, StepFunctionsOperation, input::TagResourceInput,
+    };
+    assert!(serde_json::from_str::<TagResourceInput>(r#"{"resourceArn":"resource"}"#).is_err());
+    assert!(
+        serde_json::from_str::<TagResourceInput>(r#"{"resourceArn":"resource","tags":[]}"#).is_ok()
+    );
+    assert!(StepFunctionsOperation::from_name("StartExecution").is_some());
+    assert_eq!(StepFunctionsOperation::from_name("startexecution"), None);
+    assert_eq!(
+        rustack_stepfunctions_model::TARGET_PREFIX,
+        "AWSStepFunctions"
+    );
+    let error = StepFunctionsError::new(StepFunctionsErrorCode::UnsupportedOperation);
+    assert_eq!(
+        error.message,
+        "Operation is outside the supported Step Functions profile"
+    );
+}
+
+#[test]
+fn test_should_preserve_generated_common_error_http_statuses() {
+    for (code, status) in [
+        (StepFunctionsErrorCode::RequestTimeoutException, 408),
+        (StepFunctionsErrorCode::ServiceQuotaExceededException, 402),
+        (StepFunctionsErrorCode::InternalFailure, 500),
+        (StepFunctionsErrorCode::ServiceUnavailable, 503),
+        (StepFunctionsErrorCode::AccessDeniedException, 403),
+        (StepFunctionsErrorCode::ThrottlingException, 400),
+    ] {
+        assert_eq!(code.default_status_code().as_u16(), status);
+    }
+}
diff --git a/docs/index.md b/docs/index.md
index 98752c12..22385881 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,11 +1,29 @@
 # Documentation
 
+- [Rootless Docker bootstrap review](./research/workflows-rootless-platform-review.md) - Real unprivileged daemon, signed installation, mapped socket identity, bounded privileged jobs and retained failed/read-only recovery evidence; complete platform qualification remains pending.
+
+- [Step Functions and Lambda workflows](./workflows-guide.md) - Source feature selection versus the qualified Step Functions-enabled root Docker distribution, actual static-ELF/filesystem artifact checks, safe composite Action inputs/deadlines and independent process controls, strict-auth pure example, explicit Native and qualified Docker Image execution with official Python/pinned Node24/independent Rust RIC and opt-in provided.al2023 Docker ZIP execution, explicit qualified local SDK credentials/environment and real S3/DynamoDB consumers, actual managed-image callbacks with independent Event work, retry/heartbeat/timeout/Stop and confirmed-save privacy checks, managed Pulumi image-Lambda lifecycle/encrypted-state audits/active-plugin retirement, supported ASL/integrations, immutable local Image and bounded original-ZIP archive restoration, snapshots, memory/admission and shutdown behavior, real Image/management-IO deadline, interrupted-pull and negative-platform gates, actual Runtime HTTP/isolated-admission diagnostics, retained ZIP code-volume lifecycle, same-artifact Linux Native verification and durable namespace recovery, exact Docker functional inventories and exact native qualification.
+
 - [Local smoke tests](./smoke-tests.md) - Functional SDK/HTTP checks, recent-change regressions, and Pulumi smoke coverage.
 - [Pulumi](./pulumi.md) - Use Rustack as a Pulumi AWS provider deployment target.
 - [运行时硬化操作与能力指南](./runtime-hardening.md) - 配置/信任边界/执行与持久化范围/健康与能力端点。
 
 ## Research
 
+- [LocalStack workflow test integration](./research/study-localstack-workflow-tests.md) — Pinned original pytest/snapshot execution, observed AWS semantics, exact123-node qualification and explicit packaging/coverage limits.
+
+- [Workflow final consumers and delivery review](research/workflows-final-consumers-review.md) — D104–D108 code review, source cohort, retained failures and current verification.
+
+- [Image Lambda Performance and Repeated Cleanup Review](./research/workflows-image-performance-review.md) - Direct Linux warm100/cold20 and100 causal log-flood timeout cycles, actual initialization/task/resource observations and explicit reference qualification limits.
+
+- [Direct Linux arm64 Workflows Performance Review](./research/workflows-linux-performance-review.md) - Actual Linux SDK/CLI50-state latency and100 live-loop/Stop cycles, bounded artifact/process evidence and raw VM measurements; dedicated-reference qualification remains pending.
+
+- [Native-host Workflows Performance Review](./research/workflows-native-performance-review.md) - Actual signed SDK50-state latency, live-loop health/history exhaustion and100 single-slot Stop cycles; raw host measurements, process cleanup and source/binary fingerprints, with Linux reference qualification still pending.
+
+- [Bollard Docker Transport Boundaries](./research/study-bollard-docker-transport-boundaries.md) - Pinned response collection, attach framing/EOF and diagnostic behavior; generated-type reuse, bounded production wire implementation, platform identity/default merge validation, owned image pin/quota/cleanup preparation, persisted installation identity with same-connection fences, complete bounded observed namespace inventories, controlled pull/auth/progress ownership, private registry YAML/descriptor-loading boundaries, container-origin endpoint/TLS and production provenance/retained-startup and independent custom-RIC/causal-isolation preflight, plus actual RIC/diagnostic qualification; Bollard and historical Moby sources are pinned.
+- [Container Lambda Relay Spike](./research/spike-lambda-container-relay.md) - Actual binary attach/shared-netns/official-RIC execution on arm64 and emulated amd64, with reproducible probes and explicit qualification limits.
+- [Step Functions Semantic Oracle Spike](./research/spike-stepfunctions-semantic-oracle.md) - Pinned Smithy/SDK/fixture evidence, independently reproduced numeric timestamp gap, callback errors, AWS-validated nested result shapes and historical intrinsic rounding/split boundaries.
+- [Step Functions and Container Lambda Survey](./research/survey-stepfunctions-lambda-container-runtime.md) - Official ASL/integration/image/runtime contracts, inspected Rustack gaps, current dependency APIs and the experiments required before implementation.
 - [LocalStack S3 Implementation Research](./research/localstack-s3-research.md) - Comprehensive analysis of what a Rust-based LocalStack S3 service needs to support for feature parity.
 - [s3s Crate Ecosystem Research](./research/s3s-crate-research.md) - Comprehensive analysis of the s3s Rust crate for building S3-compatible services.
 - [LocalStack Container & CI Research](./research/localstack-container-ci-research.md) - How LocalStack's Docker container works, gateway routing through port 4566, health endpoints, and the official GitHub Action for CI.
@@ -17,3 +35,5 @@
 - [SQS API Research](./research/sqs-api-research.md) - Comprehensive analysis of the AWS SQS API surface, protocol (awsJson1_0 with awsQuery compatibility), Smithy model, features (FIFO, DLQ, long polling, visibility timeout), test suites, and implementation challenges for Rustack.
 - [SQS Integration Test Suites Research](./research/sqs-test-suites.md) - Survey of available SQS compatibility/conformance test suites (ElasticMQ, LocalStack, Moto, GoAWS, AWS SDK tests) and recommendations for adoption, analogous to MinIO Mint for S3.
 - [Cargo Lambda Runtime Execution Spike](./research/spike-cargo-lambda-runtime-execution.md) - How Cargo Lambda `bootstrap.zip` artifacts are executed through the Lambda Runtime API, and what Rustack needs for native, container, or Squib execution.
+
+- [Pulumi process ownership](./research/study-pulumi-process-ownership.md) - Pinned CLI/plugin process groups, cancellation and drain ownership; constraints for managed-image IaC lifecycle qualification.
diff --git a/docs/research/spike-lambda-container-relay.md b/docs/research/spike-lambda-container-relay.md
new file mode 100644
index 00000000..4715cd8f
--- /dev/null
+++ b/docs/research/spike-lambda-container-relay.md
@@ -0,0 +1,41 @@
+# Spike: Can Docker Attach Drive an Unmodified Lambda RIC Image?
+
+Status: PASS with platform qualifications · Date: 2026-10-25 · Consumer: [runtime design](../../specs/rustack-workflows-20-lambda-runtime-design.md)
+
+## Question
+
+Can a relay own an environment-local loopback Runtime API and exchange binary control frames through Docker attach while an ordinary Lambda image runs in the same network namespace, without published Runtime API ports or host networking?
+
+## Method
+
+The retained standalone crate is [tools/workflows-spikes](../../tools/workflows-spikes/Cargo.toml), with [relay](../../tools/workflows-spikes/src/bin/relay.rs), [driver](../../tools/workflows-spikes/src/bin/driver.rs), pinned [relay image](../../tools/workflows-spikes/Relay.Dockerfile) and [official-RIC fixture image](../../tools/workflows-spikes/Handler.Dockerfile). It is an executable feasibility experiment, not the production executor or hardened external CBOR parser.
+
+Host: macOS 27 arm64, Apple M5, 64 GiB RAM. Docker CLI 29.9.2, Engine 29.5.2, Colima 0.10.3, Lima 2.2.1, QEMU 11.1.2 and Cargo Lambda 1.9.2. A dedicated arm64 VZ VM uses 4 CPUs/6 GiB; a separate x86_64 QEMU VM uses 2 CPUs/4 GiB. Neither mounts the host home or forwards its SSH agent. The x86_64 VM is **emulated hardware**, not native x86 performance evidence. Docker Desktop, rootless Docker and a native x86 runner remain required M4 lanes.
+
+Reproduction requires Docker, Cargo Lambda/Zig, and buildx. On Homebrew, set the builder executable explicitly if Docker plugin discovery is unconfigured:
+
+```sh
+make workflows-relay-spike \
+  WORKFLOWS_DOCKER_SOCKET=/path/to/docker.sock \
+  WORKFLOWS_ARCH=arm64 \
+  WORKFLOWS_IMAGE_BUILDER=/opt/homebrew/bin/docker-buildx
+```
+
+Repeat with amd64 and its own socket. Make builds the Linux relay, builds both digest-pinned fixture images, runs actual invocations and removes all created containers. It never starts another AWS emulator or contacts an AWS service API. Registry image provisioning still requires network access on a cold cache.
+
+## Findings
+
+1. Binary, non-TTY, bidirectional Docker attach works with the selected Bollard API. Attach is established before relay start; Hello and Ready are received without relying on replayed logs. The RIC's first GET /next produces a distinct BootstrapReady signal.
+2. The official Python 3.13 Lambda image enters its normal RIC path when AWS_LAMBDA_RUNTIME_API points to 127.0.0.1:9001 in the shared netns. Two calls compute 42 and 7 from different input values; the handler's counter advances 1→2. These are real handler results, not a transport echo.
+3. Handler-side evidence confirms UID 1000, memory.max=201326592, pids.max=256 and read-only rootfs. The driver independently checks that the relay publishes no ports. This proves these controls in the measured VMs; it does not establish hostile multi-tenant isolation.
+4. A raised ValueError travels through `/error`. The cancellation probe waits for the exact invocation's busy-start log marker before removing the sleeping function. Close/Ack succeeds, followed by removal of both owned containers. A single successful response is therefore not the entire evidence.
+5. Seven framing tests cover fragmented binary data, oversized prefixes, trailing CBOR data, clean/truncated EOF and redacted Debug; five doc examples compile/pass. The standalone crate passes strict pedantic/boundary Clippy and rustdoc. Its own dependency audit reports zero vulnerabilities.
+6. Initial single-run cold observations were 122 ms on arm64 and 2,526 ms on emulated amd64. These are feasibility observations under development load, **not p95 performance qualification**. Retained normalized run evidence is [arm64](../../tests/workflows/evidence/relay-arm64.json) and [emulated amd64](../../tests/workflows/evidence/relay-amd64.json), including EOF and label-reconciliation observations.
+
+## Decision
+
+**GO with qualifications:** retain the relay architecture and pay its two-container overhead in the environment budget. Configure DNS/extra-host entries on the relay/netns owner. Keep control transport separate from function SDK gateway reachability. The experiment is not permission to copy its reduced protocol validation or failure handling into production unchanged.
+
+## Risks and implementation requirements
+
+Production P1 still needs strict bounded CBOR preflight, typed variants, complete Runtime API identity/error behavior, cancellation supervision, quarantine/reconciliation, image revision lifecycle and dependency-log filtering. The real attach EOF comparison found StdinOnce=false leaves the relay running after input shutdown; true delivers EOF and ends it before cleanup. The production contract now requires true. Cleanup also reconciles a run-unique label, including a deliberately unrecorded create result, instead of relying only on received IDs. The experiment caught a Close/read-worker race: a reader must not terminate the environment before the owner consumes queued Close. Retain single-owner settlement in production. SIGKILL cleanup remains a startup reconciliation responsibility; there is no crash-recovery claim.
diff --git a/docs/research/spike-stepfunctions-semantic-oracle.md b/docs/research/spike-stepfunctions-semantic-oracle.md
new file mode 100644
index 00000000..93740f6d
--- /dev/null
+++ b/docs/research/spike-stepfunctions-semantic-oracle.md
@@ -0,0 +1,46 @@
+# Spike: Independent Step Functions Wire and Semantic Evidence
+
+Status: PASS with a confirmed generator remediation · Date: 2026-10-25 · Consumer: [API](../../specs/rustack-workflows-10-api-design.md), [ASL](../../specs/rustack-workflows-30-asl-design.md), [integrations](../../specs/rustack-workflows-40-integrations-design.md)
+
+## Question and method
+
+Can the selected STANDARD/JSONPath contracts be pinned to independent sources and ordinary SDK behavior before writing the engine?
+
+The [fixture catalog](../../tests/workflows/semantic-cases.json) contains 48 document-derived expectations, not interpreter test results. [Provenance](../../tests/workflows/provenance.json) pins SDK/dependency versions. Four [offline botocore tests](../../tests/workflows/test_botocore_wire.py) exercise its serializer/parser without creating a client, resolving credentials or contacting AWS. Run `make workflows-fixture-check workflows-wire-probe`.
+
+The [SFN Smithy model](../../codegen/smithy-model/stepfunctions.json) is pinned to aws/api-models-aws commit `18e485ce1c8dbf29d47e5ce00d9b8513da95912c`, SHA-256 `38dd64c074f5c05320978970dafa6e0f199ab2e33b6065232002e8a603c5f6ed`, 370,185 bytes. `make workflows-model-check` verifies its hash, protocol, signing name and 37-operation service. `make workflows-codegen-spike` independently generates six Rust files into `/tmp/rustack-spikes/stepfunctions-generated/src` from 312 shapes.
+
+The existing LocalStack submodule was initialized at its already-pinned commit `45dfee8ce27df00fcac3f91b8071c8156eb5c5c7`; its gitlink was not changed. Only relevant test/snapshot evidence was inspected, not the full interpreter architecture. No implementation code was copied.
+
+## Findings
+
+| Evidence | Result and binding consequence |
+|---|---|
+| botocore 1.43.118 / boto3 1.43.118 | StartExecution emits AWSStepFunctions.StartExecution and preserves the raw input JSON string |
+| SDK numeric timestamp parsing |0.125→1970-01-01T00:00:00.125Z;−0.125→1969-12-31T23:59:59.875Z. HTTP timestamps are numeric fractional epoch seconds |
+| Current generated CreateStateMachineOutput | A standalone Rust test confirms numeric creationDate fails ordinary chrono deserialization. Generation succeeds, but its current wire codec is insufficient |
+| Callback error parser and current API docs | Known closed/expired tasks use TaskTimedOut; unknown/malformed tokens use InvalidToken. TaskDoesNotExist describes a nonexistent activity |
+| Current AWS error guide | States.ALL excludes Runtime/DataLimitExceeded; explicit DataLimitExceeded matching is supported. Older upstream expectations cannot override this current documented contract |
+| AWS-validated nested snapshots | `.sync` has string Input/Output; `.sync:2` has JSON Input/Output. Both include a TaskSubmitted event between TaskStarted and terminal completion; optimized null Input normalizes to an empty object |
+
+Nested evidence is directly inspectable in the [validated tests](../../vendors/localstack/tests/aws/services/stepfunctions/v2/callback/test_callback.py) at lines 285/333; paired output shapes are in [snapshots](../../vendors/localstack/tests/aws/services/stepfunctions/v2/callback/test_callback.snapshot.json) at lines 713/1251, with validation dates 2023-06-30 and2023-08-12 in the [validation record](../../vendors/localstack/tests/aws/services/stepfunctions/v2/callback/test_callback.validation.json). Snapshot timestamps are normalized and do not establish a date unit. A [historic direct AWS execution report](https://github.com/aws/aws-cdk/issues/5474) records optimized nested dates as epoch milliseconds; this is corroborating historical evidence, not a current cloud run. The local contract explicitly selects milliseconds for optimized envelopes while HTTP remains epoch seconds.
+
+Primary references: [Smithy JSON timestamp serialization](https://smithy.io/2.0/aws/protocols/aws-json-1_0-protocol.html#shape-serialization), [AWS callback errors](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html), [error handling](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-error-handling.html), [nested integrations](https://docs.aws.amazon.com/step-functions/latest/dg/connect-stepfunctions.html). Individual cases identify their sources.
+
+## Decision
+
+**GO with concrete remediation:** keep the API/profile and correct the reviewed contracts before consumers. P2 task2.1 must add protocol-aware numeric timestamp generation and required/optional/fractional/negative round-trip tests before the model becomes a production crate. Do not hand-edit generated output or copy the existing KMS timestamp adapter's unchecked negative-fraction conversion. The transformation and intrinsic expectations remain independent fixtures for the future interpreter; passing catalog/SDK checks does not mark A04–A11 complete.
+
+## Evidence limits
+
+No live AWS differential suite was run, and no complete emulator was used as a semantic oracle. Historical AWS-validated snapshots supplement current official documentation only where they do not conflict. Current guide-compatible States.Runtime behavior is selected for unevaluable paths; internal Path/Intrinsic/ResultPath diagnostics remain separate. Native x86 hardware, Docker Desktop/rootless qualification, full execution-history parity and the final performance gates remain unverified.
+
+## Intrinsic boundary evidence inspected during P2
+
+The same pinned LocalStack submodule contains AWS-validated historical intrinsic snapshots; these are observed outputs, not emulator implementation copied into Rustack. The [math test](../../vendors/localstack/tests/aws/services/stepfunctions/v2/intrinsic_functions/test_math_operations.py) and [snapshot](../../vendors/localstack/tests/aws/services/stepfunctions/v2/intrinsic_functions/test_math_operations.snapshot.json), validated2023-09-13, show -1.5→-1, -0.5→0, 0.5→1 and2.5→3 for addition with zero. The source comments about negative-half Java behavior conflict with those recorded values; use the recorded values. This pins nearest rounding with ties toward positive infinity. A floor/fraction comparison avoids introducing a separate addition-rounding error immediately below0.5.
+
+The [split snapshot](../../vendors/localstack/tests/aws/services/stepfunctions/v2/intrinsic_functions/test_string_operations.snapshot.json), recorded2024-12-05, drops empty fragments at leading, repeated and trailing separators, preserves spaces and treats all delimiter scalars as separators. `,,,,` split on comma yields an empty array. New production tests use these independent edge inputs plus the existing12-case intrinsic catalog. Empty-delimiter behavior and int32 result overflow remain explicit local policies, not new cloud observations.
+
+The [generic snapshot](../../vendors/localstack/tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.snapshot.json), recorded2023-02-09, also shows a cloud object-formatting extension. The current formal ASL scalar-only Format contract takes precedence in Rustack's selected subset; array/object substitutions reject. Scalar/null/numeric/string formatting and escaped brace provenance are covered separately. No new AWS execution or complete workflow-engine acceptance is claimed.
+
+D114 update: the user now explicitly prefers recorded AWS collection Format behavior over the earlier scalar-only local decision. Design61 §7 supersedes that restriction with bounded recursive rendering; the earlier evidence and its historical interpretation remain above.
diff --git a/docs/research/study-bollard-docker-transport-boundaries.md b/docs/research/study-bollard-docker-transport-boundaries.md
new file mode 100644
index 00000000..96d7ab07
--- /dev/null
+++ b/docs/research/study-bollard-docker-transport-boundaries.md
@@ -0,0 +1,171 @@
+# Study: Bollard's Docker Response and Attach Boundaries
+
+Status: pinned source review complete; bounded wire implementation and qualification recorded below · Date:2026-10-25 · Vendor pins: `vendors/bollard` @ `f9ec79e7546edfb674b1066c44a68815cb52251c` (`v0.21.1`); `vendors/moby` @ `af898abe44662d9554fb15ee4d4a7307f1b8e315` (`v28.0.0`, historical compatibility/merge source)
+
+## Question
+
+Can the production Lambda environment owner use Bollard's ordinary response/attach APIs while enforcing the repository's byte bounds, strict framing and diagnostic secrecy before materialization?
+
+The [existing relay experiment](./spike-lambda-container-relay.md) proves binary Docker attach and unchanged official RIC execution. It does not establish bounds inside the selected client's decoders. This study examines that smaller boundary before P1 task1.3 consumes it. The crate's [official version documentation](https://docs.rs/crate/bollard/0.21.1) and the published package's `.cargo_vcs_info.json` agree with this vendored release pin. No performance or cloud-parity claim follows from source inspection.
+
+## Architecture map
+
+```text
+┌─ Bollard typed endpoint ───────────────────────────────────────────────┐
+│ models/query parameters → request builder → selected transport        │
+│                                │ synchronous request TRACE            │
+│               ┌────────────────▼──────────────────────────────────┐   │
+│               │ Hyper response headers / Incoming                │   │
+│               │ request timeout ends after response acquisition   │   │
+│               └───────┬───────────────────────┬───────────────────┘   │
+│                       │                       │                       │
+│  ordinary JSON        ▼                       ▼ HTTP upgrade         │
+│  collect entire body → Bytes       split read/write → FramedRead      │
+│  → response DEBUG → Serde          8-byte Docker header                │
+│                                    → await declared payload length   │
+│                                    → LogOutput / Console on EOF       │
+└──────────────────────────────────────────────────────────────────────┘
+          ▲                                      ▲
+          │ body limits must precede collect      │ framing limits must
+          │                                      │ precede buffering
+┌─────────┴──────────────────────────────────────┴──────────────────────┐
+│ Rustack host owner: independent deadlines, bounded parsing, retained  │
+│ connection tasks, no uncertain replay, mandatory dependency filter    │
+└───────────────────────────────────────────────────────────────────────┘
+```
+
+## Hot path and allocations
+
+Endpoint methods construct generated Docker requests. For example, attach creates an upgrade POST and calls the private upgrade helper, then wraps its reader in the log decoder: `vendors/bollard/src/container.rs:540` and `:557`. The independent relay protocol lives *inside* these Docker stdout records; validating a CBOR prefix after receiving LogOutput cannot bound earlier Docker decoder buffering.
+
+Ordinary model decoding collects the complete Incoming body before Serde: `vendors/bollard/src/docker.rs:1736`. String/error decoding does the same at `:1727`. Neither call site adds a body-length limiter. A bounded timeout is useful but cannot by itself bound bytes accumulated before expiry. Image inspection exposes image-supplied configuration, so these responses are not only small daemon-version records.
+
+Request execution applies a timeout around obtaining the Hyper response at `vendors/bollard/src/docker.rs:1703`. Response body consumption occurs afterward. Rustack therefore needs an absolute deadline around header acquisition **and** body/frame processing, with a clock recheck before publishing success. This finding does not mean Bollard has no timeout at all; its existing header/request timeout is a different boundary.
+
+The custom transport interface returns exactly `Response<Incoming>`: `vendors/bollard/src/docker.rs:127`. A straightforward `Response<Limited<Incoming>>` wrapper cannot satisfy that type. Lower-level counted IO or a body-forwarding transport can enforce limits, but would add a second transport layer to retain the otherwise opaque decoder. There is no ordinary response-limit parameter on the examined endpoint path.
+
+## Attach decoder and EOF behavior
+
+`NewlineLogOutputDecoder` owns a two-stage state: waiting for an eight-byte header, or waiting for a stream-type/declared-length payload. Its header processing at `vendors/bollard/src/read.rs:75` converts the u32 length and records it without a local maximum. At `:80`, it waits until BytesMut contains that length, then splits a complete payload. Incomplete records therefore remain buffered across polls. This is linear work/storage in received record size, rather than a Rustack-specific upper bound.
+
+The decoder supports both multiplexed output and console/TTY fallback. A leading byte outside its multiplexed range can yield Console, and EOF handling at `vendors/bollard/src/read.rs:103` flushes trailing bytes as Console instead of treating every incomplete non-TTY record as an error. That compatibility policy is reasonable for a general Docker client. The relay protocol instead requires strict non-TTY framing: malformed/truncated records must invalidate the environment and must never become control payload.
+
+Streaming a validated record in small chunks avoids allocating its whole declared payload. Docker record boundaries and CBOR frame boundaries are independent: a control frame can span records, and a record can carry bytes belonging to successive control frames. Rustack's existing ControlClient already preserves CBOR partial reads through retained IO; the outer decoder must preserve those bytes without relaxing its own validation.
+
+## Diagnostic dispatch
+
+Request-body TRACE runs while `process_request` constructs its future, before that future is polled: `vendors/bollard/src/docker.rs:1580`. Model response DEBUG occurs after body collection at `:1738`. Truncated log EOF DEBUG includes the trailing buffer at `vendors/bollard/src/read.rs:110`.
+
+Wrapping only an already-constructed future is insufficient for synchronous stream builders. A dependency filter must cover construction and every poll, including spawned HTTP/stream workers. Errors must also avoid formatting arbitrary daemon messages or source payloads into infrastructure output. These observations refine W01; they do not establish that W01's production consumer is already implemented.
+
+## Reusable contracts
+
+The generated `bollard-stubs` package contains Serde models and query shapes independently of the network client. The release pins version `1.53.1-rc.29.3.1` with default features disabled in `vendors/bollard/Cargo.toml:65`. Its model/query sources are `vendors/bollard/codegen/swagger/src/models.rs` and `query_parameters.rs`. Those types are useful without adopting the response collector, attach decoder, socket discovery, SSH or TLS features.
+
+The upstream API negotiation behavior at `vendors/bollard/src/docker.rs:1537` selects the lower supported version after reading the daemon version. Rustack should preserve the observable version compatibility while validating the bounded version response and rejecting an incompatible minimum. Do not infer the runtime API version only from a README example; the release's actual constant and generated model pin are more precise.
+
+## Outcome for the specification
+
+Use the generated model/query contracts, with a small bounded Unix HTTP/upgrade adapter for the exact Docker operations in this feature. Keep container/deployment ownership above that adapter. The component design, including concrete quotas, connection supervision and error behavior, belongs in [runtime §3.6](../../specs/rustack-workflows-20-lambda-runtime-design.md#36-bounded-docker-api-boundary), not in this research memo.
+
+The earlier production suggestion to use Bollard's ordinary pipe client is superseded by D19; the retained P0 driver remains valid as a feasibility experiment. This is an in-phase transport refinement, not a request to rewrite the Docker API or support another container platform.
+
+Required implementation evidence remains bounded fake-daemon tests, actual attach/large-payload/truncation checks, TRACE capture and the established arm64/amd64 RIC lanes. No unresolved source assumption authorizes bypassing those tests. A source review is not proof that the forthcoming bounded adapter works.
+
+## Implementation follow-through
+
+P1 now reuses only generated bollard-stubs models in production. DockerWire owns bounded version/info/image inspection, typed container create/start/inspect/kill/wait/remove/list and strict upgraded attach. Its actor retains request jobs after caller cancellation; ordinary HTTP drivers are aborted/joined or recover/drop their one-shot IO, and upgraded drivers join before socket transfer. A separate32-job wait lane prevents long-running lifecycle waits from starving the two destructive-cleanup slots. Deployment actors, log/pull/network/probe consumers, pool policy and provider integration remain required; this is not executor acceptance.
+
+The current workspace and standalone probe align on [Tokio1.54.1](https://docs.rs/crate/tokio/1.54.1) and [Hyper1.12.0](https://docs.rs/crate/hyper/1.12.0), rechecked against official package documentation on2026-10-25. The original Hyper1.11.1 audit remains historical evidence; mandatory task-bound filtering and fragmented trailer tests remain in effect on the updated stack.
+
+A retained compatibility regression calls the actual pinned Bollard0.21.1 create and logs APIs against a fake local Unix daemon under TRACE with LogTracer enabled. It covers synchronous stream construction, asynchronous request/response polls and the decoder's truncated-EOF Console fallback. Test-only markers in request environment, response warnings, container target and trailing bytes are absent from infrastructure capture while an application event remains present. The production boundary independently captures create requests, response bytes/headers and fragmented trailers. These are executed call-site tests, not only synthetic logging-target tests.
+
+The explicit `make test-lambda-docker-wire` target builds the real relay and unchanged official Python RIC image and uses DockerWire for daemon IO without the Docker CLI. It sends and receives6MiB-minus4096-byte-class data through actual multiplexed attach, checks computed warm results and a handler error, closes/joins the relay stream and verifies the run-label scope is empty after removal. Stress qualification uses60s IO/120s attempt budgets; it does not establish default5s latency or throughput. The existing five-test `test-lambda-runtime-docker` suite remains a separate relay-contract regression. Exact platform results and current review state are recorded in [verification](../../specs/rustack-workflows-70-verification-plan.md) and [implementation review](../../specs/rustack-workflows-93-review.md).
+
+## Platform-specific image identity follow-up
+
+The2026-10-25 Engine29.5.2/containerd-store inspection of the local official-RIC fixture disproved an overly broad reading of the generated Id field's historical config-ID description. Unqualified inspect returned an OCI index descriptor and the same digest as Id. Platform-qualified inspect returned a different Id and a single image-manifest descriptor for Linux arm64, while RepoDigests still named the parent index. The manifests view also included a separate attestation descriptor. Neither the parent Id nor the first RepoDigests string alone identifies the selected executable child.
+
+The [official version history](https://docs.docker.com/reference/api/engine/version-history/#v149-api-changes) and [CLI inspect documentation](https://docs.docker.com/reference/cli/docker/image/inspect/) pin platform-qualified inspection to API1.49+. The platform argument is JSON-encoded OCI platform data and cannot be combined with manifests=true. Generated contracts distinguish descriptor/manifest/platform data at `vendors/bollard/codegen/swagger/src/models.rs:4006`, `:4129` (manifest summary), and the typed image inspect query in `vendors/bollard/codegen/swagger/src/query_parameters.rs`. Descriptor fields and RepoDigests are daemon metadata, not evidence of a successful registry push: BuildKit load can populate RepoDigests even for a short, unpushed local name.
+
+Downstream resolution must request the declared platform when available, validate Linux architecture and an executable effective entry configuration, and reject an unresolved index or attestation as executable metadata. Older compatible API lanes may inspect legacy single-platform images but cannot silently accept an unresolved index. A registry URI must distinguish its repository/index evidence from the selected child descriptor; short local references retain the explicit local URI extension. The implementation contract and tests belong to runtime §2.8/D21. This is identity correctness evidence, not qualification of arbitrary cross-architecture emulation or registry pulls.
+
+Independent preflight also identified the Docker create merge boundary: an empty request entrypoint can cause an empty command to be filled from the image. The future create adapter must consume fully materialized validated argv/workdir, with the empty-entrypoint reset sentinel, rather than pass only optional function overrides. Capturing only a metadata hash would lose the defaults needed to do this without per-invoke inspection. Repository evidence comparison also needs familiar Docker Hub name normalization while retaining the original short-local provenance decision. These refinements are recorded as W33/W34 in the review backlog and pinned in §2.8/D21.
+
+The first consumer qualification deliberately tried create by the platform-inspect child Id and failed404 on both retained daemons. A read-only lookup of that still-current child digest also returns404, while the current unqualified parent Id is addressable. Resolution must therefore capture the addressable parent before selecting a platform and create by that immutable parent plus an explicit platform parameter. The selected manifest remains independent fingerprint/registry metadata; it must not be discarded. Rebuilding a mutable tag can also replace its index descriptor, so a later deployment owner must retain artifact availability under its own lifetime policy; missing externally removed content must fail rather than resolve a newer tag.
+
+Independent implementation review additionally requires recomputing saved fingerprints after valid-string mutations, and rejects descriptor-free fallback without positive classic-store /info evidence. A downlevel containerd reply can omit Descriptor while still exposing a nonempty GraphDriver. Classic names must match between inspect and info, manifest summaries must not contradict the fallback, and containerd's driver-type status marker must reject it. These qualifications are explicit compatibility checks, not a claim that an old containerd/GraphDriver spelling proves classic behavior.
+
+### Pinned engine source for merge and legacy-store guards
+
+The newly vendored Moby v28.0.0 is a historical API1.48 source pin, not the source version of the live Engine29.5.2 daemons. Its config merge fills an empty command when the request entrypoint has length zero at `vendors/moby/daemon/commit.go:72`; `vendors/moby/daemon/create.go:302` resets the single-empty-string entrypoint only after merge. This explains why materialized nonempty/reset entrypoints preserve an intentionally empty command. Actual modern-daemon create/inspect regressions verify both clear-command and reset-entrypoint cases.
+
+The same historical source strips Descriptor below API1.48 at `vendors/moby/api/server/router/image/image_routes.go:374`. Containerd nevertheless supplies a GraphDriver name from its snapshotter at `vendors/moby/daemon/containerd/image_inspect.go:117`; a nonempty GraphDriver cannot alone prove classic storage. The info status marker is emitted at `vendors/moby/daemon/containerd/service.go:112`, with the exact io.containerd.snapshotter.v1 value pinned at `vendors/moby/vendor/github.com/containerd/containerd/v2/plugins/types.go:39`. Classic VFS returns nil status at `vendors/moby/daemon/graphdriver/vfs/driver.go:87`. Normalize absent/null DriverStatus after matching classic driver evidence, while rejecting the explicit containerd marker and malformed rows. Fake-daemon/pure metadata tests cover these paths; no execution qualification of an old daemon is claimed.
+
+The final local resolver retains validated execution defaults in Arc storage, recomputes a canonical fingerprint on restore, binds platform inspection to the captured addressable parent Id and passes that Id with explicit platform to actual create. Its61 additional tests cover metadata/defaults/legacy API behavior and valid-value stale-hash mutation. Both real two-case Docker wire suites pass on arm64 VZ and amd64/QEMU. Full workspace1964 tests and standard build/fmt/Clippy/rustdoc pass. Deployment actors, availability leases, allowed pulls, unpacked-image quota proof and pool/provider integration still belong to the remaining P1 work.
+
+## Image pin and unpacked-size consumer preflight
+
+Pinned Moby's containerd tag path targets a resolved descriptor at `vendors/moby/daemon/containerd/image_tag.go:18`; the create/replace helper at:37 establishes the alias before later event/dangling-name work. This permits visible matching alias evidence to establish a tag commit after a lost response, while absence cannot establish that an unobserved tag will never commit. Cleanup must never replay Tag as a barrier.
+
+Image delete by repository reference removes that reference, and force/prune flags govern additional deletion at `vendors/moby/daemon/containerd/image_delete.go:24`. Rustack's adapter therefore accepts only allocated private-pin identities, never a caller source tag or content ID, and disables force/ancestor pruning. Published metadata still uses the original requested URI.
+
+The generated manifest summary explicitly separates compressed/content, unpacked image data and total storage at `vendors/bollard/codegen/swagger/src/models.rs:4236`. The real fixture's selected content size and unpacked size differ substantially. Modern quota proof must match the selected image summary by digest/platform and read ImageData.Size.Unpacked; a compressed Size or Total is not the same measurement. Legacy fallback remains restricted to verified classic storage. No image handler needs to run to obtain this metadata for already unpacked images; unavailable proof is an explicit preparation failure.
+
+Fresh-alias Tag preflight returns400/404 before mutation in the pinned Engine router at `vendors/moby/api/server/router/image/image_routes.go:472`; success201 follows backend return at:491. Classic reference validation precedes mutation at `vendors/moby/reference/store.go:125`; post-mutation storage failures map to500. The manager therefore treats only exact400/404 and local wire Busy as known no-effect rejection.
+
+A full500 response is still not a commit barrier. The containerd client invokes a remote Create at `vendors/moby/vendor/github.com/containerd/containerd/v2/client/image_store.go:73`; Moby wraps Create errors as System at `vendors/moby/daemon/containerd/image_tag.go:45`. The remote metadata update enters a database transaction at `vendors/moby/vendor/github.com/containerd/containerd/v2/core/metadata/bolt.go:54`, which does not establish that a cancelled/disconnected client's observed error stopped server commit. Keep HTTP500 in the uncertain phase and test a complete outer error followed by initial404 and a later matching alias commit. Do not replace retained quarantine with an HTTP-status-only completion assumption.
+
+The owned preparation consumer now implements that contract with bounded job/pin budgets, private-only tag/removal keys, shared release channels, phase registry/retained joins, a separate two-slot cleanup semaphore and emergency phase recovery on the captured runtime handle. The real harness keeps acquired artifacts through actual RIC calls and container retirement before joining pin cleanup. Both arm64 VZ and amd64/QEMU two-case suites pass; independent scoped image queries are empty afterward.33 new unit/lifecycle cases pass within321 Lambda core tests, plus76 core doctests; the workspace has1,997 passing tests and standard build/fmt/Clippy/rustdoc gates. Provider status/CAS, leased invocation capture, previous-run coordination, allowed pulls and the production executor remain required P1 consumers.
+
+## Persistent daemon identity for historical cleanup
+
+The vendored Moby v28.0.0 source at daemon/id.go:12–34 loads engine-id from its data root or atomically publishes a random UUID; daemon/info.go:54 exposes that installation identity as /info.ID. The [current upstream implementation](https://raw.githubusercontent.com/moby/moby/master/daemon/id.go) has the same persistence contract (checked2026-10-27). This source is not an authenticated identity scheme, and copied/reset engine IDs cannot identify distinct installations safely. The selected modern profile requires canonical nonnil UUIDs rather than guessing from hostname/path/version. Both retained Engine29.5.2 daemons return distinct canonical UUIDs; those live values are intentionally not recorded here.
+
+Rustack's wire opens a fresh Unix connection for every operation. Therefore a prior /info call on a separate socket cannot establish the identity of a later404 or mutation. D76 requires checking ID on each exact HTTP connection, before actual issuance, and never reconnecting after the checked peer closes. Persist the owner/daemon pair before first effect, refuse first binding over either nonempty journal, and carry a private exact-lease binding through ports/envelopes. Source contracts guide the design; actual bound recovery/provider/attach tests supply independent functional evidence. See [runtime§4.9](../../specs/rustack-workflows-20-lambda-runtime-design.md#49-durable-daemon-binding-and-connection-local-identity-fences).
+
+## Complete observed namespace inventories
+
+Pinned Moby daemon/list.go:435–438 stops the container iterator at a positive Limit; the existing Rustack operational limit64 query therefore cannot prove absence of additional owned resources. Use an all-state owner filter without that limit for the startup audit. Pinned image_list.go:161–182 filters individual references using distribution/reference.FamiliarMatch; helpers.go:36 delegates to path.Match, so slash-limited globs do not prove an arbitrary-depth reserved-prefix absence. The [official container listing documentation](https://docs.docker.com/reference/cli/docker/container/ls/) distinguishes all-state and last-N listing, and the [image listing documentation](https://docs.docker.com/reference/cli/docker/image/ls/) documents filtering and dangling-image behavior (checked2026-10-27).
+
+D77 therefore drains recorded effects through the existing identity-checked recoverers, then checks an untruncated owner-container list and a bounded full image-tag prefix scan. Unrecorded owned observations block admission without adoption: a name or label is not a substitute for durable mutation intent. These observations are not retroactive proof of unseen legacy effects and do not grant production readiness. See [runtime§4.10](../../specs/rustack-workflows-20-lambda-runtime-design.md#410-recorded-namespace-retirement-and-complete-observed-inventories).
+
+ImageSummary requires RepoTags in pinned api/swagger.yaml:2230 and the [current upstream schema](https://raw.githubusercontent.com/moby/moby/master/api/swagger.yaml) (checked2026-10-27). A minimal projection may ignore unrelated extension fields, but must not default a missing RepoTags field to empty. Explicit null retains the existing generated-client legacy vector compatibility; malformed/missing data fails before an empty-inventory claim. W223 records this specification correction and its HTTP regression.
+
+## Controlled pull transport preflight
+
+Pinned Moby image_routes.go:35–104 parses fromImage/tag/platform and decodes X-Registry-Auth, then calls backend PullImage; its post-progress error path emits an in-band error after headers/bytes may already have succeeded. Bollard image.rs:120–155 converts streamed errorDetail to failure, confirming that HTTP200 alone is insufficient. A bounded consumer must parse each line, discard progress and join the same HTTP driver, rather than aggregate the stream through ordinary metadata collection. The classic backend's image_pull.go:32–51 can only warn about a platform mismatch; Rustack must still validate selected image metadata itself. Remote cache activity after cancellation is not an owned-container retirement proof.
+
+The [current secrecy documentation](https://docs.rs/secrecy/latest/secrecy/) confirms0.10.3 remains current (checked2026-10-27); reuse the existing workspace cohort and explicit ExposeSecret access, wipe temporary encoded-source JSON and keep sensitive headers/filtering. No ambient Docker configuration or credential helper belongs in the runtime. See [runtime§2.14](../../specs/rustack-workflows-20-lambda-runtime-design.md#214-controlled-if-missing-pulls-and-retained-progress-transport).
+
+
+The real pull fixture uses `public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79`, selected from the public `:24` manifest list on2026-10-27. The anonymous registry response is772bytes with media type application/vnd.docker.distribution.manifest.list.v2+json; SHA-256 of the raw manifest body gives the pinned digest. Its entries advertise linux/arm64(v8) and linux/amd64. [AWS's Node.js container guide](https://docs.aws.amazon.com/lambda/latest/dg/nodejs-image.html) identifies the public Lambda repository and Node.js24 base. This is an explicit qualification source, not an implicit runtime catalog; callers still choose and allowlist their source. No anonymous registry token or ambient credentials are retained. The initial real preparation reported cacheMiss=true on each dedicated daemon, and a second explicit endpoint call exercises warm pulls. Successful preparation proves selected-platform/default/unpacked/pin validation; this base-image pull test does not execute a Node handler. Existing independent RIC/executor/pool gates establish actual function computation separately. Cache layers/source refs remain daemon-owned and are intentionally retained; complete-prefix postconditions must still show zero runtime private aliases.
+
+
+## Private registry YAML configuration preflight
+
+The existing config0.15.25 dependency resolves yaml-rust2~0.11.1. The [current YAML event API](https://docs.rs/yaml-rust2/latest/yaml_rust2/parser/enum.Event.html) distinguishes scalars/styles, anchors/tags, maps/sequences and document boundaries; pull events permit immediate rejection of unsupported structure. The [current changelog](https://raw.githubusercontent.com/Ethiraric/yaml-rust2/master/CHANGELOG.md), checked2026-10-27, lists0.12 dependency/MSRV/Marker documentation changes and0.13 an encoding_rs MSRV pin;0.11.1 contains the short-document infinite-loop fix. Reuse that already installed cohort and its pull parser for the fixed shallow credential schema; no second parser/tree or new package version is required. Secret values require quotes, are converted immediately to secret types and never enter raw-event diagnostics. Descriptor-based local private-file loading belongs in retained bounded blocking workers, not config's general plaintext Value tree. See [operations§1.8](../../specs/rustack-workflows-60-operations-design.md#18-validated-docker-settings-and-private-registry-credential-files).
+
+
+D79's loader uses safe nix OwnedFd open/openat/fstat/read in retained four-worker blocking jobs, preserving input/result permits through observer loss and zeroizing its owned source buffer. Mode/UID checks do not evaluate ACLs; operator-controlled ACLs remain explicit trust preconditions. The enhanced actual pull fixture creates only its own0600 empty auth map, then consumes shared settings→typed settings→loaded anonymous policy. Both retained daemons exercise warm public preparation; nonempty selected auth is independently checked in the scripted bound-wire preparation test, not claimed as a successful private-registry login. Existing [url2.5.8](https://docs.rs/url/latest/url/) and proptest1.12.0 workspace cohorts are direct consumer/test edges only; [current proptest documentation](https://docs.rs/proptest/latest/proptest/) was checked2026-10-27 and no package version is changed.
+
+
+## Container-origin endpoint and TLS preflight
+
+The [current stable rustls metadata](https://docs.rs/crate/rustls/latest) identifies0.23.46 with explicit aws-lc support, matching the existing workspace cohort. [tokio-rustls](https://docs.rs/tokio-rustls/latest/tokio_rustls/) is now0.26.6; update its compatible patch cohort from0.26.5 and avoid a second version. [webpki-roots](https://docs.rs/webpki-roots/latest/webpki_roots/)1.0.11 embeds Mozilla roots and requires rebuilding to refresh them. Own the TLS/HTTP future, disable any ambient proxy/redirect/retry discovery and select the aws-lc provider explicitly even if unrelated workspace clients enable ring. Dev-only [rcgen0.14.10](https://docs.rs/rcgen/latest/rcgen/) generates ephemeral test keys/certificates without committed credentials; enable only crypto/aws_lc_rs. All versions/API choices checked2026-10-27. A container-origin GET that independently observes the gateway's expected instance is a reachability/misrouting proof, not endpoint authentication. TLS adds normal certificate/name verification. See [runtime§4.11](../../specs/rustack-workflows-20-lambda-runtime-design.md#411-container-origin-gateway-reachability-evidence).
+
+[Lima's default user network](https://lima-vm.io/docs/config/network/user/) documents host.lima.internal/host networking; this guides the retained Colima fixture only. Tests still require an explicit function-visible host and actual successful network observation, never infer readiness from a VM address or host-side TCP success. Operator bridges and temporary listeners have exact fixture owners and are removed only after all attached environments settle. Production's default gateway bind remains unchanged.
+
+
+## Production startup ownership preflight
+
+[Tokio's current JoinHandle source](https://docs.rs/tokio/latest/src/tokio/runtime/task/join.rs.html) and [watch receiver contract](https://docs.rs/tokio/latest/tokio/sync/watch/struct.Receiver.html), checked2026-10-27, distinguish observer cancellation from owned task lifetime. Retain accepted lower owners before dependent effects, forbid replay after an abandoned qualification, and reuse the existing CleanupTask for one resumable ordered shutdown on the captured runtime. [Stable File locking](https://doc.rust-lang.org/std/fs/struct.File.html) retains exclusion through descriptor lifetime, not pathname existence; producer provenance must be immutable and cannot be invented by scanning an empty namespace. Add a new owner magic as a downgrade barrier and reject legacy/unexplained owner-missing state for production admission. Existing [nix0.31.3 directory APIs](https://docs.rs/nix/0.31.3/nix/dir/struct.Dir.html) provide safe descriptor-relative enumeration for bounded first-publication checks; enable only its existing package's dir feature, with no version change. See [runtime§4.12](../../specs/rustack-workflows-20-lambda-runtime-design.md#412-production-startup-provenance-and-retained-owner-composition).
+
+
+## Independent custom RIC consuming preflight
+
+The [official Runtime API](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html) defines the request identity received by GET /next and used by response/error posts. The [ImageConfig schema](https://docs.aws.amazon.com/lambda/latest/api/API_ImageConfig.html) allows empty argv arrays, so a real fixture must distinguish absent/cleared/replaced image defaults and inspect actual argv/cwd. Checked2026-10-27. D82's independent custom Rust binary consumes this protocol without linking Rustack session/relay code; the digest-pinned provided.al2023 base supplies Linux userland only. Its computed result, process counter and image environment marker qualify actual handler execution, not a second control-plane model.
+
+[Current ureq documentation](https://docs.rs/ureq/latest/ureq/) identifies3.5.0 with a changed builder/body API. D82 reuses the existing fixture package's already-locked2.12.1/no-default-features cohort without adding a dependency/version or TLS implementation. Its existing local AgentBuilder source was inspected for explicit proxy disabling, bounded IO and status errors. This is an HTTP-only test RIC using a validated injected loopback address and explicit private collector, not the production gateway HTTP/TLS client. The production aws-lc/WebPKI choices remain unchanged.
+
+A concurrent SDK call or sleep is not evidence that two handlers simultaneously consumed their requests. The two-stage bounded collector observes both active IDs before sharing foreign IDs, then requires both actual rejection reports before releasing either valid completion. The same barrier holds published A across a Successful latest B update. Operator-side mutable source aliases have unique intents separate from runtime-private pins; retained evidence, exact CLI waiters, positive target checks and joined unwind controls prevent a failed test from silently dropping cleanup authority. See [D82 qualification](../../specs/rustack-workflows-70-verification-plan.md#custom-rust-ric-and-immutable-image-revision-qualification-d82).
diff --git a/docs/research/study-localstack-workflow-tests.md b/docs/research/study-localstack-workflow-tests.md
new file mode 100644
index 00000000..b36d3ffa
--- /dev/null
+++ b/docs/research/study-localstack-workflow-tests.md
@@ -0,0 +1,143 @@
+# Study: Running LocalStack workflow tests against Rustack
+
+Date: 2026-11-01. Vendor: `vendors/localstack` at `45dfee8ce27df00fcac3f91b8071c8156eb5c5c7`. Scope: external workflow compatibility evidence, continuing P5. No live AWS execution is implied.
+
+## Decision
+
+Run original upstream pytest methods with original AWS snapshots, using a separate fixture plugin and explicitly selected node IDs. Do not extract expected values into new Rustack-authored assertions, replace the ASL evaluator, or import the upstream root conftest. Keep the vendor pin unchanged.
+
+```text
+┌─ Fixed upstream inputs ───────────────────────────────┐
+│ pytest methods │ JSON5 templates │ AWS snapshot files │
+└─────────────────────┬────────────────────────────────┘
+                      ▼
+┌─ Rustack-owned test boundary ─────────────────────────┐
+│ exact node inventory + provenance                     │
+│ endpoint/client + resource lifecycle fixtures         │
+│ private snapshot copies; update/skip-all forbidden    │
+└────────────┬──────────────────────────┬───────────────┘
+             ▼                          ▼
+     Signed boto3 requests      Upstream snapshot verifier
+             │                          ▲
+             ▼                          │
+     Actual Rustack gateway ── observed responses
+             │
+             ▼
+     Owned real Docker Lambda, where selected
+```
+
+## Relevant upstream boundaries
+
+- `tests/conftest.py:10` registers plugins that can start LocalStack. Bypass it with pytest's `--noconftest`, disable automatic plugin loading, and load only the compatibility and snapshot plugins.
+- `localstack-core/localstack/testing/pytest/stepfunctions/fixtures.py:24` adds the upstream Step Functions transformers to the snapshot session. Preserve those transformers and the method-level transformations.
+- `localstack-core/localstack/testing/pytest/stepfunctions/fixtures.py:179` creates IAM roles; Rustack treats execution-role ARNs as validated metadata. The adapter supplies a fixed local role only for tests that do not assert IAM behavior.
+- `localstack-core/localstack/testing/pytest/stepfunctions/fixtures.py:273` creates machines and later stops executions/deletes machines. The adapter must retain those resources immediately and propagate cleanup failures rather than logging and continuing.
+- `localstack-core/localstack/testing/pytest/stepfunctions/utils.py:576` drives actual Create/Start/Describe/History requests. Reuse it unchanged; this is an external client, not the LocalStack interpreter as Rustack's executor.
+- `tests/aws/services/stepfunctions/v2/intrinsic_functions/utils.py:14` executes each original input and snapshots full history. `choice_operators/utils.py:79` constructs definitions and snapshots input/output pairs. Their differing assertion scopes must remain visible.
+- `tests/aws/services/lambda_/test_lambda_api.py:1699` uses ECR-created alpine/debian images for metadata CRUD. These are not interchangeable with real-RIC invocation fixtures: unsupported ECR/packaging assumptions require an explicit exclusion rather than silently mapping arbitrary image requests to another image.
+
+The pinned snapshot0.3.4 plugin calls its persistence hooks, but baseline/raw writes occur only in update/raw modes; ordinary verification does not generate a validation file. Override its session fixture to copy the original snapshot into a private evidence directory, retaining the original node ID, and save our own observations/assertions there. Never point update/raw persistence at the vendor tree. Record hashes before and after, including templates and handler sources used by the selected tests.
+
+## Adoption rules
+
+Preserve test bodies, parameterization, expected snapshots, and existing upstream normalization/exclusion markers. Reject snapshot-update, snapshot-raw, skip-all, unexpected collection changes, xfail and runtime skips in the required inventory. Do not add masks after observing a semantic mismatch. Separate intentional profile exclusions from compatibility failures.
+
+For real handler integration, preserve original handler source. Building that source into a preprovisioned Python RIC image is a declared packaging adaptation; it does not establish managed Python ZIP runtime parity. Callback handlers must use explicit local service endpoints and credentials. No request may fall back to a real AWS endpoint.
+
+The image runtime remains Python3.12 to match upstream requests. An explicit read-only ECR manifest lookup on2026-11-01 UTC pins its Linux arm64 manifest to `ab3f7e33c838a04d8750648f4cd1250ef8c20f6137904a3bbccd90da95e4157a`. The [official AWS image documentation](https://docs.aws.amazon.com/lambda/latest/dg/python-image.html) describes the packaged RIC/AL2023 runtime. Each original handler receives its own image at `/var/task/handler.py`, preserving module/traceback names. Buildx metadata binds either the OCI image digest or configuration digest to the observed daemon-addressable ID, without assuming quiet stdout has the same identity. Fixed recipe/source/intent/metadata/result hashes are checked before execution.
+
+## Evidence limits
+
+The existing semantic-oracle memo inspected selected upstream observations but did not execute this suite. A new run reports original pytest node IDs, AWS snapshot recording dates, exact collection and outcomes, source/fixture/package hashes, and physical cleanup. This establishes compatibility for the selected inventory only. Desktop, dedicated reference, broader AWS functionality and final release acceptance remain separate requirements.
+
+
+## First execution findings
+
+Collection is a separate gate before the server starts. The pinned snapshots contain removed class/method IDs and four removed Lambda parameter IDs (`None`/`json_value7` in direct and optimized JSON-value methods). The actual selected inventory is91 pure and32 Docker nodes. Obsolete IDs remain documented in the manifest; no executed failing case was removed.
+
+Adapter faults were fixed before interpreting product outcomes: use the original AWS snapshot fixture's base transformations and extended transformer utility, and accept the role factory's original keyword argument. Source drift, muted assertions, altered image-build receipts and failed API cleanup remain failing controls.
+
+Original full histories exposed real profile corrections: initial predecessor0, captured RoleArn, serial Map admission from the prior processor terminal, shared Map success/exit predecessor, and suppression of retried Parallel failure markers. The original Parallel transformer itself removes the success marker and normalizes branch event IDs; its passing assertions establish the preserved exit predecessor and remaining assertions, not complete graph parity. Failed ResultSelector handling remains a separately tested local policy.
+
+Three pure methods mix intentional formal-profile restrictions into otherwise overlapping scenarios: context-object Format substitutions, unescaped literal braces in a nested StringToJson call, and empty/whitespace StringToJson input. The initial run also exposed valid integer -0 becoming float -0.0; W444 fixes that independently, including nested values and quoted/exponent preservation. The [formal ASL rules](https://states-language.net/spec.html) prohibit object/array Format Path substitutions and require reserved braces to be escaped; StringToJson applies a JSON parser. Keep those original failures visible while the scope decision is pending; no new ignore path or xfail is introduced.
+
+Real RIC execution additionally exposed optimized Payload double encoding/null defaults, function-error Cause whitespace, optimized service-failure event ordering, and optional timeout fields. Correct these in production rather than altering fixtures. The original optimized-class HTTP metadata exclusions remain the upstream markers. Static redacted service Cause text and unsupported redrive metadata remain distinct from these in-profile corrections.
+
+
+## Reproduction commands
+
+`make workflows-localstack-python` provisions the exact isolated Python dependencies plus the editable pinned upstream import package. `make check-workflows-localstack` runs integrity controls and strict Clippy on the new Rust owner. `make workflows-localstack-images WORKFLOWS_LOCALSTACK_IMAGES=<new-absolute-directory> WORKFLOWS_LOCALSTACK_BUILDER=<absolute-buildx> WORKFLOWS_DOCKER_SOCKET=<explicit-socket>` builds the six original handlers with immutable receipts. Evidence directories must be new, canonical and private.
+
+Run `make test-workflows-localstack-pure WORKFLOWS_LOCALSTACK_EVIDENCE=<new-absolute-directory>`. For actual Docker, use `make test-workflows-localstack-docker WORKFLOWS_LOCALSTACK_EVIDENCE=<new-absolute-directory> WORKFLOWS_LOCALSTACK_IMAGES=<image-receipt-directory> WORKFLOWS_DOCKER_SOCKET=<explicit-socket> LAMBDA_RUNTIME_IMAGE=<qualified-relay-image>`. Targets retain nonzero failure status for any original assertion mismatch, including a documented profile difference; classification never turns a failed case green. These opt-in targets do not start LocalStack or call live AWS.
+
+
+The original `TestTimeouts` class excludes `$..redriveCount` and `$..redriveStatus`. Thus its now-passing global-timeout snapshot verifies the remaining DescribeExecution fields, including error/cause omission, but does not establish redrive behavior. These paths originate upstream and are recorded in each assertion receipt; the adapter adds none.
+
+
+## Final source-cohort verification
+
+This section preserves the pre-D114 baseline; [the qualified D114 continuation](#d114-qualified-source-cohort) supersedes its compatibility status without changing its receipts.
+
+Frozen source `c16d68e41d4ee7177adcf895fec201f3d0269d796a17058aae026fa7778aa282` covers1232 execution/tooling files. The actual standalone server binary is SHA256 `88f70bace2a1acb2c0927a3f0b36f53265901f742dc27620d57faae87c387ae8`. The manifest SHA256 is `b4d9750a9fe868cb60c1f6ebb696405b3976ff05214872a56044af36bf3d6fdb`, binding42 selected upstream files plus the unchanged vendor commit.
+
+| Lane | Result | Retained evidence below `/Users/tchen/.target/` | Report SHA256 |
+|---|---|---|---|
+| Rust | All15 gates pass; all child groups joined | `workflows-localstack-rust-sixth` | `6fc6bb81a4e2c471acc22b94b8446eaa3a45a54d4497f5949c4acb115a1d65fb` |
+| Native / Action |3121 Rust passes in41 summaries;19 explicitly gated resources;26 actual Action Python controls pass; both commands joined | `workflows-localstack-native-fifth` | `edab09dd163d608f2b43911d4c26234377db9144c073741e213d28644eb363a7` |
+| Original pure pytest |88/91 pass; strict target exits nonzero | `workflows-localstack-pure-tenth` | `e4cb7cddf6620463860e63407b48740d87a557fe5b58d06cd697af47ee1f5f68` |
+| Original Docker pytest |30/32 pass; strict target exits nonzero | `workflows-localstack-docker-eighth` | `7fc2f0882143cf15a760386a0ecffea00dc3a80533c4ba8e374f41cdd7f20c93` |
+
+The13 adapter controls and strict Clippy for the new owner pass via `make check-workflows-localstack`; raw output is `/tmp/rustack-localstack-controls-seventh.log`. Strict production-core/library checks and the SDK's existing pedantic gate pass. The final core library has937 passing unit tests; the targeted actual service SDK run passes10/10 before the complete Native rerun. All current-source reports share the same source identity. This is an implemented external probe lane with measured compatibility gaps, not successful strict-compatibility acceptance.
+
+Both external server cleanup receipts confirm successful server exit, joined capture tasks, unchanged binary and absent owned resources. Docker additionally performs the real namespace audit; pure execution does not claim a Docker audit. Every node's setup/teardown passes; there are no xfails or skipped selected nodes. Baseline copies and upstream bytes remain unchanged. Packaging is original Python3.12 handler source in six real RIC images, not managed ZIP/ECR lifecycle equivalence.
+
+The Docker engine is the task-owned native ARM64 VZ profile `rustack-localstack-compat-arm64`, ID `575aa85f-ebb2-4150-a089-201e40f4d035`, with an explicit Unix socket. Existing stopped Rustack VMs were not restarted, the unrelated `reshape-build` profile was untouched, and the default context was not activated. The immutable relay import retains its original archive/ID and import receipt. The six-handler image receipt `workflows-localstack-images-second/images.json` has SHA256 `e8e920ee90dac79b5321115b2efd04574d9113c07e3255ad4d508807317d7edb`; build recipes, original handler hashes, metadata/results and live image IDs remain bound to that engine. Images and private evidence are retained for review; no prune or foreign-resource deletion occurs.
+
+### Remaining original assertions
+
+| Original class/method | Recorded mismatch | Disposition |
+|---|---|---|
+| `TestGeneric::test_context_json_path` | Object substitution in Format expects a historical map-like string | Preserve formal scalar-only Format profile |
+| `TestJsonManipulation::test_json_merge_escaped_argument` | Unescaped reserved literal braces accepted by the historical oracle | Preserve formal intrinsic escaping validation |
+| `TestJsonManipulation::test_string_to_json` | Empty and whitespace-only JSON become null in the historical oracle | Preserve strict JSON parsing; all eight other inputs, including integer -0, match |
+| `TestTaskServiceLambda::test_no_such_function` | AWS SDK-style Cause text versus the bounded static local service cause | Error class and complete event sequence match; exact diagnostic text remains different |
+| `TestTaskServiceLambda::test_no_such_function_catch` | Same Cause text propagated through Catch | Preserve the original failed assertion and local diagnostic policy |
+
+These five selected methods remain in the exact inventory and still fail their original assertions. No new mask, regenerated baseline, xfail or post-failure removal is introduced. They are118 passing nodes out of123 selected nodes, not a96% project-completion or full-AWS-coverage claim. The optional scope question received no answer during execution, so the existing formal profile remains unchanged. Expanding historical behavior requires a separate explicit profile decision; this record does not waive design61's strict successful-inventory exit criterion.
+
+### Failed attempts and interpretation
+
+All earlier directories and raw logs retain their original contents. Pure-first rejects stale snapshot node IDs in preflight; pure-second exposes the adapter's missing AWS transformer fixture; pure-third passes37/91, pure-fourth78/91, and pure-fifth through ninth88/91. Docker-first rejects four removed parameter IDs before server creation; Docker-second passes13/32, and Docker-third through seventh30/32. These outcomes are neither erased nor restamped with the final source.
+
+Rust-first and second deliberately retire after six passing gates to finish independent-review/strict-lint corrections; Rust-third through fifth pass all15 under their original source seals. Native-first fails the expanded start function's strict length lint; Native-second finds the superseded optimized Payload oracle; Native-third finds stale root-entry/timeout SDK oracles; Native-fourth reaches a strict documentation lint in the new helper comment. W438–W446 and the comment are corrected before the final frozen rerun. Direct broad Python discovery reports284 cases with17 missing-Action-fixture setup errors; the actual Action owner subsequently runs and passes all26 controls with its required fixture wiring. An exploratory extra-boundary SDK Clippy invocation exposes existing fixture indexing lints; the repository's required pedantic SDK gate passes without adding suppressions.
+
+Earlier complete83/83 rootful/rootless matrices belong to the previously recorded implementation source and remain historical component qualification. They were not rerun as current-source full matrices here. Docker Desktop, dedicated physical ARM reference and complete same-commit M4 release acceptance remain open; D100's further-x86-execution waiver remains binding. No live AWS execution, remote CI result, release publication or merge is claimed.
+
+
+## D114 observed-behavior follow-up
+
+The user explicitly selects compatibility with the saved AWS observations over the earlier local restrictions. Original `test_generic.snapshot.json` records context maps as `{Id=..., Name=...}` and `test_format_2` records `{Arg1=1, Arg2=[]}`; the latter remains outside the frozen inventory but is corroborating evidence, not a newly claimed suite pass. LocalStack's `vendors/localstack/localstack-core/localstack/services/stepfunctions/asl/component/intrinsic/function/statesfunction/generic/string_format.py:81–106` recursively uses unquoted map/list values and comma-space delimiters. Java's [AbstractMap representation](https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/util/AbstractMap.html) corroborates the delimiter style but does not establish all AWS key ordering. Explicit lexicographic ordering is the bounded deterministic local choice for unobserved maps.
+
+The [current AWS intrinsic guide](https://docs.aws.amazon.com/step-functions/latest/dg/intrinsic-functions.html), consulted2026-11-01, still documents reserved-brace escaping. D114 intentionally chooses the original successful AWS execution for ordinary string arguments while preserving Format-template placeholder validation. Empty/ASCII-whitespace JSON and missing Lambda Cause details come from the original selected snapshots. Design61 §7 defines the implementation and unchanged exact123-node acceptance; no new live AWS observation or baseline rewrite is implied.
+
+
+## D114 qualified source cohort
+
+The user explicitly authorized matching the five saved AWS behaviors. The same123 original nodes now pass:91/91 pure and32/32 actual Docker, without updating expectations, adding masks, skipping/xfailing nodes or deleting failed cases. Ordinary literal-brace acceptance, recursive collection Format, empty/ASCII-whitespace StringToJson and scoped missing-target Cause are production behavior. Format key order is explicitly deterministic; no unobserved JVM-map-ordering parity is claimed.
+
+Frozen source: `3207a320a329820fa1d0890145c9518b3be6488a3ef402c684667d700e34b226`,1232 files. Actual tested server SHA256: `739d037a172787b8fc3ab37dc7e17bd3e5fc990287780deeafa58df01577dccb`. Original vendor commit and42 pinned upstream files remain unchanged. Manifest SHA256 `539de57601b5c52e3beeff8e0f9c030825f097b9e58287622af65a85344c7b3f` differs only in clarifying that Format2's earlier exclusion was historical selection, not a currently unsupported feature; original group node values are unchanged.
+
+| Lane | Actual final result | Evidence below `/Users/tchen/.target/` | Report SHA256 |
+|---|---|---|---|
+| Rust |15/15 gates pass; all groups joined | `workflows-d114-rust-second` | `5cfecabc520e8c5c196b14db590fcc55d566cded7028349d04af4ffdf83e181b` |
+| Native / Action |3231 Rust passes across42 summaries,19 gated resources;26 actual Action controls pass; both commands joined | `workflows-d114-native-second` | `4cba17cba8b9d60907128370378da144713812d794b5a592f792569acb0fb78c` |
+| Original pure |91/91, pytest0, successful=true | `workflows-d114-pure-second` | `a0eea02455043919aff3a150be9692d2455e3d8540c3cf49ecfc20b1024aada4` |
+| Original Docker |32/32, pytest0, successful=true | `workflows-d114-docker-second` | `3374d81ca7e452351700bd3eb342ade77e2fb76984ce8f0ebb97e4d7f0cf36fc` |
+
+All four reports share the source seal. Both external cleanup receipts confirm server/capture joins, successful exit, unchanged binary and absent owned resources; Docker's actual namespace audit is performed. Every setup/call/teardown and original snapshot session passes. Each original expected key is compared, and baseline copies/vendored bytes remain unchanged. The previously failing Cause appears consistently in failed-task and Catch history, with a fresh local RFC/version4 service request identity; successful invocation IDs still come from the real provider.
+
+The same task-owned engine575aa85f-ebb2-4150-a089-201e40f4d035 and explicit socket are used. Six original Python3.12 handlers are genuinely rebuilt from cached immutable inputs under the new manifest into `workflows-d114-images-first`; its image receipt SHA256 is `e25fd654b112bd3ff9f8697cec503772a1297d3a9c7c708715409ced0de70e33`. Source/recipe/metadata/stdout/result/live-image affiliations and joined owners are retained. No old receipt is relabeled; images and evidence remain available, while task containers/volumes/private aliases retire through their original owners. Foreign resources, other VMs and the default context are preserved.
+
+Focused verification passes944 core,30 bridge and96 preserve-order intrinsic tests plus strict production core/library boundaries. `make check-workflows-localstack` passes13 integrity controls and strict owner Clippy; its final raw output is `/tmp/rustack-d114-adapter-controls-final.log`. The first original D114 pure/Docker runs also pass123/123 under their own source. Their paired full gates fail only on an unreadable hexadecimal test literal, subsequently corrected with separators before the final frozen rerun. The earlier targeted sort-style rejection and code-first ownership/dependency findings are fixed without suppressions; no compatibility error is hidden.
+
+The pre-D114118/123 and all earlier failed attempts remain unchanged above. This meets the selected strict design61 acceptance, while preserving the original scope limits: no fresh live AWS execution, whole-upstream-suite claim, managed ZIP/ECR API equivalence, current full83-case rerun, Docker Desktop/dedicated ARM qualification or final M4/release-promotion claim. D100's further-x86-execution waiver remains binding.
diff --git a/docs/research/study-pulumi-process-ownership.md b/docs/research/study-pulumi-process-ownership.md
new file mode 100644
index 00000000..1d4a4fd7
--- /dev/null
+++ b/docs/research/study-pulumi-process-ownership.md
@@ -0,0 +1,80 @@
+# Study: Pulumi CLI and plugin process ownership
+
+Status: Complete · Date: 2026-10-30 · Vendor pin: `vendors/pulumi` @ `874c77a73039cf013d6a685a15293843de2b0e01` (`v3.273.0`)
+
+## Question and decision
+
+Can the D97 IaC consumer safely treat a directly owned Pulumi CLI PID or its process group as ownership of every language/provider process?
+
+**No.** Plugins create independent process groups. Normal Pulumi shutdown owns plugin cancellation and pipe drains, but killing the CLI's group alone does not cover those groups. Run the pinned CLI and plugins inside a managed Image Lambda's existing PID namespace/cgroup. Retain the real Lambda invocation above that process tree, and qualify controller Stop while actual provider/language processes are alive. A second image function supplies the independently observed business computation. This adopts the existing Docker lifecycle instead of adding a host process-tree supervisor.
+
+This study establishes source behavior and the resulting implementation constraint. It does not claim an actual Pulumi lifecycle, CLI binary/container acceptance or process-termination experiment; those are D97's required consumers.
+
+## Architecture map
+
+```text
+┌─ Pulumi CLI / backend cancellation scope ─────────────────────────┐
+│ first signal: cancel        second signal: terminate              │
+│ ┌─ plugin Context / Host ───────────────────────────────────────┐ │
+│ │ retained Plugin handles: RPC connection, kill, wait, pipes     │ │
+│ │   ├── language host process: its own PGID ── Node program     │ │
+│ │   └── resource provider process: its own PGID ── AWS API      │ │
+│ │                                                              │ │
+│ │ Close → interrupt plugin group → existing wait promise        │ │
+│ │       → five-second allowance → group/process kill if needed │ │
+│ │       → drain attached stdout/stderr before releasing sinks  │ │
+│ └──────────────────────────────────────────────────────────────┘ │
+└──────────────────────────────────────────────────────────────────┘
+Outer CLI group kill alone does not run these independent Close paths.
+```
+
+The map describes upstream's ordinary process boundaries. The downstream managed-image choice is specified separately in the [D97 design](../../specs/rustack-workflows-50-iac-design.md).
+
+## Source map and hot path
+
+The upstream [README](../../vendors/pulumi/README.md) describes CLI/SDK-based infrastructure management. The relevant runtime boundary is the CLI's Go plugin abstraction, rather than the Node resource declaration alone.
+
+1. [`Plugin`](../../vendors/pulumi/pkg/resource/plugin/plugin.go#L114) retains RPC connection, streams, a kill function and a wait function. These are lifetime handles; the resource's ARN is not a process-ownership handle. Its internal diagnostic buffer uses a mutex and can emit unstructured plugin output after premature exit. Rustack must keep fixture diagnostics bounded/private and avoid forwarding arbitrary raw provider errors.
+2. The executable path calls `exec.Command`, [`RegisterProcessGroup`](../../vendors/pulumi/pkg/resource/plugin/plugin.go#L597), then `Start`. One goroutine waits for the child and closes its output writers. The completion promise is shared with shutdown; the parent does not create a replacement process to observe completion.
+3. The Unix [group helper](../../vendors/pulumi/sdk/go/common/util/cmdutil/child_unix.go#L48) sets `Setpgid=true`. Its [kill path](../../vendors/pulumi/sdk/go/common/util/cmdutil/child_unix.go#L27) signals the negative plugin PID, targeting that plugin's group. This does not imply membership in the CLI's own group.
+4. The plugin's [once-only kill closure](../../vendors/pulumi/pkg/resource/plugin/plugin.go#L640) first interrupts the plugin group, gives its existing wait promise five seconds, then kills the group and process on expiry. This joins the same launched plugin; a new status lookup is not a substitute.
+5. [`Plugin.Close`](../../vendors/pulumi/pkg/resource/plugin/plugin.go#L746) closes its RPC connection, invokes that kill closure and waits for attached output/error drain channels. Sinks must outlive these drains. Premature-crash diagnostics may include unstructured output, so a successful process exit is not itself a privacy audit.
+6. [`Context.Close`](../../vendors/pulumi/pkg/resource/plugin/context.go#L347) synchronously releases that context's plugins through the host before completing its sinks and tracing lifetime. The [Host contract](../../vendors/pulumi/pkg/resource/plugin/host.go#L82) distinguishes context release, host lifetime and advisory provider cancellation.
+
+The actual CLI [default host](../../vendors/pulumi/pkg/host/host.go#L573) serializes context release with plugin-load request channels, collects matching providers and reference-counted shared runtimes, and joins concurrent close operations. Loads still in flight can remain cached until host close. Its [final Close](../../vendors/pulumi/pkg/host/host.go#L724) takes the exclusive plugin lock, then joins resource/analyzer shutdown before language hosts and closes context servers last. This is why caller-owned host closure remains a backstop, rather than assuming every context release has already seen every load. The [Node language host](../../vendors/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/main.go#L988) also owns its program subprocess: cancellation interrupts it, with a five-second WaitDelay.
+
+For a finite set of launched plugins, ordinary close traverses retained handles and their output completion, rather than scanning arbitrary host processes. This source reading supplies no benchmark or universal bound for a hung CLI/plugin. The five-second allowance is a per-plugin implementation detail, not a Rustack whole-command deadline.
+
+## Cancellation and failure boundaries
+
+The backend [cancellation scope](../../vendors/pulumi/pkg/backend/cancellation_scope.go#L52) registers SIGINT and SIGTERM. The first signal requests cancellation; a subsequent signal requests termination. Its [Close](../../vendors/pulumi/pkg/backend/cancellation_scope.go#L42) unregisters notification and joins the existing signal goroutine. Immediate termination may leave remote resources; local process cleanup and API resource cleanup therefore need separate assertions.
+
+The [generic termination helper](../../vendors/pulumi/sdk/go/common/util/cmdutil/term.go#L98) interrupts a registered group, waits through a caller-supplied cooldown and escalates on expiry. Do not transplant its direct process/group assumption into a claim that every independently grouped plugin belongs to one outer CLI group.
+
+D97's ordinary SDK/ASL server still owns remote state machines and both function resources. A successful IaC destroy must remove the exact target resource. An intentionally interrupted create/update must preserve its private state evidence; the fixture explicitly removes only its known target/controller resources after the tool invocation has physically retired. Process termination must not silently masquerade as a successful IaC destroy. The DIY backend [refuses normal stack removal while non-root resources remain](../../vendors/pulumi/pkg/backend/diy/backend.go#L1092); its [removal path](../../vendors/pulumi/pkg/backend/diy/state.go#L414) moves/deletes current checkpoints and removes history. Audit encrypted provider inputs while the pre-destroy checkpoint still contains the provider, then separately verify post-destroy state and post-removal absence.
+
+## DIY backend operating-system identity
+
+The DIY backend [lock constructor](../../vendors/pulumi/pkg/backend/diy/lock.go#L46) calls `os/user.Current()` before writing its actual lock, and [CurrentUser](../../vendors/pulumi/pkg/backend/diy/backend.go#L1594) also requires the current user lookup to succeed. A numeric Docker USER does not itself register a POSIX account. The constrained fixture image must therefore contain a fixed unprivileged UID/GID1000 passwd/group identity, and pass its nonsecret USER/LOGNAME through the bounded CLI environment. This does not require changing HOME or adopting any host account/database. Actual CLI acceptance must establish that stack initialization progresses with this identity; source reading alone does not prove the cause of a particular command failure.
+
+## Live tmpfs observation
+
+The pinned Moby [container filesystem view contract](../../vendors/moby/daemon/containerfs_linux.go#L30) states that every daemon view has its own private tmpfs mounts; files in the running container's tmpfs are not visible there. [containerArchivePath](../../vendors/moby/daemon/archive_unix.go#L39) uses that view, so GET archive cannot independently inspect this fixture's actual `/tmp` files. D97's actual GET returns404 while its managed invocation remains active. Use an independently initiated fixed-argv, image-pinned read-only Node observer in the existing namespace, then require the same exec to settle successfully before host decoding. The existing container owner remains the physical backstop for any uncertain exec. This correction preserves normal noexec tmpfs, unprivileged/read-only root and no extra mount/socket policy; it does not justify a writable root or a new host supervisor.
+
+The V3 [checkpoint/deployment schema](../../vendors/pulumi/sdk/go/common/apitype/core.go#L123) marks the latest deployment and its resources slice as omitempty. A successful destroy can therefore persist a real current checkpoint without a resources member. Decode omitted resources as an empty collection only after binding the actual file hash and independently observing API deletion. This consumer has already updated its stack, so additionally require its exact stack identity and actual latest deployment/manifest; a blank newly initialized checkpoint cannot qualify. These checks cannot replace the pre-destroy encrypted-provider audit.
+
+## Adopt and avoid
+
+Adopt retained wait/drain ownership and distinct cancellation versus termination. Use fixed CLI/provider/SDK versions and a private local backend, with automatic plugin acquisition and ambient plugin discovery disabled during invocation. Read the actual plugin processes while the tool handler is causally gated, then require disappearance of the tool's exact function/relay pair after Stop while the business pair survives.
+
+Avoid relying on CLI PID absence, one process-group signal, elapsed sleeps or a successful preview as full acceptance. Do not mount the Docker socket into the tool function or let the tool own its container. Keep CLI/plugins preinstalled in the read-only image; writable private state belongs in the normal bounded `/tmp` profile. The image build and actual D97 lifecycle must verify compatibility with that noexec temporary mount.
+
+## Versions and primary API evidence
+
+Checked2026-10-30: the official [CLI installer documentation](https://www.pulumi.com/docs/install/) reports3.273.0; npm metadata independently reports `@pulumi/pulumi`3.273.0 and `@pulumi/aws`7.52.1 with published integrity values. Existing global CLI3.245.0 and unrelated cached plugins are not the new qualification toolchain.
+
+The current [StateMachine API](https://www.pulumi.com/registry/packages/aws/api-docs/sfn/statemachine/) supports the basic STANDARD resource. The [provider reference](https://www.pulumi.com/registry/packages/aws/api-docs/provider/) exposes an `sfn` endpoint override and local-implementation skip flags. [Backend documentation](https://www.pulumi.com/docs/iac/concepts/state-and-backends/) distinguishes explicit refresh from ordinary updates; [CLI environment documentation](https://www.pulumi.com/docs/iac/cli/environment-variables/) documents isolated `PULUMI_HOME` and disabled ambient/automatic plugin acquisition. These are API inputs, not evidence that Rustack has consumed them.
+
+## Remaining executable gates
+
+The D97 design must qualify the pinned image build, actual create/refresh/in-place update/destroy, independent42/46 computations, explicit unsupported-profile rejection, checkpoint/diagnostic credential omission and Stop with active language/provider processes. No source-only result closes task5.3d or final M4 acceptance.
diff --git a/docs/research/survey-stepfunctions-lambda-container-runtime.md b/docs/research/survey-stepfunctions-lambda-container-runtime.md
new file mode 100644
index 00000000..9f039a5a
--- /dev/null
+++ b/docs/research/survey-stepfunctions-lambda-container-runtime.md
@@ -0,0 +1,64 @@
+# Survey: Step Functions and Container Lambda Compatibility
+
+Status: complete documentation survey; no Docker runtime experiment performed · Date: 2026-10-25 · Consumer: [Workflows PRD](../../specs/rustack-workflows-00-prd.md)
+
+## 1. Question and outcome
+
+Can Rustack interpret ASL itself and run the Lambda images deployed by other projects without depending on another AWS emulator? Yes, provided it implements three distinct contracts: workflow semantics, Lambda execution environments, and the invocation bridge. RIE is not a workflow engine; a successfully started container is not a successful invocation.
+
+The existing [Cargo Lambda spike](./spike-cargo-lambda-runtime-execution.md) validates ZIP/bootstrap/Runtime API behavior. This survey adds official protocol and Docker API documentation. No new upstream implementation source was inspected, so no vendor submodule was added. The current `vendors/localstack` directory is uninitialized and is not evidence of an implementation review.
+
+## 2. Inspected repository facts
+
+| Fact | Evidence | Consequence |
+|---|---|---|
+| Executor already supports Native/Auto/Squib; Docker is unavailable | [executor/mod.rs](../../crates/rustack-lambda-core/src/executor/mod.rs), [config.rs](../../crates/rustack-lambda-core/src/config.rs) | Add a backend incrementally; retain disabled default |
+| Runtime API binds host 127.0.0.1:0 per instance | [runtime_api.rs](../../crates/rustack-lambda-core/src/executor/runtime_api.rs) | Changing the container hostname cannot make that host loopback socket reachable |
+| Provider separately rejects Docker | [provider.rs](../../crates/rustack-lambda-core/src/provider.rs:927) | Adding an executor file alone cannot enable invocation |
+| Invocation request omits ImageConfig/ephemeral storage, although versions store them | [types.rs](../../crates/rustack-lambda-core/src/executor/types.rs), [storage.rs](../../crates/rustack-lambda-core/src/storage.rs:115) | Capture a complete versioned execution revision |
+| Cross-service adapters live in the binary | [lambda_s3_bridge.rs](../../apps/rustack/src/lambda_s3_bridge.rs) | Workflow core should not depend directly on Lambda core |
+| Worker lifecycle is independent of snapshot participation | [runtime.rs](../../apps/rustack/src/runtime.rs), [snapshot.rs](../../apps/rustack/src/snapshot.rs) | Register workflow workers, not just an HTTP router |
+
+## 3. Protocol findings
+
+ASL now includes JSONPath, JSONata and variable syntax. The initial release therefore needs an explicit STANDARD + JSONPath profile and precise unsupported-feature diagnostics, rather than an unrestricted ASL claim. [ASL specification](https://states-language.net/spec.html), [workflow types](https://docs.aws.amazon.com/step-functions/latest/dg/choosing-workflow-type.html).
+
+AWS limits definitions to 1 MiB, state payloads to 256 KiB and Standard history to 25,000 events. Inline Map allows up to 40 concurrent iterations. Local memory/concurrency budgets must be separately documented. [Quotas](https://docs.aws.amazon.com/step-functions/latest/dg/service-quotas.html), [Inline Map](https://docs.aws.amazon.com/step-functions/latest/dg/state-map-inline.html).
+
+Ordinary optimized Lambda invocation waits for its synchronous result. Lambda does not support `.sync`, but supports callbacks. Nested Step Functions supports startExecution.sync and .sync:2, with string versus JSON Output respectively. [Integration matrix](https://docs.aws.amazon.com/step-functions/latest/dg/integrate-optimized.html), [Lambda integration](https://docs.aws.amazon.com/step-functions/latest/dg/connect-lambda.html), [nested workflows](https://docs.aws.amazon.com/step-functions/latest/dg/connect-stepfunctions.html).
+
+HTTP success does not establish Task success: Lambda can report FunctionError with HTTP200. Task deadlines differ from Lambda execution deadlines. Current AWS documentation allows explicitly matching States.DataLimitExceeded while excluding it from States.ALL; older statements that it is always uncatchable are insufficient. States.Runtime remains non-retriable. [Error handling](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-error-handling.html).
+
+The Smithy service is com.amazonaws.sfn#AWSStepFunctions, version 2016-11-23, awsJson1_0, SigV4 states. Standard StartExecution is idempotent for a still-running execution with the same name/input; closed or differently supplied input returns ExecutionAlreadyExists. Names remain reserved 90 days after closure. Input is a JSON-bearing string on the wire. [Official model](https://raw.githubusercontent.com/aws/api-models-aws/main/models/sfn/service/2016-11-23/sfn-2016-11-23.json), [StartExecution](https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html).
+
+## 4. Image and Runtime API findings
+
+Images must target Linux, implement the Lambda Runtime API and tolerate a read-only root filesystem. ImageConfig overrides ENTRYPOINT/CMD/WORKDIR at the argv level. Resolve image tags to digests on deployment; moving a tag afterward does not update the function. [Image requirements](https://docs.aws.amazon.com/lambda/latest/dg/images-create.html), [ImageConfig](https://docs.aws.amazon.com/lambda/latest/api/API_ImageConfig.html), [UpdateFunctionCode](https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionCode.html).
+
+Runtime API2018-06-01 defines next/response/error/init-error. Current documentation adds an optional Lambda-Runtime-Invocation-Id: supplied echoes must match, while older RICs can omit it. The proposed release covers single-concurrency Event Functions, not Managed Instances. [Runtime API](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html).
+
+## 5. Docker design evidence and remaining experiment
+
+Docker documents `network=container:<id>` namespace sharing. A small relay can own an environment-local loopback Runtime API and exchange tasks over Docker attach, avoiding host Runtime API publishing. **This full composition is a design inference, not a completed runtime experiment.** P0 must test attach framing/EOF, official RIC behavior, rootless/Desktop limits and cleanup. [Networking](https://docs.docker.com/engine/network/), [rootless](https://docs.docker.com/engine/security/rootless/).
+
+Control transport and handler SDK access are different paths. Docker attach can eliminate host reachability requirements for control traffic; handlers still need an operator-configured reachable gateway endpoint. No published Runtime API port does not mean arbitrary localhost SDK endpoints work inside a container.
+
+## 6. Dependency check
+
+Official documentation returned these versions on 2026-10-25; implementation must recheck them.
+
+| Dependency | Observed version/API | Recommendation |
+|---|---|---|
+| [bollard](https://docs.rs/bollard/latest/bollard/) | 0.21.1; generated query parameters, API negotiation, standalone pipe feature | Replace the old ~0.18 guidance; initial transport uses pipe only, no remote Docker |
+| [winnow](https://docs.rs/winnow/latest/winnow/) | 1.0.4 parser combinators | Parse bounded Path/intrinsic grammar rather than embed a general expression engine |
+| Tokio/bytes/ciborium/thiserror/serde/config/uuid | Already present in workspace | Reuse existing dependencies before adding a database or another async runtime |
+
+This survey is not a completed vulnerability audit, MSRV check or release build. New dependencies still require AGENTS.md audit/deny and feature review.
+
+## 7. Risk closure artifacts
+
+P0 must produce `spike-lambda-container-relay.md` for netns/attach/official RIC/native architectures, and `spike-stepfunctions-semantic-oracle.md` for source hashes, SDK versions and semantic fixtures. These are planned artifacts, not existing passing evidence. The implementation plan assigns their exit gates.
+
+## P0 follow-up
+
+The implementation run initialized the existing LocalStack gitlink without moving it, executed the retained relay experiments, and corrected the earlier protocol assumptions. See the [actual relay spike](./spike-lambda-container-relay.md) and [semantic oracle](./spike-stepfunctions-semantic-oracle.md). The original survey's lack-of-runtime-evidence statement is historical; these later memos carry the measured evidence and its limits.
diff --git a/docs/research/workflows-final-consumers-review.md b/docs/research/workflows-final-consumers-review.md
new file mode 100644
index 00000000..2ad3dce8
--- /dev/null
+++ b/docs/research/workflows-final-consumers-review.md
@@ -0,0 +1,95 @@
+# Workflow final consumers and delivery review
+
+Date: 2026-10-31. Phase5/M4 is still in progress. Specs are English. D100 waives further Linux x86_64 execution only; Docker Desktop and dedicated ARM reference evidence remain required. No image publication or remote workflow was run.
+
+## Code and independent review
+
+D104–D108 add bounded rootless fixture transport, downward CPU quantization, an inspected unstarted volume helper, the remaining archive/recovery/persistence/composite consumers, and source-bound build/Native/platform/release evidence. Candidate creation, qualification and explicit promotion use the same immutable archives. The canonical Docker inventory is83 resources across eight suites. See [the release qualification design](../../specs/rustack-workflows-59-release-qualification-design.md).
+
+Independent read-only Rust and Python source reviewers initially found no remaining concrete D108 findings. Subsequent actual-evidence review exposed a returned-envelope-path shadowing defect in the assembler; it is tracked below. Review preceded the new execution cohort. D108 preserves all existing workload deadlines, the one-second flood handler and100 cycles. The prior cycle54 end-handshake timeout has an unproven root cause; it is not reclassified as a pass.
+
+## Retained failed attempts
+
+The earlier rootless complete attempt is /Users/tchen/.target/workflows-rootless-resources-d107-second/functional-782fd498f6df4286adf510dea9f1eaab, with owner log /tmp/rustack-d107-rootless-full-first.log. It contains an incorrect archive diagnostic assertion, the unexplained flood timeout, and a genuinely successful SDK child whose interleaved stdout was rejected by the old parser at case67. All-state containers and volumes were independently observed empty afterward.
+
+D108 corrects the archive diagnostic and preserves the original semantic error during final reap; retains original/mutated affiliation bytes before effects; accepts exact non-ignored starts only with the bound zero-exit case and clean terminal summary; derives reference inventory from both canonical typed producer vectors; pins an independently verified metadata peer before timed Invoke; and always audits per-case cleanup even on transcript rejection. A stale79/46 manifest assertion is corrected to83/50.
+
+Earlier server helper inspection-shape failure and exact nonforced cleanup receipts remain in /tmp/rustack-d107-data-recovery-first. The correct single-object formatted inspection subsequently passed the four server/release consumers. Earlier D107 full Rust/Native/kernel/server successes remain historical cohorts, not qualification of D108.
+
+## D108 execution cohort
+
+Source seal: 76c14c9c8f9b0105a172d7fae228aafac23d5b67aef0a286fcf3f73abf8e06ed. Parent commit: d4dacf2; changes remain local during verification.
+
+- Relevant normal controls:19 rootless-resource,17 delivery,16 fault/peer and4 manifest controls pass. Logs: /tmp/rustack-d108-controller-controls-first.log, /tmp/rustack-d108-peer-controls-first.log, /tmp/rustack-d108-manifest-controls-first.log.
+- The independent Python discovery excluding the Rust-owned Action module passes231 controls: /tmp/rustack-d108-python-controls-first.log. The Action module requires the actual Rust-exported YAML contract and will run through its owned entrypoint; excluding it here does not waive that resource. The earlier incorrectly invoked discovery's17 setup errors remain in /tmp/rustack-d107-python-controls-all-first.log.
+- Production refresh completed with all preceding image IDs retained: /Users/tchen/.target/workflows-image-build-d108-first. Server9648a8c42b2c3d9cc0e49a8bc79bf254ea398094bfaa1aaff1a11e7a9d36a8de and release258bd00c1ded42696f03a9b9df48bf176009ce80bf907fe4071097a1ec2e5e34 remain unchanged; runtime addressable image ID is8eea79adc1ab9bbacdb8d7289bbb909fcf626a1abc4697beaf4200a45ce7f6c9. Config digests remain distinct from addressable image IDs.
+- Rootless preparation completed:15 immutable archives,1,431,524,352bytes, /Users/tchen/.target/workflows-rootless-resources-d108-first. Engine7bbe02f2-0571-42f9-a4a3-a36a81425357 is the retained D103 rootless installation. No daemon/context/VM was restarted.
+- All15 Rust gates pass with physically joined groups: /Users/tchen/.target/workflows-rust-d108-first/report.json. This includes default/feature builds, all-target tests, doctests, formatting, Clippy, rustdoc, strict core/consumer checks, audit and deny. Complete rootless execution passes83/83 with zero failures and joined child groups: /Users/tchen/.target/workflows-rootless-resources-d108-first/functional-ff29617345ab44ed8c716ef2c129662b/report.json. The final platform.json independently records zero all-state containers/volumes/private aliases on the same endpoint. This is the original76c14c cohort before W435 correction.
+
+- Complete Native passes3078 tests across41 successful summaries (19 intentionally ignored resources); the separate actual Action owner passes26 Python controls. Both fixed commands exit0 and physically join. The Native lane validator accepts the original intents/log hashes/source binding and exact27-name inventory with the three existing doubled executions, but evidence review found its returned path is overwritten by a parsed test name. Preserve this defective result unchanged; it cannot qualify final packing: /Users/tchen/.target/workflows-native-d108-first/lane-validation.json.
+
+After the current frozen matrix physically finished, W435 was corrected with separate envelope/resource variables and explicit returned-path/hash regressions across all five lane branches. Independent review and a new source cohort follow. No defective result will be rewritten or treated as final qualification.
+
+This is an execution ledger, not final release acceptance. Missing Desktop/reference lanes must continue to reject final promotion.
+
+## W435-corrected cohort
+
+Frozen source seal:3229c2fb4a7479509570a8befdc4eb2efe4ecac096acc301e2393042c2573690. Independent focused recheck found no further issue. All18 delivery controls and232 Python discovery controls pass. The corrected verifier also replays the original Native raw evidence and returns lane.json with its exact envelope hash; this new lane-path-recheck.json retains both verifier/execution source identities and the original bad-result hash, without rewriting the defective artifact or qualifying the old execution as a new source.
+
+New production refresh /Users/tchen/.target/workflows-image-build-d108-second preserves all37 preceding image IDs within38 results. New Rust/Native/rootless/rootful verification will bind this corrected cohort; the original full83/83 rootless result remains under76c14c.
+
+The corrected cohort passes all15 full Rust gates and both complete recorded Native commands (3078 Native passes and26 Action controls), all physically joined. Both actual lane-validation.json outputs now return the exact lane.json path/hash under the3229c2 seal. Missing-Desktop and missing-reference bundles each fail the actual verify-workflows entrypoint before candidate effects; both direct reason checks and joined CLI intent/raw/result receipts are retained in /Users/tchen/.target/workflows-missing-lanes-d108. These negative controls do not supply the missing platform evidence.
+
+The corrected3229c2 rootless matrix physically finishes82/83 with one real failure: the100-flood resource ends at cycle89 (begin89/release89/end88, handler-timeout). Owner65279 exits2 and joins; same-endpoint platform.json still proves zero all-state containers/volumes/private aliases. All other resources pass. Evidence: workflows-rootless-resources-d108-second/functional-bffef3c8d46f42f180cce881be7e2edc/case-046; retained server directory /var/folders/dp/zvkhkbns7fqcy8l3hpdtjhcr0000gn/T/.tmpFXiRh4. No rootless full pass is claimed for3229c2. Independent review W436 identifies stale final observation ordering, but cannot attribute the actual timeout to a specific phase. The next code work is the spec57§8 correction and bounded localization, before another final qualification cohort. Rootful3229c2 is currently running with source frozen.
+
+The D108 forward owner76690 was identity-checked, interrupted and physically joined0 after rootless consumers completed. Its final.json proves child-group join and exact socket removal. Daemons/VMs remain running and all image caches/failed evidence stay retained.
+
+Rootful3229c2 completes83/83 with no failures and physically joined owner27886 (exit0). The100-flood cycle resource passes. The final platform.json independently confirms zero all-state containers/volumes/private aliases on source engine56b0fabd-452d-46a5-ac75-5b4063ab4061; the second ARM engine's complete original image set is unchanged. Retained full evidence: /Users/tchen/.target/workflows-rootful-d108-first. This complete source-frozen run finished before D109's reviewed code was installed. It does not convert rootless's82/83 into a pass.
+
+D109 source6ec373f46eb69257d00d41a7da566df8e77fac70e86fe5225e073495e067973e passes26 image controls,14 Linux controls and17 fault/transport controls. W436's stale ordering/publication race corrections are independently reviewed. Focused /Users/tchen/.target/workflows-flood-d109-second then fails cycle84 before begin acceptance (83 begun/released/ended; callback observation1176836µs); original owner46075 joins1 and zero resources are proved. Raw server evidence is /var/folders/dp/zvkhkbns7fqcy8l3hpdtjhcr0000gn/T/.tmpUL4RGx. An earlier diagnostic launcher invocation rejected a Path where the string-only connection API was required, before resource dispatch; its empty evidence directory and log remain retained as workflows-flood-d109-first. Neither attempt is a final qualification run.
+
+D109 forward owner24684 is identity-checked and joined0; final.json confirms child-group retirement and socket removal. D110 is now specified to remove collector TCP setup from the measured window through a strict initialization-owned channel. Its code is not implemented or tested yet; historical failures remain unexplained. Existing daemons, image caches, bridges and all failure evidence remain retained.
+
+## D110 code and prequalification evidence
+
+D110's initialization-owned channel and five-image refresh are implemented and independently reviewed. Two further P2 scheduling races were fixed before tests: explicitly observe ready-written before choosing submission time, and observe end-written/physical socket close under the same returned+2s cutoff as task quiescence. The actual HTTP control holds both callbacks/closure and proves bounded waiters remain pending until their release. Generic collectors still close each response; flood channels alone permit exactly three same-socket authenticated exchanges.
+
+Frozen source seal:6ebb9e049f857c763489cb305ab18bc72806b06b313ce46af236f10018675e92.245 independent Python controls, all15 full Rust gates and both recorded Native commands pass (3078 Native tests and26 Action controls). Relevant normal targets separately pass27 image,5 channel,14 Linux,19 rootless-resource,18 delivery and18 fault/transport controls; these overlap the245 discovery count. Evidence: /Users/tchen/.target/workflows-rust-d110-first, workflows-native-d110-first and /tmp/rustack-d110-*-controls-first.log.
+
+Controlled refresh /Users/tchen/.target/workflows-image-build-d110-first runs four fixed Make targets and captures five images, retaining all38 prior source IDs inside41 results. Rootless preparation /Users/tchen/.target/workflows-rootless-resources-d110-first imports15 immutable archives totaling1,431,526,400bytes through preceding-receipt/cache-anchor checks. A fresh read-only D103 attestation confirms the same UID501 daemon/MainPID2311/dockerd2361/socket inode46, namespace GID991,4CPU/8GiB allocation and effective cgroup delegation; no daemon/VM restart or context change occurs. The signed running version remains29.5.2 with matching extras; the repository candidate29.9.2 is not installed.
+
+Focused /Users/tchen/.target/workflows-flood-d110-first is currently running the exact100-cycle resource without concurrent builds. It has not yet produced a result. All earlier failures remain under their original seals and are not reclassified. Full rootless/rootful qualification and final source-bound evidence still follow; Desktop/dedicated reference/M4 remain open.
+
+The first D110 focused resource fails at startup (2.72s), before any100-cycle protocol result. Owner38754 joins1 and resources are empty. Two isolated failure-only interpreters preserve the workspace source and identify ServiceException with fixed message Docker environment failed: Docker response status400 Bad Request; both instrumented owners30343/27391 join1 and prove zero resources. Their explicitly instrumented scope cannot qualify release. The original observer executable hash is preserved; the extended message observer is a separate executable.
+
+Actual immutable image layer inspection then proves both /image-bootstrap and /alternate-bootstrap root-owned0700: /tmp/rustack-d110-permission-proof/proof.json, source image59ad1e894c93243ad3dad7099a864d4c6d928cb59691e76e3dec6720d329dee9. The build owner's umask077 propagated into compiler output and COPY preserved it. W437 fixes both COPY modes explicitly to0555; bad images and earlier receipts stay retained. This artifact failure is distinct from the historical intermittent handshake issue. The6ebb9e cohort's normal/Rust/Native passes remain valid historical evidence; it has no successful actual flood execution.
+
+## Corrected permission artifact and final cohort
+
+The W437 correction produces source seal83b25711eadbd18016687c6ee7af01118e5bb87528aa269ea143a416da123af9. The controlled second build retains all50 observed source IDs within53 results, including every earlier41-source result; no image is deleted. Rootless second preparation imports the same15-image catalog/1,431,526,400bytes with all old cache anchors retained. Actual corrected layers are root-owned0555 for both paths, independently inspected in /tmp/rustack-d110-permission-corrected-proof/proof.json. This also verifies robustness while the build retains umask077 for private diagnostics.
+
+Focused /Users/tchen/.target/workflows-flood-d110-second passes the exact100-cycle actual resource in145.17s. Owner67650 joins0 and proves zero all-state containers/volumes/private aliases. The raw WORKFLOWS_IMAGE_PERFORMANCE report validates all100 prepared/readyBeforeInvoke/sameConnection/closed counters,100 unique requests, live positive log spans and typed one-second timeouts. Readiness p95=202µs; runtime-task baseline15 is restored every cycle, quiescence p95/max=4645/4948µs. This closes the focused dependency only; it does not reclassify earlier failures or prove their exact historical cause.
+
+The final frozen83b2571 cohort passes245 Python controls and all15 full Rust gates with joined owners. Native/rootless/rootful requalification is continuing. No complete-source/platform success is claimed before the original owners' final reports and postconditions exist. Desktop and dedicated reference evidence remain unavailable/unqualified.
+
+Final83b2571 Rust/Native lane-validation.json outputs bind the exact catalogs, original intents/log hashes and source seal, with exact returned envelope paths. Final rootless full83/83 and both actual release modes also pass the assembler's raw lane validation, including335 original platform receipts. The same-endpoint platform receipt proves zero all-state containers/volumes/private aliases. All eight individually owned empty rootless bridges are removed non-forcibly with pre-effect intents, original nonce/label/ID validation and independent absence; all27 rootless image IDs remain unchanged. Cleanup evidence: /tmp/rustack-d110-rootless-network-cleanup-final. A further platform-after-cleanup.json rechecks zero resources. Forward57462 is identity-checked and physically joined0; final.json proves SSH-group retirement and exact socket removal. The daemon/profile/images remain retained.
+
+Final rootful preflight is externally blocked before case dispatch: source engine56b0fabd-452d-46a5-ac75-5b4063ab4061 now contains two unlabelled exited debian:bullseye-slim containers (full IDs c7b56143e8952009275a4368ace4d825375f56134b461ec23697bc842d9f0e6c and049de1e8c300c349e1501a8123094a0f0427abf3763ea5373a075e28a8d7e408), plus unlabelled reshape-lambda-cargo volume. Both failed preflight owners93166/71628 join2 with no cases dispatched; retained paths are workflows-rootful-d110-final and workflows-rootful-d110-final-second. All foreign resources are preserved; no force/prune/image deletion occurs. Read-only reduced metadata is foreign-resource-review.json. A user choice is pending for these exact three resources; the corrected bundled question supersedes the earlier container-only question. No current rootful full pass is claimed. Historical3229c2 full83/83 remains under its original seal. Missing Desktop/reference still reject final qualification before candidate effects under83b2571: /Users/tchen/.target/workflows-missing-lanes-d110-final.
+
+Final independent saved-evidence review finds no discrepancy: all1224 source hashes,15 Rust/2Native catalogs/logs/intents, full83 rootless cases/335 platform receipts/two release records, eight nonforced bridge removals and forward retirement match their saved claims. Rootless full report SHA25637417c94731499de4e3d08738254092b2db0fb43578643e701ed1a19a5c3e1b2; rootless network cleanup report SHAd4a3d92df387bc380b10b33931fe71d61c5bd1b4d3fcd0eced031ec6e6dadb16. No task workload/helper/forward process remains active. The explicitly owned empty rootful bridge7a0e9af4957fafae3c314155fb7575181e3ac4aa7be45e66684239195f932088 remains retained for the pending rootful lane; foreign resources are untouched. An unrelated .gitignore addition for .DS_Store is preserved outside this phase's staging. Full M4 is not complete.
+
+## Isolated rootful continuation
+
+The user accepts preserving all three foreign resources and using an isolated rootful environment. The earlier deletion questions are superseded; they provide no deletion authorization. A subsequent reduced read-only inspection confirms both original containers and reshape-lambda-cargo remain present: /Users/tchen/.target/workflows-rootful-isolated-d111-import/foreign-preserved.json.
+
+The existing rootless-v2 infrastructure rootful daemon fbfd8647-6291-4660-a0c0-e913f1f82266 is independently observed to have zero images, all-state containers and volumes before preparation. It is distinct from both the retained rootless daemon and the occupied original rootful daemon. All15 current immutable archives are hash-checked and imported with pre-effect intents, exact post-import image metadata, retained cache aliases and a4GiB total bound (actual1,431,526,400bytes). Import receipts remain in workflows-rootful-isolated-d111-import. No VM, daemon or default context changes.
+
+Current production images are actually rebuilt on that same isolated engine through the unmodified workflows-refresh-production-images target. Owner46658 joins0; all15 imported image IDs remain retained within20 results. The source seal remains83b25711eadbd18016687c6ee7af01118e5bb87528aa269ea143a416da123af9; imported artifacts alone do not substitute for this actual engine-bound build. Build receipts are workflows-image-build-d111-isolated, with owner log /tmp/rustack-d111-isolated-build-owner.log. The rebuilt release image is02ee0a704301ba56bd8c8a9a90a2c076ed2033b122756be8c6d6d093d3c433a0. It is a separate build artifact from the prior rootless release image, not a retroactive replacement for it.
+
+The subsequent full controller owner78786 joins0 with83/83 passes and no failures: /Users/tchen/.target/workflows-rootful-d111-isolated/report.json, SHA2561460d946bbc754a1e3096e9dd18516aa52ef02c8a91835ec558d1dd5af8642a2. The100-cycle flood resource reports prepared/readyBeforeInvoke/sameConnection/closed=100 and empty resources after each timeout. The final same-endpoint platform.json proves zero all-state containers/volumes/private aliases. The actual assembler validates all335 raw platform receipts, exact case inventory/argv/log hashes, and both actual release modes against the new image ID. New envelopes bind execution HEAD60a46e0de64fbe13a9453a65cdc8748dd4e1c9ce; older pre-commit cohort records remain unchanged and are not rebound to this commit.
+
+Both exact task-owned empty rootful bridges are then removed without force: isolated caa34788b458b842d758f68730d94226aa939238bac009331154bbc42c78fd4f and original7a0e9af4957fafae3c314155fb7575181e3ac4aa7be45e66684239195f932088. Original nonce/label/ID/driver/scope/empty inspection is checked before each pre-effect removal intent. Independent absence and unchanged image/container/volume inventories on both engines follow; therefore the original foreign containers and volume remain preserved. Cleanup owner26134 joins0; receipts are /tmp/rustack-d111-rootful-network-cleanup/report.json, SHA256cd9cf555e2a8d80a31c1ac405115be45dc9092bef2d7ff6631193496c72fb9bd. Further platform-after-cleanup.json on the isolated engine confirms zero resources, SHA25693676ce4b5aaa15a7ee031d451a7051dc6db988daa34c0811ae57df88fb4284c. All daemons, profiles, source caches, imports and failed evidence remain retained. No task workload/build/helper/forward process remains active.
+
+This closes the local current-source rootful functional dependency. Desktop and dedicated physical ARM reference evidence remain unavailable; there is no complete same-commit release bundle, final M4 acceptance, publication or remote CI claim. D100's Linux x86_64 execution waiver remains unchanged.
+
+Independent read-only review finds no discrepancy in the isolated continuation: all1224 current source hashes, five executable/interpreter artifacts,15 archive hashes, actual same-engine build/log,83 exact cases/argv/terminal summaries,335 platform receipts/two release records, both same-endpoint zero-resource receipts and both exact network removals match. The original-engine cleanup baseline explicitly contains the foreign two containers and reshape-lambda-cargo, and its postconditions preserve that exact inventory. Relevant documentation checks pass: git diff --check and125 relative file links across the three updated documents. This continuation changes only verification records in Markdown; no additional Rust build/test/tooling change is introduced.
diff --git a/docs/research/workflows-image-performance-review.md b/docs/research/workflows-image-performance-review.md
new file mode 100644
index 00000000..3a624123
--- /dev/null
+++ b/docs/research/workflows-image-performance-review.md
@@ -0,0 +1,144 @@
+# Image Lambda Performance and Repeated Cleanup Review
+
+Status: final seventh-source current-profile qualification passes: host15, full ARM79, artifact-aligned direct Linux3, independent reviews and exact postconditions. Dedicated-reference/Desktop/rootless/W373 and complete M4 remain pending.
+
+The actual GNU arm64 SDK harness and Rustack CLI execute directly inside the retained4-vCPU/8GiB native VZ Linux guest. Python3.12.3 consumes the existing read-only pure-Python boto3/botocore1.43.118 tree; no host Python binary or ambient AWS credentials execute in the guest. The three preloaded local images are transported by captured immutable content ID with per-operation source/target engine fences, bounded saves/imports and preserved source caches. Captured IDs receive persistent target-only rustack-workflows-cache:d102-<full-content-hex> aliases so Docker cannot collect an untagged import when its final private runtime pin is removed; source aliases remain unchanged. SDK retries are disabled and calls use fixed local dummy credentials.
+
+The workloads use the ordinary registered Docker startup/provider/pool/environment, the independent Rust RIC and production cleanup. They retain all raw nanosecond warm observations, per-environment cold identity/initialization rows, and all100 live-flood health, timeout, task-quiescence and process observations. A bounded successful initialization event partitions relay readiness and function/RIC readiness, including each phase's Docker IO and handshake scheduling; it does not measure isolated RIC CPU time. Each cold event is joined to its independently observed environment ID. A complete immutable pre-SDK log prefix excludes only startup self-tests; every later unknown/duplicate/missing identity fails.
+
+The performance-only fixture has one environment slot and a2s idle setting. DeleteFunction itself does not promise synchronous warm retirement. Outside Invoke timing the observer waits at most15s for actual idle-driven container absence and zero allocation/memory/quarantine. Warm100 excludes one explicitly documented priming call. Cold20 includes every first call, with no excluded warmup. The100-cycle workload first primes and deletes a separate function to initialize the legitimate lazy persistent supervisor, then takes the exact Tokio task baseline for all measured cycles.
+
+Every timeout cycle succeeds on a fresh pair first, then holds an authenticated flood-begin barrier while a bounded paced writer remains active. Two capability/accounting observations bracket an actual GET /_health/ready. Only afterward is the barrier released; a matching flood-end proves0<beforeBytes<afterBytes<1MiB. The actual1s ServiceException timeout must settle physical cleanup, zero provider/environment charges and return actual live Tokio tasks to the original baseline within2s. No admission retry or eventually growing pool is hidden. Process RSS/OS thread observations are separate from configured quotas and Tokio task counts.
+
+Four virtual CPUs do not prove four dedicated physical CPUs. All reports retain referenceQualification=pending. These measurements do not close dedicated-reference, Desktop/rootless, W373 or complete M4. D100 waives further Linux x86_64 validation. D74/D99/D101 artifacts remain historical and unchanged.
+
+## Final fourth-source Linux capture
+
+The original Make owner physically joins0. All three exact guest resources pass once, with empty stderr, the same captured ELF hashes before/after, Python3.12.3 and joined child process groups. Final report SHA256 is a218d6e6345aa40fb304cf87e230c792ec7a2476b99a958f051c29486958aaa4; the complete raw report is retained below. Its guest evidence root is /tmp/rustack-d102-linux-3w_gtdcn. This capture includes the corrected W416 clock and W417 cache anchors. The same fourth source passes all15 host gates. Its complete ARM gate later fails in the repeated-flood resource; the successful Linux capture does not override that failure or qualify the full matrix.
+
+| Measurement | Final fourth-source observation | Contract |
+|---|---:|---|
+|Warm adapter overhead p95/max |3638/3980µs |100 calls, p95≤50000µs |
+|Preloaded cold total p95/max |125489/126875µs |20 distinct environments, p95≤5000000µs |
+|Relay phase p95 |73770µs |Joined by exact environment ID |
+|Function/RIC phase p95 |53312µs |Includes Docker IO and handshake |
+|Live-flood readiness p95/max |165/385µs |All100 actual readiness probes<2000000µs |
+|Timeout/physical-settlement p95/max |1149102/1162479µs |Actual1s handler timeout plus joined retirement |
+|Task quiescence p95/max |2920/3875µs |Original timeout-return clock, every cycle<2000000µs |
+|Tokio task baseline/all100 observations |15/15 |Exact baseline, no growth |
+|Containers/cycle high-water |2 |All100 pairs absent after timeout |
+|Observed server RSS/thread maxima |31884KiB/6 |Separate from configured quotas and Tokio tasks |
+
+The three final transfer archives total 285056000 bytes. Preparation and guest checks bind the captured content IDs, retained target cache aliases and source/target engines. All earlier failure/intermediate receipts remain separate; the R3 quiescence samples below are invalid under W416 and supply no accepted timing evidence.
+
+## Successful R3 development capture
+
+This capture completed before the final source seal and is retained as development evidence. Final source/host/full79 qualification will be recorded separately. No intermediate or failed capture is relabeled final.
+
+| Measurement | R3 observation | Contract |
+|---|---:|---|
+|Warm adapter overhead p95 |4033µs |≤50000µs,100 calls |
+|Warm overhead maximum |4240µs |All100 raw samples retained |
+|Preloaded cold total p95 |142324µs |≤5000000µs,20 distinct environments |
+|Relay phase p95 |81041µs |Reported separately by environment |
+|Function/RIC phase p95 |61768µs |Includes create/attach/start and handshake |
+|Live-flood readiness maximum |197µs |<2000000µs for every cycle |
+|Timeout/physical-settlement p95 |1150855µs |Actual1s handler timeout plus joined retirement |
+|Tokio task baseline/all100 observations |15/15 |Exact original baseline, no growth |
+|Development quiescence sample |1µs |Invalid clock; excluded initial observation, see W416 |
+|Observed server RSS maximum |31896KiB |Observation, not total-memory quota |
+|Observed OS thread maximum |6 |Separate from Tokio tasks |
+
+Stage percentiles describe different sample rankings and must not be added to infer a total percentile. Per-environment phase sums are instead checked against that exact Invoke observation, with only2µs rounding tolerance.
+
+## Reproduction
+
+Use make workflows-image-performance-linux-build and make workflows-image-performance-linux-images with an explicit ARM source socket and a fresh WORKFLOWS_LINUX_EVIDENCE_DIR. The preexisting selected profile must be native VZ4CPU/8GiB with the read-only repository/target mounts. Its task-owned rustack-d102-linux bridge is verified before/after execution. Then make test-workflows-image-performance-linux performs the required79-resource manifest preflight and runs the three exact guest cases. The guest also compares all46 ignored ordinary names with the frozen manifest. Existing evidence directories refuse overwritten transfer/guest receipts; retain original failures and use a fresh cohort directory.
+
+The selected source/target engines are56b0fabd-452d-46a5-ac75-5b4063ab4061 and dde55abd-dcdd-4c74-a2cb-6292373f3782. Transfer is capped at three archives,1GiB each/2GiB total, with the remaining total applied before each exec through inherited soft/hard RLIMIT_FSIZE. Each save/load has120s; overall preparation has600s. Guest/host original alarms are1500s/1650s and the SSH observation1600s. Existing bounded process owners preserve physical retirement under interruption; uncertain effects fail without retries or unrelated cleanup.
+
+## Development failures and review
+
+The retained early cohorts expose real fixture/oracle gaps: delayed DeleteFunction retirement, the lazy supervisor baseline, startup self-test events in cold logs, isolated Python entrypoint imports and guest0002 umask creating group-writable temporary ancestors. The fixes preserve production semantics and strict ownership checks. Evidence roots/logs remain retained; none is changed into a green result. The actual Linux private-root correction requests0700 explicitly. The third Linux warm workload completed but the source audit returned Docker404: saving by immutable ID imports untagged images, and removal of the final private runtime pin collects those imported sources. W417 adds persistent target-only content-addressed operator cache aliases with conflict rejection, per-operation fences and guest pre/post mapping checks. The third failure remains at /tmp/rustack-d102-linux-sjelfikq and /tmp/.tmpJ7RHNZ. Preliminary Clippy function-size failures are addressed through focused helper extraction, without lint suppressions.
+
+The independent source review records W403–W421 in [review93](../../specs/rustack-workflows-93-review.md#d102-image-performance-preflight-review). The fourth source was frozen at1260 files with SHA256 90e77dffa3d3914d5e0016d885b663c3767325e0601a8d6247e1966b6cc13305. Final complete execution and exact postconditions remain required. The fourth full owner physically joins2 after572.686s; ordinary-startup has45 passing resources and one failed repeated-flood resource, so later suites do not run. Its root /var/folders/dp/zvkhkbns7fqcy8l3hpdtjhcr0000gn/T/.tmpsuIqY9 contains97 successful initialization events (two startup, one priming, then about94 cycle environments). The missing flood barrier phase/outcome was not retained. W419 adds bounded private diagnostics and preserves the original failure; the actual cause is still unproven. No final bridge cleanup has run.
+
+## Fifth-source diagnostic reproduction
+
+W419 changes only the two measurement/diagnostic Python files; Rust, fixture image behavior, deadlines and workload counts remain unchanged. The1260-source fifth seal is c9fff14db290b672afb074a436d3fb3e1f6efb3b4ad2a96b1147a367ea8cdf37. Seventeen image controls and fourteen Linux-owner controls pass; independent source review finds no remaining diagnostic issue. Two separate exact repeated-flood resources each complete all100 cycles and their original owners join0 (143.98s and143.52s). These successes do not establish the missing fourth barrier's cause. The fifth complete matrix original owner joins0 after622.068s: all79 exact resources once,561 aggregate Rust passes/33 summaries and one explicitly gated recovery preflight. This includes the third successful100-cycle resource under the diagnostic-only revision. The original fourth failure is not reproduced and its cause remains unproven. Independent W420 review nevertheless identifies undocumented100ms scheduling guards in the producer; a capacity-one coalesced progress channel with a single absolute1s cutoff is being implemented before final qualification. No prior failure is overwritten, no cycle is retried within a workload, and no deadline/count changes.
+
+## Sixth-source progress coordination
+
+W420 replaces the two undocumented100ms busy-poll guards with capacity-one nonblocking coalesced notifications after successful writes, authoritative atomic byte counts and one absolute1s cutoff shared across first-positive and post-release progress. Stale events cannot reset that cutoff; a positive count observed too late fails. The writer remains active throughout the held begin/health/release barrier and is stopped/joined on every returned path. Actual invocation1s, health/quiescence2s and all100-cycle requirements remain unchanged. This eliminates concrete extra fixture failure paths but does not establish the fourth capture's cause.
+
+Four deterministic progress controls and strict production-binary pedantic/boundary Clippy pass, and independent source review finds no remaining issue. An initially overbroad strict command also selected preexisting hardening.rs tests and reported111 legacy test-lint errors; its failure log is retained, with no suppressions or unrelated edits. The new module's boundary attributes apply to its unit tests under normal full-workspace Clippy; the scoped strict binary check passes. The sixth1260-source seal is0d01d2f5189e9cbed4c004fd137bb18cff5294a50ec0cc3356b48dd9c19d9332. The updated three-image transfer totals285069312 bytes and retains all content-addressed target cache aliases. The original sixth Linux Make owner joins0 (session82029), preserving guest evidence /tmp/rustack-d102-linux-4tpobc2a and report SHA256d917cb943a088ce1c007b9d588ef9cc8ff913a0d8f77a5c68812ac5288a29254. All three exact resources pass once; all100 timeout pairs are absent, charges zero and Tokio tasks return to15. The original complete sixth ARM owner subsequently joins0 after599.449s, with all79 exact resources once,565 aggregate Rust passes/33 summaries and one gated recovery preflight. W421 then finds that its rebuild refreshed the three manifest-list IDs; each platform config digest is unchanged. Therefore this pre-full Linux capture is intermediate. Final imports now match all three exact full-build exports, bound by a separate export proof, and an artifact-aligned final Linux run is in progress.
+
+| Measurement | Sixth-source Linux observation |
+|---|---:|
+|Warm overhead p95/max |1805/2227µs |
+|Preloaded cold total p95/max |156604/203343µs |
+|Relay / function-RIC phase p95 |82942 /72100µs |
+|Live-flood readiness p95/max |163/235µs |
+|Timeout/physical-settlement p95/max |1132246/1138228µs |
+|Task quiescence p95/max |2949/3572µs |
+|All100 task observations / baseline |15/15 |
+|Observed server RSS / OS thread maxima |31984KiB /6 |
+
+All15 sixth-source host gates pass and the original owner joins0 after271.315s aggregate command time: default4224/429 gated/82 summaries; feature4365/500/82; strict1971/33/20; Native3078/19/41. Both builds, fmt, both workspace Clippy/rustdoc checks, Action26, image controls17, Linux controls14 and audit/deny pass. All four Native performance reports are retained separately, without deduplication. No existing advisory ignore or policy is relaxed.
+
+## Source-cache incident, exact repair and seventh-source guard
+
+The original20-ID source baseline audit detects seven missing addressable IDs after repeated fixture rebuilds. Earlier final source-preservation claims are therefore withheld. History lookup uses the [documented Buildx time filters](https://github.com/docker/buildx/blob/master/docs/reference/buildx_history_ls.md). Source BuildKit history still retains all seven original root graphs and platform payloads; five minimal provenance statement blobs are missing. Their retained full predicates are reduced to the original minimal form and serialized using the original statement encoding. Each result matches its already-referenced original SHA256 exactly; no equivalent rebuilt image or newly asserted provenance is substituted.
+
+A guarded operator repair packs55 verified blobs into a237127680-byte OCI archive (SHA256 ac3038d6685e990149235a000940bcd81109228dfbf728a72971fd9871a2470b) and imports only new content-addressed cache references. The original repair owner joins0 after3.579s; source image count changes20→27, all seven exact old IDs are restored, and all seven current fixture tags retain their before/after IDs. A fresh independent catalog check proves all original20 IDs addressable again. The seven repaired image graphs are also saved in retained host archives totaling442527232 bytes; independent review recomputes their root/statement digests. The incident, incomplete observations and repair receipts remain separate. Neither task bridge has been removed.
+
+The permanent seventh-source guard runs as the first canonical lambda-docker-fixtures step before any nested builder. It anchors captured immutable IDs for exactly the seven rebuilt aliases on the same fenced engine, rejects conflicts and malformed/ambiguous IDs, verifies each cache mapping and rechecks source aliases before returning under one120s guard. Initial/partial provisioning can omit aliases; the fixed architecture-bound allowlist minus the complete preserved list identifies absences. This guard protects observed sources and does not certify historical completeness; the independent original-ID baseline audit remains mandatory (W423).
+
+Four new controls increase the image suite to21, with14 Linux controls unchanged. Both controls and an actual7/7 retention command pass. The1260-source seventh seal is a1be06d57466a78c01377087e253cdc1aff1957cfc331b1b251e5393e3ef408c; only Makefile and the image preparation/control Python files change from sixth source. Independent source review is otherwise clean, with W423's documentation precision corrected. Final seventh-source host/full/image-cohort/Linux/postcondition qualification is in progress. No further x86 validation, publication, VM restart, image deletion or global cleanup occurs.
+
+## Raw R3 report
+
+```json
+{"schemaVersion":1,"referenceQualification":"pending","binarySha256":{"test":"7b5f8f82aae4f54de38929862779757fb8ee760732e6dccf9b47537fa589f71b","server":"3f3e6750c3e2818b3a43b410871388a5f4b99120aaf46c0dfcbffb1d0708c8f4"},"engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","network":{"id":"21c24074040e18300c00457cf60102419bdf1c01588207a322243004643106d8","name":"rustack-d102-linux","driver":"bridge","labels":{"rustack.workflows.engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","rustack.workflows.nonce":"f367ab64-5f81-400d-b484-2d5461911291","rustack.workflows.task":"D102"},"ipam":[{"Gateway":"172.18.0.1","Subnet":"172.18.0.0/16"}]},"evidenceRoot":"/tmp/rustack-d102-linux-tyh21vc1","reports":[{"architecture":"aarch64","baselineProcess":{"rssKiB":29844,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"handlerNanos":[10583420,10191589,10191713,10437421,10148589,10544171,10308754,10227130,10273296,10275005,10086130,11273126,10140755,10251421,10143589,10110672,10406171,10442212,10472629,10120380,11650291,10113172,10935085,10856253,10815711,10201422,10328547,11313251,10500504,10108714,10472421,10983294,10176588,12346205,10933378,10245380,12272165,11026669,10473963,10282297,10170172,10306296,10271922,10729503,10178755,10757003,10749795,10946710,10160463,10273255,11285584,10145963,10603670,11284168,10501379,10665295,10151963,10417837,10227005,10089006,10164672,11384334,11334001,11275918,10206380,11603083,10224005,11272251,11008252,10963878,10181464,10314671,10706004,10992460,10809961,11695667,10076381,10154089,10046423,12291664,10139214,11189001,11159961,11321209,10218588,10264547,10228422,10310255,11058002,10402504,10243255,12280289,10891127,11059460,10214255,10256964,10376546,10196130,10407129,10176089],"overhead":{"maxMicros":4240,"observedMicros":[1638,1379,1282,1319,1294,1335,1262,1408,1380,1472,1556,1500,1632,1540,1557,1673,1615,1640,1741,1706,1830,1914,2339,2126,2242,2265,2300,2345,2204,2921,4240,4213,3200,4033,2939,2468,2528,2392,3214,3820,4223,3097,3953,2817,2822,2526,2625,2383,4016,3835,3543,2800,2292,2125,2112,2394,2511,2348,2339,2443,2514,2303,3172,3141,2669,2920,3241,2811,2633,2520,2433,2873,2857,2487,3732,2445,3358,3060,3486,3093,2637,2491,2315,2219,2136,1921,2331,1918,2227,2269,2445,2722,3595,3025,2455,2375,2919,4225,4062,3593],"p50Micros":2445,"p95Micros":4033},"totalNanos":[12221164,11570209,11473709,11756290,11442042,11878291,11569875,11634833,11653291,11746958,11641583,12773121,11772124,11790666,11699958,11783291,12021123,12081706,12212998,11826291,13479452,12026998,13273952,12982204,13056745,12466122,12628497,13657785,12703704,13029161,14712280,15195320,13375827,16378691,13871492,12713038,14799781,13418119,13687743,14101782,14392406,13403077,14224407,13546202,12999953,13282785,13373952,13328993,14175658,14107741,14828113,12945870,12895579,13408493,12613079,13058578,12662788,12765079,12565580,12531455,12678246,13686909,14505782,14416906,12875037,14522448,13464494,14083158,13640785,13483243,12614247,13186828,13562910,13478536,14541864,14140533,13433743,13213369,13531743,15384278,12775329,13679243,13474952,13539493,12354331,12184706,12558539,12227957,13284286,12670789,12687580,15002238,14485323,14084449,12668872,12631038,13294703,14420365,14468740,13768785]},"os":"linux","phase":"warm","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29840,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"environments":["a33bdfe7-b25a-4e1c-a8fe-662be10adb1d","b9b645a7-5a8f-48e4-ba7f-1aea56f59b86","e7e7bc8f-3f92-4be0-b380-b9a11c1c98e7","807c769a-5656-432a-8050-a820db2cda6c","72135bf9-cbe3-4031-9f6c-5b6137978e43","3bb1434d-fea2-4ee1-8d40-ba151d224b6c","be061973-f9a4-4772-9e43-ade759febe01","48e0f24d-6d53-47ec-a25f-909b9403b196","31cdb7e9-779b-426a-bca1-892deca3232f","a6f637f2-c595-41b7-9075-02e5c63f1902","0617792d-8c84-4fcb-8f6d-e058a357921b","4528aee5-40b2-4334-b410-0114ea7ca0a2","ee83d45f-e78f-4df7-9c61-5b83f2377cc5","30f1239b-cdc9-4c8b-98dd-e96b7a71f122","236b337f-8080-455b-85df-24d66f141c2e","70bf08ee-98f4-4960-afb1-787310eb991e","bb57d39d-0e65-46e9-8bbe-929a29add634","a4062736-9ab9-464f-92af-58097dfdc514","2d6e439f-962e-414f-b963-1c8636c4b1a4","61d1dfd1-4cd4-426d-ac16-e388bd8471bd"],"initialization":{"events":[{"environmentId":"a33bdfe7-b25a-4e1c-a8fe-662be10adb1d","relayMicros":58250,"ricMicros":50920},{"environmentId":"b9b645a7-5a8f-48e4-ba7f-1aea56f59b86","relayMicros":63841,"ricMicros":52905},{"environmentId":"e7e7bc8f-3f92-4be0-b380-b9a11c1c98e7","relayMicros":67625,"ricMicros":48082},{"environmentId":"807c769a-5656-432a-8050-a820db2cda6c","relayMicros":64859,"ricMicros":52295},{"environmentId":"72135bf9-cbe3-4031-9f6c-5b6137978e43","relayMicros":66751,"ricMicros":52369},{"environmentId":"3bb1434d-fea2-4ee1-8d40-ba151d224b6c","relayMicros":74140,"ricMicros":46594},{"environmentId":"be061973-f9a4-4772-9e43-ade759febe01","relayMicros":67197,"ricMicros":52995},{"environmentId":"48e0f24d-6d53-47ec-a25f-909b9403b196","relayMicros":121135,"ricMicros":87497},{"environmentId":"31cdb7e9-779b-426a-bca1-892deca3232f","relayMicros":81041,"ricMicros":57324},{"environmentId":"a6f637f2-c595-41b7-9075-02e5c63f1902","relayMicros":69615,"ricMicros":48240},{"environmentId":"0617792d-8c84-4fcb-8f6d-e058a357921b","relayMicros":62238,"ricMicros":56398},{"environmentId":"4528aee5-40b2-4334-b410-0114ea7ca0a2","relayMicros":62349,"ricMicros":45237},{"environmentId":"ee83d45f-e78f-4df7-9c61-5b83f2377cc5","relayMicros":58317,"ricMicros":53621},{"environmentId":"30f1239b-cdc9-4c8b-98dd-e96b7a71f122","relayMicros":71744,"ricMicros":43896},{"environmentId":"236b337f-8080-455b-85df-24d66f141c2e","relayMicros":60094,"ricMicros":48020},{"environmentId":"70bf08ee-98f4-4960-afb1-787310eb991e","relayMicros":70395,"ricMicros":46205},{"environmentId":"bb57d39d-0e65-46e9-8bbe-929a29add634","relayMicros":66889,"ricMicros":50456},{"environmentId":"a4062736-9ab9-464f-92af-58097dfdc514","relayMicros":67071,"ricMicros":51030},{"environmentId":"2d6e439f-962e-414f-b963-1c8636c4b1a4","relayMicros":60475,"ricMicros":51151},{"environmentId":"61d1dfd1-4cd4-426d-ac16-e388bd8471bd","relayMicros":66440,"ricMicros":61768}],"functionRic":{"maxMicros":87497,"observedMicros":[50920,52905,48082,52295,52369,46594,52995,87497,57324,48240,56398,45237,53621,43896,48020,46205,50456,51030,51151,61768],"p50Micros":51030,"p95Micros":61768},"relay":{"maxMicros":121135,"observedMicros":[58250,63841,67625,64859,66751,74140,67197,121135,81041,69615,62238,62349,58317,71744,60094,70395,66889,67071,60475,66440],"p50Micros":66751,"p95Micros":81041},"startupBaseline":{"bytes":382,"sha256":"afe555cf6e5b886585ba07f07e14996dd50433e9727bb12fd08bbbf3a8d78b01"}},"latency":{"maxMicros":214327,"observedMicros":[113442,119421,119616,121198,121810,124643,123119,214327,142324,121979,121355,111625,114664,119596,112175,119536,119984,120861,115600,130886],"p50Micros":119984,"p95Micros":142324},"uniqueContainers":40},"os":"linux","phase":"cold","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29724,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"completedCycles":100,"containerHighWater":2,"emptyAfterEachTimeout":true,"floods":[{"afterBytes":4096,"beforeBytes":2048,"requestId":"3207fe78-9843-4cc4-b699-f487eb9da275"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5dcf34f8-8315-4061-9fc5-59105a249aa4"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"7541ebcd-1a16-453e-a285-9727bac5871f"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"4ec95214-c5c1-42dc-aa56-4271978a9b40"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"02551399-77ac-45cc-891a-4d4eccaa5d73"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9ad04107-1743-4b41-943c-4996fd3ad0ef"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"6544c2e5-ad59-4ce5-9458-9ac0bac7167b"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"e4b49d0c-82ba-428a-9308-848e39b69fbb"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"0db82b05-6eb7-4a5e-8e68-bd3ef62a7164"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"56ea89e3-413e-4e21-869a-614597e4de21"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"ed5efc5e-3d21-4952-8af7-996dedd476c0"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"d6e27b69-d2c9-43cc-9979-704a167bd4ab"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"0c00ae57-ee1e-4b17-8248-8e922a3de0e2"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"342c1e73-89d2-4759-be95-e776def517da"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"92a2afc7-ff50-48cb-ad1e-030f5a568441"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"bde34886-a8ac-4f56-a2b9-e523d8c1972a"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"37cdb243-f395-4563-aaf6-27504f0d7abb"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"c45a7b76-7c9e-4ece-9268-0f19e6c79965"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"ec9932c1-3d36-486c-9c41-886669014345"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"eb76192a-5a61-4efc-bf64-feffd5ae9b16"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"89d7473d-1841-410d-8ba4-88ad1bc9a5d5"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"826958ee-ed1c-49e8-8a9e-fbd295f58e4f"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"29cafda5-1fd6-44d1-a42b-f3ae2665086b"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"7987b440-3822-47ae-bcdb-8b6780e4ab20"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d55440a3-0c71-4988-92bc-98c9e65f8858"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f75d5efb-a90c-4e2c-9ed1-d38eed5671e4"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"44046c96-f111-473c-88e3-bd06bc3e092e"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5d330626-407f-4b3f-9c7b-68963abf3477"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"928b1844-6ea7-46b2-9179-a5425fed28b8"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"03b5aa2b-e3ee-48c7-9566-5d544e654e77"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"67894a61-7582-489c-bd55-5d96c36ee963"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"82431b08-6697-435e-adbe-2a9a5b8d9795"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"34d2bad7-3e6b-441b-b747-0f476312f783"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e36186c1-d7f8-4e89-8eeb-f662ce774aec"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"b06769ab-c5a4-47c2-ac38-0ab50f581e91"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"35fcfbe5-c8b1-43a4-86fe-4662d7a6b1d5"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"ca7b6b27-cee4-4b5d-9c62-36f695118ae6"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"ebac4743-1406-42b9-8590-abeebd62e83d"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"2dc27970-17c5-48c7-bb97-4fe6e1a89077"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"57b99fca-1f4f-46d2-b49b-688fef9d855e"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"f67ab81a-aa18-4970-b5ad-7455132b1f8b"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"21c57534-8229-4196-8002-c11d296c4a0d"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"39415aaf-5f2a-4682-9cb9-3480e0b5486e"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"736229ea-a150-4fcd-ac99-310502c1e2f7"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"26a218df-2e71-484e-af1e-356874665a37"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d18a523a-1308-4957-951a-140b6fac3e05"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"adf8800e-f11d-4db9-a140-848ae4202cf1"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9212bf74-e64f-499c-b063-759534f3ce96"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"b303c8d9-4280-425b-9b20-1dee88bd6785"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"926549f3-2405-4956-824d-86a8818660c5"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"7e0b7e5e-b455-4e0c-9a7a-e1df8f723a24"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"10db3770-a3f3-4e4f-91cf-bf41b848744d"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"9e3c95d8-be71-4c97-8da1-1eaca8832065"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"215e5e18-850f-4822-af2f-1db5cb5805f9"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"77d52206-459d-49a9-b6b4-2ee10f391103"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"09d1a014-047c-4125-b05b-446ea3c7f1f9"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"47fd0249-03d7-49f8-aa06-6a777e8f890f"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"ea177613-1256-4c56-bcc0-539d9b694d76"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"8fbfb8d2-166a-4f48-b99a-ebf7f4436437"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"ea526896-5ec5-4068-a7c3-cff81c4c0177"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"a14e63bb-387c-4567-9b39-1763e0c4761c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"34616991-e80b-4b79-983e-a0606d61dd08"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"447784be-147c-42f6-a8e0-6000b56b178e"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"b8927e30-9c48-484c-8e57-7227c3a25e54"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"6406e801-569a-44be-9cb0-0b6bcd7ff902"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"25eeac4b-d3d9-44a2-b6eb-d9dd78e98331"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"3ebbfdf9-051f-4f36-a58e-13fecda9b0e6"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"de1dfa2b-5351-4130-b442-f6ac8695f633"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"776832e4-b141-45ee-b82c-a637719f93c7"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"f3e337ab-90be-4dba-b673-514c8e86e019"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e5085ed4-8813-488e-b7c8-3eecb0f60843"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"3f38ae9b-1b16-4594-b6c9-52ae2d4f030e"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"d9531cad-375b-4e09-bb64-65d2ad65e491"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"437d7818-38ff-4c4f-8823-7109bb1550b5"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"ef9e9950-14dc-42cf-b6d7-9b1beede8586"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e68f0a9b-2e1b-4963-aaaa-710b8192801c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f4c5c585-5faf-43ef-8277-b5136f4e824c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"8b9447e5-d175-440e-8fa5-8f6fb27d23cb"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"37f20a52-801d-466e-b7f8-388677292dff"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"c9c079d4-8d73-44c4-af80-059d933a61cd"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"749115f3-0eda-4754-b4df-a847e5983ca9"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"deaeb7d1-d06c-42a1-b14e-82af9e8f0465"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"8e0c534a-865e-4761-943e-41bafcd8edb0"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"2cf710dd-6c1f-47c5-a1fe-e13acb8a96eb"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"326cf6ee-fa79-4229-a830-23f1fcb0bb55"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"051a2667-5f8e-4747-98c7-9a8cfc11bcbd"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"ad1fd01d-5c39-40ed-aa29-1f1d13ce27f3"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"66f21731-b062-4505-adbe-5e7d3aca2dca"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"d98c70ba-8ed1-4164-8957-6f77a230de37"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"159b406e-b2ea-447b-b1a9-8b70caa4c5b7"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"ef445c96-38be-4b72-8f9f-32b849dacd26"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"30590ac6-23d2-4bfb-bbf9-4977b60c6e23"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"1cb988dd-8cd2-4164-9f1a-c5a7a2a9e7a1"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"feef2ea2-1036-44c5-b5ff-2ffd3a1e1e25"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"460ff85c-9046-47f0-b175-c8446a990aa1"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"5ad2be81-157c-4d5a-80fe-5ca4b159446c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"598701bc-8d25-42ed-b9c7-8075aebe6c59"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"224e75c7-2a2b-4fd1-addd-d0f4541c8d2a"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"e14abbd7-dcff-44aa-96ee-5857b7de1361"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"8cf0f861-30c1-4f35-ad5f-6bff032a8072"}],"liveBrackets":[[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false]],"primingCleanupConfirmed":true,"primingInvocations":1,"processStats":[{"rssKiB":30428,"runtimeTasks":15,"tasks":6},{"rssKiB":30544,"runtimeTasks":15,"tasks":6},{"rssKiB":30600,"runtimeTasks":15,"tasks":6},{"rssKiB":30660,"runtimeTasks":15,"tasks":6},{"rssKiB":30716,"runtimeTasks":15,"tasks":6},{"rssKiB":30752,"runtimeTasks":15,"tasks":6},{"rssKiB":30760,"runtimeTasks":15,"tasks":6},{"rssKiB":30768,"runtimeTasks":15,"tasks":6},{"rssKiB":30816,"runtimeTasks":15,"tasks":6},{"rssKiB":30836,"runtimeTasks":15,"tasks":6},{"rssKiB":30848,"runtimeTasks":15,"tasks":6},{"rssKiB":30896,"runtimeTasks":15,"tasks":6},{"rssKiB":30912,"runtimeTasks":15,"tasks":6},{"rssKiB":30916,"runtimeTasks":15,"tasks":6},{"rssKiB":30944,"runtimeTasks":15,"tasks":6},{"rssKiB":30984,"runtimeTasks":15,"tasks":6},{"rssKiB":31036,"runtimeTasks":15,"tasks":6},{"rssKiB":31096,"runtimeTasks":15,"tasks":6},{"rssKiB":31124,"runtimeTasks":15,"tasks":6},{"rssKiB":31152,"runtimeTasks":15,"tasks":6},{"rssKiB":31180,"runtimeTasks":15,"tasks":6},{"rssKiB":31204,"runtimeTasks":15,"tasks":6},{"rssKiB":31204,"runtimeTasks":15,"tasks":6},{"rssKiB":31240,"runtimeTasks":15,"tasks":6},{"rssKiB":31244,"runtimeTasks":15,"tasks":6},{"rssKiB":31248,"runtimeTasks":15,"tasks":6},{"rssKiB":31260,"runtimeTasks":15,"tasks":6},{"rssKiB":31296,"runtimeTasks":15,"tasks":6},{"rssKiB":31300,"runtimeTasks":15,"tasks":6},{"rssKiB":31320,"runtimeTasks":15,"tasks":6},{"rssKiB":31328,"runtimeTasks":15,"tasks":6},{"rssKiB":31348,"runtimeTasks":15,"tasks":6},{"rssKiB":31364,"runtimeTasks":15,"tasks":6},{"rssKiB":31388,"runtimeTasks":15,"tasks":6},{"rssKiB":31392,"runtimeTasks":15,"tasks":6},{"rssKiB":31400,"runtimeTasks":15,"tasks":6},{"rssKiB":31412,"runtimeTasks":15,"tasks":6},{"rssKiB":31424,"runtimeTasks":15,"tasks":6},{"rssKiB":31428,"runtimeTasks":15,"tasks":6},{"rssKiB":31436,"runtimeTasks":15,"tasks":6},{"rssKiB":31436,"runtimeTasks":15,"tasks":6},{"rssKiB":31436,"runtimeTasks":15,"tasks":6},{"rssKiB":31444,"runtimeTasks":15,"tasks":6},{"rssKiB":31444,"runtimeTasks":15,"tasks":6},{"rssKiB":31464,"runtimeTasks":15,"tasks":6},{"rssKiB":31464,"runtimeTasks":15,"tasks":6},{"rssKiB":31492,"runtimeTasks":15,"tasks":6},{"rssKiB":31492,"runtimeTasks":15,"tasks":6},{"rssKiB":31492,"runtimeTasks":15,"tasks":6},{"rssKiB":31492,"runtimeTasks":15,"tasks":6},{"rssKiB":31508,"runtimeTasks":15,"tasks":6},{"rssKiB":31508,"runtimeTasks":15,"tasks":6},{"rssKiB":31512,"runtimeTasks":15,"tasks":6},{"rssKiB":31512,"runtimeTasks":15,"tasks":6},{"rssKiB":31528,"runtimeTasks":15,"tasks":6},{"rssKiB":31556,"runtimeTasks":15,"tasks":6},{"rssKiB":31576,"runtimeTasks":15,"tasks":6},{"rssKiB":31580,"runtimeTasks":15,"tasks":6},{"rssKiB":31592,"runtimeTasks":15,"tasks":6},{"rssKiB":31604,"runtimeTasks":15,"tasks":6},{"rssKiB":31604,"runtimeTasks":15,"tasks":6},{"rssKiB":31624,"runtimeTasks":15,"tasks":6},{"rssKiB":31644,"runtimeTasks":15,"tasks":6},{"rssKiB":31664,"runtimeTasks":15,"tasks":6},{"rssKiB":31664,"runtimeTasks":15,"tasks":6},{"rssKiB":31680,"runtimeTasks":15,"tasks":6},{"rssKiB":31684,"runtimeTasks":15,"tasks":6},{"rssKiB":31696,"runtimeTasks":15,"tasks":6},{"rssKiB":31696,"runtimeTasks":15,"tasks":6},{"rssKiB":31700,"runtimeTasks":15,"tasks":6},{"rssKiB":31700,"runtimeTasks":15,"tasks":6},{"rssKiB":31700,"runtimeTasks":15,"tasks":6},{"rssKiB":31712,"runtimeTasks":15,"tasks":6},{"rssKiB":31712,"runtimeTasks":15,"tasks":6},{"rssKiB":31712,"runtimeTasks":15,"tasks":6},{"rssKiB":31712,"runtimeTasks":15,"tasks":6},{"rssKiB":31724,"runtimeTasks":15,"tasks":6},{"rssKiB":31736,"runtimeTasks":15,"tasks":6},{"rssKiB":31764,"runtimeTasks":15,"tasks":6},{"rssKiB":31764,"runtimeTasks":15,"tasks":6},{"rssKiB":31764,"runtimeTasks":15,"tasks":6},{"rssKiB":31764,"runtimeTasks":15,"tasks":6},{"rssKiB":31784,"runtimeTasks":15,"tasks":6},{"rssKiB":31808,"runtimeTasks":15,"tasks":6},{"rssKiB":31824,"runtimeTasks":15,"tasks":6},{"rssKiB":31828,"runtimeTasks":15,"tasks":6},{"rssKiB":31828,"runtimeTasks":15,"tasks":6},{"rssKiB":31828,"runtimeTasks":15,"tasks":6},{"rssKiB":31828,"runtimeTasks":15,"tasks":6},{"rssKiB":31828,"runtimeTasks":15,"tasks":6},{"rssKiB":31836,"runtimeTasks":15,"tasks":6},{"rssKiB":31844,"runtimeTasks":15,"tasks":6},{"rssKiB":31844,"runtimeTasks":15,"tasks":6},{"rssKiB":31852,"runtimeTasks":15,"tasks":6},{"rssKiB":31872,"runtimeTasks":15,"tasks":6},{"rssKiB":31872,"runtimeTasks":15,"tasks":6},{"rssKiB":31872,"runtimeTasks":15,"tasks":6},{"rssKiB":31880,"runtimeTasks":15,"tasks":6},{"rssKiB":31884,"runtimeTasks":15,"tasks":6},{"rssKiB":31896,"runtimeTasks":15,"tasks":6}],"readiness":{"maxMicros":197,"observedMicros":[135,113,154,124,176,88,146,95,119,141,127,152,118,147,138,107,197,109,110,131,138,116,103,159,113,143,145,137,131,134,133,121,120,168,126,116,113,174,115,147,133,135,115,133,118,148,134,116,139,128,135,165,125,121,124,158,113,150,145,120,139,113,112,145,137,122,117,133,139,167,169,133,132,103,186,137,131,175,132,108,112,129,110,126,128,151,115,113,127,153,122,121,130,109,155,144,116,137,135,95],"p50Micros":131,"p95Micros":169},"runtimeTaskBaseline":15,"taskQuiescence":{"maxMicros":1,"observedMicros":[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1],"p50Micros":1,"p95Micros":1},"timeout":{"maxMicros":1174857,"observedMicros":[1138944,1132920,1139375,1146117,1159925,1174857,1133104,1139770,1150855,1135758,1138778,1136066,1140506,1130666,1143134,1139287,1151248,1149939,1130561,1131169,1138996,1138436,1125277,1121839,1132699,1138563,1151445,1141670,1149604,1140054,1137010,1132679,1136597,1142960,1141088,1140457,1127617,1138469,1146172,1130191,1126323,1144021,1120842,1146648,1132440,1147464,1138686,1135795,1142700,1140068,1137934,1135764,1124078,1115584,1145465,1134386,1136201,1146762,1134614,1146688,1143590,1140188,1140314,1147191,1134666,1146306,1148504,1146253,1129684,1136857,1134028,1145327,1148240,1149644,1134147,1135378,1139756,1140504,1129059,1151708,1135986,1133397,1124958,1139920,1135422,1135272,1148799,1129824,1137406,1137784,1126746,1137263,1139241,1146090,1139185,1130541,1138304,1133722,1126437,1143782],"p50Micros":1138563,"p95Micros":1150855}},"os":"linux","phase":"cycles","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"}],"exactResourcesPassed":["test_should_measure_one_hundred_warm_image_invocations","test_should_measure_twenty_preloaded_cold_image_environments","test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts"],"processGroupsJoined":true,"python":"3.12.3","profileConfiguration":{"display_name":"colima [profile=rustack-workflows-performance-arm64]","driver":"macOS Virtualization.Framework","arch":"aarch64","runtime":"docker","mount_type":"virtiofs","docker_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/docker.sock","containerd_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/containerd.sock","kubernetes":false,"cpu":4,"memory":8589934592,"disk":25769803776}}
+```
+
+## Raw final fourth-source report
+
+```json
+{"schemaVersion":1,"referenceQualification":"pending","binarySha256":{"test":"a4bb4b8152f67cbe78522e12db0ac882c127ae717e0d4029e3383629b174c6a9","server":"3f3e6750c3e2818b3a43b410871388a5f4b99120aaf46c0dfcbffb1d0708c8f4"},"engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","network":{"id":"21c24074040e18300c00457cf60102419bdf1c01588207a322243004643106d8","name":"rustack-d102-linux","driver":"bridge","labels":{"rustack.workflows.engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","rustack.workflows.nonce":"f367ab64-5f81-400d-b484-2d5461911291","rustack.workflows.task":"D102"},"ipam":[{"Gateway":"172.18.0.1","Subnet":"172.18.0.0/16"}]},"evidenceRoot":"/tmp/rustack-d102-linux-3w_gtdcn","reports":[{"architecture":"aarch64","baselineProcess":{"rssKiB":29832,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"handlerNanos":[10422194,10937741,10638530,10809740,10893491,10127525,10167442,10302568,10405860,11257704,10338069,10238359,10026399,11104327,10071816,10129858,10055482,11306204,10406736,11019575,10936825,11014034,10138108,10254484,10270359,10253109,10123108,10173816,11413414,10181816,10139775,10693531,10804240,10266901,10323610,10222484,10097816,10139441,11222202,11062784,10549279,10280484,11321246,11245703,11607373,10266067,10730489,11334913,10075816,10122274,10277318,11796000,10264068,10614738,10121649,11317787,11042950,11010576,10535695,10224442,10194025,10220525,10330193,12333423,10737364,11005742,10569237,10209983,10118691,10497236,10139566,11515581,10575362,10677197,10112983,10217442,10237025,10219775,11268620,11314329,10248568,10188067,10366443,10217901,10278317,12528674,10261859,10206942,10176983,10163608,10261526,10157066,10249567,10532821,11708999,10168234,10191816,10216817,12276172,10257859],"overhead":{"maxMicros":3980,"observedMicros":[1708,1372,1275,1362,1352,1415,1400,1539,1566,1678,1794,1637,1799,1849,2037,1958,1874,1900,1993,2175,2431,2555,2317,2652,2624,2455,2674,2676,2507,2846,2708,2639,2437,3430,3638,3191,3152,2596,3200,2924,3127,2694,2741,2978,2436,2592,2350,2062,2363,2149,2199,2317,3011,2750,2200,2585,2310,2578,2613,2488,3261,3128,2664,3505,2916,2895,2873,2676,2493,3746,3980,3141,2712,2901,2579,2686,2491,2624,2277,3305,3772,2866,2829,2314,2639,2825,2432,2416,2362,2391,2264,3873,3064,3736,3452,2568,2497,2285,2151,2361],"p50Micros":2568,"p95Micros":3638},"totalNanos":[12129379,12309131,11913168,12171671,12245172,11542414,11567415,11841043,11970878,12935346,12131338,11874710,11825251,12952805,12108462,12087212,11928794,13206016,12399674,13193807,13366892,13568727,12454883,12905887,12893721,12707218,12796552,12849595,13920023,13026889,12847470,13332309,13240724,13696188,13960815,13412517,13249516,12734927,14421570,13986523,13675396,12974221,14061649,14223068,14042525,12857636,13080389,13396809,12438633,12270547,12475924,14112526,13274308,13364600,12321256,13901940,13352184,13587645,13148682,12711677,13454351,13347558,12994138,15838001,13652978,13900564,13441434,12885512,12611342,14242276,14119525,14656031,13286891,13577478,12691093,12903304,12727927,12843178,13545227,14618863,14019691,13053514,13195140,12531634,12916387,15353372,12693552,12622550,12538133,12553759,12524550,14029858,13312850,14268277,15160911,12736011,12688510,12501591,14426237,12618051]},"os":"linux","phase":"warm","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29832,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"environments":["847077d6-a371-4e0a-92d4-c9e8c9f0d75e","f26b8d88-b70f-46b7-a3a6-890da26f4606","e854bfa1-2917-4d3f-8bee-950297344a5b","015eee1a-5a7b-4304-87d8-3b1af0b9bc34","feeaad6d-c69b-4040-b104-09dadc59a8f1","1cdb8acd-0955-42e2-b4a7-58517f656df7","ad79ebf2-bedf-40af-9e50-349fe165403a","7e13330b-d26d-4a9c-8e5e-9060bd057db6","13175ca9-e543-41b8-8b6c-afaea9372d32","3db56b69-44ba-4818-8e3a-2ba2ab06f853","781b50ec-cd59-4fb6-a00e-b0b085cf4639","ad082df6-2665-4ec9-bbdc-26f3821652d7","9932b747-c06e-40a8-a3d7-6a9cb8a6fbb0","07a6991a-653a-4401-815a-79ff624958fb","abc4af31-518a-4c18-a7bc-efa6f316bb49","a7e9064b-725f-4e4e-b070-3d199f1a323a","06b5430c-8339-42e3-9ba6-aaefd14a1668","67ec9783-4d67-42b4-8e19-35da3fe14fbd","e219db9c-c41d-413a-8e70-d71285321923","cf949820-79cd-4315-b56c-d8acfa6df31c"],"initialization":{"events":[{"environmentId":"847077d6-a371-4e0a-92d4-c9e8c9f0d75e","relayMicros":62172,"ricMicros":50202},{"environmentId":"f26b8d88-b70f-46b7-a3a6-890da26f4606","relayMicros":73770,"ricMicros":48637},{"environmentId":"e854bfa1-2917-4d3f-8bee-950297344a5b","relayMicros":62413,"ricMicros":48470},{"environmentId":"015eee1a-5a7b-4304-87d8-3b1af0b9bc34","relayMicros":63743,"ricMicros":49637},{"environmentId":"feeaad6d-c69b-4040-b104-09dadc59a8f1","relayMicros":64591,"ricMicros":53312},{"environmentId":"1cdb8acd-0955-42e2-b4a7-58517f656df7","relayMicros":63973,"ricMicros":43077},{"environmentId":"ad79ebf2-bedf-40af-9e50-349fe165403a","relayMicros":65772,"ricMicros":55607},{"environmentId":"7e13330b-d26d-4a9c-8e5e-9060bd057db6","relayMicros":61709,"ricMicros":48074},{"environmentId":"13175ca9-e543-41b8-8b6c-afaea9372d32","relayMicros":69543,"ricMicros":46237},{"environmentId":"3db56b69-44ba-4818-8e3a-2ba2ab06f853","relayMicros":59051,"ricMicros":44679},{"environmentId":"781b50ec-cd59-4fb6-a00e-b0b085cf4639","relayMicros":75409,"ricMicros":48800},{"environmentId":"ad082df6-2665-4ec9-bbdc-26f3821652d7","relayMicros":56089,"ricMicros":52955},{"environmentId":"9932b747-c06e-40a8-a3d7-6a9cb8a6fbb0","relayMicros":61962,"ricMicros":50916},{"environmentId":"07a6991a-653a-4401-815a-79ff624958fb","relayMicros":58553,"ricMicros":49234},{"environmentId":"abc4af31-518a-4c18-a7bc-efa6f316bb49","relayMicros":63387,"ricMicros":50797},{"environmentId":"a7e9064b-725f-4e4e-b070-3d199f1a323a","relayMicros":66464,"ricMicros":52369},{"environmentId":"06b5430c-8339-42e3-9ba6-aaefd14a1668","relayMicros":62655,"ricMicros":50226},{"environmentId":"67ec9783-4d67-42b4-8e19-35da3fe14fbd","relayMicros":66459,"ricMicros":51011},{"environmentId":"e219db9c-c41d-413a-8e70-d71285321923","relayMicros":67318,"ricMicros":52313},{"environmentId":"cf949820-79cd-4315-b56c-d8acfa6df31c","relayMicros":61137,"ricMicros":46339}],"functionRic":{"maxMicros":55607,"observedMicros":[50202,48637,48470,49637,53312,43077,55607,48074,46237,44679,48800,52955,50916,49234,50797,52369,50226,51011,52313,46339],"p50Micros":49637,"p95Micros":53312},"relay":{"maxMicros":75409,"observedMicros":[62172,73770,62413,63743,64591,63973,65772,61709,69543,59051,75409,56089,61962,58553,63387,66464,62655,66459,67318,61137],"p50Micros":63387,"p95Micros":73770},"startupBaseline":{"bytes":382,"sha256":"133f73e0b961925cf6b5e3b98e91f6848cb468e93e053297c7075d929a3ed224"}},"latency":{"maxMicros":126875,"observedMicros":[115427,125255,113758,117775,121836,111194,125489,113819,118617,107805,126875,111947,116890,111801,118331,122820,116838,120351,123792,111545],"p50Micros":116890,"p95Micros":125489},"uniqueContainers":40},"os":"linux","phase":"cold","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29860,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"completedCycles":100,"containerHighWater":2,"emptyAfterEachTimeout":true,"floods":[{"afterBytes":4096,"beforeBytes":1024,"requestId":"5ab043a7-b775-4968-aa77-c9794ba108e6"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e2b072e3-f6b0-4bf7-82c7-bd05f3d4fc50"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"8fcd421c-289e-4ef1-a608-8a78d299103f"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"6951fc87-ae5d-48f9-b3d2-c0ad82845145"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"8ec7bf50-f164-4e9e-a05c-4404295bc283"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"da8831cd-5aa5-4948-9594-451e20e49035"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5ad5a78b-ea1a-4d02-a151-0ebaefd7b882"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"bc7ebe6e-fd3e-40f9-ab72-6166a76133b3"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"1d6610b4-fddd-4a52-8bd5-57f3492b43f0"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"dbca636e-d8bc-430a-a454-e7fb1ab289e3"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"bfbc8cf9-4b27-46cb-819b-5b4e7aa65f2c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"386a8992-a7e9-4a84-85da-957a77ae6e2c"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"6e687376-2012-4c6a-a49d-0130f225f268"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"641c1202-052d-4899-b45b-548fe94772b5"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"1ef26b1f-97ea-41da-b334-bc828f6345bb"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"a1e4907e-e470-4c5c-bff4-5a0e215ee2a9"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"f9cc99e2-845a-4bea-ad5c-4580c9e44e94"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"04a06376-437c-490b-83fa-1e824abb6237"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"587a1a8f-eab4-40a5-954b-70492d968f23"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"705ee9a4-2b99-4751-a26f-d05fc2ffd67c"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"9bea31c7-14f2-47a9-9111-b6877cd6b41f"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"d70f1c4f-ac09-423e-ae34-29249c5fa6f3"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"fe7821a6-9d10-4a11-80b9-a45794f08dee"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"2264be57-969a-4ac8-b200-290a3400e998"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"b741d49f-1e86-47e6-820c-1f245adc5bbe"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"6e834158-82f1-41f9-a5b8-59cc6ad2202c"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"fa6ceab4-04b2-478f-b85c-6eaf7ae4768f"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"5c33cf3b-57f8-44e1-ada5-5cedf4b40b72"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"52cf41cb-87cc-4832-a421-7ac1d9b0c652"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"959cefe7-300b-44c0-ab87-353347944f33"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"fb862b02-5f68-4712-85f4-c6ad526fdd49"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"a20f5a25-b96b-42fd-aea7-a7e6fc470a2c"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"00da86be-cde8-4b64-b25b-891d07c53dcf"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"c0ede24c-f31e-413f-acdc-bdef6add9091"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"2f445418-a067-4797-93c5-469223158d52"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"66e59ae1-ffad-42a3-9495-42def6f49bcd"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"73c1e8af-9fca-4baf-86a0-7754bff63f73"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"a66c2c08-c496-4994-b470-bc682b3a8fa8"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"57dc5f2c-895c-474a-85b9-e271c8d6aaa9"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"8dc27c5f-ccc9-4d13-a6dc-5ab7aa49fe49"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"f60b6b07-6d82-4402-9086-bc035bc9c400"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"6f138247-147d-4736-8314-7cad46f06c23"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"49abae89-9e8a-499f-bd54-5ee0e5a95161"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"09d0bebc-2233-4bf7-a3b1-d3103b2aa0cd"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"ad0a2ae0-1761-47b3-bf5b-d0944e9f0330"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"089b5370-8ad9-4a1e-80fd-4a6a1b6728bd"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"c670cda8-112a-435c-a752-41d4cf655acf"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"ddfb8bb3-3616-4f72-92e8-ba4c65dca322"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"78135f4e-829d-4532-a8bb-076013ee7d83"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"65c3f38d-a902-43b8-99d0-95817fe9dbab"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d9e71b3d-86af-4cc1-b551-32788a6001f0"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"87f51df3-84e3-4953-85f7-95cd83482477"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"644639b3-4e04-4ee0-ba08-8d30d768c271"},{"afterBytes":6144,"beforeBytes":2048,"requestId":"c3586f1d-2fa6-4d76-bc67-407dd1cd0be6"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"10992748-4131-4314-b95e-095f935fbf59"},{"afterBytes":5120,"beforeBytes":2048,"requestId":"db93c9a8-f9b4-4572-a6c1-33db73a20a22"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"93f2ebcc-1073-4df5-a7ce-a1c7feb867ed"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"27487e99-372c-4815-9bf4-95d856b6f6cd"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"516d5adb-7f3c-40d4-b56c-b3c982bcf3ea"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"3b1eca70-9549-416b-946c-0f68b5d49e03"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"fadaf9e5-969d-4cd0-91c7-768dd1f092ae"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"ee4cf1b1-9586-4d44-830e-f9db2d641024"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"b8bd5a88-ff9c-4a68-96f5-674b563d1e06"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"c00418aa-df16-4b53-9291-e52b7602e9f0"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"5b573744-0ed2-4e93-b398-ccadcc980965"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"eec44888-3a6f-40fc-8ebf-dc895b4800bb"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"f5a34ce9-ccf6-46f5-8fde-84866cf8f343"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"2f118bc7-959a-49bc-a257-a089eb2accca"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"834f803f-73a7-4059-a1ed-fbcae9b299ce"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"cacd2ea4-5a15-46ea-9938-c6212c01cfb8"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"c7f4c0df-8f78-4c25-85a0-48b8e3701b63"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f8a6e2f2-9d22-47ac-b35f-c8667b18de44"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"71977f56-4b9f-4944-b00c-80c3ac609745"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"8fb70833-2505-456b-a385-ac2116534c7c"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"3c34b8c7-56cc-4900-a5fd-003f20bbdf52"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"2fcc9864-9f13-4ed0-af28-4af0021944b3"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"4b07da18-d178-4565-b2be-88cd361660f0"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"8d241313-a7bd-478a-a2ab-9b5e19ff2370"},{"afterBytes":4096,"beforeBytes":2048,"requestId":"ee2b1182-0f1d-4582-ba7f-82a2d53672f9"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f530432f-326c-48ce-ae02-824376565849"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"23b98dbc-b0a9-4159-855b-7465949a0816"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d2ae50a1-245c-4208-88a9-e3e27e2ffa2b"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"88eb29d3-83d7-4c08-8711-96fa58da84f1"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"e34815a9-d4ba-4848-95bf-81c100983758"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"31e5e7a7-042f-4eb9-9ba8-a8ad76cb9671"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"75ceb9c7-e13b-41e3-be0e-c03539da33ef"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"ccf62f08-bddc-48ea-8736-781f6c13c8b6"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"bb661245-b647-43d4-8aa5-4aca9d04b60b"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5636ed12-2c4c-4ae6-b137-2182be33b4a5"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"7fe4a4bc-3bec-49b7-947c-167166f24cd8"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"75a863e2-c928-41f6-bbf1-0e9982115aad"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"4a600a9b-e0c8-4718-bfd6-cc0b067f2462"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"d2db93fe-3b7c-462a-8dde-dfd87949f293"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"1405568f-33ee-4f98-a90b-2b06f5636419"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"6c78aad2-588a-4f13-8046-e1105af14ed8"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"e08b6bfb-da67-4baa-bebf-dbe179f4d4eb"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"2261eaec-eaa5-4ec2-91fd-b3f653f8c05b"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"19f931ee-3c4e-45af-a3c2-d716b1db3d40"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"c2965c09-62f4-496a-96c8-21c74f30ebc5"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"dc73fb56-c332-45cc-a583-adcf84057728"}],"liveBrackets":[[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false]],"primingCleanupConfirmed":true,"primingInvocations":1,"processStats":[{"rssKiB":30428,"runtimeTasks":15,"tasks":6},{"rssKiB":30596,"runtimeTasks":15,"tasks":6},{"rssKiB":30656,"runtimeTasks":15,"tasks":6},{"rssKiB":30728,"runtimeTasks":15,"tasks":6},{"rssKiB":30784,"runtimeTasks":15,"tasks":6},{"rssKiB":30824,"runtimeTasks":15,"tasks":6},{"rssKiB":30848,"runtimeTasks":15,"tasks":6},{"rssKiB":30904,"runtimeTasks":15,"tasks":6},{"rssKiB":31004,"runtimeTasks":15,"tasks":6},{"rssKiB":31024,"runtimeTasks":15,"tasks":6},{"rssKiB":31072,"runtimeTasks":15,"tasks":6},{"rssKiB":31092,"runtimeTasks":15,"tasks":6},{"rssKiB":31112,"runtimeTasks":15,"tasks":6},{"rssKiB":31188,"runtimeTasks":15,"tasks":6},{"rssKiB":31192,"runtimeTasks":15,"tasks":6},{"rssKiB":31216,"runtimeTasks":15,"tasks":6},{"rssKiB":31216,"runtimeTasks":15,"tasks":6},{"rssKiB":31220,"runtimeTasks":15,"tasks":6},{"rssKiB":31232,"runtimeTasks":15,"tasks":6},{"rssKiB":31244,"runtimeTasks":15,"tasks":6},{"rssKiB":31256,"runtimeTasks":15,"tasks":6},{"rssKiB":31272,"runtimeTasks":15,"tasks":6},{"rssKiB":31276,"runtimeTasks":15,"tasks":6},{"rssKiB":31276,"runtimeTasks":15,"tasks":6},{"rssKiB":31304,"runtimeTasks":15,"tasks":6},{"rssKiB":31304,"runtimeTasks":15,"tasks":6},{"rssKiB":31320,"runtimeTasks":15,"tasks":6},{"rssKiB":31320,"runtimeTasks":15,"tasks":6},{"rssKiB":31324,"runtimeTasks":15,"tasks":6},{"rssKiB":31348,"runtimeTasks":15,"tasks":6},{"rssKiB":31356,"runtimeTasks":15,"tasks":6},{"rssKiB":31400,"runtimeTasks":15,"tasks":6},{"rssKiB":31436,"runtimeTasks":15,"tasks":6},{"rssKiB":31456,"runtimeTasks":15,"tasks":6},{"rssKiB":31484,"runtimeTasks":15,"tasks":6},{"rssKiB":31488,"runtimeTasks":15,"tasks":6},{"rssKiB":31496,"runtimeTasks":15,"tasks":6},{"rssKiB":31516,"runtimeTasks":15,"tasks":6},{"rssKiB":31516,"runtimeTasks":15,"tasks":6},{"rssKiB":31520,"runtimeTasks":15,"tasks":6},{"rssKiB":31524,"runtimeTasks":15,"tasks":6},{"rssKiB":31540,"runtimeTasks":15,"tasks":6},{"rssKiB":31544,"runtimeTasks":15,"tasks":6},{"rssKiB":31544,"runtimeTasks":15,"tasks":6},{"rssKiB":31544,"runtimeTasks":15,"tasks":6},{"rssKiB":31544,"runtimeTasks":15,"tasks":6},{"rssKiB":31568,"runtimeTasks":15,"tasks":6},{"rssKiB":31568,"runtimeTasks":15,"tasks":6},{"rssKiB":31576,"runtimeTasks":15,"tasks":6},{"rssKiB":31592,"runtimeTasks":15,"tasks":6},{"rssKiB":31600,"runtimeTasks":15,"tasks":6},{"rssKiB":31616,"runtimeTasks":15,"tasks":6},{"rssKiB":31616,"runtimeTasks":15,"tasks":6},{"rssKiB":31616,"runtimeTasks":15,"tasks":6},{"rssKiB":31616,"runtimeTasks":15,"tasks":6},{"rssKiB":31620,"runtimeTasks":15,"tasks":6},{"rssKiB":31624,"runtimeTasks":15,"tasks":6},{"rssKiB":31624,"runtimeTasks":15,"tasks":6},{"rssKiB":31624,"runtimeTasks":15,"tasks":6},{"rssKiB":31624,"runtimeTasks":15,"tasks":6},{"rssKiB":31628,"runtimeTasks":15,"tasks":6},{"rssKiB":31656,"runtimeTasks":15,"tasks":6},{"rssKiB":31660,"runtimeTasks":15,"tasks":6},{"rssKiB":31660,"runtimeTasks":15,"tasks":6},{"rssKiB":31672,"runtimeTasks":15,"tasks":6},{"rssKiB":31676,"runtimeTasks":15,"tasks":6},{"rssKiB":31676,"runtimeTasks":15,"tasks":6},{"rssKiB":31680,"runtimeTasks":15,"tasks":6},{"rssKiB":31680,"runtimeTasks":15,"tasks":6},{"rssKiB":31680,"runtimeTasks":15,"tasks":6},{"rssKiB":31696,"runtimeTasks":15,"tasks":6},{"rssKiB":31696,"runtimeTasks":15,"tasks":6},{"rssKiB":31696,"runtimeTasks":15,"tasks":6},{"rssKiB":31716,"runtimeTasks":15,"tasks":6},{"rssKiB":31716,"runtimeTasks":15,"tasks":6},{"rssKiB":31716,"runtimeTasks":15,"tasks":6},{"rssKiB":31716,"runtimeTasks":15,"tasks":6},{"rssKiB":31720,"runtimeTasks":15,"tasks":6},{"rssKiB":31728,"runtimeTasks":15,"tasks":6},{"rssKiB":31736,"runtimeTasks":15,"tasks":6},{"rssKiB":31748,"runtimeTasks":15,"tasks":6},{"rssKiB":31752,"runtimeTasks":15,"tasks":6},{"rssKiB":31780,"runtimeTasks":15,"tasks":6},{"rssKiB":31788,"runtimeTasks":15,"tasks":6},{"rssKiB":31792,"runtimeTasks":15,"tasks":6},{"rssKiB":31796,"runtimeTasks":15,"tasks":6},{"rssKiB":31796,"runtimeTasks":15,"tasks":6},{"rssKiB":31800,"runtimeTasks":15,"tasks":6},{"rssKiB":31812,"runtimeTasks":15,"tasks":6},{"rssKiB":31820,"runtimeTasks":15,"tasks":6},{"rssKiB":31828,"runtimeTasks":15,"tasks":6},{"rssKiB":31840,"runtimeTasks":15,"tasks":6},{"rssKiB":31848,"runtimeTasks":15,"tasks":6},{"rssKiB":31848,"runtimeTasks":15,"tasks":6},{"rssKiB":31852,"runtimeTasks":15,"tasks":6},{"rssKiB":31852,"runtimeTasks":15,"tasks":6},{"rssKiB":31852,"runtimeTasks":15,"tasks":6},{"rssKiB":31852,"runtimeTasks":15,"tasks":6},{"rssKiB":31884,"runtimeTasks":15,"tasks":6},{"rssKiB":31884,"runtimeTasks":15,"tasks":6}],"readiness":{"maxMicros":385,"observedMicros":[96,97,135,162,131,133,113,131,135,129,150,110,135,126,152,123,148,165,188,156,142,132,145,170,134,109,144,110,156,114,147,133,135,110,148,142,107,112,131,147,134,117,114,128,158,149,170,117,145,96,131,129,136,165,140,385,141,131,149,113,157,129,110,123,138,116,133,132,132,142,139,128,156,135,144,111,131,131,98,139,115,110,131,129,138,163,169,124,132,160,161,135,121,110,109,109,115,103,107,134],"p50Micros":132,"p95Micros":165},"runtimeTaskBaseline":15,"taskQuiescence":{"maxMicros":3875,"observedMicros":[2706,2431,3135,2490,2560,2501,2468,2548,2576,2586,2540,2567,2648,2550,2705,3061,2489,2630,2695,2771,2835,2604,2698,2452,2471,2617,2492,2640,2704,2662,2751,2868,2566,2552,2635,2438,2674,2529,2603,2594,2920,2619,2635,2647,2575,2838,2735,2629,2596,3107,2446,2602,2569,2569,2563,2566,2676,2488,2601,2545,2572,2569,2896,2785,2745,2717,2585,2597,2898,2454,2474,2532,2629,2549,2645,2518,2899,2739,2689,2396,2779,2747,2779,2501,2715,2607,2600,2659,2669,2499,2624,2692,2668,2633,3875,2606,2707,2885,2986,2497],"p50Micros":2617,"p95Micros":2920},"timeout":{"maxMicros":1162479,"observedMicros":[1136413,1100208,1127365,1129268,1137203,1162479,1129518,1140368,1145727,1139333,1131199,1136388,1133954,1137551,1143065,1130313,1105192,1134214,1125240,1150594,1126636,1141794,1128890,1137954,1135795,1135514,1143988,1139066,1141168,1146377,1139123,1126525,1152341,1127539,1135709,1138768,1139919,1132776,1143995,1131213,1147591,1144765,1134964,1147248,1138968,1144179,1138965,1139700,1142882,1134871,1136519,1142035,1143156,1135710,1140604,1143708,1130980,1133632,1140934,1130349,1135588,1141550,1158401,1143528,1139691,1135075,1148422,1139551,1151248,1123693,1138378,1128065,1145801,1141754,1149102,1125487,1123304,1127684,1147383,1135239,1140308,1128572,1144784,1133318,1121155,1146741,1128307,1135281,1141547,1139703,1142096,1148093,1143491,1141089,1141929,1141742,1144084,1134195,1135218,1145261],"p50Micros":1138968,"p95Micros":1149102}},"os":"linux","phase":"cycles","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"}],"exactResourcesPassed":["test_should_measure_one_hundred_warm_image_invocations","test_should_measure_twenty_preloaded_cold_image_environments","test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts"],"processGroupsJoined":true,"python":"3.12.3","profileConfiguration":{"display_name":"colima [profile=rustack-workflows-performance-arm64]","driver":"macOS Virtualization.Framework","arch":"aarch64","runtime":"docker","mount_type":"virtiofs","docker_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/docker.sock","containerd_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/containerd.sock","kubernetes":false,"cpu":4,"memory":8589934592,"disk":25769803776}}
+```
+
+## Raw sixth-source Linux report
+
+```json
+{"schemaVersion":1,"referenceQualification":"pending","binarySha256":{"test":"a4bb4b8152f67cbe78522e12db0ac882c127ae717e0d4029e3383629b174c6a9","server":"3f3e6750c3e2818b3a43b410871388a5f4b99120aaf46c0dfcbffb1d0708c8f4"},"engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","network":{"id":"21c24074040e18300c00457cf60102419bdf1c01588207a322243004643106d8","name":"rustack-d102-linux","driver":"bridge","labels":{"rustack.workflows.engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","rustack.workflows.nonce":"f367ab64-5f81-400d-b484-2d5461911291","rustack.workflows.task":"D102"},"ipam":[{"Gateway":"172.18.0.1","Subnet":"172.18.0.0/16"}]},"evidenceRoot":"/tmp/rustack-d102-linux-4tpobc2a","reports":[{"architecture":"aarch64","baselineProcess":{"rssKiB":29668,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"handlerNanos":[10541413,10148157,10324493,12460901,10670416,12425776,11986019,10142491,10528121,10119531,10207242,10325869,12935951,11661764,10249201,10190783,10194700,12120521,11598679,12664655,10294452,11543762,10181992,10094531,10441453,10085823,10357786,11208632,11025963,10521705,11887018,10726583,10135365,10384869,10288118,10239784,10071532,10285743,10309660,10612164,10269243,10107115,10127615,10387577,12387859,11143714,10186700,10824501,10205575,10303035,10249200,10190033,10319618,10535121,10351493,10267701,10181325,10656082,10295243,11174507,10225284,10093407,10343410,10380578,10456746,10147240,10188283,11621306,10108365,10083114,10201824,10709416,10391536,10547872,11439344,10190908,10361452,10217325,11150048,10159365,10330369,10291951,11487512,10241159,10324285,10087323,10309451,10175824,10136615,10332327,10307451,10207074,10229367,10361410,10092698,10133490,10136366,11815183,10365744,10212991],"overhead":{"maxMicros":2227,"observedMicros":[1670,1704,2227,1648,1462,1380,1386,1533,1449,1356,1279,1332,1419,1323,1330,1333,1443,1444,1387,1497,1390,1358,1350,1304,1214,1457,1340,1545,1313,1296,1340,1398,1368,1284,1322,1284,1234,1245,1225,1258,1328,1549,1326,1341,1234,1350,1276,1270,1557,1355,1364,1288,1278,1348,1311,1390,1330,1326,1396,1379,1336,1273,1298,1356,1508,1453,1686,1476,1370,1805,1528,1643,1789,1582,1438,1462,1419,1360,1448,2098,1805,1696,1513,1442,1641,1447,1390,1488,1446,1572,1438,1388,1376,1875,1696,1515,1484,1739,2203,1488],"p50Micros":1390,"p95Micros":1805},"totalNanos":[12210814,11851517,12550944,14108010,12132229,13805630,13371124,11674514,11976936,11475011,11485637,11657764,14354889,12983993,11578971,11523054,11637138,13563919,12985077,14161470,11684348,12901200,11531053,11398176,11654472,11542679,11697098,12752947,12338900,11817225,13226538,12123688,11503220,11668848,11609471,11523762,11305300,11529845,11534096,11869518,11597097,11655139,11453594,11727849,13621253,12493485,11462219,12093562,11762140,11657472,11612596,11477928,11596638,11882226,11662098,11656931,11510720,11981270,11690597,12553194,11561096,11365968,11640764,11735598,11964102,11599514,11874142,13097245,11478220,11887725,11729390,12352233,12179897,12129729,12876783,11652764,11780433,11576971,12597904,12257315,12134647,11987935,13000410,11682598,11965144,11534179,11699431,11663306,11582179,11904227,11744932,11594763,11604555,12235648,11787850,11647763,11620139,13553711,12568570,11700098]},"os":"linux","phase":"warm","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29800,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"environments":["cf963cb6-4e36-44c6-9c02-f0396d7fdcb5","7d0f13b8-1c87-47e8-989c-45afe42beafb","1005f50b-4745-4738-b8dc-49bf62b493c7","efe29817-b878-49ee-b3f2-64cffbcd2f2c","3777b50f-8b62-4964-963d-eb3eccc2bae7","003ee7a0-fa50-47ed-8199-584c239be41c","8ada8a59-04e1-465e-87bf-0c421029b857","3dde9e65-e55c-4365-8d8f-7ff0462b5eda","8fec072e-1475-482c-8173-93453623a64f","b04ca71f-b70d-45cd-ab76-00a8e641e03d","865c8ec9-5129-4ef0-8e93-5ad12ba243ed","1ef79070-2de5-4458-8ad2-a6336cd40a63","8fac4fe8-0a4e-49c9-b799-307e7291c21a","fcda519b-d711-400b-b284-caab52539e29","7d97b40d-f09c-441d-b686-e841bd280140","689522d7-b29c-41ab-b8cb-7e9896328b30","99978b99-97e4-4a31-9653-71d85d80c2a5","182e110f-4377-42e0-8ae1-712c8cf5455b","b2b6fb96-2f3d-4e72-b0e3-784baebb9086","bc1b5b00-5e3c-4571-91a7-dc5cc8437499"],"initialization":{"events":[{"environmentId":"cf963cb6-4e36-44c6-9c02-f0396d7fdcb5","relayMicros":73228,"ricMicros":55282},{"environmentId":"7d0f13b8-1c87-47e8-989c-45afe42beafb","relayMicros":71591,"ricMicros":53465},{"environmentId":"1005f50b-4745-4738-b8dc-49bf62b493c7","relayMicros":77340,"ricMicros":49546},{"environmentId":"efe29817-b878-49ee-b3f2-64cffbcd2f2c","relayMicros":68434,"ricMicros":52682},{"environmentId":"3777b50f-8b62-4964-963d-eb3eccc2bae7","relayMicros":69147,"ricMicros":51795},{"environmentId":"003ee7a0-fa50-47ed-8199-584c239be41c","relayMicros":78823,"ricMicros":62777},{"environmentId":"8ada8a59-04e1-465e-87bf-0c421029b857","relayMicros":67564,"ricMicros":56037},{"environmentId":"3dde9e65-e55c-4365-8d8f-7ff0462b5eda","relayMicros":59718,"ricMicros":55830},{"environmentId":"8fec072e-1475-482c-8173-93453623a64f","relayMicros":66162,"ricMicros":52774},{"environmentId":"b04ca71f-b70d-45cd-ab76-00a8e641e03d","relayMicros":82942,"ricMicros":60009},{"environmentId":"865c8ec9-5129-4ef0-8e93-5ad12ba243ed","relayMicros":119306,"ricMicros":78987},{"environmentId":"1ef79070-2de5-4458-8ad2-a6336cd40a63","relayMicros":70857,"ricMicros":59827},{"environmentId":"8fac4fe8-0a4e-49c9-b799-307e7291c21a","relayMicros":80180,"ricMicros":72100},{"environmentId":"fcda519b-d711-400b-b284-caab52539e29","relayMicros":79659,"ricMicros":59924},{"environmentId":"7d97b40d-f09c-441d-b686-e841bd280140","relayMicros":72159,"ricMicros":56448},{"environmentId":"689522d7-b29c-41ab-b8cb-7e9896328b30","relayMicros":70953,"ricMicros":62207},{"environmentId":"99978b99-97e4-4a31-9653-71d85d80c2a5","relayMicros":63920,"ricMicros":52880},{"environmentId":"182e110f-4377-42e0-8ae1-712c8cf5455b","relayMicros":65416,"ricMicros":53021},{"environmentId":"b2b6fb96-2f3d-4e72-b0e3-784baebb9086","relayMicros":73011,"ricMicros":55856},{"environmentId":"bc1b5b00-5e3c-4571-91a7-dc5cc8437499","relayMicros":69478,"ricMicros":55368}],"functionRic":{"maxMicros":78987,"observedMicros":[55282,53465,49546,52682,51795,62777,56037,55830,52774,60009,78987,59827,72100,59924,56448,62207,52880,53021,55856,55368],"p50Micros":55830,"p95Micros":72100},"relay":{"maxMicros":119306,"observedMicros":[73228,71591,77340,68434,69147,78823,67564,59718,66162,82942,119306,70857,80180,79659,72159,70953,63920,65416,73011,69478],"p50Micros":70953,"p95Micros":82942},"startupBaseline":{"bytes":382,"sha256":"9782d42899a080b5bd61901a29e6bcf8b21fd53fb1e09d8d44e82aa1db244642"}},"latency":{"maxMicros":203343,"observedMicros":[132962,129126,130845,125064,125064,145011,127828,118559,123228,147778,203343,134941,156604,142894,132653,136112,120939,121247,133185,129016],"p50Micros":130845,"p95Micros":156604},"uniqueContainers":40},"os":"linux","phase":"cold","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29864,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"completedCycles":100,"containerHighWater":2,"emptyAfterEachTimeout":true,"floods":[{"afterBytes":4096,"beforeBytes":1024,"requestId":"2e4cecf9-fd61-481a-968f-dafc56cdf910"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5d46f1da-a2bd-4ec7-8b50-3f2a590ad42a"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e57fb4f4-71c9-455f-a153-a656f2b3df51"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"fa4e3ca6-b490-4441-908f-ad5efb175a9e"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"468a3945-0dee-4099-9b66-b4c55505bddf"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"5e4e9b28-90ae-4bae-acd5-c345abeb0b5b"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"59061def-bd48-4acd-97e7-c0db74bd3f7b"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"9ebdcf10-bfb7-4d2f-9367-d0a20156070f"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"bf02917e-1c6d-4edc-99e3-b54f53229e37"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"8fffae17-efc2-41ad-b536-a128e3949b70"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"12ca5240-e6f0-4bbe-9a9c-9ef7cc48ca77"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"acd86740-a7a8-4337-95e7-4a2d008180fd"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"aca22311-ada3-40fc-8292-f881ee5fab49"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"267ce9a6-015d-41fe-b5ce-bb825051f4ea"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5459f9a1-4fc3-446e-b791-e1b32beacc89"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"e5674473-a2bc-4974-84c3-f7cc60f71ce5"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"0826a355-55ea-45ca-8729-f99b3578aee9"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"f658f788-753d-479b-b378-69b17d7294a0"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"1f403fd8-4617-4fbe-8705-2d76c6c6605c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"a51f4236-3000-46fc-a6a6-0200ab86be3f"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"a897c291-9c4d-45bd-83af-511d4ebb4ac1"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"7d051130-1882-44f0-b4a3-47bf171852e9"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"326b0a74-ed4b-40bf-8e48-8241cb0d2be5"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"765cb43d-a4ef-4954-b552-933f2614beb9"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"0e47b64b-5f48-4c6d-ab1e-38b668996669"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"760b2d78-8589-4daa-9933-53a28693cb3b"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"eab4960c-1c58-4dea-8405-d0043b7c3683"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"32d631f9-fe50-4d01-832f-c8f5714ac659"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"b1bfa538-7963-4b6c-9632-fdb68ce6e347"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"eacd2a3a-b03a-40b1-a330-4460972a670b"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"fc865eee-099b-480d-af9e-d8539aba99fe"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"eb084eda-ae74-4816-b3f2-d62f2c167a77"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"c14f8491-c5c9-4526-afd6-986fd5ade2c9"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"b9f01927-f470-451d-9aad-126dcefaaf49"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"08dd2f80-c9b0-45c5-8a20-51df17d64178"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"843ab77a-e696-482a-a46e-7ec934233240"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"6316f465-d365-403d-95b8-df4cd54b32ed"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5d9da143-9fc3-4d2f-b02b-fd9641746384"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"5fdbf85c-f3f3-458d-9293-6a7820751171"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"faecdd07-55a8-48e9-83e4-ae434ce2fc76"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"ba973efd-fdef-4982-88f4-370129ca91ac"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"96356a1a-36ac-42c7-b57e-7ab235b5aaeb"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"a0a9651b-d0da-4097-8120-b177b1e7aced"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"7d03548a-67f2-449f-a10a-a7b43c155249"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"33776cf0-3f39-46f2-a164-952ad15228ec"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"16eccae0-d6e4-46e5-b11b-cc518dbf5601"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"333c2b2b-abf5-4709-a38c-7142d79973f9"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"20083043-1b45-4efd-bac5-e35c0aedfa2f"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"49e9eb90-23f2-49cb-83f7-045b9618d4eb"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"b5fd6dc2-74ee-4409-af84-211f5eff54f1"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"ebf81683-7b17-4855-8fa3-8e3af7fb127b"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"264834fc-e9ea-4c6f-9d36-c34c7e8d3868"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"a2554169-8b80-4996-9671-16025e491d8a"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"b8b1af4a-927d-4671-8eb2-89f3eaa4a6d6"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"0390487c-bf40-46e2-aadd-b8444aa48ad0"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"2759c5b2-8c18-4dde-91c6-427da3fdb17c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d51dd408-af1c-4749-8e26-ffbea4bc4a02"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"0c927880-39e9-4a22-bc57-67a28bcdae59"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"dfd61f57-bac6-4e7b-8737-7b4869d6bb29"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d1974de9-1108-49f2-ac24-74b2f40251d0"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"b8bcf452-cbe3-4ed0-9b9c-5774ba2b581a"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"332534e2-92b9-4d51-93e4-be9bb0b27266"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"afdaafba-d43f-42d6-9819-3470f2fd1066"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"76aa1294-34c6-4d10-9e3a-9a5a8bf2deb5"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f8c6bf27-bbfd-4925-805f-63628687df94"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"41b0af5b-ae2a-4968-9f09-067381782029"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f85cfe1c-1976-4ebf-9bd4-40e42d2e6ef5"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"c357cbee-b944-43b9-8cda-cad85986d44a"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"4e61c627-9f66-4302-acf8-94e41be14b07"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"59386586-1285-4a5b-90a7-f0b862423d65"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"11689c43-8ee7-4da1-aa28-f9c363595be8"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"a390ac06-1598-4378-861e-265b3441d080"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"221a26ea-d8c6-47f9-88c3-faf19dcb3414"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"bc1dd2b5-f618-4d20-921d-a266a8b19790"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"c99baeea-2dcb-466c-bb8b-aab1de68e033"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"d49addb9-5115-4b0f-b000-9696bcb3d117"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"94b8cbd9-2b59-429f-99ec-fc6ba1cb850e"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"29c7ae55-83ee-4c79-976d-a96fc0c3b506"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"022a0909-c4f9-4d0b-bd18-08679dcedcab"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"3f607227-b121-441a-b458-c200d5b1dbe8"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"3f3ede28-fa25-461d-b8d6-334e24f22b51"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"45a80227-96c3-494a-9317-55fcb8248f7a"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"5015c28a-466d-4e2e-a924-a55273f8b3d9"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"b21da6eb-7c33-4495-a611-b7d789deab1c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"49924c9c-22db-422e-943f-777595449c9b"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"57012dd9-859e-49ae-bb5d-fe96a963fbad"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"1e0cbd55-21fb-4d51-9459-f983454f902a"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"5930afe6-0604-4e33-9a3a-ca0681212f84"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"2ec1ac00-20c8-482d-99da-0697ea577a72"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"a609832d-e968-45a9-a871-90895f3ec436"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"e7539160-183a-4647-a8f0-c8cf4f8faca3"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"e5c5f622-2031-451b-a381-a8720e411e68"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"7a14fb78-35e0-481f-9019-e425c8f6692d"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"e16a4949-f85b-4fa6-8d24-031808fcfd34"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"3954768c-cae4-4046-b134-05dcffc43e73"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"53fd5abf-31d0-475c-ad20-512d2b120735"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"8591cac4-a07a-44bd-97c4-bd9600a779c9"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"a9a009e0-3a27-4d2e-b6fe-5c3a2687bfc7"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"2d61fe8d-17ae-46bb-a7eb-d50716cc64a4"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"3b3d1169-a077-4a6f-b979-61b8b7137d96"}],"liveBrackets":[[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false]],"primingCleanupConfirmed":true,"primingInvocations":1,"processStats":[{"rssKiB":30484,"runtimeTasks":15,"tasks":6},{"rssKiB":30540,"runtimeTasks":15,"tasks":6},{"rssKiB":30592,"runtimeTasks":15,"tasks":6},{"rssKiB":30680,"runtimeTasks":15,"tasks":6},{"rssKiB":30736,"runtimeTasks":15,"tasks":6},{"rssKiB":30752,"runtimeTasks":15,"tasks":6},{"rssKiB":30860,"runtimeTasks":15,"tasks":6},{"rssKiB":30968,"runtimeTasks":15,"tasks":6},{"rssKiB":30996,"runtimeTasks":15,"tasks":6},{"rssKiB":31020,"runtimeTasks":15,"tasks":6},{"rssKiB":31020,"runtimeTasks":15,"tasks":6},{"rssKiB":31036,"runtimeTasks":15,"tasks":6},{"rssKiB":31048,"runtimeTasks":15,"tasks":6},{"rssKiB":31048,"runtimeTasks":15,"tasks":6},{"rssKiB":31068,"runtimeTasks":15,"tasks":6},{"rssKiB":31092,"runtimeTasks":15,"tasks":6},{"rssKiB":31132,"runtimeTasks":15,"tasks":6},{"rssKiB":31140,"runtimeTasks":15,"tasks":6},{"rssKiB":31176,"runtimeTasks":15,"tasks":6},{"rssKiB":31204,"runtimeTasks":15,"tasks":6},{"rssKiB":31240,"runtimeTasks":15,"tasks":6},{"rssKiB":31240,"runtimeTasks":15,"tasks":6},{"rssKiB":31268,"runtimeTasks":15,"tasks":6},{"rssKiB":31272,"runtimeTasks":15,"tasks":6},{"rssKiB":31276,"runtimeTasks":15,"tasks":6},{"rssKiB":31284,"runtimeTasks":15,"tasks":6},{"rssKiB":31328,"runtimeTasks":15,"tasks":6},{"rssKiB":31352,"runtimeTasks":15,"tasks":6},{"rssKiB":31368,"runtimeTasks":15,"tasks":6},{"rssKiB":31384,"runtimeTasks":15,"tasks":6},{"rssKiB":31440,"runtimeTasks":15,"tasks":6},{"rssKiB":31440,"runtimeTasks":15,"tasks":6},{"rssKiB":31456,"runtimeTasks":15,"tasks":6},{"rssKiB":31464,"runtimeTasks":15,"tasks":6},{"rssKiB":31476,"runtimeTasks":15,"tasks":6},{"rssKiB":31496,"runtimeTasks":15,"tasks":6},{"rssKiB":31512,"runtimeTasks":15,"tasks":6},{"rssKiB":31516,"runtimeTasks":15,"tasks":6},{"rssKiB":31528,"runtimeTasks":15,"tasks":6},{"rssKiB":31564,"runtimeTasks":15,"tasks":6},{"rssKiB":31576,"runtimeTasks":15,"tasks":6},{"rssKiB":31576,"runtimeTasks":15,"tasks":6},{"rssKiB":31580,"runtimeTasks":15,"tasks":6},{"rssKiB":31592,"runtimeTasks":15,"tasks":6},{"rssKiB":31592,"runtimeTasks":15,"tasks":6},{"rssKiB":31608,"runtimeTasks":15,"tasks":6},{"rssKiB":31616,"runtimeTasks":15,"tasks":6},{"rssKiB":31648,"runtimeTasks":15,"tasks":6},{"rssKiB":31656,"runtimeTasks":15,"tasks":6},{"rssKiB":31656,"runtimeTasks":15,"tasks":6},{"rssKiB":31700,"runtimeTasks":15,"tasks":6},{"rssKiB":31700,"runtimeTasks":15,"tasks":6},{"rssKiB":31700,"runtimeTasks":15,"tasks":6},{"rssKiB":31700,"runtimeTasks":15,"tasks":6},{"rssKiB":31720,"runtimeTasks":15,"tasks":6},{"rssKiB":31720,"runtimeTasks":15,"tasks":6},{"rssKiB":31720,"runtimeTasks":15,"tasks":6},{"rssKiB":31740,"runtimeTasks":15,"tasks":6},{"rssKiB":31764,"runtimeTasks":15,"tasks":6},{"rssKiB":31788,"runtimeTasks":15,"tasks":6},{"rssKiB":31792,"runtimeTasks":15,"tasks":6},{"rssKiB":31808,"runtimeTasks":15,"tasks":6},{"rssKiB":31808,"runtimeTasks":15,"tasks":6},{"rssKiB":31824,"runtimeTasks":15,"tasks":6},{"rssKiB":31824,"runtimeTasks":15,"tasks":6},{"rssKiB":31824,"runtimeTasks":15,"tasks":6},{"rssKiB":31824,"runtimeTasks":15,"tasks":6},{"rssKiB":31844,"runtimeTasks":15,"tasks":6},{"rssKiB":31880,"runtimeTasks":15,"tasks":6},{"rssKiB":31880,"runtimeTasks":15,"tasks":6},{"rssKiB":31880,"runtimeTasks":15,"tasks":6},{"rssKiB":31880,"runtimeTasks":15,"tasks":6},{"rssKiB":31880,"runtimeTasks":15,"tasks":6},{"rssKiB":31884,"runtimeTasks":15,"tasks":6},{"rssKiB":31888,"runtimeTasks":15,"tasks":6},{"rssKiB":31904,"runtimeTasks":15,"tasks":6},{"rssKiB":31904,"runtimeTasks":15,"tasks":6},{"rssKiB":31908,"runtimeTasks":15,"tasks":6},{"rssKiB":31928,"runtimeTasks":15,"tasks":6},{"rssKiB":31936,"runtimeTasks":15,"tasks":6},{"rssKiB":31936,"runtimeTasks":15,"tasks":6},{"rssKiB":31936,"runtimeTasks":15,"tasks":6},{"rssKiB":31944,"runtimeTasks":15,"tasks":6},{"rssKiB":31944,"runtimeTasks":15,"tasks":6},{"rssKiB":31944,"runtimeTasks":15,"tasks":6},{"rssKiB":31944,"runtimeTasks":15,"tasks":6},{"rssKiB":31944,"runtimeTasks":15,"tasks":6},{"rssKiB":31944,"runtimeTasks":15,"tasks":6},{"rssKiB":31944,"runtimeTasks":15,"tasks":6},{"rssKiB":31964,"runtimeTasks":15,"tasks":6},{"rssKiB":31964,"runtimeTasks":15,"tasks":6},{"rssKiB":31964,"runtimeTasks":15,"tasks":6},{"rssKiB":31968,"runtimeTasks":15,"tasks":6},{"rssKiB":31968,"runtimeTasks":15,"tasks":6},{"rssKiB":31976,"runtimeTasks":15,"tasks":6},{"rssKiB":31976,"runtimeTasks":15,"tasks":6},{"rssKiB":31976,"runtimeTasks":15,"tasks":6},{"rssKiB":31984,"runtimeTasks":15,"tasks":6},{"rssKiB":31984,"runtimeTasks":15,"tasks":6},{"rssKiB":31984,"runtimeTasks":15,"tasks":6}],"readiness":{"maxMicros":235,"observedMicros":[125,131,165,107,103,116,113,131,191,134,109,144,135,132,154,130,135,115,116,124,131,132,142,123,126,110,136,128,138,130,140,133,109,113,134,124,130,130,159,111,156,103,143,103,108,126,136,235,114,149,125,112,122,135,114,127,132,137,135,157,163,110,134,128,167,120,158,113,138,134,139,139,133,134,131,127,139,137,104,98,104,144,129,135,133,125,143,132,163,127,149,113,145,113,137,125,134,131,132,122],"p50Micros":131,"p95Micros":163},"runtimeTaskBaseline":15,"taskQuiescence":{"maxMicros":3572,"observedMicros":[2934,2683,2728,2423,2806,2420,2496,2522,2492,2525,2485,2544,2393,2465,2494,2376,3265,2681,2636,2399,2455,2421,2538,2867,2503,2483,2423,2502,2830,2532,2586,2712,2618,2464,2681,2622,2696,2616,2636,2539,2372,2559,2949,2473,2648,2726,2532,2606,2519,2482,2564,2597,2420,2447,2522,2724,2443,2437,2628,3228,2563,2535,3572,2637,2441,2481,2987,2544,2436,2655,2516,2408,2593,2837,2478,2593,2649,2430,2502,2461,2441,2492,2523,2625,2462,2459,2624,2516,2553,2591,2580,3097,2716,2820,2448,2578,2606,2763,2428,2590],"p50Micros":2539,"p95Micros":2949},"timeout":{"maxMicros":1138228,"observedMicros":[1106523,1104475,1121616,1113164,1138228,1130126,1126636,1132763,1123567,1116807,1128391,1132946,1122449,1122543,1132246,1116600,1124828,1111639,1116444,1128679,1115304,1119818,1117645,1119968,1120488,1117287,1128089,1116331,1121500,1108458,1120946,1121405,1124874,1124794,1125074,1133111,1119209,1124735,1114573,1114208,1118770,1114873,1123231,1129989,1131789,1125312,1128957,1119824,1124553,1107366,1115336,1130352,1126587,1108112,1126041,1117338,1118944,1119927,1121006,1113813,1127257,1125949,1121269,1120096,1113258,1119358,1115528,1120906,1117949,1105577,1129503,1123868,1111950,1115282,1115531,1116539,1115721,1115575,1121355,1115664,1136642,1125390,1119858,1111326,1110606,1123509,1110826,1122917,1128321,1126178,1104394,1119617,1102617,1122027,1116902,1118500,1120341,1128204,1122400,1117169],"p50Micros":1120096,"p95Micros":1132246}},"os":"linux","phase":"cycles","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"}],"exactResourcesPassed":["test_should_measure_one_hundred_warm_image_invocations","test_should_measure_twenty_preloaded_cold_image_environments","test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts"],"processGroupsJoined":true,"python":"3.12.3","profileConfiguration":{"display_name":"colima [profile=rustack-workflows-performance-arm64]","driver":"macOS Virtualization.Framework","arch":"aarch64","runtime":"docker","mount_type":"virtiofs","docker_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/docker.sock","containerd_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/containerd.sock","kubernetes":false,"cpu":4,"memory":8589934592,"disk":25769803776}}
+```
+
+## Final seventh-source acceptance
+
+The original host owner joins0, all15 gates pass and all1260 source hashes/modes remain unchanged. Default/feature workspaces pass4224/4365 cases (429/500 gated,82 summaries each), strict boundaries1971 (33 gated,20 summaries) and complete Native3078 (19 gated,41 summaries). Image controls21, Linux-owner controls14, Action26 and the four deterministic Rust producer controls pass. All four Native performance reports remain separately retained. Audit scans498 dependencies against1395 advisories; deny passes with its existing warnings, with no new policy exception.
+
+The complete ARM owner physically joins0 after618.093s: all79 exact names once,565 aggregate Rust passes/33 summaries and one gated recovery preflight, with the recovery resource subsequently executed explicitly. Its first canonical pre-build snapshot protects7/7 existing fixture references. The final Linux owner is recorded before launch (ownerPID61755, MakePID/PGID61757); the original exec session53686 and the exact child Make both join0, and PID/group absence is checked. The earlier direct run lacking that launch record remains intermediate. All three final resources pass once with empty stderr, three exact raw terminal summaries, report equality and current Cargo-selected ELF hashes.
+
+The final report SHA256 is671777af24926d3cafaa8aa7aee6b4c84acb10801660f77dec0a3e96ac1bd5bb, with guest evidence /tmp/rustack-d102-linux-ne2snot9. Its three transported image IDs equal the exact named manifest-list exports recomputed from the complete full log. The copied raw guest files, aggregate guest/host records, preparation/archive hashes and original launch/completion records are independently rechecked; final acceptance never relies on an exit0 or cleanup boolean alone.
+
+| Measurement | Final seventh-source Linux observation | Contract |
+|---|---:|---|
+|Warm overhead p95/max |3196/3612µs |100 calls; p95≤50000µs |
+|Preloaded cold total p95/max |165350/170596µs |20 distinct environments; p95≤5000000µs |
+|Relay / function-RIC phase p95 |94906 /66319µs |Matched by exact environment ID |
+|Live-flood readiness p95/max |315/434µs |All100 actual readiness probes<2000000µs |
+|Timeout/physical-settlement p95/max |1155489/1361856µs |Actual1s timeout plus joined retirement |
+|Task quiescence p95/max |5539/9888µs |One timeout-return clock, every cycle<2000000µs |
+|All100 task observations / baseline |15/15 |Exact baseline, no growth |
+|Observed server RSS / OS thread maxima |32112KiB /6 |Separate from configured quotas and Tokio tasks |
+
+The independently reviewed final reader first validates all source/owner/argv/log/report/artifact/export/recovery bindings and the frozen565/33/1/79 aggregate. Only afterward do48 successful CLI observations/effects prove zero all-state containers, volumes and forbidden references on both engines. Source/target retain32/15 distinct image IDs, including all original20 source IDs restored by the documented repair, the seven protected pre-build source IDs and all final selected images/cache aliases. The source baseline is32, not an inferred34: some platform/config exports are unchanged. Only the two exact recorded D102 bridge IDs are removed after engine/name/nonce/driver/local-scope/empty checks; images and both retained VMs remain. Final postcondition receipt SHA256 ise77841fae2ee1a9952f0bdc123e2c48d98250c89b28107fa13a51633da66f9e2.
+
+W403–W426 are corrected and independently rechecked. The old fourth repeated-flood failure remains retained with unproven exact cause; W420 removes concrete extra scheduling guards without asserting that causal diagnosis. The source-cache incident is recorded as an actual loss followed by exact repair, not rewritten as uninterrupted preservation. This closes the current-profile image-performance/repeated-cleanup dependency only. Four virtual CPUs still do not prove physical dedication; every report retains referenceQualification=pending. Required reference/Desktop/rootless, remaining load/correctness, W373 and complete5.4/M4 remain open. No x86 validation, publication, push, VM/context restart or unrelated cleanup occurs.
+
+## Raw final seventh-source Linux report
+
+```json
+{"schemaVersion":1,"referenceQualification":"pending","binarySha256":{"test":"a4bb4b8152f67cbe78522e12db0ac882c127ae717e0d4029e3383629b174c6a9","server":"3f3e6750c3e2818b3a43b410871388a5f4b99120aaf46c0dfcbffb1d0708c8f4"},"engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","network":{"id":"21c24074040e18300c00457cf60102419bdf1c01588207a322243004643106d8","name":"rustack-d102-linux","driver":"bridge","labels":{"rustack.workflows.engine":"dde55abd-dcdd-4c74-a2cb-6292373f3782","rustack.workflows.nonce":"f367ab64-5f81-400d-b484-2d5461911291","rustack.workflows.task":"D102"},"ipam":[{"Gateway":"172.18.0.1","Subnet":"172.18.0.0/16"}]},"evidenceRoot":"/tmp/rustack-d102-linux-ne2snot9","reports":[{"architecture":"aarch64","baselineProcess":{"rssKiB":29696,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"handlerNanos":[10166233,10430070,10399528,10133483,10420820,10094565,10214858,11191831,10347069,10097107,11111664,10229942,10944744,10215567,10075481,10841410,10645531,10037522,10145524,10265068,11548462,10755783,10158482,10652032,10276359,10109815,10131315,10241609,11123331,10597822,11694172,10219775,10093481,10739449,10186025,11418459,10285193,10190191,10148482,10111649,10569781,10130649,10160649,10603406,10937119,10944995,11930509,10103565,10084940,10110857,12144928,10528905,11342917,10234858,11045079,10279734,10166525,10356652,12134720,10279901,11157456,10098106,10152608,10182691,10158274,10282568,10135482,10189067,10038064,11014412,10235442,10191941,10369902,10326402,10258859,10136815,10078689,10243025,11322500,10139566,10249900,11238707,10171774,10565405,11188622,11139580,10286360,10116107,10258400,11022704,11038620,10106691,10121191,10669448,10973577,11536044,10507738,11839465,10230984,10867118],"overhead":{"maxMicros":3612,"observedMicros":[1773,1663,2129,1727,1552,1663,1916,1600,1453,1603,1645,1493,1840,1630,1492,1575,1425,1524,1510,1809,1556,1756,1406,1419,2318,2479,2133,2691,2080,2724,2958,3439,3196,3452,2853,3612,2974,3165,2816,2710,2533,2709,2790,3056,2793,2609,2503,2496,2467,2650,2621,2747,3200,3040,2071,2704,2111,2813,3024,2925,3081,2699,2886,2859,3098,2522,2191,2050,1964,2062,2215,1879,1779,1927,2103,3092,2238,1985,3061,3061,2748,3172,2644,2257,1895,2523,2061,2799,2021,3092,2477,3084,3390,3045,2592,2092,2667,2068,2472,2228],"p50Micros":2477,"p95Micros":3196},"totalNanos":[11938593,12092094,12528059,11859799,11972760,11756715,12130011,12791563,11799798,11699547,12756104,11722006,12784521,11844841,11567336,12415682,12069802,11560670,11655255,12073261,13103776,12510934,11563586,12070094,12593602,12588560,12263889,12932356,13203320,13321779,14651174,13657826,13288903,14191251,13038692,15029721,13258779,13354488,12963733,12820938,13102235,12839398,12949940,13658951,13729410,13553866,14433379,12599019,12551727,12760730,14765633,13275362,14542880,13274612,13115610,12983733,12276972,13168819,15158306,13204610,14238043,12796480,13038525,13041608,13255736,12804313,12325722,12238804,12001676,13076025,12449558,12070052,12148387,12252847,12361181,13228569,12315972,12227679,14382628,13199569,12997899,14410628,12814813,12822271,13083151,13662451,12346431,12914231,12278972,14114583,13514698,13190028,13511074,13714243,13565449,13627450,13173818,13907454,12702311,13094609]},"os":"linux","phase":"warm","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29744,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"environments":["68ef47b8-b78e-40bf-9972-8cb48cc6f97f","f03ba950-c9dd-4024-81f6-a91d7908f24f","79a3cbbc-b465-434c-b64e-f70792e0ead7","4d3f2551-c8a7-4a04-94b4-87d05c5234b4","3ee1d3c9-ff1d-48b3-96d4-4041374cfc09","e09e3aec-1e45-479a-b216-1f0914f1b974","1f79eab0-6c48-4647-99e7-1489afa498c8","7d57cc71-1a63-463a-92db-d0a839df177e","67c0a9ad-a8a2-47ae-8c96-bc64d539ceaf","dc5bfe10-1911-4800-8724-d4a72a637b7b","4d5ab512-4991-475d-9bb2-8c0c2d66c5f5","089ffd5b-8cae-40c5-b3c7-06fb9887a7e2","fc09d7bd-568b-4ab1-abd1-2bf7f3bd95d7","7e612f8c-da55-4301-846d-e2a66ee20228","d8d95a5f-d247-4635-96bd-6108286fa2f1","6f7df49e-5503-4cfa-859b-11f1db8a7074","8669f9eb-cfc1-46a4-915e-ea5d2cf96da0","63f7c8d5-1d0c-45a6-91a5-18774f4aefc0","577b9c8b-f6dd-4991-b6ae-f14cf60f98a2","532c822b-4e58-4ae9-a310-8d7a333aa363"],"initialization":{"events":[{"environmentId":"68ef47b8-b78e-40bf-9972-8cb48cc6f97f","relayMicros":67888,"ricMicros":50255},{"environmentId":"f03ba950-c9dd-4024-81f6-a91d7908f24f","relayMicros":71361,"ricMicros":51589},{"environmentId":"79a3cbbc-b465-434c-b64e-f70792e0ead7","relayMicros":71850,"ricMicros":49328},{"environmentId":"4d3f2551-c8a7-4a04-94b4-87d05c5234b4","relayMicros":59195,"ricMicros":53192},{"environmentId":"3ee1d3c9-ff1d-48b3-96d4-4041374cfc09","relayMicros":65728,"ricMicros":45093},{"environmentId":"e09e3aec-1e45-479a-b216-1f0914f1b974","relayMicros":60648,"ricMicros":55524},{"environmentId":"1f79eab0-6c48-4647-99e7-1489afa498c8","relayMicros":94906,"ricMicros":53538},{"environmentId":"7d57cc71-1a63-463a-92db-d0a839df177e","relayMicros":86236,"ricMicros":75658},{"environmentId":"67c0a9ad-a8a2-47ae-8c96-bc64d539ceaf","relayMicros":69773,"ricMicros":53675},{"environmentId":"dc5bfe10-1911-4800-8724-d4a72a637b7b","relayMicros":69742,"ricMicros":53223},{"environmentId":"4d5ab512-4991-475d-9bb2-8c0c2d66c5f5","relayMicros":67634,"ricMicros":53994},{"environmentId":"089ffd5b-8cae-40c5-b3c7-06fb9887a7e2","relayMicros":100844,"ricMicros":66319},{"environmentId":"fc09d7bd-568b-4ab1-abd1-2bf7f3bd95d7","relayMicros":77152,"ricMicros":50644},{"environmentId":"7e612f8c-da55-4301-846d-e2a66ee20228","relayMicros":77441,"ricMicros":50808},{"environmentId":"d8d95a5f-d247-4635-96bd-6108286fa2f1","relayMicros":81532,"ricMicros":65941},{"environmentId":"6f7df49e-5503-4cfa-859b-11f1db8a7074","relayMicros":77013,"ricMicros":61773},{"environmentId":"8669f9eb-cfc1-46a4-915e-ea5d2cf96da0","relayMicros":72214,"ricMicros":57896},{"environmentId":"63f7c8d5-1d0c-45a6-91a5-18774f4aefc0","relayMicros":69925,"ricMicros":61711},{"environmentId":"577b9c8b-f6dd-4991-b6ae-f14cf60f98a2","relayMicros":70916,"ricMicros":52191},{"environmentId":"532c822b-4e58-4ae9-a310-8d7a333aa363","relayMicros":77146,"ricMicros":56441}],"functionRic":{"maxMicros":75658,"observedMicros":[50255,51589,49328,53192,45093,55524,53538,75658,53675,53223,53994,66319,50644,50808,65941,61773,57896,61711,52191,56441],"p50Micros":53538,"p95Micros":66319},"relay":{"maxMicros":100844,"observedMicros":[67888,71361,71850,59195,65728,60648,94906,86236,69773,69742,67634,100844,77152,77441,81532,77013,72214,69925,70916,77146],"p50Micros":71361,"p95Micros":94906},"startupBaseline":{"bytes":382,"sha256":"6c35342ce6d2d54769690ee6849bf2d1d4a8db311116d446c24830a72ce000a5"}},"latency":{"maxMicros":170596,"observedMicros":[121428,126905,125255,115377,114857,119085,152643,165350,127805,127027,125651,170596,131881,132578,152537,143315,134056,135713,127080,137878],"p50Micros":127805,"p95Micros":165350},"uniqueContainers":40},"os":"linux","phase":"cold","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"},{"architecture":"aarch64","baselineProcess":{"rssKiB":29848,"tasks":6},"debugAssertions":true,"emptyAfterWorkload":true,"measurement":{"completedCycles":100,"containerHighWater":2,"emptyAfterEachTimeout":true,"floods":[{"afterBytes":4096,"beforeBytes":1024,"requestId":"0e22fff9-9a5c-4213-80e5-9264dd9693ab"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"69bc3dfc-ed30-437f-a2fd-755a03ca6714"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"38363803-4b82-4fae-859e-a7b969d982a5"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"1e38a7f2-6723-430f-bc61-d3d3a8245c57"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"753638d7-2a51-4dee-ba8b-6b7518a976d6"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"10179839-01e1-4ab9-81a1-4c4bfa7a785e"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"6f56252f-b4d9-4399-bae2-a35fc2ab2fe2"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"7f36e047-32ac-454b-b2b3-4572ef13dce6"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"3ca3e8f6-c48e-48bb-9700-2c9064d95886"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"1cd48aa8-ac8f-4686-bc54-347dda85e1db"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"e230075a-a93a-40c3-83af-27d16ab1c457"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"de205cba-a1ca-4186-a2ff-049d99982b7e"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"8b44c1ad-69e2-47fe-8c5d-cb2791feb364"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"b8c071d1-95d5-40d2-b987-cbf5dc3c59e9"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"1905e87c-a5a4-4b81-9837-159a32ebdb29"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"4dfd3a79-b036-4d00-b54a-4857a5bb80d4"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f1670708-f903-45b7-a946-b920fa5163bc"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"8e04ccf3-1eb1-4e84-a802-fd6d3bfa7515"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"a8cf07db-925f-409d-89e0-a8f8717f2316"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d61b93d2-27db-4a06-911f-a1685656938a"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"dab4b2eb-c997-4d8d-8964-edd06824f232"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"65e91c38-d124-469b-a0de-caa838076706"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"649d7c3d-5b83-4e96-81c9-9d8a97cff923"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"7663376f-dc34-444c-a614-524e65cdfe6e"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"eab88bc5-2c68-48ef-98d6-8c9915c5cc52"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"393b431b-22d8-4121-9675-b702f2dfa08e"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"27e186cc-43ed-4d58-a665-48945f2af34a"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e1d46eb4-be98-4291-af32-b1ace90fe5c8"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"97d9ddbc-3d02-45ad-aa45-a2743250229a"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9bf99aca-d59f-4b5a-9dec-44bdf6cd611f"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"00dda22f-0b9e-4863-917e-9d4ed380f4a1"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9ac12cce-5ada-4fb7-8815-2f05b8895d2d"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"a4102582-47f8-4e5c-a473-c615324697ed"},{"afterBytes":8192,"beforeBytes":1024,"requestId":"5be326c5-b131-4115-b9f4-2c2d0084c913"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"9f3b9dda-39e1-43d2-9eb8-8313bfb0532a"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"3dc65d78-7ba6-4f5c-aeb5-7997220077a3"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"5f139691-01b3-4531-957c-e9de16f1f15a"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"675c1739-aa96-426b-8bba-08ba0853de03"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"58ae78e0-7af5-42e3-b407-a41530965a54"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"d7d5b83f-5939-4244-8c34-6578ce275ce3"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"43f3c4ba-38c1-45a1-ae20-bb87b8b34ba8"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"a8e95103-4877-4775-a627-8449d6dfc85f"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"8b191c6f-656a-4c9b-bd7d-ec6696aada20"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"12f42d0d-452e-4daa-935e-2a6e9e7de57e"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"0b3f65ea-792a-4518-80e5-36dcfd6d67ef"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"d89c8dfd-bb83-4b55-8b72-56caf53d21b3"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"6fedd034-8278-4a76-8498-59bf1b100589"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"9ef3b444-3f91-4cbe-9b53-b3ee7e6112e8"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"4b5be88d-bec8-4ca7-8835-c872b008be2a"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"75fe6f83-9d6c-4d9f-bfda-b690221a4ff1"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"8ecfe2dc-c099-4c23-8f4b-aad39418f35f"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"0888b6d5-f1cd-41a4-9be7-007f6e66b76a"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"e694d4fd-926e-44cc-86d9-6df2fe82c733"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"a85181fa-4df3-4317-a3cc-3b39d6b063d5"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e6b31742-c946-4000-83ff-e7ffd3284f02"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"aff71efe-d139-4eff-8d8a-9f4401ae827e"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"6a3b9808-040e-4c1f-8e36-1d25ba413035"},{"afterBytes":9216,"beforeBytes":1024,"requestId":"fa668776-273b-4370-92dc-dbd49d2234d8"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"0c5d6717-6c32-4953-bf49-3dd6214ce7dc"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"59a55225-fd28-4a52-8592-2c2c0adac3e9"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"e2396cf7-b282-427e-a94f-b00215b0a115"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"d1cc5ba4-2e5e-4c35-a8fa-4f6f22721cee"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9de12e62-a40b-487b-85d7-807acb12da25"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"52be790f-d79c-4e17-8d4e-4282627fc30b"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"acd9b300-6004-4999-a155-e3960e86e351"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"c85e9629-556c-4a91-83ca-ecc6d4b7ac4c"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"d5c894d7-a81b-4f59-8c46-f7fdc07f1503"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"8bfbcda0-9cf6-432d-b818-9002e8ba75d4"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"2e10f2b6-3225-4224-96ad-10ebb80928e4"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"93ecce95-ac40-429c-9a46-f485445632e4"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"3735d986-e15d-455b-8a1b-57f72f823416"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"18c50d00-ea8b-4cba-9d9b-e243f968b2ac"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"5daf3981-1bcc-4578-9040-38d8f969aa5a"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"0a41ac2d-811f-4fef-ae90-f7ff732654a6"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"1fe54be4-d226-4a0c-a86e-b92dced0ed47"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"eb75c5ac-7ea7-4ae5-a69c-a93e8c108799"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"e4d1f61a-0bd8-47b4-b349-cf8d6bcd1e63"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"998558b7-d9b2-4e92-be1a-512618db4041"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9c2d25c5-efbc-4549-b327-f2871d7fa033"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"a55f6892-7c73-4e98-9ef0-6470d8de27a2"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9a52c88d-d54f-4ebe-b0ba-4552235198ec"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9b31fd84-1b05-497e-904a-c21fc70025b7"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"5fa5b604-f104-4d63-a0ac-f87f72c8ebb8"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"7a787bb4-3772-45f0-9ffe-71c482708ed1"},{"afterBytes":3072,"beforeBytes":1024,"requestId":"03830bcb-b5a9-4dde-a2e0-088e8104b633"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"ba2dfb89-b06a-402b-855c-bfb340bf3fae"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"792337d8-fafc-4d1b-b007-b6f3c347179f"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"46512caa-78d9-461f-9da2-b4f8f7aadb30"},{"afterBytes":5120,"beforeBytes":1024,"requestId":"e3e02939-d295-4c0f-bf13-25ee2cacfec3"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"9dcaf9e7-b1d5-42f0-a22e-339974b1bac3"},{"afterBytes":6144,"beforeBytes":1024,"requestId":"c3f38ed4-69af-43e4-a4cd-074c532ff521"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"c5d722b3-e623-4ee2-8443-c1bf301a9baa"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"0a7a3c53-ef29-4219-a01a-89f013b5109b"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"acba0e90-ec23-4fdb-9f4a-8b7a8976b0bd"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"3cb5781c-f584-4f05-b029-885c68364a73"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"2167195b-a17a-4489-95ab-208ebefff5fc"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"f7ba0637-2b5d-4c81-83bd-323a99c23c44"},{"afterBytes":4096,"beforeBytes":1024,"requestId":"c197efbe-0b91-43ce-9de2-b35e590cd748"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"04258030-3a74-46f5-a9a3-459d2e8c5fa2"},{"afterBytes":7168,"beforeBytes":1024,"requestId":"0546cef9-feca-4981-af6b-39f2775b6ce6"}],"liveBrackets":[[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false],[1,1,false]],"primingCleanupConfirmed":true,"primingInvocations":1,"processStats":[{"rssKiB":30456,"runtimeTasks":15,"tasks":6},{"rssKiB":30580,"runtimeTasks":15,"tasks":6},{"rssKiB":30612,"runtimeTasks":15,"tasks":6},{"rssKiB":30672,"runtimeTasks":15,"tasks":6},{"rssKiB":30720,"runtimeTasks":15,"tasks":6},{"rssKiB":30768,"runtimeTasks":15,"tasks":6},{"rssKiB":30772,"runtimeTasks":15,"tasks":6},{"rssKiB":30852,"runtimeTasks":15,"tasks":6},{"rssKiB":30868,"runtimeTasks":15,"tasks":6},{"rssKiB":30888,"runtimeTasks":15,"tasks":6},{"rssKiB":30928,"runtimeTasks":15,"tasks":6},{"rssKiB":30944,"runtimeTasks":15,"tasks":6},{"rssKiB":30972,"runtimeTasks":15,"tasks":6},{"rssKiB":30996,"runtimeTasks":15,"tasks":6},{"rssKiB":31020,"runtimeTasks":15,"tasks":6},{"rssKiB":31096,"runtimeTasks":15,"tasks":6},{"rssKiB":31108,"runtimeTasks":15,"tasks":6},{"rssKiB":31140,"runtimeTasks":15,"tasks":6},{"rssKiB":31160,"runtimeTasks":15,"tasks":6},{"rssKiB":31184,"runtimeTasks":15,"tasks":6},{"rssKiB":31196,"runtimeTasks":15,"tasks":6},{"rssKiB":31264,"runtimeTasks":15,"tasks":6},{"rssKiB":31268,"runtimeTasks":15,"tasks":6},{"rssKiB":31284,"runtimeTasks":15,"tasks":6},{"rssKiB":31300,"runtimeTasks":15,"tasks":6},{"rssKiB":31348,"runtimeTasks":15,"tasks":6},{"rssKiB":31360,"runtimeTasks":15,"tasks":6},{"rssKiB":31396,"runtimeTasks":15,"tasks":6},{"rssKiB":31412,"runtimeTasks":15,"tasks":6},{"rssKiB":31432,"runtimeTasks":15,"tasks":6},{"rssKiB":31436,"runtimeTasks":15,"tasks":6},{"rssKiB":31456,"runtimeTasks":15,"tasks":6},{"rssKiB":31464,"runtimeTasks":15,"tasks":6},{"rssKiB":31468,"runtimeTasks":15,"tasks":6},{"rssKiB":31484,"runtimeTasks":15,"tasks":6},{"rssKiB":31520,"runtimeTasks":15,"tasks":6},{"rssKiB":31536,"runtimeTasks":15,"tasks":6},{"rssKiB":31556,"runtimeTasks":15,"tasks":6},{"rssKiB":31576,"runtimeTasks":15,"tasks":6},{"rssKiB":31576,"runtimeTasks":15,"tasks":6},{"rssKiB":31592,"runtimeTasks":15,"tasks":6},{"rssKiB":31624,"runtimeTasks":15,"tasks":6},{"rssKiB":31624,"runtimeTasks":15,"tasks":6},{"rssKiB":31632,"runtimeTasks":15,"tasks":6},{"rssKiB":31680,"runtimeTasks":15,"tasks":6},{"rssKiB":31716,"runtimeTasks":15,"tasks":6},{"rssKiB":31716,"runtimeTasks":15,"tasks":6},{"rssKiB":31724,"runtimeTasks":15,"tasks":6},{"rssKiB":31744,"runtimeTasks":15,"tasks":6},{"rssKiB":31744,"runtimeTasks":15,"tasks":6},{"rssKiB":31748,"runtimeTasks":15,"tasks":6},{"rssKiB":31784,"runtimeTasks":15,"tasks":6},{"rssKiB":31792,"runtimeTasks":15,"tasks":6},{"rssKiB":31800,"runtimeTasks":15,"tasks":6},{"rssKiB":31820,"runtimeTasks":15,"tasks":6},{"rssKiB":31820,"runtimeTasks":15,"tasks":6},{"rssKiB":31844,"runtimeTasks":15,"tasks":6},{"rssKiB":31856,"runtimeTasks":15,"tasks":6},{"rssKiB":31864,"runtimeTasks":15,"tasks":6},{"rssKiB":31864,"runtimeTasks":15,"tasks":6},{"rssKiB":31864,"runtimeTasks":15,"tasks":6},{"rssKiB":31864,"runtimeTasks":15,"tasks":6},{"rssKiB":31864,"runtimeTasks":15,"tasks":6},{"rssKiB":31876,"runtimeTasks":15,"tasks":6},{"rssKiB":31904,"runtimeTasks":15,"tasks":6},{"rssKiB":31916,"runtimeTasks":15,"tasks":6},{"rssKiB":31936,"runtimeTasks":15,"tasks":6},{"rssKiB":31948,"runtimeTasks":15,"tasks":6},{"rssKiB":31948,"runtimeTasks":15,"tasks":6},{"rssKiB":31948,"runtimeTasks":15,"tasks":6},{"rssKiB":31952,"runtimeTasks":15,"tasks":6},{"rssKiB":31956,"runtimeTasks":15,"tasks":6},{"rssKiB":31960,"runtimeTasks":15,"tasks":6},{"rssKiB":31968,"runtimeTasks":15,"tasks":6},{"rssKiB":32000,"runtimeTasks":15,"tasks":6},{"rssKiB":32000,"runtimeTasks":15,"tasks":6},{"rssKiB":32000,"runtimeTasks":15,"tasks":6},{"rssKiB":32000,"runtimeTasks":15,"tasks":6},{"rssKiB":32000,"runtimeTasks":15,"tasks":6},{"rssKiB":32016,"runtimeTasks":15,"tasks":6},{"rssKiB":32016,"runtimeTasks":15,"tasks":6},{"rssKiB":32028,"runtimeTasks":15,"tasks":6},{"rssKiB":32028,"runtimeTasks":15,"tasks":6},{"rssKiB":32036,"runtimeTasks":15,"tasks":6},{"rssKiB":32040,"runtimeTasks":15,"tasks":6},{"rssKiB":32040,"runtimeTasks":15,"tasks":6},{"rssKiB":32040,"runtimeTasks":15,"tasks":6},{"rssKiB":32044,"runtimeTasks":15,"tasks":6},{"rssKiB":32044,"runtimeTasks":15,"tasks":6},{"rssKiB":32044,"runtimeTasks":15,"tasks":6},{"rssKiB":32048,"runtimeTasks":15,"tasks":6},{"rssKiB":32048,"runtimeTasks":15,"tasks":6},{"rssKiB":32048,"runtimeTasks":15,"tasks":6},{"rssKiB":32048,"runtimeTasks":15,"tasks":6},{"rssKiB":32048,"runtimeTasks":15,"tasks":6},{"rssKiB":32056,"runtimeTasks":15,"tasks":6},{"rssKiB":32056,"runtimeTasks":15,"tasks":6},{"rssKiB":32060,"runtimeTasks":15,"tasks":6},{"rssKiB":32104,"runtimeTasks":15,"tasks":6},{"rssKiB":32112,"runtimeTasks":15,"tasks":6}],"readiness":{"maxMicros":434,"observedMicros":[142,200,107,101,140,115,146,133,156,107,181,123,107,131,130,113,157,151,276,148,142,168,152,159,149,104,163,138,132,140,143,146,111,359,274,278,382,207,359,314,275,227,136,135,196,162,154,136,147,181,147,147,196,144,149,210,315,434,264,237,133,319,152,188,158,139,149,144,139,221,155,116,134,140,154,147,203,295,185,280,131,153,137,134,128,165,133,134,152,140,168,108,131,145,158,96,119,151,292,284],"p50Micros":149,"p95Micros":315},"runtimeTaskBaseline":15,"taskQuiescence":{"maxMicros":9888,"observedMicros":[2699,3046,2731,2892,2759,2568,2866,3093,2677,4223,2788,3226,2681,2648,2654,2795,2837,3248,3265,2634,3491,3548,3005,3555,2982,3451,3323,3475,2822,2981,3747,3072,3863,4274,5442,5539,5495,5087,4472,5298,3416,3684,3006,4232,3339,3073,3645,3199,5448,3274,3696,3166,4712,3387,3279,5480,5497,5112,3926,3140,4828,2998,4320,4200,3350,3136,3385,2875,3117,3271,2998,9888,2852,4975,4811,4536,5615,2752,5343,4124,3925,4491,3089,2952,3935,2981,3170,4325,3083,4974,2798,3339,2986,2969,2821,3171,3913,5803,6038,5623],"p50Micros":3323,"p95Micros":5539},"timeout":{"maxMicros":1361856,"observedMicros":[1125127,1135684,1116300,1107132,1150798,1127243,1109867,1125222,1112081,1119170,1111534,1120153,1125250,1108767,1126114,1118284,1132551,1128335,1132651,1117465,1126976,1135318,1112579,1139813,1133914,1146400,1114955,1117374,1115429,1131815,1121655,1117887,1120347,1139244,1135048,1150990,1154019,1146482,1138844,1160130,1148663,1135370,1121744,1134679,1136660,1128192,1123171,1127897,1133268,1130152,1137035,1129718,1157917,1126641,1122094,1142873,1152949,1155489,1141351,1142180,1145997,1144200,1158602,1136799,1128465,1129831,1129073,1108713,1109444,1113770,1108468,1361856,1110088,1161639,1150309,1139574,1145415,1128098,1147477,1124991,1136958,1131138,1126832,1129243,1145483,1139243,1137730,1128353,1124561,1137841,1126073,1125367,1115477,1132107,1126197,1108056,1122912,1140671,1150173,1146324],"p50Micros":1129718,"p95Micros":1155489}},"os":"linux","phase":"cycles","python":"3.12.3","referenceQualification":"pending","schemaVersion":1,"sdkVersion":"1.43.118"}],"exactResourcesPassed":["test_should_measure_one_hundred_warm_image_invocations","test_should_measure_twenty_preloaded_cold_image_environments","test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts"],"processGroupsJoined":true,"python":"3.12.3","profileConfiguration":{"display_name":"colima [profile=rustack-workflows-performance-arm64]","driver":"macOS Virtualization.Framework","arch":"aarch64","runtime":"docker","mount_type":"virtiofs","docker_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/docker.sock","containerd_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/containerd.sock","kubernetes":false,"cpu":4,"memory":8589934592,"disk":25769803776}}
+```
diff --git a/docs/research/workflows-linux-performance-review.md b/docs/research/workflows-linux-performance-review.md
new file mode 100644
index 00000000..5c3bb158
--- /dev/null
+++ b/docs/research/workflows-linux-performance-review.md
@@ -0,0 +1,53 @@
+# Direct Linux arm64 Workflows Performance Review
+
+Status: measured native-arm64 Linux VM evidence; dedicated-reference qualification remains pending. Decision: [D101](../../specs/rustack-workflows-99-decisions.md#d101--measure-the-existing-pure-workloads-directly-inside-native-arm64-linux). Contract: [verification§5.2](../../specs/rustack-workflows-70-verification-plan.md#52-direct-linux-arm64-pure-workflow-measurements-d101).
+
+The actual Linux SDK harness and CLI run directly inside a new VZ guest, rather than running the controller on macOS or putting the pure workload in a test container. The locked aarch64-unknown-linux-gnu debug-assertion build reuses the reviewed Zig0.16 compatibility adapter and explicit lambda/stepfunctions/s3/dynamodb features. The shared Performance fixture now selects the disabled Lambda executor; the other Native SDK profiles remain unchanged. All six existing measurement controls and both exact resource cases pass, with joined test groups, joined actual servers and zero Native processes. Thirteen new independent controls cover bounded metadata/artifacts, exact inventory/reports, malformed and mutated evidence, original deadlines and causal real-child signal/retirement ownership.
+
+The guest has4 virtual CPUs and8GiB configured RAM; /proc reports8,113,560KiB. These allocations do not prove four dedicated physical CPUs. Every report therefore retains referenceQualification=pending. The new profile is rustack-workflows-performance-arm64, driver macOS Virtualization.Framework, native aarch64, kernel6.8.0-117-generic, Python3.12.3 and local Docker engine dde55abd-dcdd-4c74-a2cb-6292373f3782. Rosetta/binfmt are disabled; repository and target mounts are read-only; autoActivate=false. The existing ARM profile remains4CPU/6GiB. No existing VM is restarted/stopped, no global Docker context is activated and no x86_64 validation is run. The new VM is retained for further ARM qualification.
+
+| Measurement | Observed (µs) | Contract |
+|---|---:|---|
+|100×50-state/1KiB p50 |9534 |All100 ordered samples retained |
+|100×50-state/1KiB p95 |10791 |≤100000 |
+|100×50-state/1KiB maximum |11999 |<2000000 |
+|100 live-loop cycles, readiness maximum |318 |<2000000 |
+|100 live-loop cycles, Stop→ABORTED maximum |1335 |<2000000 |
+|History-exhaustion readiness maximum |313 |<2000000 |
+|History-exhaustion live/all probes |175/175 |RUNNING on both sides of each probe |
+|History-exhaustion final event ID |7560 |Reserved failure,≤25000 |
+
+Every latency execution validates exactly102 ordered causal history events and preserves its1KiB input/output. The loop workload proves explicit history exhaustion,100 immediate single-slot starts and ABORTED terminals after Stop. Child high-water RSS is150,176KiB, the Linux RUSAGE_CHILDREN maximum across this owned cohort; it is neither isolated server RSS nor allocator instrumentation, a sum of concurrent processes, or a configured storage quota. No dedicated-reference, image warm/cold timing, image log-flood/timeout cleanup, Desktop/rootless, publication or complete M4 acceptance follows.
+
+## Reproduction and provenance
+
+On an ARM macOS host with the pinned toolchain, existing GNU target, Zig/cargo-zigbuild and Colima0.10.3, use make workflows-performance-linux-provision once for a new profile, then make test-workflows-performance-linux. WORKFLOWS_LINUX_PROFILE selects the explicit profile; WORKFLOWS_LINUX_EVIDENCE_DIR selects its Cargo artifact evidence directory. Provisioning refuses an existing profile. Use the measurement target to reuse the retained profile. The helper requires4CPU/8GiB native VZ and preserves the pending reference designation. Colima's [profile](https://colima.run/docs/profiles/) and [configuration](https://colima.run/docs/configuration/) contracts support separate VM allocations and read-only mounts; local CLI help and resulting YAML verify activate=false, rosetta=false and binfmt=false.
+
+The guest owns an original450s alarm and clamps its child observations; the host owns530s with SSH capped500s. Existing three-second child retirement cannot be interrupted by the original alarm or TERM/HUP/INT. Local metadata/hash/report IO stays under the original alarm. Both boundaries reuse the existing Action Runner and bounded metadata decoder. This evidence does not add a second process supervisor.
+
+Captured 2026-10-31T14:57:18.367342+00:00 from parent commit cf8dd24. The source cohort includes1,252 runtime/test/build inputs; documentation is outside that code seal. The final Make owner and the original13-gate host owner both physically join0. Standard9, default/feature workspaces4,218/4,359, strict1,969 and complete Native3,078 pass, with fmt/build/Clippy/rustdoc/audit/deny. The Native verifier retains both its SDK-stage measurement pair and its dedicated-performance pair; the latter has host p95=10445µs and health/Stop maxima309/1101µs. All four host reports remain in the final host evidence, separate from the two once-only Linux resources. The fresh audit scans498 dependencies against1,395 advisories. Deny exits0 with existing policy warnings; no new ignore is added.
+
+| Artifact | SHA256 |
+|---|---|
+| source cohort /tmp/rustack-d101-source-seal-third.json | ca801aa058f84f86d5712a5d008649efe3c7b4853d4f3e4a85fca09cb8bec896 |
+| raw Linux /tmp/rustack-d101-linux-report-third.json | cfe27b9420dbe323db82506e21e94ed0dc4cea941f0631a585fa35e4a8f9a624 |
+| Cargo artifact stream | bbc2765c5c0111e266d52ba2a7b57535eaba913c922907b5ff2b7c59b775b8d5 |
+| Actual Linux test ELF | 85222c74e7466abff45fa66e3c67f5e8484cd8046eb5145098eb906cbbc8d2e0 |
+| Actual Linux server ELF | 358053dc6029de81aadc1595bb07b5cbbcab5106b7f295a3d216ee03a10d5394 |
+
+The first execution attempt fails closed before running either resource because the initial inventory decoder incorrectly expected a footer from Rust's terse listing. The corrected decoder accepts exactly the eight actual test-name lines. That failed attempt and subsequent successful intermediate captures remain retained; the final Make capture below is authoritative. Historical D74/D99 evidence is unchanged.
+
+Seven readonly postcondition observations confirm zero containers, volumes and images on the new daemon, no running Rustack server and unchanged4CPU/6GiB allocation on the original ARM profile. The new VM remains running. Its configuration retains autoActivate=false, rosetta=false, binfmt=false and both mounts writable=false. No other engine is modified. The independent source review fixes/rechecks W397–W402 (three P2/three P3); an independent evidence review recomputes the actual source/ELF/Cargo/report hashes and raw sample ranks.
+
+| Final artifact under /tmp | SHA256 |
+|---|---|
+| rustack-d101-final-host-report-third.json | a31725626a51926b216d6967cf3ecf395503e9b1f56ccab8a1c97bce8ea1de9f |
+| rustack-d101-postconditions-third.json | 32088fb43c8325ae6d7d40801f814288515b660e073c1155ef502b47165ef79d |
+
+The final third cohort includes the explicit4096-record admission cap and removal of an unused prefix constant. Both earlier successful cohorts remain retained; the final Linux Make owner and all13 repeated host gates qualify the final source, with unchanged ELF binaries. The final host gate sequence totals233.794s. An earlier read-only config assertion counted a commented writable example; the final postcondition proof matches the two anchored actual writable=false fields. No mutation occurs during either observation.
+
+## Raw final Linux report
+
+```json
+{"schemaVersion":1,"referenceQualification":"pending","binarySha256":{"test":"85222c74e7466abff45fa66e3c67f5e8484cd8046eb5145098eb906cbbc8d2e0","server":"358053dc6029de81aadc1595bb07b5cbbcab5106b7f295a3d216ee03a10d5394"},"kernel":"6.8.0-117-generic","python":"3.12.3","observedMemoryKiB":8113560,"availableLogicalCpus":4,"childHighWaterRssKiB":150176,"controlsPassed":6,"exactResourcesPassed":["performance::test_should_measure_one_hundred_fifty_state_signed_sdk_executions","performance::test_should_keep_health_and_stop_responsive_and_reuse_one_execution_slot"],"reports":[{"schemaVersion":1,"host":{"os":"linux","architecture":"aarch64","availableLogicalCpus":4,"debugAssertions":true,"referenceQualification":"pending"},"limits":{"openExecutions":1,"transitions":1000000,"historyEvents":25000,"historyBytes":33554432,"totalHistoryBytes":134217728},"nativeProcessesObserved":0,"serverJoined":true,"measurement":{"kind":"pureLatency","stateCount":50,"inputBytes":1024,"executions":100,"budgetMicros":100000,"latency":{"count":100,"observedMicros":[11999,10722,10096,10137,9310,9358,10194,9498,9763,8675,9667,9686,9949,9361,9432,9390,9227,9409,9581,11627,9477,11174,9390,9278,9209,9804,9772,9322,9614,9454,9440,10421,9222,9410,9689,10521,9409,11110,9159,9420,9445,10076,9585,9535,9522,9933,10791,9987,9485,9465,9545,10559,9418,10383,10022,9417,9283,9517,9449,9412,9534,9422,9165,10632,10685,9260,9422,9316,9363,10106,10626,9704,11100,9435,9331,9924,9404,9266,9310,9449,9287,10328,9272,9338,10318,9402,9943,9816,9460,9947,9724,9624,9550,9610,9328,9887,9759,9644,9776,9561],"p50Micros":9534,"p95Micros":10791,"maxMicros":11999}}},{"schemaVersion":1,"host":{"os":"linux","architecture":"aarch64","availableLogicalCpus":4,"debugAssertions":true,"referenceQualification":"pending"},"limits":{"openExecutions":1,"transitions":1000000,"historyEvents":25000,"historyBytes":33554432,"totalHistoryBytes":134217728},"nativeProcessesObserved":0,"serverJoined":true,"measurement":{"kind":"loopResponsiveness","openExecutionSlots":1,"completedCycles":100,"inputBytes":1024,"historyEventHighWater":7560,"exhaustion":{"probeCount":175,"liveProbeCount":175,"maxReadinessMicros":313},"readiness":{"count":100,"observedMicros":[149,148,145,138,134,145,168,152,153,158,146,154,159,218,157,148,167,156,184,220,149,177,229,204,272,250,173,275,196,175,186,170,264,166,205,165,198,163,191,155,173,162,156,150,175,153,176,166,168,315,218,161,202,177,265,139,199,149,313,154,145,252,156,151,233,159,141,160,159,318,156,150,160,155,148,159,158,240,144,167,227,143,157,146,221,172,146,147,134,146,142,173,135,156,138,172,138,137,155,186],"p50Micros":159,"p95Micros":265,"maxMicros":318},"stop":{"count":100,"observedMicros":[1094,1092,1126,1036,1105,1131,1026,1083,1052,1059,1060,1132,1080,1042,1084,1032,1058,1035,1041,1043,1136,1145,1137,1288,1183,1197,1282,1323,1200,1224,1224,1335,1157,1180,1210,1189,1161,1226,1134,1192,1201,1207,1134,1129,1103,1177,1107,1163,1155,1101,1231,1130,1104,1188,1224,1255,1099,1138,1124,1105,1138,1122,1133,1146,1212,1107,1072,1159,1077,1119,1119,1101,1112,1061,1106,1107,1132,1122,1114,1097,1113,1106,1150,1133,1101,1108,1128,1122,1106,1112,1146,1096,1099,1107,1082,1129,1144,1091,1128,1129],"p50Micros":1124,"p95Micros":1231,"maxMicros":1335}}}],"processGroupsJoined":true,"profile":"rustack-workflows-performance-arm64","profileConfiguration":{"display_name":"colima [profile=rustack-workflows-performance-arm64]","driver":"macOS Virtualization.Framework","arch":"aarch64","runtime":"docker","mount_type":"virtiofs","docker_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/docker.sock","containerd_socket":"unix:///Users/tchen/.colima/rustack-workflows-performance-arm64/containerd.sock","kubernetes":false,"cpu":4,"memory":8589934592,"disk":25769803776},"virtualization":"native-aarch64-vz; physical CPU dedication unproven","cargoArtifactStreamSha256":"bbc2765c5c0111e266d52ba2a7b57535eaba913c922907b5ff2b7c59b775b8d5"}
+```
diff --git a/docs/research/workflows-native-performance-review.md b/docs/research/workflows-native-performance-review.md
new file mode 100644
index 00000000..ab755b29
--- /dev/null
+++ b/docs/research/workflows-native-performance-review.md
@@ -0,0 +1,56 @@
+# Native-host Workflows Performance Review
+
+Status: measured current-host evidence; required Linux reference and image/platform gates remain open · Decision: [D74](../../specs/rustack-workflows-99-decisions.md#d74--measure-pure-workflow-latency-and-loop-responsiveness-through-the-real-binary)
+
+`make test-workflows-performance` completed after the broader verification jobs had joined. It executes six normal measurement/causality controls, both real signed SDK workloads and denied-warning/pedantic Clippy. Source and tested binary fingerprints below identify this capture. The parent commit identifies the production baseline; the source fingerprints identify the new harness before its implementation commit. No production workflow code changes in this measurement slice. The retained unfinished Docker checkpoint was present in the worktree but was not exercised; the binary fingerprint identifies the tested artifact rather than claiming a clean-HEAD build.
+
+The actual server is a local macOS/aarch64 debug-assertion build with18 available logical CPUs. The workloads execute no Task states; joined process cleanup proves zero Native Lambda processes. CPU availability does not prove dedicated capacity, memory size or the specified4CPU/8GiB Linux reference. The measurements include SDK signing, local HTTP and terminal polling. They are a successful current-host check, with `referenceQualification=pending`.
+
+| Measurement | Observed (µs) | Contract |
+|---|---:|---|
+|100×50-state/1KiB, p50 |10346 | Report all100 ordered samples |
+|100×50-state/1KiB, p95 |10508 |≤100000 |
+|100×50-state/1KiB, maximum |10644 | Each observation<2000000 |
+|100 live-loop cycles, readiness maximum |283 |<2000000 |
+|100 live-loop cycles, Stop→ABORTED maximum |1102 |<2000000 |
+|History-exhaustion readiness maximum |348 |<2000000, at least one live bracket |
+|History-exhaustion live/all probes |137/137 |RUNNING→probe→RUNNING |
+|History-exhaustion final event ID |7560 | Reserved ExecutionFailed,≤25000 |
+
+Every latency execution preserves exact input/output and102 sequential typed history events. The loop reaches its configured history byte/event bound with States.HistoryLimitExceeded, then100 immediate one-slot starts each observe live work and finish ABORTED with the requested stop error. Configured accounting limits do not claim process RSS bounds. No Docker, VM, image latency, image log-flood, container cleanup, IaC or platform acceptance is inferred.
+
+The captured harness is retained in commit `43054d3`; recorded source hashes refer to that historical capture, before later fixture evolution.
+
+## Capture provenance
+
+```json
+{
+  "baseCommit": "a9b9f60d2a24537a0afbf4e4738e43936de0b0c6",
+  "decision": "D74",
+  "capturedAt": "2026-10-27T06:59:01.493816+00:00",
+  "rustc": "rustc 1.99.1 (58cf8f9c3 2026-10-13)",
+  "binarySha256": "e9fa58ece6ebe3f1cb5d2087fed849b1d597320f52d1a3144cd4415bde0e3a0a",
+  "sourceSha256": {
+    "Cargo.lock": "f88b8c7b4227d2bfe6ec8fa45570cebbafa01b309932402fb7ace07fe8cda34a",
+    "apps/rustack/tests/workflows_sdk.rs": "e1f4aee8ee16b4e397af00dc48c28bf6fe01106c1eb42ba37adf82cc75169f90",
+    "apps/rustack/tests/workflows_sdk/performance.rs": "7b3ab9eadfafdc1d1d37349eeb8ca3ebcb4c38ca6402820318f735ba14c4f4d5",
+    "apps/rustack/tests/workflows_sdk/performance/latency.rs": "8f68ae3ed3753642153dc23c0fd0f501e72879bd9bc0b43498367e01b6ee193f",
+    "apps/rustack/tests/workflows_sdk/performance/load.rs": "34f5f9c26d686d98e45a737bc652c742115093d8fb05d15b82e6694c30d7dc0e",
+    "apps/rustack/tests/workflows_sdk/performance/tests.rs": "313ce95fc0adf1b5d79704557530ff4d208438ca67801b188c86494f1bdf03ea",
+    "apps/rustack/tests/workflows_sdk/process.rs": "2750e27807c160ee0f6cd1567b946e6a6b20d7b049c22522ae8acd7b0ebd1c03",
+    "apps/rustack/tests/workflows_sdk/runner.rs": "d3b9b31be370fd0fff26ace796ce2e87d3c463901627fe6613ff2595abda6f86",
+    "apps/rustack/tests/workflows_sdk/rust.rs": "0c87f01f98c5f4ad329dc0542a57221e4c387d5de43df523166959a187996338"
+  }
+}
+```
+
+## Raw reports
+
+Each JSON line is the original bounded report emitted only after server cleanup. Raw sample order is preserved; summaries use nearest ranks50/95/100 and round durations up to whole microseconds.
+
+```json
+{"schemaVersion":1,"host":{"os":"macos","architecture":"aarch64","availableLogicalCpus":18,"debugAssertions":true,"referenceQualification":"pending"},"limits":{"openExecutions":1,"transitions":1000000,"historyEvents":25000,"historyBytes":33554432,"totalHistoryBytes":134217728},"nativeProcessesObserved":0,"serverJoined":true,"measurement":{"kind":"loopResponsiveness","openExecutionSlots":1,"completedCycles":100,"inputBytes":1024,"historyEventHighWater":7560,"exhaustion":{"probeCount":137,"liveProbeCount":137,"maxReadinessMicros":348},"readiness":{"count":100,"observedMicros":[283,274,274,282,267,259,257,265,242,240,229,225,226,250,232,207,219,224,218,235,223,229,213,219,219,216,222,230,225,221,225,224,219,220,224,223,220,218,221,217,216,207,217,219,226,220,237,225,219,221,224,230,222,224,223,253,216,249,217,226,216,220,223,225,219,225,225,224,217,227,221,226,216,229,215,218,216,217,222,222,219,215,223,220,216,219,224,218,217,224,220,220,209,227,217,214,218,219,233,224],"p50Micros":222,"p95Micros":265,"maxMicros":283},"stop":{"count":100,"observedMicros":[1058,1023,1027,1032,1068,1001,1027,1027,1016,973,1001,1000,1021,1102,1048,991,1022,1012,1012,1038,1016,1030,976,974,1019,1012,1000,998,1035,1023,958,1064,1018,1001,1035,984,1032,997,971,1032,1010,983,986,1034,1062,1039,1010,996,1028,988,1001,1031,977,989,1008,1012,982,1005,975,1024,1015,966,1024,1025,1028,979,1024,1057,1038,1055,999,980,1015,1005,1076,1052,1079,1025,1050,1033,969,1053,1037,1035,1037,1068,1046,1018,1028,1041,1043,1024,1013,1061,1000,1041,1035,1090,1051,1035],"p50Micros":1023,"p95Micros":1068,"maxMicros":1102}}}
+{"schemaVersion":1,"host":{"os":"macos","architecture":"aarch64","availableLogicalCpus":18,"debugAssertions":true,"referenceQualification":"pending"},"limits":{"openExecutions":1,"transitions":1000000,"historyEvents":25000,"historyBytes":33554432,"totalHistoryBytes":134217728},"nativeProcessesObserved":0,"serverJoined":true,"measurement":{"kind":"pureLatency","stateCount":50,"inputBytes":1024,"executions":100,"budgetMicros":100000,"latency":{"count":100,"observedMicros":[10644,10172,10264,10177,10080,10187,10263,10308,9812,10367,10388,7594,10353,10258,10274,10325,10293,10350,10441,10404,9943,10279,10338,10363,10337,10398,10235,10390,10397,10352,10411,10298,10334,10371,10340,10276,10311,10391,10333,10102,10357,10335,10386,10363,10266,10276,8990,10302,10323,10312,10228,10261,10345,10299,10390,10220,10337,10381,10338,10209,10369,10308,10284,10385,10359,10309,10290,10415,10278,10376,9835,10377,10371,10351,10388,10353,10420,10394,10346,10287,10416,10447,10389,10017,10471,10450,10561,10555,10473,10508,10384,10512,10477,10519,10484,10045,10352,10425,10488,10484],"p50Micros":10346,"p95Micros":10508,"maxMicros":10644}}}
+```
+
+See [verification§5.1](../../specs/rustack-workflows-70-verification-plan.md#51-native-host-pure-workflow-workload-and-responsiveness) for the executable contract and [review W211–W213](../../specs/rustack-workflows-93-review.md#p5-pure-workload-and-responsiveness-independent-review) for repaired evidence gaps.
diff --git a/docs/research/workflows-rootless-platform-review.md b/docs/research/workflows-rootless-platform-review.md
new file mode 100644
index 00000000..17781036
--- /dev/null
+++ b/docs/research/workflows-rootless-platform-review.md
@@ -0,0 +1,60 @@
+# Rootless Docker Bootstrap and Attestation Review
+
+Date:2026-10-31. Scope: [D103 bootstrap dependency](../../specs/rustack-workflows-58-rootless-platform-design.md), P5/5.3. Status: implemented and independently reviewed; full rootless platform/M4 qualification remains open. No further x86 validation is performed.
+
+## Contract and observed environment
+
+The installed profile is `rustack-workflows-rootless-arm64-v2`: native ARM VZ,4vCPUs,8GiB,24GiB local disk, read-only repository/target mounts and no context activation, Rosetta or binfmt. This is not a dedicated physical reference machine. The first failed profile `rustack-workflows-rootless-arm64` remains retained and unqualified; no existing VM was restarted, stopped or deleted.
+
+| Observation | Final evidence |
+|---|---|
+| Real rootless Engine | `7bbe02f2-0571-42f9-a4a3-a36a81425357`, Docker29.5.2, Linux aarch64, `name=rootless` |
+| Separate infrastructure Engine | `fbfd8647-6291-4660-a0c0-e913f1f82266` |
+| User service / dockerd | MainPID2311 / dockerd2361; all actual process UIDs501 |
+| Primary guest identity | UID501/GID1000 |
+| Socket | `/run/user/501/docker.sock`, UID501, mapped GID525278, mode01660, inode46; parent0700 |
+| Socket group inside daemon namespace | GID991, derived from the actual subordinate map; not guessed from the host GID |
+| Resource prerequisites | cgroup v2/systemd, no daemon warnings, cpu/memory/pids declared and enabled in user-manager subtree; manager/service control files owned/writable by UID501 |
+| Compatible rootless extras | `5:29.5.2-1~ubuntu.24.04~noble`; no Engine upgrade |
+| Published repository candidate | `5:29.9.2-1~ubuntu.24.04~noble`, independently recorded from signed apt metadata |
+
+The primary Docker signing key fingerprint is pinned/checked before apt consumption. Existing canonical Colima Docker repository/key files are reused rather than duplicated. Guest package operations run under exact recorded root-manager transient units, independently bounded even if the unprivileged SSH/controller disappears. Client context changes by the official installer are confined to its private DOCKER_CONFIG.
+
+## Failed attempts and read-only reconciliation
+
+Do not relabel the three original failures as successful installation owners:
+
+1. Original host handle18601 joins2. VM creation succeeds; apt update rejects two Docker Signed-By paths. No package installation or rootless user service occurs. `/tmp/rustack-d103-bootstrap-first.log`, `/tmp/rustack-d103-first-preconditions.json` and `/Users/tchen/.target/workflows-rootless-d103` retain the host evidence; guest entry/command records remain in the first VM. The conflicting task-created apt source remains with that failed, unqualified VM.
+2. Handle56590 joins2 before any guest entry/setup effect: the strict no-symlink reader rejects `/etc/os-release`. The corrected code reads canonical `/usr/lib/os-release`. `/tmp/rustack-d103-bootstrap-second.log`, `/tmp/rustack-d103-second-source` and `/Users/tchen/.target/workflows-rootless-d103-v2` retain this attempt. No second setup is dispatched until a fresh read-only probe proves all rootless state/service/socket/data absent.
+3. Explicit resumed owner57532 joins2 after all22 guest commands return0 and the actual daemon starts. Its final observer rejects legitimate sticky socket mode01660 and a mapped socket GID distinct from the primary guest GID. `/tmp/rustack-d103-bootstrap-resumed.log`, `/Users/tchen/.target/workflows-rootless-d103-v2-resumed` and the exact guest entry/source/intents/results/raw hashes preserve the failure. No package/service operation is rerun to fix report validation.
+
+The recovery path requires a complete contiguous command inventory, all zero-exit results with matching raw hashes, one successful official installer, both equal historical rootless info reads and the historical rootful identity. Every exact root transient job must be absent. It then independently re-observes actual process/namespace/socket/controller/package/engine state. New host receipts bind old source bytes/nonce and the current script; the original failed guest records are unchanged.
+
+Read-only recovery handle40810 joins0. Final-source capture79104 joins0 under `/Users/tchen/.target/workflows-rootless-d103-v2-final`; `/tmp/rustack-d103-final-attestation.log` retains its Make output. The source SHA256 is `a127607623ef137e422a6facb4ab2f52d78400271adb58ea239f9a190e0ce5e4`. Both qualification fields remain pending. The documented ordinary `workflows-rootless-attest` entry point also rechecks this recovered capture without guest mutation: original handle87420 joins0, retained in `/tmp/rustack-d103-repeat-attestation.log`.
+
+## Verification and independent review
+
+`make test-workflows-rootless-controls` passes25 normal controls. They cover rootful masquerade; UID/map/socket substitution; missing, unavailable or merely visible controllers; package/key/source conflicts; private source/intent ownership; exact root job timing; delayed fsync preventing dispatch; concurrent file publication; fresh-only setup resumption; mapped sticky sockets; and missing/corrupt/live-job recovery proof. No VM, Docker daemon or package installation is used by these controls.
+
+The actual privileged-owner control handle53204 joins0. A root UID0 Python process ignores TERM and sleeps60s inside the exact root systemd invocation path. The configured runtime/stop budget kills it after10,312ms; PID/PGID3030 and its exact unit are independently absent afterward. `/tmp/rustack-d103-root-owner-control.log` and `/home/tchen.guest/.local/state/rustack-rootless-owner-d103` retain intent, raw output, nonzero service result and physical absence. The unit is `rustack-d103-c4dcae2735d349b69d2a75df6595bff4-001.service`. This qualifies privileged setup ownership; it is not the Lambda kernel probe.
+
+The independent read-only reviewer rechecks delegation, atomic root-file publication, signed existing-repository reuse, root-owned lifetime bounds, durable pre-effect intents, post-fsync timing reserve, fresh-only resumption, recovery and mapped socket identity. No remaining concrete in-slice source findings. [W427–W434](../../specs/rustack-workflows-93-review.md#d103-rootless-bootstrap-review-w427w434) record the corrections and observed failures.
+
+`/tmp/rustack-d103-postconditions.json` independently verifies the original three VM allocations and default Docker context unchanged, the original source/measurement engines unchanged, all32/15 original image IDs retained and zero containers/volumes on those engines. `/tmp/rustack-d103-rootless-inventory.json` retains four successful explicit-endpoint queries proving the new rootless engine ID and zero all-state containers, volumes and images before workload provisioning. No image build, retag, deletion, prune or publication occurs in this dependency.
+
+This change is Python provisioning/control automation plus English specs/docs. New Make entries invoke metadata/provisioning/attestation only; no Rust source, artifact, dependency, feature, toolchain or Rust build/test target changes. Rust verification is not applicable to this slice; retain D102's existing Rust evidence without relabeling it as rootless execution. Text/link/index and diff checks apply here.
+
+## Remaining platform exit
+
+| Requirement | Status |
+|---|---|
+| Real rootless user daemon and effective delegation prerequisites | Pass |
+| Signed/version-matched installation and bounded privileged ownership | Pass |
+| Immutable install proof, independent/repeat attestation and source preservation | Pass |
+| Actual Lambda Rust kernel probe under rootless policy | Pending |
+| Immutable fixture transport and complete79-resource rootless inventory | Pending |
+| Rootless server-container mapped socket access and endpoint proofs | Pending |
+| Rootless performance/load and exact workload cleanup | Pending |
+| Desktop, dedicated reference, remaining recovery/load, W373 and full M4 | Pending |
+
+Continue from this retained installed daemon. Do not substitute bootstrap success for any pending row, rerun installation, or acquire an x86 runner.
diff --git a/docs/runtime-hardening.md b/docs/runtime-hardening.md
index 8005aac1..b8e35a3c 100644
--- a/docs/runtime-hardening.md
+++ b/docs/runtime-hardening.md
@@ -77,18 +77,20 @@ advertisedEndpoint: "http://localhost:4566"
 
 ### 3.1 Lambda
 
-默认 `disabled`；Docker **不支持并显式报错**。`native`/`auto`（squib 需要可用虚拟化）是**可信主机执行**，不是沙箱。执行准入：全局 32、每函数默认 8，保留并发为 0 时拒绝；异步事件预算 128（采用当前 AWS 异步载荷上限 1 MiB，同步 6 MiB）。ZIP 上传不可变、按内部 UUID 落地，`latest` 与已发布版本不再共享同一可覆盖路径；坏 ZIP/CRC/路径/大小/IO 在发布前被拒绝且保留先前版本与 warm 指纹。
+默认 `disabled`；显式 Docker Image 模式需要配置目录归属、daemon、relay、网络并通过实际启动探针，ZIP 与镜像快照恢复仍未开放。`native`/`auto`（squib 需要可用虚拟化）是**可信主机执行**，不是沙箱。执行准入：全局 32、每函数默认 8，保留并发为 0 时拒绝；异步事件预算 128（采用当前 AWS 异步载荷上限 1 MiB，同步 6 MiB）。ZIP 上传不可变、按内部 UUID 落地，`latest` 与已发布版本不再共享同一可覆盖路径；坏 ZIP/CRC/路径/大小/IO 在发布前被拒绝且保留先前版本与 warm 指纹。
+
+启用源代码 `stepfunctions` feature 后可运行纯 ASL 和显式 Native Lambda 工作流，支持 Parallel/Inline Map、嵌套 .sync、回调与终态快照。构建/配置/范围和已验证示例见 [English workflow guide](./workflows-guide.md)。纯服务不分配 Lambda/回调执行口；Docker Image 已接入实际启动与 SDK/ASL 路径，完整平台和发布验收仍未完成。
 
 ### 3.2 快照（`--snapshot <name>`）
 
 - 目录 `RUSTACK_SNAPSHOT_DIR`（默认 `.rustack/snapshots`）下按名字排他锁（`.{name}.lock`），同一快照名同时只能一个运行时拥有；
 - 保存：staged 目录写入与 fsync → 校验 manifest → 发布为目录级原子替换，替换前保留 `.{name}.previous`，崩溃或发布间隙通过恢复逻辑回到上一个完整代际；发布失败/恢复失败会**报错退出**，不会静默以空状态继续；
-- 加载：先恢复再读取；目标缺失且无可恢复代际才视为空起始（首次运行建快照的合法场景）；
-- **覆盖范围不等于全量持久化**：S3/DynamoDB 持久资源+数据，DynamoDB Streams 记录，Lambda 元数据+代码（不可变 artifact），其余服务为资源或缓存；SQS **消息**、Events/SNS 投递历史、无快照声明的服务不随快照保留。日志明确打印本次 coverage。
+- 加载：先恢复再读取；目标缺失且无可恢复代际才视为空起始（首次运行建快照的合法场景）；物理发布中断可恢复上一完整代际，profile/hash/quota 等导入失败不自动回退，并保留现有/previous 两代；
+- **覆盖范围不等于全量持久化**：S3/DynamoDB 持久资源+数据，DynamoDB Streams 记录，Lambda 元数据+代码（不可变 artifact），其余服务为资源或缓存；Step Functions 在启用时保存定义、保留的执行结果与完整历史；重启不恢复活跃任务、计时器、回调或进程，不重放 Lambda 副作用，旧分页/回调句柄失效。SQS **消息**、Events/SNS 投递历史、无快照声明的服务不随快照保留。日志明确打印本次 coverage。
 
 ### 3.3 停机（SIGINT/SIGTERM）
 
-收到信号后：停止接受连接（保留诊断连接）→ 在共享总 deadline（`budgets.shutdownSeconds`，默认 30 s）内排空 HTTP → 按顺序 quiesce：Events/SNS 停新投递并等待已接受投递 → DynamoDB 排空已准入 blocking 工作 → Lambda 停新执行并收割子进程 → SQS 停新移交并排空 DLQ 移交 → 快照保存（有快照名且前序成功）→ 并行停止各 provider。quiesce/保存超时不发布一致性快照；总截止前留出清理余量，被卡住的 blocking IO 不会让进程无限挂起。
+收到信号后：停止接受连接（保留诊断连接）→ 在共享总 deadline（`budgets.shutdownSeconds`，默认 30 s）内排空 HTTP → 按顺序 quiesce：Events/SNS 停新投递并等待已接受投递 → DynamoDB 排空已准入 blocking 工作 → Step Functions 关闭 API、保留原 grace 截点、取消并等待执行/回调/桥接清理 → Lambda 停新执行并收割子进程 → SQS 停新移交并排空 DLQ 移交 → 快照保存（有快照名且前序成功）→ 并行停止各 provider。quiesce/保存超时不发布一致性快照；总截止前留出清理余量，被卡住的 blocking IO 不会让进程无限挂起。
 
 ## 4. 健康与能力端点
 
diff --git a/docs/smoke-tests.md b/docs/smoke-tests.md
index 3b1ba57f..402f7a7b 100644
--- a/docs/smoke-tests.md
+++ b/docs/smoke-tests.md
@@ -30,6 +30,18 @@ Individual existing integration tests do not all enforce cleanup, and KMS key
 deletion is scheduled rather than immediate. Restart the in-memory server to
 discard remaining fixtures. The runner does not stop a server it did not start.
 
+## Owned Step Functions workflow smoke
+
+`make smoke-workflows` owns a separate strict-auth pure Step Functions server,
+loads the documented YAML/ASL example, asserts success and Fail branches with
+ordinary signed SDK requests, and joins process cleanup. It needs no existing
+server, Native bootstrap, uv/boto3 or Docker. See the [workflow guide](./workflows-guide.md)
+for feature selection and supported behavior. `make verify-workflows-native`
+adds exact resource inventories and the implemented Native/SDK/history/restart
+and performance gates; final image/IaC/reference-platform qualification remains
+separate. These opt-in workflow checks are not included in the 30-case default
+service smoke manifest below.
+
 ## Functional coverage
 
 The Makefile contains an explicit manifest of 30 exact test names. The runner
diff --git a/docs/workflows-guide.md b/docs/workflows-guide.md
new file mode 100644
index 00000000..f0e06819
--- /dev/null
+++ b/docs/workflows-guide.md
@@ -0,0 +1,807 @@
+# Step Functions and Lambda workflows
+
+Rustack runs STANDARD workflows through its own ASL engine. The opt-in
+`stepfunctions` source feature supports a bounded JSONPath profile, all eight
+state types, retries/timeouts, Inline Map/Parallel, nested workflows and Lambda
+callbacks. Real Lambda execution is qualified through the explicit trusted-host
+Native backend and the ordinary Docker image startup path. Docker requires the
+configured ownership/recovery and real kernel/network/optional gateway probes
+below; it uses the actual shared provider for SDK and ASL calls. The configured
+provided.al2023 profile executes original ZIP code and restores bounded ZIP/Image
+archives through the same qualified owner. Official Python, pinned Node24 and an
+independent Rust RIC have functional evidence on the retained lanes. Explicit
+local SDK access to S3/DynamoDB, real image callbacks and managed Pulumi IaC
+consumers and the separate Linux server-container topology are qualified below.
+The actual root release image and composite Action are qualified through D99.
+The immutable candidate/qualification/promotion pipeline is implemented.
+Complete release acceptance still requires all current-source platform and
+dedicated ARM reference evidence; local checks do not publish images. The user has waived
+further Linux x86_64 validation; recorded amd64/QEMU results are historical
+functional evidence, with no native-x86 performance claim.
+
+## Run the pure example
+
+Run the commands from the repository root, using Cargo and the pinned Rust toolchain. The qualification commands require a Unix host
+(Linux or macOS); performance evidence includes macOS/aarch64 and a native arm64 Linux VM. The feature is absent from the default source build;
+adding `SERVICES=stepfunctions` to that unchanged binary cannot enable it.
+
+```bash
+# Compile the Step Functions service without Lambda or other service adapters.
+cargo build --locked -p rustack-cli --bin rustack \
+  --no-default-features --features stepfunctions
+
+# Run the checked-in strict-auth configuration; only dummy local credentials apply.
+env -u AWS_ACCESS_KEY_ID -u AWS_SECRET_ACCESS_KEY -u AWS_SESSION_TOKEN \
+  RUSTACK_CONFIG=examples/workflows/rustack.yaml \
+  cargo run --locked -p rustack-cli --bin rustack \
+    --no-default-features --features stepfunctions -- --snapshot workflow-demo
+```
+
+The server listens on `127.0.0.1:4566`. The
+[example YAML](../examples/workflows/rustack.yaml) enables only Step Functions,
+requires local SigV4 credentials and sets enforced workflow budgets. Process
+environment overrides YAML; conflicting region/account/credential aliases fail
+startup. `RUSTACK_CONFIG` selects the file; there is no `--config` flag.
+
+In another terminal, use an installed AWS CLI v2. The explicit endpoint applies to
+each request, as described in the [AWS CLI endpoint guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-endpoints.html).
+
+```bash
+export AWS_ACCESS_KEY_ID=local-key AWS_SECRET_ACCESS_KEY=local-secret
+export AWS_DEFAULT_REGION=us-east-1 AWS_REGION=us-east-1 AWS_PAGER=""
+unset AWS_SESSION_TOKEN
+export WORKFLOW_ENDPOINT=http://127.0.0.1:4566
+
+aws --endpoint-url "$WORKFLOW_ENDPOINT" stepfunctions validate-state-machine-definition \
+  --definition file://examples/workflows/pure.asl.json --type STANDARD
+
+aws --endpoint-url "$WORKFLOW_ENDPOINT" stepfunctions create-state-machine \
+  --name Documented --type STANDARD \
+  --role-arn arn:aws:iam::000000000000:role/Workflows \
+  --definition file://examples/workflows/pure.asl.json
+
+aws --endpoint-url "$WORKFLOW_ENDPOINT" stepfunctions start-execution \
+  --state-machine-arn arn:aws:states:us-east-1:000000000000:stateMachine:Documented \
+  --name Positive --input '{"n":6}'
+
+aws --endpoint-url "$WORKFLOW_ENDPOINT" stepfunctions describe-execution \
+  --execution-arn arn:aws:states:us-east-1:000000000000:execution:Documented:Positive
+
+aws --endpoint-url "$WORKFLOW_ENDPOINT" stepfunctions get-execution-history \
+  --execution-arn arn:aws:states:us-east-1:000000000000:execution:Documented:Positive
+```
+
+Start returns acceptance; describe again if it is still RUNNING. The checked-in
+[ASL](../examples/workflows/pure.asl.json) doubles `n`, selects the positive branch,
+waits zero seconds and succeeds with the JSON output `{"doubled":12}`. Starting a
+different execution name with `{"n":0}` reaches Fail with `Example.NotPositive`.
+Output is a JSON-bearing string in the API response. The role ARN is validated
+and captured locally; this is not IAM policy enforcement. CLI argument shapes
+follow the official [create](https://docs.aws.amazon.com/cli/latest/reference/stepfunctions/create-state-machine.html)
+and [start](https://docs.aws.amazon.com/cli/latest/reference/stepfunctions/start-execution.html)
+commands; Rustack implements the narrower profile below.
+
+The automated equivalent owns its server, uses the same YAML/ASL files and an
+ordinary signed Rust SDK, tests both branches and joins server cleanup:
+
+```bash
+make smoke-workflows
+```
+
+This smoke needs Cargo and Python 3 for inventory validation. It does not need a
+running server, Native bootstrap, `uv`, boto3 or Docker. Other SDK acceptance
+targets deliberately provision their own additional fixtures.
+
+## Run Docker image Lambda tasks
+
+Build with `--features lambda,stepfunctions` (the default source feature set also
+contains Lambda). Explicit `LAMBDA_EXECUTOR=docker` selects the real image runtime;
+execution otherwise stays disabled. Supply an operator-selected relay artifact,
+existing user bridge or explicit `none`, local Unix daemon socket and a private
+absolute `DATA_DIR`. The existing data-directory default is `/var/lib/localstack`;
+choose a writable private directory for local development. Example YAML:
+
+```yaml
+environment:
+  SERVICES: "lambda,stepfunctions"
+  GATEWAY_LISTEN: "127.0.0.1:4566"
+  DATA_DIR: "/absolute/private/rustack-data"
+  LAMBDA_EXECUTOR: "docker"
+  LAMBDA_DOCKER_SOCKET: "unix:///var/run/docker.sock"
+  LAMBDA_DOCKER_RELAY_IMAGE: "rustack/lambda-runtime:integration-arm64"
+  LAMBDA_DOCKER_NETWORK: "none"
+  LAMBDA_SKIP_SIGNATURE_VALIDATION: false
+  STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION: false
+  ACCESS_KEY: "local-key"
+  SECRET_KEY: "local-secret"
+budgets:
+  startupSeconds: 600
+  shutdownSeconds: 30
+```
+
+The relay tag is an explicit locally built operator source, not a runtime catalog.
+Build it for the selected daemon architecture with
+`make lambda-runtime-image WORKFLOWS_ARCH=arm64 WORKFLOWS_DOCKER_SOCKET=<socket-path>`;
+choose the installed Docker buildx command through `WORKFLOWS_IMAGE_BUILDER` if
+needed. The actual image reference defaults to the architecture-suffixed integration
+tag shown above. Image sources must already exist unless you explicitly configure
+the exact registry allowlist and `ifMissing` pull policy in the
+[operator specification](../specs/rustack-workflows-60-operations-design.md#11-docker-configuration).
+No ambient registry credential helper is executed. A private credential file has
+its own bounded quoted YAML schema, ownership/mode checks and operator-controlled
+ACL precondition.
+
+The daemon must be Linux and expose the required enforced resource/isolation
+controls. Startup resolves its selected arm64/amd64 platform and pins the relay
+by captured immutable identity. With cross-architecture false, the host and daemon
+architectures must match. Explicit true permits the separately probed selected
+target, including a remote emulated daemon; other function architectures are
+rejected during preparation. Pass `Architectures=["arm64"]` or `["x86_64"]` when
+creating an Image function to match the qualified platform. Use the same ordinary
+Lambda and Step Functions clients/ASL integrations described in this guide.
+
+`none` deliberately permits disconnected functions with `workers.docker.sdkGateway=false`.
+For function-originated service access, select an existing user bridge and set
+`LAMBDA_DOCKER_GATEWAY_ENDPOINT` to the independently chosen function-visible origin.
+Choose a gateway listener reachable from that network; default host loopback is
+not generally sufficient. Startup runs the trusted pinned function in that exact
+network and requires a response from this listener instance. No endpoint is
+inferred from Host or the advertised URL. HTTP is operator-trusted local networking;
+HTTPS uses normal name/certificate verification with embedded public roots, without
+production private-CA loading. This reachability receipt is separate from the actual handler SDK and callback
+acceptance described below. Configure the explicit local SDK pair deliberately;
+host AWS secrets are never inherited.
+
+Before readiness, the actual listener serves bounded diagnostics only. The fixed
+`/_rustack/runtime-probe` identity is public correlation, not authentication.
+Ordinary ingress opens only after recorded previous-run cleanup, complete bounded
+namespace inventories, live pins, actual kernel/optional endpoint receipts, provider
+construction and snapshot validation. `workers.docker` reports ready, platform,
+sdkGateway and zip=false. Backend/deployment owner faults affect readiness;
+normal FunctionError does not. One startupSeconds deadline includes all startup
+work, independently of shutdownSeconds.
+
+New ownership identities carry the journal-generation magic. Legacy identities
+are preserved and refused for production; an empty scan cannot upgrade them.
+Retain old evidence and choose a fresh controlled DATA_DIR when appropriate; this
+does not reclaim old resources. Never delete/reset owner, lock, daemon binding or
+journals to bypass refusal. Shutdown retains exact cleanup ownership and removes
+only recorded private resources, preserving operator source images/cache.
+
+An invocation whose function memory plus the64MiB relay charge exceeds
+`lambdaDockerMemoryBytes` returns429 before allocation. Temporary contention
+uses the bounded runtime queue. For a qualified Docker backend, shutdown reserves
+`lambdaDockerCleanupSeconds`, capped at half of `shutdownSeconds`, for final
+cleanup inside the original shutdown deadline. Native/pure workflows keep their
+existing grace period. An unfinished accepted-work drain still exits with an
+error and does not publish a successful snapshot, even if container cleanup
+succeeds.
+
+ZIP deployment staging bounds compressed code to50MiB, expanded content to250MiB,
+and explicit entries plus implicit parent directories to10,000 filesystem nodes.
+It rejects traversal/absolute/drive/NUL names, links, special file declarations,
+privileged modes and corrupt directory/file streams.
+
+Docker runs Image functions by default. The explicitly configured provided-runtime
+profile below adds ZIP execution and managed ZIP archives. Named Image snapshots
+restore resources, published versions, aliases and terminal workflow history without replay. The archive stores
+image references and execution metadata, not image layers. Every usable revision
+requires the exact saved immutable content to remain in the local daemon; restore
+never pulls or follows a changed source tag. The provider account and region must
+match. Fresh platform/fingerprint/size proof precedes publication and ingress.
+Invalid metadata, missing content or an expired startup deadline preserves both
+current and previous archive generations.
+
+Image-only Docker Lambda metadata is capped at16MiB,256 functions and1024 total
+latest/published revisions, with bounded depth, members and scalar sizes. Saving
+over-profile metadata fails before generation publication. The managed ZIP profile
+retains the same metadata/count limits and adds separate original-code budgets below. See the
+[Image archive contract](../specs/rustack-workflows-20-lambda-runtime-design.md#216-candidate-store-image-archive-restoration-d88)
+for exact limits. Named Native/pure workflow snapshots remain available within
+their documented profile. The L01–L09 Docker fault/admission matrix is functionally
+qualified on the retained lanes, including the pinned Node24 consumer below.
+Image SDK access to S3/DynamoDB and image callbacks also pass on those lanes.
+Managed Pulumi IaC also passes on those lanes. Server-in-container, native
+reference and final platform/release gates remain open.
+
+The explicit `make test-lambda-startup-docker` gate builds its host executable in
+an isolated Cargo target directory and captures a fixture-owned executable copy,
+so concurrent plain/minimal builds cannot replace it. It requires the explicit
+socket, architecture, fixture images and (for connected cases) an owned user bridge
+and function-visible host. Missing prerequisites fail; it uses actual startup
+receipts and ordinary signed SDKs, without injected readiness.
+
+The custom Rust RIC acceptance fixture is built explicitly with
+`make lambda-custom-ric-images` for the chosen architecture/socket. The
+`test-lambda-custom-ric-docker` target runs the complete ordinary startup suite,
+including signed Rust SDK computation and boto3 ImageConfig, mutable-tag/update,
+publication/alias and active cross-invocation identity cases. Supply the same
+explicit owned bridge and function-visible host as endpoint qualification. Its
+bounded fixture-only collector holds both consumed requests until each rejects
+foreign/stale completions; it also proves a published A call finishes as A after
+latest updates successfully to B. Cold published-A/latest-B launches must also
+return counter=1 after other resources displace their environments. Test source tags are uniquely owned and checked
+before removal. The collector is a test barrier, not a required user endpoint or
+handler SDK compatibility claim. Official Python, pinned Node24 and independent
+Rust RIC and image callback evidence covers the recorded retained lanes;
+the remaining platform matrix stays open. Collector failure controls run with `make test-lambda-custom-ric-fixture`.
+
+The pinned official Node24 handler image has a separate explicit consumer:
+
+```bash
+make test-lambda-node-docker \
+  WORKFLOWS_ARCH=arm64 \
+  WORKFLOWS_DOCKER_SOCKET=/absolute/selected/docker.sock \
+  WORKFLOWS_NETWORK=existing-user-bridge \
+  WORKFLOWS_GATEWAY_HOST=192.168.5.2 \
+  WORKFLOWS_DOCKER_BIN=/absolute/path/to/docker \
+  WORKFLOWS_IMAGE_BUILDER=/absolute/path/to/docker-buildx
+```
+
+This builds the digest-pinned Node24 base with the checked-in built-in-only
+handler and exercises signed Rust/boto3 calls and an optimized ASL Lambda task.
+It checks actual Node version/architecture/UID, read-only code, writable temporary
+storage, stdout/stderr tails, cold/warm counters, published versions/aliases after
+CMD updates and named FunctionError followed by a fresh healthy replacement.
+`make test-lambda-node-fixture` runs its observer, child-join, Runtime HTTP and session-admission
+controls without allocating Docker resources. Node ZIP/runtime-name support is
+outside this image profile. Both retained functional lanes execute Node24.22.1.
+See the [official Node contract](../specs/rustack-workflows-20-lambda-runtime-design.md#417-official-node-image-consumption-d94)
+for exact ownership and validation bounds. Required arm64/reference and Docker
+Desktop/rootless remain separate requirements; image callback acceptance is documented below.
+
+The default Node RIC can retain five normal keepalive sockets. The local Runtime
+API allows eight connection tasks, one active invocation/poll and four charged
+POST bodies of at most6MiB each. Admission remains charged while an accepted
+payload is queued even if its HTTP observer expires. General header values remain
+256 bytes within16KiB aggregate; only the exact FunctionError X-Ray cause field
+allows up to8KiB. Rejected metadata does not settle the invocation. Custom images
+with larger worker/socket pools must fit these bounds.
+
+Image and provided-runtime functions can opt into local AWS SDK access. Configure
+both `LAMBDA_DOCKER_SDK_ACCESS_KEY_ID` and
+`LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY`, together with the existing qualified
+`LAMBDA_DOCKER_GATEWAY_ENDPOINT` and a selected user bridge. The pair must match
+the local services' credentials. Build with `lambda,stepfunctions,s3,dynamodb`
+and explicitly enable those services when using S3/DynamoDB. Server credential
+aliases must agree; differing `ACCESS_KEY` and `AWS_ACCESS_KEY_ID` fail validation.
+
+Startup issues the SDK context only after its actual same-instance endpoint
+proof. The function receives the explicit pair and canonical `AWS_ENDPOINT_URL`;
+profile, session, role, metadata/container credential and per-service endpoint
+selectors are cleared, including inherited image defaults. SDK clients can use
+their default credential/endpoint providers. S3 clients should use path-style
+addressing for the local gateway. Client code can still explicitly select other
+credentials or endpoints. With the pair absent, existing user environment
+behavior is preserved. Partial pairs fail startup; host credentials are never
+used as a fallback for this context.
+
+The injected pair belongs to the installed runtime and its function containers.
+It does not enter relay/probe environments, GetFunctionConfiguration, captured
+revisions or saved archives. A new installation can supply a different pair;
+restored function metadata cannot choose it. `sdkGateway` continues to report
+qualified reachability, rather than authorization for a particular service.
+See the [local SDK contract](../specs/rustack-workflows-20-lambda-runtime-design.md#418-explicit-local-handler-sdk-environment-d95)
+for limits, affiliation and environment precedence.
+
+`make test-lambda-handler-sdk-docker` uses the same explicit socket, architecture,
+owned bridge, function-visible gateway, Docker CLI and image-builder settings as
+the full gate below. It builds a separate pinned Node24 SDK image and runs two
+exact resources: real default-provider S3/DynamoDB cold/warm read/write with
+independent host verification, and wrong explicit credentials with precise
+authorization errors despite valid ambient server credentials. Its quiet-body
+control checks cancellation after HTTP headers. The pinned image's actual
+clients are 3.1105.0; no npm installation is needed.
+`make test-lambda-handler-sdk-fixture` runs the configuration, environment,
+affiliation, bounded archive-omission and observer controls without Docker
+resources. Both retained functional lanes pass these SDK consumers. After the
+fixture images have been provisioned, `make test-lambda-image-sdk-consumers-docker`
+repeats the Node/SDK controls, complete compiled manifest and all three exact
+Node/SDK resources using those recorded images. It does not rebuild images;
+missing prerequisites fail. Image callback acceptance is documented next;
+remaining reference/platform gates are separate requirements.
+
+`make test-lambda-callback-docker` builds a separate digest-pinned Node24 callback
+image and runs two exact resources covering all nine callback cases. Supply the
+same selected/other Docker sockets, architecture, bridge, gateway and builder
+settings as the full gate below. `make test-lambda-callback-fixture` checks the
+safe gates and independent privacy/archive observers without allocating Docker
+resources.
+
+The callback Task invokes dispatcher A synchronously. For post-return completion,
+A uses the actual default-provider Lambda SDK to accept worker B with Event/202;
+B stays in its own active invocation while A returns. Safe DynamoDB gates then
+release B to call SendTaskSuccess or SendTaskHeartbeat; gated A supplies the
+early success/failure cases with SendTaskSuccess or SendTaskFailure. This
+requires no work to continue after A's managed handler returns. Tests prove
+before/after-return causality, unrelated Lambda progress with one workflow
+dispatch slot, fresh tokens on retry, heartbeat versus absolute timeout and
+Stop cancelling A while independent B remains owned until released and joined.
+
+Both retained functional lanes pass real Lambda/Step Functions/DynamoDB
+clients3.1105.0, exact SDK error classes and all nine catalog cases. Confirmed
+saved archives retain the two actual functions and terminal workflow rows;
+bounded history/log/archive scans reject leaked tokens or injected credentials.
+See the [image callback contract](../specs/rustack-workflows-40-integrations-design.md#56-real-image-sdk-callbacks-and-independent-event-worker-d96).
+This is native-arm64 VZ/emulated-amd64 QEMU functional acceptance; required arm64
+reference, Docker Desktop/rootless and complete release gates remain open.
+
+`make test-workflows-iac-docker` builds the pinned Pulumi tool image and runs two
+real consumers through the ordinary service. Supply the same architecture,
+selected/other sockets, bridge, gateway and builder settings as the full gate
+below. `make test-workflows-iac-fixture` runs dependency, artifact, program,
+privacy, replay and process-ownership controls without allocating Docker
+resources. Provisioning stays in the project fixture/cache; no global Pulumi CLI
+or user plugin cache is used.
+
+The tool function runs CLI/core3.273.0 and AWS provider7.52.1 inside the managed
+image namespace. A separate Node image supplies actual business computation.
+The lifecycle runs create/refresh/update, three explicitly rejected unsupported
+updates, valid recovery followed by strict no-change convergence, destroy and
+stack removal. Independent clients require42/46 results with new execution and
+request identities, and observe the actual API resource before and after each
+transition. A scoped existing unpublished machine supports an empty
+ListStateMachineVersions read; publication, qualified version ARNs and aliases
+remain unavailable.
+
+State audits distinguish encrypted provider inputs before destroy, actual
+current state/API absence after destroy, and active-checkpoint absence after
+stack removal. A pinned read-only observer reads the live tmpfs and must finish
+successfully before host decoding. The Stop consumer observes actual CLI,
+language and provider processes alive, retires only the tool function/relay,
+and verifies that the exact business pair remains healthy. The private test
+profile uses two environments, two workflow dispatches and a1,536MiB aggregate
+memory ceiling. See the [IaC contract](../specs/rustack-workflows-50-iac-design.md).
+At D97, both retained functional lanes passed the lifecycle and Stop resources, all72
+full Docker resources and exact zero-remnant/source-preservation checks. See
+[final D97 qualification](../specs/rustack-workflows-93-review.md#d97-final-qualification-and-exact-postconditions).
+D98 qualifies the separate server-container topology below. Required arm64
+reference and additional Docker platforms remain required.
+
+`make test-workflows-server-docker` builds the actual Linux Rustack CLI in a
+separate server fixture image and runs two exact resources. In addition to the
+full gate's inputs, explicitly supply `WORKFLOWS_DOCKER_DAEMON_SOCKET` and
+`WORKFLOWS_DOCKER_DAEMON_SOCKET_GID`: these describe the socket path and group
+inside the selected Linux daemon host. They are distinct from the host client's
+Unix socket. No macOS-to-VM path inference is performed. The image build uses
+the pinned toolchain, existing GNU targets, cargo-zigbuild and Zig0.16.0; a
+bounded compatibility adapter handles its obsolete linker optimization flag.
+
+The server runs as UID/GID65532 with the supplemental socket group, a read-only
+root, dropped capabilities and a dedicated named data volume. Only that trusted
+server receives the socket. Its internal bridge DNS address supplies the handler
+SDK endpoint; the host client uses a separately inspected loopback-published
+port. Real signed SDK calls compute42/46, and a nested `.sync:2` child computes50
+through the same warm function/relay pair. The negative case must reject a
+closed internal gateway port during production startup. Both paths validate
+the actual persisted owner/engine records and normal server/runtime shutdown
+before removing their exact server and volume. They never force-clean a failed
+production shutdown into a passing result.
+
+Both focused resources and the complete74-resource gate pass on native-arm64
+VZ and emulated-amd64 QEMU, with535 Rust cases per full lane. Exact postconditions
+prove zero remnants, fourteen preserved source IDs per engine and removal of
+only the two task-owned empty bridges. See [final D98 qualification](../specs/rustack-workflows-93-review.md#d98-final-qualification-and-exact-postconditions).
+`make test-workflows-server-fixture` runs the import, history, identity,
+archive, policy, privacy and diagnostic controls without Docker allocation.
+See the [server-container contract](../specs/rustack-workflows-55-server-container-design.md).
+This fixture topology does not qualify the default release Dockerfile or close
+required arm64/reference/Desktop/rootless/final-release requirements.
+
+## Build and qualify the release image
+
+The root `Dockerfile` now builds the normal default CLI plus `stepfunctions`
+with the pinned Rust toolchain and the repository's security patch. This Docker
+distribution profile differs from the opt-in source feature above. Compiled
+Step Functions supports pure ASL without a Lambda executor; real code execution
+still requires explicit backend settings and successful startup probes.
+
+```bash
+make lambda-workflows-release-image \
+  WORKFLOWS_ARCH=arm64 \
+  WORKFLOWS_DOCKER_SOCKET=/absolute/selected/docker.sock \
+  WORKFLOWS_IMAGE_BUILDER=/absolute/path/to/docker-buildx
+```
+
+The default local tag is `rustack/workflows-release:integration-arm64`; choose
+`amd64` for the other architecture. `WORKFLOWS_RELEASE_BUILD_JOBS` defaults to2
+and accepts1..8. The production recipe builds musl inside the selected Linux
+engine; it keeps scratch, UID65532, CA roots and its real image healthcheck.
+Builds/pulls are separate from runtime timing. Every build also runs the
+`test-workflows-release-image` gate: it saves the captured immutable image ID
+without starting a container, checks the actual static ELF and exact scratch
+filesystem/health profile, and retains a private artifact receipt. The same
+target can recheck an existing image. Kernel file limits, bounded decompression
+and finite CLI observations guard this inspection.
+
+`make test-workflows-release-docker` accepts the same explicit daemon-side
+socket/group, network, gateway, other daemon and builder inputs as the complete
+gate below. It builds the actual root image and runs two exact resources:
+signed SDK42/46 plus nested `.sync:2` child50, and unreachable-gateway startup
+rejection. It reuses the server owner and places only public budget YAML into
+the exact data volume; private credentials remain in a separate env file.
+Release acceptance requires actual Docker health, persisted identity proof and
+normal server/runtime cleanup. Source/build completion alone is insufficient.
+
+The composite GitHub Action exposes `stepfunctions-skip-auth` with the existing
+service conventions. Its default container does not receive a daemon socket;
+pure workflows work without enabling function code execution. All inputs enter
+the runtime through environment values and are validated before effects.
+Readiness uses elapsed time, exact container/image/daemon identity and structured
+health. A healthy full container ID is handed to the caller for cleanup.
+`make test-workflows-action-fixture` runs26 actual-body adversarial/process
+controls under an independent Rust process owner and an exact one-resource
+Action manifest. This Action profile is separate from Native26 and the current Docker83 inventory.
+The default Action CI consumer also checks pure ASL21→42 and its exact history;
+local YAML/control verification is not a remote CI result.
+
+The [release-image contract](../specs/rustack-workflows-56-release-image-design.md)
+records the required both-lane acceptance and remaining publication/platform
+work. Both actual image profiles pass final D99 qualification: all76 resources
+and558 aggregate Rust cases per full lane, with zero remnants and fifteen
+source identities preserved per engine. See [final D99 evidence](../specs/rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions).
+[D100](../specs/rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation.
+Existing both-lane commands/results describe completed evidence; future required
+platform work uses arm64 and the remaining Desktop/rootless/reference gates.
+
+The current release pipeline builds immutable candidates without login or push in
+`release-docker.yml`. `workflows-evidence.yml` uploads a deliberately staged,
+source-bound bundle from a configured qualification runner. `qualify-workflows.yml`
+checks same-repository, successful, same-commit candidate/evidence runs and reruns
+`make verify-workflows`; `promote-docker.yml` alone holds package-write permission
+and publishes the exact qualified archives. Local work does not trigger publication.
+See the [qualification contract](../specs/rustack-workflows-59-release-qualification-design.md)
+for the bounded bundle schema, seven required lanes and selective evidence packing.
+Missing Desktop or dedicated ARM reference evidence prevents qualification.
+
+For a local bundle, run:
+
+```bash
+make verify-workflows \
+  WORKFLOWS_RELEASE_BUNDLE=/absolute/private/bundle \
+  WORKFLOWS_RELEASE_REPORT=/absolute/private/report.json
+```
+
+`verify-workflows-rust` and `verify-workflows-native-recorded` record the fixed
+Rust and Native command catalogs. `test-workflows-docker-functional` consumes an
+explicit rootful/Desktop topology JSON; `test-workflows-rootless-functional`
+consumes the retained attestation, immutable preparation and bounded SSH forward.
+Both execute the same exact83-resource manifest without rebuilding fixtures.
+
+`make test-lambda-faults-docker` runs that complete startup suite plus real
+initialization/error/exit/OOM/timeout, signed initializing/busy caller
+disconnects, reserved quotas and128 accepted Event requests under two actual
+environment pairs. Its held backlog must report unfinished draining while
+still cleaning owned containers before natural expiry. The bounded observer
+controls run with `make test-lambda-fault-fixture`; library memory/admission
+regressions run with `make test-lambda-faults`. These gates require the same
+explicit images, daemon, bridge and function-visible host. The full gate below also qualifies allocation/cleanup IO faults, daemon loss
+and pull/deployment saturation on the retained functional lanes.
+
+The complete current Docker functional resource gate is explicit:
+
+```bash
+make test-lambda-docker \
+  WORKFLOWS_ARCH=arm64 \
+  WORKFLOWS_DOCKER_SOCKET=/absolute/selected/docker.sock \
+  WORKFLOWS_DOCKER_DAEMON_SOCKET=/var/run/docker.sock \
+  WORKFLOWS_DOCKER_DAEMON_SOCKET_GID=991 \
+  WORKFLOWS_OTHER_DOCKER_SOCKET=/absolute/other/docker.sock \
+  WORKFLOWS_NETWORK=existing-user-bridge \
+  WORKFLOWS_GATEWAY_HOST=192.168.5.2 \
+  WORKFLOWS_DOCKER_BIN=/absolute/path/to/docker \
+  WORKFLOWS_IMAGE_BUILDER=/absolute/path/to/docker-buildx
+```
+
+Choose values for your actual two distinct daemons, daemon-side socket/group and function-visible gateway;
+the addresses above are placeholders. The gate builds fixtures, compares eight
+compiled inventories against the [frozen 76-resource manifest](../tests/workflows/docker-required-suites.json), then runs every
+resource sequentially. Missing/extra/renamed ignored tests fail preflight.
+It includes the standalone relay suite and real cross-daemon binding; run each
+selected architecture with the other daemon supplied. This qualifies the
+`docker-image-functional` profile, while final platform/release requirements
+remain open. `make test-lambda-docker-manifest` checks inventories without
+running Docker resources.
+
+Docker ZIP execution is an explicit provided-runtime installation. Set
+`LAMBDA_DOCKER_ZIP_IMAGE` to a locally available immutable `repository@sha256:...`
+OS image for `provided.al2023`, alongside the relay image. There is no implicit
+base catalog or fallback runtime. Deploy a ZIP with a root executable Linux ELF
+`bootstrap`, `Runtime=provided.al2023`, an ASCII handler of1..128 bytes using
+letters, digits or `_./:-`, and one architecture matching that installed image.
+The handler is passed as `_HANDLER`; Rustack always starts `/var/task/bootstrap`.
+Original ZIP SHA256/size remain the public code identity. Validation failures do
+not replace the latest revision, publications or aliases.
+
+Use a fresh data directory for this installation: its `RSDKOWN3` namespace
+journals code-volume ownership. Existing Image ownership roots are refused rather
+than upgraded. Startup recovers recorded code effects before image pins and
+qualifies the exact base/producer before advertising `workers.docker.zip=true`.
+An image-only installation advertises false and rejects ZIP before fetching or
+staging it. A failed/revoked installed source revokes backend readiness.
+
+Each cold environment receives a unique daemon-local code volume. A never-started
+RW loader transfers the original archive; the actual function receives only a
+read-only `/var/task` mount, normalized root-owned code, and its own writable
+noexec `/tmp`. Code preparation shares the environment's original start/invocation
+deadline. Cancellation joins the original upload and physical consumer retirement
+before releasing code-volume and environment reservations. Configure
+`budgets.lambdaDockerCodeUploadSeconds` in YAML when tuning upload IO (default60,
+range1..600 seconds); the cold deadline still caps it. Shutdown joins functions
+and IO, then code volumes, image pins and the Docker wire.
+
+`make test-lambda-provided-docker` selects the ordinary signed SDK/ASL/revision/
+fault/cancellation cases and the exact-same-ZIP Linux Native verifier after the
+compiled inventory check. It consumes the explicit fixture variables set by the
+full gate; run `make test-lambda-docker` to provision and verify all66 resources.
+Keep fixture files unchanged throughout a run. The verifier executes the same
+original A ZIP bytes through the real Native provider and joins its child; it
+uses an executable temporary mount only inside that separately owned verifier.
+This does not change production Lambda's noexec policy.
+
+Named snapshots include original ZIP bytes, revisions, publications, aliases and
+terminal workflow history when the provided runtime is configured. Image-only
+installations reject ZIP archives before startup ingress. Import validates the
+complete private ZIP candidate before acquiring Image leases and publishes only
+after final source/backend/deadline checks. Invalid metadata/code, unavailable
+immutable content, a missing provided runtime or expiry preserves both committed
+archive generations. No code volumes, containers, host extraction paths, warm
+counters or live invocations are restored; a process restart starts with a fresh
+runtime pool and does not replay function/workflow work.
+
+The managed Lambda archive payload is capped at128MiB, with a separate16MiB
+metadata limit. Original ZIP bytes are capped at50MiB per revision and64MiB total;
+repeated latest/published copies count separately even when their live artifacts
+share memory. The private restore candidate additionally caps expanded logical
+file bytes at512MiB and materialized nodes at20,000, including three artifact
+wrapper nodes per revision. Existing per-ZIP tree/expansion limits still apply.
+The256-function/1024-revision limits remain. These are fixed safety profiles:
+a deployment can be valid to invoke yet too large to save, in which case the
+previous committed generation remains usable. Metadata limits apply globally
+before an owned archive DTO is built; ZIP fields do not enlarge policy/layer or
+other metadata allowances.
+
+The provided base remains operator configuration, outside saved function code.
+Restart requires a qualified immutable base for the saved ZIP architecture.
+Changing that base deliberately changes the runtime environment while preserving
+the original ZIP hash/size; archive metadata cannot select a base, registry,
+network or credentials. Image archives continue requiring their exact saved
+local image identities. `make test-lambda-zip-archive` runs the pure profile,
+projection, codec, staging, candidate and clock controls;
+`make test-lambda-provided-archive-docker` runs both ordinary archive resources
+after fixture provisioning and the exact compiled manifest check.
+
+Image callbacks and managed Pulumi IaC are functionally qualified on the retained
+lanes. Server-in-container and the actual root release image are separately
+qualified through D98/D99. Required arm64/reference/platform and complete release
+acceptance remain separate under D100. The implementation ledger records final functional
+qualification; the native-workflow verifier alone does not certify these Docker
+archive resources.
+See the [ordinary ZIP contract](../specs/rustack-workflows-20-lambda-runtime-design.md#68-ordinary-provided-runtime-installation-and-environment-consumption-d92)
+and [managed archive contract](../specs/rustack-workflows-20-lambda-runtime-design.md#69-bounded-provided-runtime-zip-archives-and-mixed-candidate-restoration-d93)
+and [verification status](../specs/rustack-workflows-93-review.md#d93-final-actual-qualification-and-exact-postconditions).
+
+The management IO cases hold actual Create/Tag acknowledgments and owned DELETE
+requests. Deleting a Pending deployment cannot release its quota while critical
+image mutation/retirement remains owned. Admission transfers only when a live
+artifact is consumed or its exact deployment commits. Whole transport loss can
+revoke backend readiness and reject Invoke while diagnostics remain reachable;
+restoring the test transport does not revive a failed owner. The test keeps that
+transport alive through joined server cleanup, preserving any specific shutdown
+failure. `make test-lambda-io-faults` runs the proxy's framing/lifecycle controls;
+`test-lambda-io-faults-docker` runs the full ordinary startup/fault suite.
+
+Additional cases keep the signed caller connected through actual Create/DELETE
+acknowledgment expiration. Cleanup preserves the original handler exit failure.
+The gate explicitly provisions the preserved immutable public Node baseline before
+ordinary resources; `make lambda-pull-fixture-image` runs this bounded prerequisite
+separately. An interrupted `ifMissing` pull preserves the old active revision while the fixture
+retains and positively drains the real daemon stream. This explicitly connected
+resource uses the pinned public Node source through its HTTPS port443 reference;
+it refuses a preexisting extra cache reference and removes only its own verified
+reference, preserving the original cache. `make lambda-negative-images` provisions
+two genuinely incompatible platform artifacts and a separate Linux process that
+never speaks Runtime API. They qualify preparation rejection and bootstrap timeout,
+respectively. `make test-lambda-deadline-fixture` runs the bounded protocol, archive
+and cleanup-receipt controls without executing Docker resources.
+
+The additional Runtime HTTP resource sends unsupported methods, oversized header
+values and declared bodies, a GET body and chunked trailers from a real consumed
+custom RIC attempt, then requires the correct result and warm reuse. Separate
+execution-capacity resources require actual8/32 permit ownership before429.
+Physical-resource cases independently bind memory256MiB versus one environment,
+and hold function then relay deletion to prove charges remain until full retirement.
+
+## Enable trusted-host Lambda tasks
+
+Build with the Lambda feature and select the backend explicitly. Override the
+pure example's service/executor selection and require Lambda signature validation:
+
+```bash
+env -u AWS_ACCESS_KEY_ID -u AWS_SECRET_ACCESS_KEY -u AWS_SESSION_TOKEN \
+  RUSTACK_CONFIG=examples/workflows/rustack.yaml \
+  SERVICES=lambda,stepfunctions LAMBDA_EXECUTOR=native \
+  LAMBDA_SKIP_SIGNATURE_VALIDATION=false \
+  cargo run --locked -p rustack-cli --bin rustack \
+    --no-default-features --features lambda,stepfunctions
+```
+
+Deploy a compatible ZIP/bootstrap through the Lambda API before starting a Task.
+Native runs trusted host code, with a bootstrap matching the host OS and CPU; a
+Linux deployment binary is not a macOS executable. Use the real fixture gates for
+a reproducible computed result, failures, cancellation and SDK callbacks:
+
+```bash
+make test-stepfunctions-bridge-native
+make test-stepfunctions-sdk
+```
+
+Direct function ARN Tasks return the function payload. The optimized
+`arn:aws:states:::lambda:invoke` integration returns its Lambda envelope and
+treats FunctionError as Task failure. `.waitForTaskToken` requires the installed
+Lambda/callback service; SendTaskSuccess/Failure/Heartbeat act on secret tokens.
+Nested `states:startExecution`, `.sync` and `.sync:2` are supported; waiting
+parents release dispatch capacity. The [integration contract](../specs/rustack-workflows-40-integrations-design.md)
+describes result shapes, scope/depth limits and cancellation ownership. Pure mode
+rejects Lambda and callback definitions instead of inventing an execution port.
+
+## Supported profile and limits
+
+| Area | Installed behavior |
+|---|---|
+| Workflow type/query language | STANDARD and the documented JSONPath subset |
+| States | Pass, Task, Choice, Wait, Succeed, Fail, Parallel, Inline Map |
+| Data/recovery | InputPath/Parameters/ResultSelector/ResultPath/OutputPath, ordered Retry/Catch, bounded jitter/backoff and Task/execution deadlines |
+| Intrinsics | Format, StringToJson, JsonToString, Array, ArrayLength, ArrayGetItem, ArrayContains, ArrayPartition, StringSplit, MathAdd, UUID, shallow JsonMerge |
+| Lifecycle | CRUD/list/describe/tag definitions, empty unpublished-version inventory, Start/Stop/list/describe executions, captured-definition describe, execution history, Validate, installed callback APIs |
+| Static ceilings | 1MiB definitions, 256KiB state payloads, 25000 events, Inline Map concurrency≤40 |
+| Local budgets | Validated YAML `budgets.workflow*`; transition/history/frame/result/admission limits may terminate or reject work explicitly |
+
+EXPRESS, JSONata/variables, Activities, Distributed Map/MapRun, redrive, arbitrary
+AWS SDK integrations, published state-machine version/alias use and mutation, enabled
+CloudWatch logging/tracing and customer-managed encryption are outside this
+profile. Unknown fields/resources or unavailable integration profiles reject
+explicitly. Do not infer implementation from the generated 37-operation model.
+See the [API](../specs/rustack-workflows-10-api-design.md),
+[ASL](../specs/rustack-workflows-30-asl-design.md) and
+[configuration](../specs/rustack-workflows-60-operations-design.md#12-tunable-budgets)
+contracts for exact grammar and ranges.
+
+The observed AWS intrinsic profile accepts objects/lists in `States.Format`,
+using `{key=value}` / `[value, value]` text with bounded recursive rendering.
+Ordinary intrinsic string arguments accept literal braces; Format templates
+still validate placeholders and escaping. `States.StringToJson` maps empty or
+ASCII-JSON-whitespace-only text to null and rejects other malformed JSON. Missing
+Lambda targets produce scoped, qualified AWS-style causes with a fresh local
+service-error request ID. See [D114's exact contract](../specs/rustack-workflows-61-localstack-compatibility-design.md#7-authorized-observed-aws-compatibility-continuation-d114).
+
+Optimized `lambda:invoke` treats a string `Payload` as serialized JSON. Omitted
+or null `Payload` sends `{}`; supply the serialized spelling `"null"` to send a
+JSON null, or `"\"hello\""` to send a JSON string. Direct Lambda tasks preserve
+their ordinary JSON input. Task deadline errors retain `States.Timeout` without
+a manufactured Cause; overall TIMED_OUT responses omit error/cause fields.
+
+Definition updates affect new executions; existing ones keep their captured
+revision. A RUNNING execution accepts a replay only with the same name and exact
+original input. Closed names remain reserved for 90 days, even after shorter
+history retention expires. An HTTP observer timing out does not imply the
+accepted command or its physical cleanup was cancelled.
+
+## Snapshots and shutdown
+
+`--snapshot workflow-demo` loads before the listener opens and saves after a
+proven shutdown cut. The root defaults to `.rustack/snapshots`; set
+`RUSTACK_SNAPSHOT_DIR` to change it. One process owns a snapshot name at a time.
+Use Ctrl-C/SIGINT or SIGTERM and wait for process exit. Restart with the same
+configuration and snapshot name to read retained definitions, names, outcomes,
+captured revisions and full history.
+
+Shutdown stops intake, drains producers, gives workflows the configured grace
+interval, cancels/joins remaining execution work, then joins downstream Lambda
+and consumer work before saving. Live work stopped at this cut is archived
+terminal. Restore does not resume tasks, timers, callbacks or processes and does
+not replay Lambda side effects. Unexpected imported RUNNING records become
+ABORTED/Rustack.ExecutionInterrupted. Old page/callback handles are invalid after
+restart. SIGKILL can lose everything since the previous completed save: there is
+no WAL. Unrecoverable corruption and incompatible/quota-rejected imports refuse startup.
+Physical interrupted-publication recovery may select a previous valid generation;
+domain/policy failure preserves both generations rather than silently rolling back.
+
+Snapshot coverage is per service. Workflow resources/history and qualified Lambda
+metadata/code are persisted; SQS messages and arbitrary external effects are not.
+Image availability and cross-platform code execution remain separate requirements.
+
+## Run original LocalStack compatibility probes
+
+The opt-in probes execute pinned LocalStack pytest bodies and original AWS
+snapshots against an owned Rustack process. They preserve upstream handlers and
+assertions; they do not start LocalStack. Read the [study and evidence ledger](./research/study-localstack-workflow-tests.md)
+for the91-node pure and32-node real Docker inventories, original upstream masks,
+profile differences and failed runs. These counts are pytest nodes, not all AWS
+behaviors or a project completion percentage.
+
+```bash
+make workflows-localstack-python
+make check-workflows-localstack
+make test-workflows-localstack-pure \
+  WORKFLOWS_LOCALSTACK_EVIDENCE="$HOME/.target/localstack-pure-new"
+
+make workflows-localstack-images \
+  WORKFLOWS_LOCALSTACK_IMAGES="$HOME/.target/localstack-images-new" \
+  WORKFLOWS_LOCALSTACK_BUILDER=/absolute/path/to/docker-buildx \
+  WORKFLOWS_DOCKER_SOCKET=/absolute/path/to/docker.sock
+make test-workflows-localstack-docker \
+  WORKFLOWS_LOCALSTACK_EVIDENCE="$HOME/.target/localstack-docker-new" \
+  WORKFLOWS_LOCALSTACK_IMAGES="$HOME/.target/localstack-images-new" \
+  WORKFLOWS_DOCKER_SOCKET=/absolute/path/to/docker.sock \
+  LAMBDA_RUNTIME_IMAGE=rustack/lambda-runtime:integration-arm64
+```
+
+Use new absolute evidence directories with canonical parents, an explicitly
+selected native ARM64 Docker daemon and an existing qualified runtime relay.
+Image creation packages each original Python3.12 handler separately; it does not
+qualify managed ZIP deployment or ECR lifecycle APIs. Ambient AWS profiles and
+pytest selection/snapshot-update settings are rejected. Clients use unique local
+credentials and the owned loopback endpoint; there is no live AWS fallback.
+
+Every mismatch retains a nonzero exit and private observations, assertions,
+JUnit and cleanup receipts. D114 qualifies the unchanged inventories at91/91 and
+32/32 by implementing the observed AWS behavior. No new mask, xfail or case
+removal makes them green; these opt-in targets still require the explicit
+runtime/image prerequisites above. This covers the selected original nodes and
+their retained upstream exclusions, not the full upstream suite or full AWS parity.
+
+## Health, capabilities and qualification
+
+```bash
+curl --fail http://127.0.0.1:4566/_health/ready
+curl --fail http://127.0.0.1:4566/_rustack/capabilities
+```
+
+`workflows` reports installed state types, integration flags and effective limits,
+including `snapshot: "resources-and-history"`, `snapshotResume: false`,
+`paginationEpoch: "fresh-on-restart"` and `dockerQualified: false`. Without a
+selected Lambda port, `lambdaRequestResponse` and `callbacks` are false. Health
+reads worker status independently of business admission; business quota rejection
+does not by itself make a healthy service unready.
+
+With Lambda installed, `workers.lambdaAdmission` shows actual
+`acceptedInvocations` and `activeExecutions`, plus their limits128/32 and the
+default per-function limit8. Active work includes backend pool waiting and
+retained cleanup; it is not a count of running containers. The two counters are
+independently sampled. Qualified Docker also reports `workers.docker.capacity`
+with actual retained environment/memory/quarantine charges. These bounded views
+contain no function names or request data and remain readable at work saturation.
+
+```bash
+make test-workflows-manifest  # Exact compiled ignored-test inventory preflight.
+make verify-workflows-native  # Serial current-host workflow qualification.
+```
+
+The [reviewed inventory](../tests/workflows/required-suites.json) binds 26 resource
+tests across Native bridge, registered SDK and typed HTTP SDK suites. Missing,
+renamed, newly ignored or no-longer-ignored cases fail before resource execution.
+The native verifier also runs model/codegen, compiler/runtime, archive,
+persistence and performance checks. Full workspace build/Clippy/rustdoc and
+audit/deny remain repository gates. This command certifies its native-workflow
+scope; it does not certify the unfinished full image/platform release.
+
+Current macOS measurements and raw provenance are in the
+[performance review](./research/workflows-native-performance-review.md).
+The [direct Linux measurement review](./research/workflows-linux-performance-review.md)
+records the same signed SDK workloads inside a4-vCPU/8GiB native ARM VZ guest,
+with p95=10.791ms, exact histories and joined process cleanup. To provision a new
+dedicated test VM without activating its Docker context, then run the measurements:
+
+```bash
+make workflows-performance-linux-provision  # Refuses an existing profile.
+make test-workflows-performance-linux       # Reuses the retained ARM guest.
+```
+
+The default profile is `rustack-workflows-performance-arm64`; select an explicit
+profile with `WORKFLOWS_LINUX_PROFILE`. Both source and target mounts are read-only.
+The VM remains running after the test. Four virtual CPUs do not prove four
+dedicated physical CPUs: `referenceQualification` remains `pending`.
+Required dedicated-reference Linux performance
+and final platform lanes remain open in the
+[implementation plan](../specs/rustack-workflows-90-impl-plan.md).
diff --git a/examples/workflows/pure.asl.json b/examples/workflows/pure.asl.json
new file mode 100644
index 00000000..5ee13e42
--- /dev/null
+++ b/examples/workflows/pure.asl.json
@@ -0,0 +1,25 @@
+{
+  "Comment": "Pure local workflow: double a number, choose, wait, and finish.",
+  "StartAt": "Compute",
+  "States": {
+    "Compute": {
+      "Type": "Pass",
+      "Parameters": { "doubled.$": "States.MathAdd($.n, $.n)" },
+      "Next": "Positive"
+    },
+    "Positive": {
+      "Type": "Choice",
+      "Choices": [
+        { "Variable": "$.doubled", "NumericGreaterThan": 0, "Next": "Pause" }
+      ],
+      "Default": "Reject"
+    },
+    "Pause": { "Type": "Wait", "Seconds": 0, "Next": "Done" },
+    "Done": { "Type": "Succeed" },
+    "Reject": {
+      "Type": "Fail",
+      "Error": "Example.NotPositive",
+      "Cause": "The doubled value must be positive."
+    }
+  }
+}
diff --git a/examples/workflows/rustack.yaml b/examples/workflows/rustack.yaml
new file mode 100644
index 00000000..ea92b897
--- /dev/null
+++ b/examples/workflows/rustack.yaml
@@ -0,0 +1,19 @@
+# Dummy local credentials; never put real AWS credentials in this example.
+environment:
+  GATEWAY_LISTEN: "127.0.0.1:4566"
+  SERVICES: "stepfunctions"
+  LAMBDA_EXECUTOR: "disabled"
+  DEFAULT_REGION: "us-east-1"
+  DEFAULT_ACCOUNT_ID: "000000000000"
+  STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION: false
+  ACCESS_KEY: "local-key"
+  SECRET_KEY: "local-secret"
+budgets:
+  workflowOpenExecutions: 32
+  workflowEvaluations: 4
+  workflowDispatches: 8
+  workflowTransitions: 100000
+  workflowHistoryBytes: 33554432
+  workflowTotalHistoryBytes: 268435456
+  workflowSnapshotBytes: 536870912
+  workflowDrainSeconds: 5
diff --git a/patches/squib-loader/.cargo_vcs_info.json b/patches/squib-loader/.cargo_vcs_info.json
new file mode 100644
index 00000000..857239cd
--- /dev/null
+++ b/patches/squib-loader/.cargo_vcs_info.json
@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "69ad91905b8fbf0c0e87c344d530a6c8dffa6084"
+  },
+  "path_in_vcs": "crates/loader"
+}
\ No newline at end of file
diff --git a/patches/squib-loader/Cargo.toml b/patches/squib-loader/Cargo.toml
new file mode 100644
index 00000000..1fc16421
--- /dev/null
+++ b/patches/squib-loader/Cargo.toml
@@ -0,0 +1,71 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2024"
+rust-version = "1.95"
+name = "squib-loader"
+version = "0.2.0"
+authors = ["Tyr Chen <tyr.chen@gmail.com>"]
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "aarch64 kernel image loader (PE / Image / Image.gz / Image.zst) for squib"
+homepage = "https://github.com/tyrchen/squib"
+documentation = "https://docs.rs/squib-core"
+readme = false
+keywords = [
+    "kernel",
+    "loader",
+    "aarch64",
+    "linux",
+]
+categories = ["virtualization"]
+license = "Apache-2.0"
+repository = "https://github.com/tyrchen/squib"
+
+[lib]
+name = "squib_loader"
+path = "src/lib.rs"
+
+[dependencies.flate2]
+version = "1"
+
+[dependencies.squib-arch]
+version = "0.2.0"
+
+[dependencies.squib-core]
+version = "0.2.0"
+
+[dependencies.thiserror]
+version = "2.0.18"
+
+[dependencies.zstd]
+version = "0.14.3"
+
+[lints.clippy]
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+module_name_repetitions = "allow"
+must_use_candidate = "allow"
+
+[lints.clippy.pedantic]
+level = "warn"
+priority = -1
+
+[lints.rust]
+missing_debug_implementations = "warn"
+rust_2024_compatibility = "warn"
+unreachable_pub = "warn"
+unused_qualifications = "warn"
diff --git a/patches/squib-loader/Cargo.toml.orig b/patches/squib-loader/Cargo.toml.orig
new file mode 100644
index 00000000..ba7b210f
--- /dev/null
+++ b/patches/squib-loader/Cargo.toml.orig
@@ -0,0 +1,23 @@
+[package]
+name = "squib-loader"
+description = "aarch64 kernel image loader (PE / Image / Image.gz / Image.zst) for squib"
+categories = ["virtualization"]
+keywords = ["kernel", "loader", "aarch64", "linux"]
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+license.workspace = true
+documentation.workspace = true
+repository.workspace = true
+homepage.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+flate2 = { workspace = true }
+squib-arch = { workspace = true }
+squib-core = { workspace = true }
+thiserror = { workspace = true }
+zstd = { workspace = true }
diff --git a/patches/squib-loader/Cargo.toml.registry b/patches/squib-loader/Cargo.toml.registry
new file mode 100644
index 00000000..5af66001
--- /dev/null
+++ b/patches/squib-loader/Cargo.toml.registry
@@ -0,0 +1,71 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2024"
+rust-version = "1.95"
+name = "squib-loader"
+version = "0.2.0"
+authors = ["Tyr Chen <tyr.chen@gmail.com>"]
+build = false
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "aarch64 kernel image loader (PE / Image / Image.gz / Image.zst) for squib"
+homepage = "https://github.com/tyrchen/squib"
+documentation = "https://docs.rs/squib-core"
+readme = false
+keywords = [
+    "kernel",
+    "loader",
+    "aarch64",
+    "linux",
+]
+categories = ["virtualization"]
+license = "Apache-2.0"
+repository = "https://github.com/tyrchen/squib"
+
+[lib]
+name = "squib_loader"
+path = "src/lib.rs"
+
+[dependencies.flate2]
+version = "1"
+
+[dependencies.squib-arch]
+version = "0.2.0"
+
+[dependencies.squib-core]
+version = "0.2.0"
+
+[dependencies.thiserror]
+version = "2.0.18"
+
+[dependencies.zstd]
+version = "0.13"
+
+[lints.clippy]
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+module_name_repetitions = "allow"
+must_use_candidate = "allow"
+
+[lints.clippy.pedantic]
+level = "warn"
+priority = -1
+
+[lints.rust]
+missing_debug_implementations = "warn"
+rust_2024_compatibility = "warn"
+unreachable_pub = "warn"
+unused_qualifications = "warn"
diff --git a/patches/squib-loader/LICENSE.md b/patches/squib-loader/LICENSE.md
new file mode 100644
index 00000000..fe033781
--- /dev/null
+++ b/patches/squib-loader/LICENSE.md
@@ -0,0 +1,7 @@
+Copyright <2025> <Tyr Chen>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/patches/squib-loader/provenance.json b/patches/squib-loader/provenance.json
new file mode 100644
index 00000000..774a532f
--- /dev/null
+++ b/patches/squib-loader/provenance.json
@@ -0,0 +1,24 @@
+{
+  "schemaVersion": 1,
+  "package": "squib-loader",
+  "version": "0.2.0",
+  "registryChecksum": "5bd137eb148a011bc2debae200a3c428d5e6c0934c242c64e1c89c374af1a69c",
+  "upstreamCommit": "69ad91905b8fbf0c0e87c344d530a6c8dffa6084",
+  "upstreamRepository": "https://github.com/tyrchen/squib",
+  "dependencyChange": {
+    "zstd": {
+      "from": "0.13",
+      "to": "0.14.3"
+    }
+  },
+  "publishedLicense": "Apache-2.0",
+  "upstreamNotice": "https://github.com/tyrchen/squib/blob/69ad91905b8fbf0c0e87c344d530a6c8dffa6084/LICENSE.md",
+  "noticePolicy": "Preserve the upstream MIT notice separately from unchanged published SPDX metadata.",
+  "sha256": {
+    "src/lib.rs": "2e45625122a3c28bbc66961a4a8b6159fb5bb43c5f5ccd2c3b11e3882bceff0d",
+    "Cargo.toml.registry": "1a1220a9bc9e1be88d54f5c57d42e8862d32e388c457ef1512bd2cb46363555b",
+    "Cargo.toml.orig": "5d8ae47853e907f9551d8e3ac66fc20243d6ec9f44b532a45631e590935ac7df",
+    ".cargo_vcs_info.json": "791431ffe0e76481f4934c01035a9680193b624ac00e954f7e233321112af889",
+    "LICENSE.md": "9276b15bf68cefab4696c3c286883f44ec327ac50b4a2690f80d0c09b5108450"
+  }
+}
diff --git a/patches/squib-loader/src/lib.rs b/patches/squib-loader/src/lib.rs
new file mode 100644
index 00000000..02df4877
--- /dev/null
+++ b/patches/squib-loader/src/lib.rs
@@ -0,0 +1,582 @@
+//! aarch64 kernel image loader.
+//!
+//! Detects compression by magic bytes, decompresses if needed, parses the aarch64 boot
+//! header to recover `text_offset` and `image_size`, and returns a [`LoadedKernel`] ready
+//! to be copied into guest RAM.
+//!
+//! Loading happens at config time (when the operator posts `/boot-source`), not at
+//! `InstanceStart`, so a malformed kernel image returns a 4xx synchronously rather than
+//! detonating in the boot orchestrator.
+//!
+//! ## Trust boundary
+//!
+//! Per [70-security.md § 4](../../../specs/70-security.md#4-input-validation), every
+//! external string crossing into squib goes through a fallible-constructor newtype before
+//! reaching downstream code. For host-filesystem paths the canonical newtype is
+//! `squib_api::schemas::common::SafePath`: byte-length cap of 1024, NUL-byte rejection,
+//! charset / parent-traversal handled at the API layer.
+//!
+//! The loader sits below the API layer and accepts a `&Path` for `load_from_path`. To
+//! make the trust boundary load-bearing rather than aspirational, this crate also runs a
+//! **defence-in-depth** check on the path before opening it (`enforce_path_bounds`):
+//! length cap of 1024 bytes, NUL-byte rejection. A buggy caller that bypasses the API
+//! layer surfaces a [`LoaderError::PathRejected`] instead of letting a megabyte path or
+//! an interior-NUL path reach `std::fs::metadata`.
+//!
+//! See [13-arch-and-boot.md § 7](../../../specs/13-arch-and-boot.md#7-kernel-loader) and
+//! `arm64/booting.rst` for the boot-header contract.
+
+#![forbid(unsafe_code)]
+#![warn(missing_docs)]
+// Kernel images are loaded once at config-time before vCPUs run; using sync std::fs is
+// fine here and keeps the loader trivially testable. The clippy disallowed-method ban on
+// `std::fs::*` exists for *runtime* code that should yield to the tokio scheduler — this
+// crate's I/O is the synchronous moral equivalent of `getopts`.
+#![allow(clippy::disallowed_methods)]
+// Hardware identifiers (`text_offset`, `image_size`, `ARM\x64`, etc.) appear in doc text
+// in their canonical underscore form; backticking each one bloats the documentation.
+#![allow(clippy::doc_markdown)]
+// `1 * 1024 * 1024` is a documented constant, not an identity simplification.
+#![allow(clippy::identity_op)]
+
+use std::{
+    io::{Cursor, Read},
+    path::Path,
+};
+
+use squib_arch::layout::{DRAM_BASE, DRAM_MAX_END, KERNEL_LOAD_OFFSET};
+use thiserror::Error;
+
+/// `MZ` — DOS / PE magic.
+pub const MAGIC_PE: [u8; 2] = *b"MZ";
+/// `1f 8b` — gzip magic.
+pub const MAGIC_GZ: [u8; 2] = [0x1F, 0x8B];
+/// `28 b5 2f fd` — zstd magic.
+pub const MAGIC_ZST: [u8; 4] = [0x28, 0xB5, 0x2F, 0xFD];
+/// `ARM\x64` — aarch64 Image magic at offset 0x38.
+pub const MAGIC_AARCH64_IMAGE: [u8; 4] = *b"ARM\x64";
+
+/// Offset of the aarch64 magic field within the kernel image.
+pub const AARCH64_MAGIC_OFFSET: usize = 0x38;
+
+/// Minimum size for any kernel image we accept (the boot header alone is 64 bytes).
+pub const MIN_IMAGE_SIZE: usize = 64;
+
+/// Hard upper bound on the *compressed* input size, in bytes.
+///
+/// Accepting unbounded compressed input is a decompression-bomb vector. 1 GiB is
+/// generously larger than any realistic Linux kernel image (typical aarch64 vmlinux is
+/// ≤ 32 MiB). Operators with a legitimate need can raise this via the `MaxSizes`
+/// builder; the default bounds make the decompression bomb a non-issue.
+pub const DEFAULT_MAX_COMPRESSED: u64 = 1024 * 1024 * 1024;
+
+/// Hard upper bound on the *decompressed* image size, in bytes.
+pub const DEFAULT_MAX_DECOMPRESSED: u64 = 4 * 1024 * 1024 * 1024;
+
+/// Errors that can surface while loading and parsing a kernel image.
+#[derive(Debug, Error)]
+pub enum LoaderError {
+    /// Reading the image file failed.
+    #[error("kernel image I/O error")]
+    Io(#[from] std::io::Error),
+
+    /// Image is too small to contain an aarch64 boot header.
+    #[error("kernel image is too small ({size} bytes; need ≥ {MIN_IMAGE_SIZE})")]
+    ImageTooSmall {
+        /// Actual image size in bytes.
+        size: usize,
+    },
+
+    /// Image format could not be identified by magic bytes.
+    #[error("unknown kernel image format (no recognised magic)")]
+    UnknownFormat,
+
+    /// aarch64 boot magic missing at offset 0x38 of the (possibly decompressed) image.
+    #[error("missing aarch64 'ARM\\x64' magic at offset {AARCH64_MAGIC_OFFSET:#x}")]
+    MissingAarch64Magic,
+
+    /// Compressed input exceeds the configured cap.
+    #[error("compressed kernel image is too large ({size} bytes; cap {cap})")]
+    CompressedTooLarge {
+        /// Actual size of the compressed input.
+        size: u64,
+        /// Cap that was exceeded.
+        cap: u64,
+    },
+
+    /// Decompressed kernel exceeds the configured cap (decompression-bomb guard).
+    #[error("decompressed kernel image is too large ({size} bytes; cap {cap})")]
+    DecompressedTooLarge {
+        /// Number of bytes read before the cap fired.
+        size: u64,
+        /// Cap that was exceeded.
+        cap: u64,
+    },
+
+    /// Kernel image would not fit in the guest's RAM region.
+    #[error(
+        "kernel image (size {image_size}) would not fit in guest RAM (start {load_addr:#x}, \
+         ram_end {ram_end:#x})"
+    )]
+    DoesNotFitInRam {
+        /// Computed load address.
+        load_addr: u64,
+        /// `image_size` from the boot header.
+        image_size: u64,
+        /// Configured guest RAM end (exclusive).
+        ram_end: u64,
+    },
+
+    /// `text_offset` from the boot header overflows when added to `DRAM_BASE`.
+    #[error("invalid text_offset {text_offset:#x}: would overflow DRAM_BASE")]
+    InvalidTextOffset {
+        /// Offset that overflowed.
+        text_offset: u64,
+    },
+
+    /// Path failed defence-in-depth boundary checks before any I/O ran.
+    #[error("kernel image path rejected at boundary: {0}")]
+    PathRejected(&'static str),
+}
+
+/// Length cap on a host-filesystem path the loader will open.
+///
+/// Mirrors `squib_api::schemas::common::SafePath::PATH_MAX` so a value that passed the
+/// API-layer boundary always passes the loader-layer boundary and a value that bypassed
+/// the API layer (a buggy direct caller) still gets rejected with [`LoaderError::PathRejected`].
+pub const PATH_MAX: usize = 1024;
+
+/// Defence-in-depth path validation, run before any `std::fs` call.
+///
+/// The canonical boundary is the API layer's `SafePath` newtype — but a buggy direct
+/// caller of [`load_from_path`] could in theory pass an unvalidated path. This function
+/// runs the same byte-cap and NUL-byte rejection that `SafePath::new` runs so the loader
+/// is correct in isolation. Returns a `'static` reason string suitable for embedding in
+/// [`LoaderError::PathRejected`] without leaking the path itself into error text.
+fn enforce_path_bounds(path: &Path) -> Result<(), LoaderError> {
+    let s = path
+        .to_str()
+        .ok_or(LoaderError::PathRejected("path is not valid UTF-8"))?;
+    if s.is_empty() {
+        return Err(LoaderError::PathRejected("path must not be empty"));
+    }
+    if s.len() > PATH_MAX {
+        return Err(LoaderError::PathRejected("path exceeds PATH_MAX bytes"));
+    }
+    if s.as_bytes().contains(&0) {
+        return Err(LoaderError::PathRejected("path contains a NUL byte"));
+    }
+    Ok(())
+}
+
+/// Recognized kernel image format.
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Hash)]
+pub enum ImageFormat {
+    /// Raw aarch64 `Image` (no PE wrapper, no compression).
+    Aarch64Image,
+    /// Linux EFI PE-wrapped image (`MZ` magic at offset 0; aarch64 header present at 0x38).
+    Pe,
+    /// gzip-compressed payload.
+    Gzip,
+    /// zstd-compressed payload.
+    Zstd,
+}
+
+/// Caps for the decompression / loading paths.
+#[derive(Debug, Clone, Copy)]
+pub struct MaxSizes {
+    /// Maximum compressed size accepted on disk.
+    pub compressed: u64,
+    /// Maximum decompressed size produced by `flate2` / `zstd`.
+    pub decompressed: u64,
+}
+
+impl Default for MaxSizes {
+    fn default() -> Self {
+        Self {
+            compressed: DEFAULT_MAX_COMPRESSED,
+            decompressed: DEFAULT_MAX_DECOMPRESSED,
+        }
+    }
+}
+
+/// A loaded, decompressed, and validated aarch64 kernel image.
+#[derive(Debug, Clone)]
+pub struct LoadedKernel {
+    /// Decompressed image bytes (i.e. ready to write into guest RAM).
+    pub bytes: Vec<u8>,
+    /// Format detected at the input.
+    pub format: ImageFormat,
+    /// `text_offset` from the boot header — load offset from `DRAM_BASE`.
+    pub text_offset: u64,
+    /// `image_size` from the boot header (`0` means "use the bytes length").
+    pub image_size: u64,
+}
+
+impl LoadedKernel {
+    /// Compute the guest-physical load address for this kernel.
+    ///
+    /// Per [13-arch-and-boot.md § 7](../../../specs/13-arch-and-boot.md#7-kernel-loader),
+    /// the Image goes at `DRAM_BASE + text_offset`. Firecracker reserves the first 2 MiB
+    /// for system metadata (`KERNEL_LOAD_OFFSET`); we honour that floor so a kernel with a
+    /// tiny `text_offset` (some 5.x kernels still ship `text_offset = 0x80000`) does not
+    /// land underneath the reserved system band.
+    ///
+    /// # Errors
+    /// [`LoaderError::InvalidTextOffset`] if `DRAM_BASE + text_offset` would overflow.
+    pub fn load_address(&self) -> Result<u64, LoaderError> {
+        let raw =
+            DRAM_BASE
+                .checked_add(self.text_offset)
+                .ok_or(LoaderError::InvalidTextOffset {
+                    text_offset: self.text_offset,
+                })?;
+        Ok(raw.max(DRAM_BASE + KERNEL_LOAD_OFFSET))
+    }
+
+    /// The number of bytes that must fit in guest RAM starting at [`Self::load_address`].
+    /// Equals `image_size` from the header when non-zero, otherwise the raw payload size.
+    #[must_use]
+    pub fn image_bytes(&self) -> u64 {
+        if self.image_size == 0 {
+            self.bytes.len() as u64
+        } else {
+            self.image_size
+        }
+    }
+    // Note: `bytes.len() as u64` always fits because Vec is bounded by isize::MAX.
+
+    /// Validate that the kernel fits in a guest RAM region of length `ram_size_bytes`.
+    ///
+    /// # Errors
+    /// [`LoaderError::DoesNotFitInRam`] when `load_address + image_bytes() > ram_end`.
+    pub fn check_fits_in_ram(&self, ram_size_bytes: u64) -> Result<u64, LoaderError> {
+        let load_addr = self.load_address()?;
+        let ram_end = DRAM_BASE
+            .checked_add(ram_size_bytes)
+            .filter(|end| *end <= DRAM_MAX_END)
+            .ok_or(LoaderError::DoesNotFitInRam {
+                load_addr,
+                image_size: self.image_bytes(),
+                ram_end: DRAM_MAX_END,
+            })?;
+        let needed = self.image_bytes();
+        let end = load_addr
+            .checked_add(needed)
+            .ok_or(LoaderError::DoesNotFitInRam {
+                load_addr,
+                image_size: needed,
+                ram_end,
+            })?;
+        if end > ram_end {
+            return Err(LoaderError::DoesNotFitInRam {
+                load_addr,
+                image_size: needed,
+                ram_end,
+            });
+        }
+        Ok(load_addr)
+    }
+}
+
+/// Detect the image format from the input's first bytes.
+#[must_use]
+pub fn detect_format(bytes: &[u8]) -> Option<ImageFormat> {
+    if bytes.len() >= 4 && bytes[..4] == MAGIC_ZST {
+        return Some(ImageFormat::Zstd);
+    }
+    if bytes.len() >= 2 {
+        if bytes[..2] == MAGIC_GZ {
+            return Some(ImageFormat::Gzip);
+        }
+        if bytes[..2] == MAGIC_PE {
+            return Some(ImageFormat::Pe);
+        }
+    }
+    if has_aarch64_magic(bytes) {
+        return Some(ImageFormat::Aarch64Image);
+    }
+    None
+}
+
+fn has_aarch64_magic(bytes: &[u8]) -> bool {
+    bytes
+        .get(AARCH64_MAGIC_OFFSET..AARCH64_MAGIC_OFFSET + 4)
+        .is_some_and(|window| window == MAGIC_AARCH64_IMAGE)
+}
+
+/// Load and parse an aarch64 kernel image from disk.
+///
+/// # Errors
+/// Surfaces [`LoaderError`] for I/O, format, or size violations.
+pub fn load_from_path(path: &Path) -> Result<LoadedKernel, LoaderError> {
+    load_from_path_with_caps(path, MaxSizes::default())
+}
+
+/// [`load_from_path`] with explicit decompression caps.
+///
+/// # Errors
+/// Surfaces [`LoaderError`] on any of the documented failure modes, plus
+/// [`LoaderError::PathRejected`] when the path fails the loader's defence-in-depth
+/// boundary check (see crate-level "Trust boundary" docs).
+pub fn load_from_path_with_caps(path: &Path, caps: MaxSizes) -> Result<LoadedKernel, LoaderError> {
+    enforce_path_bounds(path)?;
+    let metadata = std::fs::metadata(path)?;
+    if metadata.len() > caps.compressed {
+        return Err(LoaderError::CompressedTooLarge {
+            size: metadata.len(),
+            cap: caps.compressed,
+        });
+    }
+    let bytes = std::fs::read(path)?;
+    load_from_bytes_with_caps(&bytes, caps)
+}
+
+/// Load and parse an aarch64 kernel image from an in-memory byte slice.
+///
+/// # Errors
+/// Surfaces [`LoaderError`] on any of the documented failure modes.
+pub fn load_from_bytes(bytes: &[u8]) -> Result<LoadedKernel, LoaderError> {
+    load_from_bytes_with_caps(bytes, MaxSizes::default())
+}
+
+/// [`load_from_bytes`] with explicit decompression caps.
+///
+/// # Errors
+/// Surfaces [`LoaderError`] on any of the documented failure modes.
+pub fn load_from_bytes_with_caps(
+    bytes: &[u8],
+    caps: MaxSizes,
+) -> Result<LoadedKernel, LoaderError> {
+    let bytes_len = bytes.len() as u64;
+    if bytes_len > caps.compressed {
+        return Err(LoaderError::CompressedTooLarge {
+            size: bytes_len,
+            cap: caps.compressed,
+        });
+    }
+    let format = detect_format(bytes).ok_or(LoaderError::UnknownFormat)?;
+    let payload = match format {
+        ImageFormat::Aarch64Image | ImageFormat::Pe => bytes.to_vec(),
+        ImageFormat::Gzip => decompress_gzip(bytes, caps.decompressed)?,
+        ImageFormat::Zstd => decompress_zstd(bytes, caps.decompressed)?,
+    };
+
+    if payload.len() < MIN_IMAGE_SIZE {
+        return Err(LoaderError::ImageTooSmall {
+            size: payload.len(),
+        });
+    }
+    if !has_aarch64_magic(&payload) {
+        return Err(LoaderError::MissingAarch64Magic);
+    }
+
+    let text_offset = read_le_u64_at(&payload, 8)?;
+    let image_size = read_le_u64_at(&payload, 16)?;
+
+    Ok(LoadedKernel {
+        bytes: payload,
+        format,
+        text_offset,
+        image_size,
+    })
+}
+
+fn decompress_gzip(bytes: &[u8], cap: u64) -> Result<Vec<u8>, LoaderError> {
+    let cursor = Cursor::new(bytes);
+    let mut decoder = flate2::read::GzDecoder::new(cursor);
+    bounded_read_to_end(&mut decoder, cap)
+}
+
+fn decompress_zstd(bytes: &[u8], cap: u64) -> Result<Vec<u8>, LoaderError> {
+    let mut decoder = zstd::stream::read::Decoder::new(Cursor::new(bytes))?;
+    bounded_read_to_end(&mut decoder, cap)
+}
+
+fn bounded_read_to_end<R: Read>(reader: &mut R, cap: u64) -> Result<Vec<u8>, LoaderError> {
+    // We refuse to allocate the whole cap upfront — bound the chunk and stop the moment
+    // we tip over.
+    let mut out = Vec::with_capacity(64 * 1024);
+    // Boxed to keep the stack frame small (clippy::large_stack_arrays).
+    let mut buf = vec![0u8; 64 * 1024];
+    loop {
+        let n = reader.read(&mut buf)?;
+        if n == 0 {
+            return Ok(out);
+        }
+        let next_total = out.len() as u64 + n as u64;
+        if next_total > cap {
+            return Err(LoaderError::DecompressedTooLarge {
+                size: next_total,
+                cap,
+            });
+        }
+        out.extend_from_slice(&buf[..n]);
+    }
+}
+
+fn read_le_u64_at(bytes: &[u8], offset: usize) -> Result<u64, LoaderError> {
+    let slice = bytes
+        .get(offset..offset + 8)
+        .ok_or(LoaderError::ImageTooSmall { size: bytes.len() })?;
+    let mut le = [0u8; 8];
+    le.copy_from_slice(slice);
+    Ok(u64::from_le_bytes(le))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Build a minimal aarch64 boot header with the supplied text_offset / image_size.
+    fn synth_image(text_offset: u64, image_size: u64, payload_len: usize) -> Vec<u8> {
+        let mut img = vec![0u8; payload_len.max(MIN_IMAGE_SIZE + 16)];
+        img[8..16].copy_from_slice(&text_offset.to_le_bytes());
+        img[16..24].copy_from_slice(&image_size.to_le_bytes());
+        img[AARCH64_MAGIC_OFFSET..AARCH64_MAGIC_OFFSET + 4].copy_from_slice(&MAGIC_AARCH64_IMAGE);
+        img
+    }
+
+    #[test]
+    fn detects_aarch64_image_by_offset_0x38_magic() {
+        let img = synth_image(0x80000, 0, 256);
+        assert_eq!(detect_format(&img), Some(ImageFormat::Aarch64Image));
+    }
+
+    #[test]
+    fn detects_pe_when_mz_at_offset_zero() {
+        let mut img = synth_image(0x80000, 0, 256);
+        img[..2].copy_from_slice(&MAGIC_PE);
+        assert_eq!(detect_format(&img), Some(ImageFormat::Pe));
+    }
+
+    #[test]
+    fn detects_gzip_and_zstd_by_magic() {
+        let mut g = vec![MAGIC_GZ[0], MAGIC_GZ[1]];
+        g.extend_from_slice(&[0u8; 100]);
+        assert_eq!(detect_format(&g), Some(ImageFormat::Gzip));
+
+        let mut z = vec![MAGIC_ZST[0], MAGIC_ZST[1], MAGIC_ZST[2], MAGIC_ZST[3], 0, 0];
+        z.extend_from_slice(&[0u8; 100]);
+        assert_eq!(detect_format(&z), Some(ImageFormat::Zstd));
+    }
+
+    #[test]
+    fn rejects_unknown_format() {
+        let bytes = vec![0xFFu8; 256];
+        assert!(matches!(
+            load_from_bytes(&bytes),
+            Err(LoaderError::UnknownFormat)
+        ));
+    }
+
+    #[test]
+    fn rejects_too_small_image() {
+        let bytes = vec![0u8; 32];
+        // No magic anywhere in 32 bytes — UnknownFormat is the right error before
+        // ImageTooSmall.
+        let err = load_from_bytes(&bytes).unwrap_err();
+        assert!(matches!(err, LoaderError::UnknownFormat));
+    }
+
+    #[test]
+    fn parses_text_offset_and_image_size() {
+        let img = synth_image(0x80_0000, 0x100_0000, 0x100_0000);
+        let loaded = load_from_bytes(&img).unwrap();
+        assert_eq!(loaded.format, ImageFormat::Aarch64Image);
+        assert_eq!(loaded.text_offset, 0x80_0000);
+        assert_eq!(loaded.image_size, 0x100_0000);
+    }
+
+    #[test]
+    fn load_address_floors_at_kernel_load_offset() {
+        // text_offset is small; floor at DRAM_BASE + 2 MiB.
+        let img = synth_image(0x80000, 0, 0x100_0000);
+        let loaded = load_from_bytes(&img).unwrap();
+        let addr = loaded.load_address().unwrap();
+        assert_eq!(addr, DRAM_BASE + KERNEL_LOAD_OFFSET);
+    }
+
+    #[test]
+    fn load_address_uses_text_offset_when_above_floor() {
+        let img = synth_image(0x80_0000, 0, 0x100_0000);
+        let loaded = load_from_bytes(&img).unwrap();
+        let addr = loaded.load_address().unwrap();
+        assert_eq!(addr, DRAM_BASE + 0x80_0000);
+    }
+
+    #[test]
+    fn check_fits_in_ram_passes_when_image_fits() {
+        let img = synth_image(0x80_0000, 0x0100_0000, 0x0100_0000);
+        let loaded = load_from_bytes(&img).unwrap();
+        let ram_size = 256 * 1024 * 1024; // 256 MiB
+        let load_addr = loaded.check_fits_in_ram(ram_size).unwrap();
+        assert_eq!(load_addr, DRAM_BASE + 0x80_0000);
+    }
+
+    #[test]
+    fn check_fits_in_ram_rejects_when_kernel_overflows() {
+        // 256 MiB image into a 128 MiB RAM region — should fail.
+        let img = synth_image(0x80_0000, 0x1000_0000, 256);
+        let loaded = load_from_bytes(&img).unwrap();
+        let err = loaded.check_fits_in_ram(128 * 1024 * 1024).unwrap_err();
+        assert!(matches!(err, LoaderError::DoesNotFitInRam { .. }));
+    }
+
+    #[test]
+    fn invalid_text_offset_overflows_cleanly() {
+        let img = synth_image(u64::MAX, 0, 256);
+        let loaded = load_from_bytes(&img).unwrap();
+        assert!(matches!(
+            loaded.load_address(),
+            Err(LoaderError::InvalidTextOffset { .. })
+        ));
+    }
+
+    #[test]
+    fn gzip_decompression_round_trips() {
+        let inner = synth_image(0x80_0000, 0x100_0000, 0x100_0000);
+        let mut compressed = Vec::new();
+        {
+            use std::io::Write;
+            let mut enc =
+                flate2::write::GzEncoder::new(&mut compressed, flate2::Compression::default());
+            enc.write_all(&inner).unwrap();
+            enc.finish().unwrap();
+        }
+        let loaded = load_from_bytes(&compressed).unwrap();
+        assert_eq!(loaded.format, ImageFormat::Gzip);
+        assert_eq!(loaded.text_offset, 0x80_0000);
+        assert_eq!(loaded.image_size, 0x100_0000);
+    }
+
+    #[test]
+    fn zstd_decompression_round_trips() {
+        let inner = synth_image(0x40_0000, 0x80_0000, 0x80_0000);
+        let compressed = zstd::stream::encode_all(Cursor::new(&inner), 0).unwrap();
+        let loaded = load_from_bytes(&compressed).unwrap();
+        assert_eq!(loaded.format, ImageFormat::Zstd);
+        assert_eq!(loaded.text_offset, 0x40_0000);
+    }
+
+    #[test]
+    fn decompression_bomb_is_rejected() {
+        // Compress a 2 MiB image, then load with a 1 MiB cap — must reject.
+        let inner = synth_image(0x40_0000, 0x80_0000, 2 * 1024 * 1024);
+        let compressed = zstd::stream::encode_all(Cursor::new(&inner), 0).unwrap();
+        let caps = MaxSizes {
+            compressed: 8 * 1024 * 1024,
+            decompressed: 1 * 1024 * 1024, // 1 MiB cap on output
+        };
+        let err = load_from_bytes_with_caps(&compressed, caps).unwrap_err();
+        assert!(matches!(err, LoaderError::DecompressedTooLarge { .. }));
+    }
+
+    #[test]
+    fn missing_aarch64_magic_after_decompression_rejected() {
+        let inner = vec![0u8; 0x100]; // No magic at 0x38.
+        let compressed = zstd::stream::encode_all(Cursor::new(&inner), 0).unwrap();
+        let err = load_from_bytes(&compressed).unwrap_err();
+        assert!(matches!(err, LoaderError::MissingAarch64Magic));
+    }
+}
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 9c2ee376..35440c48 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.99.0"
+channel = "1.99.1"
 components = ["clippy", "rustfmt"]
 profile = "minimal"
diff --git a/specs/index.md b/specs/index.md
index 99434ca9..2fbc3b0e 100644
--- a/specs/index.md
+++ b/specs/index.md
@@ -2,6 +2,96 @@
 
 本文件是 specs 的导航入口；文件中的 Draft / Implemented 状态以各原文为准，不代表经过本次运行验收。
 
+## Step Functions and Lambda Runtime — new specification set
+
+PR76 CI corrections are tracked in [the review ledger](./rustack-workflows-93-review.md#pr76-ci-regression-corrections): exact D113 Action history, synchronized Native cleanup observation, and shared stable/nightly format checks.
+
+D101 adds [direct Linux arm64 measurement](./rustack-workflows-70-verification-plan.md#52-direct-linux-arm64-pure-workflow-measurements-d101) with the actual SDK/CLI in a native4-vCPU/8GiB VZ guest:100×50-state p95=10.791ms and100 single-slot live-loop/Stop cycles pass, with exact histories and physical group cleanup. [Raw evidence](../docs/research/workflows-linux-performance-review.md) retains all ordered samples and pending reference qualification; virtual allocation does not prove physical CPU dedication. Full5.3/5.4/M4, dedicated-reference, remaining load/correctness, Desktop/rootless and W373 remain open. D100 continues to waive further x86 validation.
+
+D102 qualifies [actual Image Lambda performance and repeated cleanup](./rustack-workflows-57-image-performance-design.md): final Linux warm/cold p95=3.196/165.350ms,100 causal log-flood timeout cycles with exact task-baseline recovery, full ARM79 and host15 pass. [Raw evidence and audit history](../docs/research/workflows-image-performance-review.md) retain the unexplained pre-final failure, exact source-cache repair and48 successful zero-remnant/source-preservation/owned-bridge postconditions. This VM capture does not close the dedicated reference, Desktop/rootless, remaining load/correctness, W373 or complete M4.
+
+Current D99 checkpoint: D99/5.4a qualifies the actual root release image and safe composite Action on the retained functional lanes. Each full gate executes76 exact resources with558 aggregate Rust passes/33 summaries; each focused gate executes2 exact resources with484/27. One1250-file source cohort, standard/strict/Native/security checks, actual image filesystem/ELF audits and exact zero-remnant/fifteen-source/two-owned-bridge postconditions pass. See [final D99 evidence](./rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions). W373 promotion, required arm64/reference/Desktop/rootless platforms, remaining performance/load and complete M4 remain open. [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation; existing QEMU evidence remains historical functional evidence.
+
+Status: P0 evidence complete; P1/M0 functionally qualified on the retained native-arm64 VZ/emulated-amd64 QEMU lanes. Full M0–M4 release remains incomplete. Implemented and independently reviewed foundations include the shared runtime/HTTP/relay/client, bounded Docker wire, immutable image resolution and leased deployment/provider settlement, persistent directory ownership, allocation policy, retained environment lifecycle and FIFO/warm/LRU dispatch. Delivery-based handler clocks and invocation-scoped observed log windows are qualified through actual image execution. Per-call pool cleanup settlement is retained above dispatch workers and resumable after cancellation or waiter expiry. The Docker Executor/provider/HTTP composition is independently reviewed and exercised through ordinary boto3 against actual images, using controlled fixture readiness. Durable container intents now survive directory reacquisition; historical recovery retains unknown absence and retires only exactly verified identities, with independently reviewed, actual pair-retirement evidence on both retained daemons. Startup network qualification pins full bridge IDs; actual pinned Rust probes validate kernel resource/isolation settings and joined retirement without granting readiness. B01 dependency security, B03 strict boundaries, B04 deployment validation and B05 post-bootstrap initialization classification are closed. See the [implementation ledger](./rustack-workflows-90-impl-plan.md#11-implementation-execution-record) and [review](./rustack-workflows-93-review.md) for exact evidence.
+
+The ordinary Docker image path now consumes production provenance/recovery, typed pull/configuration, immutable relay/network/kernel/optional endpoint receipts and retained provider/listener/shutdown ownership under D81. Real signed SDK and ASL image execution is separately qualified from the earlier controlled component fixtures. D86 closes M0 functional acceptance; final image/platform release acceptance remains in progress. The P2 generated Step Functions model/numeric timestamp foundation is implemented and independently reviewed. The typed HTTP transport is implemented and independently reviewed, including signed ordinary SDK qualification against a controlled handler. Bounded compiled paths/payloads, Choice predicates, pure Wait sources, the12-call intrinsic expression profile, template/data-flow phases, the sequential machine compiler/scoped IR, deterministic six-state transition driver and supervised runtime/history/task-port owner are implemented and independently reviewed, including context headroom, exact timestamp fractions and conservative numeric comparisons. The binary Lambda bridge now invokes the real shared provider with owned admission and resumable cleanup, qualified through actual Native process scenarios. The actor-owned domain registry now captures revisions and names, provides CRUD/tags/Start/Stop/read views, retains snapshots and cleanup through independent TTLs, and is qualified through actual Native execution. The retained real API adapter now serves all15 M1 action paths over core, owns bounded preparation/response work and stable query-bound pagination, with actual Native computation through the typed HTTP layer. The opt-in main service now registers the actual target-family router first, validates supported YAML quotas, reports real worker/integration capabilities and retains a unique resumable API→grace→registry→callbacks→bridge shutdown before Lambda. Actual socket tests preserve modeled timeout envelopes and reject conflicting routing hints. Ordinary Rust SDK and boto3 now qualify the real strict-auth binary/Native path with17 independent semantic cases, all15 M1 actions and joined process/PID cleanup. Structured compilation, bounded Parallel/Map execution and registered nested start/.sync/.sync:2 and callbacks are now installed in the real service; terminal workflow persistence is installed; remaining release/platform requirements remain pending. B06 now closes the refreshed zstd advisories with one patched direct/transitive codec cohort, source-preserving loader overlay, old-frame/context/kernel regressions and clean fresh root audit/deny; preceding B01/B06 scans remain chronological evidence. The subsequent workflow/Native functional, persistence and current-host qualification requested first are implemented; work has now resumed on the preserved Docker-image checkpoint. Durable private image-pin intents/recovery are implemented and independently reviewed, with actual alias recovery and existing executor/pool/wire/container regressions on both retained daemons. W217 is now implemented under runtime§4.9/D76: immutable owner/engine binding, exact-lease runtime ports and a same-connection identity fence before each operation, with typed identity errors that cannot masquerade as resource404. Recorded namespace composition§4.10/D77 now drains containers before pins and audits untruncated owner containers plus complete bounded image-tag inventories; unrecorded resources block without adoption, and unknown records are never discharged by empty scans. Controlled pull preparation§2.14/D78 now adds exact registry/credential policy, bounded incremental progress and retained terminal ownership before image revalidation; D79 now supplies shared validated Docker budgets/keys, pure typed settings and retained private YAML credential loading. D80 adds shared validated endpoint/instance types, an owned HTTP(S) runtime probe, admission-independent gateway diagnostics and exact private endpoint receipts after physical retirement. D81 now consumes those receipts in the actual ordinary startup path, with a diagnostic-only same-listener phase and dependency-safe physical cleanup; controlled endpoint peers remain component evidence. D88 installs immutable local Image archive restoration before ingress; D93 adds bounded original-ZIP archives when the provided runtime is configured, while Image-only installations reject managed ZIP input. D82 adds independent custom Rust RIC, actual ImageConfig/immutable-revision and causal active-ID isolation qualification through ordinary startup. D83–D86 close the L01–L09 fault/admission matrix; D95–D98 additionally qualify handler SDK networking/callback images, managed IaC and the separate server container. D99 qualifies the actual release image/Action; W373 promotion, required arm64/reference/Desktop/rootless platforms, remaining performance/load and complete M4 remain required. D100 waives further Linux x86_64 validation. The complete requested scope remains M0–M4. All feature documents below are in English; start here for the owned ASL engine and actual Docker image Lambda execution.
+
+P3's explicit structured supervisor now owns asynchronous Parallel/Map calls, retained ancestor leases and per-frame causal history, including actual overlapping Native handlers. The real API now selects the registry-bound Structured profile with enforced YAML frame/result quotas, qualified by both ordinary SDKs through actual Native overlap and stopped nested handlers. Sequential library defaults remain available. The concrete atomic child registry port now has owned cancellation, typed envelope/depth/cycle bounds and actual Native child evidence. ASL child resources now use registered structured owners with exact parent-capability handoff, dispatch-free waiting and actual TaskSubmitted history. Both ordinary SDKs qualify nested envelopes and consumed Native handlers, including an actual single-dispatch server. The bounded callback token registry foundation now has secret-wrapped tokens, hash-only indexes, provisional completion, heartbeat timers and retained shutdown; Pure callback Parameters now use one evaluation with structural provenance, scoped zeroizing context and a distinct null-redacted history projection. The explicit observed Lambda callback port now binds unique report ownership and actual typed metadata, with provider-return timestamps, independent bridge settlement and actual Native early/late/failure/cancellation qualification. A deferred callback instruction assigns attempt/deadline before registered-token parameter preparation, tracks callback frames through retirement, validates heartbeat sources and projects typed Scheduled/Submitted history. The registered asynchronous owner now consumes this instruction with exact parent publication, bounded retained preparation/results, causal history acknowledgment, independent invocation/result/cleanup progress and actual Native ASL qualification. Explicitly installed runtime/Registry bindings admit callbacks; unregistered starts and services without a selected real Lambda port remain rejecting. The registry-bound public SendTask adapter is implemented under API§1.4/D67 with retained acknowledgment/error handling and documented empty success bodies; Main configuration/capability/shutdown composition and both handler-originated ordinary SDK paths now consume this binding under operations§1.7/D68. Both actual signed SDKs pass nine callback cases through Native handlers (20 consumed attempts total), including controlled early/late completion, heartbeat/timeout/retry and consumed PID retirement. The required SDK gate also proves process cleanup after fixture gate-release failure. B06 compression remediation is implemented/reviewed under operations§4.1/D69. The installed [bounded archive CBOR boundary](./rustack-workflows-60-operations-design.md#42-bounded-cbor-import-boundary) now passes full/minimal profile, actual DynamoDB/committed-generation and property qualification under D70. The [sealed registry export](./rustack-workflows-60-operations-design.md#31-sealed-registry-ownership-and-durable-export) now retains original ownership after clean shutdown and exports exact durable rows under a pre-copy budget, qualified through actual Native output/history and lifecycle/codec/clock failures. The [atomic library restore](./rustack-workflows-60-operations-design.md#32-startup-only-atomic-registry-restore) now validates, compiles and charges a startup-only replacement before one actor commit, preserving original history/retention and converting unexpected running records without replay. The [main workflow archive consumer](./rustack-workflows-60-operations-design.md#33-main-workflow-archives-and-startupshutdown-ownership) now installs this boundary in real named snapshots with retained startup/save ownership and actual Native process-restart/no-replay acceptance. The [pure workload and responsiveness gate](./rustack-workflows-70-verification-plan.md#51-native-host-pure-workflow-workload-and-responsiveness) now qualifies the actual current-host signed SDK/binary path. The [operator guide](../docs/workflows-guide.md) and [exact native resource inventory](./rustack-workflows-70-verification-plan.md#31-exact-resource-suites-and-documented-pure-smoke) expose the installed profile without claiming final release acceptance. Managed consuming-project/IaC and the separate server container are subsequently qualified through D97/D98. D99 qualifies the actual root image and Action. W373 promotion, required arm64/reference/Desktop/rootless platforms, remaining performance/load and complete M4 remain open under D100; no further Linux x86_64 validation is required.
+
+D83 adds permanent-memory rejection before allocation, a captured Docker final-cleanup reserve, and ordinary-service fault/cancellation/admission qualification. The complete Native verifier is rerun first, following the requested execution order. See the [D83 review](./rustack-workflows-93-review.md#p1-real-image-faults-and-public-cancellationadmission-review) for causal deadlines, retained resource ownership and exact evidence; remaining Docker fault injection, image archive/ZIP, handler SDK/IaC and platform release gates stay open.
+
+D84 adds consumed image-preparation admission receipts retained above worker unwind, real management-IO barriers and an exact eight-target Docker resource inventory. The unified functional gate included all 44 Docker resources at landing and preserves the separate Native policy. See the [management IO design](./rustack-workflows-20-lambda-runtime-design.md#414-causal-management-io-fault-qualification-d84) and [verification contract](./rustack-workflows-70-verification-plan.md#management-io-faults-and-exact-docker-resource-inventory-d84); full M0–M4 acceptance stays open.
+
+D85 extends the Docker functional inventory to 48 resources with live-caller Create/DELETE IO expiry, a genuinely interrupted ifMissing pull with retained backend drain and source-reference ownership, and actual incompatible/protocol-free images. See the [IO expiration and artifact design](./rustack-workflows-20-lambda-runtime-design.md#415-real-io-expiration-interrupted-pulls-and-incompatible-artifacts-d85) and [D85 verification](./rustack-workflows-70-verification-plan.md#io-expiration-interrupted-pulls-and-negative-images-d85). Both retained daemons pass the48-resource gate and final8-case IO requalification, with seven selected sources/baseline preserved and zero owned remnants. See the [D85 review and M0 audit](./rustack-workflows-93-review.md#p1-real-io-expiration-interrupted-pull-and-negative-artifact-review); at that checkpoint, actual malformed HTTP and isolated admission subcases kept M0 open. D86 below supersedes those gaps; later M0–M4 release requirements remain binding.
+
+D86 is implemented and independently reviewed: actual Runtime HTTP profile bounds and separately isolated global/default-per-function/memory/environment ceilings close the two M0 audit gaps. Both retained daemons pass the full53-resource functional gate; exact postconditions show zero owned remnants with selected sources preserved. P1/M0 is functionally qualified on the retained P0 lanes; native Linux/x86/reference performance, Desktop/rootless and the complete M4 platform matrix remain unqualified. See [runtime§4.16](./rustack-workflows-20-lambda-runtime-design.md#416-actual-runtime-http-bounds-and-independent-admission-ceilings-d86). Full M0–M4 release remains open.
+
+D87 is implemented and independently reviewed: [immutable local lease reacquisition](./rustack-workflows-20-lambda-runtime-design.md#215-immutable-local-image-lease-reacquisition-d87) supplies the saved-ID/no-pull capability required by atomic image archive restore. Both retained engines pass18 actual consuming resources and35 lease controls pass; full host/Native/strict/security gates are green. At that checkpoint, provider/main archive rejection remained for the consuming transaction now implemented in D88.
+
+D88 is implemented and independently reviewed: [candidate Image archive restoration](./rustack-workflows-20-lambda-runtime-design.md#216-candidate-store-image-archive-restoration-d88) validates/reacquires all revisions before startup publication and preserves previous generations on failure/expiry. Both retained engines pass all53 functional resources, including real archive save/restart/latest/alias/workflow history and corrupted-proof refusal; complete host/Native/strict/security gates and exact zero-remnant/source-preservation postconditions pass. Docker ZIP/Node/handler SDK/IaC/reference/platform and full M4 remain open.
+
+D89/5.1a is implemented and independently reviewed: [provided-runtime ZIP delivery](./rustack-workflows-20-lambda-runtime-design.md#61-provided-runtime-zip-delivery-contract-d89) now has typed bounded conversion, shared strict ZIP staging and local-volume/archive transport. Both retained full54-resource gates and host/Native/strict/security checks pass, with exact zero-remnant/source-preservation postconditions. Durable volume ownership/recovery5.1b, ordinary execution5.1c and ZIP archives5.2c remain mandatory; the ordinary ZIP capability stays unavailable until its actual consumer is qualified.
+
+
+| Order | Specification | Type / purpose |
+|---|---|---|
+| 00 | [Workflows PRD](./rustack-workflows-00-prd.md) | Product goals, compatibility profile and complete M0–M4 scope |
+| 10 | [API and data model](./rustack-workflows-10-api-design.md) | Smithy protocol, resource/revision identity, idempotency and execution history |
+| 20 | [Lambda runtime](./rustack-workflows-20-lambda-runtime-design.md) | Image execution, typed operator settings, controlled pulls, container-origin endpoint proofs, Docker relay, revisions, pooling and cleanup |
+| 30 | [ASL engine](./rustack-workflows-30-asl-design.md) | Scoped compiler, bounded frame scheduler and async resource owner, causal history, retries and deadlines |
+| 40 | [Task integrations](./rustack-workflows-40-integrations-design.md) | Real Lambda invocation, nested `.sync`/`.sync:2`, callbacks and heartbeats |
+| 50 | [IaC consumer](./rustack-workflows-50-iac-design.md) | Pinned Pulumi inside managed image Lambda, independent lifecycle/privacy oracles and plugin retirement |
+| 55 | [Server container](./rustack-workflows-55-server-container-design.md) | Actual Linux server, explicit socket/DNS/volume ownership, signed SDK/nested ASL and joined shutdown |
+| 56 | [Release image and Action](./rustack-workflows-56-release-image-design.md) | Actual root image build/profile, safe Action inputs/deadlines, shared release-container qualification |
+| 57 | [Image performance and repeated cleanup](./rustack-workflows-57-image-performance-design.md) | Warm100/cold20 timing, initialization diagnostics,100 log-flood timeout cycles and direct ARM Linux owners |
+| 58 | [Rootless platform](./rustack-workflows-58-rootless-platform-design.md) | Isolated user daemon, effective cgroup attestation and complete resource qualification |
+| 59 | [Final consumers and release qualification](./rustack-workflows-59-release-qualification-design.md) | Code-first acceptance completion, immutable candidates and non-skipping publication gate |
+| 60 | [Operations](./rustack-workflows-60-operations-design.md) | YAML configuration, budgets, topology, shutdown and snapshots |
+| 61 | [External LocalStack compatibility](./rustack-workflows-61-localstack-compatibility-design.md) | Original upstream pytest cases, observed AWS semantics, bounded adapters and exact123-node acceptance |
+| 70 | [Verification plan](./rustack-workflows-70-verification-plan.md) | Acceptance matrix, security boundaries, SDK/platform coverage and performance budgets |
+| 80 | [Roadmap](./rustack-workflows-80-roadmap.md) | User-visible M0–M4 outcomes and calendar assumptions |
+| 90 | [Implementation plan](./rustack-workflows-90-impl-plan.md) | P0 evidence gate and dependency-ordered P1–P5 tasks/exit criteria |
+| 93 | [Implementation review](./rustack-workflows-93-review.md) | Independent findings, corrections and required phase/security follow-ups |
+| 99 | [Key decisions and glossary](./rustack-workflows-99-decisions.md) | Alternatives, rationale, ownership and overloaded terms |
+
+Read 00 → 10 → 20 → 30 → 40; apply 60/70 throughout. Read 80 for delivery planning and 90 for the next engineering step. The [supporting survey](../docs/research/survey-stepfunctions-lambda-container-runtime.md) records source verification and remaining runtime experiments.
+
+The [pinned Docker transport study](../docs/research/study-bollard-docker-transport-boundaries.md) refines the P1 consumer boundary: reuse generated Docker types with bounded, supervised Unix HTTP/attach IO. It supersedes the initial ordinary Bollard pipe-client recommendation; it does not change the relay architecture or establish executor acceptance.
+
+```text
+┌─ P0: runtime experiment + semantic fixtures + pinned sources ───────┐
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ M0 / P1: image Lambda ──────┐   ┌─ M1 / P2: API + ASL spine ─────┐
+│ actual code + owned cleanup  │──▶│ real Lambda tasks + history      │
+└─────────────────────────────┘   └──────────────┬───────────────────┘
+                                                ▼
+┌─ M2 / P3: Parallel/Map + nested .sync ──────────────────────────────┐
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼ M3 / P4: callbacks + heartbeat
+┌─ M4 / P5: ZIP + snapshots + consuming-project CI qualification ─────┐
+└───────────────────────────────────────────────────────────────────┘
+```
+
+The new set supersedes conflicting historical Docker plans while preserving the hardening contracts. Ordinary Lambda invocation already waits for its result; `.sync` is implemented for nested Step Functions, not an invalid `lambda:invoke.sync` resource.
+
+
+D90 is implemented and independently reviewed: [durable code namespace recovery](./rustack-workflows-20-lambda-runtime-design.md#66-code-namespace-provenance-and-recovery-boundary-d90) adds an explicit code provenance generation and reader/recovery boundary before its retained producing actor. Both retained full55-resource gates and standard/strict/Native/security checks pass, with zero owned remnants and eight actual provisioned sources preserved per engine. Producing ownership is covered by D91 below; ordinary ZIP and complete M4 remain open.
+
+D91 is implemented and independently reviewed: [retained producing code-volume management](./rustack-workflows-20-lambda-runtime-design.md#67-retained-producing-code-volume-manager-d91) consumes D90 recovery and D89 typed code transfer. Both retained full56-resource gates and standard/strict/Native/security checks pass, with zero remnants and eight actual provisioned sources preserved per engine. Ordinary ZIP startup/provider/invocation and archives are next; complete M4 remains active.
+
+D92 is implemented and independently reviewed: [ordinary provided-runtime ZIP consumption](./rustack-workflows-20-lambda-runtime-design.md#68-ordinary-provided-runtime-installation-and-environment-consumption-d92) installs the actual startup/provider/environment path over D91, with retained cleanup and identical-artifact Linux Native qualification. Both final full63-resource gates and host/strict/Native/security checks pass; exact postconditions show zero remnants, nine actual source IDs preserved per engine and both owned bridges retired. Task5.1 is complete. ZIP archives5.2c, Node/handler SDK/IaC/reference/platform and full M4 remain active.
+
+D93 is implemented and independently reviewed: [managed ZIP archives](./rustack-workflows-20-lambda-runtime-design.md#69-bounded-provided-runtime-zip-archives-and-mixed-candidate-restoration-d93) preserve original code under explicit data/metadata budgets, validate complete mixed candidates before Image effects and share the retained startup commit deadline. Both final65-resource full gates and standard/strict/Native/security checks pass. Exact postconditions prove zero remnants, nine actual source IDs preserved per engine and both owned empty bridges removed. Task5.2c is complete; Node/handler SDK/IaC/server-in-container/reference/platform and full M4 remain active.
+
+D94 is implemented and independently reviewed: [official Node image consumption](./rustack-workflows-20-lambda-runtime-design.md#417-official-node-image-consumption-d94) executes pinned Node24.22.1 through signed Rust/boto3 and registered ASL, including actual context/filesystem/log/error recovery and immutable published/alias behavior. Shared Runtime HTTP supports its narrow X-Ray metadata and bounded keepalive/body-admission needs, with accepted-envelope permits surviving observer loss. Both final66-resource gates pass482 aggregate Rust cases/28 summaries each; all standard/strict/Native/security checks and exact zero-remnant/ten-source-preservation/two-owned-bridge retirement postconditions pass. Task5.3a/L02 closes; handler SDK/callback images, IaC/server-in-container/reference/platform and complete M4 remain active.
+
+D95 is implemented and independently reviewed: [explicit local handler SDK context](./rustack-workflows-20-lambda-runtime-design.md#418-explicit-local-handler-sdk-environment-d95) binds operator-selected local credentials and endpoint injection to the exact qualified runtime scope, omits injected credentials from archives and isolates warm contexts. Actual default-provider Node clients3.1105.0 complete strict-auth S3/DynamoDB cold/warm work and precise negative authorization cases. Both full68-resource gates pass509 Rust cases/29 summaries; both current-source three-consumer gates pass71 cases/seven summaries after the reviewed equivalent owner relocation. Standard/strict/Native/security and exact zero-remnant/eleven-source/two-owned-bridge retirement checks pass. Task5.3b/L10 closes; image callbacks/IaC/server-in-container/reference/platform and full M4 remain active.
+
+D96 is implemented and independently reviewed: [real image SDK callbacks](./rustack-workflows-40-integrations-design.md#56-real-image-sdk-callbacks-and-independent-event-worker-d96) use a managed Node dispatcher, an independently accepted Event worker and safe local DynamoDB gates. Both retained functional lanes pass all nine actual SDK3.1105.0 modes, both exact focused resources and all70 full resources/519 Rust cases/30 summaries. Final host/strict/Native/security gates and exact zero-remnant/twelve-source/two-owned-bridge retirement checks pass under41 unchanged source hashes. W333–W343 are fixed/rechecked; see [final D96 qualification](./rustack-workflows-93-review.md#final-d96-qualification). Task4.3/5.3c closes; IaC/server-in-container/reference/platform and full M0–M4 release remain active.
+
+D97 is implemented and independently reviewed: [Pulumi image-Lambda IaC consumer](./rustack-workflows-50-iac-design.md) runs the actual18-command lifecycle with independent SDK/current-state/privacy oracles and active-plugin Stop under the managed function owner. Both retained lanes pass the two focused resources and all72 full resources/521 Rust cases/30 summaries under78 sealed source hashes. Standard/strict/Native/security gates and exact26-command zero-remnant/thirteen-source/two-owned-bridge postconditions pass. W344–W364 are fixed/rechecked; see [final D97 qualification](./rustack-workflows-93-review.md#d97-final-qualification-and-exact-postconditions). Task5.3d closes; server-in-container/native-reference/platform and complete5.4 remain required.
+
 ## 推荐阅读顺序
 
 1. [系统审查与改进 spec](./rustack-system-review.md)：安全、正确性、架构及开发者体验；按 R01–R18 定位问题，按 M0–M4 安排修复。
@@ -42,7 +132,8 @@
 | SQS | [设计](./ruststack-sqs-design.md)、[Long-poll / DashMap safety fix](./fixes/sqs-longpoll-dashmap-safety.md) |
 | SSM | [Parameter Store](./ruststack-ssm-design.md) |
 | SNS | [设计](./ruststack-sns-design.md) |
-| Lambda | [服务设计](./ruststack-lambda-design.md)、[Executor](./ruststack-lambda-executor-design.md)、[Squib runtime](./ruststack-lambda-squib-runtime-design.md)、[S3 code packages](./ruststack-lambda-s3-code-design.md) |
+| Lambda | [Current runtime target](./rustack-workflows-20-lambda-runtime-design.md)、[Hardening](./rustack-lambda-hardening-design.md)、[服务设计](./ruststack-lambda-design.md)、[Executor](./ruststack-lambda-executor-design.md)、[Squib runtime](./ruststack-lambda-squib-runtime-design.md)、[S3 code packages](./ruststack-lambda-s3-code-design.md) |
+| Step Functions | [PRD](./rustack-workflows-00-prd.md), [ASL engine](./rustack-workflows-30-asl-design.md), [integrations](./rustack-workflows-40-integrations-design.md), [implementation plan](./rustack-workflows-90-impl-plan.md) |
 | EventBridge | [设计](./ruststack-events-design.md) |
 | CloudWatch | [Metrics](./ruststack-cloudwatch-design.md)、[Logs](./ruststack-logs-design.md) |
 | KMS | [设计](./ruststack-kms-design.md) |
diff --git a/specs/rustack-workflows-00-prd.md b/specs/rustack-workflows-00-prd.md
new file mode 100644
index 00000000..a81e6415
--- /dev/null
+++ b/specs/rustack-workflows-00-prd.md
@@ -0,0 +1,94 @@
+# Rustack Workflows: Step Functions and Real Lambda Execution
+
+Status: implementation in progress; full M0–M4 incomplete · Date: 2026-10-31 · Delivery: M0–M4
+
+D99/5.4a qualifies the actual root release image and safe composite Action on the retained functional lanes. Each full gate executes76 exact resources with558 aggregate Rust passes/33 summaries; each focused gate executes2 exact resources with484/27. One1250-file source cohort, standard/strict/Native/security checks, actual image filesystem/ELF audits and exact zero-remnant/fifteen-source/two-owned-bridge postconditions pass. See [final D99 evidence](./rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions). W373 promotion, required arm64/reference/Desktop/rootless platforms, remaining performance/load and complete M4 remain open. [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation; existing QEMU evidence remains historical functional evidence. Workflow/API/structured/nested/callback/persistence and current-host Native qualification are implemented.
+
+## 1. Problem and vision
+
+Other projects need to test real serverless workflows locally and in CI: deploy the same Lambda container images used on AWS, create state machines through ordinary AWS SDKs, exercise branching, retries, timeouts and child workflows, and inspect actual outputs and execution histories. At feature inception, Rustack had a Lambda control plane and Runtime API, explicitly rejected Docker execution and had no Step Functions engine. Returning plausible API responses or echoing inputs cannot validate function code or workflow behavior.
+
+Rustack will own an ASL interpreter and Docker Lambda execution environments, reusing its gateway, Lambda provider, immutable revisions and snapshots. Clients change their AWS endpoint rather than rewrite production workflows. The complete release profile is **STANDARD workflows, an explicit JSONPath subset, all eight state types, real image Lambdas, Retry/Catch/timeouts, Parallel/Inline Map, nested `.sync`, and Lambda callbacks**. No Step Functions Local, LocalStack, Temporal or other replacement workflow engine is required.
+
+## 2. Existing implementation and specification authority
+
+The [research survey](../docs/research/survey-stepfunctions-lambda-container-runtime.md) records inspected code and official sources. These documents describe future work; historical Implemented labels are not new verification evidence.
+
+This specification set:
+
+- Preserves [Lambda hardening](./rustack-lambda-hardening-design.md): execution defaults to disabled, artifacts are immutable, and admission and cleanup remain bounded.
+- Supersedes the RIE-forwarding architecture in the [original Lambda design](./ruststack-lambda-design.md), and the old Docker networking, dependency versions and broad cleanup rules in the [executor design](./ruststack-lambda-executor-design.md).
+- Preserves Native and Squib as independent backends. Image packages require Docker; they never silently fall back to Native or Squib.
+- Extends [runtime hardening](./rustack-runtime-hardening-design.md) worker ordering and [snapshot coverage](./ruststack-snapshot-binary-archive-design.md). It does not add a crash-consistent execution log.
+
+## 3. Users and measurable goals
+
+Primary users maintain Rust, Python or Node Lambda projects with CDK/Terraform/Pulumi-generated ASL. CI maintainers need repeatable Linux execution without cloud credentials. Apple Silicon developers need to execute Linux arm64 images without rebuilding handlers for macOS.
+
+| ID | Goal | Acceptance measure |
+|---|---|---|
+| G1 | Execute real images | Results originate inside the deployed handler; broken images, missing RICs and initialization failures fail explicitly, without echo fallback |
+| G2 | Work with ordinary SDKs | Rust SDK and boto3 create/start/describe/history/stop scenarios pass without Rustack-only required wire fields |
+| G3 | Make core ASL trustworthy | Every required case in the [verification matrix](./rustack-workflows-70-verification-plan.md) passes |
+| G4 | Implement actual `.sync` | Parents await child termination; `.sync` and `.sync:2` preserve different Output types; invalid `lambda:invoke.sync` is rejected during creation |
+| G5 | Reuse deployment artifacts | Required Linux arm64 and macOS arm64 + Docker Desktop lanes pass (D100 waives Linux x86_64 validation); the prepared example completes within five minutes excluding builds and pulls |
+| G6 | Bound and clean up work | Overload is explicit; Stop, timeout and shutdown leave no unowned tasks or containers; cleanup failures remain tracked and diagnosable |
+| G7 | Expose compatibility honestly | Unsupported syntax and integrations fail validation at a precise location; capabilities distinguish compiled, enabled, probed and limited behavior |
+
+Performance numbers are acceptance budgets, not existing measurements.
+
+## 4. Release scope
+
+| Capability | Milestone | Authoritative design |
+|---|---|---|
+| Image Lambda deploy/update/get, digest pinning, ImageConfig, versions, actual Invoke | M0 | [Lambda runtime](./rustack-workflows-20-lambda-runtime-design.md) |
+| STANDARD APIs, Pass/Task/Choice/Wait/Succeed/Fail, data transformations, Retry/Catch | M1 | [API](./rustack-workflows-10-api-design.md), [ASL](./rustack-workflows-30-asl-design.md) |
+| Parallel, Inline Map, nested startExecution/.sync/.sync:2 | M2 | [ASL](./rustack-workflows-30-asl-design.md), [integrations](./rustack-workflows-40-integrations-design.md) |
+| Lambda `.waitForTaskToken`, SendTask* and heartbeats | M3 | [integrations](./rustack-workflows-40-integrations-design.md) |
+| Container execution of provided.al2023 ZIPs, snapshots, platform and fault validation | M4 | [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md) |
+
+M0 is the smallest useful end-to-end slice: SDK → Lambda API → Docker handler → SDK result. M1 first closes SDK → ASL → Docker Lambda → history. **The complete requested outcome is M4**, not an M0/M1 scaffold.
+
+Excluded from this release: EXPRESS/StartSyncExecution, JSONata/Assign/variables, Distributed Map, Activities, Redrive/TestState, Step Functions version publication/aliases (the unpublished empty-version inventory read is included for IaC), cross-account AssumeRole, arbitrary AWS SDK integrations, ECS/Batch/Glue `.sync`, an ECR emulator, user-image builds, VPC emulation, extensions, SnapStart, streaming responses, Managed Instances, an AWS IAM policy evaluator, and cloud-grade durable workflow recovery.
+
+Each exclusion requires explicit rejection or an advertised limitation, rather than storing ignored fields and reporting success. An eventual ECS `.sync` adapter requires a real ECS execution service; starting an arbitrary Docker container does not establish ECS compatibility.
+
+## 5. User experience
+
+Use the existing configuration entry point: `RUSTACK_CONFIG=./rustack.yaml rustack`. Enable `SERVICES=lambda,stepfunctions` and explicitly choose `LAMBDA_EXECUTOR=docker`. The consuming project builds its images beforehand. Local mode accepts an image such as `rustack-echo:integration`; an unchanged ECR reference must already exist in the daemon or match an operator-enabled registry pull policy.
+
+```json
+{
+  "StartAt": "Call",
+  "States": {
+    "Call": {
+      "Type": "Task",
+      "Resource": "arn:aws:states:::lambda:invoke",
+      "Parameters": {
+        "FunctionName": "arn:aws:lambda:us-east-1:000000000000:function:echo",
+        "Payload.$": "$"
+      },
+      "TimeoutSeconds": 15,
+      "Retry": [{"ErrorEquals": ["Lambda.TooManyRequestsException"], "MaxAttempts": 2}],
+      "OutputPath": "$.Payload",
+      "End": true
+    }
+  }
+}
+```
+
+The SDK sequence is CreateFunction(PackageType=Image, Code.ImageUri=...) → wait for Active → CreateStateMachine(type=STANDARD) → StartExecution(input is a JSON string) → poll DescribeExecution → GetExecutionHistory. Production ASL needs no special testing fields. Ordinary `lambda:invoke` already waits for function completion; adding `.sync` is invalid.
+
+## 6. Compatibility declaration
+
+Unmodified production ASL works within the documented profile. Modern CDK output using JSONata or other integrations receives an explicit rejection. Resource names initially accept ASCII `[A-Za-z0-9_-]`, an advertised local restriction. Authentication follows Rustack's gateway trust modes; execution role ARNs are validated metadata, not evidence of AWS IAM authorization parity.
+
+Standard execution guarantees apply within a live Rustack runtime. Snapshots do not recover requests made after the last completed save or ensure exactly-once external side effects.
+
+## 7. Reading order and cross-references
+
+Read 00 → 10 → 20 → 30 → 40 for contracts. Read 60/70 alongside them. Document 80 describes user-visible delivery, 90 specifies engineering dependencies, and 99 records decisions.
+
+- → [API and data model](./rustack-workflows-10-api-design.md)
+- → [roadmap](./rustack-workflows-80-roadmap.md), [implementation plan](./rustack-workflows-90-impl-plan.md)
+- ↔ [key decisions](./rustack-workflows-99-decisions.md)
diff --git a/specs/rustack-workflows-10-api-design.md b/specs/rustack-workflows-10-api-design.md
new file mode 100644
index 00000000..f569f29e
--- /dev/null
+++ b/specs/rustack-workflows-10-api-design.md
@@ -0,0 +1,268 @@
+# Workflows 10: Step Functions API, Data Model and History
+
+Status: implementation contract · Depends on: [PRD](./rustack-workflows-00-prd.md)
+
+## 1. Protocol and crate boundaries
+
+Add `rustack-stepfunctions-model`, `rustack-stepfunctions-http` and `rustack-stepfunctions-core`. Keep the ASL compiler/interpreter in core's `asl/` and `engine/` modules rather than publishing another crate prematurely. HTTP owns codecs and protocol errors, not execution semantics. Generate model types with the existing Smithy generator.
+
+| Item | Contract |
+|---|---|
+| Source | [Official SFN Smithy](https://raw.githubusercontent.com/aws/api-models-aws/main/models/sfn/service/2016-11-23/sfn-2016-11-23.json); record source commit and SHA-256 when imported |
+| Generator configuration | `codegen/services/stepfunctions.toml`; namespace `com.amazonaws.sfn`, service ID `AWSStepFunctions` |
+| Protocol | `awsJson1_0`; POST `/`; Content-Type `application/x-amz-json-1.0`; target `AWSStepFunctions.<Operation>` |
+| JSON names | API camelCase; preserve ASL PascalCase using explicit serde renames, never global case conversion |
+| Signing | SigV4 service `states`; reuse gateway identity, scope checks and strict/skip modes |
+| Local service name | Feature, SERVICES and capabilities use `stepfunctions`; AWS signing and ARN service remain `states` |
+| Routing | Register before the S3 catch-all; unknown AWSStepFunctions operations must not fall through to S3 |
+
+Future automation uses Makefile targets. The current generator needs protocol-aware numeric epoch-second timestamp serde for awsJson1_0; ordinary chrono serde produces strings. Before service generation, prove required/optional timestamps, fractional seconds and negative epochs in generated round trips. Keep protocol-default behavior scoped correctly so restJson/query timestamp bindings do not change accidentally. Resolve any union support required by the selected operations in the generator; do not hand-edit generated source.
+
+### 1.1 Executable timestamp/model generation contract
+
+Generate the pinned37-operation model into rustack-stepfunctions-model without advertising those operations as implemented. Add opt-in strict_model output configuration for this service: forbid unsafe, emit non-exhaustive public structs, deny unknown struct fields, derive typed-builder for structs with more than five fields (defaults only on nonrequired members), redact every DTO Debug field, keep error Debug/Display static while preserving typed source(), document fields/variants, and emit no blanket lint suppressions. Existing services retain their current generation policy.
+
+For awsJson1_0/1_1 timestamp members, resolve member timestampFormat before target-shape format before protocol default. Default/epoch-seconds uses a generated epoch_seconds module; explicit date-time retains chrono serde; unsupported explicit formats fail generation. Other protocols retain their existing binding behavior. Apply required and optional serde adapters (optional includes default for omission); do not change plain strings which resemble dates. The pinned SFN model has no timestamp-valued list/map members; unsupported timestamp collections must fail generation rather than emit chrono string defaults.
+
+The JSON adapter uses serde_json raw_value to preserve decimal numeric lexemes without binary-float rounding or a workspace-wide arbitrary_precision feature. Accept JSON numbers including exponent notation, at most128 lexical bytes; reject strings, required null, booleans, collections, invalid numeric grammar and chrono-range overflow with static diagnostics. Normalize to millisecond precision by truncating toward zero, including negative fractional epochs. Compute checked decimal scaling with bounded work; never cast a negative fraction to unsigned nanoseconds. Serialize finite chrono timestamps as exact numeric decimal seconds at the same precision, reject leap-second representations, omit absent optional members and accept optional null. This JSON-specific wire adapter is not a generic CBOR timestamp contract. HTTP still enforces its independent request envelope limit before model parsing.
+
+`make codegen-stepfunctions` generates all source including the codec from repository templates and formats it. `make test-stepfunctions-model` checks actual generated required/optional fields, positive/negative/fractional/exponent/range/omitted/null cases and regeneration consistency. Generator tests cover format precedence, protocol isolation, serde-disabled combinations and strict output without lint ignores. The developer CLI accepts bounded UTF-8 arguments, ordinary config/model files up to1/16MiB, and a60s generation deadline using Tokio1.54.1 with explicit rt/macros/fs/time/io-util features. Validate Smithy2.0, honor configured overlay preservation/module exports and reject unsupported output.dir/custom error formats rather than silently ignoring them. Check the standalone tool graph with make audit-codegen/deny-codegen. Primary contracts: [Smithy JSON1.0](https://smithy.io/2.0/aws/protocols/aws-json-1_0-protocol.html#shape-serialization), [timestamp precision/precedence](https://smithy.io/2.0/spec/protocol-traits.html#timestampformat-trait), [RawValue](https://docs.rs/serde_json/latest/serde_json/value/struct.RawValue.html).
+
+```text
+┌─ AWS SDK clients ──────────────────────────────────────────────────┐
+│ POST / + AWSStepFunctions.*     JSON strings(input/definition)      │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼ identity / body / deadline boundary
+┌─ stepfunctions-http ───────────────────────────────────────────────┐
+│ Smithy codec → wire validation → typed commands → protocol errors  │
+└─────────────────────────────┬──────────────────────────────────────┘
+                         bounded mpsc
+┌─ core / RegistryActor ──────▼───────────────────────────────────────┐
+│ immutable machine revisions │ execution-name tombstones │ tokens  │
+│ serialized Create/Update/Start/Stop; owned replies for read views   │
+└──────────────┬───────────────────────────────┬──────────────────────┘
+               ▼                               ▼
+┌─ ExecutionActor ──────────────┐   ┌─ bounded history/read views ────┐
+│ revision, frames, generations │──▶│ event sequence, terminal data   │
+│ task handles and timers       │   │ snapshot DTOs, no live handles  │
+└───────────────────────────────┘   └────────────────────────────────┘
+```
+
+### 1.2 Typed HTTP boundary before registry wiring
+
+`rustack-stepfunctions-http` owns a concrete Hyper service, an object-safe async StepFunctionsHandler port, typed Request/Response enums for the15 M1 actions, three callback actions and one unpublished-version inventory read, immutable RequestScope and per-call RequestContext. Native async syntax with async-trait is justified by Arc<dyn StepFunctionsHandler>; no default/echo/unimplemented production handler is supplied. Model presence and callback transport types do not advertise core support. Register the service before S3 only when the real core adapter lands; keep feature/capability publication coupled to that registration.
+
+Claim any exact AWSStepFunctions target family, including unknown actions, duplicate occurrences and a missing action suffix, independent of method/path; never forward those to S3. Require POST at root without query, one bounded ASCII target/content-type, JSON1.0 media type (optionally UTF-8 charset), no compression, and unambiguous Content-Length/Transfer-Encoding. Bound the whole header map to64 entries/32KiB, each value≤8KiB; target/content-type≤256 bytes. Unknown actions return UnknownOperationException/404 per the current [SFN common-error contract](https://docs.aws.amazon.com/step-functions/latest/apireference/CommonErrors.html); known actions outside the19-action transport profile return UnsupportedOperation/400. This updates the initial custom unknown-operation status in generator configuration. These checks are local rejection policy, not a measured full AWS error-precedence oracle.
+
+Collect through the shared source-level BodyBudget capped at2MiB, with a configured total request deadline covering collection/authentication/dispatch/encoding. Reject every trailer frame before dispatch, including unknown and oversized trailer fields; trailers must not bypass the initial header limits. Authenticate the original bytes before treating a zero-byte body as `{}`. Explicit development mode skips verification; strict construction without a provider fails. Strict requests reuse ordinary SigV4 payload verification, require signing service states and the configured region, and bind x-amz-target in SignedHeaders. Scope partition/region/account comes only from validated operator configuration, never unsigned request fields. Authentication failures emit a static AccessDeniedException/403 while preserving typed sources in redacted diagnostics. This remains the gateway's local trust profile, not an IAM evaluator.
+
+Preflight JSON (depth16,4,096 aggregate members,128-byte keys and1MiB maximum strings) before typed DTO construction. Strict generated DTOs reject unknown/duplicate fields. Validate operation-specific string/collection byte bounds from §4 before calling the handler; traceHeader accepts0–256 ASCII bytes, including empty text and spaces, rather than using the nonempty identifier grammar. Business JSON input/output text is independently bounded/validated, while definition strings remain compiler-owned so Validate can return FAIL diagnostics. Domain ARN/role/profile/ASL semantics remain core-owned and must validate before actor commands. Request/response/context/body/config Debug never expose definitions, input/output, task tokens, headers or credentials.
+
+Handler response variants must match the request operation. Encode only the selected DTO, preserving numeric timestamps, with a bounded8MiB writer before returning200; failure/oversize/mismatch returns static InternalFailure/500 without replaying a mutation. History pagination later caps each encoded page at4MiB and may return fewer than maxResults with a consistent continuation token; individual events are never split/truncated. Success/error responses carry JSON1.0 content type, x-amzn-requestid and server headers; errors use short __type/message plus x-amzn-errortype. Handler messages are bounded to1KiB; invalid error status/message becomes InternalFailure. IO/JSON/auth sources are retained but never copied to public diagnostics. Final monotonic deadline checks prevent a late result becoming success. Dropping/timing out the HTTP waiter does not authorize rollback/cancellation of accepted core commands; the actor owns execution lifetime.
+
+The embedding gateway owns bounded connection/request admission; this service spawns no per-request work. Tests cover all typed action mappings, empty/normal JSON, header ambiguity and nonfallthrough claims, body limits/slow progress, duplicate/unknown keys, operation-specific bounds, signature/service/region/target binding, static error envelopes, response correlation/byte limits, and deadline/abandoned caller behavior. The network fixture owns all connection tasks in a JoinSet, signals stop on shutdown, and retains its root JoinHandle after a cleanup-waiter timeout so the same join can resume. An ordinary SDK against a controlled typed handler can qualify this transport only; it cannot satisfy registry, ASL or Lambda-execution acceptance.
+
+### 1.3 Retained real API adapter and preparation
+
+The binary-support `stepfunctions_api` module implements StepFunctionsHandler over the real core Registry; it never imports Lambda-core or supplies an executor fallback. Its constructor receives validated scope, actual compiler TaskSupport and Registry, returning an Arc handler plus a unique ApiSupervisor. Main routing/configuration remains a separately verified composition consumer. All15 M1 operations use real core semantics. With the registered callback owner installed, the three M3 callback actions follow§1.4; unbound registries return UnsupportedOperation after common request validation. Main activation/configuration and handler-originated SDK acceptance remain separately qualified.
+
+Before queueing, validate trusted RequestContext scope/deadline; the HTTP boundary already bounds decoded DTOs. The retained CPU preparation revalidates all Request field/count/JSON bounds before domain submission, including trusted typed callers. Scope mismatch is AccessDeniedException. Bounded accepted work defaults32 (1..128), CPU workers8 (1..32,≤accepted), pagination handles10,000 (1..100,000), incremental pagination bytes64MiB (8MiB..1GiB). Accepted admission remains charged through pending preparation, worker joins and unobserved replies; unexpected worker failure retains its slot. The root owns all jobs/slots above workers and preserves unresolved state on abnormal Drop/runtime loss. Clean shutdown joins the same jobs after closing admission; observer timeout never restarts work. Independent API close precedes registry close, followed by Lambda bridge/provider close.
+
+Compile/fingerprint definitions, parse business input, validate scoped ARNs/roles/tags/default settings and materialize bounded responses in retained spawn_blocking jobs under the shared CPU semaphore. A dropped HTTP future cannot detach unowned blocking work. CPU permits travel with ready results until consumption; per-request root admission bounds retained requests/large replies. Check the caller deadline before preparation and before registry submission. After submission, registry owns mutations even if reply observation expires; no rollback/replay occurs. Stop uses the owned registry Stop command and observes its atomic terminal boundary outside the metadata lane.
+
+STANDARD, logging absent/OFF, tracing absent/disabled and encryption absent/AWS_OWNED_KEY without KMS fields normalize to one effective profile. Reject EXPRESS, publication/version descriptions, enabled logging/tracing and customer encryption before idempotency or resource mutation. Update requires a definition or role (MissingRequiredParameter), including when unchanged default metadata is supplied, as specified by [UpdateStateMachine](https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateStateMachine.html). Describe supports absent/ALL_DATA; METADATA_ONLY is explicitly unavailable in this unencrypted profile rather than inventing a missing required definition. Reject MapRun/redrive/PENDING_REDRIVE and all unknown filters. Preserve trace metadata and raw input; never JSON-encode business output twice.
+
+ValidateStateMachineDefinition uses exactly the installing compiler, returns OK even with warnings, filters diagnostics by ERROR(default)/WARNING, applies0/default100/max100 and sets truncated after filtering. Invalid definitions return HTTP200 FAIL diagnostics, whereas unsupported API profile/invalid arguments return modeled errors. No validation operation creates resources. Describe-for-execution returns its captured definition/role/revision; omitted optional failure fields remain omitted. DescribeExecution includes supported input/output details with included=true and terminal status/date coherent with history.
+
+Generate common AccessDeniedException403, InternalFailure500, RequestTimeoutException408, ServiceUnavailable503 and ThrottlingException400 through service configuration, preserving generated-source ownership. These match [SFN common errors](https://docs.aws.amazon.com/step-functions/latest/apireference/CommonErrors.html). API preparation/admission overload uses ThrottlingException; invalid tokens use InvalidToken; registry create/start quota uses StateMachineLimitExceeded/ExecutionLimitExceeded. Tag operations map a missing resource to ResourceNotFound400 and a cumulative tag-count overflow to TooManyTags400, preserving the existing set atomically; an omitted tag value normalizes to empty. The action-specific missing-resource status follows [TagResource](https://docs.aws.amazon.com/step-functions/latest/apireference/API_TagResource.html), overriding the pinned model's generic404 default in the real adapter. Infrastructure errors carry static public messages and typed redacted sources. No handler echoes host/compiler payload text into infrastructure errors; bounded Validate diagnostics are deliberate API data.
+
+```text
+┌─ typed HTTP service ─────────────────────────────────────────────┐
+│ verified scope + deadline + bounded Request                       │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼ accepted slot retained above worker
+┌─ ApiSupervisor ──────────────────────────────────────────────────┐
+│ bounded worker JoinSet + root slots + actor-owned PageStore       │
+│    │                                                             │
+│    └─ worker → retained CPU prepare → Registry.submit             │
+│                    │                    │                        │
+│                    └─ page/response CPU ← immutable registry view │
+│                         PageStore cursor ↔ shared charged snapshot│
+│ close → join same workers → Clean / retained failed ownership     │
+└──────────────────────────────────────────────────────────────────┘
+```
+
+### 1.4 Registry-bound public callback adapter
+
+Install SendTaskSuccess, SendTaskFailure and SendTaskHeartbeat in the existing retained API owner when and only when its Registry has the actual callback registry installed by integrations§5.5/D66. Preserve constructor compatibility: derive both compiler capability and callback submission from the same Registry, without a separate caller-supplied registry/boolean that could route to another token epoch. Registry retains the immutable callback handle rather than a redundant capability flag and exposes a typed submit_callback command boundary bound to its own trusted scope. No callback command uses the ordinary metadata queue, creates a new token, reconstructs an execution or holds a Lambda dispatch permit. A closed/failed registry rejects new callback submission. Unbound registries keep all three APIs UnsupportedOperation and compiler callback support false. The actual main binding now consumes this adapter under operations§1.7/D68; pure/unqualified services remain rejecting and final image/platform/persistence acceptance remains separate.
+
+The retained CPU preparation validates the same bounded Request as other actions, converts the owned taskToken String into the noncloneable/nonserializable CallbackToken and prepares CallbackCommand. Move a validated owned token into SecretString; do not keep an extra plaintext credential copy for diagnostics. The raw bounded HTTP buffer/decoded request necessarily exists at ingress; zeroizing the owned domain token does not claim erasure of every wire-buffer copy. Success parses a UTF-8 JSON document≤262,144 bytes once into the existing Payload, preserving JSON scalar/array/object/null semantics without double encoding. Failure preserves omitted versus empty error/cause with256/32,768-byte limits. Heartbeat carries only the token. In the installed local profile tokens are64 lowercase hexadecimal bytes; malformed/unknown/foreign-scope tokens return InvalidToken. All preparation/error/request Debug remains redacted.
+
+Immediately before domain submission, refresh the caller deadline. Submit exactly once through Registry.submit_callback and observe its retained CallbackAck with the same absolute deadline. Dropped/expired HTTP observation never revokes the token, undoes the callback or resends it. Already accepted token actions remain callback-actor-owned; API shutdown joins its retained workers before registry/token shutdown. Actual callback-result finality still depends on the real invocation report, and successful SendTask acknowledgment need not imply the ASL execution is terminal or physically clean. Preserve callback-root errors as typed sources with static public text.
+
+Map recursive cached callback errors as follows: InvalidToken→InvalidToken400; TaskTimedOut→TaskTimedOut400; Data→InvalidOutput400; Validation→ValidationException400; Capacity→ThrottlingException400; Deadline→RequestTimeoutException408; Unavailable→ServiceUnavailable503; ownership/progress/worker/entropy/attempt inconsistency→InternalFailure500. Failure-field bounds remain ValidationException, independent of success JSON errors. Known completed/revoked/timed-out tokens remain TaskTimedOut through bounded tombstone retention; a fresh/foreign epoch token remains InvalidToken. Heartbeat reset does not create history or extend absolute Task duration.
+
+Return the correctly correlated generated empty output DTO internally; the HTTP success encoder emits status200, content-length0 and no body for the three callback variants, retaining normal content type/request-ID/server headers. Error bodies retain the existing bounded JSON envelope and all other action encodings stay unchanged. These shapes and limits follow [SendTaskSuccess](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html), [SendTaskFailure](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskFailure.html), and [SendTaskHeartbeat](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskHeartbeat.html), verified2026-10-26. The lowercase-hex local credential format and existing static common-error mappings are Rustack profile choices.
+
+```text
+Bounded HTTP / trusted typed caller
+  │ scope + caller deadline
+  ▼ retained API admission + CPU preparation
+  │ move secret token, parse success / bounded failure / heartbeat
+  ▼ Registry.submit_callback (same installed scope/epoch)
+  │ separate bounded callback command lane; submit exactly once
+  ▼ Callback actor: token hash → provisional action / terminal classification
+  │ retained acknowledgment, no business payload/token in response
+  ▼ typed empty DTO → HTTP200, zero-byte body
+  │
+  └─ abandoned/late observer: actor action stays owned; no revoke/replay
+```
+
+Acceptance: real typed HTTP→API→registered ASL tests for early/late callback success, explicit failure, heartbeat without history mutation, invocation failure overriding early success, Retry fresh-token isolation, Stop/expiry/closed-token responses, invalid/foreign credentials and invalid JSON/bounds; scope/deadline and shutdown/abandoned-observer tests; exact empty success wire metadata; error-source/redaction scans and all existing15-action/default-unbound regressions. Use a controlled observed port for adapter determinism and retain actual Native consumer acceptance independently. Both ordinary handler-originated SDKs and main-service capability/configuration/shutdown composition must pass before M3 release or callbacks=true publication.
+
+## 2. API coverage
+
+| Milestone | Operations | Required behavior |
+|---|---|---|
+| M1 | CreateStateMachine, UpdateStateMachine, DeleteStateMachine, DescribeStateMachine, ListStateMachines | Immutable revisions, STANDARD only, deletion lifecycle |
+| M1 | ValidateStateMachineDefinition | Same compiler as create/update; OK/FAIL, diagnostics, severity, maxResults, truncated |
+| M1 | StartExecution, DescribeExecution, ListExecutions, StopExecution | JSON strings, idempotency, asynchronous execution, single terminal settlement |
+| M1 | GetExecutionHistory, DescribeStateMachineForExecution | Read the revision captured by this execution, not latest |
+| M1 | TagResource, UntagResource, ListTagsForResource | Atomic validation; basic IaC create/read/update/delete coverage |
+| M3 | SendTaskSuccess, SendTaskFailure, SendTaskHeartbeat | Tokens bind to execution, scope and attempt generation |
+| M4 IaC | ListStateMachineVersions | Scoped existing unqualified machine; truthful empty version collection; no publication |
+
+Other known actions return HTTP400 local `UnsupportedOperation`, documented in capabilities; unknown actions return protocol UnknownOperationException. EXPRESS, qualified state-machine ARNs, version publication/mutation and alias requests are explicitly rejected. The read-only unpublished-version inventory described below is included. StartSyncExecution is not a shortcut for awaiting STANDARD workflows.
+
+Create/Update accept absent loggingConfiguration or level OFF. Enabled tracing, nondefault encryption and publish=true return ValidationException. roleArn is validated metadata, not IAM policy evaluation. Delete marks the machine DELETING, rejects new Start/Update, and lets accepted executions finish. When the last execution closes, remove mutable definition and tags; execution/history/name records retain their independent TTLs. Repeated deletion during DELETING is idempotent; after removal return StateMachineDoesNotExist.
+
+CreateStateMachine is idempotent for the same name, raw definition and supported effective type/logging/tracing/encryption/publication settings. A repeated request with different roleArn/tags returns the existing resource without modifying those fields; a conflicting definition returns StateMachineAlreadyExists. Validate unsupported fields before considering a request idempotent. This follows [AWS CreateStateMachine](https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateStateMachine.html). Explicit Update changes the latest revision and affects only subsequently started executions.
+
+StopExecution of RUNNING work requests cancellation and returns the committed stopDate after terminal settlement, bounded by the control deadline. A repeated Stop on an already terminal record returns its existing stopDate without rewriting outcome/history; an absent execution returns ExecutionDoesNotExist. Concurrent success/Stop settles once. If resource cleanup remains uncertain, retain quarantine ownership and expose failure diagnostics rather than rewriting a completed execution to RUNNING. Read/List operations validate every supported filter; version/alias/MapRun/redrive filters are rejected until implemented.
+
+## 3. Domain types and ownership
+
+Follow AGENTS.md § Type Design & API: private validated fields, TryFrom/FromStr, non-exhaustive public structs and redacted Debug. Multi-field construction uses typed-builder.
+
+| Type | Fields and invariants | Owner |
+|---|---|---|
+| TenantScope | Validated partition, region, account | Gateway creates; core revalidates |
+| StateMachineName / ExecutionName | 1–80 ASCII bytes, `[A-Za-z0-9_-]` | RegistryActor |
+| StateName | 1–128 UTF-8 bytes; no controls; exact matching without normalization | Compiler |
+| StateMachineArn / ExecutionArn | Structured `states` ARN, matching scope, ≤256 bytes | Boundary newtypes |
+| DefinitionRevision | Revision ID, original definition, hash, Arc<CompiledMachine>, role/config | Immutable Arc |
+| ExecutionRecord | ARN, captured revision, raw and parsed input, start/stop times, outcome | ExecutionActor |
+| TaskAttemptId | Execution UUID, frame, entry generation, retry ordinal, task UUID | Engine |
+| HistoryEvent | AWS event type/details, id, previousEventId, timestamp | Execution history owner |
+| ResourceHandle | Lambda invocation, owned child or callback handle | Engine; must be settled |
+
+ARN shapes are `arn:<partition>:states:<region>:<account>:stateMachine:<name>` and `...:execution:<machine>:<execution>`. No version/alias suffixes or MapRun labels initially. RegistryActor linearizes revision updates against execution starts.
+
+Validate execution-role metadata as an IAM role ARN in the same partition/account, with empty region, a bounded role path/name and≤256 total bytes. Do not parse it with the state-machine ARN grammar or accept arbitrary service ARNs. This is structural validation, not an AssumeRole operation or permission evaluation.
+
+Use `Running` versus `Terminal(Succeeded|Failed|TimedOut|Aborted)` domain states. Succeeded carries output, Failed/Aborted carry optional error/cause, and TimedOut carries neither; its DescribeExecution and ExecutionTimedOut details omit error/cause. This prevents combinations such as RUNNING with stopDate. Map to AWS RUNNING/SUCCEEDED/FAILED/TIMED_OUT/ABORTED; do not expose unsupported PENDING_REDRIVE.
+
+### 3.1 Executable registry ownership and resource lifecycle
+
+Implement a reusable core `Registry` handle plus unique `RegistrySupervisor`, backed by one bounded actor. Accept already compiled immutable machines and validated Payload values: parsing/compilation belongs to the embedding API's retained bounded preparation owner, never a hidden unbounded task per registry command. Registry does not implement an HTTP trait or advertise endpoints. The later binary adapter maps the15 M1 requests and installs the real Lambda bridge; no controlled handler is a production fallback.
+
+Provide private-field StateMachineName/ExecutionName (ASCII1..80), scoped StateMachineArn/ExecutionArn (whole string≤256, exact unqualified grammar), RoleArn and Tags. Parse ARNs with FromStr, build them from validated names/scope, and compare partition/region/account again at registry admission. Roles use IAM with an empty region and matching partition/account; nonempty slash-delimited visible-ASCII path components, final role name≤64 with IAM name characters and total≤256. Tags permit Unicode L/Z/N plus `_ . : / = + - @`, independent byte caps, at most50 and no case-insensitive aws: key prefix; reject duplicate keys in one mutation. Untag validates every key and the whole collection before mutation.
+
+Default caps:256 current machines,1,024 retained revisions and independently1,024 retained tag versions,10,000 retained execution records,100,000 names,128 accepted commands,24h execution retention. Allow respectively1..4,096 /1..4,096 /1..100,000 /1..1,000,000 /1..1,024 and60s..90days. The revision/record counts are allocation ownership limits, not exact byte-memory claims; existing hard compiled/payload/history limits still apply. Revision, tag-version and execution record permits stay inside shared immutable allocations, so a retained read view remains charged after deletion/expiry. Reserve a replacement revision before releasing the old one; reject saturation atomically. No premature live-record/tombstone eviction. A full accepted-command pool rejects synchronously; queue admission transfers command ownership independently of any response observer. A timed-out reply waiter can resume the same receipt; completion or sender closure consumes its receiver before returning, so repeated reads fail with a typed error.
+
+A DefinitionRevision retains a secure UUID, publication timestamp, SHA-256 of exact source bytes, compiled Arc and validated role. Create is idempotent for the same raw source under the supported effective STANDARD/OFF profile, ignoring replacement role/tags without mutating them. Unsupported wire settings must be rejected by the future adapter before entering this profile. Explicit Update creates a new UUID even for equivalent source and supports definition-only/role-only updates; tags remain separate. Scope and all fields validate before command enqueue and are rechecked at the actor boundary. Missing/deleting resources are typed distinct failures.
+
+Start receives an optional validated execution name, bounded parsed input and optional bounded ASCII trace header; omitted names use a secure UUID. The actor samples start clocks, captures latest revision, compares raw input for a still-running name, reserves record/name/runtime/history admission, constructs complete Execution/StateMachine context and registers the fresh driver without awaiting between claim and registration. On rejection no name/record is published; on success caller loss does not cancel it. A name for a closed execution always conflicts. Claims are keyed by execution ARN, so deleting/recreating a same-name machine cannot reuse that ARN during its tombstone. Captured resource UUID distinguishes old and recreated machine lifecycles.
+
+Expose immutable MachineSnapshot and ExecutionSnapshot values, including captured revision, raw input, trace/start dates, atomic engine view and a cloneable execution observer/control handle. Describe-for-execution reads that captured revision after updates/deletion. List snapshots are bounded actor-owned high-water captures for the later pagination adapter; a snapshot never rewrites a previously returned terminal view. Stop validates optional error/cause before enqueueing an owned Stop command. The actor signals the engine once; its caller awaits terminal publication on the independent control/read lane outside the registry actor, preserving omitted or explicitly empty fields. Dropping the Stop reply observer does not discard an accepted cancellation. Concurrent Stop/success and repeated Stop use the original terminal outcome/date.
+
+Maintenance reaps execution supervisor jobs, observes terminal publication, timestamps closure monotonically once, expires record retention only after confirmed cleanup and independently expires names no earlier than90days after observed closure. Pending/Quarantined cleanup retains its record/revision/name graph beyond those TTLs until physical settlement is proven. A1s timer plus command-boundary maintenance drives deletion: DELETING rejects Start/Update, allows existing executions, and removes mutable metadata/tags after its last captured resource execution becomes terminal. Cleanup may remain quarantined independently of business termination. Repeated Delete while DELETING succeeds; after removal it is absent. ListExecutions atomically requires a currently present machine (ACTIVE or DELETING), then returns retained records matching its ARN, including earlier incarnations. DescribeExecution still reads retained records after machine removal. This local reincarnation rule is explicit; the missing-resource error follows [AWS ListExecutions](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListExecutions.html). All list ordering is deterministic (machines by creation time/ARN; executions newest start/ARN first).
+
+Secure UUID entropy is acquired by at most one retained blocking preparation job, with the accepted envelope/permit held above that job in the root state; cancellation cannot manufacture worker completion. Definition hashes are prepared by the embedding caller before admission. Maintenance builds one set of running resource identities, avoiding a machines×records scan.
+
+Dropping the last Registry command handle disables its receive lane but does not close accepted execution ownership while RegistrySupervisor remains alive. Only explicit supervisor close/drop requests shutdown.
+
+Closing the unique supervisor rejects new commands, drains already accepted commands, closes the execution owner and joins the same work through observer cancellation/expiry. No HTTP/control timeout restarts an execution or grants rollback. The root owns mutable state through a Drop guard before spawn; abnormal cancellation/panic/runtime loss preserves the bounded unresolved graph as process-lifetime quarantine. Permanent execution quarantine fails shutdown and retains revision/record/name ownership. A clean joined shutdown releases registry allocations except caller-retained snapshots. Root Drop also synchronously closes the execution owner before retaining its unresolved graph. Debug/Display never expose role, names, ARN, tags, definition, input, tokens or host sources; typed sources remain internal.
+
+```text
+┌─ preparation owner (future binary API adapter) ───────────────────┐
+│ bounded compiler / Payload parse → validated domain commands      │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼ bounded accepted commands + replies
+┌─ RegistryActor + Drop guard ─────────────────────────────────────┐
+│ machines → Arc revision + retained permit                         │
+│ names (90d) ← Start transaction → records → captured revision     │
+│ Delete/Update/Tag          │          │                            │
+│ monotonic maintenance     ▼          ▼ immutable snapshots         │
+│                   ExecutionSupervisor → real LambdaTaskPort       │
+│ close → drain same runtime → Clean / retained quarantine          │
+└──────────────────────────────────────────────────────────────────┘
+```
+
+Qualification must cover concurrent raw-input idempotency, update/captured-revision isolation, delete/recreate names, omitted/empty Stop fields, cancellation after accepted commands, registration-failure rollback, independent record/name expiry, capacity held through retained snapshots, Unicode/duplicate/reserved tags, scoped ARN/role rejection, final history/view agreement and resumable shutdown. HTTP pagination, full SDK/main routing and final image/platform acceptance remain separate required consumers.
+
+## 4. Input validation and limits
+
+| Boundary | Validation |
+|---|---|
+| Control request body | Local 2 MiB limit, independently enforced before deserialization; JSON escaping counts toward this envelope limit |
+| Decoded definition | 1,048,576 UTF-8 bytes; duplicate keys rejected; JSON depth ≤64 |
+| Execution input/output and each transformation | 262,144 UTF-8 bytes; omitted input becomes `{}`, explicit empty string is invalid, JSON null is valid |
+| Input equality | Preserve decoded raw UTF-8 string; byte equality, without whitespace normalization |
+| ARN / trace / pagination token | 256 / 256 ASCII / 2,048 bytes |
+| Tags | ≤50; key 1–128 bytes, value 0–256 bytes; AWS tag character allowlist, reserved aws: prefix rejected |
+| Error / cause | 256 / 32,768 bytes; reject oversized client input; bounded internal causes carry an explicit truncation marker |
+| Compiled structure | ≤1,000 states total, machine nesting ≤16, ≤128 branches per Parallel, path ≤1,024 bytes, intrinsic expression ≤4,096 bytes |
+
+The 2 MiB envelope is a local transport policy, not exact AWS request-size parity; it can reject heavily escaped or metadata-heavy definitions despite their decoded size fitting. AWS's independent definition/payload quotas still apply. Payload strings allow legal JSON text; identifier ASCII restrictions must not corrupt business data. Every collection has count and aggregate-byte limits. Unknown API/config/ASL fields are rejected, not collected without bounds. Smaller local structural limits must appear in validation diagnostics.
+
+## 5. StartExecution idempotency and revision isolation
+
+Atomically reserve `(scope, machine identity, execution name)` and capture a revision. Validate input first, then look up the name. A RUNNING execution with identical raw input returns its original ARN/startDate, even after a definition update. Different input or any closed execution returns ExecutionAlreadyExists. Name tombstones last at least 90 days after closure, independently of shorter history retention. If tombstone capacity is exhausted, reject new starts rather than reuse names early. See [AWS StartExecution](https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html).
+
+Generate a secure random UUID when name is absent. Delete/recreate must not allow collision with an existing execution ARN; old tombstones continue blocking the corresponding ARN until expiry.
+
+Ordering: validate/compile → reserve admission → atomically claim name and create RUNNING record plus ExecutionStarted → register execution actor → return200. Registration failure rolls back the reservation and permits. A lost HTTP response does not undo a started execution. Disconnecting after Start never cancels it. Each execution uses its captured machine revision; Lambda alias resolution happens per Task attempt, as specified in the integration design.
+
+## 6. History and pagination
+
+History IDs increase from 1. previousEventId records the causal predecessor, not merely the most recently appended event across concurrent branches. ExecutionStarted has predecessor0 and includes the captured revision's roleArn for registry/API executions. The first root state entry also has predecessor0, matching the pinned AWS history observations; subsequent state/resource events retain their actual causal links. Low-level supervisor starts without registry role metadata may omit roleArn. Required events include ExecutionStarted/Succeeded/Failed/TimedOut/Aborted, Entered/Exited for supported states, LambdaFunctionScheduled/Started/Succeeded/Failed/TimedOut for direct integrations, and TaskScheduled/Started/Succeeded/Failed/TimedOut for optimized integrations. M2 adds official Parallel/Map/iteration event types and TaskSubmitted after an optimized .sync child is accepted, before its terminal result. Retry creates multiple task attempts within one state entry, not a fabricated AWS RetryScheduled event; internal retry scheduling belongs in tracing.
+
+The core implementation uses [ASL§3.2](./rustack-workflows-30-asl-design.md#32-supervised-sequential-runtime-and-history-publication): shared64-event immutable pages and charged retained views with terminal capacity reserved above worker lifetime. Its conservative data-disabled projection omits input/output and the optional optimized TaskScheduled details object containing required Parameters; this local metadata difference is documented rather than claimed as cloud differential evidence. Registry pagination and main-service registration remain separate acceptance gates.
+
+Append history, update read views and settle terminal state atomically within the owning actor. Once DescribeExecution observes termination, history contains its terminal event. API input/output remain JSON strings. includeExecutionData=false omits execution data consistently without changing event linkage.
+
+Use random opaque pagination handles backed by a bounded server-side registry. Bind scope, operation, filters, ordering, includeExecutionData and a read high-water mark. TTL is 24h. Stable execution sorting uses start time and ARN; history reversal uses event ID. Newly appended records do not change the cursor's captured boundary. History maxResults defaults to 100 and caps at 1000; 0 selects the default. Other list operations follow their Smithy limits. Expired, modified, cross-scope or argument-mismatched tokens return InvalidToken. Reject capacity exhaustion rather than evict live tokens.
+
+Cap each complete encoded history page at4MiB, including metadata and escaped JSON string contents. Return fewer than maxResults when needed, with a continuation token at the next event; never split or truncate an event. This leaves headroom below the transport's8MiB response cap.
+
+Keep at most 25,000 events, also constrained by per-execution/global byte budgets. Reserve one event slot and byte allowance for termination. Imminent exhaustion fails the execution with local `States.HistoryLimitExceeded`; never truncate history and still report success. This locally identified error is advertised as a limitation. Clean up expired terminal histories only; preserve independent name tombstones.
+
+### 6.1 Owned stable pagination and reverse history
+
+The API root owns the opaque-handle map on its existing actor lane. A bounded internal page-command channel serves accepted workers, avoiding a Mutex around pagination or core state. Generate32 random bytes in the retained blocking owner and return64 lowercase hex characters. Bind each token to scope-by-owner, operation, canonical resource, supported status filter, normalized page size, reverse order and includeExecutionData. Validate every supplied query before token lookup. Tokens are reusable and retain their immutable position/read high-water; reusing a token cannot switch to latest state. Each issued handle expires24h after issuance, including newly issued continuation handles; no live token is evicted to admit another.
+
+A first page captures the registry's stable machine/execution vector or one ExecutionSnapshot/history boundary. Subsequent tokens share one Arc<Snapshot> and a cursor index/event ID. New records/events, metadata updates, deletion and ordinary record expiry cannot alter that boundary. A continuation still works after mutable-resource deletion; new initial ListExecutions retains its atomic current-machine check. Filter execution status at capture time, not when each page is served.
+
+Charge incremental list-vector storage conservatively by checked Vec capacity×size_of(snapshot)+fixed overhead before retaining it in PageStore; shared metadata remains charged by core's revision/tag/record permits. Conservatively charge captured history bytes plus fixed overhead, in addition to core history accounting. The shared snapshot owns an aggregate-byte permit until its final in-flight worker/token reference drops. Token entries add bounded fixed metadata under the independent handle-count cap. This prevents many initial reads from multiplying uncharged high-water vectors; pages in one chain share allocation. API admission separately bounds transient registry replies/response DTOs. Capacity rejection never truncates a record or evicts an unexpired cursor.
+
+GetExecutionHistory supports ascending and descending event IDs over the captured high-water. Extend core history with page_reverse(lastInclusive,limit,includeData), reusing the same complete4MiB writer allowance/projection and causal IDs. Reverse empty history uses last=0; otherwise require1..len. Return the next lower inclusive ID or no cursor at ID1. Event ordering, not wall-clock regressions, determines stable traversal. The existing4MiB allowance reserves256 bytes for envelope/token overhead; no single event is split. Lists have at most1,000 bounded metadata DTOs per response. Primary contracts: [GetExecutionHistory](https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetExecutionHistory.html), [ValidateStateMachineDefinition](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ValidateStateMachineDefinition.html).
+
+Qualify all15 modeled real-handler mappings, atomic invalid-profile rejection, numeric dates/JSON strings, revision/Stop/history agreement, default/filter/diagnostic bounds, page replay/high-water stability, forged/modified/cross-operation/argument-mismatched/expired tokens, count/byte saturation, data-disabled/reversed complete history, caller loss, retained blocking work, root failure and resumable shutdown. Real provider/Native HTTP SDK qualification is separate from controlled transport tests and remains required for service acceptance.
+
+## 7. Rust engineering contract
+
+AGENTS.md § Error Handling: thiserror StepFunctionsError with source errors, mapped to protocol code/status without credentials, Docker internals or host paths. § Async & Concurrency: actor-owned registry/history, bounded mpsc/oneshot and supervised JoinSet; no Mutex-wrapped engine. § Type Design/Safety/Serialization: validated newtypes, checked arithmetic, forbid unsafe, immediate schema validation. § Testing: rstest error matrices and proptest ARN/idempotency/event-chain invariants. § Logging: typed IDs and redacted Debug, never input/definition/token. § Performance: Arc revisions and Bytes for original data. § Documentation: public API examples, Errors sections and ownership documentation.
+
+## 8. Cross-references
+
+- ← [PRD](./rustack-workflows-00-prd.md)
+- → [ASL](./rustack-workflows-30-asl-design.md), [integrations](./rustack-workflows-40-integrations-design.md)
+- ↔ [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md), [decisions](./rustack-workflows-99-decisions.md)
+
+
+## D97 unpublished version inventory for real IaC consumers
+
+The actual pinned Pulumi AWS7.52.1 provider performs ListStateMachineVersions while reading a normally created, unpublished machine. Support that read without enabling version publication: validate the request wire fields, parse the unqualified state-machine ARN in the caller tenant scope, and linearize an existing-machine read through RegistryActor. Return HTTP200 `{"stateMachineVersions":[]}` without nextToken because every supported machine has zero published versions. Missing resources return StateMachineDoesNotExist; malformed/qualified/foreign-scope ARNs return InvalidArn. DELETING machines remain readable until the mutable record is removed. Any supplied continuation token returns InvalidToken; this API never issues one and never reserves a cursor. Bound ARN1..256 bytes, maxResults0..1000 (0/default has the AWS default meaning), nextToken1..1024 ASCII bytes before domain preparation. Extra/invalid fields remain rejected. No registry mutation, revision/tag change, version persistence or fake published-version object is introduced. Publish=true and all publish/delete-version/alias actions retain explicit rejection.
+
+This narrow compatibility follows the actual [ListStateMachineVersions wire contract](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachineVersions.html) and the [requirement to publish before versions exist](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-version.html). Required tests cover typed transport, real API→registry existence/scope/qualified ARN/token/page bounds, empty output through creation/update/deletion and unchanged revision/tags after rejected publication, plus the actual provider lifecycle.
diff --git a/specs/rustack-workflows-20-lambda-runtime-design.md b/specs/rustack-workflows-20-lambda-runtime-design.md
new file mode 100644
index 00000000..275534bf
--- /dev/null
+++ b/specs/rustack-workflows-20-lambda-runtime-design.md
@@ -0,0 +1,1538 @@
+# Workflows 20: Docker Lambda Execution Environments
+
+Status: implementation contract; relay feasibility validated with platform qualifications · Depends on: [PRD](./rustack-workflows-00-prd.md), [Lambda hardening](./rustack-lambda-hardening-design.md)
+
+Current platform scope: [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation. Historical/native-x86 pending clauses do not impose new runner or test requirements; existing architecture support and completed evidence remain. Required arm64/Desktop/rootless/reference and other release gates still apply.
+
+## 1. Ownership and execution contract
+
+Extend `rustack-lambda-core::executor` with DockerExecutor implementing the existing Executor interface. Lambda provider remains the only invocation entry point: HTTP Invoke, Step Functions and future event sources share version resolution, reserved concurrency, 32 global execution permits, default 8 permits per logical function, and 128 accepted asynchronous-work slots. Bridges must not bypass the provider by invoking an executor directly.
+
+Add a small Linux `rustack-lambda-runtime` relay artifact. It serves the standard Runtime API inside the execution environment and exchanges private control messages over Docker attach. Extract reusable RuntimeSession state logic: Native retains its host TCP adapter, while Docker uses the environment-local adapter. Do not embed RIE or rewrite user images.
+
+```text
+┌─ Rustack host / Rustack server container ───────────────────────────┐
+│ Lambda provider → WorkSupervisor → DockerExecutor/PoolActor        │
+│ immutable revision                  bounded commands / JoinSet    │
+│                                       ▼                           │
+│ Docker Engine API client: Unix socket, API negotiation             │
+└─────────────────────────────┬──────────────────────────────────────┘
+            Docker attach stdin/stdout: non-TTY, framed CBOR
+┌─ Docker daemon trust boundary▼─────────────────────────────────────┐
+│ ┌─ one execution environment / independent network namespace ─────┐│
+│ │ relay container                 function container              ││
+│ │ RuntimeSession actor            original user image digest       ││
+│ │ 127.0.0.1:9001 ◄── Runtime API ─ RIC / custom bootstrap           ││
+│ │ owns netns                      network=container:<relay-id>    ││
+│ └──────────────────────────────────────────────┬───────────────────┘│
+│ no published Runtime API ports                 │ SDK → Rustack     │
+│ private user bridge / operator network ────────┘ gateway endpoint  │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+The two containers share only the network namespace, not PID/mount namespaces, Docker sockets or host directories. Access to one's own Runtime API is intentional; other environments cannot reach that loopback listener. Do not publish Runtime API ports, use host networking or authenticate by NAT source address. Host and server-in-container modes use the same control path. Configure DNS/extra-host entries on the relay/netns owner; Docker rejects these options on a function using network=container:<relay-id>. [Docker networking](https://docs.docker.com/engine/network/) documents the foundation; the entire composition remains subject to actual platform tests.
+
+Cost: two containers per warm environment. Each relay has a separate 64 MiB memory, 64 PID and 0.1 CPU cap. A 32-environment limit therefore permits at most 64 environment containers, with aggregate memory admission including relay overhead. Record the tradeoff in D2. If P0 invalidates the composition, revise this design and rerun its gate; do not silently substitute an exposed host listener.
+
+## 2. Image resolution and deployment lifecycle
+
+### 2.1 Immutable artifacts
+
+Replace mutually inconsistent execution-request Option fields with `DeploymentArtifact::Zip(ValidatedArtifact)` or `Image(PinnedImage)`, preserving public wire schemas. ExecutionRevision captures function resource UUID, resolved version, artifact/digest, architecture, ImageConfig, environment fingerprint, memory, timeout, ephemeral storage and backend policy. Use typed-builder for multi-field construction.
+
+Keep the caller's requested function ARN/reference separately from the resolved numeric version. Runtime Invoked-Function-Arn preserves the invoked qualifier, while ExecutedVersion identifies the actual version. Environment reuse keys use resolved identity rather than the mutable alias string. Image CodeSha256 is the base64 canonical inspected execution fingerprint, independent of the requested tag text; CodeSize uses proven unpacked storage bytes (§2.9), and never claims to be a ZIP byte count.
+
+ResolvedImage records requested reference, registry manifest digest when available, daemon content image ID, platform and inspection metadata hash. Invoke by content ID/digest, never by a freshly resolved tag. GetFunction.Code.ImageUri returns the requested reference; ResolvedImageUri returns repo@digest for registry images. A local unpushed image uses the explicitly local extension `local://sha256:<content-id>`; never invent an ECR manifest digest. Snapshots preserve this distinction; restoring such an image on another daemon requires importing the same content ID.
+
+References are≤1,024 bytes and follow a bounded OCI/Docker repository/tag/digest grammar. Reject URL schemes, userinfo, controls and shell syntax. Local short names and non-ECR registries are advertised local extensions. Unchanged ECR references work with preloaded images or an allowed pull policy; Rustack does not emulate ECR.
+
+Pulling is disabled by default. Enabling it requires an explicit registry allowlist and total timeout. The daemon performs network pulls. Registry credentials must be supplied through operator configuration; never automatically read host AWS credentials or execute shell credential helpers. Allowlist enforcement governs references submitted by Rustack; daemon-side mirror/DNS/redirect policy remains an operator responsibility and is not an SSRF guarantee.
+
+### 2.2 Create, update and publication
+
+Create(Image) rejects Runtime/Handler, defaults omitted Architectures to [x86_64], requires exactly one architecture after normalization, and rejects explicitly empty or multi-element lists. It checks mutually exclusive Image/ZIP/S3 code sources, and validates ImageConfig/environment. Reserve function identity and a deployment-work slot, return Pending, then resolve/pull/inspect on a bounded worker. Validate Linux OS, architecture and executable entry configuration before atomically making the revision Active. Failed deployments retain Failed plus bounded reason/code for inspection; Invoke rejects Pending/Failed. Deployment resolution requires available Docker; disabled execution never yields a falsely executable image revision.
+
+Validate function MemorySize in 128..10,240 MiB, Timeout in 1..900 seconds, and EphemeralStorage in 512..10,240 MiB before allocation. User environment has at most 128 pairs; keys are 2..64 ASCII bytes matching `[A-Za-z][A-Za-z0-9_]+`, individual values are≤4,096 bytes and the total remains≤4 KiB. The key/count limits are local restrictions. Function name/qualifier/artifact validation remains governed by Lambda hardening. Parse error payloads only within their 32 KiB allowance; stackTrace has≤100 entries, each≤1,024 bytes, also constrained by that total.
+
+UpdateFunctionCode keeps the previous revision usable while LastUpdateStatus=InProgress. Success atomically replaces latest; failure preserves the old digest/config and exposes a failed-update reason. RevisionId compare-and-swap prevents concurrent overwrite. Initial release rejects Image Create/Update with Publish=true using InvalidParameterValueException: asynchronous resolution cannot safely return a published version within the control deadline. This is a documented local limitation. A separate PublishVersion succeeds after Active/Successful and captures the resolved image and configuration.
+
+Tag movement never changes deployed code. Published versions are immutable; aliases move references. Update/delete/recreate cannot reuse an old environment. In-flight calls keep their captured revision. Reject package-type changes. DryRun validates input, function/qualifier and permission shape without starting a container or executing code.
+
+### 2.3 Platform and entry configuration
+
+Map x86_64 to linux/amd64 and arm64 to linux/arm64. Guarantee native architecture only. Reject cross-architecture calls unless the operator explicitly enables emulation; do not promise emulation performance/parity. Registry manifest lists select exactly one matching platform and pin its child manifest digest. Inspect local image architecture rather than trusting the declaration.
+
+Inherit Dockerfile ENTRYPOINT, CMD and WORKDIR, then override only explicitly supplied ImageConfig fields. Missing and explicitly empty arrays differ. WorkingDirectory is an image-internal absolute path≤1,000 bytes, not a host path. Each argv list has≤1,500 elements, each≤4,096 bytes and the combined argv bytes≤64 KiB locally. Pass JSON argv directly, never sh -c. Do not force CMD=bootstrap. P0 must prove official Lambda images enter their RIC path when AWS_LAMBDA_RUNTIME_API is set.
+
+### 2.4 Invocation capture and resource identity
+
+A function receives a nonnil random FunctionResourceId on creation, independent of its name, version and configuration RevisionId. Updates and publication preserve that resource identity; deletion followed by recreation receives a new one. Store mutation cannot change it. Snapshots preserve it; importing an older snapshot without this field assigns an identity once for the restored resource, never once per invocation. An explicitly malformed or nil saved identity rejects restore.
+
+The provider captures the resource identity, resolved revision, complete ImageConfig (including omitted versus empty argv) and ephemeral storage before submitting work. The Runtime API invoked ARN is the function's canonical ARN with the caller's requested qualifier, if any. Alias invocation therefore reports `:prod` to the handler while ExecutedVersion reports the resolved numeric version. An unqualified request reports an unqualified ARN; explicit `:$LATEST` remains explicit. Pool reuse uses resource and resolved execution configuration, never the invoked alias. Requests' Debug representations redact environment values, payload, archive bytes and image argv; fingerprints may consume those values internally but must not be logged.
+
+P1 task1.1 lands this capture contract before the artifact-enum and cooperative-cancellation consumers. Its regression tests cover delete/recreate isolation, snapshot identity preservation and rejection, alias versus resolved version, configuration capture and redacted diagnostics. These foundation checks alone do not close M0.
+
+### 2.5 Captured artifact representation
+
+InvokeRequest carries one DeploymentArtifact instead of independent package-kind/path/archive/image options. A Zip variant owns a cloneable ValidatedArtifact lease: its extracted root, raw Bytes and content hash refer to the same successfully staged archive. Only FunctionStore issues leases after ownership and filesystem validation. The last store/invocation lease owns directory cleanup, so dropping the store cannot remove code still used by an invocation. Staging shares Bytes instead of retaining a second archive allocation.
+
+Validate each revision's normalized settings before downloading or staging its code. A code-source fetch has a hard 30-second deadline before staging; a paused-clock regression verifies stalled fetches leave no artifact. A newly registered ZIP belongs to an unpublished-artifact guard until the resource insertion or revision compare-and-swap succeeds. Failure, conflict or cancellation drops the guard, unregisters that new artifact and releases its directory; committed artifacts are unaffected. Snapshot restoration holds all new guards until the entire candidate store validates and commits. A rejected restore releases its new code without changing live resources. Hashing runs on the staging worker, not under a store mutation lock. Native's child supervisor retains an artifact lease until the child exit is reaped, including after the requesting store is dropped.
+
+```text
+Provider / restore          Store + staging worker            Artifact ownership
+ │ 1. validate settings            │                                  │
+ │ 2. stage shared Bytes ─────────▶│ private directory + digest         │
+ │◀── unpublished guard ──────────│─────────────────────────────────▶│
+ │ 3. validate record + insert/CAS │                                  │
+ │── failure/conflict/cancel ──────┼── drop guard → unregister → remove │
+ │── success → commit guard ──────▶│ store retains artifact lease       │
+ │ 4. capture invocation ─────────▶│ clone validated lease ────────────▶│
+ │                                │ native child also retains lease   │
+ │ 5. store/request release        │ child exit → last lease → remove  │
+```
+
+An Image variant carries a live PinnedImage with immutable ResolvedImage metadata, never a mutable tag alone. Its validated metadata contains the requested ImageReference, daemon SHA-256 content ID, optional repository/manifest reference, Linux architecture, inspection SHA-256 and inspected size. Digests use exactly 64 lowercase hexadecimal digits; inspected image size is bounded to 10 GiB locally. ImageReference accepts bounded Docker repository components, tags, SHA-256 digest suffixes and explicit DNS/IPv4/bracketed-IPv6 registry ports; URLs, userinfo, controls, invalid separators and empty components reject. Repository names are≤255 bytes and the whole reference≤1,024 bytes. Registry DNS labels are≤63 bytes; explicit ports use at most five decimal digits in1..65,535, an advertised local restriction. Bracketed IPv6 uses hexadecimal/colon syntax, excluding zone identifiers and dotted mapped forms. Follow the [distribution reference grammar](https://github.com/distribution/reference/blob/main/regexp.go), implemented with the pinned winnow parser rather than shell parsing. References are parsed again on deserialization. Missing resolution metadata cannot become an executable image; an existing metadata-only image record fails invocation explicitly until its deployment is resolved.
+
+Artifact replacement does not change public AWS wire shapes. Native and Squib accept only Zip and consume its lease; Docker accepts Image in M0 and adds Zip in M4. The resolved architecture is a closed x86_64/arm64 enum, not an unchecked list. Capture validates numeric settings and full image overrides before work admission. No per-invoke image inspection or pulling is introduced by this contract.
+
+### 2.6 Execution revision ownership
+
+ExecutionRevision groups resource/revision identity, resolved version, artifact, architecture, runtime/handler, complete image overrides, environment, timeout, memory, ephemeral storage and selected backend policy. InvokeRequest carries an Arc of that captured revision plus the requested invocation ARN, payload Bytes and log-capture flag. Cloning a request shares revision storage; aliases and subsequent function updates cannot modify captured configuration. Runtime API metadata uses the requested ARN while backend results use the revision's resolved version. Warm identity includes the captured backend policy as well as resource/configuration identity. Debug on both types redacts user environment, argv, code and payload data. Native/Squib consume the same revision object.
+
+### 2.7 Cancellable invocation and supervisor contract
+
+Provider start_invocation returns an InvocationHandle after shared admission. The handle exposes its attempt UUID, wait, cancel, cancel_and_wait(cleanup deadline) and detach. Waiting returns typed ExecutorError outcomes; the existing HTTP Invoke maps these through its existing Lambda service error conversion. Event Invoke detaches only after admission succeeds. Dropping an attached handle signals cancellation, never aborts the worker. A wait deadline may return before cleanup; cancel_and_wait reports success only after cleanup and permit release. Its timeout returns CleanupFailed while ownership remains with the supervisor.
+
+InvocationContext carries the same attempt UUID to the backend/Runtime API, an absolute monotonic deadline and a dedicated cancellation watch channel. The total deadline starts at admission, includes queue/cold start and is bounded by any caller Task deadline. Handler timeout remains separate. Admission checks backend availability against the captured request before accepting work. Unsupported backend/artifact combinations cannot return an accepted Event response.
+
+A lazily started WorkSupervisor actor owns the bounded submission mailbox, JoinSet and cancellation registry. Existing limits remain128 accepted jobs,32 executing jobs and default8 per logical function across versions. A priority shutdown signal cannot be starved by submissions. Draining closes admission, finishes accepted work, and requests cancellation if its deadline expires. The actor continues owning cleanup after a quiesce waiter is dropped or times out. Worker panic or uncertain cleanup stops admission and prevents successful quiescence. Supervisor Drop signals stop; normal shutdown awaits settlement.
+
+Native cancellation kills and reaps the owned child, drains log tasks and releases its process reservation before signaling clean settlement. Successful instances rejected by a full/disabled warm pool also retire before invocation settlement. Admission rejects declared host-architecture mismatches before accepting an Event; executable-file validation remains asynchronous. Executor Drop initiates retained process cleanup rather than aborting child supervisors.
+
+Squib cancellation must retain its startup/VM ownership and await VM shutdown; never cancel/drop SquibBuilder::spawn or Squib::shutdown as a cleanup strategy. Inspection of the pinned Squib0.2.0 facade shows startup and shutdown temporarily own join handles across awaits, so dropping those futures is not a join/cleanup proof. A caller deadline does not authorize losing those futures. Squib guest cancellation retires/poisons that VM rather than reusing a possibly busy guest. Idle and busy VM owners use the same retained shutdown path, including executor Drop. Cleanup owners capture the parent Tokio runtime handle so transfer does not require Drop to run in an entered runtime context; normal service shutdown must await cleanup before stopping that runtime. The configured Squib shutdown budget bounds waiters, never the owned shutdown future. Expiry returns CleanupFailed, retains shutdown ownership and prevents successful quiescence.
+
+```text
+Caller / HTTP            WorkSupervisor actor             Backend supervisor
+ │ start ───────────────▶│ reserve / capture attempt             │
+ │◀── handle + UUID ─────│ spawn owned worker ──────────────────▶│
+ │ drop/cancel ──────────┼── watch signal ──────────────────────▶│
+ │ wait deadline → error │ worker remains owned                 │
+ │ cancel_and_wait ─────▶│                         kill / shutdown / reap
+ │                      │◀── confirmed cleanup ────────────────│
+ │                      │ release execution + accepted permits │
+ │◀── clean settlement ─│                                      │
+ │ cleanup deadline     │ retain worker or backend quarantine   │
+ │◀── CleanupFailed ────│ prevent false successful quiescence   │
+```
+
+### 2.8 Local image resolution and selected platform identity
+
+ImageResolver::new(DockerPort) exposes resolve_local(reference, architecture, ImageConfig overrides, deadline) → ResolvedImage. ImageMetadata also owns validated ImageExecutionDefaults (normalized inherited argv/workdir/environment/user); captures and snapshots retain these values, not only their hash. Debug redacts them and deserialization revalidates their bounds. It performs inspection only, never pulls, builds, reads credentials or mutates daemon resources. The deployment actor owns its bounded work slot and publication/CAS; later allowed-pull resolution must reuse this validation path. Cancellation or expiry of this read-only operation cannot publish a late result. Recheck the absolute clock before and after metadata validation/fingerprinting.
+
+First inspect the requested reference once and capture its canonical, addressable daemon Id. On negotiated API≥1.49, inspect that captured immutable Id with a percent-encoded JSON OCI platform containing exactly os=linux and architecture=amd64/arm64, avoiding a second lookup of the mutable tag. Retain the addressable image_id and optional selected_manifest digest separately: a selected child Id returned by containerd inspection is not necessarily independently addressable for create. Every environment create supplies the captured image_id plus the explicit linux/amd64 or linux/arm64 platform parameter; it never substitutes an unqualified tag or assumes the child digest is a local image object. Older APIs retain single-platform inspection only with verified classic-store evidence. Validate the resulting OS/architecture, positive size≤10GiB and canonical SHA-256 Id. If a Descriptor is present, accept only OCI image-manifest or Docker schema2 image-manifest media types, canonical digest and a compatible optional platform. Reject index/manifest-list/attestation/unknown descriptors. A platform-selected containerd Id may be a child manifest digest rather than the legacy config digest. Validate that returned Id, but use the captured addressable parent Id for create and retain the selected descriptor digest for identity/hash checks. Never create from a parent index without the declared platform. Reject explicit nonempty Manifests in the descriptor-free fallback. Require matching classic GraphDriver and /info driver names from overlay2/aufs/btrfs/devicemapper/vfs/zfs/fuse-overlayfs, well-formed bounded DriverStatus rows and no io.containerd.snapshotter.v1 driver-type marker. Normalize missing/null DriverStatus to empty after matching classic evidence, since classic VFS legitimately reports no status rows. A missing Descriptor or nonempty GraphDriver alone is insufficient. Ambiguous/downlevel containerd resolution fails explicitly rather than choosing the daemon default platform.
+
+RepoDigests has≤128 validated digest references. Repository identity comparison applies Docker familiar-name normalization: absent registry defaults to docker.io, index.docker.io aliases docker.io, and a one-component Docker Hub repository gains library/. Registry host comparison is ASCII case-insensitive; repository paths remain case-sensitive. The original request spelling determines the short-local URI extension before normalization. A requested digest must match the selected descriptor digest or an advertised parent RepoDigest for the same repository; otherwise fail inspection. For explicit registry-domain references with matching repository evidence, use that repository plus the selected descriptor digest as registry_manifest; a legacy descriptor-free image may use a matching manifest RepoDigest, choosing the requested digest or otherwise a deterministic lexical digest. Do not use a digest from an unrelated alias/repository. A short local reference always uses registry_manifest=None and local://Id, even if BuildKit has populated RepoDigests. The returned registry URI reflects daemon metadata, not a network publication/existence check. The captured addressable Id must remain available through the deployment/version/artifact lifetime. The owned availability lease/pin policy in §2.9 must be retained by the deployment actor; tag movement must never cause it to execute a newer image. Missing externally removed content fails explicitly. ImageMetadata.size_bytes retains the selected daemon-reported Size, whose containerd representation can be compressed content rather than unpacked size. API CodeSize uses the separate proven unpacked size from §2.9. The deployment actor must obtain this proof before Active; the read-only local resolver alone does not establish the10GiB unpacked-image quota.
+
+Validate inherited ENTRYPOINT/CMD with the same argv limits as function ImageConfig, preserving omitted versus explicitly empty overrides. Docker's single-empty-entrypoint reset means no entrypoint. Compose the effective entrypoint+command, require its first executable argument to be nonempty, and reject NULs/bounds before publication; do not require a shell or bootstrap name. An absent/empty inherited working directory means Docker's root default; an explicit override still must be absolute. Inherited image Env is≤128 entries,≤4KiB per entry and≤64KiB total, with no NUL; image Env is distinct from the function's stricter4KiB environment budget. Validate a bounded ASCII environment key of1..256 bytes before `=` (or a key-only deletion marker); preserve ordered values for Docker semantics. Image USER is bounded≤256 printable ASCII bytes. Reject image-declared VOLUMEs in this local profile: automatic anonymous writable mounts would bypass rootfs/tmpfs policy. The eventual container builder must also disable image healthchecks and apply the specified nonroot-user policy.
+
+ImageExecutionDefaults::plan(overrides) validates the complete composed argv, including combined inherited/overridden byte budgets, and returns an immutable redacted ImageExecutionPlan. The plan materializes ENTRYPOINT, CMD and WORKDIR; it never relies on daemon fallback. Encode a semantic empty ENTRYPOINT as the Docker reset sentinel [""], preserve a nonempty entrypoint, and always send the full command array even when empty. This prevents Docker from re-inheriting CMD when the request entrypoint is empty. No per-invoke inspect is permitted. Empty inherited argv can be supplied by valid function overrides, but malformed inherited strings/directories remain invalid even when no default executable exists. Reject saved image metadata without validated execution defaults; older metadata-only records require deployment resolution rather than pretending to be executable.
+
+```text
+┌─ read-only image resolution ─────────────────────────────────────────┐
+│ bounded platform inspect → child identity + validated defaults       │
+│                                      │ stable base fingerprint      │
+└──────────────────────────────────────┼───────────────────────────────┘
+                                       ▼
+┌─ immutable ResolvedImage / captured revision / snapshot ─────────────┐
+│ Id + platform + URI evidence + defaults (argv/env/user redacted)      │
+│                                    │ captured function overrides    │
+│                                    ▼                                │
+│                         validated materialized plan                 │
+└────────────────────────────────────┼────────────────────────────────┘
+                                     ▼
+┌─ future environment owner ──────────────────────────────────────────┐
+│ create by selected Id; full argv/workdir; empty entrypoint=[""]    │
+│ security/resource policy + fixed environment injection separately   │
+└────────────────────────────────────────────────────────────────────┘
+```
+
+Fingerprint a versioned, explicitly ordered serialization of captured addressable Id, retained selected_manifest digest, Linux architecture, inspected size and normalized inherited execution fields (entrypoint, command, root-default workdir, ordered environment, user). Exclude tags, unrelated RepoDigests, labels, creation timestamps and map iteration order. ImageMetadata::execution_fingerprint centralizes bounded SHA-256 serialization; ResolvedImage construction/deserialization recomputes it and rejects inconsistent metadata, including valid-string execution-plan mutations. No raw argv/environment or metadata is logged. Function overrides remain captured separately in ExecutionRevision and do not change the base inspection fingerprint. Invalid overrides fail before daemon IO. Fake-daemon tests cover platform query/version fallback, every rejection, deterministic identity under tag/label/RepoDigest ordering changes and explicit-empty overrides. Real wire qualification must create/run the function and relay using identities returned by this resolver.
+
+### 2.9 Owned image pins and deployment preparation
+
+ImageLeaseManager is a retained actor above DockerWire. ImageLeaseConfig validates1..8192 total pins (default1024),1..32 accepted preparation jobs (default8,≤pin capacity) and1..60s independent Docker IO budget (default5s). These map to validated operator budgets; no process environment is mutated. ImagePinScope retains the actual DirectoryLease defined in [§4.1](#41-persistent-directory-lease-and-namespace-capability), which supplies nonnil owner/run UUIDs and holds namespace exclusion. Only the internal image owner allocates pins. Each pin allocates a fresh UUID before any mutation; its only possible alias is rustack-internal/lambda-<owner>/<run>:<pin>, with lowercase simple UUIDs. ImagePin has no arbitrary-string constructor/deserializer. Wire tag/remove APIs accept this type; removal never targets an operator source reference, bare content ID or a generic image filter. Request removal uses force=false/noprune=true. Daemon collection of content with no remaining references is separate from Rustack deleting operator tags or pruning other images.
+
+The cloneable preparation port accepts a validated reference, architecture, optional ImageConfig and absolute deadline. Reserve both a preparation slot and a pin slot before bounded mailbox admission; accepted-plus-running preparations cannot exceed their configured budget. A cancelled/expired/closed request before mutation releases those reservations. Workers resolve read-only metadata, record the expected addressable parent ID, then issue tag under an independent bounded IO budget retained across caller cancellation. Validate the private alias resolves to that exact parent. Measure unpacked size before publishing a PinnedImage. Recheck caller deadline/cancellation before success. This is preparation only: the deployment actor still owns Pending/Active/update status, resource/revision CAS, allowed pulls and rollback on stale results.
+
+PinnedImage is a closed live artifact containing immutable ResolvedImage, validated positive UnpackedImageSize≤10GiB and a shared lease. Its Debug excludes image defaults/argv/environment. Clones retain the private alias; the last lease closes a release channel. ImageLeaseManager retains every worker and pin reservation through actual cleanup. A cancelled response waiter cannot orphan a completed image sitting in its response channel. Capture must eventually use this leased artifact; serialized metadata alone is insufficient to authorize Docker execution. Snapshots serialize metadata and must reacquire/revalidate image availability during restore, not deserialize a live lease.
+
+For modern stores, inspect manifests=true by the captured immutable parent ID (never the user tag). Find exactly one available image-kind summary whose canonical ID and descriptor digest equal selected_manifest and whose image platform matches Linux/architecture. Require a positive ImageData.Size.Unpacked≤10GiB. Reject attestations, duplicates, incomplete content, incompatible platforms and missing/zero/negative/oversized unpacked proof. This reported unpacked-storage measure is the local quota; do not add compressed Content to it or confuse Total with it. For descriptor-free images verified as classic by §2.8, use the classic inspect Size. Recheck deadlines before returning the validated size. No function code or probe container is run by preparation.
+
+Cleanup invalidates the lease, verifies alias identity and removes only that private alias, then confirms absence after all possible create effects are settled. A fully acknowledged tag is known created. Exact fresh-alias HTTP400/404 from the trusted Engine and wire Busy admission failure prove no tag was committed and release that reservation. Every other failed outcome remains uncertain. A complete HTTP500 is not a completion barrier: Docker can return an internal containerd gRPC error while the nested server still commits. For uncertain tag completion, one404 does not prove cleanliness: retain quarantine/reservation until a matching visible alias establishes the tag commit, then remove/confirm absence. Never reissue a tag as a cleanup barrier. A mismatching alias is not deleted. The rustack-internal/lambda-<owner>/<run> namespace is reserved for this owner and must not be concurrently retargeted by operators or other clients. Docker provides no expected-target CAS for alias deletion, so identity verification plus removal assumes that exclusive namespace; observed mismatches quarantine rather than delete. Failed cleanup retries1/2/4 seconds capped30s, retains ownership and temporarily rejects new preparations; verified recovery clears quarantine. Caller cleanup deadlines bound waiters, not the retained cleanup future. Worker panic permanently stops admission, revokes leases and retains phase/identity through supervised recovery; successful quiescence must not hide it.
+
+Owner shutdown is a separate priority signal. The runtime first joins deployment/invocation/environment consumers, then stops this owner; shutdown revokes all leases and joins known pin cleanup before DockerWire shutdown. A cancelled shutdown waiter retains the join handle; failed settlement is cached. Owner Drop signals the same path even outside an entered runtime. A root-actor failure transfers recorded pin phases/reservations and aborted worker joins to retained emergency cleanup on its captured runtime handle. Startup reconciliation of previous runs remains with the directory-lock coordinator and may act only on the same persistent owner; this manager never scans/deletes generic user images. Required tests include bounds/admission, dropped waiters, clone lifetime, tag retargeting, partial/late tag results, identity conflicts, malformed unpacked proofs, worker/root supervision failure and real private-alias cleanup on both retained daemons.
+
+```text
+┌─ deployment actor / future provider CAS ──────────────────────────────┐
+│ reserve job → prepare(ref, architecture, overrides, deadline)         │
+└───────────────────────────────┬──────────────────────────────────────┘
+                                ▼ bounded preparation mailbox
+┌─ ImageLeaseManager (owns pin slots and worker joins) ─────────────────┐
+│ resolve parent → register phase → tag unique private alias           │
+│       → verify alias → prove unpacked quota → publish shared lease   │
+│                                    │                                │
+│       last lease / priority stop ──┴─▶ verify/remove/confirm absent    │
+│           IO error / uncertain create ─▶ quarantine + retained retry │
+└───────────────────────────────┬──────────────────────────────────────┘
+                                ▼ typed pin operations, bounded drivers
+┌─ DockerWire ─────────────────────────────────────────────────────────┐
+│ tag and manifest queries: business lane │ alias cleanup: cleanup lane│
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+### 2.10 Deployment state and atomic settlement
+
+One typed DeploymentState owns both State and LastUpdateStatus; do not independently mutate string status fields. Ready maps to Active/Successful, Creating(generation) to Pending/InProgress, CreateFailed(reason) to Failed/Failed, Updating(generation) to Active/InProgress and UpdateFailed(reason) to Active/Failed. Reasons are a closed, bounded, static failure vocabulary, never Docker response bodies, image argv, credentials or arbitrary error strings. New generations are nonnil random UUIDs. PublishVersion requires Ready; code/configuration mutations reject Creating/Updating under the same store lock. A failed update can be retried or repaired by a valid configuration mutation without losing the previously usable artifact. Retrying an initially failed creation remains Pending until its first usable image is prepared.
+
+The store returns a closed ImageDeployment candidate after reserving initial insertion or update. Its settlement key binds function resource UUID, original latest revision and generation. Unprepared candidates clear unverified code hashes and size; initial Pending/Failed responses omit CodeSha256 and report CodeSize=0 until content is proven. Updating responses retain the previous verified metadata. Updates retain the complete previous latest artifact/configuration while the candidate owns new reference/architecture/configuration. Completion takes one store lock, checks all three key fields plus the pending state and validates the candidate before replacement. A stale or duplicate completion returns false and drops its image lease; it cannot mutate a deleted/recreated resource. Store/import/capture validate every resolved image CodeSha256 against the same base64 fingerprint, require CodeSize in1..10GiB and, for live pins, require exact equality to proven unpacked size. Restored size is re-proved during P5 availability reacquisition. Successful settlement requires a live PinnedImage with the candidate's exact requested reference and architecture and a valid effective entry plan. It sets the content-derived CodeSha256 from the canonical inspected execution fingerprint, CodeSize from the proven unpacked quota, a fresh revision ID and Ready. Initial failure leaves CreateFailed; update failure changes only deployment status and preserves old code/configuration/revision. A later retained deployment supervisor must reserve work before these store mutations and settle cancellation/panic through this same key; the store contract alone does not establish accepted-job ownership.
+
+VersionRecord holds an ImageArtifact enum: Unresolved, Restored immutable metadata, or Pinned live artifact. Metadata cannot masquerade as a lease. Invocation captures only a live PinnedImage into DeploymentArtifact::Image, revalidates its effective ImageConfig plan and keeps the lease through backend cleanup. Numeric publication clones the same lease; deleting latest or moving a tag cannot invalidate it. Restored metadata is inspectable but cannot execute until P5 reacquires exact captured content, without resolving the original mutable tag.
+
+Snapshots retain the legacy state field and add an optional typed deployment field. New exports derive both from the same enum. Import rejects contradictory fields and invalid/nil generations; legacy Active maps to Ready and legacy Failed/Pending to a closed failure state. A saved in-progress creation restores as CreateFailed(Cancelled), and an in-progress update restores as UpdateFailed(Cancelled) with its old artifact. Live leases are never serialized or invented on restore. Published versions must be Ready. The P5 quiescence owner must prevent exporting accepted in-progress work; these conversions also make direct/legacy import fail closed.
+
+Required consumer sequence (the retained deployment worker/API wiring remains pending):
+
+```text
+Provider + retained worker       FunctionStore                 ImageLeaseManager
+ │ reserve bounded work slot          │                              │
+ │ insert / begin update ────────────▶ │ validate; allocate generation │
+ │ ◀── closed candidate + key ──────── │ commit Pending / InProgress   │
+ │                                    │                              │
+ │ prepare captured reference ────────┼─────────────────────────────▶ │
+ │                                    │ ◀── Invoke captures old pin   │
+ │ ◀── live pin / closed failure ─────┼────────────────────────────── │
+ │                                    │                              │
+ │ settle(candidate, result) ────────▶ │ resource + revision +         │
+ │                                    │ generation checked together  │
+ │                                    │                              │
+ │ ◀── true: atomically committed ──── │ Ready or preserved-old Failed│
+ │ ◀── false: stale/deleted result ─── │ no mutation; release new pin │
+ │ join worker before freeing slot    │                              │
+```
+
+Required tests prove initial Pending/success/failure, preservation of old code while updating and after failure, concurrent mutation rejection, stale/duplicate settlement, delete/recreate isolation, live-lease capture/revocation, numeric-version ownership and snapshot migration/contradiction checks. Docker remains unavailable in capability reporting until the retained deployment owner, executor/pool and startup probes are wired and qualified.
+
+### 2.11 Retained deployment supervisor and provider admission
+
+ImageDeploymentManager owns an Arc<FunctionStore>, a qualified ImageLeasePort and bounded accepted work (default8 jobs,1..32 and no greater than the preparation port capacity). ImageDeploymentConfig sets one absolute deployment budget (default300s,1..3,600s), starting before mailbox reservation. Startup requires an entered Tokio runtime; reservation and store mutation are synchronous and contain no suspension point. Reserve an accepted-work permit and an owned bounded-mailbox permit before inserting Pending or beginning an update. Return the configuration captured at acceptance, even if preparation completes before the HTTP response is serialized. No prepared-image hash is invented during this response.
+
+An accepted envelope has a settlement guard, captured candidate, absolute deadline and capacity permit. Failure before enqueue or loss of a queued envelope settles a closed cancellation/supervision failure through the same store key. The actor registers every candidate and its capacity above the worker before spawning it, retains a JoinSet and task-ID index, and releases accepted capacity only after join (or disposal of work never started). A panicked worker closes admission and triggers failed settlement without overwriting a newer revision. Root failure marks health failed even with zero workers, transfers registered rows and aborted child joins to emergency cleanup on the captured runtime, and retains capacity until every join/settlement finishes. Drop outside an entered runtime signals the same cancellation path; the captured runtime must remain alive. Root Drop/recovery cannot leave a permanently Pending record.
+
+The overall preparation deadline accepts up to3,600s; each read/metadata stage uses min(overall deadline, now + configured independent Docker IO budget), while critical mutation/cleanup retains its separate IO lifetime. Workers call the real ImageLeasePort once and retain that same preparation future across store-change notifications; never restart it or replay a tag. FunctionStore emits a coalescing change notification after mutations/removal/restore. Ready preparation outcomes take priority over unrelated change notifications after deadline/cancellation, preventing notification starvation; the outcome still undergoes the final key check. Workers subscribe before checking their key, cancel when the candidate is deleted, replaced or no longer pending, and recheck deadline/cancellation/key before settlement. Thus deleting/recreating a name promptly cancels its old preparation, while the image owner retains any uncertain critical mutation and pin cleanup. Closed failure mappings exclude peer text:404→ImageNotFound, invalid settings/inspection/framing/limits→InvalidImage, deadline→DeadlineExceeded, cancellation→Cancelled, and unavailable/busy/quarantined/failed backend→RuntimeUnavailable or SupervisorFailed as appropriate.
+
+Manager quiesce closes admission and drains queued/running accepted work; shutdown or Drop additionally cancels it. Caller deadlines bound waiters rather than abort retained work. Cancelled waiters retain root/emergency joins and cached results. Successful manager settlement proves its deployment workers joined, not that the separate image owner finished uncertain mutations. The runtime must subsequently join invocation/environment consumers and then the image owner before global cleanup/snapshot consistency can be declared. Root or worker failure remains a cached failure after its failed records are settled. Normal deployment failures produce inspectable Failed/update-failure records without poisoning unrelated admission.
+
+The provider stores FunctionStore in Arc for retained worker ownership. Its explicit image-runtime attachment requires executor=docker and a backend image-availability check, which defaults to unavailable for Disabled/Auto/Native/Squib and unsupported Docker builds. Create(Image) without this qualified attachment rejects before metadata insertion; it never returns falsely Active. Create/Update(Publish=true) still reject before mutation. Image Create uses manager admission and initial Pending insertion; UpdateFunctionCode/Configuration deserialize RevisionId and check a bounded1..100-byte ASCII token before work and again under the mutation lock. An explicit stale precondition returns PreconditionFailedException/412; an in-progress operation or implicit staged-resource conflict remains ResourceConflictException/409. PublishVersion applies the same revision and CodeSha256 precondition category. These match the [official code API](https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionCode.html) and [configuration API](https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionConfiguration.html); the token bound/ASCII grammar is an advertised local restriction. Image Update validates package/settings/revision, preserves old latest while preparing and returns its acceptance snapshot. ZIP code staging remains synchronous and transactional. Provider shutdown cancels/joins deployments before shutting invocation/executor consumers; quiescence drains deployments and invocation work under one caller deadline. Configuration updates and publication retain the store guards from §2.10. The actual Docker backend/probes remain required before the production server can attach this owner or advertise Docker.
+
+Required tests use the real bounded wire/image-preparation actors with a scripted local daemon, plus a declared test executor capability for provider-only control-plane qualification. Cover capacity rejection before resource mutation, accepted response abandonment, initial/update success/failure, deadline and shutdown/cancelled waiters, deletion during delayed tag, stale result cleanup, normal failure recovery, worker/root panic including zero-row/queued work and off-runtime Drop, cached failure and provider Pending/Active/status/CAS. A fake executor cannot establish actual Invoke acceptance; the official-RIC Docker executor lane remains a separate P1 gate.
+
+```text
+┌─ Provider + qualified executor / deployment manager ───────────────────┐
+│ validate → reserve slot + mailbox → store CAS → captured response      │
+│                                    │ accepted settlement guard       │
+└────────────────────────────────────┼──────────────────────────────────┘
+                                     ▼ bounded envelope
+┌─ Retained actor ──────────────────────────────────────────────────────┐
+│ registry + permits → JoinSet workers → keyed settlement → joined reap │
+│         │                   │                                        │
+│         │                   └─ store change / stop / deadline cancels│
+│         └─ root failure → captured-runtime emergency join + settlement│
+└────────────────────────────────────┼──────────────────────────────────┘
+                                     ▼ one retained preparation future
+┌─ ImageLeaseManager ───────────────────────────────────────────────────┐
+│ owns critical Docker mutations and pin cleanup beyond worker cancel   │
+└───────────────────────────────────────────────────────────────────────┘
+```
+
+### 2.12 Side-effect-free code validation and bounded deployment JSON
+
+UpdateFunctionCode models DryRun explicitly. When true, validate code-source exclusivity/completeness, function and mutable qualifier (unqualified or $LATEST only), revision precondition, current deployment mutability, package compatibility, architecture syntax and local publication restrictions. Validate inline base64 syntax/canonical padding and the50MiB decoded limit without extracting or inspecting an archive. Validate image-reference grammar but do not inspect/pull/tag it; validate S3 source syntax but do not fetch it. No staging directory, code hash/revision/timestamp change, published version, work-slot reservation, container or invocation is produced. Return the current configuration snapshot after rechecking resource/revision following any bounded CPU validation. DryRun=false/omitted keeps actual deployment behavior; Invoke DryRun remains a separate API.
+
+CreateFunction, UpdateFunctionCode and UpdateFunctionConfiguration reject unknown fields, including unsupported newer AWS modes. Their nested deployment DTOs (code/environment/VPC/tracing/dead-letter/ephemeral/image/logging/SnapStart) reject unknown members too; environment/tag map keys remain dynamic. Unsupported fields must fail before provider dispatch, including when DryRun=true, rather than silently selecting another execution model. Unknown-field/JSON errors return a fixed bounded message without echoing caller text. This follows the [official DryRun parameter](https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionCode.html), with explicitly local validation/response behavior and the existing gateway permission model, not an IAM evaluator.
+
+A Lambda-specific deployment codec preserves the96MiB HTTP code envelope while bounding metadata to1MiB, container depth8, aggregate members4,096, decoded metadata strings16KiB and decoded keys256 bytes. A lexical pass bounds depth, structural delimiters and encoded keys before any map allocation. It locates borrowed raw JSON values using serde_json's existing raw_value feature (no new package/version); borrowed RawValue retains original input spans without building an arbitrary value tree ([documented ownership](https://docs.rs/serde_json/latest/serde_json/value/struct.RawValue.html#ownership)). Only root ZipFile for code updates or Code.ZipFile for creation receives the large blob exception: raw quoted content≤69,905,068 bytes. Mask that borrowed span to an empty JSON string in a capped metadata buffer, run shared JSON preflight for decoded-key duplication and exact metadata limits, then deserialize the strict DTO from the original bounded body. Escaped keys remain recognized; wrong-path blobs, unknown fields and duplicate keys cannot bypass the metadata budget. Domain settings validation still applies its tighter field caps.
+
+Pure JSON/base64 validation runs on bounded blocking workers (fixed ceiling4). Permits travel with completed results and deployment dispatch until their input work is released, preventing a backlog of large decoded requests after CPU parsing completes. Inline DryRun validation reuses its admitted request permit rather than acquiring a second slot, avoiding self-induced overload when all four requests validate concurrently. Request cancellation may leave an already-running pure parse task self-owned until it finishes; it owns only bounded bytes/results and cannot commit resources or metadata. Worker panic is surfaced as a bounded error to an attached caller. Image preparation and function execution retain their independent owners. Tests cover large valid inline blobs, wrong-path/oversized metadata, escaped duplicate keys, malformed/deep structures, static errors, parser saturation, ZIP/S3/image DryRun nonmutation, stale revisions/qualified references and actual SDK/HTTP validation. The other API decoders retain their existing profile; this does not claim a global service-parser rewrite.
+
+### 2.13 Durable image-pin intents and historical alias retirement
+
+Extend the retained ImageLeaseManager with a persistent pin record before tag issuance. Use the same DirectoryLease serial transaction permit, four blocking-worker limit, private descriptor-relative file checks and sync/rename discipline as §4.8. Factor shared snapshot file IO once; container encoding remains byte-for-byte compatible. Pin state uses `pins.v1` and `pins.pending`: eight-byte `RSDKPIN1` magic,16-byte owner UUID, big-endian u16 count, up to8,192 fixed65-byte records, then SHA-256 over preceding bytes. A record is16-byte run UUID,16-byte pin UUID,32-byte captured parent-image digest and one-byte committed flag(0/1). Maximum snapshot size is532,538 bytes. Reject nil owner/run/pin UUIDs, duplicate run/pin keys, invalid flags, wrong owner/checksum and malformed/oversized state. Compute external count/offset/report arithmetic with checked operations after count admission. A torn bounded safe staging file never overrides published state. Store no user reference, credentials, image configuration or payload.
+
+Worker phases become Unissued → Preparing(expected) → Uncertain(expected, mutation receipt) → Committing(expected) → Known(expected) → Clean, with NoEffect(expected) reserved for source-pinned no-effect tag results awaiting durable erase. Register Preparing before awaiting intent publication. No tag is issued until that publication succeeds. A tracked wire guard distinguishes definitely-unissued work during abort/queue disposal. Enter Committing synchronously after every positive physical-completion proof (successful tag acknowledgement or exact matching alias inspection), before awaiting storage, so an unsuccessful publication cannot lose that proof. Retained cleanup retries durable commitment from that phase even if the alias is already absent; never replay Tag. Publish the committed flag before publishing a live image lease; if that write fails, positive exact alias inspection can establish commitment during retained cleanup. Never publish a lease using an unpersisted commitment.
+
+```text
+Image owner                Shared directory transaction             Docker
+ │ Preparing(expected)               │                                │
+ │ prepare pin intent ──────────────▶│ pin staging sync/rename/dir sync│
+ │ register uncertain receipt        │                                │
+ │ tag once ─────────────────────────────────────────────────────────▶│
+ │ tag ACK / exact alias inspect ◀────────────────────────────────────│
+ │ Committing(expected) retained before any storage await             │
+ │ publish committed ──────────────▶│ durable replacement              │
+ │ publish live lease / await release                                │
+ │ inspect expected ID → remove exact private alias → require404      │
+ │ erase intent ────────────────────▶│ durable replacement              │
+ │ release pin/preparation reservations only after settlement         │
+```
+
+Cleanup durably erases only after Preparing/no-effect/definitely-unissued proof, or after a committed alias is confirmed absent. For a matching visible uncertain alias, persist committed before any deletion. Failed storage updates retain pin capacity/quarantine and participate in existing retained retry/shutdown/recovery. A mismatching alias is never deleted. Keep exact force=false/noprune=true requests; never reissue tag to manufacture a completion barrier. Under the reserved namespace exclusivity contract from §2.9, recheck alias ID immediately before removal. Source-defined400/404/Busy exceptions remain limited to the fresh tag request; unknown historical absence stays unresolved.
+
+`reconcile_image_pins(directory, docker, deadline)` is a resumable container-ordered startup operation. First read container records: any historical container record blocks alias mutation with Quarantined. Then process only previous-run pin records; never mutate current-run pins. Reconstruct only the reserved alias from the record's owner/run/pin UUIDs under the current retained directory lease. Unknown404 preserves its record. Matching positive inspection durably establishes commitment; committed404 permits durable erase. Otherwise verify expected parent ID, remove only the exact alias and confirm absence before erasure. Cancellation, storage/wire failure and mismatch preserve records for retry. Return settled/remaining counts, not DockerReadiness. The caller must supply the exact-directory bound port from §4.9: its immutable persisted engine identity and per-connection fence enforce the same-daemon prerequisite. Directory UUIDs alone do not prove daemon identity. Before ordinary CLI enablement, production startup must consume this binding before its first mutation and reject mismatched/unprovable historical scope before any404-based erasure. Production startup must still combine this with complete historical discovery, allowed pulls, endpoint reachability, configuration and platform acceptance.
+
+Tests must prove codec/file/budget bounds and container-format compatibility after factoring, publication before tag, commitment before lease/deletion, acknowledged-tag and matching-inspection failed-commit retry with an already-absent alias, failed erase retaining capacity, no-effect and abandoned-worker cleanup, historical unknown404→late commit, committed absence, mismatching identity, current-run exclusion, container-before-alias ordering and recovery after cancellation. Actual daemon qualification creates a durable private alias across directory reacquisition, retires it without removing the original operator tag and confirms no internal alias remains. Keep a retained evidence-directory guard above every fallible setup/recovery path; always attempt wire shutdown after successful wire creation, and preserve/print the directory on error, panic or observer loss. Release evidence only after source-tag preservation, complete pin settlement and joined wire cleanup. Requalify real provider/pool/wire execution because every image preparation consumes this path. This does not implement pulling or claim production startup acceptance.
+
+### 2.14 Controlled if-missing pulls and retained progress transport
+
+ImageLeaseManager::start remains never-pull by default. start_with_pull accepts a validated ImagePullPolicy::if_missing(registries, credentials, total_timeout); its settings are operator inputs, never Lambda request fields. Allow1..32 distinct RegistryHost values≤253 ASCII bytes, exact canonical host[:port] equality, explicit default Docker Hub normalization for short references/docker.io/index.docker.io and ASCII DNS case. Reject URI schemes, paths, credentials, wildcard/suffix hosts, invalid ports and ambiguous single-label domains (localhost is explicit). Never pull the reserved local Docker Hub rustack-internal/ namespace. Other registries remain distinct. Pull only after the initial requested-image inspect returns404; platform/metadata/identity/capability failures are not missing-image triggers. Reuse the one captured positive root in ImageResolver, avoiding a second mutable-tag lookup. A successful pull is followed by a fresh root inspection and all existing selected-platform/defaults/unpacked-size/pin validation; never publish Active/PinnedImage from progress alone.
+
+RegistryCredential has mutually exclusive Basic(username1..256bytes,password1..4096bytes) and IdentityToken(1..8192bytes) constructors with secret-wrapped strings and no controls/NUL. RegistryCredentials accepts≤32 unique approved-host records and≤64KiB total decoded host/secret bytes. Reject credentials for hosts absent from the policy allowlist. Serialize only the selected host's auth to bounded JSON, wipe the temporary JSON bytes, encode with padded base64url and retain the header as SecretString; cap its bytes at32KiB and mark the actual HeaderValue sensitive. Debug/errors/metrics never expose hosts, source references, credentials or daemon progress. Reuse the existing secrecy0.10.3 workspace cohort, not a new version. YAML auth-file loading/permission checks and CLI setting publication remain the task1.4 startup consumer of these validated types; this library constructor does not read ambient credentials/configuration/helpers.
+
+The private pull wire operation is POST /images/create with only fromImage=validated repository, explicit tag=tag-or-digest (latest when omitted), platform=linux/amd64|linux/arm64, empty body and optional X-Registry-Auth. Never request all tags or import/fromSrc. Require the same exact-directory binding and connection-local identity fence as every owned operation. Use a separate8-command/4-running pull lane, independent of business6, cleanup2 and waits32. A pull has an absolute total budget1..600s (default300s in future CLI settings), shared by queue wait, connect/identity, headers and progress; no fresh extension per line. Pull progress is metadata, not layers: cap64KiB per newline-delimited JSON object,16MiB total and65,536 records; shared preflight enforces depth8,≤128 aggregate fields/items, scalar strings≤8192bytes and keys≤256. Reject malformed/duplicate/deep/oversized/nonobject records, trailers/content encoding, overlong headers, empty streams or an unterminated final object. Accept CRLF. Error or nonnull errorDetail is a static PullFailed, even under HTTP200. PullDenied and PullFailed map to the closed deployment InvalidImage classification; never retain registry/daemon error text. Discard bounded status/progress/aux fields; no progress/result body is retained or logged. Complete HTTP framing/EOF without in-band error establishes protocol completion only; image validation still establishes executable availability.
+
+```text
+Image preparation (accepted slot + pin reservation retained)
+ │ initial inspect ── present → resolve same captured root → existing pin path
+ │        └404 → policy/host/credential admission
+ │ pull envelope ───────────▶ dedicated wire queue8 / running4
+ │                          same connection identity → POST → bounded NDJSON
+ │ cancellation/stop ──────▶ close local stream, join exact HTTP driver
+ │ ◀─ owned terminal receipt only after driver join
+ │ recheck caller/stop → fresh inspect → platform/default/size/pin validation
+ └ later publication/CAS and cleanup retain their existing owners
+```
+
+The preparation worker retains the same accepted pull future across caller expiry/abandonment; cancellation or owner stop is a separate signal to the retained exchange, never permission to drop/replay its join. The private owned-request await has no competing observation timer; exchange itself owns the absolute deadline and always joins its driver before terminal reply. Queue disposal remains effect-free. Root/worker failure leaves accepted wire jobs with the wire owner and exact directory binding; the failed preparation root cannot reopen admission. Wire root failure must transfer its accepted JoinSet to the existing retained CleanupTask under the captured runtime handle, signal stop and join exchanges without aborting them; dropping a JoinSet would abort exchange while detaching its HTTP driver. Owner shutdown persists the primary root result before awaiting fallback cleanup, so an abandoned shutdown observer cannot erase root failure; only after both settle does it cache the final result. Queue disposal remains effect-free. Runtime shutdown joins preparation owners before wire shutdown. Quiescence must still account for the wire's accepted jobs. Closing a Docker pull connection does not prove remote cache work never commits: it may populate/update the operator image cache later. This is explicitly a daemon-owned cache effect, not permission to create a private alias, publish a function revision or claim a remote job was reaped. Never delete pulled source references/content or infer success from a late tag; failed/cancelled preparation publishes no live lease. Snapshot consistency remains about owned runtime resources/revisions, not freezing the daemon's unrelated cache.
+
+Required tests cover exact registry matching/default aliases/case/ports and reserved namespaces; every host/credential/aggregate/header bound and redaction/zeroization behavior; explicit tag/digest/platform/auth query/header shapes; strict progress frame/body/JSON/error boundaries; complete-stream versus interrupted/failed outcomes; queue/running caps with independent cleanup; cancellation/expired/dropped/root-failure ownership and joined driver lifetime; present-image nonpull, only-root404 trigger, denied host, post-pull invalid image, and real ImageLeaseManager publication/CAS consumption. Actual daemon qualification must execute the real pull endpoint against an explicitly allowed immutable public reference and retain scope/source safety, then consume successful preparation through existing owned execution gates. A cached endpoint exercise must be identified honestly; actual cache-miss qualification requires an initially absent fixture reference with fixture-owned cleanup only, never deleting a preexisting operator source. Ordinary CLI Docker readiness, YAML auth loading, endpoint/startup composition and final image/platform release remain separate gates.
+
+### 2.15 Immutable local image-lease reacquisition (D87)
+
+Task5.2 first needs an owned way to turn validated saved metadata into a new live pin. Add `ImageLeasePort::restore(saved: &ResolvedImage, overrides: Option<&ImageConfig>, deadline: Instant) -> Result<PinnedImage, DockerError>`. This is a local immutable-content operation, not ordinary deployment preparation: inspect only saved `image_id`, never `requested_reference` or `registry_manifest`, and never call the ifMissing/pull policy, even on404. Reuse the exact bound daemon/directory, qualified architecture, pin/preparation quotas, absolute positive≤3600s deadline, independent configured IO deadlines, durable intent/commit, critical mutation ownership and quarantine/retirement supervisor from§2.9/§2.13. No new actor, dependency or serialized live capability is needed.
+
+Represent ordinary-reference and saved-metadata sources as separate internal enum variants. Restore derives its architecture from the validated saved image; it must not admit an independent conflicting caller architecture. Before any pin journal write or Tag, require initial immutable lookup to return exactly the saved addressable parent ID, resolve its selected platform through the existing resolver, and compare the complete canonical execution fingerprint with the saved fingerprint. That fingerprint includes parent ID, selected manifest, architecture, inspected size and validated inherited argv/environment/workdir/user. The resolver additionally verifies Linux OS and effective ImageConfig. An alias unexpectedly returned for an ID, changed selected descriptor, supported-but-different defaults/size or incompatible platform rejects as invalid inspection before mutation. Preserve original requested-reference/registry metadata in the returned `ResolvedImage` only after this proof; changing an informational source tag cannot change code identity or CodeSha256. Recheck deadline/cancellation after read/validation and before effects.
+
+Then reuse ordinary intent-before-Tag/commit-before-live-lease ordering, exact private-alias verification and fresh positive unpacked-storage proof≤10GiB. A direct missing immutable ID remains resource404; identity-fence errors, selected-platform404/InvalidImage, transient IO, expiry and stopped/failed ownership retain existing distinct provenance. Do not hide failures by following a mutable tag or trying alternate saved identities. A rejected/canceled/dropped result retains every uncertain mutation, quota, directory lease and cleanup join until known physical retirement; successful leases share ordinary clone/revocation/release semantics.
+
+```text
+validated saved ResolvedImage ───────┐
+                                    ▼
+                     Restore source (no pull branch)
+                                    │ saved addressable ID only
+                     immutable lookup + selected platform
+                                    │ exact ID + execution fingerprint
+                  mismatch/404 ── reject before mutation
+                                    ▼
+                     durable pin intent → tracked Tag
+                                    │ commit + alias + unpacked proof
+                                    ▼
+                     shared live PinnedImage capability
+                                    │ last drop / revoke
+                     retained exact-alias retirement
+```
+
+Controlled wire consumers must prove successful reacquisition after source-tag retargeting, preserved saved metadata/hash, no source-name lookups; a missing saved ID despite a newer available source tag must404 with no Tag or pull. Mutate otherwise valid saved size/default/manifest fields and recompute their fingerprint to prove actual daemon comparison rather than deserialization alone; reject before Tag. Qualify the restore path through existing bounded pin admission and a held late critical mutation/shutdown observer, then positively join cleanup. Real `docker_wire` consumers must serialize/deserialize read-only inspected metadata, acquire the function/relay leases through restore and execute the existing actual RIC computation/override resources on both retained engines. Preserve all source images and zero-remnant postconditions.
+
+This is the capability primitive for atomic archive import, not its publication boundary. Provider/main image archive rejection remains until the consuming startup-only candidate store validates all records, reacquires every required lease without changing live resources, verifies saved code hash/unpacked size and commits atomically; failed candidate pins must retire under the same owner. Backup-generation retirement and image readiness must not change merely because this primitive exists. Docker ZIP, Node, handler SDK/callback/IaC and final platform/release requirements stay binding. Docker's [platform inspection history](https://docs.docker.com/reference/api/engine/version-history/) and the pinned [transport study](../docs/research/study-bollard-docker-transport-boundaries.md#platform-specific-image-identity-follow-up) define the independent parent/selected-manifest boundary.
+
+### 2.16 Candidate-store image archive restoration (D88)
+
+Task5.2b consumes§2.15 through `RustackLambda::import_snapshot_before(snapshot, deadline)`, with existing `import_snapshot` delegating under a bounded300s compatibility budget. Docker ZIP still rejects before work. Image import requires the qualified installed deployment/image owner and healthy actual backend; metadata-only imports never manufacture readiness. This is startup/quiescent restoration, with no public live-import HTTP action. Existing Native/Squib metadata/ZIP restoration remains unchanged.
+
+Preflight the complete Docker Lambda snapshot before code or pin effects. The local image archive profile caps compact JSON at16MiB, functions at256, total latest/published revisions at1024, depth64, aggregate members65,536, scalar strings128KiB and keys1024 bytes. The actual Docker snapshot service also caps CBOR metadata at16MiB. Its archive export streams borrowed live records through per-record dynamic guards and the same bounded writer before constructing any owned snapshot. Retain shared store handles and the validation slot throughout that read-only job; build the bounded owned DTO from validated JSON and preserve stable record ordering. This also bounds ancillary data before cloning and prevents deep-policy Clone overflow. An over-profile live store cannot replace a restorable saved generation. Validate dynamic policy conditions iteratively before recursive serialization; check every prospective depth/node/string limit. Borrowed record guards share at most65,536 work units across versions, statements and dynamic nodes; charge collection lengths before walking and retain one budget across conditions. Intake uses a shared work budget across the complete snapshot, so a capped writer never follows an unbounded preliminary ancillary walk. Owned PolicyStatement destruction must also dismantle its condition iteratively on all rejection, cancellation, unpolled-future and unconsumed-result paths, so refusing deep input cannot overflow during Drop. Preserve typed redacted worker failure versus deadline versus invalid-input provenance. Use a bounded writer and existing JSON preflight, with fixed redacted errors. Four retained read-only blocking validation slots bound CPU work; the caller's deadline bounds waiting/result consumption. An abandoned validator may finish only its owned immutable input, holds its slot until completion and can never publish resources.
+
+Prepare all records in a private candidate map through existing identity/name/ARN/version/alias/configuration/artifact validation. Require every saved function ARN to equal the current provider region/account/name scope before pinning, and verify alias targets/routing references exist in the restored published versions. Duplicate identities/names, invalid state or metadata, bad layout, hash, settings or effective ImageConfig fail before any pin. Original Ready/UpdateFailed (including restored Updating→UpdateFailed(Cancelled)) image revisions require saved resolved metadata. Initial Creating→CreateFailed(Cancelled) and failed creation remain inspectable without executable availability. Published versions still require Ready. Validate every active revision's inherited-plus-override execution plan before effects.
+
+Sequentially reacquire immutable live leases through the same qualified ImageLeasePort under the original deadline. Share one lease across exact identical serialized ResolvedImage metadata; overrides are independently validated for each revision. Recheck actual positive unpacked size against each saved CodeSize and preserve CodeSha256, revision/resource identity, published versions, aliases, tags and failure states. A missing ID, changed fingerprint, wrong platform, quota, size mismatch, health failure, cancellation or deadline drops the candidate; existing pin supervision retains physical cleanup. Never change old functions/layers/event mappings on failed preparation. Recheck all candidate records with their actual pinned artifacts, backend health and deadline immediately before the synchronous infallible commit. Only then replace the function map and dependent metadata and emit the store-change signal. Old captured invocations retain their own artifact leases. Atomicity means no failed import changes live resources; concurrent business mutation/import is outside this startup-only contract.
+
+```text
+bounded snapshot → retained pure validation → complete private candidate
+                                                   │ all records/plans valid
+                                                   ▼
+                              exact saved-ID leases + fresh size proofs
+                                  │ any failure/deadline → drop candidate
+                                  │                    → owned pin retirement
+                                  ▼
+                       final health/deadline/record check
+                                  │ one no-await publication boundary
+                                  ▼
+                       functions + layers + event mappings
+```
+
+Main passes one captured startup deadline through the retained snapshot transaction and service-import hook into Lambda. Snapshot workers remain joined after observation expiry. Check the deadline before service import and after joined imports/cleanup immediately before previous-generation retirement; a failed/expired image import preserves current/previous archive bytes. Only after all required services import and the provider's live-image check succeeds may business ingress open. Failed creation rows do not require a live pin; usable images always do. No replay of workflow or function work occurs on restore.
+
+Required controlled cases cover complete duplicate/invalid-later validation before Tag, saved-A metadata with sourceB, shared published/latest leases, fresh-size mismatch after a prepared first pin, missing later ID, wrong settings/hash/active metadata, inactive creation states, budget/depth/member limits, exact held mutation cancellation/deadline and unchanged old store/ancillary resources. Main tests must preserve previous generation after delayed/expired domain import. Ordinary actual startup archives must save/restart Image and published/alias computation, preserve identity/hash/settings/history without replay, retire previous only after successful import, then verify a corrupted saved image rejects without changing either generation. Qualify on both retained P0 lanes, update the exact resource inventory explicitly and run full Rust/Native/strict/security/text/independent gates. Docker ZIP/Node/handler SDK/IaC/native-reference/platform and final M4 release stay required.
+
+## 3. Runtime API and relay transport
+
+Implement the four basic 2018-06-01 routes: GET invocation/next, POST invocation/{requestId}/response, POST invocation/{requestId}/error and POST init/error. Each environment processes one invocation at a time. Managed Instances concurrency, extensions, streaming and SnapStart restore are excluded.
+
+Inject `AWS_LAMBDA_RUNTIME_API=127.0.0.1:9001` and revision-derived Lambda name/version/memory/region/log/task-root metadata. Reject reserved-variable overrides. User environment totals≤4 KiB with Lambda key grammar. Reject NUL values and the [reserved Lambda environment keys](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-runtime), plus the local AWS_LAMBDA_FUNCTION_TIMEOUT injection. PATH, TZ and AWS_ENDPOINT_URL remain configurable. Inject only explicitly configured local test credentials; do not inherit host AWS secret variables.
+
+Control frames are 4-byte big-endian length plus CBOR envelope, protocol version 2. Maximum frame is 6 MiB+64 KiB, with metadata≤64 KiB and payload encoded as CBOR bytes rather than base64. Message variants are Hello, Ready, BootstrapReady, Invoke, InvocationResult, InvocationTimedOut, InitError, Cancel, Close and Ack. Include environment UUID and invocation-attempt UUID. Hello advertises protocol version and architecture; mismatch retires the environment. EOF, malformed frames or attach failure invalidate it. Never reconnect and silently replay an invocation. Relay stdout carries frames only; stderr carries bounded redacted diagnostics. Collect function stdout/stderr separately from its own container. Enforce an independent subscriber filter that rejects all Bollard events more verbose than INFO regardless of RUST_LOG; the selected dependency logs HTTP request/response bodies and trailing attach bytes at trace/debug. Test secret-bearing create requests and truncated attach frames under RUST_LOG=trace. Application-level redacted Debug alone is insufficient.
+
+Create the relay with Tty=false, OpenStdin=true and StdinOnce=true. Establish bidirectional attach before starting it so the initial Hello cannot be lost; then start and await Hello/Ready before creating the function container. Demultiplex Docker stdout/stderr frames before decoding CBOR, preserve partial-frame buffering within the maximum length, and cap/control metadata before allocation. Relay protocol output never passes through a text logger. Shutdown closes the input only after Close/Ack or deadline expiry. P0 experimentally showed StdinOnce=false leaves the relay running after attach-input shutdown, while true delivers EOF and terminates the relay. Each environment owns exactly one attach connection; reconnect/replay remains forbidden. Keep attach IO in separately supervised read/write tasks so slow log collection cannot deadlock invocation completion or cancellation.
+
+Reject indefinite-length CBOR collections, nesting deeper than16 and more than128 metadata members before materialization; payload bytes are the only large field. Control-message variants validate permitted fields and reject duplicates/unknown fields. BootstrapReady is emitted once, only after the first valid RIC GET /next; relay Ready cannot satisfy the function initialization deadline. The bounded transport is not permission to deserialize arbitrary recursive CBOR structures.
+
+Runtime `/next` supplies Request-Id, Deadline-Ms, Invoked-Function-Arn and Trace-Id. Convert wall deadlines with checked arithmetic and enforce elapsed time using monotonic clocks. If the optional Invocation-Id header is supplied on completion, it must match; omission remains compatible with older RICs. Unknown, expired or duplicate completions cannot resolve another request. Validate method/path/header/body limits before touching pending state. See [Runtime API](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html).
+
+```text
+Provider             Environment actor          Docker/relay             RIC
+ │1. admit + revision       │                         │                    │
+ │─────────────────────────▶│2. attach/start relay ───▶│ Hello/Ready        │
+ │                          │3. start function ───────┼───────────────────▶│
+ │                          │                         │◀── GET /next ────│
+ │                          │◀── bootstrap-ready ─────│                    │
+ │                          │4. Invoke(id,deadline) ──▶│─── event ────────▶│
+ │                          │                         │◀─ response/error ─│
+ │                          │◀── InvocationResult ────│                    │
+ │◀── typed result ─────────│5. settle once / pool     │                    │
+ │ cancel/timeout ─────────▶│6. invalidate attempt    │                    │
+ │                          │ kill function → close relay → remove both   │
+ │◀── cleanup settlement ───│ release or quarantine allocation reservation │
+```
+
+Ready means the relay is listening; bootstrap-ready means the RIC issued its first GET /next. They are different signals. Image deployment, relay start, function initialization, handler execution and cleanup have separate budgets. Synchronous Invoke's outer total includes cold start. Function handler timeout starts at event delivery and is additionally bounded by the caller's Task absolute deadline: cold start must not extend that Task deadline. Idle `/next` uses the environment idle/shutdown lease, not the short control-request timeout; this is bounded long polling.
+
+### 3.1 Shared runtime crate and control schema
+
+Add the host-portable library and Linux relay binary in `crates/rustack-lambda-runtime`. Lambda core depends on its library; the runtime crate never depends on lambda-core, Squib, the AWS SDK or Docker. Its protocol module owns framing and validated message types, its session module owns the single-invocation state machine, and transport adapters own HTTP/stdio IO and supervision. Deliver these contracts before the Docker consumer.
+
+Protocol version2 encodes one definite-length CBOR map with exactly `version` (unsigned2), `environment` (canonical nonnil UUID string) and `message` (adjacently tagged `kind`/`data` map). Unit messages omit data. All identifiers are canonical lowercase hyphenated UUID strings. The message kind and data schema are:
+
+| kind | Direction | data fields |
+|---|---|---|
+| hello | Relay→host | architecture: x86_64/arm64 |
+| ready | Relay→host | None |
+| bootstrapReady | Relay→host | None |
+| invoke | Host→relay | attempt (UUID), deadlineUnixMs (nonzero u64), functionArn (validated Lambda ARN), traceId (bounded printable ASCII), handlerTimeoutMs (omitted or integral whole-second milliseconds1,000..900,000; null rejects), payload (CBOR byte string≤6 MiB) |
+| invocationResult | Relay→host | attempt, outcome: success/functionError, payload |
+| invocationTimedOut | Relay→host | attempt; no payload |
+| initError | Relay→host | payload |
+| cancel | Host→relay | attempt |
+| close | Host→relay | None |
+| ack | Relay→host | operation: cancel/close; attempt is required for cancel and forbidden for close |
+
+Unknown fields/variants, duplicate keys, absent required values and mismatched per-variant fields reject. The decoder preflights the complete bounded byte slice before Serde allocation: definite maps only, at most16 nesting levels and128 total map members; text≤2,048 bytes; text map keys≤64 bytes; no arrays, negative integers, tags, floats, indefinite strings/collections or trailing items. Byte strings are allowed only as a single payload field; its bytes are excluded from the64 KiB metadata budget. Enforce the6 MiB payload and6 MiB+64 KiB frame limits separately. UUID, ARN, trace and deadline validation runs again during deserialization. Bytes uses serialize_bytes; a CBOR array/base64 string is not a valid payload. Debug and protocol-error displays omit payload bytes and invalid peer input.
+
+Read/write helpers operate on an owned reader/writer task. Clean EOF is distinct from a truncated prefix/body; a partial-frame timeout invalidates that transport rather than retrying from the middle. Callers supply an absolute IO deadline consistent with startup, invocation or idle leases. Cancellation of a helper authorizes retirement of that connection only; reconnect/replay is forbidden. The protocol has no registry credentials or arbitrary commands. Cancel Ack proves session invalidation, not termination of user code; the environment owner must still kill/reap the function before cleanup settlement.
+
+The existing workspace [Ciborium0.2.2](https://docs.rs/ciborium/0.2.2/ciborium/) provides CBOR/Serde encoding after preflight. Byte payload serialization uses the existing Bytes implementation; no second byte-buffer abstraction is required. Tests cover every variant, binary payloads, fragmented transport, clean/truncated EOF, malicious lengths/depth/duplicates/unknown fields, metadata/payload limits, canonical identities, timed partial IO and redacted Debug/errors.
+
+### 3.2 Runtime session ownership
+
+RuntimeSession is the single owner of idle/queued/delivered/closed invocation state and the first-poll readiness signal. HTTP adapters validate routes/headers/body budgets before sending typed commands over a bounded mailbox; the relay adapter validates protocol/environment/attempt before submitting the same commands. Only one queued or delivered attempt and one waiting GET /next are retained per environment. Concurrent polls/invocations reject explicitly. The first valid GET emits BootstrapReady exactly once, even when no job is queued. Completing an unknown/expired/already completed attempt cannot consume another attempt's response sender. Init failure and cancellation close the session; cancelled environments cannot accept another invocation.
+
+The native HTTP adapter keeps its127.0.0.1 ephemeral socket and public executor module reexports. The relay binds127.0.0.1:9001. Both use identical session metadata/result/deadline rules, and adapter shutdown joins all connection/session tasks. Native init timeout waits for first-poll readiness rather than treating process creation as readiness. The relay's outer process supervisor owns stdio/HTTP tasks and exits on malformed control input, EOF, parent lease expiry or closed session; no transport failure silently recreates a session.
+
+The shared session API has a RuntimeSession owner, cloneable SessionHandle and InvocationTicket. start(idle lease) creates one actor with an eight-command mailbox; the owner exposes its handle, first-poll readiness and a take-once initialization-error receiver. submit(validated Invocation, command deadline) returns a ticket only after actor admission. next(command deadline) permits one outstanding poll and returns the delivered Invocation. complete(attempt, optional Invocation-Id, outcome, payload, command deadline) validates both identities and active deadline atomically before resolving the ticket. initialization_error(payload, command deadline) is legal only before any event delivery, reports once and closes the session. Transport adapters convert SessionError into their own HTTP/control outcomes without logging invalid values.
+
+Invocation has validated attempt/ARN/trace/payload fields and an absolute monotonic deadline. Ticket wait returns a typed success/function-error/init-error result. Dropping an attached ticket, including cancellation of its wait/admission future, signals a dedicated per-attempt cancellation receiver. A ticket's cancel signal never targets a later attempt. Cancellation/expiry invalidates the session, resolves the current ticket/poll once, and forbids reuse. Concurrent calls receive Busy, stale/foreign completion receives UnknownAttempt without consuming active ownership, and RPC queue overload is explicit. A cancelled long-poll waiter may be replaced without losing a queued invocation. Result delivery to a disconnected ticket closes the session rather than accepting further work.
+
+Offering an event through a oneshot channel is not delivery proof: retain the queued Invocation until next() consumes its response and synchronously acknowledges a per-poll receipt. A dropped response future closes that receipt and restores the queued event. Prioritize receipt processing before later mailbox commands so immediate completion observes Delivered. Before dispatching each selected mailbox command, synchronously reconcile any ready/closed receipt and recheck stop/attempt validity: biased select alone cannot order concurrently arriving messages on separate channels. Once the adapter receives an event, failed HTTP transmission requires retiring its environment rather than silently replaying; the receipt does not prove user-code execution.
+
+```text
+┌─ RuntimeSession owner ───────────────┐   ┌─ SessionHandle / adapter ─────┐
+│ priority stop + retained join      │   │ submit / next / complete     │
+└──────────────────┬─────────────────┘   └──────────────┬────────────────┘
+                   │ stop watch                         │ bounded mailbox8
+┌─ Session actor ───▼────────────────────────────────────▼───────────────┐
+│ Idle ──submit──▶ Queued ──offer to poll──▶ Offering                   │
+│                   ▲                         │ per-poll receipt        │
+│                   └── receiver disappears ──┤                        │
+│                                             └── consumed ─▶ Delivered│
+│ Idle ◀──────── matching, active completion ────────────────────┘      │
+│ stop / cancellation / expiry ─▶ Closed: fail pending ticket + poll    │
+│ recheck attempt validity at offer, receipt and completion transitions │
+└──────────────────────────────────────────────────────────────────────┘
+    InvocationTicket drop → per-attempt cancellation watch
+    Closed session → environment owner terminates external resources
+```
+
+The actor prioritizes owner stop, active attempt cancellation/deadline and idle lease expiry over mailbox traffic. Activity refreshes the idle lease only at valid session commands; a running attempt uses its own deadline. Each command envelope carries its absolute RPC deadline, checked again before state mutation. Shutdown signals the actor and awaits its stored join handle by mutable borrow, so a cancelled shutdown waiter cannot lose the task. Cache failed joins so repeated shutdown never reports false success. Owner Drop signals stop and leaves the actor to finish its in-process channel cleanup; adapters still own/await their HTTP tasks and external execution resources. The parent Tokio runtime must remain alive until normal service shutdown has joined these owners. Paused-clock and contention tests pin single admission/delivery/settlement, cancelled poll replacement, stale-completion isolation, old-ticket cancellation, init/readiness, idle/attempt deadlines, overload and dropped shutdown/admission waiters.
+
+### 3.3 Shared HTTP adapter and Native startup
+
+The runtime library's HTTP adapter binds only an explicitly supplied loopback SocketAddr (Native127.0.0.1:0, relay127.0.0.1:9001). RuntimeApiHandle exposes its address/session port, take-once initialization notification and cancel-safe joined shutdown. One owned server task retains RuntimeSession and a JoinSet of at most eight HTTP connections (D94); an independent four-permit nonblocking POST admission bounds body collection plus its session command to the preceding24MiB maximum. GET/next does not acquire a body permit; exhausted POST admission returns429 without consuming session state. Stop/session closure ends admission, signals graceful HTTP shutdown under a five-second deadline and joins every connection, then joins the session. This lets an accepted initialization-error response reach the RIC before closure; timed-out connection futures close their sockets and fail settlement. Drop signals the retained supervisor rather than losing ownership. Failed supervision is cached and prevents a later successful shutdown claim.
+
+HTTP parsing limits are compile-time constants:16 KiB header buffer/aggregate header bytes,64 headers,256 bytes per ordinary value and256 bytes per request target. D94 permits one exact `Lambda-Runtime-Function-XRay-Error-Cause` value≤8KiB only on a canonical POST invocation/error route; this ignored optional official-RIC metadata shares the unchanged16KiB total. Its bounded opaque HTTP field bytes may include obs-text (0x80..0xff); reject C0 controls and DEL, duplicates, excess length and misplaced large values. Do not parse it as JSON, persist it or include it in diagnostics. Other values retain printable ASCII/256-byte limits. Reject absolute-form targets, query strings and duplicate Invocation-Id headers. Routes match the entire method/path and canonical attempt UUID; extra path segments do not reach the session. GET bodies must be empty. POST bodies are raw bounded bytes≤6 MiB, collected with a five-second absolute deadline shared with command processing. Reject all HTTP trailers before session mutation; streaming responses are outside this profile. Content-Length over the limit rejects before reading the body. Header parsing has its own five-second deadline. GET /next waits within the configured session idle lease instead of a five-second business timeout. Responses to rejected requests close the connection; normal RIC keepalive remains supported.
+
+Wrap the HTTP supervisor and every spawned connection future with an independent task-bound subscriber filter that suppresses Hyper/hyper_util DEBUG/TRACE regardless of the application's subscriber/RUST_LOG. Preserve allowed application span IDs/context and events through delegation. The initial Hyper1.11.1 source audit found partial chunk-trailer buffers in TRACE before application validation, so rejecting trailers alone cannot establish secrecy. The current Hyper1.12.0/Tokio1.54.1 stack retains this mandatory filter and the captured-secret regression. Capture a fragmented secret trailer under TRACE as well as ordinary header/body/target values. This shared adapter filter is separate from the mandatory Bollard filter at the future Docker boundary.
+
+GET responses include Request-Id, Invocation-Id (the same synthetic attempt UUID), checked epoch-millisecond Deadline-Ms, requested Function-Arn and a syntactically valid local Trace-Id. This local profile generates a fresh request/attempt UUID for every Invoke rather than implementing event-source event identity across redelivery. If Invocation-Id is present on completion it must match the path and delivered attempt; omission stays compatible with older RICs. Mismatch uses400/InvalidInvocationId without echoing values, Busy maps409, unknown attempts400, expired requests408 and closed sessions503. Successful completion/init error returns202. Infrastructure traces contain bounded classes/counts only, not targets, headers or payloads. This follows the [current AWS Runtime API contract](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html).
+
+Native starts the API/session before spawning the bootstrap, then waits under one initialization deadline for first valid GET /next, initialization error, process exit or caller cancellation. Spawned children remain owned and are terminated/reaped on every failed/cancelled startup branch; API/session tasks are joined before clean settlement. The handler budget is captured after successful first-poll readiness when dispatching the event, additionally bounded by the caller's absolute deadline. Initialization time cannot consume/extend an unbounded fresh handler/Task budget. Runtime API errors still require retiring the process before propagating failure. Keep the executor module's runtime_api reexports, replacing the old pending-map/queue implementation with the shared adapter rather than maintaining a second session engine.
+
+### 3.4 Relay control supervisor and process entry point
+
+RelayHandle owns one supervisor; Drop signals priority stop and leaves that supervisor owning API/control cleanup, while shutdown joins/caches its result without moving the join handle across awaits. The supervisor owns RuntimeApiHandle, dedicated control reader/writer tasks and bounded two-message input/output mailboxes. A queued output includes a write receipt; Hello, Ready, results and acknowledgements count as emitted only after the frame is flushed. Unexpected IO/task termination invalidates the environment without reconnect/replay. Every exit closes/joins the API and aborts/joins the in-process IO workers; external function termination remains the host environment owner's responsibility.
+
+Relay state is Initializing→Idle→Busy(ticket)→Idle; cancellation or initialization/function failure enters Retiring. Retiring accepts Close and idempotent Cancel for the last attempt until its bounded cleanup lease expires; acknowledging another matching Cancel must not extend that lease. Unexpected session closure or attempt expiry invalidates the control connection and exits under joined cleanup; the host must retire the external environment on that transport failure. Emit Hello then Ready after listener creation, and BootstrapReady once on the first valid GET /next. Invoke requires Idle and a matching environment UUID; reject wrong-direction messages, overlapping calls, wrong-scope frames and mismatched cancellation IDs. Validate/convert deadlineUnixMs before session admission. Keep attempt ticket ownership while selecting result versus control input; a cancel-safe borrowed ticket result method must not drop/replay a pending result or permit polling an already consumed oneshot. Completion and Close/Cancel races settle once; Cancel invalidates/closes the session before its Ack, never claims external user-code exit. Close joins the API and flushes Ack before IO teardown. A reader that queued Close may finish without making the supervisor discard that queued Close.
+
+Separate first-byte waiting from partial-frame IO: silence is bounded by the larger of the session idle lease and one hour (the validated wall-deadline ceiling), while receipt of the first byte starts the short control IO budget for the remainder of the frame. Session/retirement deadlines still stop an idle/busy relay sooner. Do not cancel/restart a partially read frame when adjusting leases. Output writes use the short absolute IO budget. Defaults are idle600s, IO5s and retirement10s; validate the same local ranges as their owner budgets.
+
+The `rustack-lambda-runtime` executable is Linux-only and serves127.0.0.1:9001. Required private child environment is RUSTACK_LAMBDA_ENVIRONMENT_ID; optional RUSTACK_LAMBDA_RELAY_IDLE_SECONDS / IO_SECONDS / RETIRE_SECONDS forward the owner's validated configuration without adding a new user configuration loader. Reject invalid/noncanonical values without echoing them. Advertise the binary's compiled x86_64/arm64 architecture. Stdout contains control frames only; diagnostic errors use bounded static tracing classes on stderr.
+
+Use safe OwnedFd clones of stdin/stdout with Tokio Unix pipe Receiver/Sender::from_owned_fd inside the entered IO runtime. The current Tokio1.54.1 constructors validate pipe/access mode and enable nonblocking IO. Do not use tokio::io::stdin or a blocking read task: cancelling its future does not stop the blocking read and can keep runtime shutdown waiting after a lease expires. Reject nonpipe descriptors/unsupported platforms explicitly. Unit tests use owned cancel-safe duplex streams; process tests exercise pipe EOF/Close and actual Linux builds precede Docker qualification.
+
+The optional local `test-lambda-runtime-docker` target builds the relay image and explicitly runs the resource-gated process suite against the selected local Unix socket. Missing Docker/images fail this explicit target; ordinary workspace tests do not pretend to provide Docker evidence. The test-only Docker CLI supplies non-TTY binary stdin/stdout; the production executor still requires the separately supervised Docker attach client. Preallocate unique container names and a run label before allocation so setup failures retain reconciliation ownership. Always remove both owned names, reap the CLI process and verify no run-labeled containers remain, even when the assertions fail. Exercise Hello/Ready/Close before a function exists, control EOF/truncation, and an unchanged official RIC image's computed result, warm counter, handler error and busy cancellation. These relay checks do not establish SDK/provider, deployment/pool or full M0 acceptance.
+
+### 3.5 Host control client and shared stream ownership
+
+The runtime crate's client module exposes ClientConfig::new(environment, architecture, io_budget), ControlClient::start(config, reader, writer), next(absolute_deadline), invoke(Invocation, absolute_io_deadline), cancel(attempt, absolute_io_deadline), begin_close(absolute_io_deadline) and shutdown(absolute_cleanup_deadline). Configuration validates a nonzero IO budget≤60s; invocation metadata uses the same checked wall deadline conversion and validated Invocation types as the local session. ClientEvent distinguishes RelayReady, BootstrapReady, InvocationResult(attempt, RuntimeResult), InitError(payload), Cancelled(attempt) and Closed. Payload Debug remains redacted. The client owns protocol state; it never owns or claims termination of external containers.
+
+Share the relay's control-stream workers with the host through an internal transport owner. It owns bounded two-message mailboxes, partial-frame parsing, flush receipts, stop signal and a retained supervisor. The reader stops after queuing its direction's terminal message (Close on relay input, Ack/close on host input), so normal peer EOF cannot overtake a queued terminal acknowledgement. First-byte silence and partial-frame IO remain separate budgets. Drop signals stop; shutdown joins/caches its supervisor by mutable borrow, preserves completed IO failures and awaits every aborted worker. A cancelled next() waits on a cancel-safe mailbox receive; it never drops the worker's partial parser. Relay API shutdown still belongs to RelayHandle, before transport retirement.
+
+Host receive state is AwaitHello→AwaitReady→Initializing→Idle→Busy(attempt)→Idle. Validate environment and advertised architecture before accepting Ready; consume Hello internally and return RelayReady only after the ordered pair. BootstrapReady is accepted once after Ready. Invoke requires Idle and a fresh last-attempt identity. Success restores Idle; FunctionError or InitError enters Retiring. Only one result per attempt is legal; any invocation result proves delivery, after which InitError is causally invalid even during later calls/cancellation. Recheck absolute receive/send deadlines after await and before successful state mutation: an already-ready inner future can win Tokio timeout polling after expiry. Reject duplicate/out-of-order/wrong-direction/foreign-scope frames and mismatched result/ack IDs without echoing their contents; invalidate the transport without replay.
+
+Set a local write-in-progress flag before awaiting a flush receipt, clearing it only after success. If a send future is dropped, that flag makes later business operations fail closed: the invocation may already have reached the relay. The retained writer still owns any partial frame. Cancellation accepts the active or just-completed last attempt, sends Cancel, and waits through next() for its matching acknowledgement. While Cancelling, at most one matching late result/init failure can be discarded before Cancel Ack; it cannot settle the cancelled call. Matching Cancel after completed/error settlement is permitted to cover completion/cancel races. No fresh Invoke is permitted after cancellation.
+
+begin_close sends Close after the Hello/Ready handshake and records closure separately from receive state. Until Ack/close, continue validating already queued bootstrap/result/init/cancel events in their ordinary causal order. Ack/close is illegal before an outstanding Cancel Ack. shutdown completes the handshake if necessary, begins closure once, consumes permitted prior events until Closed, then stops/joins IO. A protocol/IO/deadline error invalidates the session; shutdown still joins transport ownership and caches failure. Dropped shutdown waiters retain ownership and a later call must not turn an uncertain write or failed join into success. The environment owner stops/removes the function independently and retains its allocation reservation through confirmed cleanup or quarantine.
+
+```text
+┌─ Host environment owner ───────────────────────────────────────────────┐
+│ ControlClient: ordered handshake / active attempt / cancellation       │
+│ next() may be selected/cancelled; invoke/cancel/close await flush       │
+│                       │                                               │
+│       ┌───────────────▼─ shared transport supervisor ────────────────┐ │
+│       │ bounded frame mailbox2 ◀── retained partial-frame reader     │ │
+│       │ bounded write mailbox2 ──▶ retained writer + flush receipts  │ │
+│       │ stop / cached join outcome; abort and join both workers      │ │
+│       └──────────────────────┬───────────────────────────────────────┘ │
+└──────────────────────────────┼─────────────────────────────────────────┘
+               demultiplexed Docker attach streams (no reconnect)
+┌──────────────────────────────▼─────────────────────────────────────────┐
+│ Relay transport / RelayHandle ── RuntimeApiHandle ── official RIC       │
+│ Close Ack: API joined + frame flushed; external function still owned  │
+└────────────────────────────────────────────────────────────────────────┘
+```
+
+Tests pair real relay/shared HTTP with the host client over fragmented duplex streams. Pin ordered readiness, actual HTTP result/error forwarding, warm attempts, wrong scope/architecture/order/IDs, duplicate outcomes, cancellation with a late result, Close with queued events, cancelled next/send/shutdown waiters and cached IO failures. Re-run real Linux relay/RIC qualification after extracting shared IO; a production Docker attach adapter is still required before executor acceptance.
+
+### 3.6 Bounded Docker API boundary
+
+The pinned [Bollard transport study](../docs/research/study-bollard-docker-transport-boundaries.md) supersedes the initial ordinary-pipe-client recommendation. Reuse its independently published generated `bollard-stubs` models/query types (`1.53.1-rc.29.3.1`, default features disabled); own the small Unix HTTP/upgrade adapter for the operations this feature needs. Ordinary Bollard response collection and its permissive log decoder do not enforce these local pre-materialization limits. This changes the transport implementation, not the Docker API or runtime protocol. No production shell/CLI transport, TCP/SSH fallback or TLS feature is introduced.
+
+DockerSocket is a validated operator-owned unix:// absolute path≤4,096 bytes, without controls/NUL. Resolve/check its Unix-socket metadata under an IO deadline; never consult ambient DOCKER_HOST or discover another socket. DockerWire owns bounded business/cleanup mailboxes of32/8 commands and at most eight short management jobs: six ordinary slots and two reserved cleanup slots. Kill/remove/inspection/reconciliation use the priority cleanup lane; owner stop has its own signal. Blocking lifecycle waits use a separate eight-command mailbox and at most32 retained wait jobs, bounded to one per allocated environment by the environment owner. They cannot occupy management or kill/remove reservations: two waits on running containers must never prevent the kills needed to release them. Ordinary deployment/start work cannot consume the reserved cleanup slots. Cloneable ports submit typed request envelopes with an absolute deadline; Drop of a response waiter never authorizes replay or loses connection-task ownership. The environment/deployment actor retains names/labels and side-effect reconciliation above the wire layer.
+
+```text
+┌─ typed DockerPort ────────────────────────────────────────────────────┐
+│ business mailbox32 ──▶ six short management jobs ──┐                  │
+│ cleanup mailbox8   ──▶ two reserved cleanup jobs ──┼─▶ owned Unix HTTP │
+│ wait mailbox8      ──▶≤32 lifecycle wait jobs ─────┘    drivers        │
+│ priority owner stop ─▶ close admission + signal and join all jobs     │
+└───────────────────────────────┬───────────────────────────────────────┘
+                                │ supervised handoff (release short slot)
+┌─ environment / deployment owners ────────────────────────────────────┐
+│ attach / following logs / pull streams retained under their existing │
+│ allocation reservations; stop/join independently before wire shutdown │
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+The host boundary lives in rustack-lambda-core::docker. DockerWire::connect(socket, deadline) starts its retained owner before awaiting version negotiation; dropping connection startup signals that owner rather than losing request drivers. port() returns a cloneable DockerPort; shutdown(&mut self) stops admission, signals and joins requests, and caches failure. DockerPort exposes typed version/info/image inspection and container create/start/inspect/kill/wait/remove/list/attach methods; stream/network/pull methods land with their consumers. Endpoint templates are private. DockerKey validates bounded identifier/name syntax and all path components are percent encoded. Labels supplied by the environment owner remain authoritative for mutation/reconciliation authorization above this transport layer. Request Debug exposes operation class/byte counts, never target/body values. Each upgraded attachment joins its HTTP driver before handing off an owned stream; split(io_budget) supplies a strict DockerOutputReader and raw stdin writer for the retained environment pumps. Reader next(deadline) yields redacted typed stdout/stderr chunks≤16 KiB; its record deadline survives chunk boundaries, and dropping an in-progress read poisons that reader rather than restarting partial framing.
+
+Each management request owns a fresh Hyper HTTP/1 connection to that socket, with no keepalive pool. One retained job owns connect, handshake, request, bounded response consumption and connection-driver termination through join. Use a single absolute request deadline≤600s and recheck the clock after awaits and typed deserialization. Bound socket connect, HTTP header parsing, upgrade negotiation and body/frame IO; do not leave a detached Hyper driver or count response headers as complete body success. Ordinary one-shot HTTP drivers use without_shutdown to recover/drop their owned IO, avoiding redundant half-close errors after Unix peer EOF; upgraded drivers join before transferring the socket. Cancellation/expiry closes that request's IO and joins its driver. Caller cancellation does not implicitly cancel/retry the service-side resource operation; preallocated identities and reconciliation handle uncertain create results. Environment cancellation retains an already-issued create under its independent bounded Docker IO budget, then cleans its outcome; caller Task expiry is not permission to drop that create future. An uncertain create cannot be declared clean solely because one immediate name lookup returned404.
+
+Compile-time wire quotas: management request/response bodies≤1 MiB each; response header buffer≤16 KiB,≤64 headers and≤4 KiB per value; request target≤4 KiB; decoded metadata JSON depth≤32,≤4,096 aggregate members/elements and≤16 KiB per scalar string. The larger scalar ceiling deliberately permits Docker inspection/configuration metadata; stricter image argv/environment/identity rules still validate before domain publication. Reject duplicate JSON object keys, HTTP trailers, wrong content framing and oversized Content-Length before collection. Stream chunked bodies through a byte limiter before materialization. Do not forward raw daemon error text, response bytes, registry credentials or URLs into infrastructure diagnostics; expose bounded operation/status/error classes with redacted sources.
+
+Use a reusable rustack-core::json preflight before generated-model deserialization: JsonLimits::new(bytes, container_depth, aggregate_members, string_bytes, key_bytes), validate(bytes, limits) and from_slice<T>(bytes, limits). Enforce the Docker key cap256 bytes in addition to the scalar ceiling. A linear lexical string pass bounds encoded escape expansion before Serde scratch allocation; a DeserializeSeed visitor validates depth/counts/decoded lengths and duplicate decoded keys without building a Value tree. Drop each object's bounded key set after preflight; only then materialize the requested typed model. Error classes distinguish invalid limits, size/depth/count/string/key bounds, duplicates, syntax and target schema without retaining untrusted error text. Tests pin decoded escaped-key duplicates, byte-based Unicode limits, root/container depth, aggregate arrays/maps, malformed numbers/escapes, input limits and panic-free bounded malformed input. These shared primitives may be reused by the ASL compiler, whose own profile/domain validation remains separate.
+
+Negotiate API versions from a bounded /version response. Support the local1.44..1.53 profile: select min(daemon ApiVersion,1.53), require that selection≥daemon MinAPIVersion and1.44, and reject malformed/incompatible versions. Validate daemon Linux OS/architecture and required resource capabilities during startup. Use fixed typed endpoint templates and correct path-component/query encoding. Initial operation families are version/info, image inspect/pull, container create/start/inspect/kill/wait/remove/list, attach/logs, scoped network create/inspect/remove and bounded startup-probe exec. This is a deliberately scoped adapter; arbitrary user-selected Docker paths/methods/headers never reach it.
+
+Attach establishes the versioned HTTP upgrade before relay start. Its owner retains the Hyper driver until successful upgrade transfer, then owns the upgraded stream and supervised read/write pumps through shutdown. Attach, following logs and pull-progress jobs release their management slot only after transferring the stream **and** retained driver supervision into an owned response. A dropped/failed handoff signals and joins that connection's cleanup. Long-lived stream owners do not retain management slots: they are bounded by the existing environment reservations (control plus function-log streams, up to32 environments) or deployment reservations (pull streams). Thus warm environments cannot starve inspect/kill/remove admission. Do not pass streams through the ordinary Bollard LogOutput decoder. Require a non-TTY multiplexed eight-byte Docker output header: stdout1/stderr2, zero reserved bytes and declared payload≤8 MiB. Reject console/stdin/unknown channels, malformed/truncated headers/payload and oversized declarations before allocating. Stream payload in≤16 KiB chunks instead of buffering a whole Docker record. Docker record and CBOR frame boundaries are independent. Route relay stdout only into the bounded ControlClient byte stream, drain relay stderr into bounded diagnostics storage without logging its raw content, and preserve raw stdin writes separately. A read failure invalidates the environment without reconnect/replay. Missing Close Ack or uncertain stream cleanup cannot release an environment reservation as clean.
+
+Function logs use the same strict outer framing with their own retained owner and bounded stdout/stderr rings, never sharing a control mailbox. Drain/count/drop excess output instead of blocking the handler. Control and log readers distinguish first-byte/idle waiting from partial-record IO; once a record starts it has the short control IO deadline. Stop signals must interrupt silent or flooding streams. Pull progress is bounded JSON-line streaming,≤64 KiB per line and≤4,096 bytes per displayed error, with the configured total pull deadline; discard progress after extracting bounded status/counts and never aggregate the whole layer-progress stream.
+
+Mandatory task-bound diagnostic filtering covers Hyper/hyper_util and Bollard DEBUG/TRACE during construction and polling, including every spawned IO task. Keep the model-only production path and its filter explicit; the P0/full-client compatibility probe may still use Bollard and must not reintroduce verbose payload logs. This refines W01 rather than waiving it. Fake local Unix daemons must test oversized/chunked bodies, duplicate/recursive metadata, headers/trailers, malformed multiplexed lengths/reserved bytes/channels, truncated EOF, slow partial records, dropped waiters and TRACE-secret capture. Real daemon tests must prove 6 MiB-class control payload fragmentation, normal Close/Ack and no owned allocation left behind. Startup/limit enforcement and actual SDK executor acceptance remain task1.3–1.4 gates.
+
+### 3.7 Retained function log capture
+
+The function's stdout/stderr use a separate output-only Docker attachment, established before container start with stdin=false, stdout/stderr/stream=true and logs=false. `DockerPort::attach_logs` uses the same strict upgrade and joined driver as control attach, releases the short management slot after handoff and never replays previous output. Its live owner is bounded by the environment reservation; it is not a control-stream producer. This implements continuous streaming without a second HTTP-body framing parser or the daemon's persistent log API.
+
+`FunctionLogs::start(attachment, partial_io_budget, ring_bytes)` validates record IO (positive≤60s) and ring capacity (4,096..1,048,576 bytes per channel, default operator budget262,144), reserves storage fallibly, then starts one retained actor. It owns the DockerOutputReader, separate stdout/stderr byte rings and a combined4,096-byte tail preserving observed chunk order. Excess output overwrites oldest bytes with saturating per-channel discard counters; never decode UTF-8, split lines, trace raw bytes or block waiting for a log consumer. A snapshot exposes only the combined tail, counters and closed/failure classification; Debug reports sizes/classes. Tail bytes are intentional Lambda API output and may contain arbitrary binary/user secrets.
+
+The actor's snapshot mailbox holds at most8 requests. Every envelope carries an absolute deadline; reject expired requests before copying a tail. `snapshot(deadline)` waits cancel-safely; abandoned read-only requests grant no mutation authority. Keep one partial-record read future pinned across snapshot traffic: cancelling it merely to answer a snapshot would poison/lose framing. Service at most one already-queued snapshot before polling the read, then select stop, the retained read and further snapshots, so neither log flooding nor snapshot flooding starves the other. Explicitly yield after64 chunks. First-byte silence has a fixed one-hour safety ceiling; partial-record IO keeps the reader's short deadline, independent of snapshots. Environment idle/attempt/cleanup deadlines remain authoritative and normally end a silent attachment earlier.
+
+Stop has a separate priority watch signal. `shutdown(&mut self)` signals stop and awaits the stored join by mutable borrow, retaining ownership if the waiter is cancelled; cache either the final snapshot or failure so repeated shutdown cannot report false success. Drop signals the same actor, which drops its owned socket without requiring an entered runtime. EOF marks capture closed; parser/IO/deadline failure is retained and observable through snapshots and fails joined shutdown. Drop the socket immediately on EOF/parser failure, but keep the actor available for final snapshots until owner stop, rather than losing already-captured bytes. Closing this log stream never proves container termination; environment cleanup must independently stop/wait/remove the function and relay. Unit tests cover binary order/tails, independent channel bounds/discards, record fragmentation under snapshot traffic, flood/stop responsiveness, quiet cancellation/EOF, malformed input, cancelled snapshot/shutdown waiters and cached supervision errors. Real wire qualification attaches to the function before start, captures explicit handler stdout/stderr, verifies its computed response and joins logs separately from container cleanup. This is a consumer primitive; it does not enable the production executor.
+
+### 3.8 Delivery-based handler clock and protocol v2
+
+The caller's absolute deadline continues to bound queueing, cold start, delivery and execution. A separate validated HandlerTimeout represents the captured function timeout (whole seconds1..900) as1,000..900,000 milliseconds on the control wire. Standalone Invocation defaults to no separate handler clock; `.with_handler_timeout(validated timeout)` attaches one without starting it. Docker environment calls always attach the immutable revision's timeout immediately before sending Invoke; callers cannot extend it. Native's shared session consumer validates/attaches the same captured timeout before allocating a process. This local on-demand profile excludes Managed Instances; [AWS timeout configuration](https://docs.aws.amazon.com/lambda/latest/dg/configuration-timeout.html) defines the applicable second-granularity limit.
+
+Delivery starts when SessionHandle.next consumes its offered invocation for the HTTP adapter, immediately before sending the synchronous consumption receipt. It does not start on submission, a pending GET, first-RIC readiness or an offer which is never consumed. Compute `effective = min(caller_absolute, consumed_at + handler_timeout)` with checked arithmetic. Return that effective deadline in the Invocation consumed by the HTTP adapter, hence in Lambda-Runtime-Deadline-Ms; the [Runtime API](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html) defines this header as the function's timeout timestamp. The chosen Rustack boundary precedes HTTP response transmission; network transmission consumes the same handler budget and an uncertain/failed transmission retires the environment without replay.
+
+The receipt carries the monotonic consumed_at Instant. The actor retains the original unshortened Invocation while Offering; only a successful receipt installs the same effective deadline into Pending. A dropped offer restores the original queued call without starting or consuming handler time. Reconcile receipt before Complete/InitError and every expiry decision; a delayed receipt processed after its effective deadline must immediately settle as expired rather than accept a late result. Keep both absolute and handler classification: if handler expiry is strictly earlier, return SessionError::HandlerTimeout; otherwise outer expiry (including an exact tie) remains SessionError::Deadline. InvocationTicket still enforces its outer deadline when consumed; a valid result completed before effective expiry remains valid even if its waiter resumes after handler expiry but before outer expiry. Cancellation and environment stop retain their independent priority.
+
+Protocol v2 adds optional handlerTimeoutMs to Invoke and a distinct InvocationTimedOut(attempt) relay result. Reject version1 instead of silently running with an older relay that cannot enforce this contract; rebuild/pin the operator relay image with the host. Framing/CBOR limits and all other variants remain unchanged. Relay converts only a delivered HandlerTimeout into InvocationTimedOut, then enters Retiring and closes the Runtime API; caller deadline/transport failure is never reclassified as handler timeout. ControlClient accepts exactly one matching timeout in Busy, forbids reuse and treats it as one discardable late outcome during matching Cancel. Foreign/duplicate/idle/initializing timeouts, or a timeout without an attached handler budget, reject. InitError after a timeout is invalid because timeout proves delivery.
+
+EnvironmentManager maps the matching event to typed Timeout(captured duration), invalidates the attempt and completes the existing verified-ID function/control/relay retirement before replying. Pool never returns that environment to the warm LRU and does not replay the call. Native maps the shared HandlerTimeout to ExecutorError::Timeout while retaining existing cancellation, process reap and API joins. Final provider Invoke/ASL error-envelope mapping remains part of executor/integration acceptance.
+
+```text
+Host / Environment          Relay session actor          Runtime API adapter / RIC
+ │ outer deadline + timeout       │                               │
+ │ Invoke v2 ────────────────────▶│ Queued: outer clock only       │
+ │                                │◀──── GET /next ───────────────│
+ │                                │ offer original call ─────────▶│
+ │                                │◀── consumed_at receipt ───────│ start handler clock
+ │                                │ effective=min(outer,start+T)  │ Deadline-Ms=effective
+ │                                │◀──── completion ──────────────│
+ │◀──── success/error ───────────│ only before effective expiry   │
+ │                                │ handler expires first         │
+ │◀── InvocationTimedOut(attempt)─│ close API / Retiring           │
+ │ kill/wait/remove function      │                               │
+ │ join IO / remove relay         │                               │
+ │ Timeout after settlement      │                               │
+```
+
+Mandatory tests: timeout range/CBOR schema/version rejection; delayed/abandoned offers do not start clocks; effective header and pending deadline agree; outer-shorter/tied deadline classification; delayed receipt/late completion rejection; successful pre-expiry completion with a later waiter; client timeout correlation/duplicate/cancel races; HTTP and actual relay/RIC timeout retirement and replacement; Native regression gates. No startup/network/probe readiness is inferred from this feature.
+
+### 3.9 Invocation-scoped log windows
+
+The capture actor retains environment-wide diagnostic rings, while an invocation result uses a separate4KiB window. FunctionLogs::begin(attempt, deadline) opens exactly one window before the environment sends Invoke and returns an opaque, noncloneable LogWindow capability with a fresh window UUID and the validated attempt. FunctionLogs::finish(window, deadline) validates the exact capability, copies that window's final combined bytes and closes it. A new window starts empty; it never copies the environment diagnostic tail. Windows run for every invocation, including LogType=None, so a later Tail call cannot inherit an earlier invocation's collected bytes. The existing snapshot(deadline) remains an environment-wide health/diagnostic view; it cannot serve as the invocation response.
+
+Membership is defined by the capture actor's observed stdout/stderr chunk order between successful Begin and Finish commands. This extends §3.7's observed-order contract. stdout/stderr and relay completion arrive on independent streams: an uninstrumented image supplies no cross-stream flush barrier or producer-side invocation labels. Buffered/background output arriving in a later window can therefore reflect earlier work; output observed outside a window stays in diagnostic rings only. Advertise this local timing limitation, retain function/revision isolation, and never claim causality or complete transport flushing. [AWS Invoke](https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html) defines the base64 final4KiB response; the executor encodes the bounded window bytes once. No handler rewrite, synthetic stdout marker, sleep-based flush interval or per-call Docker log replay is introduced.
+
+Reserve the extra4KiB ring fallibly when starting FunctionLogs; Begin clears/reuses that allocation. Keep one active capability at most, with no growing attempt/token history. Reject overlapping Begin, unmatched/foreign/stale Finish, Begin after EOF/failure and expired requests before mutation. Matching Finish after clean EOF may return the final window with closed=true; parser/IO failure still rejects and remains cached for joined shutdown. Snapshot discard counters retain their existing environment-wide meaning. Debug exposes IDs/counts/classes rather than bytes. LogWindow is not serializable or publicly constructible. Its Drop signals a window-specific revocation lane; losing a successfully opened capability (including cross-owner misuse) invalidates its originating capture without claiming an asynchronous join. Matching Finish disarms the capability only after its deadline-validated reply.
+
+The same bounded eight-request mailbox carries Snapshot/Begin/Finish. Keep the single partial-record read future pinned across all commands; byte ownership uses completed observed chunks, including fragments completed while a window is active. Preserve stop priority, request/read fairness and chunk yielding. Every command has an absolute deadline. Read-only snapshot cancellation is safe. For Begin/Finish, set a local pending/failed-mutation latch before enqueue/await and clear it only after a successful, deadline-validated receipt. Dropping/timing out a mutation future, a failed mutation or losing its capability prevents future window mutations on that handle; shutdown remains available. The actor does not mutate for an already abandoned request. A mutation reply carries a separate consumption receipt: retain it in the actor until the public future synchronously acknowledges before its absolute deadline. Watch that deadline even if a ready public future remains alive but unpolled. If a committed reply is lost, its guard is dropped or its receipt expires, fail capture and close its socket rather than permit an unacknowledged lifecycle change to appear healthy. An on-time consumption receipt remains valid if processed later. Stop rejects queued mutation commands and preserves already observable mutation failures during joined shutdown.
+
+The environment owns the capability inside its retained call worker. Open before control send, finish after a matching Success/FunctionError and sample closed/failure regardless of LogType. Preserve the valid business result with a clean-EOF tail but retire that environment. Any send/result/window failure, caller abandonment, timeout or worker failure follows the existing retained container/IO cleanup path; never return a window with another attempt's data or reopen after an uncertain mutation. No artificial flush-delay timers, unbounded log copies or additional Docker streams are needed.
+
+```text
+Environment worker          Function log actor              Docker stdout/stderr
+ │ validate attempt               │                                │
+ │ Begin(attempt) ────────────────▶│ fresh opaque window / clear4KiB │
+ │◀── acknowledged LogWindow ────│                                │
+ │ Invoke → relay/RIC             │◀── observed binary chunks ─────│
+ │                                │ diagnostic rings + active tail │
+ │ matching result                │                                │
+ │ Finish(LogWindow) ────────────▶│ verify capability / close window│
+ │◀── current window + status ───│                                │
+ │ Tail or discard bytes          │◀── outside-window chunks ──────│ diagnostics only
+ │ failure / abandoned mutation   │                                │
+ │ retire / join ────────────────▶│ stop + joined socket cleanup    │
+```
+
+Required tests: silent next invocation returns no collected prior tail; idle diagnostics never seed a window; bounded binary stdout/stderr ordering and overflow; invalid/stale/cross-owner capabilities; expired/abandoned/ready-but-unconsumed mutation receipts; partial records survive window commands; EOF/failure and cached shutdown; diagnostic/window independence under flooding. Actual image-pool qualification must request logs, perform a silent warm call, then a later logging call, verifying observed markers and absence of previously collected markers without weakening real payload/error/cancel/timeout cleanup gates. This closes runtime attribution mechanics; production Executor/provider SDK response wiring remains required.
+
+## 4. Environment states, pooling and cancellation
+
+State enum: Allocating → Initializing → Idle → Busy(attempt) → Idle. Any stage can become Retiring → Removed; failed cleanup becomes Quarantined. PoolActor owns its map and LRU. Bounded Docker IO futures run in a supervised JoinSet; never hold a shared-state lock across IO. Give cancellation a separate priority lane or reserved capacity.
+
+Warm identity includes resource UUID, resolved version, artifact/digest, configuration fingerprint, architecture and backend. Never share across functions. Preserve 32 global warm environments and default 1 retained warm environment per revision. Busy allocations have the same independent global cap; excess concurrent environments retire after completion instead of growing the warm pool. Wait for environment capacity only within bounded queue/deadline budgets. Default idle lifetime is 600s. Init/protocol failures, OOM, timeout and failed invocations retire their environments.
+
+Cleanup ordering: invalidate attempt → cancel relay job → stop/kill function → await exit → remove function → close/remove relay → release environment reservation. Normal execution permits survive through cleanup. If Docker becomes unreachable, retain container IDs and a quarantine allocation reservation against global capacity; the caller may receive failure while reconciliation remains owned by the supervisor. Retry cleanup after 1/2/4 seconds, capped at 30s between attempts. A dropped HTTP future cannot orphan containers. Unresolved cleanup at shutdown sets readiness=false, prevents successful consistency snapshot publication and produces nonzero exit.
+
+Labels include persistent data-directory ownerId, runId, environmentId and function resource UUID. Startup may reclaim old runs only for the same owner after acquiring its directory's exclusive lock. Never delete containers belonging to another Rustack instance based on a generic Lambda label; never delete user images. Keep revision/artifact references alive until invocation cleanup finishes.
+
+### 4.1 Persistent directory lease and namespace capability
+
+`docker::DirectoryLease::acquire(data_directory, absolute_deadline)` issues the persistent owner UUID and a fresh run UUID only after an exclusive OS file lock and durable identity validation succeed. Use the pinned stable `File::try_lock` API on a retained standard File; all synchronous filesystem/locking work runs on at most four blocking workers. Waiting for a worker and receiving its result share the caller's absolute deadline (positive and at most60s). A ready-but-unconsumed worker result retains the work permit until the result is issued/disposed; an accepted long-lived lease does not retain worker capacity. A dropped/timed-out waiter signals cancellation but cannot interrupt an already-issued filesystem operation; its worker/result retains its descriptor and work permit until completion/disposal. No Docker mutation happens in acquisition. This is an ownership capability, not a startup-reconciliation/readiness receipt.
+
+Validate the operator path before IO: absolute, nonempty,≤4,096 encoded OS bytes, no NUL or parent components, and at most128 path components. Normalize the accepted component sequence before IO, removing redundant separators/current-directory components so a trailing slash or /. cannot bypass final-component NOFOLLOW. Existing ancestor aliases such as macOS /var→/private/var remain usable, but the selected root itself must not be a symlink. Validate both logical and canonical existing ancestor chains before creating anything: directory/symlink owners must be the effective UID or root, and directories must not permit group/other writes unless protected by a trusted-owner sticky bit. Operator ACLs and namespace/ancestor entries must not grant untrusted rename/unlink access or be replaced while leases exist. Create missing components with restrictive permissions relative to the pinned trusted ancestor, validating each opened component with NOFOLLOW. Every successful acquisition syncs the resolved root-to-filesystem-root ancestor chain, even on retries through already-existing paths; stop the sync barrier when crossing a device boundary, after validating the remaining trusted path. A failed/expired prior creation therefore cannot hide an unsynced parent on retry. Pin the root descriptor, create/open `.rustack-lambda-docker` relative to it, and require an actual directory owned by the effective UID with no group/other permissions. Use the already-resolved nix0.31.3 safe `openat`/`mkdirat`/`renameat` wrappers with fs/user/dir features; no project unsafe or raw-FD conversion. NOFOLLOW/DIRECTORY/CLOEXEC and NONBLOCK where appropriate prevent symlink/FIFO/device redirection. The managed namespace is exclusively Rustack-controlled; operators must not replace its files while leases exist. This does not promise isolation from an adversary with the same UID or daemon access.
+
+Identity acquisition uses three fixed namespace children (the container journal in §4.8 adds its own two fixed files): `lease.lock` (permanent, empty regular file), `owner.v1` (authoritative immutable identity), and `owner.pending` (bounded initialization staging). Managed regular files must have effective-UID ownership, link count1 and no group/other permissions; reject unexpected file kinds or oversized/malformed contents. Lock `lease.lock` without truncating or unlinking it. A competing independent descriptor/process receives InUse. Never implement exclusivity with a PID file, an in-process registry or a replaceable lock inode.
+
+`owner.v1` contains exactly56 bytes: eight-byte `RSDKOWN2` magic for new journal-generation identities (`RSDKOWN1` remains readable as Legacy under§4.12), the16 raw bytes of a nonnil UUID, and a32-byte SHA-256 checksum over the first24 bytes. The checksum detects accidental byte corruption; it is not authentication against a same-UID writer. Existing records are read through bounded descriptor IO and rejected on malformed size/magic/UUID/checksum; never regenerate a damaged published identity. When absent under the lock, require the pristine descriptor inventory in§4.12, then validate/reuse the fixed pending regular file (≤56 bytes), write a new complete identity, sync it, atomically rename relative to the directory descriptor, and sync both the namespace and data-root directories before issuing the lease. Repeat these syncs even when the owner record already exists, so a prior failed publication sync cannot be bypassed on retry. A first-initialization crash before publication may leave only a bounded pending file; an unsuccessful acquisition never authorizes resource creation. Published identity survives ordinary restart, while run UUID changes on every new successful acquisition. The OS releases the lock after the last owning descriptor closes or the process exits.
+
+`ImagePinScope::new(DirectoryLease)` replaces arbitrary UUID construction; allocation becomes internal to the retained image owner. Every ImagePin retains the scope/lease. The image preparation port, queued pin envelope, live record and emergency recovery therefore keep directory exclusion through uncertain mutations and cleanup joins. Dropping the top-level directory handle cannot release a lock still retained by any of those owners. Unit fake-daemon fixtures may use a private test-only identity constructor; production and real wire fixtures require actual leases. Read-only OwnerFilter UUID construction does not grant mutation/reclamation authority.
+
+```text
+Coordinator                Filesystem worker              Image owner / cleanup
+ │ acquire(path, deadline)        │                                │
+ │───────────────────────────────▶│ open root + private directory   │
+ │                               │ NOFOLLOW, UID/mode/kind checks  │
+ │                               │ try_lock(permanent inode)       │
+ │                               │ read or publish+sync owner.v1   │
+ │◀──── DirectoryLease ───────────│                                │
+ │ owner_id + fresh run_id        │                                │
+ │ ImagePinScope(lease clone) ─────────────────────────────────────▶│
+ │ drop coordinator handle       │            queued/live/recovery │
+ │                               │◀──── descriptor still owned ───│
+ │                               │           last clean owner drop │
+ │                               │◀──── close releases lock ──────│
+```
+
+Errors are typed Configuration/InUse/InvalidState/Deadline/Cancelled/Worker/Io with source IO errors, static bounded Display/Debug and no path/identity bytes in diagnostics. Apply AGENTS.md boundary lints and doc/example requirements. Tests prove stable owner/fresh run, independent-process contention/reacquisition, clone/pin lifetime, malformed/oversized/nil identity, symlink/hardlink/FIFO/mode rejection, bounded pending-file recovery, deadline/cancelled-worker retention and image-manager cleanup ownership. Real wire fixtures keep a temp data directory and use its actual lease. Production Docker selection stays unavailable until the separate startup reconciliation, historical uncertain-effect handling, pool/executor and probe consumers are implemented; a directory lease alone must not advertise a ready backend.
+
+### 4.2 Immutable environment allocation plan
+
+`EnvironmentPlan::new(directory_lease, relay_image, captured_revision, policy)` constructs the two fixed create requests before any daemon mutation. The plan retains the actual directory capability, live relay/function image leases and Arc revision until cleanup owners release it. Allocate one fresh environment UUID and preallocate distinct relay/function names before IO. Labels on both include directory owner/run/environment/function resource identity and a fixed relay/function role; never accept labels or names from invocation payloads. Use captured addressable image IDs plus explicit platforms, and recheck both leases before each create. A plan is not a reservation, reconciliation receipt, executor or readiness proof; the environment owner must register it and retain uncertain-create ownership before awaiting either create.
+
+`ContainerPolicy` validates UID/GID in1..2,147,483,647, requested CPU in100,000,000..16,000,000,000 nanocpus and whole-second relay budgets (IO/retirement1..60s, idle1..86,400s). Under user-approved D105, normalize CPU downward to a10,000,000-NanoCPU quantum (0.01 CPU) once at policy construction. Preserve requested and effective values; all relay/function/probe create plans use the effective value. This never exceeds the requested maximum, preserves the existing0.1..16 range and default1 CPU, and avoids systemd rounding fractional percentages upward. Expose the pair as a bounded `cpu` capability only with retained qualification evidence. Keep the actual probe's exact checked comparison against the effective policy; never accept a higher kernel quota. `NetworkSelection` accepts an explicit none mode for disconnected pure-handler testing or a bounded operator user-bridge name/ID. Reject host, default bridge and arbitrary container sharing; only the plan itself constructs function `container:<preallocated-relay-name>` sharing. Named bridges require separate daemon bridge/ownership validation at startup; parsing a selection does not prove network readiness. The default enabled topology remains a private/user bridge; none is deliberate opt-in and advertises SDK callbacks unavailable. Docker documents [none isolation](https://docs.docker.com/engine/network/drivers/none/) and [container namespace sharing](https://docs.docker.com/engine/network/).
+
+Revalidate externally constructible revisions: Docker backend, Image artifact, live matching Linux architectures, absent ZIP runtime/handler, canonical nonnil revision UUID, bounded function name and resolved numeric version/$LATEST, integral timeout1..900s, memory128..10,240MiB and ephemeral512..10,240MiB. Validate captured user environment under the existing4KiB/count/key rules, separately accepting only the provider's bounded AWS_REGION/AWS_DEFAULT_REGION injections; require matching nonempty region values. Compose a deterministic map with exactly one entry per key: last inherited image value/deletion marker, then captured variables, then authoritative runtime metadata. Bare-name inherited deletion markers remain explicit unless a later tier supplies that key. Do not concatenate duplicate names: process lookup of duplicate environment entries is not a portable precedence mechanism. Inject fixed loopback Runtime API, name/resolved version/memory/timeout, on-demand initialization, log group/stream and task root. Never copy process environment or host credentials. The four Rustack-supplied relay Env entries contain only its environment UUID and validated relay budgets; Docker also retains validated relay-image defaults. No captured function variables or process environment are supplied to the relay. Preserve omitted/empty ImageConfig through the already-validated execution plan, with no shell or tag re-resolution.
+
+Both create bodies explicitly request private cgroup namespaces (never inherit the v1 host default) and disable inherited healthchecks and daemon persistent logging, set Tty=false, no automatic removal/restart, read-only rootfs, cap-drop ALL, no-new-privileges and privileged=false, with no host binds/devices or published ports. Function memory and swap-total are equal (no extra unaccounted swap),256 PID cap and the selected CPU cap; relay is64MiB/64PIDs/0.1CPU. Aggregate memory admission uses checked function+relay bytes. The function /tmp tmpfs has its captured ephemeral byte cap, nosuid/nodev and mode1777; relay /tmp is1MiB. Tmpfs memory still counts against each memory cap. Matching memory/swap semantics follow [Docker resource constraints](https://docs.docker.com/engine/containers/resource_constraints/). Require default seccomp/resource enforcement in the separate daemon probe.
+
+Absent/root/numeric-zero image USER is replaced with configured nonzero UID:GID; preserve bounded nonroot numeric/named image USER declarations and reject malformed user/group grammar rather than passing arbitrary text. Named-account resolution remains the image's own /etc/passwd contract, not a host account lookup or proof against operator-supplied hostile image aliases. The relay always uses configured nonzero UID:GID. Permission-incompatible images fail initialization. No host filesystem/user lookup or credential inheritance is allowed.
+
+Tests pin immutable IDs, platforms, distinct names/labels, image overrides, env ordering/authoritative metadata/redaction, user policy, all resource/swap/tmpfs/health/log/restart fields, invalid revision/policy/region rejection before mutation, and actual directory/image lease lifetime. Real wire qualification consumes the plan for both containers and verifies the handler's cgroup/user/rootfs/tmpfs output, actual argv/workdir overrides, warm/error results and owned cleanup. These are allocation policy checks; environment/pool lifecycle, historical reconciliation, named bridge validation, probes and SDK executor acceptance remain required.
+
+### 4.3 Retained environment owner and allocation reservations
+
+`EnvironmentManager` is the low-level environment owner above DockerWire, separate from the executor's future warm/LRU pool. It accepts only EnvironmentPlans for its retained directory owner/run. Validated EnvironmentSettings bound1..32 allocated environments,256MiB..1TiB aggregate memory including relay overhead,1..60s independent IO/start budgets,1..86,400s idle lease and4KiB..1MiB channel rings. Defaults are32/8GiB,5s IO,15s start,600s idle and256KiB rings. Reserve count and checked aggregate memory before enqueueing; queued/allocating/busy/idle/retiring/quarantined records all retain their reservation. A bounded32-message admission queue and per-environment bounded invocation mailbox cannot create unbounded accepted work. Pool/provider admission remains a separate required consumer.
+
+One root actor owns keyed records above a JoinSet of environment workers. Each record retains Arc plan, reservation, separate relay/function mutation phases, stop/status/settlement channels and a retained IO cleanup task. Record Uncertain before issuing create, retaining a wire mutation receipt. Its RAII guard moves with the accepted request, marks possible issuance immediately before HTTP send and records completion even when validation, connect, queue or worker teardown fails. Only a completed never-issued receipt proves absence without lookup; a still-queued receipt does not. An issued create is awaited under its independent IO budget even after caller/start expiry. Complete400/404 validation failures and unissued mailbox Busy are known no-effect;500, lost/truncated replies and invalid IDs remain uncertain. Never replay create. Observe the preallocated name and verify exact owner/run/environment/resource/role labels, captured Config.Image and canonical64-byte lowercase container ID before adopting it. A foreign/malformed object is quarantined, never killed or removed. An initial404 cannot settle an uncertain create; retain and retry until its single possible commit is observed and cleaned.
+
+Successful initialization is relay create/verify→attach→start→Hello/Ready→function create/verify→output attach→start→BootstrapReady. Always mutate verified container IDs, not a name that could be retargeted. Preallocated names remain the uncertainty recovery keys. Distinguish initialization payload, relay/protocol error, function early exit/OOM, cancellation and deadline errors. Init payloads are capped at32KiB. Worker states are Allocating/Initializing/Idle/Busy/Retiring/Quarantined/Removed; phase and primary bounded error are observable without payload logging. `wait_ready(deadline)` is a cancel-safe read of that state. An owner handle's Drop or explicit cancel signals retirement, independently of entered runtime. Caller loss never aborts accepted create ownership.
+
+BootstrapReady proves a valid Runtime API poll occurred, not that an event was consumed. If that poll is abandoned, InitError remains legal in Idle or during the first queued invocation until delivery. Classify every accepted InitError of at most32KiB as EnvironmentError::Initialization in initialization, idle and busy paths. Oversized InitError and other unexpected events remain Protocol failures. Preserve redacted payload ownership and the same joined retirement before publishing an active call's failure; idle failures remain observable in status and cannot enter the warm pool.
+
+After readiness one worker owns the ordered ControlClient, function log capture and bounded control-output bridge. Invocation commands contain an already-validated runtime Invocation and a cancellation guard. Only one active invocation is allowed; a cancellation guard retains the environment stop signal through response receipt and post-receipt deadline validation. Abandoning even a ready-but-unconsumed reply retires the environment; a successfully consumed result disarms that guard. Results remain raw success/FunctionError bytes with an optional bounded captured tail. Successful calls return to Idle; FunctionError, protocol failure, timeout, cancellation, early exit and idle expiry retire. Selecting/cancelling ControlClient.next is safe; never cancel/replay an invocation send to reuse an uncertain session. Poll bounded container/log/bridge health while initializing/idle/busy rather than inspecting per call. Schedule the next health interval after a completed check, so slow IO cannot accumulate ready timer ticks and starve queued invocation commands. This primitive enforces the supplied invocation absolute deadline and attaches the immutable revision handler clock described in §3.8. Invocation-window ownership follows §3.9; final executor/provider composition remains required before production enablement.
+
+Normal retirement invalidates/cancels the active attempt, then inspects/kills/waits/removes the verified function, joins log/control/bridge IO, then removes the verified relay. Keep count/memory/image/directory references until both container absence and IO settlement are established. Retry cleanup at1/2/4 seconds capped30s; failed cleanup is observable Quarantined and prevents safe readiness/snapshot success. A verified known ID's404 is terminal absence; an uncertain name's404 is not. Separate reserved cleanup concurrency prevents business saturation from starving retirement. No generic container/image deletion is permitted.
+
+IO handles live in a worker guard which transfers them to the record's retained cleanup task on abnormal worker Drop using its captured runtime handle. Root recovery aborts and joins failed workers, then joins their transferred IO and cleans recorded containers before releasing reservations. A root actor Drop transfers records and joins to retained emergency recovery, preserving off-runtime ownership. Shutdown stops admission, retires workers and awaits root/emergency joins through the same absolute caller deadline, preserving ownership across timed-out/cancelled waiters and caching failure. Worker/root panic latches failed admission; clean later recovery cannot rewrite that failure as successful shutdown. A failed IO supervision receipt remains owned/quarantined rather than being treated as clean.
+
+Known operational protocol/IO failures must remain distinct from uncertain supervision. Control transport shutdown joins its workers even after a protocol error; prioritize Worker when combining handshake and IO-join failures so a preceding protocol error cannot mask uncertain cleanup. The environment may retire a known-bad session once its IO and containers are proven stopped, preserving the business error. A failed/aborted cleanup supervisor cannot grant that proof. Tests require ordinary/warm/error execution, count/memory pressure, aborted admission/call/shutdown, critical delayed create including500→404→late commit, foreign labels/IDs, cleanup quarantine/recovery, idle expiry, worker/root panic and actual two-container/IO cleanup. Production selection remains disabled until the executor/pool, historical reconciliation, pulls, network/probes and complete M0 gates land.
+
+```text
+Provider / future Pool         Environment root               Environment worker
+ │ plan + reserved budget ────▶│ record(plan, phases, permit)         │
+ │                             │ ABOVE retained JoinSet ──────────▶│ create/attach/start
+ │◀── handle/status ──────────│                                  │ client + logs + bridge
+ │ invoke / cancel ──────────────────────────────────────────────▶│ one active attempt
+ │                             │                                  │
+ │ drop / shutdown ───────────▶│ priority stop ───────────────────▶│ retire function
+ │                             │                                  │ join IO → retire relay
+ │                             │◀──── known clean settlement ─────│
+ │                             │ remove record / release budget    │
+ │                             │                                  │ panic / abort
+ │                             │◀── guard transfers IO cleanup ────┤
+ │                             │ join failed worker + IO receipt   │
+ │                             │ reconcile phases / quarantine     │
+ │                             │ retain records until proven clean │
+```
+
+### 4.4 Warm checkout and retained pool dispatch
+
+`EnvironmentPool` owns a bounded FIFO of accepted calls, a JoinSet of at most32 invocation/retirement jobs and an LRU of exclusive idle EnvironmentHandles. It consumes validated EnvironmentPlans and runtime Invocations through a cloneable PoolPort; executor/provider wiring remains a required consumer. PoolConfig bounds globally retained warm environments0..32, warm retention per identity0..32 (default1), and accepted waiting calls1..256 (default256). The EnvironmentManager remains the authoritative allocation/memory/quarantine owner. A separate queue permit spans channel admission and the actor's pending queue, and releases only on dispatch/rejection. Calls cannot build an unbounded second queue behind the mailbox.
+
+Warm identity is a SHA-256 of canonical typed allocation inputs: directory owner/run, resource/revision/name/resolved version/backend, architecture, function and relay resolved image metadata, complete ImageConfig, sorted captured environment, timeout/memory/ephemeral storage and operator container policy/relay budgets. Hash raw validated values, never redacted Debug output. Equivalent HashMap insertion orders match. Fresh environment UUIDs/names/log streams are excluded; configuration, image, scope or policy changes do not share environments. Construct the identity before admission and recheck live image leases on dispatch, including the warm path.
+
+The actor services stop and completions before new admissions and periodically expires cancelled/deadline-exhausted calls, reaps dead idle handles and revisits capacity. Dispatch FIFO head to a matching healthy Idle handle or perform one cold allocation. Known no-effect Busy admission may wait and retry; never retry a successfully admitted environment's startup or invocation. If another identity occupies idle capacity, retire the least-recently-used idle handle, await its settlement, then retry allocation. Do not evict busy environments or release their authoritative reservation early. Idle environments retain the manager's independent idle deadline. Per-identity/global warm limits apply on successful return; excess environments retire. A retired handle's identity is not transferable to another function.
+
+Every dispatched call has a separate cancellation lane. Caller timeout/Drop, including a ready-but-unconsumed result, retires its environment. After a successful runtime result the worker waits for the public receiver's synchronous consumption receipt before returning an Idle handle to the LRU. Keep the absolute deadline and cancellation authoritative through offering and receipt waiting even when the public future remains alive but unpolled; worker-side expiry retires that environment. Receipt readiness precedes sender-closed cancellation because successful consumption synchronously acknowledges before dropping its cancellation sender. A valid FunctionError remains a business result but its environment retires. An unsuccessful invocation is not replayed. A waiting public future does not own cleanup: accepted dispatch remains with the actor until resources are reusable or retired. Supplied runtime absolute deadlines govern queue/init/invoke; the environment attaches the captured delivery-based handler clock per §3.8. Invocation windows follow §3.9; final executor/provider integration remains required.
+
+Before spawning any environment task, retain a cloneable retirement receipt (priority stop, status and cached settlement) above the JoinSet. Worker panic aborts admission and retires that receipt even though its exclusive handle was dropped. Root Drop transfers the JoinSet, all receipts and idle handles into captured-runtime emergency cleanup; abort/join workers before awaiting environment retirement. Normal shutdown closes admission, rejects queued calls, cancels dispatched calls and joins every active/idle retirement. Cancelled/timed-out shutdown waiters retain that operation; cached worker failure cannot become success after physical cleanup. Underlying quarantined resources remain accounted by EnvironmentManager and prevent clean pool shutdown. Infrastructure diagnostics never include payload, environment variables or unhashed allocation inputs.
+
+```text
+Caller                   Pool actor / retained registry       Environment owner
+ │ queue permit + plan + call      │                                │
+ │────────────────────────────────▶│ FIFO + immutable warm identity  │
+ │                                 │ matching Idle ──────┐           │
+ │                                 │ cold spawn ────────┼──────────▶│ reserve/create
+ │                                 │ retain receipt     │           │
+ │                                 │ supervised call ◀──┘           │
+ │◀──────── offered result ────────│                                │
+ │ consumed receipt ──────────────▶│ success → bounded warm LRU      │
+ │ Drop / expiry ─────────────────▶│ stop → join retirement ───────▶│ retained cleanup
+ │                                 │ worker/root panic              │
+ │                                 │ abort/join → receipt cleanup ─▶│ quarantine/settle
+```
+
+Tests must pin identity isolation/order normalization, queue+active bounds, FIFO capacity waiting, LRU and per-identity retention, dead idle handles, cancellation before/after dispatch and at ready-result receipt, no replay after startup failure, root/worker abort recovery and cancelled/repeated shutdown. Actual image-RIC qualification must prove warm counter reuse, independent-function/revision cold counters, bounded capacity eviction and no owned allocations after joined shutdown. This pool does not establish startup reconciliation, registry/network/resource probes or production backend readiness.
+
+### 4.5 Supervised pool invocation receipt
+
+The Executor consumer needs a cancellation settlement port distinct from a response future. `PoolPort::start(plan, invocation, capture_logs)` synchronously admits once and returns an exclusive `PoolInvocation`; immediate overload/readiness errors and actor-side scope rejections allocate nothing. Existing `PoolPort::invoke` delegates to start plus wait and retains its response behavior. No method replays an invocation.
+
+`PoolInvocation::wait(&mut self)` is cancel-safe while pending. It preserves the response receiver across a dropped waiter, validates the absolute invocation deadline before synchronously acknowledging a successful result, and disarms cancellation only after consuming a valid offer. A ready-but-unconsumed result still belongs to the retained dispatch worker. A consumed response cannot be consumed twice. Success already proves the environment reusable; FunctionError and ordinary failure offers are published only after physical retirement or a no-allocation rejection. Closed response channels alone prove neither result nor cleanup.
+
+`cancel_and_wait(&mut self, cleanup_deadline)` requests cancellation and closes the unconsumed response lane before validating the independent cleanup deadline. It then awaits a cached per-call settlement receipt. An expired invocation deadline cannot shorten this cleanup budget. A timed-out or dropped cleanup waiter retains its receiver and may resume; Drop signals cancellation without claiming cleanup. After a consumed successful response, this operation only waits for bookkeeping settlement and cannot cancel an environment returned to another call.
+
+Keep each dispatched call's settlement sender alongside its environment Retirement record **above** the pool JoinSet. Normal completion publishes clean only after reusable/retired proof; a failed worker/root carries Worker uncertainty through retained recovery and publishes only after owned physical retirement. Never derive clean from sender Drop, response-channel closure, aborted workers or a cleanup timeout. Queued calls rejected before allocation publish clean settlement. Maintenance retirement has no call receipt. The Executor must retain the Lambda invocation work future/permits through this independent settlement, returning CleanupFailed for unresolved or uncertain ownership. Startup readiness, production enablement and Executor response mapping remain separate mandatory consumers.
+
+```text
+Lambda work owner          PoolInvocation          Pool actor registry       Environment owner
+ │                          │                     [Retirement + receipt]          │
+ │ start ──────────────────▶│ ── bounded admission ─────▶│                         │
+ │                          │                          │ allocate/checkout ──────▶│
+ │ wait (cancel-safe) ──────▶│◀──── result offer ────────│◀── actual result ───────│
+ │ cancellation             │                          │                         │
+ │ cancel_and_wait ────────▶│ ── stop/drop offer ──────▶│ ── retire ─────────────▶│
+ │ keeps permits            │                          │ waits physical + IO ◀───│
+ │                          │◀── cached settlement ─────│                         │
+ │ release only on proof ◀──│                          │                         │
+ └─ waiter/root loss: registry transfers receipt + retirement into retained recovery ─┘
+```
+
+Tests must hold retirement behind a channel barrier and prove cancellation does not return early, including invocation expiry and dropped cleanup waiters. Cover queued no-allocation rejection, consumed-success bookkeeping without retiring warm reuse, root/worker abort recovery and closed-receipt uncertainty. These ownership tests do not establish actual Docker/provider acceptance.
+
+### 4.6 Docker Executor and provider composition
+
+`executor::DockerExecutor` implements the existing object-safe Executor over EnvironmentPool. `DockerExecutorConfig` is a typed-builder input containing the retained DirectoryLease, live pinned relay, ContainerPolicy, matching EnvironmentPort, trusted readiness port and validated DockerExecutorSettings. Settings contain PoolConfig and an independent cleanup budget (whole seconds1..60, default10). Construction validates scope, lease availability, settings and an entered Tokio runtime before creating the bounded pool; it performs no daemon mutation. Native/Squib/Auto remain independent. The binary's ordinary Docker selection remains rejected until task1.4 startup acceptance is implemented.
+
+The synchronous object-safe `DockerReadiness::check()` port returns a typed DockerExecutorError. It is supplied by the **trusted in-process startup coordinator**, which owns reconciliation/probe evidence for the exact directory/relay/policy it injects; checks are bounded, nonblocking and contain no daemon IO. This is the existing trusted Rust dependency-injection boundary (which already permits custom Executors), not a user-request field or a helper that proves readiness from booleans/socket connectivity. Tests may supply a controlled readiness fixture and must label that narrower evidence. Production must supply the actual historical-reconciliation, pull/network/resource probe consumer before CLI enablement. Revocation rejects new admission; explicit runtime shutdown separately retires accepted work.
+
+`image_available` requires the readiness port, a live relay, accepting/healthy environment service and pool, and an executor that has not begun shutdown. `available` additionally constructs/validates a pure EnvironmentPlan and validates bounded raw payload and FunctionArn, the captured function name and region, and the requested qualifier versus resolved version. Bare/$LATEST ARNs require captured $LATEST; numeric qualifiers must equal the resolved version; aliases require a published numeric revision. Preserve alias text for Runtime API metadata. No admission probe pulls/resolves/inspects an image, starts code or contacts a public endpoint.
+
+Invoke rechecks availability and InvocationContext, creates one Invocation with the context's UUID/deadline, local trace and original Bytes, then calls PoolPort::start once. Select the cancel-safe wait against context cancellation. On every accepted call, await the separate pool settlement with the independent cleanup budget before returning a response/error to WorkSupervisor. A consumed successful response only waits for bookkeeping; it cannot cancel an environment reused by another call. Unresolved/uncertain settlement becomes existing ExecutorError::CleanupFailed, so WorkSupervisor cannot report clean quiescence. The retained pool/environment owners keep physical cleanup after waiter expiry or Executor Drop. Never replay a request following uncertain transport or function failure.
+
+HTTP Invoke strictly accepts InvocationType RequestResponse/Event/DryRun and LogType None/Tail (omission defaults to RequestResponse/None); repeated scalar headers and invalid/non-ASCII values return a static InvalidParameter error before admission. Preserve existing provider.invoke as the default no-tail convenience entry point and add invoke_with_logs to carry the validated capture request through immutable admission. Only RequestResponse requests return tails; Event/DryRun do not capture response logs. Internal start_invocation retains its no-tail default.
+
+Successful raw `/response` bytes produce InvokeResponse HTTP200. A raw `/error` produces HTTP200 with FunctionError=Unhandled and unchanged payload. ExecutedVersion is the captured resolved qualifier, while metadata receives the requested alias ARN. LogType=Tail base64-encodes the already bounded invocation window exactly once, including Some("") for an empty requested tail; None produces no log header. Reject an oversized internal tail rather than accidentally encoding diagnostic history. RuntimeResult::InitError is defensively classified as bounded initialization failure, never successful output. Environment Timeout/Deadline/Cancelled retain their existing ExecutorError categories; pool/environment admission Busy maps to Lambda TooManyRequests; nested Docker wire Busy remains a typed infrastructure error (HTTP500), because it can arise after handler side effects and does not prove pre-execution quota rejection; initialization/early-exit/OOM/protocol/transport errors remain distinct typed sources under DockerExecutorError::Environment. Invalid request/clock/session metadata have typed source variants and static redacted diagnostics. Infrastructure errors never become fabricated handler output.
+
+Shutdown first closes executor admission synchronously, then transfers its pool root into a retained CleanupTask before awaiting. The owned cleanup operation retries timed-out pool joins without losing its root; public shutdown waiters use the independent budget and can resume. Physical pool settlement precedes environment-manager shutdown, image-owner revocation and wire shutdown in the startup coordinator. Do not hold a mutex over IO; a short owner-slot mutex only transfers the root once. Shutdown and Drop share the same path and keep the cached supervision outcome.
+
+```text
+┌─ Lambda HTTP/provider ──────────────────────────────────────────────────┐
+│ immutable revision + requested ARN → WorkSupervisor (retains permits)   │
+└────────────────────────────────┬────────────────────────────────────────┘
+                                 ▼ Executor::invoke
+┌─ DockerExecutor ────────────────────────────────────────────────────────┐
+│ pure plan/metadata validation ◀── trusted startup readiness check       │
+│ raw result + one base64 tail   │ cancellation → wait settlement        │
+│ retained CleanupTask owns pool shutdown after waiter/Executor loss     │
+└────────────────────────────────┬────────────────────────────────────────┘
+                                 ▼ one accepted PoolInvocation
+┌─ retained pool/environment actors ──────────────────────────────────────┐
+│ bounded FIFO / warm checkout → actual relay + handler → raw outcome    │
+│ explicit result consumption │ resource/IO retirement → cleanup receipt │
+└─────────────────────────────────────────────────────────────────────────┘
+```
+
+Verification includes pure rejection before allocation, dynamic readiness/pin revocation, alias/resolved-version metadata, binary response/FunctionError/tail preservation, typed failures, context cancellation with delayed settlement, dropped shutdown waiters and actual Image create→Active→publish/alias→Invoke through provider/HTTP. A real Docker fixture readiness adapter proves execution composition only; final production startup/probe/platform acceptance remains separately required.
+
+### 4.7 Startup network qualification and actual resource probe
+
+Startup qualification has separate proofs; a connected daemon, parsed policy or successful image lease is insufficient. `NetworkSelection::qualify(port, deadline)` is read-only: none issues a disconnected selection without a daemon call; a named/ID network uses the bounded GET /networks/{key} endpoint. Require an exact selected name or full canonical64-lowercase-hex ID, local scope, bridge driver, non-ingress/non-config-only flags, a non-builtin name and a missing or explicit false default_bridge option. Reject partial IDs and ambiguous/missing metadata. Return a private QualifiedNetwork containing the full ID selection so later name reuse cannot redirect allocation. No network is created/deleted by qualification; operator-selected egress remains explicit, without an SSRF/firewall promise. This follows [Docker bridge semantics](https://docs.docker.com/engine/network/drivers/bridge/).
+
+The pinned Rust runtime binary adds an exact `probe` command mode (normal relay accepts no arguments). The probe image is the same operator-pinned relay image, started as the function side of an EnvironmentManager allocation with an explicit `/rustack-lambda-runtime probe` entrypoint. Its private minimal Runtime API client connects only to127.0.0.1:9001, consumes exactly one empty-object challenge, and reports a bounded typed JSON ResourceReport with version1, consumed attempt UUID, architecture, actual kernel limits and isolation flags. It never consults host process credentials, runs a shell, writes large files, spawns children or infers success from Docker inspect fields. Unknown arguments fail statically. Probe mode is not a public API listener.
+
+Both relay/function allocation bodies explicitly request private cgroup namespaces. Verify /proc/self/cgroup membership is rooted at / for unified v2 or every required v1 memory/PID/CPU controller before accepting controller-root files; missing/duplicate membership rejects. Docker defaults differ between [v1 and v2](https://docs.docker.com/engine/containers/runmetrics/), so inherited defaults cannot establish this invariant. Read kernel-owned /proc/self/status and mountinfo with64KiB/512-line/4KiB-line caps, and fixed cgroup files with128-byte caps, within the consumed handler deadline and bounded per-request IO. Normalize cgroup v2 memory.max, memory.swap.max, pids.max and cpu.max; for a v1 layout normalize memory.limit_in_bytes, memory.memsw.limit_in_bytes (subtract memory with checked arithmetic), pids.max and cpu.cfs_{quota,period}_us. Only a missing v2 memory file selects v1; permissions, malformed or incomplete controller evidence fail. Textual unlimited markers (v2 max and v1 -1) become None/omitted report fields and cannot satisfy a finite expected quota. Numeric v1 unlimited sentinels retain their numeric form and fail the exact finite-memory/swap comparisons; do not claim every kernel unlimited encoding becomes None. Parse proc UID/GID/capabilities/no_new_privs/seccomp with duplicate/missing-field rejection. Require an actual read-only root mount and a tmpfs /tmp with nosuid/nodev, captured size and mode1777. Bound/check every numeric conversion; parse kernel unit suffixes with checked multiplication. The [kernel cgroup contract](https://docs.kernel.org/admin-guide/cgroup-v2.html), [v1 memory](https://docs.kernel.org/admin-guide/cgroup-v1/memory.html), [CPU bandwidth](https://docs.kernel.org/scheduler/sched-bwc.html) and [proc contract](https://www.kernel.org/doc/html/latest/filesystems/proc.html) define these observations.
+
+`probe_environment` receives the retained directory/relay/environment port, qualified allocation policy and bounded startup/cleanup budgets. It constructs a private captured Image revision with128MiB memory,512MiB tmpfs,256 PIDs, configured CPU and a10s consumed-handler budget; only one probe attempt is submitted and never replayed. Await BootstrapReady, actual invocation result and independent environment retirement. A returned EnvironmentProbe is private proof of the matching directory/run, relay and policy inputs and cannot be constructed from serialized metadata. Validate the4KiB report before issuing it: exact version/attempt/architecture and namespace-root membership; finite memory, zero extra swap and PID limits; finite CPU quota matching `floor(nano_cpus * period / 1e9)` with checked arithmetic and period1,000..1,000,000us; nonroot UID/GID, zero effective capabilities, no_new_privs and seccomp mode2; root/tmp flags and exact tmp bytes/mode. Missing/mismatched fields or FunctionError reject, never fabricate qualification. This observes actual kernel enforcement configuration; it does not claim to exhaust memory/PID limits or replace dedicated OOM/fault tests.
+
+The minimal probe HTTP connection stays owned inside its request future (no detached connection worker), with bounded response/header/body and one absolute deadline. After posting its report and receiving202, the probe waits for host-owned retirement. On collection failure it reports a static bounded invocation error and still waits for retirement; payloads, paths and kernel text do not enter infrastructure diagnostics. The host uses existing retained environment ownership, so a dropped/timed-out probe waiter cancels the environment without losing container/IO cleanup. Issue proof only after shutdown confirms settlement and a final startup/caller-deadline and retained-input availability recheck; expired callers never receive late successful proof. Cleanup keeps its independent budget and uncertainty remains a distinct error.
+
+```text
+┌─ startup coordinator (admission closed) ─────────────────────────────────┐
+│ persistent directory │ historical effects │ daemon/image qualification │
+│           │                         (independent mandatory gates)       │
+│ operator network → inspect → fixed network ID                          │
+│ pinned relay/policy → private probe revision                            │
+└─────────────────────────────┬───────────────────────────────────────────┘
+                              ▼ retained EnvironmentManager allocation
+┌─ relay container ───────────┐      ┌─ same-image probe function ─────────┐
+│ loopback Runtime API        │◀────▶│ one challenge → kernel observations │
+│ ordered control transport  │      │ bounded report → wait for retirement│
+└─────────────────────────────┘      └──────────────────────────────────────┘
+                              ▼ host validates + joins normal retirement
+                   private EnvironmentProbe (does not open readiness)
+```
+
+The coordinator must combine these proofs with historical uncertain-effect reconciliation, allowed pulls, endpoint reachability and final configuration/capability acceptance. Neither QualifiedNetwork nor EnvironmentProbe alone implements DockerReadiness or enables CLI Docker. Tests include strict report/parser mismatches, exact/no-effect network requests, actual none and operator bridge probes, failed/unavailable resource observations and retained cancellation/cleanup. A fake report is never counted as actual resource enforcement evidence.
+
+### 4.8 Durable container intents and restart reconciliation
+
+Before each environment create can reach Docker, persist its preallocated identity under the retained DirectoryLease. A bounded descriptor-relative snapshot (`containers.v1`, staging `containers.pending`) contains at most64 container records. It stores no invocation payload, environment variables, credentials or paths. Each record contains run/environment/function-resource UUIDs, relay/function role, immutable image SHA-256 and an optional full container ID. Names and authoritative labels are derived from these fields. All UUIDs are nonnil; duplicate environment/role keys and inconsistent identities are invalid. Fixed binary encoding is `RSDKCTR1`, owner UUID, one-byte count,114-byte records, then SHA-256 over preceding bytes. A record is three16-byte UUIDs, one-byte role(function0/relay1),32-byte image digest, one-byte ID-presence flag and32-byte ID (zero when absent). The maximum is7,353 bytes. Corrupt published state is rejected, never reset.
+
+Serialize snapshot transactions with one bounded async permit per lease, then use the existing four-worker blocking budget. Workers retain the lease and transaction permit through cancellation/completion; no detached filesystem write can overtake cleanup. Apply existing private regular-file/no-follow/link/owner checks to both files. Write/truncate only staging, sync staging, rename relative to the pinned namespace, then sync the namespace. Validate and sync authoritative state on reads, including retries after failed publication sync. An interrupted bounded staging file does not override a published snapshot. All operations share an absolute positive deadline of at most60s and typed, redacted ownership errors.
+
+The environment worker registers an uncertain in-memory receipt before awaiting intent publication. It sends no create if publication fails. Positive exact inspection is durably recorded as a known full ID before removal can occur. Cleanup erases a record only after a definitely-unissued receipt, pinned source-defined no-effect response, or confirmed absence of that known ID. A failed erase remains quarantined and retains allocation ownership. Thus process death before issue can conservatively leave an unknown intent, but cannot leave an issued create without an intent.
+
+```text
+Environment owner          Directory transaction worker          Docker
+ │ register uncertain                │                              │
+ │ publish intent ──────────────────▶│ staging sync → rename → sync  │
+ │ durable acknowledgement ◀────────│                              │
+ │ create ────────────────────────────────────────────────────────▶│
+ │ exact inspect ◀─────────────────────────────────────────────────│
+ │ publish known ID ────────────────▶│ durable replacement           │
+ │ kill/wait/remove by ID ─────────────────────────────────────────▶│
+ │ confirmed known-ID absence ◀────────────────────────────────────│
+ │ erase intent ───────────────────▶│ durable replacement           │
+ │ release reservation only after joined IO and durable erase       │
+```
+
+`reconcile_containers(directory, docker, deadline)` is a resumable startup operation, not a readiness grant. Read the durable snapshot; skip current-run records and process historical functions before their relays. An unresolved function blocks its matching relay. For an unknown record, require positive exact name, owner/run/environment/resource/role labels, immutable Config.Image and full64-character lowercase container ID before persisting the ID. A404/empty list cannot discharge an unknown record. Known-ID404 is terminal; otherwise revalidate identity before kill/wait/remove and require subsequent known-ID404 before durable erase. Foreign/malformed resources are never mutated. Cancellation, failure or deadline leaves the record for retry. Return remaining/settled counts; remaining records prevent startup admission. Do not reset, prune, or remove foreign resources. This covers recorded environment containers only: historical image aliases, other mutation classes, production coordinator and complete platform acceptance remain separate required gates.
+
+Tests cover restart identity and ordering, unknown404 followed by late commit, known absence, foreign labels/image/name/ID, failed/cancelled publication, concurrent transactions, bounded/corrupt/unsafe files, repeated cleanup, and a failed erase retaining ownership. Actual Docker qualification must use real persisted records, reacquire the directory under a new run and verify exact owned-resource cleanup. Existing lifecycle/probe/SDK suites must still pass.
+
+### 4.9 Durable daemon binding and connection-local identity fences
+
+Close W217 before ordinary startup can consume historical absence. `DockerPort::bind_directory(&DirectoryLease, deadline)` obtains the engine ID from bounded unversioned GET /info and returns a new port with a private retained binding to that exact lease instance. Accept only a nonnil canonical lowercase hyphenated UUID (36 ASCII bytes), matching the selected modern Docker Engine profile; missing/null/legacy/arbitrary IDs reject without fallback to hostname, socket path, version, architecture or storage path. The UUID is an installation/data-root identity, not authentication: operators must not clone/reset engine-id independently of outstanding ownership, and same-UID/daemon adversaries remain outside the contract. Moby's pinned daemon/id.go loads or atomically creates engine-id; daemon/info.go returns it as ID. Current upstream source agrees; actual modern-daemon evidence remains independent of the historical vendor pin.
+
+Before issuing the bound port, serialize a descriptor-relative transaction under the existing four-worker/one-per-lease transaction limits. Authoritative daemon.v1 contains exactly72 bytes: RSDKDMD1(8), persistent owner UUID(16), nonnil daemon UUID(16), SHA-256(32). daemon.pending is bounded safe staging. Reuse private-file checks, authoritative read/sync and staging-sync→rename→directory-sync, including retries after publication/observer failure. Reject wrong owner/magic/length/checksum/UUID and unsafe files without regeneration. A previously published different ID fails even when journals are empty; never automatically rebind. First publication requires both validated container and image journals to be empty in the same serialized transaction. Missing binding with any record, including a current-run record, rejects as unprovable historical scope. This is not proof that all pre-journal effects were discovered; complete historical namespace discovery remains coordinator work.
+
+The private binding retains the exact DirectoryLease and daemon identity through cloned ports, queued envelopes and in-flight requests. ImageLeaseManager and EnvironmentManager construction, and both historical recovery entry points, require a port bound to the exact supplied lease instance before creating workers, touching records or using404 settlement. A port for another acquisition/owner cannot be substituted. The existing test-only synthetic lease constructor remains restricted to unit fixtures; real-filesystem and actual-daemon acceptance use persisted production binding. Raw DockerWire ports remain trusted low-level protocol primitives, not runtime readiness/capabilities.
+
+Every exchange from a bound port first sends GET /info on its newly established HTTP/1.1 connection, consumes and validates the bounded200 response, and compares the UUID. Only then send the requested operation on that same connection. Never check on one connection and mutate on another; never reconnect/replay if the peer closes the checked connection. This applies to reads, cleanup, waits and upgraded attach as well as create/tag. The check and actual request share one absolute IO deadline and joined driver; a fresh deadline/stop fence precedes actual request issuance. Mark a tracked mutation issued only after the identity check passes. Different/malformed/unavailable identity fails closed, leaves durable records intact and cannot establish absence. Wrap every identity-stage failure in a distinct typed IdentityCheck error retaining its redacted source; never expose an identity GET status (especially404) as the requested operation status. Otherwise recovery could erase records without an actual absence inspection. Diagnostics use static redacted classes, with no daemon UUID or filesystem path.
+
+```text
+Coordinator                  Directory transaction               Docker connection
+ │ raw /info → validated ID          │                                  │
+ │ bind exact lease + ID ───────────▶│ validate existing binding          │
+ │                                 │ or require both journals empty     │
+ │                                 │ write/sync/rename/sync daemon.v1    │
+ │ ◀─ bound port retains lease ─────│                                  │
+ │ enqueue request + binding ─────────────────────────────────────────▶│
+ │                                 │      GET /info on new connection  │
+ │                                 │      UUID match + fresh fence     │
+ │                                 │      actual operation, same conn  │
+ │                                 │      complete body/upgrade + join │
+ │ mismatch/closed/expired → no actual issuance; retain ownership        │
+```
+
+Required tests cover canonical identity and static redaction; same-daemon reacquisition; permanently different binding; missing binding with either journal; damaged/unsafe/staging files and exact byte bounds; cancelled publication/retained serial lease; foreign lease rejection before any recovery IO; same-connection success and switched-peer rejection with no mutation issuance; unavailable/malformed/check-close/expired identity and joined shutdown; and bound upgrades. Requalify actual persisted image/container recovery and real executor/pool/wire consumers on both retained daemons, with empty scoped postconditions. Do not restart or modify an operator daemon solely to simulate restart: directory/wire reacquisition plus pinned source establishes persistent installation identity, while switched actual daemon rejection is tested read-only. Production startup, allowed pulls, endpoint reachability and original M0–M4 acceptance remain separate gates.
+
+### 4.10 Recorded namespace retirement and complete observed inventories
+
+`reconcile_namespace(directory, bound_port, deadline)` composes the implemented container and image-pin recovery before any runtime owner/deployment/probe starts. Require the exact §4.9 lease binding and a positive absolute budget≤60s. The trusted coordinator must exclude concurrent producers for the entire operation; this data report does not grant DockerReadiness or authenticate a daemon. Reject any current-run journal entry before mutation. Do not adopt resources from labels/names alone or reset a journal: an unrecorded effect has unproven intent/commitment and must block startup with Quarantined, preserving it for explicit operator investigation.
+
+Sequence: (1) read both journals and reject current-run work; (2) reconcile historical containers; (3) if any remain, return incomplete counters without touching pins or issuing image inventory; (4) require an empty owner-filtered, all-state container inventory with no daemon-side limit; (5) reconcile historical pins; (6) if any remain, return incomplete counters; (7) require that the complete bounded all-images inventory contains no tag in this owner's reserved repository prefix, at any path depth; (8) repeat the untruncated owner container inventory and both journal reads, rejecting a new observation/record; (9) recheck the clock and return the settled counters with zero remaining. Never infer unknown intent settlement from an empty inventory. Errors may follow successful earlier durable retirements; retries resume the same recorded state without replaying create/tag.
+
+```text
+Startup coordinator (exclusive producer phase; exact directory-bound port)
+ │ preflight journals: no current-run work
+ │ reconcile recorded containers ── incomplete → retain counters/records
+ │ all-state owner list, no limit ── any row → Quarantined, no adoption
+ │ reconcile recorded pins ──────── incomplete → retain counters/records
+ │ full bounded image list ──────── owned-prefix tag → Quarantined
+ │ repeat owner list + journal emptiness
+ │ fresh clock fence → data-only settled/remaining report
+ └ allowed pulls / probes / endpoint / main readiness still required
+```
+
+Do not reuse OwnerFilter's existing limit64 operational listing as an absence proof; its existing callers/wire shape remain unchanged. A private inventory request uses all=true and the exact persistent owner label, without limit, since or before. Reject more than64 returned rows under the existing1MiB/metadata bounds; any nonempty admitted result blocks startup, so no foreign/malformed resource is inspected or mutated by this audit. The known-record recoverer remains the only destructive path. A list404/error is not an empty result; identity-stage errors keep their separate origin.
+
+For aliases, server-side reference globs are insufficient to prove prefix absence: Moby's FamiliarMatch uses path matching and does not match arbitrary slash depth. Use GET /images/json?all=true without reference, digest or manifest expansion. Deserialize the required RepoTags field (explicit legacy null means no tags; a missing field rejects as incomplete metadata), while the shared preflight still bounds every JSON field. Cap4096 image rows and4096 total tags, each≤1024bytes and valid ImageReference syntax except the Docker dangling sentinel <none>:<none>. Normalize only the default docker.io/ and index.docker.io/ prefixes before comparing the exact rustack-internal/lambda-{owner.simple()}/ prefix. Any matching tag, including malformed/deep/current-run reserved aliases, is unresolved; other owners, lookalike prefixes and other registries remain untouched. Raw references and peer payloads never enter diagnostics. A global image response exceeding the existing1MiB/depth/member budget fails explicitly; it must not be silently truncated or called clean. Recorded pins are drained first, so ordinary crash cleanup does not need to inventory all8192 live journaled aliases at once. This bounded local metadata profile does not promise startup against an arbitrarily large operator cache.
+
+Return public non-exhaustive NamespaceRecovery with ContainerRecovery and ImagePinRecovery counters, never a readiness boolean/capability. No extra background tasks are needed: wire jobs and filesystem transactions already retain their exact binding/lease and typed outcomes. Abandoned/cancelled calls leave durable records, and accepted IO keeps exclusion through its existing owners. Polling unknown effects, automatic adoption, global prune, source/digest image deletion and implicit directory rebinding remain forbidden. Inventory emptiness proves only the observed namespace under the journal-before-effect producer contract; it cannot retroactively prove that a pre-journal legacy caller has no unseen in-flight mutation. Normal startup must preserve that provenance contract rather than certify legacy uncertainty through scans.
+
+Tests require exact query shape/no limit; empty fresh and repeated operation; original operational list compatibility; unresolved container blocking every pin/image request; unknown pin retained despite absent alias; current-run preflight without mutation; observed orphan containers/aliases blocking without deletion; arbitrary-depth/default-registry aliases and other-owner/registry/lookalike controls; every inventory byte/count/tag/null/syntax bound, including missing required RepoTags; non-success lists and identity404 not becoming absence; final container/journal observations preventing late success; observer loss and resumable recorded cleanup. Actual daemon qualification must persist a binding, create recorded previous-run containers/private pins, reacquire the directory and drain them through this aggregate operation while preserving source tags. Separate deliberately unrecorded owned container/alias controls must block and remain visible until the fixture explicitly removes only its known created identities. On post-effect failure, preserve the first cleanup error, attempt every independent captured identity while retaining function-before-relay and container-before-alias gates, and still attempt the aggregate audit/source check and wire join. Preserve evidence until ownership settles. Requalify existing owned runtime and Native workflow consumers; main startup/pulls/endpoints/ZIP/IaC/reference/platform/full release remain separate gates.
+
+### 4.11 Container-origin gateway reachability evidence
+
+D80 adds the endpoint prerequisite of the production coordinator. A host-side TCP/HTTP check is insufficient: the pinned probe function must reach the operator-configured gateway from the exact qualified function network. Keep ordinary Docker selection gated until the complete coordinator consumes this evidence. No endpoint means deliberately unconfigured handler SDK access; an endpoint with none networking cannot qualify.
+
+`probe::GatewayInstanceId` is a nonnil canonical lowercase UUID identity, generated fallibly with OS randomness and never used as an authentication token. The synchronous generator may block and is reserved for blocking owners or pre-runtime code. Async startup uses generate_owned with four retained read-only blocking slots and one absolute positive≤60s queue/work observation budget. Running jobs and ready results retain permits across observer timeout/drop; late work cannot publish identity. Capture the gateway startup deadline before this work, before constructing providers, and reuse it through snapshot/bind instead of restarting a fresh budget. `probe::GatewayEndpoint` validates the same literal-root HTTP(S) grammar as operations§1.8, with≤2048 source/canonical bytes and no raw whitespace, userinfo, query, fragment, backslash or dot-path normalization. Move that grammar into the shared runtime crate; preserve DockerGatewayEndpoint as its validated core wrapper with the existing DockerError surface. Debug redacts identifiers/endpoints. GatewayReply(version1,instanceId) is intentional bounded diagnostic data, not a serialized readiness capability.
+
+The gateway optionally receives the exact startup instance identity from its trusted owner and serves GET/HEAD /_rustack/runtime-probe before business admission/worker readiness checks. No configured identity means404, not an invented response. GET returns only the typed version1 instance reply with no-store; HEAD has no body. The same installed identity survives adding workers/cloning the gateway. Health-only reserved connections may serve it. This route performs no business admission, service operation, credential lookup or mutation; other methods do not get a successful probe response. It remains available during closed admission/drain for proof/diagnostics. The future coordinator must still reject activation after drain and perform a final live-input/clock fence. A public per-instance identifier detects stale/wrong instances; it is not endpoint authentication or MITM protection. HTTP is operator-trusted local networking; HTTPS additionally verifies the configured server name/certificate.
+
+The pinned relay gains an explicit endpoint-probe command beside its existing resource probe. It accepts one private Runtime API EndpointChallenge(version1,endpoint,instanceId),≤4096 encoded bytes, no unknown/duplicate fields or trailing document. Constructors/deserialization validate literal endpoint, nonnil canonical instance ID and exact schema before network work. Do not send expected instance identity in the gateway request: issue one GET to the fixed /_rustack/runtime-probe path and compare the independently returned version/ID. Never follow redirects, retry, discover proxy/ambient credentials/configuration, probe arbitrary caller routes or echo the expected ID into a successful report. Return EndpointReport(version1,consumed attempt,compiled architecture,observed instanceId) only after successful bounded response validation; failures post a static Runtime API error and then wait for host-owned retirement, matching the resource-probe lifecycle.
+
+Resolve/connect/TLS/headers/body all share the consumed invocation's absolute deadline; no extension per stage or packet. Use bounded HTTP/1 headers (32/16KiB), body≤4096bytes, reject non200, encoding, trailers, overlong headers/declared/actual body and malformed response/schema. Own the HTTP driver future inside the request; no detached HTTP task/pool remains after return or cancellation. TLS uses explicit rustls aws-lc-rs provider and embedded Mozilla webpki roots; no native TLS/OpenSSL/ring choice, global provider mutation, ambient proxy or root-file discovery. Disable redirect/retry/pooling by using one owned connection. Keep server name verification enabled. Embedded-root updates require a runtime rebuild; custom/private CA loading is not installed by this component. Test-only roots may be injected only through private unit-test seams. Reuse the existing rustls0.23.46/webpki-roots1.0.11/getrandom/url cohorts and update the shared compatible tokio-rustls cohort from0.26.5 to current0.26.6. TLS unit fixtures generate ephemeral keys/certificates with a bounded dev-only rcgen0.14.10 dependency; never commit a private key or disable verification for production.
+
+`EndpointProbeConfig` contains the existing EnvironmentProbeConfig, an actual matching EnvironmentProbe receipt, the validated endpoint and expected gateway identity. Reject disconnected networks, revoked/mismatching resource evidence or expired settings before allocation. Reuse one shared private probe invocation/retirement path with the resource probe: immutable pinned relay as trusted function, exact selected network/policy/scope,128MiB/512MiB/256PIDs, one consumed invocation, bounded settings and existing retained EnvironmentManager ownership. EndpointReport schema/attempt/architecture/instance must all match. Issue private non-exhaustive EndpointProbe only after independent physical environment retirement and a final deadline/live-input check. EndpointProbe::matches rechecks exact origin/identity plus matching retained directory/relay/policy/environment service/resource receipt. It is not constructible from a report/boolean, does not implement DockerReadiness and does not advertise SDK readiness by itself.
+
+```text
+trusted startup owner                    gateway listener (business closed)
+ instance ID ───────────────────────────▶ optional fixed diagnostic reply
+ resource receipt + exact inputs
+     │ endpoint challenge (private Runtime API; expected ID not sent outward)
+     ▼
+ pinned endpoint-probe function ── GET fixed path ──────────▶ gateway
+ selected qualified network      ◀── independent instance reply ──┘
+     │ one owned HTTP/TLS future, absolute deadline, bounded parse
+     ▼ report: attempt + architecture + observed ID
+ host validates → retires function/relay + IO → final fence
+     ▼ private EndpointProbe receipt (still not production readiness)
+ coordinator later combines startup provenance, pins, resource/endpoint evidence
+```
+
+Qualification includes pure endpoint/ID/schema/redaction limits and literal raw authority rejection; owned HTTP success, wrong/stale instance, redirects, missing/duplicate/unknown fields, malformed headers/encoding/trailers/body caps/early EOF, deadline/cancel and no outstanding driver; HTTPS valid ephemeral CA/name, wrong name/untrusted CA and explicit aws-lc provider. Gateway socket tests prove exact reply, preserved identity, disabled404, HEAD/method handling, closed/saturated business admission and no worker readiness dependency. Host tests prove preallocation rejection, one actual consumed attempt, report mismatches, no replay and retained cleanup through dropped waiters/worker failure. Actual two-daemon cases require an explicit operator bridge plus function-visible host, run resource evidence first, then positive identity/negative wrong-instance/unreachable/abandoned endpoint probes and verify physical retirement/source preservation. Existing resource/kernel, executor/provider/pool/wire/recovery lanes must remain qualified after the shared probe/runtime artifact change. Exact fixture provisioners remove only their own captured bridge/server after runtime owners join. Native x86/Linux reference/platform/full M0–M4 release remain separate gates.
+
+
+### 4.12 Production startup, provenance and retained owner composition
+
+D81 consumes§§2.13–2.14/4.9–4.11 in the ordinary binary. Parse all operator/Lambda settings before opening the diagnostic listener. Capture one global startupSeconds deadline (default600,1..3600s) before entropy, owner/provider construction, snapshot load or bind; every stage uses its remaining time and existing independent≤60s IO/probe limits. Startup is separate from shutdownSeconds. No global environment mutation, implicit execution/backend/network/image source or CLI transport. DATA_DIR uses the existing core default /var/lib/localstack when absent; its private Docker namespace stays outside snapshot directory swaps. Explicit Docker remains image-only until§6's Docker ZIP consumer; reject an explicitly configured ZIP source, ZIP creation and ZIP archive import rather than silently ignore it or fall back to Native/Squib. Missing configured endpoint is an explicit SDK-unconfigured profile; a configured endpoint must pass actual proof.
+
+**Provenance.** Newly published owner.v1 records retain their56-byte checksummed layout but use RSDKOWN2 magic to attest creation by the journal-before-effect producer generation. Old RSDKOWN1 records decode into immutable Legacy provenance for controlled diagnostics/recovery, never production admission. No automatic rewrite, migration, new owner over existing records, owner reset or inventory-based certification. Before first publication, enumerate the retained namespace descriptor under a small fixed entry cap and allow only the permanent lock and safe bounded owner.pending initialization file; any daemon/container/pin/unknown entry rejects before creating an identity. This permits harmless prepublication crash retry, not retroactive provenance. Preserve owner/run/exclusion semantics on reacquisition. Old readers reject the new magic, preventing downgrade into pre-journal producers. Require a controlled exclusive producer/namespace; same-UID/daemon adversaries and operator unlink/replacement remain outside the contract. Legacy operators must retain/reconcile their evidence and choose a new controlled data directory, not delete ownership files to bypass uncertainty.
+
+**Unique runtime owner.** Add DockerRuntime::new(validated StartupConfig) with bounded global admission and current-runtime capture, no IO. qualify(&mut self, deadline) performs one attempt: New→Qualifying→Ready; a failed/abandoned Qualifying attempt cannot replay, and only shutdown is allowed afterward. Store each constructed lower owner and each pending acquisition/connect receipt in the retained state before awaiting dependent effects. Directory acquisition keeps a Queued/Running/Consumed state with the exact blocking task, including permits for unobserved success/error results; completed JoinError outcomes are consumed/cached, never polled twice. Wire construction is likewise retained until its exact outcome joins. Directory acquisition→require journaled provenance→connect/bind exact daemon→reconcile_namespace with zero remaining records→validate Linux daemon/target architecture→load explicit pull credentials→start image owner→pin relay→qualify exact network→start environment owner→actual resource proof→optional matching endpoint proof→final live/clock fence→private readiness holder/executor. Namespace recovery occurs before mutating producers start. A nonzero remaining count, orphan/incomplete inventory, identity/provenance failure or any probe failure prevents installation. Retain distinct typed/static relay-preparation and endpoint-qualification error contexts; negative startup evidence must assert its intended stage (including missing-relay404) and reject earlier daemon/resource failures. Do not manufacture readiness from counters or booleans.
+
+The selected runtime platform is the validated daemon platform (amd64/x86_64 or arm64/aarch64), and crossArchitecture=false additionally requires the host architecture to match. Explicit crossArchitecture=true permits the separately probed selected target, including a remote emulated daemon; it is not a promise that arbitrary other function architectures can run. The image preparation port rejects a platform different from the qualified relay before pin/allocation/IO. Docker image deployments must not become Active with a platform the executor cannot run. Effective full-ID network policy and all parsed memory/environment/log/CPU/IO/start/cleanup/idle/warm/deployment limits feed their actual owners. Apply Lambda init_timeout only to the function BootstrapReady wait, additionally bounded by the existing total cold-start deadline; relay-ready cannot satisfy it.
+
+Production readiness is a private immutable exact-input receipt holder with independent revocation, not a user-supplied DockerReadiness implementation. Its bounded nonblocking check covers journaled exact lease/bound port, wire and image/environment owner health, live relay, resource.matches and optional endpoint.matches for the exact effective policy/network/instance. Installation captures the validated Lambda configuration and actual image preparation/deployment settings; no caller can swap a different runtime into this proof. Provider configuration parsing may recognize Docker, but unqualified constructors keep execution unavailable. Existing disabled/Auto/Native/Squib behavior remains explicit. Reject unsupported Docker ZIP explicitly. Restored image metadata is not a live lease; do not advertise such an archive as executable or silently follow a changed mutable tag. The subsequent [D88 archive consumer](#216-candidate-store-image-archive-restoration-d88) reacquires immutable live leases before startup publication or previous-generation retirement; absent or mismatched content rejects. ZIP archives still reject in this profile. The original current/previous generations remain byte-identical, and the final pre-ingress validation remains defense in depth.
+
+**Listener handoff.** Bind one actual listener and independently installed instance identity before endpoint qualification; serve only bounded diagnostics while the runtime owner qualifies. Business routes remain closed and readiness=false. The admission-independent fixed probe route remains live, with reserved/bounded connections, header/IO budgets and no unbounded tasks. Retain one diagnostic actor with its exact cached supervisor join, stop signal and captured-runtime reaper; it aborts/joins all bounded connection tasks before completion. Observer loss signals that same actor rather than dropping its JoinSet. Deadline/signal select a result before a retained join; do not wrap snapshot diagnostic observation in an outer timeout that can cancel its drain. Reuse the same bound listener and instance for final business serving. A signal/deadline/accept/worker failure cancels the observer and invokes owned shutdown; it cannot leave a second listener or detached diagnostic task. Build the actual Lambda provider/ASL bridge only from qualified installation, then load snapshots, fence clocks/live health again and open business routes. Any later provider/workflow/snapshot failure retires the already-constructed runtime graph. No readiness during partial construction.
+
+**Shutdown.** Add a fallible provider shutdown_before(deadline), retaining deployment/work/executor owners and their typed failure under one absolute deadline; the legacy convenience wrapper may log but main must consume the Result. Keep producer→workflow→Lambda consumer quiescence before snapshot. Final cleanup revokes readiness, joins the actual executor/pool and environment owner, then image owner/pins, audits empty current namespace/journals and only then joins wire. Separate sticky diagnostics from physical settlement: retain the first typed fault, but advance to downstream cleanup when root/emergency joins and durable allocation/pin counters prove that stage physically empty. An earlier cached Worker cannot prevent later safe image/wire cleanup; a final diagnostic remains Err even after physical retirement. Keep the exact lease and upstream IO through unresolved downstream cleanup. DockerRuntime::shutdown(&mut self, deadline) starts one retained cleanup operation and waits resumably; timeout/drop never restarts it or releases the graph. Drop starts that same operation on the captured runtime. Each IO attempt is bounded; unresolved cleanup retries with bounded backoff while retaining exclusion/capacity, and cannot become successful shutdown/snapshot. Preserve the original primary startup failure while reporting cleanup uncertainty separately. Worker diagnostics include actual Lambda/Docker/deployment health and static platform/SDK/ZIP limitations; ordinary handler errors never poison owner readiness.
+
+```text
+validated settings + one startup deadline + fresh instance
+  │ bind actual listener; diagnostics only, business closed
+  ▼
+lease/provenance → bound daemon → recorded recovery + complete inventories
+  ▼ no producer before this point
+pull policy → relay pin → full-ID network → environment owner
+  ▼
+actual kernel receipt → optional container GET to this listener → final fence
+  ▼ private exact-input readiness + real executor/preparation
+provider/ASL bridge → snapshot validation → final fence → same listener opens
+  │ signal/error/deadline
+  ▼ revoke / quiesce / snapshot decision
+executor+pool → environments → image pins → empty namespace audit → wire
+  └ unknown cleanup: retain exact owner graph + exclusion, retry; never publish clean
+```
+
+Qualify pure validation/provenance/downgrade/lost-owner refusal, one-attempt lifecycle, scoped receipt health/revocation, selected-platform preallocation refusal, retained cleanup/deadline/drop and actual diagnostic listener handoff. Test init timeout independently from relay-ready and total cold-start. Actual ordinary binary gates on both retained daemons must consume real startup receipts and strict-auth Rust SDK/boto3 computed/warm/error/revision/workflow execution, plus startup missing-image/wrong-endpoint/legacy failures, joined signal cleanup/reacquisition and source preservation. Requalify existing owned Docker and Native consumers. This enables the qualified ordinary image path; full L01–L09, immutable archive lease restore, L10/L11, IaC/reference/platform and complete M0–M4 acceptance still require their explicit gates.
+
+## 4.13 Permanent invocation memory admission and real fault settlement
+
+D83 distinguishes a request that can never fit the captured aggregate environment memory limit from temporary count/memory contention. The charge includes the function plus its64MiB relay. Add a static typed EnvironmentError::MemoryLimit for charge greater than the configured total. Check it before environment-count reservation, and at DockerExecutor request planning before provider accepted/execution admission. The pool must reject this permanent error rather than retry it at the head of its pending queue or evict healthy warm resources. Map it to the existing public TooManyRequestsException/429 class; no daemon side effect or owner-health failure occurs. Equal charges may fit, and temporary aggregate/count exhaustion retains the existing bounded queue/eviction/cleanup semantics. Library boundary callers remain defended even if they bypass the provider.
+
+For the production main consumer, reserve the configured Docker cleanup window capped at half the global shutdown budget, with the existing non-Docker floor; use that same captured reserve for HTTP drain and consistency quiescence. Final cleanup may complete after an unfinished Event drain cutoff, but the original cutoff error/nonzero exit remains authoritative and no successful snapshot is published. See operations§1.11.
+
+Real function init/error, bootstrap timeout, handler timeout, early exit and daemon-reported OOM remain distinct typed sources. A normal function fault cannot mark the runtime owner failed, turn the result into a successful payload or release resource/admission ownership before joined cleanup. SDK errors use the existing redacted Lambda error envelope; initialization error payloads do not become error/log diagnostics. After these failures, immutable code remains deployable/Active and a repaired or subsequent invocation must use a fresh environment and return a computed value with counter1.
+
+An invalid Runtime API request receives its own bounded HTTP4xx and cannot settle a different/valid invocation. Do not reinterpret unrelated malformed requests as authorization to kill the active invocation: D82's foreign/malformed/stale rejection controls and the runtime HTTP boundary tests preserve this isolation. Dedicated real transport interruption/allocating/cleanup controls remain separate from init/busy caller cancellation.
+
+## 4.14 Causal management-IO fault qualification (D84)
+
+Existing allocation and cleanup ownership must survive lost callers while daemon acknowledgments are pending. A definitely issued Create remains uncertain until its exact effect is identified and its journal settles; a physically removed container alone cannot release a still-pending wire/journal/cleanup receipt. Deployment capacity similarly includes canceled preparations until the retained preparation worker settles. An unavailable daemon or failed update never publishes an Active placeholder or replaces an existing successful revision.
+
+Qualify these contracts through an ordinary strict-auth server behind a fixture-owned transparent Unix HTTP proxy, never a production injection hook. The proxy forwards version, identity and management requests to one explicit real daemon; an identity check and following operation keep the same downstream connection. It neither fabricates metadata/results nor owns runtime resource mutation. Direct independent observations use the D83 owner/expected-engine fence. Only fixture-created sockets/threads and the exact server child are controlled; shared Docker services and source images are preserved.
+
+```text
+signed SDK/client       ordinary Rustack       test Unix proxy       real daemon
+      │                       │                      │                    │
+      ├─ Invoke / deploy ─────►│ /info + operation ──►│ same connection ──►│
+      │                       │                      │                    │
+      │   create case: real201 + physical created ID ◄───────────────────┤
+      │                       │◄── hold201 ───────────┤                    │
+      ├─ disconnect ──────────►│ retain work/IO/journal│                    │
+      │   release held201     │◄──────────────────────┤                    │
+      │                       ├─ identify/retire ────────────────────────►│
+      │                       │                      │                    │
+      │   cleanup case: owned function DELETE ──────►│ hold before effect │
+      ├─ disconnect ──────────►│ capacity stays charged                    │
+      │   release DELETE      │──────────────────────────────────────────►│
+      │                       │◄─ real absence + journal settlement ──────┤
+      └─ cold recovery ──────►│ release capacity only after retained join │
+```
+
+Actual D84 qualification exposed that a deleted deployment can finish its outer observer before the independently retained image IO. Carry a shared accepted-deployment permit into the private image-preparation request, in addition to the deployment actor row. The image actor record above the worker JoinSet retains both preparation and deployment admission through worker/root unwind and physical recovery. A shared private receipt releases these guards only after a caller consumes a validated live artifact (ordinary prepare), or after the exact deployment CAS commits (deployment prepare); successful oneshot enqueue alone is not handoff. The image worker retains it through canceled/failed preparation retirement even if the caller future/row is gone; only a successfully delivered live artifact releases preparation admission early. Keep the existing public prepare API unchanged via a private guarded preparation path. An artifact rejected by a closed/unconsumed preparation response is not successful handoff and must retire before releasing either preparation/deployment admission. After live-artifact delivery, its independent image lease continues to charge pin/cleanup quotas. Worker supervision failure still closes admission rather than reviving a failed runtime. Qualify isolated management acknowledgment loss/old-revision preservation separately from full loss of live environment IO; the latter revokes backend readiness and rejects business execution while diagnostic ingress remains available. Restore only the test transport so the retained owner can physically clean up; server shutdown may succeed or preserve the specific cached Docker/quiesce failure, but a forced kill or unrelated error cannot qualify.
+
+```text
+accepted deployment permit (shared ownership)
+        ├─ deployment actor row / observer
+        └─ image actor record above JoinSet
+              ├─ preparation permit + deployment permit
+              ├─ shared receipt → worker → offered PinnedImage
+              │      ├─ consumed validated ordinary prepare ──┐
+              │      └─ exact successful deployment CAS ──────┤ clear receipt
+              │                                               └─ live pin quota remains
+              └─ cancel / failed handoff / worker or root unwind
+                     └─ retained recovery → physical retirement → drop guards
+```
+
+The proxy is test infrastructure, not a new supported runtime transport. Preserve production limits and ordinary bootstrap/init/handler deadlines. Tests prove retained pending work and timely post-release cleanup, not impossible settlement while an unacknowledged effect remains held. See [D84 verification](./rustack-workflows-70-verification-plan.md#management-io-faults-and-exact-docker-resource-inventory-d84).
+
+## 4.15 Real IO expiration, interrupted pulls and incompatible artifacts (D85)
+
+Consume the existing production deadline/ownership and image validation contracts through four more ordinary-service resources. These tests must leave caller sockets and acknowledgment barriers live while the configured IO deadline expires; a caller cancellation, manually released barrier or natural bootstrap/handler expiry cannot qualify as IO expiration. Removal confirmation may settle an exact owned container after a lost DELETE acknowledgment, preserving the original function failure. An interrupted chunked pull never publishes a prepared artifact, even when complete JSON progress records preceded the truncated HTTP body.
+
+A platform-qualified lookup of an already captured immutable image ID is a distinct boundary from the first reference lookup. A direct404 from that selected-platform operation means the captured artifact cannot supply the requested platform; classify it as invalid image metadata and expose `InvalidImage`. Preserve a first-reference404 as `ImageDeleted`; retain identity-check, transport and all other status failures without reclassification. Never inspect or match daemon error-message text. Actual incompatible images and controlled root/selected/identity404 cases must exercise this distinction.
+
+```text
+first reference lookup ── direct404 ─────────────→ ImageDeleted
+          │ captured immutable ID
+          ▼
+platform-qualified lookup ── direct404 ──────────→ InvalidImage
+          ├─ identity-check failure ─────────────→ original typed identity failure
+          └─ other status/transport/deadline ────→ original failure
+```
+
+Negative fixtures are real daemon-loaded content-addressed images, not fabricated inspection replies: an explicitly non-Linux image, an image with the opposite Linux architecture, and a separate compiled Linux process that never implements Runtime API. OS/architecture failures occur during preparation before function container allocation; a valid protocol-free process instead reaches bootstrap timeout. Each failed deployment/execution must recover to a real computed result through a subsequent supported image revision.
+
+For pull interruption, retain the actual daemon stream above the deliberately truncated runtime-facing stream. Observe valid non-error progress, cut the runtime HTTP body before its chunked terminator, and independently drain the real backend to positive terminal completion. A bounded fixture-only receipt, exact immutable expected source ID and source-cache checks govern cleanup of the separately owned cache reference. Never fabricate progress, silently accept a registry failure as interruption, delete an operator's preexisting reference or release uncertain ownership on absence alone.
+
+```text
+ordinary update → ifMissing preparation → exact approved real image pull
+                              │
+                 test proxy ──┼─ real non-error progress prefix → runtime
+                              │                    └─ truncate before HTTP terminator
+                              │                         → Failed candidate / old revision stays
+                              └─ retain backend stream → positive EOF + expected immutable ID
+                                                    └─ bounded ownership receipt
+                                                         → remove only fixture cache reference
+                                                         → preserve original cache/source IDs
+```
+
+Make explicitly provisions and preserves the baseline public immutable source with the selected platform before ordinary startup resources run; a fresh daemon must not depend on cache left by a prior core-suite execution. The pull resource explicitly uses the existing public immutable provisioning fixture via its HTTPS port443 spelling to obtain a genuine cache miss without removing existing sources. It requires anonymous public-registry connectivity, like the existing explicit pull resource; ordinary non-resource Rust CI remains offline. Record absence and intended immutable ID before the daemon pull, refuse preexisting/conflicting spellings, and positively join/drain before ID-checked reference removal. This test-side reference owner is separate from runtime-private pins. See [D85 verification](./rustack-workflows-70-verification-plan.md#io-expiration-interrupted-pulls-and-negative-images-d85). Full platform/performance and remaining image archive/ZIP/handler/IaC acceptance stay required. The artifact contract follows the [Lambda container requirements](https://docs.aws.amazon.com/lambda/latest/dg/images-create.html); negative metadata fixtures are explicit [Docker image-load archives](https://docs.docker.com/reference/cli/docker/image/load/), not a new runtime archive format.
+
+## 4.16 Actual Runtime HTTP bounds and independent admission ceilings (D86)
+
+Close the two explicit [M0 audit gaps](./rustack-workflows-93-review.md#m0-exit-audit-after-d85) using five additional ordinary-service resources. Reuse the signed SDK/owned server, exact daemon identity, transparent real DELETE barrier, bounded collector and physical observers. Use the existing read-only worker diagnostics for bounded actual accepted/active permit counts (operations§2.1); no test injection hook or new HTTP route is introduced. Preserve the global32, default per-function8, accepted128 and pool waiting256 policies.
+
+A custom RIC consumes a real active request, then opens a separate bounded loopback TCP connection for each unsupported Runtime HTTP request: GET on the active completion path (405), a257-byte header value (431), a nonempty GET-next body (413), an active completion declaring6MiB+1 without allocating that body (413), and a genuine chunked completion with a trailer (400). Valid HTTP syntax lets these requests reach the API profile boundary; these are real method/header/declared-body/trailer rejection proofs, not fabricated daemon/HTTP replies or a claim of exhaustive HTTP parser fuzzing. Every error must arrive before a five-second exchange deadline under2KiB response/4KiB request caps. Then the same consumed attempt must complete normally, expose the five exact statuses with computed15/counter1, and reuse the same environment for computed15/counter2. Check infrastructure logs and requested log tails for a fixture sentinel. Implement the raw client independently in the fixture; do not import production limits or route helpers as the oracle. [Runtime API methods](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html) and [chunked trailers](https://www.rfc-editor.org/rfc/rfc9112.html#section-7.1) remain primary protocol references; these bounds are Rustack's explicit local profile.
+
+Global admission uses exactly32 acknowledged Events across two functions with reserved32 each; their first handlers are causally held and all remaining events compute only after resource release. The two physical pairs saturate the configured Docker pool, keeping the remaining work pending; per-function reservations and accepted/pool queues are nonbinding. Before a synchronous third function is probed, require the actual diagnostics to show acceptedInvocations=activeExecutions=32 with limits128/32/default8. The third function must reject429 without allocation. Event202 alone cannot prove exact active capacity: lower execution limits can leave acknowledged events waiting before their permit acquisition. Default per-function admission instead uses one environment,384MiB, one held Event plus seven acknowledged computing Events, and no reserved override. Require acceptedInvocations=activeExecutions=8 before a synchronous ninth request to that function rejects429, while global/accepted queues remain nonbinding. Start each case with both counters0 and reobserve the same exact counts while DELETE is held; after all work/cleanup joins require0 again. No sleep or lack of response counts as successful admission proof; only the positive typed429 under these known bounds qualifies.
+
+For both admission tests release a held handler into real exit42 while its exact function DELETE is withheld before effect. The rejected request must still return429 and the exact pair(s) remain allocated. Then release only that function DELETE and independently hold the paired relay DELETE before effect: the function is absent, relay remains, actual work counts stay unchanged and actual environment allocation/memory charges stay at their full pair reservation. No counted computation or waiting B consumption can occur before final relay release. Release DELETE, observe old pair retirement and require a real computed recovery. A successful warm response may release work permits without retiring a healthy pool environment; cancellation/failed-exit paths must retain permits until physical settlement. Keep these distinct.
+
+Isolate temporary physical resource pressure with two profiles: environments2/memory256MiB and environments1/memory384MiB. Each128MiB function+64MiB relay pair fits individually; only the named ceiling is binding. Hold a synchronous A, submit B with reserved1, and require a second B request to return429: this proves the first B is admitted while independent metadata shows only A's pair. The first B is waiting in the bounded pool, not itself rejected by the physical ceiling. Release A into exit42 with function DELETE held, then advance to an independently held paired relay DELETE after function absence. Actual Docker capacity must still report allocated1/memory192MiB/quarantined0 at both cuts; B cannot start or allocate while A's function/relay retirement is incomplete. Release DELETE; B's consumed-request collector must appear with only a new pair, old IDs absent, exact128/64MiB limits, and computed15/counter1. Retire B and verify healthy backend/empty ownership. Dynamic temporary contention remains bounded waiting; permanently impossible memory remains the existing immediate429 case.
+
+```text
+acknowledged work → function/global permits → bounded Docker pool queue
+       │ actual accepted count  │ actual active count
+       └──────── read-only existing worker diagnostics ───────┘
+                                │                         │
+                      limit reached →429          resource ceiling reached
+                                                          │ wait, no allocation
+held A handler → real exit42 → held owned DELETE ──────────┤ charge retained
+                                   │ release              │
+                                   ▼                      ▼
+                         exact pair retirement → permits/resources return
+                                                          │
+                                                B consumes → computed result
+```
+
+Collector release is per validated target, with one observation per first held function and joined finite workers. `hold-exit` is deliberate fixture behavior, not a runtime executor substitute. The frozen Docker inventory grows from48 to53 (ordinary startup19→24); no other resource disappears. Qualify all five new cases and existing exact suites on both retained engines, then standard/strict/Native/security/text gates and independent review. Full M0 closure still requires an explicit final L01–L09 audit, and no later Image archive/ZIP/Node/handler/IaC/platform requirement is waived.
+
+## 4.17 Official Node image consumption (D94)
+
+Close L02's remaining managed-language consumer through the ordinary production binary. Build a fixture from the existing immutable official Node.js24 manifest `public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79`, whose selected-platform provenance is recorded in the [transport study](../docs/research/study-bollard-docker-transport-boundaries.md#controlled-pull-transport-preflight). The [official Node container guide](https://docs.aws.amazon.com/lambda/latest/dg/nodejs-image.html), rechecked2026-10-30, documents the preinstalled runtime/RIC, handler CMD and selected-platform image build. Node24 remains a supported AL2023 runtime. Reuse this explicit pinned source; no new npm dependency or runtime catalog is needed. Build each architecture explicitly, load `rustack-official-node:<architecture>` and capture its actual exported content ID before resources execute.
+
+The fixture uses Node built-ins, a module-local invocation counter and two exported async handlers: `node.handler` computes twice a bounded integer, while `node.alternate` computes three times it. Both return the actual Node24 patch version, process architecture, UID, invocation/context identity, captured function settings and counter. Observe root immutability with an actual failed write requiring EROFS and observe a private0600 `/tmp` write/read/unlink. Do not infer these results solely from configured container flags. An intentional named NodeFixtureError must produce Invoke HTTP200 with FunctionError=Unhandled and errorType=NodeFixtureError. Existing error retirement requires the next healthy call to use a fresh replacement counter1, followed by a successful warm call counter2. Keep ordinary successful cold/warm assertions separate from this recovery sequence. Explicit stdout/stderr markers must appear in the bounded requested log tail. Never return host environment contents or credential values.
+
+The ordinary consumer exposed the official RIC's optional X-Ray error-cause header exceeding the generic256-byte profile. Consume the narrow§3 allowance above; no handler/SDK monkey patch may suppress normal error metadata. Validate exact/over8KiB, Unicode/opaque field bytes, duplicates, control bytes, misplaced values, lookalike header names and unchanged aggregate limits before session mutation. A real Runtime API HTTP test must reject invalid metadata without consuming the pending attempt, then accept a valid larger cause and deliver the original FunctionError payload unchanged. Retain the failed exit139 observation and independent native-client header probe as separate evidence; the probe alone does not establish that an HTTP rejection causes139.
+
+Hyper syntax/header parse rejection must retire only that rejected connection, preserving the shared session and other active connections. Treat its explicit `is_parse()` class like the existing per-connection header timeout after Hyper sends its bounded4xx response; genuine IO/driver/supervision failures retain the existing fatal path. Control-byte/DEL raw-header regressions must prove the original ticket survives and subsequently settles once with valid metadata. Do not relax parser limits or accept invalid HTTP field syntax to obtain that behavior.
+
+The official default Node RIC also needs more than four retained HTTP connections: the [reference native `next` binding](https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/9ab0fac53c768d6d8901dca9788c729d8eba94ec/src/native/rapid-client.cc) runs on libuv's [four default workers](https://r2.nodejs.org/docs/latest-v24.x/api/cli.html#uv_threadpool_sizesize), with thread-local cURL handles, while response/error posts run on the main thread. Permit eight bounded connection tasks while separately limiting POST body readers to four; keep the session's one-outstanding-poll/one-active-invocation contract. Acquire an owned body permit nonblockingly after route/header/declared-length validation and before collecting any POST body. Transfer it with the accepted Complete/InitError envelope into the session mailbox; retain it until that envelope is processed/rejected or dropped with the actor. HTTP observer timeout, abandonment or disconnect must not release admission for a payload still queued. Failed admission releases the permit immediately; pre-admission body errors retain no command. Direct non-HTTP SessionHandle callers do not acquire this HTTP quota. Exhaustion returns429 and closes only that rejected connection without touching the attempt. This preserves the preceding four-reader24MiB body-work ceiling while allowing five normal default-RIC keepalive sockets. The connection/header ceiling remains fixed; custom images with larger native worker/socket pools must remain within this local profile. Test five retained successful keepalive connections, four charged body readers, GET progress, fifth-POST refusal and permit recovery. No SDK/handler concurrency or Node worker override is needed to qualify its default behavior.
+
+```text
+ official Node RIC                     owned relay Runtime API supervisor
+ ┌────────────────────────┐           ┌──────────────────────────────────┐
+ │ native GET workers     ├──────────►│ ≤8 joined HTTP connection tasks  │
+ │ main response/error POST├─────────►│ route/header/declared-size checks│
+ └────────────────────────┘           └────────────────┬─────────────────┘
+                                          ┌───────────┴───────────┐
+                                          │ GET                   │ POST
+                                          ▼                       ▼
+                                  no body permit        try one of4 body permits
+                                          │                │ no slot →429/close
+                                          │                ▼
+                                          │          collect≤6MiB within deadline
+                                          └──────────┬─────┘
+                                                     ▼
+                                    RuntimeSession: one poll/active attempt
+                                        exact correlation + one settlement
+                                                     │ accepted envelope owns permit
+                                                     ▼
+                                     processed/rejected/dropped → permit released
+
+ parse rejection → close that connection; preserve session/other connections
+ stop → close listener → signal/join≤8 connections → join RuntimeSession
+```
+
+Use independently hard-coded arithmetic expectations:21→42 and23→46 for the default handler;7→21 after latest CMD becomes `node.alternate`; published version/alias stays7→14. Signed Rust SDK and boto3 independently create/invoke/delete real image functions. Boto3 additionally proves cold/warm counters, selected architecture, nonroot execution, actual filesystem observations, configured environment/context, published version and alias retention across an ImageConfig command update, modeled FunctionError and recovery. A registered optimized Lambda ASL Task invokes the published Node alias and returns its computed result. Capture the exact handler version and invoked ARN rather than treating an arbitrary successful JSON body as execution evidence.
+
+Keep ordinary server, exact immutable source capture and SDK process owners above droppable resource observers. Capture one480s original cutoff before preparation; time only preparation before any Python child exists, then spawn and explicitly join the SDK outside that timeout with the same original cutoff through its PID handshake/wait. Always perform the joined wait after failed/late PID observation before reporting that error. Use bounded stdout/stderr; forced termination cannot qualify success. Check the original polling cutoff immediately after every SDK deployment/execution response, including terminal responses. Disable automatic evidence-root cleanup before awaiting observations; re-enable only after primary success, joined server shutdown, namespace/source audit and diagnostic scan. Panic/cancellation or a failed cleanup proof retains the root. A failed Node consumer cannot silently bypass inventory, cleanup or source-preservation checks.
+
+```text
+ explicit pinned Node24 base → selected-platform fixture build → captured ID
+                                                           │
+ signed Rust SDK / boto3 → ordinary strict-auth Rustack → immutable revision
+                                                           │
+                          owned relay + official Node RIC/function
+                             │ actual computation/context/RO/tmp/logs
+ signed ASL Start → captured published alias ────────────────┘
+                             ▼
+                 joined SDK → server stop → full namespace/source audit
+                   any failure → retain root and fail required resource
+```
+
+Freeze exact resource `test_should_execute_official_node_image_with_signed_sdks_and_asl` before first execution:66 total, ordinary33 and other seven suites unchanged. Add `lambda-node-fixture-image` and focused `test-lambda-node-docker` targets, with explicit prerequisites and sequential orchestration; include the fixture in full provisioning. Both full functional lanes must execute the exact66 inventory once, retain ten actual source IDs per engine and meet complete physical postconditions. Standard Rust/strict/security/text checks and independent review remain required. This closes L02's Node functional consumer only; handler SDK networking/callbacks, IaC/server-in-container, reference/platform and complete M4 remain open.
+
+### 4.18 Explicit local handler SDK environment (D95)
+
+Implemented and independently reviewed for task5.3b/L10 on the retained native-arm64 VZ and emulated-amd64 QEMU functional lanes. See the [D95 qualification review](./rustack-workflows-93-review.md#p5-explicit-local-handler-sdk-qualification-d95); image callbacks and full M4/platform acceptance remain separate.
+
+#### Contract and opt-in
+
+Docker control attach and handler-to-service calls are independent channels. Existing `sdkGateway` establishes a container-origin instance match only. Add an optional explicit local SDK environment so an ordinary image handler's default AWS SDK provider chain can authenticate to the same Rustack S3/DynamoDB gateway. Keep user function code, HTTP/ASL Lambda dispatch, package capture and service registration unchanged.
+
+Operator YAML `environment` adds `LAMBDA_DOCKER_SDK_ACCESS_KEY_ID` and `LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY`. Do not read `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `ACCESS_KEY`, `SECRET_KEY`, files, profiles or credential helpers as fallback for this pair. Both absent means disabled. Exactly one, empty/invalid values, disconnected networking or absent `LAMBDA_DOCKER_GATEWAY_ENDPOINT` fails pure configuration before filesystem/daemon work. Bounds: access key1..128 ASCII `[A-Za-z0-9_-]`; secret1..256 nonspace printable ASCII bytes. These are local test credentials; no execution role/STS service is synthesized.
+
+The gateway setting uses its existing bounded literal endpoint grammar. Startup must finish its actual resource/network and matching instance endpoint probe before issuing SDK context. URL parse, a public health endpoint, boolean flag, prior process receipt or caller-supplied evidence cannot issue it. Probe payloads/containers never receive SDK credentials. Keep existing SDK service enablement explicit: opt-in does not add S3/DynamoDB to SERVICES or compiled source features.
+
+#### Ownership and affiliation
+
+Add a cloneable opaque context with private fields, static redacted Debug and no serde support. It retains SecretStrings, the canonical qualified endpoint, an immutable nonsecret nonzero context ID and exact current qualification affiliation. Clones retain the ID. Allocate a fresh process-local NonZeroU64 from a checked monotonic atomic counter for each separately issued context; exhaustion returns Configuration without wrapping. The existing warm identity already includes the random directory run UUID, so a process-local counter is sufficient across restarts. It is an identity dimension, not an authorization token. No secret enters ContainerPolicy, which remains Eq/Serialize and already participates in warm fingerprints.
+
+Bind context to the same DirectoryLease acquisition, relay identity, environment service, qualified network/policy and gateway instance proof. Validate affiliation at executor construction and before any plan allocation. Public/cloneable DockerExecutorConfig must not accept a context copied from a different acquisition, network, endpoint instance or qualification. The context ID separates warm keys but does not prove affiliation. Retain the same private coordinator readiness Arc and compare Arc::ptr_eq to the executor configuration, DirectoryLease::same_instance, EnvironmentPort::same_service, exact bound ContainerPolicy and live relay image/fingerprint. That readiness holder retains/rechecks the actual resource/network/endpoint instance evidence. Invoke its live check at construction and plan admission. The private startup issuer accepts credentials and derives the endpoint/scope from its stored successful endpoint Evidence tuple; it must not accept a separately supplied unproved endpoint, and absent endpoint evidence cannot issue a context. Add only an internal read-only endpoint accessor if needed. No public proof constructor or serde reconstruction is allowed.
+
+Add DockerExecutorConfig.sdk: Option<DockerSdkEnvironment> with typed-builder default None. The exported context type has private fields/constructor; DockerRuntimeSettings stores a private optional LocalSdkCredentials parsed only from the explicit pair. The context applies to both Image and provided-runtime ZIP plans through one private plan method before any create/queue effect. Preserve the existing captured revision and all resource limits. Include the context ID in warm identity without encoding/hashing credential strings; unequal contexts cannot borrow a warm environment. The immutable installed runtime is the rotation boundary. A prepared EnvironmentPlan retains a private secret-free SDK affiliation/liveness guard, not only the materialized Env and warm ID. Its existing live() fence rechecks that guard before create/health boundaries, including after pool waiting. Revocation before a new create call must return Stopped without a Docker RPC; already accepted uncertain IO remains owned by normal retirement. Shutdown revokes existing readiness and retires environments through established owners; a revoked SDK proof cannot prepare another plan.
+
+```text
+ operator private YAML          startup coordinator                 handler
+ ┌─────────────────────┐       ┌────────────────────────────┐
+ │ explicit SDK pair   ├──────►│ pure pair/network validation│
+ │ selected endpoint   ├──────►│ existing resource proof      │
+ └─────────────────────┘       │ actual same-instance probe  │
+                               └─────────────┬───────────────┘
+                                             ▼
+                           opaque SDK context + exact affiliation
+                          secrets + endpoint + nonsecret context ID
+                                             │
+                             executor check / plan affiliation fence
+                                             ▼
+                         function Env only, authoritative last tier
+                                             │
+                              actual default signed SDK requests ──► local S3/DDB
+
+ relay/probe: no SDK secrets      archive/revision/journal: no SDK context
+ shutdown/revocation → reject admission → existing physical retirement/join
+```
+
+#### Environment precedence and confidentiality
+
+The disabled case preserves current user-configurable AWS_ENDPOINT_URL semantics. Under explicit SDK opt-in, runtime SDK entries are authoritative over both image defaults and captured user variables. Produce one entry per key using the existing deterministic map. Insert:
+
+- AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY from this explicit pair.
+- AWS_ENDPOINT_URL from the qualified canonical gateway; AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=false.
+- AWS_EC2_METADATA_DISABLED=true.
+- AWS_CONFIG_FILE=/dev/null and AWS_SHARED_CREDENTIALS_FILE=/dev/null.
+
+Clear selectors with explicit bare-name Env deletion markers (KEY with no equals/value), preserving the daemon override key so image defaults cannot be merged back. Do not simply remove map entries. Clear inherited/captured AWS_ENDPOINT_URL_* per-service selectors, AWS_PROFILE/AWS_DEFAULT_PROFILE, AWS_SESSION_TOKEN/AWS_SECURITY_TOKEN, legacy AWS_ACCESS_KEY/AWS_SECRET_KEY, web-identity/role selectors, container-credential endpoint/token selectors and EC2 metadata endpoint overrides. The fixed deletion set is AWS_PROFILE, AWS_DEFAULT_PROFILE, AWS_SDK_LOAD_CONFIG, AWS_SESSION_TOKEN, AWS_SECURITY_TOKEN, AWS_ACCESS_KEY, AWS_SECRET_KEY, AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME, AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, AWS_CONTAINER_AUTHORIZATION_TOKEN, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE, AWS_EC2_METADATA_SERVICE_ENDPOINT and AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE. Test every member and the dynamic AWS_ENDPOINT_URL_ prefix. Do not delete unrelated user variables or relax reserved-variable/API validation. Never copy the host process environment. The handler can still intentionally construct an SDK client with another endpoint/credentials; this feature is not an egress policy.
+
+Validate before any Docker effect: SDK-added fixed names/values together at most4KiB; final function Env at most320 entries/80KiB, each encoded Env entry at most4097 bytes. This preserves existing128 image entries/64KiB,128 user entries/4KiB, bounded runtime metadata and SDK settings; the extra equals byte preserves a valid4096-byte key+value user entry. Clearing existing dynamic selectors only shrinks their values. Retain existing1MiB create-JSON encoding limits. Count bytes with checked arithmetic, not characters, and reject before allocation; no unbounded scan/concat. Context secrets use the existing secrecy cohort. Plaintext transfer in the function's bounded Docker create request is intentional access for the selected operator daemon. Function/model APIs, immutable revisions, code hashes, archives, durable journals, relay/probe bodies, tracing, Debug and static infrastructure errors never contain these injected values. Redaction tests cover actual request/plan/config diagnostics, not just the secret newtype.
+
+No new capability should imply service authorization from an unauthenticated reachability probe. Retain sdkGateway's documented narrow meaning; if a separate context-installed boolean is exposed, define exactly its configuration/proof semantics.
+
+#### Required consuming fixtures
+
+Use a separately named SDK Node image on the existing pinned Node24 manifest, leaving D94's built-in-only fixture unchanged. The unstarted, exact-owner arm64 source reader verified actual bundled S3, DynamoDB and SFN clients at /var/runtime/node_modules/@aws-sdk/*/package.json, all3.1105.0, from D94's built-in-only image on the same pinned base. `/tmp/rustack-d95-sdk-source-intent.json` records expected engine/image, bounded raw outputs/hashes, all package hashes and exact unforced removal; it never starts a process and leaves zero containers. This is actual package metadata, not SDK execution evidence. Both consuming lanes must independently report the actual S3/DynamoDB versions; no latest-version assumption or npm install/new package is introduced.
+
+The handler uses actual `@aws-sdk/client-s3` and `@aws-sdk/client-dynamodb`. Constructors may configure maxAttempts=1, S3 forcePathStyle and bounded timeouts; they must not pass endpoint or credentials explicitly, because default provider resolution is the behavior under test. Use a single original10s handler SDK budget across all sends and response-body consumption, maxAttempts=1, bounded4KiB S3 response collection and explicit abort/stream/client closure on every path. Bind the same abort signal directly to the returned readable before awaiting any body chunk, so a quiet body after headers cannot outlive the budget. The positive resource first executes a held-header/quiet-body cancellation control through the same image helper, verifies prompt AbortError/destruction and joins its loopback HTTP owner, then switches to the real SDK handler. The two SDK fixture profiles use one environment so command replacement retires that control environment before cold/warm observations. No endpoint or credential option is passed to clients. SDK fixture init has an explicit20s installation profile and30s Lambda timeout; it does not raise unrelated profile budgets. No background callback/timer or raw secret/environment dump is permitted. Return arithmetic, module counter and SDK versions; project SDK errors to fixed names/booleans.
+
+Two independently required ordinary resources:
+
+1. **Correct explicit pair / poisoned image credentials.** Start the real registered lambda,stepfunctions,s3,dynamodb binary with strict authentication and explicit local server credentials. Server AWS credential aliases must agree with ACCESS_KEY/SECRET_KEY; contradictory aliases are rejected before startup. Inject wrong image credentials while the explicit Docker SDK pair matches local auth. Host signed clients create a bucket/table. The real handler cold21→42 and warm23→46 writes/reads S3 objects and DynamoDB items. Host clients independently verify literal expected bytes/numbers. Poison image/captured endpoint/profile selectors and prove the authoritative local context wins. Inspect only boolean credential/endpoint/relay classifications through exact scoped daemon metadata; never persist Env. GetFunctionConfiguration and the installed bounded archive producer omit the operator pair. Separate lookup controls and the negative resource prove absence of ambient fallback.
+2. **Wrong explicit pair / valid ambient AWS values.** Outer signed Lambda clients still use correct local service auth; the explicitly injected handler SDK secret is wrong while ambient server AWS values would be valid. Each selected service operation must fail with its precise modeled authorization error and typed function failure, not successful business output or ambient fallback. Use normal GetObject AccessDenied/HTTP403 and GetItem AccessDeniedException/HTTP400 from the existing adapters; avoid HEAD errors without modeled bodies. Verify the actual SDK name/status before emitting a fixed fixture error. The environment is physically retired and postconditions are empty. Do not accept arbitrary errors/timeouts as authorization evidence.
+
+Separate unit/pure controls cover pair validation, no ambient lookup, endpoint/network prerequisites, redacted Debug, no serde fabrication, all selector precedence/bounds, no relay/probe injection, different-context warm isolation, cloned/foreign qualification refusal and revocation before create. Existing default-None plans and archive semantics remain unchanged.
+
+Reuse the existing docker_startup integration target, retained Server and SDK child owners through a handler_sdk module. Keep the shared Node/SDK PID-barrier-and-join composition in its Docker-only image_sdk module, using the existing lower-level Runner. The Native integration target also includes Runner and must not compile unused Docker-only methods. Centralize its Make feature cohort as WORKFLOWS_DOCKER_CLI_FEATURES=lambda,stepfunctions,s3,dynamodb in the existing isolated WORKFLOWS_DOCKER_TARGET_DIR. All ordinary Docker Make/manifest consumers use that same cohort, avoiding competing binary feature builds or duplicate/dead helper modules. Other core suites retain their existing features. Existing Server profiles still enable only lambda,stepfunctions in SERVICES; only Sdk/SdkWrongCredentials profiles explicitly enable s3,dynamodb and strict authentication. Do not feature-gate the two new resource names: minimal manual resource execution must report missing prerequisites rather than silently omit them.
+
+Freeze test_should_execute_local_s3_and_dynamodb_from_an_explicit_image_sdk_context and test_should_reject_wrong_image_sdk_credentials_without_ambient_fallback in the existing ordinary suite before running:33→35 ordinary resources,66→68 overall/eight suites. A Make lambda-docker-fixtures provisioning aggregate prepares the full fixture set sequentially, including the new SDK image; ordinary full-startup aliases cannot omit Node/ZIP/SDK prerequisites. lambda-handler-sdk-fixture-image builds the separately named image on the pinned base; test-lambda-handler-sdk-fixture runs pure consumer/ownership controls; test-lambda-handler-sdk-docker runs both exact resources after provisioning and the full compiled inventory. Full both-lane gates include both resources and preserve eleven actual source IDs per engine (the prior ten plus the new image).
+
+Exit requires both positive/negative resources, meaningful pure controls, all existing required resources, exact source/zero-remnant/owned-bridge postconditions, standard/strict/Native/security/text gates and independent review. Callback images, IaC, server-in-container, native-x86/reference/platform and final5.4 release acceptance remain required after L10. No L10 completion is inferred from operator configuration or pure plans alone.
+
+Primary compatibility references: [AWS SDK endpoint precedence](https://docs.aws.amazon.com/sdkref/latest/guide/feature-ss-endpoints.html), [official Node container image](https://docs.aws.amazon.com/lambda/latest/dg/nodejs-image.html) and [runtime-included SDK versions](https://docs.aws.amazon.com/lambda/latest/dg/lambda-nodejs.html). The vendored historical Moby merge at [daemon/commit.go](../vendors/moby/daemon/commit.go) and unset handling at [container/env.go](../vendors/moby/container/env.go) explain why bare-name markers must remain; actual consumer tests qualify installed-daemon behavior rather than claiming an exact Engine source attestation.
+
+### 4.19 Managed Node image callback consumers (D96)
+
+Task4.3/5.3c consumes D95's qualified SDK environment through the existing observed Lambda and independent Event owners. The separate pinned callback image selects dispatcher/worker exports with CMD, uses actual default-provider Lambda/Step Functions/DynamoDB3.1105.0 clients and preserves Image configuration/revision isolation. A synchronously dispatched callback Lambda can accept an Event worker and return; that independently active worker later sends the real callback. Keep the Runtime API/SDK channels and both function/relay ownership graphs distinct. Do not depend on code running after a managed handler returns or expose callback tokens to a control database.
+
+The explicit callback profile uses two256MiB functions/two64MiB relays within768MiB runtime memory, init20s/function45s, one workflow dispatch and D95's same paired credentials/proof. Other profiles and SDK capacity1 stay unchanged. Its post-stop audit hook inspects confirmed saved resources without weakening the shared child/server always-join path. No new public runtime setting, service API, image privilege or host mount is required. Actual source metadata and all twelve-source/focused/full cleanup gates are defined by [integrations§5.6](./rustack-workflows-40-integrations-design.md#56-real-image-sdk-callbacks-and-independent-event-worker-d96). Both retained functional lanes now pass actual nine-mode image callback acceptance and the complete70-resource gate; see [final D96 qualification](./rustack-workflows-93-review.md#final-d96-qualification). IaC/reference/platform/full-release acceptance remains open.
+
+## 5. Isolation and resource limits
+
+- Initial Docker transport is a local Unix socket only. Disable implicit TCP/SSH fallback. Explicit docker configuration requires a startup daemon/version/relay-image/resource-limit probe; failure aborts startup. Default remains disabled. Auto does not acquire a new Docker fallback; Image on native/squib/auto fails explicitly.
+- Function containers use read-only rootfs, cap-drop ALL, no-new-privileges, default seccomp,≤256 PIDs, default 1 CPU and configured function memory subject to aggregate admission. Prohibit privileged mode, host PID/IPC/network, devices, Docker sockets and arbitrary host mounts. Preserve a nonroot image USER; override absent/root USER with the configured unprivileged UID/GID. Permission-incompatible images fail explicitly.
+- `/tmp` is a size-capped tmpfs, 512–10,240 MiB. Its used memory counts toward the container memory cap, unlike AWS disk-backed ephemeral storage; advertise this limitation. ZIP code reaches a daemon-owned volume through a validated archive, not a host-path bind assumption. Mount `/var/task` read-only; never expose the project root.
+- Docker runs operator-selected code; it is not a hostile multi-tenant isolation promise. Egress follows the configured Docker network. Without network policy, do not claim handler SSRF prevention. Registry pull allowlists do not restrict arbitrary handler networking.
+- Continuously drain stdout/stderr into separate bounded rings,≤256 KiB each; LogType=Tail returns the final 4 KiB. Cap individual diagnostic lines at 16 KiB and errors at 32 KiB. Drop/count excess logs without blocking handlers. User stdout is intentional user output, not infrastructure tracing; do not promise automatic secret detection in arbitrary logs.
+
+## 6. Responses, errors and ZIP support
+
+`/response` yields original Bytes. `/error` yields Invoke HTTP200 plus FunctionError=Unhandled and bounded payload. Missing images, OOM, missing RIC, early exit, initialization and protocol failures produce distinct ExecutorError variants mapped to Lambda errors. Infrastructure failures must never become success payloads. ASL mappings are specified separately.
+
+M4 adds Docker execution of provided.al2023 ZIPs using an operator-pinned OS-only image digest. Safely populate the code volume and explicitly execute `/var/task/bootstrap`; an OS-only image's runtime launcher is not the user's bootstrap. Validate Linux ELF architecture. Preserve Native/Squib ZIP behavior. Managed Python/Node ZIP runtime mappings are excluded; deploy images containing their RICs instead.
+
+### 6.1 Provided-runtime ZIP delivery contract (D89)
+
+Task5.1 uses the original validated ZIP bytes, never a host directory bind. The supported runtime is exactly `provided.al2023`, with a root regular executable `bootstrap` containing a little-endian ELF64 executable or PIE for the captured Linux architecture (x86_64 machine62 or arm64 machine183). Require the complete64-byte ELF header, current ELF versions and valid executable/shared-object type. Reject missing/nonexecuting/script/Mach-O/wrong-class/endian/architecture bootstraps before Docker effects. Do not claim to prove dynamic-library availability from this header; actual launch/init failures remain runtime outcomes. Preserve the configured handler in runtime metadata; launch the fixed `/var/task/bootstrap` rather than an image launcher, shell or handler-derived path. Managed Python/Node ZIP mappings remain excluded.
+
+Build a deterministic daemon-transfer TAR from the immutable archive, not extracted host files. Reuse the existing ZIP name/attribute validator and250MiB expansion/10,000-entry limits. Count implicit parent directories as well as explicit members under a shared10,000-node filesystem-tree cap, for both Native staging and Docker transfer; reject file/parent conflicts in either ordering. Reject lexical absolute/drive/NUL paths before any library normalization. Emit each implicit/explicit directory exactly once with normalized permissions. Reject all special-file declarations, links, privileged permission bits, conflicting normalized paths, corrupt CRCs and declared/actual expansion mismatches. Native extraction continues using the shared validation rules. Only ordinary files/directories enter the TAR. Empty directories require declared size/CRC0 and a positive bounded read proving compressed-stream EOF; metadata alone is insufficient. Use root UID/GID0, mtime0 and normalized read-only modes (directories0555, executable files0555, other files0444); preserve the original ZIP/hash as the public code identity. GNU long-name records must support the existing1024-byte path profile. Per-entry padding/header/long-name overhead is included in an absolute282MiB transfer limit. An error yields no partial transfer artifact and no Docker request.
+
+`DockerCodeArchive::prepare(ValidatedArtifact, Architecture, deadline)` is a retained read-only blocking conversion. Its absolute deadline inherits the positive, at-most600s Docker operation window; embeddings clamp longer workflow/function authority to their existing preparation budget without extending the original deadline. Bound allocated output capacity as well as encoded length. Two process-wide admission slots remain charged through conversion, returned archive clones and any enqueued upload until their last owner drops, bounding retained transfer buffers to564MiB plus bounded source/parser state. Conversion checks the original deadline before admission, between entries and bounded reads/writes, and after join; cancellation/observer loss never publishes code or releases worker/buffer ownership early. A `DockerCodeArchive` exposes only byte count, architecture and source hash; Debug/errors never display code or filenames. Its bytes have no public unchecked constructor. No filesystem read, TAR extraction or daemon effect occurs during conversion.
+
+### 6.2 Bounded archive and volume wire operations (D89)
+
+Extend the existing bound DockerPort rather than adding a second client. `upload_code(container, archive, deadline)` uploads only the typed code artifact to fixed `/var/task`, using PUT `/containers/{id}/archive`, `noOverwriteDirNonDir=true`, `copyUIDGID=false` and `application/x-tar`. Retain the complete typed artifact in the accepted request, including after observer cancellation, until the existing exchange/driver owner drains. This operation alone permits a282MiB request body; all JSON requests and all responses keep their existing1MiB bounds, strict framing, same-connection daemon fence and reserved cleanup capacity. Do not serialize the TAR as JSON/base64 or let a public raw byte argument bypass validation.
+
+Provide explicit local-volume create/inspect/list/delete operations using the existing generated Docker models and query encoder. Creation always names the volume, selects `local`, supplies no driver options/cluster/bind configuration and validates a bounded label map before enqueue. Names use DockerKey validation; at most16 labels have128-byte allowlisted keys and256-byte control-free values. Verify create-response name, local driver/scope, empty options and exact requested labels. Inspection/listing are observations, never ownership receipts by themselves. Listing uses the full supplied owner-label scope without a positive result limit; reject warnings, missing collections, oversized/incomplete metadata. Deletion always uses `force=false`; ownership and attachment proofs belong to the consuming volume owner. Both inspect/list/delete use reserved cleanup admission. No prune or mountpoint access is added.
+
+These are transport/artifact prerequisites, not ordinary ZIP runtime support. Existing Docker ZIP source/create/archive refusal and capability bits remain until the retained volume and invocation consumers below are implemented and qualified. Tests must distinguish large TAR request admission from unchanged JSON/response caps, exact URI/content type, retained buffer ownership after caller loss, malformed/oversized volume metadata, label validation, identity-check404 versus resource404, and helper/function read-write versus read-only mount behavior through a real daemon.
+
+### 6.3 Retained code-volume owner and environment ordering
+
+An environment owns one randomly named daemon-local code volume and one never-started loader container, separate from its relay/function identities. Use a new bounded checksummed durable code journal under the existing DirectoryLease, recording owner/run/environment/resource/revision, immutable ZIP hash/base image fingerprint, volume name, loader name/image and observed full loader ID before effects/cleanup. Preserve existing container/image formats and producer provenance; old namespaces cannot silently certify new effects. Publish durable intent before volume or loader creation. Unknown creation absence is not a commit barrier; retain uncertain issued work and exclusion through later positive observation or operator reconciliation. Matching labels alone cannot adopt an unrecorded resource.
+
+After environment capacity is reserved, create the local volume, verify its complete identity, then create an unstarted trusted pinned OS-image loader with that volume mounted read-write at `/var/task`, `NoCopy=true`, network none, root filesystem read-only and dropped capabilities. Upload only the validated TAR. The loader never starts and executes no uploaded code. Disable copyUIDGID so its inherited/configured User cannot override the normalized TAR UID/GID; qualify actual extracted ownership and modes. Remove and prove loader absence before creating the function with the same volume mounted read-only. Loader root read-only does not prohibit writes to its explicitly read-write code volume; the real daemon must qualify this distinction. Preserve relay initialization/BootstrapReady ordering and all existing function security/CPU/memory/tmpfs limits. Materialize the fixed bootstrap entrypoint, empty command and `/var/task` workdir; discard the OS image launcher/default argv.
+
+```text
+immutable ZIP → bounded retained converter → typed TAR
+                                             │
+reserved environment + durable code intent    │
+         │                                   │
+         ▼                                   ▼
+local volume → never-started RW loader → PUT archive
+                                             │ joined upload
+                                             ▼
+                                 remove/prove loader absent
+                                             │
+relay Ready → function + RO code volume → bootstrap → BootstrapReady
+                                             │ cancel/exit/evict/shutdown
+                                             ▼
+                        function absent → IO joined → code volume absent
+                                             │
+                                      relay/pins retirement
+```
+
+Keep environment/work capacity and source/base-image/code-journal leases through physical retirement, including caller loss and panic. Cleanup never removes the volume while a known/uncertain function or loader can reference it. Volume identities lack a separate Docker object ID: exact random name, full recorded labels, local driver/options and current daemon binding form the controlled-producer proof; hostile daemon/same-UID ABA remains outside the existing threat model. Delete only the recorded named volume with force disabled and positively inspect absence afterward. Historical startup recovery retires recorded consumers before code volumes and image pins, then audits complete owner-filtered volume and container inventories. Orphan/foreign/conflicting/unknown resources block without deletion. Current-run final audit includes volumes. No source image, host path or unrelated volume is removed.
+
+### 6.4 Startup, provider and archive consumers
+
+A configured ZIP base must be an operator-pinned immutable Linux `provided.al2023` OS-only image digest, prepared through the same qualified image owner/platform/fresh-size policy as relay/function images. Readiness captures that exact pin and policy; absent configuration keeps ZIP explicitly unavailable. Add no mutable runtime mapping. Provider validates the supported runtime/architecture/bootstrap before accepted ZIP execution, while preserving Native/Squib behavior, original ZIP hash and immutable publication/alias/in-flight revisions. Environment warm keys include ZIP hash/revision, selected OS image fingerprint and effective sandbox policy. Missing/changed content fails without source substitution.
+
+Enable `DockerCapabilities.zip` and ordinary ZIP Create/Update/Invoke only after this actual consumer is installed. Image-only settings remain valid. ZIP archive restore is a separate5.2c consumer: preserve source bytes and original identities, rebuild validated host artifacts, and use the same immutable operator base/code-volume path without persisting live volumes or replaying calls. Reconcile the Docker metadata/data profile and producer bounds before lifting its existing ZIP snapshot rejection; D88's16MiB Image-only profile must not silently become a managed ZIP archive profile.
+
+### 6.5 ZIP qualification and dependency order
+
+Implement5.1a typed conversion and bounded archive/volume transport first;5.1b consumes them in the durable volume owner/recovery;5.1c installs the real runtime/provider and ordinary SDK/ASL acceptance. No prerequisite alone closes5.1/P5. Controlled tests must cover malformed ELF/ZIP/paths/attributes/CRC/expansion, global conversion/buffer admission and cancellation, exact large-body framing, volume/helper create acknowledgment loss, upload loss, late side effects, panics and consumer-before-volume-before-pin retirement. Actual ordinary signed clients must deploy the same cross-built bootstrap ZIP used by Native qualification, compute cold/warm results, invoke published/alias A while latest becomesB, distinguish init/error/timeout/exit, cancel in allocation/init/busy/cleanup, and prove read-only task code with writable bounded `/tmp`. Exercise both retained functional architectures, exact source preservation and zero containers/private volumes/image aliases after joined cleanup. Retain native-reference/platform/Node/handler SDK/IaC and complete M4 requirements. Use explicit Make targets and freeze any new resource names before execution; standard/strict/Native/security/text gates and independent review remain mandatory.
+
+### 6.6 Code namespace provenance and recovery boundary (D90)
+
+Deliver 5.1b in dependency order: the durable decoder/recovery boundary in D90, then the retained producing manager, then 5.1c ordinary runtime consumption. D90 installs no production code-volume producer and does not enable ZIP capabilities. Test producers exercise the actual published format and wire cleanup; do not expose a speculative public journal-writing API before its retained owner exists.
+
+**Namespace.** Preserve fresh Image-only `RSDKOWN2` and legacy `RSDKOWN1` behavior. Explicit `DirectoryLease::acquire_code` creates fresh `RSDKOWN3` with the same 56-byte owner layout (magic (8 bytes), nonnil owner UUID (16 bytes), SHA-256 (32 bytes)). It rejects existing generations 1/2 before any Docker effect and never upgrades or rewrites their owner. General acquisition accepts 3 so Image-only startup can drain a previous code namespace. Generation 3 is deliberately unreadable by older binaries. Journal provenance accepts 2/3; code provenance accepts 3 only. Both `code.v1` and `code.pending`, even empty/safe, are forbidden under generations 1/2. Validate this during acquisition and daemon binding, including when a binding already exists. First daemon binding additionally requires an empty code journal. Preserve all existing container/image/daemon formats.
+
+**Format.** Publish `code.v1` through descriptor-relative private `code.pending`, using the existing serialized bounded blocking transaction, file fsync, atomic rename and directory fsync. Header: `RSDKCOD1` (8 bytes), owner (16 bytes), record count u8. Up to 32 fixed 194-byte records follow, then SHA-256 (32 bytes) of the preceding bytes; maximum 6,265 bytes. Each record is run/environment/resource/revision UUIDs (16 bytes each), original ZIP SHA-256 (32 bytes), immutable base parent ID (32 bytes), base inspection fingerprint (32 bytes), volume state u8, loader state u8 and loader full ID (32 bytes). IDs are nonnil; environment IDs are unique across all runs; states are canonical. Volume states 0 Planned/1 Uncertain/2 Known/3 Retired; loader states use the same tags, but Known requires the recorded full ID and other states require all-zero padding. A loader Uncertain/Known requires a Known volume; a Retired volume requires a Retired loader. A Planned/Uncertain volume requires a Planned loader. No host paths, code bytes, credentials or executable configuration enter the journal. Invalid checksum/owner/count/length/state/padding/duplicates fail closed, including syntactically valid recomputed checksums.
+
+Record offsets are relative to the beginning of each 194-byte row:
+
+| Offset | Bytes | Field |
+|---:|---:|---|
+| 0 | 16 | Run UUID |
+| 16 | 16 | Environment UUID (unique across the snapshot) |
+| 32 | 16 | Function resource UUID |
+| 48 | 16 | Revision UUID |
+| 64 | 32 | Original ZIP SHA-256 |
+| 96 | 32 | Immutable base image parent ID |
+| 128 | 32 | Base inspection fingerprint |
+| 160 | 1 | Volume state tag |
+| 161 | 1 | Loader state tag |
+| 162 | 32 | Known loader ID, otherwise zero padding |
+
+| Volume state | Permitted loader states |
+|---|---|
+| Planned | Planned |
+| Uncertain | Planned |
+| Known | Planned, Uncertain, Known, Retired |
+| Retired | Retired |
+
+**Identity.** Derive `rustack-code-{environment}` and `rustack-code-loader-{environment}` from the recorded random UUID. Exact label maps include ownerId, runId, environmentId, functionResourceId, revisionId, codeSha256 (lowercase hex), baseFingerprint (lowercase hex) and role (`code` or `code-loader`), all under `rustack.lambda.`. A volume must have this exact map, local driver/scope and empty options. A loader must have the exact reserved `rustack.lambda.*` map/name (additional non-reserved inherited image labels are permitted; maximum 64 total labels, 128-byte allowlisted keys and 256-byte control-free values), immutable Config.Image and inspected Image parent ID, canonical matching full 64-character lowercase ID, and exactly one named-volume mount at `/var/task`, writable, with matching name and local driver. It must have non-running `created` state and no prior start (`StartedAt` is absent/empty/zero Docker timestamp). Recovery never starts, kills or waits for a loader. A running/exited/restarted or identity-conflicting loader is quarantined without destructive requests. The controlled producer must use NoCopy and the sandbox contract in§6.3; recovery does not infer execution readiness from these observations.
+
+**Monotonic recovery.** Under an exact bound directory/daemon port and one startup coordinator, refuse all current-run records before destructive work. Drain recorded function/relay consumers first. For code-generation roots, do not run the empty container inventory until recorded loaders are retired. Process each historical code record loader first, volume second, image pins last. For `(volume Planned, loader Planned)`, atomically persist both Retired without Docker requests because no create may precede durable Uncertain. For `(volume Uncertain, loader Planned)`, retain loader Planned while inspecting the volume: unknown404 leaves both unchanged; an exactly matching positive observation permits durable volume Known, then retire the Planned loader and finally the volume. This observation order does not authorize volume deletion before loader retirement. Other Planned loaders can retire individually while their volume remains Known. Uncertain absence remains unresolved; only an observed exactly matching resource can become Known. Publish Known/full loader ID before DELETE with force=false, re-inspect that exact ID and revalidate identity before deleting, then positively inspect404 before Retired. Known initial404 can retire; identity-fence404 never becomes resource absence. Known volume deletion revalidates exact identity, uses force=false and positively observes404. Failed DELETE may still be followed by a valid absence proof. Any unknown/mismatched/retained code record blocks pin retirement; no list or empty scan settles it. Persist progress after each effect and erase only when both effects are Retired; retry after observer loss resumes that same snapshot. Recovery does not erase source images, mountpoint files, unrecorded volumes or foreign helpers.
+
+```text
+exclusive lease + same-daemon fence
+           │ current-run preflight (containers / code / pins)
+           ▼
+recorded function + relay retirement
+           ▼
+code records: loader (full ID) → volume (exact name + labels)
+           │ any uncertain absence → retain journal + pins; stop
+           ▼
+complete owner container + volume audits (no adoption)
+           ▼
+recorded image-pin retirement → complete image / container / volume audits
+           ▼
+all three journals empty → subsequent startup qualification
+```
+
+Generation 2 has no code-volume inventory RPC and retains existing query/effect ordering; it cannot have controlled code effects. Generation 3 always includes complete owner-volume audits and the code journal in startup/shutdown completion. `NamespaceRecovery.code` reports settled/remaining records, not individual effects or readiness. Public ordinary startup must reject nonzero code.remaining. Direct container/pin recovery remains a low-level operation with an explicit prerequisite that consumers/code owners have joined; only namespace recovery composes the full ordering. Final Image-only startup shutdown on a generation 3 root audits volumes even though no ZIP producer is installed.
+
+**Verification.** Corrupt every format/identity/state field with recomputed checksums, duplicate records, maximum 32 versus33, safe torn staging, symlink/hardlink/mode/oversize refusal and generation compatibility/no rewrite. Controlled wire tests cover Planned/Uncertain/Known/Retired, known versus unknown404, publication before DELETE, identity recheck, daemon-fence404, loader start refusal, mount/label/base/full-ID conflicts, attached-volume conflict, observer loss/retry, current-run preflight, consumer-before-code-before-pin order and orphan/full volume audits. Actual retained arm64/amd64 resource qualification must recover a journaled unstarted loader and local volume across directory reacquisition, preserve source images and prove zero owned remnants. Freeze the resource inventory before execution. The retained producing actor, uncertain mutation receipts/admission/source pin ownership, upload-loss/panic handling and ordinary ZIP execution remain required after this boundary; D90 alone does not close 5.1b/P5.
+
+### 6.7 Retained producing code-volume manager (D91)
+
+This completes the producing-owner portion of5.1b after D90. It remains a library component: ordinary ZIP capability, runtime/provider installation and ZIP archives stay gated until5.1c/5.2c. Preserve the generation3 format and historical decoder/recovery contract in§6.6.
+
+**Public boundary.** Add `CodeVolumeIdentity::new(resource, revision)` validating two nonnil UUIDs and allocating a fresh environment UUID; the token is consumed by prepare and is neither Clone nor Copy, while Ready exposes a borrowed identity; `CodeVolumeConfig::new(volumes, jobs, io, upload)` with volumes1..32, jobs1..2 not exceeding volumes, independent IO1..60s and upload1..600s (defaults32/2/5s/60s). `CodeVolumeManager::start(bound_port, directory, config)` requires a current Tokio runtime, an exact directory-bound port and code-generation provenance. `CodeVolumePort::prepare(identity, typed_archive, live_base_pin, deadline)` accepts one immutable ZIP TAR and an image of the same validated architecture, with a positive absolute preparation budget no larger than3600s. The synchronous `start_preparation` variant returns a `CodePreparation` result/cancellation handle with a cloneable `CodeRetirement` receipt before any result observation; `prepare` is the convenience start-and-wait form. Capture that receipt before awaiting a fallible preparation so the parent environment can retain its own work/memory admission through failed-preparation cleanup. `CodeRetirement::wait(deadline)` is observation-only and succeeds only after physical effects and durable journal retirement; dropped/expired observers do not cancel cleanup. Check the observer deadline again after wakeup before returning a queued result; later waits observe the same receipt. Ready PinnedCode also exposes this metadata-only retirement receipt. The result is cloneable `PinnedCode`, whose `mount()` checks liveness and returns only a named RO `/var/task` mount with NoCopy. Expose bounded diagnostic volume/preparing/quarantine/accepting/worker-failed counts, `is_live`, immutable identity/name access and retained/cached `shutdown(deadline)`. These APIs confer no general readiness or ownership of raw mounts created by arbitrary callers.
+
+Image pins gain private exact-directory affiliation at their existing production factory. A code preparation must receive a live pin from the same acquisition, not just the same owner UUID or same content ID. Test-only image fixtures remain unaffiliated. Reacquired/foreign pins reject before Docker mutation. Keep the pin through physical helper/volume retirement. Before effects, inspect the captured immutable parent through the bound daemon, require the exact ID, reject declared VOLUMES, and validate inherited loader labels: at most56 non-reserved entries so the eight owned entries fit64;128-byte allowlisted keys and256-byte control-free values; reserved rustack.lambda.* image labels reject. No mutable source lookup, pull, uploaded-code execution or implicit source substitution is allowed. Persist only§6.6's immutable primitive identity, not a live lease or host path.
+
+**Ownership and admission.** A bounded32-envelope actor owns a map of at most32 records above its JoinSet workers. Acquire one private producer semaphore from the exact DirectoryLease acquisition at manager start; retain it in the actor/stages/reapers through physical settlement, so a replacement manager cannot overlap a previous retained producer. The guard can release cleanly only after an empty joined ledger (or an entirely unissued empty actor) is proven. Whole-runtime destruction which drops the transferred cleanup without that proof permanently poisons this DirectoryLease acquisition before releasing the semaphore; another runtime using the same acquisition must reject production. Preserve durable evidence for historical recovery under a fresh acquisition. Stopped port clones do not independently retain this producer permit. Before accepting a request reserve both a volume slot and a preparation slot; enqueue failure has no effects and returns both. Reject duplicate active environment IDs without replacing their owner. Retain the source pin, archive, directory, mutation receipts and both reservations above worker unwind. The archive reservation may release only after the retained upload call/driver has joined; keep it during unknown or panicked staging until that task joins. The preparation slot releases on a consumed successful handoff via a retained acceptance receipt; failed/lost handoffs retain it until physical/journal retirement. Ready clones retain the volume slot/source pin until last release or explicit shutdown after consumers have joined. A quarantined cleanup blocks new admission. Worker/root panic permanently closes admission, revokes ready leases and reaps retained records; no restart creates replacement owners while previous side effects remain uncertain.
+
+**Timed consumed handoff.** The retained handoff record separately stores Pending/Consumed(Instant)/Expired and its optional preparation permit. A successful caller consumes it under the watch lock, checking original deadline and transitive code/base/owner liveness at that linearization point, records the consumption Instant and releases preparation admission. The owner has its own sleep-until-original-deadline branch and first reconciles an on-time Consumed timestamp, even if processing is delayed. Otherwise it atomically marks Expired, revokes and retires without waiting for caller repoll. Keep an expired handoff's preparation permit until physical/journal cleanup; clear it explicitly afterward so an unpolled queued reply cannot retain admission. PinnedCode holds immutable metadata and control/release/receipt handles, not the source pin, TAR or resource permits; actor records hold those until retirement. Ready-but-unconsumed expiry must release physical/source capacity even while the prepare future itself remains alive and unpolled. Add queued-ready abandonment, live-unpolled expiry and late-consumption controls.
+
+**Retained staging.** Register a single stage task in a retained CleanupTask before starting it. Root/worker cancellation never aborts this task: each accepted Docker operation is awaited through its existing wire/driver settlement, under the smaller captured phase deadline. Cancellation/deadline/stop are checked between effects; an observation timeout never restarts the stage. The manager uses a private owned-response clone of its bound DockerPort: all stage and reaper RPCs await the accepted envelope response through exchange/driver settlement, then enforce the captured deadline. The public observer-timed wire behavior and existing callers remain unchanged. Its cached terminal result and progress live above workers; worker panic joins the same stage before retirement. If the stage itself panics, its JoinHandle is consumed once, source/admission/intent remain retained, and the recovery owner reads serialized durable state before proceeding. This avoids treating a dropped upload waiter or an empty volume scan as an IO barrier.
+
+```text
+prepare caller ── reserve(volume + preparation) ──► bounded actor
+     │ lost observer                                    │ record owns guards
+     └─ cancellation signal                             ▼
+                                            retained stage task (never aborted)
+                                            │ journal / tracked create / upload
+                                            ▼
+                                  unstarted loader positively absent
+                                            │ consumed ready handoff
+                                            ▼
+                               PinnedCode clones → RO environment consumer
+                                            │ last release / ordered shutdown
+                                            ▼
+                             stage joined → loader absent → volume absent
+                                            │ durable journal erased
+                                            ▼
+                                      release guards/quotas
+actor/worker panic → close/revoke → join original stage → retained reaper loop
+whole runtime loss → poison same acquisition → fresh acquisition/historical recovery
+```
+
+**Durable effects.** Insert a current-run Planned/Planned record before any create, refusing historical code records. Allocate/store each MutationReceipt above workers before durably arming that effect Uncertain; move its guard into tracked volume/container create only after publication succeeds. No accepted issued error/status by itself permits settlement. Persist exact matching volume Known, then loader Uncertain, then the positively inspected full loader ID before upload. The helper uses the immutable parent/platform, User65534:65534, fixed never-start entrypoint/empty Cmd, workdir `/var/task`, network none, readonly root,128MiB memory, one CPU, PIDs64, all capabilities dropped, no-new-privileges and a single NoCopy RW named volume; never start/attach/execute it. Upload only the typed original-ZIP archive with copyUIDGID=false. After joined upload, require the same Created/non-running/unstarted identity, remove with force=false and persist loader Retired after positive absence. Only then publish Ready.
+
+Extend the journal's private producer transactions with exact identity/CAS checks. Allowed producer transitions are Planned volume→Uncertain, Uncertain→Known; once volume Known, Planned loader→Uncertain and Uncertain→Known(full ID). Existing recovery transitions stay monotonic. Current-process definitely-unissued receipts additionally authorize `(volume Uncertain, loader Planned)→(Retired,Retired)` or `(volume Known, loader Uncertain)→(Known,Retired)`; validate the retained receipt before this exceptional transaction. Historical unknown404 still cannot use this proof. All transactions preserve max32, profile3 and private serialized snapshot rules. Retain receipts before publication so lost disk acknowledgment or worker panic cannot forget an unissued effect.
+
+**Retirement.** Share D90's loader/volume identity checks and effect-retirement logic between historical and current owners; current owners may retire only their own exact record after the stage has joined and consumers have released. Read serialized authoritative state after interrupted writes, preserving immutable identity. Normalize only proven unissued effects, then retire loader before volume. Separate physical-effect retirement from journal erasure: publish a retained in-memory retired witness before erasure so an erased-but-unacknowledged snapshot can be recognized on retry. An absent journal with possibly issued effects and no retirement witness remains quarantined. Any mismatch, unknown issued absence, attached volume or IO/storage failure retains guards/quota and retries with bounded cleanup concurrency2 and backoff1..30s. Root emergency recovery never aborts its transferred worker JoinSet; existing workers receive stop and join their current IO/stage before retirement. It keeps the map above replacement cleanup workers and moves/joins original workers without aborting accepted IO before reaping; independent entries can retire even if another remains quarantined. No forced deletion, adoption, image deletion, mountpoint access or source mutation is added.
+
+Shutdown closes admission/revokes leases, finishes original stages and joins all reapers before the image manager and Docker wire stop. Callers must first join known/uncertain function consumers and IO while retaining their PinnedCode; force=false is an extra attachment barrier, not proof that an unseen consumer create cannot arrive. Expired/abandoned shutdown observation retains the same owner/JoinHandle/emergency task; repeated shutdown joins and returns the cached terminal supervision result. Independently retain a positive empty-ledger witness outside those tasks, publishing it only when all entries and original jobs have joined or a dropped root already owns neither. Cached terminal supervision, including an error from destroyed Tokio tasks, is not physical proof. The consuming startup owner may advance to image retirement only after observing both task settlement and this retained witness. Dropping the public manager signals this same retained shutdown, with detached continuation justified only to preserve accepted resources until they are physically retired.
+
+**Exit evidence.** Cover same-acquisition/architecture/base-label/VOLUMES rejection before effects, caps/duplicate IDs, publication before each create, unissued receipts versus issued404, canceled/lost create/upload acknowledgments, retained buffer/source/volume/preparation reservations, release of conversion capacity after joined upload, consumed versus lost Ready handoff, cloned leases, loader force=false/identity conflicts, volume conflict/storage erasure acknowledgment loss, worker/root/stage panic, original-stage joining and repeated/expired shutdown. Add a frozen actual resource on each retained architecture: use the producing manager to transfer original immutable ZIP code, consume its returned RO mount with the cross-built probe, demonstrate computed42/ownership/modes/EROFS/writable tmp, join consumer before lease/volume/image retirement, and verify namespace absence/source preservation. Keep all standard/strict/Native/security/text gates and full Docker manifest; no prerequisite alone claims ordinary ZIP or full M4.
+
+### 6.8 Ordinary provided-runtime installation and environment consumption (D92)
+
+Task5.1c consumes D89-D91 end to end through the installed Docker executor: ordinary signed ZIP Create/Update/Publish/Alias/Invoke and ASL Lambda Tasks. Preserve Image and Native/Squib behavior. ZIP archive restore remains task5.2c: keep its explicit rejection and the16MiB Image-only metadata profile until its own consumer is qualified. Full M4/platform/Node/handler SDK/IaC acceptance remains required.
+
+**Selected source and installation.** `LAMBDA_DOCKER_ZIP_IMAGE` is optional. When supplied, require a digest-qualified reference, Linux architecture matching the selected daemon, exact live image-owner affiliation, no declared VOLUMES and D91 inherited-label bounds. The operator asserts that this OS-only image is compatible with provided.al2023; metadata does not attest a distribution or promise dynamic-library availability. Prepare its immutable content through the qualified image owner and fresh unpacked-size policy. Retain it alongside the relay. Require at least two image-pin slots. A preparation/policy failure aborts qualification and uses ordered retained shutdown; never substitute a source.
+
+Configured ZIP startup uses retained code-profile DirectoryAcquisition: create RSDKOWN3 only for a fresh directory, refuse generations1/2 without upgrade, and reopen3 under the existing daemon binding. Image-only startup keeps general acquisition/recovery. Drain historical consumers/code/pins and audit the complete namespace before producers start. Start one CodeVolumeManager for this acquisition, with volumes equal to the validated environment cap, jobs min(2, volumes), existing management IO and `budgets.lambdaDockerCodeUploadSeconds` (default60, range1..600). The original total cold-start deadline bounds conversion/upload/relay/bootstrap; never reset it after preparation. Independent BootstrapReady initialization timing stays unchanged.
+
+Add closed `DockerZipRuntime` inputs containing the live base pin and CodeVolumePort, validated against the supplied DirectoryLease. DockerExecutorConfig accepts this optionally, absent by default for existing Image callers. Private startup Evidence captures the exact source, checks base/producer health with existing daemon/image/environment/resource/network/endpoint proofs, and installs it into the real executor. `DockerCapabilities.zip` is true only for a ready installation with this source. Public ready/zip observations stay false until the executor graph is installed and its final deadline fence passes; internal proof validation during construction is not public activation. Absent configuration explicitly rejects ZIP. Source/producer failure revokes readiness. Add `Executor::zip_available(architecture) -> Result<(), ExecutorError>` with an unsupported default; only the installed Docker executor opts in for its captured architecture. Diagnostics and arbitrary pins cannot establish readiness.
+
+**Provider boundary.** Docker ZIP Create/CodeUpdate/ConfigurationUpdate validate exactly runtime provided.al2023, a1..128-byte handler using ASCII alphanumeric or `_./:-`, one architecture matching the installed source and existing common settings before revision commit. Reject a healthy backend with no configured ZIP source as InvalidParameterValueException before fetching or staging code, preserving the existing image-only negative SDK contract. A configured source or backend that becomes unavailable remains a service failure. The ASCII handler bound matches the [Lambda CreateFunction Handler limit](https://docs.aws.amazon.com/lambda/latest/api/API_CreateFunction.html#lambda-CreateFunction-request-Handler). New staged ZIP code passes D89's retained converter before commit: ELF/ZIP/CRC/tree errors map to InvalidZipFile with static redacted diagnostics; conversion admission waits within the captured validation deadline; explicit bounded Busy maps to modeled throttling and admission expiry maps to ResourceNotReady; expiry/worker failure cannot become deployment success. Preserve the existing independent30s source-fetch and ZIP-staging limits. Capture one separate30s absolute precommit conversion deadline using `CODE_FETCH_TIMEOUT`; semaphore admission, conversion and final join checks share it without resetting it. This does not add a new end-to-end deployment budget or change Native/Squib staging semantics. Immediately release the validation TAR. Original ZIP bytes/hash/size remain public identity. Cold staging revalidates the same immutable bytes. Failed/canceled validation rolls back staged files, preserving previous latest/publications/aliases. Configuration-only updates need no conversion for unchanged code/architecture, but cannot switch to an unsupported runtime. Preserve Native/Squib and DryRun semantics.
+
+**Environment plan.** Add `DockerZipRuntime::new(directory, base, code_port)` and `EnvironmentPlan::new_zip(directory, relay, revision, policy, source)`, sharing validated revision/policy/relay construction, with a fresh consumed CodeVolumeIdentity. Its environment UUID is shared by relay/function/code identities. Derive the volume name through the shared identity helper. A plan owns one single-use identity slot and retained code-stage state; allocation cannot replay its identity after retirement. Warm lookup alone performs no conversion or Docker mutation. The deterministic warm key includes resource/revision/qualifier, original ZIP hash, runtime/handler, selected immutable base metadata/fingerprint, relay, architecture, effective environment and full sandbox policy; exclude random environment names. Published/alias/in-flight calls retain captured revisions.
+
+Acquire an exclusive per-plan allocation claim at the bounded environment port after capacity reservation and before enqueue. Carry the claim guard in the envelope; unaccepted/rejected envelopes may reset it because they issued no effects. The actor commits it before registering the worker. A committed claim never resets, even after physical retirement. Duplicate Arc-plan allocation across two managers must reject before a second cleaner can erase or retire another consumer's records. The stage separately consumes its unique code identity once.
+
+Materialize fixed `/var/task/bootstrap`, empty Cmd, `/var/task` workdir, configured unprivileged UID/GID, immutable base ID/platform and exactly one named RO `/var/task` NoCopy mount. Preserve relay networking, authoritative Runtime API/function metadata, tmpfs/cgroup/memory/CPU/PIDs/security/log policies. No image defaults, handler-derived argv, host binds or extra mounts. Image overrides remain unchanged. Both public and tracked function-create paths require a consumed live code lease and exact volume identity; relay creation requires source availability but cannot authorize a function before code readiness. ZIP ownership inspection additionally verifies the sole actual RO named code mount.
+
+**Retained preparation and cleanup.** Reserve the existing environment slot and function+relay memory before conversion or volume requests. Register one code-stage CleanupTask in plan state above the worker before starting its future. Consume the identity once, await bounded immutable conversion, check stop/deadline, then call start_preparation. Publish its CodeRetirement receipt above worker unwind before awaiting the fallible result. Caller/worker/root loss cannot forget accepted work or its original stage. Cancellation drops result observation while retaining the receipt; never start replacement preparation. Publish consumed PinnedCode in the same retained state only after helper absence. Code readiness precedes relay Ready, function create/start and BootstrapReady. A pending/failed stage cannot authorize function creation.
+
+The cleaner joins the same stage and reads authoritative state, including after panic. Never restart staging. Prove function retirement and join all environment IO before dropping the code lease. Observe the same physical receipt through bounded resumable waits. Unknown effects, identity mismatch, failed erase or worker loss retain environment/work/memory admission and quarantine. Code physical/journal retirement precedes relay cleanup completion, Removed and admission release. All stage acceptance uses a private D91 entry point with a synchronous pre-enqueue receipt publisher. Construct the no-effect retirement guard before invoking the publisher; invoke it before the envelope can enter the owner mailbox. The stage stores that receipt above unwind before acceptance, so publisher panic cannot leave an accepted preparation without a retained receipt. A joined stage without a receipt proves no acceptance only through this enforced before-enqueue contract; joining an arbitrary failed stage alone is insufficient. Any uncertain publication remains quarantined. Source pins/intents stay above cleanup workers. Late accepted function creates remain quarantined under existing mutation receipts until positively observed and retired; force=false does not authorize releasing an unknown consumer.
+
+Retain a typed code-stage error origin. Immediate Busy from the synchronous `start_with_receipt` call proves that no preparation was enqueued and maps to environment admission Busy/TooManyRequests only after the parent cleanup has positively settled. A Busy reported by an accepted preparation or its Docker wire remains a nested infrastructure error, including after volume/loader effects. Never infer origin by rewriting every Busy observed by `wait_ready` (D36). Both paths retain their same stage and any published retirement receipt through cleanup.
+
+```text
+signed SDK / ASL -> captured ZIP revision -> qualified Docker executor
+                                            | warm-key lookup
+                              reused environment ------+
+                                            | cold     |
+                        environment slot + memory      |
+                                            v          |
+                        retained conversion/code stage |
+                          | preparation receipt above worker
+                          v
+                        D91 owner -> loader absent -> consumed RO lease
+                                            v
+                        relay Ready -> function bootstrap -> warm calls
+                                            | cancel / exit / eviction / stop
+                                            v
+                        function absent -> IO joined -> RO lease released
+                                            v
+                        code receipt settled -> relay absent
+                                            v
+                        environment/work/memory released
+                                            v
+                        code manager -> image manager -> audits -> wire
+worker/root failure -> join original stage -> same receipt + retained cleaner
+```
+
+**Shutdown.** Startup State joins executor pool, environment manager, code-volume manager, image manager, final container/code/pin/volume audits and wire in that order. Preserve the first diagnostic independently of physical settlement. Add a private code-manager physical-settlement observation: cached Worker after complete joins must not prevent safe later cleanup. Expired observers retain original joins. Whole-runtime loss uses D91 same-acquisition poison/historical recovery, never replacement or adoption.
+
+**Executable acceptance.** Controlled cases cover fixed argv/user/mounts; source/scope/architecture/runtime rejection; warm-key isolation; no create before Ready; cancellation/panic/root loss; failed preparation receipts retaining original environment memory through cleanup; provider rollback/ELF/runtime/architecture rejection; startup provenance/readiness/shutdown order; and YAML bounds. Freeze new resource names before execution. Signed SDK tests deploy the actual cross-built runtime bootstrap ZIP, compute cold/warm results, preserve published/alias A while latest becomesB, and invoke via ASL. Exercise init/error/exit/timeout, allocation/init/busy/cleanup cancellation and actual RO code/writable bounded tmp. Qualify the exact same per-architecture ZIP bytes with the production Native executor on Linux in a separately owned verifier process: equal source code or host Mach-O is not same-artifact evidence. Bound verifier inputs/results, use the real FunctionStore/provider/runtime API, compute cold/warm results, join actual children, and record consumer/volume intent before effects. Both full functional lanes, source preservation, zero remnants, all Rust/strict/Native/security/text gates and independent review are required. Native reference/platform/Node/SDK/IaC/full M4 requirements remain unchanged.
+
+### 6.9 Bounded provided-runtime ZIP archives and mixed candidate restoration (D93)
+
+Task5.2c consumes the qualified§6.8 runtime and D88's retained startup transaction. Restore saved original ZIP code and metadata; never restore a live environment, code volume, loader, Runtime API session, invocation receipt or warm counter. Preserve existing Native/Squib archive behavior and the Image-only profile. This section is a delivery contract, not a completion claim.
+
+**Installed profile and public boundary.** The executor exposes its optional configured Docker ZIP architecture synchronously, independently of its health/readiness result. This is a bounded archive-profile selector only; it cannot authorize execution. Native/Squib/unconfigured executors default to no Docker ZIP architecture. The qualified Docker implementation reports the architecture of its sealed§6.8 source. Provider archive operations must separately check the actual backend/source capability before work and immediately before publication. Rename the misleading provider `image_archive_payload_limit` accessor to `archive_payload_limit` and update the main SnapshotService consumer and examples; no deprecated shim is required. Docker without a configured ZIP source retains16MiB and rejects every ZIP row. Configured Docker ZIP uses the explicit managed profile below. Unhealthy configuration cannot silently select a permissive fallback or manufacture readiness.
+
+| Managed ZIP archive budget | Ceiling / rule |
+|---|---|
+| Complete Lambda service CBOR payload and compact JSON work representation |128MiB each; checked fallible capped writers before allocation growth |
+| Metadata excluding designated version ZIP bodies | D88's16MiB, depth64,65,536 members,128KiB scalar strings and1,024-byte keys |
+| Functions / latest plus published revisions |256 /1,024, shared with Image archives |
+| One original ZIP / canonical standard-base64 body |50MiB decoded / `4 * ceil(decoded/3)` encoded |
+| Total original ZIP bytes across latest and published rows |64MiB decoded, counting repeated revisions independently, even when live Bytes are shared |
+| Complete private candidate extraction |512MiB expanded logical bytes and20,000 materialized nodes, counting every revision plus its three wrapper nodes |
+| Pure validation/export workers | Existing shared four-slot retained worker admission; no unbounded spawn/copy before admission |
+| ZIP tree, extraction and ELF/TAR conversion | Unchanged D89 filesystem, expansion, node and converter admission limits |
+| Deadline | Original startup/import deadline throughout; export uses its one captured caller budget |
+
+Before typed CBOR deserialization, the main Lambda service applies a schema-path-aware mode of the existing structural scanner. Only `functions.functions[*].latest.zipBytesBase64` and `functions.functions[*].versions[unsigned-version].zipBytesBase64` may have large definite text contents. Keys, length headers and all other encoded bytes count against16MiB metadata. The mode additionally caps metadata scalar strings128KiB, keys1,024 bytes, container depth64 aggregate members65,536 (one unit per map pair or array element), and aggregate values131,073 (covering that member profile plus map keys/root). Wrong-shape paths and the same key under arbitrary/unknown fields never gain the exemption. The original generic duplicate-key/CBOR syntax checks still run before typed allocation. Keep this as a policy of the existing scanner, not a second CBOR parser. Expose corresponding capped Lambda encode/decode helpers; successful encode must pass the same policy before archive publication. Other services and Native/Squib retain their existing generic codecs/limits. Image-only Docker uses the same domain policy with zero large-body exemptions and its existing16MiB cap, preserving valid D88 DTO/schema compatibility. The Rust provider's owned DTO boundary still performs its separate metadata preflight after designated string moves; it cannot recover unknown fields already erased by serde.
+
+The larger service allowance applies only to the exact typed version `zipBytesBase64` bodies. Ancillary policies, descriptions, environment values, unknown dynamic condition members and layers do not inherit larger scalar/metadata limits. Do not increase core JsonLimits or the generic CBOR profile. Preflight collection counts and encoded per-body/aggregate decoded sizes before decoding or making another owned copy. Require canonical standard alphabet/padding/trailing bits and exact decoded length; reject malformed input rather than normalize it. Preserve ZIP codeSha256/codeSize and compare against the actual original bytes before publication. Per-body/aggregate arithmetic is checked. A valid Create package can exceed this aggregate archive profile; save then fails without replacing the previously committed generation, with the local limit documented to operators.
+
+**Pure intake and bounded export.** Extend the existing Image snapshot validator as a Docker profile validator, keeping one implementation of shared scope/identity/count/dynamic-policy checks. An owned intake job may temporarily move the designated ZIP strings into a bounded side vector, validate the remaining DTO under the unchanged16MiB metadata limits, then put the original strings back in their exact version slots. This moves ownership without cloning bodies and does not alter the serialized archive schema. The side vector and input remain owned by the same admitted job through rejection/unwind; no late pure result holds a publication capability. Verify version slot/count alignment and retain iterative policy destruction. Canonical ZIP source syntax/size validation precedes host staging; actual bytes/tree/hash/ELF validation happens in the complete private candidate before any image-pin mutation.
+
+Export must remain borrowed and bounded before constructing an owned DTO: capture shared stores only after worker admission, check counts and complete ZIP source/expanded-byte/node aggregate budgets with the same read-only measurement used by candidate staging, counting every revision and wrapper, and guard borrowed records while each map-entry read guard is held. Before constructing any owned DTO, serialize a metadata-only borrowed projection into the unchanged16MiB fallible writer, replacing only the exact latest/unsigned-version ZIP body values with null without invoking their serializer. Validate that projection with the unchanged global JsonLimits (depth64/members65,536/scalar128KiB/key1,024). Use a private recursive Serializer decorator over the same borrowed records, supporting both SerializeStruct and SerializeMap/flatten, exact path state, bounded key classification and no dynamic Value/to_value/to_string copies. Never exempt policy/layer/unknown lookalikes. This bounds aggregate owned metadata nodes as well as encoded storage; per-record guards and a128MiB writer alone cannot do that. Under the startup/quiescent contract, subsequently serialize the full managed128MiB view, construct its owned DTO in the same admitted worker and revalidate the complete profile before returning. Keep the final validation even after the projection pass; do not collect all DashMap guards or introduce cross-shard locking. The Image-only path retains its existing16MiB preflight-before-deserialization. Do not Clone live dynamic policies or all ZIP/base64 data before admission. Preserve deterministic function/layer/mapping ordering and the existing v2 envelope/DTO shape.
+
+**Candidate preparation and publication.** Require startup/quiescent use and the healthy idle deployment owner, as D88 does; there is no live import HTTP API. The full metadata pass precedes code or pin preparation. Build every function/ancillary candidate privately, preserving resource/revision/version identities, aliases, tags, concurrency and source metadata. Before each extraction, inspect the original ZIP without filesystem effects using the shared validated paths/tree layout; charge its checked declared expansion and materialized tree nodes against the one candidate budget. Include three wrapper nodes per retained artifact (artifact directory, extracted root and code.zip). Repeated latest/published code is charged repeatedly; do not rely on compression ratio or assumed sharing. Bound actual extraction by the bytes charged for that ZIP so a false central-directory declaration cannot exceed the aggregate reservation; malformed/CRC/actual-size mismatch fails the candidate. These are logical data/node ceilings, not claims about filesystem block allocation. Budget exhaustion must happen before allocating that artifact and leave no Image pin effects. Stage original ZIP bytes through the existing immutable FunctionStore artifact owner; reject unsupported runtime/handler/architecture, missing code, image fields on ZIP rows, mixed package types within one function, non-Active ZIP revisions, wrong hash/size and alias targets/routing that do not exist. A usable ZIP revision must have provided.al2023, the§6.8 handler bound and exactly the configured selected architecture. Run every staged ZIP through the retained D89 converter; its effective cutoff is `min(original import cutoff, now + existing600s converter ceiling)`, never a replacement for the original aggregate cutoff. This supports valid import budgets up to3,600s while preserving the public converter profile. Recheck the original cutoff after each conversion and discard the temporary TAR. Do not create a loader, code volume or function container while restoring metadata.
+
+Only after all candidate records, aliases, ZIP bytes and effective plans validate may D88 reacquire any Image leases. Keep exact saved image IDs/platform/fingerprints/fresh-size proofs, shared leases, no tag/pull fallback and retained mutation ownership. Mixed functions are permitted in one managed archive, with homogeneous package type per function. Validate all final records, recheck source/backend/deployment health and the original deadline, then publish functions/layers/event mappings in the existing synchronous startup boundary. A failed later ZIP, pin or deadline drops the entire candidate and its original staging/lease owners; old stores remain unchanged. Do not reset a fresh30s budget for each restored ZIP or let a late converter result publish after expiry. Add a deadline-aware internal staging path: carry the original import cutoff into per-version extraction and check it immediately before artifact registration and record continuation. Existing public Native/Squib staging retains its established independent budget. Merely wrapping the old staging API in an observer timeout is insufficient because its continuation can otherwise register a late artifact. A detached blocking extraction owns only bounded private TempDir/source/permit state and no store-publication capability.
+
+The provided base is operator runtime configuration, not function ZIP code identity. On restart the archive cannot select a registry, mutable tag, daemon, network, credentials or UID/GID. Validate/use the currently configured immutable qualified provided base and selected architecture. A deliberately changed operator base may change the execution environment while original ZIP hash/size and function identities stay fixed, as with runtime configuration changes; archive import cannot implicitly follow a mutable source. Persist no host extraction path or saved base-derived warm identity. After a process restart/fresh runtime startup, the first invocation allocates fresh§6.8 code/environment ownership and executes the original saved bytes. Archive import never resurrects serialized live resources or replays function/workflow work. Preserve D88's startup/quiescent library semantics: an in-process quiescent import does not itself invalidate an already live same-runtime cache whose complete D92 identity remains eligible; it does not claim a process restart. The actual restart resources qualify fresh-pool behavior.
+
+```text
+ retained startup transaction: one original deadline, business ingress closed
+ ┌─ managed Lambda archive ───────────────────────────────────────────┐
+ │ original ZIP bodies + bounded metadata + exact Image proofs         │
+ └───────────────────────────────┬─────────────────────────────────────┘
+                                 ▼
+         admitted pure profile validation (no code/pin effects)
+                                 ▼
+       complete private FunctionStore candidate and original ZIP leases
+          ├─ every ZIP: tree/hash/ELF/TAR validation, no Docker create
+          └─ every Image: exact saved-ID/fresh-size lease reacquisition
+                                 │ any failure/expiry
+                                 ├────────► discard candidate; join original work
+                                 │          preserve old stores/current/previous
+                                 ▼ final backend/source/deadline fence
+          one synchronous functions + layers + mappings publication
+                                 ▼ startup transaction commits, then ingress
+        first new invocation → fresh owned volume/container; no replay
+```
+
+**Errors and ownership.** Malformed/unsupported/oversized archive data is a static InvalidParameter error; unavailable/revoked qualified sources, retained worker faults and deadlines preserve existing typed infrastructure/deadline classes. No input bytes, base64 bodies, paths or operator references appear in errors/logs. Observer expiry cannot abort an accepted ZIP extraction/conversion/pin exchange, erase a mutation receipt or release original cleanup ownership. Preserve D88/main transaction retention through joined imports and previous-generation retirement. A failed save/import leaves both committed archive generations byte-identical. Existing Docker Image-only archives remain byte/schema compatible and Native/ZIP paths outside Docker retain their established behavior.
+
+**Acceptance.** Pure tests cover both profile ceilings, exact/over ZIP and aggregate limits with small injected test budgets, canonical base64, malicious ancillary/deep conditions and unknown raw CBOR fields, aggregate expansion/node exhaustion before extraction, output writer bounds, absent/revoked source, mixed candidates, homogeneous package layout, missing code, runtime/handler/architecture/hash/size/ELF/tree failures, alias routing, duplicate resources, invalid later ZIP before Tag, valid ZIP plus failing later Image, deadline/caller loss and unchanged old functions/layers/mappings. Actual ordinary signed resources save/restart latest B/published A/alias A ZIP and mixed Image functions plus terminal workflow history; prove original hashes/IDs/settings, no replay and new cold/warm computations, then checksum-valid corrupt ZIP metadata refusal preserving both generations. A separate Image-only restart must refuse a saved ZIP archive with no configured runtime. Freeze the two new names in the exact manifest before execution, then run both full functional lanes and all host/strict/Native/security/text/independent gates with exact inventories. Node/handler SDK/IaC/server-in-container/reference/platform and full M4 remain required.
+
+
+## 7. Rust engineering contract
+
+Apply AGENTS.md § Error Handling/Async/Type/Safety: thiserror sources; retain async-trait for the existing dyn Executor and document object safety; concrete internal actors use ordinary async methods. Use Bytes/Arc revisions, validated artifact enums, redacted Debug, checked memory/deadline arithmetic, forbid unsafe, IO deadlines and supervised JoinSet tasks. Serde control envelopes use camelCase; Runtime API uses AWS headers. Validate raw lengths before parsing. Tests use actual RIC images and cancellation/failure matrices. Tracing contains IDs, durations and classes, not payloads. Avoid per-invoke pull/inspect. Public APIs document Errors and examples; operational docs cover both deployment topologies.
+
+### 7.1 Strict production boundary closure (B03)
+
+Before P1 closes, `make test-lambda-boundaries` must pass strict production-library Clippy for the Lambda model/HTTP/core, shared core and authentication crates, plus their unit/doc regressions. Apply pedantic, missing Errors docs, indexing/slicing, unwrap/expect and panic checks without new ignores. Document actual method-specific error paths rather than generic boilerplate. Replace guarded external-input indexing with exhaustive slice patterns or checked access, preserving the existing protocol profile; this work does not claim broader layer/IAM compatibility.
+
+The existing RustCrypto HMAC0.13 / digest0.11 constructors formally return Result even though HMAC accepts arbitrary key lengths ([upstream API](https://docs.rs/hmac/0.13.0/hmac/)). Remove production expect calls by propagating a typed AuthError::CryptoInitialization with the original InvalidLength source. Public derive_signing_key and compute_signature return Result; update direct callers/examples in the same change, with no deprecated infallible shim or fabricated signature fallback. Preserve library HMAC computation and constant-time comparisons; do not hand-roll key normalization to sidestep the fallible API. Header/presigned/streaming verification propagates this error without treating it as a mismatch or trying another signing interpretation. Existing raw-versus-S3-normalized eligibility rules stay unchanged. Independent published HMAC vectors and existing streaming/query tamper regressions pin output semantics. No new crypto dependency/version is needed.
+
+Native log draining uses checked access for the successful AsyncRead length and terminates on an invalid reader count with a static diagnostic. This cannot bypass existing child/API retirement. These changes remove the known baseline boundary debt; they do not enable Docker or establish P1 acceptance by themselves.
+
+Use the rechecked Bollard0.21.1 generated-type/API contracts through model-only bollard-stubs; the bounded transport decision and quotas are authoritative in §3.6/D19. Reuse Hyper/Tokio/Bytes/ciborium. Docker management transport remains local Unix-only. The container-origin endpoint probe§4.11 uses HTTP(S), with explicit rustls/aws-lc-rs and embedded webpki roots; it never installs a global or ring-backed TLS default.
+
+### 7.2 Dependency security closure (B01)
+
+P1 must close the16 recorded advisory findings with a current cargo audit/cargo deny run and no new advisory ignores. Upgrade the workspace ZIP reader/writer to the current stable9.1 line (9.1.1 verified against [upstream documentation](https://docs.rs/zip/9.1.1/zip/)); retain default-features=false and only deflate. Reuse bounded manual extraction rather than ZipArchive::extract, and retain rejection of traversal, symlinks, special permission bits, duplicate paths, oversized expansion and corrupt CRCs. Regression fixtures must encode hostile central-directory attributes directly because a safe writer may normalize forbidden permissions; failed staging must retain the old artifact and leave outside sentinels untouched. ZIP9 makes name decoding fallible: bound the raw name to1,024 bytes before decoding, reject decoding failure with a static InvalidZipFile error, then enforce the decoded byte cap and the existing path checks. Never decode lossily or replace a failed name with a sanitized path. The released reader falls back to CP437 even for malformed UTF-8-flagged names, so explicitly require valid UTF-8 when bit11 is set; legacy CP437 remains allowed without that flag, within the decoded cap. The new unix_mode accessor clears special bits: inspect the high16 external-attribute bits before normalization and reject raw symlink/special-permission declarations rather than accidentally admitting them. DOS-origin entries retain DOS attribute semantics; their high bits are not interpreted as POSIX permission declarations. Reject archive.has_duplicate_names() before iterating: the upstream metadata index collapses identical raw names, so the per-path set alone cannot detect those original duplicates. Retain the per-path set for different raw encodings that decode to the same filesystem path.
+
+Update the locked affected TLS/PKI/QUIC/constant-time libraries to patched compatible releases: rustls≥0.23.46, rustls-webpki≥0.103.16, both WebPKI root crates≥1.0.10, quinn-proto≥0.11.18, crypto-bigint≥0.7.6 and ctutils≥0.4.4. These are minimum security floors, not invented direct dependencies. Verify actual resolved features and audit output rather than assuming the top-level manifest excludes vulnerable transitive versions. Retain AWS-LC TLS selection and existing SDK HTTP/Tokio features.
+
+The workspace SDK S3/EventBridge/STS clients explicitly enabled optional SigV4a despite the local gateway's [existing fail-closed ECDSA profile](./rustack-http-hardening-design.md). They serve regional local clients; enabling multi-region AWS signing is not a workflow/runtime acceptance requirement. Remove those three unused SigV4a feature selections while retaining SigV4 and the current SDK model versions. This does not change the SDK/runtime bundled inside user Lambda images. The current upstream signer1.6.3 still directly requires crypto-bigint0.5 under SigV4a (inspected released Cargo.toml), which has no patched compatible0.5 version for RUSTSEC-2026-0387. Do not downgrade the security claim, add an ignore or vendor a cryptographic fork merely to retain an unused client mode. Future multi-region support requires an upstream repaired graph and explicit protocol tests. Ordinary regional SDK CRUD, Lambda deployment/Invoke, KMS cryptography, Native ZIP execution and the strict boundary suite must still pass. Record resolved versions, removed features and remaining advisory outcomes in the review; B01 stays open until all required security gates pass.
+
+## 8. Cross-references
+
+- ← [PRD](./rustack-workflows-00-prd.md), [existing runtime spike](../docs/research/spike-cargo-lambda-runtime-execution.md)
+- → [integrations](./rustack-workflows-40-integrations-design.md), [operations](./rustack-workflows-60-operations-design.md)
+- ↔ [verification](./rustack-workflows-70-verification-plan.md), [decisions](./rustack-workflows-99-decisions.md)
diff --git a/specs/rustack-workflows-30-asl-design.md b/specs/rustack-workflows-30-asl-design.md
new file mode 100644
index 00000000..aff63f3c
--- /dev/null
+++ b/specs/rustack-workflows-30-asl-design.md
@@ -0,0 +1,463 @@
+# Workflows 30: ASL Compiler and State Machine Engine
+
+Status: implementation contract · Depends on: [API/data model](./rustack-workflows-10-api-design.md)
+
+## 1. Compile before execution
+
+Create, Update and Validate share AslCompiler and produce immutable CompiledMachine objects. Never repeatedly parse definitions or resolve string Next targets during execution. Reject duplicate JSON keys and enforce byte/depth limits before constructing serde_json::Value. Business payloads are dynamic JSON; state definitions must become typed tagged enums rather than arbitrary maps interpreted throughout the engine.
+
+Pipeline: bounded bytes → strict AST → field/state validation → scoped graph validation → Path/Intrinsic AST → integration resolution → indexed IR. StateId is a checked internal index. Next/Catch/Choice targets stay within their machine scope: no branch jumps to a parent or sibling machine. Loops are valid; do not require a DAG. Require a reachable terminal state; unreachable states are warnings.
+
+Reject unsupported fields, JSONata, Assign, Credentials, dynamic Resource, Distributed Map and unavailable integrations during creation. Diagnostics carry JSON Pointer location, severity, stable Rustack code and bounded message without copying definition/input into logs. QueryLanguage may be omitted or explicitly JSONPath.
+
+### 1.1 Executable sequential compiler and indexed IR
+
+AslCompiler is synchronous, side-effect-free and configured with a validated TenantScope and trusted TaskSupport (Disabled/Lambda). The future composition root derives support from its installed adapter, not a request field; this compiler flag alone never advertises service readiness. Default construction supports pure workflows in the existing local default scope. Preserve original definition bytes on successful compilation for revision/idempotency use. Preflight at most1MiB,64 JSON container levels,65,536 members,1MiB strings and262,144-byte keys, including decoded duplicate-key rejection, before allocating the generic boundary tree. That tree is used only during compilation; execution consumes typed IR, never state maps or string targets.
+
+Require an object with StartAt and nonempty States (at most1,000). Accept only optional Comment, Version="1.0", QueryLanguage="JSONPath" and positive integer TimeoutSeconds≤31,536,000. Validate state names/targets as1–128 UTF-8 bytes without controls. Assign StateIds in lexical state-name order and resolve every Next, Choice/Default and Catch target through the same scope's index. Allow loops, require at least one terminal reachable from StartAt, and warn for each unreachable state. Fail is terminal; a Task/Pass/Wait End=true is terminal. Potential runtime errors do not substitute for a reachable structural terminal. Bound compiled state/component/policy nodes to65,536; component-local bounds remain independently enforced.
+
+The M1 compiler emits Pass, Task, Choice, Wait, Succeed and Fail only. Known Parallel/Map and child/callback integrations return a profile-unavailable diagnostic until their milestones; unknown types/actions return unsupported/invalid diagnostics. Enforce the field table in§2 before compiling shared data flow. Reject End=false, simultaneous/missing Next/End, top-level Choice Next/End, empty/more-than128 Choices, and every unknown state field. State-level QueryLanguage may be omitted or JSONPath; validate/drop Comment metadata. Pass Result is immutable dynamic JSON retained for bounded materialization at execution; it is exclusive with Parameters. Choice branches compile predicates without their Next field. Wait compiles only its one source. Succeed compiles only input/output paths. Fail preserves omitted/literal/dynamic error/cause fields without inventing an omitted error name; Error/Cause limits are256/32,768 bytes, literal/path pairs are exclusive, and dynamic paths must be reference paths or allowlisted intrinsic expressions yielding strings at execution.
+
+Task Resource is a static complete ARN. Validate exact direct Lambda scope/name/optional qualifier or the partition-matching optimized lambda:invoke ARN; reject scope mismatch, malformed/trailing components and suffix-only .sync matches. A syntactically valid Lambda resource without TaskSupport returns dependency-disabled. Validate known static optimized Parameters fields FunctionName/Payload/Qualifier/InvocationType; FunctionName supports a name or same-scope ARN, InvocationType is RequestResponse and conflicting known qualifiers reject. Dynamic values remain checked by the future adapter. Task timeout is omitted, positive integer1..99,999,999 seconds or a singular TimeoutSecondsPath, never both. M1 rejects heartbeat fields because callback support is unavailable.
+
+Compile Retry/Catch into immutable ordered policies (at most128 entries each and128 nonempty bounded256-byte/control-free error names per matcher). States.ALL must be alone and last in its policy; duplicate names in a matcher reject. Retry defaults/ranges follow§4, with zero MaxAttempts retained. Catch requires a same-scope Next and compiles absent ResultPath as replacement, null as discard, or a data-root reference. Recovery matching never handles States.Runtime; States.ALL/States.TaskFailed exclude DataLimitExceeded unless named explicitly, and TaskFailed excludes Timeout. These are the selected local matching rules. Timing is retained as typed metadata; actor retry counts/timers and jitter sampling remain separate work.
+
+Successful Compilation contains Arc<CompiledMachine> and bounded warnings. The machine exposes immutable checked StateId/read views, original bytes and optional timeout; the IR stores compiled data flow, predicates, waits, resources, recovery and failure expressions. Invalid IDs fail explicitly. CompileError owns one Diagnostic and an optional typed JSON/ASL source; all Debug/Display redact definitions, literals, names and paths. Diagnostic codes/messages are static bounded Rustack-prefixed values, severity is ERROR/WARNING, and location is an RFC6901 pointer (empty for root; escaped ~ and /; at most4,096 bytes). A component failure may identify its enclosing component field rather than an exact expression token. Compilation stops at the first error; Validate later projects the same error or filtered/truncated warnings, without claiming AWS diagnostic ordering/count parity. CPU compilation must be run under bounded admission off the HTTP/registry scheduling loop when integrated.
+
+Literal payload caching uses a64-byte minimum bounded-writer reservation rather than4KiB per scalar; otherwise a valid65,536-node artifact could retain hundreds of MiB in tiny literal buffers. This changes allocation behavior only, retaining all encoded byte/depth/member limits. Exact aggregate-budget fixtures must compile at65,536 nodes and reject65,537 while remaining below source/state limits.
+
+```text
+┌─ original definition bytes ──────────────────────────────────────┐
+│ bounded JSON/duplicates → strict field/type validation            │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+┌─ compiler-owned scope index ──────────────────────────────────────┐
+│ lexical names → StateId; resolve Next/Choice/Catch in this scope  │
+│ data flow / predicates / waits / task and recovery metadata       │
+│ reachability + terminal check; bounded warnings/compiled units    │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+┌─ immutable compilation artifact ──────────────────────────────────┐
+│ Arc<CompiledMachine> + original bytes + typed read views          │
+│ diagnostics contain bounded pointers, no source-value excerpts   │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼ future registry/revision + actor
+```
+
+Tests require all six IR forms, graph loops/invalid targets/unreachable terminals, field/profile/dependency/scope rejection, static optimized metadata, timeout and Retry/Catch defaults/ranges, fail expressions, original bytes, pointer escaping/redaction, duplicate/deep/large definitions, exact state/choice/compiled-node limits and malformed-input properties. This compiler is not endpoint, actor, resource execution or complete M1 acceptance.
+
+### 1.2 Structured scope compilation and staged runtime admission
+
+P3 extends the immutable IR with Parallel and Inline Map instructions. Each branch or processor owns an `Arc<CompiledMachine>` with a separate lexical StateId index. All scopes share one immutable copy of the original root definition bytes and the same validated tenant scope. `original_bytes()` on any nested artifact returns that root source, not a reserialized branch document. `state_count()` remains scope-local. Retain unforgeable root-versus-nested provenance in each artifact: registry Create/Update reject a nested artifact before accepting a command, even when its instructions are sequential and its tenant matches. A branch cannot be promoted into a root revision whose fingerprint/Describe source still denotes the containing definition. No nested scope can resolve transitions against its parent or siblings; repeated state names in independent scopes are valid. Run graph validation for every scope, including unreachable branches, and aggregate warnings with full root-relative JSON Pointers.
+
+Compilation traverses the already preflighted boundary tree once. A shared compilation context charges at most1,000 state definitions and65,536 state/component/policy units across the entire tree; neither counter resets at a nested scope. Root depth is0; at most16 nested branch/processor levels are allowed, independently of the64 JSON-container preflight limit. A Parallel has1–1,000 branches, additionally constrained by the shared state budget. Every scope has a nonempty States object and a reachable terminal. Branch/processor machines allow StartAt, States, Comment and QueryLanguage=JSONPath; Version and TimeoutSeconds are root-only. Both ItemProcessor and its legacy synonym Iterator additionally permit ProcessorConfig, an object with only optional Mode=INLINE; absent configuration, `{}` and INLINE are equivalent. Distributed configuration and execution-type overrides fail compilation.
+
+A normalized Map instruction stores input/output/result data flow, a compiled ItemsPath (default `$`), optional compiled item-selector template, a processor artifact, concurrency metadata, ordered recovery and continuation. Legacy Parameters becomes the item selector, **not** the Map data-flow Parameters step. Reject Parameters+ItemSelector and Iterator+ItemProcessor independently; current and legacy spellings from different pairs may coexist. Require exactly one processor spelling. Preserve JSON null versus omission: a present selector must be an object. ItemsPath and MaxConcurrencyPath must be singular reference paths; wildcard/slice sources fail compilation. Concurrency is a typed positive static limit or a compiled dynamic reference. Omitted/zero static limits normalize to40; static1–40 are retained; negatives, fractions, values above40 and simultaneous literal/path fields fail. Dynamic value/type/range checks happen on entry, against the effective Map input after InputPath. Count the item-selector template toward the shared node budget. Parallel uses the ordinary Parameters and result pipeline. Both instructions compile Retry/Catch in the enclosing scope, and expose Catch edges to enclosing graph validation.
+
+The compiler's trusted `StateSupport` defaults to Sequential; explicit Structured enables construction/inspection of these artifacts for the frame executor. This flag is never a wire field or a readiness claim. The standard ExecutionDriver constructor and default ExecutionSupervisor::start retain sequential library admission. Explicit structured construction/start require the installed bounded frame owner (§3.5). The real service binds compilation and execution through the immutable registry profile (§3.6), qualified by causal history, sibling cancellation, child-frame Lambda execution and both SDKs. Neither compiler selection alone nor eight-state service acceptance establishes nested-job or full M2 acceptance.
+
+```text
+┌─ strict root JSON + shared original Bytes ───────────────────────┐
+│ one budget: ≤1,000 states / ≤65,536 units / ≤16 nested scopes    │
+└────────────────────────────┬────────────────────────────────────┘
+                             ▼
+┌─ enclosing machine: lexical StateIds ───────────────────────────┐
+│ Parallel: branch Arcs ─┬─ independent machine/index → output[0] │
+│                       └─ independent machine/index → output[1] │
+│ Inline Map: one processor Arc; compiled selector + concurrency │
+│ Next / Catch resolve only in this enclosing machine            │
+└────────────────────────────┬────────────────────────────────────┘
+                             ▼
+          frame owner (next P3 dependency; API stays gated)
+```
+
+Compiler acceptance covers lexical reuse and cross-scope rejection for StartAt/Next/Choice/Catch, nested terminal validation and warnings, shared source ownership, current/legacy Map equivalence and conflicting pairs, exact state/unit/depth boundaries, nested Lambda dependency detection, pointer escaping/redaction and default API/driver refusal. P3 runtime acceptance remains the full scheduler/cleanup/nested-integration exit criteria in the implementation plan.
+
+## 2. Supported ASL profile
+
+The [ASL specification](https://states-language.net/spec.html) supplies language terminology. The table below is the release contract; supporting eight state types does not imply support for every recent language extension.
+
+| State | Supported fields beyond Type/Comment and applicable InputPath/OutputPath | Constraints |
+|---|---|---|
+| Pass | Result, Parameters, ResultPath, Next/End | Result and Parameters are mutually exclusive locally; no Retry/Catch |
+| Task | Resource, Parameters, ResultSelector, ResultPath, Retry/Catch, TimeoutSeconds/Path, HeartbeatSeconds/Path, Next/End | Exact integration allowlist; heartbeat supported for callback only |
+| Choice | Choices, Default | No top-level Next/End or ResultPath; first matching rule wins |
+| Wait | Seconds, SecondsPath, Timestamp, TimestampPath, Next/End | Exactly one wait source |
+| Succeed | InputPath, OutputPath | No Next/End or Retry/Catch |
+| Fail | Error/Cause, ErrorPath/CausePath | Each literal/path pair is exclusive; no input/output transforms or Next/End |
+| Parallel | Branches, Parameters, ResultSelector, ResultPath, Retry/Catch, Next/End | At least one independent branch machine |
+| Map, INLINE | ItemsPath, ItemSelector, ItemProcessor, MaxConcurrency/Path, ResultSelector, ResultPath, Retry/Catch, Next/End | Normalize legacy Iterator/Parameters; reject simultaneous legacy/current equivalents |
+
+States supporting Next/End require exactly one, with End=true. Choice Next exists only inside rules. ProcessorConfig only permits Mode=INLINE. MaxConcurrency and MaxConcurrencyPath are exclusive. Compile-time constraints fail compilation; dynamically selected values are validated on entry and never replaced with defaults after an error.
+
+### 2.1 Paths
+
+Use winnow for an explicit ASL subset rather than treating a general JSONPath crate as the AWS contract. Support `$` and `$$`, `.identifier`, `['quoted-key']` with bounded quote/backslash escaping, nonnegative `[index]`, object/array `[*]`, nonnegative `[start:end]`, and consecutive wildcards such as `$[*][*]`. Reject filters/scripts, recursive descent, unions, negative indices/steps and dot-escape syntax at creation. ReferencePath permits only root/member/index; ResultPath must target `$`, never `$$`.
+
+Return Missing, Single or Selection, distinguishing JSON null from no match. Wildcard/slice selections remain arrays even with one match. Array ordering is stable; object wildcard uses deterministic key order as a local behavior, not an AWS object-order guarantee. Reference lookup failures do not panic or become null.
+
+#### 2.1.1 Executable path and payload foundation
+
+The first `rustack-stepfunctions-core` slice exposes only implemented pure semantics: immutable Payload, compiled Path/ReferencePath and bounded result merging. It does not supply a registry, handler or advertised service capability. Core depends on shared JSON validation, not HTTP, Lambda or an SDK. Reuse the workspace winnow1.0 parser (current1.0.4 [API](https://docs.rs/winnow/1.0.4/winnow/)); no new external dependency is required.
+
+Payload constructors validate at most262,144 original UTF-8 JSON bytes, depth64 and65,536 aggregate members through the shared duplicate-key preflight. Preserve original bytes for API idempotency and expose only an immutable parsed value. Constructors accepting an existing Value borrow it; validate structure and finish bounded serialization before cloning, so rejection never recursively drops a caller-owned deeply nested tree. Serialization must stop at262,144 bytes rather than build an oversized buffer first. All diagnostic Debug/Display implementations redact values, paths and source text. Typed source errors remain available without public input excerpts.
+
+EvaluationContext has an independent internal envelope:4MiB,68 container levels and131,584 aggregate members, with each decoded string/key at most262,144 bytes. This accommodates full-size/depth/member-count Execution.Input and Map.Item.Value plus fixed context metadata. Compact exponent lexemes can expand during numeric serialization:65,535 copies of1e9 fit262,141 source bytes but encode to about852KiB. The pinned serializer uses at most24 bytes per numeric value; a conservative allowance of both original256KiB sources plus24 extra bytes per131,584 members and256KiB metadata remains below4MiB. Test both exponent-heavy inputs together and mixed exponent/string payloads, rather than deriving context capacity from string fixtures alone. It is immutable, constructed from a borrowed validated tree before cloning, and redacts Debug. Engine-owned typed builders must later constrain the actual context schema and per-field metadata. Selecting from context still materializes through the ordinary payload's256KiB/depth64/member65,536 boundary; the context root itself need not fit that output boundary. Converting an existing Payload into EvaluationContext shares its immutable Arc and requires no serialization.
+
+Paths are at most1,024 UTF-8 bytes and128 segments. Dot member shorthand starts with an ASCII letter/underscore or non-ASCII non-control scalar; subsequent characters may also be ASCII digits. Bracket members use single quotes and support only escaped single quote/backslash; reject control characters and unterminated/unknown escapes. Bracket indices are decimal usize values with checked conversion; slices allow omitted lower/upper bounds, defaulting to zero/array length, and never negative indices, steps or whitespace. The whole string must parse. A general path may use either root; ReferencePath rejects wildcard/slice segments, and a separate result-target conversion rejects the context root. This is the local subset of the [AWS path contract](https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-paths.html), not full JSONPath support.
+
+Evaluation borrows immutable payload/context values and bounds work to10,000 visited candidates/selected members per call. A wildcard/slice makes the result a Selection even with zero or one match; failed singular traversal is Missing, distinct from Single(null). Preserve array traversal order; explicitly sort object wildcard keys independently of serde_json feature unification. No missing/type mismatch is converted to null. Materialization returns a bounded Payload and raises a typed missing/data-limit/work-limit error. Selection materialization streams references through the bounded writer before building its owned value.
+
+Result merging accepts only the validated data-root ReferencePath. The root replaces the original payload. Nested object members may be created only as objects; writing through scalar/null or a missing member immediately followed by an array index fails. Existing arrays require an in-range index; never grow an array. Apply edits to an owned copy, preserving the original payload on every failure, and enforce the full output depth/member/byte limits after the edit. Discarding a result is a separate data-pipeline decision, not a special path spelling.
+
+```text
+┌─ bounded source text ─────────────┐   ┌─ bounded path text ────────────┐
+│ JSON preflight → Payload        │   │ winnow → Path / ReferencePath  │
+│ original bytes + immutable tree │   │ root + checked typed segments │
+└────────────────┬────────────────┘   └─────────────────┬──────────────┘
+                 └──────────────────┬──────────────────┘
+                                    ▼
+┌─ pure evaluator / result merge ────────────────────────────────────┐
+│ borrowed candidates;10,000 work units; deterministic selections  │
+│ Missing / Single / Selection → bounded writer → validated Payload │
+│ typed redacted failures; original input never mutated             │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+Tests must exercise the actual evaluator against independent examples in the semantic fixture catalog, exact source/compiled/expansion limits, hostile escapes/overflow, context access, consecutive wildcards, null/missing/empty selection, scalar merges and non-growing arrays. Property tests cover arbitrary UTF-8 parsing and quoted-key round trips; this foundation does not satisfy complete compiler/engine acceptance.
+
+### 2.2 Data processing
+
+```text
+┌─ immutable raw state input S ─────────────────────────────────────┐
+│ InputPath(default $, null→{}) → effective input I                 │
+│                    ▼                                              │
+│ Parameters template(I,$$), or I when absent                        │
+│                    ▼                                              │
+│ Task / Pass / Parallel / Map produces raw result R                 │
+│                    ▼                                              │
+│ ResultSelector(R,$$), or R when absent                             │
+│                    │                                              │
+│ S ────────────────▶ ResultPath(default $, null→preserve S) → M      │
+│                                                            │      │
+│ OutputPath(default $, null→{}) ◀─────────────────────────────┘      │
+│                    ▼ next state's raw input                      │
+└───────────────────────────────────────────────────────────────────┘
+       Every expansion/merge checks the 256 KiB payload budget.
+```
+
+ResultPath merges into original S, not the Parameters result. Missing object members may create intermediate objects; writes through scalar/null/wrong container types fail, and arrays do not grow to arbitrary indices. ResultPath=null discards the result. Parameters/ResultSelector recursively process object/array `.$` fields. Dynamic fields require valid Path/Intrinsic strings; collision after removing `.$` is a compile error. ResultSelector `$` refers to raw result, not state input.
+
+Bounded writers enforce final UTF-8 JSON size without allocating unbounded output first. Connector results are size-checked before OutputPath can discard them. Catch.ResultPath merges `{Error,Cause}` into the failed state's raw input rather than a partially transformed result.
+
+#### 2.2.1 Executable templates and data-flow phases
+
+Template compiles a JSON object through the shared1MiB/depth64/member4,096/262,144-byte string/key source boundary. Existing Value inputs are borrowed and validated before compilation. Recursively compile nested arrays/objects into a private AST; dynamic fields ending in `.$` must hold an Expression string. Strip exactly one suffix and reject collisions after normalization, including nested objects. Literal field values are never inferred to be expressions from their text. Preserve array order and emit object fields in lexical normalized-key order. Limit nesting to32 template containers and4,096 total template/expression nodes, charging embedded expression nodes as well as their wrapper. Nonobject template roots, unsupported expressions and limits fail creation with redacted diagnostics.
+
+Evaluation first prepares bounded borrowed literal views and owned expression results, sharing one intrinsic work/text/materialization budget across all dynamic fields. Stream the prepared view through the bounded JSON writer before constructing an owned Payload; never construct an oversized expanded Value tree and only then measure it. Preserve input/context on every failure. Template::evaluate uses the same explicit/default UUID sourcing rules as Expression. Template tests must cover collisions, literal/dynamic distinctions, arrays/context/intrinsics, aggregate expression limits and output expansion; callback history provenance/redaction remains the M3 integration's responsibility and is not advertised by this M1 component.
+
+DataFlow compiles only InputPath, Parameters, ResultSelector, ResultPath and OutputPath from a component object; the containing state compiler owns the allowed field subset for each state type. Parameters/ResultSelector, when present, must be Template objects; explicit null is invalid. Absent input/output paths compile to `$`; null paths produce `{}`. Absent ResultPath replaces with result; null preserves the original raw state input; other ResultPaths use the data-root-only merge contract. Reject unknown fields and malformed paths without defaults after an error.
+
+`prepare(original,context)` applies InputPath then Parameters and returns the resource's effective input. `finish(original,rawResult,context)` applies ResultSelector to the raw result, merges into the original state input and applies OutputPath. The execution owner must retain original separately across the external call; neither phase mutates it. Each phase shares one bounded evaluation budget across its operations and templates. Every selected/intermediate/result payload is validated before the next operation may discard it. Identity/default paths use the same selection/materialization behavior as explicitly supplied `$`. Finish requires an already validated rawResult, so an oversized connector cannot bypass its boundary through a selector or discarded result. The component performs no resource call, scheduling or accepted-command ownership; those remain actor responsibilities.
+
+### 2.3 Context and intrinsics
+
+Support `Execution.{Id,Input,Name,RoleArn,StartTime}`, `StateMachine.{Id,Name}`, and `State.{Name,EnteredTime,RetryCount}`. Map ItemSelector may read `Map.Item.{Index,Value,Source}` with Source=STATE_DATA; inner iteration states receive such data through ItemSelector rather than implicit outer context. Only callback tasks expose Task.Token. Timestamps use RFC3339 UTC and fixture-defined precision. Context is read-only; internal actor IDs cannot masquerade as AWS ARNs.
+
+Intrinsic allowlist: States.Format, StringToJson, JsonToString, Array, ArrayLength, ArrayGetItem, ArrayContains, ArrayPartition, StringSplit, MathAdd, UUID and JsonMerge. JsonMerge supports only `States.JsonMerge(a,b,false)` shallow merging. Reject all others at creation. Nesting is at most ten; each evaluation permits at most 10,000 AST operations and remains within the output budget. P0 fixtures pin escaping, Format, StringSplit delimiter behavior, MathAdd rounding/ranges, shallow merge and UUID format. Do not substitute Rust formatter/split semantics. Production UUIDs use secure randomness; deterministic tests inject a typed ID source rather than seed production randomness.
+
+#### 2.3.1 Executable expression contract
+
+Expression compiles a complete Path or an allowlisted States call, without evaluation during creation. Use the existing winnow lexer with a private typed AST. Bound each expression to4,096 UTF-8 bytes,1,024 nodes, ten nested calls and128 arguments per call. Full consumption is mandatory; reject surrounding whitespace, unknown functions, wrong arity, trailing commas, malformed numbers and unsupported syntax. Internal ASCII whitespace may surround arguments/commas. Arguments may be single-quoted strings, JSON numbers/booleans/null, compiled Paths or nested calls; object/array literals are constructed through Array/StringToJson. Numeric lexemes are at most128 bytes and use existing correctly rounded JSON conversion. These are local bounds, not full ASL parser support.
+
+Decode apostrophe/backslash/brace escapes exactly once. String literals support only `\'`, `\\`, `\{` and `\}` escapes; reject dangling/unknown escapes. Business control characters already decoded from the outer JSON string remain data and are safely JSON-encoded in results. Preserve a format literal's escape provenance until Format processes it, so an escaped brace is not accidentally reinterpreted as a placeholder. Literal non-format braces are accepted without escaping to match observed AWS behavior. Format accepts only `{}` slots, checks slot/argument equality and accepts scalar substitutions (string without JSON quotes; number/bool/null compact JSON spelling); array/object substitutions use the observed collection representation defined in design61 §7. A runtime first argument may itself be a path or nested expression yielding a format string. No host formatter, regex or string interpolation evaluates user syntax.
+
+| Call | Arity | Selected value behavior |
+|---|---:|---|
+| Format |1–128| Scalar/collection replacement; observed map/list representation; brace/backslash escapes; dynamic format checked at evaluation |
+| StringToJson |1| Bounded duplicate-key-safe JSON decoding of a string; normalize integer token -0 to0 at any depth, preserving strings and decimal/exponent zero spellings |
+| JsonToString |1| Compact bounded JSON text, then ordinary JSON string encoding |
+| Array |0–128| Preserve argument order |
+| ArrayLength |1| Array count |
+| ArrayGetItem |2| Nonnegative JSON integer index; no growth, coercion or missing→null |
+| ArrayContains |2| Bounded structural JSON equality; numeric representation differences use supported finite comparison |
+| ArrayPartition |2| Positive chunk size rounded as below; stable final short chunk |
+| StringSplit |2| Each delimiter scalar separates; discard empty fragments; empty delimiter preserves nonempty input as one fragment |
+| MathAdd |2| Round each finite argument to nearest integer, ties toward positive infinity; require int32 operands and checked int32 sum |
+| UUID |0| Fallible OS entropy, RFC4122 variant/version4; no hidden deterministic production seed |
+| JsonMerge |3| Objects only, false third value; right-side keys replace left, no recursive merge |
+
+MathAdd/partition rounding is pinned to the historical AWS-validated math fixtures, including negative halves; implement floor plus a fractional comparison, avoiding `floor(x+0.5)` rounding at adjacent representable values. ArrayGetItem deliberately requires an integer JSON number rather than rounding floats. For mixed numeric structural equality, apply the Choice interoperability range so large integer/float values cannot silently alias; equal integer representations compare exactly. Empty-delimiter split and checked result overflow are explicit local choices. Primary language/function contracts: [ASL](https://states-language.net/spec.html), [AWS intrinsics](https://docs.aws.amazon.com/step-functions/latest/dg/intrinsic-functions.html); historical boundaries are recorded in the [semantic memo](../docs/research/spike-stepfunctions-semantic-oracle.md).
+
+StringToJson validates the original JSON bytes and all ordinary input bounds before normalization. A bounded string/escape-aware scan removes the minus only from complete integer `-0` tokens; quoted text, keys, escaped quotes/backslashes, `-0.0` and `-0e0` are unchanged. Charge whitespace classification, the original parse scan, normalization scan and any changed-source reparse to the shared text budget. Empty or ASCII JSON-whitespace-only text returns null, matching AWS observations; nonempty invalid JSON, malformed numbers and duplicate keys still reject. This numeric compatibility correction is separate from intentional strict JSON input restrictions.
+
+
+Every evaluation shares10,000 AST/data work units,4MiB of scanned text and4MiB of cumulatively materialized encoded payloads. These local budgets include nested calls, array equality/partition members and string delimiter construction (at most1,024 unique delimiter scalars). Reject exhaustion with WorkLimit; never return a partial result. Each intermediate result independently satisfies the256KiB/depth64/member65,536 payload contract, including connector/context selections before another function can discard them. Encode arrays/partitions/merges through borrowed views and the bounded writer before building an owned result; bound variadic argument retention by the shared materialization budget. Allocation overhead is separate from encoded byte accounting. Callers cannot mutate source payload/context.
+
+Expression::evaluate uses a concrete OS-backed UUID source. A separate synchronous UuidSource port enables typed deterministic/failure fixtures; validate injected UUID version/variant before publishing. Use getrandom0.4.3 fill and uuid's existing random-byte builder, preserving typed entropy failures rather than using a panicking random convenience API. Both packages are already in the workspace graph; no unrelated dependency version upgrade is required. System entropy can block during early boot: the future async actor must inject pre-acquired IDs or evaluate through a bounded retained blocking worker, rather than make an entropy syscall inside its scheduling loop. Diagnostics and Debug remain redacted. Tests execute the12 independent intrinsic catalog examples and historical half/split edge inputs, nested/escaped/path/context grammar, exact limits, type/missing errors, overflow, output expansion, work exhaustion and UUID success/source failure. Expression acceptance does not qualify template/pipeline/compiler or workflow execution by itself.
+
+```text
+┌─ bounded expression text ─────────────────────────────────────────┐
+│ winnow tokens → private call/path/scalar AST                      │
+│ arity + escapes + static format checks; no source in diagnostics  │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼ shared evaluation budgets
+┌─ pure evaluator ──────────────────────────────────────────────────┐
+│ immutable data/context → bounded arguments → intrinsic operation │
+│ UUID source → fallible entropy      borrowed output views        │
+│                    ▼                                             │
+│ bounded writer → validated Payload → next expression/template    │
+└──────────────────────────────────────────────────────────────────┘
+```
+
+### 2.4 Choice and Wait
+
+Choice supports short-circuit And/Or/Not, IsPresent/IsNull/IsString/IsNumeric/IsBoolean/IsTimestamp; String/Numeric/Timestamp Equals/LessThan/GreaterThan/LessThanEquals/GreaterThanEquals and their Path variants; BooleanEquals/Path and StringMatches. Do not coerce strings to numbers. IsPresent safely tests missing data; other missing-reference errors are runtime failures. Present values of inappropriate comparison types yield false. Distinguish missing, null and wrong type in fixtures. StringMatches implements AWS wildcard/escaping grammar, not user regex. Reject NaN/Infinity; preserve numeric comparison precision within the documented binary64 interoperability range.
+
+Wait Seconds is nonnegative; timestamps must be valid RFC3339. Dynamic type errors fail. Past timestamps finish immediately. Apply AWS second-level timestamp truncation, compute remaining duration using wall time once, then use a monotonic timer to avoid NTP jumps. Overall deadlines still bound long waits. No dedicated sleeping thread per state.
+
+#### 2.4.1 Executable Choice predicate contract
+
+Compile a Predicate independently of its containing rule's Next target; the machine compiler owns the target. A predicate is either a sole And/Or array (1–128 children), a sole Not object, or exactly Variable plus one supported comparison/test. Reject unknown/duplicate operators and invalid literal types, paths and patterns before execution. Variable and comparison Path operands are ReferencePaths. The public constructor borrows a Value and validates bounded structure before any recursive compilation:1MiB encoded JSON, depth64,4,096 members,262,144-byte strings/keys. Limit the resulting predicate to1,024 nodes and32 nested predicate levels; these local limits must become compiler diagnostics.
+
+And/Or evaluate left-to-right and short-circuit, including errors in unvisited operands. IsPresent alone safely observes a missing reference; every other test/comparison raises a typed missing-reference error. Resolve both comparison references before type comparison; present values of the wrong type yield false. IsNumeric tests the JSON number type. Numeric comparisons accept integers in[-2^53,2^53] and floating-point values strictly inside(-2^53,2^53). Reject boundary floats conservatively because an original out-of-range decimal/exponent lexeme can round to exactly2^53; retaining only its parsed f64 cannot distinguish it from an exact boundary float. Reject other out-of-range values rather than silently aliasing large integers. Enable the existing serde_json float_roundtrip feature centrally so equivalent interior decimal/exponent forms convert correctly to binary64; arbitrary_precision remains disabled. Compile-time numeric literals outside the range reject. Boolean/string comparison never coerces another type. Timestamp literals parse at compilation; dynamic invalid timestamps compare false. Validate RFC3339 offsets with chrono, then represent the UTC whole seconds and the complete decimal fraction separately; remove trailing fractional zeros and compare exact fractions beyond nanosecond precision. Reject leap-second representations and do not equate complete timestamp strings lexically. Debit original literal and dynamic timestamp byte lengths before parsing/comparison.
+
+StringMatches compiles a bounded glob: at most4,096 UTF-8 pattern bytes and1,024 tokens, literal Unicode scalars, `*` for zero or more scalars and only `\\*`/`\\\\` escapes. Braces/question marks are ordinary characters; reject dangling/unknown escapes. Collapse consecutive stars. Evaluate with checked UTF-8 offsets, no user regex and no unbounded recursion. A trailing star can accept the remainder directly.
+
+Each evaluation has one shared10,000-unit budget for predicate/glob steps and1MiB aggregate compared string/timestamp bytes. Debit before work; exhaustion is a typed WorkLimit failure, never false. This prevents compound comparisons and glob backtracking from monopolizing the execution actor. These are local safety limits, not an AWS parity claim. Keep compiled predicates and diagnostics redacted. Tests cover the supported literal/Path operator matrix, logical order, missing/null/wrong type, timestamp offsets, binary64 boundaries, Unicode glob escapes/work exhaustion and borrowed extreme-depth rejection. Do not claim complete Choice state/compiler/engine acceptance from this evaluator alone. Primary operation names/short-circuit examples: [AWS Choice JSONPath rules](https://docs.aws.amazon.com/step-functions/latest/dg/state-choice.html#choice-state-rules-jsonpath).
+
+#### 2.4.2 Executable Wait source contract
+
+Compile WaitSource from an object containing exactly one of Seconds, SecondsPath, Timestamp or TimestampPath; the containing machine compiler owns Type, transforms and transitions. Reuse bounded source preflight/borrowed-tree validation before compilation. Static and dynamic seconds must be nonnegative JSON integers; reject floating-point spellings (including1.0), strings and booleans. The general ASL integer field ceiling is99,999,999; this STANDARD-only profile additionally caps a single resolved wait to31,536,000 seconds (365 days). Reject an overlong static Seconds at compilation and an overlong dynamic/datetime wait at entry. Other overall execution/operator deadlines can end the execution sooner.
+
+Reference sources compile to singular ReferencePath values. Missing lookup raises Missing; present invalid type/range/date raises a distinct WaitValue failure and never silently defaults. Absolute dates use RFC3339 with uppercase T and uppercase Z when no numeric offset is present; permit explicit numeric offsets, reject leap seconds, lowercase separators, date-only text and invalid calendar values. Validate dates once for static timestamps and on entry for path timestamps. Truncate the target to its whole second before subtraction, retaining the current wall clock's fractional precision. Past/equal targets resolve to zero; future targets resolve to a checked std::time::Duration within the STANDARD cap.
+
+Resolution is pure and receives the caller's sampled UTC wall time; it performs no IO, sleep or clock reads. The execution actor must sample its wall/monotonic pair once, add the resolved relative duration to that monotonic instant with checked arithmetic and register a generation-tagged timer bounded by the independent execution deadline. Do not recompute an absolute wait from wall time while the same state entry is suspended, or respond to subsequent NTP jumps. A new state entry evaluates its source afresh. WaitSource owns no task or timer handle and does not qualify scheduler/cancellation acceptance by itself. Tests cover all four source forms, exact caps, invalid/double fields, duplicates, path missing/null/wrong type, UTC offsets, fractional target truncation, fractional current time and past targets. Primary contract: [AWS Wait state](https://docs.aws.amazon.com/step-functions/latest/dg/state-wait.html).
+
+## 3. Execution ownership and scheduling
+
+One ExecutionActor owns execution data, all branch frames, attempt generations, retry counters, timers and history. Branches are frames, not an unbounded tree of Tokio tasks. A ready queue drives pure transitions, yielding after at most 64 transitions per tick. Bounded supervised JoinSet futures perform external calls and return typed results; pure evaluation never performs network IO.
+
+Each frame holds state ID, entry generation, raw input, parent and phase: Entering, Calling, WaitingTimer, WaitingChildren, WaitingCallback or Completing. Timer entries carry generations. Reject stale timers/results before applying them. Completion, timeout, Stop and callback messages settle through the same owner exactly once. Results observed at or after the monotonic deadline cannot win a select race and become success.
+
+```text
+┌─ Supervisor ───────────────────────────────────────────────────────┐
+│ open-execution permits │ JoinSet │ panic monitor │ cancellation    │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ ExecutionActor: one mutable owner ────────────────────────────────┐
+│ ready frames → evaluate ≤64 transitions → history + read views    │
+│      ▲                  │                       │                  │
+│ timer heap         Task dispatch                ├─ terminal settle│
+│      └─ Wait/Retry       ▼ bounded external calls└─ cancellation    │
+│                         IntegrationPort                           │
+│ frames ◀────────── result(attempt,generation)                      │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+Pure loops are bounded by transition/history/total-duration limits and cannot starve Stop or health. Registry mailbox defaults to 256; per-execution control/completion lanes to 64 each, with an independent stop/watch lane. Acquire downstream admission before dispatch. Waiting for Lambda capacity must not hold a scheduler worker or downstream dispatch slot indefinitely.
+
+### 3.1 Sequential transition driver
+
+The execution owner uses a synchronous `ExecutionDriver` over one captured `Arc<CompiledMachine>`. It performs at most one state/attempt transition per `advance` call; the actor batches at most64 calls before yielding. The driver owns original state input, effective context, entry time, per-retrier counters, total retry count, generation and phase. It performs no IO, spawn, sleep, clock reads, registry mutation or implicit resource retries. This is the sequential frame implementation; adding it does not advertise the HTTP execution service before the supervisor, registry, history and real bridge are installed.
+
+Each call receives a paired wall/monotonic `ClockSample`. Reject regressing monotonic samples as an internal terminal failure; equal samples are valid. Derive the absolute execution deadline once from the minimum of configured positive duration (at most365 days) and machine TimeoutSeconds. Check it before processing a completion, a ready transition or Stop; at/after the deadline execution timeout wins. A settled outcome is immutable. Wall changes only affect the timestamp of a new entry and newly resolved absolute Wait sources. Already parked timers retain their original monotonic target.
+
+Phases are Ready, Calling, Waiting (Wait or Retry), and Terminal. Commands return Continue, Dispatch, Park or Settled plus an optional cancellation obligation. Dispatch contains a machine-local state ID, unique monotonically increasing AttemptId, evaluated parameters and absolute attempt deadline. It transfers no resource ownership: the supervisor must retain each accepted invocation until settlement, even after the driver returns a cancellation obligation or terminal outcome. Complete accepts only the current Calling ID; old/duplicate completions are inert. A Task deadline observed by advance/complete invalidates the ID, returns its cancellation obligation once, and enters normal Timeout recovery. Stop invalidates an active ID and bypasses all user recovery. A retry may dispatch only after the owner has processed the previous cancellation/cleanup obligation; the pure driver cannot certify cleanup.
+
+On entry, build `$$.State.Name`, EnteredTime (UTC RFC3339 nanoseconds), and RetryCount over the immutable base context supplied by the registry. Require an object base context; the later registry owns its Execution/StateMachine schema and scope. RetryCount starts at0, increments for every actual scheduled retry and does not reset when another retrier matches. Retries preserve EnteredTime and raw input; entering another state resets counters and captures a new entry time. Evaluate Parameters afresh on each dispatch. UUID evaluation uses the explicit fallible source; async owners run potentially blocking entropy/evaluation under retained bounded worker admission.
+
+Pass evaluates prepare, selects its optional static Result (otherwise prepared input), then finish against raw input. Choice evaluates predicates against prepared input in source order, applies OutputPath after selecting a target, and raises States.NoChoiceMatched without a matching rule/default. Wait resolves against prepared input, stores its finished output once, and parks until its monotonic target; a zero wait completes immediately. Succeed applies input/output transforms. Fail evaluates each present literal/expression field against raw input/context, requires strings within256/32,768 bytes, and preserves omitted fields. Task resolves TimeoutSecondsPath against raw state input (before Parameters), validates a positive integer≤99,999,999, prepares parameters, and parks for its external result. Omitted Task timeout is bounded by the execution/operator deadline under this local profile.
+
+Recovery scans the first matching retrier. An exhausted/zero-count matching retrier proceeds to Catch rather than falling through to a later retrier. Counts belong to each retrier for the current state visit. Compute exponential delay without unchecked duration conversion; saturate at the minimum configured cap and remaining execution duration before monotonic checked addition. FULL uses rejection sampling from an injected uniform64-bit source over the inclusive nanosecond range; bound rejection work to128 samples and fail internally if the source cannot provide an acceptable draw. A timer reaching the execution deadline cannot resume. Catch merges the bounded Error/Cause object into original input according to its compiled ResultPath, then enters the target. A failure in result processing follows Task recovery; Runtime is fatal and DataLimit requires explicit matching. Keep the typed AslError diagnostic separate from the static public failure cause. Every entered state/retry dispatch consumes the configured transition budget (1..1,000,000); before scheduling a retry, verify another dispatch is possible. Exhaustion fails immediately with Rustack.TransitionLimitExceeded rather than parking an impossible retry. Encoded payload byte/string/key limit failures map to States.DataLimitExceeded; bounded JSON syntax/depth/member failures remain Runtime. Encoding/allocation/entropy/invariant failures are Rustack.InternalError and bypass business recovery.
+
+The driver exposes state, input, retry count, current deadline and stable outcome for its owner. It does not persist AWS history or expose an SDK endpoint; the actor must journal the official events and atomically publish read views under the independent history budgets before claiming execution acceptance. Tests drive clocks and completions explicitly: all six states, raw/effective input, dynamic Fail fields, default/missing Choice, Wait wall jumps, per-entry retry state, capped/FULL backoff, first-match exhaustion, catch merges, exact Task/execution deadlines, stale/duplicate completions, stop/timeout single settlement, and transition-loop exhaustion.
+
+```text
+┌─ execution owner / retained invocation supervisor ─────────────────┐
+│ paired clocks + entropy + validated completion/stop                │
+│                    ▼                                              │
+│  ExecutionDriver: raw input + scoped IR + generation + phase       │
+│       Ready → Calling / Waiting → Ready → immutable Terminal      │
+│                    ▼                                              │
+│ Continue / Dispatch / Park / Settled + cancellation obligation     │
+│                    ▼                                              │
+│ owner: official history + timers + calls + cleanup + read views    │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+### 3.2 Supervised sequential runtime and history publication
+
+`ExecutionSupervisor` is owned by the future registry actor and contains the execution JoinSet, admission slots, dispatch/evaluation semaphores and quarantine records. Construction validates1..4,096 open executions,1..1,024 dispatches and1..128 evaluation workers; defaults128/32/8. Start accepts a fresh, unused compiled driver, reserves admission plus initial/terminal history capacity, registers a JoinSet job and returns a handle. Start requires an active Tokio runtime; invalid context returns a typed error rather than panicking. Dropping the handle never cancels accepted work. A lost control producer requests Shutdown instead of spinning on a permanently ready closed watch. Handles use independent watch lanes for first Stop and immutable Arc read views; no engine Mutex or per-request polling task is introduced. The supervisor must be reaped by its registry owner. Close rejects starts and signals Rustack.Shutdown; drain uses one absolute deadline and retains the same jobs/slots on timeout. Restart constructs a new accepting supervisor after the old instance is clean; it never replays uncertain business calls. Dropping a nonempty public supervisor transfers its bounded state to an explicitly detached fallback drain. That fallback has its own Drop guard: cancellation before first poll, panic, runtime shutdown or absence of a runtime retains unresolved slots/jobs/dispatch leases as process-lifetime quarantine, never as successful retirement. Normal joined drain releases the graph.
+
+One execution actor owns its driver, journal and current call. All CPU/entropy evaluation runs in a retained spawn_blocking JoinSet under the shared evaluation semaphore. Keep a cheap immutable pre-operation checkpoint (Arc payload/context/machine, bounded retry counters, shared typed diagnostic). Sample Task completion at the owning actor before queueing its pure result transformation; this observation must precede the Task deadline. After the worker returns, recheck Stop and the absolute execution deadline before accepting effects. Discard an unpublished proposal and settle from the checkpoint if control/overall timeout won during evaluation. A late prepared dispatch also cannot issue work. No late dispatch or terminal success can bypass this final check. A pending Stop overrides an unpublished proposal and prevents new calls. Synchronous admission returns use one paired observation sample for post-return control/deadline checking, history and completion. Ready processing checks control between operations and yields after at most64 operations. A CPU panic becomes Rustack.InternalError without replay; the outer supervisor handles actor panics, publishes failure using its retained terminal reserve and keeps the slot quarantined when resource settlement cannot be proven.
+
+LambdaTaskPort uses synchronous bounded admission returning a concrete channel-backed TaskCall immediately. The adapter's retained manager owns every accepted start future before returning. Core never starts an async admission future that can lose its eventual handle. An invocation sends Started at most once and one Completed result. The bounded event lane has capacity4. Clean completion confirms settlement; uncertain completion transfers its communication receipt into a QuarantinedTask that must stay beside the actual owned resource until joined cleanup calls settle. Call Drop requests cancellation only. Closed lanes never imply clean settlement. Core dynamically injects this synchronous object-safe trait without async-trait; async handle waits are concrete methods. This refines the logical start/handle contract in the integration design without changing the AWS API.
+
+A completed/invalidated call moves to a retained cleanup JoinSet, holding its dispatch permit until Clean. Explicit ASL recovery may proceed while earlier uncertain calls remain owned, sharing the same bounded dispatch budget; no hidden business retry is added. At terminal publication, cancel current/retired calls and continue joining cleanup independently of HTTP observers. The open-execution slot remains reserved until all owned work settles. Lost cleanup channels or actor failures remain quarantined with their admission/dispatch capacity; drain reports failure instead of publishing a successful consistency snapshot. A waiter timeout never aborts or replaces owned work. The adapter must retain actual handles and report cleanup truthfully; the core receipt alone cannot prove an external resource is gone.
+
+History is generated from official model DTOs and published together with outcome, stop timestamp and cleanup state in one immutable watch value. ExecutionStarted exists before Start succeeds and registry/API executions include the captured revision's roleArn. The first root state entry uses previousEventId0, independently recorded by the pinned upstream AWS snapshots. Later sequential causal predecessors use the last committed event ID. Enter/Exit and direct Lambda/optimized Task schedule/start/result/timeout events use official names; retries stay within one state visit. A missing/failed result selection follows the raw resource-success event; Stop/overall expiry never manufactures a successful state exit. Invalidated completions are omitted. M2 must extend causal frames rather than apply this linear predecessor rule to concurrent branches.
+
+Use an append-only persistent history view: immutable pages of at most64 Arc events, shared previous pages, and a copied bounded tail. A view never clones the full event vector or business trees on every append. Read pages validate start/limit (limit1..1,000), traverse at most25,000 records, preserve ascending IDs and can strip execution data without changing causality. The local data-disabled projection removes input/output fields and omits the optional parameter-bearing optimized TaskScheduled details object as a whole; it never fabricates replacement parameters. This conservative metadata difference is not a cloud differential claim. API pagination/high-water/4MiB page encoding remains registry/HTTP work. Snapshots retain charged event Arcs, so global accounting is released only after the last view is dropped. Bound event count to2..25,000 and per-execution charged bytes to1..256MiB; global capacity8MiB..4GiB, at least the per-execution cap. Charge bounded serialized event bytes plus fixed DTO/Arc overhead, before installing an event; include a4KiB terminal data allowance plus charged fixed DTO/page overhead held above worker lifetime. Ordinary events cannot consume that event/byte reserve. Oversized/exhausted ordinary or successful terminal history settles with the small reserved States.HistoryLimitExceeded failure. This is a local quota diagnostic. Internal event construction/encoding failures become Rustack.InternalError. Terminal history and read-view outcome always agree.
+
+Typed worker/evaluation sources remain in redacted internal read-view diagnostics; they are not copied into protocol errors. Debug of a history view reports bounded counters rather than traversing its full chain. Test-only blocking worker gates have a separate RAII release guard so failed assertions cannot strand the blocking pool.
+
+Tests must exercise actual asynchronous pure executions and channel-backed calls; caller loss, immediate completion/start races, Retry/Catch, timers, stop during calls/CPU admission, exact final-deadline checks, CPU/actor panic, dispatch/open saturation, retained cleanup/quarantine, repeated drain timeout and recovery, history limits/global accounting, stable old views, execution-data omission and25,000-event drop. These core tests do not advertise main-service readiness or replace real Lambda bridge/SDK acceptance.
+
+```text
+┌─ registry-owned ExecutionSupervisor ─────────────────────────────────┐
+│ JoinSet + admission slots + global history reserve + quarantine      │
+│   ┌─ execution actor ─────────────────────────────────────────────┐  │
+│   │ Stop watch → driver proposals → final clock/control check     │  │
+│   │        bounded retained CPU workers                          │  │
+│   │ journal → immutable history/outcome watch → API read handles  │  │
+│   │ Dispatch → TaskPort → current call → retired cleanup JoinSet  │  │
+│   └───────────────────────────────────────────┬───────────────────┘  │
+│ terminal visible; slot/dispatch capacity held └→ Clean / quarantine  │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+### 3.3 Deterministic structured frame-effect protocol
+
+The frame interpreter emits effects; it does not spawn children or own Lambda calls. `ExecutionDriver::for_structured_owner` explicitly enables typed Parallel/Map effects for an owner that implements this protocol. `new` remains sequential and the current supervisor rejects any structured artifact, including a driver produced by the explicit constructor. This prevents an IR-only rollout from accepting incomplete service executions. No definitions are re-parsed during execution.
+
+On Parallel/Map entry, process InputPath and the normalized Parameters stage once, then prepare an immutable `FanoutPlan`. The plan captures the machine-local state, fresh round AttemptId, original absolute execution deadline, effective input, current state context and child base context. Parallel child descriptors share the effective input and preserve branch-definition indices. Map resolves ItemsPath to an array, bounds it to10,000 items and the256KiB payload contract, then resolves MaxConcurrencyPath against the effective input. The selected local dynamic range is integer0–40, with0 normalized to40; reject missing/null/wrong-type/fraction/negative/over-limit values as States.Runtime, including for empty arrays. Static limits are already normalized by compilation. The local Inline profile remains array-only, even if broader AWS language documentation adds object iteration.
+
+Map child inputs are prepared lazily by index. Without a selector, pass that exact array element, including JSON null. With ItemSelector/legacy Parameters, evaluate against the effective Map input, adding Map.Item.Index, Value and Source=STATE_DATA only to the selector's context. The selector observes the enclosing Map state's State.Name/RetryCount. Its resulting payload becomes the processor's raw input. Child base context shares Execution/StateMachine metadata but removes Map; inner states cannot implicitly read Map.Item. All descriptors and plans redact Debug output. Generating a descriptor can acquire UUID entropy and must run under bounded CPU ownership. A retained plan captures its round context; retries produce fresh plans and re-evaluate selection with the updated RetryCount.
+
+The owner honors the plan's maximum concurrency and shared frame budgets, admits children lazily, and records each descriptor's index independently of completion order. `FanoutPlan::collect` accepts exactly one indexed output per descriptor, rejects missing/duplicate/out-of-range indices, and encodes the ordered output array through the bounded writer before allocating a result tree. The owner must also bound cumulatively retained result bytes while outputs arrive; collect-time validation alone is not a retention budget. An empty Map joins `[]` immediately without allocating child frames, while still applying ResultSelector→ResultPath→OutputPath. Both instructions merge into the state's original raw input.
+
+The driver parks in JoiningChildren for a nonempty plan. Task completion cannot settle a round, and round completion cannot settle a Lambda attempt. Round completions carry the captured AttemptId: stale/duplicate/cross-kind results are inert. A successful join must be an array with the captured cardinality; invalid owner output is Rustack.InternalError. The owner reports either a bounded branch failure or a typed selector/aggregation failure after stopping admission, cancelling and joining siblings. Branch failures use the same ordered Retry/Catch policy as Task. For an omitted branch Fail Error, match policies using States.TaskFailed while retaining omission if no policy handles it. States.Runtime bypasses policies; explicit DataLimitExceeded remains recoverable. Preserve diagnostic sources for typed failures. A retry starts the complete round again from original raw input with a fresh attempt and new item descriptors; it never resets the root deadline. At/after that deadline, timeout wins over round completion. Stop invalidates a pending round and returns its cancellation obligation; repeated Stop, stale completion and later ticks cannot resurrect it.
+
+```text
+┌─ one frame interpreter ──────────────────────────────────────────┐
+│ Ready → prepare Parallel/Map → FanOut(plan, attempt, deadline)   │
+│                         │                 ▼                     │
+│                    JoiningChildren ← owner: lazy indexed frames │
+│                         │                 │                     │
+│  retry ← ordered recovery ← failure + sibling cleanup joined    │
+│                         │                                       │
+│  next/end ← raw-input result pipeline ← ordered bounded outputs │
+│ Stop/deadline → invalidate round → owner retains cancellation    │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+This protocol is the interpreter dependency of P3 scheduling, not proof of concurrent actor/history or actual child-Lambda execution. The frame owner must share the root transition budget and exact deadline across descriptors, hold frame/resource ownership until cleanup is known, and commit history causally before publishing execution views. Child construction must install the captured absolute deadline exactly, including when less than one second remains; calling the root constructor again with a duration is insufficient. Preserve the terminal failure origin separately from retained historical diagnostics: a diagnostic may refer to an earlier handled error. Propagate an actual child interpreter/internal terminal error through typed Evaluation, never flatten it into a business Branch failure that could trigger States.ALL replay. Its admission gate is removed only with the complete bounded owner and P01–P03 lifecycle verification.
+
+### 3.4 Bounded frame scheduler and retirement protocol
+
+`FrameScheduler` is the single mutable, synchronous frame-tree owner between the frame interpreter and the asynchronous resource actor. It performs no IO, spawning, sleeping or clock reads. All potentially entropy-bearing steps run under retained bounded CPU admission. Its public updates are Transition, ChildStarted, ChildFinished, Cancel, Park, Yield and Settled; transitions retain the lexical machine, state, raw entry/output exit and parent linkage needed by the history actor. FrameIds are monotonically allocated and never reused, including across retries. A call identity combines FrameId and AttemptId; result/retirement messages cannot affect a sibling or a later generation. Default supervisor/API admission stays gated until resource calls and concurrent causal history consume these updates.
+
+One root transition counter and exact absolute deadline apply to every frame. A child is initialized directly with the captured deadline, even with less than one second remaining. Polling/timers do not replenish or consume entry transitions. All advances/completions first observe root control; at/after deadline, timeout wins. Root Stop settles one business outcome, invalidates work and emits cancellation for every outstanding call. Business outcome and cleanup readiness are separate: root terminal publication may precede retirement, while retained calls/frames remain charged. Late/duplicate completions and retirements are inert; an acknowledgement for an active, unretired call is an explicit protocol error.
+
+Frames are admitted lazily, with each newly admitted child queued before more siblings; this seeds nested work before filling breadth. Ready ownership is deduplicated and each public advance performs at most one interpreter/admission/notification action, scanning at most64 ready candidates before Yield. Map concurrency counts business-active iterations. A blocked capacity acquisition never owns a CPU worker while waiting for IO. Global frame capacity defaults4,096 and per-execution512, validated1..4,096/1..512. Parent/child frame permits remain held until terminal notification emission, descendant retirement and call retirement. A queued notification is still owned internally: distinguish Waiting/Queued/Emitted and retain its frame/slot until it is emitted, including a successful sibling cancelled before normal notification. Capacity-blocked work parks only while another local call/timer/retirement can make progress; a tree consisting solely of joins waiting for additional frame slots fails Rustack.FrameLimitExceeded rather than deadlocking. Global capacity may be rejected under this local fail-fast policy; a capacity notification allows the resource actor to retry admission when other executions release slots.
+
+A completed Task result immediately queues its retirement cancellation; Task retry may progress while its earlier call remains owned, subject to the bounded outstanding-call ceiling1,024 per execution and downstream dispatch limits. A child success is notified once and inserted by definition/item index, even while its resource retirement remains pending. Such terminal frames continue holding capacity. A child failure pins the first enclosing-round failure, stops admission, discards aggregate slots, cancels the round's complete descendant tree and waits until every child slot from that round is retired before applying enclosing Retry/Catch. A retry allocates fresh frame/call identities; stale results cannot enter it. Cancellation of a nested join recursively invalidates its descendants; no business retry runs for cancelled frames.
+
+Ordered aggregate semantic bytes include brackets, commas and compact JSON values, with the256KiB payload ceiling enforced as each output arrives. Aggregate-slot resource weight additionally charges original payload bytes, compact encoded bytes and128 bytes per slot. Charge both per-execution and global byte semaphores before retaining a slot; release both on round completion/failure. Defaults32MiB per execution and256MiB globally, validated4KiB..128MiB/4KiB..1GiB, additionally bounded by the host semaphore maximum. These are aggregate-slot charges, not a claim about the complete JSON heap; frame payloads remain independently bounded by frame/payload ceilings. Global/local slot exhaustion fails Rustack.ResultLimitExceeded without business retry. Register a capacity notification before checking availability and return permits before waking waiters; see [Tokio Notify](https://docs.rs/tokio/latest/tokio/sync/struct.Notify.html). The eventual YAML composition must expose these tunable ceilings. Root/child open-execution admission and Lambda dispatch budgets remain independent.
+
+Terminal failures carry private origin metadata: Business, typed Evaluation source, or non-recoverable Safety. Store this origin with the actual failure, not in the historical diagnostic field. Catching an evaluation error and later entering a business Fail state must leave the terminal failure Business even though diagnostics retain the earlier error. Conversion to FanoutFailure preserves the child's original error/cause classification alongside its typed evaluation source, and preserves non-recoverable safety failures across arbitrarily nested rounds. A recovery-source WorkLimit already classified as Rustack.InternalError/Task recovery failed must not become States.Runtime through reclassification in the parent. No child internal error or transition/frame/result quota can become States.ALL business replay. Error/cause omission and UTF-8 fields remain unchanged on the wire.
+
+```text
+┌─ FrameScheduler (one root budget + deadline) ────────────────────┐
+│ ready queue → one frame transition → typed history descriptor   │
+│      │            │                                            │
+│      │            └─ Task(frame,attempt) → resource actor        │
+│      └─ lazy child frame → indexed result slots                 │
+│ failed round → cancel descendants → await retirement → recovery │
+│ root terminal ≠ cleanup ready; retained frames/calls stay owned  │
+└─────────┬─────────────────────────────────────────┬──────────────┘
+          ▼ global/local frame permits              ▼ byte permits
+     FrameCapacity / FrameLimits              aggregate result slots
+```
+
+Acceptance requires deterministic explicit-clock traversal of nested Map/Parallel and Task effects, out-of-order results, lazy concurrency and shared quotas, exact subsecond inherited deadlines, sibling failure gated by call retirement before retry, stale IDs, root Stop/deadline draining, capacity deadlock rejection and result-retention exhaustion. These scheduler tests are necessary P3 ownership evidence, not actual asynchronous Lambda/history/API or M2 completion. The existing real actor remains gated until its effects, panic retention and causal journal are integrated and independently verified.
+
+### 3.5 Asynchronous structured resource owner and commit fence
+
+Install an explicit `ExecutionSupervisor::start_structured` composition for the frame scheduler; library defaults remain sequential, while the service selects the qualified registry profile through §3.6. Both sequential and structured executions charge the shared frame pool, including roots. `new_with_frames` accepts validated global/local budgets for explicit composition; default construction uses the documented defaults. The structured actor uniquely owns the scheduler, a bounded resource-event lane, pending dispatches, resource watchers, CPU joins, causal journal and independently retained dispatch/frame leases. A watcher exists only for an accepted external call, bounded by dispatch admission; never spawn a Tokio task per Map item or pure frame. The scheduler remains the single owner of frame business state.
+
+Each CPU operation moves the scheduler into one retained blocking worker with an owned CPU permit. There is no scheduler clone and no mutex. The asynchronous actor retains root control/deadline, published state and all accepted-resource controls above that worker. Updates are speculative until a fresh control/deadline check after the worker returns. Stop/overall timeout can publish terminal history and cancel accepted calls while the CPU worker is still pending. Discard its uncommitted transition; when it returns, a private commit-fence control operation supersedes that speculative scheduler outcome and drains its bookkeeping. No discarded dispatch may reach the task port. A speculative call with no issued resource is cancelled/acknowledged locally. A child that never committed ChildStarted cannot generate an orphan history notification. Once the root outcome passes this fresh commit fence, retain it through synchronous terminal bookkeeping so a later Stop cannot overwrite the committed business outcome between state exit and terminal publication.
+
+Frame slots use immutable Arc lineage leases. Each child lease retains its parent lease; accepted calls publish their dispatch permit plus frame lineage in the supervisor's retained ledger before calling a task port that could panic. The supervisor also retains the root frame lease. Worker/actor panic or observer cancellation cannot return a capacity slot while its accepted call or descendant remains uncertain. Known-clean watcher retirement releases dispatch capacity only after its result/cancellation bookkeeping has reached the scheduler; unknown settlement retains the OwnedCall and ledger lease. TaskCall remains owned inside a joined watcher, and its cancellation control is independently available to the actor. Started/Completed event ordering and success-before-Started validation match the sequential adapter. Bounded sends are cancellation-aware so a full event lane cannot prevent cleanup.
+
+Pending dispatch waits do not hold CPU permits or downstream dispatch permits. Before actual port admission, re-check root control and the Task deadline. A timeout while queued emits the scheduled/timeout lifecycle without invoking Lambda. Per-call events use FrameCallId, so equal interpreter AttemptIds in concurrent branches remain independent. Completion may precede known-clean watcher join or vice versa; retain metadata until both are reconciled. A clean join cannot discard an unread result. Observe each pending Task expiry once, exclude that consumed deadline from future timer selection, and clear obsolete park timers when scheduling CPU work; an already expired timer must not starve a ready worker join. CPU admission waits still observe Task expiry and cancel accepted IO. Fence late Started/admission errors with the actual Task deadline before writing history. Cancelling Stop/drain observers never aborts accepted resource or CPU tasks; joins remain resumable. Terminal outcome and cleanup status remain independent, and uncertain graphs stay supervisor-owned.
+
+The causal journal accepts a validated predecessor0..current high water while preserving strictly increasing event IDs and all existing byte/terminal-reservation accounting. Sequential per-frame events chain through that frame's cursor. Forked Parallel branch entry points to its enclosing round-start event. A Map iteration start adds index/name metadata before the processor's first state; its predecessor is the latest completed processor terminal within this round, or the round-start event until a processor completes. Iteration completion chains from its last committed child state/resource event. A successful join publishes the round-success marker and state exit with the same predecessor: the last observed child completion (including MapIterationSucceeded). The success marker advances the frame cursor; a successful state exit overrides only its own predecessor with the captured join predecessor. If result processing fails and there is no exit, retain the success marker as the terminal predecessor (local policy; the selected upstream success snapshots do not establish this error-after-success linkage). A failed round that will retry publishes no MapStateFailed/ParallelStateFailed; the next round start chains from the last child completion. A failure that exhausts recovery or transfers through Catch publishes the failure marker and advances the frame cursor. Retry emits a new round start; failure/cancellation never rewrites earlier links. Root termination chains through the root cursor. Reverse/data-disabled projections preserve these links. This is the selected local causal profile, not a claim of undocumented AWS concurrent ordering parity. Use official Map/Parallel/iteration DTO shapes; every invalid predecessor fails before append mutation.
+
+Frame transition metadata explicitly identifies fanout preparation/start and publishable round success/failure after retry selection, including empty Map, so history never guesses success from a Catch continuation. Cancellation notifications retire descendant cursors before their parents. Forced control appends active committed-state aborts and Map iteration aborts before root terminal publication, never aborts an already exited state, and ignores uncommitted work; no events append after root terminal. Real actor acceptance requires overlapping task starts, reordered completion, cleanup-gated sibling recovery, dispatch saturation, Stop/deadline during gated CPU work, panic-retained frame lineage, history quotas and causal reverse projection. Actual Native overlap evidence requires two distinct consumed-event PID/request-ID markers, atomically published after full Runtime API body receipt immediately before a shared release gate; bridge admission counts and process startup alone are insufficient. Release and join cleanup before inspecting assertions. Service SDK acceptance remains required before enabling the real API profile. Nested workflow integration remains a separate P3 requirement.
+
+```text
+┌─ supervisor slot (outlives actor/CPU observation) ────────────────┐
+│ open permit + root frame lease + published dispatch/frame ledger│
+│  ┌─ structured actor ─────────────────────────────────────────┐ │
+│  │ scheduler ⇄ retained CPU worker → fresh control commit fence│ │
+│  │ causal journal → history/outcome watch                      │ │
+│  │ pending dispatch → admitted watcher → result + clean join   │ │
+│  │ Stop/deadline → publish terminal + cancel retained controls  │ │
+│  └────────────────────────────────────────────────────────────┘ │
+│ panic/uncertain join → retained leases; known-clean → release    │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### 3.6 Structured service composition and capability binding
+
+The executable service selects `StateSupport::Structured` on its registry, through `Registry::new_with_state_support`; the existing `Registry::new` keeps the Sequential library profile. A registry exposes its immutable `state_support()` to the API preparation owner. Create, Update and Validate use the same compiler profile as execution admission; clients cannot opt into a different profile in a request. Registry Create/Update reject structured artifacts under Sequential before publishing resources, and still reject nested-scope artifact promotion in both profiles. Captured root revisions retain the selected semantics through update/delete. Choose the structured driver/supervisor only for a machine requiring it; ordinary sequential machines retain their established history protocol. Start, record/name publication and rollback remain one non-awaiting transaction.
+
+Main composes validated global/local frame and intermediate-result budgets into `ExecutionSupervisor::new_with_frames`. Root executions count against the same frame pool as descendants. Capacity rejection preserves the existing modeled admission error and does not claim names or create records. The installed API reports eight state types, Inline Map concurrency at most40, and effective frame/result ceilings; nested jobs, callbacks, JSONata and workflow snapshots remain unavailable until their own acceptance passes. No implicit Lambda executor or Docker readiness change is introduced.
+
+Service acceptance requires full/minimal feature composition, validated YAML exact bounds and relationships, actual API Create/Update/Validate/Start for structured definitions, unsupported Distributed Map rejection, independent deterministic structured cases through both ordinary SDKs, real Lambda fanout with indexed results, consumed-event gated parallel overlap, causal forward/reverse/data-disabled history, Stop of active nested tasks and known PID retirement. Existing M1 SDK semantics and cleanup gates remain mandatory. Only these consuming-service gates remove the default API admission restriction; nested `.sync` remains a separate P3 requirement.
+
+```text
+validated frame/result YAML ─► shared frame capacity + local limits
+                                        │
+registry immutable Structured profile ──► execution supervisor
+          │ captured root revision       │ requires fanout?
+          ├─► API compiler               ├─ no: sequential owner
+          │ Create/Update/Validate       └─ yes: structured owner
+          └─► Start + atomic record/name ───────► real Lambda port
+capabilities ◄─ installed profile + effective quotas + actual port
+```
+
+## 4. Retry, Catch and deadlines
+
+Retry applies to Task/Parallel/Map. Scan retriers in order and use the first matching one. Maintain retry counts per retrier within a state entry. MaxAttempts counts retries after the first failure; zero disables retries. Defaults: IntervalSeconds=1, MaxAttempts=3, BackoffRate=2.0, JitterStrategy=NONE. Retry k waits `min(IntervalSeconds × BackoffRate^(k-1), MaxDelaySeconds)`; FULL samples uniformly between zero and that delay. Use checked/saturating arithmetic and the remaining overall deadline.
+
+Validate IntervalSeconds in 1..99,999,999, MaxAttempts in 0..99,999,999, finite BackoffRate≥1, MaxDelaySeconds in 1..31,622,400, and NONE/FULL jitter. Effective work remains bounded by local transition/history budgets. States.ALL is the sole entry of the last matcher. States.TaskFailed matches task failures except States.Timeout, subject to uncatchable-error rules.
+
+Only after retries exhaust does Catch scan in order. Without a match, propagate to the parent frame or terminate root execution. Retry starts from the original state input and reevaluates Parameters with updated RetryCount; it does not consume the failed output. Generate fresh attempt, Lambda request ID and callback token. External side effects may repeat. See [AWS error handling](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-error-handling.html).
+
+| Condition | Behavior |
+|---|---|
+| Task TimeoutSeconds/Path | Cancel resource, raise States.Timeout; Task Retry/Catch may handle it; reset per attempt |
+| Machine TimeoutSeconds, Standard one-year ceiling or operator deadline | Execution TIMED_OUT; internal Catch cannot resume it |
+| Callback heartbeat expiry | States.HeartbeatTimeout; starting point defined by callback integration |
+| Lambda's own timeout | Preserve Sandbox.Timedout or the runtime-specific Lambda error |
+| States.Runtime: unevaluable paths/types/expressions | Fatal, no Retry/Catch |
+| States.DataLimitExceeded | Not matched by States.ALL; explicit matching may Retry/Catch it |
+| Stop or parent cancellation | Abort/cancel; bypass user Retry/Catch |
+| Actor panic or invariant failure | Supervised Rustack.InternalError, no automatic business replay |
+
+Explicit DataLimitExceeded handling follows current AWS documentation rather than older claims that it is always uncatchable. Keep failure data bounded; repeated oversized transformations fail again. Runtime diagnostics retain Path/Intrinsic/ResultPath categories without embedding inputs. P0 pins precise boundary errors and history details for the profile.
+
+Task deadline failures retain error States.Timeout and omit Cause in both Task/Lambda timed-out history details and the final task failure/Catch object. Overall execution expiry is the typed TimedOut outcome; DescribeExecution omits optional error/cause rather than manufacturing a task error. Its ExecutionTimedOut details likewise omit optional error/cause. This matches the pinned task-timeout observations; redrive metadata remains unsupported and excluded by the upstream timeout class markers, so no redrive coverage is established.
+
+## 5. Parallel and Inline Map
+
+Parallel starts each branch with the same effective input and orders results by branch definition. Map selects an array via ItemsPath, applies ItemSelector and orders outputs by item index, never completion order. Empty Map returns `[]`. Normalize Iterator/ItemProcessor and legacy Parameters/ItemSelector once in the compiler.
+
+Map MaxConcurrency=0 or omission selects the Inline limit of 40, further constrained by local task/frame budgets. Lower operational concurrency changes scheduling but not result order. MaxConcurrencyPath must resolve to a nonnegative integer. Static values above 40 are rejected by the local profile. Bound items to 10,000 and input to 256 KiB; active frames to 4,096 globally and 512 per execution. Create iterations lazily, not one spawn per item. Nested Map/Parallel share all budgets.
+
+An uncaught branch/iteration failure stops new work, cancels and joins in-flight siblings, then settles the enclosing state. External side effects are not rolled back. Parallel/Map Retry repeats all branches/items, not just failed ones. Invalidate old generations/tokens before the next round; do not reset the execution deadline. All branch events belong to the root execution's history sequence with correct causal links.
+
+## 6. Lifecycle and Rust engineering contract
+
+Start transfers ownership to the supervisor, independent of its HTTP request. Stop marks cancellation, invalidates attempts, cleans up resources and commits the terminal state. Quarantined external resources remain supervisor-owned and visible in diagnostics. Restarting a supervisor restores its ability to accept work; it never silently replays an uncertain invocation or restarts a failed execution.
+
+Apply AGENTS.md: thiserror/source errors; bounded actor messages and JoinSet; no Mutex-wrapped engine; non-exhaustive public DTOs and exhaustive internal state enums; forbidden unsafe/external panics and checked budgets; immediate serde validation; rstest/proptest/paused-time race tests; tracing skips payloads; Arc/Bytes and compiled IR avoid repeated parsing. Public compiler/runtime APIs provide examples and Errors sections. Configuration is centralized in the operations design, not embedded test shortcuts.
+
+## 7. Cross-references
+
+- ← [API/data model](./rustack-workflows-10-api-design.md)
+- → [integrations](./rustack-workflows-40-integrations-design.md), [verification](./rustack-workflows-70-verification-plan.md)
+- ↔ [operations](./rustack-workflows-60-operations-design.md), [decisions](./rustack-workflows-99-decisions.md)
diff --git a/specs/rustack-workflows-40-integrations-design.md b/specs/rustack-workflows-40-integrations-design.md
new file mode 100644
index 00000000..1b58ff47
--- /dev/null
+++ b/specs/rustack-workflows-40-integrations-design.md
@@ -0,0 +1,438 @@
+# Workflows 40: Lambda Tasks, Nested `.sync` and Callbacks
+
+Status: implementation contract · Depends on: [API](./rustack-workflows-10-api-design.md), [Lambda runtime](./rustack-workflows-20-lambda-runtime-design.md), [ASL](./rustack-workflows-30-asl-design.md)
+
+## 1. Internal ports and dependency direction
+
+stepfunctions-core defines an object-safe LambdaTaskPort, a concrete channel-based ChildExecutionPort, and callback commands. The binary's `apps/rustack/src/stepfunctions_bridge.rs` injects a Lambda provider adapter. Core does not depend on lambda-core, an AWS SDK, HTTP loopback calls or Docker. Child execution uses a registry handle, avoiding a strong Arc cycle back to its own provider.
+
+LambdaTaskPort logically exposes `start(validated command, deadline) → InvocationHandle`, with completion and `cancel_and_wait(deadline)`. The concrete channel-backed implementation uses synchronous bounded admission: the adapter retains the start future before returning TaskCall. The trait is object-safe without async-trait; concrete handle methods await results/cleanup. See [ASL§3.2](./rustack-workflows-30-asl-design.md#32-supervised-sequential-runtime-and-history-publication). ChildExecutionPort submits scoped Start/Subscribe/Cancel messages with parent references. Pure Pass workflows work without Lambda; compiling a Lambda integration without an installed adapter produces a dependency-disabled diagnostic.
+
+Add a shared internal invocation-handle API to Lambda provider; HTTP Invoke delegates to it without changing wire behavior. Dropping the old response future cannot prove Docker cleanup. RAII may signal cancellation, but a supervisor must await cleanup; Drop cannot pretend to finish asynchronous IO.
+
+```text
+┌─ stepfunctions-core ───────────────────────────────────────────────┐
+│ ExecutionActor → TaskAdapter enum                                 │
+│    │              ├─ LambdaTaskPort (dyn) ───────────────────┐     │
+│    │              ├─ ChildExecutionPort → registry actor     │     │
+│    │              └─ CallbackRegistry: token + generation    │     │
+│    └─ cancellation / generation validation                   │     │
+└──────────────────────────────────────────────────────────────┼─────┘
+┌─ binary composition root ────────────────────────────────────▼─────┐
+│ StepFunctionsLambdaBridge → Lambda provider.start_invocation_owned│
+│                            version resolution + same admission   │
+└───────────────────────────────────────────────┬───────────────────┘
+                                      Executor → actual runtime
+```
+
+### 1.1 Owned admission receipts and the binary Lambda bridge
+
+Add `InvocationSubmission` to the shared Lambda API. `start_invocation_owned(reference, qualifier, payload, deadline, cancellation)` validates/resolves/captures a revision, then synchronously queues owned work and returns the submission before waiting for execution admission. An error before this return means no function call was queued. The submission retains its InvocationHandle independently of the admission result: `admitted(&mut self)` is cancellation-safe and `into_handle(self)` transfers the cleanup receipt even after admission rejection/expiry. Existing start_invocation/HTTP paths await admission through this receipt and retain their wire semantics. Dropping their old waiter still requests cancellation while the existing work supervisor owns cleanup.
+
+InvocationHandle adds borrowed `wait_response`, `wait_cleanup` and `wait_settlement(deadline)` methods. The unbounded cleanup observer waits only on the retained supervisor state, not on IO; the bridge bounds its first observation and resumes the same handle after observer expiry. Consuming a response does not consume cleanup ownership. A second response read returns a typed error rather than repolling a completed oneshot. Settlement waiters can expire/be dropped and resume the same handle; Pending, Uncertain or closed channels never imply Clean. Retain the existing consuming wait/cancel_and_wait conveniences. Optional external cancellation is validated before/after artifact capture, before queueing and by InvocationContext before allocation/during execution. A bridge relay combines Step Functions cancellation and bridge shutdown; it stays alive through physical settlement. The bridge retains a pending start future until it returns a receipt or a prequeue error, even when its ASL caller has stopped.
+
+`apps/rustack/src/stepfunctions_bridge.rs` implements LambdaTaskPort in a feature-gated public binary-support library. This is reusable composition code, not main-service registration. Construction requires an active Tokio runtime and an actual injected provider/scope. It returns an Arc port plus a supervisor controller. Synchronous start checks scope/deadline/accepting state, reserves bounded accepted-work capacity and queues before returning TaskCall. Defaults128 accepted calls, cleanup wait10s; validate1..1,024 and1..60s. The manager owns submissions, invocation worker JoinSet and per-call admission slots above worker lifetime. Never invoke Noop/echo as a production fallback. Construction rejects a disabled backend and mismatched provider partition/region/account; the main composition root installs it only for an explicitly selected real backend.
+
+The controller's shutdown uses one absolute deadline and retains the same manager JoinHandle after timeout or waiter cancellation. It stops admission and signals active workers before the Lambda provider itself quiesces. A worker panic retains its root slot and publishes no clean completion. Expired cleanup observation quarantines the business result while retaining the actual Lambda handle, QuarantinedTask receipt and admission slot. Resume the same cleanup observer: eventual Clean settles only the receipt, without publishing a second business result; terminal Uncertain/closed retains the unresolved graph. Drop transfers/drains ownership independently of public handles; an abort/runtime-loss guard preserves unresolved state as process-lifetime quarantine. Normal clean shutdown releases all reservations. Raw requests/responses, payloads, host errors and credentials never appear in Debug/logs; typed sources remain in redacted internal diagnostics.
+
+At each attempt, decode direct Resource or optimized prepared Parameters, then call the same provider's owned API. Revalidate optimized object fields, FunctionName string≤256 bytes, optional Qualifier1..128 bytes and RequestResponse-only InvocationType after template evaluation. The bridge accepts only a plain function name or complete same-scope ARN; reject partial ARNs and name:qualifier forms after dynamic evaluation as well as static compilation. Let the provider's ordinary resolver validate name/ARN/qualifier existence/conflicts and capture the revision. Ordinary Lambda Invoke retains supported same-account partial ARNs but rejects mismatched partial-ARN accounts before local resolution. Omitted or null optimized Payload uses `{}`. A string Payload contains serialized JSON: validate and preserve those JSON bytes rather than JSON-encoding the string a second time. Other scalar/array/object values are compact-serialized. This corrects the earlier local convention against the original AWS snapshots; callers needing a JSON string event supply its serialized JSON spelling. Direct Lambda payloads retain their JSON type. Invalid serialized JSON fails explicitly before invoking a function. No alias/revision pinning across retries and no adapter-added business retries.
+
+Direct Lambda reports Started once on provider admission success. Optimized Lambda reports TaskStarted after validated integration admission into the bridge, before calling the provider; an absent function is a TaskFailed service-call result, not a TaskStartFailed. Callback invocation-start reporting retains provider-admission semantics. Read response while retaining the Lambda handle; signal cancellation on ASL/manager stop and join settlement independently of the attempt deadline. Map business response under bounded retained CPU work. Direct success is the parsed JSON itself; optimized success is Payload, StatusCode=200, ExecutedVersion, SdkHttpMetadata.HttpStatusCode=200 and SdkResponseMetadata.RequestId from the actual admitted Lambda UUID. Do not synthesize cloud trace headers. Enforce256KiB on raw JSON and final envelope; quota failures are States.DataLimitExceeded, invalid JSON/UTF-8 or evaluated parameter shape are States.Runtime. Non200 executor responses are Lambda.ServiceException.
+
+FunctionError alone selects the failure path; ordinary success keys named error/FunctionError/statusCode are business data. Parse a bounded errorType; empty/control-containing/over256-byte/reserved States.* values become Lambda.Unknown. Cause is compact error JSON preserving the decoded values, capped at32,768 bytes on a UTF-8 boundary with an explicit truncation marker. Serialize through a writer retaining only the bounded prefix while consuming the remaining bounded Value; decimal expansion must not reapply the ASL materialized-payload limit or replace the original error type. No expanded full-size buffer is retained; malformed error output uses a static safe cause. Runtime timeouts map Sandbox.Timedout, entrypoint/init failures Runtime.InvalidEntrypoint, runtime exits Runtime.ExitError, and known service exceptions Lambda.<code>. Missing function/version/alias causes follow design61 §7 using validated caller target/scope and a fresh local integration request UUID. Unknown/IO/uncertain errors map Lambda.ServiceException with static public causes and retained internal sources. Core owns ASL States.Timeout and rejects late results. Only confirmed settlement calls TaskResponder.finish; an uncertain result uses quarantine and remains charged.
+
+Qualify direct/optimized actual Native bootstrap execution, dynamic parameter rejection, FunctionError/Catch, retries, version/alias re-resolution, cancellation/timeout, function-owned Sandbox.Timedout and distinct metadata IDs before returning to image work. Cancellation/ASL-timeout fixtures must first observe a handler-written PID/request-ID marker after Runtime API event consumption, then assert that PID is absent after joined cleanup; Started alone proves admission, not handler execution. Controlled provider/executor fixtures separately exercise admission/cleanup races; they do not replace actual process execution. The registered main service and ordinary Rust SDK/boto3 qualification now exercise this actual Native path; final real-image/platform and later integration acceptance remain required.
+
+```text
+┌─ Step Functions actor ──────────────────────────────────────────────┐
+│ TaskCall ← synchronous bounded port.start(command)                  │
+└────────────────────────────┬───────────────────────────────────────┘
+                             ▼ manager owns queue / root slots / jobs
+┌─ binary Lambda bridge worker ───────────────────────────────────────┐
+│ retained start future → InvocationSubmission → admitted → Started  │
+│                    │                 │                             │
+│ cancellation relay └→ InvocationHandle.wait_response                │
+│                         ↓ bounded result mapping                   │
+│ retained handle.wait_settlement → Clean / owned quarantine         │
+│                   TaskResponder.finish / QuarantinedTask            │
+└────────────────────────────┬───────────────────────────────────────┘
+                             ▼ same provider resolution and quotas
+                 actual Native / Squib / ready Docker executor
+```
+
+## 2. Integration allowlist
+
+| Resource | Pattern | Milestone | Successful Task result |
+|---|---|---|---|
+| `arn:<partition>:lambda:<region>:<account>:function:<name>[:qualifier]` | Direct Lambda RequestResponse | M1 | Function JSON payload itself |
+| `arn:<partition>:states:::lambda:invoke` | Optimized RequestResponse | M1 | AWS envelope with Payload/StatusCode/ExecutedVersion/metadata |
+| `...:states:::states:startExecution` | Await child start acceptance | M2 | ExecutionArn, StartDate; no wait for child termination |
+| `...:states:::states:startExecution.sync` | Job wait | M2 | Child execution envelope; Output is a JSON string |
+| `...:states:::states:startExecution.sync:2` | Job wait | M2 | Same envelope; Output is a JSON value |
+| `...:states:::lambda:invoke.waitForTaskToken` | Callback | M3 | SendTaskSuccess JSON output |
+
+Partition must match scope; initially region/account must also match. Reject `lambda:invoke.sync`, `aws-sdk:*`, other services' `.sync`, and direct-Lambda callback at validation. Match the entire service/action/pattern allowlist, never arbitrary resources ending in `.sync`. [AWS integration patterns](https://docs.aws.amazon.com/step-functions/latest/dg/integrate-optimized.html).
+
+## 3. Lambda RequestResponse
+
+Direct ARN passes Parameters, if supplied, otherwise effective input, as the function event; the result is the function payload. Optimized Parameters supports FunctionName, Payload, Qualifier and InvocationType. Omitted/RequestResponse is supported; Event/DryRun is rejected in this release to avoid confusing acceptance with function completion. FunctionName may be a supported name or ARN. Reject conflicting explicit and embedded qualifiers rather than silently choosing one. Dynamic values use the same Lambda resolver after evaluation.
+
+Resolve aliases/latest at each attempt's invocation time and capture that Lambda revision for the call. Machine revision capture does not freeze all future Lambda aliases. Projects needing fixed code across retries use published version ARNs. Retry resolves alias/latest again; Rustack must not invent execution-wide alias pinning.
+
+Optimized success contains parsed JSON Payload, StatusCode=200, ExecutedVersion, SdkHttpMetadata.HttpStatusCode and SdkResponseMetadata.RequestId. Only include meaningful bounded metadata; do not invent cloud tracing capabilities. Never JSON-encode Payload twice. Raw Lambda Invoke supports arbitrary Bytes, but ASL requires JSON: invalid UTF-8/JSON or oversized connector output fails explicitly without lossy conversion.
+
+FunctionError causes Task failure even when Invoke returns HTTP200. Extract a bounded errorType and cause from the error payload; use Lambda.Unknown when no valid type exists. Do not infer failure from ordinary success payload keys such as error/statusCode. Adapter mappings are:
+
+| Origin | ASL behavior |
+|---|---|
+| Lambda reserved/global concurrency rejection | Lambda.TooManyRequestsException |
+| Known Lambda service exception | `Lambda.<AWS exception code>`, without host internals |
+| Function `/error` | User errorType; reserved `States.*` names become Lambda.Unknown |
+| Function's own timeout | Sandbox.Timedout or supported runtime-specific error |
+| Initialization/entrypoint failure | Runtime.InvalidEntrypoint or appropriate Runtime.* class |
+| Step Functions Task deadline | States.Timeout; cancel handle and reject late completion |
+| Docker transport failure with uncertain result | Lambda.ServiceException; internal deliveryUnknown diagnostic; no automatic replay |
+
+P0 fixtures pin exact exception/event details. Only explicit ASL Retry repeats business calls; adapters must not add hidden invocation retries. Retrying deliveryUnknown may repeat external side effects, so retain attempt IDs for diagnosis.
+
+## 4. Child workflows and `.sync`
+
+Parameters supports StateMachineArn, Input and Name. Normalize omitted/null Input to `{}`. An Input string is already serialized JSON: validate and preserve its bytes rather than encoding it again. Compact-serialize other JSON values. Passing the serialized string `null` therefore differs from a null Parameters value. Users may place `AWS_STEP_FUNCTIONS_STARTED_BY_EXECUTION_ID.$: $$.Execution.Id` inside child Input. Do not inject fields into business payloads. Generate an independent UUID name when absent and store parent linkage internally.
+
+RequestResponse waits only for acceptance. Such a detached child is not cancelled when its parent subsequently fails/stops, but remains owned by the global supervisor. `.sync`/`.sync:2` establish an owned relationship. Subscribe atomically with Start or use a versioned subscribe-then-read protocol; a fast child must not terminate before its parent can observe completion. Deliver termination once. Use internal events, not HTTP polling or EventBridge rules.
+
+```text
+Parent actor              Registry actor               Child actor
+ │1. StartChild + subscribe      │                           │
+ │─────────────────────────────▶│2. name/revision/admission   │
+ │                              │──────────────────────────▶│
+ │◀── executionArn + lease ─────│                           │
+ │3. release dispatch slot       │                           │
+ │   await child terminal        │                           │
+ │                              │◀── terminal/read view ────│
+ │◀──4. child result ───────────│                           │
+ │   .sync: Output string        │                           │
+ │   .sync:2: Output JSON        │                           │
+ │ Stop/timeout ────────────────▶│5. cancel owned child ─────▶│
+ │◀── cleanup settlement ───────│◀── child cleanup/terminal ─│
+```
+
+Use the optimized integration's PascalCase ExecutionArn/StateMachineArn/Name/Status/Input/Output/StartDate/StopDate envelope. Dates in optimized child-start and child-completion envelopes are integer epoch milliseconds, unlike HTTP API fractional epoch seconds. Do not reuse the camelCase HTTP DescribeExecution serializer. `.sync` retains Input/Output as JSON strings; `.sync:2` decodes both Input and Output into JSON values. Include InputDetails/OutputDetails.Included where applicable. The P0 oracle memo pins the upstream AWS-validated evidence and its historical-date limitation. [AWS nested workflows](https://docs.aws.amazon.com/step-functions/latest/dg/connect-stepfunctions.html).
+
+FAILED/TIMED_OUT/ABORTED children fail the parent Task with States.TaskFailed and bounded child ARN/error/status cause. A child's timeout is not the parent's own States.Timeout. Parent Task timeout, Stop or sibling-branch failure requests cancellation of an owned child. Single terminal settlement resolves concurrent completion; successful children and external side effects are never rolled back.
+
+The default 128 open-execution limit includes parents and children; nesting depth≤16. **A waiting parent holds no dispatch slot or Lambda permit**, preventing parents from exhausting all capacity required by children. If open-execution admission is exhausted, return ExecutionLimitExceeded rather than queue a child forever. Recursive workflows are allowed within depth/history/duration limits. Retry creates another child attempt; a user-supplied fixed Name still obeys normal idempotency/name-retention rules.
+
+### 4.1 Atomic child-execution registry port
+
+Before ASL resource admission is enabled, implement the concrete `ChildExecutionPort` returned by `Registry::child_port()`. It holds a Weak reference to the registry admission state, never an Arc cycle through execution owners. `ChildStartParameters::parse(scope, payload)` immediately validates the exact StateMachineArn/Input/Name fields. Reuse scoped ARN/name newtypes; reject other fields and nonstring Name/ARN. Omitted/null Input becomes `{}`; string Input is validated serialized JSON with original bytes retained, other JSON values are compact encoded. Invalid dynamic parameters map to States.Runtime; input/envelope quota violations map to States.DataLimitExceeded.
+
+`ExecutionSnapshot::child_parent()` yields an opaque capability retaining that exact charged parent record. Registry admission verifies Arc identity against its own retained record, fresh RUNNING state and scope; same-scope records from another registry cannot authorize a child. Accepted commands capture this capability, a deadline clamped to the parent's captured absolute deadline, typed RequestResponse/Sync/Sync2 pattern, cancellation control and independent admission lease. Every execution records a bounded immutable lineage (root depth0, children at most16); owned replay edges also enforce the longest active dependency path≤16. No business Input mutation supplies lineage. A fresh child extends the parent lineage; idempotent RUNNING replay preserves its original identity/lineage. Public names and ordinary Start continue using the existing atomic registration/idempotency rules.
+
+The registry owns a separate bounded child-request lane and retained pending request before entropy work. The root retains its own admission state until joined shutdown, so losing external registry handles does not orphan execution-side requests. Its live child-call ceiling equals the runtime open-execution ceiling; it uses a separate semaphore, never the ordinary command-admission lane or a Task/Lambda dispatch permit. Requests reject saturation rather than waiting forever. At commit, recheck cancellation, absolute deadline, parent identity/liveness and depth. Reserve relation identity and reject self or active dependency-graph cycles before creating an owned edge. Active owned relations form a bounded directed acyclic graph; idempotent replay may join the same RUNNING child, and each owned relation can request cancellation of that selected execution. A graph-cycle attempt is a local States.Runtime safety failure; depth/call/open saturation maps to StepFunctions.ExecutionLimitExceeded. Failed starts publish neither a new record nor a name claim.
+
+Synchronous command transfer returns `ChildSubmission` before awaiting admission. `admitted(&mut self, deadline)` retains its receiver on observer expiry/cancellation and caches the one accepted child or typed rejection, with fresh pre/post observer deadline fences even when the reply was already ready; `into_execution(self)` transfers the unique cancellation owner. Drop/cancel before commit prevents issuance. Drop/cancel after owned commit signals the registry; a lost reply still drops the returned child capability and requests owned cleanup. RequestResponse detaches at acceptance, so later caller/parent loss cannot cancel that child. `ChildExecution` keeps snapshot/terminal/cleanup observations independent and cancellation-safe; observer deadlines never release unsettled ownership. `result()` is pure bounded envelope mapping for an embedding CPU owner, and requires an observed terminal result for Sync/Sync2.
+
+Start and subscription are one non-awaiting registry transaction: install the owned relation before returning a captured watch handle, including when the child already terminated. The registry retains the relation/admission lease until child cleanup is Clean. Notify wakes cancellation promptly; monotonic maintenance checks parent termination and child deadlines without HTTP polling. Propagate cancellation through all owned descendant relations in one bounded graph traversal; detached edges are excluded. Alternate ready ordinary/child intake, allowing at most one child turn before a ready ordinary command. While any UUID worker is retained, continue selecting cancellation notifications, monotonic maintenance and close alongside its join; closed intake must promptly stop roots and reject unissued queued children even before that worker returns. Root shutdown closes both intake lanes, rejects queued child requests, stops/joins all roots through the existing runtime drain, and retains pending/unknown state on failure or observer loss.
+
+Use integer epoch milliseconds from captured accepted/stopped dates for optimized envelopes. Include PascalCase execution/machine ARN, Name/Status, Input/Output and Included details for successful Sync variants. Map unsuccessful child terminal status to States.TaskFailed with bounded JSON ARN/status/error/cause; never flatten a child's timeout into the parent's States.Timeout. Record only actual values; never invent cloud metadata. Validate exact string-versus-JSON/null/raw-input mapping, quotas, dates, foreign/closed parents, replay/collision/cycle/depth/call/open limits, fast completion, lost/cancelled/expired admission observers, detached survival, nested cancellation, retained cleanup and actual Native child execution before using this port in ASL actors. The Native cancel scenario uses a300s relation deadline,3600s parent Wait,900s Lambda timeout and180s handler gate around a30s business scenario, so unrelated clocks cannot masquerade as explicit cancellation. Probe the consumed PID before global cleanup; retain/reap the exact probe process on timeout and exercise that forced-reap path independently. This dependency alone does not enable `.sync` resources or advertise nested service capability.
+
+```text
+┌─ caller / parent observer ────────────────────────────────────────────┐
+│ exact snapshot capability → ChildExecutionPort (Weak admission)        │
+│ ChildSubmission → ChildExecution → result / independent cleanup views │
+└───────────────────┬───────────────────────────────────▲───────────────┘
+                    │ bounded transfer                  │ captured watch
+┌─ retained registry root ───────────────────────────────┴───────────────┐
+│ ordinary lane ⇄ fair intake ⇄ child lane + independent call quota      │
+│ retained pending → UUID worker join ⇄ cancel / deadline / close        │
+│ fresh identity/depth/cycle/control checks → atomic Start + owned edge  │
+│ Notify + maintenance → cancel owned DAG → retain edge until Clean      │
+└───────────────────┬───────────────────────────────────────────────────┘
+                    ▼ runtime owns every root, with no wait dispatch slot
+              child actor → actual Lambda port → retained IO settlement
+RequestResponse detaches at acceptance; unknown joins retain ownership.
+```
+
+### 4.2 ASL binding, registration gate and retained child Task worker
+
+Trusted compilation enables child resources independently of Lambda support. Match only the three exact partition-scoped startExecution resources in §2. Validate literal StateMachineArn/Name and serialized Input immediately; dynamic fields pass the same validated domain parser after Parameters evaluation. Unknown parameters and normalized literal/dynamic collisions reject. Callback resources remain unavailable. Recursively distinguish Lambda dependency from child dependency across Parallel/Map scopes.
+
+Registry admission routes machines containing child Tasks through the structured owner, including sequential one-frame machines. Public unregistered supervisor starts reject child-dependent artifacts. Registered starts allocate a one-shot parent-capability gate before spawning; the registry inserts the exact charged record and name claim before publishing its ChildParent. The actor awaits that gate before evaluating work, while still honoring Stop/execution timeout. A closed gate fails without issuing work. Ordinary sequential Lambda/pure machines retain their established execution path.
+
+Each accepted child Task retains a frame-only resource lease in the supervisor ledger before spawning a protocol worker. It acquires no Task dispatch permit, including while parsing, submitting, waiting for completion or awaiting cleanup. Pending child Tasks can pass a Lambda Task waiting for a dispatch permit. Accepted child work is bounded by frame/open/child-lane capacity; payload parsing and envelope serialization additionally use retained bounded CPU jobs. The actor joins workers and result watchers before releasing resources. An unexpected worker loss closes progress/settlement, cancels owned relations and preserves actual child/CPU receipts in charged process quarantine; channel closure never proves cleanup.
+
+The worker retains the same ChildSubmission through caller cancellation, Task timeout and delayed admission. After cancellation it requests cancellation and still resolves acceptance to determine issuance. Explicit rejection before issuance is clean; a lost admission owner is uncertain. RequestResponse detaches on registry acceptance and returns its start envelope without waiting for child business/cleanup. Owned patterns emit Started then Submitted only after real acceptance, observe terminal business outcome, cancel on parent Task control, and publish the mapped terminal business result once before awaiting actual physical cleanup to confirm settlement. A later Task deadline cannot replace an already observed business result merely because cleanup remains pending; frame retirement/recovery still waits for cleanup. Observation expiry never drops a receipt. Cleanup waiting observes in-memory retained execution state rather than external IO; quarantine remains charged until proven Clean or permanently retained after owner loss.
+
+```text
+Registry                  Structured owner            Child Task worker
+  │ allocate gate ───────────▶│                              │
+  │ commit record + name      │ wait gate / Stop / deadline   │
+  │ publish ChildParent ─────▶│                              │
+  │                          │ ledger(frame, no dispatch)    │
+  │                          │ spawn retained worker ───────▶│
+  │◀─────────────────────────┼── parse(CPU), child port.start│
+  │ atomic acceptance ───────┼─────────────────────────────▶│
+  │                          │◀── Started, Submitted         │
+  │ child terminal + cleanup ┼─────────────────────────────▶│
+  │                          │◀── mapped business result     │
+  │                          │    retain frame / child       │
+  │                          │◀── physical cleanup: Clean    │
+  │                          │ join worker/watcher, retire   │
+  │◀── Stop/timeout ──────────┼── cancel, retain same receipt │
+```
+
+Child Task history uses TaskScheduled/TaskStarted/TaskSucceeded/TaskFailed/TaskTimedOut/TaskStartFailed with resourceType `states` and the exact resource action (`startExecution`, `startExecution.sync`, `startExecution.sync:2`). Sync patterns additionally produce TaskSubmitted between Started and completion, with the actual ExecutionArn/StartDate start envelope as output. RequestResponse has no Submitted event. Per-frame predecessor chains remain causal; includeExecutionData=false removes Submitted output and outputDetails alongside existing Task data. No synthetic child ARN or invented Lambda event is emitted.
+
+Acceptance requires real registry execution for all three patterns; string/JSON output distinction, fast completion, detached child survival, owned Stop/Task timeout cleanup, errors/capacity/depth and no-dispatch deadlock tests. The service capability remains false until actual registered Native and both ordinary SDK nested suites qualify this binding. Docker remains deferred.
+
+### 4.3 Example: wait for a real child workflow
+
+The child can be the image-Lambda machine from the PRD. The parent definition is:
+
+```json
+{
+  "StartAt": "RunChild",
+  "States": {
+    "RunChild": {
+      "Type": "Task",
+      "Resource": "arn:aws:states:::states:startExecution.sync:2",
+      "Parameters": {
+        "StateMachineArn": "arn:aws:states:us-east-1:000000000000:stateMachine:ImageChild",
+        "Input.$": "$"
+      },
+      "TimeoutSeconds": 30,
+      "OutputPath": "$.Output",
+      "End": true
+    }
+  }
+}
+```
+
+The parent must remain RUNNING until the child's container handler finishes. A failed child cannot produce a successful parent output.
+
+## 5. Callback and heartbeat, M3
+
+Support optimized Lambda `.waitForTaskToken` only. Before dispatch, generate a 256-bit CSPRNG token, register its hash/scope/execution/frame/generation, and then evaluate Parameters so `$$.Task.Token` exists. Invoke Lambda synchronously. After Lambda succeeds, await callback; the Lambda return payload is not the Task output. Lambda failure revokes the token and follows ordinary failure handling.
+
+A callback can arrive before the Lambda invocation returns. Store it provisionally in the same owner, commit it after successful Lambda return, or discard it if Lambda fails. A fast callback is neither lost nor allowed to hide invocation failure.
+
+Task timeout includes invocation and callback waiting. Heartbeat timing starts only after successful synchronous Lambda return. SendTaskHeartbeat extends the heartbeat window, not the absolute Task deadline. Retry/timeout revokes old tokens and creates a fresh token for the next attempt. Without a heartbeat field, do not invent a short heartbeat timeout. [AWS Lambda callback timing](https://docs.aws.amazon.com/step-functions/latest/dg/connect-lambda.html).
+
+SendTaskSuccess.output is a JSON string≤256 KiB. Failure.error/cause are≤256/32,768 bytes. Token input is≤2,048 bytes. Malformed, unknown or cross-scope tokens return InvalidToken; known revoked/completed/timed-out callback tasks return TaskTimedOut. TaskDoesNotExist is reserved for the nonexistent-activity API case, outside this callback-only profile. Retain bounded token tombstones for execution retention to preserve classification.
+
+Treat tokens as credentials. Infrastructure tracing/Debug/metrics/causes never contain raw tokens; the registry stores hashes. Before history persistence, redact values injected from Task.Token in materialized Parameters; mark truncation only on event details that actually support it, as specified in§5.2. Advertise this local history difference; never save raw tokens and hope a later logger redacts them. This does not promise scanning arbitrary business data for secrets. Use constant-time comparison where token material is compared and a production security-grade random source.
+
+### 5.1 Owned callback registry foundation
+
+Implement a concrete scoped `CallbackRegistry` and unique `CallbackSupervisor` before ASL callback resources are enabled. The registry is a bounded actor, independent of HTTP, Lambda and Docker; its consuming workflow owner supplies an exact captured `ExecutionSnapshot`, opaque `FrameCallId`, Task deadline and optional heartbeat duration in `CallbackAttempt`. Validate same-scope execution identity and current RUNNING parent state at registration and callback mutation. Clamp the Task deadline to the captured parent deadline. Minting is a trusted internal operation, never a public SendTask API. The consuming engine must additionally supply its current frame/attempt and revoke its unique task receipt on retirement; the foundation does not claim ASL admission, context injection or provenance redaction.
+
+`register(attempt)` synchronously reserves live-token, future-tombstone and command/reply capacity before queuing a retained mint request. Reserve closed classification at mint admission, so later timeout/cancellation cannot lose a known token when tombstone capacity is exhausted. Defaults are live4,096, retained100,000 (active plus reserved/closed), commands1,024, entropy workers8 and retention24h; validate positive documented ranges and retained≥live. Active records release live capacity on terminal callback state; their digest/attempt/parent classification reservation remains until the parent execution terminates and execution retention expires. Never evict live entries to admit another token. Once a terminal result is published, drop the table's outcome sender and invocation receiver: only caller-owned watch readers may retain business payloads/failure causes. Tombstones retain lightweight identity/classification, never completed output data. A duplicate captured execution/frame/generation cannot mint a second token while its classification record is retained. Each record has one removable timer, so arbitrarily many heartbeats cannot accumulate timer nodes.
+
+The actor retains bounded blocking entropy joins while continuing to process already issued token commands, control notifications, timers and close. Use production `getrandom` for32 random bytes, encode exactly64 lowercase hexadecimal bytes and transfer the token once in a secret wrapper. Zeroize transient entropy buffers and the token on Drop. Store only SHA-256 digests in actor indexes; digest equality uses constant-time comparison. The plaintext exists only in the retained entropy result/registration reply, the unique `CallbackTask` and explicitly exposed outbound/context material, never in table keys, infrastructure Debug, tracing, error text or metrics. `CallbackToken::from_str` enforces the input's2,048-byte cap and exact local opaque format; malformed/unknown tokens produce InvalidToken. Caller scope is trusted request context, never token-supplied data; foreign scope always produces InvalidToken, including for a locally known closed digest. Tokens are not serializable by default. Use [secrecy0.10.3](https://docs.rs/secrecy/0.10.3/secrecy/)'s explicit secret exposure and zeroize re-export, plus the workspace's existing subtle2.6/hex0.4 cohort; verify current upstream APIs and dependency gates.
+
+The unique `CallbackTask` holds its token, monotonic control and watch receipt. `invocation_complete(Result<(),TaskFailure>)` is one-shot; Drop/revoke is an idempotent cancellation signal with independent Notify, never a best-effort queue send. Both mint receipts and task observers survive observation timeouts; dropping a mint receipt revokes even before admission. Dropping an API acknowledgment waiter never undoes its accepted callback action. Cache late-ready replies before enforcing a fresh post-await observer deadline, preserving the same acceptance/error for later observation. A fresh clock/parent/control fence precedes every state mutation. An execution stopped or completed while a callback is pending revokes that task; known closed token classification remains TaskTimedOut.
+
+```text
+Execution owner                 Callback actor                 API caller
+  │ reserve + register ───────────▶│                              │
+  │                               │ bounded retained CSPRNG join  │
+  │◀── unique token/task receipt ─│ store digest + attempt only    │
+  │ invoke Lambda                 │◀── SendTaskSuccess/Failure ────│
+  │                               │ Invoking: provisional result  │
+  │                               │──────── accepted / closed ───▶│
+  │ invoke success ──────────────▶│ commit provisional OR Waiting  │
+  │ invoke failure ──────────────▶│ discard provisional; fail Task │
+  │◀── watch terminal state ──────│                              │
+  │ Drop / revoke ───────────────▶│ tombstone; independent Notify  │
+  │                               │◀── heartbeat while Waiting ──│
+  │                               │ replace one heartbeat timer  │
+  │                               │ deadline / root close: revoke│
+```
+
+While Invoking, accept at most one provisional success/failure; subsequent completion or heartbeat on that consumed token returns TaskTimedOut. Before any provisional completion, heartbeat is accepted but does not start/reset a clock. Successful Lambda completion uses the captured return timestamp to compute heartbeat deadline=min(observed+interval, absolute Task deadline). A provisional result commits only when its actor-receipt timestamp precedes that deadline; otherwise the Task expires. With no provisional result, start Waiting only if the derived deadline is still in the future. Lambda failure wins over a stored provisional callback and publishes InvocationFailed. While Waiting, a completion commits once; heartbeat replaces only its heartbeat timer and cannot extend the absolute Task deadline. A heartbeat at or after either deadline fails TaskTimedOut. No heartbeat setting means no heartbeat timer. Preserve distinct Task-deadline and heartbeat-expiry reasons for the consuming engine's ASL mapping. On simultaneous readiness the actor checks fresh absolute/heartbeat deadline and revocation/parent liveness before invocation or external completion; already committed terminal state is immutable. Accepted provisional completion closes the external token but cannot bypass the still-running Lambda invocation's absolute deadline.
+
+`SendTaskSuccess` preparation parses bounded JSON without double encoding. Failure preparation preserves omitted/empty error/cause and validates256/32,768-byte ceilings. Valid command acceptance returns a bounded resumable acknowledgment; classification is InvalidToken for unknown/foreign/malformed, TaskTimedOut for known consumed/revoked/expired, and explicit Capacity/Unavailable/Deadline for infrastructure admission/observation. No TaskDoesNotExist fallback, synthetic success, hidden retry or raw token in diagnostics. Root close rejects queued unissued work, revokes active entries, joins accepted entropy work and supports resumed shutdown observation. Root panic/runtime loss marks issued receipts unavailable, requests revocation and conservatively retains unresolved jobs/permits in process quarantine; closed channels never imply successful callback completion.
+
+Foundation acceptance covers early/late success and failure, Lambda failure after early success, heartbeat before/after activation and exact boundaries, absolute deadline, revoked/duplicate/foreign/unknown tokens, parent Stop, old attempt reuse, same-attempt mint collision, capacity and retention recovery, saturated command lane with independent revoke, observer loss/late replies, entropy delay/panic and resumable root shutdown. Debug/table/token-source scans must prove no plaintext storage or formatting. ASL `.waitForTaskToken`, injected-parameter history redaction, public SendTask routing, actual handler callbacks and service capability remain consuming P4 work; this foundation alone must not advertise callbacks.
+
+### 5.2 Single-evaluation callback Parameters and history provenance
+
+Before the ASL actor can admit callback resources, add `DataFlow::prepare_callback_with_source(original, base_context, token, source) -> CallbackParameters` as the pure bounded token/materialization boundary. The caller must already own an actually registered `CallbackTask` and pass its `CallbackToken`; this helper does not mint or start a function. It evaluates InputPath and Parameters once with a transient Task.Token context. `CallbackParameters::outbound()` is the actual invocation payload; `history()` returns a distinct, immutable `CallbackHistory` that has no public unchecked constructor. `CallbackHistory::payload()` exposes only the prepared history JSON and `redacted()` declares the local policy. Both types have redacted Debug and no implicit credential-bearing serialization. Preparation failures return no partial pair and must cause the consuming owner to revoke the same task before retry/retirement.
+
+The supplied base context must be an object without the reserved Task member. Reject stale/forged Task context rather than overwriting it. Clone its bounded validated tree once, inject only `{ "Task": { "Token": <registered secret> } }`, and keep this context local to preparation. Do not mutate the base, store Task.Token in the driver, carry it into the next state/retry, or inject it into business Input automatically. The sensitive context storage clears the injected token String with zeroize when its final Arc drops, including error/unwind and shared-context clones; ordinary contexts retain their existing cheap Arc sharing. Enforce the existing4MiB/68-level/context-member limits, with checked size accounting for the fixed credential envelope, before publishing this sensitive context. Do not serialize the plaintext-bearing context just to measure it. Outbound payloads intentionally contain requested token material; they remain bounded/redacted immutable Payloads and must never be passed to the callback history projector.
+
+Compiled paths classify provenance structurally, independent of raw string contents. A context-root selection is token-sensitive when its compiled member/wildcard sequence may select Task.Token or an ancestor containing it: `$$`, `$$.Task`, `$$.Task.Token`, bracket-equivalent names, `$$[*].Token`, `$$.Task[*]`, `$$[*][*]`. Context siblings such as State/Execution, nonmatching/case-distinct keys and data-root paths are not intrinsically sensitive. Indices/slices cannot traverse the reserved object-member address. An expression is conservatively sensitive if any eagerly evaluated argument is sensitive, including Format, JSON/string conversion, arrays, length, item selection and merge; replace the complete dynamic expression result in history, never search its serialized value for the token. This intentionally redacts a boolean/count or an enclosing object when computed from sensitive context, even when it no longer contains plaintext. It does not scan arbitrary business data for secrets.
+
+InputPath provenance must follow the effective input into Parameters. If InputPath selects sensitive context, every data-root dynamic reference to that effective input is conservatively sensitive too. Literal template members remain literal. If Parameters is omitted, redact the complete sensitive effective input. A null InputPath produces an ordinary empty input. Each dynamic expression executes exactly once under the existing shared work/output budget and caller UUID source; build actual and history projections from that same prepared tree. Untainted dynamic values, UUID results, business fields and literals remain identical in both projections. Sensitive dynamic nodes serialize to JSON null only in history. Any resulting actual or history payload must independently satisfy the existing256KiB/depth/member limits before the pair is returned, including pathological redaction expansion for tiny intrinsic results. Failure never silently truncates an otherwise invalid payload. Original input and base context remain immutable.
+
+The schema qualification resolves a spec ambiguity: [TaskScheduledEventDetails](https://docs.aws.amazon.com/step-functions/latest/apireference/API_TaskScheduledEventDetails.html) has required parameters JSON but no execution-data-details/truncated member, as confirmed by the pinned generated model. Therefore its parameters contain the null-redacted projection, without a fabricated AWS field or wrapper. Internal `CallbackHistory::redacted()` and the eventual advertised local history policy identify the difference. Callback invocation submission history will omit the ignored synchronous Lambda business Payload and mark `TaskSubmitted.outputDetails.truncated=true` where that official field exists. This does not mark unrelated state input as truncated. The consuming history adapter must take CallbackHistory explicitly; callback resource/API capability stays disabled until registered token preparation, invocation/result ownership and actual handler/SDK history scans are qualified together. Result-phase and later-state contexts never gain this transient credential.
+
+```text
+registered CallbackTask.token ──────┐
+original Input + immutable context ┼──▶ scoped sensitive context
+                                  │        │ cleared on last Drop
+InputPath (provenance bit) ────────┼────────▼─────────────────────┐
+compiled Parameters               │ one bounded evaluation tree  │
+                                  │ dynamic values + provenance  │
+                                  └────────────────┬──────────────┘
+                                      ┌────────────┴─────────────┐
+                                      ▼                          ▼
+                            CallbackParameters.outbound   CallbackHistory
+                            actual requested token        tainted nodes:null
+                                      │                          │
+                                Lambda owner              history projector
+```
+
+Acceptance covers all supported member/bracket/wildcard/ancestor paths, effective-input propagation, nested templates/arrays/intrinsics, static business values equal to a token, shared source/budget accounting, exactly-once UUID acquisition, unchanged input/context, rejection of existing Task context, sensitive context headroom/zeroization, independent history limits and failure without partial output. Serialize the history projection through the actual generated TaskScheduled model to prove no injected plaintext or invented wire field. These pure preparation proofs do not establish ASL callback admission, history persistence or SendTask service acceptance.
+
+### 5.3 Observed synchronous Lambda return and independent cleanup
+
+Before the ASL callback owner can use the real Lambda port, separate the unique invocation-report capability from CallbackTask. `CallbackTask::take_invocation_reporter()` transfers a noncloneable `CallbackInvocationReporter` exactly once; the Task keeps its token, revocation control, invocation observation and callback-result watch. Its existing direct `invocation_complete` remains available only while it owns the reporter. Neither path may report twice or report after delegation, revocation, closure or the absolute Task deadline. Dropping an unreported reporter revokes the attempt through independent control; dropping a reported reporter preserves the pending callback. Task Drop still revokes regardless of reporter ownership.
+
+A reporter captures validated scope, exact opaque FrameCallId, registration-commit time and absolute Task deadline. `complete_at(result, observed)` accepts only a nonfuture observation at/after registration, then applies fresh closed/revoked/deadline fences before a single watch publication. Its successful result is typed `CallbackInvocationMetadata`, with a real version4 request UUID and actual `$LATEST` or canonical positive numeric executed version. Do not accept arbitrary strings/payload objects as response metadata, invent a version, or include the synchronous function business body. Expose immutable `CallbackInvocation` observations (captured return time, optional metadata or bounded failure) separately from callback business outcome and from physical cleanup. Direct foundation reports may omit metadata; the eventual ASL owner must require real metadata before projecting invocation submission.
+
+The callback registry consumes the same captured report time for heartbeat start. Retain one actor-receipt timestamp beside provisional completion, so a callback received at/after observed+interval cannot bypass expiry when reporting is delayed. A genuinely pre-return callback or a callback received within the window remains eligible even if mapping/report publication occurs later. Heartbeat commands received while still Invoking remain the §5.1 no-op, including the observation-to-report gap; they never extend the captured window. Only commands linearized after successful report activation reset the heartbeat timer. An observation arriving after its heartbeat window cannot extend that window. Early callback success/failure remains provisional until a valid successful report; invocation failure discards it. Reporter watches preserve late-ready success/error/owner-loss observation fences and never duplicate invocation work. Terminal table records continue dropping their outcome sender and invocation receiver; caller-owned observers alone may retain report data. Metadata is bounded by its typed schema rather than an unrestricted256KiB response payload.
+
+Add `LambdaTaskCommand::observed_callback(machine, dispatch, call, reporter)` for the internal optimized request-response call. Validate the exact optimized Lambda resource, machine scope, call/attempt identity and unused live reporter before transfer; clamp the invocation deadline to the captured callback deadline. A rejected command drops/revokes its unique reporter. This is an internal invocation observation mode, not an enabled ASL callback definition/profile. The consuming callback owner will materialize the actual CallbackParameters, commit CallbackHistory, and then hand the same registered reporter to this command. Ordinary direct and optimized RequestResponse commands retain their established payload/settlement behavior.
+
+The binary bridge consumes this mode explicitly. Before any actual issuance, validate dynamic optimized parameters as usual. For accepted calls, publish Started only after real provider admission. Capture the monotonic return time immediately when the real InvocationHandle yields its response, before retained blocking result mapping or cleanup. On HTTP200 without FunctionError, ignore the function body completely (including non-JSON or ASL-oversized bodies already bounded by Lambda), produce only actual typed invocation metadata, and report success at the captured time. FunctionError, admission/executor failure and invalid trusted metadata report a bounded invocation failure; an early callback can never hide them. Mapping uses the same retained worker/cancellation/InvocationHandle ownership. No business invocation retry is added.
+
+The current Lambda provider publishes InvocationHandle responses after executor cleanup/settlement. This slice observes that provider-return boundary, not the earlier handler Runtime API POST; do not claim independently delayed backend cleanup on successful Native responses. Publish the invocation report before the bridge waits for its independent physical-settlement receipt. The low-level TaskCall still owns its independent cleanup receipt and returns only safe metadata in observed mode. Cleanup expiry/uncertainty must not rewrite an already reported business return or fabricate Clean: retain the actual handle, report/settlement receipts and admission charge through resumed cleanup or quarantine. Never drop a blocking mapping join when cancellation arrives. Caller/manager cancellation must relay while mapping and cleanup are pending. Ordinary Lambda behavior remains unchanged. The later callback owner releases its workflow dispatch permit only after invocation retirement, while retaining the callback frame/token through external completion.
+
+```text
+CallbackTask -- transfer once --> InvocationReporter --> LambdaTaskCommand
+      │ own token/revoke/watch                           │ real bridge
+      │                                                  ▼
+      │                                      retained provider admission
+      │                                                  │ Started
+      │                                                  ▼
+      │                                      actual response + captured time
+      │                                                  │ bounded mapping
+      │◀── invocation metadata/failure + observed ─────────┤
+      │    commit provisional / start heartbeat           │
+      │                                                  ▼
+      │ independent callback wait               retained physical cleanup
+      │                                                  │
+      └─ callback result / revoke              TaskCall Clean / quarantine
+```
+
+Acceptance requires exact delegation/report/time/scope/attempt invariants, old report rejection, report observation before held bridge settlement delivery, heartbeat anchored before delayed mapping, drop/revocation and resumed observers, and no terminal-payload retention regression. Qualify the real binary bridge with actual consumed Native handlers: early and late callbacks, failure after early success, stop/reap, ignored synchronous bodies, actual request/version identity and no token in metadata/Debug. Existing M1/M2 SDK regressions remain required. ASL callback scheduling/history, public SendTask APIs, actual handler-originated SDK callbacks and service capability remain separately gated until consuming integration; Docker remains deferred.
+
+## 6. Rust engineering contract and cross-references
+
+Follow AGENTS.md Error/Async/Type/Safety/Serialization: typed thiserror mappings, documented dyn object safety, supervisor-owned handles, bounded IO/channel budgets, validated private scope/ARN/token types, redacted Debug and camelCase internal envelopes. Tests cover absent adapters, HTTP200 function errors, alias updates, child subscription races, early callbacks, cancellation and deadlines. Tracing records IDs; internal calls avoid HTTP serialization and reparsing. Public APIs need runnable SDK examples and Errors documentation.
+
+- ← [API](./rustack-workflows-10-api-design.md), [Lambda](./rustack-workflows-20-lambda-runtime-design.md), [ASL](./rustack-workflows-30-asl-design.md)
+- → [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md)
+- ↔ [key decisions](./rustack-workflows-99-decisions.md)
+
+### 5.4 Deferred ASL callback instruction and pure effect boundary
+
+The ordinary Task driver evaluates Parameters before it emits TaskDispatch. Callback Tasks require the opposite ownership order: assign the attempt/frame/deadline first, register the token against that identity, then evaluate Parameters exactly once with the registered credential. Do not insert placeholder JSON, mint a token inside the pure driver, defer ordinary Lambda templates, or temporarily inject Task.Token into retained driver context.
+
+Add an independent trusted `AslCompiler::with_callback_support(bool)` capability, default false. With Lambda enabled and callback support explicitly selected, accept only same-partition `lambda:invoke.waitForTaskToken`; ordinary Lambda/child resources still reject heartbeat fields. Store callback heartbeat as a validated TaskTimeout source inside a distinct `Integration::LambdaCallback` variant. Static and dynamic heartbeat seconds and CallbackAttempt registration use one shared positive1..99,999,999 profile; literal/path forms are mutually exclusive. A configured heartbeat must be strictly smaller than the configured Task timeout: check two literals during compilation and all resolved combinations before emitting an effect. For validation when Task timeout is omitted, use the AWS Task documentation's99,999,999-second default ceiling; an explicit heartbeat equal to that ceiling is invalid. Resolve dynamic values from original state input/context, before InputPath/Parameters. Omitted Task timeout still retains the existing operator/execution deadline cap; its validation ceiling does not create a new timer or compare heartbeat with remaining parent duration. See [ASL Task timeouts](https://states-language.net/spec.html#task-state) for mutual exclusion, positive integers and the strict interval relation, and [AWS Task fields](https://docs.aws.amazon.com/step-functions/latest/dg/state-task.html) for the99,999,999-second omitted-timeout validation ceiling (verified2026-10-26). The latter agrees with the existing supported numeric profile; it does not adopt the ASL text's different default timer.
+
+A callback-dependent root or nested lexical scope emits `DriverStep::Callback(CallbackDispatch)`, never ordinary Dispatch. The immutable effect retains its exact machine/state, fresh attempt, original input, credential-free State/Execution context, absolute Task/execution minimum deadline, optional resolved heartbeat and optional explicit timeout seconds for history. It performs no entropy, registration, invocation or template evaluation. Generation/RetryCount/deadline and stale/duplicate completion semantics reuse the existing Phase::Calling protocol. FrameScheduler charges/tracks/cancels/retires this effect exactly like an ordinary Task call, including equal frame-local generation numbers in different branches. The effect is cloneable only as immutable instruction data; token/report ownership stays unique in the registry and consuming worker.
+
+`CallbackDispatch::prepare_with_source(token, source)` evaluates the effect's captured DataFlow once using §5.2, returning a materialized TaskDispatch plus distinct CallbackHistory. Bind preparation to the effect's captured machine, not a caller-supplied state ID/artifact. Keep original input/context immutable; errors return no partial invocation/history output and preserve typed sources. The async consumer remains responsible for fresh control/deadline/attempt checks before and after bounded CPU work, matching the exact registered token to this attempt and revoking on preparation failure. A cloned effect cannot authorize duplicate business issuance.
+
+The generic history scheduled helper rejects callback resources. A separate typed scheduled_callback helper accepts only CallbackHistory, preserves explicit resolved timeout/heartbeat seconds (omitted fields remain absent), and uses the official TaskScheduled DTO without invented truncation fields. Callback TaskSubmitted includes actual bounded metadata and outputDetails.truncated=true because the synchronous Lambda body is deliberately omitted. TaskStarted/TaskSucceeded/TaskFailed/TaskTimedOut retain the callback resource name and causal frame linkage; CallbackDispatch output preparation never finishes the ASL Task. Only the selected external callback result passes through the existing ResultSelector/ResultPath/OutputPath and Retry/Catch engine.
+
+```text
+┌─ Pure frame driver ───────────────────────────────────────────────────┐
+│ resolve timeout/heartbeat → fresh generation → Phase::Calling         │
+│ emit CallbackDispatch(machine, state, original, context, deadline)    │
+└─────────────────────────────────┬────────────────────────────────────┘
+                                  ▼ exact opaque FrameCallId
+┌─ Consuming async owner (subsequent binding) ───────────────────────────┐
+│ register actual parent/attempt → unique token/report owner            │
+│ bounded prepare once → actual TaskDispatch + typed CallbackHistory    │
+│ commit/ack Scheduled history → issue observed Lambda command          │
+│ real return → Submitted metadata → external result → driver.complete │
+│ Stop/timeout/retry → revoke + cancel + retain joined cleanup/charges   │
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+Stage this pure compiler/effect/history dependency independently of activation: sequential ExecutionDriver rejects callback-dependent artifacts; current ExecutionSupervisor (including start_structured) and Registry Create/Update must also reject them until the registered async consumer is installed. API preparation and main callbacks capability remain false. Extend the internal observed Lambda command/bridge allowlist to the explicit callback integration only when its unique reporter is present; no ordinary response-mode callback invocation is permitted. Qualify compiler errors and nested capability propagation, no pre-registration UUID/template work, exact captured context/clock/deadline behavior, single evaluation/provenance, dynamic interval errors, Retry/Catch, stale completion, structured frame identity/retirement/cancellation, generated event wire fields and all current Native/SDK regressions. The subsequent parent registration/history acknowledgment/retained callback worker, public SendTask and handler-originated SDK acceptance are still required before M3 is complete; Docker stays deferred.
+
+### 5.5 Registered asynchronous callback owner
+
+Install the actual callback registry into a fresh ExecutionSupervisor through a checked, immutable composition method. It must reject reconfiguration after work/shared ownership exists and require the same trusted scope when Registry composition binds it. Registry exposes callback support from its installed runtime; it admits compiled callback-dependent definitions only with that binding. Subsequent API activation must derive compilation from that capability together with installed SendTask routing. This library binding precedes main/API capability activation and handler-originated SDK acceptance; no test-only or disabled backend may advertise production readiness.
+
+Extend the existing atomic parent-registration gate to transfer the exact ExecutionSnapshot after record/name insertion, converting it to ChildParent only for child job calls. Callback-dependent machines use the structured owner even without Parallel/Map. Unregistered start/start_structured paths continue rejecting callbacks, even when a registry port was injected. A failed Start cannot publish a token, Scheduled event or business invocation before the exact snapshot commits. Keep the gate independent of ordinary registry command and Lambda dispatch permits.
+
+For each CallbackDispatch, retain the exact frame lineage in the supervisor ledger before starting its joined callback worker. Record call state/deadline through a separate instruction descriptor; never manufacture TaskDispatch parameters for bookkeeping. The worker owns mint reply, CallbackTask, retained preparation JoinHandle, actual Lambda TaskCall, physical dispatch permit and preparation-byte charge. A Drop/panic guard requests token/call cancellation and retains unknown receipts/charges. The actor retains and joins callback jobs alongside child jobs and resource watchers; channel loss never certifies cleanup. A retirement that changes graph readiness invalidates the parked timer, so parent recovery cannot sleep past completed sibling cleanup.
+
+Charge callbacks to the same global/local intermediate-result byte pools as fanout. Before mint, reserve MAX_PAYLOAD_BYTES plus64KiB protocol/failure allowance in the frame's immutable call lease; keep it until resource retirement and consumed result notifications, including provisional callback/result queues. Queue business/completion metadata together with an owned lease, retain terminal child charges while their notification is Waiting/Queued, and reconcile only after the returned update is consumed and downstream aggregation is charged. Before bounded preparation CPU work, reserve2*MAX_PAYLOAD_BYTES plus256 bytes for the outbound/history pair, then shrink that charge to actual encoded pair sizes plus256 bytes. Hold it through actual invocation cleanup, because command/bridge copies may still retain outbound credential data. Byte reservation failure is an explicit unrecoverable Rustack.ResultLimitExceeded resource failure; token/registry admission capacity uses Rustack.CallbackLimitExceeded. Both reject without hidden retry, never an unbounded allocation or a wait holding scarce dispatch capacity. Shared CPU permits bound temporary materialization; no token/callback waiter holds a CPU permit after its job joins.
+
+Register CallbackAttempt from the committed snapshot, exact FrameCallId, effect deadline and heartbeat. Resolve the same retained mint reply through cancellation/deadline rather than dropping accepted entropy work. Prepare the captured effect once under CPU/byte admission with a short-lived secret-wrapped token copy. Preserve template errors as typed evaluation-origin failures with the same classification/recovery as eager Task Parameters; do not accidentally make States.Runtime catchable or lose the source by mapping every error to Lambda.ServiceException. Retained CPU cancellation joins the same job before disposal.
+
+After preparation, send a bounded actor message containing FrameCallId, typed CallbackHistory and a unique acknowledgment sender. The actor checks fresh Stop/deadline/current generation, commits the official Scheduled event on its causal frame cursor, publishes the coherent view and acknowledges whether issuance remains authorized. The worker must observe positive acknowledgment and recheck its controls before acquiring/issuing real Lambda work. History failure, closed acknowledgment, Stop, timeout or superseded generation revokes the token; there is no unscheduled business call.
+
+Acquire a physical dispatch permit only for actual Lambda issuance and cleanup. Build the explicit observed command with the same registered reporter and materialized TaskDispatch. Forward actual Started once; successful actual invocation report publishes TaskSubmitted metadata with supported truncation. Invocation failure overrides provisional external completion. The external callback result alone produces TaskSucceeded/TaskFailed; heartbeat expiry maps States.HeartbeatTimeout with TaskTimedOut history, absolute Task timeout remains States.Timeout. Use the captured report timestamp for activation (§5.3), not cleanup observation. Waiting for external callback must not retain a physical dispatch permit after confirmed Lambda Clean. Keep the frame/token/result charge until the callback Task retires. A single-dispatch runtime must therefore run another workflow's Lambda while a prior callback waits externally.
+
+Drive actual invocation progress/settlement and callback completion independently. Publish the selected business result before late physical cleanup when appropriate, using the existing completion/settlement receipt protocol. Pending/Quarantined cleanup cannot rewrite an observed report or release its physical permit; continue the same join or retain quarantine. A callback-root failure must not prevent an independently provable physical cleanup from releasing its dispatch/preparation charge; retain only the remaining unknown token/frame/result receipts. Stop/Task timeout/sibling cancellation revokes the token, cancels the actual call, joins accepted preparation/mint work, waits for registry terminal revocation so provisional payload is no longer table-owned, and retires only after proven cleanup. Unexpected revocation of an unreported live invocation is typed ownership loss, not a recoverable timeout. Closed callback/root/CPU/port ownership is a typed fatal condition; request cancellation and continue provable cleanup, retaining unknown receipts when proof fails. A joined preparation-only CPU panic proves no invocation was issued and may clean its revoked token, while a callback/port worker panic retains its exact unknown receipts. Never poll an already consumed failed JoinHandle again. Preserve the first diagnostic source through later cleanup errors. Token tombstone classification remains available after worker retirement.
+
+```text
+Registry owner       Structured actor       Retained callback worker       Lambda port
+  │ commit snapshot ───────▶│                         │                         │
+  │                        │ frame/result lease ────▶│ register + resolve mint │
+  │                        │                         │ bounded retained CPU    │
+  │                        │◀── typed Scheduled+ack ─│ one preparation         │
+  │                        │ commit/publish ── ack ─▶│                         │
+  │                        │                         │ dispatch permit + call ─▶│
+  │                        │◀── Started/Submitted ──│◀── actual report ───────│
+  │                        │                         │◀── independent Clean ──│
+  │                        │                         │ release physical permit │
+  │                        │                         │ await external callback │
+  │                        │◀── selected result ────│                         │
+  │                        │ driver/recovery/retire │ settle after all joins  │
+  │                        │ Stop/timeout ──────────▶│ revoke + cancel + join  │
+  │                        │ root/worker panic ─────▶│ retain unknown leases   │
+```
+
+Qualification requires real registered ASL executions with a controlled observed port, then actual Native consumption: early/late success and external failure, function failure after provisional success, captured heartbeat expiry/reset, timeout, Stop, Retry fresh token/old-token rejection, nested Parallel/Map cancellation, exact causal history and pre-issuance history failure, single-dispatch progress while callbacks wait, result/CPU/token quotas, resumed shutdown, worker/source failures and credential scans. Default unbound runtimes/registries remain rejecting. Keep public SendTask routing, ordinary handler-originated SDK callbacks, persistence and final image/platform gates explicitly incomplete until their consuming acceptance runs. Docker remains deferred.
+
+### 5.6 Real image SDK callbacks and independent Event worker (D96)
+
+Implementation/acceptance contract for task4.3/C01–C03 and5.3c, after D95/L10. The registered callback owner, public APIs and Native SDK consumers already exist; this slice qualifies their actual Docker composition. Preserve the existing token, timer, admission, history and cleanup contracts. Do not add another state-machine engine, callback registry, authentication scheme or implied broad SDK capability.
+
+**Source and independent worker.** Build a separately named callback image on the exact D94/D95 pinned Node24 base. The D96 bounded unstarted source reader verifies actual client-lambda, client-sfn and client-dynamodb3.1105.0 package metadata, removes its exact read-only/network-none container and preserves all eleven preceding sources. This is metadata, not callback execution. The image exports dispatcher and worker handlers; two Image functions select them through CMD. Constructors use default endpoint/credential providers, maxAttempts1 and D95's exact qualified SDK context. No endpoint/credential constructor override, npm installation, host credential lookup or arbitrary host mount is introduced.
+
+For late callback modes, dispatcher A invokes worker B with the real Lambda SDK, InvocationType=Event. Require actual HTTP202 acceptance, not worker completion. Forward the injected token only in that bounded invocation payload; keep it out of DynamoDB control rows. A then returns an intentionally ignored synchronous body. B remains in its own real active invocation while awaiting a caller-controlled gate, and sends the Step Functions callback after A's successful TaskSubmitted observation. The Lambda Event owner retains the accepted B work independently. This uses the documented [asynchronous queue/202 contract](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html) and [callback heartbeat activation after Lambda return](https://docs.aws.amazon.com/step-functions/latest/dg/connect-lambda.html), checked2026-10-30. No work needs to continue in A after its handler returns.
+
+```text
+ caller / ordinary SDK       workflow + callback owner       Image A       Event owner       Image B
+          │                           │                         │               │               │
+  1 Start ├──────────────────────────►│ mint scoped token       │               │               │
+          │                           ├─ real observed Invoke ─►│               │               │
+          │                           │                         ├─ SDK Event ──►│ retain B work │
+          │                           │                         │◄─ HTTP202 ────┤──────────────►│
+          │                           │◄─ A returns / Clean ────┤               │               │
+          │◄─ causal TaskSubmitted ───┤ release dispatch slot    │               │               │
+  2 gate ├───────────── local DynamoDB safe control row ──────────────────────────────────────►│
+          │                           │◄──────── signed SendTaskSuccess/Failure/Heartbeat ─────┤
+          │◄─ callback Task outcome ──┤                         │               │◄─ B completes─┤
+          │                           │                         │               │ join accepted │
+ Stop ───►│ revoke token + cancel A   │                         │               │ B independent │
+          │ confirm A pair absent; release B; B proves TaskTimedOut; join B; save/scan; audit all │
+```
+
+**Explicit fixture profile.** Reuse the ordinary Docker target and four-feature cohort. Add only its callback profile to the explicit SDK/service opt-in, keeping strict Lambda/Step Functions/DynamoDB signatures and the same valid server aliases. Use two environments, function memory256MiB each plus two64MiB relay charges, with lambdaDockerMemoryBytes805306368. D95's two SDK profiles retain capacity1. Set init20s/function timeout45s and one workflow dispatch slot; callback tokens2/tombstones64/commands8/workers1 match the existing Native constrained profile. Enable named snapshots for this profile. SDK bodies and gates share an original35s handler budget, individual sends at most4s, and an explicit abort/client/timer cleanup path. No transport/business retry or detached task is added.
+
+**Safe control channel.** Host SDKs create one local DynamoDB table before function deployment. Its bounded rows contain only nonce, role, actual request UUID, attempt0/1, phase, arithmetic, SDK versions, counters and SHA256(token). Gate rows contain caller-selected booleans and bind the case nonce plus attempt number, so a consumed first-attempt return grant cannot release a retry. Never store raw tokens in rows, function environment, output, causes or diagnostics. Validate payload shape, identifiers and collection/string/number bounds before SDK IO. A/B use the D95 endpoint/pair rather than another control listener. Cap the fixture at64 rows/2KiB per row,64 reported token hashes and16KiB report bytes. Retain the original token only in invocation-local memory and A's bounded previous-attempt memory for the retry oracle; compare token material with constant-time Node crypto. All error messages are fixed, and raw SDK errors/input are never printed.
+
+**C01 causal cases.** Use the existing independent callback case catalog for expected statuses/errors/arithmetic. Early success/failure calls the actual SDK while A remains gated: require RUNNING, Scheduled with redacted token and no Submitted before releasing A. An early success followed by A's fixed FunctionError must fail as CallbackInvocationFailure and retire A's pair. Late success uses B, requires A's actual request/version metadata in Submitted before releasing B, and returns callback-computed42 rather than A's ignored body. While B waits and the callback owns no physical dispatch permit, another workflow must compute42 through the already warm A using the one dispatch slot. Keep a slot available for both A/B; do not allocate an unrelated third function just for this check.
+
+**C02/C03 timer and generation cases.** Retry CallbackRetry once; require two A request UUIDs in the same warm environment, retry counts0/1, distinct token hashes and actual old-token Heartbeat→TaskTimedOut before the new callback. For heartbeat reset, A sends an Invoking heartbeat and remains gated longer than a3s interval while the parent stays RUNNING. Release A, observe Submitted, then enable B heartbeats; keep the parent RUNNING beyond another complete interval with at least four acknowledged heartbeats before success. Absolute Task timeout8s remains fixed while B continually heartbeats; require States.Timeout, then B's success attempt→TaskTimedOut. A no-heartbeat mode yields States.HeartbeatTimeout after successful A return, followed by the same precise stale-token rejection. Default Task timeout is60s/execution timeout120s; prewarm A/B before timed cases to isolate the timer contract from image initialization.
+
+For Stop, A accepts B's Event and remains in its own invocation. Observe both active pairs, Stop the parent with error Stopped, and require ABORTED/no Submitted. Prove A's exact pair is absent while B's pair remains; then release B and require its callback→TaskTimedOut before joining it. B is explicitly independent Event work and must not be counted as an A cleanup leak. Forged tokens produce InvalidToken, and duplicates/completed tokens produce TaskTimedOut through the actual image SDK. Retain existing Native/public wrong-scope tests; do not infer multi-account image authentication from this single-account fixture.
+
+**Evidence, archives and ownership.** Every case records safe actual A/B UUIDs and token hashes. The host independently checks contiguous history IDs/previous IDs, expected TaskSubmitted count and real request/version identity, null redacted Scheduled token, supported body-omission marker and exact terminal result/error. Each image also checks that its token is absent from actual SDK GetExecutionHistory. The host scans histories/logs and the saved archive independently by hashing bounded64-hex candidates and comparing with reported token hashes; it never needs a raw token. Limit the private saved generation to128 filesystem entries/64 regular files/depth8/4096-byte paths, compressed4MiB per file/16MiB total and plain16MiB per file/64MiB total; logs are at most1MiB. Cap candidate hashes at65,536 and known hashes at64, rejecting malformed hash inputs before IO. Scan zstd-decoded bytes for compressed entries and raw bytes for plain manifest data, with a single30s observation deadline and joined accepted decoder jobs even on expiry. Reject links/special files; never follow an archive path outside the private generation. Verify the two functions through the existing typed Lambda metadata reader and require every reported terminal execution ARN in the actual Step Functions metadata, so an empty/unrelated archive cannot pass. Include a deliberate known-token leak control to prove detection and cap/invalid-file controls.
+
+The hash observer must test every overlapping64-byte lowercase-hex window, including a token embedded in a longer hex run. Scan a capped complete decoded buffer or carry the final63 bytes across decoder chunks; never miss a split token or double-charge an already scanned window. Charge one aggregate65,536-candidate budget across all history, log and archive sources for that resource, carrying the host history count into the post-stop audit. Exhaustion rejects the run rather than stopping with a clean result. Controls include shifted/embedded tokens, a decoder-chunk split and exact/over aggregate caps across multiple sources.
+
+Set/read back reserved concurrency1 for both A/B before prewarming or accepting an Event. Keep functions, state machines and safe control rows until confirmed graceful snapshot save, so archive scans inspect real retained resources. Before save, positively observe every expected B terminal marker and then a successful reserved=1 worker probe; a probe alone cannot prove a queued Event was delivered. Reuse the existing image_sdk Server/child owner with an async post-stop audit hook; default Node/SDK consumers use a no-op wrapper. Preserve the original PID cutoff, always-join failure paths, server stop/audit/log checks and retained evidence on any failure. The hook may inspect a saved archive only after successful stop; no duplicated Runner or lifecycle implementation is allowed.
+
+**Delivery.** Freeze two exact ordinary resources before execution: test_should_execute_real_image_callbacks_before_and_after_lambda_response and test_should_enforce_image_callback_retry_heartbeat_timeouts_and_stop. Ordinary35→37/all68→70/eight suites. Split the catalog's four C01 modes and five timer/retry/Stop modes between them, with actual forged/duplicate checks alongside. Add explicit pinned image/fixture/focused Make targets and include the image in lambda-docker-fixtures; all full lanes preserve twelve actual source IDs. Run both focused/current full lanes, all existing required resources, standard/strict/Native/security/text gates and independent review with exact owned cleanup. IaC/server-in-container/native-reference/Desktop/rootless/final5.4 remain open. No image callback completion is inferred from D95's metadata or S3/DynamoDB acceptance.
diff --git a/specs/rustack-workflows-50-iac-design.md b/specs/rustack-workflows-50-iac-design.md
new file mode 100644
index 00000000..f7ae86d6
--- /dev/null
+++ b/specs/rustack-workflows-50-iac-design.md
@@ -0,0 +1,115 @@
+# Workflows 50: Pulumi Image-Lambda Consumer Design
+
+Status: Implemented and qualified on the retained functional lanes; full M4 acceptance remains open · Updated: 2026-10-31 · Work item: D97 /5.3d
+
+## 1. Outcome and dependencies
+
+Qualify a normal Pulumi AWS provider's STANDARD StateMachine create, explicit refresh, in-place definition/tag update and destroy against the ordinary strict-auth Rustack binary. Independently execute the resulting definition through a real image Lambda before and after update. Existing callback/runtime/API semantics stay unchanged.
+
+Depends on D94's pinned Node image, D95's qualified function SDK environment, D96's retained SDK/server consumer and the [Pulumi process study](../docs/research/study-pulumi-process-ownership.md). The [survey](../docs/research/survey-stepfunctions-lambda-container-runtime.md) and [relay spike](../docs/research/spike-lambda-container-relay.md) retain the original image/network contracts. This slice closes the IaC consumer only; server-in-container, native-x86/reference, Desktop/rootless and final5.4 remain required.
+
+Use a dedicated managed Image Lambda as the IaC runner. Its handler launches the actual pinned CLI, language host and provider inside the already owned function PID namespace/cgroup. A separate pinned Node function supplies the target computation. Host tooling is the existing directly owned Python SDK child; it spawns no Pulumi process. This avoids assuming that Pulumi's independently grouped plugins share one host process group.
+
+## 2. Versions, image and provisioning
+
+Checked2026-10-30 through primary documentation and npm metadata:
+
+| Component | Required pin / source |
+|---|---|
+| Function base | Existing Node24 index `public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79` |
+| CLI and core SDK |3.273.0; [CLI documentation](https://www.pulumi.com/docs/install/) |
+| AWS provider/SDK |7.52.1; [StateMachine reference](https://www.pulumi.com/registry/packages/aws/api-docs/sfn/statemachine/) |
+| SDK npm integrity | `@pulumi/pulumi`: `sha512-Yh2k0Kry4u5LM730KUO5HZFnqHdlW9ypoQ8zgO0Tqam1G6urFXjIUTUaLxvWrdsm6gKCoyVS6CPdeOGcV+Msvg==`; `@pulumi/aws`: `sha512-EkiZJacWBqwxq+LLeiDA131OWaoFGAnPKKx8aCpcn6lWKyYNqdZIgUhY8OrHefYtirWL5rnabDuPJ9YuluTPQQ==` |
+| Private transitive security overrides | `glob`14.0.3 and `minimatch`11.0.3; source-locked CommonJS/Arborist/workspace/packlist/cancellation/amplification controls required on host and selected Linux image |
+| Runtime control client | Actual bundled DynamoDB3.1105.0 default-provider client, independently source/version checked |
+| Linux CLI SHA256 | arm64: `c2e1b600b37d9d84551259b6f391f5035e336dfe63c49412f22d855a91995ed5`; amd64 (`linux-x64` archive): `ec08f86671fd58f0a186540e1cee00066393beaf5c6716b0075f690919800432` |
+| Linux provider SHA256 | arm64: `1976366b71dc08d8827a04fbb8eaf50a0d1ec5757726e593b6d7c27e7636daf8`; amd64: `2e705824a2103dd6e3dc66744ba2d55cad55d665476b3ffcd8ce024cf4cab081` |
+| Upstream lifecycle | `vendors/pulumi` @ `874c77a73039cf013d6a685a15293843de2b0e01` |
+
+The official CLI [checksum manifest](https://get.pulumi.com/releases/sdk/pulumi-3.273.0-checksums.txt) supplies its SHA256 pins. Provider archive SHA256 values come from the official [release API asset digests](https://api.github.com/repos/pulumi/pulumi-aws/releases/tags/v7.52.1); its [legacy checksum file](https://github.com/pulumi/pulumi-aws/releases/download/v7.52.1/pulumi-aws_7.52.1_checksums.txt) contains SHA1 entries and is not substituted for those SHA256 pins. That checksum file itself matches the release API's published SHA256 `8be82022258a646741d4558d2117ac07e462d4b637e034498a22d089035065cf`. Source-only metadata reads are not image execution.
+
+The initial unmodified Node lock reports20 moderate transitive findings, rooted in [glob cancellation](https://github.com/advisories/GHSA-3g3m-2fjr-6pw4) and [minimatch amplification](https://github.com/advisories/GHSA-g3hv-75wg-m249). Use the two exact patched overrides only in this private fixture. Require a zero-finding npm audit, real dependency-graph/workspace/packlist compatibility, default CommonJS exports and owned-worker regression controls, then the complete actual CLI lifecycle. This does not claim compatibility for arbitrary external SDK projects or suppress advisories. Preserve the original audit/lock as development evidence.
+
+Add a separately tagged `rustack-pulumi:<selected-architecture>` image. Build only for that selected daemon's Linux architecture. Retain the official base, required Linux CLI/language binaries, the exact AWS plugin and lockfile-resolved Node dependencies in the image; no runtime download/install. Use published official checksums for CLI/plugin artifacts and npm lockfile integrity; reject missing/mismatched artifacts before executable use. Network downloads have explicit time/byte caps:512MiB per archive,2GiB expanded/tool archive,4,096 members,512-byte member paths, no link/special/traversal extraction. Extract only the required tool roots; do not invoke a downloaded installer shell. Record actual binary/package hashes in a small image provenance file and compare runtime versions/hashes during real invocation. The final unpacked fixture image must be≤4GiB.
+
+Make owns provisioning and test entry points. `lambda-pulumi-fixture-image` reuses the existing explicit immutable Node source provisioner and builder; `test-workflows-iac-fixture` runs program/protocol/privacy controls without Docker; `test-workflows-iac-docker` executes the two exact actual resources. Add these to the sequential complete fixture/resource gate. No global Pulumi CLI, plugin, npm project, cloud login or existing user state is changed. Keep preceding fixture images and code artifacts intact.
+
+Host dependency installation locks the single actual installation root independently of any supported npm-cache override; validate private empty config files even on a cache hit. A two-cache contention control must observe the second real flock blocking while the first install is held. Tool-cache reuse requires the exact directory/file allowlist (three binaries plus manifest), source-derived binary hashes, owner/modes, no links/specials/extras and total selected-tool bytes≤2GiB. Derive expected binary hashes from checksum-verified archives rather than trusting a self-declared cached manifest. The provider archive's exact zero-sized `.`/`./` directory record is a permitted no-op; traversal or other dot-segment spellings remain invalid. No host path is extracted from that root entry.
+
+Do not copy the host's plugin cache or Node modules into the Linux function. Build/install under the selected Linux architecture with scripts disabled for locked npm dependencies. Resolve any build requirement through a pinned explicit step, never an unrecorded postinstall. The prior observed global CLI3.245.0 is not this consumer's toolchain.
+
+## 3. Runtime composition and limits
+
+```text
+ SDK host             controller workflow       managed tool Lambda       target workflow / Node Lambda
+    │                         │                         │                              │
+ 1  ├─ Start controller ─────►│─ real observed Invoke ─►│ CLI + language + provider     │
+    │                         │                         ├─ Create target via SFN API ──►│
+    │◄─ safe created-held row ┼─────────────────────────┤ provider still alive          │
+ 2  ├─ independently Start target / verify42 ─────────────────────────────────────────►│
+    ├─ grant stage via DDB ────────────────────────────►│ up completes / refresh        │
+    │◄─ updated-held row ─────┼─────────────────────────┤ same ARN, new definition      │
+ 3  ├─ independently Start target / verify46 ─────────────────────────────────────────►│
+    ├─ grant stage ────────────────────────────────────►│ reject / recover / settle     │
+    │◄─ pre-destroy row ─────┼─────────────────────────┤ audit actual encrypted inputs │
+ 4  ├─ exact-CID reader exec ─────────────────────────►│ read actual tmpfs (no writes) │
+    │◄─ bounded TAR; Inspect same exec exit0 ──────────┤                              │
+    ├─ audit checkpoint+logs; grant destroy ────────────►│ destroy, then hold            │
+    ├─ verify API absence+post-destroy state; grant rm ►│ stack rm, then hold           │
+    ├─ verify active checkpoint absent; grant finish ►│ result / cleanup / return     │
+    │◄─ controller SUCCEEDED ┤◄─ invocation settled ────┤                              │
+    │                         │                         │                              │
+ fail/Stop while created-held ├─ cancel exact call ────►│ whole function+relay retire   │
+    │ confirm tool pair absent and business pair preserved; no CLI/PGID shortcut      │
+```
+
+Use a dedicated IaC test profile. Enable the existing four-service cohort and exact qualified SDK pair. Two function environments are required: tool memory1,024MiB plus64MiB relay, business256MiB plus64MiB relay, within lambdaDockerMemoryBytes1,610,612,736 (1,536MiB). Keep other profiles unchanged. Use two workflow dispatch slots because the controller holds one real invocation while the independent target needs the other. Keep the ordinary PID/nonroot/read-only/network policy and512MiB noexec temporary storage; preinstall executable tools in the read-only image. `GOMAXPROCS=1` and a small explicit Node worker pool constrain CLI/plugin threads within the existing function PID policy.
+
+The tool function has timeout720s, controller Task780s/execution840s, SDK consumer an original1,020s cutoff, per CLI90s and per DDB SDK send4s. Every CLI/phase wait clamps to the same remaining handler budget and fresh pre/post observation fences. Init remains20s. Missing readiness, source, socket, network or tool version fails rather than skips. Keep the default shared SDK consumer cutoff unchanged; only this named profile receives the larger explicitly bounded cutoff.
+
+## 4. Tool handler, program and control protocol
+
+Deploy the tool with `PackageType=Image` and a fixed handler CMD, and the business function with D94's `node.handler`. Set/read back reserved concurrency1 on each before prewarming. The immutable tool image registers the fixed UID/GID1000 as an unprivileged POSIX account; DIY backend locking and CurrentUser call os/user.Current and cannot assume a numeric Docker USER has a passwd entry. Child USER/LOGNAME are fixed to that account; HOME is not overridden. The tool handler validates≤8KiB payload, exact field allowlists, canonical nonce/request identities, function/machine/table names≤64/80/128 ASCII bytes, ARNs≤256 bytes and stage/value enums before IO. Use fresh per-invocation workspace `/tmp/iac-<actual-request-UUID>`; no shared mutable warm workspace.
+
+The handler's private PULUMI_HOME/backend/project/log paths stay under that workspace. Its plugin directory may reference only the verified read-only image plugin root. Set explicit local backend URL, a fresh per-invocation passphrase, disabled automatic plugin acquisition and ignored ambient plugins; clear cloud tokens/profile/session/role/proxy selectors. Do not change HOME. The program declares one explicit provider and one StateMachine with a fixed name/role/region/type and supported definition/tags. Use the provider's documented `sfn` endpoint override to the injected qualified origin, validation/metadata/account lookup skip flags and maxRetries0. Wrap both explicit provider credentials sourced from the injected function environment with `pulumi.secret`, so any checked/defaulted provider inputs are encrypted in local checkpoints. No credentials appear in argv or program source. [Provider inputs](https://www.pulumi.com/registry/packages/aws/api-docs/provider/), [backend/refresh semantics](https://www.pulumi.com/docs/iac/concepts/state-and-backends/), [CLI environment controls](https://www.pulumi.com/docs/iac/cli/environment-variables/).
+
+The ordinary provider declaration is real; do not mock RegisterResource/RPC or synthesize state files. An asynchronous output gate after the actual machine ARN resolves holds the first/second up operation while provider and language processes remain alive. Gate-bearing up commands require `--yes --skip-preview --non-interactive`; the program additionally checks `pulumi.runtime.isDryRun()` and never writes/reports/waits for a gate in a preview. Grant paths bind the invocation nonce, mode, command ordinal and stage; recovery ups have gating disabled so a previous grant cannot release another command. It writes a small private phase file; the tool handler reports a safe DDB row and waits for the corresponding host grant before releasing that program gate. Validate actual descendant CLI/language/provider PIDs and process groups through bounded `/proc` observations (at most256 entries,4KiB per observed file,32 reported PIDs); do not read process environments. A held row must prove the CLI and both actual plugin classes are still running before the host's Stop test.
+
+Control rows contain only nonce, actual invocation UUID, mode/stage, target ARN, revision/definition hashes, values, versions, bounded PID/group identities and booleans. No pair, passphrase, token, raw CLI output or checkpoint content goes into DDB. Bound≤64 rows/2KiB each; gates bind nonce+mode+stage and cannot release another run. The host uses existing real strict SDKs and safe polling. The SDK child spawns no OS subprocess.
+
+## 5. Positive lifecycle and independent oracle
+
+Use one actual local stack and at most20 CLI commands. The expected sequence is version, local login, stack init, initial up, no-change refresh, definition/tag update up, no-change refresh, three rejected unsupported ups each followed by a valid recovery up and a separate strict no-change settling up, destroy and stack removal. Use noninteractive explicit stack/cwd options and fixed argv; every up bypasses previews with --yes --skip-preview. No shell or hidden provider retries. Include a pure dry-run/known-ARN control proving no gate is reported or held. Capture stdout/stderr separately with≤1MiB each per command/16MiB aggregate and fixed redacted host errors. A direct-child failure retains its capped output privately through the same joined owner and log writer, including exit before a live gate; only fixed diagnostic categories/command labels/exit codes may cross the control channel. An unexpected direct-child failure or CLI exit code offers a bounded20s failure-audit gate while the invocation remains active; the independent observer may retain the capped raw log TAR in its existing private evidence root, without extracting host files or echoing raw CLI data. The observer then fails and the existing server owner physically retires the namespace. This diagnostic path never counts as positive lifecycle acceptance.
+
+At initial held up, the host describes the target, checks STANDARD/name/role/definition/tags and starts it with an independent literal expected42. The definition sends value21 to the real business function. After releasing up and explicit refresh, require unchanged ARN/revision/definition and successful no-change CLI status. Update value23 and tags in place; require same ARN, changed revision/exact intended definition and independent computed46 with actual request UUID, Node24 version and selected architecture. Refresh again without changes. Every independent Start must yield a distinct execution ARN and a new canonical business request UUID. Under the exact preserved business pair, require the literal warm counter sequence as well; the final report retains all distinct execution/request identities. A repeated valid46 result cannot count as a later invocation. Derive expectations from the fixed fixture contract, not engine/Pulumi-produced desired outputs.
+
+The provider performs a real ListStateMachineVersions read even for publish=false. Implement the scoped existing-machine empty-version inventory in [API design](./rustack-workflows-10-api-design.md#d97-unpublished-version-inventory-for-real-iac-consumers), without enabling publication, qualified ARNs or version mutations. The actual create failure identifies this dependency; do not mock or intercept that provider request.
+
+For unsupported fields, run actual provider updates with publish=true, valid AWS-shaped ALL logging+destination, and CUSTOMER_MANAGED_KMS_KEY+valid-shaped KMS ARN. Each CLI must fail for the modeled ValidationException; reject a generic crash, missing tool or local schema typo as acceptance. Independently verify the last valid target ARN/definition/revision/tags remain unchanged and executable. Restore the supported program with a real recovery up, then run a separate --expect-no-changes settling up before the next negative. Pulumi can persist failed desired inputs (observed publish=true) even while the service rejects the mutation. Recovery may legitimately issue a supported update and capture a new revision; independently require the same ARN/effective definition/role/tags and computed46 afterward. The failed request itself must still preserve the pre-failure revision; never conflate it with the later successful recovery. Each settling up must exit0 under --expect-no-changes and propose no resource change. The fixed catalog is18 CLI commands within the20-command cap. No KMS/log resource is provisioned and no unsupported field is silently discarded.
+
+Before destroy, hold the still-active tool invocation and independently audit the actual current post-up checkpoint while the provider resource and both encrypted credential inputs still exist. Bind its path/byte count/SHA256 to the separately observed phase. Do not substitute a backup, empty state or post-destroy checkpoint for this credential audit.
+
+Destroy must actually remove the target: independently wait for StateMachineDoesNotExist and absence from the supported list. After destroy but before stack removal, hold and independently audit a separate actual current checkpoint with the target absent, alongside the API absence. Pulumi V3 marks resources as omitempty: an absent resources collection is a valid empty post-destroy representation. Require checkpoint.stack=organization/rustack-iac/fixture and the actual latest deployment/manifest after these completed updates; a newly initialized/empty/unrelated checkpoint cannot qualify. Validate manifest version against the pinned CLI, its SHA256 magic and bounded timestamp shape. An empty collection is never proof of encrypted pre-destroy inputs. Keep the actual current path/hash, successful destroy command and independent API404 requirements unchanged. Then grant stack removal; require its actual successful command result and absence of the active checkpoint before granting finish. Backups are not active state, and historical files cannot prove current resource presence/absence. Keep pre-destroy, post-destroy and post-removal identities and expectations distinct. Do not equate a successful preview, missing resource declaration or stack-file deletion with API destroy. The controller is a separate fixture-owned machine and must not be miscounted as an undeleted Pulumi target.
+
+## 6. Failure ownership and privacy
+
+The second exact resource holds initial up after real target creation with actual CLI/language/provider processes alive. The host prewarms the business function, observes both exact function/relay pairs, then Stops the controller with a fixed error. Require ABORTED/Stopped, disappearance of the tool's exact pair and preservation of the business pair. The kernel container lifetime covers independently grouped plugins; CLI PID absence alone is insufficient. Invoke the business function again to prove continued health. Remove only the known fixture target/controller through SDK cleanup after physical retirement; this is compensating fixture cleanup, not a successful Pulumi destroy claim.
+
+The tool handler always joins each accepted CLI child through success/error/timeout and closes clients/timers. It may request graceful CLI cancellation and then terminate that CLI; the retained Lambda owner remains responsible for the entire function namespace. EOF/error in the SDK observer cannot release physical environment or invocation charges early. Reuse the existing image SDK Server/child owner; do not add an unowned host CLI or second runtime lifecycle implementation.
+
+At each pre-destroy, post-destroy and post-removal gate, the tool is still actively invoking. Independently read the exact tool function container's real backend and captured-log directories through a bounded independently initiated Docker exec of the pinned read-only evidence reader; verify original engine, exact full CID/source/owner/run/function labels and request-UUID path before each observation. The archive GET API cannot read the live tmpfs: Moby opens a separate mount view with fresh private tmpfs instances. Run only the image-pinned Node reader as UID/GID1000 with fixed argv (actual request UUID and backend/logs enum), no shell/stdin/privilege/extra mounts or credential arguments. It reads actual live files with no-follow regular-file/directory validation and emits a bounded USTAR stream; it neither synthesizes checkpoints nor parses desired resource output. The host initiates this independent observation after full CID/source/owner/run revalidation, verifies the multiplexed stream and joins the same exec through Inspect(Running=false, ExitCode=0) before accepting bytes. Unexpected EOF, timeout or uncertain exec outcome fails the SDK child and leaves whole-namespace retirement to the existing server owner; it cannot release physical charges early. Never extract host files. Cap TAR16MiB total/128 entries/depth8/path512 bytes, regular JSON/log files2MiB each; reject links/special/traversal/truncated/trailing/over-limit data. Scan complete bounded bytes and decoded JSON string values for both injected credential values with fixed errors. In the pre-destroy current checkpoint, require both actual encrypted provider-secret input fields without decrypting them; the host never needs the passphrase. Require real pre-destroy provider/checkpoint/log content, distinct post-destroy current state without the target and actual completed command records. After successful stack rm, explicitly require active-checkpoint absence; an empty/unrelated archive never substitutes for either earlier audit. Deliberate plaintext/escaped-secret and malformed/archive-cap controls prove the oracle.
+
+Finally grant tool return, join the controller invocation, stop/join the server and audit exact Docker resources/source IDs. Retain private evidence on any uncertainty; no global pruning or unrelated-container cleanup. Failed updates retain the last valid resource; an uncertain effect remains owned until its actual physical outcome is settled.
+
+## 7. Frozen inventory, automation and exit
+
+Add exactly these ignored ordinary resources before first actual execution:
+
+- `test_should_manage_a_real_image_workflow_through_pulumi_lifecycle`
+- `test_should_retire_the_pulumi_plugin_tree_after_controller_stop`
+
+Preserve all existing names:39 ordinary/72 total/eight suites. New image adds one source to D96's twelve, so each lane preserves thirteen actual IDs (the existing Node base is reused). Freeze the literal CLI/stage/provider-error catalog and image/tool hashes before qualifying execution. Keep native-arm64 VZ and emulated-amd64 QEMU functional scope explicit.
+
+Dependency order: (1) pinned study/design and independent preflight; (2) checksummed image/package provisioning and pure program/control/privacy tests; (3) constrained profile and shared owner cutoff; (4) positive and active-plugin Stop consumers with independent SDK/archive oracles; (5) frozen inventories/focused resources; (6) full72 on both lanes, complete standard/strict/Native/security/text gates and exact zero-remnant/thirteen-source/two-owned-empty-bridge postconditions; (7) independent final source/evidence review, guide/index reconciliation and coherent commit. New dependencies require appropriate npm audit plus existing cargo audit/deny; do not suppress advisories to make this fixture pass.
+
+The final78-source cohort passes the complete lifecycle, negatives, privacy and active-plugin Stop resources on both retained functional lanes. Both full72 gates, final standard/strict/Native/security gates and exact zero-remnant/thirteen-source/two-owned-bridge postconditions pass. W344–W364 are fixed and independently rechecked; see [final D97 qualification](./rustack-workflows-93-review.md#d97-final-qualification-and-exact-postconditions). Task5.3d is complete on those functional lanes. D96's committed qualification remains historical and unchanged. Server-in-container, native-x86/reference, Desktop/rootless and complete5.4 remain required; the full M0–M4 objective stays active.
diff --git a/specs/rustack-workflows-55-server-container-design.md b/specs/rustack-workflows-55-server-container-design.md
new file mode 100644
index 00000000..5d95837b
--- /dev/null
+++ b/specs/rustack-workflows-55-server-container-design.md
@@ -0,0 +1,127 @@
+# Workflows 55: Server-in-Container Qualification
+
+Status: Implemented and functionally qualified on retained ARM64/QEMU AMD64 lanes · Updated: 2026-10-31 · Work item: D98 /5.3e
+
+Current platform scope: [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation. Historical/native-x86 pending clauses do not impose new runner or test requirements; existing architecture support and completed evidence remain. Required arm64/Desktop/rootless/reference and other release gates still apply.
+
+## 1. Outcome and dependency
+
+Run the actual registered Rustack Linux executable inside a Docker container, using the same daemon as its managed Lambda function/relay pairs. Ordinary signed host clients must create/invoke image functions and execute nested ASL; a real handler must call the containerized Rustack S3/DynamoDB gateway through its ordinary SDK. Readiness and graceful shutdown retain the existing production provenance, endpoint, kernel and physical cleanup requirements. This consumes [D97](./rustack-workflows-50-iac-design.md) and the existing [runtime](./rustack-workflows-20-lambda-runtime-design.md), [operator configuration](./rustack-workflows-60-operations-design.md#11-docker-configuration) and [verification](./rustack-workflows-70-verification-plan.md) contracts.
+
+This is a qualification topology, with a purpose-built fixture image containing the actual CLI and an explicit lambda,stepfunctions,s3,dynamodb feature set. It does not certify the repository's default release Dockerfile, change default source features, introduce Docker-in-Docker or close the remaining native-x86/reference/Desktop/rootless/full-M4 requirements. No production executor, ASL or isolation relaxation is planned.
+
+## 2. Topology and trust boundaries
+
+```text
+┌─ host test root: retained ServerContainer owner ─────────────────────────┐
+│ private intent + env file │ bounded/joined Docker CLI │ SDK child owner │
+│ client socket: operator-selected local Unix endpoint                    │
+└──────────────┬───────────────────────────────┬────────────────────────────┘
+               │ management                   │ signed host SDK
+               ▼                              ▼ published loopback port
+┌─ selected Linux daemon / explicitly qualified user bridge ─────────────┐
+│ ┌─ Rustack server: immutable Linux image ID ──────────────────────────┐ │
+│ │ /rustack, UID/GID65532; supplemental socket GID; root read-only       │ │
+│ │ daemon-side socket → /run/rustack/docker.sock (server only)          │ │
+│ │ exact owned named volume → /data; DATA_DIR=/data/state              │ │
+│ │ ordinary gateway 0.0.0.0:4566; known unique server DNS name           │ │
+│ └────────────┬─────────────────────────▲───────────────────────────────┘ │
+│              │ existing DockerWire     │ default-provider S3/DDB SDK    │
+│              ▼                        │ http://<server-name>:4566/     │
+│ ┌─ normal managed Lambda environment ─┴──────────────────────────────┐ │
+│ │ relay + function, shared network namespace only; existing limits    │ │
+│ │ no server socket, data volume, host config mount or published port  │ │
+│ └────────────────────────────────────────────────────────────────────┘ │
+└───────────────────────────────────────────────────────────────────────┘
+```
+
+Distinguish three independent addresses: the host client's Unix socket; the socket bind source on the daemon's Linux filesystem; and the server DNS origin used by relay/function traffic. Docker [bind mounts use daemon-host paths](https://docs.docker.com/engine/storage/bind-mounts/), so a macOS client socket cannot be inferred to be a mountable VM path. A [user-defined bridge supplies container-name DNS](https://docs.docker.com/engine/network/drivers/bridge/); qualify that actual path through the production startup probe and handler SDK, without a guessed container IP or host-network fallback. Only the external SDK uses the independently observed loopback-published port.
+
+## 3. Explicit inputs and bounded artifacts
+
+Add WORKFLOWS_SERVER_IMAGE, WORKFLOWS_DOCKER_DAEMON_SOCKET and WORKFLOWS_DOCKER_DAEMON_SOCKET_GID to Make's discoverable inputs and pass them through the test environment. The existing client socket, selected/other daemon, architecture, bridge and image builder inputs remain required. The daemon-side socket and GID have no inferred client-path default; missing values fail the required gate before allocation. For the retained development VMs, read-only preflight observes /var/run/docker.sock, root:GID991, mode0660 on both; this observation is not portable configuration or native-x86 evidence.
+
+Validate the Linux bind source before CLI dispatch: absolute ASCII path,1..256 bytes, only letters/digits/underscore/hyphen/dot/slash, no empty/dot/parent components, NUL, commas, whitespace or trailing slash. GID is canonical decimal0..2147483647. Resolve the existing user bridge to its exact qualified full ID. Image references use the existing validated grammar; capture its nonempty Linux/selected-architecture content ID and use that ID with --pull=never. Names and labels derive only from one fresh UUID: server name rustack-server-<32 lowercase hex>, volume rustack-server-data-<same hex>, one exact task nonce and distinct server/server-data roles. Record the actual daemon UUID and source/network IDs before effects.
+
+Build the real CLI with the pinned Rust toolchain, existing GNU targets and cargo-zigbuild (observed0.23.4 in this development cohort), --locked --release --no-default-features --features lambda,stepfunctions,s3,dynamodb. For Zig0.16.0 only, a bounded linker argv adapter removes the exact obsolete -Wl,-O1 semantic no-op and execs the explicitly selected cargo-zigbuild zig cc in the same process. Preserve every other argument and diagnostic, Rust code optimization, target filters and libc support; reject unknown compatibility versions/targets/tool paths or oversized argv before execution. Four pure controls cover exact translation, unchanged effective options and boundaries. Record the selected cargo-zigbuild absolute path and observed version with build evidence; the adapter enforces its Zig compatibility version. No lint/diagnostic suppression or global Rust flag change is permitted. Reuse the already pinned provided.al2023 fixture base, whose libc supports these Linux artifacts; do not place a GNU-linked executable in scratch. The image replaces the Lambda entrypoint with /rustack, contains a fixed public YAML budget file and initializes /data ownership to65532:65532. It contains no credentials, operator config, socket, host executable or host data. The Make build context is the selected architecture's bounded fixture output, not the repository or node_modules. Capture source ID and architecture after build.
+
+The test owner creates its private host evidence root before allocation, mode0700, and an exclusive mode0600 env file consumed locally by Docker --env-file. No env-file bind mount is used. It sets only the explicit four services, DATA_DIR, fixed YAML path, strict service authentication, known local test authentication/SDK pair, Docker settings and the unique DNS gateway origin. Clear ambient AWS selectors through the existing qualified SDK policy. Keep raw credentials/env bodies out of diagnostics, report fields and command argv; retain the private env file only as owned evidence when cleanup is uncertain.
+
+SDK failure diagnostics contain only a fixed operation stage and an optional allowlisted local helper basename/canonical line number. Bound traceback traversal to32 frames. Never render exception messages, source text, locals, arbitrary filenames or response bodies. Rust independently validates this small diagnostic grammar before displaying it; pure controls reject forged origins and credential-bearing exceptions.
+
+## 4. Server policy and readiness
+
+The server uses UID/GID65532 plus the explicit supplemental socket GID, --cap-drop=ALL, no-new-privileges, read-only root,512MiB memory with equal memory+swap, one CPU,128 PIDs,64MiB noexec/nosuid/nodev temporary storage and a json-file log driver bounded to1MiB/one file. Its only writable persistent mount is the exact owned local named volume at /data; the only bind mount is the explicit socket, mounted read-only at /run/rustack/docker.sock. The image prepares that target path before the read-only root is used. No devices, host PID/network namespace, arbitrary bind, privileged mode, automatic removal or restart policy is allowed. A read-only socket mount still grants trusted server API control; it is never copied into a Lambda plan. Validate actual inspected user, groups, limits, security flags, mount types/sources/destinations, log limits, network ID and port bindings before accepting readiness.
+
+The server's constant YAML keeps startup180s/shutdown60s and the existing60s Docker management/start/cleanup observer budgets, two environments/two dispatches and768MiB aggregate Lambda memory. Existing function/relay policies and init20s apply. Set LAMBDA_DOCKER_CROSS_ARCHITECTURE=false: the actual Linux server executable and managed images must match the selected daemon architecture. Outer evidence still identifies the amd64 VM as QEMU emulation. Publish only127.0.0.1:<daemon-selected-port>:4566; validate a unique nonzero port and use it for the host SDK. The injected gateway remains http://<server-name>:4566/, including its distinct internal port.
+
+Require ordinary capabilities to report ready=true, Docker ready with the correct Linux platform and sdkGateway=true, and installed Step Functions integration support. A live PID or published port alone is not readiness. Startup's actual container endpoint/kernel probes must finish before ordinary ingress. Bound each health response by the existing helper and each observation by its original deadline.
+
+## 5. Ownership, failure and shutdown
+
+The retained test owner is separate from the existing host-process Server; a container must not masquerade as its Child. Reuse the unchanged Runner for direct Docker CLI processes and the existing Python PID barrier for the SDK child. Each command uses argv, explicit client socket, cleared environment, null stdin and independently drained32KiB stdout/stderr caps. Physically join every command, including timeout/forced termination, before interpreting its result. One600s original observation cutoff covers preparation, readiness and the SDK consumer; individual management CLI calls are bounded by60s, with the dedicated server-exit wait bounded by70s, and cannot reset the enclosing cutoff. Image builds/provisioning occur before this workload. Existing SDK480s and IaC1020s cutoffs remain unchanged.
+
+Persist intent before volume/container creation. Never retry an uncertain create or treat404/CLI death as proof that no daemon mutation occurred. Resolve known names only under the same engine, exact nonce/role labels, immutable source ID and expected volume; mismatched or unproven resources are retained, never adopted/deleted. Any forced/uncertain mutating command fails qualification and retains intent/evidence even if an immediate inventory is empty. All exercise errors flow through the same owner's cleanup, above the SDK future; assertions about the exercise occur only after cleanup results are collected.
+
+After readiness, independently read only owner.v1 and daemon.v1 from the actual /data/state/.rustack-lambda-docker directory through bounded Docker cp-to-stdout archives, not host extraction. Verify the inspected server has exactly the expected named volume at /data. Each archive is≤32KiB, contains one expected regular basename with UID/GID65532, mode0600 and exact56/72-byte body. Allow at most one≤1KiB PAX timing header with≤4 bounded mtime/atime/ctime decimal values; reject other metadata, links, special/directory/extra entries, alternate paths, duplicate records, malformed/truncated checksums and nonzero data after the archive terminator. Use the existing workspace tar0.4.46 as a test dependency with raw-entry iteration; do not unpack. Require owner magic RSDKOWN2 and daemon magic RSDKDMD1, their SHA256 checksums, nonnil UUIDs, matching owner UUID and the actual engine UUID. These records bind subsequent independent complete runtime-container/private-image inventories to this server; a similarly named unrelated container cannot establish ownership.
+
+On completion/error, send SIGTERM to the verified exact server container when still running and wait for its actual exit. A positive resource requires exit0; a negative startup requires its specified nonzero failure. Forced kill or cleanup uncertainty never qualifies. Use a separate180s cleanup cutoff, with at most70s for graceful server exit; remaining observations/removals share that original cleanup cutoff. Capture bounded logs privately and scan both raw bytes and bounded decoded JSON string tokens/keys for credential leakage without printing candidates. The aggregate64KiB log profile caps4096 tokens and64KiB decoded bytes; malformed/unclosed tokens fail closed. Before removing the server or volume, require the production shutdown to have left zero owner runtime containers/private aliases/volumes, with no repair performed to turn failure into success. The positive SDK leaves its warm function alive so shutdown must retire a real function/relay pair.
+
+Then re-inspect exact engine/container ID/name/nonce/source/mounts, remove only that stopped server, verify no remaining attachment to its exact named volume, revalidate volume name/local driver/labels and remove only that volume. Confirm both are absent and all captured operator source IDs unchanged. On unknown ownership, late effects, nonzero unexpected exit or unproven physical cleanup, fail and retain the directory/volume/known resources for diagnosis. No global prune, context change, VM restart or unrelated cleanup is allowed.
+
+## 6. Independent positive and negative oracles
+
+The positive ordinary signed boto3 consumer creates one real Node SDK image Lambda and S3/DynamoDB resources. Direct21 and23 calls return literal42/46 with warm counters1/2; independently read each exact object body and consistent DynamoDB result. A parent uses states:startExecution.sync:2 to await a child containing optimized Lambda invocation with25; require literal50/counter3, a new child execution ARN, the JSON Output distinction and causal successful histories. Validate actual SDK versions against the pinned3.1105.0 fixtures. Keep the exact function/relay IDs warm across calls; independently inspect authoritative environment injection to require the literal DNS origin, strict explicit local credentials, cleared conflicting selectors and no credentials in the relay. Inspect both managed containers to reject any server socket/data bind or published Runtime API. Delete workflow/data test resources but leave the warm function for server shutdown. Report only fixed cases, versions, counts and validated IDs/booleans.
+
+The child has one optimized Lambda Task with Parameters.FunctionName fixed to that function, Payload.$=$, OutputPath=$.Payload, Task timeout60s and execution timeout90s. The parent has one states:startExecution.sync:2 Task with the fixed child ARN, Input.$=$, OutputPath=$.Output, Task timeout90s and execution timeout120s. Its third SDK event uses key=third, value25 and mode=roundtrip. The final parent/child JSON outputs must contain computed50/counter3, not an encoded JSON string; verify the parent Submitted history references the actual child ARN and the documented causal ordering. All three independent S3 object bodies must equal the literal rustack-sdk:<input>:<double> and DynamoDB numeric results42/46/50. Remove their objects before bucket deletion.
+
+The negative resource configures the same valid server name but closed internal port9 as its gateway. Require production endpoint qualification to reject before ordinary readiness, the expected static startup diagnostic and nonzero server exit. An arbitrary early image/socket/config failure cannot substitute. After that verified exit, capture and validate the same actual owner.v1/daemon.v1 archives from the exact inspected persistent volume before any owner-scoped inventory or server/volume removal. Positive capture follows readiness; this negative capture follows its expected exit. Missing, malformed or unbound records fail and retain the volume/server/evidence, even if a broad inventory is empty. Verify all probe/runtime resources retire, then perform the same exact server/volume/source postconditions. Missing infrastructure fails; neither resource may skip.
+
+Pure controls exercise invalid socket/GID input before dispatch; immutable server/mount/label/port-policy mismatches; matching record archives; wrong archive path/type/owner/mode/size/checksum/UUID/engine, duplicate/extra entries, bounded optional timing metadata and trailing concatenated data. Client-oracle controls reject wrong literal computations/counters, changed warm IDs and a host-published origin substituted for the internal DNS origin. Reuse existing real Runner reap/PID controls instead of duplicating them.
+
+The independent container metadata reader compares each container's actual Image ID directly with its pre-captured source ID. Config.Image is an invocation reference, and the relay uses an immutable source reference rather than an owner-private image alias. Do not widen the existing private-alias image inspection boundary to make this check pass.
+
+## 7. Build order and exit gates
+
+1. Polish/review this design, source references and task5.3e ledger; no server-container resources run at the design checkpoint.
+2. Add bounded server fixture image/Make provisioning and pure identity/policy/oracle controls. Reuse existing Runner/metadata/SDK patterns and tar workspace dependency; no new runtime dependency.
+3. Implement the retained server-container owner, actual startup/identity binding, both ordinary consumers and always-joined exact cleanup. Prove all failures remain failures.
+4. Freeze two exact ignored ordinary names before first execution: test_should_execute_image_sdk_and_nested_asl_from_a_server_container; test_should_refuse_unreachable_server_container_gateway_and_join_startup_cleanup. Preserve all existing names:41 ordinary/74 total/eight suites. Add discoverable test-workflows-server-fixture and test-workflows-server-docker targets and include provisioning/controls in the complete Docker gate.
+5. Run both focused resources and all74 full resources on both retained engines under the final source cohort. Preserve fourteen actual source IDs per engine: D97's thirteen plus the server image; capture actual build exports and unchanged prebuild references. Reconcile the full Make footer with actual SDK/IaC status while this consuming gate changes; do not rewrite D97 evidence.
+6. Run complete standard/strict/Native/security/text gates and independent source/evidence review. Prove zero all-state containers/volumes/private/test/pull references, all fourteen source IDs preserved and removal of only the two exact task-owned empty bridges.
+7. Reconcile English guide/index/roadmap/capabilities and commit task5.3e. It closes server-in-container functional acceptance on the recorded lanes only. Native-x86, reference image/pure performance, Desktop/rootless and complete5.4 stay required.
+
+## 7.1. Rootless data-volume transfer (D106)
+
+The D104 rootless diagnostic exposes a Docker archive limitation: `docker cp` against the actual server tries to remount its read-only daemon socket and fails EPERM. The main server and socket policy must remain unchanged. An independently inspected, never-started data-transfer container provides archive access to the same exact named data volume without a socket mount. The actual experiment reads both checksummed identity records with UID/GID65532/mode0600; the exact stopped server/helper/volume are subsequently removed without force after engine/label/source/record affiliation checks. Preserve this as a failed original resource plus explicit recovery, not a successful server case.
+
+```text
+ retained Owner → validated exact server-data volume
+       │                      │
+       ├─ actual server       └─ temporary data-transfer container
+       │  read-only socket       created only; NEVER start/exec
+       │  unchanged lifecycle    no socket / no network / nonroot
+       │                         archive GET identity or PUT/GET config
+       └─ retained intent ← exact inspected helper removal + absence
+```
+
+Use this transport consistently on both supported daemon drivers, avoiding a failed-copy fallback that could hide an ambiguous write. Each operation creates an exclusive generated helper name and durable parent-nonce/engine/source/volume/purpose intent before IO. Capture the full returned container ID separately. Inspect exact ID/name/source, UID/GID65532, the three parent ownership labels with role=data-transfer, created/nonrunning/PID0 state, read-only root, no privilege/capability additions, no-new-privileges, no restart/healthcheck, network none, no ports/binds/devices/volumes-from, and exactly one read/write named-volume mount at/data. No socket or credentials are passed. Bound metadata to the existing strict CLI decoder and all IO to the retained absolute operation cutoff. Resource metadata uses32MiB/no swap,0.1 CPU and16 PIDs; the helper never executes.
+
+Identity reads are the two fixed existing owner.v1/daemon.v1 paths, preserving the existing bounded tar/checksum/UID/GID/mode/engine oracle. Release configuration uses the existing fixed public bytes and explicit CopyUIDGID behavior, then independently reads/validates the resulting UID/GID/mode/content. No shell, arbitrary path or mount access is accepted.
+
+After the archive operation, inspect the same never-started helper again, remove only its captured ID without force and prove absence before returning. Attempt exact cleanup on an operation error as well. If create/delete reply, inspection, identity or cleanup is uncertain, retain the intent/ID and parent uncertainty; do not start the server, delete its data volume or claim clean qualification. Configuration writes remain uncertain until their complete existing content/metadata oracle and evidence receipt commit. The original server shutdown/namespace/source audit remains unchanged and runs only after helper settlement.
+
+Controls must reject substituted helper ID/image/name/labels/user/state, extra socket/bind/network/mount/port/device/privilege and incorrect volume flags; actual server/release positive and unreachable-gateway cases must pass on rootless and the retained rootful lane. This changes test/qualification transport only, not the production Lambda archive or user API. D105's CPU normalization and the full rootless79-resource exit remain independent requirements.
+
+## 8. Sources
+
+- Docker [container run options](https://docs.docker.com/reference/cli/docker/container/run/) for explicit env files, supplemental groups, resource/security/network policy and publishing.
+- Existing [LocalStack container/CI study](../docs/research/localstack-container-ci-research.md) for the separate server-container topology; it is prior art, not Rustack execution evidence.
+- Pinned Moby [archive filesystem ownership](../vendors/moby/daemon/archive_unix.go) and [archive header construction](../vendors/moby/pkg/archive/archive.go); persistent volume records differ from D97's live tmpfs observer.
+- [tar0.4.46 raw entry API](https://docs.rs/tar/0.4.46/tar/struct.Entries.html#method.raw), verified current on2026-10-31; it already exists in workspace dependencies. Bound input before parsing and never extract.
+
+## 9. Executed qualification
+
+Both focused owners and both complete74-resource owners join0 under the same103-source cohort. Each full gate passes535 Rust cases/31 summaries and executes every required name exactly once; each focused gate passes463/25 and its two exact names once. Standard9, workspace4,217/4,354, strict boundaries1,969, complete Native3,078 and fresh audit/deny pass. The actual SDK computes42/46/50 with warm counters1..3; closed-port startup rejection and clean production shutdown pass. Exact26-command postconditions prove zero all-state containers/volumes/private references, fourteen preserved source IDs per engine and removal of only the two task-owned empty bridges. See [final D98 qualification](./rustack-workflows-93-review.md#d98-final-qualification-and-exact-postconditions).
+
+W365–W370 and W376–W377 are fixed and independently rechecked. The three failed development owners/source cohorts/private evidence remain intact. The root release Dockerfile/Action/promotion findings W371–W375 are open for5.4, alongside native-x86/reference/Desktop/rootless and remaining performance/load requirements. No default-image or complete M4 qualification follows from this fixture.
diff --git a/specs/rustack-workflows-56-release-image-design.md b/specs/rustack-workflows-56-release-image-design.md
new file mode 100644
index 00000000..9065a786
--- /dev/null
+++ b/specs/rustack-workflows-56-release-image-design.md
@@ -0,0 +1,163 @@
+# Workflows 56: Release Image and Action Qualification
+
+Status: Task5.4a functionally qualified; executed evidence below · Updated: 2026-10-31 · Work item: D99 /5.4a
+
+## 1. Outcome, dependencies and remaining release work
+
+D99 consumes committed [D98](./rustack-workflows-55-server-container-design.md) (658ad61). Build the actual root Dockerfile for Linux arm64 and amd64; qualify its unchanged final image through the same real signed handler SDK/nested-ASL and startup-rejection consumers. Close release findings W371/W372/W374/W375 from [the canonical backlog](./rustack-workflows-93-review.md#release-packaging-backlog-for-task54). Preserve D98 artifacts and the source Cargo feature default. Acceptance comes from the actual root images and their required artifact/runtime consumers; see the executed evidence below.
+
+The Docker distribution will compile Step Functions by default alongside all currently default-enabled services. The ordinary source build keeps its existing explicit stepfunctions feature; documentation must distinguish these two build profiles. Execution still requires the existing explicit Lambda executor configuration and real startup probes. Compiling a service never implies a ready Docker backend.
+
+This is task5.4a, not the complete M4 exit. W373's same-commit/exact-image publication gate depends on the final platform/performance manifest and remains required in5.4b. D100 waives further Linux x86_64 validation; required arm64/reference/Desktop/rootless and remaining performance/load rows stay required. No image upload, remote workflow execution, git push, tag, global prune, context change or VM restart is authorized by this local qualification task.
+
+## 2. Source build and final image contract
+
+The root Dockerfile must copy patches/ before Cargo resolution, retaining the source-identical squib-loader security overlay. Align its official Rust builder version with rust-toolchain.toml (1.99.1 at this checkpoint). Keep --locked, Rust2024 and musl targets. Build the selected architecture's normal default CLI plus --features stepfunctions; do not silently add Step Functions to apps/rustack/Cargo.toml's source defaults or remove the security patch to make the build pass.
+
+Retain scratch, CA roots, /rustack entrypoint, UID/GID65532, /data working directory, port4566 and the actual --health-check image command. Prepare /data mode0700/owner65532 and /tmp mode1777. Set ownership in the builder and copy the complete /runtime/ contents into final / as nested entries: copying each directory to a newly created top-level destination can reset that destination to0755. Verify the actual exported layer metadata, not only builder RUN permissions. Prepare the fixed /run/rustack/docker.sock placeholder in the builder and copy its parent tree into scratch before read-only execution. The only daemon socket remains an operator-supplied runtime mount, never an image layer. Do not bake test credentials, qualification YAML, a Docker client/daemon, user code or host executables into the release image. Exclude local env files, dependency/Python/Pulumi caches and Finder metadata from context without dropping required package sources/security patches. Limit source build jobs to default2, explicitly selectable1..8, for the retained VM memory budgets; record this build argument.
+
+Record the selected builder manifest/compiler/target, actual image ID/platform and source revision. CI version updates in touched workflows must use current official releases with reviewed immutable source references; no remote CI result or publication is inferred from local YAML validation. Existing dedicated GNU fixture and relay/function sources remain required regression inputs.
+
+Add discoverable Make variables WORKFLOWS_RELEASE_IMAGE (default rustack/workflows-release:integration-<arch>) and targets lambda-workflows-release-image, test-workflows-release-fixture and test-workflows-release-docker. Build with the already explicit selected Unix daemon/builder and --platform linux/<arch>, load locally and disable build provenance wrapping for the functional fixture cohort. The root Dockerfile remains the production recipe; do not replace its build stage with a host-prebuilt binary or test-only alternate Dockerfile. Builds precede runtime timing.
+
+## 3. Reuse the retained server owner with an explicit image profile
+
+Use a closed Fixture/Release profile selected by the Rust test, not arbitrary caller paths or shell fragments. Fixture selects the existing source variable/configuration; Release selects RUSTACK_RELEASE_IMAGE and the root-image contract. Keep all [D98](./rustack-workflows-55-server-container-design.md#5-ownership-failure-and-shutdown) budgets, directory/engine/nonce ownership, actual source pinning, CLI/Python PID joining, private env-file input, socket/GID/mount policy, independent identities, error retention and exact cleanup. No new Runner or process supervisor is needed.
+
+```text
+┌─ Make build / immutable-ID artifact gate ──────────────────────────────┐
+│ same engine → bounded save → graph/hash/ELF/exact filesystem validation │
+│ inherited kernel file cap; failure retains archive before runtime work │
+└───────────────────────┬───────────────────────────────────────────────┘
+                        ▼
+┌─ retained host owner ───────────────────────────────────────────────────┐
+│ explicit Fixture / Release profile                                     │
+│ intent → owned volume → exact created server ID                         │
+│ Release only: public YAML → bounded Docker cp → read-back verification   │
+│ private env file → start → real readiness / expected rejection           │
+└───────────────────────┬─────────────────────────────────────────────────┘
+                        ▼
+┌─ actual root-Dockerfile scratch image ───────────────────────────────────┐
+│ /rustack + CA roots; UID65532; built-in --health-check retained           │
+│ socket bind only + exact /data volume; read-only root; D98 limits         │
+│ /data/qualification.yaml (public) → /data/state (private owner records)   │
+│ internal DNS gateway ↔ normal relay/function pair                        │
+└───────────────────────┬─────────────────────────────────────────────────┘
+                        ▼
+ SDK42/46 → parent .sync:2 → child Lambda50 → leave exact warm pair
+                        ▼
+ server TERM/wait → verify runtime retirement → remove exact server/volume
+```
+
+### 3.1 Public configuration inside the existing volume
+
+The release image does not contain the fixture YAML. After exact server creation/inspection and before start, create a separate exclusive public YAML file under the private host root (mode0644, at most4096 bytes, credentials absent). Its contents are the existing fixed D98 budget profile. Use direct argv docker cp --archive <that-file> <exact-id>:/data/qualification.yaml; no stdin pipe, tar extraction, extra bind mount or change to Runner. Mark the mutation uncertain before dispatch and clear only after successful joined reply plus independent read-back verification. Never retry an uncertain copy.
+
+Read back only that fixed basename through the existing bounded32KiB raw archive profile. Require one regular file, exact original bytes, UID/GID65532, mode0644, expected target volume affiliation, bounded timing PAX metadata and no extra/trailing entries. The original default-copy/root-ownership assumption failed on the actual engine: the default preserved the host501:20 archive owner. The explicit archive flag selects Moby copyUIDGID=true, whose tarCopyOptions derives ChownOpts from the independently validated numeric Config.User65532:65532. Require that exact destination ownership and0644 readability; do not accept arbitrary owner alternatives. Add a control requiring the actual copy argv flag, and reject root/host/wrong UID or GID in archive controls. Do not chmod the private env file to make it readable or put credentials into this public configuration. Set only the Release profile's RUSTACK_CONFIG=/data/qualification.yaml; DATA_DIR remains /data/state. Capture this intent and copy receipt privately before starting the server. Copy/read-back/schema failure fails qualification and retains uncertain authority/evidence.
+
+### 3.2 Image health and readiness
+
+Independently project/validate the selected source image's Config.User, WorkingDir, Entrypoint, Cmd and Healthcheck. Fixture retains its exact NONE health command. Release requires the exact exec-form [CMD,/rustack,--health-check], interval2s, timeout4s, start period1s and retries3, with no shell command or alternate executable. Keep the release healthcheck enabled in docker create; do not override it to mimic the fixture.
+
+Release positive readiness requires both normal production capabilities and actual Docker health=healthy before the original180s readiness cutoff. An earlier unhealthy probe during real initialization is not successful readiness and does not reset that cutoff. The closed-port negative path still requires the precise production endpoint diagnostic/nonzero exit and persisted identity proof; it must never advertise ready. Preserve normal cleanup's non-OOM/non-dead/expected-exit checks and join health/server termination through the daemon's actual stopped state.
+
+The signed SDK program, literal computations, independent S3/DynamoDB verification, nested parent/child history, warm IDs, no-socket/data leakage checks and error redaction remain shared with D98. Profile selection must not weaken their assertions.
+
+### 3.3 Required actual image artifact gate (W391)
+
+After every lambda-workflows-release-image build, Make invokes test-workflows-release-image on that selected local engine/reference; the latter can also inspect an already built image. Use a Python-standard-library fixture verifier under tests/workflows, reusing the tested Action Runner for every bounded direct CLI child. This adds no runtime container, mutable image alias, manifest resource or second process supervisor. Keep Docker76/Native26/Action1 unchanged. The release-fixture target also runs positive/adversarial archive controls.
+
+Validate explicit arm64/amd64, a bounded local Unix endpoint, a non-option image reference and the selected WORKFLOWS_DOCKER_BIN (literal docker or bounded absolute executable path) before children. Start the original deadline before local filesystem observations. Capture the canonical daemon UUID; fence each operation on that endpoint, resolve the tag once to its immutable full image ID and save that ID with docker image save --output into a fresh0700 host root. Bound image metadata32KiB/strings4096/depth8, declared image size64MiB, saved archive128MiB (enforced before CLI dispatch through an inherited POSIX RLIMIT_FSIZE hard/soft cap, retaining any stricter inherited cap), at most128 outer members/eight layers, total expanded layer bytes256MiB and binary128MiB. CLI caps are info5s, inspect10s, save120s under one180s original cutoff; Runner retains its bounded pipes/TERM/KILL/physical-join behavior. An original POSIX alarm bounds local observations too; tighten the remaining post-save parse/report phase to10s without extending that original cutoff. Parent interruption follows the same retirement contract. Failure retains private evidence and is never accepted; no daemon runtime resource requires cleanup.
+
+Before normalized tarfile iteration, enumerate every physical512-byte TAR header using bounded offsets and checksum-checked header decoding. Count metadata headers too; reject GNU longname/longlink/sparse/global-PAX and chained local metadata. Allow only one≤1024-byte local timing PAX immediately before its member, with≤3 unique mtime/atime/ctime keys and≤64-byte decimal timestamp values. Validate sizes, padding, canonical names and final zero terminators before normalized parsing; normalized member identities must match the raw table. Decode one bounded manifest.json and config, permit validated zero-size directories and bounded regular files only; reject duplicate/unsafe/oversized members, links/devices/FIFOs/other types, archive truncation and nonzero trailing material; never extract. Support bounded gzip or uncompressed saved layers, verify all uncompressed diff_ids and content-addressed blobs, and bind the saved graph to the captured config/OCI-manifest image ID. Preserve only the exact scratch filesystem: /rustack, CA root ancestors/bundle, /data, /tmp, /run and fixed socket ancestors/placeholder. Require data65532:65532/0700, tmp65532:65532/1777, runroot0:0/0555, nested run/rustack0:0/0555 and empty socket0:0/0444. The actual ELF must be64-bit/little-endian, match the selected Linux machine and contain no PT_INTERP. Require the same numeric user, working directory, entrypoint, absent Cmd/Volumes and exact image health contract as the runtime profile. Accept only Docker's fixed Linux PATH plus the three declared public image environment values; an implicit PATH is expected, not a leaked executable. Record hashes/identity/metadata under the private root. Final qualification independently binds these accepted artifact image IDs to the full gate's named build exports.
+
+Controls require a valid graph for each machine and gzip/plain layers, then reject wrong ownership/mode/tree, architecture/interpreter, source/config/layer digest substitution, changed health/environment, links/duplicate/truncated/trailing archives and bounded decompression failures, including truncated gzip normalized to a fixed error. A real child inheriting a small test file limit must prove writes cannot exceed it; post-save fstat alone is insufficient. This audits the artifact actually consumed by Docker; builder RUN metadata alone cannot qualify it.
+
+## 4. Composite Action input and readiness boundary
+
+Keep the existing composite Action interface/defaults and caller-owned healthy container lifecycle. Docker image compilation adds Step Functions; add a stepfunctions-skip-auth boolean matching the existing service-specific convention and set STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION explicitly. An absent auth pair omits both server credential variables and their provider; enabled service skip-auth flags still govern. Reject an absent pair with an enabled strict flag before effects. The Action does not implicitly mount a daemon socket or opt a caller into code execution. Its default health/smoke path qualifies pure Step Functions; the separate release-container consumers qualify Docker Lambda.
+
+All inputs cross into shell only through named step env entries. No ${{ inputs.* }} expression may appear in any run body. Quoted shell expansion is required; never use eval, shell-constructed command strings, unquoted arithmetic input, arbitrary environment names or a caller-selected registry/command. Validate every input in one first step before image lookup/pull, Docker allocation, outputs or exported environment mutation.
+
+| Input | Boundary |
+|---|---|
+| image-tag | Docker tag grammar [A-Za-z0-9_][A-Za-z0-9_.-]{0,127}; fixed ghcr.io/tyrchen/rustack repository |
+| port | canonical ASCII decimal1..65535; no leading zeros/sign/whitespace |
+| wait-timeout | canonical decimal1..300 seconds; readiness budget only |
+| default-region | exactly lowercase [a-z0-9][a-z0-9-]{0,63}, matching production settings; uppercase rejects before effects |
+| log-level | exactly error/warn/info/debug/trace |
+| all skip-auth flags; persistence | exactly true/false |
+| services | empty or comma-separated supported service names, no whitespace/duplicates/empty members; max512 bytes/32 members; include stepfunctions |
+| access-key / secret-key | both absent or both present; printable ASCII, each≤512 bytes, no control/CR/LF/NUL; values never rendered as shell source |
+
+Use one Python3-standard-library Action runtime module under tools/github-action/ (outside the apps/* Cargo workspace glob). The composite run body only invokes that fixed module through a quoted trusted action-path env value; all input expressions occur in the step env map. It validates ASCII bytes/domain invariants before any child, image lookup or runner output mutation. Set LC_ALL=C for CLI diagnostics; never render a candidate value, exception traceback, raw Docker/server log or command trace. Nonempty credentials are registered through GitHub's percent-escaped masking command only; they do not enter ordinary diagnostics. This single entrypoint replaces the old multi-step Bash command owner; it is not a second Runtime API supervisor or an external dependency. Do not introduce shell scripts or duplicate the Rust server Runner.
+
+Write Docker environment contents through a mode0600 file below an exclusive mode0700 RUNNER_TEMP child, with constant keys and bounded bytes (≤8KiB). Pass only its path with --env-file. Credentials never enter Docker argv, JSON intent or GITHUB_OUTPUT. Remove the input file after the physically joined run attempt, including failure; retain only nonsecret intent/identity evidence on uncertain effects. Export AWS/local endpoint/region/credential values through runner-owned GITHUB_ENV after successful readiness, with no multi-line injection possible. Open runner output paths with no-follow/nonblocking flags before checking their regular-file type so a FIFO cannot block handoff. Healthy service lifetime is explicitly handed to the caller through the validated full container-id output. Before that handoff the Action owns its created server and must attempt exact graceful cleanup on failure. Never force-remove, inspect/adopt a foreign existing name, or turn an ambiguous command into success.
+
+### 4.1 One bounded direct subprocess owner
+
+Capture one420s original launch cutoff after input validation. It covers local intent/env-file observations, daemon selection, image lookup/pull/resolution and Docker run; individual operations also have the following caps. Before dispatch and after every joined result, check the enclosing cutoff. No retry resets it. Readiness starts its separate validated wait-timeout cutoff immediately after the successful joined full-CID run reply; identity/publication checks consume that same readiness budget. Cleanup gets a separate90s cutoff. These budgets are compile-time constants, not new public tuning inputs.
+
+| Operation | Maximum observation |
+|---|---|
+| Resolve local Unix endpoint; same-daemon identity fence |5s each, enclosing cutoff still applies |
+| Image presence listing and projected image/container inspection |10s each |
+| Missing-image pull |300s, docker pull --quiet; lookup errors never mean absence |
+| docker run --detach |60s |
+| Health HTTP | min(3s, remaining readiness); connect≤min(2s, remaining) |
+| Cleanup TERM / final inspect / exact stopped-ID removal |10s each, cleanup cutoff |
+| Cleanup daemon wait |≤70s and remaining cleanup |
+
+Every child uses direct argv, null stdin, an isolated process group and independently drained bounded stdout/stderr (32KiB each; the health-body call alone allows64KiB stdout). Use one selector-driven helper in the Action runtime for all Docker/curl children. On deadline, output overflow, IO error or parent interruption: terminate that exact child group, allow≤1s grace, kill if necessary and physically wait/reap/drain/close within a further≤2s. Forced observation is always failure. A timed-out mutating Docker run may already have created a container: retain its pre-effect nonsecret intent and do not retry or delete by name. Actual controlled hung-child/descendant/flood cases must prove both pipes and processes are settled. No unbounded subprocess.run(...capture_output...) is permitted in the Action runtime. On Darwin an unreaped exited direct child can make group signal0 return EPERM. Reap only the owned direct child and independently retry group observation; do not reinterpret a persistent permission denial as proof of absence.
+
+Resolve Docker's effective configured endpoint read-only after input validation, honoring explicit DOCKER_CONTEXT over DOCKER_HOST and require a local Unix endpoint, not TCP/SSH/npipe. Pin the resolved endpoint explicitly with --host on every later command; do not switch contexts. The Action requires a trusted local Docker engine with its loopback-published ports visible to the runner; it does not support arbitrary forwarded remote daemons. Capture the canonical nonnil daemon UUID and recheck it before/after each requested operation on the same selected endpoint. Missing/ambiguous/changed metadata fails rather than falling back.
+
+Use an exact-reference bounded image listing to distinguish absence from CLI failure; only a successful empty listing permits one quiet pull. Then project the selected Linux image's full content ID/platform, and invoke the captured immutable ID rather than its mutable tag. Before run, write nonsecret intent with engine/source/expected name/port and a fresh UUID nonce. Add the exact nonce label at creation. The successfully returned64-lowercase-hex ID is recorded before further observations. A failed/ambiguous creation without that known identity never authorizes name-based inspection/removal.
+
+### 4.2 Readiness affiliation and failure cleanup
+
+Publish only127.0.0.1:<port>:4566 and preserve the http://localhost:<port> output contract. Every readiness iteration inspects only the returned full ID under the pinned daemon, requiring the exact image ID, nonce/name, running=true, dead=false, OOM=false, no restart policy and the exact unique4566/tcp→127.0.0.1:<port> publication. Require actual Docker health=healthy. Record StartedAt and ensure it is unchanged around the successful observation; never accept an exited/replaced/restarted producer or missing/foreign publication.
+
+Between those exact pre/post inspections, request the fixed http://127.0.0.1:<port>/_health/ready URL through bounded direct curl argv, with --disable first to ignore ambient curl configuration and a separate exact HTTP200 status projection. Require200 and structured ready=true with a nonempty≤32-entry services map whose bounded ASCII names have only running/disabled states, matching the installed CLI's readiness semantics. Bound JSON to64KiB, depth8,512 total members,256-byte keys/strings; reject duplicate keys and malformed/late responses before acceptance. HTTP200 alone, ready=false, an unrelated body, a dead owned CID or a different published port cannot qualify. Recheck actual identity/health/publication after the HTTP result and then the original monotonic cutoff. Sleep at most0.5s/remaining budget. The outer runner step timeout is separate and cannot substitute for these finite child/readiness contracts.
+
+On pre-handoff failure with a known verified CID, use only that same engine/full ID/source/nonce to request TERM, wait for actual exit and verify stopped/non-OOM/non-dead state before exact ID removal. Unexpected exit/forced command, changed identity, failed wait or uncertain mutation remains failure with retained intent/evidence; do not erase uncertainty because a later listing is empty. No volume or unrelated-container cleanup is performed. If output/env-file handoff fails, the server is still owned and this cleanup runs. On successful handoff, remove the private input/evidence root and leave the healthy exact container to the documented caller lifecycle.
+
+## 5. Meaningful verification and required resources
+
+Reuse the existing workspace YAML parser only as a test dependency edge (currently0.11.1; current upstream0.13.0 is observed, not silently substituted into production configuration). No new runtime parser/version change is needed to read trusted repository Action YAML. Bound the source to128KiB, one document,≤64 steps,≤128 env fields/step and≤16KiB per run body. Extract and execute the actual Action run block and its referenced real Python runtime in an isolated temporary root, with Docker/curl replaced by fixed controlled executables. A normal Rust contract test validates the actual YAML. A separate explicitly ignored Action process suite exports bounded run/env/default metadata under its private root, starts the real Python control suite through the existing independent Rust Runner, verifies its actual PID barrier and joins bounded capture under one180s cutoff. Failed/forced runs retain private reports and never qualify. The Python controls execute the actual body with an isolated environment/private cwd and the same bounded child helper; the independent Rust owner remains above that helper. The existing Rust Runner stays unchanged. Freeze the one Action suite in action-required-suites.json and verify its exact compiled ignored listing before execution, with positive/missing/renamed/extra/duplicate and cross-profile drift controls; this distinct action-process-controls profile does not add cases to Native26 or Docker76. Assert their argv/environment/output effects, not a rewritten copy of the Action logic.
+
+Controls must prove malicious tag/port/timeout/region/log/services/boolean inputs dispatch no Docker/curl command and create no injected marker/output/env record; printable credential metacharacters stay literal, never execute, never enter Docker argv or diagnostics; valid defaults/custom values export the correct endpoint and credentials; partial/oversized/multi-line credentials reject; a foreign existing name is not deleted; true bound readiness succeeds; missing/failed/late/ready=false/unrelated200 health, exited owned CID and wrong publication fail; known failure cleans only its exact stopped CID while unknown creation retains authority; hung/flooding child groups are killed and joined; the advertised timeout uses real elapsed seconds; all children/pipes are joined. Add a pure STANDARD Step Functions SDK/CLI computation and exact history assertion to the existing default Action CI consumer (MathAdd input21→42); a service-count check cannot prove compilation/execution. YAML/profile/context controls also prove patches present, toolchain alignment, Step Functions compilation, unchanged source defaults and correct final socket/data/health policy.
+
+Freeze the two new ordinary ignored resource names before execution:
+
+- test_should_execute_image_sdk_and_nested_asl_from_the_release_image
+- test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup
+
+The manifest becomes43 ordinary/76 total/eight suites; keep Native's26-resource inventory unchanged. Extend normal fixture provisioning and a focused target without bypassing any existing exact inventory. Require19 existing Python controls/12 existing Rust controls plus new focused policy/archive/Action controls; do not replace existing consumers with release-only variants. Both old GNU and new root-image resources run in the full gate. Existing journal corruption prerequisites must guarantee a changed field even when an original UUID byte is0xff; a random no-op must not masquerade as an invalid-state decoder failure. Use a fixed0xff owner boundary fixture plus a guaranteed different owner byte, preserving the remaining malformed canonical fields and production codec.
+
+## 6. Dependency-ordered implementation and exit (executed D99)
+
+1. Polish this design, phase ledger, key decision and verification contract; independently review before source changes. D98 is committed/frozen and must not be rerun or overwritten.
+2. Correct root build context/pin/profile/filesystem; implement Action env/validation/privacy/deadline changes and meaningful actual-body controls. Run targeted controls/strict lint first.
+3. Add the explicit release owner profile, public-config copy/read-back and exact image-health validation with adversarial controls. Preserve existing profile behavior and Runner.
+4. Build both actual root images; capture provenance/ELF/platform and actual sources. Retain every failed build/run as its original cohort; never repair failure evidence to green.
+5. Freeze a complete new source cohort,43/76/eight manifest and fifteen source identities per engine (the prior fourteen plus one actual root release image). Run both focused resources and every full76 resource on both retained engines.
+6. Run all standard Rust default/feature build/test/fmt/Clippy/rustdoc, strict boundaries, complete Native, fresh audit/deny and text checks on that same source. Independently review source/evidence; verify zero remnants and preserve all fifteen sources, removing only exact task-owned empty bridges.
+7. Reconcile English guide/capabilities/roadmap/current summaries and commit task5.4a. W371/W372/W374/W375 close only with actual acceptance. W373 and required arm64/reference/Desktop/rootless/remaining performance/load/full5.4 remain required under D100; no local image publication or push occurs.
+
+## 7. Sources and prior art
+
+- [D98 retained server owner](./rustack-workflows-55-server-container-design.md), [runtime ownership](./rustack-workflows-20-lambda-runtime-design.md), [operations](./rustack-workflows-60-operations-design.md) and [verification](./rustack-workflows-70-verification-plan.md) bind shared behavior.
+- [Existing container/CI research](../docs/research/localstack-container-ci-research.md) supplies prior art, not Rustack release-image evidence.
+- [GitHub secure use](https://docs.github.com/en/actions/reference/security/secure-use) specifies intermediate environment variables, quoting and secret masking. The input validator and private env-file contract above are Rustack's own stricter boundary.
+- [Docker test before push](https://docs.docker.com/build/ci/github-actions/test-before-push/) explains local load→test→publish ordering; its simple example does not prove both architectures or Rustack's complete release requirements.
+- [Current build action](https://github.com/docker/build-push-action) and [releases](https://github.com/docker/build-push-action/releases) observe v7.4.0; [checkout releases](https://github.com/actions/checkout/releases) observe v7.0.1. These are source references, not a claim that any CI run has occurred.
+- Current official release metadata and git tag resolution pin the touched CI consumers to [checkout7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1), [build-push7.4.0](https://github.com/docker/build-push-action/releases/tag/v7.4.0), [setup-buildx4.4.1](https://github.com/docker/setup-buildx-action/releases/tag/v4.4.1), [upload-artifact7.0.2](https://github.com/actions/upload-artifact/releases/tag/v7.0.2) and [download-artifact8.0.2](https://github.com/actions/download-artifact/releases/tag/v8.0.2). Use their complete resolved commit IDs with version comments. Only the existing test-action workflow and its local artifact loader are touched; this is no remote execution/publication evidence.
+- [Current YAML API](https://docs.rs/yaml-rust2/latest/yaml_rust2/) observes0.13.0. The test reuses this repository's existing audited workspace version; a production YAML upgrade is outside this dependency edge.
+
+
+## 8. Executed qualification and scope update
+
+The final1250-source cohort passes both actual corrected root-image artifact audits and focused SDK/nested/startup-rejection consumers, both complete76-resource functional gates, standard/strict/Native/security/text and independent source/evidence review. Full gates pass558 aggregate Rust cases/33 summaries per lane; focused gates pass484/27. Artifact13, actual Action26 and shared Rust-policy16 controls remain separate from Docker76/Native26/Action1 inventories. Exact postconditions prove zero runtime remnants, fifteen actual source IDs per engine and removal of only two exact task-owned empty bridges. [Final D99 evidence](./rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions) records original failed cohorts, exact hashes and cleanup authority.
+
+[D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) records the subsequent user instruction to perform no further Linux x86_64 validation. Both-architecture commands/contracts above describe the completed D99 cohort, not future mandatory x86 work. W373 and required arm64/reference/Desktop/rootless/performance/load/full-M4 work remain open. No remote CI result or publication is claimed.
diff --git a/specs/rustack-workflows-57-image-performance-design.md b/specs/rustack-workflows-57-image-performance-design.md
new file mode 100644
index 00000000..930e328d
--- /dev/null
+++ b/specs/rustack-workflows-57-image-performance-design.md
@@ -0,0 +1,168 @@
+# Image Lambda Performance and Repeated Cleanup
+
+Status: implemented and independently reviewed; final seventh-source current-profile host15/full ARM79/direct Linux3/postcondition qualification passes. Dedicated-reference/Desktop/rootless/W373 and full M4 remain open.
+
+Phase:P5/5.3. Decision:D102. Apply [verification§5](./rustack-workflows-70-verification-plan.md#5-performance-and-resource-acceptance), [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) and [D101](./rustack-workflows-70-verification-plan.md#52-direct-linux-arm64-pure-workflow-measurements-d101). This design does not waive dedicated-reference or Desktop/rootless requirements.
+
+## 1. Scope and ownership
+
+Qualify three real signed ordinary-SDK workloads:100 warm calls,20 preloaded cold environments and100 successful-invoke/handler-timeout cycles under active log flood. Reuse the existing production startup, Docker provider/pool/environment, independent Rust RIC image, Python SDK Matrix/metadata oracle, registered image SDK owner and unchanged Rust Runner. Add no benchmark crate, AWS API field, initialization hook or alternate executor. The operational workers diagnostic adds optional runtimeTasks, read from the actual Tokio handle metrics; omit it outside a runtime. It carries only a bounded count, no task identities or request data. The controller and actual CLI must additionally run directly inside the native arm64 Linux guest; a macOS controller/server capture alone cannot establish Linux execution.
+
+The direct Linux lane uses the retained D1014-vCPU/8GiB VZ profile with read-only source/target mounts and independently bounded guest/host owners. Four virtual CPUs do not establish physical dedication: every report retains referenceQualification=pending. Do not run x86_64 validation. Preserve historical D74/D99/D101 evidence.
+
+```text
+┌─ explicit Make: same-source ELF build + preloaded local images ───┐
+│ exact test inventory → original host/guest process owners         │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+┌─ native arm64 Linux guest ───────────────────────────────────────┐
+│ Python SDK → actual CLI → provider/pool → relay + function/RIC    │
+│ warm100 / fresh20 /100×(success → log flood + timeout → absence)  │
+│ independent daemon/owner metadata + live health/admission probes │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+ successful child join → clean server shutdown → namespace audit
+ → bounded raw report + artifact/source/resource postconditions
+```
+
+## 2. Clock and initialization diagnostics
+
+Use monotonic integer nanoseconds in the SDK and handler. Round reported durations up to whole microseconds. For warm overhead, subtract handler nanoseconds from the complete signed Invoke/response-body nanoseconds before rounding; reject handler time greater than the enclosing observation. Do not subtract separately rounded samples, interpolate percentiles or exclude slow observations. Record all ordered raw end-to-end/handler/overhead samples. Nearest-rank p50/p95/max use ranks50/95/100 for100 samples,10/19/20 for20 samples. Enforce warm overhead p95≤50000µs and cold end-to-end p95≤5000000µs.
+
+At successful Image environment initialization emit one structured INFO event on the dedicated rustack_lambda_core::docker::initialization target: fixed message, validated generated environment UUID, relay_micros and ric_micros as bounded numeric fields. The relay phase starts on entry to environment initialization and ends at observed RelayReady; the function/RIC phase starts there and ends at observed BootstrapReady. They include their respective container create/attach/start IO, scheduling and handshake observation; they do not claim isolated RIC CPU time. The two contiguous intervals partition observed initialization. Do not emit a successful-ready event on initialization error, cancellation or timeout. No artifact path, function name, request/event/environment value, credential or token appears in the event. Existing default log-level behavior and runtime wire/ASL/history/archive schemas are unchanged.
+
+The performance-only server profile enables this target with all other logs at error. After startup readiness and before spawning the SDK child, the retained Rust owner captures a bounded newline-complete immutable server-log prefix. Verify that prefix is unchanged after joined shutdown and bind its byte count/hash; the prefix contains startup kernel/endpoint self-test environment events, which are not workload samples. Parse every successful initialization event in the remaining suffix, rejecting unknown identities. Cold evidence requires exactly20 distinct environment IDs, exactly one event per independently observed environment, both durations and their sum bounded by that environment's enclosing Invoke duration with explicit rounding tolerance. Never match by line order alone. Ordinary profiles retain their existing error-only filter. A deterministic controlled tracing subscriber must verify stage intervals and absence of a ready event on failed initialization.
+
+## 3. Independent handler fixture
+
+Extend the existing independent Rust RIC with two explicit modes, timed and timed-log-flood. They retain the existing computed value, request ID, process-local counter, revision and other response fields. Only these modes add handlerNanos, measured after next returns through computation/delay, immediately before response JSON construction. Existing compute/error/framing/forgery/hold behavior and output contracts remain unchanged.
+
+The timed mode sleeps for the existing bounded delayMillis (warm workload uses10ms). The flood mode starts one owned writer thread, writes fixed non-secret1KiB chunks paced1ms apart with a hard1MiB ceiling, and enters an authenticated bounded collector barrier only after a positive write. The controller probes readiness while that barrier holds the handler and the writer remains active. After release the handler stops/joins its writer and reports a second matching request-ID barrier with before/after byte counts; require0<before<after<1MiB, proving the flood phase spans the probe and did not exhaust before release. It then sleeps5000ms and is retired by the real1s handler timeout. All collector threads/connections and writer exits are owned/bounded; a missed barrier, exhausted writer, early timeout, failed join or mismatched ID fails the workload. The collector reuses the existing bounded custom-RIC HTTP collector and token barrier; the established explicit bridge/gateway startup profile supplies reachability. Do not emit host data or random unbounded text. Fixture response serialization/posting is intentionally part of adapter overhead. Verify checked timing conversion and unchanged ordinary response fields without unsafe code or panic on input.
+
+## 4. Workloads
+
+The registered server owner creates its evidence root with explicit0700 permissions, independent of host/guest umask; production ancestor/namespace permission checks remain unchanged. Each workload has a fresh owned server with one environment slot, an explicitly configured2s idle timeout and actual production resource limits. DeleteFunction removes metadata but does not promise synchronous warm-environment retirement. Outside Invoke timing, deletion starts one15s observation covering deletion completion, actual idle-driven container absence and zero allocation/memory/quarantine charges; fail on expiry rather than assuming API completion proves cleanup. Warm calls stay sequential within the configured idle window. Other fixtures retain their existing idle setting. Its selected images are provisioned/inspected before timing; ordinary service startup and one warm priming call are excluded only where explicitly stated below. All SDK retries are disabled, credentials are fixed local dummy credentials, per-operation IO is bounded and complete child lifetime stays within the existing480s image SDK owner cutoff. A Python original400s alarm covers workload/cleanup/report IO and interruption handlers; timeout worker futures/threads must join within their bounded SDK operation. Errors retain evidence and fail qualification.
+
+### 4.1 Warm100
+
+Create/settle one function with reserved concurrency1. Prime once and prove a single relay/function pair. Execute100 sequential timed10ms calls; require computation, revision, unique request IDs, counters2..101 and the same exact pair/environment throughout. Keep all100 raw nanosecond observations, rank summaries and measured overhead. Delete the function and independently prove its pair absent before returning the report. Function creation, priming, metadata inspections and deletion are outside individual Invoke timing.
+
+### 4.2 Cold20
+
+Create/settle a fresh function for each observation. Require no live environment before its first Invoke. Execute one timed call with counter1; keep its exact pair/environment identity and complete Invoke duration. Delete and prove all containers absent before the next iteration; require20 distinct environments and40 distinct container IDs. Do not pull/build during measurements. After clean server shutdown bind the20 actual initialization events to these identities and durations, reporting relay and function/RIC phase samples separately. Require actual server/SDK OS/architecture provenance; distinguish debug assertions and VM allocations from reference qualification.
+
+### 4.3 Success/timeout100 with live health
+
+Use a function with Timeout=1 and reserved concurrency1. Each of100 cycles first succeeds on a fresh pair with counter1, then invokes timed-log-flood asynchronously on that same pair. Observe the matching flood-begin barrier before probing; release only after the live readiness bracket, then require flood-end with increased but unexhausted byte counts before accepting the timeout. Bracket an actual GET /_health/ready observation with two capabilities observations showing active Lambda work while the future remains incomplete; record per-cycle health latency and require it below2s. Future submission or container existence alone cannot prove accepted handler work. Require the actual ServiceException timeout classification, then zero owned containers and zero accepted/active invocation/environment charges after the returned error. Do not retry admission or hide an eventually growing pool.
+
+Record all100 health/timeout durations, exact completed-cycle count, per-cycle container high-water≤2, absent pairs after every timeout and successful reuse of the single slot. Keep stage-independent daemon identity and owner-label fences. Use one persistent health connection. First perform and explicitly report one successful priming invocation followed by function deletion and independently confirmed empty namespace; this initializes the provider's legitimate lazy persistent WorkManager supervisor. Create the actual test function, then record runtimeTasks before its first invocation. This priming is outside the100 measured cycles and cannot replace any cycle. Start the original2s quiescence clock immediately when the timeout result returns, before container/accounting/task observations. Check its cutoff before and after every task response, including an immediate baseline match; measure through that successful response. After each timeout require zero Docker allocation/memory/quarantine and provider accepted/active charges, then within2s observe the actual Tokio live-task count return to that exact original baseline before the next cycle; report all100 quiescence durations/counts. No admission retry is permitted. Record actual server RSS/OS thread overhead separately from configured resource quotas where available; container/task accounting cannot be inferred from elapsed times or a final empty list. A missed budget is retained and analyzed, never filtered away. Producer coordination uses a capacity-one channel with nonblocking coalesced notifications after positive writes. Atomic byte counters establish progress. Both first-positive and post-release observations share one absolute1s cutoff beginning at flood entry; stale notifications cannot reset it or prove progress. Keep the writer active across the held begin barrier and stop/join it on every returned path. There is no independent100ms scheduler-speed guard. Controls must prove delayed first progress, stale notifications under the original cutoff, disconnect and nonblocking coalescing. This does not change the actual1s invocation timeout or any health/quiescence/workload requirement. An unobserved flood barrier must retain a bounded fixed diagnostic distinguishing begin/end, expected/observed begin/release/end counts and the already-completed invocation outcome (timeout, function exit, other service/SDK failure or success). Never print exception messages, credentials, collector tokens or payloads, retry a cycle, or substitute a later successful run for the failure.
+
+## 5. Linux artifacts and reproducibility
+
+Add discoverable Make targets for controls, focused resources, Linux cross-build and direct guest execution. Reuse the D101 bounded artifact selector with an explicit allowlisted test-target parameter for workflows_sdk or docker_startup. Keep the old default behavior and its pure-lane regressions. Require one actual GNU arm64 ELF harness and its Cargo-embedded sibling server, matching hashes before/after on both sides, original deadlines and fixed diagnostics. Each Cargo stream stays≤4MiB/4096 records and each record≤262144 bytes with the existing depth/member/string caps. Measurement documents explicitly allow up to4096 members under their32KiB byte limit; all existing Action/D101 decoder callers retain their512-member default.
+
+Before the canonical lambda-docker-fixtures entrypoint performs any image build, retain existing IDs for the seven rebuilt source aliases (relay, ordinary handler, custom A/B, no-runtime, server and release image) with immutable content-addressed cache tags on the same fenced source engine. The allowlist has exactly seven names for arm64 or amd64; unknown architectures fail before Docker IO. Preserve every alias observed at entry; absent aliases are skipped to support initial or partial provisioning. The architecture-bound seven-name allowlist minus the report's complete preserved-reference list identifies those absences. This guard cannot certify that an absent alias never existed: the independent original-ID baseline audit remains mandatory for detecting prior loss. Reject multiple/invalid source IDs and cache alias conflicts before overwriting any reference; tag only captured IDs, verify each cache mapping and recheck original aliases before returning. Every operation uses the existing local-Unix/engine fences and original120s preparation guard; interrupted/uncertain effects fail without retries or deletion. Preserve the snapshot as one bounded WORKFLOWS_SOURCE_CACHE record in full qualification logs. This protects addressability when fixture builds replace mutable aliases; platform config equivalence alone cannot replace old image IDs.
+
+Provision the relay, ordinary handler and updated custom-RIC images on the selected Linux daemon before timing. Resolve each selected source alias once to its full immutable content ID, save only that ID, load that ID and anchor it on the target with the content-addressed operator cache alias rustack-workflows-cache:d102-<64 lowercase hex digits>. Reject an existing alias mapped to any other ID; a matching alias is reusable. Fence alias inventory, creation and inspection like every other Docker operation and validate its exact mapping before and after the guest workload. Preserve these target cache aliases: untagged image imports can otherwise be garbage-collected when the runtime removes its final private pin. Configure/inspect the guest fixtures by the captured IDs; mutable alias movement cannot substitute a later artifact. Validate both Docker endpoints with the existing local-Unix grammar and fence every save/load/image inspect/inventory operation with the captured daemon ID immediately before and after dispatch. A post-effect mismatch retains uncertainty and fails without retry or deletion. Import only explicitly selected immutable local image sources from the retained ARM source engine if needed; bind source/target daemon IDs, content IDs and archive hashes/size limits, retain image caches, and preserve all preexisting sources. Transfer exactly three selected images, at most1GiB per saved archive and2GiB total. Each source save and target load has120s, all preparation has600s; readonly identity/metadata calls have10s and32KiB outputs. Save only into exclusive regular files in the task-owned evidence directory, enforce an inherited min(1GiB, remaining aggregate allowance, inherited soft/hard limits) file-size limit before dispatch and verify size/link/type/hash afterward. Retain CLI process/group ownership through completion or bounded retirement; source/target identity mismatch or output overflow fails without deleting images. No registry publication, prune, unrelated deletion, existing VM/context restart or global activation is permitted. The new guest remains retained after tests. Final image-cohort acceptance additionally binds each selected ID to the complete ARM fixture builder's exact named manifest-list export. A fixture rebuild can refresh attestation/index IDs despite identical platform configs. After the complete gate, capture/import its exact exported IDs and perform the final Linux run without another image build; retain earlier focused captures separately rather than equating config digests with addressable image IDs.
+
+The guest uses its actual Python3.12 interpreter and the existing pinned pure-Python boto3/botocore1.43.118 package tree mounted read-only from the host SDK cache. Pass that explicit SDK root as a validated argument, verify actual distribution versions and record interpreter/package provenance. Do not execute the host Python binary or use ambient AWS credentials/proxies. Existing host executions keep the established pinned Python3.13 environment. This introduces no package/version change or network install into the guest.
+
+Both actual-resource Make entrypoints require the current same-feature Docker manifest preflight (83 resources after D107). The direct guest owner additionally requires exact equality between its ignored ordinary test names derived from the canonical manifest (50 after D107) and the frozen manifest, then runs exactly the three named ignored performance resources once. Verify guest Python3.12 before dispatch and in each resulting report. Each normal Rust control and each required Python control must run explicitly; no exit0/zero-test success is accepted. The guest original cutoff is1500s, each resource group≤480s and its existing retirement allowance; the host SSH cutoff1600s stays within an original1650s host observation. Metadata/hash/report IO is covered, with the D101 interruption/retirement-safe guard. No user request/token/env dump is allowed. Preserve bounded raw child reports only after successful physical cleanup.
+
+```text
+┌─ one owned paced writer ──────────────┐
+│ stderr write → atomic byte counter    │
+│              → try_send notification │
+└────────────────────┬─────────────────┘
+                     ▼ capacity1, coalesced; writer never waits here
+┌─ handler thread: one absolute1s cutoff ─────────────────────┐
+│ first positive count → held begin/health/release barrier    │
+│ newer count → stop + join writer → end proof → timed sleep  │
+│ stale event: reread count; never renew the original cutoff  │
+└────────────────────────────────────────────────────────────┘
+```
+
+## 6. Inventory, review and acceptance
+
+Freeze the following three ordinary-startup resources before first execution:
+
+- test_should_measure_one_hundred_warm_image_invocations
+- test_should_measure_twenty_preloaded_cold_image_environments
+- test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts
+
+They extend43 ordinary/76 total Docker resources to46/79 across the existing eight suites; Native26 remains unchanged. Focused and complete functional gates must use the same final sources. Only ARM qualification is scheduled under D100. The second ARM engine may satisfy existing two-engine correctness preconditions; both architectures are not required. Retain original Runner/image SDK lifecycle semantics and failure evidence.
+
+Normal controls cover exact sample count/order/ranks, subtract-before-rounding, budget boundaries, invalid handler time, cold identity/event duplication/mismatch/missing rows, non-live health evidence, timeout classification, accounting growth and malformed/oversized reports. Run focused Linux resources and complete ARM functional inventory, required build/test/fmt/Clippy/rustdoc/strict/Native/security/text gates, independent source/evidence review and exact namespace/source-preservation postconditions. A successful local VM capture closes this workload dependency only: dedicated-reference, Desktop/rootless, W373 and complete M4 remain required.
+
+## 7. Pinned metadata peer during the live flood bracket
+
+Before each timed invocation, connect, negotiate the API and verify the engine on one independent metadata socket. Retain that exact socket with implicit reconnect disabled until the live pair comparison and authenticated end observation finish. Reject socket closure/replacement and nested/concurrent use; close on every exit. Outside this scope, each ordinary observation still verifies its own connection.
+
+```text
+┌─ before timed Invoke ───────────────────────────────────────┐
+│ connect → negotiate API → verify engine → pin exact socket   │
+└────────────────────────────┬───────────────────────────────┘
+                             ▼ no reconnect or new identity setup
+┌─ existing live bracket, original deadlines ─────────────────┐
+│ begin → readiness/health → same pair → release → end         │
+│ socket loss/replacement → fail → finally close owned socket  │
+└────────────────────────────┬───────────────────────────────┘
+                             ▼ normal per-operation fencing resumes
+```
+
+Keep the one-second handler/handshake budget, 100 cycles, health budget, physical retirement proof and resource limits unchanged. The previous rootless run's cycle-54 end-handshake timeout remains failed evidence with an unproven root cause. Removing repeated connection/identity setup from the live bracket does not retrospectively explain that failure.
+
+## 8. Live observation ordering and failure localization (D109)
+
+The second D108 source cohort fails cycle89 at end observation after begin89/release89/end88; handler outcome is the actual one-second timeout. The earlier complete83/83 run remains valid historical evidence, but cannot establish that the intermittent issue is fixed. Source review identifies a concrete oracle defect: the final capabilities/completion samples precede the potentially slow live Docker GET. Move that GET before the final capabilities sample, then sample completion last. Under the collector condition, check completion, insert the release flag, and check completion again before notifying: a completed future requires withdrawing the flag and rejecting the cycle. Future completion is monotonic, so the last negative sample brackets the inserted flag without treating the collector lock as a lock on Future state. Require running rows for both observed roles. This strengthens the existing live proof without changing deadlines.
+
+```text
+┌─ before Invoke ─────────────────────────────────────────────────┐
+│ verified pinned metadata peer → actual running warm pair          │
+└──────────────────────────────┬───────────────────────────────────┘
+                               ▼ original submission clock
+┌─ one-second handler live bracket ────────────────────────────────┐
+│ begin → before capabilities → health → live pair GET               │
+│       → after capabilities → completion sample                     │
+│       → collector lock: completion recheck → release → end         │
+└──────────────────────────────┬───────────────────────────────────┘
+                               ▼ existing timeout/retirement/accounting
+```
+
+Retain bounded monotonic phase diagnostics on any failed cycle: submit, collector acceptance, begin receipt, before-capability/health/pair/after-capability boundaries, release insertion/withdrawal/commit, begin-response-written, end acceptance and completion-callback observation. Use fixed field names, nonnegative elapsed microseconds and current-cycle counters only; never emit tokens, event bodies, function names or credentials. Each timestamp is a local observation; the callback observation can lag the actual Future transition, and a successful server write does not prove client receipt. Bind the accepted/written transport hooks and completion callback to their original cycle object so delayed callbacks cannot contaminate a later cycle. A missing phase remains missing rather than being inferred. The existing healthy report schema and all100-cycle/one-second/health/retirement budgets remain unchanged. Normal controls must expose a delayed pair lookup and completion at the release boundary.
+
+The previous logs cannot distinguish a delayed controller observation, begin-response transport, writer join or end connection. The production log ring overwrites capped data while continuing to drain; no cap-stop fault has been established. Diagnose the focused100-cycle resource first; only after concrete code corrections stabilize should the final complete source cohort be frozen and requalified. A retry alone must not relabel the failed cohort as passed.
+
+## 9. Initialization-owned flood control channel (D110)
+
+Focused D109 diagnostics retain a failure at cycle84 before any authenticated begin was accepted: only submitted=0 and completionCallbackObserved=1176836µs, with83 complete prior cycles. This proves late controller release is not the sole failure mode. It does not identify whether first writer progress, scheduling or request transport caused that historical timeout.
+
+Remove connection establishment from the one-second measured handler window. The opt-in IMAGE_FIXTURE_INIT_MODE=flood branch prepares the collector channel through the existing RIC Agent before its first Runtime next request. This uses the existing20s initialization budget, adds no invocation and leaves warm-counter semantics, handlerTimeout=1s,100 cycles,2s health, physical retirement, process limits and report-size bounds unchanged. All other initialization modes retain their behavior. The existing ureq2.12.1 Agent pools fully consumed, length-delimited responses by scheme/host/port/proxy; Runtime API traffic therefore uses a separate pool key. Pool reuse alone is insufficient because it may reconnect: the collector enforces socket identity independently. See the [versioned upstream source](https://docs.rs/crate/ureq/2.12.1/source/README.md) and local registry response.rs/pool.rs/unit.rs.
+
+```text
+┌─ existing initialization owner (before first next) ───────────────┐
+│ explicit flood mode → authenticated POST /flood-ready              │
+│ full response read → same Agent retains this connection           │
+└────────────────────────────────┬─────────────────────────────────┘
+                                 ▼ one actual socket object
+┌─ collector channel: exactly three authenticated exchanges ────────┐
+│ new → ready reply → ready                                         │
+│ ready → begin reply held for live health proof → begin            │
+│ begin → end reply with positive writer-span proof → complete       │
+│ mismatch/replay/new socket/invalid fields → reject + close         │
+│ end response → close; next environment requires a fresh channel    │
+└────────────────────────────────┬─────────────────────────────────┘
+                                 ▼ existing handler timeout + pair retirement
+```
+
+The pure channel state owns a strong reference to the accepted socket object; never authorize by reused descriptor number or peer port. Bind function name and the canonical invocation UUID, require exactly ready→begin→end, and commit each phase only after its successful response write. Ready accepts exactly functionName; existing begin/end body validation remains mandatory. A new ready channel requires the previous one complete and physically closed. Reject begin/end on a replacement connection, including a client library's implicit reconnect. The generic collector keeps its existing close-per-response behavior unless an explicit bounded flood transport policy opts in; keep4 connection slots,4KiB cumulative headers,2KiB request bodies, existing socket/collector deadlines and joined shutdown. Close on rejection and after end. Delayed transport hooks retain the original channel and timeline objects.
+
+Before timed submission, wait for authenticated ready plus its response-write commit under the collector condition. Charge this wait to the original20s preparation cutoff captured before the warm invocation; never reset it after receiving a response. Choose the timed submission clock only after that observation and under the same lock as submit, so a delayed callback cannot acquire a later timestamp than an already-chosen start. After timeout and physical environment retirement, wait for the end-write commit and actual socket close, then prove the request UUID and same-socket phases. This wait and runtime-task quiescence share the original timeout-return+2s cutoff and elapsed accounting; never create a new close budget. Notify observers after actual collector socket closure. SDK response completion/Docker retirement alone is not a synchronization event for collector threads. The successful cycles measurement adds controlChannels with exactly four integer counters: prepared, readyBeforeInvoke, sameConnection and closed, each exactly100. The existing unique100 request UUIDs and finite state transitions prevent replay; do not enlarge the32KiB report or weaken existing validators. Record current-cycle channel stage in bounded failure diagnostics without addresses, tokens or function names.
+
+Normal controls cover strict phase order, mismatched/reused socket objects, closed sockets, wrong function/request identity, premature replacement, response-write ordering, authentication before transport hooks, exactly three persistent exchanges and close after end, and missing/wrong channel counters in retained reports. Focused actual rootless cycles must prove the protocol before final qualification. Keep every prior failure unchanged; describe this as removing a setup hazard, not proving the historical cause.
+
+The controlled execution-image refresh now covers five sources: runtime, custom RIC A/B, server and release, through four fixed Make targets (runtime/custom-RIC/server/release). Retain all old IDs before any build. Both explicit functional controllers and rootless import require the exact five-image source-sealed producer; only those five canonical aliases may advance with preceding receipt/cache-anchor proof. The full catalog remains15 images within the existing archive bounds. No x86 build/validation, daemon restart, image deletion or publication is introduced.
+
+### D110 executable artifact correction
+
+The first real D110 run fails before the flood protocol because the rebuilt RIC layer preserves a host0700 bootstrap owned by root. The build owner inherited umask077 to protect private diagnostics; relying on COPY's source mode made both entrypoints unexecutable by UID1000/65532. The retained actual image-2.tar independently proves both root-owned0700 entries; this is a confirmed artifact defect, separate from earlier intermittent handshakes. Set explicit COPY --chmod=0555 for /image-bootstrap and /alternate-bootstrap. Keep the non-root user/read-only policy, retain the bad image IDs and raw failure records, rebuild through the existing guarded five-image producer, inspect the new immutable layer permissions and execute the real non-root resource. No budget or protocol waiver is permitted.
diff --git a/specs/rustack-workflows-58-rootless-platform-design.md b/specs/rustack-workflows-58-rootless-platform-design.md
new file mode 100644
index 00000000..fe61928c
--- /dev/null
+++ b/specs/rustack-workflows-58-rootless-platform-design.md
@@ -0,0 +1,102 @@
+# Rootless Docker Platform Qualification
+
+Status: bootstrap/attestation dependency implemented and independently reviewed; actual rootless daemon, read-only recovery and root-owned timeout retirement pass. Full kernel/resource platform qualification remains pending.
+
+Phase: P5/5.3. Decision: [D103](./rustack-workflows-99-decisions.md#d103--qualify-an-isolated-rootless-daemon-with-effective-resource-controls). Apply the [required matrix](./rustack-workflows-70-verification-plan.md#2-required-test-matrix), [image performance contract](./rustack-workflows-57-image-performance-design.md) and D100's x86 waiver. Desktop and the dedicated reference remain separate requirements.
+
+## 1. Scope and dependency order
+
+First provision and attest a real rootless daemon. Then qualify the complete current Docker resource inventory, including official Python/Node/custom RIC, provided ZIP, SDK callbacks, Pulumi, archive/recovery, server-container and release-image consumers. Rootless bootstrap success alone does not close P5/5.3. Do not replace required cases with a minimal Invoke smoke or suppress kernel policy failures. Keep the existing D102 evidence and every existing VM/context intact.
+
+```text
+┌─ explicit Make / bounded host process owner ──────────────────────┐
+│ fresh native ARM VZ profile → retained ownership receipt          │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+┌─ separate Linux VM: infrastructure rootful daemon retained ──────┐
+│ signed packages → unprivileged systemd user service              │
+│ rootless Docker: private user socket / local disk / cgroup v2    │
+│ identity + UID mapping + delegated cpu/memory/pids attestation   │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+ immutable fixture transport → kernel probe → complete resource gate
+ → exact owned-resource absence + retained source-image audit
+```
+
+## 2. Isolated provisioning and installation
+
+Expose `workflows-rootless-provision`, `workflows-rootless-attest` and `test-workflows-rootless-controls` through Make. The default profile is `rustack-workflows-rootless-arm64`. Provision accepts only a fresh profile, on macOS arm64, using the existing D101 native VZ provisioning contract: 4 vCPUs, 8 GiB, 24 GiB local disk, read-only repository/target mounts, no Rosetta/binfmt, no context activation or SSH-config mutation. Four virtual CPUs do not prove physical dedication.
+
+Create a private, exclusive host evidence directory before any VM mutation. Retain an entry receipt with schema version, profile, random nonce, rootless-script hash and original command intent. A failed or interrupted provisioning attempt retains its directory/profile and must not be silently retried against the partially provisioned VM. Attestation is read-only and may be repeated from that receipt; missing or conflicting receipts fail. Never stop/restart/delete a preexisting VM, daemon or user service. The new VM's infrastructure rootful daemon stays running and must have a different engine ID from the rootless daemon.
+
+The explicit `workflows-rootless-resume-setup` target may reuse an owned failed-provisioning VM only when a read-only guest probe proves that no rootless state/entry directory, Docker user service, user daemon socket or rootless data directory exists. Require the original private host entry, exact profile/allocation and target mount path; create a new exclusive evidence directory, preserve the old entry/hash and bind the current script/nonce before dispatch. This handles failures before any guest setup effect (for example a trusted OS-release symlink rejected before the entry). A guest with any setup entry fails this path. Never use it to rerun partial package/service installation. The second attempt has one1,200s cutoff; the prior evidence remains unchanged.
+
+If installation completed but only its final report validator failed, `workflows-rootless-recover-attestation` performs a new90s read-only capture. Bind the original host entry/nonce and guest entry/exact retained script hash; require the original failure outcome, no successful result, and a complete, hash-verified zero-exit result for every durable command intent. Require exactly one successful official setup invocation, both equal historical rootless info observations and the historical rootful engine ID. Every exact recorded root transient unit must be absent before re-attestation. Re-observe actual UID/maps/socket/delegation/package/engine state and require historical engine equality. Write only a new host receipt; never rewrite failed guest evidence, rerun installation, restart a service or accept an uncertain privileged job. Later attestation of this capture uses the same immutable installation proof.
+
+Inside this newly owned VM only, install `uidmap`, `dbus-user-session`, `slirp4netns` and `docker-ce-rootless-extras`. Use Ubuntu's signed repositories and Docker's signed official apt repository, with the official Docker key fingerprint checked before repository configuration. Pin rootless extras to the installed infrastructure Engine version, recording that version rather than upgrading the existing Engine opportunistically. Reject an unavailable exact package. Record the currently published version separately from the compatibility pin. All package operations use argv, bounded output and finite deadlines; no downloaded convenience script is piped to a shell. Repository/key files are created exclusively or accepted only with identical contents. Do not disable AppArmor or unprivileged-namespace restrictions globally.
+
+Colima may already supply the canonical Docker `docker.list` and `/etc/apt/keyrings/docker.asc`. Before creating any source, inspect at most64 active apt source files, bounded64KiB each. Reuse only the exact arm64/noble/stable official HTTPS source with a root-owned regular0644 source/key and the pinned primary key fingerprint. Reject duplicate or unfamiliar Docker source configuration. Do not add a second Signed-By path for an existing repository. New system files use root-owned same-directory temporary files, fsync and atomic no-replace link publication; any existing destination must be a root-owned regular0644 exact-content match. Never overwrite a concurrent destination.
+
+Require nonzero guest UID, private `/run/user/<uid>`, at least 65,536 subordinate UIDs/GIDs and cgroup v2. Prove `cpu`, `memory`, `pids` in the user manager's systemd DelegateControllers, available controllers and enabled subtree; require its subtree control file to be owned/writable by the guest user. Independently prove the daemon service's declared/available controllers and writable delegated control file. Availability alone does not prove delegation. Reload the newly provisioned guest's user-unit catalog and start its package-provided DBus socket before the installer. Install/start the official user service using `dockerd-rootless-setuptool.sh install --force` with a separate private `DOCKER_CONFIG`, so any installer-created CLI context cannot change the host or ordinary guest client context. Use an explicit Unix endpoint thereafter. Enable lingering only for this newly owned guest user. Keep the installed user service and VM retained after qualification. Their continued existence is explicit infrastructure, not evidence that workload cleanup passed.
+
+## 3. Attestation and trust boundaries
+
+Attestation must independently inspect the running user service's MainPID and `/proc` identity: real/effective/saved/fs UIDs are the unprivileged guest UID; daemon UID/GID namespace mappings include that user; the service is active with delegation. `docker info` must identify Linux arm64, `name=rootless`, cgroup v2/systemd and no CPU/memory/PIDs support warnings. Record both engine IDs, exact socket owner/mode/path, service PID, package versions, controller set, UID/GID mappings, kernel and observed VM allocation. A rootful daemon reachable through an unprivileged user's docker group fails rootless attestation.
+
+Use a bounded strict JSON document, reject duplicate/unknown fields and bool-as-integer values, cap collection counts and strings, and use fixed local diagnostic codes. No credentials, payloads, environment dumps or arbitrary command errors appear in public diagnostics. Raw bounded command receipts stay in the private evidence directory. Attestation preserves source fingerprints and profile allocation before/after; altered code, profile or engine identities invalidate the capture.
+
+Preserve actual Unix socket permission/special bits. Accept owner read/write with optional group read/write and sticky bit (`0600`, `0660`, `01600`, `01660`) only beneath the private0700 runtime directory; reject world access and setuid/setgid. Socket group need not equal the guest's primary group: Docker's daemon-side group may map through subordinate GIDs. Record the primary guest GID, exact GID map and socket GID; derive the unique namespace socket GID from that map. The server-container lane must use that derived group. Do not equate a mapped host GID with a container group number.
+
+## 4. Workload qualification
+
+Bootstrap reports `platformQualification=pending`. Before changing this to qualified, execute the existing actual Rust kernel probe against the rootless socket and prove effective CPU quota, memory/no-swap, PIDs, nonroot, read-only root, bounded noexec tmpfs, capability drop and no-new-privileges. Docker accepting create options is insufficient. A missing controller is a failure, never an accepted reduced policy.
+
+Use the same exact source-controlled resource inventory as D102, updated only for intentional new cases. Capture/retain immutable fixture IDs before export and after import; preserve all source aliases and operator cache anchors. An explicit owned SSH Unix forwarding socket may connect host-native test binaries to the user daemon; its process group and private local socket remain owned/joined. Container-origin endpoints must be observed reachable, not copied from rootful bridge addresses. Namespace-local rootless container addresses do not establish host reachability. For server-container consumers, prove the actual mounted socket's mapped group rather than assuming the rootful socket GID.
+
+Record every original owner PID/handle, exact test names and summaries, source/artifact hashes, all-state containers/volumes/private aliases before and after, and preservation of unrelated source resources. Fail on unexpected skipped/extra/missing resources, namespace leftovers, changed source IDs or cleanup uncertainty. Remove only exact nonce-owned empty networks. Preserve failed owners/evidence and never force-prune or delete user images. Reuse D102 performance workloads for rootless responsiveness/resource evidence; do not label the VM a dedicated performance reference.
+
+## 5. Budgets, controls and exit
+
+Host provisioning has one 1,500 s absolute cutoff, including VM creation (330 s maximum), guest installation (1,100 s maximum), receipt IO and attestation. Guest package commands are individually capped at 300 s, service operations at 60 s and read-only queries at 15 s. Existing Runner owns direct child process groups with its original 3 s retirement budget; a host SSH timeout does not by itself prove guest termination. The guest retains its own absolute cutoff and on-disk final outcome. A late/missing outcome is unqualified and needs read-only reconciliation before any further mutation. Attestation has a separate 90 s overall cutoff. No async unbounded subprocess dispatch.
+
+An unprivileged process owner cannot assume signalling authority over sudo descendants. Each privileged setup command therefore runs as a uniquely named recorded root-manager transient systemd service, with Type=exec, no restart, RuntimeMaxSec ending at least6s before the caller cutoff,2s start/stop bounds, KillMode=control-group and SendSIGKILL. The manager retains and bounds the job independently of the SSH/controller. No broad unit matching or service restart is allowed. Publish/fsync a private exact unit/argv/cutoff intent before dispatch; retain the result separately afterward, including on nonzero exit. Failed intent publication prevents the effect. Host and guest entries retain the exact script bytes. A late/unknown command fails setup rather than inferring successful retirement from the outer sudo PID.
+
+After the intent fsync, recheck that the root job's recorded lifetime plus the full6s reserve still fits the original caller cutoff. If local IO consumed that slack, fail without dispatch. Never extend the caller deadline or silently recalculate the recorded unit after its intent was published.
+
+Normal controls must cover fresh/existing profile rejection, malformed receipt/nonce, duplicate JSON, socket substitution, rootful masquerade, PID UID mismatch, missing delegation, invalid namespace mapping, unavailable exact package, key fingerprint mismatch and before/after engine or artifact changes. Tests must not install packages, start VMs or depend on a real Docker daemon.
+
+Exit requires actual retained rootless infrastructure, effective kernel-probe proof, the complete resource inventory with exact postconditions, relevant standard/strict/Native/security/text checks for source changes, and independent read-only review with all valid findings fixed. Provisioning/attestation can land as an explicitly incomplete dependency; the ledger must retain the full resource/platform exit until executed.
+
+## 6. Rootless resource execution (D104)
+
+Expose separate Make targets for the bounded Unix forward, immutable fixture preparation and kernel resource consumer. Keep D103's installed daemon/script/receipts unchanged. A native macOS ARM controller may drive the daemon: the actual pinned Linux relay/Rust kernel probe executes inside rootless containers. This is functional platform evidence, not dedicated-reference performance. Task5.3 remains open until the complete inventory is qualified.
+
+The forward owner creates an exclusive private directory beneath `/tmp`, with a socket path at most100 bytes, and records its PID, nonce, profile, remote Unix socket and expected rootless engine before spawning. Use the generated exact-profile Lima SSH configuration with multiplexing/persistence disabled, no default context change, ExitOnForwardFailure, bounded keepalive detection and a private local Unix forward. The existing Runner owns the SSH child/group under one3,600s deadline; INT/TERM uses its original3s physical retirement budget. The original tool handle must be joined, and both socket inode/parent ownership and process absence verified before unlinking only that forward's socket. Never unlink a substituted/preexisting socket. A local socket appearing alone is insufficient readiness: every consumer must connect through it and prove the attested engine identity.
+
+Preparation captures both daemon IDs, all source/target image IDs and exact named fixture metadata before effects. Save only captured immutable IDs through the existing per-file bounded save owner, hash every archive, load through the fenced rootless endpoint and preserve each imported ID with an operator cache alias before workload private pins can disappear. Bind canonical fixture tags only if absent or already equal; reject conflicting target names. Preserve every source ID/tag. The initial kernel dependency transports exactly the relay and official Python handler, at most1GiB per archive/2GiB total; full-matrix preparation must additionally include every declared fixture, with a separately explicit bounded total accommodating Pulumi. No rebuild, source retag or image deletion.
+
+Create one fresh nonce-labeled bridge with durable pre-effect intent; record and independently validate its full ID, bridge/local driver/scope, label, empty attachment map and IPAM. Keep it for later full-matrix use or remove only that exact empty owned bridge. The external collector address is the operator-declared Colima gatewayAddress (recorded config192.168.5.2), not an inferred Docker namespace-local IP; actual endpoint tests must prove reachability later.
+
+The kernel target first compares the actual ignored inventory with the manifest's two exact docker-probe names. Run both existing Rust scenarios: disconnected and operator bridge, retaining their exact policy checks. D105 changes the expected quota to33000/100000 for the approved downward-normalized request. Require each exact test's successful row and a single terminal summary of2 passes/0 failures/0 ignored. Preserve bounded raw stdout/stderr/argv/cutoff before interpreting results. The tests must also prove memory128MiB/no swap, PIDs256, nonzero UID/GID, seccomp/capability/no-new-privileges, read-only root and512MiB tmpfs, plus retained cleanup. No success on merely accepted Docker create metadata. Check zero owned containers/volumes/private pins and retained imported/source images afterward. A failed resource case is evidence of a compatibility defect, not permission to skip or reduce a policy.
+
+Normal controls cover socket substitution/path bounds, stale engine, existing directories/tags, source/target identity collision, missing/extra/ignored resource rows, false terminal summaries, archive budgets and network ownership. New Rust test automation requires the standard Rust gates; independent read-only review and exact owner/source/cleanup evidence remain mandatory. Full79, image performance/load, mapped server-container access and endpoint/callback/IaC/recovery cases remain required after the kernel dependency.
+
+Full-fixture preparation has an explicit15-reference allowlist: the relay/Python handler, custom A/B, no-runtime, two deliberate incompatible-platform fixtures, provided.al2023, immutable public Node pull fixture, official Node, handler SDK, callback, Pulumi, server and release images. Bound each archive to1GiB and the aggregate to4GiB, retaining exact ID/platform/size/hash metadata. Only the two fixed negative fixtures may have their declared incompatible OS/architecture. For immutable public Node/provided references, a bounded provision-time pull of that exact digest may restore repository-digest association after ID-only import; require the resulting ID to equal the captured source ID. Do not fetch mutable tags or use this provision-time activity as workload-pull acceptance.
+
+The actual first kernel owner fails both cases: requested333333333 NanoCPUs produces cpu.max34000/100000 on the rootless systemd driver. Independent actual Docker observation confirms the value while memory/swap/PIDs match exactly. The user explicitly approves D105 downward0.01-CPU normalization:333333333 requested becomes330000000 effective, and both unmodified-policy-check probe resources must now demand cpu.max33000/100000. Keep the original failure; do not accept34000 or a tolerance band. Full qualification remains failed until the revised actual resources pass. Never filter them out or call the remaining cases a qualified rootless platform.
+
+`test-workflows-rootless-functional` runs a diagnostic complete inventory with the preloaded fixtures and no rebuild: verify all eight compiled ignored inventories against the manifest, then execute every exact name once using the fixed source-owned Cargo target map. Capture successful-test output with `--show-output` so report text cannot hide the exact terminal test row. Retain every argv/intent/raw stdout/stderr/exit and a source/manifest/image receipt seal. Each case has at most1,200s within one2,700s owner cutoff, additionally fenced before the forward owner's cutoff. Assert empty container/volume/private-alias inventories before and after each case. Nonzero test results may be collected to expose all platform defects only after physically joined commands and successful cleanup observations; they must remain failures in the final report and process exit. Abort on uncertain ownership/cleanup/source/daemon state. Use the attested daemon-side socket and derived namespace GID for server/release containers, explicit192.168.5.2 gateway and a distinct recorded arm64 daemon for identity tests. Any nonzero-failure report is failed qualification, never a waiver or a narrowed profile. D107 expands the current canonical inventory to83; retained79-resource reports remain historical.
+
+Do not compare monotonic timestamps from different controller processes: a process may use a different monotonic epoch. Before functional dispatch, query the recorded live forward PID's kernel elapsed age with bounded `ps`, validate its whole-second format, subtract the age plus3s observation/truncation reserve from the fixed3,600s forward lifetime, and require more than1,200s remaining. Bound the functional owner by the smaller of that remainder and2,700s. Each process still uses its own original monotonic deadline internally. A dead, expired or malformed forward observation prevents dispatch.
+
+The forward entry additionally binds its kernel start identity and UID, which every consumer re-observes before deriving age or using the socket; PID reuse must reject. Start the functional cutoff at the local timestamp before the complete ps identity/age observation, subtracting all query/validation elapsed time in addition to the3s reserve. Seal/recheck executed repository Python/JS/config/helper inputs with Rust sources and manifests, plus the exact four local ZIP/bootstrap/verifier artifact hashes/modes and resolved SDK interpreter identity. Retain the original provisioning controller bytes/hash separately from the current consumer code; immutable archives/IDs may be independently revalidated without rebuilding or rewriting earlier producer evidence.
+
+Enumerate source through bounded `git ls-files --cached --others --exclude-standard -z` queries for the explicit source roots. Include tracked and nonignored in-progress source files, excluding ignored dependency/build trees; never recursively seal node_modules, virtual environments or generated caches as project source. Enforce path/count/byte limits and retain complete bounded shards. The verification runner bounds its merged diagnostic stream through a pipe into a private capped log. Do not apply RLIMIT_FSIZE to Cargo or its test children: that changes legitimate S3/archive workload behavior. The existing Runner still owns and bounds the complete command process group.
+
+## 7. Official sources
+
+Checked 2026-10-31: [rootless prerequisites and installation](https://docs.docker.com/engine/security/rootless/), [systemd and resource delegation](https://docs.docker.com/engine/security/rootless/tips/), [Ubuntu namespace policy and networking limitations](https://docs.docker.com/engine/security/rootless/troubleshoot/), [signed Ubuntu repository installation](https://docs.docker.com/engine/install/ubuntu/). These describe setup constraints, not Rustack qualification evidence.
+
+Executed evidence and retained failed attempts: [rootless bootstrap review](../docs/research/workflows-rootless-platform-review.md). The installed native VZ profile has a real UID501 daemon, version-matched29.5.2 extras, distinct rootful/rootless engine IDs, effective manager delegation and derived socket namespace GID991.25 normal controls, a root-owned TERM-ignoring timeout/physical-retirement control and independent source review pass. The existing Rust kernel probe and complete79-resource inventory have not run against this daemon; platformQualification stays pending.
+
+D110 expands the guarded execution-image refresh to runtime/custom RIC A/B/server/release with one canonical five-source producer. The15-image catalog and all existing size/time/ownership bounds remain unchanged. See [the explicit channel/refresh contract](./rustack-workflows-57-image-performance-design.md#9-initialization-owned-flood-control-channel-d110); previous three-source receipts stay historical and cannot qualify changed sources.
diff --git a/specs/rustack-workflows-59-release-qualification-design.md b/specs/rustack-workflows-59-release-qualification-design.md
new file mode 100644
index 00000000..ce98289a
--- /dev/null
+++ b/specs/rustack-workflows-59-release-qualification-design.md
@@ -0,0 +1,78 @@
+# Final workflow consumers and release qualification (D107)
+
+This is the remaining code of tasks 5.3/5.4, followed by execution and independent review. The user requires completion of code before starting verification. D100 still waives further Linux x86_64 execution. No build, test, image publication or remote workflow is implied by writing this design or pipeline.
+
+## 1. Consumer completion
+
+O01's named Native snapshot consumer must hold all five outstanding forms at the same graceful cutoff: Wait, callback, Retry backoff, an inline Map with a waiting iteration, and an owned nested `.sync:2` child. Poll actual history until the corresponding state/Task failure/Map iteration/child-start event is present, rather than sleeping and assuming entry. On restart each outstanding execution is ABORTED/Rustack.Shutdown, no successor marker runs, no callback token remains usable, and no prior computation is replayed. Snapshot failure after unconfirmed physical cleanup must preserve the preceding generation; the Docker transport-loss consumer checks this actual binary path.
+
+O03 must consume actual named archives with a moved operator alias A→B, retaining source A/B by immutable IDs. A cold restore must select saved A; a syntactically valid archive referring to an absent immutable ID must reject even when source B is locally available. Separate valid-checksummed owner and engine affiliation mismatches must reject before publishing readiness. Each rejected startup preserves current/previous snapshot fingerprints and both source IDs. Fixture faults mutate a private copy of metadata/affiliation only; never remove an operator image or retag canonical fixtures.
+
+O04 runs two actual live binaries with distinct private data roots on one explicit engine. Establish a warm survivor invocation, SIGKILL and join the other binary, restart the crashed owner, then assert the survivor's exact container ID and warm counter survive recovery and continue to advance. Check concurrent signed readiness during recovery; stop/join both and require scoped zero owned resources. Failure keeps evidence rather than deleting uncertain resources.
+
+O05 adds a composite consumer with a large nested ASL payload and an oversized Runtime response. While work is active, signed control calls/readiness and Stop must complete within existing budgets. Assert typed quota/protocol outcomes and physical environment retirement, then admit and complete a fresh request. Existing infinite-loop and 100 log-flood-timeout consumers remain mandatory.
+
+Add every new ignored resource name to the canonical eight-suite Docker manifest; consumers derive cardinality from that exact manifest and reject missing/extra compiled names. No hard-coded historic resource count may narrow the new cohort.
+
+## 2. Immutable artifact refresh
+
+Rebuilding runtime/custom-RIC/server/release fixtures first retains old source IDs with the existing content-cache guard. Rootless imports may promote a canonical server/release alias only when a private preceding preparation receipt proves its exact old ID and its immutable cache anchor is still present. Check old/new IDs, source engine, destination engine, platform, alias allowlist, archive size/hash and producer source. Retain an intent before retagging; ambiguous effects fail closed. Never overwrite an unrelated tag. Keep previous receipts and archives intact; a new preparation owns a new directory and bridge. Image inventories after rebuild require the old-ID set as a subset, allowing explicitly recorded new IDs.
+
+## 3. Complete release evidence
+
+`verify-workflows` is the final, non-skipping evidence assembler. An input bundle contains source-bound raw lane receipts and exact candidate archive seals. Required lanes are Rust gates, Native, Linux arm64 functional, rootless arm64 functional, Docker Desktop, dedicated arm64 pure/image performance and load, plus release-image qualification. No `pending`, focused-only, skipped, waived non-x86 lane, missing required resource or nonzero command may pass. D100 is the sole fixed waiver; never convert Desktop/reference unavailability into success.
+
+Each lane envelope carries schemaVersion=1, lane, commit, sourceSealSha256, status=passed, allChildGroupsJoined=true, exact resource-name inventory and SHA-256-bound raw receipts. The bundle also records candidateRunId (a numeric Actions run ID, or local for non-publication work). Rust receipts include the actual gate report, entry, every exact argv intent and log; default and feature doctests are required in addition to all-target tests. Reference envelopes bind the original pure/image producer reports; revalidate all raw samples, ranks, live brackets, cleanup and unchanged summary metrics. Physical dedication is an explicit operator attestation, never inferred from virtual CPU count. Platform envelopes bind an actual explicit-daemon platform receipt; rootless/Desktop attribution comes from engine metadata and zero-resource observations. Release logs must contain both typed consumer records with exact source image ID, container/engine identity and successful physical cleanup; an image ID claimed only in the envelope is insufficient. Only repository-known lane names and resource inventories are accepted. Candidate seals include architecture, archive byte count/SHA-256, exact immutable daemon-addressable Docker image ID and a separately verified configDigest (Docker containerd stores may address a manifest/index rather than the config), commit and source seal. All receipts and archives are bounded regular files under the bundle; reject traversal, symlinks, duplicates and unrelated commits/source cohorts. The assembled report records hashes of every input and both candidate seals; it is evidence, not a signature or permission to publish.
+
+## 4. Build, qualify, promote
+
+```text
+┌─ release-docker: read-only repository/package permissions ─────────┐
+│ native architecture build → Docker archive + exact seal artifact   │
+│ arm64: load that archive → exact root filesystem/ELF verification  │
+│ amd64: build-only artifact; D100 execution waiver explicitly kept  │
+└──────────────────────────────┬────────────────────────────────────┘
+                               ▼ immutable run artifacts
+┌─ operator qualification on required platforms ────────────────────┐
+│ same commit/source/candidate → release SDK/reject + all lane receipts   │
+│ verify-workflows → complete release report + candidate seals       │
+└──────────────────────────────┬────────────────────────────────────┘
+                               ▼ explicit promotion workflow inputs
+┌─ promote-docker: only job holding packages:write ──────────────────┐
+│ download candidates + full report → verify all bindings            │
+│ load same archives → verify image IDs → push per-arch immutable tag│
+│ create version/latest manifest from pushed registry digests        │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+Candidate creation never logs in or pushes. Promotion accepts candidate and qualification run IDs, verifies both successful same-repository workflow runs and same head commit, downloads immutable artifacts, and executes the assembler again. No source rebuild occurs after qualification. Only after all checks succeed may registry credentials enter the distinct promotion job. Publication is not run locally. Invalid/missing evidence must prevent login and push, including manual dispatch. Actions are pinned by full commit SHA to current official releases.
+
+## 5. Code-first / verification boundary
+
+Finish consumers, manifests, receipt validation, controlled import, Make targets, CI and their normal negative controls first. Obtain an independent read-only code review and fix valid findings. Then freeze source and run normal controls, full Rust gates, Native, focused rootless/server consumers and complete required resource matrices. Every code correction invalidates the affected source cohort and requires appropriate reruns. Historical D102/D103 passes remain historical; none qualify modified code automatically. Required unavailable platform/reference evidence keeps final qualification incomplete with a concrete missing-lane error.
+
+## 6. Artifact schema and operator handoff
+
+Use the canonical source seal from the retained controllers. Stage a private0700 bundle with bundle.json, two candidate-<architecture>.json seals (each retaining distinct imageId/configDigest), their release-<architecture>.tar archives and seven lane JSON envelopes. bundle.json keys are schemaVersion, commit, sourceSealSha256, candidateRunId, candidates (two relative seal paths) and lanes (the seven fixed lane names mapped to relative envelope paths). Each envelope has exactly schemaVersion/lane/commit/sourceSealSha256/status/allChildGroupsJoined/tests/receipts/qualification. Each receipt has path/sha256/code=0/groupJoined=true. Paths are relative, component-validated, non-symlink regular files. Each lane permits at most512 bound receipts. Lane logs have a256MiB aggregate bound and16MiB/file; JSON is bounded to1MiB, depth16,32,768 members and16KiB/string. Config/archive identities are checked independently of Docker's current image cache, with fixed-block TAR preflight before any eager parser. The arm64 candidate additionally passes the existing exact filesystem/ELF verifier.
+
+Qualification fields are lane-specific: Rust uses gates/report/entry/intents; reference uses referenceQualification/os/architecture/physicalCpus/exclusive, pureP95Micros/warmOverheadP95Micros/coldEndToEndP95Micros/loadCycles, and pureReport/imageReport; platform lanes use os/architecture/engineId/rootless/desktop/zeroOwnedRemnants/platformReport/executionReport/executionEntry/caseReceipts; Native uses nativeChildrenJoined plus the same gates/report/entry/intents producer fields as Rust; release uses imageId/zeroOwnedRemnants, corroborated by typed WORKFLOWS_RELEASE_RESOURCE records. Raw reports, entry/intents and platform reports must themselves appear in the bound receipts list. Platform execution must come from the exact controller report/entry on that same endpoint/engine/source seal, with every canonical case mapped to its original intent/result/stdout/stderr and revalidated argv, exit code, hashes and one-resource summary. A rootful test log plus a fresh rootless postcondition receipt must fail. Linux/Desktop use test-workflows-docker-functional with an explicit topology JSON; rootless retains its attested controller. Both share one strict compiled-inventory/case sequence. Performance limits remain pure100ms, warm adapter overhead50ms and cold end-to-end5s, with100 load cycles; this delivery work does not tighten or relax them.
+
+`workflows-platform-receipt` records the final explicit engine metadata and empty-resource observations. `workflows-release-evidence` validates and copies only referenced inputs to a fresh artifact directory (at most2,048 files/6GiB), revalidating the copy. The workflows-evidence workflow requires a deliberately configured self-hosted rustack-qualification runner and WORKFLOWS_EVIDENCE_ROOT repository variable pointing to the staged bundle. Missing infrastructure/evidence is a concrete release dependency, never an automatic success. Its immutable artifact feeds qualify-workflows, which independently checks the candidate/evidence run provenance and reruns verify-workflows; promote-docker accepts only that successful same-commit qualification run. Only promotion holds packages:write. The actual push digest is captured, its immutable remote manifest/config binding rechecked, and only those digests form public version manifests.
+
+Negative controls cover A-consumer/B-candidate substitution, missing modes, modified/duplicate/failed receipts, fake Rust logs without producers, contradictory reference summaries, lane aggregate limits, traversal/symlinks, duplicate/deep/nonfinite JSON, oversized PAX/GNU extensions, archive config identity, transient GH token scoping and remote tag/config races. These controls are code-complete before execution begins; writing them is not evidence that they passed.
+
+The Linux/Desktop topology JSON has exactly socket, otherSocket (a distinct actual installation), daemonSocket (container-visible daemon path), socketGid, network, gateway, fixtures, sdk, target and buildReceipt. Paths are explicit absolute values; the gateway is a private IPv4 address and the supplied network must be an existing bridge. The fresh production-image build receipt must match the current source seal, daemon, runtime/custom-RIC A/B/server/release IDs and bounded build-log hash. This prevents a newly sealed test controller from silently consuming stale production binaries. No controller provisions or changes a Docker context, VM or daemon.
+
+## 7. Existing Native-stage transcript compatibility
+
+The complete existing verify-workflows-native target deliberately executes the saved persistence case and both performance cases twice: once through the SDK stage and once through their dedicated stages. Preserve those stages and all original logs. The final Native lane expects exactly those three doubled names, every other canonical Native name once, and the separate Action resource once. Reject missing occurrences and third duplicates; a minimum-count check is insufficient.
+
+Some actual child processes inherit stdout outside libtest capture, so the genuine typed HTTP SDK log interleaves its start row even without nocapture. A Native-only parser may count exact canonical non-ignored START rows, provided an owned producer proves both fixed commands (make --no-print-directory -j1 verify-workflows-native and make --no-print-directory -j1 test-workflows-action-fixture), original pre-effect intents, unchanged source, log hashes, zero exit and physically joined groups. All Rust terminal summaries must be successful; the typed HTTP SDK start must be followed by its exact one-pass/zero-failure/zero-ignored summary. The Action command must likewise have exactly its one-pass summary. Never infer success from a loose trailing ok, retrofit historical pre-effect records, narrow the Native stages, or substitute unbound transcript counts for platform/reference producers.
+
+verify-workflows-native-recorded writes the same source/entry/intent/report protocol as the Rust gate runner, using an internal two-command catalog. Native qualification adds nativeChildrenJoined to that producer's gates/report/entry/intents fields. Literal controls cover inherited-output interleaving, the three known doubled names, missing/extra occurrences and an incorrect HTTP one-resource summary.
+
+## 8. Bound producer transcript and archive rejection corrections
+
+Fixed Docker cases may inherit child stdout between libtest's start and status. Require the exact non-ignored canonical start vector, exactly one matching N-pass/zero-failure/zero-ignored summary, no failed status, and the existing zero-exit, exact-argv, hash-bound case receipt. Platform inventory is derived exclusively from those validated cases; unrelated receipt text cannot add executions. Reference inventory instead requires both canonical ordered exactResourcesPassed vectors (two pure resources and three image resources), whose union is the exact five-resource lane. Keep every raw measurement, phase, rank, live bracket, cleanup and joined-child validation. Reference reports need not fabricate flat libtest rows. A transcript parsing failure still runs the independent per-case cleanup observation before propagating the failure. Every validated lane result must return the exact requested envelope path paired with that envelope hash; parsed test/resource names may never overwrite the envelope identity. Selective packing consumes that exact returned path.
+
+Archive affiliation rejection uses the actual invalid Docker ownership state diagnostic for both valid-checksummed foreign-owner and foreign-engine records. Persist the original record and each intended mutation before startup, then prove unchanged snapshot fingerprints and exact rejected bytes. Final physical reaping is status-independent because each semantic startup oracle already checks failure; always attempt alias cleanup and audit, retain evidence on any error, and preserve the original failure instead of masking it with a cleanup status expectation.
diff --git a/specs/rustack-workflows-60-operations-design.md b/specs/rustack-workflows-60-operations-design.md
new file mode 100644
index 00000000..1e9a8e33
--- /dev/null
+++ b/specs/rustack-workflows-60-operations-design.md
@@ -0,0 +1,621 @@
+# Workflows 60: Configuration, Operations and Snapshot Boundaries
+
+Status: implementation contract · Depends on: [API](./rustack-workflows-10-api-design.md), [Lambda](./rustack-workflows-20-lambda-runtime-design.md), [ASL](./rustack-workflows-30-asl-design.md), [integrations](./rustack-workflows-40-integrations-design.md)
+
+Current platform scope: [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation. Historical/native-x86 pending clauses do not impose new runner or test requirements; existing architecture support and completed evidence remain. Required arm64/Desktop/rootless/reference and other release gates still apply.
+
+## 1. Extend the existing configuration system
+
+Use `RUSTACK_CONFIG` and the existing YAML `environment`, `budgets`, `advertisedEndpoint` schema. Do not add a parallel configuration loader or mutate process environment. Add keys to the validated settings allowlist and add typed, camelCase budget fields. Process environment overrides YAML; defaults apply last. Reject unknown keys, malformed scalars, zero/excessive budgets and conflicting executor settings before listening. Configuration structs use typed-builder and validated newtypes.
+
+The following selects the implemented image-only Docker startup profile. Choose the explicit trusted listener/network/origin and an absolute private DATA_DIR for the host topology; full release/platform qualification remains separate:
+
+```yaml
+environment:
+  SERVICES: "lambda,stepfunctions"
+  DATA_DIR: "/absolute/private/rustack-data"
+  GATEWAY_LISTEN: "0.0.0.0:4566"
+  LAMBDA_EXECUTOR: "docker"
+  LAMBDA_DOCKER_SOCKET: "unix:///var/run/docker.sock"
+  LAMBDA_DOCKER_RELAY_IMAGE: "rustack/lambda-runtime:integration"
+  LAMBDA_DOCKER_NETWORK: "rustack-integration"
+  LAMBDA_DOCKER_PULL_POLICY: "never"
+  LAMBDA_DOCKER_GATEWAY_ENDPOINT: "http://host.docker.internal:4566"
+budgets:
+  workflowOpenExecutions: 128
+  workflowDispatches: 32
+  workflowMaxDurationSeconds: 3600
+  workflowSnapshotBytes: 536870912
+  workflowHistoryBytes: 33554432
+  workflowTotalHistoryBytes: 268435456
+  lambdaDockerEnvironments: 32
+  lambdaDockerMemoryBytes: 8589934592
+```
+
+Start with `RUSTACK_CONFIG=./rustack.yaml rustack`; the current CLI does not have a `--config` flag. Existing `--snapshot <name>` remains the persistence entry point. Installing this feature must not silently enable code execution: absent explicit selection, Lambda remains disabled.
+
+### 1.1 Docker configuration
+
+| Key | Default and validation |
+|---|---|
+| DATA_DIR | Existing core default `/var/lib/localstack`; absolute private operator directory; durable Docker ownership is separate from named snapshot directory swaps |
+| LAMBDA_DOCKER_SOCKET | `unix:///var/run/docker.sock`; operator may select Desktop/rootless socket; absolute local socket path≤4,096 bytes; no TCP/SSH fallback |
+| LAMBDA_DOCKER_RELAY_IMAGE | Required when Docker enabled; bounded image reference, resolved and pinned at startup; no implicit pull |
+| LAMBDA_DOCKER_NETWORK | Operator-owned user bridge name/ID, or a per-owner private bridge created by Rustack;≤128 ASCII bytes; explicit none opts into disconnected pure handlers with SDK callbacks unavailable; never host/default-bridge/arbitrary-container sharing |
+| LAMBDA_DOCKER_PULL_POLICY | never / ifMissing; default never; missing image gives actionable error |
+| LAMBDA_DOCKER_REGISTRIES | Required for ifMissing; comma-separated≤32 approved registry hosts, each≤253 bytes; exact host[:port] matching, no suffix matching |
+| LAMBDA_DOCKER_REGISTRY_AUTH_FILE | Optional operator-owned YAML credential map by approved registry host;≤64 KiB,≤32 entries, secret fields redacted and permissions checked; parse as a secret-bearing type, never execute credential helpers |
+| LAMBDA_DOCKER_GATEWAY_ENDPOINT | Optional operator-trusted HTTP(S) endpoint reachable by functions;≤2,048 bytes; no userinfo/fragment; never derive from a request Host header |
+| LAMBDA_DOCKER_SDK_ACCESS_KEY_ID | Disabled unless paired with the explicit SDK secret;1..128 ASCII identifier bytes, no ambient/server-credential fallback; requires the configured gateway and connected proof |
+| LAMBDA_DOCKER_SDK_SECRET_ACCESS_KEY | Paired local test secret;1..256 nonspace printable ASCII bytes; secret-wrapped/redacted, never included in function metadata/archive; partial pairs fail before IO |
+| LAMBDA_DOCKER_UID / GID | Default1000; nonzero bounded numeric IDs; only overrides absent/root image USER |
+| LAMBDA_DOCKER_CPU | Default1; finite decimal CPU units in 0.1..16; no zero/unlimited value |
+| LAMBDA_DOCKER_LOG_RING_BYTES | Default262,144;4,096..1,048,576 per stdout/stderr ring |
+| LAMBDA_DOCKER_CROSS_ARCHITECTURE | false; true permits an explicitly configured daemon emulation path, outside guaranteed performance |
+| LAMBDA_DOCKER_ZIP_IMAGE | Required only for Docker ZIP; provided.al2023 image pinned by content/digest; no implicit runtime catalog |
+
+Retain LAMBDA_DOCKER_ENABLED as the existing alias for explicit docker selection; conflicts remain errors. Add configured local test credentials through the existing secret-bearing configuration mechanism; never print them or infer real AWS credentials from the host. The advertised gateway endpoint and the function-visible endpoint are independent; the former cannot automatically solve Docker networking.
+
+Registry credential records accept only approved host, username≤256 bytes, password≤4,096 bytes or identityToken≤8,192 bytes, with explicit mutual-exclusion rules and secret wrappers. The credential-file path is an operator-controlled local path, loaded with a timeout and restrictive file-ownership/permission checks. The configuration file must not be included in generated artifacts, snapshots or user-code mounts.
+
+### 1.2 Tunable budgets
+
+All budgets are validated once; limits below are local defaults and safe configuration maxima. Static AWS payload/definition quotas are compile-time constants and cannot be raised by YAML.
+
+| Budget field | Default | Allowed range / relationship |
+|---|---:|---|
+| workflowApiAccepted / workflowApiWorkers |32 /8|1..128 /1..32; workers≤accepted, root admission remains charged through ready replies |
+| workflowPaginationBytes |64 MiB|8 MiB..1 GiB incremental shared snapshot storage, plus core allocation/history budgets |
+| workflowRegistryMachines |256|1..4,096 current resources |
+| workflowRegistryVersions |1,024|1..4,096, independently applied to retained definition revisions and immutable tag versions |
+| workflowRegistryRecords |10,000|1..100,000 total retained execution records, including RUNNING and unsettled terminal work |
+| workflowRegistryCommands |128|1..1,024 accepted commands, held through pending CPU preparation and unobserved replies |
+| workflowOpenExecutions |128|1..4,096, including children |
+| workflowEvaluations |8|1..128; retained blocking evaluation/entropy workers |
+| workflowDispatches |32|1..1,024; released while waiting on child/callback |
+| workflowLambdaAcceptedCalls |128|1..1,024; separate binary-bridge queue/running/quarantine ownership budget |
+| workflowLambdaCleanupSeconds |10|1..60; initial cleanup observation only, never releases an unresolved invocation |
+| workflowFrames / workflowFramesPerExecution |4,096 /512|1..4,096 /1..512; per-execution≤global; roots and retained ancestor leases count |
+| workflowResultBytes / workflowResultBytesPerExecution |256 MiB /32 MiB|4 KiB..1 GiB /4 KiB..128 MiB; per-execution≤global; intermediate indexed aggregation slots |
+| workflowMaxDurationSeconds |3,600|1..31,536,000; independent local ceiling even without ASL TimeoutSeconds |
+| workflowTransitions |100,000|1..1,000,000; history may exhaust first |
+| workflowSnapshotBytes |512 MiB|1 MiB..1 GiB; conservative copy and per-part encoded limit |
+| workflowHistoryBytes / workflowTotalHistoryBytes |32 MiB /256 MiB|1..256 MiB /8 MiB..4 GiB; per-execution≤total |
+| workflowCompletedExecutions |10,000|1..100,000; do not evict unexpired retained records |
+| workflowRetentionSeconds |86,400|60..7,776,000; terminal history retention |
+| workflowNameTombstones |100,000|1..1,000,000; always retain names 90 days |
+| workflowPaginationTokens |10,000|1..100,000; token TTL 24h |
+| workflowCallbackTokens / workflowCallbackTombstones |4,096 /100,000|1..65,536 /1..1,000,000; retained active+closed entries≥live tokens; closed-token TTL follows workflowRetentionSeconds |
+| workflowCallbackCommands / workflowCallbackWorkers |1,024 /8|1..100,000 /1..128; commands include accepted actions and ready acknowledgments; workers bound retained mint entropy |
+| lambdaDockerEnvironments |32|1..32 initially, including busy/idle/quarantined environments |
+| lambdaDockerMemoryBytes |8 GiB|256 MiB..1 TiB; includes relay caps and all allocated environments |
+| lambdaDockerPullSeconds |300|1..600; one absolute queue/connect/progress deadline, independent of metadata IO |
+| lambdaDockerDeploymentJobs |8|1..32; queued plus running deployments;≤image preparation capacity and pin budget |
+| lambdaDockerDeploymentSeconds |300|1..3,600; absolute queue plus preparation deadline |
+| lambdaDockerImagePins |1024|1..8,192; preparations, live revisions/captures and quarantined aliases |
+| lambdaDockerIoSeconds |5|1..60; independent bounded management/mutation and partial-control IO budget |
+| startupSeconds |600|1..3,600; one process startup deadline before entropy/provider/listener/snapshot work |
+| lambdaDockerStartSeconds |15|1..60; total environment start/probe cap |
+| lambdaDockerCleanupSeconds |10|1..60; bounded by global shutdown remaining time |
+| workflowDrainSeconds |5|0..60; bounded by global shutdown remaining time |
+
+Deployment JSON/base64 workers have a fixed aggregate ceiling of four, retained through completed results and provider dispatch; overload returns429. Code bodies remain capped at96MiB, with only the designated inline ZIP span exempted from the1MiB metadata budget. Unknown fields and malformed/budget-exceeding JSON return static400 errors; worker failure is a static500 error. See [runtime §2.12](./rustack-workflows-20-lambda-runtime-design.md#212-side-effect-free-code-validation-and-bounded-deployment-json). These are compile-time safety ceilings, not YAML tuning fields.
+
+Registry/execution mailbox capacities and per-tick quantum are compile-time implementation constants from the ASL design, not runtime tuning knobs. Function init/idle settings reuse existing validated Lambda configuration. CPU and log limits use the exact environment keys above. Effective memory admission may allow fewer than 32 environments. Lower quotas must reject admission or fail the affected execution explicitly, never silently drop data/work.
+
+### 1.3 Persistent Docker namespace ownership
+
+Acquire the existing configured data directory before constructing a mutating image owner. [Runtime §4.1](./rustack-workflows-20-lambda-runtime-design.md#41-persistent-directory-lease-and-namespace-capability) defines its descriptor lease, immutable checksummed owner UUID, fresh run UUID and filesystem trust rules. Acquisition has a positive absolute deadline≤60s and a fixed four-worker IO ceiling. Require an operator-controlled local filesystem with advisory locking, atomic rename and directory sync support; an unsupported filesystem fails acquisition rather than falling back to an unlocked namespace. ACLs must not grant untrusted namespace/ancestor replacement, and operators must not unlink/replace live lock files or data roots. Same-UID/root or Docker-daemon adversaries remain outside this local execution isolation promise.
+
+The permanent lease.lock inode is never truncated, replaced or deleted during release. Last-descriptor closure releases exclusion; image scopes, pins, queued work and quarantined cleanup retain clones until their ownership settles. A failed/cancelled acquisition may leave bounded initialization files, which are validated on retry. A corrupt published identity fails closed and is never silently regenerated. Errors contain static classes without operator paths or identity values. No Docker effect is authorized until acquisition succeeds.
+
+This capability alone is not a ready backend. Startup must separately reconcile prior runs and unresolved historical effects under the same persistent owner before accepting image execution. Do not treat one empty list/404 as proof that a prior uncertain daemon mutation cannot appear later. Shutdown keeps the lease until environment/deployment/image cleanup owners are joined; unresolved cleanup prevents successful quiescence/snapshot publication.
+
+### 1.4 Network and kernel probe receipts
+
+Startup must use [runtime §4.7](./rustack-workflows-20-lambda-runtime-design.md#47-startup-network-qualification-and-actual-resource-probe) to inspect an exact operator bridge and bind the full network ID before allocation. none is deliberately disconnected. Relay/function creation explicitly requests private cgroup namespaces; the pinned Rust probe checks current controller membership before reading normalized kernel limits. Host validation and joined retirement precede issuance of a private, exact-input resource proof; a final deadline/live-input check prevents late or revoked success. A serialized report alone cannot establish readiness.
+
+`make test-lambda-probes` runs bounded parser/qualification/facade regressions. `make test-lambda-probes-docker WORKFLOWS_DOCKER_SOCKET=<socket-path> WORKFLOWS_ARCH=arm64 WORKFLOWS_NETWORK=<existing-user-bridge>` requires an explicit pre-provisioned operator bridge and the pinned fixture images; it runs both none and bridge cases without silently skipping either. Tests do not create/delete the operator bridge. Test provisioners retain their own bridge identity/ownership and remove only their known bridge after all attached probe environments settle.
+
+Current actual execution evidence is on cgroup-v2 arm64 VZ and amd64/QEMU daemons. v1 normalization/private namespace behavior has parser and allocation-body coverage; an actual v1 daemon lane is still unmeasured. Network/resource receipts are implemented components; historical uncertain effects, registry pulls, endpoint reachability and the production startup coordinator remain mandatory before CLI Docker enablement.
+
+### 1.5 Historical container records
+
+[Runtime §4.8](./rustack-workflows-20-lambda-runtime-design.md#48-durable-container-intents-and-restart-reconciliation) defines the bounded containers.v1 snapshot and its safe staging file. Environment creation durably records identity before daemon issuance; known IDs are persisted before deletion. Failed durable erasure retains allocation capacity even when Docker returned a no-effect status or the container is absent. Never remove these files to bypass an unresolved startup: unknown absence can precede a late create.
+
+Before ordinary admission, call reconcile_containers under the same DirectoryLease. It processes historical functions before their relays, leaves current-run records untouched and returns remaining/settled counts. Unknown404 remains unresolved; a positive exact identity is pinned durably before ID-only retirement. Repeating a cancelled/failed pass resumes the saved state. Foreign identity or corrupt/unsafe files fail closed. This operation covers recorded environment containers; private image aliases are reconciled afterward through the separate pin journal described below. Other mutation classes, allowed pulls and the complete coordinator remain required before production readiness.
+
+`make test-lambda-recovery` covers bounded/corrupt files, restart transactions, cancellation, foreign resources and delayed commits. `make test-lambda-recovery-docker WORKFLOWS_DOCKER_SOCKET=<socket-path> WORKFLOWS_ARCH=arm64` provisions actual owned containers, releases/reacquires the directory under a new run and retires the historical pair. Failed actual qualification preserves durable ownership evidence rather than deleting the temporary data root.
+
+#### Historical private image aliases
+
+[Runtime §2.13](./rustack-workflows-20-lambda-runtime-design.md#213-durable-image-pin-intents-and-historical-alias-retirement) defines pins.v1/pins.pending under the same retained descriptor lease and serial transaction boundary. The image owner persists intent before Tag, commitment before publishing a live lease or deleting an alias, and erasure before releasing pin capacity. Failed storage retains ownership and quarantine through retry; a positive acknowledgment or exact inspection remains a retained Committing phase until its publication succeeds. Never remove these files to bypass unresolved effects.
+
+After historical containers settle, reconcile_image_pins examines only previous-run records. An unknown404 remains unresolved, while matching positive identity can establish durable commitment. Confirm absent committed aliases before durable erasure; never replay Tag or remove operator source tags/digest IDs. The returned counters do not establish backend readiness. Both recovery operations require the same daemon that received the intents: before production admission, durably bind the directory to a validated stable daemon identity before the first mutation, and reject mismatched or unprovable historical bindings before any404-based settlement. This mandatory binding prerequisite is implemented as W217/D76 in the [review backlog](./rustack-workflows-93-review.md).
+
+`make test-lambda-image-recovery` runs the codec, retained image-owner and scripted recovery regressions. `make test-lambda-image-recovery-docker WORKFLOWS_DOCKER_SOCKET=<socket-path> WORKFLOWS_ARCH=arm64` adds actual unknown-visible and committed-absent alias recovery across directory reacquisition. Tests retain/print the evidence root on failure, verify the original source tag and exact alias absence, and always attempt joined wire cleanup. Ordinary CLI Docker selection remains unavailable pending the coordinator and remaining M0 gates.
+
+The W217 consumer uses [runtime§4.9](./rustack-workflows-20-lambda-runtime-design.md#49-durable-daemon-binding-and-connection-local-identity-fences): bind the raw wire port to the exact directory before constructing runtime owners or recovering records. daemon.v1 persists the canonical engine UUID; a missing binding with any journal record, corrupt binding or changed ID rejects startup. Never delete/reset it to bypass failure. Keep the operator engine-id unique and coupled to its Docker data root; cloning/resetting it while ownership is outstanding violates the local installation identity contract. Every bound request verifies identity on the same connection it uses for the operation, and cannot reconnect after a checked connection closes. A bound port retains directory exclusion through queued and in-flight work. This prerequisite does not grant production readiness.
+
+Before starting any runtime producer, call [runtime§4.10](./rustack-workflows-20-lambda-runtime-design.md#410-recorded-namespace-retirement-and-complete-observed-inventories) reconcile_namespace using the exact bound port. It drains recorded containers before pins (in a code-generation root, loaders/code volumes retire between them), retains unknown effects and audits the complete observed owner namespace without limit64 or slash-limited reference globs. Current-run work, unrecorded owned resources, oversized metadata or later nonempty observations reject qualification. Do not remove journals or auto-adopt these resources to bypass uncertainty. The all-images response retains the1MiB shared metadata ceiling; a larger cache explicitly fails this local profile. Keep producers excluded until the complete startup coordinator consumes all remaining proofs. The returned counters and empty observations do not alone establish readiness or certify pre-journal mutation provenance.
+
+#### Historical code volumes and loaders (D90)
+
+[Runtime§6.6](./rustack-workflows-20-lambda-runtime-design.md#66-code-namespace-provenance-and-recovery-boundary-d90) adds explicit fresh `RSDKOWN3` roots and bounded `code.v1`/`code.pending` snapshots. Default Image roots remain `RSDKOWN2`; existing generations1/2 cannot be upgraded or accept any code journal file. General acquisition and ordinary Image startup understand3 for historical recovery; older binaries reject its magic. Do not rewrite the owner or remove journals/bindings to bypass quarantine. Initial daemon binding refuses nonempty code records, and existing binding validation also enforces the namespace profile.
+
+Keep producers excluded while namespace recovery retires recorded consumers, code loaders, code volumes and image pins in that order. Loader deletion uses force=false and never starts/kills/waits for uploaded code. Unknown404 remains unresolved; matching positive identity is persisted before deletion, while known404 can establish retirement. Complete volume audits run before pin retirement and in the final startup/shutdown observations for generation3. Current-run code records, any remaining code count, orphan volumes, identity conflicts or incomplete observations block readiness without adoption/deletion of unrecorded resources. Direct pin recovery rejects any code record. D90 adds the durable reader/recovery prerequisite. D91 adds the separately retained producing library owner (§6.7): join all mount consumers, then code preparation/retirement, then image pins and Docker wire. Keep the preparation retirement receipt when result observation fails; a preparation error does not establish physical retirement or release parent environment admission. Ordinary ZIP runtime/provider installation remains required.
+
+### 1.6 Executable M1 gateway composition
+
+The opt-in `stepfunctions` binary feature registers the real typed HTTP target-family router before all heuristic path/signing-scope routers and the S3 catch-all. `SERVICES=stepfunctions` also works without the Lambda feature/service. Conflicting paths, duplicate targets and query-protocol content/signing headers still reach Step Functions envelope validation; no fallback into another service is allowed. It uses the validated default region/account, partition `aws`, and `STEPFUNCTIONS_SKIP_SIGNATURE_VALIDATION` (default true, the existing local-development policy). Strict mode requires the existing static credential provider before listening. Lambda Tasks are enabled only when the actual registered Lambda provider has an explicitly selected non-disabled executor and its scope matches. Otherwise compilation rejects Lambda Tasks while pure workflows remain available. No implicit code-execution selection is introduced. Shared gateway routing must pass strict production boundary lints: consolidate repeated SigV4 service classification into a borrowed iterator parser, and remove unchecked indexing/allocation from Lambda date-prefix classification while preserving existing route matches. Exercise malformed credentials and supported/rejected Lambda prefixes; this is gateway integration boundary closure, with no authentication-policy change.
+
+Implement the M1-supported budgets from §1.2 in the existing root `budgets` mapping: workflowApiAccepted, workflowApiWorkers, workflowPaginationBytes, workflowPaginationTokens, workflowRegistryMachines, workflowRegistryVersions, workflowRegistryRecords, workflowRegistryCommands, workflowNameTombstones, workflowRetentionSeconds, workflowOpenExecutions, workflowEvaluations, workflowDispatches, workflowMaxDurationSeconds, workflowTransitions, workflowSnapshotBytes, workflowHistoryBytes, workflowTotalHistoryBytes, workflowLambdaAcceptedCalls, workflowLambdaCleanupSeconds and workflowDrainSeconds. Validate their ranges/relationships before allocation; execution history still has the static25,000-event ceiling. Frame and intermediate-result settings workflowFrames, workflowFramesPerExecution, workflowResultBytes and workflowResultBytesPerExecution are enforced by the structured supervisor. Callback budgets are installed by§1.7; the separate completed-record budget remains proposed until persistence/retention work installs it. No ignored configuration field may pretend to enforce a quota.
+
+```text
+validated YAML/scope ──► main composition ◄── actual registered Lambda provider
+                              │                    (optional, explicit executor)
+                              ▼
+gateway: exact SFN target first → bounded typed HTTP → retained API/registry
+                                                        │ captured revision
+                                                        ▼
+                                                execution supervisor
+                                                        │ actual Task port only
+                                                        ▼
+                                                Lambda bridge → provider
+```
+
+The gateway capability response reports the installed JSONPath/eight-state profile, Inline Map concurrency ceiling40 and enforced frame/result quotas, whether the actual Lambda port is installed, effective local limits, and resources-and-history snapshot coverage under§3.3 with snapshotResume=false and paginationEpoch=fresh-on-restart. Available integration is distinct from final Docker qualification. The Step Functions transport owns its full modeled request deadline; the gateway must not race it with an earlier generic504 timer. Actual socket slow-body timeout qualification must assert the AWS JSON error and request-ID header. Readiness reads API state, registry worker/cleanup status, installed callback root status and installed bridge status without submitting a business command. Registry status is updated on command/maintenance boundaries (at most a one-second maintenance interval), and root loss closes readiness immediately. Last ordinary Lambda diagnostics (missing function, business failure, handler timeout or Stop) do not poison readiness after cleanup settles; permanent worker failure/uncertainty does. Manual Docker provider injection requires image_available readiness; the ordinary CLI still rejects unsupported Docker selection before listening.
+
+### 1.7 Executable callback service composition
+
+Compose the registered callback owner§5.5/D66 and public adapter§1.4/D67 in the real WorkflowRuntime when the actual selected Lambda port exists. Start one scoped CallbackRegistry/unique CallbackSupervisor, install its handle into the fresh ExecutionSupervisor, then compose Registry and API from that same binding. Pure services and disabled/unavailable/unqualified Lambda providers allocate no callback root and keep callback definitions/API unavailable. Preserve feature-minimal builds and explicit executor selection; this does not enable Docker startup or qualify its network.
+
+Support YAML workflowCallbackTokens=4096 (1..65,536), workflowCallbackTombstones=100000 (1..1,000,000 and≥tokens), workflowCallbackCommands=1024 (1..100,000), workflowCallbackWorkers=8 (1..128). Build CallbackLimits with workflowRetentionSeconds (60..7,776,000s). Validate all fields and relationships before allocating/spawning roots, including pure-service configurations; reject unknown/invalid settings. Tombstone capacity includes active classification reservations, not an extra independent live+closed pool. Actual callback preparation/result bytes share the existing global/local workflowResultBytes budgets; do not add unenforced storage settings or make budget exhaustion a wait holding dispatch capacity.
+
+WorkflowStatus retains a read-only handle to that exact callback root. Admission-independent readiness includes its status.ready in addition to API, registry and actual bridge health. Publish callbacks=true only when the real registered callback/SendTask composition is installed; this is integration availability, separately reported from dockerQualified=false and the independently qualified snapshot=resources-and-history contract under§3.3. Report all four effective callback limits and their shared retention interval. Root loss/close immediately makes readiness false without requiring a command slot; temporary live/retained/command saturation is an action quota error, not permanent worker unhealthiness. A missing Lambda port leaves callbacks=false.
+
+Retain the callback controller in the unique WorkflowSupervisor. Normal resumable shutdown order is API close/join → original grace cutoff → registry cancellation/physical cleanup join → callback root close/join → bridge close/join → Lambda provider. A Callback phase is retained after observer expiry; all joins share the original global absolute deadline and never restart grace/mint/preparation. Preserve the first typed diagnostic if a later owner fails. On final-cleanup observation failure, signal registry, callback and bridge close independently before main attempts provider destruction; no successful consistency cut is claimed until all owners prove cleanup. Closing callback intake early must not certify execution/physical cleanup. A dropped unique controller still closes its own root through existing Drop behavior.
+
+```text
+validated YAML + explicit selected Lambda provider
+              │
+              ▼
+       actual Lambda bridge ◄──── execution physical calls
+              │
+              └─ CallbackRegistry(scope, limits) + unique controller
+                         │ install before any execution
+                         ▼
+                 ExecutionSupervisor → Registry → typed API
+                         │               │          │
+                         │ retained ASL  │ binding  └─ SendTask commands
+                         └───────────────┴────────────▶ callback actor
+
+readiness = API ∧ registry ∧ installed callback root ∧ installed bridge
+shutdown  = API → grace → registry → callbacks → bridge → provider
+expiry    = retain same phase/joins; final close signals every retained owner
+```
+
+Qualification: validate exact YAML boundaries/defaults/relationships and reported limits; pure/minimal services reject callbacks; actual Native composition accepts callback ASL and all three APIs; callback root closure bypasses saturated ordinary admission and poisons readiness; resumable/expired final shutdown retains phase and signals every owner. Before publishing this capability, the consuming binary must pass the real handler SDK acceptance below, including signed callbacks from Rust SDK and boto3 and consumed PID retirement. No dependency package/version changes or relaxed authentication are required for the feature.
+
+## 2. Deployment topology and readiness
+
+| Topology | Control path | Handler SDK path | Required test |
+|---|---|---|---|
+| Host Rustack + Linux Docker | Local socket + attach | Configured host-gateway address; bind gateway on an operator-approved reachable interface | Linux amd64/arm64 |
+| Host Rustack + Docker Desktop | Desktop socket + attach | host.docker.internal with reachable gateway bind | macOS arm64 |
+| Rustack server container + sibling functions | Mounted daemon socket + attach | Shared user bridge and stable Rustack service alias | Linux container lane |
+
+The host example requires a suitable gateway listener; the default host loopback listener is not universally reachable from containers. Do not change the default listener merely because Docker is enabled. Startup diagnostics explain the chosen endpoint and its probe status. With no function-visible endpoint, pure handlers may run, but capabilities state that SDK callbacks are unconfigured. rootless Docker requires its limit capabilities to be probed; unsupported resource enforcement fails explicit Docker readiness rather than removing limits.
+
+Expose capability fields for workflow type/query profile/state types/integrations, local quotas, snapshot coverage, Docker platform, backend probe result, relay protocol version and limitations. Distinguish available adapter from successfully executed test fixture. Health endpoints remain free of ordinary business admission starvation. Metrics contain bounded error classes/counts/durations, not function names, input, image credentials or task tokens as unbounded labels.
+
+### 2.1 Bounded Lambda admission diagnostics (D86)
+
+The existing `/_rustack/capabilities` worker projection gains optional `workers.lambdaAdmission` whenever the actual Lambda provider is installed, on every backend. It is omitted without Lambda. No new route, authentication policy, business request option, persistence field or quota-setting surface is added.
+
+```json
+{"acceptedInvocations":0,"activeExecutions":0,"accepting":true,
+ "limits":{"acceptedInvocations":128,"activeExecutions":32,"defaultFunctionExecutions":8}}
+```
+
+`acceptedInvocations` counts the real accepted-work semaphore charges, including queued asynchronous work and retained cleanup. `activeExecutions` counts the real global execution permits, including Native/Docker execution, Docker pool waiting and failure/cancellation cleanup; it is not a running-container count. The provider exposes a typed non-exhaustive `InvocationWorkStatus` with typed `InvocationWorkLimits`, both redacted-data-free Debug/serde camelCase values. Read the same WorkManager used by real provider submissions; never substitute a fixture counter or cumulative invocation metric. Values are bounded by their reported limits; the two atomic counters are independently sampled, not a transactional cross-counter snapshot. Stable held-work tests can require exact values while no completion is possible.
+
+The qualified Docker worker also projects optional `workers.docker.capacity`, using the exact existing EnvironmentPort status: allocated, memoryBytes, quarantined, accepting and workerFailed. Omit it before qualification. These are retained reservation counters (including incomplete/quarantined cleanup), not a count of presently running processes; independently sample them without IO/mailbox admission. A stopped/deleted function can still retain its full function+relay memory charge until the paired relay/IO/journal ownership settles. This reuses the existing bounded EnvironmentCapacity type and contains no peer/resource identity.
+
+Reading diagnostics never starts a supervisor, submits business work, takes execution/admission permits, waits on actor mailboxes or changes readiness. Counts contain no function names, ARN, payload, image URI, request IDs, credentials or tokens. Existing diagnostic access/readiness rules remain authoritative. Limits come from the same constants used to construct/acquire the semaphores and default function capacity. Serialization is deterministic and bounded; service feature gating preserves minimal builds.
+
+```text
+WorkManager owned semaphores / accepting flag
+                    │ constant-time read, no admission
+                    ▼
+RustackLambda::work_status → RuntimeWorkers::diagnostics
+                                        │
+                          existing capabilities JSON
+```
+
+Qualification must show idle0 without lazy supervisor initialization, actual accepted versus active divergence, exact saturation/cleanup retention and return to0, cached admission closure, typed JSON fields/limits and absence for non-Lambda services. Existing actual Docker32/default8 resources consume this boundary, alongside Native regression. Independently mutate/lower permit ownership in controls so a claimed capacity cannot be manufactured merely from configured limits or an Event acknowledgment.
+
+## 3. Shutdown, cancellation and snapshots
+
+```text
+┌─ admission boundary ───────────────────────────────────────────────┐
+│ mark draining; reject new external work                           │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ producers and workflow workers ───────────────────────────────────┐
+│ Events/SNS quiesce → Step Functions drain/cancel → Lambda quiesce  │
+│                   owned children / tokens / invocations cleaned   │
+│ DDB and other existing workers retain their required dependencies │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼ SQS/final downstream quiescence
+┌─ consistency cut ──────────────────────────────────────────────────┐
+│ no RUNNING execution; no unresolved container cleanup             │
+│ success → existing atomic snapshot save → workers shutdown        │
+│ failure → retain prior snapshot; diagnostics; nonzero exit         │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+The binary keeps the unique composite WorkflowSupervisor outside the shared RuntimeWorkers health view. It directly retains ApiSupervisor, RegistrySupervisor, optional CallbackSupervisor and optional LambdaBridgeSupervisor; no Mutex or additional unowned task is needed. Cancellation of an observing quiesce future retains those exact controllers and its shutdown phase. Final cleanup uses a separate shutdown entry point: skip grace, retain the same API/registry/callback/bridge joins, and synchronously signal all remaining controllers if the observer deadline expires before joining. A resumed final observer does not re-enter grace; uncertainty still forbids a successful consistency cut. One drain cutoff is captured on first quiesce; a resumed waiter never restarts the grace interval.
+
+```text
+main (unique mutable ownership)        gateway (shared read-only handles)
+  WorkflowSupervisor                    WorkflowStatus
+    ├─ ApiSupervisor     ◄────────────    API readiness
+    ├─ RegistrySupervisor◄────────────    registry status watch
+    ├─ CallbackSupervisor ◄────────────    callback root readiness
+    └─ LambdaBridgeSupervisor             actual port readiness
+       │
+       ▼ one resumable shutdown phase
+  API join → grace cutoff → registry cancel/join → callback join → bridge join
+  final stop: skip grace; expiry → close retained owners, no successful cut
+       │ clean only
+       ▼
+  Lambda quiesce → snapshot decision → final worker shutdown
+```
+
+Producer quiescence precedes the composite. Failure of HTTP drain or producer quiescence still enters final workflow cleanup before provider destruction. Cleanup failure is propagated, and the other providers still receive their final cleanup attempt under the global deadline. Dropping the composite closes all child controllers; their existing retained roots remain responsible for accepted work. Workflow resources/history are not added to the current snapshot format by M1 registration; capabilities and startup coverage must state this explicitly.
+
+The workflow drain interval permits already accepted executions to finish. Then cancel remaining executions with ABORTED and error=Rustack.Shutdown, preserving terminal history. This is deliberate local shutdown behavior, not cloud-style pause/resume. Revoke callback tokens, cancel owned children and await Lambda cleanup before Lambda itself quiesces. Quarantine or unfinished cleanup prevents publishing a successful consistency snapshot. Quiescence must be idempotent and share one global absolute deadline, not restart a full timeout per worker.
+
+The host and pinned relay image must implement control protocol version2 together (§3.8 of the runtime design). An older version1 relay is incompatible and fails initialization before function allocation. Rebuild/re-pin the relay on protocol upgrades; do not silently omit handler-timeout enforcement to accept an older image. Caller absolute budgets include queue/startup/execution; the captured function handler budget arms only at consumed Runtime API delivery. Cleanup remains independently owned if the caller budget expires.
+
+LogType=Tail uses the invocation's bounded observed log window; environment-wide diagnostic tails remain separate. Window boundaries follow actor-observed completed chunks across independent stdout/stderr and control streams. Buffered/background output can arrive in a later window; this local runtime does not claim a causal producer flush barrier. A silent invocation never copies the prior collected diagnostic tail. Lost capabilities or unconsumed/expired mutation receipts invalidate capture and require environment retirement. No flush sleeps or extra Docker log replay are used.
+
+The real binary API adapter uses [API§1.3/§6.1](./rustack-workflows-10-api-design.md#13-retained-real-api-adapter-and-preparation) the supported validated YAML limits from §1.6. Its root owns request workers and PageStore; token entries are count-bounded and share a separately byte-charged read capture. Charge vector capacity, not filtered length. Stop API admission and join its same workers before registry shutdown. Loss of API/Registry command handles alone does not cancel accepted executions while the unique registry supervisor remains alive. API health distinguishes a closed intake or retained worker failure, with typed diagnostics preserved through shutdown.
+
+Registry constructor limits implement [API§3.1](./rustack-workflows-10-api-design.md#31-executable-registry-ownership-and-resource-lifecycle); §1.6 wires its supported YAML fields. One retained blocking worker acquires secure IDs while its pending command stays owned above the await. Source fingerprints/compilation are prepared by the embedding caller's bounded CPU owner. Record and name TTLs never release uncertain cleanup; deletion may remove mutable tags while the captured revision/resource identity remains retained. Immutable tag versions have independent allocation accounting, and cloned list snapshots share those allocations. Close the registry and observe the same joined shutdown, then close/join the installed callback root before closing its Lambda bridge. Root failure synchronously signals the execution owner and preserves the bounded graph instead of inferring cleanup.
+
+The Step Functions Lambda bridge closes and joins before provider quiescence. Its supervisor retains one manager join across deadline expiry or a dropped shutdown waiter; unresolved Lambda handles and bridge slots remain charged, and the same cleanup observer can later settle the receipt without a second business outcome. See [integrations§1.1](./rustack-workflows-40-integrations-design.md#11-owned-admission-receipts-and-the-binary-lambda-bridge). The main composition supplies these validated budgets from the supported YAML fields in §1.6.
+
+Within Lambda, stop deployment/invocation producers before retiring the pool/environment consumers. Join EnvironmentPool before EnvironmentManager, then join EnvironmentManager before revoking image leases, and join image cleanup before DockerWire shutdown. Environment count and aggregate function+relay memory remain reserved through allocating, idle, busy and quarantined states; a timed-out shutdown waiter leaves that ownership intact. A removed environment's business failure is distinct from failed supervision: known protocol/handler errors may retire cleanly, while Worker failure remains cached even after physical recovery. The lower-level owner alone is not a startup readiness receipt; historical uncertain effects and daemon/network/resource probes remain separate required gates.
+
+Snapshot coverage:
+
+| Resource | Persist | Restore behavior |
+|---|---|---|
+| Machine definitions/revisions, role/config/tags | Yes | Validate, compile and stage all records before replacing live state |
+| Terminal executions/history and captured machine revision | Yes, within retention/byte budgets | Preserve outcomes, causality, pagination source data and DescribeStateMachineForExecution |
+| Name tombstones | Yes | Retain remaining90-day reservations; reject overflow rather than shorten retention |
+| RUNNING records in imported/unexpected archives | No resumption | Convert to ABORTED/Rustack.ExecutionInterrupted before serving; never replay uncertain side effects |
+| Callback tokens/live handles/pagination handles | No | Fresh runtime epoch invalidates old handles; no plaintext token archive |
+| Lambda image content references/config | Yes | Validate same digest/content availability before image execution; no tag re-resolution; serialized metadata never grants a live PinnedImage |
+| Lambda deployment readiness/update state | Yes | Apply [runtime §2.10](./rustack-workflows-20-lambda-runtime-design.md#210-deployment-state-and-atomic-settlement): reject contradictory legacy/typed status; abandoned initial/update work becomes failure, retaining prior update code |
+| Docker image layers, containers, tmpfs and code-process state | No | Images must be preloaded/allowed pulls must fetch exact digest; environments start cold |
+
+Use the existing versioned service archives: `services/stepfunctions/meta.ss.zst` and `data.ss.zst` for definitions/indices and bounded history payloads. Store durable DTOs, not Arc/compiler heap/channel layouts. Recompile definitions with an archived profile version. Unknown profile versions or invalid references fail import atomically. Add versioned Lambda image metadata to its existing archive, preserving the existing artifact protections. Imported run records do not authorize deletion of containers from another owner.
+
+Reserve terminal-record and name-tombstone capacity at Start admission so accepting a run never depends on finding retention capacity after its side effects finish. Reserve the terminal history allowance independently of ordinary event append capacity. History deletion cannot release a still-live name reservation.
+
+There is no WAL: SIGKILL may lose all requests since the previous completed snapshot. A running-record conversion can explain an imported historical record; it does not recover executions that were never saved. Old completed snapshots remain recoverable under the existing replacement protocol. Restored pagination handles are invalid, and this epoch boundary is advertised.
+
+### 3.1 Sealed registry ownership and durable export
+
+Before workflow import, retain the actual registry state across its successful shutdown and implement the complete library export boundary. `Registry::export_snapshot(SnapshotLimits)` returns an owned, redacted-Debug, serde-Serialize `RegistrySnapshot` only after the unique registry root has drained every execution and proved physical cleanup. An accepting, merely closing, failed, panicked or quarantined root is not a sealed snapshot; an observer timeout while drain is still pending cannot expose one. The snapshot API does not use ordinary command admission and never starts/cancels work. The main snapshot coverage stays unsupported until the consuming restore/archive service is installed and qualified.
+
+The root retains its state above every await as today. On successful drain, perform final maintenance, validate that every retained record has one terminal outcome, stop date and Clean cleanup and that every name claim has a terminal close observation. Move resource maps, immutable terminal views and name reservations into one immutable capture published through a watch slot shared with Registry. Retain the prepared capture in the unique owner's failure guard while destroying the drained runtime/port owner before publishing: a destructor panic must expose no cut and preserve the original allocations in bounded quarantine. Publish at most once before root success; do not serialize/clone all payloads inside the actor. The capture retains the same revision/tag/record/history allocations and permits through the last shared observer, including after a shutdown controller is dropped. Root failure publishes no capture and preserves the existing quarantined graph. This is the registry's consistency cut only; the main supervisor still must join callbacks/bridge/providers before global snapshot publication.
+
+```text
+Registry commands / child submissions → unique registry root
+                                            │ close; original drain owner
+                                            ▼
+                           executions settle + physical cleanup joins
+                                            │ final maintenance / invariants
+                     ┌──────────────────────▼────────────────────────┐
+                     │ immutable sealed capture (one watch slot)    │
+                     │ moved resources + exact terminal read views  │
+                     │ original allocation permits + name claims   │
+                     └──────────────────────┬────────────────────────┘
+                                            │ retained after root join
+                         bounded caller CPU ▼
+                     export_snapshot(SnapshotLimits) → durable DTO
+                         error: retain same cut; no dispatch or replay
+                                            │ later consuming service
+                                            ▼
+                         CBOR/archive boundary§4.2 → atomic save
+
+root failure/quarantine → no sealed capture; no successful snapshot cut
+main shutdown still joins callbacks → bridge → Lambda before global publish
+```
+
+Capture one adjacent paired Tokio-monotonic/UTC sample before final maintenance and capture traversal. Perform final maintenance relative to that same monotonic cut; never pair an early monotonic reading with UTC observed after a long traversal. Retained record expiry is close-observation+configured retention; name expiry is close-observation+90days. Project the remaining monotonic interval onto that sample's UTC without millisecond truncation, so restart downtime ages the remaining reservation and rounding never shortens it. Expired clean records/names are removed by final maintenance; uncertain cleanup cannot be archived. Freeze the timestamps once: repeated exports from the same capture are identical even when observed later. Preserve existing separate record/name TTL semantics, deletion/recreation identities and independent caller snapshot allocations.
+
+Schema/profile versions start at1. Profile1 retains the existing effective STANDARD/JSONPath/OFF/tracing-disabled service contract; no unsupported mutable settings are invented. All DTO field names use camelCase; rows have deterministic order. The export is data only:
+
+| Root / row | Durable fields |
+|---|---|
+| Root | schemaVersion, profileVersion, scope(partition/region/account), stateSupport(sequential/structured), lambdaSupport, callbackSupport, capturedAt, resources, revisions, machines, executions, names |
+| resources (resourceId order) | resourceId, arn, createdAt; include identities captured by executions even after deletion/recreation |
+| revisions (revisionId order) | revisionId, resourceId, definition(exact UTF-8 source), sourceHash(32 bytes), roleArn, publishedAt; include old captured revisions once |
+| machines (ARN order) | resourceId, revisionId, status(active/deleting), updatedAt, tags |
+| executions (execution ARN order) | arn, resourceId, revisionId, input(exact original JSON text), optional traceHeader, startedAt, stoppedAt, expiresAt, outcome, history |
+| outcome (status tag) | SUCCEEDED + exact output text; FAILED or ABORTED + separately omitted/empty error/cause; TIMED_OUT without invented failure fields |
+| history | rows {timestamp, eventJson} in ascending event ID order: timestamp is the exact ordinary UTC datetime; eventJson is the complete official JSON DTO string, including its public numeric timestamp and all payload text/causal fields |
+| names (execution ARN order) | arn, expiresAt; include reservations whose retained execution has already expired |
+
+HistoryEvent's generated epoch_seconds adapter is JSON-only and truncates to milliseconds; never serialize that DTO directly as CBOR. The separate ordinary timestamp retains nanoseconds. A future importer must validate eventJson as the official DTO, cross-check its numeric timestamp against the public projection of the exact timestamp, then restore the exact UTC instant; a disagreement rejects the archive. Preserve all other official fields byte-for-byte through the JSON string and keep injected-token projections intact. Qualify an actual Ciborium wrapper round trip with a nanosecond timestamp and demonstrate the direct-DTO CBOR failure/precision loss as a negative control.
+
+Serialize no compiled heap layout, actor/channel/permit, monotonic Instant, task token/hash/epoch, pagination handle, child runtime lineage, live deadline, port, infrastructure diagnostic/source error or cleanup handle. Persist the installed instruction/Lambda/callback profile, not an inferred capability from definition text. Root `Debug` and errors expose fixed classes, not rows. Intentional definition/input/output/history data remain available to the authorized archive consumer; injected callback credentials stay absent through the already qualified history provenance boundary.
+
+SnapshotLimits is a validated library source-copy budget of1byte..1GiB, default512MiB. Before cloning source/history data, conservatively charge4096 bytes of root/metadata allowance per resource/revision/machine/execution,512 per name, all exact definition/role/tag/input/output/error/cause/trace text bytes, and history's complete charged_bytes (which includes its fixed and terminal reserve allowances). Deduplicate shared resource/revision identities using borrowed keys before copying. Reject checked-arithmetic overflow, inconsistent UUID bindings or a budget overrun without returning a partial DTO or releasing the sealed source. History extraction must use bounded direct traversal, preserving every event rather than an API page; reserve its vectors fallibly. The embedding encoder independently enforces actual encoded section/archive bytes. This budget is an explicit bound on export work, not a claim that serialized bytes or total RSS equal it. Async embeddings must call synchronous export/serialization under their retained bounded CPU owner; no detached background encoder is introduced here.
+
+Qualification: live/closing/saturated-command roots reject export; clean shutdown (including controller loss) publishes exactly one deterministic capture; timed-out/dropped observers resume the same root and cannot expose premature state; failed/quarantined cleanup never seals. Exercise deleted/recreated identities, captured old revisions/roles/raw input, tags, all terminal outcomes, causal/full histories beyond page boundaries, independent name/record expiry with fractional intervals, conservative budget failures/retry and redacted Debug. An actual Native workflow must export computed terminal output and original history after joined cleanup. Source allocations stay charged through existing retained read handles and the sealed capture. This dependency does not implement restore or advertise the CLI archive service; those remain mandatory next tasks under5.2.
+
+### 3.2 Startup-only atomic registry restore
+
+Consume the exact schema1 export with strict data-only Deserialize DTOs, then compile/validate and reserve a complete replacement before one actor commit. The library APIs are `Registry::prepare_snapshot(RegistrySnapshot, SnapshotLimits) -> PreparedSnapshot` (synchronous caller-owned bounded CPU work) and `Registry::restore_snapshot(PreparedSnapshot) -> RegistryReceipt`; acknowledgment is RegistryResult::Restored. No HTTP action is added. Main archive registration remains a subsequent dependency. An embedding must decode under a byte/depth/node/collection/scalar bounded redacting adapter and join its preparation worker before shutdown; neither serde deserialization nor a parsed document alone grants domain validity.
+
+Use an atomic startup phase Open → Preparing → Serving. Any domain-valid business admission attempt closes Open for restore; invalid wire/domain requests do not. Preparing admits exactly one owning lease and rejects business admission independently of command capacity. Failed preparation or dropping an unsubmitted prepared graph releases all temporary charges before reopening Open. The lease binds to the exact Registry instance, not just matching account/region. A successful actor commit transitions permanently to Serving; subsequent restore is rejected even after deleting all resources. Closing/root loss dominates every phase. Keep health non-ready while Preparing. A prepared graph lost after submission remains owned by its accepted envelope; an expired/dropped acknowledgment never replays the replacement.
+
+```text
+bounded storage decoder → unvalidated RegistrySnapshot
+                                  │ startup Open lease (exact instance)
+                                  ▼ Preparing; business admission unavailable
+               caller's retained bounded CPU owner
+               ├─ validate all shapes/IDs/scope/profile/references/history
+               ├─ compile every revision and verify exact source hash
+               └─ reserve existing revision/tag/record/history pools
+                                  │ no invocations, frames, tokens or IO ports
+                                  ▼ PreparedSnapshot (graph first, lease last)
+                       same bounded registry command mailbox
+                                  │ no parsing/compilation/IO in actor commit
+                                  ▼
+               exact instance + Preparing + root not closing
+               swap resource/execution/name maps once → Serving → ack
+
+prepare/drop/failure → release partial graph, unchanged namespace, reopen Open
+closing/foreign lease/failed commit → no replacement or business dispatch
+observer loss after acceptance → same owned envelope; never repeat commit
+```
+
+The caller-owned prepared graph uses the exact actor allocation/history pools, not a second unaccounted store. Allocate these immutable quota handles during registry admission and share them with the preparer; maps remain actor-owned. Preparation constructs immutable terminal handles with Clean cleanup, closed view channels, no runtime deadline and empty runtime lineage. It allocates no open-execution/dispatch/frame/callback capacity, starts no task and invokes no Lambda/child/endpoint. The actor only moves the fully prepared maps and performs ordinary maintenance. Root consistency/export guards remain in force. Require the target to supply the same or stronger installed capabilities; reject a weaker target, unknown schema/profile, foreign scope and callback-without-Lambda profile before compilation. Then compile every revision and validate its history kinds against the archive's declared source state/Lambda/callback profile, independently of stronger target capabilities. This guarantees re-export can compile all captured revisions using its recorded installed profile.
+
+Keep strict DTO bounds before exposing deserialized fields: resources/revisions/machines≤4096, executions≤100000, names≤1000000, history≤25000 per row; definition≤1MiB; history eventJson≤2MiB; input/output≤262144bytes; resource/revision UUID strings≤36; ARN≤256 except role≤2048; trace≤256; tags≤50 with key/value≤128/256; errors/causes≤256/32768; scope strings use existing TenantScope bounds. Reject unknown fields, duplicate tags, overlong fields/collections and contradictory outcome fields, including extra fields on RUNNING and TIMED_OUT. Decode each required/optional instant from at most64bytes of canonical ordinary Chrono UTC text; reject excess fractional precision, noncanonical offsets/formatting and leap seconds instead of silently normalizing them. These are absolute decode ceilings; live configured quotas apply to the retained replacement after expiry pruning. SnapshotLimits applies the same conservative metadata/text/history estimate as export before compilation/copying; compute history charge with the engine's actual fixed/event/terminal-reserve sizes, without trusting a serialized charge counter. Deserialize errors remain the embedding adapter's fixed redacted Schema class; domain/prepare failures remain static RegistryError classes.
+
+Validate every row, including expired data, before treating it as ignorable. Require canonical secure UUID identities, unique resource/revision IDs, one current machine per ARN/incarnation, correct revision→resource bindings and no dangling/unused resource or revision rows. Parse/check every machine/execution/role ARN against the trusted tenant. Execution ARN must agree with its captured resource ARN; each retained/expired execution has exactly one matching name row. Every finite name expiry, including name-only rows, must lie in(capturedAt,capturedAt+90days]. Terminal record expiry must satisfy the same interval and be no later than its name reservation. Validate these original intervals before pruning expired-at-restore data. Names may outlive all execution/resource rows. Reject a capturedAt later than the paired restore UTC cut rather than clamp away clock skew. Do not require wall timestamps to be monotonically ordered: system UTC can step while event IDs retain causality. All persisted UTC instants must be representable by the public non-leap timestamp profile.
+
+For every history row, preflight bounded JSON before official-model deserialization. Require contiguous IDs1..N, previousEventId in0..id-1, ExecutionStarted only at ID1, the supported profile's event/detail discriminator shape and field bounds, no intermediate terminal event, and a final terminal event matching stoppedAt/outcome/output/error/cause exactly for terminal records. Reject AWS-model fields the selected runtime never emits (including assignments, task credentials, alias/version metadata), and irrelevant fields for the chosen detail kind. Check direct scheduled function ARNs with the compiler's same scoped grammar. Timeout/heartbeat fields, when present, are positive and at most99999999seconds; heartbeat exists only on callback scheduling and is strictly less than the explicit timeout or99999999 when omitted. Input/output truncation flags follow actual runtime projections, including true only for callback TaskSubmitted output. Cross-check the raw numeric timestamp lexeme against the official canonical public projection of the separate exact UTC timestamp, then restore the nanosecond instant. Reject mismatches and noncanonical timestamp numbers; preserve payload text and all remaining typed data. Validate initial input against the captured original input. Rebuild history with the original IDs/prior links under the existing global/per-record limits and terminal reservation; no API projection or page boundary may lose records. Infrastructure diagnostics are not restored.
+
+Schema1 decoding additionally recognizes an unexpected outcome {status:RUNNING}, with absent stoppedAt/expiresAt, a nonterminal history and a matching name with absent expiresAt. Such rows never resume. After all raw validation/compilation, capture one adjacent monotonic/UTC restoration sample and convert them to ABORTED/Rustack.ExecutionInterrupted with a fixed local cause, a fresh terminal event and new configured record retention/90day name reservation. Reserve the terminal event before committing; overflow rejects import rather than truncating history. A null/absent expiry is otherwise invalid. Ordinary exports remain terminal-only. No token, callback epoch, live frame, parent relation, invocation or pagination state can be supplied through this schema.
+
+Represent retention explicitly as Running, ClosedAt(close observation, original TTL), or Until(imported monotonic deadline). New completions use current configuration; imported terminal record/name deadlines preserve their remaining UTC-derived duration and age during preparation/queue delay. A changed retention setting does not shorten or reset them. Keep record and name expiry independent, and retain uncertain cleanup as before. Terminal restored records have no live deadline; child/callback parent admission rejects them explicitly. Expired rows are still validated/compiled but do not consume retained record/name/history slots; prune again at commit. This dependency does not authorize an unqualified Docker backend, image tag resolution or execution during startup.
+
+Qualification must round-trip actual exported data through CBOR and prepare/commit/read/re-export, preserve raw inputs/source/roles/tags/recreated identities, all outcomes and nanosecond/full causal history, retain/prune independent TTLs under changed configuration, reject schema/hash/scope/profile/ID/reference/history/expiry/field/collection corruption without publishing partial state, and release all temporary permits/leases on failure/drop. Prove exact-instance and startup-only admission, business rejection during preparation, retained accepted commit after observer loss, and close-before-submit rejection. Imported RUNNING rows must append the interruption event with zero Lambda/child calls; terminal parents cannot mint callbacks/children. Exercise an actual Native restored workflow, preserving old output/history without replay, then executing a new request with computed output. Keep the full runtime/SDK/security gates and independent review. Actual main meta/data archives and startup/shutdown process restart acceptance remain required next.
+
+### 3.3 Main workflow archives and startup/shutdown ownership
+
+Install D71/D72 in the existing named snapshot service, without a parallel persistence format. Register exactly one stepfunctions service with SnapshotKind::Data whenever the actual WorkflowRuntime is built, including pure/minimal binaries. Its meta.ss.zst contains the v2 ServiceMeta envelope/state section and a data-only RegistryMetadata document. Its data.ss.zst uses the existing ServiceData/directory/CRC envelope and exactly one fixed history.cbor payload, even for an empty registry. The metadata is the schema1 RegistrySnapshot shape with empty history arrays; RegistryHistories is {schemaVersion:1, histories:[{arn, history:[{timestamp,eventJson}]}]}. Both parts retain strict serde bounds/redacted Debug. Library into_archive_parts/from_archive_parts move data without JSON intermediaries or compiler/actor serialization. Join requires schema1 history data, empty metadata histories and exactly one unique matching history row per execution; reject missing/duplicate/orphan payloads before prepare_snapshot. The final combined document must pass every D72 invariant. Definition/input/output/trace are intentional authorized metadata; injected callback credentials remain absent by the existing provenance contract.
+
+Use budgets.workflowSnapshotBytes (camelCase YAML), default536870912, supported1048576..1073741824. This bounds the D71/D72 conservative source-copy budget and each actual encoded metadata/history CBOR payload, with the existing lower structural/collection/scalar limits still enforced. A save that exceeds either bound fails before global publication and retains the previous committed generation. Raw history.cbor reads are regular-file-only bounded streaming reads of at most configured bytes plus one detection byte. The v2 envelope has a separate uncompressed allowance of payloadLimit+1024bytes for its fixed headers/directory, and a conservative compressed allowance of min(existing2GiB archive ceiling, 2*uncompressedAllowance+1MiB), each with a single overflow-detection byte. Enforce these bounds before allocating full compressed/decompressed input, and the actual section payload ceiling before copying section bytes. Apply the workflow limits during recovery validation as well as service load/save validation and data unpacking; a typed budget failure refuses startup without classifying a possibly valid target generation as corrupt or replacing it with a previous generation. Structural/CRC failures retain the existing recovery behavior. Physical envelope validity selects the current generation but does not authorize deleting its previous completed backup before domain imports. Keep .previous on profile/hash/scope/quota/schema rejection; retire it only after all enabled services import successfully, or after the next prepared generation validates and syncs before publication. Never silently roll back a domain/policy failure. For this service require exactly one state section and exactly two data sections; cap its encoded data directory at1024bytes and deserialize exactly one entry named history.cbor before extracting any files. Reject missing/extra history payload files and oversized metadata before typed decoding. Qualify exact-boundary incompressible framing round trips, oversized valid-envelope rejection, unchanged recovery generations under a reduced configured budget, and profile/hash/scope rejection with both current/previous bytes intact followed by successful import and previous retirement. Reject nonregular input before open; on Unix use safe nonblocking/no-follow flags and post-open file metadata checks to close FIFO/symlink swap races ([nix OFlag](https://docs.rs/nix/latest/nix/fcntl/struct.OFlag.html), existing0.31.3 cohort). Keep the actual typed JoinError behind a classified redacting worker wrapper/explicit accessor; raw panic text never enters Display/Debug/source-chain diagnostics. Fresh clock fences after ready IO/transaction/lease joins and before/after listener bind prevent a ready future from bypassing its expired observation deadline. Fixed diagnostics must never include serde row contents. Reuse the existing nix cohort through one Unix-only CLI dependency edge; no package/codec/version or advisory/lint waiver is added.
+
+One workflow archive actor owns a single accepted operation/reply slot and one retained blocking CPU join. SnapshotService load transfers an owned metadata buffer and staging path to this actor; save transfers its staging path. Receiver loss never cancels accepted work or starts a replacement. Keep the active envelope/permit and CPU JoinHandle in the unique owner across awaits. CPU preparation decodes both parts under the shared bounded CBOR profile, joins them and returns the fully charged PreparedSnapshot; the owner transfers it to the same Registry and observes its one receipt. Save CPU work exports only a sealed root, splits and encodes the parts; the owner writes history.cbor before returning metadata. Disk operations use an absolute budgets.requestSeconds IO deadline. Retain the actual asynchronous disk task/join past observation expiry until physical completion; do not discard Tokio filesystem futures that can still own blocking IO. CPU work is retained until joined and must recheck the original deadline before issuing Registry commit or starting a write. A fatal actor/CPU failure closes admission and remains sticky; retain unresolved CPU/envelope ownership on owner panic. Errors/drop release ordinary temporary data and quotas; a controller observation timeout keeps the same worker/join and can be resumed.
+
+```text
+build services → real workflow registry/API + archive actor + unique controllers
+       │ register shared archive handle in RuntimeProviders
+       ▼ named-snapshot lease
+existing v2 meta/data readers → owned metadata + private staging directory
+       ▼ one accepted archive envelope / quota slot
+archive owner ── retained blocking join ──► bounded CBOR decode + parts join
+       │                                  source compile + charged preparation
+       ◄────────────────────────────────── PreparedSnapshot
+       ▼ exact Registry receipt / one commit
+all enabled services loaded successfully → bind gateway listener → serve
+
+HTTP drain → producer quiescence → workflow API/grace/registry/callback/bridge join
+       ▼ Lambda/downstream quiescence proves the global consistency cut
+existing save workers → archive owner → sealed export/split/CBOR → history.cbor
+       ▼ existing meta/data envelopes + manifest + atomic generation replacement
+final cleanup: archive close/join → retained workflow controllers → provider shutdown
+failure/timeout at any stage → join accepted archive work; no unproven save/replay
+```
+
+Workflow quiesce must leave archive admission available for the subsequent sealed save. Final shutdown closes/joins the archive actor before closing Registry, including startup failure or a lost save/load observer; it then attempts all existing controller/provider cleanup under the same global deadline. Keep this final archive close/join separately resumable from workflow quiesce. Main bounds lease/load/bind observation by budgets.shutdownSeconds and must clean up built services on startup failure before returning, and must never save a failed startup's partially imported graph. Startup import happens before opening a public listener; an error in any service prevents serving. Existing cross-service import mutability is not replaced with a new distributed transaction. Drain every started service load/save task on the first result error before removing shared staging or returning; do not abort sibling futures containing accepted workflow archive work. Main retains one SnapshotSession containing acquisition, loaded state and the same load/save transaction above all observing awaits. Repeated load/save observations never start another import/publication, and saving after failed startup is rejected. The session retains one SnapshotTask join above observing awaits; its owned task keeps the cloned provider registry and named lease while generic archive IO/codec/service work is running. Observer expiry/drop never aborts that task or its sibling joins. Final cleanup first resumes that same transaction, then joins the workflow archive actor before Registry/provider destruction. A task panic quarantines its bounded provider/lease graph. An accepted save may complete after its observer expires using its already proven cut; never issue a second save, and rely on the existing generation recovery protocol. Cancellation of the outer observation leaves the named lease, transaction and archive controller retained until final cleanup. A completed save only follows a proven workflow/bridge/provider consistency cut. On a failed startup/save/cleanup observation, quarantine the single named OS lease until process exit because legacy storage futures can have uncertain physical retirement; never release it for a competing runtime while such effects could finish. Keep lease acquisition itself in one retained LeaseAcquisition join above the startup timeout; final cleanup resumes it, and a lost unresolved owner quarantines its exact join so a late-acquired lock cannot escape ownership. OS process exit releases this bounded lock quarantine. Successful runs retain/release the lease normally.
+
+Advertise snapshot=resources-and-history in installed workflow capabilities/coverage only after this consumer is qualified. Add snapshotResume=false and paginationEpoch=fresh-on-restart; all old callback/page handles stay invalid because new roots/tables are constructed on each process start. Persistence capability does not imply Docker qualification, image availability, WAL/crash recovery of unsaved work, cloud pause/resume or live code-process restoration. Missing stepfunctions entries in older completed manifests start an empty workflow registry; unknown schema/profile, malformed parts, quota failure or missing registered payload rejects startup. A disabled service's manifest entry follows existing disabled-service behavior.
+
+Qualification includes real v2 meta/data/manifest generations, empty/full round trips, independent TTLs and full history, malformed/missing/orphan/cross-part/schema/profile/hash/quota rejection with no partial workflow publication, redacted errors, retained CPU/receipt/drop/deadline ownership and failure-before-save preservation of the previous generation. Main full/minimal feature and routing/capability tests must consume the actual registered service. An actual strict-auth named-snapshot binary must run pure and Native Lambda work, gracefully save/restart, read old exact results/history/captured revisions/tags/name reservations, reject old pagination/callback handles, then execute a new real Lambda request without replay. Verify shutdown cancellation of live work is archived terminal only, SIGKILL loses unsaved work while the previous completed generation remains readable, and a corrupt workflow archive refuses to listen without changing that generation. Exercise process/PID cleanup and reuse existing SDK fixtures/Make targets. Performance/IaC/final image/platform release requirements remain separately required under5.3/5.4; do not claim M4 complete from this consumer alone.
+
+## 4. Debugging and engineering contract
+
+Diagnostics identify deployment Pending/Failed, backend unavailable, invalid image architecture, missing Runtime API polling, handler error, Task timeout, callback expiry, child failure and cleanup quarantine separately. Payload-bearing execution history is an intentional API capability; infrastructure logs are redacted. Operator log access remains a trust boundary.
+
+Follow AGENTS.md Error/Async/Type/Safety/Serialization/Testing/Logging/Performance/Documentation: config errors identify key/source without secret values; resource ownership remains in actors; validation is repeated on archive import; decompression has byte/count/depth limits; shutdown tasks are joined; config and snapshot fixtures test rejection/atomicity; use existing archive mechanisms rather than per-record files. Authentication configuration reuses current gateway behavior; no new public Runtime API listener is created.
+
+Explicit exception to AGENTS.md § Injection Prevention, URL/SSRF: an operator-configured local gateway may use HTTP and private/loopback addressing because local AWS emulation requires it. It is not an ASL-controlled outbound URL, and request Host headers cannot configure it. Function networking and Docker daemon registry networking remain separate operator trust boundaries. Local cancellation actively terminates a function container; this is resource hygiene, not a promise that AWS Lambda would stop code when a Step Functions Task times out. Already completed side effects survive both paths.
+
+### 4.1 Patched compression cohort before workflow persistence
+
+Close existing B06 before installing the workflow archive decoder. Use the current patched zstd0.14.3 / zstd-safe8.2.0 / zstd-sys2.1.2 cohort (or later compatible patched releases) across both the direct snapshot dependency and the transitive Squib loader graph. Keep the existing snapshot envelope/version/compression level, bounded streaming decode and independent archive CRC validation. Do not downgrade to a nominally unaffected old binding or waive advisory checks. The current [zstd release](https://docs.rs/zstd/0.14.3/zstd/) and local fresh RustSec database define the patched baseline.
+
+The published squib-loader0.2.0 and upstream HEAD4f1fd673c20ab28328b47592138409ad68f12f76 still require zstd0.13. Apply one explicit crates.io path override under patches/squib-loader, excluded from Rustack workspace membership as an independently maintained third-party package. Preserve the published0.2.0 src/lib.rs byte for byte, normalized package metadata/dependency versions and API/type identity; change only its zstd requirement to the patched0.14 line. The rest of Squib stays on its pinned registry cohort. Include original manifest, VCS/package checksum, source fingerprints and upstream license notice so the exact overlay is inspectable. Preserve upstream's declared Apache-2.0 metadata and its separately supplied LICENSE.md notice verbatim; do not silently rewrite either. Do not copy its stale lockfile, edit Cargo's cache, add first-party unsafe/lint exceptions, or mutate/publish another repository. Retire the override when an upstream compatible release supplies the patched dependency. Source/binary build distributions must include the overlay directory and root manifest. Independently published Rust crates consumed under another workspace require that root to repeat the override or adopt the upstream fixed loader, because [Cargo applies patches only from the workspace root](https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html#the-patch-section). This dependency closure is verified for the current Rustack workspace.
+
+Make qualification must verify the overlay source/manifest provenance, select the intended patched loader package, execute its existing synthetic kernel decompression/size/magic/overflow regressions and the runtime snapshot suite, and fail on any remaining vulnerable zstd cohort. Add a harmless pre-upgrade snapshot frame generated with the original resolved0.13.3 graph as compatibility evidence; the updated decoder must preserve its typed envelope/section bytes and reject truncated/corrupt input. Reusable raw encoder/decoder contexts also need a regression across an abandoned stream and subsequent frame, including bounded decoding, matching the repaired leak class. These are library/codec regressions, not new VM/Docker/platform qualification.
+
+```text
+snapshot archives ──► direct zstd ~0.14.3 ───────────────┐
+                                                       ▼
+squib0.2.0 → vmm → patched loader0.2.0 → zstd0.14 → safe8.2 → sys2.1.2
+                         │
+                         └─ original source/API + one dependency override
+
+acceptance = source provenance + old-frame/kernel regressions
+             + normal/strict workspace gates + fresh audit/deny
+```
+
+Fresh cargo audit must have no vulnerabilities or unsound compression warnings, and all cargo deny checks must pass without new ignores. Historical B01/B06 evidence remains chronological; mark B06 closed only after inspecting the current resolved graph and gates. Workflow archive export/import, frozen-registry lifetime, cross-service consistency and final image/platform acceptance remain separate work.
+
+### 4.2 Bounded CBOR import boundary
+
+Before adding workflow DTO import, replace the generic snapshot CBOR helpers with one shared preflight/encode boundary, used by manifest, service metadata and data-directory readers. A compressed/envelope byte cap alone does not bound a forged container's declared allocation or a decoder's recursion. Keep the v2 archive envelope, existing service DTO shapes and compression unchanged. This is an installed archive boundary prerequisite; it does not advertise workflow persistence.
+
+The Rustack v2 CBOR profile permits unsigned/negative integers, definite byte/text strings, booleans/null/simple/floating values and definite or indefinite arrays/maps. Map keys are definite UTF-8 text or unsigned/negative integers; reject duplicate decoded keys even when their integer/length headers use different widths. Reject tags, indefinite byte/text strings, reserved header encodings, invalid UTF-8, misplaced breaks, odd indefinite maps, truncated values and any bytes following the single root value. These restrictions match the current serde-generated archive DTOs, including integer-keyed Lambda version maps, byte payloads and unknown-length serde collections; arbitrary RFC8949 data is not a Rustack archive schema. Preserve non-minimal integer/length encodings rather than require a new canonical encoder. Follow the [CBOR wire grammar](https://www.rfc-editor.org/rfc/rfc8949.html#section-3); the domain profile intentionally rejects unneeded general-purpose features.
+
+| Structural budget | Ceiling | Enforcement |
+|---|---:|---|
+| One CBOR section | 2GiB | Before traversal, capped fallible writer while encoding |
+| Container depth | 128 | Before descending; scalar root depth0, array/map root depth1 |
+| Aggregate values (root, keys, values and containers) | 8,000,000 | Before visiting each item; includes ignored schema fields |
+| One array / map | 1,000,000 elements / pairs | Before definite-container traversal; during indefinite traversal |
+| One definite byte/text scalar | 128MiB | Before reading/decoding declared contents; accommodates existing base64 Lambda ZIP metadata |
+| One text map key | 128MiB (same generic scalar ceiling) | Before UTF-8/key tracking; integer keys require no string allocation |
+
+The generic text-key ceiling intentionally equals the scalar ceiling: existing service maps can contain user data, including DynamoDB attribute names above4KiB, and this prerequisite must not silently impose workflow identifier limits on them. Per-workflow schema validation must choose narrower domain bounds. The preflight borrows the input, builds no dynamic value tree and copies no text. Only the active maps retain bounded duplicate-key sets. Use checked arithmetic/conversions for every external count/length and compare minimum remaining value bytes before loops. Run the existing Ciborium typed decoder only after the entire structure passes, with an explicit256 [Ciborium recursion limit](https://docs.rs/ciborium/0.2.2/ciborium/de/fn.from_reader_with_recursion_limit.html) and exact reader consumption. The typed limit includes headroom for Ciborium's additional enum recursion entries: a scalar unit enum also enters its recursion guard, so it must exceed the128-container wire depth. Structural and schema failures expose fixed redacted error classes, with no attacker-controlled Ciborium diagnostic/source in the error chain. Schema-specific quotas/references, unknown-field policy, compiled definition validation and aggregate live/history accounting remain the workflow importer's responsibility; these generic ceilings do not claim to enforce them or guarantee a small total process RSS.
+
+The writer must enforce the same byte/structural profile before returning an encoded section, so a successful save never produces a section the shared reader would reject. Allocation failure and oversize encoded output return errors; the existing atomic replacement protocol retains the previous completed snapshot. Do not change the existing cross-service import publication contract or perform blocking parser work in a newly detached task. Workflow preparation will own its bounded CPU/restore transaction separately.
+
+```text
+archive bytes → bounded zstd → v2 envelope / CRC → CBOR section
+                                                  │
+                           ┌──────────────────────▼─────────────────┐
+                           │ complete borrowed preflight            │
+                           │ bytes/depth/nodes/collections/scalars   │
+                           │ UTF-8 / key uniqueness / exact root    │
+                           └──────────────────────┬─────────────────┘
+                                                  ▼ only on success
+                                  typed Ciborium decoder (limit256)
+                                                  ▼
+                                  existing service import validation
+
+service DTO → capped fallible writer → same preflight → archive publish
+failure at either boundary → fixed redacted class; no new snapshot publication
+```
+
+Qualification must exercise real manifest/service/data-directory round trips, the original pre-upgrade frame, definite/indefinite collections, integer-keyed maps, actual DynamoDB export/decode/import with long attribute names, byte/float encodings and derived enum trees at the exact128-container boundary. Test every numeric header width, malformed/truncated inputs, invalid text, alternate-width duplicate keys, empty/root/trailing cases and every resource ceiling at/either side of its boundary using small test budgets. A Deserialize sentinel proves hostile structure is rejected before any typed visitor runs; an oversized serializer proves the writer stops while serializing. The actual SnapshotConfig save/load path must preserve and successfully reload its previously committed generation when an encoder rejects a duplicate-key section. Use bounded property cases for valid nested profile values and arbitrary hostile bytes; no panic, unchecked index or input-bearing diagnostics. Expose these tests through Makefile and retain standard/minimal-feature Rust gates. No dependency/version upgrade or Docker/VM work is required.
+
+## 5. Cross-references
+
+- ← [runtime hardening](./rustack-runtime-hardening-design.md), [binary archives](./ruststack-snapshot-binary-archive-design.md)
+- ↔ [verification](./rustack-workflows-70-verification-plan.md), [implementation](./rustack-workflows-90-impl-plan.md), [decisions D8/D10](./rustack-workflows-99-decisions.md)
+
+### Controlled pull library dependency
+
+[Runtime§2.14](./rustack-workflows-20-lambda-runtime-design.md#214-controlled-if-missing-pulls-and-retained-progress-transport) supplies validated registry/credential policy and retained ifMissing preparation. Main must load the bounded private YAML credential file, construct these types and select start_with_pull explicitly; default start never pulls. Only initial missing-image lookup triggers network work. The daemon performs registry networking; exact allowlist matching is not a guarantee about its mirrors/DNS/redirects. Close/join preparation and wire work during shutdown, and never delete source cache references as runtime cleanup. YAML loading, endpoint/readiness and final startup acceptance remain required consuming work.
+
+
+### 1.8 Validated Docker settings and private registry credential files
+
+D79 implements the operator configuration dependency of task1.4 without granting ordinary Docker readiness. Extend the existing settings key allowlist with the Docker keys in§1.1 and its typed RuntimeBudgets with the Docker fields in§1.2. Validate budgets before any file/daemon work: environments1..32, aggregate memory256MiB..1TiB, pull1..600s(default300), deployment jobs1..32(default8) and seconds1..3600(default300), image pins1..8192(default1024), IO1..60s(default5), start1..60s(default15), cleanup1..60s(default10). Deployment jobs must not exceed pin capacity. CPU remains an environment scalar, not a floating point budget. Delete the older contradictory120s pull default; D78's300s value is authoritative. Existing process-over-YAML precedence and disabled/Native/Squib semantics remain unchanged. Parsing these keys does not enable Docker selection.
+
+`DockerRuntimeSettings::from_lookup(lookup, budgets, idle_timeout)` is a side-effect-free validated library constructor for the future startup owner. Require explicit relay image and network selection; default only the local Unix socket, UID/GID1000, CPU1 and cross-architecture false. Validate relay/optional ZIP references with ImageReference and socket/network/policy/IO/idle/cleanup with the existing domain constructors. ZIP remains optional until Docker ZIP execution is implemented. CPU accepts decimal ASCII units with at most9 fractional digits and no signs/exponent/whitespace, computes checked exact integer nanocpus and enforces0.1..16. No float rounding or unlimited zero. Require cross-architecture exactly true/false (shared settings normalizes documented boolean aliases). A missing network never falls back to host/default bridge. Runtime settings expose validated immutable accessors and Debug redacts paths/references/endpoints/registries; these values are never snapshot state.
+
+`DockerGatewayEndpoint` validates≤2048bytes, absolute HTTP(S), explicit host, nonzero port, literal empty-or-root path, no userinfo/query/fragment/controls/whitespace or backslash normalization. It is an operator trust boundary; private/loopback hosts are legitimate local gateway choices. Parsing is not a reachability receipt or permission to derive the endpoint from request Host. Endpoint IO/SDK qualification remains the startup consumer. `RegistryAuthFile` validates an absolute UTF-8 path≤4096bytes with no parent components, NUL or controls; never expand tilde, interpolate environment or search ambient Docker/AWS files. Missing policy means never. Reject registry/auth-file settings with never, empty/over32/duplicate registries, unapproved credential hosts and ambiguous registry matching. ifMissing requires an exact approved-host list; credentials are optional for public sources.
+
+`DockerRuntimeSettings::load_pull_policy(deadline)` reads only its explicit auth file, then returns the existing validated ImagePullPolicy with the configured total pull budget. Never mode performs no filesystem read. Credential file loading uses a dedicated static four-worker semaphore. Queue+open/read/parse share one positive absolute deadline≤60s. The blocking worker retains its permit/file/input across observer timeout/drop, checks cancellation/deadline between local syscalls and parser events and cannot return late success. Regular local files are required; nonblocking/no-follow descriptor opens prevent FIFO/device hangs and symlink traversal. Do not perform synchronous IO on the async runtime. IO/worker/schema/unsafe-file/timeout errors are fixed classes, never paths/hosts/secret values or parser snippets. A read-only worker may finish after its observer disappears; it retains its bounded permit and drops all owned secret buffers before exiting, with no runtime readiness/publication effect.
+
+Open from the root descriptor and traverse each component with no-follow directory-relative opens; reject symlinks in ancestors or leaf, non-directory ancestors and replacement by untrusted users. Ancestors must belong to effective UID or root and not be group/world writable, except root-owned sticky temporary directories. Require leaf ownership by effective UID, exactly one hard link, regular file, no group/other/special/execute bits, and size1..65536bytes. Read at most65537bytes, require observed byte count to match initial size and recheck device/inode/uid/mode/link/size/mtime/ctime after reading. POSIX mode checks do not evaluate extended ACLs. As an explicit operator filesystem precondition, ACLs must grant no untrusted credential-file read/write or ancestor replacement; use a controlled local private directory. The loader does not claim to prove ACL confidentiality from mode0600. Same-UID/root modification and hostile network filesystems remain outside the local operator contract. No file creation, chmod, deletion or mutation. Unsafe/missing/corrupt files never fall back to anonymous auth.
+
+The credential document is one YAML mapping directly from approved registry host to a credential mapping:
+
+```yaml
+registry.example:5000:
+  username: "local-test-user"
+  password: "local-test-password"
+public.example:
+  identityToken: "local-test-token"
+```
+
+Allow an empty map for anonymous sources. Require secret scalar values to be quoted YAML strings; plain host/field keys and normal block/flow mappings are allowed. Keys are exactly username/password/identityToken; require both basic fields or one token, with no null/empty/default/coercion/mixed form. Reject unknown or repeated fields, duplicate canonical hosts, more than32 records, excess decoded total64KiB, anchors, aliases, tags, merge keys, sequences, complex keys, multiple documents or trailing malformed input. The fixed two-map schema and512-event limit reject deeper structures before tree materialization. Each scalar is checked against its domain bound; constructors enforce no controls. The owned input buffer and credential strings use zeroizing/secret wrappers. Parser-internal scratch allocation has no memory-forensics guarantee; no Debug/error/tracing ever projects raw events. Reuse yaml-rust2~0.11.1, already resolved through config0.15.25; current0.13.0's post0.11.1 changes are dependency/MSRV/marker-documentation updates. Use its low-level pull events to reject unsupported structure before constructing credentials, not the general configuration Value tree. No helper execution/include/expansion/deserialization callbacks.
+
+```text
+existing YAML/environment settings → validated Docker budgets/settings
+ │ pure parse only; no daemon/config helper IO
+ ▼ explicit load_pull_policy(deadline)
+ dedicated workers4 → root-relative no-follow descriptors → private regular file
+ │ byte cap + stable metadata → zeroizing input → bounded YAML events
+ │ exact approved hosts + mutually exclusive secret fields
+ ▼ ImagePullPolicy::if_missing → existing owned preparation (D78)
+ timeout/drop → worker keeps permit/buffers until local terminal cleanup
+ production coordinator still owns reconciliation/probes/endpoint/readiness
+```
+
+Required tests cover shared YAML keys/precedence/defaults/range/relationships; every typed scalar/CPU/endpoint/registry/policy bound; stable redacted Debug/errors; valid empty/basic/token/flow/quoted escape files; duplicate/unknown/mixed/typed/alias/tag/deep/multiple/trailing inputs; exact host/credential bounds and aggregate quotas; real safe file ownership/mode/link/symlink/ancestor/FIFO/directory/size/replacement checks; timeout, abandoned observers and worker cap retention with controlled read-only gates. Consume a file-loaded policy through the existing real bound wire/preparation path in a scripted integration, proving selected auth reaches only the approved registry and post-pull validation remains mandatory. Main startup, endpoint/resource proofs and ordinary SDK Docker activation remain task1.4 consumers and cannot be inferred from these constructors.
+
+
+### 1.9 Gateway endpoint proof before Docker activation
+
+D80 supplies [runtime§4.11](./rustack-workflows-20-lambda-runtime-design.md#411-container-origin-gateway-reachability-evidence)'s endpoint receipt without enabling ordinary Docker. When Lambda is installed, main captures the existing global startup deadline and obtains a fresh nonsecret gateway instance ID through bounded owned entropy work before provider construction. No-Lambda services have no runtime-probe identity. The optional GET/HEAD `/_rustack/runtime-probe` route returns a typed version1 instance reply with no-store, independently of business admission, worker readiness and drain state; absent identity returns404 and other installed-route methods return405. HEAD is empty with the corresponding content length. Reserved diagnostic connections can serve this route. Preserving the identity across gateway workers/clones prevents a later construction step from silently replacing the observed instance.
+
+The configured function-visible endpoint is independently validated and remains separate from the advertised endpoint and listener address. A later production coordinator must bind/start the actual diagnostic listener while business admission is closed, run the immutable pinned endpoint function in the qualified operator network after resource evidence, and consume its exact private receipt before publishing availability. A missing configured endpoint is an explicit SDK-unconfigured profile. A configured endpoint with disconnected networking cannot qualify. Default loopback binding is unchanged; choose a suitable reachable listener explicitly. Never derive the origin from Host headers, infer function reachability from host TCP success or accept a serialized report as readiness.
+
+The instance ID is public diagnostic correlation, not authentication. HTTP assumes operator-controlled local networking; HTTPS uses normal server-name/certificate validation with explicit AWS-LC and embedded Mozilla roots. There is no ambient proxy/root lookup, redirect/retry or production private-CA loading; rebuild the pinned runtime to update roots. Expected identity is private probe input and is never sent in its GET. Endpoint errors expose fixed classes; verbose TLS diagnostics are suppressed because peers may embed names in them. Deadline/cancel owns and drops local IO; successful response processing joins the same HTTP driver. The receipt also requires physical probe environment retirement and a final live-input/clock fence. It cannot activate Docker alone.
+
+D80 alone did not activate Docker. The production consumer in§1.10 now composes these receipts in the ordinary binary. D80 controlled-peer tests remain component evidence; D81 separately exercises the actual listener/provider/SDK path. Handler-originated SDK networking to S3/DDB remains its own L10 gate.
+
+
+### 1.10 Ordinary production Docker image composition
+
+[Runtime§4.12](./rustack-workflows-20-lambda-runtime-design.md#412-production-startup-provenance-and-retained-owner-composition)/D81 installs the actual owner and qualified provider in main. Explicit Docker settings parse before the diagnostic listener; no ordinary business admission occurs until directory provenance, exact daemon binding/recovery, selected-platform relay pin, full-ID network, actual resource and optional same-instance endpoint receipts pass, providers construct, snapshots validate and final live/deadline fences succeed. The same bound listener and instance are reused after all diagnostic connection owners join. A saved error path covers bind, qualification and late installation; later provider/workflow/snapshot failures also await retained runtime cleanup. Default execution remains disabled.
+
+Use startupSeconds(default600,1..3600) independently of shutdownSeconds. Root startup phases, snapshot load and listener use one captured absolute startup deadline; each IO/probe has its own existing smaller ceiling. Each pending filesystem acquisition/wire construction is retained above observer cancellation. The default Image RSDKOWN2 owner magic attests the journal-generation producer and blocks downgrade; explicit code-generation RSDKOWN3 is separately understood under§1.5/D90; RSDKOWN1 remains readable for controlled recovery but cannot activate this coordinator. Do not delete/reset an owner, lock, journal or daemon binding to bypass refusal. Preserve legacy evidence and choose a fresh controlled DATA_DIR if needed; that does not reclaim old resources. Unknown owner-missing namespace entries reject before identity publication.
+
+The qualified platform is the Linux daemon architecture. Cross-architecture false requires the host architecture to match; true permits the actual independently probed selected target, including the emulated daemon fixture. Other function architectures fail preparation before allocation/IO and never become Active. Lambda init_timeout bounds the function BootstrapReady wait independently of total environment start, with a typed initialization timeout; earlier caller/global deadlines remain authoritative. Configured memory/CPU/log/environment/IO/idle/warm/deployment budgets feed the real owners. workers.docker reports ready, selected platform, sdkGateway and zip=false. sdkGateway means the configured origin passed the reachability receipt, not completed handler S3/DDB/callback acceptance or authentication. No endpoint deliberately leaves it false. Normal function failures do not poison worker health.
+
+This coordinator rejects a configured ZIP runtime source, Docker ZIP creation and ZIP archive import. The subsequent [D88 consumer](#34-immutable-image-archive-import-and-startup-commit-deadline-d88) restores Image archives only after exact local immutable lease validation; failures precede store publication or previous-generation retirement. Source tags are never followed to replace saved code. Snapshot scope remains the installed profile, with no live invocation resume. Provider quiescence additionally checks backend health before permitting save. Main uses fallible shutdown_before and retains the first fault while performing dependency-safe physical cleanup: executor/pool, environments, image pins, current namespace audit, wire and final handle release. Timed-out observers keep the same cleanup operation, exact lease and bounded admission. Physical retirement can still return an earlier owner fault; unresolved resources retain exclusion. Inactive provider/installation/status handles may continue retaining the directory until dropped, consistent with DirectoryLease clone lifetime.
+
+The actual ordinary-binary gate covers signed Rust SDK/boto3 computed warm Image execution, FunctionError, published alias capture, wrong-architecture failure, no-RIC initialization timeout, real ASL Image task, same-owner/fresh-instance restart, missing relay/legacy/wrong-endpoint refusal and byte-identical current/previous image-archive rejection. It uses no injected readiness. Full custom-RIC/L01–L09 matrix closure, Docker ZIP, immutable archive lease restore, handler SDK networking/callback images, IaC/reference/platform and complete M0–M4 release remain required.
+
+
+### 1.11 Docker final-cleanup reserve and unfinished Event drain (D83)
+
+Capture one cleanup reserve for both HTTP drain and the main consistency phase. Preserve the existing non-Docker reserve min(shutdown/10,1s). When a qualified Docker runtime is installed, reserve max(that floor, min(lambdaDockerCleanupSeconds, shutdown/2)) for final owner cleanup; do not let connection/accepted-work draining consume all but one second of a configured Docker cleanup window. The captured absolute global deadline never changes, and Native/pure grace behavior remains unchanged. Producer→workflow→Lambda quiescence still precedes any snapshot; final pool/environment/pin/wire cleanup retains the original graph and is independently attempted after the consistency result.
+
+A backlog deliberately held past the drain cutoff cannot claim successful quiescence or snapshot. Preserve the original typed drain failure and nonzero process exit even when subsequent cancellation physically cleans every resource. Qualification must assert that precise failure, joined child exit without forced kill and zero owned resources before natural function/collector expiry. Physical cleanup and successful graceful draining are distinct outcomes; never weaken either assertion to make the other appear successful.
+
+```text
+signal / close ingress             work cutoff           original global deadline
+          │                            │                           │
+          ├─ HTTP / producer drain ─────┤                           │
+          │  workflow → Lambda settle  │                           │
+          │  snapshot only on success │                           │
+          │                            ├─ retained final cleanup ──┤
+          │                            │ pool → environments → pins│
+          │                            │ → wire → directory lease  │
+          │                            └─ keep original drain error│
+          └─ one captured reserve: max(floor, min(cleanup, total/2))┘
+```
+
+
+## 3.4 Immutable Image archive import and startup commit deadline (D88)
+
+Consume [runtime§2.16](./rustack-workflows-20-lambda-runtime-design.md#216-candidate-store-image-archive-restoration-d88). Docker Image archives use the installed qualified owner and the16MiB image metadata profile; Native/ZIP archive behavior stays separate. Add a default deadline-aware SnapshotService load hook and override it for Lambda. The retained SnapshotTask captures the original startup deadline, passes it to load/service import and rejects expiry before previous-generation retirement, while still joining every accepted sibling/IO worker. Observer timeout does not restart/abort a transaction or extend its commit deadline. Preserve both generations after invalid metadata, unavailable immutable content, fresh-size mismatch or expiry. No business route is enabled until image lease validation and all startup work succeed. Existing snapshot serialization and live image metadata schema remain compatible; no live lease/channel is serialized.
+
+
+## 3.5 Managed provided-runtime ZIP archive profile (D93)
+
+Apply [runtime§6.9](./rustack-workflows-20-lambda-runtime-design.md#69-bounded-provided-runtime-zip-archives-and-mixed-candidate-restoration-d93) through the existing Lambda SnapshotService and retained startup transaction. Select the service payload cap from the explicit installed Docker profile:16MiB for Image-only,128MiB for configured provided ZIP. The latter additionally keeps a16MiB metadata-only budget,50MiB per original ZIP and64MiB aggregate decoded ZIP bytes counting every revision. Private candidate extraction additionally caps512MiB logical expansion and20,000 nodes including artifact wrappers. Before typed CBOR allocation, the existing scanner enforces a Lambda-specific exact-path body exemption and unchanged metadata ceilings, including unknown fields. Generic CBOR structural/decompression budgets and other services do not change. Persist original code bytes and identities, never Docker/host live resource ownership. ZIP archives cannot override operator base/network/credentials and use the currently qualified immutable runtime source after fresh startup validation.
+
+All profile validation, candidate ZIP staging/conversion and exact Image reacquisition share the original startup deadline. No code volume or executable container is allocated by import; the first new invocation allocates afresh. Close ingress through complete candidate validation and the final source/backend/deadline fence. The existing retained transaction must join imports and preserve both committed generations after any data, capability, cleanup or expiry failure. Save rejects over-profile live data without replacing the previous valid generation. Operator documentation must expose aggregate/revision counting and changed-runtime-base behavior before enabling this profile. D93 is planned/in progress until both actual full gates and exact postconditions pass.
+
+### 1.12 Explicit local handler SDK configuration (D95)
+
+Configure the explicit pair only for a function-visible gateway already selected by LAMBDA_DOCKER_GATEWAY_ENDPOINT and a connected user network. Both absent leaves the existing environment profile intact; partial/invalid pairs or absent endpoint/network fail pure validation. ACCESS_KEY/SECRET_KEY configure server authentication and are not fallback inputs for handler injection. Supply matching local values deliberately when desired. A wrong explicit SDK pair can still pass the unauthenticated instance/reachability probe; real SDK requests must receive modeled authorization errors without ambient fallback.
+
+Only after actual kernel/network and same-instance endpoint qualification may startup issue the opaque SDK context, affiliated with that exact directory acquisition/readiness holder/policy/relay/environment service. Context clones preserve their nonsecret identity; new contexts allocate a checked nonzero process-local identity. Runtime SDK settings win over image/function endpoint/profile selectors through unique-key Env and explicit bare-name unsets. Use the fixed local endpoint, explicit credentials, disabled EC2 metadata and /dev/null shared credential/config files. Configuration files remain operator-private and outside user-code mounts/snapshots. Rotation requires a runtime restart; no SDK context/secret is persisted with function code. See [runtime§4.18](./rustack-workflows-20-lambda-runtime-design.md#418-explicit-local-handler-sdk-environment-d95).
+
+Keep service enablement explicit: the SDK consuming fixture compiles the ordinary Docker executable with lambda,stepfunctions,s3,dynamodb, while only its two new profiles add S3/DynamoDB to SERVICES. Existing ordinary profiles retain lambda,stepfunctions. sdkGateway remains a reachability proof rather than an authorization or full-SDK compatibility claim. Handler code can deliberately override a client endpoint/credentials; no egress policy is implied. Both retained functional lanes pass the strict-auth positive/negative SDK consumers and all68 full resources, closing task5.3b/L10. Image callbacks, IaC/server-in-container/reference/platform and final release requirements remain open.
+
+### 1.13 Explicit image callback fixture profile (D96)
+
+Use the same qualified endpoint/explicit SDK pair and ordinary four-feature cohort. Only the new callback profile opts into its required services, two environments,768MiB total memory, init20s/function45s, constrained callback budgets and named snapshot. Preserve D95 SDK capacity1 and all unrelated profile budgets. One workflow dispatch slot is deliberate: after A's successful return, a waiting callback must not block another actual Lambda task. The Event worker has independent Lambda ownership and must be joined before successful snapshot save.
+
+The safe DynamoDB control table is an explicitly enabled consuming fixture, not a production callback protocol or new API. It stores gates and nonsecret token hashes, never the injected token. Retain live functions and terminal workflow resources through confirmed save; then scan bounded archive/log/history data and audit exact cleanup. Stop of A must preserve B until the host releases and joins that independent Event. See [the complete image callback contract](./rustack-workflows-40-integrations-design.md#56-real-image-sdk-callbacks-and-independent-event-worker-d96). Docker callback, IaC/reference/platform and final release claims remain gated by actual acceptance.
diff --git a/specs/rustack-workflows-61-localstack-compatibility-design.md b/specs/rustack-workflows-61-localstack-compatibility-design.md
new file mode 100644
index 00000000..fc0b22fb
--- /dev/null
+++ b/specs/rustack-workflows-61-localstack-compatibility-design.md
@@ -0,0 +1,86 @@
+# Workflows 61: External LocalStack compatibility tests
+
+Status: D114 qualifies all123 selected original nodes under one source cohort; broader M4 qualification remains separate. Continues P5 verification within the existing state/integration/API scope. Based on [the pinned upstream study](../docs/research/study-localstack-workflow-tests.md).
+
+## 1. Outcome and authority
+
+Execute an explicit, reproducible subset of LocalStack's original Step Functions pytest tests against Rustack, retaining original test bodies, templates and AWS snapshot assertions. Test counts describe collected pytest nodes; report execution/input counts separately where available. Never report the entire LocalStack suite or cloud parity as passed from a subset.
+
+The first inventory covers deterministic JSONPath intrinsics, Choice and data flow, basic states, Parallel/Inline Map, and the overlapping Lambda task/error/timeout/nested patterns. Inventory and exclusions are chosen before executing the selected tests. Unsupported JSONata, EXPRESS, Activities, distributed Map, AWS SDK integrations, IAM authorization, ECR-specific metadata and non-overlapping service behavior remain explicitly excluded. Callback and image-version cases must be reported according to actual upstream coverage, not inferred from existing Rustack tests.
+
+## 2. Execution boundary
+
+The vendor gitlink and actual checkout must equal `45dfee8ce27df00fcac3f91b8071c8156eb5c5c7`. A checked-in manifest pins selected node IDs and provenance. Collection is exact: no missing, duplicate, unexpected, skipped or xfailed required nodes. Validate files, hashes, bounds and dependencies before starting Rustack or creating resources. Bound manifest/file reads, case count, wall time, diagnostic files and SDK retries/timeouts. Reject symbolic-link or traversal substitutions in evidence paths.
+
+Use original upstream pytest imports with a pinned isolated Python environment. Disable auto-loaded plugins and root conftest; explicitly load the Rustack fixture plugin and upstream snapshot plugin. Run one selected group at a time against an actual owned Rustack process with signed boto3 calls. Runtime startup, readiness, observers, graceful shutdown and forced fallback remain under existing Rust test owners. No background process may outlive its owner unnoticed.
+
+Clients receive an explicit loopback endpoint, region and local test credentials. No AWS profile, ambient credential provider, metadata service or default AWS endpoint is allowed. Do not execute live AWS tests automatically. A future cloud differential invocation requires an explicit isolated account configuration and a separate intentional target.
+
+## 3. Allowed fixture adaptations
+
+- Supply `aws_client` and client factories using actual SDK clients pointed at the owned endpoint, retries disabled and bounded connect/read timeouts.
+- Supply a valid local role ARN for tests that treat it as metadata. Do not claim policy validation or IAM lifecycle coverage.
+- Create machines/functions through public APIs. Register ownership immediately upon successful creation. Cleanup stops active executions, deletes owned machines/functions, closes clients and propagates all errors.
+- Preserve original handler code for real Docker execution. The image packaging, architecture, immutable image ID, runtime version and any supported handler/environment overrides are explicit artifacts. Do not substitute an echo handler or silently map ECR-specific fixtures to local images.
+- Keep original snapshot/session transformers. Copy baseline files into private evidence storage before snapshot verification, preserve original node IDs, and persist actual/validation artifacts only there. The baseline bytes must remain unchanged.
+
+Snapshot update/raw/skip-all flags and environment variables are forbidden. Existing upstream skip-path markers may be retained with their provenance, but new masks or regenerated expectations cannot make a failed comparison pass. Full-history and output-only upstream assertions retain their original scope.
+
+## 4. Reports and failure semantics
+
+Write a versioned JSON report containing vendor commit, manifest/source/dependency hashes, original node IDs, expected/collected/executed counts, pass/fail/skip/xfail outcomes, per-node snapshot paths and hashes, actual runtime/packaging mode and cleanup status. Save bounded private raw pytest diagnostics and JUnit/validation output. A successful process exit alone is insufficient: require exact selected outcomes and successful snapshot verification. Any mismatch, missing baseline or cleanup uncertainty fails the target and retains evidence.
+
+Classify findings as product bugs within the supported profile, deliberate profile restrictions, upstream-oracle defects requiring independent evidence, or adapter faults. Preserve original failing evidence before fixes. Never remove a failed selected case to obtain a passing report. Any later inventory change needs a recorded reason and a new manifest identity.
+
+## 5. Delivery and verification
+
+Expose environment preparation, normal adapter controls, pure-ASL execution and real-Docker execution through discoverable Make targets. Use existing process/resource ownership helpers and explicit Docker sockets; preserve unrelated containers, volumes, images, daemons and contexts.
+
+Controls must prove rejection of source drift, snapshot mutation/update attempts, missing/extra/skipped nodes, altered semantic output/error assertions and failed resource cleanup. Relevant Rust gates apply to added Rust owners or product fixes. An independent read-only review checks the original assertions, fixture trust boundaries and actual saved evidence before completion.
+
+Exit evidence is an exact successful required inventory, unchanged upstream baselines, joined owned processes and zero owned Docker remnants, with failures/exclusions and actual coverage documented. A compatibility failure is useful evidence but is not a passing exit. Broader M4 platform/reference and same-commit release qualification remain open.
+
+## 6. Historical pre-D114 baseline
+
+The pre-D114 source c16d68e executes every selected node without skipped/xfail cases: pure88/91 and Docker30/32. All current-source Rust gates, Native/Action checks and physical cleanup pass. See [the evidence ledger and remaining original assertions](../docs/research/study-localstack-workflow-tests.md#final-source-cohort-verification). The three formal-profile and two static-diagnostic differences remain original failures; the targets correctly return nonzero. Implementation of the probe lane is complete, while the exact successful-inventory acceptance criterion above is unmet and is not waived by this baseline.
+
+## 7. Authorized observed-AWS compatibility continuation (D114)
+
+The user explicitly authorizes matching the five remaining recorded AWS behaviors. This supersedes the earlier formal-only/local-static-cause choices for these cases. Keep the same91 pure and32 Docker nodes, vendor commit, original baseline bytes and masks. No live AWS calls, new excluded scope or expectation regeneration are required. Reclassify the existing Format2 exclusion reason as historical selection rather than a current unsupported feature; the unchanged node set receives a new manifest identity and genuinely rebuilt image receipts. Acceptance is91/91 plus32/32 with the existing resource/verification controls.
+
+```text
+┌─ Validated ASL / captured Lambda task ─────────────────────────┐
+│ literal decoding → bounded Format / StringToJson              │
+│ validated target + tenant → owned service-error mapping       │
+└────────────────────────┬─────────────────────────────────────┘
+                         ▼
+┌─ Observed AWS wire semantics ─────────────────────────────────┐
+│ collection text │ empty JSON→null │ qualified missing target   │
+│ all existing byte/depth/work bounds and redaction preserved    │
+└────────────────────────┬─────────────────────────────────────┘
+                         ▼
+         original snapshot assertions → exact123/123 gate
+```
+
+### Intrinsic grammar and value conversion
+
+- Decode intrinsic string escapes exactly once. Ordinary single-quoted string arguments may contain literal `{`/`}`; escaped braces retain the same value. Unknown/dangling escapes and unterminated strings still reject. Format's first argument retains escape provenance; placeholder count and malformed/unescaped format-brace checks remain unchanged.
+- Format accepts string, null, boolean and number substitutions as before. Arrays render recursively as `[a, b]`, objects as `{key=value, key=value}`, strings/keys without JSON quotes, null as `null` and booleans/numbers using the existing JSON scalar representation. Delimiters are comma+space and equals. Explicitly sort object keys lexicographically so the selected profile is independent of serde feature unification; the two recorded object observations use this order. This selects deterministic local ordering, without claiming arbitrary JVM map-implementation ordering parity.
+- Walk only previously validated Payload trees (depth≤64). Charge value visits and object-entry sorting to the shared work budget before allocation; charge every emitted byte to the scanned-text budget and existing262144-byte intermediate/final encoded payload bounds. Never return partial output. Deep/wide/large outputs still produce typed quota errors; no host formatter or executable interpolation is introduced.
+- StringToJson returns null for empty text or text consisting only of ASCII JSON whitespace (space, tab, CR, LF). Charge whitespace classification before this branch and independently charge subsequent parse/normalization scans. Non-ASCII whitespace/control characters, nonempty malformed JSON, duplicate keys and original byte/depth/member limits still reject. Existing integer-negative-zero normalization and conditional reparse charging are unchanged.
+
+### Missing Lambda service causes
+
+FunctionNotFound, VersionNotFound and AliasNotFound keep `Lambda.ResourceNotFoundException`. Build the public target from the already validated caller function reference, optional qualifier and captured tenant scope, never by formatting arbitrary provider/host error text. Plain names become full same-scope ARNs; retain embedded or explicit qualifiers and append `$LATEST` when absent. Revalidate canonical target grammar and its512-byte ceiling before publishing; tenant identity must never be hardcoded.
+
+The exact cause is `Function not found: <qualified ARN> (Service: AWSLambda; Status Code: 404; Error Code: ResourceNotFoundException; Request ID: <UUID>; Proxy: null)`. The UUID identifies this local integration service failure, not an admitted Lambda invocation or a real cloud request. Obtain fallible OS entropy in retained blocking work under the existing accepted-call capacity; validate version4/RFC4122 before publishing. An entropy/worker/conversion failure uses the existing safe service failure path, with a retained redacted typed diagnostic. Successful Lambda response metadata continues using the actual provider invocation ID.
+
+Both prequeue resolution errors and admission-receipt errors use this mapping, while retaining the same start/result/cleanup owner. Direct/optimized/callback event ordering and physical cleanup semantics do not change. Other service/IO/unknown errors retain static bounded causes and internal typed sources. Public causes stay within32768 bytes; Debug/logs redact targets and host error sources.
+
+### Verification order
+
+Finish all code and regression cases, perform independent read-only review and fix findings, then run focused core/bridge/boundary checks before resource execution. Cover nested collections, feature-independent order, Unicode/escaping, literal braces versus format placeholders, empty/ASCII/non-ASCII JSON inputs, quotas, complete missing target qualifiers/scopes, source redaction, entropy failures and request-ID uniqueness. Then execute the exact original91/32 inventories and standard Rust/Native/Action gates under one frozen source cohort. Preserve all previous failed reports as historical evidence; update the English ledger and PR with the actual new results.
+
+## 8. D114 measured acceptance
+
+Source3207a320a329820fa1d0890145c9518b3be6488a3ef402c684667d700e34b226 passes the unchanged91/91 pure and32/32 actual Docker nodes with original baselines/masks, exact collection, complete assertions and successful joined cleanup. All15 Rust gates,3231 Native passes,26 actual Action controls and13 adapter controls pass. The selected strict successful-inventory criterion is met; no current123-node compatibility difference is waived. See [the D114 source/image/report ledger](../docs/research/study-localstack-workflow-tests.md#d114-qualified-source-cohort). This does not qualify the whole upstream suite, live AWS, managed ZIP/ECR lifecycle or the remaining M4 platforms/reference/release bundle.
diff --git a/specs/rustack-workflows-70-verification-plan.md b/specs/rustack-workflows-70-verification-plan.md
new file mode 100644
index 00000000..aee26807
--- /dev/null
+++ b/specs/rustack-workflows-70-verification-plan.md
@@ -0,0 +1,859 @@
+# Workflows 70: Verification, Security and Performance Gates
+
+Status: acceptance contract; executed foundation evidence is recorded in the implementation ledger/review; full M0–M4 acceptance remains open · Applies to M0–M4
+
+Current platform scope is governed by [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived): the user waives all further Linux x86_64 validation. Older both-architecture/native-x86 requirements below are historical and superseded for future work; retain their completed results without claiming native-x86 performance. Required Linux arm64, Desktop/rootless, reference/performance/load and release promotion remain unchanged. Two-daemon correctness tests may use two distinct arm64 installations.
+
+## 1. Evidence and oracle policy
+
+Use independent expected fixtures from official AWS API/language documentation and sanitized, provenance-recorded AWS observations where available. Each fixture records source/date, SDK/model version, supported profile and normalized nondeterministic fields. Do not calculate expected results with the same evaluator under test. Existing bootstrap fixtures and the [Cargo Lambda spike](../docs/research/spike-cargo-lambda-runtime-execution.md) are useful evidence, not proof of Docker or ASL execution.
+
+Ordinary CI is offline after image provisioning and never contacts AWS. Optional AWS differential tests require an explicitly configured isolated test account and an intentional command; they are not run as part of this specification task. If no AWS account is available in P0, use official protocol fixtures and a documented evidence limitation; do not claim cloud differential parity. Any unresolved behavior that changes acceptance semantics blocks the corresponding release gate until a documented fixture or narrower profile resolves it.
+
+## 2. Required test matrix
+
+| ID | Scenario | Observable acceptance | Gate |
+|---|---|---|---|
+| L01 | Real image handler returns a computed value and invocation counter | Correct value and increasing counter; no echo path; warm reuse visible | M0 |
+| L02 | Official Python/Node RIC image plus a custom Rust RIC image | At least one official managed-language image and custom RIC pass; both Python and Node pass by M4 | M0/M4 |
+| L03 | ImageConfig overrides ENTRYPOINT/CMD/WORKDIR, including explicit empty arrays | Correct argv/cwd; absent differs from empty; no shell evaluation | M0 |
+| L04 | Tag moves A→B, publish A, update latest B, alias movement | Published A stays A, latest uses B only after update, old in-flight revision completes A | M0 |
+| L05 | Wrong OS/architecture, no RIC, init/error, early exit, OOM, malformed Runtime API | Distinct failures, no successful payload and no retained unhealthy environment | M0 |
+| L06 | Two concurrent functions and a third forged completion | No cross-invocation response, stale/duplicate/foreign request rejected | M0 |
+| L07 | Timeout/HTTP cancellation during allocating/init/busy/cleanup | Terminal failure once; function/relay removed or quarantined under retained ownership | M0 |
+| L08 | Docker unavailable, interrupted pull, missing image, deployment saturation | Bounded failure; previous revision preserved; no Active placeholder | M0 |
+| L09 | Reserved=0, global/per-function admission, memory/environment caps | Explicit throttling; permits not released before cleanup; no unbounded allocation | M0 |
+| L10 | Container SDK calls Rustack S3/DDB | Real local result, no host credential inheritance; test enables those services explicitly | M4 |
+| L11 | provided.al2023 Cargo Lambda ZIP in Docker | Same Linux bootstrap artifact executes on its native architecture | M4 |
+| A01 | Create/update/delete/list/tag/describe through Rust SDK and boto3 | Correct JSON protocol, ARNs, timestamp types and errors | M1 |
+| A02 | Concurrent Start with same name/input and mismatched input | One execution; same original response for RUNNING duplicate; correct collision error otherwise | M1 |
+| A03 | Definition update while execution waits | Running execution uses old revision; new execution uses new revision | M1 |
+| A04 | Pass/Task/Choice/Wait/Succeed/Fail | Correct transitions, outputs and terminal status | M1 |
+| A05 | Full InputPath→Parameters→result→ResultSelector→ResultPath→OutputPath | Merge uses original raw input; missing/null/selection distinctions match fixtures | M1 |
+| A06 | Path quoting/index/wildcard/slice, invalid grammar and duplicate .$ output keys | Correct bounded results or creation diagnostics | M1 |
+| A07 | Every allowed intrinsic and nesting/operation/output boundary | Documented AWS-compatible fixture outputs; unsupported functions rejected | M1 |
+| A08 | Choice short-circuit, missing/null/wrong-type, StringMatches and timestamps | Guarded missing path safe; no coercion/regex injection; NoChoiceMatched diagnosed | M1 |
+| A09 | Retry ordered matchers, zero/default counts, backoff/jitter, Catch merge | Exact attempt count and bounded delay; no hidden adapter retries | M1 |
+| A10 | Lambda timeout versus Task timeout versus execution timeout | Distinct errors/terminal states; execution timeout cannot be caught internally | M1 |
+| A11 | States.Runtime and explicit DataLimitExceeded matching | Fatal runtime bypasses Catch; ALL does not catch data limit; explicit matching does | M1 |
+| A12 | History pagination, reverseOrder, data omission, forged/expired tokens | Stable snapshot boundary and causal IDs; no cross-scope access | M1 |
+| A13 | History/byte/transition budget exhaustion | Explicit failure with reserved terminal record; never successful truncated execution | M1 |
+| I01 | Direct versus optimized Lambda with FunctionError/HTTP200 | Correct result envelope and Task failure mapping | M1 |
+| I02 | Child finishes before subscription consumer runs | Parent always receives terminal result, no missed wakeup | M2 |
+| I03 | startExecution versus .sync versus .sync:2 | Acceptance-only detached child; waiting owned child; string/JSON Output distinction | M2 |
+| I04 | Parent Stop/timeout, child timeout/failure, simultaneous completion | Correct ownership/cancellation/status; one settlement | M2 |
+| I05 | Nested parents saturate open/dispatch limits | Rejection or progress, no parent-holds-child-slot deadlock | M2 |
+| P01 | Parallel completes out of order, Map completes out of order | Outputs preserve definition/item order | M2 |
+| P02 | Map empty input, ItemProcessor/Iterator, MaxConcurrencyPath, nested Map | Correct empty/legacy/current behavior, bounded frames/concurrency | M2 |
+| P03 | Branch failure plus state-level Retry/Catch | Siblings cancelled/joined; whole container state reruns, not failed branch alone | M2 |
+| C01 | Callback before/after Lambda response, Lambda failure after early callback | Provisional result settles only after successful invoke; errors are not hidden | M3 |
+| C02 | Heartbeat reset, overall timeout, retry and old token reuse | Task deadline unchanged; old token cannot complete new attempt | M3 |
+| C03 | Wrong-scope/forged/expired/duplicate tokens | Defined API errors; no plaintext in tracing/history/archive | M3 |
+| O01 | Graceful shutdown during Wait/Retry/Map/.sync/callback | Correct ABORTED cutoff, downstream cleanup, no false snapshot success | M4 |
+| O02 | Restore terminal history/definitions/names; import RUNNING record | Atomic restore; RUNNING becomes interrupted, never replayed | M4 |
+| O03 | Corrupt archive, changed tag, missing pinned image, owner mismatch | No partial restore or unsafe cleanup; no tag substitution | M4 |
+| O04 | Two Rustack instances share daemon; one crashes | Restart removes only owned abandoned containers; other instance survives | M4 |
+| O05 | Infinite ASL loop, log flood, large nested payload, oversized frame | Bounded memory/CPU/output; health and Stop remain responsive | M4 |
+
+Every row needs positive and failure-path assertions where applicable. Tests involving Docker must assert container ownership/cleanup after completion and failure; checking only response JSON is insufficient.
+
+## 3. Test layers and automation
+
+1. Unit/parameterized tests: compiler, Path/intrinsic evaluator, retry matcher, data pipeline and protocol error mapping. Use descriptive `test_should_` names and rstest.
+2. Property tests: no panic on bounded malformed input; valid graph transitions stay in scope; generation invalidation prevents double completion; result ordering independent of completion order; history causes refer only to earlier events.
+3. Paused-time tests: deadlines, backoff/jitter ranges, token lifetimes and completion/cancel races using Tokio test clocks. Use real clock tests only for integration boundaries.
+4. In-process integration: actual providers and binary adapters; controlled external ports only for forcing failures. Avoid replacing the entire engine with mocks.
+5. SDK/HTTP integration: AWS SDK for Rust plus boto3, exact endpoint and test credentials; verify headers, field casing, JSON strings and errors.
+6. Docker integration: native-architecture official/custom images, fault injection and ownership checks on all required platform lanes. Missing Docker may skip a local optional suite, but a required CI lane must fail if prerequisites are missing.
+7. IaC smoke: basic Pulumi aws.sfn.StateMachine create/refresh/update/destroy with supported fields and a deployed image Lambda; versions/logging/encryption outside profile must reject explicitly.
+
+Add future Makefile targets: `codegen-stepfunctions`, `test-stepfunctions`, `test-lambda-docker`, `smoke-workflows`, and `verify-workflows`. Add image provisioning/build targets instead of shell scripts. Pin fixture-image digests/content IDs and expected test manifest entries. `verify-workflows` runs the exact required suites and checks that none were silently skipped. Reuse the existing build/fmt/clippy/audit/deny targets.
+
+### 3.1 Exact resource suites and documented pure smoke
+
+D75 freezes an exact resource-test inventory in tests/workflows/required-suites.json. Its schemaVersion1, profile=rustack-standard-jsonpath-v1 and qualification=native-workflow-only are mandatory; it is not a full M0–M4 release certification. Require exactly three suite IDs: native-bridge (the CLI library's ignored Native cases), registered-sdk (all ignored workflows_sdk cases, including documented pure smoke, persistence and performance), and typed-http-sdk (all ignored network integration cases). The manifest contains only IDs and exact test names; it never supplies shell commands or environment variables. Bound the manifest to64KiB, three suites,1..128 distinct names per suite and256 ASCII bytes per name; accept only Rust identifier/namespace characters. Reject duplicate/unknown fields, schema/profile/qualification changes and incomplete/extra suites. Native bridge names must belong to the actual native_e2e selection.
+
+Make test-workflows-manifest compiles/lists the actual same-feature targets with --ignored --list before resource execution and compares each complete inventory with its manifest set. Parse at most32KiB per regular file, require one well-formed matching count summary with zero benchmarks and no duplicate/unknown lines. Reject missing, renamed, extra or no-longer-ignored tests, duplicate/invalid names and zero-test/forged summaries. Reject nonregular/symlink input without blocking on a FIFO. The Python standard-library parser has normal positive/negative controls; Make owns inventory creation and cleanup. No runtime command is constructed from manifest contents. Existing Native, SDK and HTTP SDK Make targets depend on this preflight, so their usual explicit --ignored execution cannot succeed after losing a required case. This does not replace individual test assertions, source-derived semantic catalogs or the broader correctness/security gates.
+
+Add a source-controlled examples/workflows/pure.asl.json with Pass/intrinsic→Choice→Wait→Succeed and a reachable Fail branch. The smoke-workflows target owns a strict-auth actual binary with SERVICES=stepfunctions and Lambda disabled, requiring no bootstrap/Docker/Python SDK artifact. Exercise positive and failing inputs, exact public results/raw input and history, installed pure capabilities, readiness and joined process cleanup. A typed fixture enum distinguishes Pure from Native(bootstrap), and its fallible bootstrap accessor prevents a pure fixture from masquerading as a code artifact. Existing Native/semantic/performance fixture behavior remains unchanged. The pure smoke is an explicit ignored SDK case included in the registered-sdk manifest; its exact-name Make invocation cannot silently run zero cases.
+
+verify-workflows-native serially composes manifest preflight, model/codegen, HTTP/core/runtime, actual Native/SDK, snapshot and performance checks plus codec provenance, without invoking Docker/VM lanes. Report native-workflow-only coverage. The final verify-workflows release command/exact platform suites remain a5.4 consuming gate until Docker startup, image/ZIP/SDK/IaC and all reference platforms are qualified; never make a native-only target imply those rows passed.
+
+Publish docs/workflows-guide.md in English and link README/docs index/smoke guidance. Show source feature selection, pure and explicit trusted-host Lambda modes, actual YAML keys, strict local credentials/endpoint, ASL and ordinary SDK/CLI use, supported state/integration/API profile, snapshot shutdown/restart/no-replay behavior, capabilities/diagnostics and current limitations. Verify its pure example through the owned smoke, reconcile stale runtime-hardening shutdown/snapshot descriptions with installed workflow behavior and preserve explicit Docker-disabled/current-platform limitations. No new dependency or release-readiness claim is authorized by documentation.
+
+```text
+reviewed required names → compile/list identical feature targets → exact sets
+                                      │ missing/extra/change → fail before execution
+                                      ▼
+           owned pure smoke + Native/SDK/HTTP resource suites
+                                      │
+                  joined cleanup + actual assertion results
+                                      ▼
+                    native-workflow-only qualification
+                                      │
+       pending: image/ZIP/IaC, reference Linux/Desktop/rootless, full release
+```
+
+For Rust-relevant implementation work run cargo build, cargo test, cargo +nightly fmt, and cargo clippy -- -D warnings, plus the repository's stricter pedantic/boundary lint selection and existing applicable targets. Run cargo audit and cargo deny check when dependencies land. Specification-only edits use text/link checks per AGENTS.md.
+
+The shared runtime contract suite is available as `make test-lambda-runtime`; it runs the library tests/doctests and strict production boundary Clippy without lint ignores. Protocol property tests use [proptest1.12](https://docs.rs/proptest/1.12.0/proptest/) with512 cases per property, exercising bounded malformed bytes, mutations of valid envelopes and arbitrary binary payloads. Only its std feature is enabled; subprocess/fork machinery is unnecessary for these deterministic bounded parser checks. Runtime-session/relay tests extend this same target as their consumers land; a passing codec suite alone does not satisfy Docker acceptance.
+
+`make test-json-boundaries` verifies the shared core JSON preflight and its strict production-boundary lints. Test escaped-key duplicates, per-object key scope, UTF-8 byte limits, encoded escape work, container depth, aggregate object/array members, empty collections, malformed syntax/numbers, typed schema redaction and configurable limits. Two512-case properties exercise arbitrary bounded malformed bytes and generated recursive valid values. This supports the Docker metadata/ASL parser boundaries; it does not establish their higher-level semantics or executor acceptance.
+
+`make test-lambda-runtime-docker` builds the selected architecture's relay and pinned official Python RIC fixture images, then explicitly executes every resource-gated test in the shared runtime's Docker suite. It requires WORKFLOWS_DOCKER_SOCKET and a matching WORKFLOWS_ARCH; missing prerequisites fail rather than skip. The CLI is only the test transport. Assert computed42/7, warm counter1/2, request metadata, cgroup/user/rootfs restrictions, distinct FunctionError, running-handler cancellation, pre-function Close, EOF/truncated/partial frames, idle expiry, failed setup and expired helper reaping. The ordered production ControlClient also consumes real container pipes and drives computed warm calls followed by separate function-error/busy-cancellation scenarios; join its stream supervisor independently of container/CLI cleanup on all exits. Every case reconciles its preallocated owned names/run label and joins its CLI process. These are relay/client qualification checks, not provider/deployment/pool acceptance for L01–L09. Native x86, Docker Desktop and rootless qualification still require their M4 lanes.
+
+`make test-lambda-docker-wire` builds those images and explicitly qualifies production DockerWire management/attach IO without using the CLI for execution. Assert near6MiB input/output fragmentation, real computed warm calls, handler failure, Close/Ack, joined control/bridge tasks and empty owned run labels after removal. The15 fake-daemon/framing tests additionally pin bounded malformed responses/headers/trailers, typed encoding/version negotiation, reserved cleanup during business saturation, Kill while two waits are blocked, dropped callers, cancelled shutdown waiters, cached worker panic, slow response-body expiry and poisoned partial reads. Captured TRACE tests cover production Hyper requests/responses/trailers; `make test-workflows-spikes` separately exercises actual pinned Bollard request/response/EOF decoder log sites, including synchronous stream construction.
+
+Current wire qualification on2026-10-25 passes on Engine29.5.2 Linux arm64 in native VZ and Linux amd64 under QEMU. Both near6MiB cases pass with60s IO/120s attempt stress budgets. These do not establish the default5s IO latency budget, native x86 performance, Docker Desktop/rootless support or full Lambda provider/pool/deployment acceptance. Independent daemon queries find no remaining containers bearing the wire harness ownership label after the runs.
+
+Local image resolution now extends `test-lambda-docker-wire` with a second real create/inspect case: clear inherited CMD and reset ENTRYPOINT without daemon re-inheritance. The execution case uses the captured addressable parent Id plus explicit platform, and preserves the selected child manifest independently.61 unit additions cover validated inherited defaults/plans, deterministic base fingerprints, ten valid-value stale-hash snapshot mutations, familiar registry identities, actual captured-parent query encoding and legacy API1.44/1.48 classic evidence. Null/missing VFS status remains valid; explicit containerd markers and contradictory manifest summaries reject. Historical engine code is pinned at vendors/moby v28.0.0; fake older-version cases are not old-daemon execution qualification. Current two-case suites pass on both retained daemons. Local resolution does not establish deployment status/CAS, availability leases, allowed registry pulls or unpacked-image quota enforcement.
+
+Owned image preparation now extends the same real wire suite: acquire private aliases/live PinnedImages, prove selected unpacked size, retain leases through handler/container lifetime, remove containers, release/join pins, then stop DockerWire. Both retained architecture lanes pass and subsequent scoped image queries find no private aliases. The33 additional cases cover size proof, shared lease release, precommit rejection, complete outer500 with delayed nested commit, initial404 uncertainty, discarded successful responses, conflicting aliases, lost/failed DELETE, capacity observation and retained shutdown/worker/root recovery including off-runtime Drop. Source-pinned exceptions treat only exact fresh-alias400/404 and wire Busy as no-effect; HTTP500 remains uncertain. These gates do not establish provider publication/CAS, snapshot live-lease reacquisition, previous-run reconciliation or a production executor.
+
+Deployment settlement foundation (§2.10) must independently prove resource/revision/generation CAS, simultaneous duplicate completion, preservation of old code through updates/failure, pending mutation/publication rejection, static public reasons, fallible transaction rollback, and real lease capture/revocation. Tampered resolved snapshot hash/size must reject atomically; saved pending work must restore as failure with metadata-only images. A private-builder compile-fail doctest prevents arbitrary external candidate construction. These are store/capture proofs; they do not close L01/provider admission, retained deployment supervision or Docker executor acceptance.
+
+Retained deployment ownership (§2.11) now has19 additional actor/provider cases plus one core precondition-error case and one model wire-field case. They use the actual bounded wire/image owners with a scripted local daemon and an explicitly declared test executor, covering accepted capacity, dropped responses/waiters, deletion, deadlines, root/worker/off-runtime failure, atomic receipts and stale revisions. These prove provider control-plane preparation, not actual handler invocation through Docker. A3,600s overall-budget case proves per-read IO separation; a simultaneously-ready notification/result test proves scheduling progress.
+
+`make test-lambda-invoke-native` exercises real Native functions directly through the provider; it bypasses AWS SDK/HTTP. Historical references to it as a Native SDK target are corrected to Native provider evidence. `make test-lambda-revision-wire SMOKE_ENDPOINT=<running-gateway>` separately runs an actual Rust SDK through HTTP: valid configuration/code updates/publication require explicit nonempty advancing revision IDs; stale requests decode as modeled PreconditionFailedException with raw412, and an immediate read proves revision/hash/size/description are unchanged before any successful update. This test is included in the explicit service smoke manifest. It does not establish boto3 or Image handler execution acceptance. The changed image read deadlines are additionally qualified by both two-case real Docker wire suites on Engine29.5.2 arm64 VZ and amd64/QEMU; independent queries find no private image aliases or owned containers. Image metadata reads use the configured5s budget, while the wire harness retains60s stream IO/120s attempt stress allowances; full executor default latency and native x86/Desktop qualification remain open.
+
+`make test-lambda-validation-wire SMOKE_ENDPOINT=<running-gateway>` explicitly runs SDK/HTTP code DryRun with inline nonarchive bytes and a nonexistent S3 source; both must succeed without extraction/fetch, revision/hash/size/configuration changes or publication. Unsupported Create KMSKeyArn, UpdateCode SourceKMSKeyArn and UpdateConfiguration KMSKeyArn decode as InvalidParameterValueException; rejected creation must leave no resource. The test is in the explicit service smoke manifest. Image DryRun separately uses the qualified scripted daemon/preparation owner and a declared test executor: old full snapshot and tag count remain unchanged, with no new removal. This is not Image Invoke acceptance.
+
+The deployment decoder (§2.12) has exact-limit, escaped/duplicate-key, wrong-path blob, malformed/unknown-field and depth/member/string/key/metadata tests. Inline base64 covers canonical padding and the exact50MiB decoded boundary without allocation of decoded bytes. Capacity remains owned after waiter cancellation and after a result becomes ready; four concurrent admitted inline validators reuse permits. Worker panic releases capacity and surfaces a bounded error; capacity429 must not be downgraded to400. At B04 closure,395 core tests and101 doctests pass; workspace2,072 tests pass,401 resource-gated cases remain separately selected.
+
+`make test-lambda-boundaries` runs unit/integration/doctest regressions and strict production-library Clippy for authentication, shared core, Lambda model/HTTP/core and shared runtime. Require pedantic, missing Errors docs, doc formatting, unwrap/expect, indexing/slicing and panic checks without new ignores. The B03 closure catalog has659 unit tests and165 doctests (824 passes); seven Docker cases remain resource-gated and must run via their explicit real-daemon targets for executor qualification. Four fixed RFC2202/RFC4231 HMAC vectors complement existing signature/query/streaming regressions; changing signing helpers to Result must preserve every computed output and propagate provider errors rather than treating them as mismatches. This closes B03 for these production libraries, not every repository test or service.
+
+Dependency security closure (§7.2/D27) additionally requires current cargo audit and all cargo-deny checks without new ignores; confirm the regional SDK feature graph has no unused SigV4a/old bigint0.5 branch. ZIP9 regressions encode original external attributes and malformed flag/name bytes directly: symlink/SUID/SGID/sticky, invalid flagged UTF-8, raw/decoded name caps, DOS compatibility, existing traversal/CRC/expansion and retained executable modes. Assert rejection leaves no new artifact, old code remains readable and an outside sentinel stays unchanged. Rerun actual SDK/HTTP validation and revision tests plus Native provider execution after the dependency migration; library parsing alone does not establish platform/handler execution acceptance. Current B01 closure has404 core tests/101 doctests,2,083 workspace tests and833 boundary unit/doctest passes (668+165), with unchanged401 workspace/seven boundary resource-gated cases. Standard and strict gates, both selected regional SDK/HTTP tests, Native provider regressions and all audit/deny checks pass. The Squib selection in the Native target is gated and remains excluded as VM evidence.
+
+## 4. Security acceptance
+
+`make test-lambda-environments` verifies the retained root/worker owner independently of Docker: transactional count/memory admission, scope rejection, definitive create rejection, canceled critical create,500→404→late commit, foreign label/image/name/ID quarantine, root abort recovery, revoked/connect-failed never-issued settlement, slow-health command fairness, failed versus normal queued-handle settlement, final log EOF without reuse and bounded startup under a long caller deadline. The transport regression combines an actual scope error with owner abort and requires Worker precedence/caching. Never count these scripted cases as image code execution.
+
+The B05 regression composes the actual session/HTTP/relay/client with an environment worker after BootstrapReady and an abandoned poll. For an active call, observe an offered but unconsumed event with a recording waker, abandon that offer, then POST InitError. Test Idle and Busy at32KiB and32KiB+1, require the bounded initialization class versus Protocol, redacted diagnostics and joined control/log/API retirement. Scripted container absence remains distinct from real Docker code execution.
+
+`make test-lambda-probes` and explicit `make test-lambda-probes-docker` (with WORKFLOWS_NETWORK set to an operator-provisioned bridge) cover startup network/resource qualification (§4.7/D37). They must reject builtin/nonlocal/partial-ID networks and pin accepted bridge IDs. Probe report decoding is bounded and strict; independently vary attempt/version/architecture, finite memory/swap/PIDs/CPU, UID/GID/capabilities/seccomp and root/tmp observations. Actual pinned Rust probe execution in none and an explicit user bridge must report kernel limits, then leave zero owned environment reservations/resources before proof issuance. Historical reconciliation and production readiness remain separate gates.
+
+Docker Executor composition (§4.6/D36) additionally requires pure admission rejection, trusted readiness revocation, raw/binary success and FunctionError preservation, one Tail base64 encoding with empty/None distinction, resolved-version versus requested-alias metadata, typed initialization/OOM/transport outcomes and independent cancellation/shutdown settlement. The actual image/provider/HTTP fixture must perform deployment, version/alias and computed-result/error calls. Controlled fixture readiness is not production startup/probe evidence. `make test-lambda-executor` runs the Executor/header boundary and supervisor tests; `make test-lambda-executor-docker` builds the pinned fixtures and executes boto3→HTTP→provider→actual image deployment/version/alias/results/logs/error/timeout/replacement. Scalar header duplicates must reject before lookup. Only admission quota Busy maps429; nested wire Busy remains typed infrastructure500. Exact invoked alias ARN must reach the RIC independently from resolved-version response headers.
+
+The pool settlement consumer tests exercise `start`/cancel-safe `wait`/independent `cancel_and_wait`. Hold retirement behind an explicit barrier; require pending settlement after invocation expiry, after a dropped cleanup waiter, and during root-abort recovery. Queued rejection must settle without allocation, consumed success must preserve warm reuse, and closed or supervision-failed receipts must never report clean.
+
+`make test-lambda-log-windows` verifies diagnostics remain environment-wide while each invocation window starts empty: binary order/overflow, silent next call, partial records across Begin/Finish, matching EOF finish, capture failure, stale/cross-owner capabilities and direct capability Drop. Mutation receipts require direct tests where a ready reply is abandoned or remains live/unpolled through deadline: the quiet socket must close before any later diagnostic request, and the local handle must forbid another mutation. Also cover on-time receipts processed after deadline, no-effect expired/abandoned commands, priority-stop rejection and flooded-output fairness. `make test-lambda-log-windows-docker` runs the seven-case owner/pool suite: the window case alternates Tail/logging, None/logging, Tail/silent and Tail/logging through actual warm counters1..4. Require computed payloads, expected observed stdout/stderr markers and empty silent/None tails; never use the diagnostic tail as the response. The independent-stream timing limitation in runtime §3.9 remains explicit.
+
+`make test-lambda-timeouts` runs the complete shared runtime library suite and real Native hardening fixtures. Require delayed/abandoned offers to retain the original caller deadline until consumed, no receipt/body after outer expiry, an effective Runtime API deadline matching the consumed handler budget, earlier-handler versus outer/tied classification, late receipt/completion rejection, on-time completion with a delayed ticket waiter, and strict v2 timeout/cancel correlation. A manual-poll actual actor.run regression must make the receipt and old outer timer ready between polls and require HandlerTimeout. Preserve independent Native initialization timeout classification plus process reap and separate delivered-handler timeout/quiescence. `make test-lambda-timeouts-docker` includes actual image-pool timeout retirement: a900s caller-supplied handler budget cannot override captured3s; the error is Timeout3s, allocation accounting reaches zero before that result, and replacement code starts at counter1. Rebuild/pin the version2 relay image with the host; version1 must fail protocol validation.
+
+`make test-lambda-pool` verifies one accepted FIFO queue across mailbox/actor waiting, canonical typed allocation identity, deadline/cancellation while waiting or offering a result, warm reuse only after consumption, zero warm retention and excess concurrent per-identity returns, one LRU eviction barrier under delayed cleanup, FIFO no-replay startup rejection, cached worker/root failure, receipt recovery and cancelled/repeated shutdown. The unpolled-live response regression requires environment removal before polling the public future again. Source inspection establishes bounds validation before fingerprint materialization; oversized-capture cases independently pin rejection. `make test-lambda-pool-docker` runs the shared six-case owner/pool real-image suite. None of these tests substitutes for full executor/provider SDK acceptance.
+
+`make test-lambda-environments-docker` builds the required images and explicitly runs six real owner/pool cases per selected daemon: relay/function readiness, near6MiB computed result, warm counter, allocation saturation, actual FunctionError and an observed running handler canceled by abandoning its call. Require an actual canceled task join (not any JoinError), joined observer/control/log IO, no retained allocation budget, empty owner/run container queries and joined image cleanup. Keep setup under a cleanup owner before image preparation; preserve namespace files on every unresolved setup/cleanup path. A missing image/socket fails this explicit suite. These owner primitives still do not establish provider/SDK executor acceptance and base64 log-header wiring, startup bridge/resource probes or historical reconciliation. The pool cases use the same production owner and actual RIC to prove warm counter1/2, captured revision isolation, one-slot LRU eviction, FunctionError retirement/replacement and independently observed running-handler abandonment with joined cleanup.
+
+`make test-lambda-environment-plans` verifies §4.2/D30 before allocation: fixed image IDs/platforms, distinct names and ownership roles, relay/function resource/swap/tmpfs/health/log/restart policy, user selection/grammar, bounded revision/region/env/argv validation, single-key inherited→captured→runtime environment precedence with deletion markers, retained real-directory and both-image lease lifetime, and revoked availability before IO. A spawned create regression proves the wire future is Send. The actual two-case wire suite consumes EnvironmentPlan for both ordinary RIC execution and empty ImageConfig overrides: require handler-reported CPU/memory/no-swap/PIDs,512MiB tmpfs/mode, cap-drop/no-new-privileges/read-only rootfs, and configured metadata despite intentionally conflicting image defaults. Inspect real CMD/ENTRYPOINT/WORKDIR and require expected exits142/0 for inherited-empty and reset-entrypoint variants. Join control/log streams and remove both owned containers/aliases on all normal test outcomes. This is allocation-policy qualification, not lifecycle/pool, startup bridge/probe, historical reconciliation or SDK executor acceptance.
+
+`make test-lambda-logs` verifies the independent function output owner: binary stdout/stderr ordering, separate bounded overwrite rings and saturating discard counts, combined4KiB tail, EOF/failure retention, socket closure on framing failure, snapshot admission bounds, partial-frame reads retained through completed/abandoned snapshot requests, fixed partial/silence deadlines, output-flood responsiveness, cancelled shutdown join, off-runtime Drop and cached actor panic. A scripted daemon pins output-only/no-replay attach query and driver handoff. The real wire suite additionally attaches before function start, enables explicit handler stdout/stderr markers, requires both markers without affecting computed results, and joins logs independently after function removal. These tests qualify capture, not complete per-invocation log attribution or the still-pending executor.
+
+`make test-lambda-ownership` verifies the real directory capability independently of Docker: stable owner/fresh run, descriptor/allocated-pin lifetime, actual subprocess contention and reacquisition, bounded malformed/pending state, symlink spellings (including trailing slash/current-directory), hardlink/FIFO/permission rejection, trusted/sticky ancestor rules and repeated parent sync after interrupted creation. Worker tests cover admission expiry, running deadline/cancelled waiter retention, completed-but-unconsumed result capacity and panic release. A scripted-daemon integration additionally holds a real directory lease through abandoned image-owner quarantine and delayed deletion, requiring exclusion until cleanup settles. Production wire fixtures acquire actual directory leases and retain their namespace files on uncertain cleanup. These checks do not establish prior-run reconciliation, startup readiness or full M0 acceptance.
+
+| Boundary | Required proof |
+|---|---|
+| HTTP/ASL/archives | Byte/count/depth bounds before expansion; duplicate-key rejection; invalid values cannot reach unchecked engine indexing |
+| Docker control | Local trusted socket only, no user-selected host mounts/socket/devices, no Runtime API port publish |
+| Environment | Unprivileged identity, limits actually enforced, read-only code/rootfs, bounded tmpfs/logs |
+| Invocation identity | One active attempt per environment; duplicate/stale/foreign completion cannot settle another call |
+| Secrets | Redacted Debug/tracing, no host credentials, token hashes/tombstones, injected token redaction before history persistence |
+| Cross-service | Scope validated at compiler and dynamic invocation; adapter cannot bypass Lambda admission |
+| Shutdown | No forgotten resources; cleanup uncertainty blocks successful consistency snapshot |
+
+Apply AGENTS.md boundary lints: unwrap_used, expect_used, indexing_slicing and panic. Dependency security audit is required evidence, not a claim derived from popularity. This local executor does not claim hostile multi-tenant containment or IAM policy parity.
+
+## 5. Performance and resource acceptance
+
+Use a recorded reference machine under D100: native Linux arm64, 4 dedicated CPUs, 8 GiB RAM and local Docker; also record Desktop results separately. Provision images before timing. These are provisional budgets to measure during implementation, not existing benchmarks:
+
+| Measurement | Budget / method |
+|---|---|
+| Pure 50-state Pass/Choice execution, 1 KiB input | p95≤100 ms over 100 sequential executions, no Docker |
+| Warm image Lambda adapter overhead | p95≤50 ms beyond handler time over 100 calls, concurrency 1 |
+| Preloaded-image cold environment | p95≤5s over 20 environments; report relay and RIC init separately |
+| Stop observability | Terminal/readiness response within cleanup budget; no health starvation under pure loops/log flood |
+| Bounded storage |≤configured history/frames/containers/log limits; record allocator/RSS overhead separately rather than treating quotas as a total RSS claim |
+| Steady-state cleanup | No growing container/task count after 100 invoke/timeout cycles |
+
+Do not introduce a benchmark crate early. First measure these integration workloads and profile deviations; use current criterion only when a stable hot-path benchmark is justified. A missed provisional budget requires recorded analysis and an explicit spec amendment, not deleting the measurement.
+
+### 5.1 Native-host pure workflow workload and responsiveness
+
+Implement the non-image part of5.3 through the actual registered binary and ordinary signed Rust SDK. Reuse the retained SDK Server owner and process cleanup proof. A distinct performance fixture profile sets workflowOpenExecutions=1, workflowTransitions=1000000, workflowHistoryBytes=33554432 and workflowTotalHistoryBytes=134217728; the normal semantic fixtures retain their existing smaller limits. Native capability may be installed by the shared fixture, but these definitions have no Task states and the final cleanup must prove zero Lambda processes. No Docker/VM execution or image evidence is implied.
+
+The latency workload has exactly50 reachable states:25 Pass,24 Choice and one Succeed. Every Choice tests that the1KiB synthetic payload is a string, takes the next state on true and reaches Succeed early on false. All100 sequential executions must preserve the exact original input/output. Measure from immediately before signed StartExecution through the first observed terminal DescribeExecution, including client serialization/signing, local HTTP and bounded1ms polling. Include the first execution; do not exclude warmups or slow samples. History validation runs outside the measured interval and requires exactly102 events: ExecutionStarted,50 exact typed Entered/Exited pairs in definition/name order, then ExecutionSucceeded. Require IDs1..102, previousEventId0 for ExecutionStarted and the first root entry, and previousEventId=id-1 thereafter for this sequential workload (D113). Normal positive/mutated controls reject missing/wrong exits, wrong names/types and broken predecessor links. Every measured operation has a2s observation deadline and the complete workload has a120s deadline; success requires nearest-rank p95≤100000µs. Keep100 raw ordered samples, p50/p95/max and integer rounding up to microseconds. A percentile helper has independent deterministic normal regressions, including exact rank and boundary rejection; do not use interpolated or rounded-down values.
+
+The load workload uses a legal Choice→Pass→Choice loop with a reachable Succeed branch that the1KiB input never selects. First let one execution reach its configured history/event bound while repeatedly probing actual readiness. Count a live probe only when both DescribeExecution observations bracketing that probe report RUNNING; require and report at least one live probe separately from all probes. An already-terminal or RUNNING→terminal pair cannot establish live-load responsiveness; normal negative status-sequence controls pin this distinction. The execution must fail explicitly with a reserved final failure event, stay within25000 events and leave the service ready. Then run100 sequential start/observe-live-work/Stop cycles with the single open slot. Require observed nonterminal loop history before Stop, an ABORTED terminal record with the supplied fixed stop error, and actual readiness during every cycle. Each readiness/Stop/terminal observation is bounded by2s. The next immediate iteration must obtain the same one-slot admission without a hidden retry, proving that repeated completion/cleanup does not consume growing open-execution capacity. Retain per-cycle health/Stop samples and report their maximum, loop event high-water and completed cycle count. Enforce the same fresh2s deadline and explicit reported maximum on exhaustion health probes; exact-boundary negative controls prevent ready-after-deadline results passing. This is workflow admission/history/health evidence, not process RSS, image log-flood or container cleanup evidence.
+
+Emit one bounded schema1 JSON measurement report only after the owned server joins and verifies zero Native processes. Record OS, architecture, available logical CPU count, debug-assertion mode, configured budgets, exact workload parameters, raw latency/health/Stop samples, summary ranks and cleanup evidence. Report current-host measurements with referenceQualification=pending; logical CPU count alone cannot prove dedicated Linux CPUs or8GiB memory. Make test-workflows-performance builds the existing host fixture and explicitly executes both resource-gated SDK workloads with no skipped cases. Each report is a fixed-prefixed JSON line in captured test output, avoiding shared output-file races or sensitive request/environment dumps. The new performance and modified process boundary modules explicitly enable hostile-input Clippy lints (unwrap/expect/indexing/panic); the entire SDK target also passes denied-warning pedantic checks without suppressing existing semantic fixtures. Default unit/workspace runs continue to exclude these slow workloads; their dedicated required target executes them. Final reference Linux, Desktop, warm/cold image and full exact-suite release manifests remain required under5.3/5.4 and may not be marked complete from this host lane.
+
+```text
+┌─ explicit Make qualification / bounded signed SDK observer ──────┐
+│ 100×50 states → terminal → exact history → latency samples         │
+│ bounded loop → health → history failure →100×live loop/Stop       │
+└─────────────────────────────┬───────────────────────────────────┘
+                              ▼
+┌─ actual binary: one open execution slot ─────────────────────────┐
+│ gateway → retained API → registry → structured pure owner         │
+│ health reads readiness independently of business admission        │
+│ Stop → ABORTED history → joined cleanup → slot available          │
+└─────────────────────────────┬───────────────────────────────────┘
+                              ▼
+        retained server join/PID absence → bounded JSON report
+```
+
+### 5.2 Direct Linux arm64 pure-workflow measurements (D101)
+
+Deliver the Linux execution dependency of5.3 without conflating a virtual machine with the dedicated reference machine. `make test-workflows-performance-linux` cross-builds the existing CLI and SDK test harness for aarch64-unknown-linux-gnu with the pinned toolchain, locked dependencies, the existing reviewed Zig linker adapter and explicit lambda/stepfunctions/s3/dynamodb features. Use debug assertions, matching the D74 measurement mode; report this rather than implying release-mode timing. No new dependency or benchmark crate is needed. The performance fixture selects the pure executor, so neither this lane nor the existing host lane needs a Native bootstrap. Other SDK profiles retain Native execution unchanged.
+
+The operator supplies an existing Colima profile through WORKFLOWS_LINUX_PROFILE. Provisioning is a separate discoverable Make target with an explicit new profile, native aarch64 VZ,4 virtual CPUs,8GiB configured memory, no Rosetta/binfmt, read-only repository/target mounts and activate=false. Refuse an existing profile rather than restarting or changing it. Do not touch other engines, global contexts or x86_64. Keep the new VM after measurement. Four dedicated physical CPUs are not established by these virtual allocations: all D101 reports retain referenceQualification=pending, including successful timing budgets. A physical/dedicated reference acceptance requires separate evidence; this slice does not amend that requirement.
+
+Run the Linux SDK harness and its actual CLI directly inside the guest, with no test container, Lambda/Docker invocation, host-native controller, or image initialization in the measured interval. A fixed stdlib Python entrypoint owns the guest test groups through the existing bounded Action process owner. List and freeze the six normal measurement controls and two resource tests before running anything; reject missing/extra/duplicate names. Run the six controls once, then each exact ignored resource once serially with nocapture. Require the precise Rust terminal summaries and one schema1 report per resource, matching the expected workload, Linux/aarch64 identity, configured limits, sample counts, budget ranks and joined-zero-Native cleanup. Never infer success from exit0 alone or accept a report from a skipped/filtered test.
+
+One original450s guest cutoff covers inventory, local file IO/hashing, tests and final report publication, enforced by both monotonic checks and a POSIX real-time alarm. Clamp each resource group to220s or the remaining original cutoff, whichever is smaller; normal controls have30s and listing10s. The existing owner retains its3s retirement allowance after expiry. The host SSH owner has500s, exceeding the guest's453s worst-case cutoff plus retirement, within an original530s host alarm covering local observations and publication. Provisioning has a separate330s cutoff and retains its new profile on any failure. Both owners bound stdout to64KiB and stderr to32KiB and require physical child/group termination. TERM/HUP/INT enter the same exception-driven retirement path; interruption/alarm signals during the existing bounded retirement must not interrupt its physical join. Test these boundaries only after positively observed child entry. Reuse the existing metadata decoder's depth8/member512/string16KiB caps, duplicate/nonfinite rejection and fixed malformed-JSON normalization for each bounded JSON document. The guest remains independently bounded if the host connection fails. Any timeout, late result, output overflow, malformed report, unexpected group or forced retirement fails qualification. Preserve fixed diagnostics and evidence; no environment/request dumps. The helper accepts only bounded shell-safe absolute executable/source paths and profile identifiers, since Colima's SSH boundary may render a remote command. It never invokes a local shell.
+
+Record the configured profile allocations separately from observed guest /proc/meminfo, CPU availability, kernel, Python version, virtualization declaration and child high-water RSS (KiB, not a storage quota). Bound the Cargo stream to4MiB/4096 records and each record to262144 bytes; reject excess record counts before decoding. Record SHA256 of the actual ELF arm64 test and server binaries before and after execution on both sides, plus the bounded Cargo artifact stream used to select exactly one SDK test executable. Reject changed or mismatched artifacts, symlinks, wrong architecture and unexpected Cargo paths. The server must be the sibling target/debug/rustack embedded by Cargo's CARGO_BIN_EXE_rustack, not an independently substituted binary. Reports retain the two ordered raw measurements and their separate cleanup proofs. Results are evidence for Linux pure performance/load only, not image warm/cold timing, image timeout cleanup, Desktop/rootless, dedicated reference resources or complete M4.
+
+```text
+┌─ host Make: locked arm64 cross-build + artifact selection ────────┐
+│ explicit profile → bounded SSH owner → immutable ELF hashes       │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+┌─ native aarch64 Linux guest: fixed Python owner ──────────────────┐
+│ exact inventory →6 controls → latency resource → loop resource    │
+│ each SDK harness → actual CLI → joined PID/group cleanup         │
+│ no Docker workload; bounded /proc metadata + child RSS + samples  │
+└─────────────────────────────┬────────────────────────────────────┘
+                              ▼
+     artifact recheck → bounded report; reference still pending
+```
+
+Independent controls must reject inventory drift, zero-test success, duplicate/wrong/malformed reports, non-Linux/arm64 identity, sample/rank/budget/cleanup mutations, unsafe paths/profile names, ambiguous Cargo artifacts and architecture/hash changes. Run the actual Linux lane, existing host performance target, required Rust/build/tooling gates and independent review before closing this dependency. Preserve the historical D74/D99 evidence unchanged.
+
+Executed D101 acceptance: thirteen Python controls, all six listed Rust controls and both exact Linux resources pass. Pure p95=10791µs;100-cycle health/Stop maxima318/1335µs; live exhaustion probes175/175. Both actual ELF hashes and Cargo provenance are bound under one1252-source cohort. All13 host gates and the original owner join0; readonly postconditions show zero new-daemon containers/volumes/images and no running Rustack server. W397–W402 are fixed and independently rechecked. See the [raw Linux review](../docs/research/workflows-linux-performance-review.md) and [implementation record](./rustack-workflows-90-impl-plan.md#p5-direct-linux-pure-workflow-measurement-dependency-53-d101). The reference remains pending.
+
+### 5.3 Image invocation, initialization and repeated cleanup (D102)
+
+Apply the executable [image performance design](./rustack-workflows-57-image-performance-design.md) for warm100/cold20/100 causal log-flood timeout cycles, actual readiness/Tokio accounting, immutable image transfers and direct Linux ownership. The three added resource names expand the frozen Docker functional inventory to46 ordinary/79 total; Native26 remains unchanged. The [measurement review](../docs/research/workflows-image-performance-review.md) distinguishes development/final captures and preserves pending dedicated-reference qualification. Full79 ARM, standard/strict/Native/Action/security/text gates and independent source/evidence review remain mandatory. Executed D102 acceptance: the final seventh source passes host15, full79 exact resources once/565 Rust cases/33 summaries and all three artifact-aligned Linux resources. Warm/cold p95=3196/165350µs;100 live-flood timeouts return tasks to15, with quiescence p95/max=5539/9888µs. All source/artifact/raw-log/owner bindings and48 exact postcondition commands pass; original20 source IDs are fully restored and retained within the final32-source/15-target inventories, and only two exact owned empty bridges are removed. See the measurement review for the original unproven fourth failure, exact cache repair, W403–W426 and complete raw evidence. This closes the workload dependency, not dedicated reference or M4.
+
+## 6. Cross-references
+
+- ← [all component contracts](./rustack-workflows-00-prd.md#7-reading-order-and-cross-references)
+- → [roadmap exits](./rustack-workflows-80-roadmap.md), [implementation gates](./rustack-workflows-90-impl-plan.md)
+- ↔ [operations](./rustack-workflows-60-operations-design.md), [decisions](./rustack-workflows-99-decisions.md)
+
+## Durable container restart qualification
+
+The §4.8/D38 container journal must be exercised through the real EnvironmentManager create/cleanup path: a published intent exists when the first create arrives; failed durable erase retains the allocation until repaired. Transaction abandonment retains its lease/serial permit until its blocking worker completes. Reject overlong budgets before waiting for that permit. Verify maximum64 records/7,353 bytes, corruption/checksum/owner/UUID/duplicate identity, unsafe staging/published inodes, torn safe staging and authoritative-state preservation.
+
+Scripted restart cases require unknown404 plus blocked relay, later positive commit and exact function-before-relay cleanup; known-ID404; separately mutated name/ID/image and every authoritative label; current-run nonmutation; and an aborted recovery waiter leaving a durable known identity for the next pass. `make test-lambda-recovery` runs these independently of Docker. The explicit `test-lambda-recovery-docker` target requires socket/architecture/image, leaves two real journaled containers across directory reacquisition, then verifies both durable records are settled. Actual recovery tests preserve evidence and close the wire on every post-intent failure. Requalify actual pool/provider/HTTP/wire suites after integration. This is container historical-recovery evidence, not image-alias reconciliation, production startup or complete platform acceptance.
+
+## Durable private image-pin restart qualification
+
+Runtime§2.13/D39 must preserve the container journal format while sharing descriptor-relative bounded snapshot transactions. `make test-lambda-image-recovery` covers8 pin codec/storage cases,7 ordinary historical recovery cases and25 image-owner cases. Exercise strict byte/count/UUID/owner/checksum/flag/duplicate/unsafe-inode bounds, intent-before-Tag and commitment-before-live-lease/delete ordering, no-effect and definitely-unissued erasure, failed-erasure reservation retention and cancellation. Acknowledgment and matching-inspection regressions must retain positive completion proof across a failed commit even when the next alias inspection returns404; retry never replays Tag.
+
+Historical cases require container-before-alias ordering, current-run nonmutation, unknown404 followed by positive identity, durable committed absence, mismatching alias quarantine and cancellation/retry. The explicit `test-lambda-image-recovery-docker` target runs unknown-visible and committed-absent real daemon cases after directory reacquisition. Each requires complete durable settlement, exact private alias absence and unchanged operator source image; a retained evidence guard covers every setup/assertion/cleanup failure, and successful wire creation always leads to an attempted joined shutdown. Requalify the real executor/provider, pool/environment, wire and container recovery targets on the final source.
+
+Final qualification uses the retained cgroup-v2 arm64 VZ and emulated amd64/QEMU daemons with explicit socket/architecture and pinned Rust fixture images. Emulation proves functional behavior only, not native x86 or Linux-reference performance. Empty scoped post-run container/private-alias queries are mandatory. This prerequisite does not enable CLI Docker or satisfy pulling, endpoint reachability, ZIP/handler networking/IaC or final release/platform acceptance. W217 requires production startup to durably bind the ownership directory to the same daemon before mutation and before trusting historical404; the low-level caller precondition is not that startup implementation.
+
+## Durable daemon binding qualification
+
+Runtime§4.9/D76 closes W217 only with executable persistence and same-connection fences. Require strict canonical UUID parsing/redaction, exact72-byte owner-bound encoding, safe staging/authoritative inode rules, permanent mismatch and nonempty-journal first-bind rejection. Reacquire the same directory/wire and retain the installation ID; prove dropped/expired filesystem observers cannot release exclusion or permit a subsequent transaction to overtake publication. Runtime constructors/recovery reject unbound and foreign-acquisition ports before IO or erasure.
+
+Use scripted persistent connections to prove the identity GET and actual request share a socket, that mismatched/malformed/unavailable identity never marks or issues a mutation, that checked-peer closure never reconnects/replays, and that attach still upgrades only after identity verification. Keep shared deadline/fresh-fence, bounded metadata and joined driver requirements. Actual retained-daemon tests must bind before first intent, recover after directory/wire reacquisition, reject a different actual daemon without modifying its resources, and preserve scoped empty postconditions. Existing raw protocol tests do not substitute for these bound runtime paths. Ordinary production startup, pulls, endpoints and full image/platform release remain required.
+
+Executed D76 evidence: `make test-lambda-daemon-binding` passes24 ordinary port/connection/recovery cases and13 storage/transaction cases, with its one actual two-daemon case explicitly gated. `make test-lambda-daemon-binding-docker WORKFLOWS_DOCKER_SOCKET=<primary> WORKFLOWS_OTHER_DOCKER_SOCKET=<different-installation>` passes in both retained socket directions. Existing actual image recovery2, executor/provider1, environment/pool7, wire2 and container recovery1 pass per daemon using persisted bound ports. Scoped container/private-image queries are empty afterward. The x86_64 daemon is emulated, so this is functional qualification only. Complete ordinary startup, discovery, pulling, networking, ZIP/IaC/reference/platform and full release remain unproven by this prerequisite.
+
+## Recorded namespace startup composition qualification
+
+Runtime§4.10/D77 must use a separate all-state owner container query without limit and a complete bounded image-tag scan. Test sequencing, incomplete/unknown/current-run records, no pin work before settled containers, orphan refusal without adoption/deletion, arbitrary-depth/default-registry prefixes, strict inventory limits/required-field/null/dangling handling, peer/list errors, final observations and cancellation/resumption. Empty inventory never discharges an unknown record. The coordinator must exclude producers; this report cannot certify pre-journal unseen effects or grant readiness.
+
+Actual daemon cases must consume recorded previous-run containers and private aliases through the aggregate operation, preserve operator source images, explicitly prove orphan container/alias refusal and retain those resources until fixture-owned cleanup. Evidence roots and joined wire/cleanup survive post-effect failures. Both retained architecture lanes and existing owned runtime/Native gates remain required; emulation supplies functional evidence only. Startup, allowed pulls, endpoints and full image/ZIP/IaC/reference/platform release remain open.
+
+Executed D77 evidence: `make test-lambda-namespace` passes30 namespace/fixture/actual-wire cases and14 inventory cases; three resource cases are explicitly gated. `make test-lambda-namespace-docker WORKFLOWS_DOCKER_SOCKET=<socket> WORKFLOWS_ARCH=arm64|amd64` passes the recorded pair/pin and orphan container/alias cases on each retained daemon. Existing image recovery2, executor/provider1, environment/pool7, wire2 and container recovery1 remain required regressions. The exact1MiB response control completes; declared/chunked oversize, malformed/missing required fields, counts and tag-byte controls reject without a clean report. Fixture cleanup retains first failure while attempting independent identities and aggregate/source checks, with dependency gates and joined outer wire cleanup. This is observed/recorded namespace evidence under the documented provenance contract, not ordinary readiness or automatic legacy certification. Independent post-run alias checks scan the full image inventory and compare complete prefixes client-side; a shallow reference glob is not a complete prefix postcondition.
+
+## Step Functions generated protocol/model qualification
+
+`make workflows-model-check` verifies the pinned312-shape/37-operation source. `make test-stepfunctions-model` compares formatted regeneration byte-for-byte, exercises five generator policy cases and34 actual model cases plus a runnable macro doctest, then applies ordinary tool and strict production-model Clippy. Cover required/optional/omitted/null, negative and fractional epochs, scientific notation including huge zero/underflow exponents, positive overflow, chrono boundaries, submillisecond truncation, hostile lexical size, required collections, unknown fields and diagnostic redaction of task tokens/nested data/error sources. Verify format precedence and unchanged other-protocol timestamp bindings, both serde-disabled JSON protocols and strict no-serde Debug ownership. No generated lint suppression or ignored doctest may satisfy a check.
+
+Run `make audit-codegen deny-codegen` for the excluded developer-tool graph as well as the workspace gates. Model presence and known operation names do not establish endpoint, execution, authorization, ASL or Lambda integration acceptance. The user-prioritized API/compiler/engine work proceeds before final Docker-image qualification, whose original acceptance requirements remain required.
+
+## Step Functions typed HTTP qualification
+
+`make test-stepfunctions-http` exercises all18 typed action mappings, operation-correlated DTO encoding, numeric dates, source-level2MiB body limits, total deadlines, redaction and strict production-library Clippy. Reject duplicate/unknown JSON fields, header ambiguity, signed service/region/action mismatches, nondecimal Content-Length and every trailer frame. Cover exact byte bounds, Unicode business JSON, empty/space-containing ASCII trace headers, oversized/invalid handler errors and8MiB response overflow without mutation replay. Cancellation cases verify accepted commands survive HTTP waiter loss; these controlled-handler cases do not establish execution-actor ownership.
+
+The actual Hyper network fixture rejects a chunked request carrying an oversized trailer without dispatch. A paused regression expires its cleanup waiter and then resumes the same root task's join, proving connection-task ownership is retained. `make test-stepfunctions-http-sdk` runs pinned ordinary boto3 with strict signed local requests against the controlled typed handler: StartExecution preserves raw input and a numeric negative fractional date, ListStateMachines decodes normally, DescribeExecution returns a modeled exception and CreateActivity reports unsupported. The fixture bounds connection admission and joins its server/connection tasks. These are transport-only proofs; the main program does not advertise/register Step Functions until a real core adapter exists.
+
+## Step Functions compiled path/payload qualification
+
+`make test-stepfunctions-core` exercises actual compiled winnow paths and transactional result merging. All seven independent path catalog cases run against the evaluator. Cover singular missing/null, context roots, deterministic object wildcards, consecutive wildcards/slices, unsupported syntax/escapes/index overflow,1,024-byte/128-segment and10,000-work boundaries, exact256KiB data,64-depth/65,536-member preflight and escaped output expansion. Three512-case properties cover arbitrary UTF-8 parsing, quoted-key round trips and merge preservation. Twelve executable public doctests and strict production Clippy qualify the API.
+
+Reject a borrowed50,000-depth Value without owning its recursive teardown; the test caller safely dismantles that tree iteratively. Context tests embed maximum-size/depth/member source payloads plus metadata, including compact exponent input whose normalized number representation expands, mixed/full numeric Map items, exact4MiB internal bytes and+1 rejection. Selected context output retains the normal payload limits. This pure semantic foundation does not satisfy compiler, registry or execution acceptance.
+
+## Step Functions Choice predicate qualification
+
+The existing `make test-stepfunctions-core` target includes the compiled predicate evaluator: all90 ordered family/operator/literal-Path combinations, BooleanEquals variants, six type tests, logical short-circuit/error order and four independent Choice catalog cases. Two additional512-case properties compare the Unicode-glob implementation with an independent dynamic-programming oracle and preserve integer order. Validate source duplicates/unknown operators,1,024-node/32-level/128-child and pattern/work/string-byte limits, borrowed50,000-depth rejection, redaction, context references and wrong-type behavior.
+
+Raw JSON regressions must include decimal/exponent forms at and beyond the conservative float endpoints, their negative counterparts and correctly rounded interior equivalents; constructing json! from already-rounded Rust f64 values is insufficient. Keep integer endpoints valid and IsNumeric a type test. Timestamp cases compare offsets, fractions beyond nine digits and trailing-zero equivalence; valid large literal and Path predicates must exhaust the shared byte budget explicitly. Workspace serde_json float_roundtrip is enabled, so rerun full standard workspace gates and the generated-model/HTTP signed SDK targets for feature-unification regressions. The excluded generator retains its own graph. This qualifies predicates only; state target selection and the complete compiler/execution actor remain required.
+
+## Step Functions Wait source qualification
+
+The core target includes all four Wait source forms and a512-case static/dynamic seconds equivalence property. Test exact365-day STANDARD caps, zero/past waits, uppercase timestamp separators, numeric offsets, target-only truncation, long target fractions, fractional current samples, duplicate/unknown fields and dynamic missing/null/wrong-type/range errors. Confirm the component returns only a relative Duration and never reads a clock or starts a timer. Core166 unit cases/18 doctests and strict checks pass. These tests do not qualify generation-tagged timer ownership, monotonic scheduling, execution deadline races or cancellation; the execution actor remains responsible for those gates.
+
+## Step Functions expression/intrinsic qualification
+
+`make test-stepfunctions-core` now executes the12 independent intrinsic catalog cases plus historical AWS rounding/split edge inputs. Cover format escape provenance (including nested/dynamic formatting), quoted/context paths, scalar substitutions, shallow merge, structural numeric equality, checked int32 arithmetic, JSON duplicate rejection, Unicode delimiter sets and source/UUID failures. Exact4,096-byte,128-argument, ten-call and1,024-node boundaries are exercised; the next byte/argument/call/node rejects. Two new512-case properties cover hostile UTF-8 compilation and checked addition.
+
+Expansion cases exercise bounded string/JSON output, shared path work, cumulative argument materialization, string scans, delimiter cardinality and repeated delimiter work. Repeated200-key late object mismatches must consume lookup work even when comparison returns false before queued child visits. Keep a valid single mismatch as a control. The concrete entropy adapter produces valid distinct v4 IDs; injected failures preserve typed sources with redacted diagnostics and invalid injected IDs reject. Actor-side entropy isolation and template/pipeline/compiler integration remain separate gates. Current core242 unit cases/21 doctests and strict production/all-targets Clippy pass.
+
+## Step Functions template/data-flow qualification
+
+The core target executes all four independent pipeline fixtures through prepare/finish, proving that parameters read effective input, selectors read raw resource results and merges target the original state input. Template cases cover recursive arrays/context/intrinsics, literal text preservation, single-suffix normalization/collisions, lexical normalized-key order, one shared UUID source and aggregate work across dynamic fields. Exact4,096 combined template/expression nodes compile/evaluate;4,097 rejects. Cover32-container depth, duplicate source fields, invalid/null templates and borrowed extreme-depth rejection.
+
+Expanded constants and repeated dynamic selections must fail in the bounded writer before an owned oversized output tree exists. Fail oversized Parameters/selectors/merges even when a later path discards them; retain original raw bytes on all outcomes. Default and explicit root paths must behave identically under numeric normalization. Share one result-phase budget between selectors and OutputPath, with valid isolated-selector controls. Two new512-case properties cover arbitrary normalized business keys and discarded-result preservation. Core270 unit cases/31 doctests and ordinary/strict checks pass. These are pure transformation proofs, not compiler, callback provenance or execution/resource ownership evidence.
+
+## Step Functions sequential compiler qualification
+
+The core target compiles all six M1 IR forms and follows resolved Next/Choice/Catch indices. Test structural loops with reachable terminals, missing/cross-scope targets, unreachable-terminal rejection and bounded warnings. Verify strict root/state fields, JSONPath/version rules, mutually exclusive transitions/sources, unavailable Map/Parallel/child/callback profiles and adapter-disabled diagnostics. Check static direct/optimized Lambda grammar, tenant scopes, qualifiers, invocation type and parameter fields without performing any invocation or alias resolution.
+
+Recovery tests pin defaults/zero attempts, ranges, matcher uniqueness/order, fatal and wildcard exclusions, explicit DataLimitExceeded matching and same-scope catch targets. Fail instructions retain omitted/literal/expression fields. Source tests cover decoded duplicate keys, arbitrary malformed bytes, original bytes, RFC6901 escaping, redacted diagnostics with typed sources and enclosing data-flow field locations. Exact1MiB,64-level,1,000-state,128-choice and65,536-compiled-node boundaries pass; one over rejects. Two new512-case properties cover malformed input and generated linear graph index correctness. Core315 unit cases/66 doctests and ordinary/strict checks pass. The64-byte minimum scalar writer reservation avoids4KiB cached buffers per literal while preserving hard payload caps. Compiler evidence does not qualify registry, execution scheduling, adapters or endpoints.
+
+## Step Functions sequential transition-driver qualification
+
+Drive ASL§3.1 directly with paired explicit clocks and typed completions. Cover six-state processing, original/effective input separation, dynamic Fail strings/omission, ordered Choice/default errors, all four Wait forms and wall jumps, raw-input TimeoutSecondsPath, fresh attempt IDs and stable entry times across Retry, per-retrier counters, exhausted-first-match behavior, capped/FULL backoff and bounded unbiased rejection. Exact Task/execution deadlines beat ready results; Stop bypasses recovery and invalidates one active attempt. A repeated/late completion cannot change a terminal Arc. A512-case arbitrary control-order property checks single settlement, absent repeated cancellation and redacted Debug.
+
+Boundary regressions include exact256KiB encoded Pass string success and+1/string-cap failures as DataLimitExceeded; explicit handling of parameter/result expansion limits; failed Catch scalar traversal as Runtime; internal encoding failure retaining its typed source without business Retry/Catch; and exhausted transition budget rejecting a long retry before timer/entropy/counter mutation. This qualifies the deterministic sequential driver, not async actor scheduling, official history, resource cleanup or an API/real Lambda adapter. Core365 unit cases/89 doctests and strict checks pass. Those acceptance gates remain required under the workflow-first priority.
+
+## Step Functions supervised runtime and history qualification
+
+The core target runs actual async pure-state executions and concrete task-channel fixtures under ASL§3.2/D49. Cover fast Started/Completed ordering, caller loss, per-state Retry visits, uncertain completion with retained earlier capacity, Task/execution timeouts, cancelled-call cleanup, dispatch/CPU admission saturation, Stop during a retained blocking worker, late prepared dispatch/result proposals, CPU/actor panic, observer deadline expiry and repeated drain of the same jobs. No fake production Lambda adapter or endpoint is installed.
+
+History tests verify atomic terminal/read-view agreement, official direct/optimized events, source-preserving internal diagnostics, fixed causal IDs, stable old pages, local data-disabled projection, complete4MiB pages, global/per-execution exhaustion, successful-terminal fallback to reserved failure, global accounting through the last retained view and exact25,000-event fill/drop. Three independent findings W115–W117 are fixed/rechecked: fallback Drop safety across runtime loss, one-sample post-admission control/deadline checks, and RAII release of blocking test gates. A runtime-shutdown fixture keeps the adapter receipt outside the stopped runtime and proves permits remain charged.
+
+Core404 unit cases/129 doctests and strict checks pass, including39 new cases. Standard current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,909 tests/415 gated, including retained deferred Docker work. Reuse resolved model/Tokio/tracing edges without any new package/version. Root audit still reports4 vulnerabilities/10 unsound warnings in the existing zstd/Squib graph (477 packages,1,378 advisories); deny passes bans/licenses/sources and fails advisories under B06. Registry/revision/name/tag semantics, authenticated pagination, main routing and the real Lambda bridge/SDK acceptance remain required; core receipts do not replace actual backend cleanup evidence.
+
+## Step Functions real Lambda bridge qualification
+
+`make test-stepfunctions-bridge` exercises integrations§1.1/D50 with11 controlled-provider cases and six executed doctests, ordinary all-targets Clippy and strict production-boundary Clippy. Cover owned queue/admission/response/cleanup separation, same-provider direct and optimized results, dynamic invocation-type/reference rejection, provider-scope mismatch and disabled-backend rejection, FunctionError-only selection, bounded UTF-8 causes, invalid/deep/non-JSON output, raw/envelope256KiB quotas and redacted plans. Expire one cleanup observer, resume the same handle and supervisor, and prove capacity remains held through quarantine, manager failure and terminal backend uncertainty.
+
+`make test-stepfunctions-bridge-native` first builds the actual host bootstrap, then explicitly selects seven process tests with zero ignored: computed direct/optimized output and actual Lambda UUID metadata; FunctionError Retry with reevaluated retry count; alias version1→2 between attempts; FunctionError Catch preserving original input; actual running-handler Stop and ASL Task timeout; omitted/null/string/array optimized Payload; and the function's own timeout caught as Sandbox.Timedout. The cancellation fixture observes a handler-created PID/request-ID file after Runtime API event consumption and verifies that process is absent after joined workflow/bridge/provider/executor cleanup. Tests collect errors before assertions and preserve temporary files if physical cleanup is unproven. These are real Native provider/process qualifications, not HTTP/SDK or image tests.
+
+Shared Lambda submission regressions cover external cancellation/closed channels and deadline precedence, rejected admission with retained cleanup, resumable response observation and second-read rejection, plus uncertain/closed cleanup remaining non-Clean. Ordinary Invoke rejects a cross-account partial ARN before resolving any local function and retains supported same-account partial references. `make test-lambda-boundaries` passes1,228 unit/doctest cases and all six strict production-library checks, with20 separately resource-gated cases. Core remains404 unit cases and now132 doctests; its focused target passes.
+
+Final feature-enabled current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,925 tests and422 explicitly resource-gated cases, including the retained deferred Docker checkpoint. The seven Native cases are separately selected and pass; they are not silently counted as ordinary workspace execution. CLI feature `stepfunctions` is explicit/nondefault and exposes only binary-support composition until main registration. Reuse already-resolved dependency packages/versions. Fresh audit retains4 existing vulnerabilities/10 unsound warnings in477 packages against1,378 advisories; deny bans/licenses/sources pass while advisories fail under B06. Registry, authenticated API pagination, main routing, ordinary Rust SDK/boto3 real-service acceptance, full M1 and final image/platform gates remain required.
+
+## Atomic child registry port qualification (P3 dependency)
+
+[Integrations§4.1](./rustack-workflows-40-integrations-design.md#41-atomic-child-execution-registry-port)/D60 establish the registry dependency before ASL child-resource admission. `make test-stepfunctions-core` runs19 child-port cases plus two controlled scheduling cases under default and serde_json preserve_order. Tokio test-util is enabled only for core development tests to drive exact observer clocks; no package/version changes are required.
+
+Require exact serialized/null/scalar/array input handling; PascalCase envelopes with real epoch-millisecond dates and distinct string/JSON outputs; failed/timed-out child error mapping and bounded UTF-8 cause truncation; combined envelope limits and Bytes/String/Key quota classification. Observe a fast child's termination before consuming its start receipt, then recover the same terminal watch. Cancel a polled admission waiter and resume; make an already-ready success/error observable after its original deadline and prove that the deadline wins while cached ownership/result survives. Closed reply ownership remains distinct from an explicit no-issuance rejection.
+
+Reject foreign/closed parent records and scoped parameter errors, verify immutable creator lineage and exact16/17 bounds, reject active idempotent graph cycles and excessive replay chains even when all nodes began as external roots. Exhaust open admission without claiming a name, retry that same name after cleanup, saturate the independent child-call pool while ordinary read admission remains usable, and prove a stale completed cancellation owner cannot stop a new child. Accepted RequestResponse survives parent Stop and handle loss. Owned descendant cancellation retains child-call capacity through a blocked physical Task settlement, then releases it only after Clean. Dropped accepted replies still cancel owned children; a weak port survives public registry-handle loss but becomes unavailable after joined root shutdown.
+
+Controlled scheduling cases keep unrelated entropy work blocked while cancel/deadline/close must stop an existing child before the gate is released; the root join remains retained until release. Keep child intake ready and require an accepted ordinary read after at most one child turn. These tests exercise actual registry/runtime channels and controlled resource receipts, rather than an HTTP completion poller.
+
+`make test-stepfunctions-bridge-native` additionally executes actual child computation and owned cancellation through the new registry port with a single available Task dispatch slot. The handler must write its PID/request ID after consuming the event and before a release gate; returned computation42 and identities match that record. In the cancellation case prove the consumed PID absent before any global cleanup. The30s business scenario is shorter than its300s relation deadline,3600s parent Wait,900s Lambda timeout and180s fixture gate, excluding competing timeout/completion explanations. The PID probe retains its spawned process through timeout kill and explicit reap, with a separate actual forced-timeout probe case. Preserve cleanup before propagating assertion failures.
+
+This qualifies the concrete port and optimized envelope mapping. Compiler allowlisting, sequential/structured ASL child dispatch without retained Task permits, TaskSubmitted history, service capability and ordinary nested SDK acceptance remain required before claiming `.sync`/`.sync:2` or P3/M2 complete. Existing SDK and eight-state service regressions remain mandatory; Docker image work stays deferred.
+
+## Structured service and ordinary SDK qualification (P3 continuation)
+
+[ASL§3.6](./rustack-workflows-30-asl-design.md#36-structured-service-composition-and-capability-binding)/D59 bind API Create/Update/Validate to the registry's immutable state profile. Sequential library composition rejects structured artifacts before publication; Structured composition executes captured root definitions. Exhaust the shared root-frame pool, verify failed registration does not publish a record/name, then retry that same name after joined Stop. Validate exact minimum/maximum YAML frame/result limits and per-execution≤global relationships; confirm reported quotas reach the main supervisor under full and minimal feature sets. Reject Distributed Map and Lambda Tasks without an actual port.
+
+Both ordinary SDKs run the independent [six-case structured catalog](../tests/workflows/structured-cases.json): Parallel ordered results, dynamic-concurrency Map selectors/nulls, empty Map, nested Parallel/Map, business Catch and actual Lambda Map outputs. Each also executes two actual consumed-event scenarios through the registered binary: two Parallel handlers must publish distinct PID/request IDs before release and return those exact identities; Stop an enclosing Parallel with two active Map handlers and prove both PIDs absent. Gate Lambda timeout900s and fixture gate180s exceed the outer120s qualification window, preventing natural function expiry from masquerading as Stop cleanup.
+
+Check exact shared Parallel round-start predecessors and MapIterationStarted→MapStateStarted edges, not just previous<id. Require both stopped iteration indices0/1 before the root ExecutionAborted. Forward/reverse/data-disabled SDK paginators retain IDs/predecessors and omit all execution/state/task/Lambda inputs, outputs, data-detail metadata and the required optimized TaskScheduled parameters object. Reuse the complete omission assertion with M1 cases. These are selected local causal semantics backed by official DTOs, not cloud concurrent-order differential evidence. Keep all17 M1 catalog cases, all15 APIs, strict signing, revision capture, cleanup and forced-runner proof in the same required `make test-stepfunctions-sdk` gate. Nested `.sync`, callbacks, snapshots and image/platform acceptance remain separate.
+
+## Asynchronous structured ownership qualification (P3 dependency)
+
+`make test-stepfunctions-core` executes [ASL§3.5](./rustack-workflows-30-asl-design.md#35-asynchronous-structured-resource-owner-and-commit-fence)/D58's ten asynchronous owner cases under default and preserve_order JSON configurations. Prove overlapping accepted calls with reordered completion and ordered results; Map/empty-Map lifecycle; resumable Stop cleanup; nested sibling failure gated by actual retirement before Catch; descendant-first cancellation and forced Map iteration aborts; no stale abort after a committed state exit; expired pending dispatch cannot spin ahead of a ready CPU join; Stop during speculative CPU work cannot issue IO; late admission error cannot append past a Task timeout; and actor panic retains all accepted dispatch/ancestor leases in quarantine. Direct journal regression rejects future predecessors without mutating counts/bytes/global charges, retains terminal reserve under exhaustion, and preserves non-linear branch links through reverse/data-disabled projection.
+
+`make test-stepfunctions-bridge-native` requires actual host bootstrap processes. The structured Parallel case waits for two distinct PID/request-ID records, atomically published after complete Runtime API body receipt and immediately before the shared release gate. Both records must exist before release; returned results must match those identities after joined cleanup. Merely observing two bridge-owned calls or two process-start markers is insufficient overlap evidence. This is Native/library composition qualification. Consuming-service structured SDK gates below qualify eight-state API admission; nested workflow acceptance remains mandatory for P3/M2.
+
+## Bounded frame scheduler qualification (P3 dependency)
+
+`make test-stepfunctions-core` covers [ASL§3.4](./rustack-workflows-30-asl-design.md#34-bounded-frame-scheduler-and-retirement-protocol)/D57 with22 explicit-clock scheduler cases, including a64-case nested Map/Parallel property. Run the scheduler suite again under serde_json preserve_order. Literal outcome checks cover nested data flow, out-of-order indexed outputs, Map business concurrency with old successful calls still charged, sibling failure/cancellation and retirement before retry, new frame identities, stale completions/retirements, root Stop over nested calls, exact subsecond child deadlines, Wait and Task timeout, join-only capacity deadlock rejection, global/local result slot exhaustion, aggregate DataLimit Catch after every sibling retires, and shared root transitions. Exercise the exact1,024 outstanding-call ceiling and retained ownership on exhaustion.
+
+Hold a successful sibling's queued notification unconsumed after acknowledging physical retirement; shared frame capacity must remain charged until notification emission. Propagate a nested Task FULL-retry WorkLimit and preserve Rustack.InternalError, the original Task recovery failed cause and typed source; separately prove a later business Fail remains Business after a handled evaluation diagnostic. Capacity waiting must wake only after the actual slot is returned. Validate invalid caps, root admission rollback and monotonic regression. These cases establish synchronous ownership/retirement semantics; actual asynchronous ports, panic retention, concurrent history and service/profile integration remain separate mandatory gates.
+
+## Structured frame-effect interpreter qualification (P3 dependency)
+
+`make test-stepfunctions-core` covers [ASL§3.3](./rustack-workflows-30-asl-design.md#33-deterministic-structured-frame-effect-protocol)/D56 with explicit clocks, independent literal inputs/outputs and a128-case indexed-order property. The effect suite also runs with serde_json preserve_order. Verify Parallel effective inputs and raw-input merge, all four current/legacy Map selector/processor pairs, lazy UUID sourcing, enclosing State/RetryCount and Map.Item.Source context, no implicit Map namespace in child states, null item preservation, empty Map result processing, effective-input dynamic concurrency0/1/40 and invalid values, exact10,000/10,001 items, and exact256KiB/256KiB+1 ordered aggregation. Missing/duplicate/out-of-range outputs and invalid join shape fail explicitly.
+
+Retry tests require original raw input, preserved EnteredTime, updated RetryCount, fresh round identity and unchanged absolute deadline. Stale/duplicate/cross-kind completions remain inert. Stop and completion at the deadline return the invalidated round's cancellation obligation and never resurrect execution. Explicit DataLimitExceeded Catch preserves raw input and typed sources; actual lazy-selector Missing and typed internal failures bypass business recovery. An exhausted transition budget fails before jitter entropy or retry counters mutate. Default driver and supervisor admission remain gated even with the explicit structured effect constructor. These are pure interpreter tests; they do not claim actual concurrent Lambda scheduling, joined sibling resource ownership, causal concurrent history or nested workflow acceptance.
+
+## Structured scope compiler qualification (P3 dependency)
+
+`make test-stepfunctions-core` covers [ASL§1.2](./rustack-workflows-30-asl-design.md#12-structured-scope-compilation-and-staged-runtime-admission) and D55. Run the default core suite and an explicit compiler suite with `serde_json/preserve_order` enabled: IDs must remain lexical even when another workspace consumer enables insertion-order maps. Raw nonlexical source fixtures verify root and nested StartAt/Next identities. Nested artifacts share the original root byte allocation and tenant, while scopes reuse names independently and reject parent/sibling jumps. Check root-relative escaped warnings, graph validation in unreachable branches, enclosing recovery targets, legacy/current selector/processor combinations, default/dynamic concurrency and unsupported processor configuration.
+
+Exact16/17 scope-depth fixtures use Map processors so both remain inside the independent64-container JSON limit; sixteen nested Parallel wrappers separately demonstrate preflight JSON-depth rejection. A128-case mixed Map/Parallel property covers lexical reuse and shared source ownership. Exact1,000/1,001 aggregate states and65,536/65,537 compiled units span nested machines; an additional exact-node fixture includes a Map item-selector template in the shared charge. Registry Create/Update must reject sequential child artifacts carrying the enclosing root source, preserving current revisions and leaving rejected names absent. Default compiler and sequential-driver refusal remain mandatory until the frame owner lands. These tests establish the compilation dependency only; they do not qualify lazy scheduling, concurrent history, sibling cleanup, nested `.sync`, or service-level M2 acceptance.
+
+## Step Functions resource/execution registry qualification
+
+`make test-stepfunctions-core` qualifies API§3.1/D51 with38 new registry cases (442 total unit cases,173 executed doctests), including a512-case generated-name/scoped-ARN property. Core remains independent of Lambda/HTTP. Cover exact raw-input RUNNING replay under16 concurrent starts, closed/conflicting names, revision capture across Update, role-only publication, exact source-byte Create identity, registration-failure rollback, deletion/recreation and old-ARN tombstones, atomic tags and unchanged old snapshots, context IDs/input/role metadata, omitted versus empty Stop fields, repeated Stop/success history agreement, lost accepted Start/Tag/Stop replies and resumable receipts/shutdown. A closed oneshot reply lane is consumed before returning Unavailable, so repeated observation returns a typed failure rather than repolling a completed receiver.
+
+Inject monotonic maintenance observations rather than waiting90days. Prove record expiry and90day name expiry are independent, unexpired claims are never evicted at capacity, externally retained records/revisions/tag versions remain charged, and Pending/Quarantined cleanup retains its complete record/revision/name graph beyond both TTLs until Clean. Abort the root during a gated real blocking entropy worker: its accepted envelope/permit remains charged above the join, even after the test gate is released. The gate uses channel disconnection as an RAII release so assertion failure cannot strand the blocking thread. An aborted root signals running executions, while a live shutdown observer can expire and resume the same retained task cleanup. Maintenance builds running-resource membership once, avoiding a deleting-machines×records scan.
+
+Boundary cases reject invalid/overlong identifiers, qualified/wrong-service ARNs, cross-scope compiled IR/role/resource references, IAM region/path/name failures, reserved/duplicate/oversized tags, invalid trace data and zero/excessive trusted capacities. Unicode tags retain the selected AWS character classes. ListExecutions atomically rejects an absent machine, while DescribeExecution remains available after deletion and a recreated ARN can list still-retained old-incarnation records under the explicit local contract.
+
+`make test-stepfunctions-bridge-native` now explicitly selects eight actual Native process cases with zero ignored. The new registry case creates a machine, invokes real Lambda to compute42, publishes a new prepared definition, invokes it to compute44, deletes the mutable machine and reads both captured execution revisions and distinct actual request metadata afterward. It gathers failures before joining registry, bridge, provider and process owners, preserving its directory if any registry/bridge settlement is unproven. This qualifies domain registry→engine→shared provider→actual process, not HTTP/SDK/main routing.
+
+Final feature-enabled current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,963 tests/423 separately gated cases, including the retained deferred Docker checkpoint. Focused core/bridge production-boundary gates pass. Adding sha2/regex local dependency edges adds no external package/version; current usage was checked against their primary documentation. Fresh audit remains4 vulnerabilities/10 unsound warnings in477 packages against1,378 advisories; deny passes bans/licenses/sources and fails unchanged B06. The retained API preparation owner, authenticated pagination,15-operation real HTTP adapter/main registration, ordinary SDK acceptance, remaining P2–P5 and final image/platform gates are still required.
+
+## Step Functions real API preparation and pagination qualification
+
+`make test-stepfunctions-api` reuses the shared binary-support gate:30 unit cases (19 actual API/HTTP-owner cases plus11 Lambda bridge cases),12 executable doctests, all-targets Clippy and strict production-boundary Clippy. Drive all15 M1 operations through the real typed HTTP service, API worker root and actual registry/engine. Check JSON-string input/output, numeric dates, immutable revision/publication-date capture, all terminal projections, optional failure/Stop fields, no-mutation profile rejection, validation severities/truncation, current resources and tag CRUD. Missing tag resources use ResourceNotFound400; adding the51st tag returns TooManyTags400 without changing the existing50. Wrong trusted scopes fail before dispatch; unsupported callback/encryption/publication/metadata profiles never fall back to fabricated results.
+
+Stable pagination cases capture machines before deletion/new creation and RUNNING executions before Stop, then replay query-bound tokens against the same old boundary. Reject changed size/status/order/data flags, cross-operation or forged handles, collisions and expired tokens. Count saturation preserves live entries. Byte saturation charges Vec capacity even for sparse captures, and releasing one Arc does not release its snapshot reservation while another remains. Reverse history reuses the complete4MiB limit/projection, fixed high-water and original causal IDs; an additional core case spans pages without splitting or duplicating records.
+
+Retained CPU fixtures gate a real blocking worker before expiring shutdown observation, then join the same work and hold root admission through unobserved replies. Root abort preserves capacity even after the worker finishes. Worker panic preserves its typed diagnostic through quarantine/shutdown. Paused Tokio clocks advance only after worker-entry or ready-reply proof, preventing setup latency from masquerading as a post-work timeout. Separate real execution timing verifies TIMED_OUT agrees with its terminal history event. Sender-loss regressions prove the registry command lane can disappear while its independent supervisor and accepted Task remain live; explicit close still joins them. Core445 units/177 doctests pass, including these additions.
+
+`make test-stepfunctions-bridge-native` explicitly selects nine actual process cases with zero ignored. The new HTTP case creates/starts/describes a real optimized Lambda task, obtains computed42 and matches handler-reported request ID with invocation metadata, then deletes mutable metadata and continues a reversed, data-disabled history cursor. It gathers failures before joining API→registry→bridge→provider→process owners, using one absolute cleanup deadline and retaining files on uncertain settlement. This is actual generic Hyper-body HTTP codec/handler→Native execution evidence; it is not a socket listener, main gateway or ordinary SDK client qualification.
+
+Generator regression checks preserve HTTP402/408 rather than collapsing them to500; configured common errors remain generated. Six standalone generator tests,35 model cases/one doctest, formatted regeneration consistency and strict model/tool checks pass. HTTP retains56 unit cases, two actual framing cases, one separately gated SDK transport case and nine doctests. CLI test-only Tokio test-util enables controlled clocks; getrandom/HTTP/model dependency edges reuse resolved packages without version changes. Final feature-enabled current-worktree build/test/fmt/Clippy/rustdoc pass with2,986 tests/424 separately gated cases, including retained deferred Docker changes. Constructor-only stepfunctions feature checking succeeds without Lambda. Root audit still fails4 existing vulnerabilities/10 unsound warnings (477 packages,1,378 advisories); deny passes bans/licenses/sources and fails B06 advisories. Standalone codegen audit/deny pass. Main settings/routing/health/worker coordination, both ordinary SDKs against the real service, complete M1 and remaining P2–P5/image/platform gates remain required.
+
+### M1 registered gateway and composite lifecycle qualification
+
+`make test-stepfunctions-runtime` composes the actual supported API/bridge gate with full and workflow-only binary tests and strict production checks. Pin target-family priority under conflicting Lambda paths, form/SNS signing hints and duplicate DynamoDB/SFN targets. Use actual sockets to check modeled408 timeout/error/request-ID framing. Validate supported YAML ranges/relationships and strict credential requirements before listening; reject unqualified backend capability claims. Saturate registry command admission while reading health without business commands.
+
+Natural grace must let a real one-second Wait succeed. Cancel and expire separate shutdown observers only after actual execution acceptance; resume the same cutoff/controllers. Final cleanup must bypass60-second grace and abort an outstanding3600-second Wait with Rustack.Shutdown before provider destruction. Keep actual Native timeout/Stop/missing-function readiness separate from retained worker failures. Report unsupported workflow snapshots and later compiler/integration features truthfully. Ordinary Rust SDK+boto3 against the actual registered service remains a separate required acceptance gate; transport-only SDK or generic Hyper-body tests cannot close it.
+
+### M1 ordinary SDK acceptance against the real binary
+
+Add an explicitly selected `make test-stepfunctions-sdk` gate. It builds the host bootstrap and the stepfunctions-enabled Rustack binary, then runs separate ordinary Rust SDK and pinned boto3 suites against independently owned real server processes. Use aws-sdk-sfn1.123.0 (current Cargo registry and [official builder](https://docs.rs/aws-sdk-sfn/latest/aws_sdk_sfn/config/struct.Builder.html), checked2026-10-26) and existing aws-sdk-lambda. The new service requires the current shared SDK runtime; upgrade aws-config to1.13 to match aws-types1.7/current shared Smithy protocol rather than mixing its previous Smithy schema0.2 protocol type. Re-run existing SDK consumer compilation/workspace suites and dependency gates; retain the pinned boto3/botocore1.43.118 fixture requirements. Disable SDK retries and install bounded connection/operation timeouts, an independent120s exercise deadline, and page/token limits even for empty or repeated pages. Credentials/endpoint/region are explicit local values; never resolve host profiles or contact AWS.
+
+The server child receives a cleared environment, strict Step Functions/Lambda signature validation, only those two enabled services, explicit Native selection, and an owned temporary root (including TMPDIR for Lambda artifacts). Health must become ready before SDK calls, with bounded checks of early child exit. Deploy the actual executable bootstrap using ordinary Lambda CreateFunction ZIP APIs. Computation doubles21 to42; FunctionError, fail-once retry and consumed-event timeout fixtures execute actual processes. Host bootstrap evidence does not qualify Docker/managed-language images.
+
+A checked-in SDK case catalog carries independent literal expectations and official-source links. Both clients execute all catalog entries, including full data pipeline/original-input merge, paths/intrinsics, guarded Choice, successful Wait, explicit Fail, fatal runtime, exact data-limit matching, and transition/history-byte exhaustion under small validated quotas. Exercise all15 M1 APIs, raw-input RUNNING idempotency and mismatched/closed collisions, consumed-event-gated definition revision capture (never a short timing window), concrete original/update/captured revision IDs and advancement, direct/optimized Lambda envelopes, retry/Catch and distinct function/Task/execution deadlines. Validate numeric dates through each SDK's native timestamp type, exact ARN scope, raw input/output JSON strings, exact sequential predecessor IDs, preserved reverse/data-disabled pages, token replay/query binding and continuation after deletion. No fixture may calculate expected values with the evaluator under test.
+
+Provision the pinned Python environment as a dedicated build artifact before any server starts; uv run temporary environments are not persistent interpreter paths. Spawn the interpreter directly, with a cleared environment and32KiB stdout/stderr caps; a PID-barrier timeout regression must kill and reap that actual Python process. The harness retains server process, stop signal, temporary directory and one resumable root JoinHandle above test/SDK futures. On any exercise error, stop and join the server before reporting assertions. Dropping/expiring a cleanup observer signals the same root and retains its join. The root sends SIGTERM for the main coordinated shutdown; forced termination or uncertain marker/child retirement fails qualification and retains the private directory. The bootstrap writes per-PID ownership markers before taking events; after clean server exit, require every recorded PID to be absent. Never kill arbitrary marker PIDs or delete evidence after uncertain cleanup. Bound marker count, file bytes, health responses and child output. Missing bootstrap/uv/prerequisites fails the explicitly selected gate; ordinary offline workspace tests may mark these resource cases ignored, but the required gate executes both suites with no skipped cases.
+
+```text
+make → real Rustack executable + real host bootstrap
+           │ isolated strict-auth server root owns process/files/join
+           ▼
+   Rust SDK       boto3 (separate server)
+      └──── signed localhost HTTP ────┘
+                         ▼
+       gateway → actual API/registry/ASL → actual Lambda provider
+                         │                      ▼
+                 real bounded history      computed bootstrap/error/timeout
+                         │                      │ PID ownership markers
+                         └──── SIGTERM/join ────┘
+                        clean absence proof / retained failed evidence
+```
+
+A01–A13/I01 closure combines these ordinary SDK observations with the existing detailed unit/property/Native matrices; record the exact case mapping and limits, rather than claiming cloud differential parity or final workflow/image acceptance. Existing B06 security remediation remains required.
+
+#### Executed SDK evidence mapping
+
+The [17-case SDK catalog](../tests/workflows/sdk-cases.json) has explicit outcome/source validation and per-case document/local-policy provenance. Both clients execute it, then independently exercise control-plane behavior. Host Native acceptance is not AWS differential or image/platform qualification.
+
+| Acceptance | Ordinary SDK observation | Complementary detailed evidence |
+|---|---|---|
+| A01 | All15 supported actions; native date types, scoped ARNs, tags, validation and explicit unsupported action | Typed model/HTTP framing and API error matrices |
+| A02 | Concurrent equal raw-input RUNNING start, mismatched/malformed input rejection, closed-name collision | Registry name/retention/property cases |
+| A03 | Actual consumed-event gate holds the old execution through update/new execution; original/update/captured UUIDs and dates checked | Immutable revision/admission/TTL cases |
+| A04–A05 | All six instruction forms and full Task data pipeline with original-input merge | Driver/evaluator phase and missing/null matrices |
+| A06 | Quoted/index/wildcard/slice selections; invalid grammar and duplicate .$ output produce validation failure | Parser/compiler bounded malformed-input properties |
+| A07 | All12 intrinsics, including valid v4 UUID; literal expected values are independent | Intrinsic nesting/work/rounding/output-boundary matrices |
+| A08 | Guarded missing/null/string glob/timestamp Choice and Wait/Succeed path | Short-circuit/type/numeric/clock boundary matrices |
+| A09 | Actual fail-once Lambda retries exactly twice; FunctionError/Catch preserves parsed cause | Matcher/backoff/jitter/count/race matrices and alias re-resolution Native cases |
+| A10 | Distinct function-owned Sandbox.Timedout, Task States.Timeout and uncatchable execution TIMED_OUT | Consumed-event Native PID cancellation/timeout cases |
+| A11 | Fatal runtime bypasses ALL; data limit excludes ALL and is caught explicitly | Parameters/result/selector/failure-domain boundaries |
+| A12 | Native SDK paginators, exact sequential causality, reverse/data omission, replay/forgery/query-binding and deletion continuation | Page-store24h expiry/collision/capacity and scope tests |
+| A13 | Local80-transition and1MiB history-byte failures retain final ExecutionFailed events | Reserved terminal event/count/global-byte/admission tests |
+| I01 | Direct/optimized actual Lambda results, correct FunctionError handling and actual invocation-ID envelope | Envelope/quota/invalid-JSON/error-type mapping matrices |
+
+The required SDK target also observes a directly owned Python PID, forces a timeout and proves reap/absence, including a malformed-PID-barrier path that still joins cleanup. It explicitly runs three resource cases with no skipped resource case. The separate catalog-shape test runs in ordinary workspace tests. Current source/dependency verification results and review resolutions are recorded in the implementation ledger and review.
+
+### Nested ASL Task binding qualification
+
+Cover all three exact child resources and disabled/unregistered admission; pure nested execution without Lambda; dynamic validation; string/JSON result envelopes; fast child termination; actual Submitted identity/causality and data omission; fixed-name replay/collision; open/depth exhaustion; detached survival after parent Stop; owned Stop/Task timeout retirement. A parent waiting for a child must permit a real child Lambda to run with global dispatch capacity one. Retain delayed acceptance, CPU jobs and actual cleanup across cancellation and actor/worker failure. Actual Native ASL and ordinary Rust SDK/boto3 nested acceptance are required before nestedSync capability is true.
+
+Implemented evidence: `make test-stepfunctions-core` runs600 units/245 doctests plus preserve_order91 compiler/35 frame-effect/22 scheduler/10 async/17 nested/19 atomic-child/2 controlled cases. The17 nested cases cover actual registry ASL execution, exact Submitted predecessor/data projection, pure child execution, single-dispatch child Lambda admission, detached/owned Stop, parent Task timeout, recursive depth, capacity rejection and fatal child CPU panic with retained typed source/no Retry. A held child cleanup regression retains the observed successful business result beyond the parent's Task deadline. `make test-stepfunctions-sdk` runs both signed ordinary clients' six-case nested catalog and two consumed Native child lifecycle scenarios each, plus an actual single-dispatch server and owned runner-reap regression (four required tests; none ignored). Both full/minimal main suites execute a pure nested ASL definition without a Lambda adapter. No live cloud differential or Docker qualification is claimed.
+
+### Callback registry foundation qualification
+
+Integrations§5.1/D62 require controlled-clock state matrices for provisional callbacks and invocation success/failure; early heartbeat suppression; post-return heartbeat resets and absolute deadline boundaries; duplicate, forged, foreign, revoked and old-attempt tokens; parent termination and execution-retention classification; live/reserved-tombstone/command saturation; one timer per token under repeated heartbeat; independent revoke under saturation; retained entropy and canceled/expired observers; and resumed close/runtime-loss handling. Verify Debug and table indexes never retain plaintext token material. Re-run dependency audit/deny for secrecy and reused subtle/hex additions; preserve known B06 failures explicitly. No ASL/public API/handler callback acceptance is inferred from this foundation.
+
+Implemented foundation evidence: thirty callback cases exercise the real retained registry actor against actual captured parent executions and opaque frame-generation identities. Controlled-clock cases pin pre-/post-invocation heartbeats, two hundred distinct reset deadlines with one timer, absolute/provisional timeout priority, retained closed-token classification until parent-relative TTL, and real replacement admission after expiry. Late-ready mint/API/Task observers preserve success/errors and unknown owner loss after an expired observer. Blocked/panicking entropy, root panic, controller Drop and actual Tokio runtime loss preserve truthful unavailable/typed failure states; shutdown observation resumes the same retained join. A weak-Arc result test proves closed records release payload ownership while preserving TaskTimedOut. Both ordinary SDK/main regressions remain required for the existing M1/M2 profile; none is labeled callback acceptance.
+
+Foundation gates pass630 core units/267 doctests and all preserve_order/strict cases; final workspace build/test/Clippy/rustdoc/nightly formatting pass3,194 tests with431 separately gated. Existing full/minimal main77/57 and both SDK/single-dispatch Native/runner4 regressions pass. Security gates retain the explicit existing B06 failures; the new secrecy package introduces no new advisory/license/bans/source failure.
+
+### Callback parameter provenance qualification
+
+Integrations§5.2/D63 require exact structural token/ancestor/wildcard/bracket path coverage, conservative intrinsic dependencies, sensitive InputPath propagation to data paths, literal/business data preservation without string scanning, one UUID/source evaluation, original/context immutability, rejection of stale reserved Task context, zeroizing sensitive storage and explicit context/output budgets. Test both actual outbound JSON and null-redacted typed history, including generated TaskScheduled DTO round trips without invented truncated fields. Pure preparation evidence does not establish callback service or persistent history acceptance.
+
+Implemented boundary evidence:56 callback preparation cases include two512-case properties; four context storage/headroom/member cases; and one actual registered-token case that preserves Invoking until explicit revoke. Verify generated TaskScheduled JSON has only the official fields, no plaintext from injected token paths, and no invented truncated member. A compile-fail doctest prevents implicit serialization of the combined outbound/history object. The bracket [*] profile is unchanged. Actual ASL callback/Lambda/history persistence/API acceptance remains separately required.
+
+Qualified gates: core691 units/273 doctests, explicit preserve_order56 preparation/10 payload cases and all existing strict gates; workspace build/test/Clippy/rustdoc/nightly formatting3,255 passing cases with431 separately gated; full/minimal main77/57 and the existing actual SDK/single-dispatch Native/runner4 regression cases. No actual callback service acceptance is inferred. Existing B06 audit/deny advisory failures remain explicit, with no new dependency or ignore.
+
+### Observed Lambda callback invocation qualification
+
+Integrations§5.3/D64 require scoped exact-call one-shot reporter transfer, timestamp/closed/deadline fences, immutable response metadata and independent callback/report/cleanup observers. Test invocation reports before held cleanup and heartbeats using captured return time before delayed mapping. Actual Native bridge cases must prove early/late callback gating, invocation failure after early success, PID retirement on stop, ignored sync body and actual provider metadata. No ASL/public callback or image qualification is inferred from these internal port tests.
+
+Provider-return timing is measured when InvocationHandle yields InvokeResponse, which the current provider publishes after backend cleanup. Independent report/settlement receipt tests must not be described as proof of an earlier handler Runtime API return or independently held successful Native backend cleanup. Delayed-report tests retain provisional callback receipt time and enforce the captured heartbeat boundary; preactivation heartbeat remains an accepted no-op.
+
+Deferred callback effect acceptance (integrations§5.4/D65): explicit compiler capability/resource/heartbeat diagnostics, original-input dynamic interval resolution and strict heartbeat<Task timeout, no UUID/template evaluation before registration, captured retry context and single-evaluation outbound/history, stale/late/duplicate completion, branch frame identity/cancellation/retirement, and actual generated callback Scheduled/Submitted metadata. All sequential/runtime/Registry/API paths stay gated until the async consumer is installed; tests must prove rejection without token mint or invocation.
+
+Registered callback owner acceptance (integrations§5.5/D66): exact parent publication gate, retained mint/CPU joins and causal pre-issuance history acknowledgment; real callback-driven ASL result/retry/timeout/heartbeat/Stop behavior; global/local data admission and release; single-dispatch unrelated work progressing during external wait; held physical cleanup and unknown-worker ownership; actual Native consumption and full token exposure scans. Public SendTask/SDK/main activation remains separately required.
+
+Registered-owner evidence:24 runtime cases, two queued-result lease barriers and four actual Native registered-ASL scenarios now qualify§5.5. The Native gate executes14 cases with none ignored. Unknown token-root cleanup cannot retain an independently proved physical dispatch slot; separate token capacity rejects with Rustack.CallbackLimitExceeded while an existing waiter remains valid. Reporter loss is fatal rather than Catch/Retry business input. Public SDK SendTask and main-service activation remain pending.
+
+Public callback adapter acceptance follows [API§1.4](./rustack-workflows-10-api-design.md#14-registry-bound-public-callback-adapter): actual registered ASL through HTTP for all three commands, no heartbeat history events, provisional invocation priority, token generation/closed/foreign/error classification, zero-byte success body with normal headers, retained caller-independent mutation, typed deadlines and shutdown. Unbound API/main remains rejecting until its own composition is installed.
+
+Public-adapter evidence:31 cases qualify API§1.4 through actual registered ASL, including explicit same-scope epoch and foreign-scope rejection, heartbeat with unchanged history, actual HTTP throttling with retained acknowledgment permits and later live-token completion, metadata lane independence, dropped/late-ready observers, and pre-submission deadline rejection. Six owned-token cases verify storage transfer, redacted Debug and malformed credential rejection. Exact content-length0 callback success wire behavior is pinned in the18-action transport table. Main-service activation/handler-originated SDK callback acceptance remain required.
+
+### Real handler SDK callback acceptance and Native evidence boundary
+
+Operations§1.7/D68 activate the actual binary only with a selected real Lambda port. Add a source-linked callback case catalog consumed through both actual handler SDKs: early success, gated late success, external failure, invocation failure after provisional success, Retry with first failure/fresh attempt and old-token rejection, continuing heartbeats beyond one interval, absolute timeout despite heartbeats, heartbeat expiry, and Stop during a consumed handler. Match execution status/error/output to catalog expectations, actual request/version/Submitted metadata, exact causal history and token-safe projections. Both SDKs use normal credentials, region, explicit loopback gateway endpoint, disabled automatic retries and bounded connect/read/operation timeouts; the server keeps strict signature validation enabled.
+
+Use a separately named Rust custom-runtime fixture binary with ordinary aws-sdk-sfn and the existing ureq Runtime API client, and a provided-runtime Python bootstrap using the pinned real boto3 interpreter. Native deliberately accepts only host ELF/Mach-O executables, so the Python artifact bundles the same native launcher plus callback.py; an explicit fixture-only interpreter setting makes that launcher exec the configured interpreter in the same PID. Keep Native format checks unchanged and do not introduce an untracked child process or shell. These are actual Lambda code artifacts deployed through the real Lambda SDK. Make builds the Rust fixture explicitly and passes both host artifact/interpreter paths; no test-only handler substitutes for the production API/bridge. Reuse current workspace SDK versions (verified aws-sdk-sfn1.123.0 against [upstream docs](https://docs.rs/aws-sdk-sfn/1.123.0/aws_sdk_sfn/)); boto3 remains the existing pinned requirements cohort. Test fixture dependency edges add no package/version. Rust uses checked/fallible parsing, safe structured errors and joined IO; do not add production unwraps or relax boundary Clippy.
+
+Per-request atomic evidence files contain only validated request ID, PID, case/stage/count and boolean history/token classification results. Never persist plaintext injected tokens, callback output bodies or credentials. The handler itself requests execution history through its ordinary SDK and checks that the exact in-memory token is absent, returning only the boolean evidence. Handler SDK results check empty successful DTO parsing and expected modeled TaskTimedOut on duplicate/closed tokens. Preserve token confidentiality in infrastructure logs/Debug through the existing typed boundaries; persistent history qualification still belongs to P5.
+
+For late callbacks, the Native warm handler first posts its real Runtime API success, records a post-response stage and waits for an explicitly released gate before its SDK completion. The driver must independently observe TaskSubmitted and RUNNING before release. A single-dispatch server must execute another real Lambda while that external callback waits. This is evidence for the measured Native warm lifecycle only, not AWS background-execution/freeze guarantees or Docker networking. Heartbeat tests wait beyond an original interval with multiple observed successful SDK heartbeats. Timeout/Stop tests verify the actual selected error, closed-token response when the warm handler resumes, and consumed busy PID absence before server/global cleanup where cancellation owns that process.
+
+The retained Server owner already joins the actual server and verifies all recorded process PIDs disappear on shutdown. Extend its explicit cleanup/evidence ownership to both callback artifacts and bounded per-request marker/gate directories; errors/observer timeouts release known fixture gates before cleanup, preserve evidence if shutdown cannot be proved and never replace the owned server after observation timeout. Run callbacks as an additional required ordinary SDK gate, with no ignored case inside that explicit make target. Image C01–C03, Docker gateway reachability, all platform lanes, persistent token/history scans and M4 remain separate pending gates.
+
+Implemented/reviewed Native service evidence: both actual handler SDKs pass all nine catalog cases against strict authentication and one workflow dispatch slot, with20 consumed request identities. Early callbacks remain RUNNING until the held real Lambda return; late callbacks wait for actual TaskSubmitted and permit another real workflow Lambda; retry checks distinct in-memory tokens and old-token TaskTimedOut after the next attempt starts. Handler history checks, real request/version/omission metadata, heartbeat renewal/absolute expiry and pre-global-cleanup consumed PID absence pass. The SDK make gate executes6 required cases with none ignored, including forced gate-write failure after an actual Native compute: saved fixture error still permits coordinated server/child join, cached failure and retained evidence. Delete that fault evidence only after independent PID absence checks. This closes the Native consuming-service dependency, leaving image/platform/persistence and B06 explicitly open.
+
+Compression security acceptance follows [operations§4.1](./rustack-workflows-60-operations-design.md#41-patched-compression-cohort-before-workflow-persistence): verify exact overlay provenance and the current single patched zstd graph; read an original0.13.3-generated snapshot envelope, reject corrupt/truncated frames, prove abandoned encoder/decoder context isolation and execute upstream synthetic loader decompression/size/magic/overflow cases. Fresh audit/deny require zero vulnerable/unsound compression findings and no new ignores. Preserve all real Native/SDK regression gates; this evidence does not qualify a VM or Docker platform.
+
+B06 closure evidence: the provenance/cohort target remains enforcing under PYTHONOPTIMIZE=1; both corrupted-source and vulnerable-cohort negative inputs reject. The checked-in old frame retains its original codec cohort/fingerprint metadata. Fifteen upstream synthetic loader and29 snapshot cases pass; isolated original-codec context reuse fails both negative controls while patched reuse cases pass. Fresh root audit is clean across482 dependencies/1,378 advisories and all deny checks pass. No first-party unsafe/lint exceptions or advisory ignores are added. Workflow archive/VM/Docker/platform acceptance remains separate.
+
+### P5 bounded CBOR prerequisite acceptance
+
+Operations§4.2/D70 require the installed generic helpers to reject malformed/oversized/ambiguous CBOR before a typed visitor runs, preserve existing service/manifest/data-directory and legacy-frame round trips, stop oversized serialization, and pass boundary/property/standard/minimal-feature qualification without Docker or dependency changes. This is not evidence that workflow state is persisted.
+
+Current evidence: make test-workflows-archive passes111 full-feature and110 minimal-feature snapshot cases, including82 new tests (two512-case properties). The suite exercises original-writer byte equality, derived enum headroom, before-visitor rejection, stopped serialization, actual long-name DynamoDB restore and prior-generation reload after encoder rejection. Both strict production binary checks pass. Plain/feature workspace3,410/3,495 tests, build/Clippy/denied-warning rustdoc and nightly formatting pass; separately gated415/435 cases are not counted as platform acceptance. Fresh audit482 dependencies/1,378 advisories is clean and every deny check passes. No new package/version or ignore; the CLI only reuses the existing proptest dev-dependency. Workflow state persistence and final Docker/platform acceptance remain required.
+
+### P5 sealed registry export acceptance
+
+Operations§3.1/D71 require one post-cleanup immutable cut, no capture from a live/closing/failed/quarantined owner, original ownership retained across dropped/expired shutdown observers, deterministic versioned data-only export, exact identity/revision/raw input/full causal history, separate record/name expiry and conservative copy-budget admission. Qualify actual Native output/history after cleanup. Restore and CLI persistence remain required consuming work.
+
+Current export evidence:27 snapshot cases (24 additions) pass with and without preserve_order; core826 units/305docs, existing strict/preserve gates and full/minimal runtime171/148 pass. Actual Native14 and ordinary SDK6/cleanup cases pass with none ignored in their selected gates. The Native retained-revision test verifies data-only export after joined cleanup with computed42/44 results and exact history rows. Nano CBOR negative/positive controls, a controlled delayed cut, post-drain destructor-panic permit retention, independent TTLs, budget retries and full traversal beyond1,000 events close W192–W194. Plain/feature workspace3,434/3,519 cases, build/Clippy/rustdoc/fmt and fresh audit/deny/provenance pass without new packages/versions or ignores. These are export/ownership proofs; no workflow import, CLI persistence or Docker/platform acceptance is claimed.
+
+### P5 atomic library restore acceptance
+
+Operations§3.2/D72 require a complete CBOR/export/prepare/commit/read round trip under original allocation/history quotas; startup/exact-instance leases and rollback/drop/observer ownership; strict schema/hash/reference/profile/history/expiry rejection; independent retention across configuration changes; zero-dispatch conversion of unexpected RUNNING records; no callback/child capability from restored terminal records; and actual Native historical/no-replay/new-computation evidence. Main archives and process restart remain a separate required consuming gate.
+
+Current D72 qualification passes80 new restore cases in both normal/preserve_order configurations, full core906 units/309docs, actual Native15 and required SDK/cleanup6. Full/minimal runtime171/148 and plain/feature workspace3,514/3,599 pass with standard/strict/rustdoc/fmt/security gates. Source-profile history/IR checks, canonical bounded dates, typed history allowlists, partial quota rollback and real Native no-replay/new request evidence close W195–W202. This is a library restore boundary; main archive/restart and final image/platform requirements remain open.
+
+### P5 main archive and process restart acceptance
+
+Operations§3.3/D73 require actual registered v2 stepfunctions meta/data payloads, strict bounded/cross-part rejection, original quotas and retained CPU/commit ownership, global cut before save and old-generation preservation on failure. Execute real named-snapshot strict-auth binary restart with pure and Native Lambda results/history/revisions/tags/names, fresh page/callback epochs, new computation with no replay, terminal shutdown cancellation, SIGKILL loss of unsaved work and corrupt-startup refusal before listening. Repeat full/minimal runtime, all existing SDK/Native, workspace/strict/security/document checks and independent review. These persistence proofs do not replace final image/platform/performance/IaC release acceptance.
+
+D73 qualification: `make test-workflows-persistence` passes7 actual split/join cases,143 full/142 minimal snapshot cases, the collector error/cleanup regression and actual named Native binary restart. The process fixture preserves computed42/full history/captured revisions/tags/names, rejects stale callback/page handles, proves no replay before new44, archives live Wait/callback work as ABORTED, loses only unsaved work after SIGKILL and refuses corrupt startup before listening. Profile/hash/scope errors retain current/previous bytes and publish no partial workflow state; a new valid startup retires the backup. W203–W210 are fixed/rechecked. Core913 units/313docs, full/minimal main204/181, Native15 and required SDK7 pass; plain/feature workspace3,535/3,640 and final standard/strict/security/document evidence are recorded in review93. These are local Native workflow persistence proofs; the remaining performance, IaC and image/platform rows still gate release.
+
+D74 current-host qualification: `make test-workflows-performance` passes6 normal controls and both actual workloads. The final standalone macOS/aarch64 debug capture records50-state p95=10508µs over100 sequential executions,100 successful one-slot Stop cycles, readiness maximum283µs, Stop→ABORTED maximum1102µs and137/137 live exhaustion probes (maximum348µs). The reserved failure event is ID7560 within the25000-event ceiling; the configured history byte budget can bind before that event ceiling. Full source/binary fingerprints and all raw samples are retained in the [measurement review](../docs/research/workflows-native-performance-review.md). W211–W213 are fixed/rechecked. Full SDK gate now explicitly executes9 cases, including both new workloads; broad standard/strict/security evidence is in review93. Required native Linux reference, image load/log-flood, warm/cold image, IaC and platform/release gates remain open.
+
+D75 qualification: parser6 normal controls and actual CLI exact26-case/renamed-case controls pass; explicit -I -B leaves no bytecode. smoke-workflows owns a strict-auth pure service, consumes the exact documented YAML/ASL, validates/creates/reads back original definition bytes and checks both complete branch histories with zero Native processes. verify-workflows-native completes its serial model/HTTP/core/runtime, Native15, SDK10, HTTP SDK1, snapshot and performance targets with no resource cases ignored in their explicit runs. Full/minimal main204/181 and plain/feature workspace3,535/3,646 pass with standard/strict/rustdoc/fmt/audit/deny/provenance gates. The [English operator guide](../docs/workflows-guide.md) and source-controlled example describe actual capabilities and pending release scope. W214–W215 are fixed/rechecked. This native-only inventory is a dependency of the final image/platform/reference/IaC release manifest, not a substitute for it.
+
+## 7. Controlled image-pull preparation qualification
+
+Runtime§2.14/D78 requires `make test-lambda-pull` to qualify exact host/case/port/default-Hub matching and reserved aliases; credential/header/aggregate byte limits, padding and redacted Debug/TRACE; explicit tag/digest/platform/auth transport; incremental JSON/line/record/total limits and in-band errors; separate four-running/eight-queued admission with independent cleanup; cancellation, timeout, abandoned waiters and wire-root failure with actual driver settlement. An interrupted shutdown observer must preserve primary Worker failure through fallback cleanup. Present local images and metadata-only404 must never pull; denied/nonmissing errors fail without pin publication; preparation timeout retains cleanup and post-pull invalid metadata never becomes live.
+
+Run `make test-lambda-pull-docker WORKFLOWS_DOCKER_SOCKET=<explicit-socket> WORKFLOWS_ARCH=<arm64|amd64>` on each retained daemon. The Makefile default is the immutable public Node.js24 manifest recorded in the [transport study](../docs/research/study-bollard-docker-transport-boundaries.md#controlled-pull-transport-preflight); explicit overrides must remain immutable public.ecr.aws references. The fixture logs whether its initial lookup missed, consumes the configured policy through the actual ImageLeaseManager, requires exactly one committed live pin, exercises the real pull endpoint again and checks source identity. It joins image cleanup before reacquisition/namespace audit and always attempts wire shutdown; failure retains the evidence directory. Never delete a preexisting operator source to manufacture a cold-cache result. CacheMiss=true establishes missing requested-reference preparation, not proof that every layer was absent. Repeated warm endpoint runs must be described as warm. Retain source cache by design.
+
+Requalify existing namespace3, image recovery2, executor/provider1, environment/pool7, wire2 and container recovery1 real cases per daemon after the wire change. Run strict Lambda production boundaries, ordinary/feature workspace gates and the full native-workflow-only verifier. Final independent all-state container and full image-prefix inventories must show zero runtime containers/private aliases. Capture exact argv/status/raw output hashes and the client prefix predicate; Docker reference globs are insufficient. Native arm64 VZ and emulated amd64/QEMU evidence remains functional scope, not Linux-reference/native-x86 performance. YAML auth-file permissions/loading, runtime startup/configuration, Docker ZIP/handler SDK networking/IaC and complete platform/release gates remain open.
+
+Executed D78 evidence:55 ordinary pull cases/1 real gated plus the retained-primary regression; Lambda core833 ordinary/8 gated and165 doctests; strict boundary1,377 passes/25 gated. Ordinary/feature workspace tests3,674/3,785 with420/445 gated and standard/strict Rust gates pass. Initial real pulls report cacheMiss=true on both retained daemons; final17-case consumer lanes pass warm, followed by zero complete observed containers/private aliases. The complete native-workflow-only verifier, fresh audit/deny and local text checks pass. See the [controlled pull review](./rustack-workflows-93-review.md#p1-controlled-image-pull-preparation-independent-review) for exact evidence and qualifications.
+
+
+## 8. Docker operator settings and private registry YAML qualification
+
+Operations§1.8/D79 requires `make test-lambda-docker-settings`: the existing shared YAML/environment loader accepts all documented Docker keys, preserves process precedence/boolean normalization, validates default300s pull and every Docker budget boundary/relationship, and supports the full32×253byte registry CSV. Pure domain settings enforce exact decimal CPU, literal root endpoint/authority, explicit sources/network, path/source limits, never/ifMissing consistency and canonical registries. A compile-fail doc proves callers cannot bypass validation through the generated private builder.
+
+Exercise the fixed shallow credential schema with quoted basic/token values, empty map, flow/block/escape forms and controls at every field/file/decoded aggregate bound; reject unknown/duplicate/typed/mixed/alias/tag/merge/deep/multiple/trailing data and hostile property inputs. Real descriptor tests cover private mode/link/kind/ancestor/symlink/FIFO/size/UTF-8 and observed-change rejection, without claiming extended-ACL evaluation. Retained worker tests causally hold all four permits after observer abandonment, reject another admission on its queue deadline, keep completed results charged until consumed, preserve a timed-out read until its physical worker exits and classify worker failure. Oversized approved input must fail before allocating its second collection or entering a blocked worker pool. No lint waiver is required for descriptor IO; nix safe OwnedFd operations run in the blocking owner.
+
+The file-loaded nonempty-auth integration must consume DockerRuntimeSettings→explicit private YAML→ImagePullPolicy→bound ImageLeaseManager: initial404, selected authenticated POST, complete progress, failed post-pull validation and zero published pins/records. It establishes header/policy composition, not remote private-registry acceptance. Reuse `make test-lambda-pull-docker` on both explicit retained daemon sockets after enhancing its fixture to create only its own0600 empty YAML and pass through shared settings/typed settings/the real loader. This actual public-source run proves anonymous file-loaded preparation/pull/pin cleanup and source preservation; report cacheMiss=false honestly for retained warm sources. Do not relabel D78's historical initial cache-miss evidence as a new cold pull.
+
+Run ordinary/feature workspace build/all-target tests/Clippy/denied-warning rustdoc, nightly fmt, strict six-library Lambda boundaries, the complete Native verifier and fresh audit/deny. Only existing yaml-rust2/url/proptest dependency edges are added; no resolved version or policy/advisory exception changes. Independent final full all-state container and all-image-prefix snapshots must show zero owned remnants and retain exact argv/status/hash/predicate provenance. Production startup still must compose directory provenance/reconciliation, live pinned relay, network/resource/endpoint receipts, provider/shutdown ownership and capability publication before ordinary Docker selection can succeed. Docker ZIP/handler SDK networking/IaC/native-reference/platform/full M0–M4 release remain open.
+
+
+Executed D79 evidence:84 focused settings/file regressions pass. Lambda core915 ordinary/8 gated and178 doctests; strict boundaries1,474 passes/25 gated. Final ordinary/feature workspace tests3,758/3,869 with420/445 gated and all standard/strict Rust checks pass. Both retained actual daemons consume the file-loaded anonymous policy successfully against warm source cache, followed by zero containers/private aliases in complete observed inventories. The complete serial Native verifier and fresh audit/deny pass. See the [D79 review](./rustack-workflows-93-review.md#p1-docker-settings-and-private-yaml-credential-review) for exact scope, ACL preconditions and evidence provenance.
+
+
+## Container-origin gateway endpoint proof qualification (D80)
+
+Run `make test-lambda-endpoints` for shared endpoint/identity/schema bounds, one owned HTTP(S) request, runtime diagnostics filtering, exact core receipt ownership and real gateway socket behavior. Cover literal authority/path normalization, canonical nonnil UUIDs, duplicate/unknown/version fields, expected identity absent from outbound bytes, independently wrong instance, no redirect/retry, headers/body/encoding/trailer/EOF limits, deadline and abandoned IO. Ephemeral TLS fixtures must prove valid trusted name, wrong name, untrusted CA and stalled handshake with an explicit AWS-LC provider; private roots are a unit-test seam only. Owned entropy tests retain both physical worker and unobserved-ready-result slots. Gateway tests cover disabled404, identity preserved across workers/clones, draining/saturated/health-only access, HEAD framing and method405, including the no-Lambda build.
+
+Run `make test-lambda-endpoints-docker WORKFLOWS_DOCKER_SOCKET=<explicit-socket> WORKFLOWS_ARCH=<arm64|amd64> WORKFLOWS_NETWORK=<owned-bridge> WORKFLOWS_GATEWAY_HOST=<function-visible-host>` on each retained daemon. This builds the actual pinned runtime and executes four independent scenarios: matching gateway identity, wrong expected instance, unavailable listener and abandoned caller after a consumed outbound request. Each first consumes actual kernel/resource evidence, then requires physical environment retirement, zero allocated capacity and preserved operator source image identity. Failures retain evidence. The peer is a bounded controlled gateway-protocol server; separate socket tests exercise the actual GatewayService route. Do not call this ordinary Docker main-service acceptance.
+
+After the shared runtime/probe change, requalify existing resource probes2, pull1, namespace3, image recovery2, executor1, environment pool7, wire2 and container recovery1 per daemon, in addition to the new endpoint4:23 actual cases per architecture. Pull reruns use warm retained cache and file-loaded anonymous policy. Provision only exact fixture-owned bridges, capture their full IDs/owner labels, join all runtime/peer owners, inspect empty attachments and remove only those captured IDs. Fresh complete all-state container and full image-prefix snapshots must show zero runtime containers/private aliases; retain exact argv, statuses, raw-output hashes and predicates. Never prune or remove operator source images.
+
+Run full ordinary/feature workspace build/all-target tests/Clippy/denied-warning rustdoc, nightly fmt, strict six-library boundaries, the complete Native verifier and fresh audit/deny. D80 shares the existing stable rustls/WebPKI cohorts, updates tokio-rustls0.26.5→0.26.6 and adds dev-only rcgen0.14.10 with ephemeral keys; record the actual locked dependency audit without waivers. arm64 VZ is actual native functional evidence; amd64/QEMU is emulated functional evidence. Production startup receipt consumption, image ZIP, ordinary handler SDK networking, IaC, native Linux/x86 reference, final platform and complete M0–M4 release remain required.
+
+
+Executed D80 evidence: the76-case endpoint target (55 new ordinary cases plus21 existing probes),2 no-Lambda route cases and strict1,540/29 gated pass. Ordinary/feature workspace tests pass3,813/3,924 (424/449 gated); complete Native verifier passes2,979 aggregate/19 gated. Both retained daemons pass23 actual cases each, followed by four final reviewed endpoint cases each. Owned bridges are removed after full-ID/label/empty-attachment verification, and fresh complete inventories show zero containers/private aliases while preserving source cache. All standard/strict/security/text gates and independent review pass; see the [D80 review](./rustack-workflows-93-review.md#p1-container-origin-endpoint-proof-review) for exact scope and evidence provenance. Production Docker activation and final image/platform release remain open.
+
+
+## Production Docker image startup qualification (D81)
+
+Runtime§4.12 and operations§1.10 consume the preceding component proofs in the ordinary executable. Run `make test-lambda-startup` for startupSeconds validation, pure Docker configuration, no-replay lifecycle, captured/pending worker ownership, provenance/downgrade refusal, blocked physical acquisition, sticky-fault cleanup progression, platform preallocation and actual diagnostic actor cancellation/join. Shared ownership tests require failed unobserved blocking results to retain their physical/result permits. A synthetic private receipt is used only in unit lifecycle tests; no actual binary fixture injects readiness.
+
+Run `make test-lambda-startup-docker` with an explicit socket, architecture, fixture bridge, function-visible host and image-builder path on each retained daemon. The dedicated `WORKFLOWS_DOCKER_TARGET_DIR` isolates the executable from other workspace feature builds, and each fixture freezes its own private executable copy before launch. The six actual cases are disconnected, connected, missing relay, legacy provenance, wrong endpoint and metadata-only Image archive rejection. Negative cases require their specific startup stage; a nonignored control rejects an earlier resource failure, unrelated daemon404 and relay500. Require daemon binding to preexist the post-exit audit for every nonlegacy profile. Wrong endpoint must fail in endpoint qualification, and missing relay must fail in selected-relay preparation with404; a generic nonzero exit is insufficient.
+
+Positive cases use the actual diagnostic-only same listener, production runtime owner, strict authentication and ordinary signed Rust SDK/boto3. Check computed42/7, warm counter1/2, effective UID/request identity, published version and alias, normal FunctionError with healthy backend, selected daemon platform, ZIP rejection before extraction, wrong architecture Failed, missing-RIC bootstrap timeout independent of the total startup deadline, and optimized ASL Lambda Task output42. The disconnected process restarts after joined SIGTERM, preserving the namespace owner and changing the gateway instance. Connected capability proves gateway reachability from the pinned trusted probe; it does not close the separate handler-origin S3/DDB/callback image gate.
+
+The archive case creates/publishes an actual Image function, saves through ordinary shutdown, retains a valid previous generation, then restarts. Reject Image metadata before domain import/backup retirement; raw fingerprints of both generations must remain unchanged. ZIP/configured ZIP source rejection is explicit. Never reacquire a source tag as a substitute for a saved immutable image lease.
+
+Every actual fixture joins/reaps its exact child, reacquires the same directory, verifies the captured daemon binding, reconciles zero recorded resources and preserves operator source images. On failure retain evidence; a forced kill is a failed graceful-cleanup assertion. Requalify endpoint4, resource2, warm file-loaded pull1, namespace3, pin recovery2, executor1, environment pool7, wire2 and container recovery1: together with ordinary startup6,29 actual cases per daemon. A registry/Docker500 is a failed observation, never evidence of a successful pull; retain the failed run and require a successful complete rerun.
+
+Run ordinary/feature workspace build/all-target tests/Clippy/denied-warning rustdoc, nightly fmt, strict library and full/minimal main boundary checks, the complete Native verifier, actual-fixture pedantic Clippy, and fresh audit/deny. Existing nix0.31.3 gains descriptor-directory enumeration and test process/signal features; the app test gains the already locked SHA2 edge. No resolved package/version, new advisory ignore or lint waiver is required. Source and evidence receive independent review.
+
+After all actual owners settle, verify each captured bridge's full ID/name/owner label and empty attachments before removing only that bridge ID. Preserve exact argv/status/raw hashes; independently inspect complete all-state containers and full image lists with explicit private-repository prefix predicates. Keep source images/cache. arm64 VZ is native functional evidence; amd64/QEMU is emulated functional evidence, without native-x86 or Linux-reference performance claims.
+
+This opens qualified ordinary Docker Image execution only. Full custom-RIC/L01–L09, immutable Image archive lease restore, Docker ZIP, handler SDK networking/callback images, IaC, native reference/Linux arm64/final platform and complete M0–M4 release remain required. See the [startup review](./rustack-workflows-93-review.md#p1-production-docker-startup-review) for executed evidence and corrected failed observations.
+
+
+Executed D81 evidence: startup68 focused cases, strict boundaries1,581/29 gated, ordinary/feature workspace3,845/3,957 with424/455 gated, Native2,981/19 gated and all standard/strict/security/text checks pass. Each retained daemon passes29 actual cases on final source. Exact owned bridges are removed after verified empty attachments; complete final inventories show zero containers/private aliases while preserving source cache. W235–W244 are fixed/rechecked. See the [startup review](./rustack-workflows-93-review.md#p1-production-docker-startup-review) for the rejected shared-binary race/intermediate Docker500 observations, complete provenance and functional/platform scope. Full M0–M4 acceptance remains open.
+
+
+## Custom Rust RIC and immutable image revision qualification (D82)
+
+Consume ordinary production startup directly for the still-required L02–L04, plus real L06 rejection controls. Add an independent Rust custom RIC fixture executable in the existing bootstrap package, without new dependency versions. Build it for the selected Linux architecture and package it over the already pinned provided.al2023 base. Two explicit immutable fixture sources differ by image environment revision A/B; preserve both sources. Its entrypoint is the custom Rust binary, its inherited CMD is a visible literal argument and its inherited WORKDIR is /var/task. Provide a second binary path and existing /tmp workdir for override cases. Neither the executor nor fixture evaluates argv through a shell.
+
+The RIC uses only the injected loopback Runtime API, validates bounded operator inputs, bounds event/response/argv data, and implements actual GET /next plus POST /response and /error. Compute input+7 with checked arithmetic, maintain a process-local counter, report actual argv/cwd, captured image marker, request ID/qualifier and whether a literal shell-like argument caused a filesystem side effect. Caller-controlled modes are a closed fixture vocabulary: compute, FunctionError, forged response probes, barrier-forge and bounded delay. A forged canonical request ID, invalid request ID and previous request completion must receive rejection before the valid current completion; report independently observed HTTP statuses. To prove active cross-invocation isolation, use a bounded two-stage host collector on an explicit bridge: both distinct function lanes report consumed active request IDs and block until both arrive; each receives the other active ID, tests rejection, then reports checked statuses to a second barrier. Release valid completions only after both checked reports arrive. Deadlines, duplicate/unknown/oversized input and observer failure abort/wake both barriers. Join collector server/connection threads before its Python process completes; sleep/future overlap or IDs learned only after response are insufficient evidence. Collector host/socket/token are explicit fixture-only function environment, not inherited credentials or a product endpoint. A function error remains a normal HTTP200 FunctionError and subsequent compute stays usable. This is a trusted test fixture, not a general-purpose runtime catalog or a new supported user API.
+
+Use strict signed Rust SDK for the initial custom-RIC compute, then ordinary boto3 for the consuming matrix. Cases require (1) computed42/7 and warm1/2 with actual identity; (2) inherited defaults, explicit empty CMD, replacement ENTRYPOINT/CMD/WORKDIR and an argv element containing literal shell syntax without side effects; (3) explicit empty ENTRYPOINT with an executable CMD, distinct from absent; (4) a fixture-unique mutable source tag initially A, publication A, retarget B without code update (both latest/published remain A), UpdateFunctionCode on that same tag, publication B and alias movement while published A stays A; and (5) two different functions executing concurrently with distinct values/request IDs while the RIC attempts foreign/stale/malformed completions; and (6) a published A invocation causally held at the consume barrier before updating latest to B, proving update is Successful while A remains held, then releasing A to complete its original output/version before independently invoking latest B. Finally invoke the original movable-tag function after the separate in-flight/helper resources have displaced its environments: require published A and latest B to return their own image markers with counter1, qualifying cold launches as well as warm immutability. Report the exact semantic case IDs only after all assertions and process cleanup succeed.
+
+The test alone owns its unique source alias. Capture its expected A/B content IDs in a per-alias nonce/path record, atomically publish record updates through a sibling file so abandoned writes preserve the prior complete identity, never retarget/delete a preexisting alias, use argv-form bounded Docker CLI calls only for this operator-side tag fixture, and remove only the captured alias if its final identity matches an owned source. Always attempt alias cleanup before propagating the primary failure; preserve unexpected identities/evidence rather than deleting them. Disable automatic evidence-directory deletion before any alias mutation and restore it only after alias absence, joined server shutdown and namespace audit. Retain each exact CLI waiter before awaiting; observer loss hands it to a captured-runtime reaper. Actual cancel/panic-after-committed-tag controls must preserve the exact alias/source record, join the failed task, and transfer cleanup authority only after that join. Collector controls include quiet/partial-header shutdown, bad token/oversized headers, ready-state expiry and two-stage release. Host fixture shutdown joins/reaps the exact ordinary server and Python process, then reacquires the same directory/reconciles zero recorded resources and verifies immutable source identities. No Docker CLI starts user functions: actual invocation uses only the production runtime.
+
+Make owns cross-build/image/test automation. Isolate the ordinary executable using D81's target directory and private copied binary; set explicit source/socket/architecture/relay prerequisites. Run both retained daemon lanes, standard and strict Rust checks, prior ordinary startup/owned consumers and the complete Native verifier, with independent review and complete zero-remnant observations. Functional amd64/QEMU evidence does not establish native x86 performance. Do not close full L01–L09 from these cases: actual OOM/init/early-exit/fault/cancel/admission/saturation cases still require their own qualified consumers, as do archive/ZIP/network/IaC/reference/platform/full M0–M4 gates.
+
+
+Executed D82 evidence: both retained daemons pass30 actual consumer cases each, followed by7 final reviewed ordinary startup/custom cases each. The latter require cold published-A/latest-B counter1 and all nine frozen Python semantic IDs; four collector controls and actual alias cancel/panic recovery also pass. Ordinary/feature workspace3,845/3,957 (424/456 gated), strict boundaries1,581/29 gated, Native2,981/19 gated and all standard/strict/security/text checks pass. Captured bridges are removed after exact identity/owner/empty-attachment checks; final complete inventories show zero containers/runtime-private aliases/fixture-source aliases and preserve all four selected source images/cache. W245–W248 are fixed/rechecked. See the [custom RIC review](./rustack-workflows-93-review.md#p1-independent-custom-ric-and-immutable-image-revision-review) for precise cohort chronology, artifact provenance and remaining fault/platform/release scope.
+
+
+## Real Image faults, caller cancellation and public admission (D83)
+
+Consume the ordinary qualified executable in four independently gated cases: typed faults, initializing caller disconnect, busy caller disconnect and accepted-work saturation followed by owned shutdown. Reuse D82's independent custom RIC and bounded collector framing/socket/thread owner; no mock Executor or successful error payload may qualify these cases.
+
+The typed-fault case independently requires init/error, pre-poll exit42, no first poll within the5s init window, post-delivery exit42, actual cgroup OOM at128MiB, and a1s handler timeout after real delivery. The RIC's bounded modes intentionally POST a static redacted init error, exit, hold initialization, or touch at most256MiB; no shell/host injection or unbounded allocation is introduced. Error classes must respectively identify initialization, exited/oom=false, initialization deadline, exited/oom=false, exited/oom=true and function timeout. Before each call capture all owned container IDs; after its infrastructure error no new owned relay/function container may remain, including stopped containers. Clear fixture init configuration where necessary and require a real computed15/counter1 recovery plus healthy backend. Preserve actual image source identities and record no init payload sentinel in SDK diagnostics.
+
+For caller cancellation use a single-stage bounded hold collector that records stage/function/PID and, only for Busy, the actual canonical request ID. It must observe the function before the client closes its signed ordinary Invoke socket. A reserved=1 second invoke must reject429 while that first call is held; after disconnect, require physical removal of its owned function/relay without releasing the hold, repair fixture configuration and invoke successfully with counter1. Physical absence does not itself release a still-joining channel/journal receipt: allow only explicitly observed429 responses in a bounded recovery observation (≤5s and before t0+15s), requiring zero new containers on each throttle. Fence each attempt before dispatch and after success; reject even a first-attempt success at/after the deadline. Bound recovery-client connect/read IO by its remaining budget. Controls must reject expired-before-dispatch and late first success, accept only timely allocation-free throttling/recovery, and propagate other errors; any failure to return the slot fails. Do not change backend permit-release ordering to satisfy an immediate retry. Use an independent20s init budget and900s function timeout for the controlled disconnect profile. Capture t0 immediately before sending Invoke, require stage observation before t0+10s and physical pair removal strictly before t0+15s. Initialization starts after t0, so its20s expiry cannot explain that removal; Busy's900s handler budget, gateway budget and collector lease likewise exceed it. Require the collector's remaining deadline to exceed the observation cutoff with headroom. A socket-close timestamp alone, natural timeout or eventual zero count cannot satisfy cancellation. Reserved=0 and out-of-range reserved values must reject without new allocation or mutation. Scope client-side range-validation disabling only to the signed malformed quota requests, so these controls actually reach the service; normal SDK calls and all server validation/authentication remain enabled. The hold collector aborts/closes/wakes/joins all accepted workers on every exit, with deadline/duplicate/stage/token/body controls inherited from D82.
+
+The controlled profile has two environments and exactly384MiB aggregate memory (two128MiB functions plus two64MiB relays). A512MiB function is valid Lambda configuration but cannot fit locally: require immediate429 before any new container or provider work slot, then prove a fitting invocation still progresses. Add library tests for greater/equal/static-vs-temporary charges and pool progress without evicting a healthy warm environment. Reuse the exact WorkManager global32/per-function8/zero and retained-cleanup permit tests as separately labeled state-machine evidence; physical two-environment runs do not prove32 simultaneously running containers.
+
+For accepted-work saturation start two different reserved=1 functions with real Event202 receipts and hold both consumed events. Fill the existing128 accepted slots through signed Event requests; the129th rejects429. Containers remain the same two owned pairs. Emit a second bounded PID barrier only after saturation/physical-count assertions; the Rust owner then signals and joins the exact ordinary server. Hold RPCs use a bounded240s client IO budget, beyond the saturation collector's180s lease; before the second PID barrier require enough remaining collector/IO lease for the entire75s shutdown observation plus5s headroom. The saturation hold has a180s lease and900s function budgets; the script observes zero owner containers within75s of its ready barrier and strictly before that still-held lease can expire (with5s headroom), then joins collector workers. Require the exact unfinished Lambda quiesce failure/nonzero exit after the configured drain cutoff while physical cleanup succeeds (at least25s from signal under the60s/30s-reserve controlled profile, ruling out an immediate unrelated failure). Capture server-stop elapsed time immediately after joining that server, before waiting for Python or its metadata/collector teardown; do not relabel this as successful draining. Capture the configured final-cleanup reserve under operations§1.11 so native/pure behavior is unchanged and real Docker retirement has time inside the original60s global shutdown deadline; Rust always joins/reaps Python even if either barrier or server stop fails, then reacquires/audits the same data directory. Do not drain queued work by releasing the handlers or hide a forced kill as successful graceful cleanup. Preserve the existing5s PID startup barrier; add a separate absolute-deadline observation for this later phase, never a second unbounded wait.
+
+Read-only independent daemon observation uses an explicit Unix socket, fixed versioned GET endpoints, bounded body/JSON/cardinality/IDs and exact owner-label filtering including all stopped containers. Capture the expected daemon identity and check it before each observation on the same connection. Owner and expected daemon UUIDs come from the bounded checksummed generation2 owner and owner-matching daemon binding records; an empty inventory from a different engine cannot qualify. The fixture observer never mutates Docker or adopts an unrecorded resource. Keep mutable source-alias ownership with D82 and use the existing runtime owners for every user function.
+
+Run ordinary/feature workspace, strict libraries/binary, four new actual cases on both retained daemons, prior ordinary/owned Docker cases, Native verifier and independent review; retain exact complete postconditions and source-cache scope. This consumes the actual fault and init/busy/accepted-capacity paths. Real response-held allocating/cleanup/pull/deployment-saturation and unavailable-daemon controls, exact Docker suite inventory/test-lambda-docker, Node/archive/ZIP/handler SDK/IaC/reference/platform and full M0–M4 acceptance remain required.
+
+
+Executed D83 evidence: both retained daemons terminate with 34 actual cases each, including the four new fault/cancellation/admission resources. The final arm64 startup/fault rerun passes 11 after the remaining-time IO-share refinement; fresh amd64 passes the complete 34. Eleven observer controls/four prior collector controls pass. Ordinary/feature workspace 3,849/3,961 (424/460 gated), strict boundaries 1,584/29 gated and complete Native 2,983/19 gated pass, together with standard/strict/dependency gates. Exact owned bridges are removed and complete observations find zero containers/runtime-private/test-source aliases with four selected sources/cache preserved. See the [D83 review](./rustack-workflows-93-review.md#p1-real-image-faults-and-public-cancellationadmission-review) for corrected failed cohorts, causal fences and exact evidence scope. Remaining matrix and full M0–M4/platform requirements are unchanged.
+
+
+### Management IO faults and exact Docker resource inventory (D84)
+
+Run four ordinary-server resources on both retained daemons, using D83's two-environment/384MiB/20s-init/900s-handler controlled profile and existing signed SDK/physical observers. No daemon shutdown, fake metadata, injected readiness, mutable operator image deletion or ambient credential discovery is permitted.
+
+1. **Allocating disconnect:** arm only a new owned function Create. Forward it to the actual daemon, validate HTTP 201 and full ID, then withhold its complete acknowledgment. Independent metadata must show that exact stopped/Created function plus its relay. Close the signed Invoke socket while 201 is held; a second reserved=1 Invoke must remain HTTP 429 and physical IDs remain unchanged. Release before the proxy's 30s lease and production 60s IO expiry. Require physical pair retirement within 10s after release, before any possible 20s init expiry; fixture init-hold/900s function budgets prevent natural completion explaining retirement. Clear init hold and require cold computed15/counter1 recovery. The proxy must not have observed a function start after the canceled allocation.
+2. **Cleanup disconnect:** arm an exact recorded owned-function DELETE before forwarding it; trigger real handler exit 42, observe the DELETE and independently confirm its stopped function still exists. Close the signed Invoke while cleanup is held; reserved=1 remains HTTP 429 without new allocation. Release, observe pair absence within 10s and cold computed recovery. Physical disappearance cannot substitute for retained logical settlement; bounded explicit429-only recovery preserves the D83 permit contract.
+3. **Management acknowledgment loss and full transport loss:** execute and publish A. Forward B source inspection to the real daemon but drop that management connection before returning its acknowledgment; existing environment streams and unrelated health exchanges remain transparent. Updating latest must fail boundedly while configuration remains Active with A's previous code/revision and published A unchanged. Restore forwarding; published A remains executable and a subsequent valid B update computes as B. A separate absent-source create settles Failed and cannot execute a successful placeholder. Finally, with live environment IO independently present, close all proxy connections and refuse new exchanges. Submit a signed invocation to exercise the failed live environment, require backend/global readiness=false within 10s through bounded diagnostic ingress, and require another business Invoke to reject with the typed unavailable error. Close the held caller and restore forwarding for retained physical cleanup. The exact server then joins after SIGTERM; accept either successful shutdown or its specific cached Docker/quiesce failure, never forced reap or unrelated failure. Full-loss owner/readiness revocation is not silently revived by the fixture. Preserve all sources and expected daemon identity; the parent performs cleanup even when service API cleanup is no longer possible.
+4. **Deployment saturation:** hold two real private-pin Tag acknowledgments after their daemon effects, with deployment capacity 2. Both creates are Pending; a third create rejects HTTP 429 before resource insertion. Delete one held Pending function and require the third create still429 until retained IO settles. Independently verify both exact owned private aliases exist while acknowledgments are held. Release both operations; the deleted function cannot resurrect, the other becomes Active with real computed output, and the previously rejected name can be created and executed. Normal HTTP 412/conflict semantics and old revisions remain unchanged.
+
+Proxy framing follows [HTTP/1.1 message framing](https://www.rfc-editor.org/rfc/rfc9112.html#section-6.3) and [chunked coding](https://www.rfc-editor.org/rfc/rfc9112.html#section-7.1). Read request/identity/create envelopes with no read-ahead across protocol boundaries; cap each head at 16KiB/64 fields, targets at 2KiB, request/create bodies at 1MiB, identity body at 2MiB and framing lines at 4KiB. Reject ambiguous length/transfer coding, truncation and malformed framing before allocation. Forward ordinary responses and upgraded Docker attach streams as bounded 16KiB duplex chunks with independent half-close propagation. Never interpret relay frames or log bodies/credentials. Bound 64 active connections, finite IO/header/gate/process deadlines and joined worker threads. Controls cover real fixed/chunked keep-alive identity exchanges, upgrade bytes and half-close, invalid framing/size, expired gates, wrong selection scope and abort of quiet connections.
+
+One owned Python child starts the proxy and performs SDK cases. Rust first joins two 5s PID startup barriers (process entry and bound proxy), launches the exact private ordinary server copy with a fixture-only socket argument and publishes bounded endpoint/owner/engine configuration. After either semantic success or failure Python restores transparent forwarding, emits a third bounded PID barrier and keeps the proxy alive for Rust's server shutdown. Rust saves every outcome, writes an independent restore marker before cleanup, joins the server/audits the real namespace, writes stop, and always joins/reaps the same Python child. A server or SDK error retains both evidence roots; forced kill cannot qualify success. No global env mutation or orphan/background daemon is introduced.
+
+The frozen Docker manifest covers every ignored resource in eight explicitly compiled targets: CLI ordinary startup, core library, core environment/executor/endpoint/probe/wire integration tests and runtime relay tests. The new four resources increase the current distinct count from 40 to 44; retain reciprocal real-daemon binding and the five standalone relay resources, not only the prior 34-case cohort. Manifest schema 1 uses fixed profile rustack-docker-image-v1 and qualification docker-image-functional. Compare exact complete compiled ignored-test names (including unexpected new tests) before resource execution. Reuse the existing bounded/no-follow manifest and inventory decoder with a statically selected Docker policy; native defaults retain their exact three-suite, 26-case contract. No manifest field becomes a command or chooses a weaker policy.
+
+`make test-lambda-docker-manifest` compiles/list-checks all eight inventories and runs positive/drift/scope/hostile-text controls. `make test-lambda-docker` requires explicit selected/other sockets, architecture, image builder, user bridge and function-visible host; build fixtures, validate inventories, then execute every listed resource with one thread and no ignored skip. Run gate orchestration sequentially even if parent Make uses -j. Resource commands stay fixed in Make, including the reciprocal binding test's second socket. The gate reports functional image scope only; it cannot close remaining interrupted-pull, Node, immutable image archive, ZIP, handler SDK/IaC, native reference/final platform or complete M0–M4 release requirements.
+
+D84 frozen inputs: [Docker functional resources](../tests/workflows/docker-required-suites.json) and the separate [Native workflow resources](../tests/workflows/required-suites.json). Their policies and names are reviewed source artifacts, not regenerated expectations during verification.
+
+
+Executed D84 evidence: `make test-lambda-docker` terminates successfully on each retained daemon, validates all eight inventories and executes all44 resources without skipped cases, including reciprocal daemon binding and all five standalone relay resources. Proxy11/observer12/collector4/manifest10 controls pass. Ordinary/feature workspace3,850/3,962 (424/464 gated), strict boundaries1,585/29 gated and Native2,983/19 gated pass with all standard/strict/dependency gates. Exact bridges are removed and complete observations show zero containers/private aliases, preserving the four selected source images/cache. See the [D84 review](./rustack-workflows-93-review.md#p1-management-io-and-exact-docker-resource-review) for corrected failed observations, guard/handoff regressions and evidence scope; complete M0–M4/platform acceptance remains open.
+
+
+### IO expiration, interrupted pulls and negative images (D85)
+
+Add four ordinary-server resources to the D84 inventory (48 total, 19 ordinary startup resources). Keep both retained daemons, independent expected-engine/owner observations, bounded proxy/collector/child ownership, named source preservation and every later M0–M4 exit requirement.
+
+- **Create acknowledgment expiration:** use a five-second Docker IO budget, 60s environment-start budget and 20s init/900s function budgets. Hold a real owned function Create201 acknowledgment for up to30s after independently observing its stopped Created container/relay. Keep the signed caller connection live. Do not release the barrier until the production IO deadline returns the typed deadline infrastructure failure and exact pair retirement is observed within15s of the held effect. No function start may occur. Recover cold after releasing the obsolete proxy reply; never force worker cancellation or infer progress from sleeps.
+- **DELETE acknowledgment expiration:** execute real exit42, forward the exact owned function DELETE and hold its successful204 acknowledgment after the physical effect. Independent observations must see function absence but the relay/retained reserved slot still charged while deletion awaits IO settlement. Keep the signed caller live and the acknowledgment held; require eventual pair absence within15s and the original typed exit42 failure, not successful payload or a replacement cleanup error. Release only afterward and recover cold. Deadline completion, identity-confirmed absence and receipt/journal joins govern permit return.
+- **Interrupted actual pull:** preserve published A and its latest code/revision, enable only explicit ifMissing/anonymous public.ecr.aws:443 policy with private0600 empty auth YAML, and verify the exact alternate immutable reference is initially absent. Persist a fixture source-reference intent before updating. Proxy the actual images/create request and non-error chunked progress; forward at least one complete valid progress record then terminate only the runtime-facing body before its terminating chunk. Keep draining the real daemon response under a bounded120s owner until valid successful EOF, with16MiB total/64KiB line/record limits, no error fields and positive expected cached image identity. Require candidate LastUpdateStatus=Failed, previous Active A code/revision unchanged, actual published-A execution and later successful B computation. Atomically publish a bounded completion receipt before the parent handoff; cleanup requires this proof, the exact expected image ID, prior absence and preserved baseline reference. Remove only the extra port-qualified reference without force/pruning, and prove the original immutable cached reference/source ID remains. A failed/uncertain backend drain retains intent and fails the resource; it does not authorize cleanup from an empty scan.
+- **Real negative artifacts:** provision bounded deterministic Docker image archives with non-Linux OS/opposite Linux architecture, and build a separate protocol-free process on the pinned provided.al2023 base. The real daemon must inspect the promised OS/architecture/content IDs; no inspection-response substitution is permitted. Signed creates settle Failed/never invoke an Active placeholder for the two metadata failures, with no new function containers. Update each to supported A and require computed15. The valid Linux protocol-free image reaches the configured five-second bootstrap initialization error, remains infrastructure failure with no successful payload, is physically retired and leaves backend healthy. Updating to supported A executes cold computed15/counter1. Preserve every selected source image/cache; fixture archives are explicit Make provisioning artifacts, not runtime import support.
+
+Extend the proxy with an after-effect delete-ack barrier and a separately owned real pull-stream drainer. Controls cover DELETE204 after-effect ordering, valid progress prefix with missing outer terminator, truncated/error/oversized backend streams, retained drainer after the runtime peer closes, deadline fences and a failed completion receipt. Reuse the D82 exact CLI waiter/reaper and atomically published source-alias intent for the extra pull reference; transfer cleanup authority only after positive daemon completion. The proxy must stay alive through server cleanup on every result, and the parent must attempt all owned cleanup without masking primary SDK failures.
+
+Provision the preserved baseline first with `make lambda-pull-fixture-image`, validating the exact immutable public Node reference/selected platform before invoking the explicit daemon CLI. Never require a previous test run to have populated it. Use `make lambda-negative-images` for the three extra selected sources, `test-lambda-deadline-fixture` for protocol/archive/owner controls and the existing exact `test-lambda-docker` gate for all48 real resources. Build artifact generators with bounded fixed schemas and deterministic hashes/paths; no new external package is necessary. Update the frozen manifest/control count explicitly, not by regenerating expected names during verification. Full/minimal workspace, strict boundaries, Native verifier, independent review and complete all-state/prefix inventories remain mandatory. Node execution, immutable image archive restore, Docker ZIP, handler SDK/callback, IaC/native reference/final platforms and any remaining explicit release matrix rows cannot inherit completion from this slice.
+
+
+Executed D85 evidence: both retained daemons pass the exact eight-target48-resource functional gate and all8 final management-IO resources after the last deadline fences. Sixteen proxy/three archive-and-provisioning controls and the typed cleanup-receipt control pass, including late ready IO and retained backend completion after peer close. Four platform-provenance wire regressions/six retained ifMissing preparation cases pass. Ordinary/feature workspace3,854/3,967 with424/468 gated, strict boundaries1,589/29 gated, complete Native2,983/19 gated, standard/security/text gates and independent review pass. Exact bridges are removed with complete zero-container/private/test-source/extra-pull-reference observations and seven selected source images plus baseline preserved per daemon. See the [D85 review](./rustack-workflows-93-review.md#p1-real-io-expiration-interrupted-pull-and-negative-artifact-review) and [remaining M0 audit gaps](./rustack-workflows-93-review.md#m0-exit-audit-after-d85); no full M0–M4 or native-x86/reference qualification is implied.
+
+
+### Actual Runtime HTTP and isolated admission ceilings (D86)
+
+The five resources implement [runtime§4.16](./rustack-workflows-20-lambda-runtime-design.md#416-actual-runtime-http-bounds-and-independent-admission-ceilings-d86) through the real ordinary service and independent custom RIC. Freeze their full names before execution (53 total,24 startup). Cases: Runtime HTTP bounds, global32, default per-function8, temporary memory256MiB with2 environments, and environment1 with384MiB.
+
+Require exact405/431/413/413/400 rejection statuses during one consumed attempt, computed15/counter1 afterward, unchanged pair IDs and warm counter2; inspect requested log tail and infrastructure diagnostics for the sentinel. Native raw-client controls cover bad/oversized/truncated/late replies and exact request construction without reusing production routing/parser code. The resource does not claim exhaustive malformed HTTP grammar coverage.
+
+For admission, use only acknowledged Events below accepted128 and pool256 capacities: global32 across two reserved32 functions with two independently held handlers; default8 with one held handler/one environment and seven computing Events. Start with zero actual accepted/active counters, then require the existing diagnostic projection to report exact32/32 or8/8 accepted/active ownership under limits128/32/default8. Typed429 to an otherwise valid unused/same function then proves the upper boundary; a lower actual limit cannot pass the positive count requirement. Event202 alone is not active admission evidence. Preserve both the exact active/accepted count and429 while the first released handler exits42 and its real DELETE stays held. Require zero counters after all computations and cleanup join. Then positively retire the old pair and require computed recovery; do not treat a timeout, an unprocessed socket or a cached response as admission evidence.
+
+For resource pressure, one bound must be nonbinding by construction. First B's reserved1 slot is positively demonstrated by second-B429, while B's first signed socket remains live and no B container exists. Keep A's exit cleanup held and verify unchanged IDs and retained B reservation. Advance the proxy in two independent stages: after the held function deletion, hold the paired relay deletion before effect. Require function absence, relay presence, unchanged actual work counts, Docker allocated/memory charges retained and no B consumption/computing tickets. Only then release the relay. After release, observe B's actual consumed ID/new running pair, absence of every old ID and exact memory limits, then release B and require cold computed output. No allocation is permitted before physical retirement. The fixture must join raw callers/collector/proxy/server on every error; preserve source IDs and zero-remnant postconditions. Per-target collector controls must reject unknown/duplicate targets and expired release without mutation, independently release one waiter and keep its peer blocked, then join on abort.
+
+Run the reusable fixture controls through `test-lambda-deadline-fixture`/custom-RIC fixture targets, the five actual resources on each retained daemon, the complete exact `test-lambda-docker` profile, required Native verifier, Rust production/fixture checks and dependency/text gates. Record actual observations separately from the prior controlled ProbeExecutor evidence. Keep the M0 gap ledger open until terminal evidence and independent review support closure; all later M0–M4 gates remain binding.
+
+
+Executed D86 evidence: both retained engines pass the complete frozen53-resource/eight-target functional gate, plus3 raw-RIC and1 cleanup-receipt controls, with no required skip. The17 proxy/3 negative archive-provisioning/4 admission/4 prior collector controls pass. Ordinary/feature workspace3,860/3,973 (424/473 gated), strict boundaries1,591/29 gated and Native2,986/19 gated pass, along with all standard/fixture/audit/deny/text gates and independent review. Captured exact bridges are removed only after full ID/name/nonce/empty-attachment verification; complete all-state/image inventories find zero containers/private aliases/test-source aliases/extra pull references. Seven selected source images and the immutable baseline preserve their captured IDs per engine. The [D86 audit](./rustack-workflows-93-review.md#m0-source-and-acceptance-audit-after-d86) closes P1/M0 functional acceptance on native-arm64 VZ/emulated-amd64 QEMU P0 lanes. Native Linux/x86/reference, Desktop/rootless and the complete M4 platform/release requirements remain binding.
+
+
+### Immutable local image-lease reacquisition (D87)
+
+Qualify [runtime§2.15](./rustack-workflows-20-lambda-runtime-design.md#215-immutable-local-image-lease-reacquisition-d87) through the real shared image owner. Controlled wire tests require successful saved-A reacquisition while source tag pointsB, zero additional mutable-source lookups, exact saved metadata/CodeSha256 and unpacked proof; absent A must404 without Tag/pull even though B remains available. Independently valid fingerprint-changing saved fields must fail actual comparison before any mutation. Reuse bounded pin/preparation and late uncertain-mutation/shutdown controls for both ordinary and restore source variants. Existing real wire resources must round-trip resolved metadata through serialization and restore its leases before actual RIC execution/override assertions, on both retained engines. Keep the frozen53-resource inventory; this extends those consumers rather than dropping/renaming resources. Run standard/strict/Native/security/fixture/text checks and independent review. This primitive cannot qualify archive publication or permit backup retirement; provider/main rejection remains mandatory until its atomic consuming boundary is implemented.
+
+
+Executed D87 evidence:35 lease controls pass, including both ordinary/restore variants of uncertain canceled mutation and bounded pin/preparation/shutdown cases, four valid recomputed metadata changes, wrong root ID before platform lookup, saved-A/tag-B isolation and absent-A/available-B no-fallback behavior. Each retained engine passes the two real wire resources with serialized metadata/restored leases and16 related recovery/namespace/binding/pull/environment/provider resources. The unchanged frozen53-name/eight-suite inventory verifies. Ordinary/feature workspace3,869/3,982 (424/473 gated), strict boundaries1,601/29 gated and complete Native2,986/19 gated pass, with standard/fixture/security/text checks and independent review. Complete postconditions are empty for containers/runtime-private/test-source/extra-pull aliases and preserve eight distinct captured post-provisioning source IDs per engine. See the [D87 review](./rustack-workflows-93-review.md#p5-immutable-local-image-lease-reacquisition-review-d87). This qualifies task5.2a only; archive-store/main publication and the final full release matrix remain required.
+
+
+### Candidate-store Image archive import and startup deadlines (D88)
+
+Verify [runtime§2.16](./rustack-workflows-20-lambda-runtime-design.md#216-candidate-store-image-archive-restoration-d88) before enabling archive consumption. Controlled provider/store tests pin all-record prevalidation before Tag, unchanged old resources after later pin/size/deadline failures, shared exact saved metadata leases, inactive versus usable deployment states and bounded hostile metadata. A delayed service import must preserve previous-generation bytes when the retained transaction finishes after its original deadline. Replace the former unconditional Image-archive refusal resource with real ordinary save/restart/computation/no-replay acceptance, plus corrupted saved-image refusal preserving current/previous bytes. Freeze any changed/new resource names before actual execution. Run both actual P0 lanes and the full relevant Docker/Native/standard/strict/security/text gates with exact postconditions and independent review; no final M4 claim follows from archive support alone.
+
+
+D88 freezes the replacement ordinary resource as `test_should_restore_real_image_archive_and_preserve_generations_after_rejection`; it supersedes the prior unconditional metadata-only refusal resource, retaining53 total/24 ordinary startup cases. The fixture writes a genuine checksummed v2 Lambda section with only saved CodeSize changed, independently from the production reader, so rejection must reach fresh image proof rather than outer corruption. Its bounded codec controls reject wrong kind/layout/CRC/truncation and decompression excess. Actual positive restore checks saved Lambda DTO/resource identities, cold latest/published-alias computation, restored state-machine execution and unchanged prior terminal history before any new work.
+
+D88 controlled qualification passes18 candidate/export cases, five pure metadata/worker controls, two producer-save preservation cases, one retained late-import deadline case and two independent archive-codec controls. Deep50,000-level policies reject without recursive destruction; over20MiB ancillary metadata cannot be cloned into an archive or replace either generation. Foreign account/region, later invalid records and invalid effective ImageConfig reject before Tag. Later missing content/fresh-size failure, canceled held mutation and expiry after complete preparation preserve original functions/layers/mappings and retain physical retirement. Positive borrowed export equals the existing owned DTO schema. Shared prospective guard budgets reject before a complete many-condition/version walk. These controls are distinct from actual resource qualification.
+
+Final D88 acceptance: both retained actual lanes pass the complete exact53-resource manifest (57 Rust passes each, ten summaries, zero failed/ignored resources), including the replacement archive resource. Complete Native/host/strict/security checks and expected-engine, empty-container, zero-private-reference, eight-source-preservation and exact bridge-removal postconditions pass; see the [D88 execution review](./rustack-workflows-93-review.md#d88-final-qualification-and-exact-postconditions) for evidence and earlier failures. Native x86/reference, Desktop/rootless and full release/platform acceptance are not inherited from these functional lanes.
+
+
+### Provided-runtime ZIP delivery prerequisites (D89)
+
+Qualify [runtime§6.1–§6.5](./rustack-workflows-20-lambda-runtime-design.md#61-provided-runtime-zip-delivery-contract-d89) without claiming ordinary ZIP execution from transport-only evidence. Controlled converters must reject missing/nonexecutable/script/Mach-O/truncated/class/endian/type/version/machine-invalid ELF, hostile ZIP attributes/paths/collisions/CRC/expansion and over-budget transfers. Independent TAR readers verify deterministic exact bytes, normalized modes/ownership/mtime and1024-byte path support. Admission remains charged through returned artifacts and accepted uploads after caller cancellation. Fake-daemon cases assert exact TAR URI/type, unchanged JSON/response bounds, fixed local-volume options, full owner lists, redacted failures and actual connection-local identity fencing. Actual-daemon component resources must write a private volume only through an unstarted helper and consume it read-only, with source preservation and exact joined cleanup; freeze resource names before execution. Durable owner/recovery and ordinary SDK/ASL ZIP execution remain subsequent mandatory consumers.
+
+D89 freezes the added docker-wire resource `code::test_should_upload_zip_code_to_a_private_volume_and_consume_it_read_only`, giving54 total resources/eight suites (24 ordinary startup unchanged). It consumes a separately cross-built standalone Linux probe from a ZIP, not an inherited image executable or Lambda response stub. Through a never-started RW loader and RO function mount, require computed42, actual root UID/GID0 and0555/0444 modes for implicit directories/code/data, chmod→EROFS rather than a data-open error confounded by normalized permissions, writable `/tmp`, unchanged source content and exact fixture-owned consumer/volume cleanup. This proves transport/mount behavior, not ordinary provided-runtime Lambda execution. `lambda-zip-code-build` and `test-lambda-code-fixture` own automation; no new runtime source image is needed.
+
+Final D89 prerequisite acceptance: both retained actual lanes pass all54 exact resources and52 pure code/four prior Rust controls (110 aggregate passes/13 summaries per lane, zero failed/ignored in these commands). New code-volume computation/mount/ownership/mode semantics pass with the final oracle. Full host/Native/strict/security gates and exact empty-container/private-volume/reference, eight-source-preservation and guarded bridge-removal postconditions pass. See the [D89 execution review](./rustack-workflows-93-review.md#d89-final-qualification-and-exact-postconditions), including the pre-fix directory regression and earlier failed extra oracle. This does not certify ordinary ZIP Lambda execution or inherit missing final platform/reference/release evidence.
+
+### Durable code namespace recovery (D90)
+
+Apply the field/state/provenance, wire ordering and real restart matrix in [runtime§6.6](./rustack-workflows-20-lambda-runtime-design.md#66-code-namespace-provenance-and-recovery-boundary-d90). Keep generation2 query ordering and existing Image/Native acceptance intact. Before execution, add the exact actual-daemon resource to the frozen required Docker manifest and use both retained architecture lanes. Pure codec/wire tests do not count as resource cases. No production code-volume writer or ordinary ZIP capability is claimed at this boundary.
+
+The exact new frozen resource is `docker::recovery::code::tests::real::test_should_recover_real_code_volume_and_unstarted_loader_across_reacquisition`, raising Docker inventory to55 resources in eight suites (nine core-library resources). `make test-lambda-code-recovery-docker` provisions the selected relay source and runs that exact test. An explicitly supplied test-only `RUSTACK_CODE_RECOVERY_RESUME` first drains a retained failed fixture root through the production namespace recovery, preserving that directory as evidence; the same test always then executes its fresh full create/reacquire/recover/source-preservation qualification. It cannot skip or replace the fresh required resource. Pure prerequisites now comprise36 journal/profile and36 code-recovery controls in addition to the existing52 conversion/wire/layout controls. Their default recovery selection reports one gated real case, which the frozen resource gate executes explicitly later. Do not count that preflight gate as a skipped required resource or count the124 pure controls as actual Docker resources.
+
+D90 executed acceptance: both retained full55-resource gates terminate0 with183 aggregate Rust passes/15 summaries and all required resources explicitly executed. Final focused recovery runs,124 pure prerequisites, ordinary/feature workspace4,024/4,139, strict1,769, complete Native3,001 and standard/strict/security/text gates pass. The [D90 review](./rustack-workflows-93-review.md#d90-final-qualification-and-source-reconciliation) records the exact postconditions, retained failed roots and actual full-gate build-export source projection. Initial prebuild tag IDs are not claimed unchanged. Both exact owned empty bridges are removed, with zero owned containers/code volumes/private references and eight actual provisioned sources preserved per engine. Only the durable reader/recovery prerequisite is closed; producing-owner and ordinary ZIP/M4 acceptance remain required.
+
+### Retained producing code-volume owner (D91)
+
+Apply [runtime§6.7](./rustack-workflows-20-lambda-runtime-design.md#67-retained-producing-code-volume-manager-d91): real manager-created volume plus RO probe consumption on both retained lanes, and controlled affiliation/admission/journal/receipt/observer/upload/panic/retirement/shutdown controls. Freeze any new exact resource before execution; count pure controls separately. Ordinary ZIP provider and M4 acceptance remain open.
+
+D91 freezes `code::test_should_prepare_code_with_retained_owner_and_consume_it_read_only` in docker-wire before execution: 56 resources/eight suites, four docker-wire resources and nine core-library resources. It uses the producing manager under generation3 and an affiliated image pin, consumes the original ZIP despite mutated host extraction, checks computed42/root ownership/normalized modes/EROFS/writable temporary storage, and retains code ownership until the physical consumer is gone. Observe the preparation retirement receipt, join code cleanup before image cleanup, and prove the complete namespace is empty. This is component qualification; ordinary provided-runtime ZIP Lambda execution remains required. Retirement observers also fence their return time and preserve resumable physical evidence after timeout.
+
+D91 executed component acceptance:46 owner controls pass; both retained native-arm64 VZ and emulated-amd64 QEMU full gates pass all56 exact resources and170 pure code/four retained controls (230 aggregate Rust passes/16 summaries each). The one gated preflight recovery case is subsequently executed explicitly; no required resource is ignored. Ordinary/feature workspaces4,070/4,185, strict1,833 and Native3,001 pass with all build/Clippy/fmt/rustdoc/audit/deny/text gates. Final26-command postconditions prove zero containers/private code volumes/private references, eight actual provisioned sources preserved per engine and both exact owned empty bridges removed. See the [D91 final review](./rustack-workflows-93-review.md#d91-final-actual-qualification-and-exact-postconditions). The producing component closes5.1b; ordinary provided-runtime ZIP invocation/archive and complete M4 acceptance remain required.
+
+### Ordinary provided-runtime ZIP consumption (D92)
+
+Qualify [runtime§6.8](./rustack-workflows-20-lambda-runtime-design.md#68-ordinary-provided-runtime-installation-and-environment-consumption-d92) through the ordinary installed binary and the producing owner, with no replacement executor or fabricated runtime response. Freeze the exact eight-suite inventory before execution:63 resources, comprising ordinary30/core9/environment7/executor1/endpoint4/probe2/wire5/relay5. Pure prerequisite controls remain separate from actual resources. Missing, extra or renamed compiled cases fail preflight.
+
+The six new ordinary resources cover immutable provided.al2023 ZIP Create/Update/Publish/Alias and repeated A/B revision changes; computed cold/warm results, root-owned read-only code and writable temporary storage; ASL optimized Lambda invocation; transactional ELF/configuration rejection; typed init/handler-exit/handler-timeout/FunctionError recovery; signed client disconnect after observed initialization/event consumption; and disconnect while actual function Create/DELETE is held by the real-daemon proxy. Each observer must positively join the ordinary child, preserve its source images and require shutdown to leave zero recorded containers, pins and code volumes. Reconciliation that repairs anything after exit does not qualify as successful shutdown. Preserve all failures and their roots.
+
+Generate original A/B ZIP files once per selected architecture with `lambda-provided-zip-build`; use those exact A bytes both in signed SDK operations and in the separately owned Linux Native verifier. SDK and Native observations record the same SHA256. The verifier embeds the real production Native provider, computes42/46 from21/23, observes counter1→2 and a reused actual child PID, joins provider shutdown and requires `/proc/PID` absence. Its explicitly owned executable `/tmp` mount is only verifier infrastructure; production Docker Lambda keeps its noexec temporary-storage policy. No host bind mount, host CLI function execution or alternate ZIP repackaging substitutes for this resource.
+
+The full `test-lambda-docker` gate builds all selected-architecture artifacts before any resource executes. Do not rebuild or overwrite the fixed provided fixture paths while any SDK/Native resource is using them; SHA comparison rejects such mixed-generation development runs. Run the full gate independently on native-arm64 VZ and emulated-amd64 QEMU with distinct bound daemons, nonce-labeled owned bridges and recorded source IDs. Require all63 exact names, complete physical postconditions, captured build-export source projections, full Rust/Native/strict/security/text checks and independent review before closing5.1c. Emulated amd64 proves functional scope only. ZIP snapshots5.2c, Node/handler SDK/IaC/reference/platform and final M0–M4 acceptance remain mandatory.
+
+
+Final D92 consumption acceptance: both retained full functional lanes pass all63 frozen resources,263 aggregate Rust cases/20 summaries each. Original per-architecture ZIP bytes are identical across all four ordinary SDK cohorts and the real Linux Native verifier; controlled admission/wire-origin, publication, cleanup and handler-boundary regressions pass. Standard/strict/Native/security gates and the26-command exact zero-remnant/nine-source-preservation/owned-bridge-removal report pass. See the [D92 final qualification](./rustack-workflows-93-review.md#d92-final-actual-qualification-and-exact-postconditions) for original hashes, failed development evidence, source-projection provenance and platform limits. This closes5.1, with ZIP archives and full M4 acceptance still required.
+
+
+### Managed provided-runtime ZIP archive qualification (D93)
+
+Implement [runtime§6.9](./rustack-workflows-20-lambda-runtime-design.md#69-bounded-provided-runtime-zip-archives-and-mixed-candidate-restoration-d93) before lifting ZIP archive rejection. The following are required independent oracles; profile tests use small injected private ceilings for exact/over cases rather than materializing production-sized bombs.
+
+| Boundary | Required observation |
+|---|---|
+| Profile selection | Image-only16MiB/no ZIP; configured managed128MiB plus separate live capability checks; health revocation cannot authorize restore |
+| Raw CBOR before typed decode | Only exact latest/unsigned-published ZIP paths gain large-text allowance; misplaced/unknown/layer/policy bodies and excessive metadata/scalars/keys/depth/nodes reject before Deserialize sentinel |
+| Original bodies | Canonical standard base64, per-body50MiB and aggregate64MiB counting every revision; metadata16MiB remains independent |
+| Private extraction | Aggregate512MiB logical expansion/20,000 nodes including wrappers; exact/over budget and false-size input reject before uncharged artifact allocation, with no pin effects |
+| Complete candidate | Invalid later ZIP/alias/runtime/architecture/hash/size/ELF/tree preserves all old stores and emits no Image Tag; later Image failure discards prior private ZIP staging |
+| Deadline/observer | One original cutoff reaches each version and pre-registration/conversion/pin/commit; expired or dropped observers never grant late publication and original workers retain their cleanup |
+| Ordinary restart | Signed save/restart computes latest B/published A/alias A and mixed Image, preserves original hashes/IDs/settings/history, starts fresh environments, performs no replay |
+| Archive failure | Checksum-valid bad ZIP metadata and missing configured runtime reject ingress/import and preserve both current/previous archive bytes |
+
+Add exact ordinary resource names `test_should_restore_provided_zip_archives_without_replay_and_preserve_invalid_generations` and `test_should_refuse_provided_zip_archives_without_configured_runtime` before first execution, increasing the frozen inventory63→65 (ordinary32 and all other suites unchanged). Add a discoverable Make target for pure profile/candidate/codec controls and a focused real ZIP-archive target using the existing fixture provisioning/manifest gates. Full both-lane Docker, unchanged Native inventory, standard/strict/security/text and independent review with exact zero-remnant/source-preservation/owned-bridge evidence remain required. No Node/handler SDK/IaC/server-in-container/reference/platform/full-M4 completion follows from this archive slice.
+
+### Official Node image qualification (D94)
+
+Consume [runtime§4.17](./rustack-workflows-20-lambda-runtime-design.md#417-official-node-image-consumption-d94) through the actual ordinary binary and official pinned Node24 RIC. Freeze `test_should_execute_official_node_image_with_signed_sdks_and_asl` before any execution, increasing65→66 required resources, ordinary32→33. Require signed Rust SDK computation and signed boto3 cold/warm arithmetic, actual Node version/architecture/UID, EROFS plus0600 temporary file roundtrip, context/settings, stdout/stderr tail, published/alias retention after CMD update, named FunctionError/recovery and optimized ASL execution. Expected arithmetic and semantic case names are source-controlled independently of runtime results. SDK observers fence every response against their original deadline and join their PID owner. Inject a late-terminal response in a pure observer control so this cannot regress to accepting post-cutoff success.
+
+The official Node error consumer also requires the narrow Runtime HTTP X-Ray cause allowance. Cover≤8KiB on exact error route, larger valid/Unicode metadata delivery, over-limit/duplicate/control/wrong-route/lookalike rejection and unchanged16KiB aggregate/general256-byte bounds. A rejected request must leave the original ticket pending; the next valid request returns202 and delivers the exact error bytes. Runtime diagnostics must omit the cause. Rebuild the actual relay artifact on both selected architectures before requalification; no old relay can qualify the corrected boundary.
+
+Default Node RIC keepalive consumption requires eight bounded HTTP connections with an independent four-reader POST quota. A real HTTP control retains five separately acknowledged successful keepalive sockets through five distinct valid attempts; no concurrent `/next` or extra handler capacity is implied. Verify four held POST body reservations, uncharged GET admission, fifth-POST429, untouched session state and admission recovery after release. Hold the real session mailbox behind a deterministic actor barrier and cover both Complete and InitError: four accepted body envelopes keep quota exhausted after observer expiry or abandonment; retry cannot acquire a slot until the queued envelopes are rejected/processed or the actor drops them. An expired command must not mutate session state. Cover mailbox-full/closed/pre-expired rejection releasing its newly acquired permit. Keep16KiB header/6MiB body limits and all joined shutdown paths. Actual Node published-version/alias warm reuse and ASL must continue after other revisions execute or fail; capture only scoped bounded daemon state when diagnosing unexpected exits.
+
+`lambda-node-fixture-image` builds the fixed digest source for the selected architecture; `test-lambda-node-docker` provisions its relay/Python baseline/Node/SDK prerequisites and exact inventory before selecting the single resource by exact name. Full both-lane gates must provision Node before the first required resource, execute all66 once and capture ten actual sources: the existing nine plus the Node handler image. Preserve the base pull fixture independently. Require zero containers/all volumes/private and test image references and exact owned empty bridge retirement; no global prune. Missing images/Node prerequisites fail the required lane. Both frozen-source full logs, source export provenance, standard/strict/security/text checks and independent review are required before L02 closes. Existing Native/workflow semantics retain their separate verifier evidence. This is functional qualification on the recorded lanes, not native-x86/reference, Desktop/rootless or full release acceptance.
+
+Final D94 acceptance: both retained functional lanes execute all66 exact resources once and pass482 aggregate Rust cases/28 summaries each. The one recovery resource ignored during pure preflight is subsequently explicitly executed in its required core suite; no required resource is skipped. Official Node reports24.22.1 and all independent signed semantic cases pass. Standard/strict/Native/security/text gates and exact zero-remnant/ten-source-preservation/two-owned-bridge-removal postconditions pass. See [D94 final qualification](./rustack-workflows-93-review.md#d94-final-qualification-and-exact-postconditions) for source/export/exit-observation provenance and retained failed/interrupted evidence. This closes only task5.3a/L02; handler SDK/callback images and the remaining M4 gates stay required.
+
+### Explicit image handler SDK acceptance (D95)
+
+Qualify [runtime§4.18](./rustack-workflows-20-lambda-runtime-design.md#418-explicit-local-handler-sdk-environment-d95) and [operations§1.12](./rustack-workflows-60-operations-design.md#112-explicit-local-handler-sdk-configuration-d95). Freeze both exact resource names in the ordinary suite before execution:35 ordinary/68 total/eight suites. Keep every prior resource. Build the separate pinned SDK image and centrally expanded ordinary Docker feature cohort; only the SDK profiles enable S3/DynamoDB. Require actual bundled3.1105.0 client metadata and real default-provider SDK execution, not merely successful package lookup.
+
+Pure tests cover all pair bounds/partial/absent combinations and zero ambient lookup, endpoint/network prerequisites, redacted Debug/no serde, unique/bounded final Env with preserved maximum valid user entry, all fixed selector unsets and dynamic endpoint prefixes, unchanged disabled profile and relay/probe bodies, checked context-ID overflow/clones/warm separation, exact foreign readiness/directory/network/relay/manager affiliation and revocation before create. Prepare a valid SDK plan, then revoke its proof while images/environment service remain live; both relay/function create calls must synchronously fail Stopped with zero observed Docker requests. Prepared/queued plans retain the secret-free guard through the existing live() checks. No SDK secret may enter warm-key serialization, revision/API/archive/journal or raw diagnostic projection.
+
+Positive resource first runs the same image's quiet-body control: receive real HTTP headers from an owned held loopback peer, remove request-stage abort observation, abort the returned body and require the helper to reject promptly/destroy the stream; join all local HTTP owners under one2s control cutoff. Then update CMD to the SDK handler with environment capacity1, preserving cold/warm1/2. Positive resource: strict-auth actual S3/DynamoDB/Lambda gateway, valid consistent server credential aliases and correct explicit SDK pair; poison image credentials and inherited/captured profile and per-service endpoints. Host clients create resources; actual Node clients cold21→42 and warm23→46 write/read bounded objects/items through default endpoint/credential resolution. Independent host reads verify literal expected bytes/numbers. Require actual SDK versions, unique warm process identity/counter, selector-unset booleans, relay credential absence and installed bounded archive-producer omission without persisting Env values.
+
+Negative resource: correct outer Lambda/service credentials and valid ambient AWS pair, deliberately wrong explicit SDK secret. Independently request GetObject and GetItem, requiring exact actual SDK AccessDenied/403 and AccessDeniedException/400 before throwing fixed fixture errors. Ordinary Invoke must report those typed function failures, never successful payload, arbitrary timeout or ambient fallback. Confirm environment retirement and no business mutation. Each SDK call/body read shares the original10s handler budget; no retries, detached IO or client leak.
+
+The signed SDK child follows the existing original-deadline/PID-handshake/always-join pattern; all failure paths retain evidence until exact server/runtime cleanup and daemon/source audit. Run focused Make fixture/resource gates, all68 full resources on both retained engines, standard/strict/Native/security/text gates and independent review. Final observations require zero all-state containers/volumes/private references, eleven actual source IDs preserved per engine and only the exact owned empty bridges removed. Local package preflight at `/tmp/rustack-d95-sdk-source-intent.json` is not execution acceptance. Docker callback images, IaC/server-in-container/reference/platform and complete5.4 release acceptance remain pending.
+
+After an equivalent shared test-owner relocation, requalify the affected two SDK resources and official Node resource with `test-lambda-image-sdk-consumers-docker`. This target consumes already provisioned/recorded sources, runs current Node/SDK controls and the full compiled manifest before those three exact resources, and never rebuilds images. Missing prerequisites fail. Preserve the original full resource seal and image IDs: BuildKit can change attestation-bearing parent IDs even for cached exports. Record the reviewed helper/append-only Make delta separately from the test-style delta; all production and handler-image bytes remain unchanged. Require both current-source focused lanes, full current host/strict/Native/security gates and source-ID/zero-remnant checks before accepting that lineage.
+
+D95 executed acceptance: both retained full gates pass all68 required names once,509 Rust cases and29 summaries each. Both final-source three-consumer gates pass71 cases/seven summaries, including all3 exact resources; no image is rebuilt. Standard9, ordinary/feature workspace4,217/4,333, strict boundaries1,969, complete Native3,077, audit/deny and final text checks pass. Exact postconditions prove zero all-state containers/volumes/private references, eleven actual source IDs preserved per engine and retirement of only the two owned empty bridges. W324–W332 and both reviewed source deltas are closed in the [D95 review](./rustack-workflows-93-review.md#p5-explicit-local-handler-sdk-qualification-d95). This closes L10 on native-arm64 VZ/emulated-amd64 QEMU functional lanes; image callbacks/IaC/server-in-container/reference/platform and complete M4 stay open.
+
+### Actual managed-image SDK callback acceptance (D96)
+
+Consume [integrations§5.6](./rustack-workflows-40-integrations-design.md#56-real-image-sdk-callbacks-and-independent-event-worker-d96), [runtime§4.19](./rustack-workflows-20-lambda-runtime-design.md#419-managed-node-image-callback-consumers-d96) and [operations§1.13](./rustack-workflows-60-operations-design.md#113-explicit-image-callback-fixture-profile-d96). Keep the ASL callback invocation RequestResponse; only dispatcher A's internal SDK invocation of B is Event. Both actual clients use D95's default endpoint/credential providers. Node's A/B handlers finish all their own SDK/gate work before returning. Source metadata at `/tmp/rustack-d96-sdk-source-intent.json` verifies bundled Lambda/SFN/DynamoDB3.1105.0 and exact unstarted-reader removal, not callback execution.
+
+Freeze both exact resource names before first execution: test_should_execute_real_image_callbacks_before_and_after_lambda_response and test_should_enforce_image_callback_retry_heartbeat_timeouts_and_stop. Keep all previous cases:37 ordinary/70 total/eight suites. Provision a separate pinned callback image through Make and the sequential complete fixture aggregate; preserve twelve actual source IDs per lane. Missing sources/features/network settings fail, never skip.
+
+| Resource | Independent expected cases | Required observations |
+|---|---|---|
+| Early/late image callbacks | early, late, externalFailure, invocationFailure | Early RUNNING gate/no Submitted; SDK provisional outcome; late real Event acceptance and B's active invocation after A's real Submitted; unrelated Lambda task progresses with dispatch1; callback value42 replaces ignored A body; exact external/fixed FunctionError and A retirement |
+| Retry/heartbeat/timeout/Stop | retry, heartbeat, absoluteTimeout, heartbeatTimeout, stop | Actual retry0/1/warm A, new hash and old-token TaskTimedOut; pre-return heartbeat no-op and post-return repeated reset; unchanged8s absolute deadline; exact States.HeartbeatTimeout; Stop ABORTED/Stopped, A absent while B survives, B stale-token TaskTimedOut and joined Event |
+
+Use the existing callback-cases.json catalog's literal statuses/errors, not engine-produced expected values. Both resources require real SDK versions, actual request UUIDs/version metadata, contiguous causal history, redacted Scheduled token, correct Submitted count/body-omission marker, forged InvalidToken and duplicate TaskTimedOut. Keep all Native/public wrong-scope and callback race tests. Prewarm the two image functions before timed modes. Persist only safe phase/control/hash rows; bound reports/collections/payloads as specified. A reserved=1 worker probe positively confirms B's Event has finished before snapshot save.
+
+Pure fixture controls must detect a deliberately injected token by its reported hash, including every shifted/overlapping window in a longer hex run and a token split across decoder chunks. Test exact/over aggregate candidate caps across multiple history/log/archive sources; exhaustion fails rather than passing a partial scan. Also reject byte/file/depth caps, malformed hashes and linked/special archive inputs, and cover stage/gate classification and late child always-join. No raw-token diagnostic is accepted. A complete saved archive must still contain the actual functions, terminal workflows and safe control rows. Scan bounded decompressed archive data/log/history for token-hash matches and require injected SDK credential omission. Original-source/current-source hashes and SDK client package provenance remain independently inspectable.
+
+The private stopped-generation observer uses asynchronous bounded file IO with NONBLOCK/NOFOLLOW leaf opens and immediate regular-file checks, under the existing operator-controlled ancestor/no same-UID mutation precondition. It does not claim to withstand a hostile same-UID ancestor replacement. Reject FIFO/replaced-special leaves promptly. Retain and join each bounded CPU decoder through timeout, with fresh post-join and final success deadline fences; ready-but-late results fail. Check both injected access ID and secret with redacted errors. Decode the v2 framing/CRC and a typed bounded execution projection; require actual terminal execution rows, rejecting expected ARNs found only in unrelated fields or malformed frames.
+
+Run focused both-lane resources and every current full70 resource under frozen source, all standard/strict/Native/security/text checks, then independent source/evidence review and exact zero-remnant/twelve-source/owned-empty-bridge postconditions. The shared async post-stop audit hook also changes existing Node/SDK ownership composition, so those consumers remain in the full gate. No C01–C03 image completion or whole M4 completion is inferred from the source reader, D95, simulated SDKs or successful creation alone. IaC/server-in-container/reference/native-x86/Desktop/rootless/final5.4 remain active.
+
+
+D96 executed acceptance: both final full owners complete0 and pass all70 exact names once/519 Rust cases/30 summaries each. Both final focused owners pass two exact resources/451 Rust cases/24 summaries; their single gated recovery preflight is explicitly executed in each complete gate. Actual SDK3.1105.0 causal/timing groups cover all nine independent modes. Final standard9, workspace4,217/4,341, strict1,969, Native3,077 and audit/deny pass. Exact postconditions verify both engine inventories, all26 successful CLI results, zero remnants, twelve source IDs preserved per engine and only two exact owned empty bridges removed. See [final D96 qualification](./rustack-workflows-93-review.md#final-d96-qualification). This closes task4.3/5.3c on retained functional lanes; IaC/server-in-container/reference/native-x86/Desktop/rootless and complete5.4 remain required.
+
+### Managed Pulumi image-Lambda IaC qualification (D97)
+
+Qualify [the IaC consumer](./rustack-workflows-50-iac-design.md) with the actual pinned CLI3.273.0, Node SDK3.273.0 and AWS provider7.52.1 inside a managed Image Lambda. A controller ASL Task invokes that function synchronously; a separate managed business Image Lambda executes the provider-created state machine. Use the existing function/relay owner for CLI, language host and provider lifetime. Do not substitute host Pulumi, fake checkpoints, an echo handler or a second process supervisor. The dedicated profile admits two environments/two dispatches and1,536MiB; tool1024+relay64+business256+relay64 totals1,408MiB. Preserve the normal non-root, read-only-root, bounded noexec temporary storage and PID policies. Only this consumer receives the original1,020s SDK cutoff; each CLI command remains bounded by90s and the tool handler by700s inside its720s function timeout.
+
+Execute the literal18-command catalog: version, local login, stack init, create, refresh-created, update, refresh-updated, reject/recover/strictly-settle publication, reject/recover/strictly-settle logging, reject/recover/strictly-settle encryption, destroy and stack removal. Gates bind the run nonce, lifecycle/Stop mode, command ordinal and finite stage. Up uses --skip-preview; an explicit dry-run control proves preview performs no gate IO. Independent SDK observations must prove created input21 computes42, updated input23 computes46, supported refresh/settling ups report no changes, and every unsupported request preserves its own preceding service revision and effective resource. A supported recovery may advance the revision after Pulumi records failed desired inputs; it must be followed by a separate --expect-no-changes up. Require eight distinct target execution ARNs, ten distinct canonical business request UUIDs and literal warm counters1..10, rather than accepting repeated completed executions or output shapes. Controlled replay negatives exercise both stale ARN and stale UUID paths.
+
+Audit three separate actual current backend states: before destroy, after destroy and after stack removal. The first requires the real provider resource and both encrypted credential inputs; the second binds a successful destroy and independent describe/list absence to the actual empty checkpoint; the third requires successful stack removal and active-checkpoint absence. Require stack=organization/rustack-iac/fixture, the latest deployment and its pinned engine manifest/time/magic. Accept omitted resources only for the legitimate post-destroy representation. Empty/unrelated checkpoint objects, backups and changed hashes cannot replace a current-state proof.
+
+Read live tmpfs through the fixed image-pinned read-only Node evidence reader in the exact existing function namespace. Docker GET archive does not observe that live mount. Bound the reader's fixed argv, UID/GID1000, no-follow regular-file checks and USTAR output; independently validate Docker framing, archive paths/types/counts/bytes and the same exec's container, entrypoint, arguments, identity, nonprivileged/non-TTY settings, Running=false and ExitCode0. Scan every regular backend/log body for raw and decoded JSON-string credential values, including .json.bak. Keep raw failure archives only below an exclusive private evidence child; do not extract container paths onto the host or print CLI output, checkpoints, credentials or the private backend passphrase. Uncertain exec settlement must fail the SDK child and remain under existing server/container retirement.
+
+The Stop resource must first observe actual CLI/language/provider processes alive. Stop the controller and require ABORTED/Stopped, physical absence of the complete tool function/relay pair, and preservation of the exact business pair. Probe that same business environment again, requiring three distinct request UUIDs/counters1..3. Then perform explicit SDK compensation of the known target/controller. That compensation is not evidence that interrupted Pulumi completed destroy. All child/SDK/server owners must join on success and failure, with evidence retained whenever retirement is uncertain.
+
+Make test-workflows-iac-fixture runs20 Node controls, two dependency-root lock/configuration controls, ten artifact/tool controls, nine archive/privacy/exec controls and the replay control. Make test-workflows-iac-docker selects both exact ignored ordinary resources after normal provisioning and manifest verification. Freeze72 total/39 ordinary/eight suites before execution. Require both focused resources and every full resource on both retained lanes, all standard/strict/Native/security/text gates, independent review and exact daemon/source postconditions. Each engine must preserve thirteen actual source IDs, captured as nine named build exports plus four unchanged prebuild references. Remove only the two exact owned empty bridges after repeated identity/nonce/attachment checks. Keep native-arm64 VZ and emulated-amd64 QEMU functional scope explicit; server-in-container, native-x86/reference, Desktop/rootless and complete5.4 remain separate required acceptance.
+
+
+D97 executed acceptance: both final full owners join0 with all72 exact resource names once/521 Rust passes/30 summaries per lane; both focused owners join0 with two exact resources/451 passes/24 summaries. Every current checkpoint, literal result/fresh identity/privacy and active-plugin Stop assertion passes under the same78-source seal. Standard9, default/feature workspaces4,217/4,342, strict1,969, complete Native3,078 and audit/deny pass. Exact26-command postconditions prove zero remnants, thirteen source IDs preserved per engine and removal of only two exact owned empty bridges. W344–W364 are fixed/rechecked; see [final D97 qualification](./rustack-workflows-93-review.md#d97-final-qualification-and-exact-postconditions). Task5.3d closes on the retained functional lanes; server-in-container/native-x86/reference/Desktop/rootless and complete5.4 remain required.
+
+
+### Server-in-container functional qualification (D98)
+
+Apply the [server-container contract](./rustack-workflows-55-server-container-design.md). Require the actual Linux CLI inside its immutable selected-architecture image, explicit daemon-side socket/GID, the exact named data volume, a qualified bridge and internal server DNS endpoint. The host's published SDK origin and the handler's internal DNS origin are different independently checked values. A positive consumer must prove strict signed S3/DynamoDB42/46 plus nested .sync:2 child50 and warm counters1..3 through the same managed pair. A negative consumer must prove the expected endpoint qualification rejection at closed internal port9, rather than accepting an unrelated startup failure.
+
+Freeze test_should_execute_image_sdk_and_nested_asl_from_a_server_container and test_should_refuse_unreachable_server_container_gateway_and_join_startup_cleanup before first execution:41 ordinary/74 total/eight suites. Pure archive/policy/oracle controls and both focused resources precede complete both-lane74, standard/strict/Native/security/text and independent review. The owner must join all CLI/SDK children, verify the actual persisted owner/engine records without extraction, observe clean production runtime shutdown before deleting the stopped server/volume, retain uncertain resources/evidence and preserve fourteen actual source IDs per engine. Guarded complete inventories and exact task-owned empty-bridge removal remain mandatory. D98 executed acceptance: both full74 owners join0 with535 Rust passes/31 summaries and all exact names once; both focused2 owners join0 with463/25. Standard9, workspace4,217/4,354, strict1,969, complete Native3,078 and audit/deny pass under one103-source cohort. Exact26-command postconditions confirm zero remnants, fourteen source IDs preserved per engine and only two exact owned empty bridges removed. W365–W370 and W376–W377 are fixed/rechecked; see [final D98 qualification](./rustack-workflows-93-review.md#d98-final-qualification-and-exact-postconditions). Root release packaging W371–W375 and native-x86/reference/Desktop/rootless/remaining performance/load/full5.4 stay required.
+
+
+### Actual root release image and composite Action (D99)
+
+Apply [release-image qualification](./rustack-workflows-56-release-image-design.md). Before source changes, review the explicit root build context/security-patch/compiler/profile contract, public-config copy/read-back, actual image/health policy and Action validation/privacy/monotonic subprocess boundaries. Freeze test_should_execute_image_sdk_and_nested_asl_from_the_release_image and test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup, increasing43 ordinary/76 total/eight suites; Native26 stays unchanged. Both focused resources and all76 full resources must pass on each retained engine under one new frozen source cohort, with15 source IDs preserved, zero remnants and exact task-owned empty-bridge removal. The separate action-process-controls profile freezes one exact ignored Rust process suite; a normal YAML contract test plus that independent owner qualify the actual Action body and its controlled CLI/PID cases. Run the Action inventory decoder drift controls before compiled listing validation. Action1 is additional evidence, separate from Native26 and Docker76. Standard/strict/Native/security/text and independent source/evidence/current-summary reviews remain required. D99 executed acceptance: both full76 owners join0 with558 Rust passes/33 summaries and both focused2 owners join0 with484/27 under one1250-source cohort. Standard9, default4,218/feature4,359, strict1,969, Native3,078 and audit/deny pass. Artifact13/Action26/Rust-policy16 controls and exact26-command zero-remnant/fifteen-source/two-owned-bridge postconditions pass. See [final D99 qualification](./rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions). Full M4 remains incomplete; D100 removes further Linux x86_64 validation from the remaining scope.
diff --git a/specs/rustack-workflows-80-roadmap.md b/specs/rustack-workflows-80-roadmap.md
new file mode 100644
index 00000000..c7565928
--- /dev/null
+++ b/specs/rustack-workflows-80-roadmap.md
@@ -0,0 +1,66 @@
+# Workflows 80: User-Facing Delivery Roadmap
+
+Status: M0 functionally qualified on retained P0 lanes; full M0–M4 release incomplete · Date: 2026-10-31
+
+Current checkpoint: D99/5.4a qualifies the actual root release image and safe composite Action on the retained functional lanes. Each full gate executes76 exact resources with558 aggregate Rust passes/33 summaries; each focused gate executes2 exact resources with484/27. One1250-file source cohort, standard/strict/Native/security checks, actual image filesystem/ELF audits and exact zero-remnant/fifteen-source/two-owned-bridge postconditions pass. See [final D99 evidence](./rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions). W373 promotion, required arm64/reference/Desktop/rootless platforms, remaining performance/load and complete M4 remain open. [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation; existing QEMU evidence remains historical functional evidence.
+
+## 1. Delivery principles
+
+Each milestone is usable end to end and preserves bounded execution, honest errors and explicit capability reporting. Unfinished capabilities remain rejected. M0 is useful independently, but the requested workflow/runtime feature is complete only after M4. The [implementation plan](./rustack-workflows-90-impl-plan.md) orders engineering work by dependency; this roadmap groups outcomes a consuming project can use.
+
+```text
+┌─ P0: evidence, contracts and risk retirement ───────────────────────┐
+│ official RIC + Docker relay proof │ semantic fixtures / model pin │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ M0: run real image Lambdas ────────────────────────────────────────┐
+│ deploy → immutable digest/version → actual Invoke → cleanup        │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ M1: test sequential serverless workflows ─────────────────────────┐
+│ SDK → ASL/data flow → Docker Lambda → Retry/Catch → history         │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ M2: coordinate fan-out and nested jobs ────────────────────────────┐
+│ Parallel/Inline Map │ child execution │ .sync/.sync:2 cancellation  │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ M3: test callback workflows ──────────────────────────────────────┐
+│ Task.Token → real Lambda → SendTask* → heartbeat/deadline           │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ M4: use in consuming-project CI ──────────────────────────────────┐
+│ provided ZIP │ snapshots │ platform matrix │ fault/load/IaC gates  │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+## 2. Milestones
+
+| Milestone | What another project can do | Exit evidence | Engineering phase |
+|---|---|---|---|
+| M0 — Actual image execution | Create/update an Image Lambda, publish/alias it and receive the handler's actual result using a normal SDK | L01–L09; official RIC and custom Rust fixture; digest/version isolation and owned cleanup | P1 |
+| M1 — Sequential workflows | Create STANDARD definitions and test six state types, transformations, real Lambda tasks, retries, catching, waiting and timeouts | A01–A13, I01; Rust SDK+boto3; PRD scenario succeeds and deliberate failures fail | P2 |
+| M2 — Fan-out and nested completion | Execute all eight state types, bound Inline Map concurrency, wait for real child workflows and stop owned subwork | I02–I05, P01–P03; correct order/types and no missed completion/deadlock | P3 |
+| M3 — Callback workflows | Pass Task.Token to a real function and complete/fail/heartbeat its task safely | C01–C03; early callbacks, retries and revoked tokens covered without token disclosure | P4 |
+| M4 — Reusable local/CI dependency | Use supported image/ZIP artifacts, snapshots and a basic IaC lifecycle across the platform matrix | L02 completed, L10/L11, O01–O05; complete verification manifest passes without required skips | P5 |
+
+All milestone evidence refers to the [verification plan](./rustack-workflows-70-verification-plan.md). Each exit also includes the applicable repository quality gates and fresh capability output. A demo without negative cases does not close a milestone.
+
+## 3. Calendar and confidence
+
+Assume one experienced Rust engineer, a working Docker environment, preexisting gateway/Lambda hardening, no distributed persistence requirement and access to both Linux architectures plus Docker Desktop in the original estimate. D100 now waives Linux x86_64 validation; this does not supply a new measured delivery estimate. Estimate 56–83 engineering days including P0, then add 25% for review, integration and platform troubleshooting: approximately **14–21 calendar weeks**. These are planning estimates based on identified work, not measured delivery velocity.
+
+| User-visible checkpoint | Approximate cumulative calendar window |
+|---|---|
+| M0 | Weeks 4–6 |
+| M1 | Weeks 8–12 |
+| M2 | Weeks 10–15 |
+| M3 | Weeks 12–18 |
+| M4 | Weeks 14–21 |
+
+P0 is the first re-estimation point. If relay portability fails, or semantic evidence forces a broader expression engine, revise this roadmap before implementation commitments. Image execution, ASL semantics and shutdown correctness are substantive work, not a small API addition. Optional future scope—EXPRESS, JSONata, ECS/Batch, WAL recovery—has no implicit delivery date in this estimate.
+
+## 4. Cross-references
+
+- ← [PRD](./rustack-workflows-00-prd.md)
+- ↔ [implementation plan](./rustack-workflows-90-impl-plan.md), [verification](./rustack-workflows-70-verification-plan.md), [decisions](./rustack-workflows-99-decisions.md)
diff --git a/specs/rustack-workflows-90-impl-plan.md b/specs/rustack-workflows-90-impl-plan.md
new file mode 100644
index 00000000..93b05f7a
--- /dev/null
+++ b/specs/rustack-workflows-90-impl-plan.md
@@ -0,0 +1,478 @@
+# Workflows 90: Dependency-Ordered Implementation Plan
+
+Status: P0 complete; P1/M0 functionally qualified on the retained P0 lanes; complete M0–M4 implementation objective remains active · Date: 2026-10-31
+
+## 1. Readiness and dependencies
+
+Available: existing gateway/YAML/snapshot infrastructure and independent Native/Squib backends; Lambda control plane, immutable revision/artifact capture and supervised admission/cancellation; shared RuntimeSession/HTTP/relay/client, bounded DockerWire, platform-aware image resolution/leases and provider asynchronous deployment/status/CAS. Persistent directory ownership, allocation plans, retained environment lifecycle, bounded FIFO/warm/LRU dispatch, delivery-based handler timing and invocation-scoped observed log windows and resumable per-call pool cleanup settlement are implemented. Docker Executor/provider/HTTP composition is implemented and qualified through controlled-readiness real SDK fixtures. Startup network/full-ID qualification and actual pinned Rust kernel resource proofs are implemented. Production startup now composes journal provenance, validated settings/private credentials, endpoint reachability and actual capabilities under D81; D82 qualifies custom RIC/ImageConfig and immutable revisions. D86 closes the actual malformed Runtime HTTP and independently isolated admission/resource requirements. P1/M0 is functionally qualified on the recorded P0 lanes. D88 implements and qualifies immutable local Image archive restoration on both retained P0 lanes, as recorded below. D96 also qualifies actual handler SDK networking and image callbacks on those retained lanes; D97 qualifies managed Pulumi lifecycle and active-plugin Stop; D98 qualifies the separate actual Linux server-container topology on both retained functional lanes. D99 qualifies the actual root release image and safe Action. Remaining: W373 promotion, required Linux arm64 reference/Desktop/rootless lanes, remaining performance/load and complete M0–M4 release qualification. D100 explicitly waives further Linux x86_64 validation. Step Functions API/ASL/nested/callback/persistence and current-host Native qualification are implemented as recorded below. The execution ledger distinguishes implemented foundations from full phase exits.
+
+The [survey](../docs/research/survey-stepfunctions-lambda-container-runtime.md) validates documentation, not a working relay. Existing [Cargo Lambda evidence](../docs/research/spike-cargo-lambda-runtime-execution.md) establishes the bootstrap protocol but cannot close Docker/platform risks. P0 must precede production implementation. P0 subsequently initialized the pinned vendor tree and inspected the specifically cited AWS-validated nested test/snapshot pairs; no complete upstream interpreter review is claimed.
+
+```text
+┌─ P0 evidence ──────────────────────────────────────────────────────┐
+│ relay/RIC/platform spike │ protocol fixtures │ source/deps audit  │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼
+┌─ shared contracts, landed before consumers ────────────────────────┐
+│ revision/artifact enum │ invocation handle/cancel │ scope/errors    │
+│ RuntimeSession + transport │ supervisor ownership │ budget schema  │
+└───────────────┬──────────────────────────────┬─────────────────────┘
+                ▼                              ▼
+┌─ P1 / M0 ────────────────────┐   ┌─ P2 foundations ────────────────┐
+│ image resolver + Docker pool │   │ Smithy API + registry + compiler│
+│ relay + provider lifecycle   │   │ actor/timer/history spine       │
+└───────────────┬──────────────┘   └──────────────┬───────────────────┘
+                └────────────────┬───────────────┘
+                                 ▼ P2 closes M1: real Lambda tasks
+┌─ P3 / M2 ──────────────────────────────────────────────────────────┐
+│ frame scheduler → Parallel/Map → child start/subscription/.sync    │
+└─────────────────────────────┬──────────────────────────────────────┘
+                              ▼ P4 / M3: token registry + callbacks
+┌─ P5 / M4 ──────────────────────────────────────────────────────────┐
+│ ZIP containers │ snapshots/shutdown │ platform + fault + IaC gates │
+└───────────────────────────────────────────────────────────────────┘
+```
+
+## 2. Effort model
+
+Execution priority update (2026-10-26, explicit user direction): defer further Docker-image work and advance the Step Functions API/compiler/engine and subsequent workflow features first. P2 protocol, registry and pure semantics do not require Docker readiness. Qualify LambdaTaskPort against existing real execution backends while preserving the final real-image acceptance requirements. Do not mark M0/M1–M4 complete until their original image/platform gates are backfilled. The image-pin journal checkpoint was preserved while those subsequent workflow components were implemented. After their functional, persistence and current-host native qualification below, Docker work resumed: D39 durable pin recovery, D76 daemon binding, D77 namespace composition and D78 controlled pulls now form the startup dependencies.
+
+| Phase | Outcome | Engineering days |
+|---|---|---:|
+| P0 | Resolve load-bearing risks |4–6|
+| P1 | Close M0 |12–17|
+| P2 | Close M1 |15–22|
+| P3 | Close M2 |10–15|
+| P4 | Close M3 |6–9|
+| P5 | Close M4 |9–14|
+| Total | Complete this specification set |56–83|
+
+One developer plus 25% calendar overhead gives 14–21 weeks. Estimates explicitly include test/error/cleanup work; they are not benchmarks or guarantees. Independent fixture preparation can overlap design work, but API/adapter contracts and cancellation semantics must stabilize before consumers. Do not count theoretical parallelism as completed evidence.
+
+## 3. P0 — Evidence and risk retirement
+
+| Task | Deliverable | Contract | Days |
+|---|---|---|---:|
+| 0.1 | Reproducible isolated relay spike; Docker attach framing/EOF, netns sharing, official RIC, unprivileged limits and owned cleanup | [Lambda §§1–5](./rustack-workflows-20-lambda-runtime-design.md) |1–2|
+| 0.2 | Semantic fixture catalog and memo: input equality, data null/missing, intrinsic/Choice edge cases, history event shapes, nested result/date types, boundary error matching | [ASL](./rustack-workflows-30-asl-design.md), [verification §1](./rustack-workflows-70-verification-plan.md#1-evidence-and-oracle-policy) |1–2|
+| 0.3 | Pin official SFN model commit/hash and chosen SDK/fixture-image versions; prove numeric timestamp generator compatibility and dependency feature/security status | [API §1](./rustack-workflows-10-api-design.md#1-protocol-and-crate-boundaries) |1|
+| 0.4 | Record measured spike outcomes, amend decisions/design/profile and recalibrate estimates; resolve incompatible assumptions | [decisions](./rustack-workflows-99-decisions.md) |1|
+
+Artifacts: [relay spike](../docs/research/spike-lambda-container-relay.md) and [semantic oracle](../docs/research/spike-stepfunctions-semantic-oracle.md), with retained runnable probes, fixtures and exact commands/environment. Both memos now exist and are indexed. Spike-only automation belongs in Makefile if retained in the repository; no production workaround is hidden in the experiment.
+
+**Exit:** actual relay+RIC execution and failure cleanup pass on at least Linux amd64 and macOS arm64; Linux arm64 lane is provisioned; source/fixture provenance is recorded; no unresolved question can change the selected public contract. Cloud differential evidence may remain unavailable only under the verification plan's explicit narrower-evidence policy. A failed spike requires a design amendment before P1.
+
+## 4. P1 — Runtime contracts and real Image Lambda, closes M0
+
+| Task | Strict dependency order | Contract | Days |
+|---|---|---|---:|
+| 1.1 | Land validated artifact/revision enum, full ImageConfig/ephemeral propagation and cancellable invocation handles; adapt HTTP and existing backends without behavior regressions | [Lambda §§1–2](./rustack-workflows-20-lambda-runtime-design.md), [ports](./rustack-workflows-40-integrations-design.md#1-internal-ports-and-dependency-direction) |3–4|
+| 1.2 | Extract RuntimeSession state; add bounded relay codec/server artifact, socket client and startup probes | [Lambda §3](./rustack-workflows-20-lambda-runtime-design.md#3-runtime-api-and-relay-transport) |3–4|
+| 1.3 | Add image resolution/digest records, Pending/update lifecycle, deployment workers, revision publication and pool/environment actors | [Lambda §§2–5](./rustack-workflows-20-lambda-runtime-design.md), [configuration](./rustack-workflows-60-operations-design.md) |3–4|
+| 1.4 | Wire provider/config/capabilities, remove obsolete Docker rejection branches, implement cleanup/quarantine/reconciliation and L01–L09 | [verification §2](./rustack-workflows-70-verification-plan.md#2-required-test-matrix) |3–5|
+
+Add appropriate Makefile fixture-image/runtime build and `test-lambda-docker` targets. Update workspace dependencies/features once, auditing bollard and the relay artifact. Remove obsolete fallback branches rather than deprecating unavailable execution paths. Keep default disabled, Auto and Native/Squib behavior explicit.
+
+**Exit:** ordinary SDK invokes a real image on the recorded [P0 functional lanes](../docs/research/spike-lambda-container-relay.md) (macOS arm64 host with native arm64 VZ and emulated Linux amd64/QEMU Docker environments), returns computed output, distinguishes failures, preserves published code across updates, and cleans/quarantines every failed allocation under bounded ownership. This functional milestone does not qualify native-x86/reference performance, Docker Desktop/rootless or the complete M4 platform matrix. Existing Lambda quality gates and `make test-lambda-boundaries` pass, including [runtime §7.1](./rustack-workflows-20-lambda-runtime-design.md#71-strict-production-boundary-closure-b03) typed authentication error propagation and method-specific Errors docs. No requirement is satisfied using a noop/echo executor.
+
+## 5. P2 — API, compiled semantics and sequential engine, closes M1
+
+| Task | Strict dependency order | Contract | Days |
+|---|---|---|---:|
+| 2.1 | Implement protocol-aware numeric timestamp generation with required/optional/fractional/negative tests; import pinned model/config, generate model/HTTP, add service routing and feature/settings/health registration; registry/revisions/names/tags/read views | [API §§1–5](./rustack-workflows-10-api-design.md) |3–4|
+| 2.2 | Build bounded strict compiler, scoped IR, Path/intrinsic evaluators and exact data transformations against fixtures | [ASL §§1–2](./rustack-workflows-30-asl-design.md) |4–6|
+| 2.3 | Execution actor/timer/generation/history spine, six sequential states, Retry/Catch/deadlines and shutdown ownership | [ASL §§3–4](./rustack-workflows-30-asl-design.md), [API §6](./rustack-workflows-10-api-design.md#6-history-and-pagination) |4–6|
+| 2.4 | Binary Lambda bridge, direct/optimized results/errors, Rust SDK+boto3 coverage and complete A01–A13/I01 | [integrations §3](./rustack-workflows-40-integrations-design.md#3-lambda-requestresponse) |4–6|
+
+Add `codegen-stepfunctions`, `test-stepfunctions` and a sequential `smoke-workflows` target. Compiling a not-yet-implemented Parallel/Map/callback definition returns a precise unavailable-profile diagnostic until its milestone. Model presence alone does not advertise execution support.
+
+**Exit:** PRD example executes its real image through ASL; failure, Retry/Catch, timeout and history semantics pass independent fixtures through both SDK clients. Duplicate Start/update races and forged pagination are tested. Stop cannot be starved by a tight loop.
+
+## 6. P3 — Structured fan-out and nested jobs, closes M2
+
+| Task | Dependency order | Contract | Days |
+|---|---|---|---:|
+| 3.1 | Extend frame scheduler for lazy branches/items, stable result ordering and global/per-execution frame budgets | [ASL §5](./rustack-workflows-30-asl-design.md#5-parallel-and-inline-map) |3–4|
+| 3.2 | Parallel/Map Retry/Catch, legacy normalization, sibling cleanup and P01–P03 | [ASL §5](./rustack-workflows-30-asl-design.md#5-parallel-and-inline-map) |4–6|
+| 3.3 | [Atomic child registry port](./rustack-workflows-40-integrations-design.md#41-atomic-child-execution-registry-port), then ASL child start/subscribe/cancel contracts, .sync/.sync:2 output mapping, admission/depth rules and I02–I05 | [integrations §4](./rustack-workflows-40-integrations-design.md#4-child-workflows-and-sync) |3–5|
+
+**Exit:** all eight state types run; nested workflow example waits for actual child Lambda completion; string/JSON result distinction, fast-child races, cancellation, deadlock saturation and out-of-order fan-out tests pass. Unsupported service suffixes still reject.
+
+The first P3 dependency is the structured scope compiler in [ASL§1.2](./rustack-workflows-30-asl-design.md#12-structured-scope-compilation-and-staged-runtime-admission): shared bounded compilation, normalized Map IR and lexical branch indexes. This dependency alone does not close3.1 or enable the service profile. Next implement the [structured frame-effect protocol](./rustack-workflows-30-asl-design.md#33-deterministic-structured-frame-effect-protocol), then implement the [bounded scheduler/retirement protocol](./rustack-workflows-30-asl-design.md#34-bounded-frame-scheduler-and-retirement-protocol) and compose it with the [asynchronous owner/commit fence](./rustack-workflows-30-asl-design.md#35-asynchronous-structured-resource-owner-and-commit-fence). The explicit `start_structured` path composes the frame owner; the [structured service binding](./rustack-workflows-30-asl-design.md#36-structured-service-composition-and-capability-binding), validated frame/result settings and both SDK lifecycle/history gates now enable real eight-state API execution. Sequential library defaults remain separate. The registered nested ASL binding (§4.2/D61) now implements job integration3.3 and qualifies I02–I05 through the real registry and actual SDK/Native lifecycle gates. The complete release still requires callbacks, persistence, security remediation and the deferred image/platform gates.
+
+## 7. P4 — Callback tasks, closes M3
+
+| Task | Dependency order | Contract | Days |
+|---|---|---|---:|
+| 4.1 | [Owned callback registry foundation](./rustack-workflows-40-integrations-design.md#51-owned-callback-registry-foundation), then ASL token context/provenance and injected-token history redaction | [integrations §5](./rustack-workflows-40-integrations-design.md#5-callback-and-heartbeat-m3) |2–3|
+| 4.2 | Lambda callback adapter, SendTask* routing, heartbeat/Task timers and cancel/retry invalidation | [integrations §5](./rustack-workflows-40-integrations-design.md#5-callback-and-heartbeat-m3) |2–3|
+| 4.3 | Actual callback-capable image fixture, C01–C03, token exposure scans and race coverage | [verification](./rustack-workflows-70-verification-plan.md) |2–3|
+
+**Exit:** real handler callbacks work before/after Lambda return; Lambda failure cannot be hidden; old tokens never settle a new attempt; tracing/history persistence do not contain injected plaintext token values.
+
+## 8. P5 — Persistence and consuming-project qualification, closes M4
+
+| Task | Dependency order | Contract | Days |
+|---|---|---|---:|
+| 5.1 | provided.al2023 Docker ZIP execution and same-artifact fixture | [Lambda §6](./rustack-workflows-20-lambda-runtime-design.md#6-responses-errors-and-zip-support) |2–3|
+| 5.2 | Compression/CBOR prerequisites, workflow quiescence ordering, versioned service archives, image reference metadata and atomic restore validation | [operations §3](./rustack-workflows-60-operations-design.md#3-shutdown-cancellation-and-snapshots), [archive boundary§4.2](./rustack-workflows-60-operations-design.md#42-bounded-cbor-import-boundary) |3–4|
+| 5.3 | Required arm64/Desktop/rootless lanes under D100, server-in-container topology, fault/load cases, SDK service callbacks, IaC lifecycle and L10/L11/O01–O05 | [verification §§2–5](./rustack-workflows-70-verification-plan.md) |3–5|
+| 5.4 | Final documentation/capability reconciliation, exact required-suite manifest and independent implementation review against this spec | [PRD goals](./rustack-workflows-00-prd.md#3-users-and-measurable-goals) |1–2|
+
+The next required platform dependency is [rootless qualification D103](./rustack-workflows-58-rootless-platform-design.md): provision/attest an isolated user daemon, then run the full resource inventory and effective kernel policy proofs. Bootstrap alone does not close5.3. TaskCreate is unavailable; this ledger tracks the dependency. Desktop, dedicated-reference, remaining load/recovery and final release requirements remain active.
+
+[D104 resource consumption](./rustack-workflows-58-rootless-platform-design.md#6-rootless-resource-execution-d104) follows the implemented D103 bootstrap: bounded private Unix transport, immutable fixture import, both unchanged kernel resources, then complete inventory/topology/performance consumers. Preserve the original platform exit; do not treat this dependency ordering as a narrower acceptance profile.
+
+Add `verify-workflows` and extend existing snapshot/smoke targets rather than introducing parallel scripts. Record measured performance and platform limitations. Update existing service documentation only with features actually verified.
+
+D101's [direct Linux arm64 measurement](./rustack-workflows-70-verification-plan.md#52-direct-linux-arm64-pure-workflow-measurements-d101) dependency is implemented and independently reviewed before image performance: spec polish, exact artifact/inventory runner and pure fixture, actual Linux/host measurements, standard/strict/Native/security gates and independent review all pass. D101 alone does not close the dedicated reference or full5.3 acceptance.
+
+**Exit:** every required verification row passes, no required lane silently skips Docker, all repository Rust/dependency checks relevant to the implementation pass, and unresolved correctness/security findings are fixed. Snapshot behavior and local compatibility limitations are user-visible. This closes the requested work.
+
+## 9. Why this order is necessary
+
+Cancellation/revision contracts precede both the Docker executor and workflow bridge; otherwise stopping a Task leaks resources or reuses mutable code. Compiler and history semantics precede Parallel/Map so branch machinery has one data/error contract. Child subscription/admission rules precede `.sync` so fast completion cannot be missed and parents cannot block child capacity. Snapshot integration follows fully settled lifecycle semantics, avoiding archives that appear resumable while silently replaying side effects.
+
+Implement phases with the repository's impl workflow and its independent review requirement. Specification publication and P0 feasibility evidence alone do not establish production runtime acceptance.
+
+## 10. Cross-references
+
+- ← [survey](../docs/research/survey-stepfunctions-lambda-container-runtime.md), [PRD](./rustack-workflows-00-prd.md)
+- ↔ [roadmap](./rustack-workflows-80-roadmap.md), [verification](./rustack-workflows-70-verification-plan.md), [decisions](./rustack-workflows-99-decisions.md)
+
+## 11. Implementation execution record
+
+The complete implementation objective includes P0–P5. This ledger records chronological evidence under the current PRD scope; D100 explicitly narrows Linux x86_64 validation at the user’s request. Entries describe their chronological checkpoint; later entries supersede earlier pending/deferred labels, including the historical Docker deferral. TaskCreate is unavailable in this environment; task rows below provide the phase tracking required by the impl workflow.
+
+| Task | State | Evidence / next action |
+|---|---|---|
+| 0.1 | Evidence complete | Real official RIC image execution, warm reuse, handler failures, cgroup/nonroot/rootfs checks, busy-handler cancellation, attach EOF comparison and label reconciliation passed on arm64 VZ and Linux amd64/QEMU. Native x86/Desktop/rootless qualification remains M4. |
+| 0.2 | Evidence complete | 48 independent semantic/protocol expectations; four offline SDK serializer/parser checks; pinned AWS-validated nested shapes and error corrections. No interpreter/cloud-differential execution is claimed. |
+| 0.3 | Evidence complete | Model commit/hash and 37 operations pinned; six generated files compile in the standalone experiment. Numeric timestamp failure independently reproduced and mandatory generator remediation assigned task 2.1. Rust updated to current stable 1.99.1. |
+| 0.4 | Complete | Independent final recheck confirms W07–W09 fixed, zero owned containers on both daemons, and no further P0 correctness finding. W01–W06 contracts are corrected; production consumers remain in their assigned phases. Full workspace build/test/fmt/Clippy/rustdoc pass; unchanged baseline audit/deny advisory failures are B01 and must be fixed in P1 dependency work. |
+| 1.1 | Foundation implemented and reviewed; P1 gates remain open | Resource/revision capture, closed artifact/architecture types, shared ZIP ownership, validated immutable image metadata, early settings preflight and transactional staging rollback are implemented. Arc ExecutionRevision and cooperative InvocationHandle/WorkSupervisor now preserve attempts, deadlines, cleanup ownership and bounded admission across Native/Squib. Independent W13–W15 findings fixed/rechecked. Workspace:1,767 passing tests; Lambda:215 unit tests, five real Native fixture tests and native provider/DryRun regressions pass. Actual Squib VM regression is not claimed. Baseline B01/B03 are now closed by the security and six-library strict passes in §§7.1–7.2; remaining P1 runtime acceptance still applies. |
+| 1.2 | Runtime contracts implemented/reviewed; Docker consumer/probe gates remain | Protocol4da7df3, shared actor2c50c2d, Native migration95282c4 and relay6779f93 are committed. The ordered host ControlClient now shares retained stream workers with the relay, validates causal attempt/cancel/close messages and poisons uncertain sends. Workspace:1,867 tests; runtime:97 tests/47 doctests and strict boundary Clippy; actual Linux entry-point Clippy passes. Five explicit Docker qualification tests pass on each arm64 VZ and amd64/QEMU daemon, including production ControlClient→real relay→official RIC computed warm calls, FunctionError, busy cancellation and independent stream/container cleanup. W27–W29 are fixed/rechecked. Startup deployment/resource probes still require the task1.3–1.4 Docker consumer; no production executor/provider acceptance yet. |
+| 1.3 | In progress | Pinned transport study/§3.6/D19 define generated-type reuse, bounded Unix HTTP/upgrade IO, retained handoff and reserved cleanup slots. Shared core JSON preflight is implemented/reviewed before the Docker model consumer:21 new parser tests, two512-case properties, four core doctests and strict core boundary Clippy pass. Workspace:1,888 tests; audit remains unchanged B01. DockerWire now implements typed management and strict attach with15 fake-daemon/framing tests, retained IO/driver supervision and separate lifecycle-wait capacity (W32/D20). Real near6MiB official RIC wire tests pass on arm64 VZ and amd64/QEMU; independent review finds no remaining in-slice issue. Workspace1,903 tests and standard gates pass. Read-only ImageResolver and retained validated defaults/plans now bind platform inspection to captured addressable parent IDs, preserve selected manifests, verify snapshot fingerprints and support explicit platform create.61 additional tests and corrected two-case real Docker suites pass; independent W33–W38 fixes are rechecked. Workspace1,964 tests and standard gates pass. Owned ImageLeaseManager/PinnedImage preparation now preserves private-alias availability, proves unpacked quota, retains uncertain mutations and joins phase-aware cleanup/recovery.33 additional cases pass; real two-case suites on both retained daemons consume leases through actual container execution/cleanup. Independent W39–W42 fixes and final recheck pass. Workspace1,997 tests and standard gates pass. Typed deployment state/store settlement and leased invocation capture are implemented and independently reviewed (§2.10); initial/update failures, stale resource/revision/generation results, rollback and metadata-only restore are covered by25 additional cases (346 core tests,92 doctests). Workspace2,022 tests and standard build/test/fmt/Clippy/rustdoc gates pass; Native provider/DryRun regressions pass without claiming the gated Squib case as VM evidence. W43–W46 fixes are reviewed; strict B03 and dependency B01 remain open. Retained ImageDeploymentManager and provider Image admission/status/revision wiring are implemented/reviewed (§2.11).20 core additions and one model wire-field case pass (366 core tests,101 doctests; workspace2,043 tests). Actual Rust SDK/HTTP revision/412 regression passes separately from Native provider execution tests. W47–W50 fixes pass. B04 is now closed by explicit side-effect-free code-update DryRun, strict deployment DTOs and bounded borrowed-blob JSON decoding (§2.12).29 additional core cases pass (395 core tests,101 doctests; workspace2,072 tests,401 gated cases), and actual SDK/HTTP validation and revision tests pass. W51–W53 fixes/recheck pass. B03 strict closure is independently reviewed (§7.1), with all six production libraries passing without new ignores; two added HMAC-vector tests preserve signing semantics. Final workspace2,074 tests and standard gates pass; the boundary target passes659 unit tests/165 doctests and strict Clippy for all six libraries. B01 dependency closure is implemented/reviewed (§7.2/D27, W57–W59): nine ZIP regressions, workspace2,083 tests,833 boundary tests/doctests, green standard/strict gates, clean audit and all deny checks. Regional SDK/HTTP and Native provider regressions pass. Production Docker execution is still disabled. Directory ownership/previous-run reconciliation, allowed pulls, remaining stream/network/probe consumers and environment/pool integration remain required. |
+| 1.3 directory namespace | Implemented/reviewed; runtime consumers remain | DirectoryLease binds permanent nonreplaced file locking, durable checksummed owner/fresh run and trusted descriptor-relative filesystem operations to all image scopes/pins/jobs/recovery. W60–W62 fixes independently rechecked; 38 ownership cases plus abandoned image-owner cleanup pass. Workspace2,122 tests, core443 tests/103 doctests, boundary874 unit/doc passes, all standard/strict/audit/deny gates pass. Both real two-case wire suites pass on arm64 VZ and amd64/QEMU; post-test owned containers/internal aliases are empty. This does not prove previous-run reconciliation, Linux-host lock qualification or Docker executor readiness. |
+| 1.3 function logs | Implemented/reviewed; environment integration remains | Output-only attach and FunctionLogs retain partial framing across snapshot traffic, bounded independent rings/combined4KiB binary tail, fair service, early socket closure and cached joined shutdown (§3.7/D29).18 focused tests pass; W63/W64 fixes independently rechecked. Core461 tests/107 doctests, workspace2,140 tests, boundary896 unit/doc passes and all standard/strict gates pass. Both real two-case wire suites receive deliberate handler stdout/stderr markers independently from computed results and join logs during cleanup. No new dependency/version. Per-invocation log attribution, environment integration and complete executor acceptance remain pending. |
+| 1.3 allocation policy | Implemented/reviewed; lifecycle owner remains | EnvironmentPlan fixes both create bodies to captured identities/platforms/revision, retained directory/image leases, validated policy and authoritative unique-key environment (§4.2/D30).54 new cases pass; W65–W67 fixed/rechecked. Core515 tests/116 doctests, workspace2,194 tests, boundary959 unit/doc passes and standard/strict/audit/deny gates pass. Both real two-case wire suites now consume plans for normal/empty ImageConfig execution, with actual resource/tmpfs/privilege/env assertions; all five shared runtime Docker regressions also pass per daemon. No production pool/executor or historical reconciliation readiness is claimed. |
+| 1.3 environment lifecycle | Implemented/reviewed; pool/executor integration remains | EnvironmentManager retains count/memory/plan/container/IO ownership above supervised workers, including uncertain creates, cancelled callers, panic recovery and quarantine (§4.3/D31). W68–W77 fixes and final independent recheck pass. Twenty scripted lifecycle cases plus one runtime failure-precedence regression pass. Core535 unit tests/127 doctests, workspace2,215 tests/403 gated cases, boundary800 unit tests/191 doctests and all standard/strict/audit/deny gates pass. Actual owner2, wire2 and shared runtime5 cases pass on each arm64 VZ and amd64/QEMU daemon; final owner2 cases are rechecked after the ready-reply cancellation fix. Both daemons have no owned containers/internal aliases afterward. Exact delivery-based handler timeout, invocation log attribution, warm/LRU checkout, historical reconciliation/pulls/network/probes and final executor wiring remain required before M0. |
+| 1.3 warm pool | Implemented/reviewed; executor composition remains | §4.4/D32 implement one bounded accepted FIFO queue, canonical validated allocation identity, receipt-gated warm return, independent worker-side receipt deadline, one-at-a-time capacity LRU eviction, zero/excess retention and retained panic/shutdown retirement. W78–W81 fixes and final independent recheck pass. Eighteen scripted pool cases pass. Core553 unit tests/132 doctests; workspace2,233 tests/405 separately gated; strict boundary818 unit tests/196 doctests (1,014 total). Standard build/test/fmt/Clippy/rustdoc, strict production checks and fresh audit/deny pass. Both arm64 VZ and amd64/QEMU explicitly pass four owner/pool real-RIC cases, including warm1/2, revision/capacity eviction, FunctionError replacement counter1 and observed running-handler abandonment; no owned containers/internal aliases remain afterward. Exact delivery-based handler timeout/log attribution and production Executor/provider/startup composition remain required. |
+| 1.3 delivery clock | Implemented/reviewed; executor envelope mapping remains | §3.8/D33 implement validated relative handler budgets, consumed monotonic receipts/effective HTTP headers, strict earlier-handler versus outer/tie classification, protocol-v2 compatibility/timeout correlation, immutable captured override and joined environment retirement; Native attaches the shared clock and preserves independent initialization expiry. W82–W84 fixes and final independent recheck pass. Runtime119 unit tests/51 doctests; core553 unit tests/132 doctests. Workspace2,255 tests/406 gated; strict boundary839 unit tests/199 doctests (1,038 total); standard build/test/fmt/Clippy/rustdoc, strict production, audit and deny pass. Timeout target131 passes includes12 real Native fixtures. On each arm64 VZ and amd64/QEMU daemon, owner/pool5 + wire2 + shared runtime5 cases explicitly pass (12 per daemon); captured3s defeats caller-supplied900s, confirmed retirement releases capacity, replacement counter1 and no owned resources afterward. Six actual Native/DryRun provider scenarios pass separately; the gated Squib case is not VM evidence. Per-invocation log attribution and final Executor/provider/startup composition remain required before M0; P2–P5 remain pending. |
+| 1.3 invocation logs | Implemented/reviewed; Executor/provider response composition remains | §3.9/D34 separate bounded per-attempt windows from diagnostic rings, with opaque revocable capabilities, actor-retained consumption receipts/deadlines, exact ownership, pinned partial reads and Tail/None integration. W85 self-review correction and final independent recheck pass.36 log cases (18 added) pass; core571 tests/134 doctests; workspace2,273 tests/407 gated; strict boundary857 unit tests/201 doctests (1,058 total). Standard build/test/fmt/Clippy/rustdoc, strict production, audit/deny pass. Each arm64 VZ and amd64/QEMU daemon explicitly passes owner/pool6 + wire2 + shared runtime5 cases (13 per daemon), including real requested/uncaptured/silent log windows with warm counters1..4. Post-run owned resource queries are empty. Observed-stream timing limits remain explicit; B05 and final Executor/provider/base64 response wiring remain mandatory before M0. |
+| 1.3 post-bootstrap initialization | Implemented/reviewed; full M0 remains open | Shared bounded InitError classification preserves initialization failure after an abandoned BootstrapReady poll, including an offered-but-unconsumed first event. Four actual session/HTTP/relay/client/worker composition regressions prove Idle/Busy32KiB boundaries, no active reply before a scripted known-container absence barrier, redaction and joined IO/API retirement. Independent read-only review has no findings. Environment target25 cases, workspace2,277 tests/407 separately gated, strict boundary1,062 unit+doc passes/13 Docker-gated; build/test/fmt/Clippy/rustdoc and strict production checks pass. Evidence: `/tmp/rustack-workflows-b05-{environments,build,tests,fmt,clippy,docs,boundaries}.log`. B05 closed; this is not production Executor/startup or actual Docker acceptance. |
+| 1.3 supervised pool invocation | Implemented/reviewed; Executor consumer remains required | §4.5/D35 expose synchronous start, cancel-safe response wait and separate resumable cancel_and_wait with an independent cleanup deadline. Per-call settlement senders stay beside Retirement records above JoinSet through worker/root recovery. Nine new regressions,27 total pool cases, prove delayed/expired cleanup, waiter loss, no-allocation rejection, worker/root failure, warm success and missing-producer uncertainty. W86 observer rejection cleanup is fixed; final independent review has no remaining finding. Workspace2,286 tests/408 separately gated; strict boundary870 units+204 docs (1,074 total)/14 Docker-gated; standard build/test/fmt/Clippy/rustdoc and strict production checks pass. Each arm64 VZ and amd64/QEMU daemon explicitly passes7 owner/pool real-image cases, including per-call awaited retirement before global shutdown, container404 and replacement counter1 while admission stays open. Post-run owned containers/internal aliases are absent. This does not close Executor/provider/startup or M0 acceptance. |
+| 1.3 Docker Executor/provider | Implemented/reviewed under trusted runtime injection; production startup remains | §4.6/D36 consume one PoolInvocation with independent cleanup settlement, immutable plan/metadata validation, raw outcomes, resolved version, requested alias ARN and one base64 tail encoding. W87–W91 are fixed/rechecked.15 Executor +16 handler cases pass, including held reserved concurrency, expired cleanup/failed quiescence and resumed physical retirement. Workspace2,313 tests/409 separately gated; core611 units/141 docs; strict boundary897 units+208 docs (1,105 total)/15 Docker-gated; standard/strict/audit/deny pass. Each arm64 VZ and amd64/QEMU daemon passes actual boto3→HTTP→provider→Docker deploy/publish/alias/Invoke/error/timeout/replacement plus seven existing owner/pool cases (eight per daemon). Controlled fixture readiness is not startup/probe/native-x86 evidence; post-run owned containers/internal aliases are absent. |
+| 1.3/1.4 startup probes | Implemented/reviewed; no readiness grant | §4.7/D37 validate exact user bridge/none selections, bind full IDs, and execute the pinned Rust probe under retained EnvironmentManager ownership. Private cgroup namespaces and process root-membership checks cover v1/v2 parser semantics; exact kernel limits/flags, scoped proof matching, caller abandonment, independent cleanup and final deadline/live-input checks are enforced. W92–W94 closed;57 focused cases pass. Workspace2,370/411 gated, boundary954 units+217 docs (1,171 total)/17 gated; standard/strict/audit/deny pass. Each arm64 VZ and amd64/QEMU cgroup-v2 daemon passes17 distinct actual probe/SDK/pool/wire/runtime cases; scoped resources and the two dedicated probe bridges are removed. Actual v1/native-x86, historical effects, pulls, endpoint/config/capability coordinator acceptance remain open. |
+| 1.3/1.4 historical container effects | Implemented/reviewed; other mutation classes remain | §4.8/D38 add bounded durable per-container intents before creation and known IDs before deletion. The restart pass preserves unknown absence, blocks unresolved relays, validates exact identities and resumes after cancellation. W95–W96 are fixed and independently rechecked.24 new scripted/unit cases pass, including create-before-effect and durable-erase reservation barriers. Workspace2,394/412 gated; boundary978 units+218 docs (1,196 total)/18 gated; standard/strict/audit/deny gates pass. Each arm64 VZ and amd64/QEMU daemon passes11 distinct actual recovery/pool/SDK/wire cases; scoped container/private-alias queries are empty afterward. Actual directory reacquisition and historical pair retirement pass on both. This does not cover historical image aliases or enable production startup. |
+| 2.1 generated model/timestamps | Implemented/reviewed; HTTP/registry still pending | API§1.1/D40 generates37 official operations from312 pinned shapes with exact numeric required/optional epoch dates and strict DTO policy.5 generator cases,34 model cases,1 doctest, regeneration consistency and strict model/tool checks pass. W97–W100 are fixed/rechecked. Final current-worktree workspace2,447/414 gated, including the retained deferred image checkpoint; build/test/fmt/Clippy/rustdoc, root475/tool29-crate audit and both deny graphs pass. This is protocol/model evidence, not API/engine or real-image workflow acceptance. |
+| 1.3/1.4 durable image pins | Implemented/reviewed prerequisite; production startup remains gated | Runtime§2.13/D39 add bounded persistent intent/commitment and container-ordered historical alias recovery, preserving the container wire format. W216/W218 are fixed/rechecked; W217 same-daemon durable binding is now consumed by D76 below; production startup still must compose its remaining proofs. The targeted40 pin/owner/recovery cases and legacy24 recovery regressions pass. Each retained arm64 VZ and emulated amd64 daemon passes13 actual image-recovery/executor/pool/wire/container cases, with empty scoped container/private-alias queries afterward. Full qualification is recorded in the resumed D39 work item below. No ordinary CLI Docker readiness is claimed. |
+| 1.3/1.4 daemon identity | Implemented/reviewed prerequisite; production startup remains gated | Runtime§4.9/D76 closes W217 with persisted engine identity, atomic empty-journal first binding, exact-lease runtime ports and same-connection identity fences. W220/W221 are fixed/rechecked;37 new ordinary cases, actual two-daemon binding in both directions and13 actual consumer cases per retained daemon pass. Plain/feature workspace3,574/3,685, Native15/SDK10/HTTP SDK1 and standard/strict/security gates pass. The coordinator must still consume all startup/historical/pull/network proofs before advertising Docker. |
+| 1.3/1.4 recorded namespace | Implemented/reviewed prerequisite; production readiness remains gated | Runtime§4.10/D77 composes recorded container-before-pin cleanup and complete bounded observed inventories without orphan adoption. Unknown/current-run/unrecorded/oversized/late observations block. W222/W223/W224 are fixed/rechecked;44 new ordinary cases and3 actual namespace cases per retained daemon pass with the requalified13 owned consumer cases. Full standard/strict/native/security gates pass; the coordinator still must consume provenance, allowed pulls, endpoints and final release proofs. |
+| 1.3 controlled pull preparation | Implemented/reviewed prerequisite; ordinary startup remains gated | Runtime§2.14/D78 adds default-never/exact ifMissing policy, secret credentials, separate bounded pull scheduling, strict incremental progress and retained terminal ownership before full image/pin validation. W225–W228 are fixed/rechecked.55 pull regressions plus primary-shutdown regression pass; both daemons qualify initial cache-miss preparation and17 actual cases each, with zero final containers/private aliases. Standard/feature/strict/native/security gates pass. YAML auth-file/configuration and production startup/endpoint remain1.4 consumers. |
+| 1.4 Docker operator settings/private credentials | Implemented/reviewed prerequisite; ordinary startup remains gated | Operations§1.8/D79 extends shared keys/Docker budgets and adds pure typed settings plus retained four-worker no-follow private YAML loading. W229/W230 fixed/rechecked.84 focused cases,1,474 strict boundary passes and ordinary/feature workspace3,758/3,869 pass; both retained daemons consume a file-loaded anonymous policy in actual warm prepare/pull/pin cleanup. Production constructor/activation, endpoint/probe/reconciliation and original M0–M4 release remain consuming work. |
+| 2.1 typed HTTP transport | Implemented/reviewed; real core/registration pending | API§1.2/D41 implements18 typed ports, bounded envelopes/body/response, strict SigV4 service/region/target binding, exact DTO dates and accepted-command waiter isolation.56 unit tests, two nongated network tests, eight doctests, strict HTTP Clippy and four real signed boto3 calls pass. W101–W104 are fixed and independently rechecked. Current-worktree workspace2,505/415 gated, standard build/test/fmt/Clippy/rustdoc, audit and deny pass. No production fallback handler, main registration or engine acceptance is claimed. |
+| 2.2 compiled paths/payloads | Implemented; complete compiler remains | ASL§2.1.1/D42 supplies bounded immutable payloads/context, compiled paths, borrowed missing/single/selection and transactional result merge.75 unit tests (three512-case properties),12 doctests and strict production checks pass; W105–W107 corrections cover borrowed deep-tree rejection and numeric/depth/member context headroom. Standard workspace build/test/fmt/Clippy/rustdoc pass with2,580 tests/415 gated, including the retained deferred Docker checkpoint. New existing-dependency advisory findings are tracked as B06; audit/deny currently fail that baseline, with no ignores added. |
+| 2.2 compiled Choice predicates | Implemented/reviewed; state/compiler integration remains | ASL§2.4.1/D43 implements typed literal/Path comparisons, logical short-circuit, exact timestamp fractions, conservative numeric interoperability and bounded glob/shared budgets. Core125 unit cases/15 doctests and strict checks pass, including90 operator combinations and four independent Choice catalog cases. W108–W109 are fixed/rechecked. Shared float_roundtrip adds no external package/version. Final current-worktree standard workspace gates pass with2,630/415 gated; regenerated model/strict HTTP and signed SDK regressions pass. Complete compiler, transition selection and engine remain required; B06 stays open. |
+| 2.2/2.3 compiled Wait source | Implemented/reviewed; actor scheduling remains | ASL§2.4.2/D44 supplies four typed sources and pure supplied-clock duration resolution; no sleeping task or timer is created. Independent review reports no findings. Core166 unit cases/18 doctests and strict checks pass; standard current-worktree workspace gates pass with2,671/415 gated, including deferred Docker changes. Monotonic timer/generation/deadline/cancellation acceptance remains required; B06 stays open. |
+| 2.2 compiled expressions/intrinsics | Implemented/reviewed; template/pipeline/compiler remain | ASL§2.3.1/D45 implements all12 selected intrinsics, bounded winnow AST, format provenance, shared work/text/materialization budgets and fallible UUID source. W110–W111 are fixed/rechecked. Core242 unit cases/21 doctests and strict checks pass; standard current-worktree workspace gates pass with2,747/415 gated. Existing getrandom/uuid dependency edges add no package/version. B06 audit/deny remains open; actual template/compiler/actor integration is still required. |
+| 2.2 compiled templates/data flow | Implemented/reviewed; machine compiler remains | ASL§2.2.1/D46 supplies normalized templates, streaming prepared views and shared prepare/finish budgets preserving original input. Independent review reports no findings. Core270 unit cases/31 doctests and strict checks pass; standard current-worktree workspace gates pass with2,775/415 gated. Four independent pipeline fixtures and exact4,096/4,097 aggregate-node boundaries pass. No dependency change; B06 stays open. |
+| 2.2 sequential machine compiler/IR | Implemented/reviewed; actor/registry/bridge remain | ASL§1.1/D47 compiles six M1 state types, scoped indices, strict fields/graphs, original bytes, bounded diagnostics, static Lambda resource checks and recovery metadata. Independent review reports no findings. Core315 unit cases/66 doctests and strict checks pass; final current-worktree standard workspace gates pass with2,820/415 gated. Exact source/state/choice/compiled-node limits and two512-case properties pass. No dependencies changed; B06 stays open. This is compilation, not execution or endpoint acceptance. |
+| 2.3 sequential transition driver | Implemented/reviewed; actor/history/resource ownership remain | ASL§3.1/D48 supplies six-state transitions, raw-input retries/catch merging, injected clocks/entropy, parked Wait/Retry, opaque attempt IDs, exact deadline/Stop single settlement and explicit cancellation obligations. W112–W114 are fixed/rechecked. Core365 unit cases/89 doctests and strict checks pass; final current-worktree standard workspace gates pass with2,870/415 gated, including retained deferred Docker changes. New512-case control-order and exact payload/error/budget fixtures pass. No dependencies changed; B06 stays open. This driver performs no IO and does not establish async ownership/history/registry/real bridge or endpoint acceptance. |
+| 2.3 async supervisor/history/task port | Implemented/reviewed; registry/real bridge/main remain | ASL§3.2/D49 adds bounded actor/CPU/dispatch admission, fresh-driver registration, caller-independent watch control/read views, concrete synchronous task admission and result/cleanup separation, retained retired calls/ledger capacity, Drop-safe fallback/quarantine and official persistent history. W115–W117 fixed/rechecked. Core404 units/129 doctests and strict checks pass; final current-worktree standard workspace gates pass with2,909/415 gated. Exact25,000-event fill/drop,4MiB pages, terminal/global budget and CPU/actor/race/lifecycle regressions pass. Reuse three already-resolved dependency edges; audit/deny still fail unchanged B06. No registry/endpoint/real Lambda or image acceptance is claimed. |
+| 2.4 real Lambda binary bridge | Implemented/reviewed for Native; service/SDK acceptance remains | Integrations§1.1/D50 add owned Lambda submission before admission, independent resumable response/cleanup observers, external cancellation, bounded retained bridge workers/slots and typed direct/optimized mappings. W118–W122 fixed/rechecked; final independent review has no findings. Eleven controlled cases/six doctests and strict bridge checks pass; seven explicitly selected actual Native process cases pass, including FunctionError Retry/Catch, alias re-resolution, actual request IDs, handler-observed Stop/Task timeout with PID retirement, payload JSON types and function-owned Sandbox.Timedout. Shared strict boundary target passes1,228 unit/doctest cases; core404 units/132 docs. Final feature-enabled workspace build/test/fmt/Clippy/rustdoc pass with2,925/422 gated, including retained deferred Docker changes. No new external package/version; B06 audit/deny remains open. No main/registry/ordinary SDK or image qualification is claimed. |
+| 2.1/2.3 domain registry and captured resources | Implemented/reviewed; retained API preparation/pagination/main remain | API§3.1/D51 add bounded owned commands, scoped identities/roles/tags, shared revision/tag/record admission, serialized CRUD/Start/Stop, exact raw-input idempotency, secure retained entropy preparation, captured context/revisions, deletion/recreation, independent record/name expiry and Drop-safe resumable shutdown. W123–W130 fixed/rechecked. Core442 units/173 doctests and strict gates pass, including38 registry cases and a512-case identity property. Eight explicitly selected actual Native cases pass; the new registry→real Lambda scenario computes42/44 from separate revisions and reads old execution data after deletion. Final feature-enabled current-worktree build/test/fmt/Clippy/rustdoc pass with2,963/423 gated. Only two already-resolved dependency edges added; B06 remains open. No HTTP/pagination/ordinary SDK or image acceptance is claimed. |
+| 2.1/2.4 retained real API and stable pagination | Implemented/reviewed; main and real network SDK acceptance remain | API§1.3/§6.1/D52 add all15 real M1 action mappings, bounded owned preparation/response CPU work, root admission, captured-revision/publication-date projection and opaque256-bit query-bound cursors over shared charged snapshots. W131–W137 fixed/rechecked.19 API cases plus11 bridge cases/12 docs and strict checks pass; core445 units/177 docs. Nine actual Native cases pass, including in-memory Hyper HTTP→actual Lambda computed42, real request metadata and reversed cursor continuation after deletion. Six generator tests and35 model cases/one doctest preserve402/408/common errors and regeneration. Final feature-enabled current-worktree build/test/fmt/Clippy/rustdoc pass with2,986/424 gated; no external package/version change. Root B06 remains open while standalone tool audit/deny pass. Main/config/health/composite shutdown and ordinary SDK network flows remain required; no production gateway availability or final image acceptance is claimed. |
+| 2.1/2.4 real gateway composition | Implemented/reviewed; ordinary SDK acceptance remains | Operations§1.6/§3/D53 wire the opt-in target-family-first router,20 validated supported YAML quotas, actual-provider capability selection, admission-independent health and unique resumable shutdown controllers. Full/pure binary qualification covers natural/forced drain, dropped/expired observers, snapshot limits and actual socket routes/timeouts. W138–W145 fixed/rechecked;31 API/bridge units,13 CLI examples,75 full and55 pure binary tests,445 core units/180 docs, nine actual Native scenarios and full/pure strict production checks pass. Final feature-enabled workspace build/test/fmt/Clippy/rustdoc pass with3,003/424 gated. The checks are retained in Makefile. No new dependency/version, ordinary SDK proof or final Docker/platform acceptance. |
+| 2.4 ordinary SDK feature acceptance | Implemented/reviewed; B06 release gate and later milestones remain | Verification§3/D54 add separate real strict-auth binary/Native processes for Rust SDK and boto3. Both execute17 independent case expectations and all15 M1 actions, including real computation/error/timeout, idempotency/revision gates, typed dates and stable causal history. A third explicit resource case proves actual Python timeout/reaping including malformed PID barriers. W146–W152 fixed/rechecked. New aws-sdk-sfn1.123 and required aws-config1.13/shared SDK cohort are checked against existing consumers; no production SDK dependency or new security ignore. Final feature-enabled workspace build/test/fmt/Clippy/rustdoc pass with3,004/427 gated; full/pure strict checks and nine actual Native cases pass under the coherent SDK dependency cohort. Fresh audit/deny retain only the known B06 findings. Exact evidence is recorded in the review; no image/platform/cloud-differential acceptance is claimed. |
+| 1.4 and final M0–M4 release | Pending | Ordinary CLI Docker startup/platform, image ZIP/handler networking, IaC, Linux reference and final release acceptance remain required. Selected P2–P5 workflow implementation and Native qualification are recorded in the continuation rows below. |
+
+P0 measurements validate architecture feasibility, not production throughput or reduced delivery estimates. Keep the existing P1–P5 estimates until an implemented executor/engine provides calibration. B04 side-effect-free code-update DryRun and bounded request validation are implemented and independently reviewed with live SDK evidence. The task1.3 persistent directory capability (§4.1/D28) is implemented/reviewed. Immutable allocation policy (§4.2/D30) and retained environment ownership (§4.3/D31) are also implemented/reviewed. Bounded warm/LRU checkout (§4.4/D32) is implemented/reviewed. Delivery-based handler timing (§3.8/D33) is implemented/reviewed. Invocation log windows (§3.9/D34) are implemented/reviewed. B05 initialization-error classification is now implemented/reviewed. The supervised pool invocation receipt (§4.5/D35) is implemented/reviewed. The §4.6/D36 Docker Executor/provider composition is implemented/reviewed with controlled-readiness actual SDK evidence. Startup network/resource qualification (§4.7/D37) is implemented/reviewed and independently exercised with actual pinned Rust images. Container-specific durable restart reconciliation (§4.8/D38) and durable private image-pin recovery (§2.13/D39) are now implemented; persistent daemon binding (§4.9/D76) is now implemented as well. Next complete other outstanding mutation classes and allowed pulls, then combine the independent proofs in the production startup coordinator with endpoint reachability, task1.4 configuration/capability publication and complete platform acceptance. B01/B03/B04/B05 are now closed with the security, six-library strict boundary and live SDK/API evidence in §§7.1–7.2/D27. These baseline closures do not enable Docker execution or close M0; remaining startup consumers and final M0–M4 release gates remain required. Docker execution is not yet advertised as available in Rustack.
+| 3.1/3.2 asynchronous structured owner | Implemented/reviewed for explicit library/Native composition; service and nested jobs remain | ASL§3.5/D58 retain unique scheduler CPU ownership, fresh commit fences, ancestor-frame/dispatch leases, cancellation-aware joined watchers and per-frame causal history. W158–W163 fixed/rechecked. Core558 units/224 doctests,89 compiler/35 frame-effect/22 scheduler/10 async preserve_order cases and strict production Clippy pass. Actual Native gate executes10 cases with no ignored case, including two distinct consumed-event handlers before gate release. Feature-enabled workspace build/all-target tests pass3,117 cases with428 separately gated; Clippy/rustdoc/nightly formatting and full/minimal service gates pass. Ordinary Rust SDK, boto3 and runner-cleanup acceptance pass3 cases with none ignored. No dependency versions or Docker experiments changed; B06 remains open. Default API stays Sequential until structured service/configuration/SDK acceptance; `.sync`, callbacks, persistence and final image/platform qualification remain required. |
+| 3.1/3.2 structured service binding | Implemented/reviewed; nested job3.3 remains | ASL§3.6/operations§1.6/D59 bind API compiler and registry profile, retain sequential artifact semantics and configure enforced frame/result budgets. W164–W165 fixed/rechecked. Core560 units/226 doctests, preserve_order89 compiler/35 effect/22 scheduler/10 async cases and strict production checks pass. Full/minimal main gates pass77/57 cases, including actual API quota failures and socket capability reporting. Both actual signed SDKs each execute17 M1 cases, six structured cases and two consumed-event lifecycle scenarios; the required SDK gate passes3 cases with none ignored. Native10 actual cases pass. Final workspace build/test/Clippy/rustdoc/nightly formatting pass3,123 cases with428 separately gated. No dependency changes or Docker experiments; B06 remains open. Nested .sync/.sync:2, callbacks, persistence and final image/platform gates remain required. |
+| 3.3 atomic child registry port | Implemented/reviewed dependency; ASL/service child resources remain gated | Integrations§4.1/D60 add exact parent capabilities, weak port linkage with retained root admission, independent bounded child calls, atomic Start/watch/relation publication, typed cached observations, lineage/DAG limits, detached acceptance and owned cleanup. W166–W172 fixed/rechecked. Core581 units/243 doctests; preserve_order89 compiler/35 effect/22 scheduler/10 async/19 child/2 controlled cases and strict checks pass. Native12 actual cases pass, including real child computation/cancel with a single dispatch slot and forced probe reap. Final feature-enabled workspace build/test/Clippy/rustdoc/nightly formatting pass3,144 cases with430 separately gated; full/minimal main77/57 and actual Rust SDK/boto3/runner3 regressions pass. Fresh audit still reports4 vulnerabilities/10 warnings on481 dependencies/1,378 advisories (unchanged B06); deny advisories fail, bans/licenses/sources pass. No new packages/versions or ignores; existing Tokio test-util is enabled only for deterministic core dev tests. ASL child routing/history and nested SDK acceptance remain required; Docker remains deferred. |
+| 3.3 registered nested ASL binding | Implemented/reviewed; whole release remains active | Integrations§4.2/D61 enable exact child resources independently of Lambda, gate actor work on atomic parent publication, route child-dependent machines through retained frame owners and publish actual TaskSubmitted data. Core600 units/245 doctests; preserve_order91 compiler/35 effect/22 scheduler/10 async/17 nested/19 child/2 controlled cases and strict checks pass. Both ordinary SDKs each execute six nested catalog cases and two actual Native child lifecycle scenarios. An additional actual server with dispatch capacity one proves nested Lambda progress and Stop cleanup; required SDK gate4 tests pass with none ignored. Native12 regressions and full/minimal main77/57 pass, including pure nested workflows without Lambda. W173–W176 are resolved; final independent review reports no remaining valid finding. Final workspace build/test/Clippy/rustdoc/nightly formatting pass3,164 cases with431 separately gated. Docker work remains deferred; callbacks/persistence/B06/final image/platform requirements remain. |
+| 4.1 callback registry foundation | Implemented/reviewed dependency; ASL/public callbacks remain gated | Integrations§5.1/D62 add a concrete scoped actor, secret-wrapped256-bit CSPRNG token transfer, hash-only indexes, captured execution/frame/generation, reserved closed-classification capacity, provisional callbacks, invocation failure priority, one replaceable heartbeat/Task timer, independent revoke and retained entropy/root ownership. Thirty targeted callback cases include exact virtual-clock edges, generation isolation, live/retained/command/entropy limits, late observers, parent retention recovery, root/controller/runtime loss and weak-Arc terminal-payload release. W177–W178 are resolved; final independent source review has no remaining finding. Core630 units/267 doctests and all preserve_order/strict gates pass; final feature-enabled workspace build/test/Clippy/rustdoc/nightly formatting pass3,194 tests with431 separately gated. Existing full/minimal main77/57 and actual SDK/Native nested regression gate4 cases pass; callback acceptance is not inferred. Fresh audit/deny preserve B06 (482 dependencies/1,378 advisories;4 vulnerabilities/10 warnings). ASL context injection/provenance redaction, Lambda callback ownership, SendTask routing and actual callback handlers remain required. Docker remains deferred. |
+| 4.1 callback parameter provenance | Implemented/reviewed pure boundary; callback service remains gated | Integrations§5.2/D63 add checked scoped credential context with last-Arc token clearing, structural compiled path/intrinsic provenance, effective-input taint propagation, one prepared tree/UUID source, and distinct bounded outbound/CallbackHistory types. Fifty-six targeted preparation cases include two512-case properties and actual generated TaskScheduled serialization. Four context storage/limit cases and one real registered-token preparation case qualify composition without starting a Lambda. W179 closes the TaskScheduled schema ambiguity; final independent review has no remaining finding. Core691 units/273 doctests and all preserve_order/strict checks pass, including56 preparation/10 payload/31 callback cases. Feature-enabled workspace build/test/Clippy/rustdoc/nightly formatting pass3,255 cases with431 separately gated; full/minimal main77/57 and existing real SDK/single-dispatch Native/runner4 regressions pass. The consuming callback adapter and supported TaskSubmitted truncation remain required. No dependency or Docker changes; B06 remains open. |
+| 4.2 observed Lambda callback port | Implemented/reviewed internal port; callback service remains gated | Integrations§5.3/D64 bind a unique scope/frame/generation reporter to explicit optimized invocation, preserve actual bounded metadata without synchronous function Payload, capture provider-return time before mapping and observe bridge settlement independently. Real Native early/late/failure/cancel qualification passes; cancellation PID absence is checked before global cleanup. W180 fixes provisional receipt-time fencing at the captured heartbeat boundary; provider observation remains explicitly after current backend cleanup. Final gates pass721 core units/289 doctests,61 callback cases with preserve_order,34 binary-support units/13 docs,13 actual Native cases, full/minimal main77/57 and4 existing SDK regressions. Workspace build/test/Clippy/rustdoc/nightly formatting pass3,288 tests with432 separately gated. No new dependency/ignore; fresh audit preserves B06 (4 vulnerabilities/10 warnings); deny advisories fail while bans/licenses/sources pass. ASL callback scheduling/history/API and handler-originated SDK callbacks remain required; Docker remains deferred. |
+| 4.1/4.2 deferred callback effect | Implemented/reviewed pure effect; async/service activation remains gated | Integrations§5.4/D65 add explicit compiler capability and callback resource/heartbeat IR, fresh identity before credential parameter evaluation, captured original context/deadline, one materialized dispatch plus typed history, and shared scheduler call/retirement protocol. W182 aligns registered heartbeat bounds with the effect; W183 preserves resolved heartbeatInSeconds. Forty-eight effect cases plus an actual large-heartbeat registered-token composition pass. Core770 units/299 docs, preserve_order and strict gates pass; workspace3,337 tests/432 separately gated and standard build/Clippy/rustdoc/nightly formatting pass. Actual Native callback composition now consumes the deferred effect and registered token; all13 Native and4 existing SDK regressions pass. Runtime/Registry gates reject unsupported publication without port calls or revision mutation. Registered async owner/history acknowledgment, SendTask APIs, handler-originated SDK callbacks, persistence and B06 remain required. Docker stays deferred. |
+| 4.1/4.2 registered async callback owner | Implemented/reviewed library/Native binding; public SendTask/service remains gated | Integrations§5.5/D66 bind immutable same-scope callback injection to the committed parent snapshot and retained structured owner. One preparation, actor Scheduled acknowledgment, typed evaluation/heartbeat failures, shared byte admission, dispatch-free external waiting and joined token/CPU/physical cleanup are qualified. W184–W186 are resolved and independently rechecked. Core796 units/301 doctests,24 registered-owner cases and two queued-result lifetime barriers pass; plain/feature workspace3,311/3,363 tests, full/minimal main77/57, strict Clippy/rustdoc/nightly formatting and existing SDK4 pass; all14 actual Native cases include registered ASL early/late/failure/cancel consumption. Public SendTask routing, handler-originated SDK callbacks, persistence/B06 and final image/platform gates remain required. No dependency/ignore or Docker changes. |
+| 4.2 registry-bound public callback adapter | Implemented/reviewed API binding; main/handler SDK activation remains | API§1.4/D67 retain the actual callback handle in Registry, move owned validated credentials into the secret wrapper, derive API compilation from that exact binding and submit one typed CallbackAck action independently of metadata admission. Thirty-one API cases and six owned-token cases pass, including real ASL early/late/failure/heartbeat/retry/timeout/Stop, epoch/scope/error/budget/lost-observer behavior. W187 stale documentation is corrected; independent final review has no remaining finding. Core802 units/302 docs, plain/feature workspace3,317/3,400 tests, full/minimal main77/57 and strict Clippy/rustdoc/nightly formatting, all14 Native and existing SDK4 pass; default main stays callback=false. No package/version addition or ignore; B06, main/handler SDK composition, persistence and final image/platform acceptance remain open. |
+| 4.2 callback main-service and actual handler SDK binding | Implemented/reviewed Native service; persistence/image/platform release gates remain | Operations§1.7/D68 install a real scoped callback root, enforce four YAML quotas, report actual installed capability/health and retain API→registry→callback→bridge shutdown. Two new controller cases and exact settings bounds pass. Both signed handler SDKs execute nine catalog cases (20 actual attempts total) through the real binary with one dispatch slot; the required SDK gate passes6 cases, including coordinated server/Native PID cleanup after forced gate-write failure. W188 is fixed/rechecked with no remaining independent finding. Core802 units/302 docs, full/minimal main79/57, Native14 and plain/feature workspace3,318/3,403 tests pass with standard/strict gates. Only optional fixture dependency edges change; no package/version, lint/advisory ignore or Docker operation. B06 and persistence/final image/platform qualification remain open. |
+| 5.2 compression security prerequisite | Implemented/reviewed; B06 closed, workflow archives remain | Operations§4.1/D69 replace the direct/transitive vulnerable codec cohort with zstd0.14.3/safe8.2.0/sys2.1.2 and a provenance-checked source-identical loader overlay. W189 is fixed/rechecked. Fifteen original loader and29 snapshot cases pass, including ten legacy/context/limit additions and failing original-codec negative controls. Plain/feature workspace3,328/3,413 tests, full/minimal main89/67, Native14, required SDK6 and standard/strict/rustdoc/fmt gates pass. Fresh audit482 deps/1,378 advisories is clean and every deny check passes without new ignores. No VM/Docker work; persistence/restore and final image/platform requirements remain open. |
+| 5.2 bounded archive decoding prerequisite | Implemented/reviewed structural boundary; workflow state archives remain | Operations§4.2/D70 install complete preflight and capped fallible encoding in existing snapshot helpers. W190/W191 are fixed/rechecked. Full/minimal snapshot111/110 cases pass (82 additions include two512-case properties), actual DynamoDB long-name archives and committed-generation rejection/reload; encoded profile bytes match the original Ciborium writer. Plain/feature workspace3,410/3,495 tests and standard/strict/rustdoc/fmt gates pass. Audit482 deps/1,378 advisories is clean; deny passes without new ignores or package/version changes. No Docker/VM work; retained registry export/restore remains next. |
+| 5.2 sealed registry export | Implemented/reviewed library cut and durable export; restore/main archives remain | Operations§3.1/D71 retain original ownership only after joined physical cleanup and export deterministic version1 rows with exact identities/revisions/input/history, separate record/name expiry and pre-copy budget admission. W192–W194 are fixed/rechecked. Target27 normal/preserve cases (24 additions), core826 units/305docs, runtime171/148, actual Native14/export and SDK6/cleanup pass. Plain/feature workspace3,434/3,519 and all standard/strict/rustdoc/fmt/audit/deny gates pass. No package/version, ignore or Docker work. |
+| 5.2 atomic library restore | Implemented/reviewed terminal restore; main archives/restart remain | Operations§3.2/D72 add bounded schema1 input, an exact-instance startup lease, source-profile compilation/history validation, original-pool preparation and one actor map commit. W195–W202 are fixed/rechecked. Eighty normal/preserve_order restore cases, core906 units/309docs, actual Native15/no-replay/new-computation and required SDK6 pass. Plain/feature workspace3,514/3,599 and full/minimal/standard/strict/rustdoc/fmt/audit/deny/provenance gates pass. Main persistence capability remains unavailable until actual archive/startup/shutdown composition and restart acceptance consume this boundary; Docker stays deferred. |
+| 5.2 main workflow archives | Implemented/reviewed; final performance/image/platform gates remain | Operations§3.3/D73 install actual v2 workflow metadata/history payloads, bounded owned archive work, retained main lease/transaction lifetime and pre-listen import. W203–W210 are fixed/rechecked. Seven split/join cases,143 full/142 minimal snapshot cases, actual named Native restart/no replay/new44, terminal live-work shutdown, stale handles, SIGKILL unsaved loss and corrupt-startup refusal pass. Full/minimal main204/181, core913 units/313docs, Native15 and required SDK7 pass. Plain/feature workspace3,535/3,640 pass; final gate evidence is in review93. Docker remains deferred. |
+| 5.3 pure workload/current-host responsiveness | Implemented/reviewed; Linux reference and image/platform lanes remain | Verification§5.1/D74 adds actual signed SDK100×50-state latency and100 live-loop/Stop cycles through one open slot, plus explicit history exhaustion under causally live health probes. W211–W213 are fixed/rechecked. Six normal controls and both real workloads pass; current macOS/aarch64 p95=10508µs, health/Stop maxima283/1102µs. Raw samples/source+binary provenance are in the measurement review. Plain/feature workspace3,535/3,646, Native15, required SDK9 and standard/strict/security gates pass. No Docker/VM experiment or new dependency. |
+| 5.4 native inventory and operator guide dependency | Implemented/reviewed; final release qualification remains | Verification§3.1/D75 freezes26 exact Native/SDK/HTTP resource cases and validates actual ignored-test listings before execution. The new smoke consumes documented raw YAML/ASL in a strict-auth pure binary, proves positive/Fail outcomes/exact histories and joins zero-Native cleanup without a bootstrap. verify-workflows-native completes serial model/HTTP/core/runtime/Native/SDK/archive/persistence/performance gates. W214–W215 are fixed/rechecked; parser6 controls, Native15, SDK10, HTTP SDK1, main204/181 and plain/feature workspace3,535/3,646 pass. English guide/capability/snapshot/shutdown text is reconciled. Image/ZIP/IaC/reference/platform/full-release gates remain open. |
+
+Current execution priority: the compiled driver, supervised execution/history owner and real Lambda binary bridge are implemented/reviewed. The validated domain registry§3.1/D51 is now implemented/reviewed, including actual Native composition. The retained API preparation/pagination adapter§1.3/§6.1/D52 is now implemented/reviewed, including actual Native composition through typed HTTP. The real main registration/settings/health/composite shutdown§1.6/§3/D53 is now implemented/reviewed, including actual socket routing/timeout regressions. Ordinary Rust SDK+boto3 acceptance through the real registered service§3/D54 is now implemented/reviewed for the selected M1 profile. Parallel/Map service composition§3.6/D59 is now implemented/reviewed through both real SDKs. The atomic child registry port§4.1/D60 is now implemented/reviewed, including Native execution and retained cleanup. The registered ASL child binding§4.2/D61 now passes actual SDK/Native acceptance with dispatch-free waiting and causal Submitted history. The callback registry foundation§5.1/D62 now implements its token/provisional/timer ownership dependency. The pure callback parameter provenance boundary§5.2/D63 is now qualified. The observed Lambda invocation dependency§5.3/D64 is implemented/reviewed and qualified. The deferred callback instruction/materialization/history dependency§5.4/D65 is now implemented/reviewed. The registered async callback owner/history acknowledgment§5.5/D66 is now implemented/reviewed. The public SendTask adapter§1.4/D67 is now implemented/reviewed. Main configuration/capability/shutdown and both actual handler SDK paths§1.7/D68 are now implemented/reviewed. The B06 compression prerequisite§4.1/D69 and installed bounded CBOR archive boundary§4.2/D70 are now implemented/reviewed and fresh audit/deny pass. Sealed registry ownership and durable library export§3.1/D71 are now implemented/reviewed. Atomic library restore§3.2/D72 is now implemented/reviewed, including actual Native no-replay and new-computation evidence. Real main archive registration and process-restart acceptance§3.3/D73 are implemented; final qualification and independent recheck are recorded in the main archive work item. Pure workflow current-host performance/responsiveness§5.1/D74 is now implemented/reviewed with raw measurements and explicit Linux reference limitations. Exact native resource inventories and the current-profile operator guide§3.1/D75 are now implemented/reviewed. The subsequent workflow/Native functional path, persistence and current-host qualification are available; the recorded namespace composition§4.10/D77 is now implemented/reviewed; the controlled pull preparation§2.14/D78 is now implemented/reviewed; D79 validated settings and private credentials are now implemented/reviewed; D80 endpoint and D81 production startup consumers are now implemented/reviewed, and D82 qualifies custom RIC and immutable Image revisions. D83 now qualifies real faults/cancellation/admission; D84 adds retained consumed preparation admission, management IO faults and the exact Docker functional manifest; remaining IO-deadline/interrupted-pull and negative-image qualification, image archive/ZIP/SDK/IaC, reference/platform and the final full-release manifest stay required. Preserve the original M0–M4 acceptance scope and the user's implementation order. The user-requested subsequent workflow implementation is complete for the selected Native profile; Docker-image work has resumed. Preserve all original final image/platform gates, and consume the implemented W217/D76 bound ports before ordinary startup can use historical404 proofs.
+
+### M1 gateway composition work item (2.1/2.4 continuation)
+
+Implemented/reviewed operations§1.6 and§3: validated supported YAML budgets, exact target-family gateway priority over heuristic routers, actual-provider capability selection, admission-independent worker health and a unique resumable composite supervisor. Full/pure feature checks cover disabled/unqualified backend rejection, strict authentication configuration, normal drain and forced shutdown history, dropped/expired shutdown observers, modeled socket timeouts, conflicting routes and accurate capability/snapshot reporting. This does not close ordinary Rust SDK/boto3 acceptance or later fanout/callback/persistence milestones.
+
+### M1 real SDK work item (2.4 continuation)
+
+Implemented/reviewed verification§3's real binary SDK contract: a source-linked17-case catalog, retained process fixtures, all15 APIs and semantic/error/history/revision cases through Rust SDK and boto3. The Makefile gate, standard/strict/dependency checks and independent review are recorded above. SDK protocol-type compatibility was fixed by the coherent shared dependency cohort; all review findings are resolved. At that checkpoint Docker work was preserved and deferred while fanout/nested.sync/callback/persistence were implemented. Their later Native qualification permits the resumed image work recorded under D81–D83; final image/platform gates remain required.
+
+### P3 asynchronous structured ownership work item (3.1/3.2 continuation)
+
+ASL§3.5/D58 compose the synchronous frame scheduler with one retained asynchronous resource owner. Explicit structured starts execute actual overlapping Native handlers; default service/API compilation remains Sequential. Retain accepted-call ancestor leases above CPU/actor joins, commit updates only after fresh root control checks, and project per-frame causal history. This component's reviewed tests cover nested cleanup before recovery, stale/expired timer starvation, committed versus speculative history, Map iteration aborts and panic quarantine. Consuming-service frame configuration, ordinary Rust SDK/boto3 structured cases and nested `.sync`/`.sync:2` remain required before P3/M2 closure. The user's Docker deferral remains binding.
+
+### P3 structured service work item (3.1/3.2 consuming-service continuation)
+
+ASL§3.6/D59 bind compilation to the registry's installed profile and compose validated global/local frame/result quotas. The actual main service now executes Parallel/Map through typed HTTP and reports eight state types, while sequential machines preserve their established event protocol. Both signed ordinary SDKs execute six independent structured cases plus two consumed-event lifecycle scenarios: concurrent handlers return their recorded identities, and Stop retires both nested Map handler PIDs. Exact fork/iteration predecessors, full payload omission and reverse pagination are verified. W164–W165 strengthen this evidence; nested start/subscription/.sync remains the next P3 requirement. Docker work remains deferred.
+
+### P3 atomic child registry port work item (3.3 dependency)
+
+Integrations§4.1/D60 add a concrete weak registry port, exact retained parent capability, separate bounded child lane/call quota, atomic Start/watch/owned-relation commit, immutable lineage and active DAG limits. Typed admission/terminal/cleanup observations preserve cancellation and late ready results. RequestResponse detaches at acceptance; owned graph cancellation remains live through blocked entropy and retains physical cleanup charges. Actual Native success/cancel and owned probe-reap qualification pass. Compiler/resource routing, per-actor child admission with no waiting dispatch permit, TaskSubmitted events and nested service SDK acceptance remain the next3.3 work; the service still rejects nested resources. No whole P3/M2 or image qualification is claimed.
+
+### P3 nested ASL binding work item (3.3 continuation)
+
+Integrations §4.2/D61 specify independent compiler capability, exact parent registration gate, frame-only child Task ownership, CPU-bounded parameter/envelope work and causal TaskSubmitted projection. Implement and qualify this binding through registry tests, actual Native ASL parents and both ordinary SDKs before advertising nestedSync. Preserve the deferred Docker checkpoint.
+
+### P4 callback registry foundation work item (4.1 dependency)
+
+Implement integrations§5.1/D62 with trusted captured attempt registration, hash-only bounded actor indexes, provisional invocation/result protocol, independent revoke, exact timers, resumable receipts/shutdown and token security/dependency qualification. Keep ASL callback resources/public SendTask capability gated until token context injection, history provenance, Lambda ownership and actual SDK handler acceptance are integrated. This is a dependency of4.1/4.2, not the complete M3 exit.
+
+### P4 callback parameter provenance work item (4.1 continuation)
+
+Implement integrations§5.2/D63: scoped zeroizing credential context, structural compiled path/expression provenance, effective-input propagation, one bounded template evaluation, distinct outbound/history types and actual generated history-model serialization checks. Reconcile the absent TaskScheduled truncation field explicitly. Keep callback resource and public API activation gated until the consuming actor owns registration, Lambda invocation, history and terminal/cleanup protocol end to end.
+
+### P4 observed Lambda callback invocation work item (4.2 dependency)
+
+Implement integrations§5.3/D64: unique reporter transfer, typed bounded real invocation metadata, captured-time heartbeat activation and independent TaskCall cleanup, with explicit observed optimized invocation commands and real Native bridge qualification. Preserve normal Lambda modes and callback capability=false until ASL scheduling/history/API/handler-originated callback acceptance is installed. Docker remains deferred.
+
+### P4 deferred callback effect work item (4.1/4.2 binding dependency)
+
+Implement integrations§5.4/D65: independent callback compiler capability, static/dynamic heartbeat constraints, credential-free deferred effect with fresh attempt/deadline, exact one-time materialization and typed history projection. Teach frame ownership/cancellation and observed Lambda mapping about the distinct integration while preserving runtime/Registry/API activation gates. Then install the registered async token/history/physical-call consumer before enabling SendTask routing or claiming M3 acceptance.
+
+### P4 registered async callback owner work item (4.1/4.2 consuming binding)
+
+Implement integrations§5.5/D66 end to end: immutable registry injection, exact committed parent snapshot gate, shared/local callback data charges, joined token/preparation/physical-call owner, actor Scheduled-history acknowledgment, separate invocation/callback/cleanup progress, dispatch release during external wait, typed evaluation/heartbeat failures and registered ASL/Native acceptance. Keep service/API activation gated until SendTask routing and real handler-originated SDK qualification follow.
+
+### P4 public callback adapter work item (4.2 API continuation)
+
+Implement API§1.4/D67 using the same installed Registry callback handle for capability and typed submission, owned token conversion in retained CPU work, action-specific errors and exact zero-body success transport. Qualify actual HTTP→registered ASL behavior, provisional/closed/foreign token cases, heartbeat/history, observer/deadline/shutdown ownership and unbound regressions. Main/settings/capability and both handler-originated SDK consumers follow before M3 release.
+
+### P4 callback main-service and actual handler SDK work item (4.2 consuming composition)
+
+Implement operations§1.7/D68: validated four callback budgets, same-scope real root installation, accurate readiness/capability and retained API→registry→callback→bridge shutdown. Qualify both real handler SDKs against the strict-auth actual Native binary using the source-linked nine-case catalog, request/cleanup/secret evidence and one dispatch slot. Preserve all default/pure/minimal and existing SDK acceptance. Persistence/B06 and deferred image/platform gates remain required for complete release.
+
+### P5 compression security prerequisite (B06 / 5.2 boundary)
+
+Implement operations§4.1/D69 before workflow archive import: direct patched codec cohort, one source-identical loader overlay with recorded provenance, exact old archive/context-isolation/kernel regressions, complete dependency/normal/strict gates and independent review. Preserve all runtime/SDK regressions and deferred Docker worktree state. This closes the codec advisory prerequisite, not workflow persistence or final platform acceptance.
+
+### P5 bounded archive decoding prerequisite (5.2 boundary)
+
+Implement operations§4.2/D70 before constructing workflow archive DTOs. Install the shared preflight/capped encoder into existing manifest, service metadata and data-directory paths; qualify the precise v2 profile, duplicate-key semantics, all resource bounds, typed-visitor/serializer failure barriers, legacy compatibility and full/minimal standard/strict gates. Workflow state export/import and frozen-registry ownership remain required after this prerequisite.
+
+### P5 sealed registry export (5.2)
+
+Implement operations§3.1/D71: freeze state only after joined physical cleanup, preserve permits across root/controller lifetime, exact paired-clock record/name expiry, deterministic versioned durable rows, bounded direct history traversal and conservative export admission. Qualify all lifecycle/revision/retention/budget/error cases and actual Native output/history. Staged restore and real main archive registration follow; do not publish a persistence capability early.
+
+### P5 atomic library restore (5.2)
+
+Implement operations§3.2/D72 end to end: bounded schema1 input, exact-instance startup lease, full validation/compilation and existing quota staging before actor map replacement, explicit retained deadlines, lossless history reconstruction, zero-dispatch RUNNING conversion and actual Native restore/new-execution proof. Keep main persistence unavailable until meta/data registration and process-restart acceptance consume this boundary.
+
+### P5 main workflow archives (5.2 consuming composition)
+
+Implemented/reviewed operations§3.3/D73: move-only metadata/history archive parts, validated workflowSnapshotBytes, one owned archive CPU/IO/receipt lane, actual RuntimeProviders registration, drained staging errors and retained pre-listen startup/final-shutdown cleanup. Real v2 generations and strict-auth pure/Native save/restart/new execution qualify resources-and-history coverage with snapshotResume=false and fresh pagination epochs. Domain/policy startup rejection preserves both current and previous generations. Required performance/consuming-project/release and image/platform lanes remain open; preserve the deferred Docker checkpoint.
+
+### P5 non-image performance and responsiveness (5.3)
+
+Implemented/reviewed verification§5.1/D74 with the actual signed SDK/binary fixture:100×50-state latency samples and exact public history, one history-exhausting loop with healthy service,100 single-slot start/Stop cycles, bounded observations and a post-cleanup schema1 measurement report. Preserve normal semantic fixture budgets, qualify percentile/rank/rounding boundaries, run the dedicated target plus full standard/strict checks and independent review. Record host-specific measurements without claiming the pending Linux reference, IaC or image/platform gates.
+
+### P5 exact native suite inventory and user guide (5.4 dependency)
+
+Implemented/reviewed verification§3.1/D75: strict bounded three-suite resource inventory, actual compiled-name/ignored-state preflight, existing gate wiring, an owned pure-service smoke consuming the documented ASL example, and a serial verify-workflows-native composition. Publish an accurate English guide and reconcile capabilities/snapshot/shutdown text. Qualify parser negatives, missing/extra inventory and actual pure/Native/SDK execution, full Rust gates and independent review. The final release manifest/command and image/platform/IaC/reference acceptance remain consuming work rather than inheriting success from this native profile.
+
+### P1 durable image-pin recovery (1.3/1.4 dependency, resumed D39 checkpoint)
+
+Implemented/reviewed runtime§2.13/D39: shared bounded descriptor-relative snapshots, strict pin intents/commitments, retained Preparing/Uncertain/Committing/Known phases, erase-before-permit release and container-ordered historical alias reconciliation. The40 targeted pin/owner/recovery cases and24 legacy recovery regressions pass, including failed-storage positive-proof retention, abandoned observers and source-tag safety. Final behavioral-source real qualification passes13 cases per retained arm64 VZ and emulated amd64/QEMU daemon, including both actual directory-reacquisition cases; scoped post-run container/private-alias queries are empty. Plain/feature workspace build/all-target tests pass3,537/3,648 (415/440 separately gated), with workspace Clippy, denied-warning rustdoc, nightly formatting, strict Lambda boundaries and the complete verify-workflows-native composition. Fresh audit/deny/codec provenance pass without package/version or policy changes. W216/W218/W219 are fixed and independently rechecked; W217 same-daemon durable binding was the next mandatory dependency and is now implemented as D76 below. Startup coordinator, allowed pulls, endpoint/config publication, image ZIP/handler networking/IaC and final reference/platform/release acceptance remain open. Evidence and precise scope are in the [D39 review](./rustack-workflows-93-review.md#p1-durable-private-image-pin-recovery-independent-review).
+
+### P1 durable daemon binding (1.3/1.4 dependency, W217/D76)
+
+Implemented/reviewed runtime§4.9/D76: strict engine UUID, owner-bound immutable daemon.v1, empty-journal-only first binding, exact-lease runtime ports and per-connection ID checks before requested operation issuance. Retain accepted IO/lease ownership across cancellation and the same checked connection through attach/cleanup; typed IdentityCheck failures cannot masquerade as resource absence. W217 is closed as this prerequisite, and W220(P1)/W221(P3) are fixed and independently rechecked. The37 new ordinary binding/storage cases and actual same/different-daemon test in both directions pass; each retained daemon also passes13 existing actual owned recovery/executor/pool/wire/container cases with empty scoped postconditions. Final plain/feature workspace tests pass3,574/3,685 (416/441 separately gated); full standard/strict/native/security evidence is in the [binding review](./rustack-workflows-93-review.md#p1-durable-daemon-binding-independent-review). Startup/historical discovery/allowed pulls/endpoint and final image/ZIP/network/IaC/reference/platform/release acceptance remain consuming work.
+
+### P1 recorded namespace startup composition (1.3/1.4 dependency, D77)
+
+Implemented/reviewed runtime§4.10/D77: exact-bound aggregate container-before-pin reconciliation; current-run rejection; untruncated owner container and bounded complete image-tag inventories; unresolved/orphan/late-observation refusal without adoption or false readiness. W222/W223/W224 are fixed and independently rechecked. The44 new ordinary cases include actual-wire metadata/body/budget/error-origin controls, cancellation, dependency-aware fixture failure cleanup and required RepoTags rejection. Three actual namespace cases per retained daemon qualify recorded pair/pin retirement and preserved orphan container/alias controls; the existing13 real owned consumer cases are requalified as well. Full plain/feature Rust, strict boundaries, Native verifier and audit/deny evidence are recorded in the [D77 review](./rustack-workflows-93-review.md#p1-recorded-namespace-composition-independent-review). Production startup must still consume the journal-before-effect provenance/exclusive-producer contract, allowed pulls, endpoint/probe/configuration proofs and original image/ZIP/IaC/reference/platform/full M0–M4 release gates.
+
+### P1 controlled pull preparation (1.3 dependency, D78)
+
+Implemented/reviewed runtime§2.14/D78: validated exact registry/auth policy; secret header encoding; independent bounded pull scheduling and strict incremental NDJSON; terminal driver/directory ownership through cancellation/deadline/root failure; initial-root404-only ifMissing in the actual image preparation worker.55 focused pull cases plus one retained-primary shutdown regression pass, with833 Lambda core ordinary cases/8 gated and165 doctests. Both retained daemons pass17 actual cases each, including initially missing immutable source preparation, actual endpoint re-exercise and all existing namespace/recovery/executor/pool/wire consumers. Final complete-prefix postconditions show zero containers/private aliases. W225–W228 are fixed/rechecked. Full plain/feature Rust, strict boundaries, Native verifier and audit/deny evidence are recorded in the [D78 review](./rustack-workflows-93-review.md#p1-controlled-image-pull-preparation-independent-review). Next implement YAML auth-file/permissions/configuration and ordinary startup/endpoint composition under1.4. Source cache retention is intentional; Docker ZIP/handler networking/IaC/reference/platform/full M0–M4 release remain open.
+
+
+### P1 Docker configuration and private registry credentials (1.4 dependency, D79)
+
+Implemented/reviewed operations§1.8/D79: shared keys/Docker budgets, private typed configuration builder, exact decimal CPU/literal endpoint validation, explicit approved registry policy and retained private-file YAML credential loading. No ambient lookup/helper/secret snapshot fields. W229 ACL precondition and W230 preallocation bounds are fixed/rechecked.84 focused cases qualify scalar/schema/filesystem/worker ownership and selected auth through bound preparation; both actual daemon fixtures load their own0600 anonymous YAML and complete warm preparation/pull/pin cleanup. Plain/feature workspace, strict production boundaries and the complete native-workflow-only verifier pass. Detailed source/evidence and qualifications are in the [D79 review](./rustack-workflows-93-review.md#p1-docker-settings-and-private-yaml-credential-review). The next task1.4 consumer is actual production startup: directory/provenance reconciliation, relay pin, network/kernel/endpoint receipts, provider/shutdown ownership and capability activation. Ordinary Docker remains unavailable until that consumer is qualified. Docker ZIP/handler SDK networking/IaC/reference/platform/full M0–M4 release remain open.
+
+### P1 container-origin gateway endpoint proof (1.4 dependency, D80)
+
+Implemented/reviewed runtime§4.11 and operations§1.9/D80: shared validated endpoint/instance/challenge/report types, owned HTTP/TLS pinned command, admission-independent optional gateway identity and private exact-input receipts after physical probe retirement. W231–W234 are fixed/rechecked. The focused76-case target covers55 new ordinary cases plus21 retained probes; no-Lambda route cases2, strict boundaries1,540/29 gated, plain/feature workspace3,813/3,924 with424/449 gated and the complete Native verifier all pass. Both retained daemons pass23 actual consumer cases each plus four final reviewed endpoint cases, preserving source images. Captured fixture bridges are removed only after exact ID/owner/empty-attachment inspection; final complete observations show zero containers/private aliases. Full standard/strict/security evidence and controlled-peer/platform scope are in the [D80 review](./rustack-workflows-93-review.md#p1-container-origin-endpoint-proof-review). TaskCreate is unavailable; this ledger tracks the dependency. Production startup/listener/provider/shutdown must next consume durable provenance/reconciliation, configuration, pins and actual resource/network/endpoint receipts before enabling Docker. Image ZIP, ordinary handler SDK networking, IaC/native-reference/platform and complete M0–M4 release remain open.
+
+
+### P1 production Docker startup composition (1.4, D81)
+
+Implemented/reviewed runtime§4.12 and operations§1.10/D81: immutable new-format journal provenance, exact-daemon recovery, validated settings and real relay/network/resource/optional endpoint proofs are consumed by one retained production owner. A diagnostic-only same listener precedes qualified provider/ASL installation and snapshot validation; fallible ordered shutdown preserves pending joins and sticky diagnostics independently of physical retirement. Both retained daemons pass29 actual cases each, including6 ordinary strict-auth startup/SDK/workflow/archive cases plus23 retained component consumers. arm64 VZ is native functional scope; amd64/QEMU is emulated functional scope only. Final exact bridge removal and complete observations show zero containers/private aliases while preserving source cache. W235–W244 are fixed/rechecked. Ordinary/feature workspace tests3,845/3,957 (424/455 gated), startup68, strict boundaries1,581/29 gated, Native2,981/19 gated and all standard/strict/security/text checks pass; see the [startup review](./rustack-workflows-93-review.md#p1-production-docker-startup-review) for failures corrected, provenance and limits. TaskCreate is unavailable; this ledger tracks the consuming task. This activates ordinary Docker Image execution, not complete M0 or M0–M4 release. Next execute the full ordinary-binary L01–L09/custom-RIC matrix, then immutable Image archive lease restoration, Docker ZIP and handler SDK/network/callback images, preserving IaC/native-reference/Linux arm64/final platform acceptance. No additional startup prerequisite substitutes for those consuming gates.
+
+
+### P1 custom RIC, ImageConfig and immutable published image acceptance (1.4, D82)
+
+Implemented/reviewed verification D82 through the ordinary Docker binary: independent bounded Rust RIC/two pinned-base sources, signed Rust SDK compute, nine frozen boto3 semantic report IDs for actual defaults/empty/replacement ImageConfig, literal argv, controlled tag/update/publication/alias isolation, active foreign/stale completions and published A held across Successful B update. Cold published-A/latest-B launches additionally require counter1. Bounded two-stage collector, atomic per-alias intent publication, retained exact CLI joins and actual cancel/panic-after-tag recovery close W245–W248. Both retained daemons pass30 actual consumer cases each, followed by all7 final reviewed startup/custom cases each; four collector controls, workspace3,845/3,957 with424/456 gated, strict boundaries1,581/29 gated, Native2,981/19 gated and all standard/strict/security/text checks pass. Exact owned bridges are removed; complete observations show zero containers, runtime-private aliases and fixture-source aliases, with all four selected source images/cache preserved. See the [custom RIC review](./rustack-workflows-93-review.md#p1-independent-custom-ric-and-immutable-image-revision-review) for cohort chronology, scope and evidence. TaskCreate is unavailable; this ledger tracks the consuming task. Next close actual remaining L05/L07–L09 fault/init/exit/OOM/cancel/admission/saturation cases and the exact Docker suite inventory/test-lambda-docker target. Node, immutable Image archive lease restore, Docker ZIP, handler SDK/callback images, IaC/native-reference/final platform and full M0–M4 acceptance remain required.
+
+
+### P1 real Image faults and public cancellation/admission (1.4, D83)
+
+Implemented/reviewed runtime§4.13 and verification D83. Typed MemoryLimit rejects impossible charges before admission/pool retry/healthy warm eviction; main reserves final Docker cleanup inside the unchanged global deadline. Both retained daemons pass 34 actual cases each, including real init/error/exit/OOM/timeout with cold recovery, causally held initializing/busy signed client disconnects, reserved quotas and 128 accepted Events with exact 129th throttling and held-backlog shutdown. The final arm64 startup/fault cohort also passes all 11 cases after the IO-budget refinement. Eleven bounded observer controls and four prior collector controls pass; W249–W256 are fixed and independently rechecked. Ordinary/feature workspace 3,849/3,961 with 424/460 gated, strict boundaries 1,584/29 gated, Native 2,983/19 gated, and standard/strict/security/text gates pass. Exact owned bridges are removed; complete observations show zero containers/runtime-private/test-source aliases, preserving four selected source images and cache. TaskCreate is unavailable; this ledger tracks the consuming task. Remaining allocating/cleanup/daemon/pull/deployment fault injection and exact Docker inventory are the next M0 work; preserve every later M0–M4 gate.
+
+
+### P1 management IO faults and exact Docker inventory (1.4, D84)
+
+Implemented/reviewed runtime§4.14 and verification D84. Shared preparation/deployment admission stays in the image actor record above worker unwind, and a private receipt releases it only after consumed ordinary preparation or a successful image deployment CAS. Failed/canceled/unaccepted preparation retains physical retirement. The transparent bounded real-daemon proxy qualifies actual Create/Tag acknowledgment barriers, held DELETE, management acknowledgment loss/old-revision preservation, full transport loss/readiness rejection and deployment saturation without production injection hooks or owner revival. Both retained daemons pass all 44 resources in the new exact eight-target functional Make gate, including reciprocal daemon binding and five standalone relay resources. Eleven proxy, twelve observer, four collector and ten Native/Docker manifest controls pass. W257–W264 are resolved and independently rechecked; focused lease26/manager21 and core strict checks pass. Ordinary/feature workspace3,850/3,962 with424/464 gated, strict boundaries1,585/29 gated, Native2,983/19 gated and standard/strict/security/text gates pass. Exact bridges are removed; complete observations find zero containers/runtime-private/test-source aliases while preserving all four selected sources and cache. TaskCreate is unavailable; this ledger tracks the consuming task. Next qualify actual IO deadlines/interrupted pulls and remaining negative images, then immutable Image archive restore, Docker ZIP, Node/handler SDK/callback, IaC/reference/platform and every remaining M0–M4 release requirement.
+
+
+### P1 real IO expiration, interrupted pull and negative artifacts (1.4, D85)
+
+Implemented/reviewed runtime§4.15 and verification D85: actual Create/DELETE acknowledgment expiration, genuine interrupted ordinary ifMissing pull with positively retained backend drain/source-reference cleanup, and real incompatible/protocol-free artifacts. Both retained daemons pass all48 distinct resources in the unified functional gate and all8 final IO resources after the last deadline fences. Direct selected-platform404 now exposes InvalidImage while root/identity/other failures preserve provenance; four wire/six preparation cases pass. Explicit bounded baseline provisioning removes prior-cache test ordering. W265–W270 are fixed and independently rechecked. Final ordinary/feature workspace3,854/3,967 with424/468 gated, strict boundaries1,589/29 gated and Native2,983/19 gated pass; production and fixture checks, audit/deny/format/rustdoc/text gates pass. Captured owned bridges are removed after exact ID/name/owner/empty checks; complete observations show zero containers/runtime-private/test-source/extra-pull aliases, preserving seven selected sources and the immutable baseline per daemon. See the [D85 review](./rustack-workflows-93-review.md#p1-real-io-expiration-interrupted-pull-and-negative-artifact-review) for provenance, failed observations and scope. The independent M0 audit additionally requires actual malformed Runtime HTTP framing and separately isolated active global/default-per-function/memory/environment admission before M0 closure; see the [audit gaps](./rustack-workflows-93-review.md#m0-exit-audit-after-d85). TaskCreate is unavailable; this ledger tracks the consuming task.
+
+
+### P1 actual Runtime HTTP and independent execution/resource ceilings (1.4, D86)
+
+Implemented/reviewed runtime§4.16 and verification D86. Both retained daemons pass all53 distinct resources in the exact eight-target functional gate, plus three raw-RIC/one receipt controls, without required skips. Actual rejected method/header/body/trailer requests leave the consumed attempt usable and warm-reusable. Real WorkManager counters prove global32/default8 before429; independently binding memory/environment cases retain work and physical charges at function-DELETE and relay-DELETE barriers. W271–W274 are fixed/rechecked. Ordinary/feature workspace3,860/3,973 with424/473 gated, strict boundaries1,591/29 gated, Native2,986/19 gated, standard/fixture/security/text gates and independent review pass. Exact captured bridges are removed; complete observations show zero containers/runtime-private/test-source/extra-pull aliases, preserving seven selected sources and the immutable baseline per engine. See the [D86 M0 audit](./rustack-workflows-93-review.md#m0-source-and-acceptance-audit-after-d86).
+
+**P1/M0 is functionally qualified on the retained P0 lanes:** macOS arm64 host with native arm64 VZ and emulated Linux amd64/QEMU Docker environments. All tasks1.1–1.4 and L01–L09 are mapped to implementation and acceptance evidence. Native Linux/x86/reference performance, Docker Desktop/rootless and the complete M4 platform matrix remain unqualified. The prior ledger entries are chronological checkpoints, superseded by this closure. TaskCreate is unavailable; this ledger records completion. The broader M0–M4 goal stays active: next qualify immutable Image archive lease restoration/Docker ZIP consumers and Node/handler SDK/callback images, followed by consuming-project/IaC and remaining reference/platform/full-release gates.
+
+
+### P5 immutable image restore prerequisite (5.2a, D87)
+
+Implemented/reviewed runtime§2.15's immutable local lease reacquisition, before atomic archive-store/main publication. Image-only archive restoration is independent of provided-runtime ZIP and can consume the already-qualified M0 image owner; it does not mark5.1/5.2 or P5 complete. Deliver typed separate preparation source, exact saved-ID/platform/fingerprint proof before mutation, no pull/tag fallback, retained pin/cleanup ownership, controlled hostile/cancellation regressions and actual serialized-metadata→restore→RIC computation on both engines. Preserve all provider/main archive rejection until5.2b candidate/commit validation lands. TaskCreate is unavailable; this ledger tracks the dependency.
+
+
+D87 qualification:35 lease controls pass, including nine added/expanded cases for exact restored identity, supported-but-changed fingerprints, no mutable fallback and retained critical mutation/admission. Both retained engines pass18 actual resources each (two serialized-metadata/restored-RIC wire consumers plus16 image recovery/namespace/daemon/pull/environment/provider consumers). The unchanged frozen53-resource/eight-suite inventory verifies; it is not a new full53 execution claim. Ordinary/feature workspace3,869/3,982 (424/473 gated), strict boundaries1,601/29 gated, complete Native2,986/19 gated, build/Clippy/nightlyfmt/rustdoc/audit/deny/text checks and independent review pass. Full inventory observations show zero containers/runtime-private/test-source/extra-pull aliases with eight captured post-provisioning source IDs preserved per engine; no new bridge is needed. See the [D87 review](./rustack-workflows-93-review.md#p5-immutable-local-image-lease-reacquisition-review-d87). Task5.2a is complete; next5.2b must validate/reacquire the entire candidate store and atomically publish it through actual startup/archive generation ownership. Provider/main image archive rejection remains;5.1/5.2/P5 and the complete M0–M4 goal remain open.
+
+
+### P5 candidate Image archive import and main startup (5.2b, D88)
+
+Implemented/reviewed runtime§2.16 and operations§3.4/D88: borrowed bounded export, retained pure validation, complete private candidate preparation, exact shared immutable lease/fresh-size proofs and synchronous publication after a final health/deadline fence. The actual retained startup transaction carries its original deadline through Lambda import and previous-generation retirement. W275–W280 are fixed and independently rechecked. Eighteen candidate/export, five pure-boundary, two producer-save, one late-import and two independent-codec controls pass. Each native-arm64 VZ/emulated-amd64 QEMU full gate passes all53 exact resources/57 Rust cases, including ordinary Image archive save/restart/latest/published-alias computation, restored workflow/history and checksum-valid bad-proof refusal preserving both generations. Ordinary/feature workspace3,895/4,010 (424/473 gated), strict boundaries1,629/29 gated, complete Native3,001/19 gated and all build/Clippy/nightlyfmt/rustdoc/audit/deny/text gates pass. After all owners join, full inventories show zero containers/runtime-private/test-source/extra-pull references, eight distinct captured post-provisioning source IDs preserved per engine and both exact owned bridges removed after identity/empty-attachment checks. See the [D88 review](./rustack-workflows-93-review.md#p5-candidate-image-archive-restoration-review-d88). Task5.2b is complete; Docker ZIP/Node/handler SDK/callback images, consuming-project/IaC, native-reference/platform and complete5.1/5.3/5.4/P5/M0–M4 qualification remain active. TaskCreate is unavailable; this ledger records the dependency.
+
+
+### P5 provided-runtime ZIP prerequisites (5.1a, D89)
+
+Implemented/reviewed [runtime§6.1–§6.5](./rustack-workflows-20-lambda-runtime-design.md#61-provided-runtime-zip-delivery-contract-d89): typed original-ZIP→deterministic TAR conversion with two retained282MiB buffer reservations, Linux ELF validation, shared10,000-node filesystem-tree/path/attribute/directory-stream checks, and bounded local-volume/archive operations through the existing bound wire. W281–W285 are resolved/rechecked. Thirty-six converter,14 wire and two layout controls pass; both native-arm64 VZ/emulated-amd64 QEMU full gates pass all54 exact resources (110 aggregate Rust passes:54 resources+52 pure code controls+four existing controls,13 summaries each). The new real resource consumes the immutable ZIP through an unstarted RW loader and RO execution, requiring computed42, root ownership/normalized modes, chmod→EROFS and writable `/tmp`. Ordinary/feature workspace3,952/4,067 (425/474 gated), strict1,696/30 gated, complete Native3,001/19 gated and all build/Clippy/fmt/rustdoc/audit/deny/text gates pass. Exact postconditions show zero containers/private code volumes/private/test/pull aliases, eight captured post-provisioning source IDs preserved per engine and both exact owned empty bridges removed. The [D89 review](./rustack-workflows-93-review.md#p5-zip-conversion-and-volumearchive-transport-review-d89) retains failed observations and evidence limits. Task5.1a is complete. Next implement retained code-volume ownership/recovery5.1b, then real startup/provider/invocation5.1c and ZIP archives5.2c. Ordinary ZIP capability remains unavailable;5.1/P5 and Node/handler SDK/IaC/reference/platform/full M0–M4 acceptance remain active. TaskCreate is unavailable; this ledger records the dependency.
+
+### P5 durable code namespace boundary (5.1b prerequisite, D90)
+
+Implemented/reviewed [runtime§6.6](./rustack-workflows-20-lambda-runtime-design.md#66-code-namespace-provenance-and-recovery-boundary-d90): explicit immutable generation3 acquisition, canonical32-record code journal, monotonic loader/volume retirement, code-aware consumer/pin ordering and complete startup/shutdown volume audits. W286–W288 are resolved. The36 journal/profile and36 recovery controls pass; both retained full gates pass all55 exact resources (183 aggregate Rust passes/15 summaries each, including124 pure controls and four existing controls). Final ordinary/feature workspaces4,024/4,139, strict1,769 and Native3,001 pass with build/Clippy/fmt/rustdoc/audit/deny/text checks. Exact final postconditions show zero owned remnants, eight actual full-gate-provisioned sources preserved per engine and both exact owned empty bridges removed; the [D90 review](./rustack-workflows-93-review.md#d90-final-qualification-and-source-reconciliation) preserves initial label failures and the corrected prebuild-source comparison. The reader/recovery dependency is complete. Next implement the retained producing manager (source/admission ownership, journal-before-create mutation receipts, upload settlement, panic/loss/quarantine and joined retirement), then5.1c ordinary startup/provider/invocation and5.2c ZIP archives. No production code-volume writer or ordinary ZIP capability is installed by D90;5.1b/5.1/P5 and complete M0–M4 acceptance remain active. TaskCreate is unavailable; this ledger records status.
+
+### P5 retained producing code-volume owner (5.1b, D91)
+
+Implemented/reviewed [runtime§6.7](./rustack-workflows-20-lambda-runtime-design.md#67-retained-producing-code-volume-manager-d91): exact source-pin affiliation, exclusive retained producer/CAS/mutation receipts, above-worker source/admission/stage ownership, timed consumed Ready handoff and resumable physical retirement receipts. W289–W294 are fixed, including whole-runtime same-acquisition poison and post-wakeup deadline fencing. The46 targeted owner cases pass. Both retained full gates pass all56 exact resources (230 aggregate Rust passes/16 summaries each:56 resources+170 pure code controls+four retained controls). Ordinary/feature workspace4,070/4,185, strict1,833, Native3,001 and all standard/strict/security/text checks pass. Complete26-command postconditions show zero containers/code volumes/private references, eight actual provisioned source IDs preserved per engine and both exact owned empty bridges removed. See the [D91 review](./rustack-workflows-93-review.md#d91-final-actual-qualification-and-exact-postconditions) for provenance and limits. Task5.1b is complete. Next implement5.1c ordinary provided-runtime startup/provider/invocation, then5.2c ZIP archives; task5.1/P5 and full M0–M4, Node/handler SDK/IaC/reference/platform acceptance remain active. TaskCreate is unavailable; this ledger records status.
+
+### P5 ordinary provided-runtime ZIP consumption (5.1c, D92)
+
+Implemented/reviewed [runtime§6.8](./rustack-workflows-20-lambda-runtime-design.md#68-ordinary-provided-runtime-installation-and-environment-consumption-d92): explicit immutable provided.al2023 startup, generation3 source/producer installation, retained environment/code-stage admission and retirement, precommit ZIP validation, and ordinary signed SDK/ASL execution. W295–W305 are resolved/rechecked (eight P2 correctness/spec/fixture findings and three P3 oracle/evidence findings). Fourteen composition, ten provider and46 producer controls pass; both final frozen-source full gates execute all63 exact resources across eight suites, with263 Rust passes/20 summaries each (63 resources+196 pure code/consumer controls+four retained controls). Identical original ZIP bytes execute cold/warm through real Linux Native children on each selected engine. Final ordinary/feature workspaces4,098/4,213, strict boundaries1,864 and complete Native3,001 pass with build/Clippy/fmt/rustdoc/audit/deny/text gates. The26-command final postcondition report proves zero containers/volumes/private references, nine actual provisioned source IDs preserved per engine and both exact owned empty bridges removed. See the [D92 final qualification](./rustack-workflows-93-review.md#d92-final-actual-qualification-and-exact-postconditions) for hashes, failed observations and functional/emulation limits. Task5.1c and provided-runtime task5.1 are complete. Next implement5.2c Docker ZIP archives over the existing candidate/startup transaction; Node/handler SDK/IaC/server-in-container/reference/platform/full M0–M4 acceptance remains active. TaskCreate is unavailable; this ledger records status.
+
+
+### P5 managed provided-runtime ZIP archives (5.2c, D93)
+
+Implemented under [runtime§6.9](./rustack-workflows-20-lambda-runtime-design.md#69-bounded-provided-runtime-zip-archives-and-mixed-candidate-restoration-d93) and [operations§3.5](./rustack-workflows-60-operations-design.md#35-managed-provided-runtime-zip-archive-profile-d93). Dependency order: (1) explicit Image-only/managed profile and bounded metadata/original-ZIP ownership; (2) complete pure intake/borrowed export with canonical per-body and aggregate source checks; (3) private mixed candidate ZIP staging/conversion before Image pin effects, final capability/deadline publication; (4) hostile/rollback/deadline/observer regressions; (5) exact ordinary save/restart/no-replay/corrupt-generation/no-source resources on both engines; (6) complete gates/postconditions, guide and independent review. TaskCreate is unavailable; this ledger records the dependency. Node/handler SDK/IaC/server-in-container/reference/platform/full M4 remain active.
+
+
+D93 final qualification: W306–W314 are fixed/rechecked (seven P2 and two P3). Component gates pass42 source/projection,7 staging,23 candidate,98 raw-codec and3 producer cases:173 Rust cases plus four clock controls. Both final frozen-source full gates execute all65 exact resources once across eight suites,438 aggregate Rust passes/25 summaries each (65 resources+369 pure controls+four retained controls). Ordinary/feature workspace4,166/4,281, strict boundaries1,917 and complete Native3,077 pass with all nine standard and audit/deny commands0. The26-command final postcondition report proves zero containers/volumes/private references, nine actual provisioned source IDs preserved per engine and both exact owned empty bridges removed. The [D93 final review](./rustack-workflows-93-review.md#d93-final-actual-qualification-and-exact-postconditions) records final hashes, original ZIP identity, failed development evidence and functional/emulation limits. Task5.2c is complete. Next qualify official Node image execution, then handler SDK/callback images, IaC/server-in-container and remaining reference/platform/full M0–M4 acceptance.
+
+### P5 official Node image qualification (5.3a, D94)
+
+Complete for task5.3a/L02 under [runtime§4.17](./rustack-workflows-20-lambda-runtime-design.md#417-official-node-image-consumption-d94) and [Node verification](./rustack-workflows-70-verification-plan.md#official-node-image-qualification-d94). Dependency order: (1) executable spec/source provenance; (2) pinned selected-platform built-in-only Node fixture and explicit Make provisioning; (3) independent signed Rust/boto3 and ASL consumer with retained ownership and deadline controls; (4) frozen66-resource inventory and focused real execution; (5) both full lanes, ten-source/zero-remnant postconditions, standard/strict/security/text gates and independent review; (6) guide/capability reconciliation and coherent commit. The recorded acceptance below satisfies these gates. Remaining5.3 SDK/callback/IaC/server-in-container/reference/platform and5.4 acceptance stay active.
+
+D94 final acceptance: both final full gates pass66 exact required resources/482 aggregate Rust cases/28 summaries, including14 accepted-envelope body-admission controls. W315–W323 are fixed/rechecked (six P2, three P3). Current standard9 commands pass; ordinary/feature workspaces4,192/4,308, strict boundaries1,943 and complete Native3,077 pass with audit/deny0. Exact26-command postconditions prove zero all-state containers/volumes/private references, ten actual provisioned sources preserved per engine and both exact owned empty bridges removed. Independent source/evidence review and final text checks pass. The guide documents the pinned Node24.22.1 image profile without enabling Node ZIP runtime names or claiming full platform release. Task5.3a/L02 closes; task5.3b/L10 handler SDK networking and image callbacks are next, followed by IaC/server-in-container/reference/platform and5.4.
+
+### P5 explicit local handler SDK environment (5.3b, D95)
+
+Complete for task5.3b/L10 under [runtime§4.18](./rustack-workflows-20-lambda-runtime-design.md#418-explicit-local-handler-sdk-environment-d95), [operations§1.12](./rustack-workflows-60-operations-design.md#112-explicit-local-handler-sdk-configuration-d95) and [SDK verification](./rustack-workflows-70-verification-plan.md#explicit-image-handler-sdk-acceptance-d95). Dependency order: (1) actual bundled-client provenance and executable spec; (2) explicit typed credentials/settings and proof-affiliated context; (3) authoritative function-only Env, context warm isolation and preallocation controls; (4) separate pinned SDK fixture, existing Server/SDK owner consumption and centralized ordinary Docker feature/provisioning cohort; (5) frozen68-resource manifest, focused positive/negative real SDK execution; (6) both full lanes, eleven-source/zero-remnant postconditions, standard/strict/Native/security/text gates and independent review; (7) current guide/capability reconciliation and coherent commit. L10 is established by real default-provider requests, rather than configuration/package metadata.
+
+D95 acceptance: both full functional lanes pass68 exact resources/509 Rust cases/29 summaries. After the reviewed equivalent test-owner relocation, both current-source Node/SDK consumer gates pass all three exact resources/71 Rust cases/seven summaries without rebuilding the recorded images. W324–W332 are fixed/rechecked (five P2, four P3); all9 standard commands, ordinary/feature workspaces4,217/4,333, strict boundaries1,969, complete Native3,077 and audit/deny pass. Exact26-command postconditions prove zero all-state containers/volumes/private references, eleven actual source IDs preserved per engine and only the two exact owned empty bridges removed. Resource/final seals, the separate test-style/consumer deltas and fresh current-source qualification are recorded in the [D95 review](./rustack-workflows-93-review.md#p5-explicit-local-handler-sdk-qualification-d95). Remaining image callbacks/IaC/server-in-container/reference/platform and5.4 stay active; the full M0–M4 goal is not complete.
+
+### P4/P5 actual image callback consumption (4.3/5.3c, D96)
+
+Complete for task4.3/5.3c on the retained functional lanes under [integrations§5.6](./rustack-workflows-40-integrations-design.md#56-real-image-sdk-callbacks-and-independent-event-worker-d96), [runtime§4.19](./rustack-workflows-20-lambda-runtime-design.md#419-managed-node-image-callback-consumers-d96) and [image callback verification](./rustack-workflows-70-verification-plan.md#actual-managed-image-sdk-callback-acceptance-d96). Dependency order: (1) bounded actual Lambda/SFN/DynamoDB source metadata and executable design/preflight; (2) pinned managed Node dispatcher/independent Event worker with bounded default-provider SDK/gates and no token persistence; (3) ordinary constrained callback profile, shared retained SDK owner/post-stop audit hook and bounded independent hash/archive observer; (4) frozen37/70 inventory and Make provisioning/controls; (5) both focused and all70 full-resource lanes plus existing Node/SDK and complete Native acceptance; (6) standard/strict/security/text, twelve-source/zero-remnant/exact-owned-bridge proof and independent source/evidence review; (7) guide/capability reconciliation and coherent commit. TaskCreate is unavailable; this ledger tracks the dependency.
+
+Exit only after all literal nine callback modes and precise SDK failure classes, before/after-return causality, one-dispatch progress, old-token retry, heartbeat/absolute timeout, A-only cancellation/B independence, successful archive save/hash scans and physical cleanup are observed. Native/public wrong-scope tests remain required. Preserve the whole M0–M4 goal: IaC/server-in-container/native-reference/platform and final5.4 remain open after this slice.
+
+
+D96 final acceptance satisfies that dependency order and exit on both retained functional lanes: each full gate passes70 exact resources/519 Rust cases/30 summaries, and each focused gate passes both exact resources/451 cases/24 summaries. All nine real SDK callback modes, confirmed-save typed metadata/privacy checks and prior Node/SDK consumers pass. W333–W343 are fixed and independently rechecked (four P2, seven P3). Final standard9, workspace4,217/4,341, strict1,969, Native3,077 and audit/deny pass under the same41 source hashes. Exact26-command postconditions show zero containers/volumes/private references, twelve actual source IDs preserved per engine and only the two exact owned empty bridges removed. See [final D96 qualification](./rustack-workflows-93-review.md#final-d96-qualification). Task4.3/5.3c closes; IaC/server-in-container/native-reference/platform and final5.4 remain required, and the original complete objective stays active.
+
+
+### P5 Pulumi image-Lambda IaC lifecycle (5.3d, D97)
+
+Actual provider compatibility also requires the [unpublished version inventory read](./rustack-workflows-10-api-design.md#d97-unpublished-version-inventory-for-real-iac-consumers). Add its typed HTTP/API/registry tests before rerunning the real provider; publication remains rejected.
+
+Complete on native-arm64 VZ/emulated-amd64 QEMU under [IaC design](./rustack-workflows-50-iac-design.md) and [D97 verification](./rustack-workflows-70-verification-plan.md#managed-pulumi-image-lambda-iac-qualification-d97). Both exact consumers and both full72 gates pass under the final78-source stack/replay oracles:521 Rust cases/30 summaries per full lane,451/24 per focused lane, with the gated recovery preflight subsequently executed in each complete full72 gate. All final standard/strict/Native/security/text gates pass. The managed Image Lambda owner retains CLI/plugin lifetime; the actual18-command lifecycle, separate encrypted/current/removed-state audits and active-plugin Stop qualify task5.3d. W344–W364 are fixed/rechecked (twelve P2, nine P3). Exact26-command postconditions prove zero remnants, thirteen actual source IDs preserved per engine and removal of only two exact owned empty bridges. See [final D97 qualification](./rustack-workflows-93-review.md#d97-final-qualification-and-exact-postconditions). Keep D96 evidence intact; server-in-container/reference/platform/final5.4 and the original complete objective remain active. TaskCreate is unavailable; this ledger records the dependency.
+
+
+### P5 server-in-container functional topology (5.3e, D98)
+
+Implemented and functionally qualified under [server-container design](./rustack-workflows-55-server-container-design.md). Both complete74-resource owners join0 with535 Rust passes/31 summaries and every exact required name once; both focused owners join0 with463/25 and two exact names. All standard/strict/Native/security/text checks pass under the same103-source cohort. Exact26-command postconditions prove zero remnants, fourteen source IDs preserved per engine and only two task-owned empty bridges removed. W365–W370 and W376–W377 are fixed/rechecked; the three original failed owners/source cohorts/private evidence and D97 artifacts remain intact. See [final D98 evidence](./rustack-workflows-93-review.md#d98-final-qualification-and-exact-postconditions). Task5.3e closes on native-arm64 VZ/emulated-amd64 QEMU functional lanes. Root release packaging W371–W375, native-x86/reference/Desktop/rootless, remaining performance/load and complete5.4 remain required. The unchanged Runner and existing SDK480s/IaC1020s profiles are preserved; only this server consumer uses its600s observation profile.
+
+Exit requires an actual Linux Rustack container with an explicitly mounted daemon-side socket/supplemental GID, owned named data volume, internal DNS gateway and independently published loopback SDK port. Real handler SDK42/46, nested .sync:2 child50/warm counters, complete identity/mount/no-socket-leak proofs, expected unreachable-gateway startup rejection and physically clean server/runtime/volume shutdown must all pass. Do not substitute a host binary, guessed VM path/IP, forced cleanup, or the default release Dockerfile for this declared qualification image. Native-x86/reference/Desktop/rootless and complete5.4 remain required after5.3e.
+
+
+### P5 actual release image and Action boundary (5.4a, D99)
+
+Task5.4a complete on the retained functional lanes under [release-image design](./rustack-workflows-56-release-image-design.md). D99/5.4a qualifies the actual root release image and safe composite Action on the retained functional lanes. Each full gate executes76 exact resources with558 aggregate Rust passes/33 summaries; each focused gate executes2 exact resources with484/27. One1250-file source cohort, standard/strict/Native/security checks, actual image filesystem/ELF audits and exact zero-remnant/fifteen-source/two-owned-bridge postconditions pass. See [final D99 evidence](./rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions). W373 promotion, required arm64/reference/Desktop/rootless platforms, remaining performance/load and complete M4 remain open. [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) waives further Linux x86_64 validation; existing QEMU evidence remains historical functional evidence. Dependency order, original failed cohorts/private evidence, unchanged source feature defaults and shared Runner are preserved. The separate Action1 process profile does not change Native26/Docker76. TaskCreate is unavailable; this ledger records the dependency.
+
+Executed exit closes W371/W372/W374/W375 and W378–W396: actual root-image SDK42/46/nested50, expected startup rejection, exact image health/filesystem/ELF, owned shutdown and actual composite Action controls all pass. W373 promotion and required arm64/reference/Desktop/rootless/performance/load/full5.4 remain required; D100 removes Linux x86_64 verification as a blocker.
+
+### P5 direct Linux pure-workflow measurement dependency (5.3, D101)
+
+Implemented/reviewed under [verification§5.2](./rustack-workflows-70-verification-plan.md#52-direct-linux-arm64-pure-workflow-measurements-d101). The actual locked GNU arm64 SDK harness and CLI run directly inside a new4-vCPU/8GiB native VZ guest, with six exact normal controls and both exact resources once. The pure50-state/1KiB100-execution p95 is10791µs;100 immediate live-loop/Stop cycles, explicit history exhaustion and physical server/group cleanup pass. Both source and target mounts are read-only; no Lambda/Docker workload executes. Thirteen independent Python controls and all13 host gates pass under one1252-source cohort: default4,218/feature4,359, strict1,969, Native3,078, fmt/build/Clippy/rustdoc/audit/deny. The original host owner joins0; seven readonly postconditions confirm the new daemon has zero containers/volumes/images, no running Rustack server and the original ARM profile's allocation is unchanged. W397–W402 are fixed/rechecked; [raw measurements and exact hashes](../docs/research/workflows-linux-performance-review.md) are retained. Four virtual CPUs do not prove physical dedication, so referenceQualification remains pending. Dedicated reference, image performance/load, Desktop/rootless, W373 and complete5.3/5.4/M4 remain required. D100's x86 waiver and historical D74/D99 artifacts are preserved.
+
+### P5 image performance and repeated cleanup (5.3, D102)
+
+Implemented/reviewed under the [image-performance contract](./rustack-workflows-57-image-performance-design.md) and [verification§5.3](./rustack-workflows-70-verification-plan.md#53-image-invocation-initialization-and-repeated-cleanup-d102). The final1260-source seventh cohort adds successful initialization diagnostics, timed independent RIC modes, causal paced-flood barriers, actual readiness/Tokio accounting, strict report/rank/provenance checks, immutable image transport and pre-build source-cache retention. W403–W426 are corrected and independently rechecked. Source seal SHA256 is a1be06d57466a78c01377087e253cdc1aff1957cfc331b1b251e5393e3ef408c.
+
+All15 host gates and their original owner join0: default4224/feature4365, strict1971, complete Native3078, both build/Clippy/rustdoc profiles, fmt, Action26, image21/Linux14 controls and audit/deny. The full ARM owner joins0 after618.093s with all79 exact resources once/565 Rust passes/33 summaries. Final Linux uses those exact three full-build image IDs; its explicitly recorded owner/Make PID and group join0, all three raw cases validate against the retained report/current Cargo-selected ELF files, and warm/cold p95=3196/165350µs. All100 live-flood timeout cycles return actual Tokio tasks to15; quiescence p95/max=5539/9888µs.
+
+The source-cache audit detects seven lost old IDs; exact BuildKit-history graph/provenance recovery restores all original20, preserves current fixture tags and retains host backups. The canonical builder now protects all observed rebuilt source aliases before retagging; absence reporting does not replace the independent historical-ID audit. All48 final CLI postconditions pass: zero containers/volumes/forbidden references on both engines,32/15 source/target IDs retained, and only two exact owned empty bridges removed. [Complete raw evidence](../docs/research/workflows-image-performance-review.md) preserves the fourth unexplained flood failure, intermediate cohorts, the exact cache repair and all original owner/artifact bindings. This closes the current-profile workload dependency only. Dedicated-reference/Desktop/rootless, remaining load/correctness, W373 and complete5.3/5.4/M4 remain required; D100 still waives further x86 validation. The full objective remains active.
+
+### P5 isolated rootless bootstrap dependency (5.3, D103)
+
+Implemented and independently reviewed under the [rootless platform design](./rustack-workflows-58-rootless-platform-design.md). The retained native ARM VZ v2 profile runs a real UID501 Docker29.5.2 rootless user daemon with a separate rootful infrastructure engine, verified cgroup v2/systemd delegation and derived namespace socket GID991.25 normal controls pass; actual original installation/recovery owners and the source-fenced final/repeat read-only attestations are retained. A TERM-ignoring root UID0 control is physically killed/joined by the recorded root-manager runtime/stop bounds. W427–W434 are fixed/rechecked. The original three VM allocations/context and32/15 source image IDs are preserved; no image rebuild, publication or existing-service restart occurs. Rust verification is not applicable to this Python/environment-only slice. [Executed evidence and failed-attempt history](../docs/research/workflows-rootless-platform-review.md) distinguish the dependency from the still-required actual kernel probe, immutable fixture transport, full79-resource rootless matrix, mapped server-socket/endpoint and performance/load qualification. Desktop/reference/remaining recovery/W373/full5.3/5.4/M4 stay active; D100 remains binding.
+
+## D107 — Remaining code before verification
+
+The user requires all code completion before executing tests. Follow [final consumer/release design](./rustack-workflows-59-release-qualification-design.md) for O01/O03/O04/O05, controlled server/release image refresh, exact manifest growth, the final verify-workflows assembler and W373 immutable candidate/qualification/promotion separation. Independent read-only review precedes the new source-frozen execution cohort. Existing evidence does not qualify these unexecuted changes. Desktop/reference/full platform qualification remains required; D100 is unchanged.
+
+D107 code now supplies the additional O01/O03/O04/O05 consumers, grows the canonical Docker inventory from79 to83, and adds engine/source-bound execution transcripts for all required platform lanes. Release candidate creation, selective evidence packing, final verification and explicit publication are separate workflows/Make entry points. Exact daemon image IDs and configuration digests remain distinct. These implementations are not yet execution-qualified; preserve all earlier failed/intermediate evidence and complete the new source cohort only after the code-first independent review/formatting boundary.
+
+D108 corrects the remaining archive consumer, bound transcript parsing, canonical manifest control and timed metadata connection lifecycle before restarting verification. Freeze/review all those changes together; subsequent targeted and full matrices must use a new exact source cohort. The prior complete-rootless attempt stopped after case67 and remains failed evidence, including the unexplained cycle-54 timeout. No historical pass substitutes for the new cohort.
+
+D109's focused diagnostic reaches a pre-begin cycle84 failure. Complete [D110's initialization-owned channel](./rustack-workflows-57-image-performance-design.md#9-initialization-owned-flood-control-channel-d110), five-source controlled refresh and report/negative controls before restarting execution. Independently review code, then run normal controls and focused actual rootless100-cycle diagnosis; only stable corrected code enters the final full Rust/Native/rootless/rootful cohort. Preserve previous83/83 rootful,82/83 rootless and focused failures under their original seals.
+
+The corrected83b2571 source cohort completes code-first independent review,245 Python controls, all15 Rust gates, Native/Action, focused100-cycle rootless diagnosis and complete83/83 rootless execution. Isolated rootful execution subsequently passes83/83 after15 hash-checked imports and an actual same-engine five-image rebuild; all raw platform and release receipts validate. Foreign resources are preserved, exact owned empty networks retire non-forcibly, and original commit/source/artifact bindings remain intact. See [current-source execution and cleanup evidence](../docs/research/workflows-final-consumers-review.md#isolated-rootful-continuation). Docker Desktop, dedicated physical ARM reference and complete same-commit final release qualification remain open; no final M4 or publication is claimed. D100 remains binding.
+
+### P5 external compatibility continuation
+
+The user requests executing the overlapping LocalStack test inventory. Follow [external compatibility design61](./rustack-workflows-61-localstack-compatibility-design.md); do not weaken original upstream assertions or infer broad AWS parity. TaskCreate is unavailable, so this dependency-ordered table records the work.
+
+| Task | Deliverable | State |
+|---|---|---|
+| E01 | Pinned upstream fixture/snapshot study and executable boundary | Complete |
+| E02 | Exact selected inventory, dependency/source seals and private snapshot plugin | Complete: 91 pure / 32 Docker nodes; obsolete snapshot IDs retained as exclusions |
+| E03 | Owned actual Rustack launcher, pure and real-image Make targets | Complete: actual server and six original Python3.12 handlers |
+| E04 | Adapter negative controls and independent code-first review | Complete: 13 integrity controls, independent adapter/W438–W446 review and strict new-owner Clippy |
+| E05 | Run selected external cases; correct in-profile bugs and retain failures | Complete under D114: unchanged91/91 pure and32/32 actual Docker; original failed cohorts retained |
+| E06 | Standard gates, independent evidence review and documented coverage | Complete: 15 Rust gates, 3231 Native passes, 26 Action controls, 13 adapter controls, joined cleanup and independent saved-evidence review |
+
+
+### E05 observed-AWS closure (D114)
+
+| Task | Dependency | Deliverable | State |
+|---|---|---|---|
+| E07 | User scope decision | Design61 §7 and D114 supersede the five earlier local restrictions | Complete |
+| E08 | E07 | Bounded collection Format, relaxed ordinary literal braces, empty JSON handling and scoped missing-function Cause | Complete |
+| E09 | E08 | Regression coverage and independent code-first review | Complete: 944 core / 30 bridge / 96 preserve-order expression checks and strict boundaries; W447–W449 resolved |
+| E10 | E09 | Exact91/91 +32/32, Rust/Native/Action checks, cleanup/evidence review and PR update | Complete: unchanged123/123, all current-source gates and independent evidence review; delivered through PR76 |
diff --git a/specs/rustack-workflows-93-review.md b/specs/rustack-workflows-93-review.md
new file mode 100644
index 00000000..55e6504c
--- /dev/null
+++ b/specs/rustack-workflows-93-review.md
@@ -0,0 +1,2142 @@
+# Workflows 93: Implementation Review and Required Follow-ups
+
+Status: active implementation record · Date: 2026-10-27
+
+This is the canonical review backlog for P0–P5. A corrected specification is not evidence that its runtime consumer has been implemented. All required in-scope entries must close before the complete feature is declared done.
+
+## P0 independent review
+
+| ID | Priority / source | Finding and resolution | Remaining implementation gate |
+|---|---|---|---|
+| W01 | P1; `apps/rustack/src/main.rs:373`, runtime transport contract | Bollard logs request/response/attach bytes at debug/trace. Specification now requires an independent mandatory dependency filter, even with RUST_LOG=trace | Closed for implemented runtime/wire paths: mandatory task-bound filter plus captured Hyper and actual Bollard call-site regressions. Future Docker stream consumers must retain the same policy |
+| W02 | P1; runtime protocol contract | BootstrapReady was missing from the message variants despite being required by initialization. Specification fixed; real relay probe uses the separate signal | P1: implement production typed signal and initialization tests |
+| W03 | P1; runtime create contract | Omitted Architectures must default to x86_64, unlike an explicit empty list. Specification corrected | P1: normalize before validation and cover omission/empty/multiple |
+| W04 | P1; `codegen/src/shapes.rs:180`, `codegen/src/codegen.rs:263` | Generated chrono fields do not accept numeric AWS JSON timestamps. Independently reproduced; required/optional/fractional/negative codec behavior pinned | P2 task2.1: generator fix and executable generated round trips before service generation |
+| W05 | P2; callback error contract | Known completed/revoked callback tasks use TaskTimedOut, not TaskDoesNotExist. Specification and fixtures corrected | P4: implement token tombstone classification and retry/cancel cases |
+| W06 | P1; pinned AWS-validated `test_callback.snapshot.json:1251` | `.sync:2` decodes Input as well as Output. Root's subsequent oracle inspection corrected the specification and added TaskSubmitted | P3: validate complete optimized envelope, dates and history sequence |
+
+All six changes preserve the intended scope. No review finding has been dismissed as invalid. P0 probe review produced the following additional fixes.
+
+## P0 retained-probe review
+
+| ID | Priority | Finding and fix | Evidence |
+|---|---|---|---|
+| W07 | P2 | Create-response cancellation can lose an ID. Allocate a run UUID before requests, label every resource, reconcile labels under a bounded cleanup deadline, and deliberately omit one create result from the ID registry | Both retained architecture runs report labelReconciliation=true and independent daemon queries find no P0 containers |
+| W08 | P2 | Close/Ack did not establish EOF behavior. Add clean/truncated-prefix/truncated-body EOF tests and compare real attach-input shutdown with StdinOnce false/true | Seven unit tests pass; both architecture runs show false leaves the relay running and true exits before cleanup. Production spec now requires true |
+| W09 | P3 | Offline Python tests generated untracked bytecode | Probe target sets PYTHONDONTWRITEBYTECODE=1; generated test bytecode removed and excluded from staged files |
+
+The independent final recheck confirmed W07–W09 addressed, queried both daemon run labels and found zero containers, and reported no further in-P0 correctness issue. Production consumers remain subject to W01–W06.
+
+## P1 task1.1 foundation slice review
+
+The independent read-only review against commit `955267f` found no new in-slice correctness, security or compatibility defect. It verified strict resource UUID deserialization, immutable lifetime identity, legacy and current snapshot behavior, duplicate identity rejection, complete configuration capture, alias metadata versus resolved version, warm-key isolation and request/result diagnostic redaction. Ten new regression tests pass within 154 Lambda core tests. This approval covers the capture foundation only; artifact enums, cooperative cancellation and Docker execution remain required in P1. Standard workspace build/test/Clippy/rustdoc and two identity doctests pass; the native target validates six native/DryRun cases (its separately gated Squib case is not execution evidence). Baseline advisory remediation B01 and strict-lint remediation B03 remain open.
+
+## P1 task1.1 artifact slice review
+
+The independent review against commit `7915281` identified two implementation findings and one preflight-order documentation mismatch. All were fixed and the final independent recheck found no remaining in-slice issue.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W10 | P2; `crates/rustack-lambda-core/src/provider.rs:504`, `src/storage.rs:74` | Rejected settings could retain a staged ZIP. Shared settings preflight now runs before source IO. Unpublished-artifact guards roll back on failure/cancellation/CAS conflict, and restore commits guards only after the complete candidate validates | Invalid settings leave no artifacts; real revision-conflict, aborted owner and rejected restore regressions preserve committed resources |
+| W11 | P3; `crates/rustack-lambda-core/src/artifact/image.rs:141` | Docker classifies uppercase first components as registry domains. Parser and cases now accept Registry/worker while rejecting uppercase repository components | Parameterized reference and serde cases cover single-label registries, DNS/IPv6 ports, tags/digests and invalid syntax |
+| W12 | P3; `crates/rustack-lambda-core/src/storage.rs:813` | Snapshot settings validation followed staging despite the documented ordering. Shared settings preflight now runs before archive decoding or staging; full integrity checks still retain rollback ownership | Early-invalid-settings/invalid-base64 regression plus a separate post-staging hash-mismatch rollback regression |
+
+The slice also preserves extracted ZIP roots in Native warm keys and retains code in Native child supervision through exit. The standard workspace suite passes 1,752 tests (392 preexisting ignored), including 203 Lambda core tests; twelve Lambda doctests and six native/DryRun cases pass. The separately gated Squib case selected by the native Make target is not Squib execution evidence. New winnow/rstest dependency use introduces no audit finding; the same 16 baseline advisories remain B01. Strict production boundary lint debt remains B03; no ignore was added. ExecutionRevision ownership, cooperative invocation cancellation, deployment resolution and Docker remain required before P1/M0 completion.
+
+## P1 task1.1 cancellation/revision slice review
+
+The independent read-only review found three lifecycle/admission defects. All were fixed; its final recheck found no further concrete in-slice finding.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W13 | P1; `crates/rustack-lambda-core/src/executor/squib.rs:170` | Dropping an idle Squib executor relied on the facade's best-effort Drop and detached VMM handle. OwnedVm now transfers idle/busy VM shutdown into retained CleanupTask, using the captured parent Tokio handle | Generic owned-VM seam test drops off-runtime, expires a cleanup waiter and proves allocation retention until shutdown completes. This is not actual VM execution evidence |
+| W14 | P2; `crates/rustack-lambda-core/src/executor/instance.rs:276` | A full/disabled warm pool dropped a successful instance before reaping. Release now returns rejected ownership; Invoke awaits API shutdown and backend termination before settlement | Two overlapping real Native calls with warm retention0/1 require exactly0/1 surviving child after both responses |
+| W15 | P2; `crates/rustack-lambda-core/src/executor/native.rs:129` | Known host-architecture mismatch failed only after Event acceptance. Availability now checks architecture before work admission | Real fixture Event rejects the mismatch, then quiesces cleanly without starting the foreign bootstrap |
+
+ExecutionRevision uses shared Arc ownership; InvocationHandle and the bounded work actor preserve UUID/deadline/cancellation through backend cleanup. Waiter cancellation never aborts backend workers. Native child supervisors retain artifact leases and process reservations through reaping, including executor Drop. Tests cover late-result rejection, cleanup timeout/aborted waiters, worker panic,128 accepted/32 running/default8 function limits and permit release after cleanup. The workspace suite passes1,767 tests (392 preexisting ignored), including215 Lambda core tests and five real Native fixture tests. Lambda doctests, standard workspace build/Clippy/rustdoc and the native provider target pass. Its separately gated Squib test remains excluded as VM evidence. Full Docker and workflow milestones, plus B01/B03, remain required.
+
+## P1 task1.2 protocol slice review
+
+The independent read-only review verified bounded preflight before Serde, typed variants, duplicate/unknown-field rejection, independent metadata/payload budgets, canonical identities, redacted diagnostics, absolute IO deadlines and clean/truncated EOF handling. Its final recheck found no remaining in-slice finding.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W16 | P3; `crates/rustack-lambda-runtime/src/protocol/types.rs`, FunctionArn parsing | Numeric qualifier zero/overflow differed from the provider's validated qualifier. Runtime ARN parsing now enforces the same positive-u64 rule | Direct parse and full envelope deserialization reject0 and18446744073709551616 |
+
+The shared runtime crate has39 passing codec tests, including512-case properties for malformed bytes, mutated valid envelopes and arbitrary binary payloads, plus eight passing doctests. The workspace suite passes1,806 tests (392 preexisting ignored); build/fmt/Clippy/rustdoc and strict runtime production-boundary checks pass. `make test-lambda-runtime` runs the reusable contract suite. Proptest1.12 uses only std; its three added dev packages introduce no audit finding. The same16 B01 advisories remain; deny bans/licenses/sources pass. This approval covers the protocol only: shared RuntimeSession, HTTP migration, relay executable, Docker execution and workflow engine remain required.
+
+## P1 task1.2 shared-session slice review
+
+The independent read-only review found three cancellation/order races. All were fixed and the final recheck found no remaining concrete in-slice finding.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W17 | P2; `crates/rustack-lambda-runtime/src/session.rs:821` | A sent oneshot response was treated as delivered before its waiter consumed it. Offering now retains Invocation until a per-poll receipt; abandoned receipts recover queued ownership | Deterministic manual-poll test drops next() after send but before consumption, then receives the same event exactly once through a replacement poll |
+| W18 | P2; `crates/rustack-lambda-runtime/src/session.rs:782` | Biased selection did not recheck cancellation arriving between branch polls. Offer/receipt/completion and command dispatch now revalidate cancellation, owner closure and deadline before mutation | Direct transition tests cover cancelled/closed/expired attempts across offer, receipt and completion and require Closed with failed pending results |
+| W19 | P2; `crates/rustack-lambda-runtime/src/session.rs:768` | A receipt and following completion could arrive between select branch polls, leaving stale Offering/initialization state. Command dispatch now synchronously reconciles ready/closed receipts before matching commands | Ready-receipt→Complete succeeds; ready-receipt→InitError returns Busy and preserves the delivered attempt |
+
+The actor owns an eight-command mailbox, one queued/offered/delivered attempt and one poll; per-attempt tickets prevent old cancellation from targeting new work. RPC envelopes carry their own deadline, readiness changes once, initialization notifies once, shutdown retains its join handle across cancelled waiters and caches failed settlement. Sixteen actor tests and the39 codec tests pass;23 runtime doctests and strict production-boundary Clippy pass. Workspace build/fmt/Clippy/rustdoc and1,822 tests pass (392 preexisting ignored). This review covers the shared actor only: the Native HTTP adapter still uses its existing session implementation until migration; the relay/socket client, Docker executor and ASL engine are not implemented by this slice. B01/B03 remain required.
+
+## P1 task1.2 shared HTTP / Native migration review
+
+The independent read-only review found three boundary/lifecycle defects. All were fixed and the final recheck found no remaining concrete in-slice finding.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W20 | P1; `crates/rustack-lambda-runtime/src/http.rs:216`, pinned Hyper1.11.1 `proto/h1/decode.rs:149` | Hyper TRACE includes partial trailer bytes before application validation. Every HTTP supervisor/connection future now uses an independent subscriber denying Hyper/hyper_util DEBUG/TRACE while delegating allowed application context/events | TRACE capture covers ordinary target/header/body and a deliberately fragmented secret trailer; no secret reaches diagnostics |
+| W21 | P2; `crates/rustack-lambda-runtime/src/http.rs:456` | Collected trailers bypassed per-header validation. All trailers now reject before session mutation | Short, oversized and Invocation-Id trailers return400 without initialization notification or session closure |
+| W22 | P2; `crates/rustack-lambda-core/src/executor/instance.rs:309` | Revision mismatch cleared old instances through Drop, losing API join ownership. Acquisition now extracts stale instances and awaits bounded parallel retirement outside map guards; empty buckets are removed | Real old API holds an incomplete body while code changes; replacement waits its408 deadline/join and old child reap before invoking new code |
+
+The shared adapter replaces the old pending-map implementation while preserving executor module reexports. Native cold start now races first-poll readiness, init error, process exit and caller cancellation under one init deadline, retiring API/process owners on failure. The Native executor's one cleanup task atomically captures reaper/pool/child ownership, survives cancelled/concurrent shutdown waiters and preserves cleanup failures. Eleven real fixture tests cover slow/no polling, init failure, startup cancellation, version isolation, stale connections, busy cancellation and joined shutdown. The existing native provider target passes six Native/DryRun scenarios; its separately gated Squib selection remains excluded as VM execution evidence.
+
+Workspace build/fmt/Clippy/rustdoc and1,841 tests pass (392 preexisting ignored). Shared runtime:71 tests,34 doctests and strict production-boundary Clippy; Lambda core:212 tests and26 doctests. Three old core HTTP tests moved into the shared adapter's stronger wire suite. Cargo audit still finds the same16 B01 advisories; no new dependency version/package landed, and deny bans/licenses/sources pass. B03 remains open for old core boundaries. The relay executable/client, Docker executor and ASL engine remain required before milestone completion.
+
+## P1 task1.2 Linux relay slice review
+
+The independent read-only review found one documentation mismatch and two test-harness ownership gaps. A self-review also found a completed-worker error masking race; its fix was independently rechecked. The final review found no remaining concrete in-slice issue.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W23 | P3; `specs/rustack-workflows-20-lambda-runtime-design.md` §3.4 | Retiring was described as Close-only while duplicate matching Cancel was deliberately idempotent. The contract now documents that exception without refreshing the lease, and distinguishes fatal session/attempt expiry from the bounded retirement handshake | Repeated busy/post-completion Cancel tests plus explicit real RIC cancellation qualification |
+| W24 | P2; self-review, `crates/rustack-lambda-runtime/src/relay.rs`, RelayActor::run | Priority stop could win while a completed IO error remained in JoinSet; teardown ignored that error. Drain now preserves completed IO failure/unexpected writer exit and ignores only joined abort cancellation or the expected queued-Close reader exit | Deterministic pre-completed EOF worker with priority stop requires EOF failure and a closed API listener |
+| W25 | P2; `crates/rustack-lambda-runtime/tests/docker.rs`, busy-marker loop | An outer timeout could cancel a CLI helper before explicit kill/reap. Forward one absolute deadline into the helper owner instead | Real docker wait helper expires and is reaped while the relay remains usable for Close/Ack |
+| W26 | P2; same file, Environment::cleanup | A CLI reaping timeout returned before independent label reconciliation. Record cleanup errors, retain process ownership through reaping and still perform the label check before combining results | Every successful/failed setup, scope, pipe and handler case verifies no run-labeled container remains; final independent review confirms error aggregation order |
+
+The relay binary uses safe nonblocking owned Linux pipe descriptors, task-bound tracing, bounded two-frame mailboxes and confirmed flush receipts. It separates relay Ready from first-RIC-poll BootstrapReady, retains borrowed attempt tickets across select cancellation, rejects invalid scope/order/direction, distinguishes runtime error payloads, and joins the shared API and control workers on every exit. Close and cancellation do not claim external function termination. Pinned provided.al2023 relay images are built by Make targets for both supported Linux architectures.
+
+Workspace build/fmt/Clippy/rustdoc and1,853 tests pass. The ordinary suite has396 ignored tests:392 preexisting resource tests plus four explicitly gated Docker relay tests. Runtime:83 unit tests,39 doctests and strict production-boundary Clippy pass; the actual Linux entry point also passes cross-target Clippy. `make test-lambda-runtime-docker` explicitly ran all four tests with zero ignored on each arm64 VZ and amd64/QEMU daemon (eight executed test cases overall), proving official Python RIC computed42/7, warm counter1/2, request metadata, nonroot/read-only/cgroup limits, handler error, busy cancellation, Close/EOF/truncated/partial/idle exits, failed allocation and CLI helper timeout cleanup. Both daemons have zero remaining test-labeled containers. Native x86, Desktop and rootless qualification remain M4.
+
+No dependency version/package was added; existing anyhow/serde_json are test dependencies and tracing-subscriber is also used by the relay entry point. Audit/deny report the same16 B01 advisories; bans/licenses/sources pass. B03 remains open. The production host control client, Docker deployment/pool/provider integration and ASL engine remain required; this is not full P1/M0 acceptance.
+
+## P1 task1.2 host client / shared stream ownership review
+
+The independent read-only review found two protocol-validation defects. Both were fixed and the final recheck found no remaining concrete in-slice finding. Self-review also corrected an error-class race exposed by the existing partial-frame regression after extracting stream ownership.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W27 | P2; `crates/rustack-lambda-runtime/src/client.rs`, ControlClient::next | Tokio timeout can poll an already-ready inner receive before its expired timer. Recheck the absolute clock after await and before frame/state mutation; shared send also rechecks after its flush receipt | Paused-clock pending waiter, capacity-one input and a queued valid frame reject after caller expiry; no false BootstrapReady |
+| W28 | P3; same file, InitError handling | InitError was accepted after an earlier result proved delivery. Track proven delivery, including a discarded late cancellation result, and reject later initialization failures | Ordered Idle, later Busy and both cancellation-state cases fail closed after successful delivery |
+| W29 | P2; self-review, `crates/rustack-lambda-runtime/src/transport.rs`, Transport::recv | Reader drops its sender before supervisor settlement, so an empty mailbox could report EOF before the actual parser/deadline failure. Wait for retained supervisor classification on channel closure | Existing paused partial-frame regression still requires Protocol/Deadline; completed EOF/priority-stop test preserves EOF and joined API closure |
+
+The host validates ordered Hello/architecture/Ready and first-poll BootstrapReady, owns one active attempt, rejects foreign/duplicate/out-of-order events and discards at most one matching late outcome while cancelling. A write-in-progress flag prevents reuse after a dropped send future. Closing preserves validation of queued results/bootstrap/cancel acknowledgements; Ack/close cannot precede outstanding Cancel Ack. Cancelled next/shutdown waiters retain parsing and joined IO ownership. The same private transport supervisor now owns both relay and host stream workers, bounded mailboxes, terminal-frame preservation, flush receipts and cached failure settlement; the relay still separately joins its API before transport retirement.
+
+Workspace build/test/fmt/Clippy/rustdoc pass with1,867 tests and397 ignored (392 preexisting plus five explicit Docker tests). Runtime:97 tests,47 doctests and strict production-boundary Clippy pass; the Linux entry point passes cross-target Clippy. All five resource-gated Docker tests explicitly pass with zero ignored on arm64 VZ and amd64/QEMU. The new case transfers actual CLI pipes into production ControlClient, performs computed42/7 and warm1/2, then tests separate real FunctionError and busy Cancel paths, joins streams, removes containers, reaps the CLI and reconciles its run label. This qualifies client/relay composition, not the future production Docker attach/deployment/pool/provider.
+
+No dependency changes landed in this slice. The preceding audit remains unchanged B01 evidence; B01/B03 remain mandatory P1 gates. Docker startup/resource probes, production lifecycle integration and the ASL engine remain required by the complete P0–P5 objective.
+
+## P1 task1.3 transport design preflight
+
+The pinned [source study](../docs/research/study-bollard-docker-transport-boundaries.md) and runtime §3.6/D19 refine the forthcoming Docker consumer before production code. Independent read-only review confirmed the response collection, timeout, attach decoder and diagnostic facts. These are design/source checks, not runtime acceptance.
+
+| ID | Priority / source | Finding and resolution | Remaining gate |
+|---|---|---|---|
+| W30 | P2; runtime §3.6 capacity | An eight-connection limit was ambiguous when32 environments each retain control/log streams. Management now uses six business/two reserved cleanup slots and32/8 mailboxes; supervised stream handoff releases management slots and retains independent environment/deployment reservations | Implement saturation/cleanup-lane tests and prove long-lived streams cannot starve kill/remove |
+| W31 | P3; source study citations | Several references named enclosing methods instead of exact collection/length/trace expressions. Corrected to the vendored release's verified lines | Source/link/pin checks; no runtime behavior claim |
+
+The final independent review found no remaining load-bearing design gap. W01 remains a mandatory consumer/filter/TRACE gate under the refined model-only production path. No Rust production/dependency source changed in this preflight; bounded fake-daemon and actual Docker wire/large-payload evidence remain required before the consumer lands.
+
+## P1 task1.3 shared JSON preflight review
+
+The independent read-only review found no concrete in-slice defect. It verified per-object decoded-key uniqueness, escaped keys, UTF-8 byte limits, encoded-string scratch bounds, aggregate member/element counting, root/container depth, malformed/trailing JSON, schema-error redaction and controlled key-limit configuration. The final recheck confirmed the generic parser does not hardcode Docker's256-byte key ceiling; consumers explicitly choose that tighter profile.
+
+rustack-core::json now exposes validated nonzero JsonLimits, validate and from_slice<T>. A linear encoded-string scan precedes DeserializeSeed traversal; the traversal retains only bounded object key sets and builds no dynamic Value tree. Typed materialization follows successful preflight, and domain validation still belongs to the service. Core now forbids unsafe code. Four existing core documentation-format findings were corrected so its complete strict production-boundary check passes without ignores; B03's Lambda/auth/model debt remains open.
+
+Core has39 passing tests (21 new JSON cases, including two512-case properties) and four passing doctests. `make test-json-boundaries` runs that suite and strict production Clippy. Workspace build/test/fmt/Clippy/rustdoc pass with1,888 tests and397 ignored resource tests. Existing proptest/rstest versions are reused only for core development; no dependency version/package was added. Audit/deny still report16 B01 advisories, with bans/licenses/sources passing. Docker metadata/stream consumers and all full P1/M0 exits remain required; a passing parser is not executor acceptance.
+
+## P1 task1.3 bounded Docker wire review
+
+The independent read-only review and final recheck found no remaining concrete in-slice issue after the lifecycle-wait correction below. Review covered typed operation paths and status handling, version negotiation, bounded serialization/JSON and HTTP framing, retained driver/handoff ownership, deadline/cancel races, worker panic settlement, strict multiplexed streaming and secret capture. No production DockerExecutor/provider acceptance is claimed.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W32 | P2; `crates/rustack-lambda-core/src/docker/mod.rs`, request admission | Long-lived Wait jobs could fill both reserved cleanup slots and prevent Kill/Remove. Dedicated bounded32-job/eight-mailbox wait lane now leaves two slots for inspect/kill/remove/list; six short business slots remain separate | Held-two-waits regression completes Kill before either wait is released; business saturation admits Remove; exported attach survives wire shutdown without retaining a management slot. D20 records the ownership rule |
+
+DockerWire and DockerPort implement bounded Unix management and strict upgraded attach using generated model-only bollard-stubs1.53.1-rc.29.3.1. All15 new fake-daemon/framing tests pass within227 Lambda core tests. The workspace passes1,903 tests (398 explicitly resource-gated), build/fmt/Clippy/rustdoc; the unchanged strict Lambda boundary debt remains B03, with no new Docker-path findings. Runtime contracts pass97 tests and48 doctests plus strict production checks and actual Linux entry-point Clippy. Eleven real Native fixture tests pass; the native provider target passes its six actual native/DryRun cases, with its separately gated Squib case still excluded as VM evidence.
+
+The actual production-wire integration passes against official Python RIC images on arm64 VZ and amd64/QEMU, computing42/7 with warm counters1/2, transferring near6MiB requests/responses and surfacing a real FunctionError. Each run independently removes both named containers, joins stream/wire owners and checks its run-label scope; subsequent daemon queries find no owned wire containers. These stress cases use60s IO/120s attempt budgets rather than claiming default5s performance. The separate five-case relay suite remains required regression evidence on each daemon.
+
+W01's implemented filter now covers Hyper/hyper_util/Bollard independent of application TRACE. Production capture excludes request/response/header/partial-trailer markers while preserving application logs. The standalone compatibility suite passes eight tests/five doctests and Clippy, including actual Bollard create/logs construction/polls and truncated decoder fallback under LogTracer. It does not replace the stricter production framing decoder. Workspace/probe stacks align on Tokio1.54.1/Hyper1.12.0; root audit still has the same16 B01 advisories, deny bans/licenses/sources pass, and the standalone probe audit is clean. No ignore was added.
+
+Deployment/image actors, remaining stream/network/probe consumers, warm pooling, startup/resource checks, full SDK/provider acceptance and B01/B03 remain required before P1 closes. W30 is closed for implemented wire admission/handoff; future log/pull owners remain subject to its existing-reservation rule. W31's source citations remain pinned and checked.
+
+## P1 task1.3 local image resolution review
+
+Independent design and implementation review found the issues below. All are fixed, with a final read-only recheck reporting no remaining concrete in-slice finding. The [source study](../docs/research/study-bollard-docker-transport-boundaries.md#platform-specific-image-identity-follow-up) pins the actual observations and historical Moby merge/store source.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W33 | P2; runtime §2.8 / `artifact/execution.rs:38` | A hash alone discards the defaults needed to preserve empty overrides without per-invoke inspection. ResolvedImage now retains validated Arc defaults and returns a fully materialized redacted Docker plan with the empty-entrypoint reset sentinel | Default/override/composed-budget tests, snapshot round trips and real create/inspect merge checks |
+| W34 | P3; `docker/image.rs`, repository matching | Raw repository equality loses familiar Docker Hub digest evidence. Normalize default docker.io/library and index.docker.io, while classifying short-local provenance from original spelling | Familiar-name, registry-case, port/IPv6, unrelated-alias and short-local cases |
+| W35 | P2; `artifact/image.rs:443` | Valid saved execution changes could retain a stale inspection hash; the selected descriptor digest was not retained. Metadata now stores selected_manifest and the constructor/deserializer recomputes centralized canonical SHA-256 over parent/child/platform/size/defaults | Ten valid-value mutation cases reject stale fingerprints; immutable defaults and Debug remain redacted |
+| W36 | P2; `docker/image.rs:206` | Missing Descriptor alone can misclassify downlevel containerd as classic, including contradictory manifest summaries. Require matching classic inspect/info driver evidence, reject the containerd status marker, and reject explicit manifest summaries | API1.44/1.48 classic fallback, modern captured-parent selection, ambiguous summaries, malformed rows and btrfs/zfs marker negatives |
+| W37 | P2; `docker/image.rs:108` | Requiring nonnull DriverStatus rejects legitimate classic VFS. Normalize absent/null rows after classic evidence, retaining marker/shape rejection | Missing/null VFS positives and containerd negatives; historical source pinned |
+| W38 | P2; actual Docker qualification | Platform-qualified child Id is not independently addressable by lookup/create on the retained containerd store. Bind the requested tag once, platform-inspect its captured parent Id, retain child manifest separately and create from immutable parent plus explicit platform | Initial404 reproduced on both daemons; corrected two-case suites pass on each. Fake parent-a/child-b cases prove the second lookup cannot re-resolve a moved tag |
+
+The resolver performs bounded read-only local inspection only. It validates selected Linux image metadata, inherited argv/environment/user/working-directory bounds, effective entry overrides and local/registry URI representation. No registry pull, credential discovery or image build occurs.61 new tests pass within288 Lambda core tests;58 core doctests pass. Workspace build/test/fmt/Clippy/rustdoc pass with1,964 tests and399 explicitly resource-gated cases. Native provider/DryRun regressions pass; the separately gated Squib case remains excluded as VM evidence.
+
+Actual official-RIC wire execution now consumes resolver identities and materialized plans. Near6MiB computed warm calls/errors and a separate clear-command/reset-entrypoint create test pass on both arm64 VZ and amd64/QEMU, with independent stream/container cleanup. Default IO latency, old-daemon execution, native x86/Desktop/rootless and full provider/executor acceptance remain outside this evidence. Strict production Clippy has the same65 existing B03 findings, with none in the new resolver/defaults paths. Hex reuses an existing workspace version/package; audit still reports the16 B01 advisories and deny bans/licenses/sources pass without new ignores.
+
+Deployment/status/CAS actors, image availability leases, allowed pulls, unpacked-image quota proof, environment/pool owners, remaining network/log/probe consumers and B01/B03 remain required before P1 closes. This slice does not advertise Docker invocation in Rustack.
+
+## P1 task1.3 owned image preparation review
+
+The independent read-only design and implementation review verified typed private-only mutation endpoints, shared lease lifetime, retained cancellation/cleanup, digest/platform unpacked proof, and worker/root recovery. The final recheck found no remaining concrete in-slice issue. Source review preserves the HTTP500 uncertainty rule: a returned nested containerd gRPC error does not prove its server stopped committing.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W39 | P2; runtime §2.9, private alias removal | Verify-ID and DELETE are separate operations; Docker has no expected-target CAS. Reserve the private namespace exclusively and state that concurrent external retargeting invalidates that guarantee. Observed mismatches quarantine without deletion | Wrong-target/repair regression; generated-only pin identities and force=false/noprune=true endpoints; pinned classic/containerd source |
+| W40 | P3; `docker/lease.rs:65` | IO budget accepted subsecond positive durations despite the1..60s contract. Constructor now enforces the actual lower bound |1ns and over60s rejection plus typed config checks |
+| W41 | P2; `docker/lease.rs:606`, self-review with independent recheck | Root failure with no registered rows could drop queued work without recording failure. Actor now records settled completion explicitly; abnormal Drop closes admission/marks failure even with zero rows | Empty-root failure, aborted-root cached failure, worker panic and off-runtime root Drop tests |
+| W42 | P2; `docker/lease.rs:275`, self-review with independent recheck | Acquiring every semaphore permit to observe emptiness consumed other preparation capacity and distorted pin counts. Dedicated bounded count/watch observation now leaves admission capacity untouched | Wait-empty observer remains pending while a second legitimate preparation succeeds; clone lifetime and cancelled observer cases |
+
+ImageLeaseManager now owns accepted preparations, live aliases and uncertain cleanup through retained workers/registry reservations. PinnedImage cannot be deserialized from metadata; clones keep the release channel alive, and shutdown revokes further use after consumers settle. Successful or discarded response delivery retains artifact ownership correctly. UnpackedImageSize validates1..10GiB; modern proof selects exactly one available image summary by digest/platform and reads Unpacked, with verified classic fallback. Preparation does not run user code or pull/build images.
+
+Thirty-three new cases pass within321 Lambda core tests, including13 unpacked proof cases, two scalar/shared-lease cases and18 preparation/lifecycle cases. The latter cover exact precommit400/404 rejection, lost/postcommit/late nested500 outcomes, initial404 quarantine, no Tag replay, caller/response abandonment, bounded admission, alias conflict repair, lost/failed DELETE recovery, cancelled/timed shutdown, cached supervision failure and cleanup outside an entered runtime.76 core doctests pass. Workspace build/test/fmt/Clippy/rustdoc pass with1,997 tests and399 explicitly resource-gated cases. Native provider/DryRun regressions pass; the separately gated Squib case remains excluded as VM evidence.
+
+The real Docker wire harness now acquires PinnedImages, keeps them through actual handler calls/container cleanup, and joins the image manager before DockerWire shutdown. Both two-case suites pass on arm64 VZ and amd64/QEMU, retaining near6MiB computed warm/error and empty-override behavior. Independent daemon queries find no private pin aliases. These are preparation/control-path qualifications, not provider/executor or default-latency acceptance. No dependencies/versions changed. Strict boundary checks report the same65 preexisting B03 findings, with no new pin/preparation/defaults-path finding; B01 remains an open dependency gate.
+
+Next consume these artifacts in provider deployment/status/CAS and invocation capture, followed by pool/environment actors, startup directory ownership/previous-run reconciliation, allowed pulls, remaining stream/network/probe consumers and complete P1/M0 acceptance. No Docker execution capability is advertised by the current binary yet.
+
+## P1 task1.3 deployment settlement and capture review
+
+Independent read-only review covers typed deployment state, store-issued candidates, atomic settlement and fallible mutation rollback, snapshot migration, public status projection and leased invocation capture. It explicitly excludes the still-pending retained deployment supervisor and provider Image Create/Update admission/API wiring.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W43 | P2; `deployment.rs`, generated candidate builder | Public TypedBuilder generation bypassed store-issued candidate construction despite private fields. Builder method, type and final build are now module-private | Compile-fail external construction doctest plus independent recheck |
+| W44 | P2; `function_config.rs`, resolved-image hash/size | Imported or mutated resolved records could claim an unrelated CodeSha256/CodeSize. Central canonical base64 fingerprint validation now covers store/import/capture; live sizes must match unpacked proof and restored sizes remain bounded | Tampered hash/zero/oversize snapshot rejection, live-size mismatch rollback and capture corruption tests |
+| W45 | P3; `rustack-core/src/http.rs:375`, workspace validation | The existing2ms-progress/10ms-idle real-clock test can legitimately hit Idle when host scheduling stalls, defeating its total-deadline-only expectation. Pure timer tests now use Tokio paused time, with test-util explicitly enabled only for core dev builds | All five HTTP tests pass, including identical idle/tie/absolute-deadline assertions, without changing production behavior |
+| W46 | P2; `provider.rs`, self-review of publication guard integration | Rejecting publication only inside PublishVersion would let Image Create(Publish=true) insert before returning an error. Create/Update now reject this unsupported asynchronous combination before code processing or mutation; initial candidates clear unverified hash/size | Create leaves no resource; update preserves old revision/hash/status; initial Pending omits CodeSha256 |
+
+Twenty-five new Lambda core cases cover initial success/failure/retry, preserving old revisions during/after updates, independent resource/revision/generation CAS, two concurrent completion results, stale lease release, pending mutation/publication rejection, effective-entry rollback, published lease lifetime and resolved URI, snapshot state reconciliation and metadata-only availability. Invocation captures live leases through its captured request and rejects revoked/restored/tampered artifacts. The final independent recheck found no remaining in-slice issue. All25 new cases pass within346 Lambda core tests;92 core doctests pass, including the external builder rejection. Workspace build/test/fmt/Clippy/rustdoc pass with2,022 tests and399 explicitly resource-gated cases. Native provider/DryRun regressions pass; the separately gated Squib case is not VM execution evidence. Fresh target-only strict boundary validation reports the same65 preexisting Lambda findings and no finding in new deployment/artifact/fingerprint paths; the unfiltered attempt also exposes seven existing model documentation findings. These remain B03, not a green strict gate. B01 remains the16 recorded dependency advisories; no package/version/lock change or new ignore was introduced.
+
+This foundation is not an accepted asynchronous deployment owner: it cannot prove bounded work-slot reservation, joined worker cancellation/panic or provider Pending admission until the next consumer lands. Docker capability remains unavailable; directory ownership/reconciliation, pulls, pool/environment ownership and P1 security/strict checks remain required. No new package/version is introduced; the core test-only Tokio feature reuses the existing version.
+
+## P1 task1.3 retained deployment owner and API review
+
+Independent read-only review covers accepted-work/mailbox reservation, atomic response receipts, registry/permit ownership above JoinSet children, store-notification cancellation, keyed settlement, root/emergency recovery and provider admission/status/revision behavior. Its final recheck finds no remaining in-slice issue. It does not close the production Docker pool/executor/probe gate.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W47 | P2; `deployment/manager.rs`, preparation select | Prioritizing global store notifications can starve a ready preparation. Poll preparation before unrelated notifications after deadline/cancel and retain post-result identity validation | Sixteen simultaneously-ready notification/result iterations plus one-future/no-replay actor coverage |
+| W48 | P2; `docker/lease.rs`, overall/read deadlines | Accepted budgets up to3,600s were forwarded into the wire's600s limit. Validate total preparation separately and bound resolver, alias verification and unpacked proof by min(total, independent IO budget) | Successful actual wire/image preparation under a3,600s deployment budget |
+| W49 | P2; self-review, abnormal root Drop | A worker can observe cancellation before abort/join recovery and incorrectly expose ordinary Cancelled for a failed owner. Project failed owner health to SupervisorFailed before settlement; preserve ordinary cancellation when health is sound | Off-runtime root Drop with in-flight tag, worker/root panic and cached-error regressions |
+| W50 | P2; self-review, acceptance response capture | A metadata re-read after insertion can race deletion/recreation or fast completion. Store transactions now return an atomic acceptance receipt before enqueue, with no re-read | Delete between reservation and enqueue returns the original Pending receipt, settles stale work without poisoning admission and starts no tag |
+
+The20 additional Lambda core cases pass within366 tests; the model adds one RevisionId serialization test. Workspace build/test/fmt/Clippy/rustdoc pass with2,043 tests, with400 resource-gated tests after adding the live SDK case.101 core doctests pass, including closed-candidate construction. Native provider/DryRun regression target passes six actual Native/validation scenarios; its separately gated Squib selection remains excluded as VM evidence. The target does not use an SDK/HTTP layer; previous labels in this spec set are corrected. The independent live Rust SDK revision test passes through the running Lambda HTTP gateway, verifying modeled/raw412 responses for all three operations, explicit nonempty advancing revisions and an immediate four-field nonmutation check before any subsequent successful update. Both two-case real Docker wire suites pass again on Engine29.5.2 arm64 VZ and amd64/QEMU after the read-budget change; subsequent alias/container ownership queries are empty. The harness retains60s stream IO/120s attempt budgets and does not establish full executor default latency. No Image Invoke or boto3 evidence is claimed by these tests.
+
+Fresh target-only strict Clippy has the same65 preexisting B03 findings and none in new owner/lease/candidate code. Audit still reports16 B01 advisories; deny bans/licenses/sources pass while advisories fail, with no new ignore or dependency version/lock change. Next implement the Docker environment/pool executor, directory ownership/reconciliation, allowed pulls and startup probes/configuration before M0 can close; P2–P5 remain required.
+
+## P1 B04 deployment validation review
+
+The final independent read-only source review finds no remaining B04 issue, including the SDK rejected-creation absence check. Self-review corrected two admission-lifetime issues; the error-class correction was also rechecked against current source.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W51 | P2; self-review, `deployment_input.rs`, blocking-result ownership | Releasing capacity when CPU parsing ends allows ready large DTOs to accumulate. Return the permit with the result and retain it through provider dispatch | Completed-result capacity test plus cancelled waiter and worker panic capacity tests |
+| W52 | P2; self-review, `provider.rs`, inline DryRun admission | Acquiring a second parse permit after HTTP decoding can reject all four already-admitted requests. Reuse the existing permit for the pure base64 worker | Four concurrent admitted validators succeed without nested admission |
+| W53 | P2; review, `deployment_input.rs`, service-error conversion | Capacity and worker failure must not collapse into invalid-input400. Preserve TooManyRequests429 and Internal500 with static messages | Current conversion source independently rechecked; capacity/panic/invalid encoding cases remain separately classified |
+
+29 additional core cases pass:395 tests,101 doctests. They cover ZIP/S3/image DryRun full-snapshot nonmutation, no staging/fetch/tag/publication, stale/qualified requests, strict nested schemas, large valid blobs, wrong-path metadata, exact base64 limits and parse/result ownership. Actual Rust SDK/HTTP validation passes (one explicitly selected case, zero ignored), including Create/UpdateCode/UpdateConfiguration unsupported fields, absent rejected resources, unchanged metadata and version count. The separate SDK revision/412 regression passes again. Native provider/DryRun regression passes six actual scenarios; the gated Squib selection is still not VM execution evidence.
+
+Final workspace build/test/fmt/Clippy/rustdoc gates pass:2,072 tests, zero failed and401 resource-gated cases. No dependency package/version or Cargo.lock change landed; serde_json's existing raw_value feature supplies borrowed RawValue. Fresh strict core boundary Clippy still reports exactly65 B03 baseline findings, none in the decoder or newly extracted validation helpers. Fresh audit reports the same16 B01 advisories, and deny bans/licenses/sources pass while advisories fail; no new ignores. B04 is closed. B01/B03 and the remaining Docker executor/directory ownership/pulls/probes still block full P1/M0 acceptance; P2–P5 remain required.
+
+## P1 B03 strict production boundary review
+
+The six-library strict gate now covers rustack-auth, rustack-core, rustack-lambda-model, rustack-lambda-http, rustack-lambda-core and rustack-lambda-runtime. Fresh initial reports found65 core,47 authentication,7 model and4 HTTP findings (123 total); the shared core/runtime already passed. Method-specific Errors sections replace missing contracts, rustdoc tokens are formatted, and guarded credential/layer/date indexing uses exact slice patterns. Native output reads use checked access. These changes preserve the existing parser profile rather than claiming expanded layer compatibility.
+
+The two production HMAC expect calls are removed by returning typed CryptoInitialization errors with their original InvalidLength sources. Public derive_signing_key/compute_signature now return Result, all production/header/presigned/streaming callers propagate it, and direct S3/SQS test helpers/examples are adapted. No infallible fallback, custom crypto/key normalization, hidden retry, new dependency/version or lint ignore was introduced. Two added tests check four independent published SHA1/SHA256 vectors, including a131-byte key; existing presigned ambiguity, payload-tamper, seed/chunk/trailer and constant-time verification regressions remain active.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W54 | P3; `provider.rs`, delete_function Errors | Deletion can fail during root revalidation after metadata removal. Document both preflight and possible post-removal cleanup failure | Final source directly rechecked by independent reviewer |
+| W55 | P3; `storage.rs`, validate_artifact Errors | Generic executable validation language overstates the check. Name bootstrap/component symlink checks and explicitly preserve missing-bootstrap acceptance | Final source directly rechecked; execution remains responsible for readiness |
+| W56 | P3; authentication verifier Errors | Newly propagated MAC initialization failure was documented only on signing helpers. Add it to header/S3/presigned/streaming entry points | All public affected error contracts directly rechecked |
+
+Self-review also corrected two provider descriptions: layer permission principals are not numerically validated here, and update event-invoke configuration creates absent records before merging. The final independent read-only review confirms all corrections and no remaining in-slice finding. Full P1/M0 acceptance remains separate.
+
+Final-source workspace build/test/fmt/Clippy/rustdoc gates pass with2,074 tests, zero failed and401 resource-gated cases. `make test-lambda-boundaries` passes659 unit tests and165 doctests (824 total), seven separately gated Docker cases, and strict production Clippy for all six libraries without new ignores. Core remains395 tests/101 doctests; authentication is76 tests/12 doctests. The Native provider target again passes six actual Native/validation scenarios, excluding its gated Squib selection as VM evidence. The most recent audit/deny retains16 B01 advisories and passing bans/licenses/sources; this change has no manifest/version/lock change. Directory ownership/reconciliation, allowed pulls, real Docker pool/executor and startup/configuration/probes still block full P1/M0, and P2–P5 remain required.
+
+## P1 B01 dependency security and ZIP9 review
+
+The dependency update resolves ZIP9.1.1, crypto-bigint0.7.10, ctutils0.4.6, quinn-proto0.11.19, rustls0.23.46, rustls-webpki0.103.16 and both WebPKI root crates1.0.11. ZIP adds nix0.31.3 and typed-path0.13; deny license/source/ban checks accept the graph without new exceptions. SDK model versions remain unchanged. Removing the three unused local SDK SigV4a selections removes crypto-bigint0.5 and its old P256/ECDSA/HMAC graph; regional SigV4/HTTP/Tokio remain enabled. The inspected latest signer1.6.3 still directly requires optional bigint0.5, so a compatible patch was unavailable for that unused mode. User-image SDKs remain independent.
+
+Fresh cargo audit scans474 dependencies without vulnerabilities. Cargo deny passes advisories, bans, licenses and sources; preexisting policy notices about duplicate packages and unmatched license allowances/advisory ignores remain, with no new exception or ignore. The resolved feature tree has no SigV4a and retains AWS-LC for the SDK. Historical reqwest clients still also enable ring; this change neither introduces a TLS transport nor claims to remove every historical provider selection.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W57 | P2; self-review, ZIP9 unix_mode migration | The new accessor clears special bits before the old guard sees them. Validate original high attributes for Unix-like origins; retain DOS-specific semantics | Four direct central-header symlink/SUID/SGID/sticky fixtures reject without replacing old artifacts or touching an outside sentinel; a DOS compatibility case succeeds without special permissions |
+| W58 | P2; self-review, ZIP9 name migration | name() is fallible but can fall back to CP437 despite bit11. Bound raw names before decoding, enforce flagged UTF-8, propagate decoding rejection statically, then check decoded bytes/path | Invalid UTF-8, raw-name overflow and CP437 decoded-byte overflow reject before artifact publication; existing traversal, CRC, expansion and executable-mode regressions remain active |
+| W59 | P2; self-review, ZIP9 metadata index | Identical original raw names collapse in the upstream index, so iterating with a path set cannot detect those duplicates; by_index does not enable header-consistency enforcement by default. Reject has_duplicate_names before traversal, retaining the path set for decoded collisions | A crafted two-entry central/local-header fixture demonstrates len1 plus duplicate metadata, then requires rejection without artifacts/directories; independent source recheck finds no issue |
+
+The independent read-only review verifies the released ZIP9/source semantics, raw fixture offsets, DOS guard, feature-pruning scope and lock delta; the final recheck has no in-slice findings. This is security/profile validation, not full Docker executor or P1/M0 acceptance.
+
+Final-source workspace build/test/fmt/Clippy/rustdoc pass with2,083 tests, zero failed and401 resource-gated cases. Core has404 tests (nine new ZIP cases) and101 doctests; `make test-lambda-boundaries` passes668 unit tests/165 doctests (833 total), seven resource-gated Docker cases, and all six strict production-library checks. The Native provider target passes six actual Native/validation scenarios; its gated Squib selection is excluded as VM evidence. Post-upgrade real Rust SDK/HTTP validation and revision/412 tests each pass with zero ignored, and the owned test gateway exits normally. Audit/deny pass against the same committed dependency graph. B01/B03/B04 are closed; persistent directory ownership/reconciliation, allowed pulls, Docker environment/pool executor, startup/configuration/probes and full M0 acceptance remain required. P2–P5 also remain required.
+
+## P1 task1.3 persistent namespace lease review
+
+Independent read-only review covers runtime §4.1/D28: bounded acquisition, private descriptor-relative files, immutable durable identity, raw-path normalization, ancestor trust, process contention and retention through image cleanup. The final recheck finds no remaining in-slice issue. This is host-directory ownership evidence, not prior-run reconciliation, Docker readiness or P1/M0 acceptance.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W60 | P2; `docker/ownership.rs`, raw root spelling | A trailing slash or /. can bypass final-component NOFOLLOW. Normalize the validated component sequence before any IO | Four root-symlink spellings reject before touching the destination |
+| W61 | P2; `docker/ownership.rs`, worker result ownership | Releasing the work permit when blocking work finishes allows ready results to accumulate outside capacity. Return the permit with the result until delivery/disposal | Completed-but-unconsumed result retains capacity and the actual directory lock; abort/deadline cases retain both until worker completion |
+| W62 | P2; `docker/ownership.rs`, interrupted creation retry | Syncing only newly created parents lets a retry skip a parent left unsynced by an earlier failed attempt. Repeat the same-filesystem ancestor barrier on every acquisition | Fault at the second directory sync, then successful retry through existing parents proves the parent inode is synced |
+
+Logical and canonical ancestor checks also reject untrusted UID or writable nonsticky rename paths before creation; sticky trusted ancestors remain supported. Safe nix0.31.3 fs/user calls reuse the already-resolved package, and standard File supplies advisory locking. The only new lint exception is ownership.rs:5 for synchronous standard-file/descriptor operations, all executed on bounded blocking workers because Tokio files do not supply OS advisory locks. No unsafe, production panic/unwrap, ignored boundary finding or dependency-security exception is added.
+
+Final-source standard workspace build/test/fmt/Clippy/rustdoc pass:2,122 tests, zero failed and401 separately resource-gated cases. Lambda core has443 unit tests and103 doctests; the new ownership target has38 directory cases plus one abandoned-manager cleanup case, all passing. The actual subprocess test checks contention while held and reacquisition after release with the same owner/fresh run. The six-library strict boundary target passes707 unit tests/167 doctests (874 total), seven separately gated Docker cases and all strict production checks. Fresh audit scans474 dependencies without vulnerabilities; deny advisories/bans/licenses/sources all pass.
+
+Both explicit two-case Docker wire suites pass using real DirectoryLease-backed image owners on Engine29.5.2 arm64 VZ and amd64/QEMU. Afterward both daemons have no owner-labeled containers or rustack-internal/lambda aliases. The host-directory tests run on macOS; this is not native Linux directory-lock qualification. The harness retains60s stream/120s attempt stress budgets. The local Docker CLI lacks an auto-discovered buildx plugin, so these successful Make invocations explicitly set WORKFLOWS_IMAGE_BUILDER=/opt/homebrew/bin/docker-buildx. Initial failure with the default builder occurred before any test allocation; no default Docker/runtime readiness is claimed.
+
+Persistent namespace capability is now implemented/reviewed. Startup historical-effect reconciliation, allowed pulls, remaining log/network/probe consumers, environment/pool executor and production configuration/acceptance remain P1 requirements. P2–P5 remain required.
+
+## P1 task1.3 function output capture review
+
+Independent read-only review covers §3.7/D29: output-only live attach, bounded binary rings/tail, fair snapshot/read service, retained partial framing, early socket closure, priority stop and cached join/failure ownership. Its final recheck finds no remaining in-slice issue. Capture is a runtime consumer primitive, not production executor readiness or complete per-invocation log attribution.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W63 | P3; `docker/logs_tests.rs`, cancelled snapshot proof | Dropping the Pin reference produced by tokio::pin does not drop its backing future. Use a lexical scope around future/pin/poll to actually abandon its receiver | A fragmented record completes after both16 completed snapshots and a genuinely abandoned snapshot; shutdown succeeds |
+| W64 | P2; self-review, `docker/logs.rs`, terminal reader ownership | Keeping the idle actor alive after EOF/framing failure also retained its socket. Drop the reader immediately but preserve capture state and failure for final snapshots/join | All four malformed stream cases observe peer EOF before owner shutdown, then retain failure across repeated shutdown |
+
+Eighteen focused cases pass, including independent channel overwrite/saturating counters, binary combined tail, bounded mailbox8 admission, output flooding, quiet off-runtime Drop, partial/silence deadline independence, cancelled shutdown join, actor panic and a scripted-daemon output-only/no-replay upgrade. The latter shuts down DockerWire after handoff and still consumes the separately owned capture, proving no management slot/driver remains needed for the transferred stream. Debug exposes sizes/error classes, never user bytes. No new dependency/version or lint exception is introduced.
+
+Final-source workspace build/test/fmt/Clippy/rustdoc pass with2,140 tests, zero failures and401 resource-gated cases. Core has461 tests/107 doctests; the six-library strict boundary target passes725 unit tests/171 doctests (896 total), with seven separately gated Docker cases. The unchanged dependency graph retains the current turn's clean474-dependency audit and passing deny advisories/bans/licenses/sources from the directory slice.
+
+Both explicit two-case Docker wire suites pass on Engine29.5.2 arm64 VZ and amd64/QEMU. The official RIC handler prints deliberate stdout/stderr markers only for the requested fixture event; the test requires both independently from its computed near6MiB response and warm/error outcomes, then joins capture after function removal. After both suites, ownership queries show no Rustack containers or internal aliases. These are60s stream/120s attempt stress qualifications, not default executor latency or native x86/Desktop evidence. Historical reconciliation, pulls, network/probe consumers, environment/pool actors, production wiring and P2–P5 remain required.
+
+## P1 task1.3 immutable allocation policy review
+
+Independent read-only review covers runtime §4.2/D30: closed allocation plans retaining namespace/image/revision leases, captured IDs/platforms, environment composition, bounded user/network policy, resource/swap/tmpfs/health/log/restart fields and real-wire consumption. The final recheck finds no remaining in-slice issue. This is allocation policy, not an environment/pool lifecycle, historical reconciliation, startup probe or SDK executor acceptance.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W65 | P2; self-review, `docker/mod.rs:412`, create future | The query serializer remained in async scope across await, making container create futures non-Send and preventing supervised Tokio workers. Finish it within a lexical block before IO | A scripted-daemon test spawns EnvironmentPlan create through Tokio, checks its captured platform and successful response |
+| W66 | P2; `docker/plan.rs:566`, environment precedence | Initial concatenation retained duplicate names; process lookup cannot be treated as portable last-wins. Compose a deterministic unique-key map with inherited→captured→runtime precedence and explicit bare deletion markers | Uniqueness/last-inherited/unset/empty/captured cases plus actual handler execution despite conflicting image Runtime API/name/region/default variable |
+| W67 | P3; runtime §4.2, relay environment wording | Four supplied relay entries do not suppress Docker image Env inheritance. State the actual validated-image-default inheritance, while excluding captured function/process environment | Final prose/source directly rechecked; no host-credential inheritance is claimed |
+
+The environment rule follows [POSIX duplicate-name limitations](https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/V1_chap08.html) and the inspected [Moby image merge](../vendors/moby/daemon/commit.go) / [process environment merge](../vendors/moby/container/env.go), which do not deduplicate supplied new keys. Shared validation now accepts iterated entries so captured region injections can be checked separately without first cloning invalid user data. Reserved-key, byte/count and NUL rejection remain unchanged for existing provider settings.
+
+Fifty-four new cases pass, including both-image lease release and actual directory exclusion through plan lifetime. Standard workspace build/test/fmt/Clippy/rustdoc pass with2,194 tests, zero failed and401 resource-gated cases. Core has515 tests/116 doctests; the six-library strict target passes779 unit tests/180 doctests (959 total), with seven Docker cases separately gated. Fresh audit scans474 dependencies without vulnerabilities; deny advisories/bans/licenses/sources pass. No dependency/version or lint exception is added.
+
+Both explicit two-case real Docker wire suites pass on Engine29.5.2 arm64 VZ and amd64/QEMU. They now consume the allocation plan for normal official RIC execution and empty ImageConfig cases, including actual ENTRYPOINT/CMD/WORKDIR inspection and exit142/0. Handler reports verify memory/PID/CPU/no-swap, read-only rootfs,512MiB tmpfs/mode1777, zero effective capabilities/no-new-privileges, metadata and captured env precedence. Bounded output capture still receives stdout/stderr with daemon logging disabled; warm/error and near6MiB results remain correct. Because fixture image defaults changed, all five shared runtime/relay/client Docker regressions also pass on each daemon. These14 selected platform cases have no skips; they remain separate from full executor/default-latency and native x86/Desktop acceptance. Post-test queries on both daemons find no owner-labeled or runtime-test containers and no internal image aliases. The Native provider target also passes six actual Native/validation scenarios; its separately gated Squib selection remains excluded as VM evidence.
+
+The plan deliberately cannot authorize unreserved or untracked side effects: the future environment/pool owner must register it above retained IO and reconcile every uncertain create. Named bridges still require daemon validation; explicit none provides disconnected pure-handler tests only. Production Docker remains unavailable pending lifecycle/pool, reconciliation/pulls/network/probes and final wiring, and P2–P5 remain required.
+
+## P1 task1.3 retained environment owner review
+
+Independent read-only review covers §4.3/D31: root records/reservations above JoinSet workers, verified-ID mutation, critical create ownership, wire issuance receipts, guarded IO transfer, phase-aware cleanup/recovery, cancellation and cached shutdown failure. The final recheck has no remaining in-slice finding. An initially reported capture_logs=false EOF issue was withdrawn after direct re-read confirmed that every result samples log status before selecting returned tail bytes.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W68 | P2; `environment/worker.rs`, health scheduling | A biased periodic tick can remain ready after slow IO and starve accepted calls. Reschedule health after each completed check | Actual serve-loop test queues a call during a health RPC lasting longer than its period and requires bounded command service afterward |
+| W69 | P2; `environment/worker.rs`, unissued create | Revocation/connect/queue failure before send must not become permanent uncertain creation. Move one RAII mutation guard with the accepted wire request and permit never-issued proof only after its final disposal | Revoked-before-create and missing-socket cases settle with no mutation/quota leak;500→404 still retains uncertainty until the late object is observed |
+| W70 | P2; `environment/actor.rs`, recovered/queued settlement | Physical cleanup cannot rewrite a failed supervisor into successful handle shutdown. Preserve Worker for recovered, queued and existing records after root failure | Root abort during create and normal/root-abort/wire-stop queued tests; repeated failed shutdown remains failed while cleaned quota releases |
+| W71 | P2; `tests/docker_environment.rs`, namespace lifetime | Preparation before fixture ownership or early-return cleanup errors could unlink a namespace while image cleanup remains live. Construct the cleanup owner before preparation and retain namespace files on every unresolved error | Final source rechecked; partial image leases are retained immediately and setup failure invokes cleanup |
+| W72 | P3; `tests/docker_environment.rs`, failed observation | Busy-observation failure must not detach the invocation task or observer IO. Always abort/join the call and attempt owner/log shutdown before propagating observation failure | Final source rechecked; successful real busy-cancel qualification uses the same path |
+| W73 | P3; cancellation evidence | Any JoinError can include panic. Require is_cancelled for the abandoned invocation task | Explicit cancellation assertion in both real owner lanes |
+| W74 | P2; self-review, runtime transport/client shutdown | A preceding protocol error could hide a later transport supervisor failure through Result::and. Worker failure now takes precedence through worker drain and client settlement | Actual scope-error followed by transport-owner abort returns/caches Worker |
+| W75 | P2; self-review, log EOF at result | EOF after a valid result should not discard the result, but the environment must not return to warm reuse. Read tail/status for every result and gate reuse independently from LogType | EOF tail/health/reuse regression; raw observed results remain separate from lifecycle settlement |
+| W76 | P2; self-review, startup deadline | Valid long caller deadlines were checked against a wire limit before clamping startup. Clamp to the configured bounded startup budget first | Fifteen-minute caller deadline admits/cancels cleanly without daemon mutation |
+| W77 | P2; self-review, ready reply abandonment | Once the worker sends a result, losing the call-only cancellation receiver can hide abandonment. Retain an environment stop guard until the result is consumed and deadline-validated | Two public invoke-future poll cases distinguish ready reply abandoned versus successfully consumed |
+
+Final-source standard workspace build/test/fmt/Clippy/rustdoc pass with2,215 tests, zero failures and403 separately resource-gated cases. Lambda core has535 unit tests and127 doctests; runtime has98 unit tests and48 doctests. The focused target passes20 environment cases and the transport failure-precedence regression. The six-library strict boundary target passes800 unit tests/191 doctests (991 total), with nine separately gated Docker cases, and all strict production checks. Fresh audit scans474 dependencies without vulnerabilities; deny advisories/bans/licenses/sources all pass without new exceptions or dependency/version changes.
+
+Actual owner2, wire2 and shared runtime5 tests explicitly pass with zero ignored on both retained Engine29.5.2 daemons: Linux arm64 VZ and Linux amd64/QEMU. The final owner2 cases are rerun on both after the ready-reply cancellation correction. Owner qualification proves actual official-RIC initialization, computed near6MiB/warm results, function failure, quota rejection, independently observed running-handler cancellation and joined retirement. Read-only post-run queries find no owner/test-labeled containers or internal Lambda aliases. QEMU is not native-x86 platform acceptance; Desktop/rootless and full SDK/executor qualification remain mandatory.
+
+The owner remains a lower-level runtime consumer. It enforces supplied invocation deadlines and retains cleanup, while exact handler timeout starting at delivery, per-invocation log attribution, warm/LRU checkout limits, startup reconciliation/pulls/network/probes and final provider/executor wiring remain mandatory M0 integration work. No production backend capability is enabled by this change; P2–P5 remain required.
+
+## P1 task1.3 warm pool dispatch review
+
+Independent read-only review covers §4.4/D32: bounded admission/FIFO dispatch, canonical warm identity, exclusive handles, receipt-gated return, LRU eviction and retained root/worker retirement. The final source recheck has no remaining findings. This remains a runtime consumer, not production Docker executor acceptance.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W78 | P2; spec preflight, runtime §4.4 | A live but unpolled public receiver cannot enforce its own timeout. The worker retains the absolute deadline through result offering and consumption receipt waiting | Ready reply stays unpolled past deadline; assert environment Removed before polling that public future again |
+| W79 | P2; `docker/plan.rs`, warm identity | Hashing before complete boundary validation allocated for unbounded captured environment/ImageConfig inputs. Build bounded image bodies and validate function environment before fingerprint serialization | Independent source-order recheck plus separate oversized-input rejection regressions |
+| W80 | P2; `docker/pool/actor.rs`, capacity eviction | Repeated Busy before slow cleanup completed could evict the entire LRU for one waiter. Retain one eviction task barrier and await its settlement before retrying dispatch | Two idle peers with a deliberately held first retirement; repeated ticks keep the second idle handle alive |
+| W81 | P3; `tests/docker_environment.rs`, pooled busy-cancel observer | Fallible plan/invocation construction after attaching the observer could leave it only dropped on error. Move both constructions before observer startup | Final read-only recheck confirms every post-attach path reaches explicit call abort/join and pool/log shutdown before propagating observation failure |
+
+Final-source workspace build/test/fmt/Clippy/rustdoc all pass:2,233 tests, zero failed,405 separately resource-gated. Lambda core has553 unit tests and132 doctests. The18 pool cases cover runtime zero/global/per-identity retention, queued cancellation/capacity/FIFO, ready/unpolled results, exact warm counts, slow LRU cleanup and root/worker/shutdown ownership. The six-library boundary target passes818 unit tests/196 doctests (1,014 total),11 separately gated Docker cases and strict production Clippy. Fresh audit scans474 dependencies without vulnerabilities; all deny categories pass. No dependency or advisory exception was added.
+
+Four explicit owner/pool real-RIC cases pass with zero ignored on each retained Engine29.5.2 daemon (arm64 VZ and amd64/QEMU). Actual evidence includes near6MiB owner results, warm counters1/2, revision isolation and one-slot capacity eviction, real FunctionError followed by replacement counter1, and independent busy-marker observation before aborting a pooled invocation. Both cancellation cases require a cancelled join and attempt every call/pool/log cleanup before propagating observation errors. Final read-only daemon/image queries find no owner-labeled containers or internal image aliases. Native-x86/Desktop/rootless and full SDK/executor qualification remain required; QEMU is not native-x86 acceptance.
+
+Exact handler timeout from Runtime API delivery, per-invocation log attribution, historical reconciliation, pulls/network/resource probes and real Executor/provider composition remain mandatory M0 work. P2–P5 remain required by the complete objective.
+
+## P1 task1.3 delivery-based handler clock review
+
+Independent design and implementation review covers §3.8/D33: typed timeout bounds, protocol-v2 compatibility, original Offering ownership, consumed monotonic receipts, effective HTTP metadata, earlier-handler versus outer classification, strict timeout correlation and joined retirement. The final recheck has no remaining in-slice finding. Final Docker Executor/provider and ASL envelope mapping remain mandatory integration work.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W82 | P2; `crates/rustack-lambda-runtime/src/session.rs:761`, timer selection | A receipt could become ready after initial polling but before the old outer timer; biased timer selection then used stale classification. Reconcile again inside the timer branch and recheck current pending timing | Actual actor.run future manually polled before receipt, then both receipt/outer timer made ready between polls; result must be HandlerTimeout |
+| W83 | P2; `crates/rustack-lambda-core/src/executor/instance.rs:477`, initialization errors | Reusing invocation Deadline mapping mislabeled independent initialization expiry as caller DeadlineExceeded. Dedicated initialization mapping checks caller cancellation/deadline, otherwise preserves Timeout(init budget) at API/process/readiness sites | Real no-poll initialization requires2s error category and joined child reap; delivered-handler fixture requires1s category, reap and quiescence |
+| W84 | P3; runtime §3.1 protocol table | Optional timeout notation must not imply null support while structural preflight rejects null. Document omission-only and skip absent budget serialization | Typed round trips accept omitted/valid millisecond values; explicit null, invalid ranges and version1 reject |
+
+Final-source standard workspace build/test/fmt/Clippy/rustdoc all pass with2,255 tests, zero failures and406 separately resource-gated cases. Runtime has119 unit tests/51 doctests; Lambda core has553 unit tests/132 doctests. The six-library strict boundary target passes839 unit tests/199 doctests (1,038 total),12 separately gated Docker cases and all strict production checks. The timeout target passes119 runtime cases plus12 actual Native hardening fixtures. Fresh audit scans474 dependencies without vulnerabilities; deny advisories/bans/licenses/sources all pass. No dependency/version/advisory exception was introduced.
+
+Final production-relay images were rebuilt for protocol v2 on both retained Engine29.5.2 daemons. Owner/pool5, wire2 and shared runtime5 cases explicitly pass with zero ignored on each arm64 VZ and amd64/QEMU daemon (12 per daemon). Actual code execution proves captured3s cannot be extended to900s by caller metadata, allocation is released before the handler-timeout result, and replacement code starts with counter1. Existing near6MiB/warm/FunctionError/cancel/EOF/Close regressions pass under v2. Post-run scoped queries find no owner/test-labeled containers or internal image aliases. Native provider regression separately passes its six actual Native/DryRun scenarios; the seventh gated Squib test is not claimed as VM execution. QEMU is not native-x86 platform acceptance.
+
+Per-invocation log attribution, real Docker Executor/provider envelope mapping, historical reconciliation, allowed pulls/network/resource probes and final startup acceptance remain mandatory M0 work. The ASL engine and P2–P5 remain required by the full objective.
+
+## P1 task1.3 invocation log window review
+
+Independent design and implementation review covers §3.9/D34: separate bounded diagnostic/window tails, opaque capabilities and direct revocation, consumption receipts/deadlines, exact window identity, partial-read retention/fairness, EOF handling and environment Tail/None lifecycle integration. The final read-only implementation review has no concrete in-slice finding. Preflight explicitly required capability Drop and cross-owner misuse to revoke the originating capture. Self-review corrected the unconsumed-reply case below before final review.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W85 | P2; self-review, `crates/rustack-lambda-core/src/docker/logs/window.rs:71`, mutation receipts | Sending a reply cannot prove consumption, especially after Finish removed the active capability. Retain a separate actor-owned consumption receipt and deadline until the public mutation acknowledges | Ready-but-unconsumed Begin/Finish abandonment and live/unpolled expiry require quiet-socket closure before another diagnostic request; on-time ACK processed later remains valid |
+
+Final-source standard workspace build/test/fmt/Clippy/rustdoc pass with2,273 tests, zero failures and407 separately resource-gated cases. Lambda core has571 unit tests/134 doctests; the log target passes36 cases (18 additions). The six-library strict boundary target passes857 unit tests/201 doctests (1,058 total),13 separately gated Docker cases and all strict production checks. Fresh audit scans474 dependencies without vulnerabilities; deny advisories/bans/licenses/sources all pass. No dependency/version or advisory exception was introduced.
+
+Each retained Engine29.5.2 daemon explicitly passes owner/pool6, wire2 and shared runtime5 cases with zero ignored (13 per daemon), on arm64 VZ and amd64/QEMU. Actual image code alternates Tail/logging, None/logging, Tail/silent and Tail/logging, retaining warm counters1..4, computed42 responses, observed stdout/stderr markers, bounded tails and empty silent/uncaptured output. Existing timeout/replacement/FunctionError/cancel/large-frame/Close regressions pass with joined log/container/image cleanup. Read-only post-run queries find no owner/test-labeled containers or internal image aliases. QEMU is not native-x86 platform acceptance.
+
+Window attribution follows observed completed chunks, with the independent-stream timing limit advertised in runtime/operations specs. Production Executor/provider base64 header wiring, historical reconciliation, allowed pulls/network/probes and M0 SDK acceptance remain required; P2–P5 remain pending.
+
+## P1 task1.3 supervised pool invocation review
+
+Independent read-only review covers runtime §4.5/D35, PoolPort::start and PoolInvocation response/settlement ownership, actor registry records above JoinSet, worker/root recovery, queued no-allocation rejection, independent cleanup deadlines and the real running-handler cancellation test. The final source review has no remaining in-slice finding. One test-fixture lifecycle finding was corrected before final verification.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W86 | P3; `crates/rustack-lambda-core/tests/docker_environment.rs`, log observer followed by synchronous pool admission | A start rejection after observer attachment could skip the explicit observer join. Match admission failure and await observed.shutdown before returning the original error | Final review verifies both admission failure and normal observation/cancellation branches join the observer; no detached observer is accepted as cleanup proof |
+
+The pool target passes27 cases (nine additions): gated cancellation and invocation expiry, cancelled/timed-out cleanup waiters, retained worker/root-abort receipts, queued no-allocation rejection, resumable pending response wait and consumed-success warm reuse, missing settlement producer, and cancellation before invalid cleanup deadline rejection. Closed response channels cannot grant cleanup proof. No dependency/version or advisory exception is introduced.
+
+Final standard workspace build/test/fmt/Clippy/rustdoc pass with2,286 tests, zero failures and408 separately resource-gated cases. The six-library strict boundary target passes870 unit tests and204 doctests (1,074 total),14 separately gated Docker cases and all strict production checks. Evidence is retained in `/tmp/rustack-workflows-settlement-verified-{build,tests,fmt,clippy,docs,boundaries}.log`.
+
+The final owner/pool suite explicitly passes7 actual-image cases with zero ignored on each retained Engine29.5.2 daemon: arm64 VZ and amd64/QEMU. The new awaited cancellation case proves owner allocation0 and container404 before pool shutdown, keeps pool admission open and obtains replacement handler counter1. The separate abandoned-call path and prior warm/revision/error/timeout/log cases remain green. Post-run scoped queries find no owner/test-labeled containers or internal image aliases. QEMU is not native-x86 platform acceptance. Logs: `/tmp/rustack-workflows-settlement-verified-{arm64,amd64}.log`.
+
+Production Executor/provider composition must consume this cancellation settlement before releasing its work permits. Startup reconciliation, allowed pulls, network/resource probes, M0 SDK acceptance and P2–P5 remain required. The receipt alone does not enable Docker or complete M0.
+
+## P1 task1.3 Docker Executor/provider composition review
+
+The §4.6/D36 Executor now composes actual image execution through the retained pool: pure captured-plan/metadata validation, trusted readiness injection, original request/response bytes, context UUID/deadline propagation, resolved-version versus requested-alias metadata, synchronous log capture and independent cancellation settlement. A retained CleanupTask owns pool shutdown after dropped/expired waiters or Executor Drop. Controlled fixture readiness is not production reconciliation/probe evidence; ordinary CLI Docker selection remains unavailable.
+
+Independent read-only review and final rechecks have no remaining in-slice finding. The following corrections are closed in this source:
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W87 | P2; `crates/rustack-lambda-core/src/handler.rs`, Invoke scalar headers | HeaderMap::get silently selected the first repeated enum value. Require zero/one value through get_all before strict enum parsing | Six duplicate order/invalid-second cases plus six malformed/non-ASCII enum cases reject before lookup/admission with static errors |
+| W88 | P2; `crates/rustack-lambda-core/src/executor/error.rs`, Busy classification | Initial spec prose conflated admission quota with lower-level wire saturation, which may occur after handler side effects. Refine the uncommitted §4.6/D36 contract: pool/environment admission Busy maps429; nested wire Busy preserves a typed infrastructure500 without replay | Direct and nested category/source regressions pin the distinction; no post-effect error is claimed to prove pre-execution rejection |
+| W89 | P3; actual SDK fixture runtime metadata | Version headers did not prove the requested alias reached the RIC. Add context.invoked_function_arn to the optional real handler policy report | Exact :prod and :$LATEST assertions pass through boto3/HTTP/provider/Executor/relay/RIC alongside resolved ExecutedVersion1 |
+| W90 | P3; `crates/rustack-lambda-core/src/executor/mod.rs`, conditional documentation | An unconditional intra-doc link targeted a cfg(unix) export. Use plain backticks | Final read-only source confirmation closes portability warning without widening backend support |
+| W91 | P2; actual SDK negative evidence, provider/handler log request wiring | The first real SDK run found LogResult absent because HTTP LogType was never captured into InvokeRequest. Add provider.invoke_with_logs, preserve invoke's no-tail default and carry the synchronous flag through admission | Initial SDK run failed on both daemons; corrected final runs require actual stdout/stderr tail, empty silent tail, absent None header and unchanged FunctionError body |
+
+`make test-lambda-executor` passes31 cases:15 Executor tests plus16 handler cases (27 total additions over the prior baseline). The WorkSupervisor regression proves reserved concurrency remains occupied while Docker retirement is held behind an explicit barrier. Its expired case returns CleanupFailed from both public shutdown and invocation cleanup, rejects clean quiescence, then releases and joins physical ownership and resumes cached executor shutdown successfully. Binary outcomes/tails, static redacted typed errors, invalid scope/backend/ARN/payload/readiness/pins, warm metadata and malformed/duplicate headers are covered. No dependency/version or new advisory exception was introduced.
+
+Final-source workspace build/test/fmt/Clippy/rustdoc pass with2,313 tests, zero failures and409 separately resource-gated cases. Lambda core has611 unit tests/141 doctests. The six-library strict boundary target passes897 unit tests plus208 doctests (1,105 total),15 separately gated Docker cases and all strict production checks. Audit scans474 dependencies without vulnerabilities; deny advisories/bans/licenses/sources pass with existing unmatched/duplicate-policy notices. Evidence: `/tmp/rustack-workflows-executor-verified-{build,tests,fmt,clippy,docs,boundaries}.log`, focused log `/tmp/rustack-workflows-executor-focused-settlement.log`, and `executor-{audit,deny}.log` under the same prefix.
+
+Each retained Engine29.5.2 daemon explicitly passes one real boto3/HTTP/provider/Executor image scenario and seven owner/pool cases, zero ignored (eight selected cases per arm64 VZ and amd64/QEMU daemon). The SDK scenario deploys→Active→publishes1→aliases prod, computes42 with warm counters1/2/3, preserves raw ValueError/Unhandled, retires/replaces after FunctionError, preserves published environment across latest updates, proves DryRun does not execute, and reports a captured1s handler timeout followed by replacement counter1. Exact runtime alias ARN and resolved version remain distinct. A shared explicit-daemon fixture preserves the previous owner/pool tests. Post-run scoped queries find no owner/test-labeled containers or internal image aliases; user images remain cached. Logs: `/tmp/rustack-workflows-executor-verified-{arm64,amd64}.log`. QEMU is not native-x86 platform acceptance.
+
+M0 remains open: the actual production startup coordinator must implement historical uncertain-effect reconciliation, allowed pulls, network/resource probes, configuration/capability publication and complete platform acceptance. P2–P5/ASL remain required by the full objective. A trusted test readiness adapter must never be presented as those missing proofs.
+
+## P1 startup network/resource qualification review
+
+§4.7/D37 now provides read-only exact network inspection/full-ID policy binding and an actual pinned Rust kernel probe. Probe mode consumes one fixed-loopback Runtime API challenge, reports a bounded typed schema and waits for the host's existing retained environment retirement. Host proof remains private, exact-input/service-bound, nonserializable and independent from production DockerReadiness. Final read-only review has no remaining in-slice finding.
+
+| ID | Priority / source | Finding and resolution | Evidence |
+|---|---|---|---|
+| W92 | P2; `crates/rustack-lambda-core/src/docker/plan.rs:589`, `crates/rustack-lambda-runtime/src/probe/parse.rs:89` | Controller-root reads cannot qualify a v1 container under Docker's default host cgroup namespace. Explicitly emit private namespaces for relay/function and require current-process unified or required v1 controller membership at / | Both create-body assertions and positive/foreign/missing/duplicate v1/v2 membership fixtures pass; host rejects false namespace membership. Actual final daemons use cgroup v2; no actual v1 lane is claimed |
+| W93 | P3; runtime §4.7 and `crates/rustack-lambda-runtime/src/probe/parse.rs:12` | The initial prose overstated None normalization. Document textual max/-1 as omitted None while preserving numeric v1 unlimited sentinels for exact finite-mismatch rejection | Independent huge-sentinel fixture preserves9223372036854771712 numerically; finite memory/swap expectations reject unavailable/unlimited enforcement |
+| W94 | P2; self-review, `crates/rustack-lambda-core/src/docker/probe.rs:287` | A timely report could otherwise produce a late success after independent cleanup overran startup/caller time. Recheck deadline and live retained inputs after joined cleanup, before proof construction | Independent final source recheck confirms ordering; existing bounded environment timeouts and facade-abandonment ownership tests remain green; final actual probe rechecks pass |
+
+`make test-lambda-probes` passes57 new cases:22 runtime parser/client boundary cases,14 network qualification cases and21 host report/facade cases. Independent kernel text fixtures cover v1/v2 normalization/membership, UID/GID/capabilities/privilege/seccomp, mount options/size/mode, numeric overflow and bounded lines. Strict report cases independently alter identity/namespace/memory/swap/PIDs/CPU/users/flags/filesystems, and reject unknown/duplicate/oversized JSON. The facade cancellation regression holds an issued create response, abandons the public probe waiter and requires the allocation reservation to remain held until definitive400 and joined manager settlement. Scripted evidence is not counted as kernel execution.
+
+Final-source workspace build/test/fmt/Clippy/rustdoc and strict production boundary checks pass. Workspace has2,370 passed, zero failed and411 separately resource-gated tests. Lambda core has646 unit tests/149 doctests; shared runtime has141 unit tests/52 doctests. The six-library boundary target passes954 unit tests+217 doctests (1,171 total), with17 separately gated real-Docker cases. Audit scans474 dependencies without vulnerabilities; deny passes all four categories with existing unmatched/duplicate-policy notices. The already-resolved serde_json workspace dependency moves from runtime dev-only to production for typed report encoding; no new library/version or advisory exception is added. Logs: `/tmp/rustack-workflows-probe-verified-{build,tests,fmt,clippy,docs,boundaries}.log`, focused `/tmp/rustack-workflows-probe-focused-final.log` and security `/tmp/rustack-workflows-probe-{audit,deny}.log`.
+
+Each retained Engine29.5.2 daemon passes17 explicitly selected actual cases with zero ignored: two pinned Rust probe cases (none/operator bridge), one boto3/HTTP/provider/Executor scenario, seven owner/pool cases, two wire cases and five shared runtime cases. Final host deadline rechecks rerun the two probe cases without counting them as additional distinct cases. Both arm64 VZ and amd64/QEMU observe cgroup v2 with128MiB finite memory, zero extra swap,256 PIDs, actual33333/100000us CPU quota, nonroot IDs, zero effective capabilities, no_new_privs, seccomp2 and read-only root/512MiB mode1777 tmpfs. Proof is returned only after allocation count reaches zero. Reports cannot match changed policies. Final exact-ID/label checks remove the two bridges provisioned for this run; scoped container/internal-alias queries are empty. User images/caches remain. Actual logs: `/tmp/rustack-workflows-probe-final-{arm64,amd64}.log` (full sweep), `probe-verified-{arm64,amd64}.log` under the same prefix (host recheck). QEMU is not native-x86 acceptance; v1 behavior is fixture/policy evidence, not a measured v1 daemon claim.
+
+Production startup still requires historical uncertain-effect reconciliation, allowed pulls, function-visible endpoint reachability, final configuration/capability publication and complete platform qualification. Neither proof opens readiness by itself. M0 and P2–P5/ASL remain required by the full objective.
+
+## P1 durable container intent and restart recovery review
+
+§4.8/D38 adds descriptor-relative bounded atomic snapshots, environment create/cleanup integration and resumable prior-run container retirement. Unknown absence remains unresolved; exact positive identity and durable full ID precede destructive requests. This is the container portion of historical reconciliation and does not grant production readiness. Independent final source review finds no remaining in-slice issue.
+
+| Finding | Priority / source | Correction | Verification |
+|---|---|---|---|
+| W95 | P2; independent review, `crates/rustack-lambda-core/src/docker/ownership/journal.rs:144` | Reject positive budgets above60s before waiting for the transaction permit; retain worker-side postqueue checks | Deterministic held-permit test requires immediate Configuration instead of waiting |
+| W96 | P2; independent review, `crates/rustack-lambda-core/src/docker/recovery/tests.rs:277` | Capture reacquisition/recovery errors before propagation, retain TempDir on every post-intent failure and always attempt wire shutdown | Final-source independent review confirms the failure-path preservation; actual historical pair recovery passes on both retained daemons |
+
+Twenty-four new unit/scripted cases cover11 journal transactions/codecs/filesystem cases,12 historical recovery cases and one composed environment durable-erase barrier. Docker module332 tests pass; the actual restart case is separately gated. Final workspace build/test/fmt/Clippy/rustdoc pass with2,394 tests/zero failed/412 separately gated cases. Core670 units/150 doctests; strict six-library boundary978 units+218 doctests (1,196 total)/18 gated pass without new ignores. Audit scans474 locked crates with no vulnerabilities; deny passes all four checks with the existing policy notices.
+
+Each retained Engine29.5.2 daemon (arm64 VZ and amd64/QEMU) explicitly passes11 distinct actual cases: recovery1, owner/pool7, boto3/HTTP/provider/executor1 and wire2, all with zero ignored. The recovery fixture leaves a real stopped function and running relay across directory reacquisition, then verifies ordered retirement and durable erasure. Scoped owner-container and private-image-alias queries are empty after the suites. QEMU is not native x86 qualification. The existing network/kernel/shared-runtime evidence remains separately scoped; this change does not grant startup readiness or cover historical private image aliases, allowed pulls, endpoint/configuration coordination or P2–P5. The12 feature/index documents resolve265 local references.
+
+## P2 generated model and numeric timestamp review
+
+API§1.1/D40 lands the official model and protocol-aware numeric serde generation. This is the first P2 contract under the user's explicit priority change; HTTP/core/ASL remain required. Docker-image changes remain a separate deferred worktree checkpoint. Independent final read-only review reports no remaining model/generator issue.
+
+| Finding | Priority / source | Correction | Verification |
+|---|---|---|---|
+| W97 | P2; `codegen/src/codegen.rs:256`, separate JSON-error generation | Strict DTO Debug hides all values; strict Error is nonexhaustive with redacted Debug/Display and retained source() | Actual task-token/output/nested-history/error-source fixtures; no blanket ignores |
+| W98 | P2; `codegen/templates/epoch_seconds.rs:36` | Classify large exponents with bounded saturating arithmetic instead of rejecting representable zero/underflow at i32 parsing | Required and optional oversized exponent regressions; genuine positive overflow still rejects |
+| W99 | P2; strict no-serde branch in `codegen/src/codegen.rs:278` | Emit one manual redacted Debug without deriving another implementation | Strict no-serde policy fixture |
+| W100 | P3; `codegen/src/codegen.rs:34` | Gate codec emission on serde usage | Both AWS JSON no-serde protocols and restXml produce no unused codec module |
+
+Final focused evidence:5 generator tests,34 generated-model cases and1 executed doctest; formatted regeneration and strict tool/model checks pass. Final workspace build/test/fmt/Clippy/rustdoc pass with2,447 tests/414 gated, including retained deferred Docker changes. Audit scans475 workspace/29 standalone-tool dependencies without vulnerabilities; both deny graphs pass with existing unmatched/duplicate-policy notices and no new ignores. The developer tool uses bounded ordinary-file Tokio IO, validates Smithy2.0 and no longer retains unused trait/phase data. This does not close P2, M1 or final real-image/platform requirements.
+
+## P2 typed HTTP independent review
+
+The production transport implements API§1.2/D41 without a default handler or premature gateway registration. The independent read-only reviewer rechecked all four findings and reported no remaining in-slice findings.
+
+| ID | Priority / source | Closed correction | Verification |
+|---|---|---|---|
+| W101 | P2; `crates/rustack-stepfunctions-http/src/body.rs` | Reject every trailer frame through a local body adapter before shared collection/typed dispatch | Small/oversized generic trailer frames and an actual chunked Hyper request |
+| W102 | P2; `crates/rustack-stepfunctions-http/src/validation.rs` | Give traceHeader its0–256 ASCII text contract, including empty/spaces | Exact limits plus Unicode/oversize rejection; ordinary SDK sends empty trace |
+| W103 | P3; `crates/rustack-stepfunctions-http/src/protocol.rs` | Validate nonempty ASCII decimal Content-Length before numeric conversion | `+2`, `-0` and empty values reject before handler |
+| W104 | P3; `crates/rustack-stepfunctions-http/tests/network.rs` | Retain the same server root JoinHandle after a cleanup waiter expires; resume joining rather than aborting ownership | Paused expiry/resume test verifies task identity and joined child |
+
+Focused evidence:56 unit tests, two nongated network tests and eight doctests pass; strict production HTTP Clippy passes. The separately gated real signed boto3 fixture passes four calls against a controlled typed handler. This qualifies transport only; registry, compiler, execution engine and real Lambda/image workflow acceptance remain required. Final current-worktree standard build/test/fmt/Clippy/rustdoc pass with2,505 tests/415 gated (including the deferred Docker checkpoint). Workspace476/tool29 dependency audits and both deny graphs pass.
+
+## P2 compiled path/payload independent review
+
+ASL§2.1.1/D42 implements bounded immutable business payloads, a separate internal context, typed compiled paths, borrowed selection and transactional result writes. Review corrections:
+
+| ID | Priority / source | Correction | Verification |
+|---|---|---|---|
+| W105 | P2; `crates/rustack-stepfunctions-core/src/payload.rs` | Borrow constructed Values; validate and encode before cloning so rejection owns no recursive tree Drop |50,000-depth payload/context rejection with caller-owned iterative teardown |
+| W106 | P2; `crates/rustack-stepfunctions-core/src/path.rs` | Use a separate EvaluationContext with byte/depth/member headroom | Full256KiB,64-depth and65,536-member source inputs plus metadata/Map items |
+| W107 | P2; `crates/rustack-stepfunctions-core/src/payload.rs` | Derive4MiB internal context cap from numeric-normalization expansion, rather than original source byte lengths alone | Compact exponent-heavy inputs, max string/full numeric Map items, exact cap/+1; selected output still bounded |
+
+Focused evidence:75 unit tests (including three512-case properties),12 doctests and ordinary/strict core Clippy pass. All seven independent path catalog cases execute against the evaluator. The independent read-only reviewer rechecked all three corrections and reported no remaining in-slice findings. Standard workspace build/test/fmt/Clippy/rustdoc pass with2,580 tests/415 gated, including the retained deferred Docker checkpoint. Full compiler/registry/engine and M1 acceptance remain required.
+
+## P2 compiled Choice independent review
+
+ASL§2.4.1/D43 implements compiled predicate semantics, shared evaluation budgets and a bounded Unicode glob. The independent read-only reviewer rechecked the following corrections and reported no remaining in-slice findings.
+
+| ID | Priority / source | Closed correction | Verification |
+|---|---|---|---|
+| W108 | P2; `crates/rustack-stepfunctions-core/src/choice.rs` timestamp representation/evaluation | Preserve full normalized decimal fractions beyond chrono nanoseconds; debit cached literal and dynamic source lengths | Distinct10-digit fractions, equivalent offsets/trailing zeros and valid long-literal/Path rules exhausting shared budgets |
+| W109 | P2; `crates/rustack-stepfunctions-core/src/choice.rs` numeric comparison | Reject float endpoints conservatively to prevent out-of-range source lexemes aliasing integer2^53; keep integer endpoints valid; enable existing float_roundtrip for correctly rounded interior forms | Raw decimal/exponent positive/negative boundaries and equivalent interior lexemes; type-only IsNumeric remains independent |
+
+Focused evidence:125 total core unit cases and15 doctests pass, including the90-combination matrix, four independent Choice catalog cases and two new512-case properties. Ordinary all-targets and strict production core Clippy pass. This is predicate evidence, not a complete Choice state or compiler/engine acceptance. Final standard workspace build/test/fmt/Clippy/rustdoc pass with2,630 tests/415 gated, including retained deferred Docker changes. Model regeneration and strict model/HTTP targets plus the real signed SDK fixture pass after shared feature unification. B06 audit/deny failures remain explicitly open.
+
+## P2 Wait source independent review
+
+ASL§2.4.2/D44 implements the four typed Wait sources, source/dynamic validation, supplied-clock relative-duration resolution, target-only timestamp truncation and a365-day STANDARD cap. Shared source preflight/borrow validation is reused by Choice and Wait. The independent read-only reviewer reports no findings; scheduling/timer ownership is explicitly outside this pure component.
+
+Core166 unit cases/18 doctests and strict production/all-targets Clippy pass, including41 Wait additions and one512-case property. Final current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,671 tests/415 gated, including the deferred Docker checkpoint. B06 audit/deny failures remain open. This does not close the compiler, registry, execution actor or M1 acceptance.
+
+## P2 expression/intrinsic independent review
+
+ASL§2.3.1/D45 implements the complete12-call selected intrinsic profile, winnow AST, format provenance, shared resource accounting and fallible typed UUID sourcing. The independent read-only reviewer rechecked both corrections and reported no remaining in-slice findings.
+
+| ID | Priority / source | Closed correction | Verification |
+|---|---|---|---|
+| W110 | P2; `crates/rustack-stepfunctions-core/src/expression/eval.rs` split delimiter construction | Debit work before every construction step, including duplicate scalars |20,000 repeated identical delimiters exhaust the shared budget |
+| W111 | P2; `crates/rustack-stepfunctions-core/src/expression/eval.rs` structural object equality | Charge key lookup work before lookup and bound queued comparison work | One200-key late mismatch returns false;100 repeated mismatches exhaust rather than bypass aggregate work |
+
+Core242 unit cases/21 doctests and strict checks pass, including all12 independent catalog cases and two new512-case properties. Final current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,747 tests/415 gated, including retained deferred Docker changes. Audit still reports the same4 vulnerabilities/10 unsound warnings in the existing zstd/Squib graph (477 packages); deny passes bans/licenses/sources and fails advisories under open B06. No external package/version was added and no ignores were introduced. Template/pipeline/compiler, async entropy isolation and full workflow acceptance remain required.
+
+## P2 template/data-flow independent review
+
+ASL§2.2.1/D46 implements compiled normalized templates, streaming borrowed output preparation, phase-wide budgets and pure resource-input/result phases retaining original input. The independent read-only reviewer reports no in-slice findings. Exact combined-node and depth boundaries, shared-field/phase work, all four independent pipeline cases and intermediate failure-before-discard cases pass.
+
+Final core270 unit cases/31 doctests and strict production/all-targets checks pass, including28 additions and two512-case properties. Current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,775 tests/415 gated, including retained deferred Docker changes. No dependencies changed; the previously verified B06 audit/deny failure remains open. Machine compiler/indexed IR, actor/registry/resource execution, callback provenance and complete M1 acceptance remain required.
+
+## P2 sequential compiler independent review
+
+ASL§1.1/D47 implements strict whole-definition compilation into immutable six-state IR, lexical scoped indices, graph/terminal validation, original-byte capture, typed read views, static scoped Lambda validation and ordered recovery metadata. Data-flow component failures retain their enclosing field locations; diagnostic codes are a private exhaustive enum and static messages expose local limits without source excerpts. The independent read-only reviewer reports no in-slice findings, including the final diagnostic/allocation changes.
+
+Core315 unit cases/66 doctests and strict production/all-targets checks pass, including45 additions, two512-case properties and exact65,536/65,537 compiled-node fixtures under the source/state caps. The bounded writer minimum drops from4KiB to64 bytes to avoid hundreds of MiB in tiny scalar caches; output/depth limits remain unchanged. Final current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,820 tests/415 gated, including retained deferred Docker changes. No dependencies changed; B06 remains open. Actor scheduling/resource ownership, runtime adapter availability, API registration and complete M1 acceptance remain required.
+
+## P2 sequential transition-driver independent review
+
+ASL§3.1/D48 implements six-state deterministic execution, explicit dispatch/timer/cancellation effects, stable terminal outcomes, raw-input recovery, checked deadline/backoff and bounded unbiased FULL jitter. The outer supervisor still owns invocation lifetime, official history and API publication. Three independent findings are closed and rechecked; the final reviewer reports no remaining in-slice findings.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W112 | P2; `crates/rustack-stepfunctions-core/src/engine/recovery.rs:80` | Check remaining transition capacity before scheduling a retry | One-dispatch budget fails immediately without Park, entropy or retry-count mutation |
+| W113 | P3; `crates/rustack-stepfunctions-core/src/engine/mod.rs:433` | Treat encoding infrastructure failures as Rustack.InternalError and retain typed sources | Encoding failure bypasses business Retry/Catch and keeps its source |
+| W114 | P2; `crates/rustack-stepfunctions-core/src/engine/mod.rs:428` | Classify byte/string/key payload quota failures as States.DataLimitExceeded | Compiled Pass string at encoded256KiB succeeds; +1 and above scalar cap fail consistently |
+
+Core365 unit cases/89 doctests and strict production/all-targets checks pass, including50 new cases and a512-case arbitrary-control-order property. Catch merge errors are Runtime, explicit parameter/result expansion limits recover, and Stop/timeout/stale results settle once. Final current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,870 tests/415 gated, including retained deferred Docker changes. No dependencies changed; B06 audit/deny remains open and was not rerun for this slice. Async actor/cleanup ownership, history, registry, real Lambda bridge and complete M1 acceptance remain required; Docker-image completion remains deferred under the user's priority.
+
+## P2 supervised runtime/history independent review
+
+ASL§3.2/D49 implements a registry-owned JoinSet supervisor, retained bounded CPU proposals, watch control/read publication, separate business/cleanup receipts and persistent official history with terminal/global accounting. Root slots retain a dispatch lease ledger independently of execution-worker lifetime. The same supervisor/drain continues after waiter expiry; no business execution is restarted. Typed diagnostics are retained behind redacted Debug. The final independent read-only review reports no remaining in-slice findings.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W115 | P2; `crates/rustack-stepfunctions-core/src/engine/runtime/mod.rs:356` | FallbackOwner Drop preserves unresolved state on unpolled/cancelled fallback, panic or runtime shutdown | Adapter responder outlives stopped execution runtime; open/dispatch permits and history remain charged |
+| W116 | P2; `crates/rustack-stepfunctions-core/src/engine/runtime/actor.rs:383` | Sample admission return once, recheck control/deadline, use that same sample for history/completion | Stop during synchronous rejection omits invalidated admission failure; expired rejection follows Task timeout history |
+| W117 | P3; `crates/rustack-stepfunctions-core/src/engine/runtime/tests.rs:765` | Separate RAII controller releases test-only blocking gates on failure paths | Stop/deadline/panic CPU fixtures cannot strand spawn_blocking during failed assertions |
+
+Core404 unit cases/129 doctests and strict production/all-targets checks pass, including39 additions. Final current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,909 tests/415 gated, including the retained deferred Docker checkpoint. Newly direct model/Tokio/tracing edges add no package/version. Audit still reports4 existing vulnerabilities/10 unsound warnings; deny passes bans/licenses/sources and fails advisories under open B06. These channel-based invocation tests qualify core ownership, not actual Lambda/image execution. Registry, real bridge, SDK/main registration and complete M1 remain required. Docker-image work remains deferred under the user's workflow-first priority.
+
+## P2 real Lambda bridge independent review
+
+Integrations§1.1/D50 add an owned submission before Lambda admission, borrowed result/cleanup observation, external cancellation and a binary-support bridge to the same real provider. A bounded root manager owns slots above workers; the bridge retains start futures and uncertain invocation handles, resumes cleanup after observer expiry and never adds a business retry or disabled-runtime fallback. Direct/optimized mapping is retained CPU work and uses the admitted Lambda UUID. The final read-only review reports no remaining in-slice findings, including the additional actual function-timeout Catch fixture and final dependency/fixture cleanup.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W118 | P2; `apps/rustack/src/stepfunctions_bridge/mapping.rs:99`, `crates/rustack-lambda-core/src/provider.rs:1286` | Recheck dynamically evaluated names/complete ARNs against scope; reject bridge partial references, and reject ordinary Invoke partial-ARN account mismatch before local resolution | Dynamic partial/cross-scope calls never execute; same-account ordinary partial references still resolve |
+| W119 | P2; `crates/rustack-lambda-core/src/invocation.rs:133` | Preserve typed DeadlineExceeded when an already-expired context is also cancelled; recheck deadline on watch notification | External cancellation/closure and simultaneous deadline precedence regressions |
+| W120 | P3; `apps/rustack/src/stepfunctions_bridge/mapping.rs:25` | Replace derived CallPlan Debug with a static redacted representation | Function/qualifier/payload markers absent from formatted plan |
+| W121 | P3; `apps/rustack/src/stepfunctions_bridge/tests/native.rs:45`, `tests/lambda-fixtures/echo-bootstrap/src/main.rs:84` | Require a handler-written PID/request-ID marker after event receipt before Stop/Task-timeout cleanup assertions | Actual Native cancellation waits for consumed event, joins all owners and proves the PID is absent |
+| W122 | P3; `apps/rustack/src/stepfunctions_bridge/tests/native.rs:396` | Collect payload-loop/start/marker-read errors before assertions; always attempt joined cleanup and preserve files when cleanup is unproven | Final source recheck includes all seven actual process scenarios and failure paths |
+
+Eleven controlled bridge cases and six executable doctests pass; ordinary/strict bridge checks and all six Lambda boundary checks pass. The latter executes1,228 unit/doctest cases with20 separately gated resources. Core404 units/132 doctests pass. Seven explicitly selected actual Native scenarios pass, covering real computation/request metadata, retries, alias version switching, FunctionError Catch, running-process cancellation/timeout, JSON payload types and function-owned Sandbox.Timedout. This establishes actual provider/process execution, not an HTTP/SDK endpoint. Final feature-enabled current-worktree workspace build/test/fmt/Clippy/rustdoc pass with2,925 tests/422 gated, including the retained deferred Docker checkpoint. Existing resolved dependencies gain only local edges; no external package/version is added. Fresh audit/deny still fail B06 (4 vulnerabilities/10 unsound warnings); bans/licenses/sources pass with no new ignores. Registry/main/ordinary SDK acceptance, remaining P2–P5 and final image/platform requirements remain open under the user's workflow-first priority.
+
+## P2 resource/execution registry independent review
+
+API§3.1/D51 adds the core resource/execution registry without an HTTP dependency. A bounded root owns accepted commands and pending CPU preparation, linearizes revisions/names against Start, retains allocation permits through immutable snapshots, separates90day names from shorter terminal retention and preserves caller-independent Stop/shutdown. The final independent read-only production review reports no remaining in-slice findings after the following corrections.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W123 | P2; `crates/rustack-stepfunctions-core/src/registry/actor.rs:453`, independent cleanup/expiry review | Gate record/name expiry on confirmed Clean; retain captured identity/revision/record/name beyond TTLs while cleanup is Pending/Quarantined | Both TTLs exceeded under an actual task receipt; all slots remain charged until receipt settlement |
+| W124 | P2; `crates/rustack-stepfunctions-core/src/registry/actor.rs:173`, independent entropy review | Acquire secure IDs in one retained blocking JoinSet worker, with pending envelope and command permit above its await | Root abort while worker is gated retains accepted-command capacity; channel-disconnection gate cannot strand a failed test |
+| W125 | P2; `crates/rustack-stepfunctions-core/src/registry/actor.rs:453`, independent maintenance review | Build running-resource membership once instead of scanning every execution separately per deleting machine | Code recheck shows one bounded record pass plus indexed membership per machine |
+| W126 | P2; `crates/rustack-stepfunctions-core/src/registry/actor.rs:299`, independent API/resource review | Check current machine existence atomically before listing and pin deleted/prior-incarnation behavior in API§3.1 | Missing/deleted list rejects; retained execution reads survive deletion; recreated ARN lists retained old records |
+| W127 | P2; `crates/rustack-stepfunctions-core/src/registry/types.rs:152`, self-review of retained metadata | Share immutable tags via Arc<TagAllocation> with a separate retained-version semaphore | Old snapshots preserve tags and exhaust version capacity until their last Arc drops |
+| W128 | P2; `crates/rustack-stepfunctions-core/src/registry/mod.rs:234`, self-review of Stop cancellation | Enqueue an owned validated Stop command, then observe terminal publication outside the actor | Dropping the accepted reply still commits Stop; omitted/empty fields and repeated terminal history remain stable |
+| W129 | P2; `crates/rustack-stepfunctions-core/src/registry/actor.rs:113`, self-review of abnormal root ownership | Close ExecutionSupervisor synchronously before preserving the unresolved graph | Root abort signals active Wait work and retains immutable allocations without false clean shutdown |
+| W130 | P2; `crates/rustack-stepfunctions-core/src/registry/mod.rs:137`, self-review of reply closure | Clear a completed oneshot receiver even when its sender closed; keep timeout-only observation resumable | Repeated observation of a closed reply returns typed Unavailable twice without a panic |
+
+Core442 unit cases/173 doctests and ordinary/strict checks pass, including38 registry cases and a512-case scoped identity property. Full feature-enabled current-worktree build/test/fmt/Clippy/rustdoc pass with2,963 tests/423 gated, including the retained deferred Docker checkpoint. Eight explicit actual Native cases pass; registry creation/update/start/delete drives computed42/44 under distinct captured revisions and reads them after mutable deletion. Test failure paths join all owners and preserve files on uncertain cleanup. Existing sha2/regex packages gain local edges only; current root audit/deny retains B06 (4 vulnerabilities/10 unsound warnings), with bans/licenses/sources passing and no new ignores. Retained API preparation, authenticated pagination, main/ordinary SDK service acceptance, complete M1 and remaining P2–P5/image/platform requirements remain open. No service availability is advertised by this domain component.
+
+## P2 real API preparation/pagination independent review
+
+API§1.3/§6.1/D52 compose the actual Registry with the typed HTTP handler in binary support, without a Lambda dependency or default/fake handler. The API root retains accepted slots above request workers, bounded CPU work and an actor-owned PageStore. Shared immutable captures keep vector/history bytes charged through the last cursor/worker reference. Final independent read-only review reports no remaining in-slice production/lifecycle finding after the following corrections; later additions only extend real terminal-projection coverage and align a missing Update parameter error with the primary contract.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W131 | P2; `apps/rustack/src/stepfunctions_api/pages.rs:97`, independent allocation review | Charge actual Vec capacity and compact filtered captures, rather than charging sparse logical length | Repeated100k-capacity sparse captures exhaust8MiB admission; one remaining Arc keeps its charge |
+| W132 | P2; `apps/rustack/src/stepfunctions_api/error.rs:46`, independent modeled-error review | Map tag misses to ResourceNotFound400; distinguish core TagLimit from generic validation, and keep mutation atomic | All three missing tag operations return the modeled code; cumulative51st tag rejects with the original50 unchanged |
+| W133 | P2; `apps/rustack/src/stepfunctions_api/worker.rs:139`, `apps/rustack/src/stepfunctions_api.rs:230`, independent deadline review | Recheck after CPU admission/join and immediately before returning a handler reply | Actual entered CPU and an already-ready typed reply are rejected after controlled deadline advancement; work is still joined |
+| W134 | P3; `apps/rustack/src/stepfunctions_api.rs:292`, independent diagnostic review | Preserve an existing typed Worker failure when root Drop installs quarantine state | Worker panic diagnostic remains inspectable after request-error Drop and failed shutdown |
+| W135 | P3; `apps/rustack/src/stepfunctions_api/tests.rs:637`, independent timing review | Pause Tokio time and advance only after entry/ready proof, with RAII release of blocking gates | Deadline tests no longer depend on25ms setup/scheduling; a separate real one-second execution timeout checks API/history agreement |
+| W136 | P2; `codegen/src/codegen.rs:1114`, self-review of newly exercised status generation | Preserve402 PaymentRequired and408 RequestTimeout constants instead of mapping them to500 | Standalone generation regression, actual model status matrix, strict regenerated model and API timeout statuses |
+| W137 | P2; `crates/rustack-stepfunctions-core/src/registry/actor.rs:138`, self-review of API/registry shutdown composition | Disable a closed command lane while retaining independent registry supervisor/execution ownership | Direct root poll stays live after sender loss; an accepted Task computes42 after every Registry command handle is dropped |
+
+The shared binary gate passes30 unit cases/12 doctests; core passes445 units/177 doctests and all strict checks. Nine explicit actual Native cases pass; the new typed HTTP case checks computed42, real metadata, deleted-resource history continuation and joined cleanup before assertions. This remains in-memory generic Hyper transport qualification, not main/socket/SDK service acceptance. Six generator cases,35 model cases/one doctest and formatted regeneration/strict tool checks pass; HTTP passes56 units, two framing cases/nine doctests with its SDK case separately gated. Final feature-enabled current-worktree build/test/fmt/Clippy/rustdoc pass with2,986 tests/424 gated, including retained deferred Docker changes. Root audit/deny still fail B06 (4 vulnerabilities/10 unsound warnings), bans/licenses/sources pass, and standalone tool audit/deny pass without new ignores. Main/settings/health/worker coordination, real network Rust SDK+boto3 acceptance, complete M1 and remaining P2–P5/image/platform gates remain open.
+
+## P2 main gateway/runtime composition independent review
+
+Operations§1.6/§3/D53 compose the actual core/API/bridge under opt-in main registration,20 validated supported YAML budgets and a unique WorkflowSupervisor outside shared health handles. The final independent review reports no remaining in-slice production findings, including the shared router boundary closure.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W138 | P2; `apps/rustack/src/stepfunctions_bridge.rs:153`, independent health review | Separate permanent ownership uncertainty/worker failure from historical invocation diagnostics | Missing-function unit regression and actual Native handler timeout/Task timeout/Stop leave readiness healthy after settlement |
+| W139 | P2; `apps/rustack/src/stepfunctions_bridge.rs:185`, independent actual-provider review | Require image_available proof for manually injected Docker providers; ordinary CLI already rejects unsupported selection | Unqualified manual Docker provider rejects before advertising the port; explicit actual Native composition remains available |
+| W140 | P3; `apps/rustack/src/runtime.rs:189`, independent pure-feature review | Compile synchronous ready futures when no producer/consumer exists; conditionally compile snapshot helpers and provider imports | Pure workflow-only tests and strict production/all-target Clippy pass without new suppressions |
+| W141 | P3; `apps/rustack/src/workflows.rs:96`, independent redaction review | Preserve the typed cleanup source behind a static redacted Debug/Display wrapper | Sensitive-marker test checks redacted Debug and available error source |
+| W142 | P2; `apps/rustack/src/gateway.rs:195`, independent deadline review | Let the actual bounded Step Functions transport own its modeled deadline | Actual slow-body socket with matching one-second budgets emits408, RequestTimeoutException and x-amzn-requestid |
+| W143 | P2; `apps/rustack/src/workflows.rs:281`, self-review of final failure cleanup | Separate final shutdown from consistency grace; retain ClosingApi and signal remaining owners on observer expiry before provider destruction | A3600-second Wait under60-second grace is aborted as Rustack.Shutdown by final cleanup within5seconds; existing observer-resume cases still pass |
+| W144 | P2; `apps/rustack/src/main.rs:1316`, independent routing review | Register the exact target-family router before every heuristic path/signing-scope router | Actual sockets with Lambda path, form/SNS signing scope or duplicate DynamoDB-first/SFN targets all reach the SFN envelope rejection |
+| W145 | P3; `apps/rustack/src/service.rs:100`, `service.rs:478`, self-review of expanded strict binary gate | Share borrowed SigV4 classification and replace Lambda path Vec indexing; apply doc Markdown corrections | Existing SES classification plus malformed credential/path regressions preserve prior routing behavior; full/pure strict binary checks pass |
+
+The runtime Makefile gate includes31 API/bridge cases,13 executable CLI examples,75 full binary cases and55 pure binary cases, with strict production checks for both shapes. Core qualification passes445 units/180 doctests. Nine explicitly selected actual Native scenarios pass, including timeout/Stop readiness and joined PID retirement. Actual socket tests exercise the real registered handler and gateway; these are not ordinary SDK service acceptance. Final feature-enabled current-worktree build/test/fmt/Clippy/rustdoc pass with3,003 tests/424 separately gated cases, including the preserved deferred Docker source. No external dependency/version changes or Docker experiments were introduced. Ordinary Rust SDK+boto3 real-core acceptance, full M1 and remaining workflow/image/platform milestones remain open. Existing B06 audit/deny findings remain unresolved; no security ignore is added.
+
+## P2 ordinary SDK acceptance independent review
+
+Verification§3/D54 now qualify the selected M1 profile through ordinary Rust SDK and boto3 against separate real strict-auth Rustack/Native processes. Both execute17 source-linked outcome cases plus all15 M1 APIs, with explicit host architecture and independent literal expectations. The final independent read-only review reports no remaining in-slice findings after these corrections.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W146 | P2; `apps/rustack/tests/workflows_sdk.rs:41`, independent subprocess review | Provision a persistent private build venv first; directly own Python rather than SIGKILL only its uv parent | Real SDK suite plus directly observed Python PID timeout/forced reap/absence;32KiB stream caps and cleared child environment |
+| W147 | P2; `apps/rustack/tests/workflows_sdk.rs:21`, `workflows_sdk/rust.rs:230`, independent liveness review | Bound the whole exercise at120s and count pages/seen tokens independently of returned items | History/execution/machine cursors remain bounded even for empty/repeated/fresh-token pages; server cleanup remains outside exercise timeout |
+| W148 | P3; `apps/rustack/tests/workflows_sdk/rust.rs:391`, independent causal-evidence review | Assert exact selected sequential predecessor=id-1, and preserve predecessor pairs through reverse projection | Both SDKs validate every catalog history and reverse/data-disabled pages |
+| W149 | P3; `apps/rustack/tests/workflows_sdk/rust.rs:671`, independent timing review | Replace a two-second RUNNING window with an actual consumed-event-gated Lambda,900s handler ceiling and explicit release | Concurrent duplicate start remains RUNNING until after update/new-output proof; old captured definition still completes old output |
+| W150 | P3; same revision path, independent wire-metadata review | Require concrete valid original/update/captured UUIDs and revision advancement rather than optional equality | Both SDKs reject absent metadata and compare captured original identity/date after update |
+| W151 | P3; `apps/rustack/tests/workflows_sdk.rs:84`, independent cleanup-error review | Always join runner timeout/kill/reap before inspecting PID-barrier errors | The explicit runner regression covers both actual PID and malformed PID barriers, then proves absence |
+| W152 | P3; `apps/rustack/tests/workflows_sdk/process.rs:242`, independent helper-bound review | Route signal and absence probes through the bounded direct-child Runner, including pipe deadlines and reap | Both coordinated server cleanup and standalone forced-Python proof have bounded joined helper processes |
+
+`make test-stepfunctions-sdk` explicitly passes3 resource cases with0 ignored, plus the separate catalog-oracle validator in ordinary tests. Both SDKs execute all17 semantic cases and all15 supported actions; negative validation includes malformed paths and duplicate .$ output names. Current feature-enabled workspace build/test/fmt/Clippy/rustdoc pass with3,004 tests/427 separately gated cases, including the preserved deferred Docker source. Full/pure runtime gates retain75/55 binary cases and strict production checks; nine actual Native bridge scenarios pass under the updated SDK dependency cohort. Evidence: `/tmp/rustack-sdk-qualified{,-build,-tests,-docs,-format}.log`, `/tmp/rustack-sdk-done-clippy4.log`, `/tmp/rustack-sdk-done-{runtime,native}.log`.
+
+New aws-sdk-sfn1.123 requires matching aws-config1.13/shared protocol dependencies; existing SDK consumers compile and the workspace suites pass. The generated/model protocol and production SDK-free architecture remain unchanged. Fresh audit scans481 dependencies against1,378 advisories and still reports the existing B06 four vulnerabilities/ten unsound warnings. Deny advisories fail while bans/licenses/sources pass; no new ignore is added. This is selected M1 SDK feature acceptance on the actual host Native backend, not cloud differential, other-service live SDK acceptance, final security release clearance, later workflow milestones or image/platform qualification. Docker experiments remain deferred.
+
+## P3 structured compiler dependency independent review
+
+The structured compiler dependency in ASL§1.2/D55 extends typed IR and normalized scope compilation. It intentionally retains Sequential API and driver admission; this does not close P3 task3.1 or any runtime/child-integration exit criterion.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W153 | P2; `crates/rustack-stepfunctions-core/src/compiler/scope.rs:102`, independent lexical-index review | Assign IDs after names enter the sorted BTreeMap; source insertion order must not determine IDs while row emission remains lexical | Raw nonlexical root/nested definitions pass with default JSON maps and explicit preserve_order feature; Makefile retains both configurations |
+| W154 | P3; `crates/rustack-stepfunctions-core/src/compiler/tests/structured.rs`, independent boundary-fixture review | Distinguish scope nesting from JSON container nesting instead of requiring16 Parallel wrappers to bypass the64-container preflight cap | Exact16/17 Map processor nesting, mixed Map/Parallel property and separate excessive Parallel JSON-depth rejection |
+| W155 | P2; `crates/rustack-stepfunctions-core/src/compiler/ir.rs`, `registry/mod.rs`, independent revision-provenance review | Preserve private root/nested provenance and reject nested artifacts before accepting registry Create/Update; shared source bytes do not make a child a complete definition | Both sequential Parallel branches and Map processors fail Create and Update admission; rejected creates allocate no resource and rejected updates preserve the original revision Arc |
+
+Final independent read-only review reports no remaining in-slice findings. `make test-stepfunctions-core` passes490 unit cases,182 doctests and89 preserve_order compiler cases, followed by standard/strict production Clippy. Feature-enabled workspace build, all-target tests (3,049 passed/427 explicitly gated), Clippy, rustdoc with denied warnings and nightly formatting pass. The real Rust SDK/boto3/forced-runner suite also passes3 cases with no ignored tests. Evidence: `/tmp/rustack-p3-compiler-{core-final,build,workspace,clippy,docs,format,sdk}.log`. Six changed documents have241 resolvable local links, and diff whitespace checks pass. No dependencies, toolchain or Docker experiments changed; existing B06 remains open. Structured frame scheduling, concurrent causal history, sibling cleanup and nested integration remain required before P3/M2 acceptance.
+
+## P3 structured frame-effect interpreter independent review
+
+ASL§3.3/D56 now define lazy indexed Parallel/Map effects, typed round joins and ordered recovery. Independent read-only review reports no actionable in-slice findings after the final additions for actual selector failure, typed internal-error bypass and exhausted retry admission. FanoutFailure retains an Error source for interpreter failures and redacts business details. The existing supervisor and API remain sequential; no concurrent actor or M2 acceptance is claimed.
+
+The reviewer highlighted two binding owner-composition obligations, now explicit in ASL§3.3: inherit the exact captured absolute deadline even with less than one second left, and preserve terminal failure origin separately from a historical retained diagnostic. A child internal/interpreter terminal failure must not be flattened into a Branch error eligible for States.ALL replay. These are requirements for the next frame-owner dependency, not dismissed findings or changes to current pure interpreter acceptance.
+
+Final gates: `make test-stepfunctions-core` passes525 default units/193 doctests plus89 compiler and35 structured-effect cases under preserve_order; standard and strict production Clippy pass. Feature-enabled workspace build/all-target tests pass3,084 cases with427 explicitly gated, followed by Clippy, denied-warning rustdoc and nightly format checks. Actual Rust SDK, boto3 and forced-runner cleanup acceptance pass3 cases with no ignored tests. Evidence: `/tmp/rustack-p3-effects-{core-final,build,workspace,clippy,docs,format,sdk}.log`. Six changed documents have244 resolvable local links; diff whitespace checks pass. No dependency versions or Docker experiments changed. B06 and the remaining P3/M3/M4/image/platform requirements remain open.
+
+## P3 bounded frame scheduler independent review
+
+ASL§3.4/D57 define the synchronous frame-tree owner, shared deadlines/transitions, bounded admission/aggregate slots, causal metadata and call-retirement protocol. The default supervisor/API remain gated until asynchronous ownership, panic retention and concurrent history integrate these updates. Independent final read-only review reports no remaining in-slice findings after the following corrections.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W156 | P2; `crates/rustack-stepfunctions-core/src/engine/scheduler/control.rs`, independent ownership review | Distinguish Waiting/Queued/Emitted notifications and retain frame/slot charges until queued metadata is emitted; pruning cannot release retained internal outcomes early | A large business-successful sibling is cancelled before normal notification, both calls retire, and global capacity remains fully charged until emission |
+| W157 | P2; `crates/rustack-stepfunctions-core/src/engine/fanout.rs`, independent error-provenance review | Retain classified terminal failure and typed source together; parent propagation must not reclassify an internal recovery-source error or rewrite its cause | Nested Task FULL-retry WorkLimit remains Rustack.InternalError/Task recovery failed with the original typed source; handled historical diagnostics do not change a later business Fail |
+
+Final gates: default core547 units/221 doctests, plus89 compiler/35 frame-effect/22 scheduler preserve_order cases pass via `make test-stepfunctions-core`, followed by standard and strict production Clippy. Feature-enabled workspace build and all-target tests pass3,106 cases with427 explicitly gated; Clippy, denied-warning rustdoc and nightly format checks pass. Actual Rust SDK/boto3/forced-runner acceptance passes3 cases without ignored tests. Evidence: `/tmp/rustack-p3-scheduler-{core-final,build,workspace,clippy,docs,format,sdk}.log`. Six changed documents have248 resolvable local links and whitespace checks pass. No dependency versions changed. Fresh audit still scans481 dependencies/1,378 advisories and reports the existing B06 four vulnerabilities/ten warnings; deny advisories fail while bans/licenses/sources pass. No new ignores or Docker experiments were introduced. These gates do not establish actual concurrent resource/history/API or full P3/M2 acceptance.
+
+## P3 asynchronous structured owner independent review
+
+ASL§3.5/D58 add the explicit structured supervisor composition; default service/API admission remains Sequential. Independent read-only re-review reports no remaining component findings after all six corrections below. This does not close P3/M2, nested jobs, callbacks, persistence, security remediation or image/platform acceptance.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W158 | P1; `crates/rustack-stepfunctions-core/src/engine/scheduler/control.rs`, independent cancellation review | Sort newly generated cancellation notices descendant-first so parent history cursors outlive children | Nested Parallel→Map sibling failure reaches Catch after all accepted calls retire |
+| W159 | P1; `crates/rustack-stepfunctions-core/src/engine/runtime/structured/mod.rs`, independent timer review | Consume pending Task expiry once and clear stale park timers before CPU work; do not let a past timer starve a ready join | Dispatch saturation, expired one-second Task and gated CPU completion reach Catch without invoking the port |
+| W160 | P2; `crates/rustack-stepfunctions-core/src/engine/runtime/structured/mod.rs`, independent admission review | Fence late Started/rejection history with Task deadline and cancellation state | Delayed synchronous port rejection emits timeout history without late admission events |
+| W161 | P2; `crates/rustack-stepfunctions-core/src/engine/runtime/structured/history.rs`, independent causal review | Track active state entry separately from the last exited state | Stop while subsequent CPU work is gated does not abort the exited Task or publish speculative next-state entry |
+| W162 | P2; `crates/rustack-stepfunctions-core/src/engine/runtime/structured/history.rs`, independent iteration review | Retain parent/iteration linkage and project forced iteration aborts before root terminal | Forced Map Stop includes committed iteration aborts in causal order |
+| W163 | P2; `apps/rustack/src/stepfunctions_bridge/tests/native.rs`, independent evidence review | Wait for two atomic consumed-event markers before release, match distinct PID/request IDs to returned results after cleanup | Actual Native Parallel test proves simultaneous consumed handlers rather than bridge admission alone |
+
+Final gates: `make test-stepfunctions-core` passes558 default units/224 doctests and89 compiler/35 frame-effect/22 scheduler/10 asynchronous preserve_order cases, followed by standard and strict production Clippy. Feature-enabled workspace build/all-target tests pass3,117 cases with428 separately gated; Clippy, denied-warning rustdoc, nightly formatting and full/minimal main-service gates pass. `make test-stepfunctions-bridge-native` executes10 actual process cases without an ignored case. Actual Rust SDK/boto3/runner-cleanup acceptance executes3 cases with none ignored. Evidence: `/tmp/rustack-p3-async-{core-complete,build,workspace,clippy,docs,format,runtime,native-final,sdk}.log`. Six changed documents have251 resolvable local links; whitespace checks pass. No new dependencies, lint/advisory ignores or Docker experiments are introduced. Existing B06 audit/deny remediation remains required; no fresh advisory scan is claimed by these dependency-unchanged checks.
+
+## P3 structured service binding independent review
+
+ASL§3.6/operations§1.6/D59 align API preparation, registry publication and execution profile, install frame/result quotas and expose real eight-state capability. Independent production review found no binding/admission defect. Both qualification findings below are corrected, and final read-only review reports no remaining finding.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W164 | P2; `apps/rustack/tests/workflows_sdk/rust/structured.rs`, `tests/workflows/stepfunctions_structured.py`, independent SDK review | previous<id is insufficient: assert exact shared Parallel fork and MapIterationStarted→MapStateStarted links; reuse complete Execution/State/Task/Lambda payload/metadata omission assertions, including the optimized TaskScheduled parameters object | Both actual SDKs execute six structured catalog cases, reverse/data-disabled paginators and exact fork/iteration identity checks |
+| W165 | P2; same SDK gate deployment fixtures, independent lifecycle review | Raise gate Lambda timeout to900s; fixture gate180s and function expiry must exceed the outer120s qualification window, so natural timeout cannot masquerade as Stop cleanup | Both SDKs Stop an enclosing Parallel→Map after two consumed-event identities, then prove both handler PIDs absent and both iteration aborts precede root termination |
+
+Final gates: core560 units/226 doctests plus89 compiler/35 frame-effect/22 scheduler/10 asynchronous preserve_order cases pass via `make test-stepfunctions-core`, followed by standard/strict production checks. Main full/minimal gates pass77/57 cases and strict boundary checks; settings5 cases and strict core-library checks pass. Actual Native10 and actual Rust SDK/boto3/runner3 cases execute without ignored cases in their required gates. Each SDK runs17 M1 +6 structured catalog cases and2 consumed-event lifecycle scenarios. Feature-enabled workspace build/all-target tests pass3,123 cases with428 separately gated; final Clippy, denied-warning rustdoc and nightly format checks pass. Evidence: `/tmp/rustack-p3-service-{core,runtime-final,settings,strict-settings,build-final,workspace-final,clippy-final,docs,format-final,native,sdk-final}.log`. No fresh advisory scan is claimed for this dependency-unchanged slice.
+
+The completed service gate enables Parallel/Map API execution; nested `.sync`, callbacks, persistence, B06 and final image/platform acceptance remain required. No dependency versions, lint/advisory ignores or Docker experiments change.
+
+## P3 atomic child registry port independent review
+
+Integrations§4.1/D60 implement the concrete child registry dependency. Independent final read-only review reports no remaining finding after all six corrections below. ASL child resources, TaskSubmitted projection and nested service SDK acceptance remain gated.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W166 | P1; `crates/rustack-stepfunctions-core/src/registry/actor.rs`, independent cancellation review | While retaining an entropy join, select child Notify, maintenance and close; stop roots/reject unissued children promptly without losing the CPU worker | A gated UUID worker stays blocked while existing child cancel, child deadline and shutdown each reach terminal/Clean; the root join remains live until gate release |
+| W167 | P2; same actor intake, independent fairness review | Alternate ready ordinary/child lanes, with idempotent cancel wakeups | A continuously ready child lane yields an already accepted ordinary read after at most one child turn |
+| W168 | P2; `registry/child/parameters.rs` and `registry/child/mod.rs`, independent boundary review | Map malformed/scoped ARN/name validation to States.Runtime, preserving distinct service admission errors | Invalid ARN, foreign scope, invalid/null Name, malformed serialized Input and unknown fields all fail through the public Task error mapping |
+| W169 | P2; `registry/child/mod.rs`, independent observer review | Fresh pre/post deadline fences apply even to cached results; retain accepted child or typed rejection on late-ready observation | Paused manual-poll tests cover expired ready success/error, lost waiter and resumed observation without another start |
+| W170 | P2; `apps/rustack/src/stepfunctions_bridge/tests/native.rs`, independent evidence review | Extend relation and parent deadlines beyond the bounded scenario, excluding natural expiry from explicit cancellation proof | Consumed-event child cancellation with relation300s/parent3600s/Lambda900s/gate180s and scenario30s; PID absence precedes global cleanup |
+| W171 | P3; same Native helper, independent probe ownership review | Retain the exact spawned probe through wait timeout, kill and explicit reap; preserve unknown retirement rather than claiming success | An actual60s sleep probe hits its10ms observation timeout, is reaped, and its PID is confirmed absent before the timeout error is accepted |
+| W172 | P2; `registry/child/mod.rs`, self-review | Preserve established DataLimitExceeded classification for typed JSON Bytes/String/Key limits as well as encoded byte exhaustion | Direct typed-error matrix and a real combined Input/Output envelope overflow regression |
+
+Shared admission construction is reused by production and controlled tests. Parent identity/liveness/control/deadline checks refresh again after graph validation at the registration boundary. The weak port, retained root admission, independent child-call permits, OwnerLost distinction and cleanup graph have no remaining independent review finding. Final gates: `make test-stepfunctions-core` passes581 units/243 doctests plus89 compiler/35 frame-effect/22 scheduler/10 asynchronous/19 child/2 controlled preserve_order cases and standard/strict production checks. Feature-enabled workspace build/all-target tests pass3,144 cases with430 separately gated, followed by Clippy, denied-warning rustdoc and nightly formatting. Full/minimal main gates pass77/57 cases with strict production checks. Required Native12 and ordinary SDK/runner3 cases execute with no ignored case. Evidence: `/tmp/rustack-p3-child-{core-final,build-final,workspace-final,clippy-final,docs,format-final,runtime,native-final,sdk}.log`.
+
+No new package versions or lint/advisory ignores are introduced; Tokio test-util is enabled only for deterministic core development tests. Fresh audit scans481 dependencies/1,378 advisories and still fails the unchanged B06 four vulnerabilities with ten warnings. Fresh deny reports advisories FAILED while bans/licenses/sources pass. Evidence: `/tmp/rustack-p3-child-{audit,deny}.log`. B06 remains required before full goal acceptance.
+
+## Existing baseline issues affecting final gates
+
+| ID | Priority / source | Verified evidence | Required disposition |
+|---|---|---|---|
+| B01 | P1; `Cargo.toml:171`, `Cargo.lock`, runtime §7.2/D27 | **Closed for the original baseline:** all16 original advisory findings were resolved; audit and all four deny checks passed at that closure without new ignores. Later database additions are tracked separately in B06. Patched compatible dependencies and ZIP9 replace affected versions; unused local SDK SigV4a crypto graph is removed | Retain audit/deny, hostile ZIP and regional SDK regressions through P1 acceptance; this is not full executor/platform acceptance |
+| B02 | P2; `crates/rustack-kms-model/src/epoch_seconds.rs:39` | Existing optional epoch helper truncates negative fractional seconds and casts a negative fraction to u32; it is unsuitable as the generator's new codec | Do not reuse it in P2. Existing KMS correction is outside this workflow feature; retain as a repository follow-up without claiming it fixed |
+| B03 | P2; Lambda model/HTTP/core and shared auth/core/runtime production libraries | **Closed:** the six-library strict target passes without new ignores after correcting123 fresh baseline findings, including typed MAC initialization errors, guarded indexing and method-specific Errors contracts | Retain `make test-lambda-boundaries` through P1 acceptance; this is not global workspace strict-lint or Docker executor acceptance |
+| B04 | P2; `crates/rustack-lambda-model/src/input.rs`, `provider.rs` code-update dispatch | **Closed:** explicit DryRun, strict deployment DTOs and bounded decoder implemented; ZIP/S3/image nonmutation and live SDK rejection/absence/publication checks pass | Retain regressions through P1 acceptance; this fix does not establish Docker Image Invoke |
+| B05 | P2; `crates/rustack-lambda-core/src/docker/environment/worker.rs`, call/idle event mapping | **Closed:** BootstrapReady does not prove event consumption; shared event classification now preserves <=32KiB InitError as Initialization in initialization/Idle/Busy, with oversized/unexpected events remaining Protocol | Four composed session/HTTP/relay/client/worker regressions cover abandoned polling/offers, Idle/Busy32KiB/32KiB+1, a blocked container-absence barrier before reply, redacted diagnostics and joined control/log/API retirement. Independent read-only review reports no findings; no actual Docker execution is claimed by these scripted-container cases |
+| B06 | P1; direct snapshot and transitive squib-loader compression chain | **Closed by operations§4.1/D69:** zstd0.14.3, safe8.2.0 and sys2.1.2 now form the single resolved cohort, with a source-identical loader dependency overlay. Fresh root audit scans482 dependencies/1,378 advisories with no vulnerabilities/unsound warnings, and all four deny checks pass. The initial4 vulnerabilities/10 warnings remain historical evidence in preceding slices | Preserve provenance, old-frame/context/kernel regressions and fresh audit/deny without new ignores. This closure does not qualify a VM, Docker platform or workflow archive implementation |
+
+The P0 record distinguishes unchanged workspace advisory failures from the clean probe dependency graph; it never reports a fully green security baseline.
+
+## P3 registered nested ASL binding independent review
+
+Integrations§4.2/D61 compose the atomic child port with compiler, exact parent registration gate, structured resource ownership, causal TaskSubmitted projection and the real service. All four valid early findings/semantic corrections are implemented and covered. Final independent read-only review reports no remaining valid findings. An omission-helper concern was withdrawn after direct reread confirmed both ordinary SDK helpers already check TaskSubmitted output and metadata.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W173 | P1; `engine/runtime/structured/child.rs`, independent panic review | Preserve child CPU JoinError as typed fatal actor diagnostics before generic completion; unexpected child worker loss is also fatal, with receipts/lease quarantined | Injected parse CPU panic with Retry/Catch States.ALL produces one attempt, Rustack.InternalError, typed Worker panic and nonclean shutdown |
+| W174 | P2; `engine/runtime/structured/resource.rs`, independent error-domain review | Explicit uncertain child-port errors use ChildError's StepFunctions namespace and quarantined settlement; never fabricate a Lambda failure for child owner loss | The child worker forwards its typed mapping; channel closure from unexpected internal worker disappearance is actor-fatal under W173 |
+| W175 | P2; `engine/runtime/structured/child.rs`, independent lifecycle review | Publish known mapped child business result separately from pending physical settlement; continuation/recovery retirement retains the exact child and frame until Clean | Actual child success is observed and TaskSucceeded recorded before its cleanup receipt is released; cleanup held beyond the parent's one-second Task deadline preserves success |
+| W176 | P2; `engine/runtime/structured/mod.rs`, independent resource-bound review | Drain ready child protocol joins at every actor loop boundary before new business effects, retaining failure classification | The owner reaps ready child jobs alongside retained watcher joins; nested/depth/Stop suites retain charged resources through cleanup |
+
+Final gates: workspace build/all-target tests pass3,164 cases with431 separately gated; Clippy, denied-warning rustdoc and nightly formatting pass. Core600 units/245 doctests, all preserve_order/strict checks, full/minimal main77/57, Native12 and ordinary SDK/single-dispatch/runner4 required cases pass. All264 local links in the six changed spec documents resolve. No dependency package/version or advisory ignore changes. The deferred Docker-image worktree remains untouched. Fresh audit still reports4 vulnerabilities/10 warnings across481 dependencies/1,378 advisories; deny advisories fail while bans/licenses/sources pass (B06 remains open).
+
+## P4 callback registry foundation independent review
+
+Integrations§5.1/D62 implement the scoped callback protocol dependency; ASL/API callback capabilities remain disabled. Final independent read-only source review reports no remaining finding after W177. Self-review also closes W178 with explicit observer races.
+
+| ID | Priority / source | Resolution | Regression evidence |
+|---|---|---|---|
+| W177 | P1; `registry/callback/actor.rs`, independent retained-payload review | On terminal publication, take/drop the outcome sender and invocation receiver, retaining only lightweight token classification/identity rather than business outputs/causes through tombstone TTL | A weak terminal-outcome Arc expires after caller Task/result observers drop, while the token still reports TaskTimedOut; retirement later restores capacity for another actual parent execution |
+| W178 | P2; `registry/callback/receipts.rs`, self-review of late-ready owner loss | Cache mint/API success/errors/owner loss before the post-await observer fence; apply the Task watch observer's fresh fence to both success and closed-channel errors | Manual polling with controlled clock proves late-ready mint/API/Task success, rejection and owner loss return Deadline first and preserve the same later observation without resending or revoking |
+
+The callback suite covers provisional/late success/failure, Lambda failure after early callback, captured-time heartbeat start/reset/absolute limits, two hundred distinct heartbeat deadlines retaining exactly one timer, closed/foreign/forged/old generation classification, parent Stop and retention, command saturation with independent revoke, bounded retained entropy, observer loss, joined controller shutdown and runtime/root worker failure. Debug/secret-wrapper checks and the actor's hash-only table/index types prevent structural plaintext token retention. This is foundation evidence, not actual callback handler, ASL token provenance or SDK SendTask acceptance.
+
+Final gates: core630 units/267 doctests; preserve_order91 compiler/35 effect/22 scheduler/10 async/30 callback/17 nested/19 atomic-child/2 controlled cases and strict production checks pass. Feature-enabled workspace build/all-target tests pass3,194 cases with431 separately gated, followed by Clippy, denied-warning rustdoc and nightly formatting. Both full/minimal main77/57 and the existing actual signed SDK/single-dispatch Native/runner4 required cases pass.
+
+One new pure Rust package, secrecy0.10.3, reuses existing zeroize; core additionally uses the already resolved workspace subtle/hex cohort. No advisory/lint ignores are added. Fresh audit scans482 dependencies/1,378 advisories and still reports the existing4 vulnerabilities/10 warnings; deny advisories fail while bans/licenses/sources pass (B06 remains open). Docker-image checkpoint and all final platform gates remain unchanged.
+
+## P4 callback history schema clarification
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W179 | P2 spec defect; integrations§5 and generated `TaskScheduledEventDetails` | **Closed for schema clarification and pure projection:** D63/§5.2 clarify that TaskScheduled has no truncated metadata member. Preserve the official required parameters string with typed null-redaction; expose internal policy and mark omitted callback result data only on TaskSubmitted's supported outputDetails. Do not invent fields or mark unrelated state input. The generated-model serialization test now pins the allowed wire fields and null-redacted parameters. Actual TaskSubmitted truncation and journal/persistence integration remain consuming P4 work. |
+
+## P4 callback parameter provenance independent review
+
+Integrations§5.2/D63 implement the pure credential/materialization boundary. Final independent read-only review has no remaining findings. The bracket-wildcard forms match the existing JSONPath profile; no parser widening or fake AWS metadata is introduced.
+
+Fifty-six preparation cases cover compiled token/ancestor/wildcard/bracket paths, all12 intrinsic operations, sensitive InputPath propagation, nested templates, exactly-once UUID acquisition, unchanged raw input/base context, stale Task rejection, typed source failures and no partial output, independent actual/history byte limits, and generated TaskScheduled DTO round trips. Two512-case properties check successful compiled path projections and arbitrary untainted business data. Business values equal to a credential remain unchanged unless structurally sourced from Task.Token. Four payload-context cases check ordinary Arc sharing, sensitive clone/final-drop lifetime, zeroize of the injected String, exact4MiB context headroom and context member exhaustion. A real registered-token case checks digest identity, safe history and untouched Invoking state before explicit revoke.
+
+Final gates pass691 core units/273 doctests and preserve_order56 preparation/10 payload/91 compiler/35 effects/22 scheduler/10 async/31 callback/17 nested/19 atomic-child/2 controlled cases, with standard and strict Clippy. Full workspace build/all-target tests pass3,255 cases with431 separately gated, followed by denied-warning Clippy/rustdoc and nightly formatting. Existing full/minimal main77/57 and actual signed SDK/single-dispatch Native/runner4 regressions pass. All266 local links across the six changed specs resolve. Fresh audit still reports4 vulnerabilities/10 warnings across482 dependencies/1,378 advisories; deny advisories fail while bans/licenses/sources pass. No new dependency or ignore is introduced.
+
+The public combined Parameters type deliberately lacks Serialize, protected by a compile-fail doctest. Typed CallbackHistory has no unchecked public constructor. Temporary token context is never serialized for size measurement or stored in the driver. These proofs do not claim ASL callback admission, actual callback Lambda execution, persistent history or SendTask API acceptance. Docker remains deferred, and existing B06 is not waived.
+
+## P4 observed Lambda callback invocation independent review
+
+Integrations§5.3/D64 compose the unique reporter with the actual Lambda invocation port. Independent read-only review found one P2 issue, fixed and rechecked; the final review reports no remaining in-slice finding. Callback ASL/public API activation remains gated.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W180 | P2; `registry/callback/actor.rs`, independent delayed-report review | Store the provisional callback's actor-receipt timestamp. On successful report, compare it with captured observed+heartbeat before commit; an arrival at/after the deadline expires even if stored while Invoking. Paused 0/9/10/11s cases pin within-window and exact-boundary behavior. Existing preactivation heartbeat remains an acknowledged no-op, explicitly tested during delayed reporting. |
+| W181 | P2 evidence clarification; Lambda `work.rs` and integrations§5.3 | Current provider publishes InvokeResponse after backend cleanup/settlement. Qualify provider-return capture before bridge mapping/settlement observation; do not claim earlier handler Runtime API timing or independently held successful Native backend cleanup. A controlled Pending→Quarantined→Clean bridge receipt test proves report independence without inventing physical evidence. |
+
+New qualification covers one-shot delegation, wrong scope/frame/dispatch generation, expired/revoked ownership, past/future timestamp rejection, captured heartbeat timing, late-ready report success/failure/owner-loss fences, last-observer report release, canonical executed versions and real v4/RFC4122 request identities. Mapping tests ignore non-JSON/non-UTF8/ASL-oversized successful synchronous bodies only in callback mode, preserve FunctionError semantics and reject invalid metadata. A retained CPU-join test relays both caller and manager cancellation while the mapping job remains held. Actual Native composition covers early/late callbacks, failure after early callback, actual request/version metadata and consumed-process cancellation with PID absence before global cleanup. Handler-originated SDK callback, ASL history/dispatch, public SendTask and persistence acceptance remain required.
+
+Final gates pass721 core unit cases and289 doctests (288 merged plus one compile-fail). Preserve-order suites pass56 preparation/10 payload/91 compiler/35 effects/22 scheduler/10 asynchronous-owner/61 callback/17 nested/19 atomic-child/2 controlled-clock cases, with strict production Clippy. Binary-support qualification passes34 units/13 docs, all13 actual Native cases, full/minimal main77/57 and4 existing real SDK/runner regressions. Feature-enabled workspace build/all-target test/Clippy/denied-warning rustdoc/nightly formatting pass3,288 tests with432 separately gated. Fresh audit scans482 dependencies/1,378 advisories and preserves existing B06 (4 vulnerabilities/10 warnings); deny advisories fail, while bans/licenses/sources pass. No new dependency, advisory ignore, lint suppression or Docker mutation is introduced.
+
+## P4 deferred callback effect independent review
+
+Integrations§5.4/D65 implement a distinct immutable callback instruction/effect and typed history projection. The callback compiler capability defaults false. Sequential driver, actual async runtime and Registry Create/Update reject callback-dependent artifacts until the registered consuming worker is installed. Default API/main capability stays unchanged. This is the identity/materialization dependency, not complete M3 service acceptance.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W182 | P2; independent effect→registry composition review, `engine/states.rs` and `registry/callback/types.rs` | Reuse TASK_SECONDS_LIMIT for positive integral heartbeat registration rather than retaining the earlier365-day cap. An actual deferred effect with99,999,998s heartbeat composes with a real registered parent/token, one materialization and a timer clamped to its absolute Task/parent deadline. Reject100,000,000s and fractional/zero intervals. |
+| W183 | P2; independent generated history-field review, `engine/callback.rs` and `engine/history/events.rs` | Carry resolved heartbeat through typed scheduled_callback into the supported TaskScheduled heartbeatInSeconds field. Generated-wire cases preserve literal and dynamic values, omit absent values, and keep redacted required parameters without fabricated truncation fields. Callback Submitted marks omitted synchronous body outputDetails.truncated=true. |
+
+Both findings are fixed and independently rechecked; no remaining in-slice findings. Forty-eight effect cases pin explicit capability/resource checks, static/dynamic/mixed heartbeat/timeout relations, omitted-timeout validation ceiling, original-input resolution before InputPath, no pre-registration UUID work, exact one-time preparation/source failure, captured RetryCount, stale/duplicate/late completion, ResultSelector/ResultPath/OutputPath, Catch, Task timeout, Parallel/Map identity/result ordering, Stop/retirement and rejection without invocation or revision mutation. The generic scheduled helper rejects raw callback Parameters. Native composition now uses an actual CallbackDispatch and the same registered token before observed Lambda issuance, with safe generated Scheduled projection and existing early/late/function-failure/cancel checks. This does not claim the later actor's history commit acknowledgment or handler-originated public API callbacks.
+
+Final gates pass770 core unit tests/299 doctests (298 merged plus one compile-fail), all preserve_order suites including48 effects/62 callback cases, standard and strict Clippy. Binary-support34 units/13 docs, all13 actual Native scenarios, full/minimal main77/57 and4 existing actual SDK/runner regressions pass. Workspace build/all-target tests/Clippy/denied-warning rustdoc/nightly formatting pass3,337 tests with432 separately gated. All changed-doc local links resolve. Fresh audit scans482 dependencies/1,378 advisories, retaining existing B06 (4 vulnerabilities/10 warnings); deny advisories fail, bans/licenses/sources pass. No dependency, advisory ignore, lint suppression or Docker mutation is introduced.
+
+## P4 registered asynchronous callback owner independent review
+
+Integrations§5.5/D66 install the actual registered ASL callback consumer. Immutable fresh-runtime composition requires a real Lambda port and healthy same-scope callback registry; exact snapshot publication precedes token mint, preparation, Scheduled acknowledgment and business issuance. Unregistered starts/default API/main remain gated. Final independent source review, including physical cleanup after callback-root failure and distinct token/byte capacity failures, reports no remaining finding.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W184 | P2; independent reporter-loss review, `engine/runtime/structured/callback/progress.rs` | Unexpected live reporter revocation is typed OwnerLost, queued fatally before business completion. Retry/Catch ALL cannot recover ownership loss; physical cancellation and held/resumed cleanup preserve the original source. Explicit Stop/deadline retain their timeout path. |
+| W185 | P2; independent queued-result lifetime review, `engine/runtime/structured/mod.rs` and `resource.rs` | Completion/Submitted messages and CPU operations retain their call/data lease. Retain terminal child charges through Waiting/Queued result notification and reconcile after update consumption/downstream charging. Two barrier cases prove another callback cannot consume capacity while a large queued child result remains retained. |
+| W186 | P2; held-sibling cancellation regression, `engine/runtime/structured/mod.rs` | Invalidate the parked timer when graph retirement changes readiness. A failed callback sibling cancels the held physical call; Parallel Catch resumes only after that exact cleanup completes, without sleeping past a newly ready parent. |
+
+Twenty-four registered-owner cases cover actual early/late/external-failure results, invocation failure priority, stale Retry tokens/context, heartbeat reset/expiry, absolute timeout, Stop and joined held preparation, physical quarantine/resume, independent proved cleanup after token-root loss, worker/CPU panic, typed missing-path evaluation failure, pre-issuance history rejection, distinct token/result/preparation quotas, single-dispatch progress, Parallel sibling cancellation and ordered Map results. Two private actor barriers pin queued-result byte lifetimes. Four actual Native registered-ASL scenarios cover early/late completion, handler failure after provisional success, real request/version metadata, safe generated Scheduled/Submitted history and consumed PID absence before global cleanup. The full Native gate executes14 cases. This evidence uses a bounded test-only credential capture at the real port; it does not claim handler-originated SDK SendTask routing.
+
+Core qualification passes796 units/301 doctests (300 merged plus one compile-fail), all preserve_order suites and standard/strict Clippy. Plain workspace build/all-target tests pass3,311 cases with415 separately gated; workspace Clippy and denied-warning rustdoc pass. Feature-enabled workspace build/all-target tests pass3,363 cases with433 separately gated. Full/minimal main77/57, binary-support34 units/13 docs, actual Native14 and existing real SDK/runner4 cases pass. A method-level feature gate preserves disabled-build workflows=null and removes the pre-existing disabled-path unused receiver without an ignore; independent review confirms both wire shapes. Final nightly formatting and326 local document links pass. Evidence: `/tmp/rustack-callback-owner-final-{core,workspace,runtime,native,sdk,format}.log`. The callback owner adds no dependency, lint suppression, advisory ignore or Docker mutation. Fresh audit retains existing B06:482 dependencies/1,378 advisories,4 vulnerabilities/10 warnings; deny advisories fail while bans/licenses/sources pass. Public SendTask/service/SDK callback acceptance, persistence/security remediation and final image/platform gates remain explicitly incomplete.
+
+## P4 registry-bound public callback adapter independent review
+
+API§1.4/D67 implement all three SendTask commands for registries with the actual callback owner installed. Registry retains that exact handle instead of a redundant flag, scopes submission internally and rejects closed ownership. Retained API CPU work moves validated owned token storage into the secret wrapper; one acknowledgment observation shares the original caller deadline. HTTP emits the documented zero-byte callback success body. Unbound API/default main stay rejecting; main configuration/capability/shutdown composition and handler-originated SDK callback acceptance remain consuming requirements.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W187 | P3; independent source/spec review, API design:67 | Replace the obsolete unconditional callback UnsupportedOperation statement with bound/unbound behavior after common validation, retaining the separate main/SDK acceptance gate. Final independent recheck finds no remaining issue. |
+
+Thirty-one adapter cases cover actual registered ASL early/late success and JSON types, omitted/empty failure fields, Lambda failure overriding provisional success, fresh retry tokens, unchanged heartbeat history, Task/heartbeat timeout and Stop, forged/malformed/foreign-scope/same-scope foreign-epoch credentials, invalid output/failure bounds without token consumption, real command-lane HTTP throttling and restoration, independent metadata admission, API-root join after dropped/late-ready observers and pre-submission deadline rejection. Ten recursive error/source cases within that suite preserve static status/envelope classification. Six owned-token cases pin validation, no additional retained plaintext token copy and redacted Debug. Existing transport's18-action table now verifies content-length0 plus empty body for every callback success while preserving operation correlation and metadata.
+
+Final core gates pass802 units/302 doctests (301 merged plus one compile-fail), preserve_order suites and strict production Clippy. Plain workspace build/all-target tests pass3,317 cases with415 separately gated; workspace Clippy/denied-warning rustdoc pass. Feature-enabled workspace build/all-target tests pass3,400 cases with433 separately gated. Full/minimal main77/57, binary-support65 units/13 docs, nightly formatting and328 local links pass. Evidence: `/tmp/rustack-callback-api-final-{core,runtime,workspace,feature-workspace,native,sdk,format}.log` (HTTP transport evidence is `/tmp/rustack-callback-api-http.log`). Actual Native14 and existing signed SDK/runner4 regressions pass without ignored cases in their dedicated gates. The CLI adds a dev-dependency edge to the already pinned workspace rstest0.28.0, verified against [current upstream documentation](https://docs.rs/rstest/0.28.0/rstest/); Cargo.lock adds only that edge, no package/version. Fresh audit scans482 dependencies/1,378 advisories and retains B06's4 vulnerabilities/10 warnings; deny advisories fail while bans/licenses/sources pass. No new advisory/lint ignore or Docker operation occurs.
+
+## P4 callback service and real handler SDK independent review
+
+Operations§1.7/D68 consume the registered callback/runtime/API layers in actual main. Four YAML callback quotas and their live≤retained relationship are validated before allocation; actual capabilities report installed callbacks and effective limits while pure/unqualified backends stay rejecting. Readiness includes the callback root independently of metadata admission. The unique supervisor joins API, registry, callbacks and bridge in order, retaining phase/deadline and first diagnostics through observer expiry.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W188 | P2; independent harness ownership review, `apps/rustack/tests/workflows_sdk/process.rs:210` | Save gate-release write/timeout failure, independently signal/wait the owned server and verify Native PID absence, then return the saved failure and preserve evidence. The forced missing-directory regression launches an actual Native computation, verifies server and Native PIDs absent before removing retained files, and confirms cached shutdown failure. A proof flag distinguishes qualified process cleanup from unknown cleanup in retained-evidence diagnostics. |
+
+Final independent read-only review has no remaining finding, including same-PID Python launcher, callback capability socket checks and the gate-failure correction. A separately named optional Rust fixture uses the current workspace aws-sdk-sfn cohort; the Python artifact bundles the same native launcher plus actual boto3 code/interpreter. Native's ELF/Mach-O format checks remain unchanged. Tokio Command's standard Unix exec adapter replaces the already supervised process in the same PID, creating no untracked child. Runtime API blocking IO is joined through spawn_blocking; fixture filesystem IO is asynchronous and bounded. No new lint/advisory suppressions or package/version are introduced.
+
+Both SDK handlers pass nine source-linked callback cases (20 actual attempts) through the strict-auth binary with dispatch capacity1. Held early SDK completion remains provisional until actual invocation report; late completion follows independently observed Submitted and unrelated actual workflow Lambda progress. Invocation failure priority, explicit failure, new retry token/old-token rejection, continuing heartbeats beyond the original interval, absolute timeout despite heartbeats, heartbeat expiry, and consumed Stop PID retirement are observed. Actual request/version/Submitted omission metadata and causal safe history are checked. No plaintext credential is stored in marker/gate files; handler-side SDK history checks use the exact in-memory token. The Python proof is a measured Native warm post-response lifecycle, not Docker networking or AWS background-execution/freeze behavior.
+
+Final qualification: core802 units/302 doctests and all preserve_order/strict gates; full/minimal main79/57 and binary-support65 units/13 docs; actual Native14; required SDK/cleanup6 cases with none ignored. The latest dedicated fault run also passes after the retained-evidence proof diagnostic refinement. Plain workspace build/all-target tests pass3,318 cases with415 separately gated; optional-fixture/Step-Functions feature-enabled build/all-target tests pass3,403 cases with435 separately gated. Workspace Clippy, denied-warning rustdoc, strict settings/fixture/main/library checks, optional-fixture denied-warning docs, nightly formatting and330 local links pass. Evidence: `/tmp/rustack-callback-service-final-{core,runtime,native,workspace,feature-workspace,strict-core,format}.log`, `/tmp/rustack-callback-service-sdk.log`, `/tmp/rustack-callback-service-gate-fault.log`. Fresh audit scans482 dependencies/1,378 advisories, preserving B06's4 vulnerabilities/10 warnings; deny advisories fail while bans/licenses/sources pass. Final persistence/B06/image/platform requirements remain open, and the explicit Docker worktree checkpoint is preserved.
+
+## P5 compression prerequisite independent review
+
+Operations§4.1/D69 close B06 across direct snapshot and transitive Squib dependencies. The path overlay preserves the published loader0.2.0 library, original normalized/source manifests and VCS metadata byte for byte from the checksum-verified registry package. Its sole normalized-manifest change selects zstd0.14.3. Upstream declared license metadata and the separately supplied notice are preserved and recorded. All other Squib packages remain their existing registry identities; no Cargo cache or upstream repository is modified.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W189 | P3; independent gate review, `Makefile:225` | Invoke both provenance/cohort verifiers with python3 -I so PYTHONOPTIMIZE cannot disable assertions. Actual verifier commands under PYTHONOPTIMIZE=1 reject a corrupted copied source and valid-shaped vulnerable cohort with exit1; good current inputs still pass the full target. |
+
+Independent read-only review confirms registry checksum5bd137eb148a011bc2debae200a3c428d5e6c0934c242c64e1c89c374af1a69c, all preserved source/manifests/VCS bytes, the single dependency constraint change and codec minimum versions. No remaining in-slice finding after W189. The checked-in76-byte frame was generated with the original resolved zstd0.13.3/safe7.3.0/sys2.1.0 cohort; its88-byte v2 envelope/CRC/section identity remains readable. Every truncated prefix and reencoded bad CRC reject. Exact output limits0/1/4096 and abandoned encoder/decoder reuse cases pass. Isolated original0.13.3 negative controls fail both context-isolation checks, demonstrating that the new regressions detect the repaired class rather than just checking round trips.
+
+`make test-workflows-compression` verifies source/manifest/fixture fingerprints and the actual path/cohort, then passes15 original synthetic loader cases and29 snapshot cases. The ten new first-party cases preserve production envelope/compression behavior while exposing a private limit seam for exact small-budget tests. Full/minimal main89/67 and binary-support65 units/13 docs pass. Core802 units/302 docs and preserve_order/strict gates pass; the six-library boundary target passes1,231 unit/doc cases with20 separately gated resources. Actual Native14 and required actual SDK/cleanup6 execute without ignored cases in their dedicated gates, retaining both nine-case handler SDK paths. Plain/feature-enabled workspace build/all-target tests pass3,328/3,413 cases with415/435 separately gated; Clippy, denied-warning rustdoc, nightly formatting and332 local document links pass.
+
+Fresh root audit scans482 dependencies/1,378 advisories with no vulnerabilities or warnings; deny advisories/bans/licenses/sources all pass without new ignores (unchanged unused-ignore notices remain policy diagnostics). Evidence: `/tmp/rustack-compression-{gate-final,archive,loader,audit,deny,negative-control,verifier-negative}.log` and `/tmp/rustack-compression-final-{workspace,feature-workspace,runtime,core,native,sdk,boundaries,format}.log`. B06 is closed; workflow persistence, crash/restore semantics and final image/platform requirements remain open. No VM/Docker experiment is claimed or performed, and the image worktree checkpoint remains preserved.
+
+## Cross-references
+
+- ← [implementation plan](./rustack-workflows-90-impl-plan.md)
+- ↔ [runtime spike](../docs/research/spike-lambda-container-relay.md), [semantic oracle](../docs/research/spike-stepfunctions-semantic-oracle.md), [verification gates](./rustack-workflows-70-verification-plan.md)
+
+## P5 bounded CBOR prerequisite independent review
+
+Operations§4.2/D70 install structural preflight and capped fallible encoding in the existing shared snapshot helpers for manifest, metadata and data directories. The preflight borrows text, tracks decoded scalar keys and bounds section/scalar/key bytes, containers, nodes and members before typed deserialization. Unknown tags/string forms, malformed/truncated structure, invalid UTF-8, duplicate keys and trailing roots reject with fixed redacted classes. Existing wire bytes and codecs remain unchanged for accepted values; workflow DTO/schema/revision validation and frozen-registry ownership remain consuming work.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W190 | P2; independent initial spec review, operations§4.2; pinned ciborium0.2.2 de/mod.rs:591 | Separate128 wire-container levels from the typed decoder's256 recursion allowance. A derived enum tree with64 Seq(Vec<Enum>) wrappers passes128 wire levels but its unit Leaf needs one more typed recursion entry: the regression demonstrates literal128 failure and the installed decoder's successful round trip. This in-slice spec defect is corrected before qualification. |
+| W191 | P2; independent profile compatibility review, dynamodb-core/src/snapshot.rs:92 and provider.rs:812 | Replace the initial4KiB generic text-key ceiling with the128MiB scalar ceiling. Existing service maps contain user data, not only identifiers. A real PutItem→export→CBOR/v2 archive→decode/import→GetItem regression preserves4097,65535 and300000-byte attribute names already accepted by Rustack within its item cap. The largest case preserves existing local behavior; it does not claim AWS naming compatibility. |
+
+Both findings are fixed and independently rechecked; final read-only source/profile review has no remaining in-slice issue. The CLI reuses the already resolved workspace proptest1.12 as a dev-dependency edge only; no package/version or advisory/lint exception is added. No Docker/VM experiment occurs and the unrelated image ownership checkpoint remains outside this change.
+
+Final qualification: make test-workflows-archive passes111 full and110 minimal snapshot cases, including82 additions and two512-case properties. Both installed production binary strict checks pass without suppressions. Plain/feature workspace build/all-target tests pass3,410/3,495 cases (415/435 separately gated); workspace Clippy, denied-warning rustdoc and nightly formatting pass on final stable source. Fresh audit482 deps/1,378 advisories is clean and deny advisories/bans/licenses/sources all pass; existing unused-ignore notices remain unchanged. The graph adds only the CLI's edge to already resolved proptest. Evidence: `/tmp/rustack-cbor-final-{archive,workspace,feature-workspace,format}.log`, `/tmp/rustack-cbor-{audit,deny}.log`. An initial diagnostic Clippy invocation omitted the existing production target's --no-deps selection and elevated unchanged generated IAM documentation lints; final qualification uses the retained strict binary targets plus the normal full-workspace lint gate, with no source/lint-policy relaxation. The initial edit-time format failure is superseded by the final post-edit successful formatting gate. Frozen registry export/import, actual workflow archives and final image/platform requirements remain open. The final documentation check resolves all352 local Markdown links across the workflow set, index and binary archive design.
+
+## P5 sealed registry export independent review
+
+Operations§3.1/D71 now preserve actual registry state after clean execution shutdown and export deterministic data-only version1 rows. The unique root retains original revision/tag/record/history ownership in an immutable watch capture, separate from API/worker readiness. Conservative admission checks all copied payloads/history before export. Main snapshot coverage remains unsupported until staged restore and archive registration consume this boundary.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W192 | P2; independent durable-schema review, stepfunctions-model/src/types.rs:1546 and epoch_seconds.rs | Do not serialize generated HistoryEvent directly to CBOR: its JSON RawValue timestamp adapter is not a typed CBOR round trip and truncates submillisecond precision. Store ordinary exact UTC timestamp plus complete official eventJson string. Positive/negative epoch nanosecond cases demonstrate direct-DTO CBOR failure and public precision loss, then round-trip the durable wrapper through actual Ciborium without losing the exact instant or other fields. Future import must cross-check the public timestamp projection before restoring the exact instant. |
+| W193 | P2; independent clock review, initial registry/actor.rs seal implementation | Take adjacent monotonic/UTC samples before final maintenance/traversal and reuse that exact cut. Controlled10s delayed sealing preserves60.123456789s record and90day name projections; separate expiry keeps name reservations after record eviction. No delayed UTC resample extends reservations. |
+| W194 | P2; independent failure-retention review, registry/actor.rs Owner::run | Retain a prepared capture in Owner.capture while drained state/runtime/port destruction can panic; Owner::Drop quarantines it instead of releasing ownership. Publish only after destruction succeeds. Public wrapper and actual actor tests inject a post-drain port destructor panic after a settled ASL execution, prove no exported cut, retain weak record/revision allocations and verify unchanged original semaphore permits. No new lint exception or narrower failure contract. |
+
+All three findings are fixed and independently rechecked; final read-only source/spec/evidence review has no remaining in-slice finding. The runtime distinguishes an unresolved physical receipt from a permanently quarantined actor: the former may seal only after explicit cleanup settlement, while the latter retains sticky failure/no capture. Dropped controllers and dropped/expired observers preserve the same root; source allocations survive through the last sealed handle. Export preserves deleted/recreated identities, old revision/source hashes/roles, tags, raw input, omitted/empty failure fields, every terminal outcome, stable ordering and all retained history events in the multi-page case. Budget admission at the exact conservative boundary, retry after rejection, inconsistent identity/revision binding and redacted Debug are qualified.
+
+Final qualification:27 targeted snapshot cases (24 new) pass in normal/preserve_order configurations with strict production and all-target core Clippy. Full core826 units/305 doctests (304 merged plus one standalone) and existing preserve_order/strict gates pass. Runtime65 library units/13docs and full/minimal main171/148 pass. Native14 and required ordinary SDK/cleanup6 execute with none ignored in their dedicated gates; the Native registry revision scenario exports actual computed42/44 results and original histories after unconditional registry/bridge/provider cleanup. Plain/feature workspace build/all-target tests pass3,434/3,519 cases (415/435 separately gated), with workspace Clippy, denied-warning rustdoc and nightly formatting. Fresh audit482 deps/1,378 advisories is clean; deny advisories/bans/licenses/sources and compression provenance pass. The only dependency change is a core dev-edge to existing Ciborium; no package/version, advisory/lint ignore or Docker/VM experiment is added. Evidence: `/tmp/rustack-sealed-export-gate.log`, `/tmp/rustack-sealed-all-targets.log`, `/tmp/rustack-sealed-final-{core,runtime,native,sdk,workspace,feature-workspace,format}.log`, `/tmp/rustack-sealed-{audit,deny,compression-provenance}.log`. Staged restore, actual CLI archives, crash/restore/performance qualification and final image/platform requirements remain open; the unrelated Docker checkpoint is preserved. All354 local Markdown file links in the workflow/index/archive spec check resolve.
+
+## P5 atomic library restore independent review
+
+Operations§3.2/D72 add bounded schema1 deserialization and a synchronous caller-owned preparation boundary. One exact-instance startup lease excludes business admission, charges the original registry/history pools and owns the complete replacement graph before its lease field. Actor commit moves the already compiled terminal maps once without dispatch or fallible parsing. Imported retention uses monotonic deadlines derived from one paired restore cut; closed restored records carry no live deadline, frame, parent or token capability. Main archive registration and actual process restart remain required next.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W195 | P2; independent source-profile review, `registry/snapshot/restore/validate.rs` Context::compiler | Compile every revision and check every history kind against the archive's declared profile independently of a stronger target. Regressions separately reject Lambda IR and Lambda history declared pure, then successfully restore actual pure data into the stronger target. |
+| W196 | P2; independent expiry review, `registry/snapshot/restore/validate.rs` names/expiry | Bound every finite name expiry, including name-only/expired rows, to(capturedAt,capturedAt+90days]. Exact lower/future upper violations and independent record/name expiration reject or age without resetting target retention. |
+| W197 | P2; independent history boundary review, `registry/snapshot/restore/history.rs` DetailVisitor/check_profile | Reject fields not emitted by the selected runtime or not applicable to the detail kind; bound explicit data-details and reuse FunctionArn's compiler scope/grammar. Actual StateExited assignment, direct/optimized Scheduled credentials, alias/version and malformed/foreign direct function ARN cases reject. |
+| W198 | P2; independent timestamp decode review, `registry/snapshot/decode.rs` instant | Decode required/optional instants from at most64bytes and require the exact canonical ordinary Chrono UTC serialization. Reject long fractions, a nonzero tenth digit, noncanonical precision/offset and leap seconds. Actual CBOR preserves nanoseconds, pre-epoch and extended positive/negative year values. |
+| W199 | P3; independent preparation ordering review, `registry/snapshot/restore/validate.rs` prepare | Reject a weaker target immediately after cheap schema/scope/profile checks and before compiling source revisions. Source compilation remains independent of stronger target support. |
+| W200 | P2; independent Task-history review, `registry/snapshot/restore/history.rs` DetailVisitor/check_profile | Require positive bounded timeout/heartbeat values; heartbeat exists only on callback scheduling and stays below explicit/default timeout. Input/output truncation flags match actual emitted projections. Real scheduled Task negatives cover zero intervals and heartbeat on ordinary invocation. |
+| W201 | P3; independent regression-proof review, `registry/snapshot/restore/tests/validation.rs` | Put assignments/credentials into the generated DTO detail types that actually support them; wrong-kind negatives alone would have passed before W197. Keep genuine direct function ARN corruption cases and real source exports. |
+| W202 | P2; qualification, `registry/snapshot.rs` Outcome | Serde's internally tagged unit variants accepted contradictory extra fields despite deny_unknown_fields. Use strict empty struct variants for RUNNING/TIMED_OUT with unchanged serialized wire shape; four action-specific contradictory-field cases now reject. |
+
+All findings are fixed and independently rechecked; final read-only source/spec/test-lifecycle review has no remaining concrete in-slice finding. Preparation/drop/foreign/saturation/closing failures release all staged metadata/history charges before reopening startup. Accepted receipt loss preserves the same actor-owned commit. Partial revision/record/name/history capacity failures permit a clean retry. Tests preserve old/current incarnations, exact source/hash/role/tag/raw input/trace and all terminal outcomes, full causal history beyond1000 API events, and nanosecond instants. Unexpected RUNNING data becomes ABORTED/Rustack.ExecutionInterrupted without a Lambda call; restored terminal records cannot become child/callback parents. Actual Native evidence preserves the invocation marker, old computed42 output and history through CBOR/prepare/commit, then proves a new physical invocation computes44. Both independent registry/bridge owners and the provider fixture are unconditionally joined before assertions, retaining files when retirement is unproven.
+
+Final qualification: `make test-workflows-snapshot-restore` passes80 new cases in each normal/preserve_order configuration with strict production Clippy. Full core906 units/309 doctests, all existing selected preserve_order/strict gates, binary-support65 units/13docs and full/minimal main171/148 pass. The actual Native gate executes15 cases and the required ordinary SDK/cleanup gate executes6 with none ignored in those dedicated runs, preserving both nine-case handler callback paths. Plain/feature-enabled workspace build/all-target tests pass3,514/3,599 cases (415/436 separately gated); both workspace Clippy and denied-warning rustdoc configurations, strict full/minimal runtime/library/fixture checks, nightly formatting and356 local document links pass. Fresh audit scans482 dependencies/1,378 advisories without vulnerabilities or unsound warnings; deny advisories/bans/licenses/sources and compression provenance pass without changed policy. There are no package/dependency/version changes or new advisory/lint exceptions. Evidence: `/tmp/rustack-restore-{gate,consumer-gates,workspace-build,workspace-test,workspace-clippy,workspace-doc,feature-build,feature-test,feature-clippy,feature-doc,security,format}.log`. Main workflow meta/data archives, process restart/crash/performance acceptance and final image/platform requirements remain open. No new Docker/VM experiment is performed; the unrelated worktree checkpoint remains preserved.
+
+## P5 main workflow archives independent review
+
+Operations§3.3/D73 consume the sealed export and atomic restore through the existing v2 named snapshot service. The move-only metadata/history split remains data-only; one bounded archive actor owns CPU preparation, physical IO and the exact accepted registry receipt. Main retains named lease acquisition and one load/save transaction above observation deadlines, imports before binding, and joins archive work before registry/provider destruction. Failed startup cannot publish its partially imported graph.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W203 | P2; archive budget/recovery review, `snapshot/archive.rs` read_archive_limited and `snapshot/policy_tests.rs` | Separate actual CBOR payload, uncompressed framing and compressed-file allowances. An incompressible exact-limit payload round-trips although compressed bytes exceed payload bytes. Classify configured limits separately from corruption, so reduced policy refuses startup without rolling back or deleting either generation. |
+| W204 | P2; startup ownership review, `snapshot/lease.rs` LeaseAcquisition | Keep the exact blocking acquisition join above startup observation. Timeout/drop retains that operation and its late acquired OS lease; final cleanup resumes it, and unresolved destruction quarantines it until process exit. Controlled acquisition tests prove competing ownership remains excluded. |
+| W205 | P2; archive IO deadline review, `snapshot/workflows/owner.rs` | Join an already-ready physical IO result, then check the fresh absolute clock before preparation, mutation or successful reply. Expired/dropped observers keep the same IO task; release tests prove no preparation or commit follows expired IO. |
+| W206 | P2; filesystem boundary review, `snapshot/archive.rs` read_file_bounded_owned | Reject nonregular files before opening, use Unix nonblocking/no-follow flags, then require regular post-open metadata. Actual no-writer FIFO and regular-to-FIFO/symlink swap regressions join the exact task without reading a substituted private file. |
+| W207 | P3; worker diagnostic review, `snapshot/worker.rs` | Retain the typed JoinError behind an explicit accessor with classified Display/Debug and no raw panic source chain. Actual CPU/IO panic and cancellation cases preserve typed inspection without exposing private panic text. |
+| W208 | P2; startup clock review, `snapshot/session.rs`, `snapshot/task.rs`, `main.rs` bind_before_deadline | Cache completed load/lease/transaction outcomes but reject a first late observation using a fresh clock fence; check before and after listener binding. Ready futures cannot bypass the expired startup observation budget. |
+| W209 | P3; SDK fixture ownership review, `tests/workflows_sdk/persistence.rs` Collector | Clear a completed collector join before propagating its inner error, retain it when only the observer expires, and make close repeatable. Malformed-token and early-EOF regressions exercise token failure followed by repeated cleanup. |
+| W210 | P2; recovery/domain validation review, `snapshot.rs` recover_snapshot/retire_previous | Physical envelope validity selects current but does not justify deleting its previous completed backup. Retire only after every enabled service imports successfully, or a subsequent prepared generation validates and syncs before publication. Actual profile/hash/scope rejection preserves both generations byte-for-byte with no partial workflow publication; a new valid startup then imports current and retires previous. |
+
+All eight findings are fixed and independently rechecked; final read-only production/ownership/spec review has no remaining concrete in-slice finding. No Docker/VM experiment or dependency-policy relaxation is part of this slice. The only dependency edge is the Unix CLI's reuse of the already resolved nix cohort; no package/version changes.
+
+Final qualification: `make test-workflows-persistence` passes7 split/join cases,143 full/142 minimal snapshot cases, the normal collector cleanup regression and actual strict-auth named Native restart acceptance. Full core913 unit cases/313 doctests (312 merged plus one standalone), binary-support65 units/13docs and full/minimal main204/181 pass with the retained strict boundary targets. Actual Native15 and the required SDK/cleanup7 execute with none ignored in their dedicated runs, including both nine-case handler SDK paths. Plain/feature workspace build/all-target tests pass3,535/3,640 cases (415/437 separately gated); workspace Clippy, denied-warning rustdoc, nightly formatting and358 local document links pass. Fresh audit scans482 dependencies/1,378 advisories without vulnerabilities; deny advisories/bans/licenses/sources and codec provenance pass without policy changes. Earlier edit-time semicolon and fixture-function-length lint failures are superseded by these successful final checks; no suppression was added. The existing synchronous advisory-lock waiver moved from snapshot.rs into snapshot/lease.rs without widening its responsibility. Evidence: `/tmp/rustack-main-archive-{gate,collector,runtime-gates,workspace-build,workspace-test,workspace-clippy,workspace-doc,feature-build,feature-test,feature-clippy,feature-doc,security,format}.log`. Performance/consuming-project/IaC and final image/platform release requirements remain open. The unrelated Docker checkpoint is preserved and unstaged.
+
+## P5 pure workload and responsiveness independent review
+
+Verification§5.1/D74 use the actual strict-auth binary and ordinary signed Rust SDK for100 complete50-state executions, history exhaustion under health probes, and100 observed-live-loop/Stop cycles with one open execution slot. A separate fixture profile preserves normal semantic quotas. Reports contain the actual capability limits, raw ordered samples, nearest-rank summaries and host metadata, and publish only after joined server cleanup proves zero Native processes. Current-host evidence is explicitly not the required Linux reference or image/platform qualification.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W211 | P2; independent exhaustion deadline review, `performance.rs` Measurement::check and `process.rs` Server::readiness | Apply a fresh post-observation2s fence to readiness and recheck the exhaustion tracker's maximum before success. Normal exact-boundary/above-bound controls and a paused ready-at-expired-deadline control reject late observations. |
+| W212 | P3; independent causal history review, `performance/latency.rs` validate_history | Require102 exact events: first Start,50 correctly named/typed Entered/Exited pairs and final Success, IDs1..102 and previousEventId=id-1. Independent complete history controls plus predecessor/missing-exit/wrong-exit-kind/wrong-name/first/last mutations reject before reporting a valid workload. |
+| W213 | P2; independent live-load evidence review, `performance/load.rs` ExhaustionProbes/exhaust | Count a health probe as live only when SDK RUNNING observations bracket that same request. Require at least one and report total/live probes separately. Already-terminal and RUNNING→terminal-only normal controls reject;100 Stop cycles also prove live history/Running before health and require ABORTED after Stop. |
+
+All three findings are fixed and independently rechecked; final read-only source/spec/control review has no remaining concrete in-slice finding. The new performance and touched process modules strengthen hostile-input Clippy warnings without suppressions. Whole-target denied-warning/pedantic checks retain existing semantic fixture coverage; a diagnostic global indexing selection exposed unchanged semantic JSON indexing, so final boundary checks use scoped warnings rather than rewriting those unrelated fixtures. A diagnostic invocation without --no-deps elevated unchanged generated dependency documentation lints; the retained strict target scopes those extra lints to first-party code, alongside normal full-workspace Clippy. No dependency/version, advisory policy or lint waiver changes.
+
+Final qualification: dedicated gate6 normal controls+2 actual workloads and strict scoped/whole-target lint checks pass. Both real workloads also execute in the required actual SDK gate, now9 passed/0ignored; the existing15 Native cases, core913 units/313docs, runtime65 units/13docs and full/minimal main204/181 remain green. Plain/feature workspace build/all-target tests pass3,535/3,646 cases (415/439 separately gated), with both workspace Clippy and denied-warning rustdoc configurations, nightly formatting and fresh audit/deny/codec provenance. Audit scans482 dependencies/1,378 advisories without vulnerabilities; no dependency or policy changes. The final standalone capture has pure50-state p95=10508µs (budget100000), health/Stop maxima283/1102µs and137 causally live exhaustion probes; exact raw reports, independent rank cross-checks and source/binary fingerprints are preserved in the [measurement review](../docs/research/workflows-native-performance-review.md). Evidence: `/tmp/rustack-performance-{gate,runtime-gates,workspace-build,workspace-test,workspace-clippy,workspace-doc,feature-build,feature-test,feature-clippy,feature-doc,security,format}.log`. Initial SDK shape/closure/future-size and diagnostic lint-scope failures are superseded by the final successful checks. Required Linux reference, exact release manifest, user-facing documentation reconciliation, IaC and final image/platform acceptance remain open; preserve the unrelated Docker checkpoint.
+
+## P5 exact native inventory and operator guide independent review
+
+Verification§3.1/D75 freezes26 exact resource tests across Native bridge15, registered SDK10 and typed HTTP SDK1. Strict bounded manifest and same-feature compiled ignored-test inventories must agree before resource execution. The serial native verifier composes implemented native/current-host gates and explicitly excludes final release certification. The owned pure smoke consumes the exact checked-in YAML/ASL with strict authentication, exercises both success/Fail branches and joins zero-Native process cleanup. The English guide reflects actual feature selection, supported profile, snapshots and unfinished image/reference/IaC qualification.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W214 | P3; independent automation review, Make test-workflows-manifest | Isolated Python -I ignores PYTHON* environment settings, including PYTHONDONTWRITEBYTECODE. Pass explicit -I -B to both parser tests and preflight CLI. Normal controls and actual26-case/renamed-case runs leave no bytecode in the source tree. |
+| W215 | P2; source-fidelity qualification, `workflows_sdk/documented.rs` exercise | Do not parse the documented ASL into Value and reserialize before submission: that could mask duplicate-key drift and normalize source bytes. Send the exact include_str bytes to Validate/Create and require exact Describe readback, then verify both complete typed/name/causal branch histories. |
+
+Both findings are fixed and independently rechecked; final source/gate/fixture/doc review has no remaining concrete in-slice finding. Parser controls cover exact agreement, missing/extra/renamed/no-longer-ignored cases, schema/profile/scope/unknown/duplicate fields and suite IDs, name/count/byte bounds, UTF encoding, summary ambiguity and nonregular/symlink/FIFO inputs. The actual preflight CLI also rejects a renamed compiled case. Manifest data never becomes shell commands. Pure/native fixture ownership is a closed enum; pure mode neither loads nor exposes a bootstrap and inherited Native/performance behavior remains covered by the full gates. No new dependency, policy exception, Docker or VM experiment is introduced.
+
+Final qualification: verify-workflows-native completes the actual serial composition, including model/codegen regeneration/strict checks, HTTP unit/docs and signed boto3 transport, core913 units/313docs with preserve_order/strict, runtime65 units/13docs, full/minimal main204/181, Native15 and SDK10. Dedicated snapshot143/142, persistence actual restart and performance6controls/2workloads pass. Python parser6 tests plus actual preflight CLI positive/renamed-case controls verify26 exact resource cases; current bytecode-file checks are clean. Plain/feature workspace build/all-target tests pass3,535/3,646 cases (415/440 separately gated), with normal/strict Clippy, denied-warning rustdoc, nightly formatting and409 relevant local document links. Fresh audit scans482 dependencies/1,378 advisories without vulnerabilities; deny and codec provenance pass without changes. The refined raw-source smoke and SDK target pedantic check pass on final source. Evidence: `/tmp/rustack-qualification-{native-gate,manifest-smoke,parser,clippy,workspace-build,workspace-test,workspace-clippy,workspace-doc,feature-build,feature-test,feature-clippy,feature-doc,security,format}.log`. The only initial Rust lint was a redundant test closure, fixed without suppression. Native-only qualification does not close required image startup/ZIP, handler SDK networking, Pulumi lifecycle, Linux reference, platform lanes or the final M0–M4 release command/manifest. The original deferred Docker checkpoint remains preserved and unstaged.
+
+## P1 durable private image-pin recovery independent review
+
+Runtime§2.13/D39 resumes the preserved Docker prerequisite after the user-prioritized workflow/Native functional, persistence and current-host qualification. Shared descriptor-relative snapshot transactions preserve the container format and pin authoritative intent before Tag. Committed state precedes lease publication/deletion; durable erase precedes reservation release. Historical aliases are recovered only after historical containers settle, without Tag replay, digest-ID cleanup or operator-source-tag removal. These low-level operations retain an explicit same-daemon caller precondition and do not publish Docker readiness.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W216 | P2; completion-proof review, `docker/lease.rs:957` persist_commit | Fixed: synchronously retain Committing before every commitment write, including acknowledgment and matching-inspection paths. A failed write cannot downgrade positive physical proof to unknown absence. The actual manager regression proves retained pin/quarantine and erase-before-capacity release; a deterministic production Worker regression joins a failed matching-inspection write, repairs storage and requires commitment before GET404, then Clean/erased without retagging. |
+| W217 | P2; independent daemon-scope review, `docker/recovery/images.rs:28`, `ownership.rs` DirectoryLease | **Closed by runtime§4.9/D76 and the daemon-binding review below; production startup remains gated.** Persistent owner/run IDs alone did not bind a directory to the daemon that received its effects. Durably bind the directory to a validated stable daemon identity before its first mutation, and reject mismatched or unprovable historical bindings before any404-based container/image erasure. Same socket path, a reconnect or a boolean readiness flag is insufficient. Add same-daemon restart, switched-daemon, unavailable/malformed identity, missing historical binding and cancelled binding-publication tests. D76 now persists the canonical engine UUID, rejects unprovable first binding, requires exact-lease ports in both runtime owners/recovery functions and verifies each actual connection before operation issuance. The ordinary startup coordinator still must consume those components. |
+| W218 | P3; independent actual-fixture ownership review, `docker/recovery/images/tests.rs:259` RecoveryEvidence | Fixed: put the retained evidence guard above all fallible setup; include final counters, records, source identity and explicit alias absence in the saved recovery Result; always attempt joined wire shutdown after successful wire creation. Every error/panic/drop preserves and prints the root; only complete recovery plus cleanup releases it. |
+| W219 | P3; independent current-status documentation review, `rustack-workflows-90-impl-plan.md` execution summary | Fixed: replace the stale claim that P2–P5 are wholly outstanding with the actual remaining startup consumers and final M0–M4 release gates. Preserve the selected Native implementation/qualification scope without claiming full image/platform completion. |
+
+W216/W218/W219 are fixed and independently rechecked; final read-only review has no remaining concrete in-slice finding. W217 remains explicit consuming startup work. The preexisting ownership-module standard-file waiver remains confined to the same advisory-lock/descriptor boundary; factoring shared snapshot IO does not add or broaden a lint exception. No dependency/version or security-policy changes are introduced.
+
+Final qualification:40 targeted pin/owner/recovery cases and24 legacy journal/container/environment recovery cases pass. The strict six-library Lambda boundary runs1,233 unit/integration/doctest cases with20 separately gated; Lambda core is696 ordinary unit cases/3 gated and158 doctests. Each retained Docker29.5.2 cgroup-v2 daemon passes13 real cases: image recovery2, executor/provider1, environment/pool7, wire2 and historical container recovery1. Independent post-run queries show empty container and reserved private-image inventories on both. The x86_64 daemon uses QEMU emulation and supplies functional evidence only.
+
+Plain/feature-enabled workspace build/all-target tests pass3,537/3,648 with415/440 separately gated; both workspace Clippy and denied-warning rustdoc configurations, nightly formatting and strict production boundary checks pass. The complete serial verify-workflows-native passes the frozen26-resource inventory and actual Native15/SDK10/HTTP SDK1 suites, plus existing core/model/HTTP/runtime/archive/restart/performance/compression gates. Fresh audit scans482 dependencies/1,378 advisories without vulnerabilities; deny advisories/bans/licenses/sources and codec provenance pass without changed policy. Existing unused license/ignore diagnostics remain warnings. Final scoped checks cover40 pin regressions, workspace build and normal/strict Lambda Clippy/rustdoc after import-only style cleanup. Local document file-link and whitespace checks pass. No new ignored-test exemption, dependency or lint/advisory suppression is introduced.
+
+Evidence: `/tmp/rustack-image-recovery-{gate,final-boundaries,final-pins,arm64-final,amd64-final,native,workspace-build,workspace-test,workspace-clippy,workspace-doc,feature-build,feature-test,feature-clippy,feature-doc,security,format,final-build,final-clippy,final-strict,final-doc}.log`. Initial expected-error/assertion-lint/format checks and a mistyped nonexistent provenance target were corrected; the final named targets pass. Production Docker remains gated by W217, other historical effects, allowed pulls, endpoint reachability, startup/configuration and original M0–M4 image/ZIP/network/IaC/reference/platform/full-release acceptance.
+
+## P1 durable daemon binding independent review
+
+Runtime§4.9/D76 closes W217 as an executable prerequisite. The owner/engine pair is persisted before the first journaled effect; a first bind over either nonempty journal or an existing different identity fails closed. Private ports/envelopes retain the exact directory instance. Runtime constructors and both historical recovery entry points reject unbound/foreign ports. Every bound exchange verifies the canonical engine UUID and performs its operation on the same HTTP connection, with no reconnect/replay. This dependency does not grant normal CLI Docker readiness or authenticate a hostile daemon; cloned/reset installation identities remain outside the operator contract.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W220 | P1; independent identity-error origin review, `docker/connection.rs` check_identity | Fixed: wrap every identity-stage error in typed redacted IdentityCheck with retained source. An /info404 must never look like the requested inspection's404. Real-journal known-container and committed-alias regressions preserve byte-identical files/records and issue no actual operation; the actual image manager retains pins1/quarantine/a record/deletes0 until identity is repaired, then joins to pins0 and empty records. |
+| W221 | P3; independent guard-expiry fixture review, `docker/binding/tests/connection.rs` | Fixed: observe GET /info under a normal10s operation budget and bounded5s accept, then pause/advance20s. Remove the100ms pre-accept race that could expire before fixture observation. The requested mutation remains definitely unissued and the exact owner is shut down/joined. |
+
+Both findings are fixed and independently rechecked; final production/test-lifetime review reports no remaining in-slice finding. The additional in-flight observer regression proves that a retained envelope keeps OS directory exclusion after the caller and original directory drop, until joined wire shutdown. The live-pin regression observes quarantine before checking its failed empty-wait, avoiding a scheduler-speed assumption. No dependency/version, package policy or advisory/lint exception changes are introduced. The preexisting standard-file waiver remains confined to the same advisory-lock/descriptor-relative bounded worker module.
+
+Final qualification: the dedicated binding gate passes24 ordinary identity/port/connection/recovery/lifetime cases plus13 storage/transaction cases. Lambda core passes733 ordinary cases with4 separately gated and159 doctests; the strict six-library boundary totals1,271 unit/integration/doctest passes with21 separately gated. The existing40 pin/owner/recovery and24 legacy recovery regressions remain covered by full core and their dedicated gates. Actual read-only binding/reacquisition/different-daemon acceptance passes in both primary/other socket directions. Each retained Engine29.5.2 cgroup-v2 daemon separately passes13 actual bound image-recovery/executor/provider/pool/wire/container cases. Independent post-run queries find no containers or reserved private aliases. arm64 VZ and amd64/QEMU provide functional evidence; emulation does not establish native-x86 or Linux-reference performance.
+
+Plain/feature-enabled workspace build/all-target tests pass3,574/3,685 with416/441 separately gated; both workspace Clippy and denied-warning rustdoc configurations, nightly formatting and strict production boundaries pass. The full serial verify-workflows-native passes the frozen26-resource inventory with actual Native15/SDK10/HTTP SDK1, plus existing model/core/HTTP/runtime/archive/restart/performance/compression gates. Fresh audit scans482 dependencies/1,378 advisories without vulnerabilities; deny advisories/bans/licenses/sources and codec provenance pass without policy changes. Final targeted gates, workspace build, normal/strict Lambda Clippy and denied-warning rustdoc cover final import/Debug/doc style refinement. Relevant local Markdown file links and whitespace checks pass.
+
+Evidence: `/tmp/rustack-daemon-binding-{gate,final-gate,core,clippy,boundaries,final-boundaries,real-arm64,real-amd64,arm64-consumers,amd64-consumers,native,workspace-build,final-workspace-test,final-workspace-clippy,workspace-doc,feature-build,final-feature-test,final-feature-clippy,feature-doc,security,format,final-build,final-clippy,final-strict,final-doc}.log`. Initial moved fixture ownership, source-edit assertion syntax, private staging permissions, test-port lifetime and explicit-default lint failures were corrected without suppressions. The later successful checks supersede those edit-time failures. W217 is closed as the implemented binding consumer; production startup still must compose historical discovery/allowed pulls/endpoint/configuration and original M0–M4 image/ZIP/network/IaC/reference/platform/full-release acceptance.
+
+## P1 recorded namespace composition independent review
+
+Runtime§4.10/D77 composes recorded container-before-pin retirement and complete bounded observed inventories, without automatic orphan adoption or false readiness. Incomplete reports retain real untouched pin counts. Private owner queries omit limit64; full image-tag scanning avoids slash-limited reference filters. Unrecorded owned resources, current-run work, metadata limits and late observations block startup. The exclusive-producer and journal-before-effect provenance contract remains required; scans cannot certify unseen legacy mutations.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W222 | P3; independent fixture failure-path review, `recovery/namespace/tests/real.rs` Fixture::cleanup | Fixed: preserve the first typed error, attempt independent captured environments, retain function-before-relay and container-before-alias gates, and still attempt aggregate audit/source verification and outer wire shutdown. A scripted two-environment control proves first500, skipped dependent relay, independent404s, all three audit queries and source check, while retaining the original500. |
+| W223 | P2; self-review against pinned/upstream API schema, `recovery/inventory.rs` ImageTags | Fixed specification/consumer correction before completion: RepoTags is required by pinned Moby api/swagger.yaml:2230 and current upstream ImageSummary; defaulting a missing field to empty could turn incomplete metadata into an absence proof. Require the field, retain only explicit legacy null→empty compatibility, and add an actual HTTP missing-field rejection alongside the pure codec control. |
+| W224 | P3; self-qualification postcondition review, namespace verification | Fixed: independent private-image postconditions must scan the full formatted image inventory and compare prefixes client-side, not use a slash-limited reference glob. Final all-state container and full-prefix image queries on both dedicated daemons return zero; current exact source/alias retirement assertions remain independent. Earlier reference-filter-only observations are not by themselves complete prefix evidence. The postconditions JSON records exact argv, exit statuses, raw image output snapshots, SHA-256 and the explicit client prefix predicate for independent recomputation. |
+
+W222/W223 are fixed and independently rechecked; W224 is independently rechecked against the complete-prefix postcondition evidence; final production/fixture/schema review has no remaining in-slice finding. The fixture error control uses only scripted resources and proves dependency-aware continuation while preserving the first error. Required RepoTags projection ignores unrelated version-extension fields while the shared JSON preflight still validates their bounds and duplicates. No dependency/version, package policy, advisory exception or lint waiver is introduced.
+
+Final qualification: the dedicated gate passes30 namespace/fixture/actual-wire cases plus14 inventory cases, with3 real resource cases separately gated. Lambda core passes777 ordinary cases/7 gated and160 doctests (159 merged plus one standalone). The strict six-library boundary totals1,316 unit/integration/doctest passes/24 gated. Existing40 image-pin,24 container/journal/environment recovery and37 daemon-binding cases remain green. Final ordinary/feature-enabled workspace build/all-target tests pass3,618/3,729 with419/444 separately gated; workspace Clippy in both configurations, denied-warning rustdoc, nightly formatting and strict production boundaries pass.
+
+Each retained Engine29.5.2 cgroup-v2 daemon passes16 real cases: namespace3, historical image recovery2, executor/provider1, environment/pool7, wire2 and historical container recovery1. The3 namespace cases are also rerun after required-field schema tightening. They prove recorded container/pin retirement across reacquisition, preserved unrecorded owned containers and preserved unrecorded private alias until explicit fixture cleanup, and unchanged source image. Final independent all-state container and full formatted-image prefix queries, without reference globs, show no containers or reserved private aliases. arm64 VZ and amd64/QEMU supply functional evidence; emulation does not establish native-x86 or Linux-reference performance.
+
+The serial verify-workflows-native completes the frozen26-resource inventory and actual Native15/SDK10/HTTP SDK1 plus model/core/HTTP/runtime/archive/restart/performance/compression gates. That successful native run precedes the final Docker-only required-field refinement; final workspace/source gates and actual Docker namespace reruns qualify that refinement. Fresh audit scans482 dependencies/1,378 advisories without vulnerabilities; deny advisories/bans/licenses/sources and codec provenance pass without policy changes. Relevant local file-link and whitespace checks pass. No package/version, ignored-test exemption, lint waiver or advisory exception was introduced.
+
+Evidence: `/tmp/rustack-namespace-{gate,final-gate,clippy,final-clippy,boundaries,final-boundaries,arm64-final,amd64-final,arm64-schema-final,amd64-schema-final,arm64-qualified,amd64-qualified,native,final-workspace-build,final-workspace-test,final-workspace-clippy,final-workspace-doc,final-feature-build,final-feature-test,final-feature-clippy,final-feature-doc,security,format}.log` and `/tmp/rustack-namespace-postconditions.json` plus its `/tmp/rustack-namespace-post-{arm64,amd64}-{containers,images,aliases}.log` snapshots. Initial source delimiter, literal/semicolon lint and fixture encoded-target assertion failures were corrected without suppression; later successful gates supersede them. D77 completes the recorded/observed namespace dependency under the stated provenance/exclusive-producer contract, not ordinary readiness or automatic certification of unseen legacy effects. Allowed pulls, endpoint/resource/configuration startup composition, image ZIP/handler networking/IaC, required Linux reference/platform lanes and original M0–M4 full release acceptance remain open.
+
+## P1 controlled image-pull preparation independent review
+
+Runtime§2.14/D78 adds an operator-only exact registry/auth policy, separate bounded pull lane, strict incremental progress consumption and initial-root404-only preparation. Default construction remains never-pull. Progress completion is followed by full image/platform/default/unpacked/pin validation; remote cache effects remain daemon-owned and do not grant revision publication or source deletion. This is a production-startup prerequisite, not ordinary Docker readiness.
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W225 | P2; independent policy review, `crates/rustack-lambda-core/src/docker/pull.rs:27` RegistryHost | Fixed: validate DNS label endpoints and length in addition to the older image-reference parser. Reject leading/trailing hyphens and add exact-host regressions. |
+| W226 | P1; independent request-construction review, `crates/rustack-lambda-core/src/docker/connection.rs:37` exchange/prepare_request | Fixed: consuming RawRequest in the extracted builder released its binding too early. Take binding into the outer exchange scope before connect and retain it through every operation/driver-join/terminal branch. Existing abandoned-inflight exact-directory regression passes. |
+| W227 | P1; self-review during root-failure coverage, `crates/rustack-lambda-core/src/docker/mod.rs:962` Actor::drop | Fixed: abrupt root loss previously dropped JoinSet, aborting exchanges and potentially detaching HTTP drivers. Transfer accepted jobs to retained CleanupTask on the captured runtime; signal stop and join without aborting exchange futures. Owner shutdown awaits this fallback even after root failure. Abandoned-waiter/failed-root cases reacquire the exact directory only after joined settlement. |
+| W228 | P2; independent fallback-shutdown review, `crates/rustack-lambda-core/src/docker/mod.rs:819` Owner::shutdown | Fixed: persist primary root outcome before awaiting fallback cleanup. Otherwise an abandoned shutdown observer could lose Worker and a later call cache false success. A held cleanup gate plus timed-out observer proves taskNone/primaryWorker before release and repeated Worker afterward. |
+
+All four findings are fixed and independently rechecked. The independent final source review found no remaining in-slice production defect. Tests cover policy/auth bounds and redacted Debug/TRACE, tag/digest/platform/auth shapes, progress fragmentation/JSON/error/EOF bounds, four-running/eight-queued admission with independent cleanup, deadline/cancel/stop/abandoned/root-failure ownership, root-only404 triggering, no-pull present images, denied registries and invalid post-pull metadata. New Docker failures map to closed deployment InvalidImage classes without peer text. The only new dependency is a direct edge to the already resolved secrecy0.10.3 workspace cohort; no package/version, policy/advisory exception or lint waiver is added.
+
+Final qualification: `make test-lambda-pull` passes55 ordinary pull cases/1 real gated; the additional retained-primary shutdown regression is included in833 Lambda core ordinary passes/8 gated. Core doctests total165 (164 merged plus one standalone); the strict six-library boundary totals1,377 unit/integration/doctest passes/25 gated. Final ordinary/feature workspace build/all-target tests pass3,674/3,785 with420/445 separately gated. Workspace Clippy and denied-warning rustdoc pass in both configurations; nightly formatting and strict production boundary Clippy pass.
+
+Each retained Engine29.5.2 cgroup-v2 daemon passes17 real cases: pull1, namespace3, image recovery2, executor/provider1, environment/pool7, wire2 and container recovery1. The first pull preparation reports cacheMiss=true on both daemons; its actual warm endpoint repeat is separate from this missing-reference observation and does not establish missing layers or handler execution. Final requalification is correctly warm. Source refs/cache remain intentionally retained. Independent final all-state container and full --all formatted-image prefix inventories show zero containers/private aliases; exact argv/status/output SHA-256 and client prefix predicates are retained for recomputation. arm64 VZ and amd64/QEMU provide functional evidence only; emulation does not close native-x86 or Linux-reference performance.
+
+The complete serial verify-workflows-native passes its frozen26-resource inventory (actual Native15/registered SDK10/HTTP SDK1), plus model/core/HTTP/runtime/persistence/archive/performance/compression gates. Fresh audit scans482 dependencies/1,378 advisories without vulnerabilities; deny advisories/bans/licenses/sources passes with unchanged unused-policy warnings. Relevant400 local file links and whitespace checks pass.
+
+Evidence: `/tmp/rustack-pull-{gate,final-gate,core,clippy,boundaries,final-boundaries,arm64,amd64,arm64-final-qualified,amd64-final-qualified,native,final-workspace-build,final-workspace-test,final-workspace-clippy,final-workspace-doc,final-feature-build,final-feature-test,final-feature-clippy,final-feature-doc,audit,deny,format}.log`, `/tmp/rustack-pull-reference.json` and `/tmp/rustack-pull-postconditions.json` with `/tmp/rustack-pull-post-{arm64,amd64}-{containers,images,aliases}.log`. Earlier compile/import/lint/test-borrow failures were fixed without suppression; initial full consumer Make invocations lacked the installed buildx plugin path and were rerun successfully with WORKFLOWS_IMAGE_BUILDER=/opt/homebrew/bin/docker-buildx. Successful final gates supersede those edit/environment failures. D78 completes controlled pull preparation, not YAML/auth-file/ordinary startup activation or original image ZIP/handler networking/IaC/reference/platform/full M0–M4 acceptance.
+
+## P1 Docker settings and private YAML credential review
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W229 | P2; independent D79 design review, operations§1.8 credential-file trust | Fixed specification scope: POSIX mode/UID checks do not evaluate macOS/extended ACL confidentiality. Make operator-controlled ACLs that grant no untrusted credential read/write or ancestor replacement an explicit filesystem precondition, consistent with existing directory ownership. Loader diagnostics/documentation must not claim mode0600 proves ACL safety. |
+| W230 | P2; independent constructor review, `crates/rustack-lambda-core/src/docker/config/auth.rs:132` read_owned | Fixed: reject an empty/over32 caller-supplied approved list before collecting a second BTreeSet; only then check canonical duplicates. Also reject over32 registry CSV records before collecting domain values. Invalid sets fail before worker admission/IO. |
+
+Both W229/W230 are fixed and independently rechecked; final source/test review has no remaining in-slice finding. Settings enforce exact decimal CPU and reject raw endpoint authority/whitespace/path normalization ambiguities. File readers enforce no-follow descriptor traversal, typed/stable metadata, bounded zeroizing input and a fixed quoted YAML schema. Primary worker/ready-result permits remain charged through physical read completion and observation; a blocked pool proves oversized inputs reject before admission. The generated settings builder is private and has a compile-fail doc. File/registry Debug/errors remain redacted, and configuration/credential paths are never serialized into snapshots.
+
+The real fixture now loads only its own0600 empty auth map through shared ValidatedSettings→DockerRuntimeSettings→retained loader and consumes that anonymous policy in the existing actual preparation/pull/pin/cleanup path. Both retained arm64 VZ and amd64/QEMU daemons pass with cacheMiss=false; this is warm public-source qualification. Scripted bound-wire preparation separately verifies nonempty selected credentials and post-pull validation failure with no published pin. Neither test claims successful remote private-registry authentication, Node handler execution from the pulled base image or ordinary CLI readiness. Final complete all-state container and full --all formatted-image-prefix observations show zero containers/private aliases on both daemons, with exact command/status/hash/predicate provenance retained.
+
+No new resolved package/version is introduced. Production adds direct consumer edges to existing url/yaml-rust2 and tests add existing proptest1.12.0; current parser releases were checked, and the chosen0.11.1 cohort already contains the short-document loop fix. No advisory exception, policy change or lint waiver is added. Main startup must still construct/activate these settings together with durable provenance/reconciliation, pinned relay, resource/network/endpoint proofs, provider lifetime and capabilities; ordinary Docker selection remains explicitly unavailable until that consumer lands.
+
+
+Final source qualification: `make test-lambda-docker-settings` passes84 new cases (82 Lambda settings/file cases plus2 shared YAML/budget cases). Lambda core passes915 ordinary/8 gated plus178 doctests (176 merged and2 standalone, including private-builder compile-fail). Strict six-library boundaries pass1,474 unit/integration/doctest cases/25 gated. Ordinary/feature workspace build/all-target tests pass3,758/3,869 with420/445 separately gated; Clippy and denied-warning rustdoc pass in both configurations. Nightly fmt and fresh audit482 dependencies/1,378 advisories pass; deny advisories/bans/licenses/sources passes with unchanged unused-policy warnings. The complete serial native-workflow-only verifier passes its frozen26 resource cases (Native15, registered SDK10, typed HTTP SDK1), plus model/core/HTTP/runtime/persistence/archive/performance/compression gates. Final404 local-file links and whitespace checks pass; independent final evidence/docs recheck finds no remaining in-slice finding.
+
+Evidence: `/tmp/rustack-docker-settings-{check,core,gate,final-gate,clippy,boundaries,workspace-build,workspace-test,workspace-clippy,workspace-doc,feature-build,feature-test,feature-clippy,feature-doc,arm64,amd64,native,audit,deny,format}.log`; `/tmp/rustack-docker-settings-postconditions.json` and `/tmp/rustack-docker-settings-post-{arm64,amd64}-{containers,images,aliases}.log`. Initial dev-dependency/import/property-macro/lint failures were corrected without suppressions. Current successful focused/full/strict/actual/source checks supersede those edit-time failures; no observed-running job is restarted solely on an observation timeout.
+
+
+## P1 container-origin endpoint proof review
+
+| ID | Priority / source | Resolution / required evidence |
+|---|---|---|
+| W231 | P3; independent D80 specification review, runtime§7 dependency contract | Fixed: retire the stale TLS-unavailable sentence; distinguish Unix-only Docker management from the new endpoint HTTP(S) client using explicit aws-lc/webpki trust. |
+| W232 | P2; independent D80 source review, main.rs gateway instance generation | Fixed: synchronous OS entropy can block and must not run inside async startup. Document the synchronous constructor and use bounded retained generate_owned before provider construction, with one shared startup deadline, physical/ready-result permits and no late identity publication. |
+| W233 | P3; self-review of terminal-driver evidence, runtime probe/endpoint.rs exchange | Fixed: on successful bounded body validation, drop the sender and await the same inline without_shutdown driver under the same outer deadline. Avoid both discarding a late driver outcome and half-closing an already-disconnected socket. Error/cancel still drop locally owned futures/IO without a detached task. |
+| W234 | P3; independent D80 final source review, tests/docker_endpoint.rs abandoned observation | Fixed: save the peer observation/assertion result, always abort and await the exact spawned probe caller, then propagate the observation failure. Failed preconditions must not detach the test caller before retained fixture cleanup. |
+
+
+W231–W234 are fixed and independently rechecked; final source/fixture review has no remaining in-slice finding. The optional gateway route returns independently installed correlation data and preserves normal business admission. Shared endpoint/identity/schema constructors reject ambiguous raw inputs. The actual runtime issues one fixed GET without sending the expected instance, validates a bounded independent response, uses explicit AWS-LC/WebPKI TLS and retains no detached HTTP driver. Success joins the same driver; cancel/error drop owned IO. Async startup entropy is read-only bounded blocking work, with physical/result permits and no late publication. The private core receipt requires actual matching resource evidence, exact report identity/attempt/architecture, joined environment retirement and a final live/deadline fence. It is not serialized readiness.
+
+The actual fixture tests matching identity, wrong instance, an unavailable listener and observer abandonment after the outbound request was consumed. It saves observation failures before unconditionally aborting/joining the exact spawned caller, always attempts environment/image/wire/peer cleanup, checks preserved source identity and retains evidence on failure. These cases use a controlled diagnostic protocol peer on an explicitly provisioned owned bridge, not the ordinary main Docker startup path. Separate socket tests exercise the real GatewayService route under disabled, draining, saturated, health-only, HEAD and method conditions, including the no-Lambda build. Production startup receipt consumption, provider/listener/shutdown integration and ordinary image/handler SDK acceptance remain required; Docker selection remains unavailable.
+
+Dependency qualification reuses stable rustls0.23.46/WebPKI1.0.11 and existing url/getrandom, updates the shared tokio-rustls compatible patch0.26.5→0.26.6, and adds dev-only rcgen0.14.10 with AWS-LC for ephemeral test certificates. No committed key, private-CA production bypass, ambient proxy/root lookup, new advisory exception or lint waiver. Fresh audit scans495 locked dependencies/1,380 advisories without vulnerabilities; deny advisories/bans/licenses/sources passes with unchanged unused-policy warnings.
+
+
+Final host-source qualification:55 new ordinary regressions are covered by the76-case endpoint target (including21 retained probe cases), plus2 no-Lambda route cases. Lambda runtime passes183 ordinary cases/62 doctests; Lambda core924 ordinary/8 gated plus183 doctests (180 merged and3 standalone). Strict six-library boundaries pass1,540 unit/integration/doctest cases/29 gated. Ordinary/feature workspace build/all-target tests pass3,813/3,924 with424/449 separately gated; both workspace Clippy and denied-warning rustdoc configurations pass, as do nightly fmt and final actual-fixture Clippy. The complete serial Native verifier terminates successfully with2,979 aggregate passes/19 gated and frozen26 resource cases (actual Native15, registered SDK10, HTTP SDK1), plus archive/restart/performance/compression and existing model/core/runtime checks. Independent final docs review verifies the counts and scope. Final actual-daemon postconditions are recorded below after every retained consumer/fixture owner joins.
+
+
+Both retained daemons complete23 actual consumer cases each (endpoint4, kernel/resource2, warm file-loaded public pull1, namespace3, image recovery2, executor1, pool7, wire2, container recovery1). After W234's fixture fix, all four endpoint cases pass again on each daemon against the same final source. The arm64 VZ lane is native functional evidence; amd64/QEMU is emulated functional evidence only. Exact captured bridge IDs, names and owner labels are rechecked with empty attachments after all consumers join, then only those IDs are removed. Independent complete all-state container and all-image-prefix observations show zero containers/private aliases on both daemons. Operator source images/cache are intentionally retained. The postcondition records retain exact argv/status/raw-output hashes, predicates and raw log paths; no global prune or source removal occurs.
+
+Evidence: `/tmp/rustack-endpoint-{focused-final,minimal-gateway-final,minimal-clippy,final-build,final-tests,final-feature-build,final-feature-tests,final-plain-clippy,final-clippy,final-plain-docs,final-docs,final-fmt,boundaries-final,native-final,final-arm64,final-amd64,reviewed-arm64,reviewed-amd64,reviewed-actual-clippy,audit,deny}.log`; `/tmp/rustack-endpoint-networks.json`, `/tmp/rustack-endpoint-postconditions.json` and `/tmp/rustack-endpoint-post-{arm64,amd64}-{network-inspect,network-remove,networks,containers,images,aliases}.log`. Edit-time unused imports/style/type inference and the no-Lambda unused-self lint were fixed without suppressions; successful final checks supersede those failures. Independent source/docs/evidence review has no remaining in-slice finding. D80 closes this endpoint dependency, not production startup activation or the original image ZIP/ordinary handler SDK networking/IaC/reference/platform/full M0–M4 acceptance.
+
+
+## P1 production Docker startup review
+
+D81 consumes runtime§4.12/operations§1.10 in the ordinary executable. Qualification is one attempt owned outside the provider: journal-generation provenance and exact daemon recovery precede new producers; live relay/network/resource/optional endpoint receipts precede installation. One listener serves bounded diagnostics during qualification and snapshot validation, then opens business ingress. Platform selection, init timeout, provider health and fallible ordered shutdown use the same retained runtime graph. Legacy identities are preserved/refused, ZIP and metadata-only Image archives fail explicitly before import/backup retirement, and source tags cannot stand in for restored immutable leases.
+
+| ID | Priority / source | Resolution / regression |
+|---|---|---|
+| W235 | P2; independent lifecycle review, `docker/ownership.rs:622`, `docker/startup/qualify.rs:76` | Retain the exact Queued/Running/Consumed directory acquisition and pending wire JoinHandle before awaiting; timeout/cancel cannot lose the physical outcome. Held blocking acquisition, canceled inventory and held daemon version regressions join the original operation. |
+| W236 | P2; independent shutdown review, `docker/startup/qualify.rs:329` | Separate sticky first error from physical settlement. Joined/empty executor/environment/image stages permit safe downstream cleanup even after a Worker fault, while final shutdown retains Err. An aborted environment root regression still drains images/wire. |
+| W237 | P2; independent join review, `docker/ownership.rs:671`, `docker/startup/qualify.rs:312` | Consume terminal JoinError before returning, never polling a completed handle twice. Acquisition and connect panic regressions exercise the repeated cleanup observer. |
+| W238 | P2; independent cancellation review, `apps/rustack/src/lambda_docker.rs:37` | Retain the diagnostic actor's cached exact join and captured-runtime reaper; no outer timeout may cancel its drain. Actor failure propagates; children are aborted/joined, bounded held headers time out, observer abort closes the connection while preserving the single listener. |
+| W239 | P2; independent archive review, `crates/rustack-lambda-core/src/provider.rs:539` | Validate Docker ZIP/Image archives before FunctionStore import and previous-generation retirement. Actual Image save/restart rejection preserves byte fingerprints of both generations. |
+| W240 | P2; independent startup error-path review, `apps/rustack/src/main.rs:1564` | Keep bind/qualify/final installation in one saved startup result; any late installation failure invokes the same retained runtime shutdown before returning the primary error. Revoked-dependency installation is covered directly. |
+| W241 | P3; independent fixture ownership review, `apps/rustack/tests/docker_startup.rs` boto helper | Save the PID observation result and always await Runner before propagating it, including failed barrier observations. No failed precondition detaches the boto process. |
+| W242 | P2; self-review, `docker/ownership.rs:304` | Charge physical/result slots for failed completed blocking results as well as successful results, until the exact observer consumes them. A failed-ready-result regression verifies admission remains bounded. |
+| W243 | P2; observed harness race/self-review, `Makefile:1198`, `docker_startup/process.rs:127` | Isolate Docker acceptance builds and freeze a fixture-owned executable. A concurrent plain build had overwritten the shared executable with a different feature set; that failed lane is retained and cannot qualify Docker. Positive readiness additionally checks selected platform; negatives require intended-stage evidence and existing daemon binding. |
+| W244 | P3; independent final negative-evidence review, `docker_startup/process.rs` failure classifier | Distinguish typed relay preparation and endpoint qualification contexts from general daemon/resource errors. Require relay404 and endpoint-stage failures; the nonignored earlier-stage control rejects generic resource/daemon404/relay500 strings. |
+
+The full requested feature remains incomplete: custom-RIC/full L01–L09, immutable archive lease restoration, Docker ZIP, handler SDK networking/callback images, IaC/native-reference/final platform and full M0–M4 release acceptance remain consuming work. Ordinary connected acceptance uses actual same-instance gateway diagnostics, not a substitute for handler-originated SDK acceptance. amd64/QEMU evidence is emulated functional scope only.
+
+
+Final source qualification: ordinary/Step-Functions-enabled workspace build/all-target tests pass3,845/3,957, with424/455 separately gated. Both workspace Clippy/denied-warning rustdoc configurations and nightly formatting pass. The startup target passes68 selected cases (shared budget1, startup owner15, ownership50, diagnostic listener2); strict six-library boundaries pass1,581 unit/integration/doctest cases/29 gated. Lambda core passes953 ordinary/8 gated and194 doctests. Full/minimal main boundary checks, actual-fixture pedantic Clippy and the normal negative-evidence control pass. Fresh audit scans495 locked dependencies/1,380 advisories without vulnerabilities; deny advisories/bans/licenses/sources passes with unchanged unused-policy warnings. Existing nix0.31.3 feature activation and a dev-only existing SHA2 edge introduce no resolved package/version changes or policy/lint waivers.
+
+Corrected observations remain part of the evidence. The first combined arm64 lane used a shared executable overwritten by concurrent feature builds and failed three positive cases; its generic negative exits are not accepted as startup-stage proof. Isolated rebuilds/private executable copies supersede that run. An intermediate amd64 lane passed startup6/endpoint4/resource2, then actual pull returned Docker500; its retained pull evidence is `/var/folders/dp/zvkhkbns7fqcy8l3hpdtjhcr0000gn/T/.tmp1rzrrt`. That failed pull does not qualify the lane. Stage-specific negative assertions were subsequently strengthened after W244; only the final-source complete runs qualify the consuming path. No observed-running job was restarted solely because a wait timed out.
+
+Evidence: `/tmp/rustack-startup-stage-{quality,build,tests,clippy,docs,feature-build,feature-tests,feature-clippy,feature-docs,boundaries,actual-clippy,actual-control,fmt,main-strict,minimal-strict,strict,native,arm64,amd64}.log`; fresh security logs `/tmp/rustack-startup-{audit,deny}.log`. Earlier focused/qualified/final logs retain edit-time and harness/environment failures; final successful checks supersede them without erasing failed observations.
+
+
+Final actual qualification terminates successfully with29 cases on each retained daemon: ordinary startup6, endpoint4, resource2, warm file-loaded public pull1, namespace3, private-pin recovery2, actual provider/executor1, environment pool7, production wire2 and container recovery1. The final Native verifier terminates successfully with2,981 aggregate passes/19 gated and its frozen26 resource cases. All ten W235–W244 findings are fixed and independently rechecked; the final source and documentation/evidence review has no remaining in-slice finding. Broader acceptance stays explicitly open above.
+
+After both actual lanes terminate, exact full bridge ID/name/owner/empty-attachment checks permit removal of only the two captured fixture bridges. Fresh full all-state container observations are empty on both daemons; full image lists have zero reserved private aliases using explicit repository prefix predicates, with source/cache rows retained (arm64:9; amd64:6). Exact argv/status/raw-output hashes, predicates and removal/absence observations are retained in `/tmp/rustack-startup-networks.json`, `/tmp/rustack-startup-postconditions.json` and `/tmp/rustack-startup-post-{arm64,amd64}-{network-inspect,network-remove,networks,containers,images}.log` with corresponding stderr logs. No global prune/source removal occurs. The final384 changed-Markdown local file links and whitespace checks pass. D81 closes production startup composition; full custom-RIC/Image semantics, immutable archive restore, Docker ZIP and original handler-network/IaC/reference/platform/full M0–M4 gates remain required.
+
+
+## P1 independent custom RIC and immutable Image revision review
+
+D82 consumes the ordinary D81 startup/provider path with an independently implemented Rust RIC, digest-pinned Linux base and two explicit source images. The handler computes input+7, retains a process counter and exposes actual argv/cwd/request/image identity. Signed Rust SDK invokes it directly; boto3 checks inherited/cleared/replaced ImageConfig, literal shell-like argv without side effects, distinct FunctionError, controlled tag movement, old/latest/published/alias revision isolation, active cross-invocation rejection and a published A call held across Successful latest B update. Nine frozen Python semantic report IDs remain distinct from the single resource-gated Rust custom-RIC test and its additional Rust SDK/alias unwind controls. This is consuming code execution evidence, not a new startup prerequisite or full L01–L09/M0–M4 certification.
+
+| ID | Priority / source | Resolution / regression |
+|---|---|---|
+| W245 | P2; independent early evidence review, `tests/lambda-fixtures/echo-bootstrap/src/image.rs`, `custom_ric_sdk.py:83` | Replaced sleep/future-overlap inference with two causal barriers. Both functions report distinct active request IDs before learning the other's ID; both must reject foreign/malformed/stale completions before either valid response is released. The same barrier proves A remains consumed/held while B update becomes Successful. |
+| W246 | P2; independent collector lifecycle/deadline review, `custom_ric_sdk.py:44`, `custom_ric_sdk.py:111` | Install a socket deadline before HTTP parsing; cap headers/body, reject duplicate JSON fields and bound active workers. Abort wakes conditions and closes tracked sockets before joined shutdown; check deadlines on entry and ready-state return. Four controls include real quiet/partial-header shutdown, bad-token/oversized-header abort, expired ready state without mutation and actual two-stage release. |
+| W247 | P2; independent alias unwind review, `apps/rustack/tests/docker_startup/custom.rs:31`, `docker_startup.rs:271` | Retain exact CLI waiter before awaiting and hand it to the captured-runtime reaper on observer loss. Disable TempDir cleanup before alias work, restoring it only after positive alias absence, joined server and namespace audit. Actual cancel/panic-after-committed-tag controls preserve the exact source/alias record, join the old task and only then transfer authority for identity-checked cleanup. |
+| W248 | P2; self-review of record publication, `apps/rustack/tests/docker_startup/custom.rs` save | Give each alias a nonce-unique record path; cap/stage bytes in a sibling file and atomically rename so canceled writes cannot truncate the previous complete identity. Cap abandonment reads before allocation. The focused delta is independently rechecked. |
+
+All four findings are fixed and independently rechecked. Final source review, including the additional published in-flight A case, has no remaining in-slice finding. The deliberately panicking worker in successful actual logs is the required W247 negative control, whose JoinError is asserted as a panic before recovery; it is not an unhandled test failure.
+
+The custom fixture adds no package/version/dependency-edge changes; it reuses the existing bootstrap package's locked ureq2.12.1/no-default-features cohort with explicit proxy disabling, bounded HTTP and no new TLS provider. Current ureq3.5.0 APIs and official Runtime API/ImageConfig references were checked and recorded in the transport study. Preserve source caches and separately verify zero runtime-private aliases and zero fixture-source aliases; runtime-prefix-only scans cannot prove test-source cleanup. Remaining actual fault/init/exit/OOM/cancel/admission/saturation, Node, immutable Image archive restore, Docker ZIP, handler SDK/callback, IaC/native-reference/final platform and complete M0–M4 gates stay required.
+
+
+Host-source qualification: ordinary/Step-Functions-enabled workspace build/all-target tests pass3,845/3,957 with424/456 separately gated; both workspace Clippy and denied-warning rustdoc configurations pass. Strict six-library boundaries pass1,581 unit/integration/doctest cases/29 gated. The four collector controls, custom-RIC binary strict Clippy, actual SDK fixture pedantic Clippy and nightly formatting pass. The complete Native verifier terminates with2,981 aggregate passes/19 gated and its frozen26 resource cases. Fresh audit scans495 locked dependencies/1,380 advisories without vulnerabilities; deny advisories/bans/licenses/sources passes with unchanged unused-policy warnings. No new lint waiver or advisory exception is introduced.
+
+Evidence: `/tmp/rustack-custom-ric-cold-{quality,build,tests,clippy,docs,feature-build,feature-tests,feature-clippy,feature-docs,boundaries,fixture,fixture-clippy,fmt,arm64,amd64}.log`; prior complete30-case daemon cohorts `/tmp/rustack-custom-ric-final-{arm64,amd64}.log`; Native `/tmp/rustack-custom-ric-final-native.log`; security `/tmp/rustack-custom-ric-{security,audit,deny}.log`. Earlier initial/reviewed/settled runs retain the qualification sequence before atomic record publication and explicit cold-counter evidence. Unused-mut/manual-assert edit-time lint failures were fixed without suppressions. No observed-running process was restarted solely on an observation timeout.
+
+
+Both retained daemons terminate successfully with30 actual consumer cases each (startup/custom7 plus endpoint4/resource2/pull1/namespace3/pin recovery2/executor1/pool7/wire2/container recovery1). After final host-fixture atomic-publication/cold-evidence refinements, all7 ordinary startup/custom cases are rerun successfully on each daemon; the other 23 consumer sources and production runtime remain unchanged. The new custom case consumes all nine frozen Python semantic IDs, signed Rust SDK compute, cold published/latest counter1, active-ID barriers and actual committed-alias cancel/panic recovery. These are functional arm64 VZ and emulated amd64/QEMU results, not native x86/reference performance or a complete L01–L09 certificate.
+
+After every runtime/SDK/CLI owner joins, verify each captured bridge's full ID/name/owner label and empty attachments before removal. Final full all-state container observations are empty on both daemons. Full image lists separately show zero runtime-private aliases and zero normalized fixture-source aliases; all four selected relay/Python/customA/customB images remain present with distinct custom A/B IDs, plus preserved cache rows (arm64:11; amd64:8). Exact argv/status/raw-output hashes, explicit prefix predicates and bridge removal/absence are in `/tmp/rustack-custom-ric-networks.json`, `/tmp/rustack-custom-ric-postconditions.json` and `/tmp/rustack-custom-ric-post-{arm64,amd64}-{network-inspect,network-remove,networks,containers,images,fixture-sources}.log`, with corresponding stderr logs. The first observation collector used an unsupported host-Python zip keyword after arm64 bridge removal; it was corrected and resumed from the recorded successful removal/absence without deleting twice. Final collection terminates successfully. No global prune/source-image removal occurs. Independent final source/documentation/evidence review and whitespace/local-link checks cover this D82 slice; the complete goal remains M0–M4.
+
+
+## P1 real Image faults and public cancellation/admission review
+
+D83 consumes the existing ordinary service with six real user-code faults, causal initializing/busy signed client disconnects, reserved quotas, impossible memory and accepted-work saturation. It separately fixes permanent memory admission and final shutdown cleanup reserve. This slice preserves all remaining M0–M4 release requirements; it adds no dependency, advisory exception or lint waiver.
+
+| ID | Priority / source | Resolution / regression |
+|---|---|---|
+| W249 | P2; independent cancellation evidence review, `tests/workflows/lambda_fault_sdk.py:118` | Capture t0 before Invoke; observe the actual stage before 10s and physical pair removal before 15s, while init 20s/handler 900s/collector leases remain live. Natural expiry cannot qualify cancellation. |
+| W250 | P2; independent hold lifetime review, `tests/lambda-fixtures/echo-bootstrap/src/image.rs:124` | Give hold IO 240s, beyond collector 180s; require 80s remaining lease before handing 75s shutdown observation to Rust. No normal hold return may explain physical removal. |
+| W251 | P2; self-review of permanent memory head-of-line blocking, `crates/rustack-lambda-core/src/docker/environment/actor.rs:77`, `crates/rustack-lambda-core/src/docker/executor.rs:246` | Add typed MemoryLimit before count reservation and provider admission; map429. Three real library cases prove static/equal/temporary distinctions, no healthy warm eviction and subsequent fitting progress. |
+| W252 | P2; actual accepted-work shutdown observation, `apps/rustack/src/main.rs:1452` | Reserve configured Docker cleanup, capped at half the unchanged global deadline, and use the same captured reserve for ingress/work draining. Preserve Native/pure grace and exact unfinished-quiesce/nonzero outcome. Six policy values cover reserve behavior. |
+| W253 | P3; fixture execution corrections, `tests/workflows/lambda_fault_sdk.py:111` | Disable only malformed-quota client's SDK parameter validation so signed negative ranges reach server; own its client via closing(). Earlier SDK-local validation/context-manager failures are retained as failed observations. |
+| W254 | P2; actual busy cancellation recovery observation, `tests/workflows/lambda_fault_sdk.py:136` | Physical CID absence can precede retained channel/journal joins. Permit only observed allocation-free429 in bounded recovery; preserve production permit-release ordering and require a cold computed result. |
+| W255 | P2; independent final deadline review, `tests/workflows/lambda_fault_support.py:14` | Fence recovery before each attempt, after metadata and after success, including first-attempt success; bound fresh SDK connect/read by remaining time. Four controls cover expired entry, late success, timely allocation-free429 recovery and non429 propagation. |
+| W256 | P2; independent final elapsed-time review, `apps/rustack/tests/docker_startup/faults.rs:111` | Capture elapsed time immediately after server stop, before Python join, so later metadata/collector teardown cannot inflate evidence of the server's drain cutoff. Saved failures still precede unconditional Python join. |
+
+All eight findings are fixed; the final independent source recheck reports no remaining in-slice finding. The eleven fault-observer controls include causal held stages, expired/wrong stage, wrong/changed/nil daemon identity, foreign owner rows, bounded metadata and the four recovery controls. Four existing D82 collector controls remain required. Actual physical two-pair/384MiB evidence stays distinct from the retained global 32/per-function 8 library admission cases.
+
+
+Host-source qualification terminates successfully: ordinary/Step-Functions-enabled workspace build/all-target tests pass 3,849/3,961 with 424/460 separately gated; both workspace Clippy and denied-warning rustdoc profiles pass. Strict six-library boundaries pass 1,584 unit/integration/doctest cases/29 gated, including core 956 ordinary units/8 gated and 194 doctests. The focused memory gate passes 3 cases, and its `work::tests` filter passes 21 (seven work plus fourteen network cases). Eleven fault controls, four prior collector controls, strict custom RIC/actual SDK fixture Clippy, full/minimal main strict checks and nightly formatting pass. The complete Native verifier is run first and terminates with 2,983 aggregate passes/19 gated and the unchanged frozen 26 resource cases. Fresh audit scans 495 locked dependencies/1,380 advisories without vulnerabilities; deny passes with unchanged unused-policy warnings.
+
+Failed observations are retained and do not qualify final source: the first arm64 cohort passed 8/failed 3 because botocore rejected the invalid quota before the wire and the saturation fixture assumed successful draining/too little cleanup reserve; the next arm64 cohort passed 9/failed 2 because boto3 clients require closing() rather than direct context management. The intermediate amd64 cohort passed 9/failed 2 with the older immediate-recovery assumption. The focused busy run also observed429 after physical absence; retained joins correctly still owned its permit. Final bounded429 recovery and independent deadline/elapsed fences supersede those fixture assumptions without changing production permit ordering. The first oversized RIC stack buffer was reduced to 8KiB after strict Clippy, without a lint waiver. A later amd64 cohort again passed 9/failed 2: splitting the unchanged five-second recovery IO budget equally imposed a premature 2.5s read timeout on cold QEMU launches. The final distribution gives local loopback connect at most 0.1s and reads the remaining budget; both absolute deadline fences and non429 refusal stay unchanged. The deliberately panicking committed-alias control remains an asserted D82 unwind case, not an unhandled qualification failure. No observed-running owner was restarted merely because an observation wait timed out.
+
+Evidence: `/tmp/rustack-d83-standard.log`, `/tmp/rustack-d83-{boundaries,controls,fmt,native,security}-final.log`, `/tmp/rustack-d83-final-{arm64,amd64}.log`; the final IO-distribution arm64 startup/fault rerun is `/tmp/rustack-d83-io-final-arm64.log`, and the failed half-IO cohort remains `/tmp/rustack-d83-half-io-amd64.log`. The final test-only import cleanup passes three focused memory tests and all-target core Clippy in `/tmp/rustack-d83-import-check.log`. Earlier failures remain in `/tmp/rustack-fault-{first-arm64,reviewed-arm64,reviewed-amd64,busy-arm64}.log`; focused initializing/busy successes are in `/tmp/rustack-fault-{initializing,busy-final}-arm64.log`. Remaining actual allocating/cleanup/daemon-loss/pull/deployment fault injection, exact Docker manifest/target, Node, immutable image archive restore, Docker ZIP, handler SDK/callback, IaC/native-reference/platform and full M0–M4 release scope remain open.
+
+
+Final actual qualification terminates successfully with 34 cases on each retained daemon: 11 ordinary startup/custom/fault cases, 4 endpoint cases, 2 resource cases, 1 file-loaded public pull, 3 namespace cases, 2 private-pin recovery cases, 1 actual executor/provider case, 7 environment pool cases, 2 production wire cases and 1 container recovery case. After the final IO-share refinement, arm64 reruns all 11 startup/custom/fault cases successfully; its other 23 consumer sources are unchanged. The fresh amd64 run executes all 34 with final source. Each disconnect requires physical absence before 15s and timely cold recovery within the unchanged five-second recovery observer, not merely eventual success. Saturation preserves the exact unfinished-quiesce error/nonzero exit while physically retiring the two held pairs before natural expiry. Functional arm64 VZ/emulated amd64 results do not establish native-x86/reference performance or complete M0–M4 acceptance.
+
+After all owners on each daemon join, exact full bridge ID/name/owner/empty-attachment checks permit removal of only the two captured bridges. Fresh complete all-state container observations are empty on both daemons; full image lists separately contain zero runtime-private aliases and zero normalized fixture-source aliases. All four selected relay/Python/customA/customB sources remain present and distinct; complete image row counts remain 11/8 (arm64/amd64), including retained selected sources and cache. Commands/status/raw-output hashes, expected engine identities, explicit prefix predicates and bridge removal/absence are in `/tmp/rustack-fault-networks.json`, `/tmp/rustack-fault-postconditions.json` and `/tmp/rustack-fault-post-{arm64,amd64}-{engine,network-inspect,network-remove,networks,containers,images,fixture-sources}.log`, with corresponding stderr logs. No global prune or source-image removal occurs. Final independent evidence/text review applies only to this D83 slice; the full goal remains active.
+
+Final independent source/documentation/evidence review has no remaining finding. All 371 changed-Markdown local file links resolve; staged whitespace and final nightly format checks pass.
+
+
+## P1 management IO and exact Docker resource review
+
+D84 closes four ordinary SDK consuming scenarios through a transparent fixture-owned Unix proxy and real daemon: allocation acknowledgment loss during cancellation, held cleanup during cancellation, isolated image-inspection acknowledgment loss followed by full live transport loss, and two real Tag effects held across deletion/deployment saturation. The runtime fixes admission that could escape when a canceled deployment's outer observer completed while independent critical image mutation/retirement remained owned. It introduces no production injection hook, new dependency edge, lint waiver, advisory exception or daemon-wide shutdown.
+
+| ID | Priority / source | Resolution / regression |
+|---|---|---|
+| W257 | P3; independent proxy framing review, `tests/workflows/docker_io_proxy.py:35` | Reject terminated lines above 4096 before returning and check prospective complete encoded chunk/trailer limits before read/append. Controls cover exact encoded 20,477/+1 and terminated 4096/4097, in addition to ambiguous/truncated/oversized framing. |
+| W258 | P2; actual fixture handoff observation, `tests/workflows/lambda_fault_sdk.py:10`, `tests/workflows/lambda_io_fault_sdk.py` | Guard the standalone entry PID print so importing shared helpers emits no extra handshake. A direct stdout-capture regression prevents parent server shutdown before SDK work. All startup/completion PID barriers stay independently bounded and exact-child checked. |
+| W259 | P3; actual daemon protocol observation, `tests/workflows/docker_io_proxy.py:253` | A bound connection can legitimately carry identity GET/info followed by the operation GET/info. Forward both on the same backend connection; only the initial persistent identity response continues parsing. A control covers both image inspection and info as the second operation. |
+| W260 | P2; ownership review prompted by actual capacity observation and controlled Tag regression, `crates/rustack-lambda-core/src/deployment/manager.rs:512`, `crates/rustack-lambda-core/src/docker/lease.rs:632` | Share accepted deployment admission into image preparation. Deletion settles the outer logical outcome without releasing the permit retained by critical image IO/retirement. A direct outer-worker join regression proves the row can disappear while capacity stays charged until actual cleanup. Existing cancellation/deadline/drop cases now distinguish logical settlement from physical admission release. |
+| W261 | P2; independent unwind review, `crates/rustack-lambda-core/src/docker/lease.rs:564` Record | Retain preparation/deployment permits in the image actor record above the JoinSet and in emergency recovery, not only the worker stack. Existing worker/off-runtime-root panic controls now hold a rejected delete and prove both permits stay charged until positive physical recovery. A recovered failed-delete attempt may retry its exact identity; final aliases are absent. |
+| W262 | P2; independent handoff review, `crates/rustack-lambda-core/src/artifact/pinned.rs:148`, `crates/rustack-lambda-core/src/deployment.rs:492` | A shared private receipt releases admission only after ordinary prepare's validated consumed return or the exact successful image CAS. Enqueue into oneshot is not acceptance. A prepared-but-unaccepted image retains both quotas through held deletion; stale/invalid/canceled publications never acknowledge. Published live pins separately retain pin/cleanup quota. |
+| W263 | P2; independent full-loss contract review, `tests/workflows/lambda_io_fault_sdk.py:89`, ordinary server fixture | Preserve diagnostic ingress while readiness/business execution reject; do not invent a health-triggered listener shutdown or revive a failed owner. Restore the proxy for joined physical cleanup, accepting only successful server shutdown or its known Docker/quiesce error. Forced reap/unrelated failure remain errors. |
+| W264 | P2; self-review of actual saturation proof | A canceled read-only image inspection can settle without a daemon mutation, so holding that read was insufficient proof of critical preparation ownership. Hold two actual private Tag 201 acknowledgments after effects instead, independently inspect their exact owner aliases/distinct image IDs, and require deleted preparation to retain deployment capacity until those effects retire. Unused inspection-barrier code was removed. |
+
+All eight findings are fixed and independently rechecked. Two initially suspected issues were withdrawn after authoritative source review: ordinary transport EOF is not inherently a Worker panic, and invalid image validation already returns before any successful image CAS/acknowledgment. No production change is attributed to those withdrawn concerns. Framing, upgrade/half-close, exact owner/expired gate, quiet-connection abort, Tag-after-effect and selected-image acknowledgment-loss controls complement the actual cases. The existing bounded manifest/inventory decoder now has two statically selected policies; the native defaults remain unchanged. Native six/Docker four policy controls reject drift, unknown/duplicate/missing suites, scope downgrade and hostile input before resource execution.
+
+Earlier failed observations remain evidence, not qualification: both first four-case cohorts failed because imported helper PID output advanced parent teardown early. The reviewed cohorts exposed the valid double-info proxy exchange and an incorrect full-loss recovery assumption. The corrected arm64 cohort passed two/failed two, exposing premature deployment admission and a read-only barrier's inadequate critical-mutation proof. A later cohort again passed two/failed two before the consumed receipt and exact ResourceNotReady 502 assertion were installed. The targeted final handoff cohorts pass all four actual cases on both retained daemons; the complete eight-target functional gates and final host qualification are recorded below when terminal. Preserve all remaining interrupted-pull/IO-deadline, Node, image archive/ZIP, handler SDK/IaC, native-reference/platform and complete M0–M4 requirements.
+
+
+Host qualification terminates successfully: ordinary/Step-Functions-enabled workspace build/all-target tests pass 3,850/3,962 with 424/464 separately gated. Both workspace Clippy and denied-warning rustdoc profiles pass. Strict boundaries pass 1,585 unit/integration/doctest cases/29 gated, including core 957 ordinary units/8 gated and 194 doctests. The targeted 26 lease and 21 deployment-manager tests pass, including canceled outer-row join, unaccepted artifact and two worker/off-runtime-root unwind cases with held failed deletion. Complete Native qualification terminates with 2,983 aggregate passes/19 gated and the unchanged exact 26 resource inventory. Eleven proxy controls, twelve independent fault-observer controls, four D82 collector controls and ten Native/Docker manifest controls pass; both manifest policies retain their distinct scopes. Fresh audit/deny pass without new dependency edges or policy exceptions. Full/minimal main and actual SDK fixture strict checks, final formatting and text checks cover this slice.
+
+Evidence: `/tmp/rustack-d84-{standard,native,boundaries,security}.log`; focused source checks `/tmp/rustack-d84-acceptance-final.log`, `/tmp/rustack-d84-final-actual-build.log`, `/tmp/rustack-d84-import-placement.log`; fixture/inventory checks `/tmp/rustack-d84-{fixtures-final,manifest-final,proxy-controls-final,manifest-controls}.log`. Final complete functional resources run through `make test-lambda-docker` and log `/tmp/rustack-d84-final-{arm64,amd64}.log`; focused four-case successes are `/tmp/rustack-d84-handoff-{arm64,amd64}.log`. Earlier first/reviewed/fixed/guard/diagnostic and failed acceptance logs retain the causal debugging sequence without qualifying final source. An initial manifest CLI observation used Python isolated mode, which omits the script directory needed for its explicit sibling decoder import; the Make entry uses the trusted repository script path while control discovery remains isolated. No observed-running owner was restarted merely on an observation timeout.
+
+
+Final qualification through the unified entrypoint terminates successfully on both retained daemons: all eight inventories match and all 44 distinct resources execute without ignored skips (startup15, core8, environment7, executor1, endpoint4, probe2, wire2, relay5). The core suite includes reciprocal persisted daemon binding; selected/other sockets are explicit on both lanes. These functional arm64 VZ and emulated amd64/QEMU results remain distinct from native-x86/reference performance and full M0–M4 acceptance.
+
+Only after all owners on each daemon join, inspect each captured bridge's full ID/name/owner/empty attachments and remove exactly that ID. Fresh complete all-state observations show zero containers and zero runtime-private/fixture-source aliases on both daemons. All four selected source images remain present/distinct, with complete image row counts11/8 including cache. Exact command/status/output hashes, expected engine identities, explicit prefix predicates and bridge removal/absence are retained in `/tmp/rustack-io-networks.json`, `/tmp/rustack-io-postconditions.json` and `/tmp/rustack-io-post-{arm64,amd64}-{engine,network-inspect,network-remove,networks,containers,images,fixture-sources}.log` plus corresponding stderr logs. No global prune/source removal occurs. The initial read-only held-IO observation was a lead, not proof of a critical-mutation quota defect; the controlled Tag regression and owner-lifetime review establish that fix. Final full-goal scope remains unchanged.
+
+Final independent source/documentation/evidence recheck reports no remaining finding. All 355 changed-Markdown local file links resolve; final nightly formatting and staged whitespace checks pass.
+
+
+## P1 real IO expiration, interrupted pull and negative artifact review
+
+D85 consumes [runtime§4.15](./rustack-workflows-20-lambda-runtime-design.md#415-real-io-expiration-interrupted-pulls-and-incompatible-artifacts-d85) and the [D85 verification contract](./rustack-workflows-70-verification-plan.md#io-expiration-interrupted-pulls-and-negative-images-d85). The deliverable is four additional ordinary-server resources and their actual production failure provenance, not complete M0 or M0–M4 release. No runtime injection hook, fabricated daemon metadata, new dependency or policy/lint waiver is introduced.
+
+| Finding | Severity / source | Resolution |
+|---|---|---|
+| W265 | P2; independent stream-success review, `tests/workflows/docker_io_proxy.py`, Progress.feed | Reject the presence of either error/errorDetail field, including empty/null values. Controls require no successful stream proof for falsey errors, duplicate fields, missing/truncated JSON, absent chunk termination or oversized/count-exhausting progress. A two-stage backend remains live after the front peer closes, then positively completes before cleanup authority is available. |
+| W266 | P2; independent artifact evidence review, `apps/rustack/tests/docker_startup/io_faults.rs`, negative handoff | Inspect exact captured IDs through the actual daemon, require promised OS/architecture, positive sizes and distinct IDs, and save the preconditions before SDK dispatch. Require InvalidImage and no function allocation for incompatible artifacts; separately observe the protocol-free Linux process Running before its typed bootstrap deadline. |
+| W267 | P2; actual Engine1.53 negative execution, `crates/rustack-lambda-core/src/docker/image.rs`, resolve_captured | A captured image's platform-qualified404 was exposed as ImageDeleted. Translate only that direct selected-platform404 to invalid metadata/InvalidImage. Preserve initial reference404, wrapped connection-identity404 and selected-platform500; four wire regressions, the retained ifMissing/no-pull preparation regression and public real negative resources cover provenance without matching daemon error text. |
+| W268 | P3; actual fixture execution, `process.rs` and `lambda_io_fault_sdk.py` | Canonicalize the private0600 auth path before launch because macOS /var is a symlink. Retire each successfully recovered warm pair through its real exit42 before the next negative artifact's zero-allocation observation; function deletion does not promise immediate warm eviction. Preserve prior failed observations. |
+| W269 | P2; final fixture dependency audit, `Makefile`, ordinary startup prerequisite | A fresh daemon cannot depend on Node cache from the later core pull suite. Explicitly provision/preserve the immutable baseline through a selected-platform, explicit-daemon argv command bounded to120s, before ordinary resources. Reject invalid platforms/mutable references before CLI effects. Actual warm provisioning passes on both daemons; no preexisting source is deleted to simulate a cold baseline. |
+| W270 | P2; independent provisioning review, `Makefile`, lambda-pull-fixture-image | Do not use an optimizable Python assert for a pre-network input gate. Use isolated `python3 -I -B` and explicit nonzero exit. With PYTHONOPTIMIZE=1 and untrusted PYTHONPATH, invalid architecture, mutable reference and foreign registry still reject before the deliberately invalid CLI path can execute. Actual approved warm provisioning passes on both daemons. |
+
+Independent read-only review rechecked W265/W266 and the complete cleanup/manifest wiring, then separately reviewed W267 and its root/identity/other-status tests with no remaining in-slice finding. Final post-read/terminal/publication deadline fences and W269 prerequisite ordering are independently checked as well. The bounded typed completion receipt must match the retained source-reference intent and expected image ID; actual identity inspection precedes reference removal. Preexisting or uncertain references are preserved, and the parent keeps the proxy alive through joined server cleanup on semantic failure as well as success.
+
+Earlier failed observations are not qualification: the first arm64 eight-case cohort passed6/failed2 at the noncanonical auth path and incorrect warm-eviction assumption. The subsequent focused pull/negative cases passed, before the strengthened public InvalidImage assertion exposed W267 in the full gate. An existing preparation regression initially asserted the prior direct404 error; its expected error now follows the deliberately corrected contract while continuing to prove no images/create is issued. An exploratory strict lint command aimed at the entire integration-test target reported preexisting serde_json indexing and deliberate panic-control assertions; authoritative production-library strict gates and ordinary/pedantic fixture checks are kept separate without waivers.
+
+The final arm64 unified gate passes all48 distinct Docker resources, plus the pure cleanup-receipt control; the stricter final progress parser also passes a separate actual pull rerun. Final ordinary/feature workspace build and all-target tests pass3,854/3,967 (424/468 separately gated), workspace Clippy in both profiles, nightly formatting and denied-warning rustdoc. The production boundary target passes1,589 unit/integration/doc cases with29 separately gated, and the complete Native verifier passes2,983 aggregate cases/19 separately gated with its frozen26-resource contract. Fresh audit scans495 dependencies/1,380 advisories cleanly; deny advisories/bans/licenses/sources pass with unchanged policy diagnostics. Both retained daemon gates now join successfully with all48 distinct resources, plus the pure receipt control. Final source requalification passes all8 management-IO resources on each daemon (43.73s arm64 VZ;216.81s emulated amd64/QEMU). These are functional lanes; native x86/reference performance is not implied. The existing source-tag panic is a deliberate D82 abandonment control whose JoinError is asserted and recovered, not an unhandled failure. The newly loaded negative images are explicit selected fixture caches and remain preserved with runtime/handler/custom sources. Node execution, immutable Image archive restore, Docker ZIP, handler SDK/callback images, IaC/native reference/final platforms and complete release remain required.
+
+
+### M0 exit audit after D85
+
+Independent read-only mapping confirms actual computation/warm reuse (L01), official Python plus custom Rust RIC (M0 part ofL02), full ImageConfig including empty arrays/literal argv (L03), immutable/published/alias/in-flight revisions (L04), concurrent foreign/malformed-ID/stale completion isolation (L06), allocating/init/busy/cleanup cancellation and deadlines (L07), and unavailable/missing/pull/deployment-pressure failures (L08). D85 final job/postcondition evidence is recorded below; it does not fill the two distinctions that follow. Node execution is a later M4 requirement, not a newly invented M0 blocker.
+
+Two original M0 requirements need consuming evidence after D85, before M0 can close:
+
+| Audit gap | Current source/evidence | Required next action |
+|---|---|---|
+| M0-L05; P2 qualification gap | `tests/lambda-fixtures/echo-bootstrap/src/image.rs:77` rejects actual malformed request IDs, but broader malformed method/header/body/trailer controls are shared Runtime HTTP tests (`crates/rustack-lambda-runtime/src/http/tests.rs`). ID rejection is not hostile HTTP framing qualification. | Add a bounded actual custom-RIC malformed-framing resource through ordinary startup. Require explicit rejection, unchanged active attempt, subsequent correct computation and physical cleanup. |
+| M0-L09; P2 qualification gap | `tests/workflows/lambda_fault_sdk.py` qualifies reserved0/1, accepted128/129 and impossible memory; `lambda_fault_support.py` verifies two pairs totaling384MiB. `process.rs` simultaneously sets two environments/384MiB, so existing capacity pressure does not independently isolate memory and environment ceilings. Active global32/default-per-function8 currently have controlled ProbeExecutor coverage in `work.rs`. | Add ordinary-service retained synchronous admission controls for active global/default-per-function limits (without requiring32 container pairs), and separately configure memory/environment ceilings so one is nonbinding. Assert typed throttling, no extra allocation and progress only after physical retirement. |
+
+These are unfulfilled acceptance subcases, not observed production correctness failures. Preserve them in the implementation ledger; do not silently weaken L05/L09 or mark M0 complete. Image archive/ZIP, handler service/callback networking, IaC and final reference/platform gates remain in their existing later phases.
+
+
+### D85 final qualification and retained evidence
+
+The16 proxy controls/three deterministic archive-and-provisioning controls and typed cleanup-receipt control pass, including post-recv late completion, falsey/non-JSON errors, exact stream/count limits, partial framing and backend completion held past front-peer closure. Explicit immutable baseline provisioning passes on both retained daemons; optimization-enabled invalid platform/mutable/foreign inputs reject before CLI effects, and dry-run order checks place this prerequisite before ordinary resources. The baseline runs are warm; only the extra port-qualified reference is proven absent before each interrupted ordinary pull. No cold-layer download claim is made.
+
+All six in-slice findings W265–W270 are resolved and independently rechecked. The two M0 audit gaps above remain required next work. Final captured bridges are removed only after full ID/name/nonce owner and empty-attachment verification; complete all-state/image-prefix observations show zero containers, runtime-private/test-source aliases and extra port-qualified pull references. Seven distinct selected sources plus the original immutable public baseline keep their captured IDs on each engine. Both daemons/source caches and failed evidence roots are intentionally preserved; no global force/prune/cache cleanup occurs.
+
+Evidence: `/tmp/rustack-d85-final-arm64.log`, `/tmp/rustack-d85-functional-amd64.log`, `/tmp/rustack-d85-fenced-{arm64,amd64}.log`, `/tmp/rustack-d85-standard-accepted.log`, `/tmp/rustack-d85-boundaries-accepted.log`, `/tmp/rustack-d85-native-final.log`, `/tmp/rustack-d85-controls-committed.log`, `/tmp/rustack-d85-platform-{unit,preparation}.log`, `/tmp/rustack-d85-baseline-accepted-{arm64,amd64}.log`, `/tmp/rustack-d85-baseline-optimization.log`, `/tmp/rustack-d85-make-order.log`, `/tmp/rustack-d85-{audit,deny}.log`, `/tmp/rustack-d85-source-projection.json` and `/tmp/rustack-d85-postconditions.json` with exact argv/status/raw hashes in `/tmp/rustack-d85-post-*`. The latter records expected engines, full owned network IDs and all cleanup predicates. Earlier focused/full failed logs and evidence roots remain chronological failures rather than qualifications. Final text checks cover the indexed workflow spec set and guide.
+
+
+## P1 actual Runtime HTTP and independent admission review (D86)
+
+Implementation and independent source review against runtime§4.16/verification D86 are complete. W271–W274 are resolved and rechecked. Final native-arm64 VZ and fresh emulated-amd64 QEMU qualification and the final complete resource postconditions are green. Earlier Event-only execution-limit results are not qualification.
+
+| Finding | Severity / source | Resolution |
+|---|---|---|
+| W271 | P2; independent oracle/spec review, `lambda_admission_sdk.py`, execution_pressure | Event202 proves acceptance before function/global permit acquisition. A lower actual default/global limit can pass the initial negative-probe/ticket scheme. Add bounded real accepted/active counters to existing diagnostics, independently require exact8/32 active permits before probing429, and pin the status source to actual semaphore ownership including cleanup. Preserve no names/payloads/new diagnostic route. The original D86 no-metrics claim is a spec defect; it is surfaced and corrected before production implementation. |
+| W272 | P3; independent raw-client control review, `image_framing.rs`, live peer expiry test | Anchor expiry after positive request observation, not a100ms connect/write scheduling assumption. Join the peer unconditionally and retain/drop the locally owned client socket. |
+| W273 | P3; actual fixture configuration | The configured Docker memory minimum is256MiB. Use environments2/memory256MiB to fit one192MiB pair but not two, paired with environments1/memory384MiB. No production range change is needed. |
+| W274 | P2; self-review of physical cleanup evidence, `lambda_admission_sdk.py`, held_exit | A lone function-DELETE gate plus a later empty-pair observation cannot isolate premature budget return after function removal but before relay retirement. Add a second paired relay-DELETE gate and expose the existing actual EnvironmentCapacity counters in qualified Docker diagnostics. Require full reservation/work charges at both cuts, absent function/present relay and no waiting computation before final release. |
+
+All four findings are fixed in this slice. The actual WorkManager projection samples the same accepted/global semaphores without initialization, actor messages or IO, with fixed limits128/32/default8 and no resource names or payload. A real retained executor regression observes accepted3/active1, cleanup-held1/1 and joined0/0; the accepted128 regression also checks active8. Provider/main tests pin the installed/absent JSON source. The existing EnvironmentCapacity projection is read from the exact qualified Docker owner; a retained quarantine test pins its fields and unqualified startup omits it. No new admission owner or readiness policy is introduced.
+
+The paired real-wire proxy control independently releases the function DELETE while relay DELETE stays before effect. Each actual ceiling resource now requires full work/environment/memory charges at both cuts, including positive function absence/relay presence. Collector controls prove per-target release, expiry without mutation and bounded unique consumed/computed tickets. The independent final source review finds no remaining in-slice correctness issue, and the M0 source audit maps all original P1/L01–L09 contracts rather than inheriting completion from this slice alone.
+
+Failed observations remain chronological evidence: the initial arm64 cohort passed the original Runtime/global/default cases but failed startup at memory192MiB, below the validated256MiB minimum. The initial Event-only admission oracle could accept a lower active limit and is superseded by positive real ownership counts. An intermediate full amd64 cohort passed23 startup cases and failed global admission because its already-copied private executable lacked the newly added capacity projection; this cohort joined before the fresh final run and does not qualify current source. A deliberate committed-source panic remains the asserted D82 unwind control. No running owner was restarted merely because an observation wait yielded.
+
+Final host qualification: ordinary/feature workspace build and all-target tests pass3,860/3,973 (424/473 separately gated), both workspace Clippy profiles, nightly formatting and denied-warning rustdoc. Strict six-library production boundaries pass1,591 unit/integration/doc cases/29 gated; the complete Native verifier passes2,986 aggregate cases/19 gated with its unchanged26-resource inventory. Fresh audit scans495 dependencies/1,380 advisories without vulnerabilities; deny passes with unchanged policy diagnostics. Actual SDK fixture pedantic checks pass. Seventeen proxy, three negative/archive/provisioning, four admission collector, four prior collector, three raw-RIC and one cleanup-receipt controls pass through the fixture/functional targets. The final arm64 full gate passes all53 distinct resources plus the three raw-RIC/one receipt controls; no resource is skipped. The fresh final amd64 gate also terminates successfully with all53 resources/57 total Rust passes, ten summaries and no required skip.
+
+### M0 source and acceptance audit after D86
+
+The independent audit finds no remaining source/coverage gap in P1 tasks1.1–1.4 and M0's L01–L09 matrix. Both final full53-resource gates and exact postconditions below pass; P1/M0 is functionally qualified on the retained P0 lanes. The evidence is functional native-arm64 VZ/emulated-amd64 QEMU; native-x86/reference performance and the complete release platform matrix are not inherited from it.
+
+| Contract | Implemented and independently checked evidence |
+|---|---|
+| P1/1.1 revision and invocation ownership | Immutable execution snapshots, artifact/revision validation and published capture; actual Native/provider cancellation and retained cleanup. |
+| P1/1.2 Runtime API and relay | Strict bounded codecs/session/HTTP, forged/duplicate/stale completion rejection; actual RIC attach/control/EOF and startup receipts. |
+| P1/1.3 images, deployment and pool | Captured selected-platform IDs/defaults, private immutable pins, update CAS, old-revision preservation, actor-owned warm/FIFO dispatch and lifecycle/retirement. |
+| P1/1.4 ordinary composition | Real strict-auth SDK/gateway/provider, configuration and provenance, endpoint/network/kernel receipts, readiness and joined container-before-pin recovery/shutdown. |
+| L01–L02 computation/RIC | Official Python and independent Rust RIC compute results and increasing warm counters. Official Node remains an explicit M4 requirement. |
+| L03–L04 defaults/revisions | Absent/empty/literal ImageConfig, working directory and immutable tag/publication/alias/in-flight A→B controls through ordinary startup. |
+| L05 failures/protocol | Actual incompatible/no-RIC/init/error/exit/OOM/timeout outcomes; D86 exact method/header/body/trailer rejection followed by same-attempt correct computation and warm reuse. |
+| L06 attempt isolation | Concurrent functions and actual foreign/malformed/stale/duplicate request completion attempts, without cross-invocation delivery. |
+| L07 cancellation/retirement | Allocating/init/busy/cleanup caller loss, actual IO expiry and two-stage function/relay cleanup, with retained ownership after logical settlement. |
+| L08 daemon/deployment faults | Live acknowledgment/transport loss, interrupted real pull, missing image and held critical image mutation/deployment capacity; no Active placeholder or old-revision loss. |
+| L09 admission/resource ceilings | Reserved0/1, accepted128/129, actual global32/default8 with positive WorkManager counters, independently binding environment/memory ceilings and retained charges after function absence while relay removal stays held. |
+| Runtime§5/§7.1 and cross-cuts | Actual kernel/security policy, bounded hostile input and private ownership; six-library strict Clippy, standard workspace gates, Native regression and current audit/deny. |
+
+Image archive lease restoration, Docker provided-runtime ZIP, Node, handler service/callback SDK images, consuming-project/IaC, native-reference/platform and the complete final release manifest remain in their original later scope. The broader goal remains active.
+
+
+### D86 final qualification and exact postconditions
+
+After both complete gates join, expected engine UUIDs match before/after cleanup. Fresh full all-state container inventories are empty. Full image inventories contain zero runtime-private aliases, zero normalized custom-RIC fixture aliases and zero extra port-qualified pull references. Seven selected relay/Python/customA/customB/negative sources plus the immutable public baseline preserve eight distinct captured IDs per engine. The two captured full bridge IDs are removed only after exact name/nonce-label/empty-attachment checks, and full network inventories prove absence. Source caches, both daemons and earlier failed evidence roots remain preserved; no global prune/force removal occurs.
+
+Evidence: `/tmp/rustack-d86-final-{arm64,amd64}.log`, `/tmp/rustack-d86-standard-accepted.log`, `/tmp/rustack-d86-boundaries-final.log`, `/tmp/rustack-d86-native-final.log`, `/tmp/rustack-d86-fixture-pedantic-final.log`, `/tmp/rustack-d86-{audit,deny}.log`, `/tmp/rustack-d86-pair-controls.log`, `/tmp/rustack-d86-{work-status,diagnostics,capacity-startup,capacity-retained}.log`, `/tmp/rustack-d86-source-projection.json`, `/tmp/rustack-d86-networks.json` and `/tmp/rustack-d86-postconditions.json`, with exact argv/status/raw hashes and stdout/stderr in `/tmp/rustack-d86-post-*`. Earlier failed observations remain in `/tmp/rustack-d86-focused-arm64.log` and `/tmp/rustack-d86-functional-amd64.log`. Final independent source/ledger review has no remaining finding. Text/link/staged whitespace checks cover the final English specification and guide updates. P1/M0 functional closure does not close the complete M0–M4 goal.
+
+
+## P5 immutable local image-lease reacquisition review (D87)
+
+Task5.2a implements [runtime§2.15](./rustack-workflows-20-lambda-runtime-design.md#215-immutable-local-image-lease-reacquisition-d87), a prerequisite of atomic archive import. Independent source review before and after the controlled/actual-consumer additions finds no concrete correctness finding. This primitive does not remove provider/main archive rejection or complete5.2/P5; complete candidate validation, fresh lease/size checks and atomic startup publication remain5.2b.
+
+`PreparationSource` makes ordinary reference preparation and saved metadata restoration separate variants; restore derives architecture from the validated image. The first operation uses only the canonical saved parent ID. A root mismatch rejects before a second platform lookup, then fresh selected-platform metadata must match the complete saved execution fingerprint before any journal/Tag effect. Missing local content never enters the pull branch or follows the saved source/registry references. A successful restore preserves the saved metadata and code hash while consuming fresh unpacked proof and the existing durable pin/retirement owner. Qualified architecture, absolute/independent IO budgets, quota, canceled-response and shutdown semantics are shared, not reimplemented.
+
+Thirty-five lease controls pass (nine new/expanded cases). Positive source/immutable/platform request counters distinguish restore from ordinary fallback. An otherwise valid recomputed fingerprint with changed size/defaults/manifest/architecture rejects actual comparison and leaves no Tag, then correct restore recovers. A different initial root ID rejects before an extra platform request. Saved A remains A while its informational source pointsB; absent A404 never follows availableB. Existing canceled late Tag and bounded quota/timed-out shutdown controls now execute both source variants and retain real cleanup ownership. The qualified-platform rejection test also proves restored metadata cannot bypass platform admission. The first new test compile used the wrong existing error variant name; the final assertion uses DockerError::Image. The first all-target Clippy pass found a missing semicolon in a test match block; it was fixed without a waiver and the complete accepted profile reruns successfully.
+
+Each retained engine passes18 actual resources: two existing production-wire/RIC resources now serialize/deserialize resolved metadata and consume restored relay/function leases before actual computation/override assertions, plus16 private-image/container recovery, namespace, reciprocal daemon binding, real approved pull, seven pool/environment and ordinary boto3 Executor/provider/HTTP cases. This is native-arm64 VZ/emulated-amd64 QEMU functional scope. The frozen53-name/eight-suite manifest remains exact and verifies; this slice does not report an unexecuted full53 rerun. Explicit Make prerequisites rebuild selected relay/Python fixtures before capturing current source IDs. After every owner joins, complete all-state/image-prefix inventories show zero containers/runtime-private/test-source aliases/extra pull references and eight distinct captured post-provisioning source IDs preserved per engine. No new bridge is created, and both daemons/cache remain preserved.
+
+Final ordinary/feature workspace build/all-target tests pass3,869/3,982 (424/473 separately gated), both workspace Clippy profiles, nightly formatting and denied-warning rustdoc. Six strict production boundaries pass1,601 unit/integration/doc cases/29 gated. Complete Native qualification passes2,986 aggregate cases/19 gated with its unchanged26-resource inventory. Fresh audit scans495 dependencies/1,380 advisories cleanly; deny passes with unchanged policy diagnostics. No new dependency, production hook or policy/lint waiver is added.
+
+Evidence: `/tmp/rustack-d87-lease.log`, `/tmp/rustack-d87-wire-{arm64,amd64}.log`, `/tmp/rustack-d87-consumers-{arm64,amd64}.log`, `/tmp/rustack-d87-standard-accepted.log`, `/tmp/rustack-d87-boundaries.log`, `/tmp/rustack-d87-native.log`, `/tmp/rustack-d87-security.log`, `/tmp/rustack-d87-manifest.log`, `/tmp/rustack-d87-source-projection.json` and `/tmp/rustack-d87-postconditions.json`; exact command status/raw hashes and stdout/stderr are in `/tmp/rustack-d87-post-*`. The failed initial Clippy cohort remains `/tmp/rustack-d87-standard.log`. Final text/link/whitespace and independent evidence consistency checks apply to this primitive. Full image archive publication, Docker ZIP, Node/handler SDK/callback/IaC/native-reference/platform and the complete M0–M4 release remain active work.
+
+
+## P5 candidate Image archive restoration review (D88)
+
+Implementation and independent source review against runtime§2.16/operations§3.4 are complete. W275–W280 are fixed and rechecked, with no remaining concrete in-slice source finding. Both final full53-resource gates, broad host/Native/security qualification and exact postconditions pass. Earlier focused archive passes are separate, narrower evidence.
+
+| ID | Priority / location | Resolution |
+|---|---|---|
+| W275 | P2; `provider/snapshot.rs`, owned validation input | Rejecting deep dynamic policy conditions is insufficient if recursive destruction overflows. Give owned policy statements iterative condition destruction covering rejection, early deadline/backend refusal, canceled/unpolled import and unconsumed worker output; add a very deep-value regression. |
+| W276 | P2; `provider/snapshot.rs`, validator wait/join | Preserve typed deadline and redacted worker-panic/cancellation provenance instead of mapping infrastructure failures to InvalidParameter. Inject a real worker panic and assert category/source/redaction. |
+| W279 | P2; borrowed layer guard work | A bounded writer does not bound an earlier walk of all layer versions/conditions with reset budgets. Share a prospective65,536-unit per-record guard budget across version, statement and dynamic-condition work; apply shared intake work limits and prove rejection before visiting every condition. |
+| W278 | P2; export preflight before cloning | Function/revision counts do not bound ancillary metadata or recursive Value::clone. Stream borrowed function/layer/mapping records through per-record dynamic guards and the bounded writer, then construct the owned DTO inside the budget. Add deep live-policy/oversized ancillary export tests and previous-generation save preservation. |
+| W277 | P2; candidate ARN preflight | A grammar-valid foreign region/account can import Active then fail actual Docker invocation. Validate exact saved function ARN against installed provider scope before any pin; reject both tamper classes without old-resource changes. This tightens an omitted scope invariant before changing implementation. |
+| W280 | P3; actual archive fixture evidence lifetime | Disable temporary-root cleanup immediately after server creation and print the retained path before effects. Reenable cleanup only after successful exercise, joined shutdown and complete resource audit, preserving durable cleanup authority on panic or abandoned test futures. |
+
+D88 failed observations are retained: the initial candidate fixture used the default8 deployment jobs with a2-job fake owner, then incorrectly waited for a fake notification instead of actual supervisor pin retirement. Both controls are corrected and all18 candidate/export cases pass. The first ordinary all-target Clippy cohort finds two new test-style violations (a missing semicolon and an empty-value assertion); both are fixed without waivers before the accepted complete rerun. An extra strict CLI command initially propagated pedantic flags into unchanged generated service models; the accepted CLI production boundary uses explicit `--no-deps`, alongside unchanged full-workspace ordinary Clippy and the six-library strict target. No production fallback, lint waiver, dependency change or required-resource skip is introduced.
+
+Host qualification: ordinary/feature workspace all-target tests pass3,895/4,010 (424/473 separately gated), with both builds, both workspace Clippy profiles, nightly formatting and denied-warning rustdoc green. Six-library strict boundaries pass1,629 aggregate unit/integration/doc cases/29 gated. Complete Native qualification passes3,001 aggregate cases/19 gated with its unchanged26-resource inventory. Both CLI production profiles pass scoped strict boundary Clippy, and the actual Docker fixture passes pedantic checks. Fresh audit scans495 dependencies/1,380 advisories without vulnerabilities; deny passes with unchanged policy diagnostics. The final native-arm64 full gate passes53 distinct resources/57 Rust passes with no required skip. The fresh final emulated-amd64 full gate also terminates successfully with all53 distinct resources/57 Rust passes, ten summaries and no required skip.
+
+### D88 final qualification and exact postconditions
+
+After both complete gates join, full all-state container inventories are empty on both expected engine UUIDs. Full image inventories show zero runtime-private, normalized custom-RIC fixture or extra port-qualified pull references. Seven selected relay/Python/customA/customB/negative sources plus the immutable public baseline preserve eight distinct captured post-provisioning IDs per engine. Explicit Make prerequisites rebuilt fixture sources before capture; these are not claimed to equal D87 IDs. Both captured full bridge IDs are removed only after exact engine/name/nonce-label/empty-attachment checks, and full network inventories prove absence. Both daemons, source caches and prior failed evidence roots remain preserved; no global prune or forced removal occurs.
+
+Evidence: `/tmp/rustack-d88-final-{arm64,amd64}.log`, `/tmp/rustack-d88-standard-accepted.log`, `/tmp/rustack-d88-boundaries-native.log`, `/tmp/rustack-d88-cli-boundaries-accepted.log`, `/tmp/rustack-d88-security.log`, `/tmp/rustack-d88-source-projection.json`, `/tmp/rustack-d88-networks.json` and `/tmp/rustack-d88-postconditions.json`; the latter retains exact argv/status/raw hashes and `/tmp/rustack-d88-post-*` output paths. Earlier focused actual archive evidence is `/tmp/rustack-d88-archive-{arm64,amd64}.log`. Failed initial all-target/overbroad strict observations remain `/tmp/rustack-d88-standard.log` and `/tmp/rustack-d88-cli-boundaries.log`. The final Make success banner now names the remaining Node/ZIP/handler/IaC/reference/full-release scope; this text-only reconciliation changes no compiled resource or orchestration. Final English file/anchor/index and whitespace checks apply. This completes5.2b Image restoration, not full M4 or the broader M0–M4 goal.
+
+
+## P5 ZIP conversion and volume/archive transport review (D89)
+
+Implementation, independent source review, both final full54-resource gates and exact postconditions against runtime§6.1–§6.5 are complete. W281–W285 are resolved/rechecked; no remaining concrete in-slice finding is identified. This completes only5.1a; provided-runtime ZIP execution still requires5.1b/5.1c and its actual ordinary clients.
+
+| ID | Priority / location | Resolution |
+|---|---|---|
+| W281 | P2; self-review, `storage.rs::validated_zip_path` | Existing extraction treats every non-directory as a regular host file while rejecting only symlink/special-permission metadata. Reject FIFO/device/socket/other special-file declarations and file/directory type contradictions before staging or TAR conversion; share the checked validator and add hostile raw-attribute regressions. |
+| W282 | P2; independent D89 contract review, runtime§6.2/Moby archive_tarcopyoptions_unix.go | copyUIDGID=true rewrites TAR ownership from Config.User and can invoke user-name resolution. Correct the spec before wire implementation: explicitly use false, preserve normalized TAR UID/GID0, and assert actual extracted ownership/modes. Bound retained Vec capacity as well as logical length. |
+| W283 | P2; self-review, ZIP staging/converter tree bounds | Entry count alone permits millions of implicit directories from10,000 deep paths; implicit TAR parents also escape the promised directory mode and overhead budget. Before changing implementation, refine the shared profile to10,000 total explicit/implicit nodes, reject parent/file conflicts in either order and emit each normalized parent once. Share the layout validator between host staging and transfer; test exact node boundary and reverse-order conflicts. W281 additionally requires rejecting lexical absolute/drive/NUL names before Zip9 enclosed-name normalization. |
+| W284 | P2; independent review, converter directory branch | Shared metadata checks reject declared size/CRC errors but skipping directory payloads never validates the compressed stream. Positively read one bounded byte and require EOF for empty directories in both consumers. The new hostile-deflate control fails on the pre-fix source (`/tmp/rustack-d89-directory-negative-control.log`), proving this is a real bypass. |
+| W285 | P3; actual fixture read-only oracle | A write-open of normalized0444/root-owned code can encounter DAC denial before a mount error. Require actual RO mount inspection plus chmod→EROFS, then computed42/metadata and writable `/tmp`. Remove an extra large administrative upload to the RO function, outside upload_code's RW-target precondition; independent review confirms no required evidence is lost. One earlier ARM negative-upload outcome was not classified; diagnostic rerun/three repeats pass but do not establish its cause and are not a claimed fix. |
+
+Initial actual observations remain `/tmp/rustack-d89-code-real-{arm64,amd64}.log`, with failed roots `.tmpJNmMk8`/`.tmpDbnFjx` retained under the host temporary directory. They reach the probe but fail its original PermissionDenied oracle. `/tmp/rustack-d89-focused-initial-postconditions.json` verifies zero containers/private code volumes and eight D88 source IDs preserved on both engines afterward. The first revised ARM run (`code-real-accepted-arm64.log`) stops at the extra unclassified administrative-upload assertion, while AMD succeeds. The instrumented ARM diagnostic and three targeted observations pass (`code-arm64-readonly-{diagnostic,repeat}.log`); no root cause is inferred from those repeats. The final resource removes that redundant precondition-violating RPC and retains the independently reviewed positive mount/kernel/compute proof. The final full cohort below qualifies the required resource contract.
+
+
+D89 host qualification: ordinary/feature workspace all-target tests pass3,952/4,067 (425/474 separately gated), both builds/Clippy profiles, nightly formatting and denied-warning rustdoc. Explicit code-fixture controls pass36 converter,14 wire and two shared-layout cases (52 total), with the standalone probe's strict production Clippy. The shared original nine hostile-attribute staging cases also pass. Final root audit scans497 dependencies/1,380 advisories cleanly and deny passes with existing policy diagnostics. The only dependency additions are tar0.4.46/default features disabled and its filetime0.2.29 edge. The probe uses the existing optional Tokio dependency under its explicit zip-code feature, with bounded async IO; no new lint waiver is introduced. Six strict production boundaries pass1,696 aggregate cases/30 separately gated; the complete Native verifier passes3,001/19 gated with its unchanged26-resource inventory. Wire-fixture pedantic checks pass. The final native-arm64 full54-resource gate passes110 aggregate Rust cases across13 summaries:54 real resources,52 pure code-fixture controls and the existing four raw-RIC/receipt controls. The final emulated-amd64 full gate also terminates successfully with the same54 resources/110 aggregate Rust passes/13 summaries and no required skip. Exact final postconditions below pass.
+
+Earlier development gates are retained: initial converter30-case cohort exposed the lexical absolute-name issue and a doubled-slash long-path fixture expectation; the corrected1024-byte case now verifies normalized implicit directories too. The first volume URI assertion omitted required percent-encoded hyphens. Initial strict checks found a by-value IO error mapper, a wrongly named generated MountType enum, synchronous fixture filesystem types, excessive fixture booleans/function length and three test-style violations. These are corrected using typed phases, split functions, async probe IO and scoped imports; accepted source/fixture checks do not add policy exceptions. See `/tmp/rustack-d89-{fixture,core-strict,wire-pedantic,core-all-target-clippy}.log` for those initial cohorts and their accepted/final successors. Source fixtures are explicitly rebuilt before final source-ID capture; D88 source IDs are not inherited as unchanged across that provisioning.
+
+
+### D89 final qualification and exact postconditions
+
+After both full gates join, the26 exact recorded CLI operations verify both expected engine UUIDs, empty complete all-state container inventories and zero private `rustack-code-` volume names. Full image inventories contain no runtime-private, normalized custom-RIC fixture or extra port-qualified pull references. Eight distinct captured post-provisioning source IDs per engine remain identical. Both full captured bridge IDs are removed only after engine/name/nonce-label/empty-attachment checks; full network inventories prove absence. No unknown volume/container/image is deleted; both daemons, source caches and earlier failed evidence roots remain preserved.
+
+Evidence: `/tmp/rustack-d89-final-{arm64,amd64}.log`, `/tmp/rustack-d89-standard.log`, `/tmp/rustack-d89-boundaries-native.log`, `/tmp/rustack-d89-fixture-final.log`, `/tmp/rustack-d89-core-strict-expanded.log`, `/tmp/rustack-d89-core-all-target-clippy-accepted.log`, `/tmp/rustack-d89-security-final.log`, `/tmp/rustack-d89-source-projection.json`, `/tmp/rustack-d89-networks.json` and `/tmp/rustack-d89-postconditions.json`, with exact argv/status/raw hashes and output paths in `/tmp/rustack-d89-post-*`. The pre-fix malformed-directory control is deliberately red; early actual/fixture failures above remain chronological evidence and do not qualify the final source. Final file/anchor/index/whitespace and independent evidence checks cover this component. Ordinary ZIP execution, durable volume ownership/recovery, ZIP archives, Node/handler SDK/IaC/reference/platform and full M4 remain open; the complete goal stays active.
+
+## P5 code namespace and recovery boundary review (D90)
+
+Independent spec preflight found **W286/P2**: runtime§6.6 required Planned loaders for Planned/Uncertain volumes while prescribing loader-first retirement after each effect, leaving no legal intermediate snapshot. Corrected the contract before continued verification: atomically retire both Planned effects; keep a Planned loader while resolving an Uncertain volume, publish positive volume Known, then retire loader before deleting volume. The implementation and controlled tests demonstrate these exact transitions. No unknown404 is converted to Known/Retired. Full producing-manager/ordinary ZIP and M4 requirements remain open.
+
+**W287/P2 (spec defect, surfaced before correction):** both initial real lanes refused the loader because Docker inherited `com.amazonaws.lambda.platform.*` labels from the pinned image. Failed roots `.tmpls9RcW` (arm64) and `.tmpXluwJw` (amd64) and raw `/tmp/rustack-d90-failed-{arm64,amd64}-inspect.json` retain the evidence. Refine only loader label identity to exact reserved `rustack.lambda.*` keys/values plus bounded non-reserved inherited labels; volume labels remain exact. Do not erase the failed roots or infer success from a later retry.
+
+**W288/P2:** independent review found the existing generic container delete uses force=true, which could kill a loader after a start race. Use an explicit force=false loader DELETE, retaining the known journal on conflict/continued presence; test exact query and no kill/wait/restart. Ordinary function cleanup retains its existing policy.
+
+### D90 final qualification and source reconciliation
+
+W286–W288 are resolved and independently rechecked, with no remaining in-slice finding. The194-byte row/6,265-byte bound, explicit checked envelope arithmetic, namespace downgrade refusal, inherited-label bounds and non-force loader deletion match runtime§6.6. Thirty-six journal/profile and36 recovery controls pass; the existing36 converter/14 volume-wire/two layout controls remain green. `test-lambda-code-fixture` therefore passes124 pure controls; its one normally gated real case is separately executed by the exact manifest, not omitted.
+
+Both retained native-arm64 VZ and emulated-amd64 QEMU full gates terminate0 in `/tmp/rustack-d90-final-{arm64,amd64}.log`: all55 exact resources in eight suites,183 aggregate Rust passes across15 summaries (55 resources +124 pure controls +four existing RIC/receipt controls). Each resource suite has zero failures/ignored resources; the only ignored preflight entry is the new real recovery case subsequently executed explicitly. Both final focused recovery runs also pass in `/tmp/rustack-d90-real-final-{arm64,amd64}.log`. Earlier W287 roots are preserved and their known resources were retired through production historical recovery; checksummed code/pin journals now contain zero records. No retry is used as the explanation for their original label failure.
+
+Final `/tmp/rustack-d90-standard-final.log` records all nine commands0: both workspace build/test/Clippy profiles (ordinary4,024/426 gated; lambda+stepfunctions4,139/475 gated), nightly format, denied-warning rustdoc and strict core production boundary. `/tmp/rustack-d90-boundaries-native.log` records strict six-library1,769/31 gated and complete Native3,001/19 gated, both terminal0. The Native26-resource inventory is unchanged. All-target core pedantic Clippy and audit/deny pass under `/tmp/rustack-d90-strict-security.log`; no dependencies changed (497 packages,1,380 advisory records and unchanged accepted policy diagnostics). Manifest controls10 pass.
+
+The first postcondition attempt correctly refused comparing the early prebuild image-ID sample with the full gate's explicitly rebuilt references. Preserve `/tmp/rustack-d90-postconditions-prebuild-mismatch.json` and its five original raw observations; no bridge removal occurred on that attempt. The actual gate logs export five named OCI index IDs per architecture before resource execution. `/tmp/rustack-d90-source-post-provisioning.json` reconstructs these five exact inputs using export/name line numbers and the full log hash, plus the three unchanged prebuild references (two typed negative images and the immutable public Node baseline). The eight final source references match that actual provisioning evidence; do not claim that all initial prebuild tag IDs stayed unchanged.
+
+`/tmp/rustack-d90-postconditions.json` is complete with26 successful exact CLI observations/mutations and raw stdout/stderr hashes under `/tmp/rustack-d90-post-final-*`: expected engine IDs, complete all-state container absence, zero private code volumes and runtime-private/test-source/extra-pull references, eight distinct actual provisioned source IDs preserved per engine, exact ID/name/full-nonce/driver/empty-attachment bridge checks before unforced removal, and complete network absence afterward. Only the two current owned bridges were removed; daemons, source cache and all failed evidence roots remain. The new namespace reader/recovery boundary is complete; the retained producing manager, its admission/pin/upload-loss/panic lifecycle and ordinary ZIP execution/archive consumers remain mandatory. This does not close5.1b/5.1/P5 or full M0–M4/Node/SDK/IaC/reference/platform acceptance.
+
+Final text checks validate481 relative links and229 fragments across14 workflow spec/guide/index files with zero errors; working/staged whitespace checks pass.
+
+## P5 retained producing code-volume owner review (D91)
+
+**W289/P2 (spec defect, surfaced before correction):** caller-side polling/deadline alone cannot expire a queued Ready handoff when the prepare future remains live but unpolled. Runtime§6.7 now requires an independent owner timer and retained Pending/Consumed(Instant)/Expired receipt, timestamp reconciliation, revocation and physical cleanup before releasing an expired handoff's admission. Ready metadata cannot itself retain source/archive/resource permits after cleanup. Verify manual-poll queued abandonment/live-unpolled expiry/late-consumption, including on-time consumption processed after the timer.
+
+**W290/P2:** independent initial source review found that retained staging still used observer-timed RawPort::request; its observation timeout could return before the accepted exchange/driver joined. Use the private owned-response bound-port view for every code stage and reaper RPC, preserving public observer semantics and post-join deadline fences. Verify delayed accepted upload/create responses and root loss retain source/admission/buffers before cleanup.
+
+D91 consumer-contract refinement: add an accepted preparation handle and metadata-only retirement receipt before waiting for the result. A failed preparation result cannot itself authorize releasing a parent environment's memory/work reservation. Unaccepted envelopes publish a no-effect retirement proof when discarded; accepted records publish success only after physical and journal retirement. Expired receipt observation preserves the original cleanup owner. The convenience prepare API remains available for callers owning only code quotas.
+
+**W291/P2:** independent review found that a queued retirement watch result could win `timeout_at` when repolled after its deadline. Add the post-observation deadline fence and manual-poll positive/closed-result regressions, preserving the same receipt for subsequent observation.
+
+**W292/P2 (spec refinement surfaced before correction):** whole Tokio runtime loss can drop the transferred emergency ledger and release the producer semaphore before physical retirement. Add an acquisition-local sticky producer poison, armed by the exclusive guard and cleared only by an empty joined-ledger proof. An unclean final guard drop poisons the same acquisition; reconnecting under another runtime cannot restart it. Reacquisition remains subject to ordinary historical recovery. Verify two-runtime loss with an issued uncertain create and unchanged durable evidence, plus normal empty joined replacement.
+
+**W293/P3:** final documentation review found the guide still described the frozen manifest as55 resources after D91 added the managed consumer. Correct the guide to56 and verify against the compiled exact inventory.
+
+### D91 host qualification and reviewed ownership boundaries
+
+W289–W294 are fixed and independently rechecked: independent handoff expiry, accepted wire-response ownership, post-wakeup retirement deadlines, same-acquisition runtime-loss poison and the56-resource guide count. No remaining concrete in-slice source finding was identified. The46 targeted owner cases include policy/admission rejection, source affiliation/revocation, clone/last-release, queued/live-unpolled handoffs, both unknown creates, retained upload completion, caller/root/worker/stage loss, cleanup erasure panic/lost acknowledgment, receipt observation and two-runtime failure. Existing D90 recovery/codec and D89 immutable transfer tests continue to qualify the shared boundaries.
+
+`/tmp/rustack-d91-standard.log` has nine terminal0 commands: both workspace build/test/Clippy configurations, nightly formatting, denied-warning rustdoc and strict core production lints. Ordinary tests pass4,070/427 separately gated; lambda+stepfunctions pass4,185/476 gated (80 summaries each). `/tmp/rustack-d91-boundaries-native.log` has two terminal0 commands: strict six-library tests/lints1,833/32 gated and complete Native verifier3,001/19 gated; its26-resource inventory is unchanged. `/tmp/rustack-d91-strict-security.log` records strict production/all-target core Clippy, audit and deny all0 with497 dependencies/1,380 advisory records and unchanged accepted policy diagnostics. No dependency or ignore policy changed.
+
+The initial full-arm preflight correctly rejected the stale55-resource assertion in the manifest control before actual resource execution; preserve `/tmp/rustack-d91-first-full-arm64.log`. The first standard run's Clippy rejected a missing test statement semicolon; `/tmp/rustack-d91-first-standard.log` remains. Additional development Clippy checks rejected the underscore name of the now-used producer guard and synchronous test filesystem reads; those were corrected without allowances. The initial two-runtime regression used the wrong root-relative journal path and failed before destroying runtime1; the corrected test reads the actual private namespace bytes asynchronously. These failures are not resource success or cleanup evidence.
+
+### D91 final actual qualification and exact postconditions
+
+Both original full-gate jobs terminated0 and were joined in `/tmp/rustack-d91-full-{arm64,amd64}.log`. Each explicitly executes all56 frozen required resource names across eight suites, with230 aggregate Rust passes/16 summaries:56 resources,170 pure code controls (46 owner+124 prior converter/codec/recovery/transport/layout cases) and four retained controls. The single ignored preflight entry is the real recovery test later executed explicitly in the nine-resource core suite. The new managed consumer executes original ZIP code through the actual producing owner and returned RO mount; computed42, root ownership, normalized modes, kernel EROFS and writable `/tmp` all pass. The ordinary startup24, core9, environment7, executor1, endpoint4, probe2, wire4 and relay5 cohorts all pass on both selected engines. Native arm64 VZ and emulated amd64 QEMU establish functional scope only; no native-x86/reference/other-platform acceptance is inferred.
+
+`/tmp/rustack-d91-source-build-exports.json` preserves the exact append-only full-log prefix through the first required resource header, with prefix byte counts/hashes, five named build-export IDs and line numbers before resource execution, three unchanged prebuild reference IDs, and final full-log hashes. Its prebuild inputs and raw inspections are `/tmp/rustack-d91-sources-prebuild.json` and `/tmp/rustack-d91-prebuild-{arm64,amd64}.json`. Final source comparison uses the actual provisioned IDs; it does not assert that all early prebuild tags remained unchanged through their explicit rebuilds. Eight distinct selected source IDs per engine match the final inspect output.
+
+`/tmp/rustack-d91-postconditions.json` is complete with26 successful exact CLI observations/mutations and raw stdout/stderr hashes under `/tmp/rustack-d91-post-*`. It proves expected engine IDs, complete all-state container absence, zero all volumes/private-code volumes, zero runtime-private/test-source/alternate-pull references, eight preserved actual source IDs per engine and complete network absence after cleanup. Both captured bridges were removed only after exact engine/ID/name/full nonce/bridge driver/local scope/empty-attachment checks immediately before unforced removal. Only those owned bridges were removed; daemons, source cache and prior failed evidence remain. All test, validation and cleanup tool jobs are terminal and joined.
+
+The retained producing component and task5.1b are complete. Ordinary provided-runtime startup/provider/invocation5.1c and ZIP archives5.2c remain next, alongside every later Node/handler SDK/IaC/reference/platform/full M0–M4 requirement. Component transport/recovery evidence does not enable or certify ordinary ZIP Lambda capability.
+
+Final text checks validate484 relative links and232 fragments across14 workflow spec/guide/index files with zero errors. Working and staged whitespace checks pass.
+
+**W294/P3:** final evidence review found the prose cohort breakdown counted endpoint resources as2 instead of the frozen4. Correct endpoint4; the eight cohorts total56 and match the exact compiled manifests and executed names.
+
+## P5 ordinary provided-runtime ZIP consumer preflight (D92)
+
+Completed under the final qualification below. **W295/P2 (preflight refinement, surfaced before implementation):** joining a failed code stage without a receipt cannot by itself prove no accepted preparation. The consuming stage must publish its physical receipt before D91 can enqueue work. Add a private synchronous pre-enqueue publisher while a constructed no-effect retirement guard is held; publisher panic leaves unaccepted work or an already retained receipt. Test panic before/after publication, queue rejection and accepted stage loss. Keep a permanent per-plan allocation claim after actor commit so two managers cannot clean the same consumer.
+
+**W296/P2 (spec correction surfaced before change):** D89 conversion admission waits on its bounded semaphore under the caller deadline, rather than always rejecting immediately with Busy. Preserve that contract; document admission expiry as ResourceNotReady and explicit Busy as throttling. Do not change the proven converter policy to satisfy a mistaken new spec sentence.
+
+**W297/P2 (implementation review, fixed; final qualification below):** Create and CodeUpdate checked ZIP runtime capability before asynchronous fetch/conversion, allowing revocation during that wait to publish a successful deployment. Recheck the captured runtime/handler/architecture immediately before Create insertion and inside the final CodeUpdate revision CAS. Two held-S3-fetch controls revoke the executor after initial admission and require failure with absent Create or unchanged latest/published update state. Eight provider controls pass in `/tmp/rustack-d92-provider-sixth.log`; the earlier fifth invocation selected the wrong module filter and executed zero tests, so it is not evidence.
+
+**W298/P2 (implementation review, fixed; final qualification below):** a cached producer shutdown error does not prove physical cleanup when the originating Tokio runtime destroyed its cleanup task. Retain an empty-ledger witness outside task destruction, publish it only after all entries and original workers joined (or a root dropped with both already empty), and require both that witness and observed task settlement before startup may advance to image retirement. Extend the two-runtime W292 regression to require false after loss and the joined root-failure regression to require true after positive empty cleanup. All46 owner controls pass in `/tmp/rustack-d92-owner-third.log`; failed test builds remain preserved separately.
+
+### D92 development qualification evidence (in progress)
+
+The61-resource inventory was verified before its first new real execution. Initial actual arm64 SDK failures exposed a fixture deadline built outside its Tokio runtime and a cold-recovery observer racing positively owned code retirement. Move timeout construction inside `block_on` and allow only explicit allocation-free429 retry under the original bounded recovery cutoff. The first Linux Native verifier reached the actual provider but could not execute its child on Docker's default noexec tmpfs; explicitly permit exec only on this separately owned verifier mount, preserving production Lambda's noexec policy. Preserve `/tmp/rustack-d92-first-provided-arm64.log`, `/tmp/rustack-d92-first-native-arm64.log` and their retained evidence roots. Later SDK observations corrected the fixture's ASL alias representation (`Qualifier`, rather than a bare name containing a qualifier) and checked failure retirement against pre-existing healthy warm IDs instead of demanding an empty whole owner.
+
+The fourth arm64 focused run passes all four ordinary SDK/ASL/revision/fault/causal-disconnect resources and the actual Linux Native verifier. `/tmp/rustack-d92-fourth-provided-arm64.log` records matching original A digest `zbuW6tkkfFA7ZNEnPCV3HLjnrG5tWCSMnXG0aTOGF7U=` from every SDK cohort and the Native computation. Native owns/reuses a real child and positively joins it before the verifier exits. This is focused functional evidence only. The third arm64 attempt had one transient published-A invocation fail with function exit0; its cause remains under independent investigation, and the later passing rerun does not resolve it.
+
+The inventory then explicitly expands61→63 for two ordinary ZIP allocation/cleanup IO resources before those resources execute; the compiled eight-suite manifest passes63. Initial IO runs correctly fail because the fixture's scoped archive query omitted production's mandatory `noOverwriteDirNonDir=true`. Add that exact required field to the proxy allowlist and its positive/negative controls; all19 proxy controls pass in `/tmp/rustack-d92-proxy-fourth.log`. Retain first IO logs and roots; those failures are not successful qualification. A subsequent preflight fails at compilation of a new pin-capacity test using a non-exhaustive cross-crate literal/wrong integer type, before any new resource execution. Its correction uses default construction plus explicit fields, and preserves independent deployment-job≤pin validation. Complete Docker both-lane, full Rust/Native/security/text and independent-review gates remain pending.
+
+**W299/P2 (independent fixture review, fixed; requalification pending):** `provided_qualification.rs` independently read a temporary path immediately after Tokio `File::write_all` and drop, without joining the buffered blocking write. Tokio explicitly requires flush to complete pending writes before dropping the file. Await `file.flush()` under the existing observation deadline before independent read/removal. This concrete race can report `probe temporary contents` and normal fixture exit0, consistent with the earlier transient; absent original stderr, do not claim definitive attribution of that invocation. The fixture now returns a static `ProvidedQualificationError` through the Runtime API before exiting on future observation failure. Preserve old failed runs; rebuild both original ZIP fixtures and rerun all consuming resources after this fix. Two independent reviewers find no additional concrete production alias/pool/ZIP lifetime issue and verify W297/W298's fix shapes. Final63 qualification is still required.
+
+Review clarification: §6.8's phrase “existing bounded code-fetch/validation deadline” was ambiguous about separate operations. Preserve the pre-existing independent30s fetch/staging limits, and use `CODE_FETCH_TIMEOUT` to capture the new conversion's own absolute30s budget once; its admission/conversion/join cannot reset it. No new aggregate deployment timeout was intended. This matches the original D92 implementation scope and leaves Native/Squib semantics intact; the cold runtime path still carries its original invocation/ASL deadline through all preparation. The clarification changes no production code.
+
+The third focused amd64 SDK/ASL+same-original-ZIP Native run passes5 resources before the final W299 requalification. Its subsequent IO target passes both ZIP IO resources but has one independently detected `SDK original ZIP digest changed` failure in a repeated SDK cohort: the root agent rebuilt the fixed fixture paths while that development observer still held the prior bytes. The result is rejected and not counted as a qualified run; preserve `/tmp/rustack-d92-first-provided-io-amd64.log` and its retained root. The final full gate must provision first and freeze files throughout all consumers, as verification70 now requires. Missing-Runtime-API handling in the shared echo fixture also replaces its pre-existing `expect` with a static exit78; no production panic/lint allowance is added. Strict provided-bootstrap and Linux Native verifier lints pass after the source fix.
+
+
+**W300/P2 (full regression, fixed; final qualification below):** absent ZIP configuration was mapped to DockerUnavailable/ServiceException even when the backend was healthy; this regressed the existing pre-staging SDK rejection contract. Distinguish an unconfigured source as Unsupported (provider maps InvalidParameterValueException) from a revoked configured source/backend as service failure, and test both without allocation. The first full arm64 ordinary suite also reports an archive cleanup status mismatch after the same early SDK failure; preserve that run and do not treat its later cleanup message as a distinct production archive diagnosis.
+
+**W301/P2 (spec correction surfaced before change):** D92's proposed1..256 ASCII handler bound disagrees with both the existing128-byte provider boundary and AWS CreateFunction's128-character maximum. Since the local profile is ASCII, bytes and characters coincide. Correct the D92 shared validator/spec to1..128 and add128/129 boundaries; preserve Native/Squib and the existing common provider limit. AWS source: [CreateFunction Handler](https://docs.aws.amazon.com/lambda/latest/api/API_CreateFunction.html#lambda-CreateFunction-request-Handler).
+
+W300/W301 targeted controls pass: the provider suite now10 cases, including128/129 Create/Configuration boundaries, and an executor case distinguishes healthy-unconfigured ZIP from revoked backend without allocation. `/tmp/rustack-d92-provider-seventh.log` and `/tmp/rustack-d92-unconfigured-first.log` are terminal0. The first full arm64 ordinary30 suite passes27 and fails the two image-only negative ZIP SDK assertions plus the archive observer that hit the same early failure. Preserve `/tmp/rustack-d92-first-full-arm64.log`; later suites were not executed by that failed gate. The archive observer's generic final stop-status message does not establish a separate archive production defect. A complete full rerun is required after the mapping correction.
+
+**W302/P3 (preflight test oracle, fixed; full rerun required):** the second arm64 full gate fails before resource execution in the unchanged quiet/partial-header collector control: macOS reports ECONNRESET when the collector closes a socket with unread partial request bytes. TCP reset and EOF both positively establish peer retirement. Accept specifically `ConnectionResetError` in that terminal receive assertion while retaining byte rejection, the three-second time bound, empty connection ownership and the collector's joined-thread checks. Do not catch timeout or arbitrary IO failure. Preserve `/tmp/rustack-d92-second-full-arm64.log`. This repairs the closure-kind oracle; it does not relax physical resource cleanup or skip a control.
+
+
+**W303/P2 (cold admission origin, fixed; final qualification below):** synchronous code-preparation mailbox/job/volume rejection can return Busy before enqueue, but the environment currently wraps it as nested Docker Busy and returns500. Preserve a typed code-stage origin: only the immediate `start_with_receipt` Busy becomes environment admission Busy/429 after retirement; accepted preparation or nested wire Busy remains infrastructure failure. A blanket wait-ready Busy rewrite is invalid under D36. Add a held sole-code-job/no-second-request control and an accepted-stage nested-wire-Busy control after volume/loader effects, requiring retained cleanup before quota release.
+
+W303's typed-origin fix passes14 ZIP controls in `/tmp/rustack-d92-zip-fifth.log`. A held sole code job rejects the second preparation before enqueue, returns modeled429, emits no second Docker request and releases only that parent's memory while the first reservation remains charged. A separately controlled accepted preparation creates its volume/loader, receives nested upload-wire Busy, preserves infrastructure500 and keeps parent memory until original receipt cleanup finishes. The first version of the negative test incorrectly expected `wait_ready` to hide the primary error until retirement; library result observation and retirement are intentionally distinct. Correct the oracle to observe the error while admission remains held, then require positive cleanup before charge release. Preserve the initial failed controlled log.
+
+Before W303, both complete63-resource jobs had terminated0. Arm64's preserved `/tmp/rustack-d92-pre-admission-full-arm64.log` had260 Rust passes/19 summaries, and its post-full timed Linux Native observer also passes with the same original A digest. The first amd64 job spans live production corrections/recompilation in the shared executable target; even a successful job is not final-source qualification. Preserve these earlier logs/source projections and rerun both full gates after all W303/source/fixture corrections are frozen. Final evidence must use the new complete runs, including the extra admission controls. No component or full M4 completion is inferred yet.
+
+### D92 final-source host gates and independent review
+
+The frozen-source host gates pass after W303 and the bounded Linux Native verifier corrections. `/tmp/rustack-d92-standard-complete-report.json` records all nine commands0: ordinary and lambda+stepfunctions workspace all-target build/test/Clippy, nightly format and both denied-warning rustdoc configurations. Their tests pass4,098/428 gated and4,213/483 gated respectively, across81 summaries each. `/tmp/rustack-d92-boundaries-complete.log` passes strict six-library boundary tests/lints with1,864/33 gated across20 summaries; `/tmp/rustack-d92-native-complete.log` passes the complete unchanged26-resource Native inventory and3,001/19 gated across41 summaries. The original combined host job has terminated0 and is joined.
+
+The opt-in provided-bootstrap and new Linux Native verifier strict fixture checks pass. The latter bounds its manifest to4KiB, original ZIP to50MiB, child PID to the positive signed OS range, total execution to90s, joined shutdown to30s and post-join `/proc/PID` absence observation to5s. It uses the same original A bytes as ordinary SDK/ASL execution; architecture-specific hashes are recorded by each final resource. Its separately owned exec tmpfs does not change production Lambda's noexec policy. `/tmp/rustack-d92-security-final-report.json` explicitly records `make audit` and `make deny` both0; the only lockfile addition is the local verifier package, with no external version or policy-ignore changes.
+
+Independent reviewers recheck W295–W303 and find no further concrete in-slice defect. W303's immediate-admission and accepted-wire origins, W297's final publication fences, W298's physical witness, W299's flush and W302's narrow closure-kind oracle remain covered. Preserve every earlier failed log/root and the pre-admission full-log/source copies. Both final-source full gates and exact postconditions are now recorded below; host or focused observations alone were not used to close this task.
+
+**W304/P3 (evidence method, fixed before execution):** raw repository-prefix comparison could miss Docker Hub spellings of private/test aliases. Normalize `docker.io/`, `index.docker.io/`, `registry-1.docker.io/` and optional `library/` before checking the complete untruncated digest-inclusive inventory. Keep raw output and hashes; execute the assertion-based ephemeral observer using `python3 -I -B`, without optimization. No production source or resource test changes.
+
+**W305/P3 (evidence citation, fixed):** the historical pre-W303260-pass arm64 observation referenced the reusable final-log pathname. Point it to `/tmp/rustack-d92-pre-admission-full-arm64.log`; the corresponding preserved source projection's prefix hashes match both preserved architecture logs. Current final logs remain separate263-pass qualification evidence.
+
+
+### D92 final actual qualification and exact postconditions
+
+Both final frozen-source full-gate jobs terminate0 and are joined in `/tmp/rustack-d92-full-{arm64,amd64}.log`. Each executes every frozen required resource name successfully exactly once: ordinary30/core9/environment7/executor1/endpoint4/probe2/wire5/relay5,63 total in eight suites. Each log has263 aggregate Rust passes/20 summaries:63 resources,196 pure code/consumer controls and four retained controls. Its single ignored preflight entry is the real recovery case subsequently executed explicitly in core9. No required resource is skipped. The exact manifest was checked before actual execution; no production, Makefile or fixture artifact changed during these final runs.
+
+Four signed ordinary SDK cohorts prove provided ZIP deployment/revision/alias and ASL behavior, cold/warm computation, RO code and bounded writable tmp, initialization/error/exit/timeout and causally observed initializing/busy cancellation. Two management-IO resources additionally prove retained cleanup at accepted allocation and deletion barriers. The separate actual Linux Native verifier consumes the identical original A ZIP: all four SDK observations, the Native observation and final original file hash agree on each engine. Arm64 A is `XPlTHoxuDDliBZiXMHsz/Mo0Nulel2mlSWI0sC/rMBg=`; amd64 A is `3kCIFxNit1k7hdojXS/Us3SBcLAL7mMdrY2iXJBo6wE=`. Native computes42/46, reuses its actual child and positively joins it and observes `/proc/PID` absence before exiting. The verifier's exec tmpfs is separate from production Lambda isolation.
+
+`/tmp/rustack-d92-source-build-exports.json` captures both exact final full-log prefixes, byte counts/hashes, five explicit named build-export IDs with line numbers, four unchanged prebuild references and final full-log hashes. The final nine sources include the separately pinned provided.al2023 base. Raw initial/post-provisioning inspections remain under `/tmp/rustack-d92-{prebuild,provisioned}-{arm64,amd64}.json`. Final preservation compares actual gate-provisioned IDs; it does not assert that the five deliberately rebuilt tags retained their earlier prebuild IDs. The earlier pre-admission source projection and full logs are separately preserved and prefix-verified.
+
+`/tmp/rustack-d92-postconditions.json` is complete:26 successful CLI observations/mutations with raw stdout/stderr and hashes, expected engine IDs, complete all-state container absence, zero all volumes/private-code volumes, zero normalized runtime-private/test-source/alternate-pull references and nine distinct actual source IDs preserved per engine. Before unforced removal each bridge is rechecked against its exact engine/full ID/name/full nonce/bridge driver/local scope/empty attachments. Complete network inventories then prove absence. Only those two current owned bridges are removed; daemons, source cache and historical failure roots remain. The first observer invocation used the host Python3.9, which rejected `zip(strict=True)` before any CLI call or mutation. The successful invocation explicitly uses the provisioned Python3.13 interpreter with `-I -B` and enabled assertions. This interpreter error is not a resource failure or cleanup observation.
+
+W295–W305 are fixed and independently rechecked: eight P2 and three P3, with no remaining concrete in-slice finding or P0/P1 finding. Host/strict/Native/security gates above are final-source evidence; all qualification/cleanup jobs are terminal and joined. Both retained lanes establish functional scope: native-arm64 VZ and emulated-amd64 QEMU. They do not establish native-x86/reference, Desktop/rootless or complete platform/release acceptance. The original transient published-A exit0 is not retrospectively attributed without its missing stderr; W299 fixes the independently demonstrated buffered-write race and all final frozen consuming runs pass.
+
+Task5.1c and the provided-runtime execution task5.1 are complete. Docker ZIP archives5.2c are next; they must reconcile bounded payload/export/candidate validation before lifting current archive rejection. Node, handler SDK/callback images, consuming-project/IaC, server-in-container, reference/platform and full M0–M4 acceptance remain active.
+
+Final text checks validate493 relative links and241 fragments across14 workflow spec/guide/index files with zero errors; working and staged whitespace checks pass.
+
+
+## P5 managed ZIP archive preflight (D93)
+
+The following preflight findings were recorded before production changes; final qualification remains in progress. **W306/P2 (independent spec preflight):** compressed-byte/revision caps do not bound retained extraction of repeated highly compressible code. Add a complete candidate512MiB expanded logical byte/20,000 materialized node budget, including three private wrapper nodes per artifact and counting each revision. Charge shared validated tree/declaration measurements before allocating each artifact and limit actual extraction to its charge. Exhaustion rolls back the candidate before any Image pin. Preserve D89 per-ZIP limits; test small exact/over aggregate cases without allocating production-sized bombs.
+
+**W307/P2 (raw-boundary spec preflight):** stripping ZIP bodies from an owned DTO cannot account for unknown CBOR fields that typed serde decoding already ignored. A128MiB service cap alone would let arbitrary fields borrow the enlarged ZIP allowance. Add a Lambda-specific schema-path policy to the existing raw CBOR scanner before typed allocation: only the exact latest/published version body paths can bypass the16MiB metadata charge, with bounded headers, keys, other scalars, nodes and depth. Keep generic codecs/limits and Native/Squib behavior unchanged; Image-only Docker uses zero body exemptions and its existing cap/schema; test misplaced keys/unknown fields with a Deserialize sentinel before any typed visitor runs.
+
+**W308/P2 (original-deadline spec preflight):** current store restore calls each version's independent30s staging operation without the original import cutoff. Add an internal deadline-aware path and final pre-registration fence, preserving public Native/Squib behavior. Accepted blocking extraction retains only private source/TempDir/admission and no late store publication capability; caller expiry cannot be treated as worker settlement. Carry the same cutoff through candidate versions, conversion, pins and final publication. No D93 code is written before these contracts are executable.
+
+
+D93 development: the first raw-codec run passes97 cases and fails the duplicate-key negative fixture before reaching the new observer, because its helper used the generic validating encoder. Construct malformed duplicate CBOR with the independent raw Ciborium writer instead. The second run passes all98 raw-codec controls; the first core run passes1,209/9 gated. These are component observations, not full D93 qualification.
+
+**W309/P2 (implementation review):** D89's public converter rejects remaining deadlines over600s, while archive import allows3,600s. Passing a long original import cutoff directly rejects valid ZIP candidates as Configuration. Clamp each converter observation to min(original import cutoff, now+600s), keep the unchanged original aggregate cutoff through staging/pins/commit, and recheck it afterward. Add a valid3,600s-budget ZIP restore regression. The clamp preserves the existing converter profile rather than weakening deadline validation.
+
+
+**W310/P2 (implementation review):** generic image-error wrapping misclassifies pure ZIP converter InvalidCode/TooLarge as infrastructure500. Map these input classes to the static candidate InvalidParameter while preserving deadline/worker/allocation/stopped infrastructure errors. Candidate tests must pass checksum-valid non-ELF and wrong-ELF-target bytes through actual staging/conversion, assert the public class and no Tag, and preserve the old complete store.
+
+
+**W311/P2 (implementation review):** compressed-byte-only export could publish highly compressed/repeated ZIP rows that exceed the512MiB/20,000-node restore profile, replacing a usable generation with an unrestorable archive. Reuse the exact read-only ZIP measurement and aggregate charging in admitted borrowed export before constructing/publishing its result. Count every revision and wrapper; test source sharing does not bypass aggregate expansion/nodes and a failed actual save preserves current/previous generations. This must not extract code or create Docker effects while measuring export.
+
+
+D93 controlled qualification progresses: raw CBOR98, source/metadata31, retained staging7, complete candidate23 and actual SnapshotConfig producer3 cases pass. The first candidate-test build exposed private fixture visibility/import alias errors, then one invocation used the filename instead of the compiled module filter and selected zero cases; neither is evidence of execution. The correct `deployment::manager::tests::restore` run executes23, including the long-budget, pure ELF classification and post-preparation source revocation controls. Initial Clippy rejects padding style, let-else and two overlong functions; extract shared alias/EOF helpers and fix style without new allowances. The first producer test build lacked its explicit `ensure` macro import; the corrected three cases pass.
+
+The exact65-resource/eight-suite compiled inventory is frozen and verified before first actual archive execution. The first arm64 focused gate passes the positive mixed ZIP/Image save/restart/original-hash/history/no-replay/cold-warm/checksum-valid-corrupt refusal resource. Its no-source resource reaches the intended raw CBOR rejection with both generation fingerprints unchanged, but the outer fixture wrongly expects the already-successfully-stopped source server to exit unsuccessfully. Correct only the source shutdown oracle (`no_source` means source success; the separate consumer still requires failure). Preserve `/tmp/rustack-d93-archive-first-arm64.log` and both retained source/consumer roots; the failed resource is not counted as qualified. The generic snapshot cleanup diagnostic repeats the primary rejected import and does not by itself establish a distinct physical cleanup defect. Both namespace audits ran; full final postconditions and requalification remain mandatory.
+
+
+**W312/P2 (self-audit, independently confirmed):** managed export checked its global metadata profile only after constructing the owned DTO from128MiB JSON. Per-record65,536-node guards reset across functions, allowing millions of owned dynamic nodes before eventual rejection. Bound global metadata before DTO construction using a16MiB borrowed metadata-only projection, masking only exact version body values as null without invoking those serializers. Support flattened SerializeMap as well as SerializeStruct, bounded keys and existing global JSON limits; retain final whole-profile validation. No new parser/global-limit relaxation or all-store guard collection. Add cross-function aggregate-node, oversized live ancillary-string and non-exempt lookalike controls. Both second focused arm64 archive resources pass before this additional source hardening; final-source qualification must rerun after it.
+
+
+Independent final source review clarifies fresh-runtime wording without a runtime change: ordinary process restart creates a new pool and code/environment ownership, and archive import cannot resurrect serialized live resources or replay work. Existing D88 quiescent in-process library imports retain eligible same-runtime D92 cache behavior; importing metadata alone does not force a process restart/cache epoch. The ordinary resource asserts restart/fresh-pool behavior. The second focused arm64 run passes both resources in `/tmp/rustack-d93-archive-second-arm64.log`; this precedes W312, so it remains focused development evidence rather than final-source full qualification.
+
+
+**W313/P3 (final fixture review):** the archive SDK helper checked its90s cutoff only for RUNNING responses, accepting a late terminal success. Fence immediately after every Describe response before accepting either running/terminal data. Four monotonic-clock controls cover on-time, exactly-expired, late-terminal and late-after-RUNNING outcomes without sleeping/network retries. Include them in the existing Make archive preflight; final-source actual gates must consume the corrected observer.
+
+### D93 final actual qualification and exact postconditions
+
+**W314/P3 (final evidence/documentation review):** the current specs index overview still described all Docker ZIP archives as rejected, contradicting D93 and its own new entry. Reconcile the overview with configured managed-ZIP support versus Image-only rejection, and remove the guide's stale opening ZIP limitation. These text corrections do not alter frozen source or test evidence.
+
+Both frozen-source full jobs terminate0 and are joined in `/tmp/rustack-d93-full-{arm64,amd64}.log`. Each executes every required resource successfully exactly once: ordinary32/core9/environment7/executor1/endpoint4/probe2/wire5/relay5,65 total across eight suites. Each log contains438 Rust passes/25 summaries:65 resources,369 pure code/consumer controls and four retained controls. The single ignored preflight recovery entry is subsequently executed explicitly in core9; no required resource is skipped. Four monotonic-clock Python controls also execute in each preflight. No Rust, Makefile, Python or fixture artifact changes during these final runs.
+
+The two new ordinary resources qualify a mixed provided-ZIP/Image snapshot, complete function/version/alias metadata and original hashes, terminal execution/history preservation, restart without replay, fresh cold/warm computation and checksum-valid invalid-code rejection. Current and previous generation fingerprints remain unchanged after failure. A separately owned image-only consumer rejects managed ZIP input before ingress without weakening its scalar limit or altering either generation. Its source server has already stopped successfully; the failing consumer is observed and audited separately. Failure retention and both cleanup attempts survive outer observer expiry.
+
+Seven signed SDK observations per lane, the separate Linux Native observation and the current original A ZIP file agree exactly. Arm64 A is `XPlTHoxuDDliBZiXMHsz/Mo0Nulel2mlSWI0sC/rMBg=`; amd64 A is `3kCIFxNit1k7hdojXS/Us3SBcLAL7mMdrY2iXJBo6wE=`. These include four retained ordinary deployment/fault/cancellation cohorts plus archive positive prepare/verify and negative-source preparation. The Native verifier joins its real child; this does not certify the production Docker temporary-storage policy through its separately executable verifier mount.
+
+Pure archive qualification executes42 source/projection,7 private staging,23 candidate,98 raw-CBOR and3 actual SnapshotConfig producer cases:173 Rust passes, plus four clock controls. `/tmp/rustack-d93-archive-boundaries-first.log` also includes the complete strict production boundary gate:1,917 Rust passes/33 separately gated, giving2,090 passes/25 summaries overall. `/tmp/rustack-d93-standard-first-report.json` records all nine standard commands0: ordinary and feature-enabled workspace builds/tests/Clippy, nightly formatting and denied-warning rustdoc. Test totals are4,166/428 gated and4,281/485 gated. `/tmp/rustack-d93-native-first.log` completes the unchanged26-resource Native inventory and its full verifier,3,077 passes/19 gated/41 summaries. `/tmp/rustack-d93-security-final-report.json` records audit and deny0; no external dependency version, feature or policy changes are introduced.
+
+`/tmp/rustack-d93-source-build-exports.json` records each complete full-log hash plus the captured prefix before its first required resource, byte count/hash and five explicit build-export/name line pairs. Four additional references retain their independently captured prebuild IDs, including the immutable Node and provided bases. Raw prebuild and post-provisioning inspections remain in `/tmp/rustack-d93-{prebuild,provisioned}-{arm64,amd64}.json`. Preservation compares the nine actual full-gate-provisioned IDs rather than asserting that deliberately rebuilt tags retain earlier IDs. Final log SHA256 is `ee5555e109dac4e0ee9779910e3238b305d4391b321821cf4c86c29862bd46ce` for arm64 and `e8358fb06d7cbe22a82d2507477dd527bd284e02ffe887935114355d6b560f7a` for amd64.
+
+`/tmp/rustack-d93-postconditions.json` is complete:26 successful CLI observations/mutations with retained raw stdout/stderr and hashes. Expected engine IDs, full all-state container inventories, all-volume inventories and normalized full image inventories prove zero containers, volumes/private-code volumes or runtime-private/test-source/alternate-pull references. All nine distinct actual source IDs survive on each engine. Immediately before each unforced bridge removal, the observer rechecks the exact engine, full network ID/name/nonce, bridge driver, local scope and empty attachments. Complete network inventories then prove absence; sources and volumes are rechecked after removal. Only those two current owned bridges are removed. Source cache, daemons and failed development roots are retained. The observer uses provisioned Python3.13 with `-I -B` and assertions enabled; its pre-execution independent review reports no concrete defect.
+
+W306–W314 are fixed and independently rechecked: seven P2 and two P3, with no P0/P1 or remaining concrete in-slice finding. Recorded failed/zero-selection/development observations above remain chronological evidence and are not counted as final-source acceptance. Both retained lanes establish functional scope: native-arm64 VZ and emulated-amd64 QEMU. They do not establish native-x86/reference, Docker Desktop/rootless, handler SDK/IaC/server-in-container or complete platform/release acceptance. Task5.2c is complete; official Node execution and the remaining M4 consumers are next.
+
+Final text checks validate501 relative links and249 fragments across14 workflow spec/guide/index files with zero errors. Working and staged whitespace checks pass; no new incomplete-code markers or dead-code suppressions are added.
+
+## P5 official Node consumer preflight (D94)
+
+**W315/P2 (independent spec preflight):** the new Node acceptance wording required immediate warm reuse after FunctionError, contradicting the existing error-retirement contract. Before writing code, require HTTP200/Unhandled with NodeFixtureError, then a fresh healthy replacement counter1 followed by warm counter2. Preserve separate successful cold/warm observations. This corrects the new consumer oracle rather than changing runtime policy; final qualification remains pending.
+
+**W316/P2 (independent source review):** an outer480s timeout could drop a late-started SDK Runner wait before it explicitly reaps its child. Split timed preparation from SDK execution: create the child outside the droppable preparation observer and pass the same original cutoff through PID handshake and joined child wait. Always join after a failed/late handshake before returning its error; server shutdown follows that join. Add a late-start held-child control proving forced join and PID absence.
+
+**W317/P3 (independent source review):** disable automatic Node server evidence-root cleanup immediately after acquisition, before any observer await. Re-enable it only after successful primary execution, server shutdown, namespace/source audit and diagnostic scan. Panic/cancellation must retain the ownership/evidence root for recovery.
+
+**W318/P3 (control review):** the positive PID barrier in the new held-child control must not return with `?` before cleanup if that barrier fails. Save its Result, always call the same joined SDK owner, then check the saved barrier and final report/PID absence. Test setup is subject to the same explicit child-retirement ordering.
+
+The first actual arm64 Node resource in `/tmp/rustack-d94-node-first-arm64.log` passes Rust SDK and boto3 arithmetic/warm/context/filesystem/log/publication/CMD isolation, then fails its intentional error Invoke with ServiceException/exit139/oom=false. It is not qualified. SDK joins, server stop and audits execute; evidence root `/var/folders/dp/zvkhkbns7fqcy8l3hpdtjhcr0000gn/T/.tmpuQjvMw` remains. The actual pinned image's59,187-byte `/var/runtime/index.mjs` has SHA256 `06a141ae1969525fc8f2054894fff693f4691ca6072497154e60ed10ad21dd6d`; it calls the native error client with serialized X-Ray metadata. Its unstarted exact-label source-reading container was verified and removed, as recorded in `/tmp/rustack-d94-node-source-intent.json`.
+
+**W319/P2 (actual official-RIC consumption):** generic256-byte Runtime HTTP values reject the official Node error-cause header. An independently owned exact native-client probe captures388 bytes under `lambda-runtime-function-xray-error-cause`; its202 and431 exchanges both exit0, so that probe does not by itself attribute the observed139 to HTTP rejection. Add one exact error-route-only8KiB exception sharing the unchanged16KiB total, with opaque HTTP field bytes, no C0/DEL/duplicates, and no parsing/logging/persistence. Keep all ordinary limits unchanged. Pure and actual HTTP controls must preserve a pending ticket after rejected metadata and accept/deliver valid original error bytes; requalify the ordinary Node resource and both complete rebuilt-relay gates. `/tmp/rustack-d94-node-error-probe.json` retains request/header lengths, body hashes, statuses, exact identities and both removed probe containers.
+
+The first Runtime HTTP run passes25/26; its aggregate-bound positive fixture miscounts the40-byte cause header name by two bytes. Correct the independently fixed exact16KiB construction:8,192+40 plus thirty263-byte fields and one262-byte field. The second run passes25/26 and exposes W320 through the new raw control-byte case; neither failed run is final qualification.
+
+**W320/P2 (raw HTTP negative regression):** Hyper rejects DEL/C0 header syntax, but connection() classifies every non-timeout parse error as fatal and closes the shared session/listener. A subsequent request sees connection refusal instead of preserving the pending attempt. Treat the explicit bounded Hyper `is_parse()` class as per-connection rejection, retaining genuine IO/driver/supervision failure behavior. Keep actual parsing limits unchanged and test invalid raw header→4xx→same valid attempt succeeds. This closes a concrete error-consumption boundary exposed by D94, rather than suppressing its negative test.
+
+The second/third arm64 focused runs pass named FunctionError and fresh/warm latest recovery, but the final ASL call fails Lambda.ServiceException. A fourth adds a direct published-alias call after recovery, which also fails Docker(Stopped); that string alone does not prove global wire failure. Fifth-run independently fenced daemon observations show published A already exited1 before latest B's error, ruling out the proposed B-error causal order. Its retained root is `/var/folders/dp/zvkhkbns7fqcy8l3hpdtjhcr0000gn/T/.tmpNmgpUo`. A sixth diagnostic attempts GET logs, unsupported by the configured none log driver; this masks the original failure and is not qualification. Remove that unsupported diagnostic rather than relying on Docker log history.
+
+**W321/P2 (actual default Node keepalive consumption):** the explicitly joined, read-only exact-owner live-attach diagnostic captures A's native get_next error: endpoint returned no response, then Node24.22.1 exits1. `/tmp/rustack-d94-node-live-monitor.{json,bin}` retains the bounded stream and joined observer; its wrapper run is diagnostic only. The inspected official reference RIC v4.0.2/commit9ab0fac53c768d6d8901dca9788c729d8eba94ec uses a NAPI AsyncWorker for next and its bundled C++ source has a thread-local cURL handle. This reference inspection explains the client demand; it is not a claim that this tag is an exact source attestation for the pinned image’s native binary. The219,968-byte dependency archive SHA256 is `2da711fd0c85b8491cc4a3bf86fc9b8b1e48330e8e837c631216c98943f0fa7e`. Four default libuv GET workers plus main-thread POST can retain five normal sockets, but Runtime API's four-connection guard drops the next accepted socket without a response. Extend bounded connections to eight and independently retain four POST body-reader permits, preserving the prior24MiB body-work ceiling and single-poll/invocation semantics. Add an actual five-keepalive regression and quota/release controls, then rebuild/requalify both complete lanes. Do not force Node's worker count down or bypass its ordinary RIC.
+
+**W322/P3 (keepalive control review):** retaining five client handles alone cannot exclude older sockets expiring under the five-second header timeout on a slow test host. Capture one original four-second cutoff before the whole sequence, use it for every head observation and require the complete five-connection proof before it. This prevents the old four-slot implementation from passing through idle-slot recycling.
+
+The seventh arm64 focused resource passes the complete ordinary signed Node scenario on24.22.1, including published A remaining usable through B's named FunctionError/replacement, direct alias counter4 and registered ASL counter5. All28 Runtime HTTP controls and the joined late-child/three Python observer controls pass; independent source review reports no remaining concrete finding. Both full66-resource jobs start with production/consumer fixtures frozen.
+
+The first full host gate's all-target Clippy finds the enlarged diagnostic-redaction unit test at122 lines. Extract its identical private-error observation into a helper only in the cfg(test) HTTP test module, without changing predicates or production/resource consumers. Current28 HTTP tests and all-target runtime Clippy pass afterward; restart the complete standard/strict/Native/security host sequence. `/tmp/rustack-d94-resource-frozen-before-unit-refactor.json` captures production/Make/Node SDK/resource sources and exact resource executables before that unit-only refactor; recomputed hashes remain equal. Final evidence must distinguish this separately rechecked test-only extraction from the production/consumer-frozen actual runs rather than claiming no Rust file changed.
+
+The preceding arm64 full run completes66 exact resources/468 passes/27 summaries. The concurrent amd64 run receives SIGTERM and terminates143 during IO case06; both existing dedicated Colima profiles are then observed Stopped with missing sockets. No source of that external stop is inferred. Preserve both logs and source projections as `/tmp/rustack-d94-pre-interruption-*`; the interrupted cohort is not complete qualification. Restart only those original profiles with activation/config saving/global SSH generation disabled, preserving their configuration and Docker's default context.
+
+The first post-restart audit stops on one retained created amd64 relay, ID `83ec3f0a66945952e6b4fad57242d6b20bbce10c1a704e48d9929423f70344cc`. Its owner matches the checksummed owner/daemon journals in `/var/folders/dp/zvkhkbns7fqcy8l3hpdtjhcr0000gn/T/.tmpQA358y`. Preserve the namespace files before invoking the current production coordinator against that same DATA_DIR and bound daemon. Its disconnected startup reconciles recorded historical resources, reaches ready and then joins normal SIGTERM shutdown with exit0 and unchanged owner hash. No manual container deletion, label-only adoption, ownership reset or global prune is used. `/tmp/rustack-d94-interrupted-recovery.json` and its log retain the result; accessible temporary owner files were searched, with unrelated OS-protected temporary directories outside that observation.
+
+The complete `/tmp/rustack-d94-resumption-audit.json` subsequently records12 successful CLI observations: original engine IDs, ten pre-interruption source IDs preserved per engine, zero all-state containers/all volumes/normalized private references and both exact original D94 empty bridges. Profile configuration hashes and Docker's default context remain unchanged. The initial failed audit/raw outputs remain separately preserved. Start fresh full gates on both engines only after this recovery proof. `/tmp/rustack-d94-final-code-seal.json` captures12 executable/source/Make/manifest paths including the diagnostic unit-helper extraction before these fresh runs; final postconditions check every hash before any effect. Final qualification must use the complete fresh cohorts rather than splice successful resources across interruption boundaries. Standard second-pass4178/4294, strict1929 and Native3077 gates pass, with audit/deny0; actual fresh resource/postcondition qualification remains pending.
+
+**W323/P2 (independent cancellation audit):** SessionHandle receive() can reach its deadline after try_send accepted a Complete/InitError payload into the eight-slot mailbox. A lexical HTTP permit then drops although that payload remains queued; new POSTs can exceed the promised four-body work bound. Peer EOF itself closes the session and does not prove this nonfatal replacement path. Transfer an owned HTTP permit into each accepted envelope and retain it through processing/rejection/drop, independently of its observer. Add deterministic held-actor controls for both commands, timeout/abandonment, queue rejection and actor disposal. Preserve the already-running full cohorts as pre-fix evidence and requalify the corrected frozen sources; D94 remains open.
+
+Both pre-W323 full cohorts finish successfully and are explicitly joined:66 exact resources/468 aggregate passes/27 summaries each. `/tmp/rustack-d94-pre-permit-postconditions.json` records12 successful read-only CLI observations, zero all-state containers/volumes/private references, ten actual sources preserved and the original two exact empty bridges retained for corrected requalification. Logs, source projection/raw inspections and the12-path code seal are preserved under `/tmp/rustack-d94-pre-permit-*`; they do not qualify W323. The applied fix passes209 Runtime library tests including14 new controls. Its first all-target Clippy run rejects enlarged dispatch length; extracting the unchanged invocation-ID parser restores Clippy0 and the full209 tests pass again. No lint waiver or dependency change is introduced. Final W323-corrected full/host gates remain required.
+
+During goal-control continuation, both original tool session handles become unavailable. Host process inspection confirms the original corrected amd64 make PID44773 remains live under PID1 and both VMs remain running; it is not restarted or signalled. Its kernel EVFILT_PROC NOTE_EXIT/NOTE_EXITSTATUS observer registers against the same UID/start-time/executable identity and validates status decoding with independently owned/joined exits0 and17. The first observer attempt fails before registration because kqueue lacks a context manager; explicit contextlib.closing corrects that setup. The corrected arm64 log already reaches the final success banner, but its original join receipt is unavailable; preserve it and its source projection under `/tmp/rustack-d94-lost-handle-*`, then run arm64 again under a retained Popen owner with an atomic exit receipt. Final postconditions require the fresh owned arm64 exit0, original amd64 kernel-confirmed exit0 and both exact process PIDs absent before Docker observations/effects. This preserves scope rather than restarting the still-running amd64 job or describing a missing handle as termination. Qualification remains pending those final receipts and complete logs.
+
+Current corrected host qualification is complete in `/tmp/rustack-d94-final-host-report.json`: all nine standard commands exit0; ordinary/feature workspaces4,192/4,308 pass (428/486 gated,81 summaries each), strict boundaries1,943 pass/33 gated/20 summaries, and full Native verifier3,077 pass/19 gated/41 summaries. Audit/deny both exit0. The fresh owned arm64 full gate finishes with exit0 receipt and explicit Popen wait; all66 resources/482 aggregate passes/28 summaries pass. Its log SHA256 is `fa49555de70d26889549ca0d032ae608b51eef0b82502231a6d7090d9ffc3740`. The original amd64 full process remains live, so final two-lane/postcondition acceptance remains pending. The14-file code seal remains unchanged.
+
+### D94 final qualification and exact postconditions
+
+Both final corrected full logs pass all66 frozen exact resources once,482 aggregate Rust cases/28 summaries each (416 non-Docker Rust controls and66 required resources). Preflight's one ignored recovery resource is explicitly executed afterward in the nine-case core suite. The seven signed-SDK observer clock controls (four prior and three Node) also pass. All28 Runtime HTTP controls,14 deterministic body-admission retention/rejection cases and the held late-child join control pass. Official Node reports24.22.1; actual signed Rust/boto3/ASL cases prove cold/warm arithmetic, context/architecture/UID, EROFS/private temporary storage, stdout/stderr tail, captured version/alias after CMD update, named FunctionError with replacement and original published-A continuation through ASL.
+
+The final arm64 gate uses the persisted owned Popen wait and exit0, with the wrapper also explicitly joined. Original amd64 make is not restarted after its tool handle disappears: the same registered process yields a kernel NOTE_EXIT/NOTE_EXITSTATUS exit0, its original PID is absent, and the read-only observer itself is explicitly joined. This is kernel-confirmed exit observation, not this observer's waitpid/reap of a nonchild. Both exact PIDs are absent before postconditions. The failed first kqueue setup, lost-handle completed arm64 log, pre-W323 complete logs and prior VM-interrupted/diagnostic evidence remain separately retained and are not spliced into the final cohorts.
+
+`/tmp/rustack-d94-source-build-exports.json` records six explicit named build exports plus four unchanged prebuild references per engine, ten distinct actual provisioned source IDs and checksummed full-log/prefix/raw-inspection provenance. Rebuilt relay identities include the accepted-envelope fix; preservation compares these actual IDs rather than assuming deliberately rebuilt tags equal older ones. Prefix capture precedes the first printed required name (a gated preflight recovery case), and separately derived execution-prefix counts prove416 non-Docker Rust control passes in20 summaries with one gated case before the first actual resource. All14 executable/source/Make/manifest seal hashes remain unchanged throughout final qualification. Final full-log SHA256 values are arm64 `fa49555de70d26889549ca0d032ae608b51eef0b82502231a6d7090d9ffc3740` and amd64 `7c52f714275b301d3afa34f69e31e50a18f4f3e267e80d721c8297facc51f273`.
+
+`/tmp/rustack-d94-final-host-report.json` checksums the current complete standard/strict/Native/security reports and logs: nine standard commands exit0; ordinary/feature workspace4,192/4,308 pass with428/486 gated and81 summaries each; strict boundaries1,943 pass/33 gated/20 summaries; complete Native verifier3,077 pass/19 gated/41 summaries; cargo audit and deny both exit0. Native scope is independent and does not certify Docker platforms.
+
+`/tmp/rustack-d94-postconditions.json` is complete:26 successful Docker CLI observations/mutations with raw stdout/stderr hashes. It checks both execution receipts, process absence, all14 code hashes and complete exact logs before Docker work. Fresh expected-engine/full all-state container/all-volume/normalized image inventories prove zero containers, volumes/private code volumes or runtime-private/test-source/alternate-pull references. Ten actual source IDs survive per engine before and after cleanup. Immediately before each unforced bridge removal, recheck the exact engine, full bridge ID/name/nonce/driver/local scope and empty attachments; complete network listings then prove absence. Only the two original D94 owned bridges are removed. Preserve source cache, daemons, profile configuration and all unresolved/failed evidence roots; no global pruning.
+
+W315–W323 are fixed and independently rechecked: six P2 and three P3, no P0/P1 or remaining concrete in-slice finding. Two final read-only source/observer reviews find no additional defect. Final guide/index/link/whitespace and seal checks pass. Task5.3a/L02 is complete on native-arm64 VZ and emulated-amd64 QEMU functional lanes. Native-x86/reference, Desktop/rootless, handler SDK/callback images, IaC/server-in-container and complete M0–M4 release acceptance remain required; no complete-goal claim is made.
+
+Final text checks validate509 relative links and257 fragments across14 workflow spec/guide/index files with zero errors. Working/staged whitespace checks and the14-file executable seal pass. No new incomplete-code marker, dead-code suppression, dependency/version or lockfile change is introduced.
+
+## P5 explicit local handler SDK qualification (D95)
+
+**W324/P2 (independent design preflight):** endpoint/secrets/a random context UUID alone do not prove affiliation when DockerExecutorConfig is public/cloneable. Require the exact retained readiness Arc and directory acquisition, bound network/policy, live relay and environment service at construction/plan admission. The existing private readiness holder retains/rechecks actual resource/network/endpoint instance proof. Add cloned foreign-scope/revocation controls before any create; the nonsecret warm identity never substitutes for authority.
+
+**W325/P2 (source-backed environment preflight):** deleting selector map entries can let the daemon re-inherit poisoned image defaults. Emit existing bare-name Env deletion markers instead. Vendored historical Moby commit.go/env.go explain the merge/unset semantics; no exact Engine-source attestation is claimed. Preserve existing marker tests and require actual poisoned-image SDK consumers on both retained engines.
+
+The independently owned bounded source reader creates one exact D95-labelled read-only/network-none container on the already pinned Node source, never starts it, reads at most128KiB per package TAR with at most one regular64KiB package.json, and verifies actual S3/DynamoDB/SFN package versions3.1105.0. It checks expected engine/name/image/nonce/unstarted/no-mount identity before unforced removal, then proves zero containers and preserved source ID. `/tmp/rustack-d95-sdk-source-intent.json` retains command/raw/package hashes. This is source metadata evidence only. At that preflight, production implementation and task5.3b acceptance were pending.
+
+**W326/P2 (independent foundation source review):** materializing SDK Env/warm identity without retaining its proof lets an already prepared plan reach create after SDK readiness is revoked. Retain a private secret-free SDK liveness guard in EnvironmentPlan and recheck it in the existing live() fence before create/health boundaries. Add prepared-plan→revoke→both-create controls requiring immediate Stopped and zero RPCs; accepted uncertain IO remains with normal retirement. The initial23 foundation additions/all834 Docker-core passes did not cover this prepared-plan boundary and are not final acceptance.
+
+**W327/P3 (shared SDK observer preflight):** the prior Node poll checked only after read(), so an expired observer could dispatch one extra read after its cutoff. D95 shares a before-dispatch/after-response poll and bounded closing JSON Invoke reader across both consumers. Add expired-initial/no-dispatch and expired-after-running/no-next-dispatch controls, preserving the late-terminal controls. The SDK child remains owned and joined through its original cutoff.
+
+D95 development:24 foundation controls pass, including W326 prepared-plan revocation; all24 executor cases and strict core-library Clippy pass after the guard fix. Shared observer5 and SDK consumer5 Python controls pass. Expanded CLI compilation exposes an existing DynamoDB-only unused-mut binding when Streams is absent; shadow the provider as mutable only under the Streams feature. The first new fixture Clippy command unintentionally applies explicit pedantic flags to generated S3 dependencies (362 documentation diagnostics); align this target with the repository's existing --no-deps target-lint pattern while retaining the separate full-workspace standard and strict-boundary gates. No lint waiver, dependency or generated model change is introduced. At that stage, actual SDK consumers and all final gates were pending.
+
+**W328/P2 (independent SDK fixture review):** checking the abort signal only after for-await yields does not itself interrupt a quiet GetObject body after headers. Bind the same signal directly to the returned Node readable; add an owned held-header/quiet-body control which removes request-stage abort handling and requires prompt helper-driven rejection/destruction. Keep the original SDK budget and joined stream/client ownership.
+
+**W329/P3 (independent acceptance review):** unchanged captured Env plus GetFunctionConfiguration does not execute the promised archive-projection omission oracle. Add a real provider export/projection component control while the SDK-configured function exists, proving no injected key/secret is serialized and original user Env remains intact. No extra Docker resource is needed.
+
+**W330/P2 (first focused ARM preflight):** differing server AWS aliases conflict with explicit ACCESS_KEY/SECRET_KEY and correctly fail before readiness, so the original positive setup cannot exercise SDK precedence. The first focused cohort exits2 before any handler invocation; its owned Make receipt/log are preserved. Keep consistent valid server aliases in both profiles, poison the image credential pair for the positive path, and retain the deliberately wrong explicit pair against valid server AWS values for the negative no-fallback path. Pure lookup tests independently prove zero ambient lookup. This corrects the acceptance setup without relaxing the existing alias validator or changing production authentication.
+
+W329 refinement: the component must call the installed `export_snapshot_before(deadline)` producer with real image-preparation admission, not only the legacy unchecked export. Retain the secret-bearing SDK plan during bounded export, assert user Env preservation/credential omission, then join provider, image owner and fixture shutdown. The earlier25-control passing legacy-export cohort is development evidence only.
+
+The corrected focused ARM cohort passes both exact SDK resources, including actual default-provider clients3.1105.0, quiet-body cancellation, independent cold/warm S3/DynamoDB observations and precise negative authorization failures. The first standard host cohort passes both builds/tests and formatting, then rejects four test-only style expressions (two unit-block semicolons and two equivalent concrete Default calls). Keep the live full-resource cohort source frozen until both owners join. Preserve its32-file resource seal and original test bytes; then apply only those reviewed style edits, retain exact old/new hashes/diff and rerun the current complete host/unit/strict/Native/security gates under a separate final seal. Production, consumer, Make and manifest hashes must remain identical. No full Docker rerun is required for those equivalent test-only expressions.
+
+**W331/P3 (independent final observer preflight):** comparing only final-seal entries can overlook an omitted resource-qualified path, and a terminal host-report status does not prove success. Require identical32-path inventories before accepting the single reviewed test-style delta. Before any CLI effect, verify all required host cohort counts, raw report/log hashes and every actual command's exit0, not only status=complete. Preserve both source seals and the test delta separately.
+
+**W332/P3 (feature-workspace Clippy):** Runner is included by both Docker and Native integration targets, so placing Docker-only join composition there creates unused code in the Native target. Move that exact PID-barrier/always-join body into the already shared Docker image_sdk module, preserving the original cutoff and failed-handshake cleanup. Both Node and SDK consumers call that one function; restore the lower-level Runner to its existing scope without a dead-code waiver or artificial Native caller. Preserve the completed68-resource source seal and exact reviewed relocation diff. Re-run the three affected Node/SDK resources on both engines, plus final current-source host/strict/Native/security gates; production runtime, image fixture, Make and manifest behavior is unchanged.
+
+### Final D95 qualification
+
+Both original owned full Make processes complete with exit0 and are joined before any source amendment. Each log contains all68 frozen resource names exactly once,509 Rust passes and29 summaries. Its pre-resource prefix contains441 non-resource passes/21 summaries and one gated recovery preflight; that exact recovery resource is subsequently executed. Both lanes report actual Node24.22.1 and two actual S3/DynamoDB client3.1105.0 observations. Seven original provided-ZIP digests match each lane's independent Linux Native digest and retained artifact. The full ARM log SHA256 is `366bfd5223cddfe7c02811067eefa19d0b9325eb245b121b81d1b031de70ce15`; AMD is `10514408de528146a08cda32dbb48ab4ac7f603f875b45f228caf2b49f81a632`.
+
+The positive SDK resource proves quiet-body abort/destruction, cold21→42/warm23→46 through real default-provider S3/DynamoDB clients, independent literal host reads, stable warm identity and poisoned-image selector/credential override. The negative resource proves exact modeled AccessDenied/403 and AccessDeniedException/400 despite valid ambient server credentials, typed FunctionError, physical retirement and no business mutation. Both configuration API omission and the installed bounded archive producer's25-control component cohort keep the injected pair out of captured user Env/archives. The source-only SFN package observation is not a handler callback qualification.
+
+Preserve `/tmp/rustack-d95-resource-code-seal.json` and its32 source hashes. The final seal differs at exactly five reviewed paths: the executor test's two semicolons/two concrete Default types/imports; the equivalent helper relocation across runner/image_sdk/node; and an append-only Make target. All27 other hashes, production runtime/handler-image bytes, existing Make recipes and manifest are unchanged. `/tmp/rustack-d95-test-style-delta.json` and `/tmp/rustack-d95-consumer-relocation.json` retain exact old sources, old/new hashes and independently reviewed diffs. Runner returns byte-for-byte to HEAD. No dead-code suppression or artificial Native use is added.
+
+Both final-source `test-lambda-image-sdk-consumers-docker` lanes pass the same three exact affected resources plus controls:71 Rust passes/seven summaries/no gated case per lane. They run current Node/SDK controls and the complete compiled68-resource manifest without rebuilding images; this preserves recorded attestation-bearing source IDs. ARM current-consumer log SHA256 is `c9a96e447abda043b8034ccfa6058adf40921bd69f242e03a1ea74ac6702da7a`; AMD is `1798a1145ee3ae295a1d5428bee37e4aa31a24ee96393182ec9781165e156e34`. Both owned Make receipts complete0, both callers are joined and physical PIDs are absent. `/tmp/rustack-d95-final-code-seal.json` records all32 final hashes.
+
+Final host verification passes all9 standard commands: ordinary/feature builds and tests, nightly formatting, both workspace Clippy shapes and both rustdoc shapes with warnings denied. Workspace counts are4,217/4,333 (428/488 separately gated),81 summaries each. Strict boundaries pass1,969/33 gated/20 summaries; complete Native passes3,077/19 gated/41 summaries; audit and deny both exit0. The final third host owner completes/join-exits0 under the final seal. Standard/security outputs use the third suffix; boundaries/Native use their first suffix because the earlier host attempts stopped before reaching those gates. The final host report binds the actual paths, raw report/log hashes, all command results and final source seal. Failed first/second standard and first focused-alias cohorts remain development evidence, not qualifying final host/source claims.
+
+`/tmp/rustack-d95-source-build-exports.json` binds each full prefix to seven explicit named build exports plus four unchanged prebuild sources, eleven distinct actual source IDs and raw provisioned inspection hashes. `/tmp/rustack-d95-postconditions.json` verifies both original full receipts, both final consumer receipts, all final32 hashes, exact reviewed deltas and every required host command's exit0 before any Docker action. Its26 successful CLI commands prove expected engine identities, zero all-state containers/volumes/private or test/pull references, all eleven recorded sources preserved per engine, and retirement of only the two exact D95-owned bridges after repeated engine/full-ID/name/driver/scope/nonce/empty-attachment checks. The report SHA256 is `7a5670ac1816ed4aafb03069ad856c4f646354f82e9c6f18e0ffd1c4e403958e`.
+
+W324–W332 are fixed and independently rechecked: five P2, four P3, no P0/P1 or remaining concrete in-slice finding. Final source/evidence/text review and guide/index reconciliation close task5.3b/L10 on native-arm64 VZ/emulated-amd64 QEMU functional lanes. Image callbacks, IaC/server-in-container, native-x86/reference, Desktop/rootless and complete M0–M4 release acceptance remain required; the original full goal stays active.
+
+The final independent persisted-evidence recheck recomputes all52 CLI output hashes, both full/focused inventories, all32 final sources and both deltas, host results, eleven-source preservation and exact bridge authority/removal with no additional finding. Final text checks validate523 relative links/269 fragments across14 workflow spec/guide/index files with zero errors; working/staged whitespace checks pass. No new incomplete-code marker, lint waiver, dependency/version or lockfile change is introduced.
+
+## P4/P5 image callback preflight (D96)
+
+The source reader inspects one exact never-started read-only/network-none Node fixture on the expected arm64 engine and pinned D95 source ID. Actual client-lambda/client-sfn/client-dynamodb are3.1105.0 at /var/runtime/node_modules; Lambda package.json SHA256 is `9fc1448233071e07ca45e73406eb35561945a7f73ece5a9d683b0d9bdeaa0bab`. Exact engine/full-ID/name/image/nonce/Created/PID0/no-mount checks precede unforced removal. The final observation proves zero all-state containers/volumes and all eleven D95 source IDs preserved. `/tmp/rustack-d96-sdk-source-intent.json` retains raw command/package hashes and state=removed. This is metadata only; no callback function executes and no task4.3/5.3c completion is claimed.
+
+The polished design uses an independently accepted Event worker, safe DynamoDB phase/gate rows and default-provider SDKs, with existing token/timer/cleanup semantics. Production/fixture implementation, both focused/full70 lanes, final gates and independent review remain pending. Preserve D95's committed evidence and use new D96 report paths.
+
+**W333/P2 (independent image callback design preflight):** an unspecified64-hex regex can miss overlapping tokens in a longer hex run or a token split across decoder chunks; separate per-source counters can bypass the promised aggregate cap. Require every overlapping64-byte lowercase-hex window, either capped complete buffers or63-byte carry, and one65,536-candidate resource budget spanning histories/logs/archive. Exact/over multi-source caps and embedded/shifted/chunk-split leak controls must fail closed. Refine the observer contract before implementation; the callback engine is unchanged.
+
+W333 design refinement is independently rechecked with no further finding. The managed Node fixture and safe Python driver are implemented but not yet Docker-qualified; Node syntax and six independent Python privacy controls pass, including every shifted/split token and exact aggregate cap. The remaining Rust owner/audit integration, fixture manifest/Make consumers and actual lanes are still pending.
+
+**W334/P2 (fixture implementation preflight):** a case-wide return gate remains open after the first retry attempt, letting attempt1 return before its RUNNING/SDK evidence can be observed. Bind every gate to nonce+attempt, retain separate return grants and add a regression proving the first grant cannot release the next attempt. No callback resource has run; fix the consuming oracle before execution.
+
+
+**W335/P2 (independent Rust observer review):** raw ARN substring matching can qualify unrelated fields or invalid metadata. Validate the bounded v2 frame/CRC and typed terminal execution rows; add unrelated-field/empty-row and malformed-frame negatives.
+
+**W336/P2 (independent Rust observer review):** opening a FIFO can block before regular-file validation. Use asynchronous NONBLOCK/NOFOLLOW leaf opens, immediate regular-file checks and original-deadline IO; test a replaced FIFO. The existing private operator-owned ancestor/no same-UID mutation precondition applies.
+
+**W337/P3 (independent Rust observer review):** check both private injected values, local-key and local-secret, with separate leak controls and fixed errors.
+
+**W338/P3 (independent Rust observer review):** already-ready results observed after cutoff must fail. Retain/join the same bounded CPU job on timeout and fence post-join/final success; add a ready-but-late control.
+
+
+W334 and W335–W338 fixes are independently rechecked with no remaining concrete finding. The current fixture target passes eight Python controls, eight Rust audit controls and strict CLI Clippy without lint waivers. The observer uses asynchronous IO and owned bounded CPU jobs; typed framing/projection and deadline/privacy/special-file negatives pass. Two exact D96-owned empty bridges are provisioned after proving expected engine identities, zero containers/volumes and all eleven prior source IDs unchanged. Actual callback image/resource qualification and final host gates remain pending.
+
+
+**W339/P3 (first focused ARM startup):** the consuming assertion incorrectly requires the global dockerQualified release flag, which intentionally remains false until complete platform/reference acceptance. The first owned Make exits2 before creating/invoking either callback function; retained root and original log/receipt remain development evidence. Require actual ready Docker backend (already enforced by Server::ready), Lambda request/response support, callback support and dispatch1. Preserve the release flag and narrow functional qualification scope.
+
+
+The corrected second focused ARM owner completes0: both exact resources pass real SDK3.1105.0 causal/timing groups, with confirmed-save privacy and typed function/execution audits. The first focused AMD owner stops in a preexisting host-side code-volume unit before either Docker callback resource: its1s handoff deadline expires under parallel host/full-prefix load, then queued() correctly times out. The failed receipt/log are retained; no AMD image callback success is claimed. Keep current live owners/source unchanged until joined, then make that unit causally deterministic by admitting the handoff under a generous deadline and advancing the paused clock only after Ready is queued, as the neighboring handoff test does. Preserve the unpolled-waiter cleanup invariant and rerun current controls/resource/host gates.
+
+
+**W340/P3 (parallel fixture preflight):** a preexisting unpolled-Ready expiry unit uses a1s admission deadline before actual staging completes, so host scheduling load can expire preparation before the intended queued-handoff observation. Independent review confirms the deterministic replacement:30s admission for both cases, then pause/advance31s/resume only after actual Ready publication and retained-lease assertions. The waiter remains unpolled through physical retirement, release and final Deadline checks. Production budgets/semantics remain unchanged; apply only after current owners join and rerun current-source acceptance.
+
+
+Both original ARM full70 and original host owners complete0 and are joined before W340/import polish. The original full ARM passes519 Rust cases/30 summaries, all70 resources once; host passes all nine standard commands, strict1,969/33 gated/20 summaries, Native3,077/19 gated/41 summaries and audit/deny. These remain historical development evidence under the preceding40-path seal. W340 is then applied exactly as independently reviewed, and the audit follows specific-import conventions without algorithm changes. Final foundation controls pass, the complete41-path final source inventory is independently checked without omissions, and the final ARM focused two-resource owner passes. Final AMD focused and both current-source full lanes/host/postconditions remain pending; no complete D96 acceptance is yet claimed.
+
+
+**W341/P3 (independent final evidence-reader preflight):** strict zip only compares supplied lengths; two matching empty/short/duplicate lane inventories can bypass both-engine observations. Require exactly ordered arm64/amd64 inventories, distinct retained engine/socket/network identities, both completed engine records and all26 successful postcondition CLI results before complete. No cleanup has executed.
+
+**W342/P3 (independent final evidence-reader preflight):** revalidate the host owner receipt itself before Docker effects, not only its aggregate report. Require raw receipt SHA, complete0, matching final source seal and physical owner PID absence. The final host reader additionally asserts every exact command/doc flag and expected workspace/strict/Native count. No cleanup has executed.
+
+
+Final41 checkpoint: both focused-final owners complete0 and are joined, each passing the two exact callback resources,451 Rust cases/24 summaries and one nonexecuted recovery preflight (the complete resource gate executes it explicitly). Both actual SDK3.1105.0 groups pass all nine catalog modes. Final ARM full completes0 and is joined:519 Rust passes/30 summaries, with log SHA256 `6ca92e6b45752b72f3996625f2ed945e2ed7de5738a803b8176b7210cd4a2381`. Final host-second completes0 and is joined under unchanged41 source hashes: all9 exact standard commands, workspace4,217/4,341 (428/490 separately gated;81 summaries each), strict1,969/33 gated/20 summaries, Native3,077/19 gated/41 summaries, audit and deny. The final host report checks exact argv/doc flags, raw receipt/hash/physical absence and all counts. Source projection captures eight explicit named build exports plus four unchanged prebuild sources, twelve distinct actual IDs per engine and raw inspection/prefix hashes. W341–W342 reader fixes are independently rechecked clean before effects. Final AMD full remains live; exact zero-remnant postconditions, final source/evidence/text review and D96 closure remain pending.
+
+### Final D96 qualification
+
+The immutable final41-source cohort passes both complete owned Make runs and both focused runs. Every owner completes0 and is physically joined before postconditions. Each full log contains all70 frozen resource names exactly once,519 Rust passes/30 summaries, one gated recovery preflight subsequently executed in its required suite, Node24.22.1, both real S3/DynamoDB client3.1105.0 observations and both callback groups. Each focused run passes exactly two resources/451 Rust cases/24 summaries, including all nine actual Lambda/SFN/DynamoDB3.1105.0 callback modes. Full ARM log SHA256 is `6ca92e6b45752b72f3996625f2ed945e2ed7de5738a803b8176b7210cd4a2381`; full AMD is `9392eaa614a124c6e2182ae11b59cbd1b67aead6f04c2e56f805777ad04df252`. Final focused ARM/AMD hashes are `0e5fd29383ebb48afdb8fc2f2c5141072bf45c3fa8c0b79995984ec7d455869a` / `9185670b31ddf636d61366b19b8ed79bfdee078e38eb0306cf0f933f8c2e13eb`. The AMD full owner takes1,814.83s on QEMU; its original process/deadlines are retained throughout.
+
+Actual callbacks prove provisional early completion, late completion through an independently active Event worker after real TaskSubmitted, external failure, invocation failure winning over provisional success, retry0/1 with new hash/UUID and rejected old token, pre-return heartbeat no-op, post-return heartbeat reset, unchanged absolute timeout, heartbeat timeout and Stop cancelling only A while B survives until its stale callback is rejected and B is joined. An unrelated real Lambda workflow progresses through warm A with one dispatch slot while B waits. Reserved=1 marker-plus-probe settlement precedes successful graceful save. Both functions and actual terminal execution rows are retained and typed-decoded from valid v2 archives; bounded independent history/log/plaintext observations pass the aggregate candidate/byte/depth/file/privacy budgets and omit both injected credential values. Existing Native/public wrong-scope and prior Node/SDK cases remain green.
+
+The same41 source hashes qualify all final host commands. The second host owner is joined with complete0; its raw receipt binds the seal before/after execution. The final report asserts exact9 standard argv/doc flags and successful command results, ordinary/feature workspace4,217/4,341 (428/490 separately gated;81 summaries each), strict1,969/33 gated/20 summaries, complete Native3,077/19 gated/41 summaries and audit/deny0. `/tmp/rustack-d96-final-host-report.json` SHA256 is `2a2661970d144924069a19c53c8f4fb9b11b98e0dcaa65282a770a74bdcefa5e`.
+
+`/tmp/rustack-d96-source-build-exports.json` binds eight actual named build exports plus four unchanged prebuild sources per lane, twelve distinct current source IDs, bounded provisioned inspection hashes and original full-prefix hashes. `/tmp/rustack-d96-postconditions.json` revalidates all final source/host/owner/resource/manifest evidence before any Docker effect. Both exact architecture inventories and original engine/socket identities are mandatory, not inferred from zip lengths. All26 recorded CLI commands exit0 and prove zero all-state containers/volumes/private or test/pull references, all twelve source IDs preserved per engine and removal of only the two exact D96-owned empty bridges after repeated engine/full-ID/name/driver/scope/nonce/attachment checks. Postcondition report SHA256 is `0eb1fa91770215c59ac2fbe54dcb3cdbd26ebe4b719583de6a71254c944b92a9`.
+
+W333–W343 are fixed and independently rechecked: four P2, seven P3, no P0/P1 or remaining concrete in-slice finding. Preserve the failed first ARM startup-assertion and first AMD unit-deadline cohorts, original completed40-source ARM/host cohort, W340 old unit/import sources and all owner receipts as development history. The final41 cohort reruns both full lanes, both focused consumers and every host gate, so no final claim depends on substituting a source delta. No new dependency, lockfile change, runtime setting, lint waiver or incomplete-code marker is introduced. English guide/index/roadmap and capability scope are reconciled; task4.3/5.3c closes on native-arm64 VZ/emulated-amd64 QEMU functional lanes. IaC/server-in-container/native-reference/platform and full5.4/M0–M4 acceptance remain required; the original complete objective stays active.
+
+
+**W343/P3 (final guide review):** the guide attributes SendTaskFailure to worker B, while the actual external-failure case is sent by gated dispatcher A. Correct the guide to identify A's early success/failure and B's post-return success/heartbeats. All final source/evidence/cleanup hashes and counts independently verify clean; no implementation or additional resource run is needed for this documentation correction.
+
+The final independent persisted-evidence review recomputes all41 source hashes,52 CLI output hashes, both full/focused inventories and owner receipts, host commands/results/logs, twelve-source/eight-export/four-unchanged projections and exact bridge authority/removals with no mismatch. W343's documentation-only attribution correction is independently rechecked clean. Final text checks validate538 relative links/284 fragments across14 spec/guide/index files with zero errors; working/staged whitespace checks pass. All26 named staged paths match the working bytes and every qualified implementation blob matches its41-source seal. Rust verification for this final text-only correction is not applicable; the complete final41 Rust/resource gates above remain authoritative.
+
+
+## P5 Pulumi image-Lambda design preflight (D97)
+
+The pinned upstream process study and executable IaC design precede implementation. CLI/core3.273.0 and AWS provider7.52.1 are checked through official documentation/npm metadata; Linux archive SHA256 values are recorded from the CLI checksum manifest and provider release API. The provider's legacy manifest uses SHA1 and is not substituted for its release-asset SHA256. The source pin is vendors/pulumi@874c77a73039cf013d6a685a15293843de2b0e01. No D97 image/function/resource or production implementation has run; D96's committed evidence remains unchanged.
+
+**W344/P2 (independent IaC design review):** stack removal requires non-root provider resources already removed and moves/deletes active state/history, so post-removal data cannot prove encrypted provider inputs. Audit the actual post-up/pre-destroy checkpoint while both secret inputs exist, then a distinct current post-destroy checkpoint/actual API absence, then successful stack removal/active-checkpoint absence. Bind each path/hash/stage independently; backups/empty archives cannot substitute.
+
+**W345/P2 (independent IaC design review):** a known ARN can execute Output.apply during update preview and enter the held gate before the actual update. Require --yes --skip-preview for up and an explicit isDryRun guard that neither reports nor waits in preview; bind gates to command ordinal and add a no-gate dry-run control.
+
+W344–W345 are independently rechecked clean before implementation: pre-destroy encrypted-input audit, post-destroy target absence and post-removal active-checkpoint absence are separate; gate-bearing up explicitly skips previews and has a dry-run guard. The source study matches the pinned CLI/plugin/host paths. Text checks validate16 files/564 relative links/300 fragments without errors. No D97 image, function, resource, Rust source or Make wiring has run/changed at this design checkpoint; implementation and all actual acceptance remain required.
+
+
+**W346/P2 (D97 dependency preflight):** the otherwise current CLI/core/provider cohort resolves20 moderate npm findings through legacy glob/minimatch dependencies. Do not apply npm's suggested downgrade or ignore the audit. A private lock fixes glob14.0.3/minimatch11.0.3, with actual CommonJS exports, Arborist graph/workspace/packlist calls, stopped traversal and a bounded owned matcher worker. All five controls and the isolated Make provisioning/audit target pass with zero findings. Original lock/audit remain under /tmp/rustack-d97-*-initial; selected Linux image and actual CLI lifecycle qualification remain required before acceptance. No D97 image or function executes at this checkpoint.
+
+
+**W347/P2 (independent dependency implementation review):** cache-scoped locks do not protect a shared SOURCE/node_modules when callers choose distinct supported cache overrides. Bind the lock to the installation root, validate alternate-cache configuration before the ready return, and prove real lock contention using two cache roots without network IO. The two controls pass alongside the five Node compatibility controls and audit0.
+
+**W348/P2 (independent tool-cache review):** validating only three expected files lets unrecorded files, links, special entries or wrong modes remain in the supposedly bounded tool root. Require an exact allowlisted directory/regular-file tree, owner/mode checks and aggregate bytes, plus source-derived manifest/hash validation before reuse; add extra-file/link/directory/non-executable negatives. All ten pure artifact controls pass after this fix.
+
+**W349/P3 (first actual artifact provisioning):** both checksum-verified provider archives contain an exact zero-sized `./` directory entry; the strict initial parser refuses it before publishing any tool set. Preserve both failed first Make logs. Permit only that standard root-directory spelling as a no-op (and `.`), while rejecting traversal/alternate dot segments, links and special files. A direct root-entry control passes. Both second artifact provisioning owners are pending at this checkpoint; no downloaded executable, D97 image or function has run.
+
+
+**W350/P3 (independent runtime review):** the first handler hashed tool files before rejecting a malformed lifecycle/probe payload. Validate the exact event, request UUID and all domain fields before provenance IO; the actual handler loaded with a source spy rejects malformed inputs without any source call. The direct CLI joins root exit and both pipes on success, hold failure, output overflow, spawn error and timeout. Function errors cause physical retirement in InstanceExecutor before observed completion.
+
+**W351/P2 (independent archive-oracle review):** raw-byte scanning of CLI stdout/stderr and non-`.json` backend files misses JSON-escaped credentials, including real `.json.bak` checkpoint backups. Scan all regular archive bodies for raw credentials and bounded decoded JSON string tokens, then typed JSON/checkpoint content where applicable. Add actual stdout/stderr, backup and metadata-path escaped-secret negatives. Fixed diagnostics never echo candidates. Five privacy/archive controls pass; real container archives remain pending.
+
+D97 implementation is in progress. Both checksum-verified Linux tool provisioners completed successfully and joined without executing downloaded binaries on the host. The14 Node controls (five dependencies, four program gates, four direct-child ownership, one pre-IO boundary), two dependency-lock controls, ten archive/tool controls and five independent privacy/archive controls are retained behind Make. The frozen resource catalog is now72 total/39 ordinary/eight suites and matches actual compiled ignored inventories. The IaC-only profile has two environments,1,536MiB, two dispatches,20s init and an original1,020s SDK cutoff; other profiles retain their limits. First selected Linux image builds are development provisioning; neither actual D97 resource has run, and no lifecycle/Stop/physical cleanup acceptance is claimed.
+
+
+**W352/P2 (independent handshake concurrency review):** exclusive create publishes a phase/grant directory entry before asynchronous writing closes; the other process can read an empty/partial file and reject a valid run. Use a shared bounded publisher: exclusive private same-directory temporary, full write/close, fresh cutoff, atomic no-replace hard link, owned-temporary unlink. Keep strict malformed-file rejection. A deterministic control holds publication for both phase and grant paths, observes final ENOENT, then reads complete JSON and verifies EEXIST cannot replace it.
+
+The first ARM development resource owner completes nonzero after4.38s in lifecycle preparation; its full49.26s Make/child run is joined and all retained startup evidence remains private. It does not qualify either D97 resource. Add controlled preparation/command progress metadata to locate actual failures without exporting raw SDK/CLI errors or credentials. W350–W351 are independently rechecked clean. The initial AMD image provisioning and D97 actual lifecycle diagnosis remain in progress.
+
+
+**W353/P3 (W352 control review):** the positive polling test still wrote its live valid grant directly, retaining the race fixed in production. Use the same atomic publisher for that valid grant and its unrelated-ordinal control; prewritten malformed fixtures remain direct writes. The five program controls pass.
+
+The second/third ARM development owners complete nonzero and join. Controlled evidence narrows the failure to actual stack init (CLI ordinal3/code1), after both function probes and actual CLI version/local login succeeded; no target acceptance is claimed. Pinned DIY lock creation and CurrentUser both require os/user.Current, so the immutable image now registers a fixed unprivileged POSIX UID/GID1000 and passes fixed USER/LOGNAME without overriding HOME. This is a source-derived compatibility hypothesis until the next actual stack-init result. Preserve all three development logs/seals/retained roots.
+
+
+**W354/P3 (fifth Make prerequisite run):** an existing interrupted-pull control sees front EOF immediately after shutdown, before the proxy worker publishes pull_cut. Its unsynchronized boolean assertion can fail valid framing, then prematurely close the retained backend. Add a condition-owned wait for post-shutdown cut publication with the original deadline, use it in the real SDK observer, and make the control deterministically hold publication after actual shutdown. Keep the backend-drain barrier independent; ensure the controlled daemon joins even if proxy-close verification raises. The fifth owner completes nonzero before either IaC resource; preserve its failure log/seal.
+
+The fourth actual ARM resource confirms stack init now returns0 with the fixed POSIX identity, then the first up exits before its live created gate. Direct-child failure now preserves both bounded output streams privately through the same joined owner and log writer; only fixed diagnostic categories/labels/exit codes cross DDB. A real child control proves captured diagnostics survive root exit before a gate without leaving the PID. The next actual run must locate/fix the create failure; no IaC lifecycle/Stop acceptance is yet claimed.
+
+
+W354's19 protocol controls pass with the actual post-shutdown/publication race held deterministically, and the independent ownership review is clean. The sixth actual owner confirms init0 then create1 before its live gate; bounded diagnostics now survive direct-child failure. Its receipt/log remain private and no lifecycle acceptance is inferred.
+
+**W355/P3 (failure-evidence path preflight):** the initial diagnostic consumer assumes the Rust temporary root is canonical and mode0700. On macOS its `/var` spelling resolves through `/private/var`, and the root has mode0755 beneath a private OS parent. Normalize the already-owned absolute root and create an exclusive mode0700 evidence child; never change the parent or unpack a container path to the host. A direct alias/private-child/no-replace/input-bound control passes. The seventh owner fails before IaC resources and is joined; the eighth owner uses the corrected private root and bounded raw-TAR failure evidence protocol.
+
+
+**W356/P2 (actual daemon archive/source review):** D97's proposed GET-archive oracle cannot read actual Lambda tmpfs. Two real attempts return404 after exact container/source checks; the pinned Moby filesystem view explicitly creates independent private tmpfs mounts. Correct the design before implementation: independently start only an image-pinned read-only evidence reader in the existing function namespace with fixed request UUID/root enum and uid/gid1000, decode bounded multiplexed USTAR independently, and join that same exec to Running=false/ExitCode0. Uncertain exec remains physically owned by existing server/container retirement. No new host process, mount/socket, writable-root exception or synthetic checkpoint is permitted. Reported to the user before changing this architecture; actual observer and IaC acceptance remain pending.
+
+
+**W357/P2 (actual provider compatibility):** the actual7.52.1 provider creates the unversioned resource, then ListStateMachineVersions fails with local UnsupportedOperation, causing its up to fail before the output gate. Correct the API profile to include the truthful empty published-version inventory for a scoped existing unqualified machine, retaining unsupported publication/mutation/aliases. Reuse a normal registry machine read; validate maxResults/token/ARN and issue no cursor. The real reader exec and its raw log archive now settle successfully and independently decode/scan; the initial host diagnostic misleadingly leaves progress at unpack after success, which is corrected separately. Actual IaC acceptance remains pending.
+
+
+W357's typed19-action transport and real API→registry existence/scope/token/publication-preservation/deletion test pass. Independent production review finds no concrete implementation issue. **W358/P3:** reconcile the older current transport paragraph from18 to19 actions, explicitly adding the unpublished-version read; historical18-action evidence remains historical. The W356 real reader successfully joins its exact exec and independently decodes/scans all four actual command logs; its private TAR reveals the actual ListStateMachineVersions failure. Eight host archive/privacy/protocol/exec-identity controls and three reader filesystem controls pass. Next actual owner uses the corrected API; success is still pending.
+
+
+**W359/P2 (actual recovery semantics):** after publish=true is rejected and independent SDK checks prove unchanged service revision/definition/tags and executable46, Pulumi retains the failed desired publish input. Its valid recovery up legitimately proposes ~publish and exits7 under --expect-no-changes. Do not mask exit7 or change service rejection semantics. Correct the design to perform a real supported recovery up followed by a separate strict no-change settling up, then independently verify unchanged effective resource behavior. A recovery may create a new service revision; compare the failed request against its own pre-failure revision separately. Freeze18 CLI commands (cap20), recovery/settlement gates and independent literal outputs before execution. The original eleven/twelve development owners are joined, with real create/refresh/update42/46, publish rejection and private recovery logs retained; full IaC acceptance remains pending.
+
+
+**W360/P3 (actual post-destroy checkpoint compatibility):** after actual create/update, all three modeled rejections, successful recoveries plus strict no-change settling ups, eight literal42/46 executions, pre-destroy encrypted-provider audit and real destroy succeed, the oracle assumes resources is present in the post-destroy V3 checkpoint. Pinned apitype/core.go marks both latest/resources as omitempty. Accept their canonical empty post-destroy representation only with the actual current-file hash, successful destroy command and independent API absence; keep pre-destroy provider+both encrypted inputs mandatory. Add omitted-field/hash-mismatch controls. The thirteenth development owner joins nonzero at post-destroy; all prior positive observations are partial evidence, and stack removal/Stop/final matrix remain required.
+
+
+The immutable77-source fourteenth ARM cohort passes both exact real resources: lifecycle23.11s and active-plugin Stop5.82s, complete Make owner69.75s/exit0 and physically joined. Actual18 CLI commands include successful create/update/refresh, all three modeled rejections, supported recoveries and strict no-change settling ups, pre-destroy both-credential encrypted-input audit, actual destroy/API absence, canonical empty current checkpoint, successful stack rm and active-checkpoint absence. Eight independent target executions return literal42/46. Stop observes actual CLI/language/provider processes alive, retires only the tool pair, preserves and reuses the exact business pair, then performs explicitly compensating SDK deletion. Build-side rootfs counting reports1,605,051,884 unpacked bytes≤4GiB;20 selected Linux Node controls pass. These are native-arm64 functional observations, not AMD64/full72/host/final cleanup acceptance. The first AMD focused owner is now pending against the same77-source cohort.
+
+
+**W361/P2 (final independent checkpoint review):** W360 over-relaxes the V3 schema by accepting checkpoint={} or an unrelated stack when resources is omitted. CheckpointV3.stack and DeploymentV3.manifest are mandatory; this consumer has already performed updates and therefore requires its actual latest deployment. Require expected fixture stack identity and minimal pinned manifest/time/magic structure in both audits, preserving only legitimate omitted resources after destroy. Add missing/wrong-stack/manifest/structurally-empty negatives. Fix is pending until the current77-source owners settle.
+
+**W362/P2 (final independent consumer review):** successful output shape/computed46 and execution count alone allow replay of an old completed execution/UUID to stand in for later independent invocations. Require distinct target execution ARNs and business request UUIDs, enforce the literal preserved-warm counter progression, and retain distinct identities in the Rust-validated report. Add repeated valid46/old-ARN and fresh-ARN/old-UUID controls. Fix is pending until current owners settle; the passing first ARM cohort is partial evidence, not final qualification.
+
+
+W361 preflight follows the actual project-scoped backend: diy/state.go saveStack passes ref.FullyQualifiedName(), and diy/backend.go returns organization/rustack-iac/fixture for this stack. Require that exact persisted identity, rather than the CLI's elided display name fixture. The pinned ManifestV1 requires time/magic/version; validate its timestamp, exact engine version and SHA256(version) magic. Fixes remain pending while the original AMD owner is running; the first host owner has joined0 across standard9/strict/Native/audit/deny without source changes.
+
+
+W361–W362 are implemented after both original77-source owners settled0. Isolated and working-copy controls reject malformed/wrong-stack/manifest state and repeated valid46 execution/UUID/counter replay. Source-qualified stack identity is organization/rustack-iac/fixture; manifest matches the pinned CLI and its SHA256 magic. The causal child control additionally waits for actual SIGINT-handler readiness and requires SIGKILL escalation, rather than assuming a fixed delay is readiness. All20 Node controls, ten Python oracle/replay controls and strict CLI Clippy pass; no waiver or skip is added.
+
+The final78-source seal SHA256 is a39443ef88d166b8d3557071a5d82cf6dd14460f3ac17ddc8718053ff9c5d8d4. Its ARM focused owner completes0 and joins after both exact resources: lifecycle26.09s/Stop8.17s, total91.59s. Both current stack/manifest audits, eight distinct target execution ARNs, ten distinct business UUIDs with literal warm counters and all previous lifecycle/privacy/retirement assertions pass. AMD focused, ARM full72 and the second complete host owner are running against the same sealed source; these results remain pending.
+
+
+The final78-source AMD focused owner passes both real resources and joins0: lifecycle543.72s, Stop89.62s, whole Make780.44s. Both actual CLI budgets and the original handler/consumer cutoffs remain unchanged; QEMU is functional evidence. The same78-source ARM full gate passes all72 exact resources/521 Rust cases/30 summaries, with one recovery preflight explicitly gated then executed in its suite, and joins0 after351.05s. The final host owner joins0 after255.22s: standard9 commands; default4,217/428 gated/81 summaries, feature4,342/492/81, strict1,969/33/20, complete Native3,078/19/41 and audit/deny0. `/tmp/rustack-d97-final-host-report.json` binds the source seal, raw owner receipt and all exact argv/results/log hashes. The AMD full gate is now pending; final source projection, exact daemon/bridge postconditions and final evidence review remain required before commit/5.3d closure.
+
+
+### D97 final qualification and exact postconditions
+
+All final implementation evidence binds the same78-file source seal: /tmp/rustack-d97-resource-code-seal.json, SHA256 a39443ef88d166b8d3557071a5d82cf6dd14460f3ac17ddc8718053ff9c5d8d4. Both full/focused owners complete0 and their original waits physically join; no source delta substitutes for final qualification. Each full gate executes all72 exact frozen resource names once,521 aggregate Rust passes/30 summaries. Each focused gate executes both exact IaC names,451 aggregate passes/24 summaries. The one ignored recovery preflight is subsequently executed in each complete full72 gate and is not a skipped required resource there; the focused gates select only the two IaC resources.
+
+| Final owned Make run | Native-arm64 VZ | Emulated-amd64 QEMU |
+|---|---:|---:|
+| Full72, including all prior Node/SDK/callback/ZIP resources |351.05s|2,274.16s|
+| Focused lifecycle plus active-plugin Stop |91.59s|780.44s|
+| Individual focused lifecycle / Stop |26.09s /8.17s|543.72s /89.62s|
+
+Actual CLI/core3.273.0 and AWS provider7.52.1 complete the18-command lifecycle under the unchanged command/handler/consumer cutoffs. Independent clients prove42/46 with eight distinct target execution ARNs, ten distinct business request UUIDs and warm counters1..10. All three unsupported updates preserve their own pre-failure service revision/effective state; supported recoveries and separate strict no-change settling ups succeed. The actual project-scoped current checkpoint has its pinned manifest and both encrypted provider inputs before destroy; actual empty current state plus API absence is proved after destroy; successful stack removal leaves no active checkpoint. Every live-tmpfs observer joins its exact read-only exec before independent framing/archive/privacy acceptance. Stop observes live CLI/language/provider processes, retires only the tool pair and preserves the exact healthy business pair with three distinct UUIDs/counters1..3. Subsequent SDK compensation is recorded separately from IaC destroy.
+
+All20 Node, two dependency-lock/configuration, ten tool-artifact, nine archive/privacy/exec and replay controls pass. The actual npm dependency audit reports zero advisories after the private compatible overrides; no Cargo dependency or lockfile change is introduced. The final host owner joins0 after255.22s. Nine exact standard commands cover default/feature workspace build/test, nightly formatting, both denied-warning Clippy profiles and both warnings-denied rustdoc profiles. Default tests pass4,217/428 separately gated/81 summaries; feature tests4,342/492/81; strict boundaries1,969/33/20; complete Native3,078/19/41. Cargo audit and cargo deny both return0. The raw owner/report/argv/results/logs are bound by /tmp/rustack-d97-final-host-report.json, SHA256 8988949e044bfc67cc7a1026f8c448310eb36f8362d2998b4d4457afde80c04b.
+
+/tmp/rustack-d97-source-build-exports.json, SHA256 ab50bd90f36292e59b6e3595037a525ee5016fe5086e56486b3cb5b5a6bd283a, binds nine actual named build exports and four unchanged prebuild references per engine: thirteen distinct actual current source IDs. Original build-prefix hashes and raw provisioned-image inspections remain bound to the completed full logs. /tmp/rustack-d97-image-size-proof.json, SHA256 134c177050013bf1b446de7b3eeca742fa24dbb55683de1fc60109a2d009f0ef, independently binds those image IDs and focused-log hashes to1,605,052,583 arm64 /1,666,467,185 amd64 unpacked root bytes, both below4GiB.
+
+/tmp/rustack-d97-postconditions.json, SHA256 97c9db89763dd76f090fa15197e2a2aee6ff21f3ee23cde44e8ef836935cb239, revalidates all78 sources, host and four resource-owner results, exact inventories/log hashes and source projections before any Docker mutation. Both original engine/socket identities and architecture inventories are explicit. All26 recorded CLI results exit0, proving zero all-state containers/volumes/runtime-private/test-source/extra-pull references and preservation of all thirteen source IDs per engine. Only the two exact D97-owned empty bridges are removed after repeated full-ID/name/driver/scope/nonce/attachment checks, then their absence and source preservation are checked again. D96 artifacts remain historical and unchanged; no global prune or VM/context change occurs.
+
+W344–W364 are fixed and independently rechecked: twelve P2, nine P3, no P0/P1 or remaining concrete in-slice finding. Preserve the earlier failed development owners, their original source seals/logs/private roots, the passing original77-source cohort and first host cohort. The final78-source runs replace none of that history and require no deadline increase, test skip, lint waiver or incomplete-code marker. English contracts, verification/guide/index/roadmap and task5.3d status are reconciled. This closes the managed IaC functional slice on native-arm64 VZ/emulated-amd64 QEMU; server-in-container, native-x86/reference performance, Desktop/rootless and complete5.4/M0–M4 remain required. The original complete objective stays active.
+
+
+**W363/P3 (final documentation review):** the IaC design status header still labels actual lifecycle acceptance pending after both final functional/full cohorts and guarded cleanup pass. Reconcile the header to implemented/qualified on the retained functional lanes, preserving the full-M4 limitation.
+
+**W364/P3 (final documentation review):** the final evidence prose says the recovery preflight executes later in each gate, but the focused gates deliberately select only the two IaC resources. State explicitly that the ignored recovery case executes in each complete full72 gate; retain its gated status in focused counts. The executable evidence checker already verifies the two inventories separately; implementation and evidence bytes are unchanged.
+
+
+The final independent persisted-evidence review recomputes all78 source hashes, all52 CLI stdout/stderr hashes, exact full/focused inventories and original owner receipts, host argv/results/logs, thirteen-source/nine-export/four-unchanged projections, image sizes and exact bridge authority/removals without mismatch. W363–W364 are independently rechecked clean. Final text checks validate580 relative links/313 fragments across16 spec/guide/index files with zero errors; working/staged whitespace checks pass. All55 named staged paths match working bytes and all qualified implementation blobs match their78-source seal. Rust verification for these final documentation-only corrections is not applicable; the complete final78 Rust/resource gates above remain authoritative.
+
+
+## P5 server-in-container design preflight (D98)
+
+D97 is committed as b5abb6f with its complete immutable evidence. D98 now polishes [the separate containerized-server topology](./rustack-workflows-55-server-container-design.md) before implementation. Official Docker bind/network/run documentation and pinned Moby archive code distinguish client/daemon socket paths, internal DNS, bounded env-file input and persistent-volume records. Read-only local VM preflight observes /var/run/docker.sock root:GID991/mode0660 on both selected profiles. Existing workspace tar0.4.46 is verified current and selected only as a test dependency, with raw bounded parsing/no extraction. No D98 image, server container, volume, source/code/Make implementation or required resource has run/changed at this checkpoint; design review and all actual acceptance remain required.
+
+**W365/P2 (independent D98 design review):** ownership capture was specified only after readiness, while the expected unreachable-gateway resource fails before readiness and still needs bound owner-scoped cleanup. Require that negative path to validate the same actual persisted owner/daemon records after its verified nonzero exit, before inventory/removal. Missing/invalid/unbound records fail and retain resources/evidence; a broad empty inventory cannot substitute. The executable design is corrected before implementation.
+
+
+W365 is independently rechecked clean before implementation; the other ownership/topology review has no concrete finding. Design-only text checks validate17 files/592 relative links/314 fragments with zero errors and clean whitespace. No Rust execution/toolchain behavior has changed, so Rust verification is not applicable to this design checkpoint.
+
+**W366/P3 (first actual Linux server build):** the actual arm64 release executable builds successfully, but Zig0.16's native linker warns that rustc's GNU -O1 linker optimization is deprecated. Preserve the first build log; select the supported -flld backend through this target's Cargo rustflags instead of suppressing warnings or changing global tooling. The next build must demonstrate warning-free linking before image/resource acceptance. The existing tar crate adds only a CLI test dependency edge; no version changes or new runtime dependency occur.
+
+
+W366's first backend-selection hypothesis is disproved: -flld is accepted by Zig build-exe but rejected as an unknown Clang option by zig cc; -fuse-ld=lld is ignored and retains the warning. Preserve the joined second failed build and small linker-control log. The corrected design uses current cargo-zigbuild0.23.4 for the normal Linux CLI and a version-bounded argv adapter that removes only the known obsolete -Wl,-O1 no-op, retaining every effective option/diagnostic and Rust optimization. Four pure compatibility controls precede the third actual build. No image/server/volume or required D98 resource has run at this checkpoint.
+
+
+**W367/P3 (independent build-adapter review):** Make enforces the Zig compatibility version but does not pin cargo-zigbuild0.23.4. Describe that CLI version as the observed development cohort and bind the selected tool path/version in build evidence, rather than implying an unenforced version gate. Actual cargo-zigbuild --version reports0.23.4. The same-process argv adapter otherwise reviews clean.
+
+The third actual ARM Linux build joins0 after51.02s with no warnings, using the adapter/current cargo-zigbuild after all four compatibility controls pass. First/second/control logs remain unchanged. No image, server, volume or required D98 resource has run; full implementation/qualification remains pending.
+
+
+**W368/P2 (independent first implementation review):** the new server log consumer checks only raw credential bytes and misses JSON-escaped keys/values, repeating D97 W351's boundary on another consumer. Apply the same raw-plus-decoded-string-token profile in Rust with64KiB/4096-token/64KiB-decoded caps, fail closed on malformed input and add escaped-key/escaped-secret/error-redaction controls. Fix is implemented before any server resource runs; independent recheck and actual logs remain required.
+
+
+**W369/P2 (first actual ARM consumer):** the first100-source focused owner joins nonzero after its first resource fails2.52s into the container exercise. Actual server startup, persistent identity capture and server exit0 occur, but the SDK child exits before its PID barrier: server_container_sdk imports the CLI-only stepfunctions_sdk entrypoint, whose top-level argv parsing executes on import. A new actual import-with-no-clients control reproduces the failure before the fix. Extract bounded history/omission helpers into an import-safe module, retain the original Native CLI action-tracking callback, and test both imported paths. Add a final successful cleanup receipt and clearer PID-barrier context; do not infer business/ASL acceptance from startup or stopped-container evidence. Original source seal/log/owner/private root remain preserved.
+
+The eighth fixture check passes17 Python controls,12 Rust controls and targeted denied-warning/pedantic Clippy. Read-only post-failure audit observes zero containers/volumes/private aliases on both engines, verifies the first ARM Make's10 actual build exports plus4 unchanged references, and the14 unchanged AMD sources. Rebuilt mutable fixture tags are matched to their own joined build exports, never incorrectly compared to the prebuild IDs. W368's escaped-log correction is independently rechecked clean. W369 still requires independent recheck and actual/Native regression before closure.
+
+W369's extraction and retained cleanup receipt independently recheck clean. The second actual owner reaches direct SDK business success but fails its following environment assertion; its private cleanup receipt proves server/volume removal with no forced retirement. The ninth control pass adds credential-safe allowlisted source-coordinate diagnostics; independent diagnostic review is clean. The third joined owner pinpoints lambda_fault_support.py:164, preserving its complete original failure/source/evidence.
+
+**W370/P2 (actual container identity oracle):** the consumer passes Config.Image to a deliberately owner-private-only image reader. The relay uses a source ID and correctly fails that boundary. Compare inspected container Image directly to each pre-captured source ID instead; never broaden the metadata reader's private-alias authority. Add a control that accepts distinct function-private/relay-source invocation references, rejects either actual Image mismatch and cannot dispatch an image query. Both actual reruns and complete regression remain required.
+
+
+W370 independently rechecks clean. The fourth103-source cohort (SHA25649efe16fa2126e365183fea9d363adb97bee8b5851c7dd99d97d6b5ed67f4d13) passes both focused resources on both engines: ARM Make54.307s, positive3.42s/negative2.49s; QEMU AMD Make140.518s, positive38.21s/negative24.65s. Each focused gate has463 Rust passes/25 summaries/one gated recovery preflight; focused execution does not execute durable recovery or IaC resources. Full implementation review independently verifies all103 hashes and finds no actionable P0–P3 issue. Both full74 and final host/security/postconditions remain in progress; this is not complete5.3e acceptance.
+
+
+The original final host owner joins0 after288.799s: standard9; default workspace4,217/428 gated/81 summaries; lambda,stepfunctions workspace4,354/494/81; strict boundaries1,969/33/20; complete Native3,078/19/41; fresh audit/deny0. This includes the actual old Native SDK consumers after history extraction. The bound final host report is /tmp/rustack-d98-final-host-report.json (SHA256df75ea170df88c19ae2f9a2a11e653421275d245a5d4a34e2c31c12259236b86). The original ARM full Make owner joins0 after389.803s with all74 exact names once,535 Rust passes/31 summaries/one gated recovery preflight; full execution separately runs durable recovery. AMD full and exact final engine/network postconditions still gate closure.
+
+### Release packaging backlog for task5.4
+
+**W371/P1 (independent out-of-phase release audit; open for5.4):** Dockerfile:10–13 copies workspace manifests/crates/apps/tests but omits patches/. Cargo.toml:287–289 unconditionally selects patches/squib-loader, so the first release-container Cargo build cannot resolve that reviewed local security patch. Copy the complete required patch tree into the release build context, retain the security overlay and qualify actual root-Dockerfile builds for both architectures. D98 deliberately certifies its separate GNU fixture, not this default Dockerfile; do not expand or alter the live frozen D98 cohort to hide this release blocker. The root Dockerfile/toolchain version mismatch and absent compiled Step Functions feature also require the planned5.4 packaging reconciliation.
+
+**W372/P2 (same audit; open for5.4):** action.yml:85,98–111,119–120 interpolate action inputs directly into executable Bash source, including unquoted timeout assignment. Command substitution/quote-breaking input can execute before Docker or domain validation. Route inputs through step environment variables, validate tags/ports/timeouts/enums at the boundary and expand quoted argv only; preserve credential redaction. No payload was executed during review.
+
+**W373/P2 (same audit; open for5.4):** .github/workflows/release-docker.yml:28,63 gates publication only on build-rust, then publishes both architectures without executing those immutable images. Require same-commit exact-image qualification receipts before promotion; starting a default container/counting services is insufficient workflow/image acceptance. Do not publish any image during local remediation.
+
+**W374/P3 (same audit; open for5.4):** Dockerfile:4 selects rust1.99.0 while rust-toolchain.toml selects1.99.1. Rustup's repository override should install/select1.99.1, so this is pin drift/redundant installation, not evidence of a wrong resulting compiler. Align the explicit builder pin and record actual compiler provenance.
+
+**W375/P3 (same audit; open for5.4):** action.yml:131 sleeps0.5s while advancing ELAPSED by1, halving the advertised readiness timeout. Use an absolute deadline with validated input; cover the actual action readiness/failure paths.
+
+The release audit finds no additional D98 defect. Default Cargo features intentionally omit Step Functions and current docs disclose the opt-in build;5.4 must explicitly select/document its workflow image profile. Native-x86, reference-Linux, Desktop/rootless and the remaining required performance/load gates stay separate. These five release findings are deferred to their already-required consuming task, not waived or represented as fixed by the D98 fixture.
+
+
+## D98 final qualification and exact postconditions
+
+Task5.3e is functionally qualified on the retained native-arm64 VZ and emulated-amd64 QEMU engines. This installs an actual selected-architecture Linux Rustack server container, explicit daemon-side socket/GID, owned named data volume, internal DNS SDK gateway and independently published loopback SDK origin. No production executor/ASL/isolation relaxation occurs. The existing CLI Runner remains unchanged.
+
+Under one103-source seal, both focused owners join0 (ARM54.307s/AMD140.518s) and both full owners join0 (ARM389.803s/AMD2366.024s). Every full gate executes all74 exact required names once and passes535 Rust cases/31 summaries; every focused gate executes its two exact server resources once and passes463/25. Each has one gated recovery preflight; only the full gate separately executes durable recovery. Full gates also re-execute all real Node/handler SDK/callback/IaC consumers. Actual signed SDK results42/46 and nested .sync:2 child50 have counters1/2/3 and the unchanged complete warm pair; both closed-port startup rejection resources validate bound persisted identities and physical cleanup.
+
+The original final host owner joins0 after288.799s: standard9; default workspace4,217/428 gated/81 summaries; feature workspace4,354/494/81; strict boundaries1,969/33/20; complete Native3,078/19/41; fresh audit/deny0. The old actual Native SDK consumers pass after the import-safe history extraction. Source build evidence verifies both Linux ELF architectures and warning-free original builds with the selected tool path/version/hash. Final source projection matches each engine's ten actual named build exports plus four unchanged prebuild references, giving fourteen distinct preserved IDs.
+
+The guarded final postcondition owner joins0. All26 CLI exits and stdout/stderr hashes are retained. Both complete inventories show zero all-state containers/volumes/private/test/pull references; all fourteen source IDs remain. Only the exact two D98 nonce-bound bridges are removed after repeated engine/ID/name/driver/label/empty-attachment checks. There is no forced repair, global prune, context/VM restart or unrelated cleanup. The three original failed development owners/logs/source cohorts and private roots remain unchanged; D97 artifacts remain immutable.
+
+| Bound artifact under /tmp | SHA256 |
+|---|---|
+| rustack-d98-resource-code-seal.json | 49efe16fa2126e365183fea9d363adb97bee8b5851c7dd99d97d6b5ed67f4d13 |
+| rustack-d98-source-build-exports.json | 0fb693d4e78b92d3cf9dac9a0534f8297ccde15432f516284b6f2e4ec4ca9265 |
+| rustack-d98-server-build-proof.json | 85c1fe16d7f2be18fc004132024921dc3e2c07b87e49e3f9fc47054448a52607 |
+| rustack-d98-final-host-report.json | df75ea170df88c19ae2f9a2a11e653421275d245a5d4a34e2c31c12259236b86 |
+| rustack-d98-postconditions.json | 933a88e6098f0e40120c4318d6acd79e6675aebeb592bf1fc05315338c3dcded |
+
+W365–W370 and W376–W377 are eight valid in-scope findings (four P2/four P3), all fixed and independently rechecked. Complete implementation review finds no remaining actionable D98 P0–P3 issue; final evidence hashes/ownership are independently rechecked before commit. The separate [release packaging backlog](#release-packaging-backlog-for-task54) keeps W371/P1, W372–W373/P2 and W374–W375/P3 open for5.4. Default release Dockerfile/Action/promotion, native-x86/reference/Desktop/rootless, remaining performance/load and full M4 are not qualified by this fixture.
+
+
+**W376/P3 (final current-summary review):** guide:14–15 and implementation-plan:7 retained current introductions listing server-in-container as unfinished after the new D98 acceptance sections. Update both introductions to include D98, while keeping default release packaging/native-reference/platform/performance/full-M4 requirements explicit. Historical D97 and earlier D98 checkpoints remain chronology. Final text checks and independent recheck precede commit.
+
+
+**W377/P3 (same final current-summary review):** specs/index.md:11,13 retained unqualified current clauses describing handler SDK/callback/IaC as pending after D95–D98. Reconcile only these current remaining-work clauses; preserve chronological D93–D97 entries and all default release/native-x86/reference/platform/performance/full-M4 limitations. Final text checks and independent recheck precede commit.
+
+
+Final independent source/evidence review recomputes all103 source hashes, exact full/focused names/counts/receipts, host/ELF/tool/export evidence and all26 CLI stdout/stderr hashes clean. Final actual-file documentation recheck confirms W376/W377 fixed and eight in-scope findings closed; W371–W375 remain open for5.4. Final text checks validate17 files/600 relative links/320 fragments with zero errors; whitespace checks pass. No Rust source changes follow the frozen successful cohort.
+
+
+## D99 release image and Action design preflight
+
+Committed D98 (658ad61) remains immutable. [D99/5.4a](./rustack-workflows-56-release-image-design.md) now specifies actual root-Dockerfile qualification and W371/W372/W374/W375 remediation before source changes. Current official GitHub/Docker/YAML references are checked; Docker Hub tag metadata is unavailable through the web tool and is not treated as verified image provenance. Actual source builds must record their resolved builder/compiler/platform instead. The Action tests reuse the existing workspace YAML parser edge rather than silently upgrading production configuration. W373 and the remaining native/reference/platform/performance/load/full-M4 requirements remain open. No D99 source/image/resource has changed/run at this design checkpoint.
+
+
+**W378/P2 (independent D99 design reviews):** the initial Action design bounds readiness curl but gives Docker image lookup/pull/run no finite observer/termination/join contract. Specify one launch cutoff, separate finite per-command caps, one bounded direct subprocess owner, exact group termination/reaping and pre-effect nonsecret uncertainty retention; add real hung-child/pipe controls. Do not silently redefine wait-timeout to include image pulling.
+
+**W379/P2 (same preflight):** the proposed region allowlist permits uppercase, while production settings.rs:928–934 rejects it. Narrow the Action boundary to lowercase [a-z0-9][a-z0-9-]{0,63}, rejecting before Docker/runner output effects; do not widen production settings.
+
+**W380/P2 (same preflight):** localhost HTTP200 alone does not establish readiness of the returned Action container. Require exact daemon/CID/source/nonce/port/running/healthy affiliation around a structured /_health/ready observation under one monotonic cutoff, unchanged StartedAt and meaningful wrong-publication/exited-CID/unrelated200/ready=false controls. All three design gaps are corrected before implementation; independent recheck remains required.
+
+
+W378–W380 independently recheck clean before implementation; both design reviewers find no remaining concrete P0–P3 gap. Text checks validate18 files/613 relative links/322 fragments with zero errors and clean whitespace. Only the six design documents changed at this checkpoint; executable/source behavior remains unchanged and no D99 image/resource ran. Implementation and actual qualification remain required.
+
+
+**W381/P2 (first actual Action process controls):** Darwin returns EPERM from killpg(group,0) while the terminated direct child remains an unreaped zombie. The first retirement loop aborts before wait, producing ResourceWarning rather than joined evidence. A controlled same-child probe confirms signal0 succeeds before TERM, returns EPERM before wait and ESRCH after wait. Reap that owned child and independently retry group observation; persistent denial stays failure, never absence. Preserve the original failed control log; fresh process controls and independent recheck remain required.
+
+Independent root-Dockerfile development builds run while the Action-only module is implemented, before the final frozen qualification cohort; this overlaps independent build work without claiming actual runtime acceptance. The original ARM owner joins0 after224.857s, actual Linux/arm64 image b586dbc4e7b2dab086e1eafdd973b98c6685726c0ce19441616f91ce0e875486/21,198,862 bytes, unchanged source snapshot and all fourteen prior source IDs preserved. AMD development compilation remains live. No D99 resource or complete qualification has run.
+
+
+**W382/P2 (root Action source review):** curl --fail alone accepts3xx and reads ambient curl configuration, violating the exact local HTTP200 boundary. Put --disable first, disable proxies/other protocols, project the actual status separately and require200 without expanding the64KiB body budget; cover redirected status and argv policy.
+
+**W383/P2 (independent Action implementation review):** emitting defined empty ACCESS_KEY/SECRET_KEY fails the installed settings boundary. Omit the absent pair/provider, retain empty caller exports, and reject empty credentials with enabled strict flags before effects. Skip-auth flags still govern; do not silently invent test credentials.
+
+**W384/P2 (same review):** DOCKER_CONTEXT overrides DOCKER_HOST, but the initial client selected the host first. Resolve effective explicit context first, reject remote results even with a local host variable, then pin the local endpoint; add both-present controls.
+
+**W385/P2 (same review):** runner output paths are opened write-only before regular-file checks, so a FIFO can block before handoff/cleanup. Add nonblocking/no-follow open and an actual FIFO control proving prompt failure and exact server cleanup.
+
+**W386/P3 (same review):** a0.15s pre-spawn deadline can expire before a loaded child writes its PID marker, testing startup latency instead of retirement. Advance a controlled clock only after positive child entry, retain an independent real entry cutoff and assert actual PID absence.
+
+**W387/P3 (same review):** lone-child/flood tests do not qualify the promised descendant-group boundary. Add a causally entered real parent/descendant, retain both PIDs and require both absent with settled pipes after forced observation.
+
+**W388/P2 (same review):** the first Python control harness reused the new owner under test without its required independent Rust deadline/PID/capture boundary. Restore an explicitly selected exact Action process suite under the unchanged Rust Runner, with its own bounded manifest/listing; keep Native26/Docker76 counts separate. The normal YAML contract test remains independent of external resources. These implementation/control fixes require fresh component gates and independent recheck before closure.
+
+
+**W389/P2 (actual D99 ARM release consumer):** the design and public-configuration oracle assumed default docker cp assigns root0:0. The actual bounded read-back reports host501:20, exact296 bytes and0644, so the first sealed ARM owner fails closed before start (78.841s/exit2). The exact stopped server/volume and private evidence remain retained; the original source seal, log, receipt and raw public archive are immutable. Official CLI passes --archive to CopyUIDGID; pinned vendors/moby/daemon/archive_unix.go:136 and archive_tarcopyoptions_unix.go:18 bind that mode to Config.User. Correct the spec and command to explicit --archive, require the already validated numeric65532:65532, retain byte/mode/path/volume checks and add flag/ownership controls. Identity archives remain unchanged. Independent source review confirms this fix shape. The initial host gates finish on their original source before a new complete source cohort; fresh same-source full acceptance remains required.
+
+
+**W390/P3 (actual D99 AMD prerequisite):** codes/tests.rs:71 assigns0xff to offset8 of a random owner UUID, producing a no-op whenever that byte is already0xff. The second AMD focused owner fails case_02 in test-lambda-code-fixture before running either Release resource (99.341s/exit2); the production codec correctly accepts unchanged valid bytes. Preserve that original failure. Set this corruption test owner to fixed all0xff and XOR the owner byte so the mutation is guaranteed different and the prior defect is deterministically covered. Other malformed canonical fields and production code stay unchanged. The ongoing second ARM full/host cohorts finish before source changes; third complete-source acceptance must rerun all required gates.
+
+
+W389 reconciliation provenance: the first read-only manual observer stops before any mutation because its mount-count assertion expected one rather than the independently visible socket plus data mounts. Its partial two-command report/script and failed-owner companion remain retained. The second observer verifies both exact mounts, source/nonce/engine and never-started state, reads back the exact public archive, then removes only that stopped server and its unreferenced owned volume. All17 command results/hashes independently recheck; receipt SHA2564ec73cf52bd4b0cc05f277d2d48657bcd3423a4bef5c2281518e9502e3ff97f1. This post-failure reconciliation does not convert the original failed resource into passing acceptance.
+
+
+**W391/P2 (actual exported root-image filesystem audit):** Dockerfile top-level COPY /runtime/tmp→/tmp and /runtime/data→/data do not preserve the new destination directory modes. The saved actual arm64 root image has both0755, despite the builder correctly preparing1777/0700. Existing functional cases pass because UID65532 can still write; they do not prove the declared filesystem contract. The independent layer audit fails closed and retains its original archive/script/log. Prepare65532 ownership in the builder and copy the entire /runtime/ tree into final /, preserving nested data/tmp/run directory attributes. A small OCI-output-only COPY probe precedes source changes; final actual root images must independently prove file modes, ownership, static ELF architecture and image health under a new complete source cohort. Third-cohort full gates already in flight remain historical, not final D99 acceptance.
+
+
+**W392/P3 (independent artifact-gate design review):** spec56§3.3 initially rejected all nonregular members, conflicting with legitimate zero-size directories in both OCI outer archives and the required rootfs. Explicitly permit bounded canonical empty directories and regular files, reject every link/device/FIFO/other type and preserve duplicate/path/tree/size checks. Probe source/archive/log hashes and exact metadata independently recheck.
+
+
+**W393/P2 (independent artifact verifier review):** the prepared helper checked archive size only after docker image save joined. Captured image Size does not bound bytes emitted to disk. Install a helper-process POSIX RLIMIT_FSIZE hard/soft cap before CLI dispatch, preserving stricter inherited limits; every Runner child inherits it. Keep original child deadlines/retirement and post-join regular-file/link-count/byte checks. Add actual child output-limit proof.
+
+**W394/P3 (same review):** truncated gzip raises EOFError outside the prepared verifier exception normalization. Catch it as the fixed ImageError diagnostic and add truncated-header/trailer and CRC controls; never expose archive-derived tracebacks.
+
+
+**W395/P3 (artifact decompression recheck):** gzip also propagates zlib.error for a valid header with invalid DEFLATE data. Normalize that fixed failure alongside EOF/CRC errors and add a correctly rehashed blob/graph control with a reserved DEFLATE block. Kernel file-cap review otherwise rechecks clean.
+
+
+**W396/P2 (second independent artifact verifier review):** normalized tarfile iteration consumes GNU longname/longlink/PAX internally, bypassing physical type/count checks and permitting recursive metadata chains before validation. Add a bounded raw512-byte header/checksum/type/path/size/count pass first, permit only one bounded local timing PAX per member, reject all GNU/global/chained metadata, and compare normalized member identities to the raw table. Add hidden/chained metadata negatives and an allowed timing-PAX positive. Dockerfile/Make wiring and other artifact bounds independently review clean.
+
+
+### D99 fourth-source qualification in progress
+
+All source findings through W396 recheck clean. The actual root images now pass the permanent artifact gate on both engines, including exact0700/1777/0555 directory modes, numeric ownership, captured image/daemon/graph binding and static Linux ELF machines183/62. The installed archive controls pass13 cases, Action controls26 and shared server policy controls16. The complete fourth source cohort seals1250 non-Markdown files/modes (SHA256f4a37df83ed06f096f6363b8ec711ec16f4ffb4cf9478542f34547529c3dbc4f), independently rechecked.
+
+Both fourth focused2 owners physically join0 (ARM76.441s/AMD174.231s), with484 aggregate Rust passes/27 summaries and one gated recovery preflight each. The final ARM full76 owner joins0 after412.097s, with558 passes/33 summaries and every exact resource once. Fourth host qualification joins0 after252.740s: standard9; default4,218/429 gated/82 summaries; feature4,359/497/82; strict1,969/33/20; Native3,078/19/41; audit/deny0. The original host-fourth wrapper first exits1 before running any command because a cloned old command-report pathname was wrong; its original script/receipt remain retained. Corrected fourth-retry owner/results are separately recorded and provide final host evidence; no failure is rewritten to green.
+
+The earlier third cohort is preserved: both full76 owners join0 (ARM418.752s/AMD2461.369s), but W391's image filesystem defect prevents those successful functional runs from qualifying the final package. The fourth source fixes it and adds the artifact gate. Final fourth AMD full76, source/build-export/artifact reconciliation, exact postconditions, final current-summary review and commit are still pending at this checkpoint. No native-x86/reference/Desktop/rootless/performance/load/promotion or complete M4 acceptance follows from these local functional prerequisites.
+
+## D99 final qualification and exact postconditions
+
+Task5.4a is complete on the retained native-arm64 VZ and emulated-amd64 QEMU functional lanes. The actual root Dockerfile compiles Step Functions with the existing default CLI, keeps source Cargo defaults unchanged, includes the security patch and matches Rust1.99.1. Its required readonly artifact gate binds the actual daemon/image/graph, verifies static ELF machines183/62, exact scratch contents, data65532:65532/0700, tmp65532:65532/1777, run0:0/0555 and the unchanged real healthcheck. A kernel inherited file-size cap and bounded physical TAR/gzip parsing protect inspection; no test-only alternate image establishes this result.
+
+Under the final1250-source seal, both original focused owners physically join0 (ARM76.441s/AMD174.231s) and both full owners physically join0 (ARM412.097s/AMD2453.155s). Each full gate executes every one of76 exact required resources once, with558 aggregate Rust passes/33 summaries. Each focused gate executes its two required Release resources once, with484/27. One durable-recovery preflight is separately gated in each; only the full gate subsequently executes that actual required recovery resource. Full gates retain the existing GNU topology and all official/custom RIC, ZIP, SDK, callback, managed IaC and fault consumers. Signed SDK42/46, nested .sync:2 child50, warm counters1/2/3, expected gateway rejection, actual image health, persisted identities and physical shutdown all pass.
+
+The permanent archive controls pass13 cases; actual composite Action controls pass26 under the independent unchanged Rust Runner; shared Rust server/archive/policy controls pass16. Action1 is a distinct exact process-resource profile, separate from Native26 and Docker76/43 ordinary/eight suites. The normal Action YAML contract and malicious-input/privacy/timeout/descendant controls use the actual body. The default Action CI consumer now asserts pure ASL21→42 and exact four-event history; local checks do not claim a remote CI run. W373 publication remains open.
+
+The final host owner physically joins0 after252.740s: standard9, default workspace4,218/429 gated/82 summaries, feature workspace4,359/497/82, strict boundaries1,969/33/20, complete Native3,078/19/41 and fresh audit/deny0. The first fourth host orchestration attempt fails before running commands because an old report pathname was cloned incorrectly; its original script/receipt are retained. The corrected fourth-retry owner supplies the final host results. Earlier real failed resources/cohorts, initial unsealed builds, raw archives and diagnostic/lint failures remain historical evidence; none is edited into success. D97/D98 artifacts remain immutable.
+
+Final source projection matches eleven actual named build exports plus four unchanged prebuild references per engine, giving fifteen distinct source IDs. The independent artifact proof decodes each actual full-gate saved image, matches its immutable ID to the corresponding build export and rechecks literal filesystem/health/static-ELF expectations. Final exact postconditions verify all26 CLI results and stdout/stderr hashes: zero all-state containers, volumes and forbidden private/test/pull references; fifteen source IDs preserved per engine. Only the two exact D99 engine/ID/name/nonce/driver/scope-bound empty bridges are removed. No forced production cleanup, global prune, context/VM restart, registry publication, tag or git push occurs.
+
+| Bound artifact under /tmp | SHA256 |
+|---|---|
+| rustack-d99-resource-code-seal.json | f4a37df83ed06f096f6363b8ec711ec16f4ffb4cf9478542f34547529c3dbc4f |
+| rustack-d99-source-build-exports.json | 6acc679104120fb731c44c8af1517b7aca90c435c65cb9f65dcf2e640e65f2d1 |
+| rustack-d99-release-build-proof.json | c373903c2a8b4793d07297e3925416833998aba3e75d3319e7f2a221608d1da9 |
+| rustack-d99-final-host-report.json | dba0a12e0aeef67244c3a277503de518a5dc6f91237ce444c73bc4ef1f7aa59a |
+| rustack-d99-postconditions.json | 6fb8303471bfa3c88ef74312d145e6aace8e27fcac3ccd363ce1ed6eb72a52ae |
+
+W371/W372/W374/W375 and W378–W396 are23 valid in-scope findings (one P1/fourteen P2/eight P3), fixed and independently rechecked. W373, required arm64/reference/Desktop/rootless, remaining performance/load and complete M4 remain open. After all original D99 runs and cleanup completed, the user explicitly waived further Linux x86_64 validation; [D100](./rustack-workflows-99-decisions.md#d100--linux-x86_64-validation-is-waived) governs future work and supersedes historical native-x86 blockers without relabeling QEMU evidence. Existing x86_64 implementation support and already completed records remain intact.
+
+
+## D101 direct Linux pure measurement review
+
+The independent read-only review identified five valid in-scope findings; completion polish identified an additional Cargo record-count boundary, independently rechecked. All six are fixed; no findings remain in this dependency. The reviewer ran no tests or resource mutations.
+
+| ID | Severity | Finding | Fix and evidence |
+|---|---|---|---|
+| W397 | P2 | The sum of per-group timeouts did not cover guest preflight/hash/report IO | Original guest450s/host530s POSIX alarms include local IO/publication; group deadlines clamp to the original cutoff, with independent late-preflight/alarm controls. |
+| W398 | P2 | An original alarm could interrupt an already-active physical retirement | Share the retained Runner with the guard; defer signals only while Runner.retiring, preserve its original3s join allowance and fail afterward. An observed held child receives an alarm during positively observed retirement and must be absent as PID/group. |
+| W399 | P2 | TERM/HUP/INT could bypass the Python owner's child retirement | Route all interruption handlers through the existing exception-driven owner and defer repeated signals during retirement; real-child controls signal each owner only after child entry and require failed owner plus PID/group absence. |
+| W400 | P3 | Byte-bounded nested JSON could raise an uncaught recursion traceback | Reuse the existing depth8/member512/string16KiB metadata decoder, normalize malformed/recursive data and independently reject deep, oversized-member/string, duplicate and nonfinite inputs. |
+| W401 | P3 | Short startup-relative test timers could race before held-child entry | Start the test phase clock only after observed child PID entry; deliver SIGALRM only during observed retirement and join the signal sender under the original test guard. |
+
+| W402 | P3 | Cargo artifact streams had byte/per-document caps but no record-count admission | Reject over4096 records before decoding under the existing4MiB stream cap; literal4096-positive/4097-negative controls prove exact admission and no decoder entry on excess. |
+
+The source implementation is [linux_performance.py](../tests/workflows/linux_performance.py), its independent controls are [test_linux_performance.py](../tests/workflows/test_linux_performance.py) and the executable contract is [verification§5.2](./rustack-workflows-70-verification-plan.md#52-direct-linux-arm64-pure-workflow-measurements-d101). Final gate/source/postcondition evidence is recorded in the [Linux measurement review](../docs/research/workflows-linux-performance-review.md). This prerequisite does not close dedicated-reference, image performance/load, Desktop/rootless, W373 or complete M4. D100's x86 waiver remains in force.
+
+The final Linux Make owner physically joins0, retaining six controls and two exact resources once. Thirteen independent Python controls pass. All13 host gates pass and their original owner joins0: standard9, default4,218/429 gated/82 summaries, feature4,359/497/82, strict1,969/33/20 and complete Native3,078/19/41, plus audit/deny. The Native verifier's SDK stage and its dedicated performance stage each emit two host reports; all four are retained separately, without deduplication or confusing them with the once-only Linux resources. Final dedicated host pure p95=10445µs; health/Stop maxima309/1101µs. The fresh audit scans498 dependencies against1,395 advisories; deny exits0 with its existing warnings, with no new ignore or policy relaxation. Source hashes/modes remain identical for all1252 inputs before/after gates. Seven readonly postconditions show the retained new ARM engine has zero containers/volumes/images and no running Rustack server; the original ARM profile remains4CPU/6GiB. No existing VM/context restart, global cleanup, image publication, push or x86 validation occurs. Dedicated-reference/image performance/Desktop/rootless/W373/full M4 remain open.
+
+
+## D102 image performance preflight review
+
+- **W403/P2:** active invocation counters alone cannot prove a readiness probe overlaps log flooding. Refine the fixture to retain an owned paced writer across an authenticated begin/release/end barrier and require matching request ID plus increased/unexhausted byte counts. Implementation and execution remain required.
+- **W404/P3:** the image transfer contract lacked numeric preparation caps. Bind three images,1GiB per archive/2GiB total,120s per save/load/600s preparation and inherited pre-dispatch file-size/output/process ownership bounds. Implementation and execution remain required.
+
+- **W405/P2:** the proposed pre-invocation Tokio baseline excluded WorkManager's legitimately lazy persistent supervisor. Prime once, delete/confirm physical cleanup, create the actual cycle function and record the baseline afterward; preserve all100 measured cycles and report priming separately. Actual quiescence qualification remains required.
+
+- **W406/P2:** DeleteFunction removes metadata/code storage without joining warm environment retirement; an immediate absence assertion misstates its contract and blocks cold/priming iteration. Use an explicit performance-only2s idle setting and a bounded15s physical-absence/zero-charge observation outside all Invoke timing. Keep the existing API semantics. The first actual warm owner fails cleanly at this dependency; its evidence remains retained.
+
+- **W407/P2:** actual cold20 SDK execution completes, but the successful initialization log also contains two startup self-test environments. Capture a bounded complete immutable prefix after readiness/before SDK spawn; require exact prefix equality after shutdown, then match every suffix event to the20 independently observed environments. Do not filter unknown post-baseline events or rely on line order. The original failed cold report/log remain retained.
+
+- **W408/P2:** save-by-tag could load a later unapproved artifact before mismatch detection. Save only the captured immutable ID and configure/verify guest fixtures by that same ID, leaving existing aliases intact.
+- **W409/P2:** beginning/end-only daemon checks left intermediate effects unfenced. Validate local Unix endpoints and check the captured engine before/after each save/load/image inspect/inventory; retain uncertainty after any mismatch, without retry/deletion.
+- **W410/P2:** per-file1GiB caps could exceed the2GiB total before post-save rejection. Pass the remaining total into the child and lower both inherited file-size limits before exec.
+- **W411/P3:** focused Make entrypoints did not enforce the claimed79-resource preflight. Add the existing manifest prerequisite and independently compare the guest's46 names with the frozen set.
+- **W412/P3:** the claimed Linux Python3.12 cohort was not enforced. Check the actual interpreter before dispatch and validate the reported minor version.
+- **W413/P2:** the live bracket timed a capabilities request rather than /_health/ready. Probe and validate that actual readiness route between the two accounting observations on the same persistent connection.
+- **W414/P3:** normalized initialization summaries used loose Python equality. Apply exact numeric/rank validation before comparison and reject boolean ranks with a literal1µs regression.
+
+- **W415/P2:** actual Linux startup correctly rejects the fixture's group-writable evidence ancestor: tempfile3.27 inherits the guest's0002 umask and creates0775. Explicitly request0700 in the retained server owner; do not weaken production ownership checks. Both original failed Linux roots/logs are retained.
+
+- **W416/P2:** the initial settled-task observation preceded the quiescence timer, producing development1µs samples that excluded the proving HTTP observation. Start at timeout return, include container/accounting queries and every task response under one2s cutoff, and reject a late first baseline match. Keep the old samples explicitly developmental and rerun final qualification.
+
+- **W417/P2:** immutable-ID Docker save/load creates untagged target images. The final third Linux warm workload succeeds but shutdown removes the final private relay/custom pin and Docker collects the imported image, so source-preservation audit returns404. Retain target-only content-addressed operator cache aliases, reject conflicting mappings without mutation, fence creation/inspection and check aliases before/after the guest workload. Preserve the failed third receipts and rerun with a new evidence cohort.
+
+- **W418/P2 (independent evidence-reader review):** the draft final cleanup reader accepted zero-exit counts without exact command/source/original-owner bindings. Before any Docker observation/effect, require the exact host15 catalog, unchanged owner scripts, physically joined original host/full owners and absent PIDs, hashed logs/reports, the completed Linux Make receipt, exact three guest names and current build/preparation hashes. The draft is corrected before execution; original host/full joins remain required.
+
+- **W419/P2:** the fourth complete ARM gate fails in the repeated-flood resource near cycle94, but the shared flood-observation-expired diagnostic drops begin/end phase, collector progress and the completed invocation outcome. Retain a bounded fixed phase/count/outcome diagnostic before propagating the original failure; no deadlines/counts or admission policy change. Preserve the failed full receipt/log/root and investigate the actual mechanism before accepting final qualification.
+
+- **W420/P2 (independent fixture-design review):** the flood producer imposes two undocumented100ms busy-poll guards, which reject progress still within the actual1s invocation budget. Their relationship to the fourth capture is unproven. Replace them with capacity-one nonblocking/coalesced progress notifications, authoritative atomic byte counters and one absolute1s cutoff shared across both phases; stale notifications cannot reset the cutoff. Preserve stop/join on every returned path and prove delayed progress, stale notifications, disconnect and nonblocking coalescing. Keep the failed capture and every actual acceptance deadline/count unchanged.
+
+- **W421/P3 (artifact-cohort audit):** the pre-full sixth Linux capture and full gate share identical platform config digests, but fixture rebuilds export different attested manifest-list IDs. Preserve the first capture as intermediate; after full completion, import its exact three exported manifest-list IDs and rerun final Linux resources without another image build. Bind export/name/config/manifest/index records, the complete full log and final preparation receipt before cleanup. Never substitute config equivalence for exact captured addressability.
+
+- **W422/P2 (source-cache audit):** canonical fixture rebuilds replace seven source aliases, and Docker removes their old unanchored addressable IDs. The original20-ID baseline audit detects seven missing IDs. All seven exact old graphs are recovered from retained BuildKit history:55 blobs/237127680-byte OCI archive, including five minimal provenance statements reconstructed from retained full predicates and verified against the original referenced SHA256 values. Guarded import restores all seven IDs, preserves current fixture tags and adds content-addressed cache anchors. Add a fenced pre-build retention step for exactly the seven rebuilt aliases under the canonical Make entrypoint, with first-provisioning, conflict, invalid/multiple-ID, immutable-capture and architecture controls. Preserve the incident and repair receipts; do not claim that no loss occurred before repair.
+
+- **W423/P3 (independent source-retention review):** the guard has no historical provenance input and cannot distinguish initial absence from prior loss. Correct the contract to preserve all observed aliases, record absences by the fixed seven-name allowlist minus the complete preserved-reference list, and support initial/partial provisioning. Keep the separate original-ID baseline audit responsible for past loss detection; do not claim the guard alone certifies historical completeness. No runtime/source behavior is relaxed.
+
+- **W424/P2 (independent final evidence review):** the draft cleanup reader lacks actual Linux launch/PID/join provenance and does not independently reparse its exact three successful cases/reports or bind report ELF hashes to Cargo-selected/current files. Preserve the weaker direct capture, rerun through an explicitly recorded owner/Make PID, and require source/script/argv/exit/PID/group absence plus raw-log/report/current-artifact equality before any Docker effect. Never invent a missing historical PID.
+
+- **W425/P3 (same review):** require the frozen565-pass/33-summary/one-gated full aggregate explicitly and recompute the three exact named Buildx exports from the hashed full log; do not trust zero-failure aggregates or an enclosing export-proof hash alone.
+
+**W426/P3 (final evidence wording review):** the measurement review conflated an ignored recovery preflight with its later explicitly executed resource. State both observations separately; retain the full aggregate's one ignored preflight and count the later successful resource exactly once. This is documentation precision only.
+
+### Final D102 qualification and exact postconditions
+
+The final seventh source independently rechecks clean against all W403–W426 (sixteen P2, eight P3). Host15, default4224/feature4365, strict1971, Native3078, image21/Linux14/Action26 controls and all standard/security gates pass. The original full ARM owner joins0 with79 exact resources once/565 Rust passes/33 summaries/one gated preflight. Its first canonical source-cache snapshot preserves7/7 observed fixture aliases before any builder.
+
+The wrapped final Linux owner and actual Make PID/group are recorded at launch, physically join0 and are absent afterward. All three exact raw cases/terminal summaries, guest/host/report equality, Cargo-selected current ELF hashes, three exact named full-build exports, imported IDs/archive hashes and original completion bindings independently validate. Final warm/cold p95=3196/165350µs;100 live-flood timeouts return task counts to15, quiescence p95/max=5539/9888µs. Every report remains referenceQualification=pending.
+
+W422's real source-cache loss is repaired by restoring seven exact old graphs; five reconstructed minimal statements match their original referenced SHA256 values, and all55 graph blobs independently hash from the seven retained host archives. All original20 source IDs are addressable again. The final reader enforces every owner/source/raw-log/artifact/export/recovery/cache binding before any Docker effect, then48 successful CLI operations prove zero all-state containers/volumes/forbidden aliases,32/15 retained source/target IDs and removal of only two exact nonce-owned empty bridges. VMs/images and all earlier evidence remain retained.
+
+The original fourth flood-observation failure remains unexplained; the concrete100ms fixture scheduling guards are removed without claiming that exact cause. No historical failure is rewritten as green or ignored within an accepted workload. See the [full measurement and incident review](../docs/research/workflows-image-performance-review.md). Dedicated-reference/Desktop/rootless, remaining load/correctness, W373 and whole M4 remain open; no new x86 validation, publication, push, restart or unrelated cleanup occurs.
+
+## D103 rootless bootstrap review W427–W434
+
+Scope: [rootless bootstrap/attestation](./rustack-workflows-58-rootless-platform-design.md), not complete platform qualification. All eight P2 corrections below are fixed; the independent read-only reviewer reports no remaining concrete in-slice source findings.25 normal controls and actual retained installation/recovery/repeat-attestation/root-owner observations pass. [Full evidence](../docs/research/workflows-rootless-platform-review.md) preserves the three failed owners rather than rewriting them as successful installation runs.
+
+| Finding | Boundary and correction |
+|---|---|
+| W427/P2 | `rootless_platform.py` delegation: visible controllers alone did not prove delegation. Bind systemd DelegateControllers, manager enabled subtree and actual UID/writability of both delegated control files. |
+| W428/P2 | Privileged system-file publication: check-then-install could overwrite a concurrent destination, and identical bytes alone did not prove safe metadata. Use root-owned same-directory fsynced temporary publication by no-replace link; require regular root-owned0644 exact bytes and safe parent metadata. The concurrent-publication control preserves unrelated bytes. |
+| W429/P2 | Privileged lifetime: an unprivileged Runner cannot assume signalling authority over sudo descendants. Use uniquely recorded root systemd jobs with independent runtime/start/stop/cgroup kill bounds. An actual root TERM-ignoring process, group and exact service retire under those bounds. |
+| W430/P2 | Pre-effect ownership: post-return receipts lost exact root-job identity on interruption. Fsync exact intent/argv/cutoff before dispatch and retain results separately; failed/lost replies keep the intent. |
+| W431/P2 | Deadline reserve: intent IO could consume the privileged lifetime margin. Recheck lifetime plus full reserve after fsync; delayed publication must prevent dispatch without extending the cutoff. |
+| W432/P2 | Observed existing-repository conflict: Colima already supplies Docker's signed source/key. Verify/reuse the exact canonical configuration/key and reject duplicate/unfamiliar sources before apt; preserve the original failed attempt. |
+| W433/P2 | Observed early OS boundary: `/etc/os-release` is a symlink. Read the canonical trusted `/usr/lib/os-release`; allow explicit setup resumption only after proof that no guest setup state exists. |
+| W434/P2 | Observed final report boundary: legitimate rootless sticky socket mode and subordinate socket group differ from a plain primary-group socket. Preserve safe sticky bits, record primary GID/maps, derive namespace socket GID991 and independently recover the completed installation proof read-only. |
+
+No Rust code, dependency/toolchain/build/test target behavior changes in this dependency; Rust gates are not applicable. Required future rootless kernel/resource/functional/performance consumers, Desktop/reference/load/W373 and full M4 remain open. Keep `platformQualification=pending` until those exact consumers pass.
+
+## D107 code-first independent review (execution pending)
+
+The user requires code completion before test execution. Read-only reviewers found and drove corrections to: missing default/feature doctests; a nested unguarded source-inventory owner; omitted Action/examples/build inputs; stale production-image import provenance; missing O01 successor/entry oracles; O04 second-owner spawn cleanup and causal recovery overlap; the explicit SIGKILL receipt; the custom RIC event cap; O03 typed restore diagnostics; scoped GH credentials; raw Rust/reference report validation; aggregate evidence bounds; eager PAX allocation; mutable registry-tag races; exact candidate-versus-consumer image binding; and platform execution-versus-postcondition engine attribution. The corrected design/source is in59/D107. Reviewers executed no build, tests, network probes or resource actions. Historical D102/D103 results remain historical; D104–D107 modified sources still require a fresh complete qualification cohort. No final phase/release exit is claimed.
+
+## D108 actual-evidence review
+
+W435/P2: release_qualification.lane reused its envelope-name argument for parsed test names; actual Native lane-validation.json consequently paired a test-name path with the lane envelope hash, breaking selective packing. Rename the envelope and parsed-resource variables separately and require exact returned paths/hashes in every lane branch, including Rust logs containing unrelated test rows. The original defective artifact remains retained at /Users/tchen/.target/workflows-native-d108-first/lane-validation.json. Fixed and independently rechecked. All18 delivery controls,232 Python controls,15 full Rust gates and both recorded Native commands pass under3229c2fb4a7479509570a8befdc4eb2efe4ecac096acc301e2393042c2573690. Actual corrected Rust/Native lane outputs preserve the exact lane.json path/hash. Current runtime matrices are separate remaining qualification work; earlier raw successes remain under their original seal.
+
+W436/P2 (fixed and independently reviewed; complete source-cohort qualification pending): image_performance_sdk.py samples final admission/completion before the live metadata GET, so a delayed response can leave stale evidence at release. Reorder those observations, recheck completion at release, and retain bounded phase timings/collector write acceptance to localize the real end-handshake failure. This is a confirmed oracle defect; the cycle89 failure's exact cause remains unproven. No deadline or cycle-count waiver is allowed.
+
+W437/P2: tests/lambda-fixtures/image.Dockerfile inherited source executable permissions. Actual umask077 rebuild produced root-owned0700 /image-bootstrap and /alternate-bootstrap, so non-root starts failed with Docker400 before the protocol. Retained layer proof: /tmp/rustack-d110-permission-proof/proof.json. Fixed both COPY modes explicitly to0555 and independently rechecked. The corrected immutable layer proof and actual100-cycle non-root resource pass under83b25711eadbd18016687c6ee7af01118e5bb87528aa269ea143a416da123af9; bad IDs remain retained. Complete source-cohort qualification still follows. This does not explain historical cycle84/89 failures.
+
+## Final D110 code and saved-evidence review
+
+Independent read-only source/evidence review reports no remaining concrete findings. Frozen source83b25711eadbd18016687c6ee7af01118e5bb87528aa269ea143a416da123af9 has1224 source files. All15 Rust gates,245 independent Python controls, complete Native/Action and full83-case rootless execution pass with joined owners and source-bound raw receipt validation; both actual release modes validate. Eight exact empty owned rootless bridges and the SSH/socket owner retire without force, retaining all images. W435–W437 and the D110 observation races are fixed/rechecked; all failed cohorts remain unchanged. After the user accepts preserving foreign resources, an initially empty isolated rootful daemon receives15 verified immutable archives and a real same-engine five-image rebuild, then passes all83 exact cases with joined owner78786. The actual assembler validates335 raw receipts and both release modes against that daemon's rebuilt release image. Two exact empty task-owned rootful bridges are removed non-forcibly; all images and foreign containers/volume remain preserved. Docker Desktop/dedicated ARM reference/full M4 remain open; D100's x86 waiver persists. Older cohort commit bindings remain unchanged; no complete same-commit release bundle, publication or remote CI is claimed. See [the full ledger](../docs/research/workflows-final-consumers-review.md).
+
+## External compatibility review W438–W446
+
+External compatibility continuation finds W438/P2: the generic sequential-predecessor rule omitted AWS's initial-root-entry exception, and registered ExecutionStarted omitted the captured roleArn. Actual unchanged upstream AWS snapshots identify first root previousEventId0 and role metadata; /Users/tchen/.target/workflows-localstack-pure-third retains the original failures. Correct the API/ASL contract and both sequential/structured production histories, without adding snapshot masks. Earlier 83-case passes remain historical and do not establish this external contract. Separate adapter faults (AWS base-transformer registration and role-factory keyword signature) remain recorded as harness failures, not product compatibility results.
+
+- W439 (P2, in phase): original AWS Map/Parallel snapshots expose differences in successful-join predecessor linkage, serial Map iteration admission and retried-round failure publication. Correct the explicit causal projection and scheduler recovery metadata; preserve concurrent frame isolation, terminal reservation and failed evidence.
+- W440 (P2, spec defect corrected): the formal ASL ItemProcessor/Iterator synonym and the original INLINE Iterator snapshot permit ProcessorConfig under either spelling. Remove the accidental legacy-only prohibition while retaining Mode=INLINE and nested-field validation; Parallel branches still reject ProcessorConfig.
+- W441 (catalog fault): four Docker snapshot parameter IDs no longer exist in pinned upstream source. Exact preflight rejected them before creating the server or resources. Keep their exclusion reasons and original failed preflight; select the 32 actual source nodes under a new manifest identity.
+
+- W442 (P2, in phase/spec correction): original Docker cases expose double encoding of optimized serialized-string Payload, null Payload default, noncompact function-error Cause, optimized missing-function start/failure ordering and manufactured timeout Cause/error fields. Correct these separately from deliberately redacted service-error text and unsupported redrive metadata. Preserve all failed observations and original masks.
+
+- W443 (P2, independent W442 review): numeric serialization can expand a valid raw FunctionError beyond the ordinary materialized payload ceiling before Cause truncation. Use a bounded prefix writer, preserve errorType, and add numeric-expansion plus UTF-8 truncation regressions. The first standard-gate sequence was deliberately retired after six passing gates to finish this code correction before restarting verification.
+
+- W444 (P2, in phase): the StringToJson original method also exposes valid integer -0 becoming float -0.0. Correct integer-token normalization at arbitrary JSON depth with a bounded quote/escape-aware scan after original validation; preserve floating/exponent negative zero, strings, duplicate-key rejection and original input quotas. Keep whitespace-only rejection as a separate deliberate difference.
+- W445 (local regression oracle): the original Native optimized-Payload fixture still expected explicit null and ordinary string values under the superseded local convention. Update only that Rustack-owned test to the independently observed serialized-string/null-default contract; upstream assertions remain unchanged.
+
+- W446 (local regression oracles): complete Native SDK execution exposed additional Rustack-owned root-entry predecessor and overall-timeout expectations retaining the superseded linear/States.Timeout conventions. Update the Rust SDK/documented/nested/callback history checks, the shared SDK timeout oracle and the Map admission checks to the independently verified contract; retain every later linear link and assert explicit absence of timeout fields. No original upstream expectation is changed.
+
+
+### Final external evidence review
+
+All W438–W446 implementation/oracle findings are fixed and independently rechecked. The final read-only evidence audit recomputes1232 files under source `c16d68e41d4ee7177adcf895fec201f3d0269d796a17058aae026fa7778aa282`, validates all four report hashes and raw command/log/source bindings, original91/32 node inventories and all baseline/assertion receipts, immutable six-handler image affiliations, binary identity and joined cleanup. Rust15/15, Native3121 passes in41 summaries (19 separately gated resources), actual Action26 controls and adapter13 controls pass. Original external pure88/91 and Docker30/32 retain nonzero failure status: three formal-profile restrictions and two static service-Cause differences. Valid integer -0 now matches the original AWS observations; no executed case, original baseline or mask is changed. Review finds no additional code/evidence issue. See [the detailed ledger](../docs/research/study-localstack-workflow-tests.md#final-source-cohort-verification). Strict external acceptance and full M4 remain open; older83-case records are not relabeled as this source.
+
+
+## D114 code-first observed-AWS compatibility review
+
+- W447/P2 fixed: extracted the response-mapping helper to keep the invocation owner below the strict length limit, preserving actual response timestamps, ID and handle/cancellation lifetimes.
+- W448/P1 fixed: avoid a production-only dependency on the test-only uuid import; validate the inferred source UUID version and RFC variant through its public methods/bytes. Nil/non-RFC controls and typed source failures remain covered.
+- W449/P3 fixed: use key-based unstable sorting for deterministic object rendering, satisfying the existing pedantic gate. All core944, bridge30 and preserve-order expression96 focused checks and strict production core/library Clippy pass.
+
+Independent read-only review finds no remaining concrete implementation issue before resource execution. Original123 node IDs, upstream baseline hashes and masks remain unchanged. Rewording Format2's historical exclusion does not remove/add a node, and triggers a new manifest/image receipt rather than restamping old evidence. Actual91+32 execution, full current-source gates and final saved-evidence review follow under a frozen source; no passing result is claimed yet.
+
+W450/P3 fixed during full checks: add digit separators to the deliberately non-RFC UUID test literal. The first D114 external run is91/91 and32/32 with joined cleanup; the standard feature Clippy/Native preflight rejects only that test formatting issue. Preserve the original successful external and failed gate receipts, then rerun the exact final source without suppression.
+
+
+### D114 final saved-evidence acceptance
+
+Independent read-only audit recomputes all1232 current execution/tooling files under3207a320a329820fa1d0890145c9518b3be6488a3ef402c684667d700e34b226, matches all four report hashes and raw command/log/intent/source affiliations, and validates the unchanged original91/32 node sets, vendor hashes and123 baseline copies. All15 Rust gates and both Native/Action commands exit0 with joined groups; Native has3231 passing outcomes in42 summaries and19 separately gated resources, and the actual Action owner passes26 controls. External pure91/91 and Docker32/32 pass every setup/call/teardown and complete original snapshot comparison; all five prior failures now pass with no added skip paths (StringToJson10/10). Current binary739d037a... and new immutable image receipt e25fd654... agree with intents and cleanup receipts. Both server/capture owners join, exit successfully and prove owned-resource absence; the real Docker namespace audit is performed. The six original handler/build/result/digest affiliations match the new manifest539de576... on the recorded575aa85f engine. No additional finding remains. Detailed raw report paths/hashes and historical failures are in the D114 research ledger; no whole-upstream/live-AWS/current83/M4 claim follows.
+
+
+## PR76 CI regression corrections
+
+- The Action smoke retained the pre-D113 predecessor sequence. Require the exact four-event sequence and IDs as before, with predecessors `[0,0,2,3]` per design10 and the original AWS observations. Keep all payload, state-name and pagination assertions.
+- The native stale-revision test started an incomplete request before compressing and publishing the replacement ZIP, then incorrectly required at least four seconds of remaining cleanup. Publish the revision first, establish body collection using HTTP100 Continue, require replacement invocation to remain pending while the body is withheld, then release the request body before the independent drain deadline. Require the closed session response503 plus EOF and the old process to be reaped before accepting the replacement result. Withholding a body through the five-second graceful drain correctly fails settlement; the original success test must not require that hostile-peer path to succeed. No runtime deadline or production cleanup behavior changes.
+- Stable rustfmt rejected a multiline format macro accepted by nightly. Express the same environment bytes through explicit concatenated literals and named format arguments. `make fmt-check` runs both formatters; the existing recorded Rust fmt gate consumes that target.
+
+Code review verifies unchanged runtime behavior and request budgets, the exact D113 causal links, and removal of packaging time from the HTTP deadline observation. Validation results are recorded after execution; historical D114 receipts remain unchanged.
diff --git a/specs/rustack-workflows-99-decisions.md b/specs/rustack-workflows-99-decisions.md
new file mode 100644
index 00000000..22e939f8
--- /dev/null
+++ b/specs/rustack-workflows-99-decisions.md
@@ -0,0 +1,835 @@
+# Workflows 99: Key Decisions and Glossary
+
+Status: accepted design decisions; implementation evidence is tracked in the phase ledger/review · Date: 2026-10-27
+
+Supersede decisions with a new ID rather than rewriting their rationale after implementation. Component documents own detailed behavior; this document owns the reasons.
+
+## D1 — Own a bounded STANDARD/JSONPath interpreter
+
+- Context: other projects need actual state transitions and fault behavior, not only API-shaped responses.
+- Alternatives: wrap Step Functions Local/LocalStack; embed a general durable-workflow product; implement every ASL dialect immediately.
+- Decision: implement typed ASL compilation and an actor-based interpreter, initially STANDARD and the documented JSONPath profile.
+- Why: Rustack owns correctness, shared-service integration and lifecycle without external emulator dependencies. Explicit limits avoid accidental JSONata or EXPRESS claims.
+- Pinned by: [PRD scope](./rustack-workflows-00-prd.md#4-release-scope), [compiler/profile](./rustack-workflows-30-asl-design.md#1-compile-before-execution).
+
+## D2 — Keep Docker Runtime API inside each execution environment
+
+- Alternatives: publish a wildcard host Runtime API; assume host.docker.internal can reach host loopback; forward invokes to RIE; rewrite user-image entrypoints with an injected launcher.
+- Decision: use a small relay plus the unchanged function image sharing a network namespace; control traffic uses framed Docker attach.
+- Why: host loopback is not container loopback; publishing Runtime API complicates isolation; RIE is unnecessary when Rustack owns the Runtime API. A relay preserves arbitrary valid RIC image entrypoints and works without host-address assumptions for control traffic.
+- Cost/evidence: two containers per environment and a versioned relay artifact. Full composition is unproven until P0; this decision does not waive that gate.
+- Pinned by: [Lambda architecture/transport](./rustack-workflows-20-lambda-runtime-design.md#1-ownership-and-execution-contract), [P0](./rustack-workflows-90-impl-plan.md#3-p0--evidence-and-risk-retirement).
+
+## D3 — Pin content at deployment, not on each invocation
+
+- Alternatives: pull by tag per invocation; freeze only published numeric versions; treat local content IDs as registry digests.
+- Decision: latest and published revisions both capture resolved image content and full execution configuration; local content identity is explicitly distinguished from registry manifest identity.
+- Why: tag movement and warm reuse must not change code silently; version tests need real immutable artifacts, including ImageConfig and architecture.
+- Pinned by: [image resolution](./rustack-workflows-20-lambda-runtime-design.md#2-image-resolution-and-deployment-lifecycle), [snapshot image references](./rustack-workflows-60-operations-design.md#3-shutdown-cancellation-and-snapshots).
+
+## D4 — Preserve one Lambda admission and execution path
+
+- Alternatives: call Docker directly from ASL; use an HTTP AWS SDK client against Rustack itself.
+- Decision: binary-owned LambdaTaskPort adapter calls the existing provider through a cancellable invocation-handle contract.
+- Why: reserved concurrency, versions, backend failures and cleanup must match ordinary Invoke; an internal port avoids protocol overhead and recursive HTTP request-permit deadlock.
+- Pinned by: [integration ports](./rustack-workflows-40-integrations-design.md#1-internal-ports-and-dependency-direction).
+
+## D5 — Compile definitions and keep execution mutation in one owner
+
+- Alternatives: interpret serde_json maps each step; share mutable execution state through Mutex/RwLock; spawn one task per Map item.
+- Decision: immutable indexed IR plus one ExecutionActor with bounded frames, timers and external-call futures.
+- Why: validation happens before side effects, generations settle races consistently, and fan-out cannot become an unbounded task tree.
+- Pinned by: [ASL compiler/scheduler](./rustack-workflows-30-asl-design.md), [history](./rustack-workflows-10-api-design.md#6-history-and-pagination).
+
+## D6 — Implement `.sync` only for a real supported job integration
+
+- Alternatives: accept `.sync` on Lambda/arbitrary tasks; equate child start acceptance with child success; implement ECS-shaped responses without ECS execution.
+- Decision: ordinary Lambda invocation awaits its result; `.sync` and `.sync:2` apply to nested Step Functions in this release.
+- Why: production AWS ASL compatibility matters more than permissive local syntax. Nested child completion is a real job boundary; string-versus-JSON Output and ownership cancellation are observable contracts.
+- Pinned by: [allowlist](./rustack-workflows-40-integrations-design.md#2-integration-allowlist), [nested execution](./rustack-workflows-40-integrations-design.md#4-child-workflows-and-sync).
+
+## D7 — Expose uncertain side effects rather than replay automatically
+
+- Alternatives: retry every Docker transport failure; claim exactly-once function execution; release permits when the caller stops waiting.
+- Decision: no hidden business-call retries; explicit ASL Retry may repeat work; generation invalidation and supervised cleanup retain uncertain resources.
+- Why: a broken connection cannot establish whether user code already changed another service. Resource ownership must outlive response futures.
+- Pinned by: [Lambda cleanup](./rustack-workflows-20-lambda-runtime-design.md#4-environment-states-pooling-and-cancellation), [error mapping](./rustack-workflows-40-integrations-design.md#3-lambda-requestresponse).
+
+## D8 — Preserve snapshot semantics without claiming durable workflow recovery
+
+- Alternatives: add a new database/WAL immediately; serialize live handles/timers; replay all RUNNING tasks on restart.
+- Decision: persist definitions, terminal histories and independent name reservations; quiesce/cancel active work before normal saves; never replay imported RUNNING calls.
+- Why: existing snapshots are graceful-save archives. Exactly-once recovery requires a separate durable command/outcome protocol and external-side-effect strategy; serializing structs cannot provide it.
+- Pinned by: [snapshot contract](./rustack-workflows-60-operations-design.md#3-shutdown-cancellation-and-snapshots).
+
+## D9 — Support callbacks with scoped credentials and provisional completion
+
+- Alternatives: accept only callbacks arriving after Lambda returns; let an early callback hide Lambda failure; persist raw task tokens in diagnostics.
+- Decision: register tokens before dispatch, stage early callbacks, commit only after successful invocation, and redact injected tokens before history persistence.
+- Why: real handlers can callback immediately; old attempts must not complete new work, and task tokens authorize state transitions.
+- Pinned by: [callback protocol](./rustack-workflows-40-integrations-design.md#5-callback-and-heartbeat-m3).
+
+## D10 — Make local operational limits visible
+
+- Alternatives: inherit unlimited Docker resources; enable code execution by default; silently discard history or unsupported fields.
+- Decision: explicit Docker opt-in, startup probes, bounded quotas, local-only transport and detailed capabilities; retain existing YAML settings.
+- Why: honest local restrictions are testable. Docker permissions, tmpfs memory accounting, native-architecture coverage and non-IAM role metadata cannot be mistaken for AWS parity.
+- Pinned by: [operations](./rustack-workflows-60-operations-design.md), [security/performance gates](./rustack-workflows-70-verification-plan.md).
+
+## D11 — Apply P0 protocol evidence before implementing consumers
+
+- Context: independent review and actual transport/SDK probes exposed gaps in the original draft.
+- Decision: require BootstrapReady, default omitted Lambda architecture to x86_64, use callback TaskTimedOut for known closed tokens, generate numeric epoch-second HTTP timestamps, and decode both nested Input/Output for `.sync:2`. Optimized nested dates use epoch milliseconds. Use StdinOnce=true for the environment's single attach lifetime.
+- Why: actual EOF tests distinguish detach from process stdin closure; ordinary SDK behavior and pinned AWS-validated snapshots establish observable wire distinctions. Current official errors take precedence over older snapshots.
+- Pinned by: [runtime spike](../docs/research/spike-lambda-container-relay.md), [semantic evidence](../docs/research/spike-stepfunctions-semantic-oracle.md), [required review fixes](./rustack-workflows-93-review.md).
+- Date:2026-10-25. These amendments refine D2/D6/D9 without changing the complete M0–M4 scope.
+
+## D12 — Separate resource, resolved revision and invoked reference
+
+- Alternatives: identify warm environments by function name/alias; use configuration RevisionId as the resource lifetime; reconstruct the invoked ARN from the resolved version.
+- Decision: allocate a stable nonnil resource UUID, capture resolved execution configuration by value, and preserve the caller's qualifier separately for Runtime API metadata.
+- Why: a recreated name must never acquire a deleted resource's environment, aliases can move without rewriting handler metadata, and snapshots must preserve the same resource identity. Importing legacy snapshots assigns an identity once; invalid or duplicate saved identities reject restore.
+- Pinned by: [invocation capture](./rustack-workflows-20-lambda-runtime-design.md#24-invocation-capture-and-resource-identity).
+- Date: 2026-10-25.
+
+## D13 — Own code through staging, publication and invocation cleanup
+
+- Alternatives: pass independent ZIP paths/bytes/image options; retain every rejected staging result until shutdown; drop extracted code with its function store.
+- Decision: use a closed artifact enum, shared ZIP leases, validated immutable image metadata and a rollback guard for unpublished ZIPs. Validate normalized settings before source IO; commit new ownership only after insertion/CAS or full restore validation.
+- Why: request cancellation must not delete live code or retain rejected uploads. The archive, extracted root and hash must describe the same staged data, and restoring a candidate must not leak its new artifacts on failure. Native process supervision retains its lease through child exit.
+- Pinned by: [artifact representation and ownership sequence](./rustack-workflows-20-lambda-runtime-design.md#25-captured-artifact-representation).
+- Date: 2026-10-25.
+
+## D14 — Separate cancellation, caller response and resource settlement
+
+- Alternatives: abort backend futures at the HTTP/Task deadline; release capacity as soon as a caller returns; rely on Squib's best-effort RAII shutdown.
+- Decision: immutable Arc execution revisions, one attempt UUID/deadline, attached invocation handles and a bounded work actor. Backend cleanup survives dropped/expired waiters, and clean settlement follows resource cleanup and permit release. Idle VM Drop and Native warm-retention rejection follow the same ownership rule.
+- Why: a caller timeout does not prove a process/VM has stopped. The pinned Squib0.2.0 startup/shutdown futures temporarily own VMM join handles; its raw Drop only attempts a shutdown message. Cancelling those futures cannot establish cleanup. Capture the parent Tokio handle for retained cleanup and shut down that runtime only after service settlement.
+- Pinned by: [execution revision](./rustack-workflows-20-lambda-runtime-design.md#26-execution-revision-ownership), [cancellation and supervisor contract](./rustack-workflows-20-lambda-runtime-design.md#27-cancellable-invocation-and-supervisor-contract).
+- Date: 2026-10-25.
+
+## D15 — Confirm poll consumption before committing runtime delivery
+
+- Alternatives: treat a successful oneshot send as delivery; rely solely on biased select ordering across receipt and mailbox channels; leave an unconsumed event in Delivered until timeout.
+- Decision: retain Invocation ownership in Offering until next() consumes its reply and acknowledges a per-poll receipt. Recover the queued event if that receipt closes. Reconcile ready receipts and revalidate stop/cancellation/deadline synchronously before each command/transition.
+- Why: a sent response can be dropped without being consumed, and a receipt arriving between select branch polls can race a completion command. Explicit receipt ownership prevents lost events and false UnknownAttempt/initialization outcomes. Transport adapters still retire environments on failed HTTP delivery; session receipt is not proof of user-code execution.
+- Pinned by: [shared session ownership and state diagram](./rustack-workflows-20-lambda-runtime-design.md#32-runtime-session-ownership).
+- Date: 2026-10-25.
+
+## D16 — Enforce HTTP dependency secrecy and retain adapter retirement
+
+- Alternatives: redact only application Debug; trust RUST_LOG defaults; reject trailers after decoding without filtering the dependency; drop invalidated warm API handles without awaiting retirement.
+- Decision: task-bound Hyper/hyper_util verbosity filtering independent of the application's subscriber, no supported HTTP trailers, and explicit joined API/process retirement on revision invalidation and shutdown. Cache supervision failures and retain the complete Native cleanup future across dropped/concurrent waiters.
+- Why: pinned Hyper1.11.1 logs buffered trailer contents before application validation. Dropping a handle only signals asynchronous cleanup and cannot establish that an old listener's connections have finished. First-poll readiness, joined retirement and checked metadata let Native and the future Docker relay share one actual session engine.
+- Pinned by: [shared HTTP adapter and Native startup](./rustack-workflows-20-lambda-runtime-design.md#33-shared-http-adapter-and-native-startup), [review W20–W22](./rustack-workflows-93-review.md#p1-task12-shared-http--native-migration-review).
+- Date:2026-10-25. The separate mandatory Bollard filter W01 remains required when Docker is implemented.
+
+## D17 — Retain relay IO ownership through bounded control settlement
+
+- Alternatives: read stdin through Tokio's blocking adapter; read control frames inside a cancel-and-restart select branch; treat channel enqueue as successful emission; discard completed worker errors when priority stop wins.
+- Decision: Linux nonblocking owned pipe descriptors, dedicated supervised reader/writer tasks, bounded two-message mailboxes and explicit flush receipts. Retain attempt tickets across cancelled result polls, join the API on every exit, and preserve completed IO failures while draining aborted workers. Matching duplicate Cancel is idempotent and never refreshes retirement.
+- Why: a blocking stdin read can hold process shutdown open; restarting a partial read corrupts framing; an enqueued Ack does not prove it reached the host. Cancellation only invalidates the session, so the separate host owner must still terminate/remove the function. Real relay/RIC process tests complement the in-memory contract tests without claiming deployment/pool or SDK acceptance.
+- Pinned by: [relay control supervisor and process entry point](./rustack-workflows-20-lambda-runtime-design.md#34-relay-control-supervisor-and-process-entry-point).
+- Date:2026-10-25.
+
+## D18 — Keep host protocol state separate from retained stream parsing
+
+- Alternatives: let the Docker environment read/write raw frames directly inside cancellation selects; reconnect after attach failure; put container cleanup into the runtime library.
+- Decision: an ordered host ControlClient consumes shared supervised stream workers. Mailbox receive is cancel-safe, partial parsing never restarts, and an interrupted send poisons later business operations until joined retirement. Close preserves ordinary validation of preceding events; cancellation discards only one matching late outcome before its acknowledgement.
+- Why: Docker cancellation can race a flushed result or a partial read/write. The host must preserve framing and exact attempt identity without interpreting uncertain transport state as permission to replay or reuse. Container termination and allocation reservations remain with the environment owner that can prove them.
+- Pinned by: [host control client and shared stream ownership](./rustack-workflows-20-lambda-runtime-design.md#35-host-control-client-and-shared-stream-ownership).
+- Date:2026-10-25.
+
+## D19 — Bound Docker transport before generated-model materialization
+
+- Context: P1 consumer source review of pinned Bollard0.21.1 found whole-body collection, response-body work outside the header timeout, an attach decoder without a Rustack frame cap and console/trailing-EOF fallback.
+- Alternatives: ordinary pipe client with post-deserialization checks; a counted custom connector plus a second raw attach transport; a local forwarding proxy; duplicate Docker model definitions.
+- Decision: reuse model-only bollard-stubs1.53.1-rc.29.3.1 and implement the narrow, bounded Unix HTTP/upgrade boundary over the workspace Hyper/Tokio stack. Keep generated wire contracts, strict pre-materialization bounds, joined drivers and the mandatory dependency diagnostic filter.
+- Why: checking after collection cannot bound earlier allocation, and an outer CBOR decoder cannot validate opaque Docker buffering first. The custom transport's Response<Incoming> type does not directly accept a Limited body wrapper. Owning the small required operation set avoids a proxy/second connector while preserving explicit cleanup and no-replay semantics.
+- Supersedes: the initial recommendation to enable Bollard's ordinary pipe client in runtime §7; D2's relay architecture and the P0 feasibility evidence remain unchanged.
+- Pinned by: [bounded Docker API boundary](./rustack-workflows-20-lambda-runtime-design.md#36-bounded-docker-api-boundary), [pinned source study](../docs/research/study-bollard-docker-transport-boundaries.md).
+- Date:2026-10-25. Production acceptance still requires the specified fake-daemon and real image tests; source inspection alone closes no runtime gate.
+
+## D20 — Separate lifecycle waits from destructive cleanup capacity
+
+- Context: a Docker wait request can remain pending for an environment lifetime. Sharing two reserved management slots with waits can prevent Kill/Remove from ever reaching the daemon.
+- Alternatives: use the ordinary business lane; increase one shared queue; poll container inspection repeatedly; allocate a dedicated bounded wait lane.
+- Decision: retain six short business jobs and two reserved inspect/kill/remove/list jobs, plus a separate lane of at most32 concurrent wait jobs with an eight-command mailbox. Environment owners issue at most one wait per environment. Attach handoff releases its short management slot before warm reuse.
+- Why: waiting for external termination must not consume the capacity needed to cause that termination. Separate admission and retained supervision provide bounded ownership without cleanup starvation.
+- Pinned by: [Docker request ownership and quotas](./rustack-workflows-20-lambda-runtime-design.md#36-bounded-docker-api-boundary); executable held-wait and business-saturation regressions in the Docker wire tests.
+- Date:2026-10-25. The wire lane does not itself own container lifetime or prove successful cleanup.
+
+## D21 — Resolve the selected executable image, not its parent index
+
+- Context: the live Engine29.5.2/containerd image store returns an index Id for unqualified inspection and a child-manifest Id for platform-qualified inspection; RepoDigests may continue naming the parent index, including for unpushed BuildKit-loaded local images.
+- Alternatives: always use inspect Id without a platform; take the first RepoDigest; require a registry round trip for every local deployment; request/validate the selected platform and keep local/registry representation explicit.
+- Decision: platform-qualified read-only local resolution validates executable child identity, retains validated inherited execution defaults and derives an explicit Docker-create plan preserving empty overrides, rejects unresolved index descriptors, and derives registry child references only from matching repository evidence. Capture the addressable parent Id before platform inspection, retain the selected child descriptor independently, and create by immutable parent Id plus explicit platform; the selected child Id is not necessarily a locally addressable image object. Recompute the canonical execution fingerprint during restore. Short local names retain local://Id. Legacy descriptor-free images remain supported on older compatible APIs.
+- Why: deployment pinning must survive tag movement and daemon default-platform changes without inventing registry provenance. Inspection hashes must also be deterministic across irrelevant metadata/map ordering.
+- Pinned by: [local resolution](./rustack-workflows-20-lambda-runtime-design.md#28-local-image-resolution-and-selected-platform-identity), [live/source evidence](../docs/research/study-bollard-docker-transport-boundaries.md#platform-specific-image-identity-follow-up).
+- Date:2026-10-25. This refines D19's generated Id representation; it does not promise registry existence, cross-platform execution or completed deployment/provider integration.
+
+## D22 — Own private image aliases through deployment and invocation lifetime
+
+- Context: immutable IDs prevent tag drift but do not retain addressability when mutable image references are replaced. A prepared revision also needs unpacked-size proof rather than containerd compressed Size.
+- Alternatives: rely on an operator tag/ID remaining present; hold never-started containers per revision; create private aliases under validated owner/run/pin identities with retained lease supervision.
+- Decision: a bounded image lease actor prepares a private alias, verifies immutable identity and unpacked quota, and publishes a shared live artifact; only known private aliases can be removed. Record mutation phase before IO and retain uncertain cleanup/reservations across caller cancellation, deadlines and supervised recovery.
+- Why: published versions and captured calls must own artifact availability. Observing one absent alias after an uncertain tag does not prove that a late tag cannot appear; visible matching commit followed by removal can establish cleanliness. A root/worker failure must preserve these identities rather than merely release permits.
+- Pinned by: [owned image preparation](./rustack-workflows-20-lambda-runtime-design.md#29-owned-image-pins-and-deployment-preparation), [transport/source study](../docs/research/study-bollard-docker-transport-boundaries.md).
+- Date:2026-10-25. Provider status/CAS, allowed pulls, directory ownership and previous-run reconciliation remain separate required consumers.
+
+## D23 — Store-issued deployment generations and live captured images
+
+- **Context:** image preparation completes asynchronously while the old function may still execute, be updated, deleted or recreated. Snapshot metadata does not retain daemon availability.
+- **Alternatives considered:** independently mutable status strings allow contradictory readiness/progress; revision-only settlement cannot distinguish repeated failed attempts with the same old code; deserializing an executable image from metadata invents ownership.
+- **Decision:** use one typed DeploymentState, a module-private builder for store-issued ImageDeployment candidates, and resource UUID/original revision/generation checks in one commit transaction. ImageArtifact distinguishes unresolved/restored/live states; invocation and publication require a live PinnedImage.
+- **Why:** failed updates preserve old executable code, stale/duplicate results cannot publish, and a snapshot cannot authorize an unowned Docker execution. One canonical base64 image fingerprint and proven unpacked size bind API metadata to captured content. A fallible store mutation commits only after its closure and record validation both succeed.
+- **Migration:** snapshots retain a derived legacy state plus optional typed deployment; contradictory states reject, and abandoned in-progress work restores as a closed failure. Metadata requires exact-content availability reacquisition in P5.
+- **Pinned by:** [runtime §2.10](./rustack-workflows-20-lambda-runtime-design.md#210-deployment-state-and-atomic-settlement), [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-25.
+
+## D24 — Retained deployment admission with atomic response receipts
+
+- **Context:** provider requests may disappear after metadata mutation; deletion, shutdown and actor failure must not orphan Pending records or release capacity before worker join.
+- **Alternatives considered:** spawning from the request loses joins on cancellation; reserving only a mailbox does not bound accepted workers; re-reading metadata after enqueue can return a concurrently recreated resource or a falsely Active acceptance response; forwarding the total deployment budget to every RPC violates the wire's shorter IO limits.
+- **Decision:** reserve both accepted-work and owned-mailbox capacity before mutation, capture the response receipt in the same store transaction, register guards/permits above JoinSet children, and retain root/emergency joins through waiter cancellation. Store-change notifications cancel stale candidates without replaying preparation; ready results outrank unrelated notifications after deadline/cancel. Each Docker read is bounded independently of the total deployment budget.
+- **Why:** request lifetime cannot own accepted asynchronous work. Stale results remain harmless, failed updates preserve old code, and failure/Drop outside the entered runtime still settles keyed records. Executor image readiness defaults to unavailable, so qualified preparation alone cannot enable a nonexistent production backend.
+- **Compatibility:** explicit stale RevisionId/CodeSha256 preconditions return412; in-progress operations and implicit staging conflicts remain409. The Native fixture target bypasses SDK/HTTP and is provider execution evidence; separate live SDK wire tests establish protocol evidence.
+- **Pinned by:** [runtime §2.11](./rustack-workflows-20-lambda-runtime-design.md#211-retained-deployment-supervisor-and-provider-admission), [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-25.
+
+## D25 — Explicit DryRun and bounded deployment parsing ownership
+
+- **Context:** ignored DryRun can mutate code; blindly applying ordinary JSON string limits rejects legitimate inline ZIPs, while parsing the entire code envelope into generic values permits large metadata allocations.
+- **Alternatives considered:** permissive DTOs silently discard unsupported modes; decoding ZIPs for validation adds staging and content inspection; releasing a parse permit at CPU completion permits large ready-result backlogs; acquiring another permit inside an admitted DryRun can throttle every admitted request.
+- **Decision:** model code DryRun explicitly and validate syntax/preconditions without fetching, staging, Docker admission or publication. Reject unknown deployment fields. Borrow the sole allowed ZIP raw span, cap/validate all remaining metadata, and deserialize strict DTOs on at most four pure blocking workers. Carry permits with results through dispatch and reuse the admitted permit for inline validation.
+- **Why:** validation must not produce deployment effects, request cancellation must retain bounded CPU/memory ownership, and supported inline package sizes must not weaken metadata limits. Preserve overload429 and worker-failure500 separately from invalid-input400. This is a deployment boundary change, not a claim of a global parser rewrite or IAM parity.
+- **Pinned by:** [runtime §2.12](./rustack-workflows-20-lambda-runtime-design.md#212-side-effect-free-code-validation-and-bounded-deployment-json), [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-25.
+
+## D26 — Propagate cryptographic initialization errors through signing APIs
+
+- **Context:** strict production checks expose two HMAC expect calls on a formally fallible provider API; authentication is part of the Lambda gateway dependency boundary.
+- **Alternatives considered:** retaining panic/adding lint ignores violates the boundary contract; fabricating a signature or interpreting an initialization failure as a mismatch hides infrastructure failure; hand-rolling key normalization solely to obtain an infallible constructor duplicates cryptographic logic.
+- **Decision:** keep RustCrypto HMAC0.13/digest0.11 computations, return typed CryptoInitialization with its InvalidLength source, and make public derive_signing_key/compute_signature return Result. Update callers/examples directly; provide no deprecated infallible shim. Header/presigned/streaming verifiers propagate failure before comparison/fallback or chain advancement.
+- **Why:** no request/key can reach an explicit panic, source errors remain available without embedding credentials, and successful signatures retain their published-vector semantics. Existing S3-only normalized-fallback eligibility and constant-time comparison remain intact.
+- **Pinned by:** [runtime §7.1](./rustack-workflows-20-lambda-runtime-design.md#71-strict-production-boundary-closure-b03), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-25. This is an internal-library API migration for direct consumers, not a new AWS wire mode or a dependency upgrade.
+
+## D27 — Align SDK signing features with the regional local compatibility profile
+
+- **Context:** B01 includes crypto-bigint0.5 through optional AWS SDK SigV4a; the latest released signer inspected (1.6.3) still directly requires0.5, while the patched bigint floor is0.7.6.
+- **Alternatives considered:** an advisory ignore leaves the security gate false; an unreviewed crypto fork adds a maintenance/supply-chain burden; removing supported regional SigV4 clients would break the workflow contract.
+- **Decision:** remove the unused explicit S3/EventBridge/STS SDK SigV4a features, retain their regional SigV4/HTTP/Tokio behavior and current model versions, and upgrade affected compatible libraries plus ZIP9.1. This selects the actual local client profile already enforced by the gateway; user-image SDKs remain independent.
+- **Why:** the existing gateway fails closed for unimplemented ECDSA signing, and workflow acceptance has no multi-region AWS signing requirement. Security closure must prove the resolved graph, not merely rename or ignore a vulnerable version. Future multi-region support requires a repaired upstream signer and its own tests.
+- **Pinned by:** [runtime §7.2](./rustack-workflows-20-lambda-runtime-design.md#72-dependency-security-closure-b01), [HTTP authentication profile](./rustack-http-hardening-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-25. SDK model versions and supported AWS wire modes are preserved.
+
+## D28 — Retain an OS directory lease in image namespace capabilities
+
+- **Context:** owner/run UUIDs alone cannot exclude another process, and a coordinator-only lock can close while retained Docker cleanup still runs.
+- **Alternatives considered:** PID files/in-process maps do not establish OS exclusion; replacing a lock file splits its inode ownership; arbitrary caller-supplied UUID scopes lose the filesystem proof; following path-based symlinks can redirect managed writes.
+- **Decision:** acquire a permanent advisory-locked descriptor in a private UID-checked directory, durably publish a bounded immutable owner record, and clone the lease through the scope/pin/job/recovery lifetime. Use safe nix0.31.3 relative-descriptor operations and standard File locking on bounded blocking workers; do not expose arbitrary production scope constructors. The [current nix openat API](https://docs.rs/nix/0.31.3/nix/fcntl/fn.openat.html) returns an OwnedFd with fs enabled; [standard File locking](https://doc.rust-lang.org/stable/std/fs/struct.File.html#method.try_lock) supplies nonblocking advisory exclusion. Verified 2026-10-26; no new package version is required.
+- **Why:** process exclusion must last through cleanup settlement, persisted corruption must fail closed, and a failed/cancelled initialization cannot authorize Docker effects. Retaining a standard File is a deliberate lint exception because Tokio has no advisory-lock API; synchronous IO is confined to blocking workers. This capability does not prove previous-run reconciliation or backend readiness.
+- **Pinned by:** [runtime §4.1](./rustack-workflows-20-lambda-runtime-design.md#41-persistent-directory-lease-and-namespace-capability), [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-26.
+
+## Glossary
+
+| Term | Meaning in this specification |
+|---|---|
+| State machine revision | Immutable ASL/config snapshot captured when an execution starts; not a public Step Functions version/alias |
+| Lambda execution revision | Resolved function code plus all execution configuration captured per invocation attempt |
+| Execution | One STANDARD state-machine run, not one Lambda invocation |
+| Frame | Engine-owned state/branch/iteration context inside an execution; not necessarily a Tokio task |
+| State entry | One visit to a state; its retries share raw input and retrier counters |
+| Attempt/generation | One dispatch and its validity epoch; stale results/timers cannot complete newer work |
+| Execution environment | One function container plus its relay/netns; processes one invocation at a time and may be warm-reused |
+| RIC / RIE | Runtime Interface Client inside the function versus Runtime Interface Emulator; Rustack needs RIC compatibility, not RIE forwarding |
+| RequestResponse / `.sync` / callback | Await API/function response versus job termination versus token-authorized completion; distinct integration patterns |
+| Owned / detached child | A `.sync` child is cancelled with its parent; start-only child remains independently supervised |
+| Quarantine | A tracked environment whose cleanup is uncertain and still consumes allocation capacity |
+| Snapshot / recovery log | A completed graceful-save archive versus a crash-consistent record of accepted commands/outcomes; only the former exists in this release |
+
+## Cross-references
+
+- ← [PRD](./rustack-workflows-00-prd.md)
+- ↔ [roadmap](./rustack-workflows-80-roadmap.md), [implementation plan](./rustack-workflows-90-impl-plan.md), [survey](../docs/research/survey-stepfunctions-lambda-container-runtime.md)
+
+## D29 — Retain function output framing independently of snapshot traffic
+
+- **Context:** real Docker handlers can produce binary/flooding stdout/stderr while the control channel carries invocation results. Log snapshots must not cancel a partially consumed outer Docker record or retain unbounded output.
+- **Alternatives considered:** ordinary buffered Docker logs can accumulate response bodies; sharing control transport introduces output backpressure into invocation delivery; cancelling next() for every snapshot poisons its partial parser; blocking consumers on a full ring can block the handler.
+- **Decision:** attach live output only before function start using the existing joined upgrade transport; one retained actor owns framing and bounded channel/tail rings, preserving its pinned read future across read-only snapshot requests and prioritizing stop. Close failed/EOF sockets immediately while retaining final snapshots and join failures.
+- **Why:** snapshot and log flooding have bounded service quanta, user bytes never enter infrastructure diagnostics, and environment cleanup can join this socket independently of function/relay termination. The capture alone does not prove container exit or exact per-invocation log attribution.
+- **Pinned by:** [runtime §3.7](./rustack-workflows-20-lambda-runtime-design.md#37-retained-function-log-capture), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-26. No new dependency or version is introduced.
+
+## D30 — Materialize one immutable, bounded environment allocation plan
+
+- **Context:** container creation must bind captured function configuration to immutable image leases, namespace ownership and operator limits before any daemon side effect. Hand-built relay/function requests otherwise drift in resource, metadata and entry semantics.
+- **Alternatives considered:** per-call tag resolution breaks captured versions; assembling separate arbitrary Docker bodies permits policy drift; concatenating Env tiers leaves duplicate names with undefined process lookup precedence; inheriting daemon logging can spill unbounded output outside Rustack rings.
+- **Decision:** EnvironmentPlan owns the captured revision/leases and preallocated identities, validates policy and serializes fixed relay/function bodies; only typed create methods issue them. Compose exactly one environment entry per key with inherited→captured→authoritative precedence and explicit deletion markers. Disable daemon logging, healthchecks, restart and extra swap while retaining independent live attach capture.
+- **Why:** one plan supplies resource admission totals and immutable allocation inputs for the future environment/pool owner. Docker create futures must be Send for supervised Tokio workers, and raw request serializers must leave scope before awaits. A plan neither reserves capacity nor proves startup/reconciliation readiness.
+- **Pinned by:** [runtime §4.2](./rustack-workflows-20-lambda-runtime-design.md#42-immutable-environment-allocation-plan), [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date:** 2026-10-26. No dependency/version change is required. Network none is deliberate pure-handler opt-in; bridge and resource probes remain mandatory for production enablement.
+
+## D31 — Keep environment ownership above workers and track possible wire issuance
+
+- **Context:** cancellation, task panic or a failed HTTP reply can outlive the allocation request. Releasing a count/memory/image/directory reservation before actual cleanup permits orphaned or unaccounted execution.
+- **Alternatives considered:** worker-local quota guards disappear on panic; immediate404 cannot settle an in-flight/uncertain create; classifying every Stopped/Deadline as unissued can ignore a sent request; treating all protocol errors as uncertain supervision leaks otherwise-settled quota.
+- **Decision:** a root actor retains plans, mutation phases, reservations and IO cleanup receipts above its JoinSet. A single RAII wire mutation guard moves with the accepted request, marks possible issuance before send and proves never-issued only after final disposal. Worker guards transfer control/log/bridge ownership to retained cleanup on Drop; root recovery joins workers/IO and reconciles verified IDs. Preserve Worker failure through recovery, independently of physical quota release.
+- **Why:** every accepted effect retains an owner, while validation/connect/queue failures can settle without permanent false uncertainty. Health checks reschedule after completion to avoid backlog starvation; log EOF permits an already-observed valid result but forbids reuse. Known protocol failures remain business failures once IO joins; uncertain supervision cannot be masked by an earlier protocol error.
+- **Pinned by:** [runtime §4.3](./rustack-workflows-20-lambda-runtime-design.md#43-retained-environment-owner-and-allocation-reservations), [verification](./rustack-workflows-70-verification-plan.md), [implementation](./rustack-workflows-90-impl-plan.md).
+- **Date:** 2026-10-26. This low-level owner does not replace provider admission, warm/LRU pooling, startup reconciliation/probes or exact Lambda timeout/log integration. Production Docker stays disabled until those M0 consumers pass.
+
+## D32 — Pool dispatch retains receipt-based ownership through warm return
+
+- **Context**: §4.4 warm execution must not reuse an environment after a caller abandons a ready result or a dispatch worker fails.
+- **Alternatives considered**: transferring handles to HTTP futures loses cleanup ownership; returning to the LRU immediately after send loses result-consumption cancellation; keying by redacted Debug hides configuration differences.
+- **Decision**: retain pool tasks and environment retirement receipts above the JoinSet, require a consumption receipt before warm return and hash canonical typed allocation inputs.
+- **Why**: queue, execution, warm retention and cleanup have explicit bounded owners; underlying EnvironmentManager reservations remain authoritative through quarantine.
+- **Pinned by**: [runtime §4.4](./rustack-workflows-20-lambda-runtime-design.md#44-warm-checkout-and-retained-pool-dispatch), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26.
+
+## D33 — Arm handler timeout at consumed Runtime API delivery
+
+- **Context**: A warm RIC may not poll immediately; queue/startup time must not consume the function handler timeout or extend the caller's absolute deadline.
+- **Alternatives considered**: starting at host dispatch charges queue/transport time prematurely; starting on offer charges abandoned polls; retaining protocol v1 permits an older relay to silently omit timeout enforcement.
+- **Decision**: version2 carries a validated relative timeout; the session's consumed poll receipt arms the effective monotonic deadline and a distinct correlated timeout result forces environment retirement.
+- **Why**: HTTP metadata and actor enforcement share one delivery instant, abandoned offers remain recoverable, and handler versus outer timeout preserves error semantics without replay.
+- **Pinned by**: [runtime §3.8](./rustack-workflows-20-lambda-runtime-design.md#38-delivery-based-handler-clock-and-protocol-v2), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26.
+
+## D34 — Separate invocation log windows from environment diagnostics
+
+- **Context**: Warm reuse must not return already collected logs from an earlier call; independent stdout/control streams lack a causal flush barrier.
+- **Alternatives considered**: returning the global tail leaks prior collected bytes; clearing diagnostic rings loses health evidence; inserting sleeps or rewriting images cannot establish a reliable producer-side boundary.
+- **Decision**: use acknowledged Begin/Finish actor commands and an opaque per-attempt capability around one bounded reusable4KiB window, alongside existing diagnostic rings.
+- **Why**: current-call observed output has bounded explicit ownership, silent calls cannot inherit the cached tail, and uncertain mutations forbid reuse. The advertised stream timing limit preserves honest compatibility.
+- **Pinned by**: [runtime §3.9](./rustack-workflows-20-lambda-runtime-design.md#39-invocation-scoped-log-windows), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26.
+
+
+## D35 — Keep per-call pool cleanup settlement above dispatch workers
+
+- **Context**: the Docker Executor must retain provider invocation permits through cancellation cleanup, including response-channel closure and pool worker/root failure.
+- **Alternatives considered**: dropping an invoke future only requests cancellation; using a response-channel close as cleanup proof loses physical ownership; worker-local settlement senders disappear during panic; reusing an invocation deadline can skip cleanup once that deadline expires.
+- **Decision**: expose an exclusive PoolInvocation with cancel-safe response waiting and a separate resumable cancellation-settlement operation; retain the sender beside the environment Retirement record above JoinSet and through emergency recovery.
+- **Why**: upper-layer admission can await a positive reusable/retired proof without owning or aborting lower-layer resources. Failed supervision remains uncertain even after physical recovery; queued no-allocation rejection can settle cleanly.
+- **Pinned by**: [runtime §4.5](./rustack-workflows-20-lambda-runtime-design.md#45-supervised-pool-invocation-receipt), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. This receipt does not enable production Docker or complete Executor/provider integration.
+
+
+## D36 — Compose Docker execution through the retained pool and trusted readiness port
+
+- **Context**: the Lambda provider already captures immutable revisions and supervises invocation permits; the Docker environment/pool owners now expose reusable/retired settlement proof.
+- **Alternatives considered**: HTTP loopback invocation duplicates protocol/admission; a per-call Docker client loses bounded ownership; advertising readiness from a connected socket or a directory lease bypasses required startup qualification; rewriting handler outcomes into synthetic JSON breaks byte fidelity.
+- **Decision**: implement the existing Executor using one pool call and independent settlement, with raw outcomes/resolved-version headers and one base64 tail encoding; inject a bounded synchronous readiness port from the trusted startup coordinator.
+- **Why**: actual code execution and provider response composition can be verified independently while ordinary CLI selection remains unavailable until all production reconciliation/probes are implemented. The readiness interface shares the existing trusted Rust custom-Executor boundary and is never supplied through AWS requests. Pool/environment quota rejection is distinct from Docker wire saturation that may occur after side effects; only the former maps to429, while both retain no-replay behavior.
+- **Pinned by**: [runtime §4.6](./rustack-workflows-20-lambda-runtime-design.md#46-docker-executor-and-provider-composition), [operations](./rustack-workflows-60-operations-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. No new dependency is required; this does not close M0 startup/platform acceptance.
+
+
+## D37 — Qualify actual kernel resources through the retained environment path
+
+- **Context**: production readiness must verify the daemon's real container limits without trusting declared create fields or operator user images to attest themselves.
+- **Alternatives considered**: info/inspect-only checks do not observe process isolation; a new one-off container owner duplicates uncertain-create/cleanup semantics; shell probes require image tooling and leak text; a network name can be retargeted after inspection.
+- **Decision**: pin qualified bridge selections by full ID and execute a bounded Rust probe mode from the operator-pinned relay image as a private Lambda revision under EnvironmentManager; issue private report proof only after exact kernel validation and joined retirement.
+- **Why**: probes consume the same policy/runtime path they qualify and retain existing cleanup ownership. Resource and network proofs remain independent from historical mutation reconciliation and cannot open readiness by themselves.
+- **Pinned by**: [runtime §4.7](./rustack-workflows-20-lambda-runtime-design.md#47-startup-network-qualification-and-actual-resource-probe), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. Promote the already-resolved runtime serde_json dev dependency to a normal workspace dependency for bounded typed report serialization; no new library/version is introduced.
+
+## D38 — Persist container intent before possible creation and identity before deletion
+
+- **Context**: in-memory uncertain-create receipts do not survive process death; an absent name cannot exclude a late daemon commit.
+- **Alternatives considered**: label-only scans miss pending creation; negative lookup as proof loses ownership; always rejecting dirty restarts cannot reclaim positively identified resources; an unbounded append log adds retention and replay complexity.
+- **Decision**: use a bounded atomic directory snapshot of container identities, publish before create, persist a positively verified full ID before removal, and erase only after defensible settlement. Historical unknown absence remains unresolved and blocks its relay.
+- **Why**: the same retained directory capability protects filesystem transactions and daemon ownership; interrupted recovery is repeatable without replaying create or touching foreign resources. This is a container-specific part of full reconciliation, not production readiness.
+- **Pinned by**: [runtime §4.8](./rustack-workflows-20-lambda-runtime-design.md#48-durable-container-intents-and-restart-reconciliation), [implementation plan](./rustack-workflows-90-impl-plan.md).
+- **Date**: 2026-10-26. Reuse existing nix/sha2/hex dependencies and the bounded ownership worker pool.
+
+
+## D39 — Persist private image-tag intent and commitment separately
+
+- **Context**: a nested daemon tag request can commit after a failed HTTP result; in-memory image-owner phases do not survive restart.
+- **Alternatives considered**: owner-tag scans miss pending mutations; one negative lookup cannot settle an unknown tag; reissuing tag can replay effects; duplicating directory IO creates divergent durability/cancellation rules.
+- **Decision**: share the bounded snapshot transaction implementation with container records, keep a distinct bounded versioned pin encoding, and persist intent before issuance and commitment before lease publication/deletion. Retire historical containers before aliases.
+- **Why**: durable commitment permits absent-alias settlement after interrupted cleanup, while unknown absence remains conservative. Reconstructed aliases remain confined to the exact reserved namespace and never become operator-source cleanup keys.
+- **Pinned by**: [runtime §2.13](./rustack-workflows-20-lambda-runtime-design.md#213-durable-image-pin-intents-and-historical-alias-retirement), [implementation plan](./rustack-workflows-90-impl-plan.md).
+- **Date**: 2026-10-26. No new dependency or version is needed. Startup coordinator/pulls/platform acceptance remain required.
+
+## D40 — Generate exact JSON epoch timestamps before the Step Functions API
+
+- **Context**: Step Functions uses AWS JSON1.0 numeric timestamps; default chrono serde emits strings, and the existing optional KMS float helper mishandles negative fractions.
+- **Alternatives considered**: binary f64 arithmetic introduces avoidable rounding; copying the KMS helper preserves its negative-epoch defect; workspace-wide arbitrary_precision changes unrelated payload semantics; hand-editing generated files cannot survive regeneration.
+- **Decision**: resolve timestamp-format precedence in the generator and emit a JSON-specific RawValue decimal adapter, normalized by checked bounded arithmetic to millisecond precision toward zero. Select strict model generation for Step Functions: documented/nonexhaustive DTOs, required collections, typed builders, redacted diagnostics and no blanket ignores.
+- **Why**: SDK wire dates are numeric and exact at the promised precision, including negative/exponent/range edges, while other protocols retain their bindings. Oversized exponents are classified with bounded work. Serde-disabled output gets neither duplicate Debug nor unused codec modules.
+- **Pinned by**: [API §1.1](./rustack-workflows-10-api-design.md#11-executable-timestampmodel-generation-contract), [verification](./rustack-workflows-70-verification-plan.md), [implementation plan](./rustack-workflows-90-impl-plan.md).
+- **Date**: 2026-10-26. The model reuses workspace serde/chrono/typed-builder; the excluded developer generator adds the already-workspace [Tokio1.54.1](https://docs.rs/tokio/1.54.1/tokio/attr.main.html) with explicit local-IO features and independent audit/deny. No Step Functions endpoint or engine is advertised by the model alone.
+
+## D41 — Terminate HTTP ambiguity before typed registry dispatch
+
+- **Context**: the new workflow service needs AWS JSON1.0 routing, scope/authentication and bounded typed IO before the registry/ASL engine can consume it.
+- **Alternatives considered**: raw-JSON handler ports repeat parsing/limits; a default handler creates misleading service availability; suffix-based routing can leak unknown actions to S3; serializing an unchecked handler response can return a wrong operation or unbounded history.
+- **Decision**: expose typed18-action transport ports with explicit validated scope/auth configuration, source-level budgets and operation-correlated bounded responses. Couple main-program registration to the real core adapter. Preserve accepted command ownership beyond HTTP cancellation.
+- **Why**: protocol qualification is independently testable without claiming workflow execution; core keeps domain/compiler semantics and cleanup ownership. Encoded page budgets prevent successful responses from relying on unbounded allocation.
+- **Pinned by**: [API §1.2](./rustack-workflows-10-api-design.md#12-typed-http-boundary-before-registry-wiring), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. Reuse existing HTTP/auth/JSON/Tokio/async-trait dependencies. Unknown-action404 follows the current official common-error reference; no AWS error-precedence execution is claimed.
+
+## D42 — Compile bounded paths against immutable validated payloads
+
+- **Context**: the registry/compiler and every state evaluator need shared data semantics before the execution owner exists.
+- **Alternatives considered**: a general JSONPath engine admits unsupported syntax; interpreting path strings on every transition repeats validation; arbitrary Value cloning/serialization can allocate far beyond the output quota.
+- **Decision**: compile a bounded winnow subset into private typed segments; distinguish missing/single/selection results, borrow immutable payloads and materialize through a bounded writer. Validate result-target roots and prohibit array growth. Construct from borrowed trees only after structural/encoded checks; give the internal context separate byte/depth/member headroom while retaining normal limits on selected outputs.
+- **Why**: one pure implementation pins data behavior for future compiler/engine consumers without coupling core to HTTP, an SDK or Docker. Original business input bytes survive for name idempotency.
+- **Pinned by**: [ASL§2.1.1](./rustack-workflows-30-asl-design.md#211-executable-path-and-payload-foundation), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. Reuse the already resolved winnow1.0.4 and shared JSON/bytes/serde dependencies. This is a semantic foundation, not engine acceptance.
+
+## D43 — Compile Choice predicates and bound evaluation across the whole rule
+
+- **Context**: branching semantics need validated literal/Path operands and short-circuit behavior before the execution actor interprets Choice states.
+- **Alternatives considered**: arbitrary JSON inspection on each transition repeats validation; user regexes complicate resource bounds; binary64 coercion silently aliases large integers; per-child budgets let compounds multiply work without bound.
+- **Decision**: compile a private typed predicate tree, preserve left-to-right short-circuit and missing-reference errors, normalize timestamps to instants, use a bounded Unicode glob and share one step/string-byte budget across the complete predicate.
+- **Why**: a pure reusable evaluator pins semantics and makes local limits explicit before machine compilation and scheduling. It remains separate from transition-target ownership.
+- **Pinned by**: [ASL§2.4.1](./rustack-workflows-30-asl-design.md#241-executable-choice-predicate-contract), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. Reuse existing chrono, JSON and reference paths. Numeric integers use the closed±2^53 range; floats exclude its endpoints to avoid source-rounding aliases. Enable shared serde_json float_roundtrip for correctly rounded interior numeric lexemes; no arbitrary_precision or new external version is added. Timestamp fractions retain precision beyond nanoseconds. No complete Choice state/engine acceptance is claimed.
+
+## D44 — Resolve Wait sources once before monotonic scheduling
+
+- **Context**: absolute Wait timestamps truncate target fractions, while execution deadlines and timer ownership remain monotonic.
+- **Alternatives considered**: sleeping inside a pure evaluator obscures ownership; repeatedly subtracting wall clocks follows NTP jumps; defaulting invalid dynamic values hides workflow errors.
+- **Decision**: compile exactly one typed source and resolve it against validated data/context plus one supplied wall-time sample, returning a bounded relative duration. The future actor owns checked monotonic scheduling and generations.
+- **Why**: static validation, dynamic failures and AWS whole-second target behavior can be pinned without a sleeping task or dependency on the HTTP caller lifetime.
+- **Pinned by**: [ASL§2.4.2](./rustack-workflows-30-asl-design.md#242-executable-wait-source-contract), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. Use existing chrono/std/reference paths. STANDARD local wait cap is365 days; overall execution deadlines are independent. This is source evaluation, not scheduler acceptance.
+
+## D45 — Compile intrinsics with shared budgets and preserve format escape provenance
+
+- **Context**: Parameters/ResultSelector and the machine compiler need one reusable, bounded expression implementation.
+- **Alternatives considered**: host formatting/splitting gives different semantics; reparsing on every state entry repeats validation; decoding all format escapes before slot recognition reinterprets escaped braces; per-call budgets multiply work under nesting; infallible UUID helpers can panic on entropy failure.
+- **Decision**: compile the12-call allowlist into a private AST, preserve literal formatting provenance, share work/text/materialization budgets and encode borrowed collection views before owning results. Inject a typed UUID source and use fallible OS entropy in the concrete convenience adapter.
+- **Why**: fixed bounds and historical independent edge inputs make expression behavior reviewable before template/compiler consumers. Async execution owners keep entropy acquisition off the scheduler loop.
+- **Pinned by**: [ASL§2.3.1](./rustack-workflows-30-asl-design.md#231-executable-expression-contract), [semantic memo](../docs/research/spike-stepfunctions-semantic-oracle.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. Add normal dependency edges to already-resolved getrandom0.4.3/uuid1.26.0 without updating external versions. Formal scalar Format is selected over the historical cloud's object formatting extension.
+
+## D46 — Compile templates and keep original state input outside resource phases
+
+- **Context**: reusable Parameters/ResultSelector expansion must share limits, and result merging must target raw state input across an external call.
+- **Alternatives considered**: per-field fresh budgets allow aggregate work amplification; building expanded Value trees before sizing defeats output quotas; merging into prepared parameters changes state semantics; owning a resource inside a data helper obscures cancellation.
+- **Decision**: compile normalized collision-free templates, encode borrowed prepared views under shared budgets, and expose pure prepare/finish phases requiring the owner to retain original input.
+- **Why**: one implementation pins exact transformation ordering before state compilation/execution; future actor ownership and callback provenance remain explicit.
+- **Pinned by**: [ASL§2.2.1](./rustack-workflows-30-asl-design.md#221-executable-templates-and-data-flow-phases), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. Reuse compiled paths/intrinsics and bounded serde output; no dependency changes. This does not close machine compilation or resource execution acceptance.
+
+## D47 — Compile sequential machines into immutable scoped indices
+
+- **Context**: the registry/execution actor needs validated state graphs and precompiled operations without runtime map/string interpretation.
+- **Alternatives considered**: a runtime ASL walker repeats validation; a DAG restriction rejects legal loops; suffix-only resource routing accepts unsupported integrations; installing partially compiled definitions breaks revision invariants.
+- **Decision**: use one bounded side-effect-free compiler, strict sequential profile, lexical scoped StateIds, typed read views and immutable original-byte artifacts. Compile all control-flow targets and policies before graph acceptance.
+- **Why**: the same artifact/error drives Create/Update/Validate; later actor work consumes validated IR and concrete adapter availability remains a composition-root decision.
+- **Pinned by**: [ASL§1.1](./rustack-workflows-30-asl-design.md#11-executable-sequential-compiler-and-indexed-ir), [API](./rustack-workflows-10-api-design.md), [verification](./rustack-workflows-70-verification-plan.md).
+- **Date**: 2026-10-26. No new external dependencies; complete M1 requires registry/actor/real Lambda evidence beyond compilation.
+
+## D48 — Drive sequential execution through explicit effects and attempt generations
+
+- **Context**: compiled sequential states need deterministic execution and deadline/recovery semantics before asynchronous resource composition.
+- **Alternatives considered**: awaiting resources inside the interpreter obscures ownership; reevaluating parked waits reacts to wall jumps; per-attempt input mutation breaks Retry; dropping futures does not prove cleanup.
+- **Decision**: one bounded synchronous driver owns frame transitions and emits explicit dispatch/timer/cancellation obligations. The outer supervisor retains resource and evaluation ownership; the driver never certifies cleanup or API/history readiness.
+- **Why**: injected clock/random/completion inputs make deadline, stale-result and recovery behavior independently testable; the same frame can later be scheduled with Parallel/Map siblings.
+- **Pinned by**: [ASL§3.1](./rustack-workflows-30-asl-design.md#31-sequential-transition-driver), [integrations§1](./rustack-workflows-40-integrations-design.md#1-internal-ports-and-dependency-direction).
+- **Date**: 2026-10-26. Keep Docker-image work deferred under the user's workflow-first priority.
+
+## D49 — Retain invocation cleanup and atomically publish bounded persistent history
+
+- **Context**: the deterministic driver needs an asynchronous owner that survives caller loss, deadline races and uncertain cleanup.
+- **Decision**: use a registry-owned JoinSet supervisor, watch control/read lanes, retained bounded CPU proposals with final deadline checks, and synchronous object-safe task admission whose adapter already owns start lifetime. Keep business completion separate from cleanup and retain permits through quarantine. Publish official history and outcome as one immutable read view over shared64-event pages, with terminal capacity reserved above worker lifetime.
+- **Why**: neither dropping a waiter nor a closed response lane establishes cleanup; copied full histories scale quadratically; independent outcome/history writes expose inconsistent termination.
+- **Pinned by**: [ASL§3.2](./rustack-workflows-30-asl-design.md#32-supervised-sequential-runtime-and-history-publication), [integrations§1](./rustack-workflows-40-integrations-design.md#1-internal-ports-and-dependency-direction), [API§6](./rustack-workflows-10-api-design.md#6-history-and-pagination).
+- **Date**: 2026-10-26. Reuse resolved Tokio/model dependencies; main registration, registry, real bridge and final image acceptance remain required.
+
+## D50 — Return an owned Lambda submission before awaiting admission
+
+- **Context**: an async admission waiter may fail after queue ownership transfers; absence of a returned handle is not cleanup proof for Step Functions.
+- **Decision**: split prequeue capture/submission from admission observation, retain the invocation handle through result and settlement, and propagate external cancellation into the shared invocation context. The binary bridge queues synchronously, owns start/result/cleanup workers independently of ASL observers and preserves uncertain handles plus capacity.
+- **Why**: the bridge must distinguish prequeue errors, business completion and resource settlement without hidden retries or disabled-runtime fallbacks. Ordinary Invoke keeps its public behavior through the same receipt.
+- **Pinned by**: [integrations§1.1](./rustack-workflows-40-integrations-design.md#11-owned-admission-receipts-and-the-binary-lambda-bridge), [ASL§3.2](./rustack-workflows-30-asl-design.md#32-supervised-sequential-runtime-and-history-publication).
+- **Compatibility**: the bridge profile accepts plain names and complete same-scope ARNs; ordinary Invoke keeps same-account partial references with an explicit account guard. Cleanup observer expiry retains the same invocation handle until Clean or permanent quarantine.
+- **Date**: 2026-10-26. Qualify actual Native workflow calls before the deferred Docker image work; main registration and full milestone gates remain required.
+
+## D51 — Linearize resource revisions and execution names in one retained registry
+
+- **Context**: the execution owner and real Lambda bridge need resource identity, revision capture, idempotency and deletion semantics without coupling core to HTTP.
+- **Decision**: a bounded registry actor accepts compiled/validated domain commands, atomically registers fresh executions, retains revision/record permits through immutable snapshots and separates24h record retention from90day name tombstones. Stop observes the engine outside the registry lane. A unique controller retains shutdown and abnormal ownership.
+- **Why**: independent CRUD maps race update/start and delete/recreate; response loss is not cancellation; record expiry must not reuse an execution ARN early.
+- **Ownership refinements**: independent immutable tag-version admission prevents retained snapshots from bypassing metadata limits; pending blocking entropy and its accepted command stay in root state. Cleanup-aware TTLs retain uncertain graphs, and Stop is an owned command before its caller observes termination.
+- **Pinned by**: [API§3.1](./rustack-workflows-10-api-design.md#31-executable-registry-ownership-and-resource-lifecycle), [operations](./rustack-workflows-60-operations-design.md).
+- **Date**: 2026-10-26. Main/API pagination and the retained preparation adapter remain required before ordinary SDK service acceptance; Docker image work remains deferred.
+
+## D52 — Retain API preparation and charge shared immutable pagination captures
+
+- **Context**: typed HTTP and the real registry need one actual handler without making observer cancellation own commands or multiplying uncharged snapshot vectors.
+- **Decision**: a bounded binary-support API root retains worker admission above preparation/response CPU jobs and registry observation. Its actor-owned PageStore binds opaque256-bit handles to complete queries and shares a byte-charged immutable capture across continuation cursors. Reverse history uses the core complete-page projection.
+- **Why**: unowned spawn_blocking work outlives HTTP timeout; latest-state cursors drift; token-count limits alone permit unbounded high-water vector memory.
+- **Refinements**: count actual Vec capacity, preserve typed diagnostics and final deadline checks, and keep RegistrySupervisor alive independently of its command senders. Capture revision publication time for DescribeStateMachineForExecution. Generated common statuses preserve402/408; tag-specific errors follow the current action contract.
+- **Pinned by**: [API§1.3](./rustack-workflows-10-api-design.md#13-retained-real-api-adapter-and-preparation), [API§6.1](./rustack-workflows-10-api-design.md#61-owned-stable-pagination-and-reverse-history).
+- **Date**: 2026-10-26. Main/settings/capability composition, both ordinary SDKs and final image/platform qualification remain required; Docker image work remains deferred.
+
+## D53 — Keep composite workflow controllers unique and let transport own modeled timeouts
+
+- **Context**: gateway health shares RuntimeWorkers, while child controllers require unique mutable resumable joins and Lambda must outlive accepted workflows.
+- **Decision**: main retains WorkflowSupervisor outside the shared health view. Register the real opt-in target-family router ahead of heuristic routers, validate supported YAML quotas, and select Lambda support from an actual matching provider. Quiesce API→grace→registry→bridge before Lambda; final cleanup skips grace and signals retained controllers on observation expiry. The bounded Step Functions transport owns the request deadline and AWS timeout envelope.
+- **Why**: a mutex would obscure unique shutdown ownership; generic gateway timers can preempt modeled408 responses; historical invocation diagnostics are not supervisor failures.
+- **Pinned by**: [operations§1.6](./rustack-workflows-60-operations-design.md#16-executable-m1-gateway-composition), [shutdown](./rustack-workflows-60-operations-design.md#3-shutdown-cancellation-and-snapshots).
+- **Date**: 2026-10-26. Ordinary Rust SDK/boto3 real service acceptance and later workflow milestones remain required; Docker work remains deferred by user priority.
+
+## D54 — Qualify ordinary SDKs against the owned real binary and independent case catalog
+
+- **Context**: transport-only SDK and generic Hyper/Native fixtures cannot establish real gateway/core/SDK acceptance, and a test-process timeout must not orphan its Python runner or bootstrap children.
+- **Decision**: run ordinary Rust SDK and pinned boto3 against separate strict-auth real Rustack server processes with explicit Native execution. Both use17 source-linked literal outcome cases plus all15 M1 control actions. Retain server/process/file ownership independently; directly spawn persistent-environment Python, bound/join helpers and streams, then prove marker PID absence after coordinated shutdown. A consumed-event gate pins running idempotency and definition revision isolation without a scheduling window.
+- **Why**: independent expectations prevent the interpreter from becoming its own oracle; exact causal links, concrete revision identities and page bounds make SDK passes meaningful under slow CI and faulty responses. Latest aws-sdk-sfn requires a coherent aws-config1.13/shared runtime cohort rather than the prior incompatible protocol type.
+- **Pinned by**: [SDK contract](./rustack-workflows-70-verification-plan.md#m1-ordinary-sdk-acceptance-against-the-real-binary), [catalog](../tests/workflows/sdk-cases.json).
+- **Date**: 2026-10-26. This closes the ordinary SDK feature-acceptance gap for the selected M1 profile, not B06 security remediation, cloud differential parity, later workflow features or final Docker/platform qualification. Docker image work remains deferred by user priority.
+
+## D55 — Share compilation budgets and source bytes across lexical structured scopes
+
+- **Context**: Parallel branches and Inline Map processors must reuse compiled semantics without allowing cross-scope jumps, resetting resource ceilings or treating legacy Map Parameters as a whole-state transform.
+- **Decision**: retain nested immutable machine Arcs with lexical indexes, one root source allocation, aggregate state/unit budgets and a16-level scope ceiling. Preserve root/nested provenance and reject branch-artifact promotion at registry Create/Update admission. Normalize legacy selector/processor spellings independently, keep item selection outside ordinary Map data flow, and compile enclosing recovery targets locally. Explicit trusted Structured compilation does not enable sequential runtime or API admission.
+- **Why**: scope ownership makes frame scheduling unambiguous; a single compilation context bounds nested memory/work; staging admission preserves the current executable service contract while P3 runtime dependencies land.
+- **Pinned by**: [ASL§1.2](./rustack-workflows-30-asl-design.md#12-structured-scope-compilation-and-staged-runtime-admission), [P3](./rustack-workflows-90-impl-plan.md#6-p3--structured-fan-out-and-nested-jobs-closes-m2), [AWS Inline Map fields](https://docs.aws.amazon.com/step-functions/latest/dg/state-map-inline.html), [ASL scope semantics](https://states-language.net/spec.html#parallel-state).
+- **Date**: 2026-10-26. P3 scheduling, sibling cleanup, causal history and nested integration remain required. Docker image work remains deferred by user priority.
+
+## D56 — Interpret structured states through lazy indexed effects and explicit join recovery
+
+- **Context**: compiled branch scopes need executable input/context/result semantics before an actor may schedule them. Eager selection/spawning loses budgets, original-input merges, RetryCount context and cancellation ownership.
+- **Decision**: expose an explicit pure structured-frame constructor, immutable lazy FanoutPlans and generation-checked joins. Separate Lambda completion from round completion, bound ordered aggregation before materialization, preserve typed evaluation failures and use shared ordered recovery. Keep the existing supervisor/API admission gated until bounded concurrent ownership and causal history land.
+- **Why**: a single semantics implementation serves Parallel and Map, normalizes legacy selectors correctly and prevents a late child result from settling a retry or an elapsed execution. Effects carry the original deadline; owners remain responsible for shared transitions, result-retention charges and cancellation joins.
+- **Pinned by**: [ASL§3.3](./rustack-workflows-30-asl-design.md#33-deterministic-structured-frame-effect-protocol), [AWS item selection](https://docs.aws.amazon.com/step-functions/latest/dg/input-output-itemselector.html), [AWS Inline Map](https://docs.aws.amazon.com/step-functions/latest/dg/state-map-inline.html).
+- **Date**: 2026-10-26. The concurrent frame owner, causal history, sibling cleanup and child integrations remain required. Docker work remains deferred by user priority.
+
+## D57 — Own a bounded frame tree and separate business notification from retirement
+
+- **Context**: nested fanout needs one transition/deadline budget, failure cleanup barriers and capacity accounting that cannot deadlock or release ownership on business completion.
+- **Decision**: one synchronous frame scheduler emits typed history/resource updates, lazily seeds descendants, charges global/local frame and aggregate-slot pools, and requires explicit call retirement. Successful outputs may propagate before cleanup; failed rounds recover only after complete subtree retirement. Preserve terminal failure origin independently of historical diagnostics. Queued notifications retain their frame slots until emission; propagated evaluation failures retain their original classification/cause with the typed source.
+- **Why**: frame/attempt identities reject stale work, failed joins cannot replay uncertain siblings, and a join-only capacity cycle fails explicitly. Slot byte charges bound intermediate aggregation separately from frame payloads and official history.
+- **Pinned by**: [ASL§3.4](./rustack-workflows-30-asl-design.md#34-bounded-frame-scheduler-and-retirement-protocol), [P3](./rustack-workflows-90-impl-plan.md#6-p3--structured-fan-out-and-nested-jobs-closes-m2).
+- **Date**: 2026-10-26. Actual asynchronous task ownership, concurrent causal history and nested integrations remain required; Docker work remains deferred by user priority.
+
+## D58 — Fence asynchronous scheduler updates and retain frame lineage above accepted IO
+
+- **Context**: moving a unique scheduler into bounded CPU work must not let Stop/deadline lose to speculative success, or let a panic release accepted-call frame capacity. Concurrent history needs per-frame predecessors rather than the global last event.
+- **Decision**: an explicit structured supervisor path owns one scheduler and joined resource watchers. Fresh control checks fence each CPU update; forced control discards speculative effects and drains returned bookkeeping. Accepted calls retain immutable ancestor-frame leases in the supervisor ledger before port admission. Validate causal journal predecessors and project typed round/iteration metadata.
+- **Why**: scheduler cloning and actor mutexes are unnecessary; physical ownership remains independent of business results and CPU observation. Equal branch AttemptIds cannot collide, and a clean watcher join cannot discard its unread completion.
+- **Pinned by**: [ASL§3.5](./rustack-workflows-30-asl-design.md#35-asynchronous-structured-resource-owner-and-commit-fence), [AWS history DTO](https://docs.aws.amazon.com/step-functions/latest/apireference/API_HistoryEvent.html).
+- **Date**: 2026-10-26. Actual consuming-service Native/SDK acceptance and nested integrations remain required; Docker remains deferred by user priority.
+
+## D59 — Bind service compilation to the registry's installed execution profile
+
+- **Context**: the structured owner is qualified as an explicit library path; enabling API compilation without matching registry admission and configured shared frame budgets would advertise unusable definitions.
+- **Decision**: retain Sequential library defaults and add an immutable registry state profile read by API preparation. Main selects Structured and configures shared/global frame/result caps. Choose the structured runtime only when the captured root artifact requires it, preserving sequential event semantics. Reject unsupported artifacts before publication and roll back failed Start without name/record mutation.
+- **Why**: one trusted composition root governs Create/Update/Validate and execution; no client-supplied profile or unimplemented quota is accepted. Independent real SDK structured/lifecycle cases gate eight-state capability reporting.
+- **Pinned by**: [ASL§3.6](./rustack-workflows-30-asl-design.md#36-structured-service-composition-and-capability-binding), [operations budgets](./rustack-workflows-60-operations-design.md#12-tunable-budgets).
+- **Date**: 2026-10-26. Nested jobs/callbacks/persistence and final Docker image/platform gates remain required; Docker work remains deferred by user priority.
+
+## D60 — Atomically start and subscribe to owned child executions without a registry cycle
+
+- **Context**: nested Tasks need fast-child observation, bounded independent waiting and cancellation ownership before ASL admission can be enabled.
+- **Decision**: a Weak registry port transfers a retained child request with an exact parent-record capability. Registry commit validates lineage/cycles and publishes Start plus captured watch/owned relation atomically. An independent child-call pool mirrors the runtime open ceiling and holds no ordinary command/Task/Lambda dispatch permit. Observe business outcome and cleanup separately; detach RequestResponse at acceptance.
+- **Why**: caller loss cannot orphan accepted owned work, subscription cannot miss a fast child, and waiting parents cannot starve child dispatch or metadata/Stop admission. Explicit DAG checks reject idempotent self/ancestor cycles while preserving ordinary replay/name rules.
+- **Pinned by**: [integrations§4.1](./rustack-workflows-40-integrations-design.md#41-atomic-child-execution-registry-port), [nested semantic oracle](../docs/research/spike-stepfunctions-semantic-oracle.md), [AWS nested retry error](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-nested-workflows.html).
+- **Date**: 2026-10-26. Qualify the registry port before ASL child dispatch/history/service SDK integration. Docker remains deferred by user priority.
+
+## D61 — Bind nested ASL Tasks through registered structured owners
+
+Route child-dependent machines, including sequential machines, through the existing frame owner. A one-shot gate publishes the exact parent record only after atomic registry insertion. Retained child Task workers hold frame leases and bounded CPU receipts without acquiring Lambda/Task dispatch permits. TaskSubmitted carries actual accepted child identity; physical cleanup remains independent of business completion. See [integrations §4.2](./rustack-workflows-40-integrations-design.md#42-asl-binding-registration-gate-and-retained-child-task-worker). This reuses the reviewed atomic port rather than introducing HTTP polling or another child manager. Service capability requires Native and both SDK qualification; callback and Docker work remain separately gated.
+
+## D62 — Retain callback protocol ownership before ASL activation
+
+Implement integrations§5.1 as a separate bounded token actor: hash-only indexes, secret-wrapped256-bit tokens, one-shot invocation gate with provisional callback, independent revocation, replaceable heartbeat timers and closed-classification capacity reserved at mint admission. Capture execution/frame/generation and retain tombstones through parent execution retention. Accepted API actions and observer lifetimes remain separate. This foundation precedes ASL token injection/provenance redaction and public routing; callback capability stays false until real handler/SDK qualification. Docker remains deferred.
+
+## D63 — Track callback parameter provenance before serializing history
+
+Use one bounded template evaluation to produce actual outbound Parameters and a distinct null-redacted CallbackHistory. Classify compiled context-token paths and intrinsic dependencies, propagate sensitive InputPath into data-root selections, and never scan arbitrary business data or evaluate nondeterministic intrinsics twice. Keep injected context scoped and zeroize its token when the final sensitive context Arc drops. The official TaskScheduled schema has no truncation-details field: retain its required parameters JSON with redactions and document the local policy; mark omitted callback Lambda result data on TaskSubmitted where the model provides outputDetails. See [integrations§5.2](./rustack-workflows-40-integrations-design.md#52-single-evaluation-callback-parameters-and-history-provenance). This pure boundary precedes ASL/Lambda/API consuming integration and does not enable callback capability.
+
+## D64 — Observe Lambda business return before callback cleanup
+
+Transfer a unique scoped/frame-bound invocation reporter out of CallbackTask into an explicit optimized Lambda command. Capture the actual provider response time before mapping/cleanup; publish bounded typed metadata or failure once, while retaining physical cleanup independently. Callback-mode success ignores the synchronous business body, and heartbeat timing uses the captured return time with provisional receipt-time fencing. The current provider emits responses after backend cleanup; this observation does not claim the earlier handler Runtime API return. Preactivation heartbeats remain no-ops. Ordinary Lambda modes retain their contracts. See [integrations§5.3](./rustack-workflows-40-integrations-design.md#53-observed-synchronous-lambda-return-and-independent-cleanup). This port composition precedes actual ASL callback scheduling/public API activation; final real callback handler/SDK and Docker/image/platform gates remain.
+
+## D65 — Assign callback attempt identity before materializing credential parameters
+
+Use a distinct callback integration and pure CallbackDispatch effect, with an independent trusted compiler capability. Capture credential-free original input/context and resolve timeout/heartbeat before token registration; materialize once only after the async owner holds the exact registered token. Keep scheduled callback history typed and callback submission metadata explicitly truncated. Track callback calls through the existing frame/generation/retirement protocol; preserve sequential/runtime/registry/API admission gates until the retained async consumer is installed. See [integrations§5.4](./rustack-workflows-40-integrations-design.md#54-deferred-asl-callback-instruction-and-pure-effect-boundary). This changes effect ordering without introducing fake parameters or enabling unsupported execution.
+
+## D66 — Retain registered callback execution above token, CPU and physical-call ownership
+
+Extend the atomic parent gate to the exact ExecutionSnapshot, bind callback admission to an installed real registry, and consume deferred callback effects under the structured actor. A retained worker prepares once, waits for causal Scheduled-history acknowledgment, then invokes the observed Lambda port. Separate physical dispatch lifetime from external callback waiting; charge retained callback/preparation data to shared/local result budgets and keep unknown receipts on panic. Preserve evaluation-origin failures and typed heartbeat timeout history. See [integrations§5.5](./rustack-workflows-40-integrations-design.md#55-registered-asynchronous-callback-owner). Public API/main activation remains gated until handler/SDK acceptance.
+
+## D67 — Route public callback commands through the installed registry binding
+
+Retain the immutable CallbackRegistry in Registry shared admission and expose typed submit_callback under its captured scope. Derive API callback compiler support from that same binding; never accept an unrelated callback actor argument or a capability boolean. Reuse retained CPU/API admission and CallbackAck semantics, preserve typed static error mappings and emit the documented empty callback success body. See [API§1.4](./rustack-workflows-10-api-design.md#14-registry-bound-public-callback-adapter). Main activation and handler-originated SDK acceptance remain consuming work; Docker stays deferred.
+
+## D68 — Install the real callback root with main-service lifecycle ownership
+
+When the actual selected Lambda port exists, compose one scoped bounded callback registry before Registry/API, retain its unique controller between registry and bridge shutdown, and derive capability/health from that installed root. Enforce four validated YAML quotas and shared result-byte limits. Qualify real signed Rust SDK/boto3 callbacks from actual Native handlers, with explicit post-response gates and independent consumed-PID/history evidence; do not infer Docker/network or AWS background-execution guarantees. See [operations§1.7](./rustack-workflows-60-operations-design.md#17-executable-callback-service-composition) and [verification](./rustack-workflows-70-verification-plan.md).
+
+## D69 — Patch the complete compression graph before workflow archive import
+
+Upgrade direct snapshot zstd to the patched0.14.3 cohort and apply a provenance-checked, source-identical squib-loader0.2.0 path overlay whose only dependency change selects that cohort. Preserve upstream metadata/notice, all other Squib package identities and snapshot v2 wire semantics. Qualify old-frame compatibility, abandoned-context isolation, synthetic kernel decompression bounds and fresh audit/deny without new ignores. See [operations§4.1](./rustack-workflows-60-operations-design.md#41-patched-compression-cohort-before-workflow-persistence). No VM/Docker work or upstream publication is authorized by this dependency maintenance step.
+
+## D70 — Preflight the complete CBOR section before typed archive allocation
+
+Install one borrowed structural preflight and capped fallible encoder in the existing snapshot CBOR helpers before workflow import. Enforce the explicit v2 profile, decoded-key uniqueness, byte/depth/node/collection/scalar/key ceilings, exact single-root consumption and redacted failures. Keep existing envelope/DTO/codec semantics; workflow staging, compilation and live history quotas remain separate required work. See [operations§4.2](./rustack-workflows-60-operations-design.md#42-bounded-cbor-import-boundary).
+
+## D71 — Preserve a sealed registry cut and export durable rows after joined cleanup
+
+Move registry resources, terminal immutable views and name reservations into a single retained capture only after the root proves clean execution shutdown. Preserve their original allocation charges and one paired-clock expiry projection. Export versioned deterministic data-only rows under a conservative validated source-copy budget, with exact captured definitions/input/history and no live/token/pagination/diagnostic state. Keep main persistence unavailable until staged restore and archive registration follow. See [operations§3.1](./rustack-workflows-60-operations-design.md#31-sealed-registry-ownership-and-durable-export).
+
+## D72 — Stage charged terminal graphs behind an exclusive startup restore lease
+
+Decode bounded schema1 data, validate all references/profile/history, compile all revisions and reserve the existing registry/history quotas in a caller-owned CPU preparation phase. An exact-instance startup lease blocks business admission and reopens only after failed/dropped graph cleanup. Commit the complete graph once through the actor mailbox; restore no live deadlines/frames/tokens and convert unexpected RUNNING data to a locally interrupted terminal record without dispatch. Explicit imported retention deadlines preserve remaining reservations across configuration changes. See [operations§3.2](./rustack-workflows-60-operations-design.md#32-startup-only-atomic-registry-restore).
+
+## D73 — Consume terminal workflow snapshots through owned main archive work
+
+Split the durable registry document into strict data-only metadata and keyed history parts inside the existing v2 service meta/data archives. Keep one quota-bounded archive actor/CPU join and exact Registry commit receipt alive across observation loss, and close/join that owner during final cleanup before Registry destruction. Restore all services before binding; prove workflow/bridge/provider quiescence before publishing a generation. Drain started sibling snapshot tasks before shared staging cleanup on failure. Qualify actual named-snapshot Native process restart, fresh handle epochs and no replay before advertising resources-and-history. See [operations§3.3](./rustack-workflows-60-operations-design.md#33-main-workflow-archives-and-startupshutdown-ownership).
+
+## D74 — Measure pure workflow latency and loop responsiveness through the real binary
+
+Use the ordinary signed SDK and existing retained server owner for100 complete50-state pure executions and100 one-slot loop/Stop cycles, plus explicit history exhaustion under health probes. Include SDK/HTTP/polling overhead in the measured interval and validate exact output/history independently. Emit bounded raw samples and nearest-rank summaries only after process cleanup. Keep existing semantic fixture limits unchanged via a separate performance profile. Current-host data never substitutes for the specified Linux reference or final image/platform/IaC acceptance. See [verification§5.1](./rustack-workflows-70-verification-plan.md#51-native-host-pure-workflow-workload-and-responsiveness).
+
+## D75 — Freeze exact native resource inventories before execution and document the installed profile
+
+Bind the existing Native/SDK/HTTP SDK targets to a strict reviewed manifest and actual same-feature ignored-test listings. Reject drift before running resource cases, without executing commands from manifest text. Consume the documented pure ASL through an owned strict-auth binary with a typed Pure fixture, separate from Native bootstrap ownership. Provide an explicit serial native-workflow-only verifier and an accurate English operator guide; do not substitute it for pending image/platform/IaC/reference or final release qualification. See [verification§3.1](./rustack-workflows-70-verification-plan.md#31-exact-resource-suites-and-documented-pure-smoke).
+
+## D76 — Persist installation identity and fence each owned Docker connection
+
+A socket path can lead to another daemon after restart or while a wire is alive. Persist the validated canonical nonnil engine UUID alongside the directory owner before any runtime-owned mutation; first binding requires both journals empty, and an existing different binding never resets automatically. Return a private exact-lease-bound port and retain its lease through envelopes. Verify ID with bounded GET /info on the same fresh HTTP connection used for each requested operation, before marking mutation issuance. Refuse a closed checked connection rather than reconnecting. This consumes W217 without treating identity as authentication or replacing complete historical discovery/readiness. See [runtime§4.9](./rustack-workflows-20-lambda-runtime-design.md#49-durable-daemon-binding-and-connection-local-identity-fences). No new dependency is required; same-UID/daemon adversaries and cloned engine identities remain outside the local operator contract.
+
+## D77 — Drain recorded effects and audit complete observed namespaces without adoption
+
+Compose historical container-before-pin retirement under an exact bound lease, then require untruncated all-state owner-container lists and a bounded full image-tag prefix scan before reporting zero remaining. Existing operational limit64 listings and reference globs are not complete absence proofs. Fail closed on current-run records, unrecorded owned resources, inventory limits and late observations; never turn names/labels into authority to adopt/delete an effect without its journal. Empty observations cannot discharge unknown intents or pre-journal legacy uncertainty. This produces data-only counters for the future exclusive startup coordinator, not readiness. See [runtime§4.10](./rustack-workflows-20-lambda-runtime-design.md#410-recorded-namespace-retirement-and-complete-observed-inventories).
+
+## D78 — Isolate controlled pull streams and retain terminal ownership before pin preparation
+
+Keep never-pull as default; only a missing initial image lookup may trigger an explicitly allowlisted ifMissing pull with selected secret credentials. Use a dedicated bounded wire lane and incremental bounded NDJSON rather than ordinary response collection. Retain the accepted request through cancellation/deadline and actual driver join, then revalidate image/platform/defaults/size before private pin/publication. Remote cache effects may outlive a closed Docker request; never clean operator source tags or treat progress/cache changes as a live revision. On abrupt wire-root failure, transfer accepted exchanges to retained fallback cleanup and join them after signalling stop; never abort their exchange futures and detach HTTP drivers. Main YAML/auth-file/startup consumes these library types later. See [runtime§2.14](./rustack-workflows-20-lambda-runtime-design.md#214-controlled-if-missing-pulls-and-retained-progress-transport).
+
+
+## D79 — Validate operator Docker configuration and load explicit private YAML credentials
+
+Reuse shared settings/budgets and existing domain types; keep config parsing pure and selection gated until complete startup evidence exists. Load only an explicit private regular file under bounded retained read-only workers and no-follow descriptor traversal. Decode a fixed shallow YAML event schema directly into secret credential types, rejecting duplicates/aliases/tags/coercion. Reuse the existing yaml-rust2~0.11.1 cohort rather than adding a second parser/version; current0.13.0 was checked and its newer changes do not alter the selected event behavior. Consolidate the pull timeout default at300s. See [operations§1.8](./rustack-workflows-60-operations-design.md#18-validated-docker-settings-and-private-registry-credential-files).
+
+## D80 — Prove the configured gateway from the actual function network
+
+Add a pinned one-shot endpoint probe with independently observed gateway instance identity and a reserved fixed diagnostic response. A host connection, caller echo, cached public status or boolean does not prove function reachability. Require matching actual resource evidence, exact retained inputs and joined retirement before a private EndpointProbe receipt. Own HTTP/TLS futures under one absolute deadline and explicit aws-lc/webpki trust; do not install ambient proxies/roots or authentication bypasses. This component remains a production startup prerequisite, not ordinary Docker activation. See [runtime§4.11](./rustack-workflows-20-lambda-runtime-design.md#411-container-origin-gateway-reachability-evidence).
+
+
+## D81 — Consume startup receipts in one retained production owner
+
+Use a new immutable owner magic as a journal-before-effect provenance/downgrade barrier, never upgrade legacy uncertainty from empty inventories. Qualify the exact bound runtime graph behind a diagnostic-only same-listener phase, install private live receipts, and retain one ordered resumable cleanup owner through failure/cancellation. Main consumes fallible Lambda shutdown and advertises only actual selected-platform/image/endpoint capabilities. See [runtime§4.12](./rustack-workflows-20-lambda-runtime-design.md#412-production-startup-provenance-and-retained-owner-composition). Immutable restored-image lease reacquisition and the full platform/release gates remain mandatory consuming work.
+
+
+## D82 — Qualify custom RIC and immutable revisions through ordinary startup
+
+Use an independent bounded Rust RIC in an explicitly built test image and ordinary signed clients to consume the production runtime, preserving fixture source content IDs. Own any deliberately movable test source alias separately from runtime-private pins, refuse preexisting/conflicting tags and clean only its captured identities. Distinguish absent/empty argv and inspect actual argv/cwd/results inside the image. Real concurrent functions must reject forged/stale Runtime API completions before valid responses. These consuming semantic cases do not replace the remaining fault/admission/archive/platform matrix. See [verification D82](./rustack-workflows-70-verification-plan.md#custom-rust-ric-and-immutable-image-revision-qualification-d82).
+
+
+## D83 — Reject impossible memory charges and qualify real fault settlement
+
+Separate a permanently impossible function+relay charge from temporary environment contention. Reject the former before admission and pool queue/eviction as typed MemoryLimit mapped to429, while preserving bounded temporary waiting. Consume ordinary Docker through real failing user code and causal stage holds, not timers that infer invocation progress. Independent bounded read-only daemon observations prove physical retirement; a later PID barrier hands graceful server shutdown to its existing Rust child owner while the128 accepted-work backlog remains held. Keep global32 unit/state evidence distinct from two-container-pair functional observations. See [verification D83](./rustack-workflows-70-verification-plan.md#real-image-faults-caller-cancellation-and-public-admission-d83).
+
+
+## D84 — Control actual daemon acknowledgments, not fabricated runtime state
+
+Use a fixture-owned transparent Unix proxy to hold actual Create/private-Tag acknowledgments and pending owned DELETE requests. Preserve same-connection daemon identity, duplex attach and exact retained ownership; independently observe the real daemon. Keep the proxy alive until the exact ordinary server has stopped, including semantic-error paths. A frozen statically scoped Docker resource inventory complements the Native manifest without claiming complete release/platform acceptance. See [D84 verification](./rustack-workflows-70-verification-plan.md#management-io-faults-and-exact-docker-resource-inventory-d84).
+
+
+D84's consuming tests also require admission to cross the ownership boundary: an image actor record keeps the accepted deployment permit above worker/root failure, and a shared artifact receipt acknowledges only validated consumption or successful image CAS. A queued result is not consumption. Canceled/failed retirement and live-pin storage use their respective retained quotas. Diagnose full transport loss through readiness/business rejection; retain diagnostics and physical cleanup without adding implicit owner revival or a new health-triggered listener shutdown policy.
+
+
+## D85 — Expire actual IO and interrupt a real retained pull stream
+
+Keep caller/barrier lifetimes beyond the production IO deadline and prove physical/journal settlement. Isolate pull interruption from registry failure: truncate only the runtime-facing chunked response, retain/drain the actual daemon response and require positive completion before separately owned cache-reference cleanup. Build genuine negative image metadata/process artifacts rather than replacing daemon observations. The exact Docker functional inventory grows explicitly; it still cannot certify full release/platform acceptance. See [D85 verification](./rustack-workflows-70-verification-plan.md#io-expiration-interrupted-pulls-and-negative-images-d85).
+
+D85 execution correction: Engine1.53 returns404 for a captured image whose selected platform is absent. Translate only this direct platform-qualified operation404 to invalid image metadata; preserve initial lookup404 and typed identity/transport/other-status errors. Do not parse daemon message text. This corrects public failure provenance rather than weakening the negative artifact assertion.
+
+
+## D86 — Distinguish work throttling from bounded physical-resource waiting
+
+Prove global/default-function execution quotas using acknowledged work and positive typed rejections while physical pool capacity holds execution. Prove temporary memory/environment ceilings with one deliberately nonbinding bound and an admitted waiting caller whose reserved slot is independently observed. Hold a real exit's DELETE to demonstrate physical settlement before resource reuse. Do not substitute accepted-work saturation for active execution limits, combine both resource ceilings in one ambiguous observation, or change temporary contention into a new429 policy. Exercise actual API-profile method/header/body/trailer bounds from a real consumed RIC attempt, then require the same attempt's computed result and warm reuse. See [D86 design](./rustack-workflows-20-lambda-runtime-design.md#416-actual-runtime-http-bounds-and-independent-admission-ceilings-d86).
+
+D86 oracle correction (W271): acknowledged Event work is not positive execution admission. Extend existing read-only diagnostics with bounded actual accepted/active semaphore counts and their real limits; stable exact8/32 ownership plus upper-bound429 now qualifies the active limits. Keep the projection independent of business admission and free of names/payloads. This consumes the existing operations metrics contract without a new test hook or route.
+
+
+## D87 — Restore immutable local content through the existing pin owner
+
+Ordinary deployment and saved-image reacquisition have distinct typed sources. The latter uses only the saved parent ID, exact selected-platform fingerprint and fresh unpacked proof, with no source-tag/registry fallback or pull. Preserve informational source metadata after positive proof. Reuse existing durable pin mutation/retirement quotas and joins instead of fabricating a lease or adding another supervisor. This is the primitive for later atomic archive import; keep provider/main archive rejection and every M4 consumer gate until that publication boundary is qualified. See [runtime§2.15](./rustack-workflows-20-lambda-runtime-design.md#215-immutable-local-image-lease-reacquisition-d87).
+
+
+## D88 — Validate/reacquire an entire Image archive before startup publication
+
+Reuse existing FunctionStore preparation/validation with a private candidate, shared exact immutable pins and fresh saved-size checks; publish only after all fallible work and a final health/deadline fence. Initial failed creation is inspectable without a live image; every usable revision requires one. Bound Image metadata independently of Native ZIP archives and retain four side-effect-free CPU validators. Carry the original startup deadline through retained snapshot/service import and previous-generation retirement; observer expiry cannot extend commit authority. See [runtime§2.16](./rustack-workflows-20-lambda-runtime-design.md#216-candidate-store-image-archive-restoration-d88).
+
+
+D88 review refinements W275–W277: iterative destruction belongs to the owned dynamic policy lifetime, including unpolled API futures; infrastructure validator failures retain typed redacted provenance. Image restore preserves the installed provider account/region scope and rejects foreign saved ARNs before any pin. These are required fail-closed invariants, not relaxed archive semantics.
+
+
+W278 strengthens D88 export ownership: borrowed record projections use the same snapshot schema and are guarded while their existing map-entry read guards remain held. A bounded read-only job constructs the owned archive DTO from validated compact JSON, rather than cloning unbounded live metadata before validation. Shared store handles keep read ownership alive through observer loss; malformed export cannot replace the previous generation.
+
+W279–W280 close the bounded-work/evidence lifetime edges: share prospective ancillary traversal budgets instead of resetting them per condition/version, and retain the actual archive fixture namespace from server creation until successful joined shutdown/audit. Neither bounded serialization nor a normal-path cleanup handler alone proves those ownership contracts.
+
+
+## D89 — Transfer immutable ZIP code through a retained typed archive and local volume
+
+Use original validated ZIP bytes to create a bounded deterministic TAR with Linux ELF/bootstrap checks, never a mutable host tree bind. Keep two transfer reservations through the final queued request owner. Extend the existing same-connection-bound wire for TAR and local volumes; keep JSON/response limits unchanged. The consuming owner must journal separate local volume/never-started loader intent and retire consumers before volume and pins. Only then install ordinary ZIP runtime capability. This follows the [Docker archive API](https://docs.docker.com/reference/api/engine/version/v1.51/) read-only destination restriction and the pinned Moby check at `daemon/archive_unix.go:158–173`; an explicitly writable loader volume is required before a read-only function mount. The [tar0.4.46 builder](https://docs.rs/tar/0.4.46/tar/struct.Builder.html) supplies GNU long-name encoding without extracting TARs or following host filesystem metadata. See [runtime§6.1](./rustack-workflows-20-lambda-runtime-design.md#61-provided-runtime-zip-delivery-contract-d89).
+
+D89 refinement W282: set copyUIDGID=false; Moby archive_tarcopyoptions_unix.go:18–31 otherwise replaces TAR ownership using Config.User. Retain explicit normalized archive ownership independently of image/helper user defaults, and verify it through actual volume consumption.
+
+D89 refinement W283: bound the materialized tree, including implicit parents, to10,000 nodes. A path-length/explicit-member cap alone cannot bound filesystem work or TAR header overhead. Reject lexical absolute names before enclosed-name normalization, share checked file/directory layout, and emit normalized parent directories exactly once.
+
+D89 refinement W285: qualify code read-only behavior through observed RO volume identity and kernel chmod→EROFS, independently of normalized DAC modes. Upload only through the required RW loader; a rejected or disconnected precondition-violating large administrative request to the RO function is not the read-only oracle.
+
+## D90 — Separate code-effect provenance and recover durable states monotonically
+
+Use explicit fresh RSDKOWN3 roots for code effects, retaining Image-only RSDKOWN2 defaults and refusing automatic upgrade. Older binaries must reject the new owner magic rather than silently ignore volume obligations. Keep a separate bounded194-byte code record instead of changing the container journal's two-role format. Distinguish Planned, Uncertain, Known and Retired independently for loader/volume: unknown404 is not an absence barrier. Recover recorded consumers before code and code before image pins, with complete owner audits after recorded cleanup. Build the reader/recovery boundary before enabling its retained producer. See [runtime§6.6](./rustack-workflows-20-lambda-runtime-design.md#66-code-namespace-provenance-and-recovery-boundary-d90); all ordinary ZIP and full M4 acceptance remains required.
+
+## D91 — Retain one complete staging task above observers and require pin affiliation
+
+Use a registered retained stage for journal/create/upload/helper retirement, preserving every accepted IO call through driver join even when caller/actor worker disappears. Keep source/admission/receipts above workers and release preparation capacity only on consumed Ready handoff or physical retirement. Require the base PinnedImage's exact directory affiliation; content-ID equality alone cannot prove that this manager holds the daemon-local pin. Reuse D90 effect retirement, adding only private receipt-proven unissued transitions and an erasure witness. See [runtime§6.7](./rustack-workflows-20-lambda-runtime-design.md#67-retained-producing-code-volume-manager-d91); ordinary ZIP remains gated.
+
+D91 review refinement: exclusive producer guards require an empty joined-ledger proof before clean release. Unclean whole-runtime destruction poisons the same DirectoryLease acquisition; reconnection cannot overlap unresolved current-run effects. Recovery uses a fresh acquisition and the unchanged durable historical rules. Retirement result observation uses a post-wakeup deadline fence and retains the same receipt across observer expiry.
+
+## D92 - Reserve environments before code preparation and retain the receipt above worker failure
+
+Compose ZIP through the qualified Docker executor and environment pool. A plan's single-use code identity, registered stage and physical retirement receipt outlive worker unwind. Function absence/IO join precede code release, and environment admission survives until that same receipt proves retirement. Startup selects immutable base content and generation3 explicitly; absent sources remain unavailable. Validate candidate ZIP bytes before provider commit. Qualify identical Linux ZIP bytes through real Docker and Native paths; a host Mach-O fixture is not equal-artifact evidence. See [runtime6.8](./rustack-workflows-20-lambda-runtime-design.md#68-ordinary-provided-runtime-installation-and-environment-consumption-d92).
+
+
+D92 qualification: both final frozen63-resource functional gates and exact same-original-ZIP Linux Native consumers pass. W295–W305 refine receipt publication, conversion admission, provider publication, physical shutdown proof, fixture flush, unavailable-source mapping,128-byte handlers, terminal TCP closure and evidence normalization/citations. Task5.1 is complete; ZIP snapshot export/import remains explicitly rejected until5.2c reconciles its data budgets and candidate validation. No live code volume, process or stage receipt is archive state.
+
+
+## D93 — Separate managed ZIP data budgets from Image metadata and restore only original code
+
+Keep the16MiB Image-only contract and generic JSON/CBOR ceilings unchanged. Add an explicit configured provided-runtime archive profile with128MiB service work/payload,16MiB metadata and64MiB total decoded original ZIP bytes,50MiB per revision. Additionally bound the complete private candidate to512MiB expanded logical bytes/20,000 nodes, and enforce exact ZIP-path exemptions in raw CBOR before typed allocation. Validate a complete candidate before any Image pin mutation and publish only after the final source/backend/deadline fence. Move designated owned ZIP strings aside for unchanged metadata preflight, rather than exempt arbitrary fields or clone unbounded data. Restore original ZIP identity through the immutable artifact/converter path; allocate no Docker code resources until a later invocation. The immutable provided base remains current operator configuration and cannot be selected by saved metadata. See [runtime§6.9](./rustack-workflows-20-lambda-runtime-design.md#69-bounded-provided-runtime-zip-archives-and-mixed-candidate-restoration-d93). Both frozen65-resource functional gates and exact postconditions now pass; task5.2c is complete, with remaining M4 consumers explicitly open in the implementation ledger.
+
+## D94 — Qualify the pinned official Node runtime through ordinary consumers
+
+Reuse the already provenance-recorded Node24 manifest, adding a built-in-only handler image and independent known arithmetic/context/filesystem/error expectations. Official RIC execution, language process warm reuse, captured published/alias behavior after CMD changes and registered ASL computation must all be observed through signed ordinary clients. A successful base pull is not Node handler evidence. Preserve exact source/SDK/server ownership and freeze the additional resource before execution. Accept the official RIC's optional X-Ray error cause only through a single error-route-specific8KiB HTTP field, sharing the unchanged16KiB aggregate; keep general256-byte limits and omit this opaque metadata from diagnostics/state. Support the default RIC's thread-local keepalive clients with eight HTTP connection tasks but four independently charged POST bodies whose owned permits move into accepted session envelopes and survive HTTP observer expiry/abandonment until processing, rejection or actor drop, retaining the preceding24MiB body-work ceiling. HTTP parse rejections close only their connection. See [runtime§4.17](./rustack-workflows-20-lambda-runtime-design.md#417-official-node-image-consumption-d94). D94 qualification closes task5.3a/L02 on the recorded native-arm64 VZ and emulated-amd64 QEMU functional lanes; full M4 and the remaining SDK/platform consumers stay open.
+
+## D95 — Bind explicit local handler SDK credentials to qualified runtime scope
+
+Add an opt-in explicit Docker SDK pair and reuse the actual container-origin gateway proof, without ambient AWS/server-credential fallback. Keep secrets outside serialized ContainerPolicy/revisions/archives and issue an opaque context affiliated with the same readiness Arc, directory acquisition, bound policy, relay and environment service. A checked nonzero process-local counter separates warm contexts; the existing directory run UUID scopes restarts, and the counter grants no authority. This avoids adding an entropy dependency for an internal identity. Preserve image unsets as bare-name Env markers so Docker cannot re-inherit profile/endpoint defaults. The final SDK Env has independent320-entry/80KiB/4097-byte-entry bounds and an SDK-augmentation4KiB ceiling.
+
+Reuse the retained ordinary test owner and one centralized expanded Docker CLI feature cohort instead of duplicating its private helpers in a second integration target. Keep Docker-specific join composition in the shared image_sdk module; the lower-level Runner also serves Native targets. Only SDK fixture profiles enable S3/DynamoDB services. Actual pinned-image metadata confirms bundled S3/DynamoDB/SFN3.1105.0; both retained functional lanes now pass real positive/negative S3/DynamoDB SDK execution, full resource gates and final current-source consumer qualification. See [runtime§4.18](./rustack-workflows-20-lambda-runtime-design.md#418-explicit-local-handler-sdk-environment-d95). Task5.3b/L10 is complete; image callbacks and the remaining M4 acceptance stay open.
+
+## D96 — Use an independently active Event Lambda for post-return image callbacks
+
+Keep the observed ASL callback invocation synchronous. Dispatcher A uses the actual default-provider Lambda SDK to accept B with InvocationType Event/HTTP202; B remains in its own active image invocation while A returns. A safe local DynamoDB gate makes callback-after-Submitted causal, without a host mount/control listener or work continuing after A returns. Event B retains independent Lambda ownership through parent Stop; tests must release/join it and distinguish that work from cancellation of A. This follows the primary AWS asynchronous-acceptance and callback-timing contracts, rather than treating HTTP202 as B's completed result.
+
+Use a separate image on the existing pinned Node base, actual client-lambda/client-sfn/client-dynamodb3.1105.0 and D95's proof-affiliated SDK environment. Raw tokens travel only in authorized invocation/SDK payloads; safe control rows/reporters hold hashes and booleans. Independent history/log/archive scans compare bounded candidate hashes without revealing a token to host observers. Reuse and extend the single retained image SDK owner with an async confirmed-save audit hook. No new dependency, callback engine or public runtime setting is added. Both retained functional lanes now pass the actual nine-mode callback consumers and full70-resource gate under [integrations§5.6](./rustack-workflows-40-integrations-design.md#56-real-image-sdk-callbacks-and-independent-event-worker-d96).
+
+
+## D97 — Run the IaC toolchain inside an owned image function
+
+The pinned [Pulumi process study](../docs/research/study-pulumi-process-ownership.md) shows independent plugin process groups and context-owned cancellation/drains. A host CLI PID/group cannot represent that whole tree. Use a dedicated managed image function for the actual pinned CLI/provider and a separate real business image function; controller Stop then consumes the established container namespace/cgroup cleanup. Keep tooling read-only, local encrypted state private, supported resource lifecycle independently verified and all failure/privacy gates explicit in the [IaC design](./rustack-workflows-50-iac-design.md). This is a design decision, not actual5.3d acceptance.
+
+
+D97 actual-consumer refinements: Docker GET archive cannot see live tmpfs because Moby creates a private mount view. Use a pinned read-only observer in the same namespace with independent host decoding and same-exec successful-termination proof. The actual Pulumi provider also lists versions while reading an unpublished resource. Support an authenticated/scope-validated existing-machine empty inventory, with no publication, qualified ARN or mutation support. These are compatibility corrections required by actual consumer evidence; they do not broaden the versioning product scope.
+
+
+## D98 — Qualify a separate containerized server owner and an internal DNS gateway
+
+Use the actual Linux CLI on the same explicit user bridge as its existing function/relay pairs. Keep client Unix socket, daemon-side socket source and handler gateway origin distinct; mount the socket only into the trusted nonroot server with an explicit supplementary GID, and use its known unique DNS name at4566 for container-origin traffic. External SDK clients use an independently inspected loopback publication. A separate retained fixture owner holds server, named volume, private env file and all CLI/SDK waits; it does not reinterpret the existing host-process Child. Existing production startup/shutdown and function isolation remain authoritative.
+
+Reuse the pinned provided.al2023 base for the GNU-linked qualification CLI and the existing explicit SDK credential environment, so neither a new base nor a credential copy channel is needed. Read only bounded owner/engine records from the actual persistent volume, with the existing workspace tar crate's raw iteration and no host extraction. Treat uncertainty/forced effects as failure with retained evidence, and require clean production runtime shutdown before removing the exact stopped server/volume. See [the executable contract](./rustack-workflows-55-server-container-design.md). This design does not certify the default release Dockerfile or missing native/reference/platform lanes.
+
+
+## D99 — Qualify the actual release image without changing source defaults
+
+- Context: D98 qualifies a purpose-built GNU fixture; W371/W372/W374/W375 expose distinct release build/Action defects.
+- Decision: keep the source stepfunctions feature explicit, compile it into the normal root Docker image, preserve scratch/non-root/health behavior and all security patches, and reuse the D98 owner through an explicit Release profile. Copy only public budget YAML into the owned volume; no extra host bind or image-baked credentials/configuration. Route Action inputs through validated env values/private env files and a real monotonic readiness deadline.
+- Why: actual distribution artifacts and shell boundaries need consuming evidence; a second runtime/Runner or an alternate test image cannot establish it. Existing workspace YAML parsing is reused only for trusted Action controls.
+- Remaining: W373 promotion, Linux arm64 reference/Desktop/rootless/performance/load and complete M4 stay required. D100 removes further Linux x86_64 validation. No image publication or push is performed by local qualification.
+- Pinned by: [release image design](./rustack-workflows-56-release-image-design.md). Date:2026-10-31.
+
+- Executed evidence: [final D99 qualification](./rustack-workflows-93-review.md#d99-final-qualification-and-exact-postconditions).
+
+## D100 — Linux x86_64 validation is waived
+
+- Authority: the user's explicit2026-10-31 instruction, translated as “No need to validate Linux x86_64.” This supersedes earlier requirements for native Linux x86_64 and further emulated-amd64 validation; it is an intentional scope change, not missing evidence or a silent skip.
+- Decision: schedule no further Linux x86_64 builds/tests or native-x86 runner acquisition for this objective. Retain already completed D99 amd64/QEMU results and source artifacts as historical functional evidence; do not relabel them native/performance evidence. Existing x86_64 code/image support and existing general CI configuration are not removed; the agent will not initiate additional dedicated Linux x86_64 qualification for this objective.
+- Required platform scope: Linux arm64 and macOS arm64/Desktop, plus rootless and the recorded Linux reference/performance/load obligations. The reference machine is native Linux arm64 with4 dedicated CPUs,8GiB RAM and local Docker. Tests requiring two daemon installations may use two distinct arm64 engines; different CPU architectures are unnecessary.
+- Release consequence: native Linux x86_64 is no longer a prerequisite or blocker for5.3/5.4/M4. W373 exact-image/same-commit promotion, required arm64 platforms, reference performance and remaining load/correctness gates stay required. No new remote CI execution, publication, push, VM/context restart or unrelated cleanup is authorized by this scope change.
+- Chronology: all D99 focused/full AMD runs had completed and their original owners joined before this instruction arrived; final resource cleanup had also completed. Preserve the historical “both lanes” contracts/results. Apply this decision when interpreting their older pending native-x86 clauses.
+
+## D101 — Measure the existing pure workloads directly inside native arm64 Linux
+
+- Decision: cross-build the actual SDK harness and CLI with the existing locked GNU/Zig path, then execute both directly in an explicitly selected native arm64 Linux guest. Reuse the existing bounded Python process owner on both sides and the exact D74 workload/history/cleanup contracts. Make the performance fixture pure, removing its unnecessary bootstrap dependency.
+- Provenance: record guest resources/kernel/Python, actual binary hashes, exact inventory and ordered raw reports. Keep configured VM resources distinct from physical dedication and measured RSS distinct from configured storage quotas.
+- Scope: this closes a Linux execution/measurement dependency of5.3 only. A4-vCPU/8GiB VZ profile is useful non-emulated Linux evidence but does not prove four dedicated physical CPUs. Reference qualification remains pending; image timing/load, Desktop/rootless, W373 and complete M4 remain required. No x86 validation, existing VM restart, context activation or publication.
+- Contract: [verification§5.2](./rustack-workflows-70-verification-plan.md#52-direct-linux-arm64-pure-workflow-measurements-d101). Date:2026-10-31.
+- Executed evidence: [direct Linux measurement review](../docs/research/workflows-linux-performance-review.md). The dependency passes actual Linux/host measurements, source/artifact/postcondition checks and independent review; reference qualification remains pending.
+
+## D102 — Measure actual image invocation and initialization phases with repeated cleanup
+
+- Decision: qualify warm100/cold20/100 success-timeout cycles through the actual SDK/provider, add one bounded successful initialization diagnostic with contiguous relay and function/RIC readiness intervals, and use handler-side monotonic duration only in explicit timed fixture modes. Preserve ordinary runtime/API/wire/archive behavior.
+- Ownership: reuse the registered image SDK owner, exact daemon/owner metadata, unchanged Rust Runner and D101 bounded host/guest owner. Execute the actual Linux controller/server directly; reuse the existing pinned pure Python SDK tree without executing a host binary.
+- Scope: [image performance design](./rustack-workflows-57-image-performance-design.md) binds timings, log-flood health/accounting, inventories and full ARM gates. A VM capture remains referenceQualification=pending; dedicated-reference/Desktop/rootless/W373/full M4 remain required, with no further x86 validation.
+- Source retention: canonical fixture builds first anchor the seven existing rebuilt source aliases by captured immutable ID, under the same engine fences. Aliases absent at entry are skipped for initial or partial provisioning and are identifiable from the fixed allowlist/report difference; the independent original-ID audit detects prior loss. Conflicts or uncertain effects stop the build. W422 records an observed loss and exact history-based repair before this guard.
+- Transport: save only captured immutable IDs; after import, retain target-only content-addressed operator cache aliases and verify their mapping before/after workloads. W417 records why untagged imports cannot survive removal of the final private runtime pin.
+- Date:2026-10-31. Status: final seventh-source current-profile implementation/source/evidence review, host15/full ARM79/direct Linux3 and exact postconditions pass; reference qualification and complete M4 remain pending. See the [measurement review](../docs/research/workflows-image-performance-review.md).
+
+## D103 — Qualify an isolated rootless daemon with effective resource controls
+
+- Decision: create a separate native ARM VZ profile and install a real unprivileged systemd Docker daemon with signed, version-matched rootless extras. Preserve all existing VMs, daemons, client contexts and D102 image/evidence baselines.
+- Boundary: bootstrap attests the service process, user namespace, private socket, engine identity and delegated cgroup v2 controllers. Only the actual kernel probe plus complete resource gate can qualify the platform. Never downgrade CPU/memory/PIDs requirements to accommodate rootless defaults.
+- Contract: [rootless platform design](./rustack-workflows-58-rootless-platform-design.md). Provisioning/attestation is a dependency, not full5.3 or M4 completion. Desktop and dedicated-reference performance remain separate requirements; D100 still excludes further x86 validation.
+- Date:2026-10-31. Status: in progress.
+- Executed dependency: [bootstrap/review evidence](../docs/research/workflows-rootless-platform-review.md) records a real UID501 rootless daemon, effective user-manager delegation, namespace socket GID991,25 controls, actual TERM-ignoring root-job retirement and independent review. Bootstrap/attestation passes; the actual kernel probe, full resource inventory and rootless platform exit remain pending.
+
+## D104 — Consume the rootless daemon through owned transport and unchanged kernel probes
+
+- Decision: preserve D103 installation/receipts and use a separately owned bounded SSH Unix forward for existing native ARM test controllers. Prove the exact rootless engine before effects, import captured immutable fixture IDs with retained cache aliases, and execute the existing actual Linux Rust kernel probe without weakening policy.
+- Contract: [resource execution](./rustack-workflows-58-rootless-platform-design.md#6-rootless-resource-execution-d104). Begin with both exact kernel resources, then extend to the entire79-resource inventory, server/socket/endpoint and performance/load cases. Kernel success alone cannot close rootless or M4.
+- Date:2026-10-31. Status: in progress. No x86 validation, existing-service restart, default context change, image rebuild/deletion or publication.
+
+## D105 — Normalize CPU limits downward to a portable one-percent quantum
+
+- User decision: explicitly accepted2026-10-31 after the real rootless systemd probe observed34000/100000 for333333333 NanoCPUs. Normalize the configured maximum down to the nearest10,000,000 NanoCPUs (0.01 CPU), preserving and reporting requested/effective values. Default1 CPU is unchanged.
+- Contract: validate the original0.1..16-CPU range first, perform bounded integer normalization once in ContainerPolicy, and use only the effective amount in both containers and probe verification.333333333 becomes330000000; exact kernel quota33000/100000 must pass on both retained drivers,34000 must fail. No tolerance band, upward rounding or reduced memory/swap/PIDs/isolation requirement.
+- Diagnostics: expose the requested/effective pair from the retained qualified policy. Unit/range/floor/idempotence, actual two-kernel resources, existing functional matrices and standard/strict/security checks remain mandatory. Preserve the original failed rootless owner/independent observation as evidence, not a passed resource.
+- Status: implementation in progress.
+
+## D106 — Transfer server data through an inspected unstarted volume helper
+
+- Decision: keep the server's read-only daemon socket and use a separately owned, never-started/no-socket/no-network data-volume helper for identity archives and public release configuration on every daemon. Do not weaken socket policy or retry an ambiguous failed copy using another transport.
+- Evidence: D104's rootless server case fails on an exact EPERM remount of the read-only socket; its stderr digest matches an independently repeated archive request. An unstarted helper reads both checksummed records successfully. Exact engine/parent labels/source/record checks discharge the stopped server, helper and volume without force; original failure evidence stays retained.
+- Contract: [server data transfer](./rustack-workflows-55-server-container-design.md#71-rootless-data-volume-transfer-d106). Preserve bounded records, uncertainty, no credential inheritance, exact nonforced helper removal and complete server/release/rootless resource qualification.
+- Date:2026-10-31. Status: implementation in progress.
+
+## D107 — Complete code, then qualify exact release artifacts
+
+Finish remaining operation consumers and delivery code before starting the test stage, as explicitly requested by the user. The [delivery contract](./rustack-workflows-59-release-qualification-design.md) separates no-push candidate creation, full platform evidence assembly and explicit same-artifact promotion. D100 only waives x86 execution; missing Desktop/rootless/reference evidence must block final promotion. Historical successful receipts are preserved and do not qualify new source.
+
+## D108 — Correct bound transcript consumers and pin timed metadata observations
+
+Keep platform results bound to exact per-case intents, zero exits, original hashes, canonical non-ignored starts and clean one-case summaries despite inherited SDK output. Reference results use the canonical ordered two-plus-three producer vectors and retain every raw measurement/cleanup validator. Pin an independently negotiated and identity-verified metadata socket before each timed flood Invoke; reject reconnect, replacement, nested/concurrent use and close on exit. All existing deadlines, 100 cycles and physical cleanup remain mandatory. Preserve the original cycle-54 timeout as unexplained failed evidence. Archive rejection preserves its original primary diagnostic and retains original/mutated affiliation bytes before effects. See [image performance](./rustack-workflows-57-image-performance-design.md#7-pinned-metadata-peer-during-the-live-flood-bracket) and [bound producers](./rustack-workflows-59-release-qualification-design.md#8-bound-producer-transcript-and-archive-rejection-corrections). These are code corrections before the next reviewed execution cohort, not successful test claims.
+
+## D109 — Diagnose the intermittent flood failure without changing budgets
+
+Retain3229c2's real cycle89 end-handshake failure. Correct stale liveness observations and bracket release publication with monotonic Future-state checks, including rollback before notification. Add bounded current-cycle monotonic diagnostics and authenticated collector acceptance/write observations, bound to the original cycle even for delayed callbacks. These are oracle/diagnostic corrections, not an established production timeout fix. Use focused100-cycle diagnosis before freezing the final source cohort; keep one-second handler/100 cycles/health/physical retirement unchanged. See [the live ordering contract](./rustack-workflows-57-image-performance-design.md#8-live-observation-ordering-and-failure-localization-d109).
+
+## D110 — Prepare one authenticated flood channel during initialization
+
+Use an explicit flood initialization mode to establish the benchmark's control connection before the first Runtime next request. Require one exact socket for ready/begin/end, reject reconnects/replays and close after end. This removes connection setup from the measured one-second handler without adding invocations or changing any budget. Add strict100-channel report counters and extend controlled refresh from three production images to runtime/custom RIC A/B/server/release. The cycle84 pre-begin failure remains unexplained historical evidence. Full contract: [image performance§9](./rustack-workflows-57-image-performance-design.md#9-initialization-owned-flood-control-channel-d110).
+
+## D112 — Execute external tests with their original assertions
+
+Run pinned LocalStack pytest methods and AWS snapshots with an explicit Rustack fixture plugin and exact required node inventory. Disable upstream root conftest and automatic plugin loading; copy baseline snapshots into private evidence directories and prohibit update/raw/skip-all. Preserve upstream method bodies, parameterization, transformers and existing exclusion markers. Adapt only endpoint/authentication, role metadata, resource ownership and explicitly documented real-handler packaging. Do not transplant interpreter outputs as new expected values or silently replace ECR-only fixtures. The first batch's excluded service/API/runtime profiles remain explicit. See [external compatibility design61](./rustack-workflows-61-localstack-compatibility-design.md).
+
+
+## D113: Correct overlapping semantics using original external observations
+
+- **Evidence**: unmodified pinned LocalStack AWS snapshots, plus the [formal ASL specification](https://states-language.net/spec.html). Failed source cohorts and preflight failures remain retained; no baseline/mask rewrite is authorized.
+- **Decision**: capture revision RoleArn in ExecutionStarted, use predecessor0 for the initial root entry, correct Map admission/join and Parallel retry projection, accept INLINE ProcessorConfig under either processor spelling, decode optimized serialized-string Payload once (null/omission defaults to{}), normalize integer -0 tokens in StringToJson while preserving strings/exponents, compact function-error Cause, publish optimized service-call start before provider resolution, and omit manufactured timeout fields. See W438–W442 and design30/40. Direct and observed-callback admission retain their existing physical semantics; owned work/cleanup remain unchanged.
+- **Limits**: original Parallel normalization removes the success marker and normalizes branch IDs, so its successful exit predecessor is verified without claiming complete concurrent graph parity. Formal Format scalar/escaping and strict JSON input restrictions and static service-error causes remain visible as original failed assertions until explicitly reconciled. Redrive metadata remains unsupported and is excluded by the upstream TestTimeouts class markers; no redrive coverage is claimed. No green external-target claim follows from classifying a difference.
+
+
+## D114: Prefer explicitly authorized observed AWS behavior for the five remaining cases
+
+The user authorizes closing all five original snapshot differences after reviewing their causes. Observed AWS behavior now supersedes the earlier formal-only Format/escaping/empty-JSON restrictions and static missing-function Cause policy in D113. Follow design61 §7 without adding masks, replacing snapshots or removing nodes. Preserve all safety/ownership budgets and typed diagnostics; use fresh local service-error request UUIDs without claiming cloud execution. E05 exits only with the unchanged91+32 inventory green. This does not expand unrelated service APIs or waive M4 platform/reference gates.
diff --git a/specs/ruststack-lambda-design.md b/specs/ruststack-lambda-design.md
index bcf7abec..dd8b61eb 100644
--- a/specs/ruststack-lambda-design.md
+++ b/specs/ruststack-lambda-design.md
@@ -1,5 +1,7 @@
 # Rustack Lambda: Invoke-Focused Native Rust Implementation Design
 
+> Current execution target: [Workflows Lambda runtime](./rustack-workflows-20-lambda-runtime-design.md) supersedes this document's RIE-forwarding/Docker execution architecture. Retain unaffected control-plane details and [Lambda hardening](./rustack-lambda-hardening-design.md). This is a design update, not a claim that Docker execution is implemented.
+
 **Date:** 2026-03-06
 **Status:** Draft / RFC
 **Depends on:** [smithy-s3-redesign-design.md](./smithy-s3-redesign-design.md), [rustack-dynamodb-design.md](./rustack-dynamodb-design.md), [rustack-sqs-design.md](./rustack-sqs-design.md)
diff --git a/specs/ruststack-lambda-executor-design.md b/specs/ruststack-lambda-executor-design.md
index 779efb1f..6e3568d4 100644
--- a/specs/ruststack-lambda-executor-design.md
+++ b/specs/ruststack-lambda-executor-design.md
@@ -1,5 +1,7 @@
 # Rustack Lambda: Real Function Execution (Native + Docker Backends)
 
+> Current execution target: [Workflows Lambda runtime](./rustack-workflows-20-lambda-runtime-design.md) supersedes the historical Docker networking, dependency versions and cleanup plan below. Preserve the applicable Native/Runtime API contracts and [Lambda hardening](./rustack-lambda-hardening-design.md). Docker remains unimplemented until the new phase gates pass.
+
 **Date:** 2026-04-19
 **Status:** Draft / Implementation Plan
 **Depends on:** [ruststack-lambda-design.md](./ruststack-lambda-design.md)
diff --git a/specs/ruststack-snapshot-binary-archive-design.md b/specs/ruststack-snapshot-binary-archive-design.md
index 794e6d0f..522a684b 100644
--- a/specs/ruststack-snapshot-binary-archive-design.md
+++ b/specs/ruststack-snapshot-binary-archive-design.md
@@ -201,6 +201,10 @@ directory before publishing the snapshot. On load, the manager unpacks `data.ss.
 directory before calling the service's import method. This keeps final snapshots compact while
 allowing service-native lazy data readers to land later without changing the outer format.
 
+### 6.4 Installed CBOR resource profile
+
+The shared CBOR encoder/decoder must follow [workflow operations§4.2](./rustack-workflows-60-operations-design.md#42-bounded-cbor-import-boundary): preflight the entire single value before typed allocation, reject ambiguous/duplicate keys and enforce byte/depth/value/collection/scalar/key ceilings. Encode through a capped fallible writer and apply the same preflight before publication. These are bounds on the existing v2 metadata/directory wire profile; service-specific schema/identity and restore transaction validation still apply.
+
 ## 7. Snapshot Trait
 
 The app-level trait becomes archive-oriented:
diff --git a/tests/integration/src/test_lambda.rs b/tests/integration/src/test_lambda.rs
index 7ffc15b1..94b56715 100644
--- a/tests/integration/src/test_lambda.rs
+++ b/tests/integration/src/test_lambda.rs
@@ -9,6 +9,15 @@ mod tests {
 
     use anyhow::{Context, Result, ensure};
     use aws_sdk_lambda::{
+        operation::{
+            create_function::CreateFunctionError,
+            get_function::GetFunctionError,
+            publish_version::PublishVersionError,
+            update_function_code::UpdateFunctionCodeError,
+            update_function_configuration::{
+                UpdateFunctionConfigurationError, UpdateFunctionConfigurationOutput,
+            },
+        },
         primitives::Blob,
         types::{Architecture, Environment, FunctionCode, FunctionUrlAuthType, Runtime},
     };
@@ -160,6 +169,321 @@ mod tests {
         cleanup_function(&client, &name).await;
     }
 
+    async fn check_stale_update_requests(
+        client: &aws_sdk_lambda::Client,
+        name: &str,
+        revision: &str,
+    ) -> Result<()> {
+        let error = client
+            .update_function_configuration()
+            .function_name(name)
+            .revision_id(revision)
+            .description("must not commit")
+            .send()
+            .await
+            .err()
+            .context("Stale configuration update unexpectedly succeeded")?;
+        ensure!(
+            error
+                .as_service_error()
+                .is_some_and(UpdateFunctionConfigurationError::is_precondition_failed_exception),
+            "Wrong configuration error type"
+        );
+        ensure!(
+            error
+                .raw_response()
+                .is_some_and(|response| response.status().as_u16() == 412),
+            "Wrong configuration HTTP status"
+        );
+        let error = client
+            .update_function_code()
+            .function_name(name)
+            .revision_id(revision)
+            .zip_file(dummy_zip_blob())
+            .send()
+            .await
+            .err()
+            .context("Stale code update unexpectedly succeeded")?;
+        ensure!(
+            error
+                .as_service_error()
+                .is_some_and(UpdateFunctionCodeError::is_precondition_failed_exception),
+            "Wrong code error type"
+        );
+        ensure!(
+            error
+                .raw_response()
+                .is_some_and(|response| response.status().as_u16() == 412),
+            "Wrong code HTTP status"
+        );
+        Ok(())
+    }
+
+    async fn check_rejected_update_preserved_metadata(
+        client: &aws_sdk_lambda::Client,
+        name: &str,
+        expected: &UpdateFunctionConfigurationOutput,
+    ) -> Result<()> {
+        let current = client
+            .get_function_configuration()
+            .function_name(name)
+            .send()
+            .await?;
+        ensure!(
+            current.revision_id() == expected.revision_id(),
+            "Rejected update changed revision"
+        );
+        ensure!(
+            current.code_sha256() == expected.code_sha256(),
+            "Rejected update changed hash"
+        );
+        ensure!(
+            current.code_size() == expected.code_size(),
+            "Rejected update changed size"
+        );
+        ensure!(
+            current.description() == expected.description(),
+            "Rejected update changed description"
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[ignore = "requires running server"]
+    async fn test_should_enforce_revision_preconditions_through_the_sdk_wire() -> Result<()> {
+        let client = lambda_client();
+        let name = create_test_function(&client, "revision-cas").await;
+        let result = async {
+            let initial = client
+                .get_function_configuration()
+                .function_name(&name)
+                .send()
+                .await?;
+            let original = initial.revision_id().context("Missing initial revision")?;
+            let updated = client
+                .update_function_configuration()
+                .function_name(&name)
+                .revision_id(original)
+                .description("new configuration")
+                .send()
+                .await?;
+            let updated_revision = updated
+                .revision_id()
+                .filter(|value| !value.is_empty())
+                .context("Missing updated revision")?;
+            ensure!(
+                updated_revision != original,
+                "Configuration revision did not advance"
+            );
+            check_stale_update_requests(&client, &name, original).await?;
+            check_rejected_update_preserved_metadata(&client, &name, &updated).await?;
+            let code = client
+                .update_function_code()
+                .function_name(&name)
+                .revision_id(updated_revision)
+                .zip_file(dummy_zip_blob())
+                .send()
+                .await?;
+            let code_revision = code
+                .revision_id()
+                .filter(|value| !value.is_empty())
+                .context("Missing code revision")?;
+            ensure!(
+                code_revision != updated_revision,
+                "Code revision did not advance"
+            );
+            let error = client
+                .publish_version()
+                .function_name(&name)
+                .revision_id(original)
+                .send()
+                .await
+                .err()
+                .context("Stale publication unexpectedly succeeded")?;
+            ensure!(
+                error
+                    .as_service_error()
+                    .is_some_and(PublishVersionError::is_precondition_failed_exception),
+                "Wrong publication error type"
+            );
+            ensure!(
+                error
+                    .raw_response()
+                    .is_some_and(|response| response.status().as_u16() == 412),
+                "Wrong publication HTTP status"
+            );
+            let current = client
+                .get_function_configuration()
+                .function_name(&name)
+                .send()
+                .await?;
+            ensure!(
+                current.description() == Some("new configuration"),
+                "Rejected mutation changed configuration"
+            );
+            ensure!(
+                current.revision_id() == code.revision_id(),
+                "Rejected mutation changed code revision"
+            );
+            let published = client
+                .publish_version()
+                .function_name(&name)
+                .revision_id(code_revision)
+                .send()
+                .await?;
+            ensure!(
+                published.version() == Some("1"),
+                "Valid publication did not succeed"
+            );
+            Ok(())
+        }
+        .await;
+        cleanup_function(&client, &name).await;
+        result
+    }
+
+    async fn reject_unsupported_creation(
+        client: &aws_sdk_lambda::Client,
+        name: &str,
+    ) -> Result<()> {
+        let error = client
+            .create_function()
+            .function_name(name)
+            .runtime(Runtime::Python312)
+            .role("arn:aws:iam::000000000000:role/test-role")
+            .handler("index.handler")
+            .code(FunctionCode::builder().zip_file(dummy_zip_blob()).build())
+            .kms_key_arn("arn:aws:kms:us-east-1:000000000000:key/unsupported")
+            .send()
+            .await
+            .err()
+            .context("Unsupported creation option was ignored")?;
+        ensure!(
+            error
+                .as_service_error()
+                .is_some_and(CreateFunctionError::is_invalid_parameter_value_exception),
+            "Wrong unsupported-create error"
+        );
+        let missing = client
+            .get_function()
+            .function_name(name)
+            .send()
+            .await
+            .err()
+            .context("Rejected creation inserted a resource")?;
+        ensure!(
+            missing
+                .as_service_error()
+                .is_some_and(GetFunctionError::is_resource_not_found_exception),
+            "Rejected creation was not absent"
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    #[ignore = "requires running server"]
+    async fn test_should_dry_run_code_without_mutation_and_reject_unsupported_deployment_fields()
+    -> Result<()> {
+        let client = lambda_client();
+        let name = create_test_function(&client, "dry-run-code").await;
+        let unsupported = func_name("unsupported-create");
+        let result = async {
+            reject_unsupported_creation(&client, &unsupported).await?;
+            let before = client
+                .get_function_configuration()
+                .function_name(&name)
+                .send()
+                .await?;
+            let revision = before
+                .revision_id()
+                .filter(|value| !value.is_empty())
+                .context("Missing revision")?;
+            client
+                .update_function_code()
+                .function_name(&name)
+                .revision_id(revision)
+                .zip_file(Blob::new(b"not an archive".to_vec()))
+                .dry_run(true)
+                .publish(true)
+                .send()
+                .await?;
+            client
+                .update_function_code()
+                .function_name(&name)
+                .s3_bucket("missing-bucket")
+                .s3_key("missing.zip")
+                .dry_run(true)
+                .send()
+                .await?;
+            let error = client
+                .update_function_code()
+                .function_name(&name)
+                .zip_file(dummy_zip_blob())
+                .source_kms_key_arn("arn:aws:kms:us-east-1:000000000000:key/unsupported")
+                .dry_run(true)
+                .send()
+                .await
+                .err()
+                .context("Unsupported code option was ignored")?;
+            ensure!(
+                error
+                    .as_service_error()
+                    .is_some_and(UpdateFunctionCodeError::is_invalid_parameter_value_exception),
+                "Wrong unsupported-code error"
+            );
+            let error = client
+                .update_function_configuration()
+                .function_name(&name)
+                .kms_key_arn("arn:aws:kms:us-east-1:000000000000:key/unsupported")
+                .description("must not commit")
+                .send()
+                .await
+                .err()
+                .context("Unsupported configuration option was ignored")?;
+            ensure!(
+                error.as_service_error().is_some_and(
+                    UpdateFunctionConfigurationError::is_invalid_parameter_value_exception
+                ),
+                "Wrong unsupported-config error"
+            );
+            let current = client
+                .get_function_configuration()
+                .function_name(&name)
+                .send()
+                .await?;
+            ensure!(
+                current.revision_id() == Some(revision),
+                "Validation changed revision"
+            );
+            ensure!(
+                current.code_sha256() == before.code_sha256(),
+                "Validation changed hash"
+            );
+            ensure!(
+                current.code_size() == before.code_size(),
+                "Validation changed size"
+            );
+            ensure!(
+                current.description() == before.description(),
+                "Validation changed configuration"
+            );
+            let versions = client
+                .list_versions_by_function()
+                .function_name(&name)
+                .send()
+                .await?;
+            ensure!(
+                versions.versions().len() == 1,
+                "Validation published a version"
+            );
+            Ok(())
+        }
+        .await;
+        cleanup_function(&client, &unsupported).await;
+        cleanup_function(&client, &name).await;
+        result
+    }
+
     // ---------------------------------------------------------------------------
     // S3 code packages (issue #34)
     // ---------------------------------------------------------------------------
diff --git a/tests/lambda-fixtures/.dockerignore b/tests/lambda-fixtures/.dockerignore
new file mode 100644
index 00000000..83fc9a11
--- /dev/null
+++ b/tests/lambda-fixtures/.dockerignore
@@ -0,0 +1,3 @@
+**/node_modules
+**/__pycache__
+**/.rustack-pulumi-install.lock
diff --git a/tests/lambda-fixtures/callback.Dockerfile b/tests/lambda-fixtures/callback.Dockerfile
new file mode 100644
index 00000000..42b191c0
--- /dev/null
+++ b/tests/lambda-fixtures/callback.Dockerfile
@@ -0,0 +1,9 @@
+FROM public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79
+COPY callback.js ${LAMBDA_TASK_ROOT}/callback.js
+ENV AWS_PROFILE=callback-image-poison \
+    AWS_ENDPOINT_URL_LAMBDA=http://127.0.0.1:9 \
+    AWS_ENDPOINT_URL_SFN=http://127.0.0.1:9 \
+    AWS_ENDPOINT_URL_DYNAMODB=http://127.0.0.1:9 \
+    AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true
+USER 1000:1000
+CMD ["callback.dispatcher"]
diff --git a/tests/lambda-fixtures/callback.js b/tests/lambda-fixtures/callback.js
new file mode 100644
index 00000000..a8ad2a29
--- /dev/null
+++ b/tests/lambda-fixtures/callback.js
@@ -0,0 +1,251 @@
+"use strict";
+
+const { createHash, timingSafeEqual } = require("node:crypto");
+const { performance } = require("node:perf_hooks");
+const { setTimeout: delay } = require("node:timers/promises");
+const { LambdaClient, InvokeCommand } = require("@aws-sdk/client-lambda");
+const { DynamoDBClient, PutItemCommand, GetItemCommand } = require("@aws-sdk/client-dynamodb");
+const { SFNClient, SendTaskSuccessCommand, SendTaskFailureCommand,
+    SendTaskHeartbeatCommand, GetExecutionHistoryCommand } = require("@aws-sdk/client-sfn");
+
+const versions = {
+    lambda: require("@aws-sdk/client-lambda/package.json").version,
+    sfn: require("@aws-sdk/client-sfn/package.json").version,
+    dynamodb: require("@aws-sdk/client-dynamodb/package.json").version,
+};
+const modes = ["early", "late", "externalFailure", "invocationFailure", "retry",
+    "heartbeat", "absoluteTimeout", "heartbeatTimeout", "stop"];
+const hex = /^[0-9a-f]{64}$/;
+let counter = 0;
+let previousToken;
+
+class CallbackFixtureFailure extends Error {
+    constructor() { super("bounded image callback fixture failed"); this.name = "CallbackFixtureFailure"; }
+}
+class CallbackInvocationFailure extends Error {
+    constructor() { super("actual image invocation failure"); this.name = "CallbackInvocationFailure"; }
+}
+function check(value) {
+    if (!value) throw new CallbackFixtureFailure();
+}
+function sameToken(left, right) {
+    check(hex.test(left) && hex.test(right));
+    const a = Buffer.from(left, "ascii"), b = Buffer.from(right, "ascii");
+    try { return timingSafeEqual(a, b); } finally { a.fill(0); b.fill(0); }
+}
+function input(event) {
+    check(event && typeof event === "object" && !Array.isArray(event));
+    check(Object.keys(event).length === 8 && Object.keys(event).every(key =>
+        ["token", "executionArn", "nonce", "table", "worker", "n", "retry", "mode"].includes(key)));
+    check(typeof event.token === "string" && hex.test(event.token));
+    check(typeof event.executionArn === "string" && event.executionArn.length <= 256 &&
+        /^arn:aws:states:us-east-1:000000000000:execution:[A-Za-z0-9_-]+:[A-Za-z0-9_-]+$/.test(event.executionArn));
+    check(typeof event.nonce === "string" && /^[0-9a-f]{32}$/.test(event.nonce));
+    check(typeof event.table === "string" && /^[A-Za-z0-9_.-]{3,128}$/.test(event.table));
+    check(typeof event.worker === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(event.worker));
+    check(Number.isSafeInteger(event.n) && Math.abs(event.n) <= 1000000);
+    check(Number.isInteger(event.retry) && event.retry >= 0 && event.retry <= 1 && modes.includes(event.mode));
+    return event;
+}
+function checkEnvironment() {
+    for (const key of ["AWS_PROFILE", "AWS_ENDPOINT_URL_LAMBDA", "AWS_ENDPOINT_URL_SFN",
+        "AWS_ENDPOINT_URL_DYNAMODB"]) check(process.env[key] === undefined);
+    check(process.env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS === "false");
+    check(process.env.AWS_EC2_METADATA_DISABLED === "true");
+}
+function remaining(deadline) {
+    const value = Math.ceil(deadline - performance.now());
+    check(value > 0);
+    return value;
+}
+function apiError(error, name) {
+    return error?.name === name && error?.$metadata?.httpStatusCode === 400;
+}
+
+class Session {
+    constructor(deadline, signal) {
+        this.deadline = deadline;
+        this.signal = signal;
+        this.clients = [];
+    }
+    open() {
+        this.sfn = this.add(new SFNClient({ maxAttempts: 1 }));
+        this.ddb = this.add(new DynamoDBClient({ maxAttempts: 1 }));
+        this.lambda = this.add(new LambdaClient({ maxAttempts: 1 }));
+    }
+    add(client) { this.clients.push(client); return client; }
+    close() { for (const client of this.clients) client.destroy(); }
+    async send(client, command) {
+        this.signal.throwIfAborted();
+        const request = new AbortController();
+        const forward = () => request.abort();
+        const timer = setTimeout(() => request.abort(), Math.min(4000, remaining(this.deadline)));
+        this.signal.addEventListener("abort", forward, { once: true });
+        try {
+            this.signal.throwIfAborted();
+            remaining(this.deadline);
+            const value = await client.send(command, { abortSignal: request.signal });
+            this.signal.throwIfAborted();
+            remaining(this.deadline);
+            return value;
+        } finally {
+            clearTimeout(timer);
+            this.signal.removeEventListener("abort", forward);
+            request.abort();
+        }
+    }
+    async expect(command, name) {
+        try { await this.send(this.sfn, command); } catch (error) {
+            check(apiError(error, name));
+            return;
+        }
+        throw new CallbackFixtureFailure();
+    }
+    async gate(data, kind) {
+        const result = await this.send(this.ddb, new GetItemCommand({
+            TableName: data.table, Key: { id: { S: "gate:" + data.nonce + ":" + data.retry + ":" + kind } }, ConsistentRead: true,
+        }));
+        return result.Item?.open?.BOOL === true;
+    }
+    async waitGate(data, kind) {
+        while (!await this.gate(data, kind)) {
+            await delay(Math.min(100, remaining(this.deadline)), undefined, { signal: this.signal });
+        }
+    }
+    async record(data, state, stage) {
+        const item = {
+            id: { S: state.requestId }, nonce: { S: data.nonce }, role: { S: state.role },
+            requestId: { S: state.requestId }, tokenHash: { S: state.tokenHash }, stage: { S: stage },
+            retry: { N: String(data.retry) }, heartbeats: { N: String(state.heartbeats) },
+            historySafe: { BOOL: state.historySafe }, closedToken: { BOOL: state.closedToken },
+            oldTokenRejected: { BOOL: state.oldTokenRejected }, sdkVersion: { S: versions.sfn },
+        };
+        check(Buffer.byteLength(JSON.stringify(item)) <= 2048);
+        await this.send(this.ddb, new PutItemCommand({ TableName: data.table, Item: item }));
+    }
+    async history(data, state) {
+        const result = await this.send(this.sfn, new GetExecutionHistoryCommand({
+            executionArn: data.executionArn, includeExecutionData: true, maxResults: 1000,
+        }));
+        check(!result.nextToken && Array.isArray(result.events) && result.events.length <= 256);
+        const encoded = JSON.stringify(result);
+        check(Buffer.byteLength(encoded) <= 262144 && !encoded.includes(data.token));
+        check(result.events.some(event => event.type === "TaskScheduled"));
+        state.historySafe = true;
+    }
+    async callback(data, state, failure) {
+        const forged = "0".repeat(64);
+        check(!sameToken(data.token, forged));
+        await this.expect(new SendTaskSuccessCommand({ taskToken: forged, output: "{}" }), "InvalidToken");
+        const command = failure
+            ? new SendTaskFailureCommand({ taskToken: data.token, error: failure, cause: "actual image SDK failure" })
+            : new SendTaskSuccessCommand({ taskToken: data.token, output: JSON.stringify({
+                value: data.n * 2, sdk: "node", requestId: state.requestId, retry: data.retry,
+            }) });
+        const result = await this.send(this.sfn, command);
+        check(result.$metadata.httpStatusCode === 200);
+        await this.expect(new SendTaskHeartbeatCommand({ taskToken: data.token }), "TaskTimedOut");
+        state.closedToken = true;
+        await this.history(data, state);
+    }
+}
+
+async function dispatcher(session, data, state) {
+    if (data.retry === 1) {
+        check(previousToken !== undefined && !sameToken(previousToken, data.token));
+        await session.expect(new SendTaskHeartbeatCommand({ taskToken: previousToken }), "TaskTimedOut");
+        state.oldTokenRejected = true;
+    }
+    previousToken = data.token;
+    await session.record(data, state, "consumed");
+    if (["early", "externalFailure", "invocationFailure", "retry"].includes(data.mode)) {
+        const failure = data.mode === "externalFailure" ? "CallbackExternalFailure"
+            : data.mode === "retry" && data.retry === 0 ? "CallbackRetry" : undefined;
+        await session.callback(data, state, failure);
+        await session.record(data, state, "callback");
+        await session.waitGate(data, "return");
+        if (data.mode === "invocationFailure") throw new CallbackInvocationFailure();
+    } else {
+        if (data.mode === "heartbeat") {
+            const beat = await session.send(session.sfn, new SendTaskHeartbeatCommand({ taskToken: data.token }));
+            check(beat.$metadata.httpStatusCode === 200);
+        }
+        const body = Buffer.from(JSON.stringify(data));
+        check(body.length <= 4096);
+        const accepted = await session.send(session.lambda, new InvokeCommand({
+            FunctionName: data.worker, InvocationType: "Event", Payload: body,
+        }));
+        check(accepted.StatusCode === 202 && accepted.$metadata.httpStatusCode === 202);
+        check(!accepted.FunctionError && (!accepted.Payload || accepted.Payload.length === 0));
+        await session.record(data, state, "accepted");
+        if (["heartbeat", "stop"].includes(data.mode)) await session.waitGate(data, "return");
+    }
+    return { ignored: "synchronous callback body", requestId: state.requestId };
+}
+
+async function worker(session, data, state) {
+    check(["late", "heartbeat", "absoluteTimeout", "heartbeatTimeout", "stop"].includes(data.mode));
+    await session.record(data, state, "waiting");
+    while (!await session.gate(data, "finish")) {
+        if (["heartbeat", "absoluteTimeout"].includes(data.mode) && !state.closedToken &&
+            await session.gate(data, "heartbeats")) {
+            try {
+                const result = await session.send(session.sfn, new SendTaskHeartbeatCommand({ taskToken: data.token }));
+                check(result.$metadata.httpStatusCode === 200);
+                state.heartbeats += 1;
+                check(state.heartbeats <= 100);
+            } catch (error) {
+                check(data.mode === "absoluteTimeout" && apiError(error, "TaskTimedOut"));
+                state.closedToken = true;
+            }
+            await session.record(data, state, "heartbeat");
+        }
+        await delay(Math.min(100, remaining(session.deadline)), undefined, { signal: session.signal });
+    }
+    if (["absoluteTimeout", "heartbeatTimeout", "stop"].includes(data.mode)) {
+        await session.expect(new SendTaskSuccessCommand({ taskToken: data.token, output: "{}" }), "TaskTimedOut");
+        state.closedToken = true;
+        await session.history(data, state);
+    } else {
+        await session.callback(data, state);
+    }
+    await session.record(data, state, "finished");
+    return { workerFinished: true, requestId: state.requestId };
+}
+
+async function run(event, context, isWorker) {
+    let session, timer;
+    const controller = new AbortController();
+    try {
+        checkEnvironment();
+        counter += 1;
+        check(counter <= 128 && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(context.awsRequestId));
+        if (event?.mode === "probe" || event?.mode === "compute") {
+            check(Object.keys(event).every(key => ["mode", "n"].includes(key)));
+            if (event.mode === "compute") check(Number.isSafeInteger(event.n) && Math.abs(event.n) <= 1000000);
+            return { probe: true, computed: event.mode === "compute" ? event.n * 2 : 0,
+                counter, versions, requestId: context.awsRequestId, architecture: process.arch };
+        }
+        const data = input(event);
+        const time = context.getRemainingTimeInMillis();
+        check(Number.isFinite(time) && time > 100);
+        const deadline = performance.now() + Math.min(35000, time - 100);
+        timer = setTimeout(() => controller.abort(), remaining(deadline));
+        session = new Session(deadline, controller.signal);
+        session.open();
+        const state = { role: isWorker ? "B" : "A", requestId: context.awsRequestId,
+            tokenHash: createHash("sha256").update(data.token, "ascii").digest("hex"),
+            heartbeats: 0, historySafe: false, closedToken: false, oldTokenRejected: false };
+        return await (isWorker ? worker(session, data, state) : dispatcher(session, data, state));
+    } catch (error) {
+        if (error instanceof CallbackInvocationFailure) throw error;
+        throw new CallbackFixtureFailure();
+    } finally {
+        clearTimeout(timer);
+        controller.abort();
+        session?.close();
+    }
+}
+
+exports.dispatcher = (event, context) => run(event, context, false);
+exports.worker = (event, context) => run(event, context, true);
diff --git a/tests/lambda-fixtures/callback_bootstrap.py b/tests/lambda-fixtures/callback_bootstrap.py
new file mode 100644
index 00000000..2cc2847a
--- /dev/null
+++ b/tests/lambda-fixtures/callback_bootstrap.py
@@ -0,0 +1,144 @@
+"""Actual provided runtime using ordinary signed boto3 callback requests."""
+
+import json
+import os
+import pathlib
+import sys
+import time
+import urllib.parse
+import urllib.request
+import uuid
+
+import boto3
+from botocore.config import Config
+from botocore.exceptions import ClientError
+
+
+def run():
+    endpoint = os.environ["CALLBACK_ENDPOINT"]
+    parsed = urllib.parse.urlsplit(endpoint)
+    assert len(endpoint) <= 128 and parsed.scheme == "http"
+    assert parsed.hostname == "127.0.0.1" and parsed.port
+    assert parsed.path in ("", "/") and not parsed.query and not parsed.fragment
+    assert not parsed.username and not parsed.password
+    client = boto3.client(
+        "stepfunctions", endpoint_url=endpoint, region_name="us-east-1",
+        aws_access_key_id=os.environ["CALLBACK_ACCESS_KEY"],
+        aws_secret_access_key=os.environ["CALLBACK_SECRET_KEY"],
+        config=Config(connect_timeout=2, read_timeout=4,
+                      retries={"total_max_attempts": 1}, proxies={}),
+    )
+    api = os.environ["AWS_LAMBDA_RUNTIME_API"]
+    assert len(api) <= 64 and api.startswith("127.0.0.1:")
+    markers = pathlib.Path(os.environ["CALLBACK_MARKER_DIR"])
+    gates = pathlib.Path(os.environ["CALLBACK_GATE_DIR"])
+    processes = pathlib.Path(os.environ["PROCESS_MARKER_DIR"])
+    assert markers.is_dir() and gates.is_dir() and processes.is_dir()
+    pid = os.getpid()
+    (processes / f"pid-{pid}").write_text(str(pid))
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+    base = f"http://{api}/2018-06-01/runtime/invocation/"
+
+    def post(request_id, failure=False):
+        route = "error" if failure else "response"
+        payload = ({"errorType": "CallbackInvocationFailure", "errorMessage": "actual fixture error"}
+                   if failure else {"ignored": "synchronous body"})
+        with opener.open(urllib.request.Request(
+            f"{base}{request_id}/{route}", data=json.dumps(payload).encode(), method="POST"
+        ), timeout=4) as response:
+            assert response.status == 202
+
+    def record(request_id, stage, retry, heartbeats=0, safe=False, closed=False):
+        evidence = dict(requestId=request_id, pid=pid, sdk="boto3", stage=stage,
+                        retry=retry, heartbeats=heartbeats, historySafe=safe, closedToken=closed)
+        pending = markers / f"{request_id}.pending"
+        body = json.dumps(evidence)
+        assert len(body.encode()) <= 1024
+        pending.write_text(body)
+        pending.replace(markers / f"{request_id}.json")
+
+    def expect_closed(operation):
+        try:
+            operation()
+        except ClientError as error:
+            assert error.response["Error"]["Code"] == "TaskTimedOut"
+        else:
+            raise AssertionError("closed token accepted")
+
+    previous = None
+    while True:
+        with opener.open(f"{base}next", timeout=60) as response:
+            request_id = response.headers["Lambda-Runtime-Aws-Request-Id"]
+            assert str(uuid.UUID(request_id)) == request_id and len(request_id) == 36
+            body = response.read(524289)
+            assert len(body) <= 524288
+        event = json.loads(body)
+        assert set(event) == {"token", "executionArn", "mode", "n", "retry"}
+        token = event["token"]
+        assert isinstance(token, str) and len(token) == 64
+        assert all(value in "0123456789abcdef" for value in token)
+        mode, retry = event["mode"], event["retry"]
+        assert mode in {"early", "late", "externalFailure", "invocationFailure", "retry",
+                        "heartbeat", "absoluteTimeout", "heartbeatTimeout", "stop"}
+        assert type(retry) is int and 0 <= retry <= 1
+        assert type(event["n"]) is int and 0 <= event["n"] <= 1000
+        assert len(event["executionArn"]) <= 256
+        assert event["executionArn"].startswith("arn:aws:states:us-east-1:000000000000:execution:")
+        if retry == 1:
+            assert previous is not None and previous != token
+            expect_closed(lambda: client.send_task_heartbeat(taskToken=previous))
+        record(request_id, "consumed", retry)
+        late = mode in {"late", "heartbeat", "absoluteTimeout", "heartbeatTimeout"}
+        if late:
+            post(request_id)
+            record(request_id, "returned", retry)
+        if late or mode == "stop":
+            until = time.monotonic() + 45
+            count = 0
+            while not (gates / f"{request_id}.release").exists() and not (gates / "all.release").exists():
+                assert time.monotonic() < until
+                if mode in {"heartbeat", "absoluteTimeout"}:
+                    try:
+                        response = client.send_task_heartbeat(taskToken=token)
+                    except ClientError as error:
+                        assert mode == "absoluteTimeout"
+                        assert error.response["Error"]["Code"] == "TaskTimedOut"
+                    else:
+                        assert response["ResponseMetadata"]["HTTPStatusCode"] == 200
+                        count += 1
+                        record(request_id, "heartbeat", retry, heartbeats=count)
+                time.sleep(0.1)
+        if mode == "externalFailure" or mode == "retry" and retry == 0:
+            response = client.send_task_failure(
+                taskToken=token, error="CallbackRetry" if mode == "retry" else "CallbackExternalFailure",
+                cause="actual handler SDK failure",
+            )
+            assert response["ResponseMetadata"]["HTTPStatusCode"] == 200
+        else:
+            complete = lambda: client.send_task_success(taskToken=token, output=json.dumps(
+                dict(value=event["n"] * 2, sdk="boto3", requestId=request_id, retry=retry)))
+            if mode in {"absoluteTimeout", "heartbeatTimeout"}:
+                expect_closed(complete)
+            else:
+                assert complete()["ResponseMetadata"]["HTTPStatusCode"] == 200
+        expect_closed(lambda: client.send_task_heartbeat(taskToken=token))
+        history = client.get_execution_history(executionArn=event["executionArn"],
+                                               includeExecutionData=True, maxResults=1000)
+        safe = token not in json.dumps(history, default=str)
+        assert safe and any(item["type"] == "TaskScheduled" for item in history["events"])
+        record(request_id, "callback", retry, safe=safe, closed=True)
+        if not late:
+            until = time.monotonic() + 45
+            while not (gates / f"{request_id}.release").exists() and not (gates / "all.release").exists():
+                assert time.monotonic() < until
+                time.sleep(0.1)
+            post(request_id, failure=mode == "invocationFailure")
+        previous = token
+
+
+if __name__ == "__main__":
+    try:
+        run()
+    except Exception:
+        # No token-bearing SDK exception or input is printed by the fixture.
+        sys.exit(1)
diff --git a/tests/lambda-fixtures/echo-bootstrap/Cargo.toml b/tests/lambda-fixtures/echo-bootstrap/Cargo.toml
index e3e882d0..ce3debfd 100644
--- a/tests/lambda-fixtures/echo-bootstrap/Cargo.toml
+++ b/tests/lambda-fixtures/echo-bootstrap/Cargo.toml
@@ -15,9 +15,41 @@ workspace = true
 name = "bootstrap"
 path = "src/main.rs"
 
+[[bin]]
+name = "image-bootstrap"
+path = "src/image.rs"
+
+[[bin]]
+name = "no-runtime-bootstrap"
+path = "src/no_runtime.rs"
+
+[[bin]]
+name = "zip-code-bootstrap"
+path = "src/zip_code.rs"
+required-features = ["zip-code"]
+
+[[bin]]
+name = "callback-bootstrap"
+path = "src/callback/main.rs"
+required-features = ["sdk-callback"]
+
+[features]
+zip-code = ["dep:tokio", "tokio/io-std"]
+provided-qualification = ["dep:tokio"]
+sdk-callback = ["dep:anyhow", "dep:aws-sdk-sfn", "dep:aws-credential-types", "dep:secrecy", "dep:serde", "dep:tokio", "dep:typed-builder", "dep:url", "dep:uuid"]
+
 [dependencies]
 ureq = { version = "2", default-features = false }
 serde_json = { workspace = true }
+anyhow = { workspace = true, optional = true }
+aws-sdk-sfn = { workspace = true, optional = true }
+aws-credential-types = { workspace = true, optional = true }
+secrecy = { workspace = true, optional = true }
+serde = { workspace = true, optional = true }
+tokio = { workspace = true, optional = true }
+url = { workspace = true, optional = true }
+uuid = { workspace = true, optional = true }
+typed-builder = { workspace = true, optional = true }
 
 [dev-dependencies]
 rustack-lambda-core = { workspace = true }
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/callback/main.rs b/tests/lambda-fixtures/echo-bootstrap/src/callback/main.rs
new file mode 100644
index 00000000..a48279d4
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/callback/main.rs
@@ -0,0 +1,351 @@
+//! Actual Native custom runtime using ordinary signed Step Functions SDK calls.
+#![forbid(unsafe_code)]
+
+use std::{env, ffi::OsString, process::ExitCode, time::Duration};
+#[cfg(unix)]
+use std::{os::unix::process::CommandExt, path::PathBuf};
+
+use anyhow::{Context, Result, ensure};
+use aws_credential_types::Credentials;
+use aws_sdk_sfn::{
+    Client,
+    config::{BehaviorVersion, Region, retry::RetryConfig, timeout::TimeoutConfig},
+    error::ProvideErrorMetadata,
+};
+use secrecy::{ExposeSecret, SecretString};
+use serde::{Deserialize, Deserializer, de::Error as _};
+use serde_json::json;
+#[cfg(unix)]
+use tokio::process::Command;
+use tokio::time::{Instant, sleep};
+use url::Url;
+
+mod wire;
+use wire::Wire;
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+enum Mode {
+    Early,
+    Late,
+    ExternalFailure,
+    InvocationFailure,
+    Retry,
+    Heartbeat,
+    AbsoluteTimeout,
+    HeartbeatTimeout,
+    Stop,
+}
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Input {
+    #[serde(deserialize_with = "secret")]
+    token: SecretString,
+    execution_arn: String,
+    mode: Mode,
+    n: u32,
+    retry: u32,
+}
+fn secret<'de, D: Deserializer<'de>>(
+    deserializer: D,
+) -> std::result::Result<SecretString, D::Error> {
+    let value = String::deserialize(deserializer)?;
+    if value.len() != 64
+        || !value
+            .bytes()
+            .all(|b| b.is_ascii_digit() || matches!(b, b'a'..=b'f'))
+    {
+        return Err(D::Error::custom("invalid callback credential"));
+    }
+    Ok(value.into())
+}
+#[derive(Debug)]
+struct Sdk {
+    client: Client,
+}
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> ExitCode {
+    if let Some(interpreter) = env::var_os("CALLBACK_PYTHON") {
+        return python(interpreter).await;
+    }
+    match run().await {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(_) => ExitCode::FAILURE,
+    }
+}
+#[cfg(unix)]
+async fn python(interpreter: OsString) -> ExitCode {
+    let Some(root) = env::var_os("LAMBDA_TASK_ROOT") else {
+        return ExitCode::FAILURE;
+    };
+    let script = PathBuf::from(root).join("callback.py");
+    let path = PathBuf::from(&interpreter);
+    if !path.is_absolute()
+        || interpreter.len() > 4096
+        || !matches!(tokio::time::timeout(Duration::from_secs(2),tokio::fs::metadata(&script)).await,Ok(Ok(metadata)) if metadata.is_file())
+    {
+        return ExitCode::FAILURE;
+    }
+    // exec preserves the exact PID already owned by Native's process supervisor.
+    let _error = Command::new(path).arg(script).as_std_mut().exec();
+    ExitCode::FAILURE
+}
+#[cfg(not(unix))]
+async fn python(_interpreter: OsString) -> ExitCode {
+    ExitCode::FAILURE
+}
+async fn run() -> Result<()> {
+    let wire = Wire::new().await?;
+    let sdk = Sdk::new()?;
+    let mut previous: Option<SecretString> = None;
+    loop {
+        let (request, body) = wire.next().await?;
+        let input: Input = serde_json::from_slice(&body).context("decode callback input")?;
+        ensure!(
+            input.n <= 1000
+                && input.retry <= 1
+                && (1..=256).contains(&input.execution_arn.len())
+                && input.execution_arn.is_ascii()
+                && input
+                    .execution_arn
+                    .starts_with("arn:aws:states:us-east-1:000000000000:execution:"),
+            "invalid callback input"
+        );
+        if input.retry == 1 {
+            let old = previous.take().context("missing previous attempt")?;
+            ensure!(
+                old.expose_secret() != input.token.expose_secret(),
+                "reused callback token"
+            );
+            sdk.closed(&old).await?;
+        }
+        execute(&wire, &sdk, &request, &input).await?;
+        previous = Some(input.token);
+    }
+}
+impl Sdk {
+    fn new() -> Result<Self> {
+        let endpoint = env::var("CALLBACK_ENDPOINT").context("callback endpoint")?;
+        ensure!(endpoint.len() <= 128, "callback endpoint bound");
+        let parsed = Url::parse(&endpoint)?;
+        ensure!(
+            parsed.scheme() == "http"
+                && parsed.host_str() == Some("127.0.0.1")
+                && parsed.port().is_some()
+                && parsed.path() == "/"
+                && parsed.query().is_none()
+                && parsed.fragment().is_none()
+                && parsed.username().is_empty()
+                && parsed.password().is_none(),
+            "invalid callback endpoint"
+        );
+        let client = Client::from_conf(
+            aws_sdk_sfn::Config::builder()
+                .behavior_version(BehaviorVersion::latest())
+                .region(Region::new("us-east-1"))
+                .endpoint_url(endpoint)
+                .credentials_provider(Credentials::new(
+                    env::var("CALLBACK_ACCESS_KEY")?,
+                    env::var("CALLBACK_SECRET_KEY")?,
+                    None,
+                    None,
+                    "callback-fixture",
+                ))
+                .retry_config(RetryConfig::disabled())
+                .timeout_config(
+                    TimeoutConfig::builder()
+                        .connect_timeout(Duration::from_secs(2))
+                        .read_timeout(Duration::from_secs(4))
+                        .operation_timeout(Duration::from_secs(4))
+                        .build(),
+                )
+                .build(),
+        );
+        Ok(Self { client })
+    }
+    async fn heartbeat(&self, input: &Input) -> Result<bool> {
+        let result = self
+            .client
+            .send_task_heartbeat()
+            .task_token(input.token.expose_secret())
+            .send()
+            .await;
+        match result {
+            Ok(_) => Ok(true),
+            Err(error)
+                if input.mode == Mode::AbsoluteTimeout
+                    && error
+                        .as_service_error()
+                        .and_then(ProvideErrorMetadata::code)
+                        == Some("TaskTimedOut") =>
+            {
+                Ok(false)
+            }
+            Err(error) => Err(error).context("handler heartbeat"),
+        }
+    }
+    async fn closed(&self, token: &SecretString) -> Result<()> {
+        let error = self
+            .client
+            .send_task_heartbeat()
+            .task_token(token.expose_secret())
+            .send()
+            .await
+            .err()
+            .context("closed token unexpectedly accepted")?;
+        ensure!(
+            error
+                .as_service_error()
+                .and_then(ProvideErrorMetadata::code)
+                == Some("TaskTimedOut"),
+            "wrong closed token classification"
+        );
+        Ok(())
+    }
+    async fn complete(&self, input: &Input, request: &str, closed: bool) -> Result<()> {
+        let output = json!({"value":input.n.checked_mul(2).context("compute overflow")?,"sdk":"rust","requestId":request,"retry":input.retry});
+        let result = self
+            .client
+            .send_task_success()
+            .task_token(input.token.expose_secret())
+            .output(output.to_string())
+            .send()
+            .await;
+        if closed {
+            let error = result
+                .err()
+                .context("expired token unexpectedly accepted")?;
+            ensure!(
+                error
+                    .as_service_error()
+                    .and_then(ProvideErrorMetadata::code)
+                    == Some("TaskTimedOut"),
+                "wrong expired token classification"
+            );
+        } else {
+            result.context("handler success")?;
+        }
+        self.closed(&input.token).await
+    }
+    async fn failure(&self, input: &Input) -> Result<()> {
+        self.client
+            .send_task_failure()
+            .task_token(input.token.expose_secret())
+            .error(if input.mode == Mode::Retry {
+                "CallbackRetry"
+            } else {
+                "CallbackExternalFailure"
+            })
+            .cause("actual handler SDK failure")
+            .send()
+            .await
+            .context("handler external failure")?;
+        self.closed(&input.token).await
+    }
+    async fn history_safe(&self, input: &Input) -> Result<bool> {
+        let history = self
+            .client
+            .get_execution_history()
+            .execution_arn(&input.execution_arn)
+            .include_execution_data(true)
+            .max_results(1000)
+            .send()
+            .await
+            .context("handler history")?;
+        let mut scheduled = false;
+        for event in history.events() {
+            if let Some(details) = event.task_scheduled_event_details() {
+                scheduled = true;
+                if details.parameters().contains(input.token.expose_secret()) {
+                    return Ok(false);
+                }
+            }
+            for value in [
+                event
+                    .execution_started_event_details()
+                    .and_then(|v| v.input()),
+                event.state_entered_event_details().and_then(|v| v.input()),
+                event.state_exited_event_details().and_then(|v| v.output()),
+                event
+                    .task_submitted_event_details()
+                    .and_then(|v| v.output()),
+                event
+                    .task_succeeded_event_details()
+                    .and_then(|v| v.output()),
+                event
+                    .execution_succeeded_event_details()
+                    .and_then(|v| v.output()),
+                event.task_failed_event_details().and_then(|v| v.error()),
+                event.task_failed_event_details().and_then(|v| v.cause()),
+                event.task_timed_out_event_details().and_then(|v| v.error()),
+                event.task_timed_out_event_details().and_then(|v| v.cause()),
+                event
+                    .execution_failed_event_details()
+                    .and_then(|v| v.error()),
+                event
+                    .execution_failed_event_details()
+                    .and_then(|v| v.cause()),
+            ]
+            .into_iter()
+            .flatten()
+            {
+                if value.contains(input.token.expose_secret()) {
+                    return Ok(false);
+                }
+            }
+        }
+        Ok(scheduled)
+    }
+}
+async fn execute(wire: &Wire, sdk: &Sdk, request: &str, input: &Input) -> Result<()> {
+    wire.record(request, "consumed", input.retry, 0, false, false)
+        .await?;
+    let late = matches!(
+        input.mode,
+        Mode::Late | Mode::Heartbeat | Mode::AbsoluteTimeout | Mode::HeartbeatTimeout
+    );
+    if late {
+        wire.post(request, false).await?;
+        wire.record(request, "returned", input.retry, 0, false, false)
+            .await?;
+    }
+    if late || input.mode == Mode::Stop {
+        wait(wire, sdk, request, input).await?;
+    }
+    if input.mode == Mode::ExternalFailure || input.mode == Mode::Retry && input.retry == 0 {
+        sdk.failure(input).await?;
+    } else {
+        sdk.complete(
+            input,
+            request,
+            matches!(input.mode, Mode::AbsoluteTimeout | Mode::HeartbeatTimeout),
+        )
+        .await?;
+    }
+    let safe = sdk.history_safe(input).await?;
+    ensure!(safe, "credential exposed in history");
+    wire.record(request, "callback", input.retry, 0, safe, true)
+        .await?;
+    if !late {
+        wait(wire, sdk, request, input).await?;
+        wire.post(request, input.mode == Mode::InvocationFailure)
+            .await?;
+    }
+    Ok(())
+}
+async fn wait(wire: &Wire, sdk: &Sdk, request: &str, input: &Input) -> Result<()> {
+    let until = Instant::now() + Duration::from_secs(45);
+    let mut heartbeats = 0_u32;
+    while !wire.released(request).await? {
+        ensure!(Instant::now() < until, "fixture gate expired");
+        if matches!(input.mode, Mode::Heartbeat | Mode::AbsoluteTimeout) {
+            if sdk.heartbeat(input).await? {
+                heartbeats = heartbeats.checked_add(1).context("heartbeat overflow")?;
+                wire.record(request, "heartbeat", input.retry, heartbeats, false, false)
+                    .await?;
+            }
+        }
+        sleep(Duration::from_millis(100)).await;
+    }
+    Ok(())
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/callback/wire.rs b/tests/lambda-fixtures/echo-bootstrap/src/callback/wire.rs
new file mode 100644
index 00000000..2fa5d95e
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/callback/wire.rs
@@ -0,0 +1,161 @@
+//! Bounded Runtime API IO and credential-free atomic fixture evidence.
+
+use std::{env, io::Read, net::SocketAddr, path::PathBuf, time::Duration};
+
+use anyhow::{Context, Result, ensure};
+use serde::Serialize;
+use tokio::{fs, task::spawn_blocking, time::timeout};
+use typed_builder::TypedBuilder;
+use ureq::Agent;
+use uuid::Uuid;
+
+#[derive(Debug)]
+pub(super) struct Wire {
+    agent: Agent,
+    api: String,
+    markers: PathBuf,
+    gates: PathBuf,
+}
+#[derive(Debug, Serialize, TypedBuilder)]
+#[serde(rename_all = "camelCase")]
+struct Evidence<'a> {
+    request_id: &'a str,
+    pid: u32,
+    sdk: &'static str,
+    stage: &'static str,
+    retry: u32,
+    heartbeats: u32,
+    history_safe: bool,
+    closed_token: bool,
+}
+impl Wire {
+    pub(super) async fn new() -> Result<Self> {
+        let api = env::var("AWS_LAMBDA_RUNTIME_API")?;
+        let address: SocketAddr = api.parse()?;
+        ensure!(
+            address.ip().is_loopback() && address.port() != 0,
+            "invalid Runtime API address"
+        );
+        let markers =
+            PathBuf::from(env::var_os("CALLBACK_MARKER_DIR").context("marker directory")?);
+        let gates = PathBuf::from(env::var_os("CALLBACK_GATE_DIR").context("gate directory")?);
+        ensure!(
+            timeout(Duration::from_secs(2), fs::metadata(&markers))
+                .await??
+                .is_dir()
+                && timeout(Duration::from_secs(2), fs::metadata(&gates))
+                    .await??
+                    .is_dir(),
+            "missing fixture directories"
+        );
+        let processes =
+            PathBuf::from(env::var_os("PROCESS_MARKER_DIR").context("process directory")?);
+        let pid = std::process::id().to_string();
+        timeout(
+            Duration::from_secs(2),
+            fs::write(processes.join(format!("pid-{pid}")), pid),
+        )
+        .await??;
+        Ok(Self {
+            agent: ureq::AgentBuilder::new()
+                .timeout(Duration::from_secs(60))
+                .build(),
+            api,
+            markers,
+            gates,
+        })
+    }
+    pub(super) async fn next(&self) -> Result<(String, Vec<u8>)> {
+        let agent = self.agent.clone();
+        let url = format!("http://{}/2018-06-01/runtime/invocation/next", self.api);
+        spawn_blocking(move || {
+            let response = agent.get(&url).call()?;
+            let id = response
+                .header("Lambda-Runtime-Aws-Request-Id")
+                .context("request identity")?
+                .to_owned();
+            let parsed = Uuid::parse_str(&id)?;
+            ensure!(
+                id.len() == 36 && parsed.to_string() == id,
+                "invalid request identity"
+            );
+            let mut body = Vec::new();
+            response
+                .into_reader()
+                .take(524_289)
+                .read_to_end(&mut body)?;
+            ensure!(body.len() <= 524_288, "fixture body exceeded");
+            Ok((id, body))
+        })
+        .await
+        .context("Runtime API input worker")?
+    }
+    pub(super) async fn post(&self, request: &str, failure: bool) -> Result<()> {
+        let (route, body) = if failure {
+            (
+                "error",
+                r#"{"errorType":"CallbackInvocationFailure","errorMessage":"actual fixture error"}"#,
+            )
+        } else {
+            ("response", r#"{"ignored":"synchronous body"}"#)
+        };
+        let agent = self.agent.clone();
+        let url = format!(
+            "http://{}/2018-06-01/runtime/invocation/{request}/{route}",
+            self.api
+        );
+        spawn_blocking(move || {
+            agent
+                .post(&url)
+                .send_string(body)
+                .map(|_| ())
+                .context("Runtime API output")
+        })
+        .await
+        .context("Runtime API output worker")??;
+        Ok(())
+    }
+    pub(super) async fn record(
+        &self,
+        request: &str,
+        stage: &'static str,
+        retry: u32,
+        heartbeats: u32,
+        history_safe: bool,
+        closed_token: bool,
+    ) -> Result<()> {
+        let evidence = Evidence::builder()
+            .request_id(request)
+            .pid(std::process::id())
+            .sdk("rust")
+            .stage(stage)
+            .retry(retry)
+            .heartbeats(heartbeats)
+            .history_safe(history_safe)
+            .closed_token(closed_token)
+            .build();
+        let pending = self.markers.join(format!("{request}.pending"));
+        timeout(
+            Duration::from_secs(2),
+            fs::write(&pending, serde_json::to_vec(&evidence)?),
+        )
+        .await??;
+        timeout(
+            Duration::from_secs(2),
+            fs::rename(pending, self.markers.join(format!("{request}.json"))),
+        )
+        .await??;
+        Ok(())
+    }
+    pub(super) async fn released(&self, request: &str) -> Result<bool> {
+        let path = self.gates.join(format!("{request}.release"));
+        Ok(
+            timeout(Duration::from_secs(2), fs::try_exists(path)).await??
+                || timeout(
+                    Duration::from_secs(2),
+                    fs::try_exists(self.gates.join("all.release")),
+                )
+                .await??,
+        )
+    }
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/fixture_collector.rs b/tests/lambda-fixtures/echo-bootstrap/src/fixture_collector.rs
new file mode 100644
index 00000000..f632cab8
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/fixture_collector.rs
@@ -0,0 +1,45 @@
+//! Bounded fixture collector exchanges shared by Image and provided ZIP handlers.
+
+use std::{env, io::Read, net::SocketAddr};
+
+use serde_json::Value;
+use ureq::Agent;
+
+type Result<T> = std::result::Result<T, &'static str>;
+
+pub(super) fn variable(name: &str) -> Result<String> {
+    env::var(name)
+        .ok()
+        .filter(|value| !value.is_empty() && value.len() <= 256)
+        .ok_or("missing or oversized fixture environment")
+}
+pub(super) fn barrier(agent: &Agent, phase: &str, body: &Value) -> Result<Value> {
+    let address: SocketAddr = variable("IMAGE_FIXTURE_COLLECTOR")?
+        .parse()
+        .map_err(|_| "invalid fixture collector")?;
+    if !(address.ip().is_loopback()
+        || matches!(address.ip(), std::net::IpAddr::V4(ip) if ip.is_private()))
+        || address.port() == 0
+    {
+        return Err("fixture collector is not an explicit local address");
+    }
+    let token = variable("IMAGE_FIXTURE_TOKEN")?;
+    if token.len() != 32 || !token.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err("invalid fixture collector token");
+    }
+    let response = agent
+        .post(&format!("http://{address}/{phase}"))
+        .set("x-fixture-token", &token)
+        .send_string(&body.to_string())
+        .map_err(|_| "fixture collector exchange failed")?;
+    let mut raw = Vec::new();
+    response
+        .into_reader()
+        .take(2049)
+        .read_to_end(&mut raw)
+        .map_err(|_| "fixture collector response failed")?;
+    if raw.len() > 2048 {
+        return Err("fixture collector response exceeds limit");
+    }
+    serde_json::from_slice(&raw).map_err(|_| "fixture collector response is not JSON")
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/image.rs b/tests/lambda-fixtures/echo-bootstrap/src/image.rs
new file mode 100644
index 00000000..80861d41
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/image.rs
@@ -0,0 +1,288 @@
+//! Independent bounded custom Rust Runtime Interface Client for real Image tests.
+#![forbid(unsafe_code)]
+
+mod fixture_collector;
+#[path = "image_framing.rs"]
+mod framing;
+#[path = "image_timing.rs"]
+mod timing;
+use std::{
+    env,
+    hint::black_box,
+    io::Read,
+    net::SocketAddr,
+    path::Path,
+    process, thread,
+    time::{Duration, Instant},
+};
+
+use fixture_collector::{barrier, variable};
+use serde_json::{Value, json};
+use ureq::{Agent, AgentBuilder, Error};
+
+const EVENT_BYTES: u64 = 65_536;
+type Result<T> = std::result::Result<T, &'static str>;
+
+fn request_id(value: &str) -> Result<&str> {
+    if value.len() == 36
+        && value.bytes().enumerate().all(|(index, byte)| {
+            if matches!(index, 8 | 13 | 18 | 23) {
+                byte == b'-'
+            } else {
+                byte.is_ascii_hexdigit()
+            }
+        })
+    {
+        Ok(value)
+    } else {
+        Err("invalid fixture request identity")
+    }
+}
+fn post(agent: &Agent, root: &str, path: &str, body: &str) -> Result<u16> {
+    match agent.post(&format!("{root}/{path}")).send_string(body) {
+        Ok(response) => Ok(response.status()),
+        Err(Error::Status(status, _)) => Ok(status),
+        Err(_) => Err("fixture Runtime API transport failed"),
+    }
+}
+fn next(agent: &Agent, root: &str) -> Result<(String, String, Value)> {
+    let response = agent
+        .get(&format!("{root}/invocation/next"))
+        .call()
+        .map_err(|_| "fixture next invocation failed")?;
+    let id = request_id(
+        response
+            .header("lambda-runtime-aws-request-id")
+            .ok_or("missing request identity")?,
+    )?
+    .to_owned();
+    let arn = response
+        .header("lambda-runtime-invoked-function-arn")
+        .filter(|value| value.len() <= 2048)
+        .ok_or("missing invoked ARN")?
+        .to_owned();
+    let mut body = Vec::new();
+    response
+        .into_reader()
+        .take(EVENT_BYTES + 1)
+        .read_to_end(&mut body)
+        .map_err(|_| "fixture event read failed")?;
+    if u64::try_from(body.len()).map_err(|_| "fixture event length")? > EVENT_BYTES {
+        return Err("fixture event exceeds limit");
+    }
+    let event = serde_json::from_slice(&body).map_err(|_| "fixture event is not JSON")?;
+    Ok((id, arn, event))
+}
+fn forged(agent: &Agent, root: &str, event: &Value, previous: Option<&str>) -> Result<Vec<u16>> {
+    let foreign = event
+        .get("foreignRequestId")
+        .and_then(Value::as_str)
+        .unwrap_or("11111111-1111-4111-8111-111111111111");
+    request_id(foreign)?;
+    let mut statuses = Vec::new();
+    for id in [Some(foreign), Some("malformed"), previous]
+        .into_iter()
+        .flatten()
+    {
+        let status = post(
+            agent,
+            root,
+            &format!("invocation/{id}/response"),
+            r#"{"forged":true}"#,
+        )?;
+        if status != 400 {
+            return Err("fixture foreign/stale completion was not rejected");
+        }
+        statuses.push(status);
+    }
+    Ok(statuses)
+}
+fn hold(stage: &str, id: Option<&str>) -> Result<()> {
+    let agent = http_agent(Duration::from_secs(240));
+    let name = variable("AWS_LAMBDA_FUNCTION_NAME")?;
+    let release = barrier(
+        &agent,
+        "hold",
+        &json!({"stage":stage,"functionName":name,"pid":process::id(),"requestId":id}),
+    )?;
+    if release.get("release") != Some(&Value::Bool(true)) {
+        return Err("fixture hold was not released");
+    }
+    Ok(())
+}
+fn initialize(agent: &Agent, root: &str) -> Result<()> {
+    let mode = match env::var("IMAGE_FIXTURE_INIT_MODE") {
+        Ok(mode) => mode,
+        Err(env::VarError::NotPresent) => return Ok(()),
+        Err(_) => return Err("invalid fixture init mode"),
+    };
+    match mode.as_str() {
+        "error" => {
+            if post(
+                agent,
+                root,
+                "init/error",
+                r#"{"errorType":"FixtureInitError","errorMessage":"fixture-init-payload-sentinel"}"#,
+            )? != 202
+            {
+                return Err("fixture initialization error was not accepted");
+            }
+            thread::sleep(Duration::from_secs(30));
+            Err("failed-init fixture was not retired")
+        }
+        "exit" => process::exit(42),
+        "stall" => {
+            thread::sleep(Duration::from_secs(30));
+            Err("stalled-init fixture was not retired")
+        }
+        "hold" => hold("initializing", None),
+        "flood" => timing::prepare(agent),
+        _ => Err("unsupported fixture init mode"),
+    }
+}
+fn exhaust_cgroup_memory() -> Result<()> {
+    let mut memory = Vec::new();
+    memory
+        .try_reserve_exact(256 * 1024 * 1024)
+        .map_err(|_| "fixture virtual allocation failed")?;
+    let block = [0x5a_u8; 8 * 1024];
+    for _ in 0..32768 {
+        memory.extend_from_slice(&block);
+        black_box(memory.as_slice());
+    }
+    Err("fixture unexpectedly survived its cgroup memory limit")
+}
+fn execute(agent: &Agent, root: &str, image: &str, arguments: &[String]) -> Result<()> {
+    let mut counter = 0_u32;
+    let mut previous = None::<String>;
+    loop {
+        let (id, arn, event) = next(agent, root)?;
+        let handler_started = Instant::now();
+        counter = counter
+            .checked_add(1)
+            .filter(|value| *value <= 10_000)
+            .ok_or("fixture invocation limit")?;
+        let value = event.get("value").and_then(Value::as_i64).unwrap_or(0);
+        let computed = value.checked_add(7).ok_or("fixture arithmetic overflow")?;
+        let delay = event
+            .get("delayMillis")
+            .and_then(Value::as_u64)
+            .unwrap_or(0);
+        if delay > 15_000 {
+            return Err("fixture delay exceeds limit");
+        }
+        let mode = event
+            .get("mode")
+            .and_then(Value::as_str)
+            .unwrap_or("compute");
+        let statuses = match mode {
+            "compute" | "error" | "timed" => Vec::new(),
+            "timed-log-flood" => {
+                timing::flood(agent, &id)?;
+                Vec::new()
+            }
+            "hold" => {
+                hold("busy", Some(&id))?;
+                Vec::new()
+            }
+            "hold-exit" => {
+                hold("busy", Some(&id))?;
+                process::exit(42)
+            }
+            "framing" => framing::check(root, &id)?,
+            "counted" => {
+                let ticket = event
+                    .get("ticket")
+                    .and_then(Value::as_u64)
+                    .filter(|ticket| *ticket < 30)
+                    .ok_or("invalid fixture completion ticket")?;
+                let name = variable("AWS_LAMBDA_FUNCTION_NAME")?;
+                let accepted = barrier(
+                    agent,
+                    "completed",
+                    &json!({"ticket":ticket,"functionName":name,
+                    "requestId":id,"computed":computed,"counter":counter}),
+                )?;
+                if accepted.get("recorded") != Some(&Value::Bool(true)) {
+                    return Err("fixture computation was not recorded");
+                }
+                Vec::new()
+            }
+            "exit" => process::exit(42),
+            "oom" => {
+                exhaust_cgroup_memory()?;
+                return Err("OOM fixture was not killed");
+            }
+            "forge" => forged(agent, root, &event, previous.as_deref())?,
+            "barrier-forge" => {
+                let lane = variable("IMAGE_FIXTURE_LANE")?;
+                let peer = barrier(agent, "consume", &json!({"lane":lane,"requestId":id}))?;
+                let statuses = forged(agent, root, &peer, previous.as_deref())?;
+                let release = barrier(
+                    agent,
+                    "checked",
+                    &json!({"lane":lane,"requestId":id,"statuses":statuses}),
+                )?;
+                if release.get("release") != Some(&Value::Bool(true)) {
+                    return Err("fixture barrier did not release");
+                }
+                statuses
+            }
+            _ => return Err("unsupported fixture mode"),
+        };
+        thread::sleep(Duration::from_millis(delay));
+        let handler_nanos = u64::try_from(handler_started.elapsed().as_nanos())
+            .map_err(|_| "fixture handler duration overflow")?;
+        let (suffix, output) = if mode == "error" {
+            (
+                "error",
+                json!({"errorType":"ImageFixtureError","errorMessage":"deliberate image failure"}),
+            )
+        } else {
+            let cwd = env::current_dir().map_err(|_| "fixture cwd unavailable")?;
+            (
+                "response",
+                json!({"computed":computed,"counter":counter,"imageRevision":image,
+                "requestId":id,"invokedArn":arn,"arguments":arguments,"cwd":cwd,
+                "forgedStatuses":statuses,"shellSideEffect":Path::new("/tmp/rustack-shell-side-effect").exists()}),
+            )
+        };
+        let output = encode_response(output, mode, handler_nanos)?;
+        if post(agent, root, &format!("invocation/{id}/{suffix}"), &output)? != 202 {
+            return Err("fixture valid completion was not accepted");
+        }
+        previous = Some(id);
+    }
+}
+fn encode_response(mut output: Value, mode: &str, handler_nanos: u64) -> Result<String> {
+    if matches!(mode, "timed" | "timed-log-flood") {
+        output
+            .as_object_mut()
+            .ok_or("fixture response shape")?
+            .insert("handlerNanos".to_owned(), json!(handler_nanos));
+    }
+    serde_json::to_string(&output).map_err(|_| "fixture response encoding")
+}
+fn http_agent(timeout: Duration) -> Agent {
+    AgentBuilder::new()
+        .try_proxy_from_env(false)
+        .timeout(timeout)
+        .build()
+}
+fn main() -> Result<()> {
+    let address: SocketAddr = variable("AWS_LAMBDA_RUNTIME_API")?
+        .parse()
+        .map_err(|_| "invalid fixture runtime endpoint")?;
+    if !address.ip().is_loopback() || address.port() == 0 {
+        return Err("fixture endpoint is not loopback");
+    }
+    let image = variable("IMAGE_FIXTURE_REVISION")?;
+    let arguments: Vec<_> = env::args().take(17).collect();
+    if arguments.len() > 16 || arguments.iter().any(|arg| arg.len() > 4096) {
+        return Err("fixture argv exceeds limit");
+    }
+    let agent = http_agent(Duration::from_secs(120));
+    let root = format!("http://{address}/2018-06-01/runtime");
+    initialize(&agent, &root)?;
+    execute(&agent, &root, &image, &arguments)
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/image_framing.rs b/tests/lambda-fixtures/echo-bootstrap/src/image_framing.rs
new file mode 100644
index 00000000..d9ec3a8d
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/image_framing.rs
@@ -0,0 +1,265 @@
+//! Independent, bounded raw Runtime HTTP profile probes from a consumed RIC.
+
+use std::{
+    io::{Read, Write},
+    net::{SocketAddr, TcpStream},
+    time::{Duration, Instant},
+};
+
+use crate::{Result, request_id};
+
+const EXCHANGE: Duration = Duration::from_secs(5);
+const SENTINEL: &str = "runtime-boundary-secret";
+
+fn remaining(deadline: Instant) -> Result<Duration> {
+    deadline
+        .checked_duration_since(Instant::now())
+        .filter(|value| !value.is_zero())
+        .ok_or("fixture Runtime HTTP deadline")
+}
+
+fn status(raw: &[u8]) -> Result<u16> {
+    if raw.len() > 2048 || !raw.windows(4).any(|part| part == b"\r\n\r\n") {
+        return Err("fixture Runtime HTTP response cap or truncation");
+    }
+    if raw
+        .windows(SENTINEL.len())
+        .any(|part| part == SENTINEL.as_bytes())
+    {
+        return Err("fixture Runtime HTTP diagnostic leaked peer bytes");
+    }
+    let first = raw
+        .split(|byte| *byte == b'\n')
+        .next()
+        .ok_or("missing HTTP status")?;
+    let text = std::str::from_utf8(first).map_err(|_| "invalid HTTP status encoding")?;
+    let mut fields = text.split_ascii_whitespace();
+    if fields.next() != Some("HTTP/1.1") {
+        return Err("invalid HTTP status protocol");
+    }
+    let number = fields.next().ok_or("missing HTTP status code")?;
+    if number.len() != 3 || !number.bytes().all(|byte| byte.is_ascii_digit()) {
+        return Err("invalid HTTP status code");
+    }
+    number.parse().map_err(|_| "invalid HTTP status code")
+}
+
+fn exchange(address: SocketAddr, request: &[u8]) -> Result<u16> {
+    let deadline = Instant::now() + EXCHANGE;
+    if request.len() > 4096 || !address.ip().is_loopback() || address.port() == 0 {
+        return Err("invalid fixture Runtime HTTP request");
+    }
+    let mut stream = TcpStream::connect_timeout(&address, remaining(deadline)?)
+        .map_err(|_| "fixture Runtime HTTP connect failed")?;
+    stream
+        .set_write_timeout(Some(remaining(deadline)?))
+        .map_err(|_| "fixture Runtime HTTP write budget failed")?;
+    stream
+        .write_all(request)
+        .map_err(|_| "fixture Runtime HTTP request failed")?;
+    read_response(&mut stream, deadline)
+}
+
+fn read_response(stream: &mut TcpStream, deadline: Instant) -> Result<u16> {
+    let mut raw = Vec::new();
+    let mut block = [0; 256];
+    loop {
+        stream
+            .set_read_timeout(Some(remaining(deadline)?))
+            .map_err(|_| "fixture Runtime HTTP read budget failed")?;
+        let count = stream
+            .read(&mut block)
+            .map_err(|_| "fixture Runtime HTTP response failed")?;
+        remaining(deadline)?;
+        if count == 0 {
+            return status(&raw);
+        }
+        if raw.len().saturating_add(count) > 2048 {
+            return Err("fixture Runtime HTTP response exceeds limit");
+        }
+        raw.extend_from_slice(
+            block
+                .get(..count)
+                .ok_or("invalid fixture HTTP read count")?,
+        );
+    }
+}
+
+fn requests(id: &str) -> Result<Vec<(String, u16)>> {
+    request_id(id)?;
+    let completion = format!("/2018-06-01/runtime/invocation/{id}/response");
+    let next = "/2018-06-01/runtime/invocation/next";
+    let headers = "HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n";
+    let long = format!("{SENTINEL}{}", "x".repeat(257 - SENTINEL.len()));
+    Ok(vec![
+        (
+            format!("GET {completion} {headers}Content-Length: 0\r\n\r\n"),
+            405,
+        ),
+        (
+            format!("POST {completion} {headers}X-Boundary: {long}\r\nContent-Length: 0\r\n\r\n"),
+            431,
+        ),
+        (
+            format!("GET {next} {headers}Content-Length: 1\r\n\r\ns"),
+            413,
+        ),
+        (
+            format!("POST {completion} {headers}Content-Length: 6291457\r\n\r\n"),
+            413,
+        ),
+        (
+            format!(
+                "POST {completion} {headers}Transfer-Encoding: \
+                 chunked\r\n\r\n2\r\n{{}}\r\n0\r\nX-Boundary: {SENTINEL}\r\n\r\n"
+            ),
+            400,
+        ),
+    ])
+}
+
+/// Reject fixed out-of-profile requests without consuming the active attempt.
+///
+/// # Errors
+/// Rejects invalid fixture inputs, bounded IO failure or an unexpected status.
+pub(super) fn check(root: &str, id: &str) -> Result<Vec<u16>> {
+    let (authority, path) = root
+        .strip_prefix("http://")
+        .and_then(|root| root.split_once('/'))
+        .ok_or("invalid fixture Runtime HTTP root")?;
+    if path != "2018-06-01/runtime" {
+        return Err("invalid fixture Runtime HTTP root path");
+    }
+    let address: SocketAddr = authority
+        .parse()
+        .map_err(|_| "invalid fixture Runtime HTTP address")?;
+    requests(id)?
+        .into_iter()
+        .map(|(request, expected)| {
+            let actual = exchange(address, request.as_bytes())?;
+            if actual != expected {
+                return Err("fixture Runtime HTTP request was not rejected correctly");
+            }
+            Ok(actual)
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{io::ErrorKind, net::TcpListener, sync::mpsc, thread};
+
+    use super::*;
+
+    #[test]
+    fn test_should_reject_oversized_truncated_invalid_and_leaking_http_replies() {
+        for raw in [
+            b"HTTP/1.1 413 Empty\r\n".as_slice(),
+            b"HTTP/1.0 413 Empty\r\n\r\n",
+            b"HTTP/1.1 nope Empty\r\n\r\n",
+            b"HTTP/1.1 400 Empty\r\nX: runtime-boundary-secret\r\n\r\n",
+            &[b'x'; 2049],
+        ] {
+            assert!(status(raw).is_err());
+        }
+        assert_eq!(
+            status(b"HTTP/1.1 413 Empty\r\nContent-Length: 0\r\n\r\n"),
+            Ok(413)
+        );
+        assert!(remaining(Instant::now()).is_err());
+    }
+
+    #[test]
+    fn test_should_expire_a_live_peer_before_it_can_publish_a_late_response() {
+        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let address = listener.local_addr().unwrap();
+        let (entered, seen) = mpsc::channel();
+        let (release, released) = mpsc::channel();
+        let worker = thread::spawn(move || {
+            let deadline = Instant::now() + EXCHANGE;
+            let (mut stream, _) = loop {
+                match listener.accept() {
+                    Ok(pair) => break pair,
+                    Err(error) if error.kind() == ErrorKind::WouldBlock => {
+                        assert!(Instant::now() < deadline);
+                        thread::sleep(Duration::from_millis(1));
+                    }
+                    Err(error) => panic!("fixture accept failed: {error}"),
+                }
+            };
+            stream.set_read_timeout(Some(EXCHANGE)).unwrap();
+            stream.set_write_timeout(Some(EXCHANGE)).unwrap();
+            let mut request = [0; 1];
+            stream.read_exact(&mut request).unwrap();
+            entered.send(()).unwrap();
+            released.recv_timeout(EXCHANGE).unwrap();
+            let _ = stream.write_all(b"HTTP/1.1 400 Empty\r\nContent-Length: 0\r\n\r\n");
+        });
+        let mut observed = false;
+        let result = (|| {
+            let mut stream = TcpStream::connect_timeout(&address, EXCHANGE)
+                .map_err(|_| "fixture setup connection failed")?;
+            stream
+                .set_write_timeout(Some(EXCHANGE))
+                .map_err(|_| "fixture setup write budget")?;
+            stream
+                .write_all(b"x")
+                .map_err(|_| "fixture setup write failed")?;
+            seen.recv_timeout(EXCHANGE)
+                .map_err(|_| "fixture setup observation failed")?;
+            observed = true;
+            // Only the already observed response wait is deliberately short.
+            read_response(&mut stream, Instant::now() + Duration::from_millis(100))
+        })();
+        let signaled = release.send(());
+        let joined = worker.join();
+        assert!(observed && signaled.is_ok() && joined.is_ok() && result.is_err());
+    }
+
+    #[test]
+    fn test_should_send_independent_capped_requests_over_a_joined_loopback_socket() {
+        let requests = requests("11111111-1111-4111-8111-111111111111").unwrap();
+        assert_eq!(
+            requests
+                .iter()
+                .map(|(_, status)| *status)
+                .collect::<Vec<_>>(),
+            [405, 431, 413, 413, 400]
+        );
+        for (request, expected) in requests {
+            assert!(request.len() <= 4096);
+            let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+            listener.set_nonblocking(true).unwrap();
+            let address = listener.local_addr().unwrap();
+            let bytes = request.clone();
+            let worker = thread::spawn(move || {
+                let deadline = Instant::now() + EXCHANGE;
+                let (mut stream, _) = loop {
+                    match listener.accept() {
+                        Ok(pair) => break pair,
+                        Err(error) if error.kind() == ErrorKind::WouldBlock => {
+                            assert!(Instant::now() < deadline, "fixture accept deadline");
+                            thread::sleep(Duration::from_millis(1));
+                        }
+                        Err(error) => panic!("fixture accept failed: {error}"),
+                    }
+                };
+                stream.set_read_timeout(Some(EXCHANGE)).unwrap();
+                stream.set_write_timeout(Some(EXCHANGE)).unwrap();
+                let mut received = vec![0; bytes.len()];
+                stream.read_exact(&mut received).unwrap();
+                assert_eq!(received, bytes.as_bytes());
+                stream
+                    .write_all(
+                        format!("HTTP/1.1 {expected} Empty\r\nContent-Length: 0\r\n\r\n")
+                            .as_bytes(),
+                    )
+                    .unwrap();
+            });
+            let actual = exchange(address, request.as_bytes());
+            worker.join().unwrap();
+            assert_eq!(actual, Ok(expected));
+        }
+    }
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/image_timing.rs b/tests/lambda-fixtures/echo-bootstrap/src/image_timing.rs
new file mode 100644
index 00000000..1302c72f
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/image_timing.rs
@@ -0,0 +1,226 @@
+//! Bounded log writer whose active phase spans an authenticated health barrier.
+#![warn(
+    clippy::unwrap_used,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic
+)]
+
+use std::{
+    io::{self, Write},
+    sync::{
+        Arc,
+        atomic::{AtomicBool, AtomicU64, Ordering},
+        mpsc::{Receiver, RecvTimeoutError, SyncSender, TrySendError, sync_channel},
+    },
+    thread,
+    time::{Duration, Instant},
+};
+
+use serde_json::json;
+use ureq::Agent;
+
+use super::{
+    Result,
+    fixture_collector::{barrier, variable},
+};
+
+const PROGRESS_WINDOW: Duration = Duration::from_secs(1);
+
+pub(super) fn prepare(agent: &Agent) -> Result<()> {
+    let name = variable("AWS_LAMBDA_FUNCTION_NAME")?;
+    let response = barrier(agent, "flood-ready", &json!({"functionName": name}))?;
+    if response.get("ready") != Some(&json!(true)) {
+        return Err("fixture flood channel was not prepared");
+    }
+    Ok(())
+}
+
+pub(super) fn flood(agent: &Agent, request: &str) -> Result<()> {
+    let cutoff = Instant::now() + PROGRESS_WINDOW;
+    let stop = Arc::new(AtomicBool::new(false));
+    let bytes = Arc::new(AtomicU64::new(0));
+    let (sender, receiver) = sync_channel(1);
+    let stopped = stop.clone();
+    let written = bytes.clone();
+    let writer = thread::Builder::new()
+        .name("fixture-log-writer".to_owned())
+        .spawn(move || {
+            let mut output = io::stderr().lock();
+            let chunk = [b'x'; 1024];
+            for _ in 0..1024 {
+                if stopped.load(Ordering::Acquire) {
+                    break;
+                }
+                output
+                    .write_all(&chunk)
+                    .map_err(|_| "fixture log output failed")?;
+                output.flush().map_err(|_| "fixture log flush failed")?;
+                written.fetch_add(1024, Ordering::Release);
+                notify_progress(&sender)?;
+                thread::sleep(Duration::from_millis(1));
+            }
+            Ok::<(), &'static str>(())
+        })
+        .map_err(|_| "fixture log writer could not start")?;
+    let observed = (|| {
+        let before = progress(&receiver, &bytes, 0, cutoff, Instant::now)?;
+        if before >= 1024 * 1024 {
+            return Err("fixture flood did not enter");
+        }
+        let name = variable("AWS_LAMBDA_FUNCTION_NAME")?;
+        let release = barrier(
+            agent,
+            "flood-begin",
+            &json!({
+                "functionName":name,"requestId":request,"beforeBytes":before
+            }),
+        )?;
+        if release.get("release") != Some(&json!(true)) {
+            return Err("fixture flood was not released");
+        }
+        progress(&receiver, &bytes, before, cutoff, Instant::now)?;
+        Ok((name, before))
+    })();
+    stop.store(true, Ordering::Release);
+    let joined = writer.join().map_err(|_| "fixture log writer panicked")?;
+    joined?;
+    let (name, before) = observed?;
+    let after = bytes.load(Ordering::Acquire);
+    if after <= before || after >= 1024 * 1024 {
+        return Err("fixture flood phase was exhausted or inactive");
+    }
+    let accepted = barrier(
+        agent,
+        "flood-end",
+        &json!({
+            "functionName":name,"requestId":request,"beforeBytes":before,"afterBytes":after
+        }),
+    )?;
+    if accepted.get("recorded") != Some(&json!(true)) {
+        return Err("fixture flood end was not recorded");
+    }
+    Ok(())
+}
+
+fn notify_progress(sender: &SyncSender<()>) -> Result<()> {
+    match sender.try_send(()) {
+        Ok(()) | Err(TrySendError::Full(())) => Ok(()),
+        Err(TrySendError::Disconnected(())) => Err("fixture log observer disconnected"),
+    }
+}
+
+fn progress(
+    receiver: &Receiver<()>,
+    bytes: &AtomicU64,
+    previous: u64,
+    cutoff: Instant,
+    mut now: impl FnMut() -> Instant,
+) -> Result<u64> {
+    loop {
+        let remaining = cutoff
+            .checked_duration_since(now())
+            .filter(|remaining| !remaining.is_zero())
+            .ok_or("fixture log progress expired")?;
+        let current = bytes.load(Ordering::Acquire);
+        if current > previous {
+            return if now() < cutoff {
+                Ok(current)
+            } else {
+                Err("fixture log progress expired")
+            };
+        }
+        match receiver.recv_timeout(remaining) {
+            Ok(()) => {}
+            Err(RecvTimeoutError::Timeout) => return Err("fixture log progress expired"),
+            Err(RecvTimeoutError::Disconnected) => {
+                return Err("fixture log writer disconnected");
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        sync::{
+            atomic::{AtomicU64, Ordering},
+            mpsc::sync_channel,
+        },
+        time::{Duration, Instant},
+    };
+
+    use super::{PROGRESS_WINDOW, notify_progress, progress};
+
+    #[test]
+    fn test_should_coalesce_notifications_without_blocking_the_writer() {
+        let (sender, receiver) = sync_channel(1);
+        assert!(notify_progress(&sender).is_ok());
+        assert!(notify_progress(&sender).is_ok());
+        assert!(receiver.try_recv().is_ok());
+        assert!(receiver.try_recv().is_err());
+        drop(receiver);
+        assert_eq!(
+            notify_progress(&sender),
+            Err("fixture log observer disconnected")
+        );
+    }
+
+    #[test]
+    fn test_should_fail_disconnected_progress_without_waiting() {
+        let (sender, receiver) = sync_channel(1);
+        drop(sender);
+        assert_eq!(
+            progress(
+                &receiver,
+                &AtomicU64::new(0),
+                0,
+                Instant::now() + PROGRESS_WINDOW,
+                Instant::now
+            ),
+            Err("fixture log writer disconnected")
+        );
+    }
+
+    #[test]
+    fn test_should_reject_stale_notifications_at_the_original_cutoff() {
+        let (sender, receiver) = sync_channel(1);
+        assert!(notify_progress(&sender).is_ok());
+        let began = Instant::now();
+        let cutoff = began + PROGRESS_WINDOW;
+        let mut times = [began, cutoff].into_iter();
+        assert_eq!(
+            progress(&receiver, &AtomicU64::new(1024), 1024, cutoff, || times
+                .next()
+                .unwrap_or(cutoff)),
+            Err("fixture log progress expired")
+        );
+    }
+
+    #[test]
+    fn test_should_accept_delayed_first_progress_inside_the_invocation_window() {
+        let (sender, receiver) = sync_channel(1);
+        assert!(notify_progress(&sender).is_ok());
+        let began = Instant::now();
+        let delayed = began + Duration::from_millis(150);
+        let bytes = AtomicU64::new(0);
+        let mut first = true;
+        assert_eq!(
+            progress(&receiver, &bytes, 0, began + PROGRESS_WINDOW, || {
+                if first {
+                    first = false;
+                    began
+                } else {
+                    bytes.store(1024, Ordering::Release);
+                    delayed
+                }
+            }),
+            Ok(1024)
+        );
+        assert_eq!(
+            progress(&receiver, &bytes, 0, began + PROGRESS_WINDOW, || began
+                + PROGRESS_WINDOW),
+            Err("fixture log progress expired")
+        );
+    }
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/main.rs b/tests/lambda-fixtures/echo-bootstrap/src/main.rs
index 3ea78713..7dc2ede9 100644
--- a/tests/lambda-fixtures/echo-bootstrap/src/main.rs
+++ b/tests/lambda-fixtures/echo-bootstrap/src/main.rs
@@ -4,6 +4,12 @@
 //!
 //! - default → echo `{"echo": <body>, "request_id": <id>}`
 //! - `FAIL_MODE=panic` → POST `/error` with a known JSON shape
+//! - `WORKFLOW_MODE=1` → checked computation; optional `WORKFLOW_FAIL_ONCE=1`
+//! - `PROCESS_MARKER_DIR=path` → per-PID process ownership evidence
+//! - `WORKFLOW_GATE_FILE=path` → bounded consumed-event gate for SDK revision tests
+//! - `WORKFLOW_TOKEN_PORT=port` → local in-memory test collector; no token files/logs
+//! - `WORKFLOW_INVOCATION_DIR=path` → atomic per-request consumed-event markers
+//! - `INVOCATION_FILE=path` → per-event PID/request-ID marker after body receipt
 //! - `SLEEP_SECS=N` → sleep N seconds before responding (for timeout tests)
 //!
 //! Uses synchronous `ureq` to keep the binary tiny and free of an async
@@ -11,20 +17,32 @@
 
 #![allow(missing_docs)]
 
-use std::{io::Read as _, time::Duration};
+#[cfg(all(unix, feature = "provided-qualification"))]
+mod provided_qualification;
+
+use std::{
+    io::{Error as IoError, Read as _},
+    num::NonZeroU16,
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use ureq::{Agent, AgentBuilder};
 
 #[allow(clippy::disallowed_methods)] // This standalone bootstrap deliberately uses synchronous IO, not an async runtime.
 fn main() {
-    let api = std::env::var("AWS_LAMBDA_RUNTIME_API")
-        .expect("AWS_LAMBDA_RUNTIME_API must be set by the runtime");
-    let agent = ureq::AgentBuilder::new()
-        .timeout(Duration::from_mins(2))
-        .build();
+    let api = runtime_api();
+    let agent = AgentBuilder::new().timeout(Duration::from_mins(2)).build();
+    #[cfg(all(unix, feature = "provided-qualification"))]
+    let mut provided = match provided_qualification::Probe::selected() {
+        Ok(provided) => provided,
+        Err(error) => {
+            eprintln!("Provided fixture setup: {error}");
+            return;
+        }
+    };
     let fail_mode = std::env::var("FAIL_MODE").ok();
-    let sleep_secs: u64 = std::env::var("SLEEP_SECS")
-        .ok()
-        .and_then(|v| v.parse().ok())
-        .unwrap_or(0);
+    let sleep_secs = sleep_seconds();
 
     let code_marker = match std::fs::read_to_string("revision.txt") {
         Ok(marker) => Some(marker),
@@ -35,60 +53,325 @@ fn main() {
         }
     };
     let config_marker = std::env::var("CONFIG_MARKER").ok();
+    let workflow_mode = std::env::var("WORKFLOW_MODE").is_ok_and(|value| value == "1");
+    let workflow_fail_once = std::env::var("WORKFLOW_FAIL_ONCE").is_ok_and(|value| value == "1");
+    if let Ok(directory) = std::env::var("PROCESS_MARKER_DIR") {
+        let pid = std::process::id().to_string();
+        let path = Path::new(&directory).join(format!("pid-{pid}"));
+        if let Err(error) = std::fs::write(path, &pid) {
+            eprintln!("Write process ownership marker: {error}");
+            return;
+        }
+    }
     if let Ok(path) = std::env::var("STARTED_FILE") {
         if let Err(error) = std::fs::write(path, std::process::id().to_string()) {
             eprintln!("Write start marker: {error}");
             return;
         }
     }
+    if !initialize(&agent, &api) {
+        return;
+    }
+    let behavior = Behavior {
+        workflow: workflow_mode,
+        fail_once: workflow_fail_once,
+        code_marker: code_marker.as_deref(),
+        config_marker: config_marker.as_deref(),
+    };
     loop {
-        let next = agent
-            .get(&format!("http://{api}/2018-06-01/runtime/invocation/next"))
-            .call();
-        let resp = match next {
-            Ok(r) => r,
-            Err(e) => {
-                eprintln!("bootstrap: /next failed: {e}; exiting");
+        let (request_id, body) = match next_invocation(&agent, &api) {
+            Ok(invocation) => invocation,
+            Err(error) => {
+                eprintln!("bootstrap: invocation receive failed: {error}");
                 return;
             }
         };
-        let request_id = resp
-            .header("Lambda-Runtime-Aws-Request-Id")
-            .unwrap_or("")
-            .to_owned();
-
-        let mut body = String::new();
-        if let Err(e) = resp.into_reader().read_to_string(&mut body) {
-            eprintln!("bootstrap: read invocation body failed: {e}");
-            return;
-        }
 
+        if let Ok(path) = std::env::var("INVOCATION_FILE") {
+            let marker = serde_json::json!({"pid":std::process::id(),"request_id":request_id});
+            if let Err(error) = std::fs::write(path, marker.to_string()) {
+                eprintln!("Write invocation marker: {error}");
+                return;
+            }
+        }
+        if let Ok(directory) = std::env::var("WORKFLOW_INVOCATION_DIR") {
+            let marker = consumed_marker(Path::new(&directory), &request_id).and_then(
+                |(pending, complete, body)| {
+                    std::fs::write(&pending, body)?;
+                    std::fs::rename(pending, complete)
+                },
+            );
+            if let Err(error) = marker {
+                eprintln!("Write consumed invocation marker: {error}");
+                return;
+            }
+        }
+        if let Ok(path) = std::env::var("WORKFLOW_GATE_FILE") {
+            if let Err(error) = wait_workflow_gate(Path::new(&path)) {
+                eprintln!("Workflow fixture gate failed: {error}");
+                return;
+            }
+        }
         if sleep_secs > 0 {
             std::thread::sleep(Duration::from_secs(sleep_secs));
         }
 
         if matches!(fail_mode.as_deref(), Some("panic")) {
-            let _ = agent
-                .post(&format!(
-                    "http://{api}/2018-06-01/runtime/invocation/{request_id}/error"
-                ))
-                .send_string(r#"{"errorMessage":"boom","errorType":"TestError"}"#);
+            known_error(&agent, &api, &request_id);
             continue;
         }
 
-        let parsed: serde_json::Value =
-            serde_json::from_str(&body).unwrap_or(serde_json::Value::Null);
-        let echo = serde_json::json!({
-            "echo": parsed,
-            "request_id": request_id,
-            "codeMarker": code_marker,
-            "configMarker": config_marker,
-            "pid": std::process::id(),
+        if !complete_invocation(
+            &agent,
+            &api,
+            &request_id,
+            &body,
+            &behavior,
+            #[cfg(all(unix, feature = "provided-qualification"))]
+            provided.as_mut(),
+        ) {
+            return;
+        }
+    }
+}
+
+fn runtime_api() -> String {
+    let Ok(api) = std::env::var("AWS_LAMBDA_RUNTIME_API") else {
+        eprintln!("bootstrap: Runtime API endpoint missing");
+        std::process::exit(78);
+    };
+    api
+}
+
+fn known_error(agent: &Agent, api: &str, request_id: &str) {
+    let _ = post_runtime(
+        agent,
+        api,
+        &format!("invocation/{request_id}/error"),
+        r#"{"errorMessage":"boom","errorType":"TestError"}"#,
+    );
+}
+
+#[derive(Debug)]
+struct Behavior<'a> {
+    workflow: bool,
+    fail_once: bool,
+    code_marker: Option<&'a str>,
+    config_marker: Option<&'a str>,
+}
+fn complete_invocation(
+    agent: &Agent,
+    api: &str,
+    request_id: &str,
+    body: &str,
+    behavior: &Behavior<'_>,
+    #[cfg(all(unix, feature = "provided-qualification"))] provided: Option<
+        &mut provided_qualification::Probe,
+    >,
+) -> bool {
+    let parsed = serde_json::from_str(body).unwrap_or(serde_json::Value::Null);
+    if !collect_callback_token(agent, api, request_id, &parsed) {
+        return true;
+    }
+    let (kind, response) = invocation_response(
+        &parsed,
+        behavior.workflow,
+        behavior.fail_once,
+        request_id,
+        behavior.code_marker,
+        behavior.config_marker,
+        api,
+    );
+    #[cfg(all(unix, feature = "provided-qualification"))]
+    let mut response = response;
+    #[cfg(all(unix, feature = "provided-qualification"))]
+    if let Some(provided) = provided {
+        if let Err(error) = provided.augment(&parsed, &mut response, request_id) {
+            eprintln!("Provided fixture observation: {error}");
+            let failure =
+                serde_json::json!({"errorType":"ProvidedQualificationError","errorMessage":error});
+            let _ = post_runtime(
+                agent,
+                api,
+                &format!("invocation/{request_id}/error"),
+                &failure.to_string(),
+            );
+            return false;
+        }
+    }
+    let _ = post_runtime(
+        agent,
+        api,
+        &format!("invocation/{request_id}/{kind}"),
+        &response.to_string(),
+    );
+    true
+}
+
+fn collect_callback_token(
+    agent: &Agent,
+    api: &str,
+    request_id: &str,
+    event: &serde_json::Value,
+) -> bool {
+    if forward_callback_token(event).is_ok() {
+        return true;
+    }
+    let _ = post_runtime(
+        agent,
+        api,
+        &format!("invocation/{request_id}/error"),
+        r#"{"errorType":"FixtureTokenCollection","errorMessage":"local collector failed"}"#,
+    );
+    false
+}
+
+fn forward_callback_token(event: &serde_json::Value) -> Result<(), &'static str> {
+    let Ok(port) = std::env::var("WORKFLOW_TOKEN_PORT") else {
+        return Ok(());
+    };
+    let port: NonZeroU16 = port.parse().map_err(|_| "invalid collector port")?;
+    let token = event
+        .get("token")
+        .and_then(serde_json::Value::as_str)
+        .filter(|token| token.len() == 64)
+        .ok_or("missing token")?;
+    let collector = AgentBuilder::new().timeout(Duration::from_secs(2)).build();
+    collector
+        .post(&format!("http://127.0.0.1:{port}/token"))
+        .send_string(token)
+        .map_err(|_| "local token collector failed")?;
+    Ok(())
+}
+
+fn sleep_seconds() -> u64 {
+    std::env::var("SLEEP_SECS")
+        .ok()
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(0)
+}
+
+fn initialize(agent: &Agent, api: &str) -> bool {
+    if let Some(delay) = std::env::var("INIT_DELAY_MILLIS")
+        .ok()
+        .and_then(|value| value.parse::<u64>().ok())
+    {
+        std::thread::sleep(Duration::from_millis(delay));
+    }
+    if std::env::var("INIT_FAIL").is_ok_and(|value| value == "1") {
+        let _ = post_runtime(
+            agent,
+            api,
+            "init/error",
+            r#"{"errorMessage":"secret-initialization-value","errorType":"TestInitError"}"#,
+        );
+        return false;
+    }
+    true
+}
+
+fn consumed_marker(
+    directory: &Path,
+    request_id: &str,
+) -> Result<(PathBuf, PathBuf, String), IoError> {
+    let valid = request_id.len() == 36
+        && request_id.bytes().enumerate().all(|(index, byte)| {
+            if matches!(index, 8 | 13 | 18 | 23) {
+                byte == b'-'
+            } else {
+                byte.is_ascii_hexdigit()
+            }
         });
-        let _ = agent
-            .post(&format!(
-                "http://{api}/2018-06-01/runtime/invocation/{request_id}/response"
-            ))
-            .send_string(&echo.to_string());
+    if !valid {
+        return Err(IoError::other("Invalid invocation marker request ID"));
+    }
+    let marker = serde_json::json!({"pid":std::process::id(),"request_id":request_id});
+    Ok((
+        directory.join(format!("{request_id}.pending")),
+        directory.join(format!("{request_id}.json")),
+        marker.to_string(),
+    ))
+}
+
+fn wait_workflow_gate(path: &Path) -> Result<(), IoError> {
+    let deadline = std::time::Instant::now() + Duration::from_secs(180);
+    loop {
+        if path.try_exists()? {
+            return Ok(());
+        }
+        if std::time::Instant::now() >= deadline {
+            return Err(IoError::other("Workflow fixture gate expired"));
+        }
+        std::thread::sleep(Duration::from_millis(5));
+    }
+}
+
+fn post_runtime(agent: &Agent, api: &str, route: &str, payload: &str) -> Result<(), IoError> {
+    agent
+        .post(&format!("http://{api}/2018-06-01/runtime/{route}"))
+        .send_string(payload)
+        .map(|_| ())
+        .map_err(IoError::other)
+}
+
+fn next_invocation(agent: &Agent, api: &str) -> Result<(String, String), IoError> {
+    let response = agent
+        .get(&format!("http://{api}/2018-06-01/runtime/invocation/next"))
+        .call()
+        .map_err(IoError::other)?;
+    let request_id = response
+        .header("Lambda-Runtime-Aws-Request-Id")
+        .ok_or_else(|| IoError::other("Runtime API request ID missing"))?
+        .to_owned();
+    let mut body = String::new();
+    response.into_reader().read_to_string(&mut body)?;
+    Ok((request_id, body))
+}
+
+fn compute_workflow(
+    input: &serde_json::Value,
+    fail_once: bool,
+    code_marker: Option<&str>,
+    request_id: &str,
+) -> Result<serde_json::Value, serde_json::Value> {
+    let retry = input
+        .get("retryCount")
+        .and_then(serde_json::Value::as_u64)
+        .unwrap_or(0);
+    if fail_once && retry == 0 {
+        return Err(
+            serde_json::json!({"errorMessage":"retry requested","errorType":"WorkflowTransient"}),
+        );
+    }
+    let value = input
+        .get("n")
+        .and_then(serde_json::Value::as_i64)
+        .and_then(|n| n.checked_mul(2))
+        .ok_or_else(
+            || serde_json::json!({"errorMessage":"invalid input","errorType":"WorkflowInputError"}),
+        )?;
+    Ok(
+        serde_json::json!({"computed":value,"retryCount":retry,"request_id":request_id,"codeMarker":code_marker,"pid":std::process::id()}),
+    )
+}
+
+fn invocation_response(
+    input: &serde_json::Value,
+    workflow: bool,
+    fail_once: bool,
+    request_id: &str,
+    code_marker: Option<&str>,
+    config_marker: Option<&str>,
+    api: &str,
+) -> (&'static str, serde_json::Value) {
+    if workflow {
+        return match compute_workflow(input, fail_once, code_marker, request_id) {
+            Ok(body) => ("response", body),
+            Err(error) => ("error", error),
+        };
     }
+    (
+        "response",
+        serde_json::json!({"echo":input,"request_id":request_id,"codeMarker":code_marker,"configMarker":config_marker,"pid":std::process::id(),"runtimeApi":api}),
+    )
 }
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/no_runtime.rs b/tests/lambda-fixtures/echo-bootstrap/src/no_runtime.rs
new file mode 100644
index 00000000..237f61d4
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/no_runtime.rs
@@ -0,0 +1,12 @@
+//! A real Linux process that deliberately never speaks the Lambda Runtime API.
+//!
+//! The Docker negative fixture must reach the production initialization deadline
+//! while this process is alive. It has no runtime client or network operations.
+
+#![forbid(unsafe_code)]
+
+use std::{thread::sleep, time::Duration};
+
+fn main() {
+    sleep(Duration::from_secs(300));
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/provided_qualification.rs b/tests/lambda-fixtures/echo-bootstrap/src/provided_qualification.rs
new file mode 100644
index 00000000..5eeb455a
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/provided_qualification.rs
@@ -0,0 +1,117 @@
+//! Optional per-process observation for identical Docker/Native ZIP fixtures.
+
+#[path = "fixture_collector.rs"]
+mod collector;
+
+use std::{
+    env,
+    os::unix::fs::{MetadataExt, PermissionsExt},
+    time::Duration,
+};
+
+use serde_json::{Value, json};
+use tokio::{
+    fs,
+    io::AsyncWriteExt,
+    runtime::{Builder, Runtime},
+    time::timeout,
+};
+
+/// One selected fixture process and its bounded observation runtime.
+#[derive(Debug)]
+pub struct Probe {
+    runtime: Runtime,
+    calls: u64,
+}
+impl Probe {
+    /// Select observations only when explicitly enabled by the fixture.
+    pub fn selected() -> Result<Option<Self>, &'static str> {
+        if env::var("PROVIDED_QUALIFICATION").as_deref() != Ok("1") {
+            return Ok(None);
+        }
+        if env::var("PROVIDED_HOLD_STAGE").as_deref() == Ok("initializing") {
+            hold("initializing", None)?;
+        }
+        let runtime = Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .map_err(|_| "probe runtime")?;
+        Ok(Some(Self { runtime, calls: 0 }))
+    }
+    /// Add computed per-process/sandbox evidence without changing normal fixtures.
+    pub fn augment(
+        &mut self,
+        event: &Value,
+        response: &mut Value,
+        request_id: &str,
+    ) -> Result<(), &'static str> {
+        if event.get("providedAction").and_then(Value::as_str) == Some("exit") {
+            std::process::exit(23);
+        }
+        if env::var("PROVIDED_HOLD_STAGE").as_deref() == Ok("busy") {
+            hold("busy", Some(request_id))?;
+        }
+        self.calls = self.calls.checked_add(1).ok_or("probe counter limit")?;
+        let snapshot = self
+            .runtime
+            .block_on(async { timeout(Duration::from_secs(5), snapshot(self.calls)).await })
+            .map_err(|_| "probe observation expired")??;
+        let object = response.as_object_mut().ok_or("probe response shape")?;
+        object.insert("providedCounter".into(), json!(self.calls));
+        object.insert("providedSandbox".into(), snapshot);
+        Ok(())
+    }
+}
+async fn snapshot(calls: u64) -> Result<Value, &'static str> {
+    let metadata = fs::metadata("bootstrap")
+        .await
+        .map_err(|_| "probe bootstrap metadata")?;
+    let mode = metadata.mode() & 0o777;
+    let mut permissions = metadata.permissions();
+    permissions.set_mode(0o755);
+    let read_only = match fs::set_permissions("bootstrap", permissions).await {
+        Ok(()) => false,
+        Err(error) if error.raw_os_error() == Some(30) => true,
+        Err(_) => return Err("probe chmod failed without EROFS"),
+    };
+    let name = format!("/tmp/rustack-provided-{}-{calls}", std::process::id());
+    let mut file = fs::OpenOptions::new()
+        .create_new(true)
+        .write(true)
+        .mode(0o600)
+        .open(&name)
+        .await
+        .map_err(|_| "probe temporary create")?;
+    file.write_all(b"ok")
+        .await
+        .map_err(|_| "probe temporary write")?;
+    file.flush().await.map_err(|_| "probe temporary flush")?;
+    drop(file);
+    let data = fs::read(&name).await.map_err(|_| "probe temporary read")?;
+    fs::remove_file(&name)
+        .await
+        .map_err(|_| "probe temporary removal")?;
+    if data != b"ok" {
+        return Err("probe temporary contents");
+    }
+    Ok(
+        json!({"codeReadOnly":read_only,"codeUid":metadata.uid(),"codeGid":metadata.gid(),"codeMode":mode,"tmpWritable":true}),
+    )
+}
+
+fn hold(stage: &str, id: Option<&str>) -> Result<(), &'static str> {
+    let agent = ureq::AgentBuilder::new()
+        .try_proxy_from_env(false)
+        .timeout(Duration::from_secs(240))
+        .build();
+    let name = collector::variable("AWS_LAMBDA_FUNCTION_NAME")?;
+    let value = collector::barrier(
+        &agent,
+        "hold",
+        &json!({"stage":stage,"functionName":name,"pid":std::process::id(),"requestId":id}),
+    )?;
+    if value.get("release") != Some(&Value::Bool(true)) {
+        return Err("provided fixture hold not released");
+    }
+    Ok(())
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/src/zip_code.rs b/tests/lambda-fixtures/echo-bootstrap/src/zip_code.rs
new file mode 100644
index 00000000..3ce29899
--- /dev/null
+++ b/tests/lambda-fixtures/echo-bootstrap/src/zip_code.rs
@@ -0,0 +1,106 @@
+//! Standalone Linux code-volume probe; this is not a Lambda Runtime API client.
+
+#![forbid(unsafe_code)]
+
+use std::{
+    error::Error,
+    fs::Permissions,
+    io,
+    os::unix::fs::{MetadataExt, PermissionsExt},
+    process::ExitCode,
+    str::from_utf8,
+    time::Duration,
+};
+
+use serde_json::json;
+use tokio::{
+    fs::{self, File},
+    io::{AsyncReadExt, AsyncWriteExt, stderr, stdout},
+    time::timeout,
+};
+
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> ExitCode {
+    match timeout(Duration::from_secs(30), probe()).await {
+        Ok(Ok(())) => ExitCode::SUCCESS,
+        result => {
+            let message = match result {
+                Ok(Err(error)) => format!("code volume probe failed: {error}\n"),
+                _ => "code volume probe deadline exceeded\n".to_owned(),
+            };
+            let _ = timeout(
+                Duration::from_secs(1),
+                stderr().write_all(message.as_bytes()),
+            )
+            .await;
+            ExitCode::FAILURE
+        }
+    }
+}
+
+async fn probe() -> Result<(), Box<dyn Error>> {
+    let mut input = Vec::new();
+    File::open("/var/task/data/input")
+        .await?
+        .take(65)
+        .read_to_end(&mut input)
+        .await?;
+    if input.len() > 64 {
+        return Err(io::Error::from(io::ErrorKind::InvalidData).into());
+    }
+    let input = from_utf8(&input)?.trim().parse::<i64>()?;
+    let result = input
+        .checked_mul(2)
+        .ok_or_else(|| io::Error::from(io::ErrorKind::InvalidData))?;
+    let mut observations = Vec::new();
+    for (path, mode) in [
+        ("/var/task/bootstrap", 0o555),
+        ("/var/task/data", 0o555),
+        ("/var/task/data/input", 0o444),
+    ] {
+        let metadata = fs::metadata(path).await?;
+        if metadata.uid() != 0 || metadata.gid() != 0 || metadata.mode() & 0o7777 != mode {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "code metadata mismatch: uid={} gid={} mode={:o}",
+                    metadata.uid(),
+                    metadata.gid(),
+                    metadata.mode() & 0o7777
+                ),
+            )
+            .into());
+        }
+        observations.push(
+            json!({"uid":metadata.uid(), "gid":metadata.gid(), "mode":metadata.mode() & 0o7777}),
+        );
+    }
+    match fs::set_permissions("/var/task/data/input", Permissions::from_mode(0o600)).await {
+        // chmod reaches the mount write check independently of data-write DAC.
+        Err(error) if error.raw_os_error() == Some(30) => {}
+        Err(error) => {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("code mount permission mutation: {:?}", error.raw_os_error()),
+            )
+            .into());
+        }
+        Ok(()) => {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "code mount accepted metadata mutation",
+            )
+            .into());
+        }
+    }
+    fs::write("/tmp/rustack-code-probe", b"writable").await?;
+    if fs::read("/tmp/rustack-code-probe").await? != b"writable" {
+        return Err(io::Error::from(io::ErrorKind::InvalidData).into());
+    }
+    fs::remove_file("/tmp/rustack-code-probe").await?;
+    let output = serde_json::to_vec(
+        &json!({"computed":result, "readOnly":true, "tmpWritable":true, "metadata":observations}),
+    )?;
+    stdout().write_all(&output).await?;
+    Ok(())
+}
diff --git a/tests/lambda-fixtures/echo-bootstrap/tests/hardening.rs b/tests/lambda-fixtures/echo-bootstrap/tests/hardening.rs
index 58fa5fbc..011e88c6 100644
--- a/tests/lambda-fixtures/echo-bootstrap/tests/hardening.rs
+++ b/tests/lambda-fixtures/echo-bootstrap/tests/hardening.rs
@@ -8,6 +8,7 @@ use std::{
 use base64::{Engine, engine::general_purpose::STANDARD};
 use rustack_lambda_core::{
     config::LambdaConfig,
+    error::LambdaServiceError,
     executor::ExecutorBackend,
     provider::{InvokeKind, InvokeOutcome, RustackLambda},
     storage::FunctionStore,
@@ -75,6 +76,269 @@ async fn invoke(provider: &RustackLambda, version: Option<&str>) -> serde_json::
     serde_json::from_slice(&response.payload).unwrap()
 }
 
+#[tokio::test]
+async fn test_should_wait_for_first_poll_before_starting_the_native_handler_budget() {
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            init_timeout: Duration::from_secs(3),
+            ..Default::default()
+        },
+    );
+    let mut input = create("slow-init");
+    input.timeout = Some(1);
+    input.environment = Some(Environment {
+        variables: Some(HashMap::from([("INIT_DELAY_MILLIS".into(), "1200".into())])),
+    });
+    provider.create_function(input).await.unwrap();
+    let started = tokio::time::Instant::now();
+    assert_eq!(invoke(&provider, None).await["codeMarker"], "slow-init");
+    assert!(started.elapsed() >= Duration::from_millis(1200));
+    provider.shutdown().await;
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_join_stale_revision_api_connections_before_invoking_replacement_code() {
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            ..Default::default()
+        },
+    );
+    provider.create_function(create("old")).await.unwrap();
+    let old = invoke(&provider, None).await;
+    // Finish ZIP compression, extraction and publication before starting the
+    // held request's deadline. That work can take seconds on a busy CI runner.
+    provider
+        .update_function_code(
+            "revision-test",
+            UpdateFunctionCodeInput {
+                zip_file: Some(package("new")),
+                ..Default::default()
+            },
+        )
+        .await
+        .unwrap();
+    let address = old["runtimeApi"].as_str().unwrap();
+    let mut held = tokio::net::TcpStream::connect(address).await.unwrap();
+    held.write_all(b"POST /2018-06-01/runtime/init/error HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\nExpect: 100-continue\r\nContent-Length: 1\r\n\r\n").await.unwrap();
+    // The interim response proves the server is collecting the withheld body;
+    // a sleep after writing headers does not establish that ordering.
+    let mut acknowledgement = [0; 25];
+    tokio::time::timeout(
+        Duration::from_secs(2),
+        held.read_exact(&mut acknowledgement),
+    )
+    .await
+    .unwrap()
+    .unwrap();
+    assert_eq!(&acknowledgement, b"HTTP/1.1 100 Continue\r\n\r\n");
+    let replacement = invoke(&provider, None);
+    tokio::pin!(replacement);
+    assert!(
+        tokio::time::timeout(Duration::from_millis(100), replacement.as_mut())
+            .await
+            .is_err(),
+        "replacement must remain pending while the old API body is withheld"
+    );
+    // Release the body before the independent five-second drain deadline.
+    // A peer that withholds it through that deadline correctly fails shutdown.
+    held.write_all(b"0").await.unwrap();
+    let response = tokio::time::timeout(Duration::from_secs(10), replacement)
+        .await
+        .unwrap();
+    assert_eq!(response["codeMarker"], "new");
+    let mut reply = Vec::new();
+    tokio::time::timeout(Duration::from_secs(1), held.read_to_end(&mut reply))
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(reply.starts_with(b"HTTP/1.1 503"));
+    let status = tokio::process::Command::new("kill")
+        .arg("-0")
+        .arg(old["pid"].as_u64().unwrap().to_string())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .await
+        .unwrap();
+    assert!(!status.success());
+    provider.shutdown().await;
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_time_out_and_reap_a_bootstrap_that_never_polls_the_runtime_api() {
+    let root = tempfile::tempdir().unwrap();
+    let marker = root.path().join("started");
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path().join("code")),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            init_timeout: Duration::from_secs(2),
+            ..Default::default()
+        },
+    );
+    let mut input = create("never-ready");
+    input.timeout = Some(120);
+    input.environment = Some(Environment {
+        variables: Some(HashMap::from([
+            ("INIT_DELAY_MILLIS".into(), "60000".into()),
+            ("STARTED_FILE".into(), marker.to_string_lossy().into_owned()),
+        ])),
+    });
+    provider.create_function(input).await.unwrap();
+    let started = tokio::time::Instant::now();
+    let error = provider
+        .invoke("revision-test", None, b"{}", InvokeKind::RequestResponse)
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(error, LambdaServiceError::Internal { message } if message=="function timed out after 2s")
+    );
+    assert!(started.elapsed() < Duration::from_secs(4));
+    let pid = tokio::fs::read_to_string(marker).await.unwrap();
+    let status = tokio::process::Command::new("kill")
+        .arg("-0")
+        .arg(pid.trim())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .await
+        .unwrap();
+    assert!(
+        !status.success(),
+        "initialization timeout must join child cleanup"
+    );
+    provider.shutdown().await;
+}
+
+#[tokio::test]
+async fn test_should_report_native_initialization_error_without_echoing_its_payload() {
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            ..Default::default()
+        },
+    );
+    let mut input = create("init-error");
+    input.environment = Some(Environment {
+        variables: Some(HashMap::from([("INIT_FAIL".into(), "1".into())])),
+    });
+    provider.create_function(input).await.unwrap();
+    let error = provider
+        .invoke("revision-test", None, b"{}", InvokeKind::RequestResponse)
+        .await
+        .unwrap_err();
+    assert!(!format!("{error} {error:?}").contains("secret-initialization-value"));
+    provider.shutdown().await;
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_cancel_and_reap_a_bootstrap_while_waiting_for_first_poll() {
+    let root = tempfile::tempdir().unwrap();
+    let marker = root.path().join("started");
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path().join("code")),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            init_timeout: Duration::from_secs(30),
+            ..Default::default()
+        },
+    );
+    let mut input = create("cancel-init");
+    input.environment = Some(Environment {
+        variables: Some(HashMap::from([
+            ("INIT_DELAY_MILLIS".into(), "60000".into()),
+            ("STARTED_FILE".into(), marker.to_string_lossy().into_owned()),
+        ])),
+    });
+    provider.create_function(input).await.unwrap();
+    let handle = provider
+        .start_invocation("revision-test", None, b"{}", None)
+        .await
+        .unwrap();
+    let pid = tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            match tokio::fs::read_to_string(&marker).await {
+                Ok(pid) if !pid.is_empty() => break pid,
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                Ok(_) => {}
+                Err(error) => panic!("Read initialization marker: {error}"),
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .unwrap();
+    handle
+        .cancel_and_wait(tokio::time::Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+    let status = tokio::process::Command::new("kill")
+        .arg("-0")
+        .arg(pid.trim())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .await
+        .unwrap();
+    assert!(
+        !status.success(),
+        "cancelled startup must reap before settlement"
+    );
+    provider.shutdown().await;
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_join_shared_api_and_child_cleanup_after_cancelled_and_concurrent_native_shutdown_waiters()
+ {
+    use std::{
+        future::Future,
+        task::{Context, Waker},
+    };
+
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            ..Default::default()
+        },
+    );
+    provider.create_function(create("shutdown")).await.unwrap();
+    let response = invoke(&provider, None).await;
+    let executor = provider.executor().clone();
+    let mut waiting = Box::pin(executor.shutdown());
+    assert!(
+        waiting
+            .as_mut()
+            .poll(&mut Context::from_waker(Waker::noop()))
+            .is_pending()
+    );
+    drop(waiting);
+    let (first, second) = tokio::join!(executor.shutdown(), executor.shutdown());
+    first.unwrap();
+    second.unwrap();
+    let status = tokio::process::Command::new("kill")
+        .arg("-0")
+        .arg(response["pid"].as_u64().unwrap().to_string())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .await
+        .unwrap();
+    assert!(!status.success());
+    provider.shutdown().await;
+}
+
 #[tokio::test]
 async fn test_should_preserve_published_code_and_refresh_warm_revisions() {
     let root = tempfile::tempdir().unwrap();
@@ -213,3 +477,207 @@ async fn test_should_cancel_and_reap_native_event_on_quiesce_deadline() {
     );
     provider.shutdown().await;
 }
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_reap_cancelled_invocations_and_share_attempt_identity_with_runtime_api() {
+    let root = tempfile::tempdir().unwrap();
+    let started = root.path().join("started");
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path().join("code")),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            ..Default::default()
+        },
+    );
+    let mut input = create("cancellable");
+    input.timeout = Some(120);
+    input.environment = Some(Environment {
+        variables: Some(HashMap::from([
+            ("SLEEP_SECS".into(), "60".into()),
+            (
+                "STARTED_FILE".into(),
+                started.to_string_lossy().into_owned(),
+            ),
+        ])),
+    });
+    provider.create_function(input).await.unwrap();
+    let handle = provider
+        .start_invocation("revision-test", None, b"{}", None)
+        .await
+        .unwrap();
+    let pid = tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            match tokio::fs::read_to_string(&started).await {
+                Ok(pid) if !pid.is_empty() => break pid,
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                Ok(_) => {}
+                Err(error) => panic!("Read start marker: {error}"),
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .unwrap();
+    handle
+        .cancel_and_wait(tokio::time::Instant::now() + Duration::from_secs(5))
+        .await
+        .unwrap();
+    let status = tokio::process::Command::new("kill")
+        .arg("-0")
+        .arg(pid.trim())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .await
+        .unwrap();
+    assert!(
+        !status.success(),
+        "cancel acknowledgement must follow process reaping"
+    );
+
+    provider
+        .update_function_configuration(
+            "revision-test",
+            &UpdateFunctionConfigurationInput {
+                environment: Some(Environment {
+                    variables: Some(HashMap::new()),
+                }),
+                ..Default::default()
+            },
+        )
+        .unwrap();
+    let handle = provider
+        .start_invocation("revision-test", None, br#"{"value":42}"#, None)
+        .await
+        .unwrap();
+    let id = handle.id().to_string();
+    let result = handle.wait().await.unwrap();
+    let response: serde_json::Value = serde_json::from_slice(&result.payload).unwrap();
+    assert_eq!(response["request_id"], id);
+    assert_eq!(response["echo"]["value"], 42);
+    assert_ne!(response["pid"].as_u64().unwrap().to_string(), pid.trim());
+    provider.quiesce(Duration::from_secs(2)).await.unwrap();
+    provider.shutdown().await;
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_reap_successful_instances_before_returning_when_warm_retention_is_full() {
+    for max_warm_instances in [0, 1] {
+        let root = tempfile::tempdir().unwrap();
+        let provider = RustackLambda::with_store(
+            FunctionStore::new(root.path()),
+            LambdaConfig {
+                executor: ExecutorBackend::Native,
+                max_warm_instances,
+                ..Default::default()
+            },
+        );
+        let mut input = create("retirement");
+        input.environment = Some(Environment {
+            variables: Some(HashMap::from([("SLEEP_SECS".into(), "1".into())])),
+        });
+        provider.create_function(input).await.unwrap();
+        let first = provider
+            .start_invocation("revision-test", None, b"{}", None)
+            .await
+            .unwrap();
+        let second = provider
+            .start_invocation("revision-test", None, b"{}", None)
+            .await
+            .unwrap();
+        let (first, second) = tokio::join!(first.wait(), second.wait());
+        let mut alive = 0;
+        for result in [first.unwrap(), second.unwrap()] {
+            let response: serde_json::Value = serde_json::from_slice(&result.payload).unwrap();
+            let status = tokio::process::Command::new("kill")
+                .arg("-0")
+                .arg(response["pid"].as_u64().unwrap().to_string())
+                .stderr(std::process::Stdio::null())
+                .status()
+                .await
+                .unwrap();
+            alive += usize::from(status.success());
+        }
+        assert_eq!(
+            alive, max_warm_instances,
+            "nonretained instances must already be reaped"
+        );
+        provider.shutdown().await;
+    }
+}
+
+#[tokio::test]
+async fn test_should_reject_native_event_architecture_mismatch_before_acceptance() {
+    let root = tempfile::tempdir().unwrap();
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path()),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            ..Default::default()
+        },
+    );
+    let mut input = create("mismatched");
+    input.architectures = Some(vec![
+        if cfg!(target_arch = "aarch64") {
+            "x86_64"
+        } else {
+            "arm64"
+        }
+        .into(),
+    ]);
+    provider.create_function(input).await.unwrap();
+    assert!(
+        provider
+            .invoke("revision-test", None, b"{}", InvokeKind::Event)
+            .await
+            .is_err()
+    );
+    provider.quiesce(Duration::from_secs(1)).await.unwrap();
+    provider.shutdown().await;
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_should_preserve_delivered_native_handler_timeout_and_join_process_retirement() {
+    let root = tempfile::tempdir().unwrap();
+    let marker = root.path().join("started");
+    let provider = RustackLambda::with_store(
+        FunctionStore::new(root.path().join("code")),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            init_timeout: Duration::from_secs(5),
+            ..Default::default()
+        },
+    );
+    let mut input = create("handler-timeout");
+    input.timeout = Some(1);
+    input.environment = Some(Environment {
+        variables: Some(HashMap::from([
+            ("SLEEP_SECS".into(), "60".into()),
+            ("STARTED_FILE".into(), marker.to_string_lossy().into_owned()),
+        ])),
+    });
+    provider.create_function(input).await.unwrap();
+    let error = provider
+        .invoke("revision-test", None, b"{}", InvokeKind::RequestResponse)
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(error,LambdaServiceError::Internal{message} if message=="function timed out after 1s")
+    );
+    let pid = tokio::fs::read_to_string(marker).await.unwrap();
+    let status = tokio::process::Command::new("kill")
+        .arg("-0")
+        .arg(pid.trim())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .await
+        .unwrap();
+    assert!(
+        !status.success(),
+        "handler timeout returned before child reap"
+    );
+    provider.quiesce(Duration::from_secs(5)).await.unwrap();
+    provider.shutdown().await;
+}
diff --git a/tests/lambda-fixtures/handler-sdk.Dockerfile b/tests/lambda-fixtures/handler-sdk.Dockerfile
new file mode 100644
index 00000000..f84431d6
--- /dev/null
+++ b/tests/lambda-fixtures/handler-sdk.Dockerfile
@@ -0,0 +1,12 @@
+FROM public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79
+COPY handler-sdk.js ${LAMBDA_TASK_ROOT}/handler-sdk.js
+ENV AWS_ACCESS_KEY_ID=sdk-image-poison-key \
+    AWS_SECRET_ACCESS_KEY=sdk-image-poison-secret \
+    AWS_PROFILE=sdk-image-poison \
+    AWS_ENDPOINT_URL_S3=http://127.0.0.1:9 \
+    AWS_ENDPOINT_URL_DYNAMODB=http://127.0.0.1:9 \
+    AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true \
+    AWS_SESSION_TOKEN=sdk-image-poison \
+    AWS_CONTAINER_CREDENTIALS_FULL_URI=http://127.0.0.1:9
+USER 1000:1000
+CMD ["handler-sdk.handler"]
diff --git a/tests/lambda-fixtures/handler-sdk.js b/tests/lambda-fixtures/handler-sdk.js
new file mode 100644
index 00000000..3e062a94
--- /dev/null
+++ b/tests/lambda-fixtures/handler-sdk.js
@@ -0,0 +1,170 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const { performance } = require("node:perf_hooks");
+const { addAbortSignal } = require("node:stream");
+const http = require("node:http");
+const { once } = require("node:events");
+const { S3Client, PutObjectCommand, GetObjectCommand } = require("@aws-sdk/client-s3");
+const { DynamoDBClient, PutItemCommand, GetItemCommand } = require("@aws-sdk/client-dynamodb");
+const versions = {
+    s3: require("@aws-sdk/client-s3/package.json").version,
+    dynamodb: require("@aws-sdk/client-dynamodb/package.json").version,
+};
+let counter = 0;
+
+function remaining(deadline) {
+    const value = Math.ceil(deadline - performance.now());
+    assert(value > 0, "SDK fixture deadline expired");
+    return value;
+}
+function selectorsCleared() {
+    return ["AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_SESSION_TOKEN",
+        "AWS_CONTAINER_CREDENTIALS_FULL_URI", "AWS_ENDPOINT_URL_S3", "AWS_ENDPOINT_URL_DYNAMODB"]
+        .every(key => process.env[key] === undefined);
+}
+async function bodyBytes(body, signal, deadline) {
+    const chunks = [];
+    let total = 0;
+    try {
+        addAbortSignal(signal, body);
+        for await (const chunk of body) {
+            remaining(deadline);
+            signal.throwIfAborted();
+            total += chunk.length;
+            assert(total <= 4096, "SDK response body exceeds fixture cap");
+            chunks.push(chunk);
+        }
+        remaining(deadline);
+        return Buffer.concat(chunks, total);
+    } finally {
+        body.destroy();
+    }
+}
+class SdkS3AuthorizationError extends Error {
+    constructor() { super("actual SDK AccessDenied/403 " + versions.s3); this.name = "SdkS3AuthorizationError"; }
+}
+class SdkDynamoAuthorizationError extends Error {
+    constructor() { super("actual SDK AccessDeniedException/400 " + versions.dynamodb); this.name = "SdkDynamoAuthorizationError"; }
+}
+
+exports.handler = async event => {
+    assert(event && typeof event.bucket === "string" && /^[a-z0-9-]{3,63}$/.test(event.bucket));
+    assert(typeof event.table === "string" && /^[A-Za-z0-9_.-]{3,128}$/.test(event.table));
+    assert(typeof event.key === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(event.key));
+    assert(["roundtrip", "deny-s3", "deny-dynamodb"].includes(event.mode));
+    assert(Number.isSafeInteger(event.value) && Math.abs(event.value) <= 1000000);
+    counter += 1;
+    assert(selectorsCleared(), "image SDK selector survived authoritative unsets");
+    assert.equal(process.env.AWS_EC2_METADATA_DISABLED, "true");
+    assert.equal(process.env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS, "false");
+    assert.equal(process.env.AWS_CONFIG_FILE, "/dev/null");
+    assert.equal(process.env.AWS_SHARED_CREDENTIALS_FILE, "/dev/null");
+    const deadline = performance.now() + 10000;
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const s3 = new S3Client({ maxAttempts: 1, forcePathStyle: true });
+    let dynamodb;
+    let timer;
+    const send = async (client, command) => {
+        remaining(deadline);
+        const response = await client.send(command, { abortSignal: signal });
+        remaining(deadline);
+        return response;
+    };
+    try {
+        dynamodb = new DynamoDBClient({ maxAttempts: 1 });
+        timer = setTimeout(() => controller.abort(new Error("SDK fixture deadline expired")), remaining(deadline));
+        if (event.mode === "deny-s3") {
+            try {
+                const unexpected = await send(s3, new GetObjectCommand({ Bucket: event.bucket, Key: event.key }));
+                unexpected.Body?.destroy();
+            } catch (error) {
+                assert.equal(error.name, "AccessDenied");
+                assert.equal(error.$metadata.httpStatusCode, 403);
+                throw new SdkS3AuthorizationError();
+            }
+            throw new Error("wrong explicit SDK credentials unexpectedly authorized S3");
+        }
+        if (event.mode === "deny-dynamodb") {
+            try {
+                await send(dynamodb, new GetItemCommand({ TableName: event.table, Key: { id: { S: event.key } } }));
+            } catch (error) {
+                assert.equal(error.name, "AccessDeniedException");
+                assert.equal(error.$metadata.httpStatusCode, 400);
+                throw new SdkDynamoAuthorizationError();
+            }
+            throw new Error("wrong explicit SDK credentials unexpectedly authorized DynamoDB");
+        }
+        const computed = event.value * 2;
+        const expected = Buffer.from(`rustack-sdk:${event.value}:${computed}`);
+        await send(s3, new PutObjectCommand({ Bucket: event.bucket, Key: event.key, Body: expected }));
+        const object = await send(s3, new GetObjectCommand({ Bucket: event.bucket, Key: event.key }));
+        assert.deepEqual(await bodyBytes(object.Body, signal, deadline), expected);
+        await send(dynamodb, new PutItemCommand({ TableName: event.table,
+            Item: { id: { S: event.key }, result: { N: String(computed) } } }));
+        const item = await send(dynamodb, new GetItemCommand({ TableName: event.table,
+            Key: { id: { S: event.key } }, ConsistentRead: true }));
+        assert.equal(item.Item.result.N, String(computed));
+        return { computed, counter, versions, selectorsCleared: true,
+            nodeVersion: process.versions.node, architecture: process.arch };
+    } finally {
+        clearTimeout(timer);
+        controller.abort();
+        s3.destroy();
+        dynamodb?.destroy();
+    }
+};
+
+
+exports.bodyControl = async () => {
+    const deadline = performance.now() + 2000;
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const budgetTimer = setTimeout(() => controller.abort(), remaining(deadline));
+    let heldReply, request, response, abortTimer, headerAbort;
+    let headersObserved = false;
+    let rejected = false;
+    const server = http.createServer((_request, reply) => {
+        heldReply = reply;
+        reply.writeHead(200, { "Content-Length": "1" });
+        reply.flushHeaders();
+    });
+    try {
+        server.listen(0, "127.0.0.1");
+        await once(server, "listening", { signal });
+        remaining(deadline);
+        response = await new Promise((resolve, reject) => {
+            signal.throwIfAborted();
+            request = http.get({ host: "127.0.0.1", port: server.address().port, path: "/quiet", agent: false });
+            headerAbort = () => request.destroy(new Error("control header deadline"));
+            signal.addEventListener("abort", headerAbort, { once: true });
+            request.once("error", reject);
+            request.once("response", value => {
+                signal.removeEventListener("abort", headerAbort);
+                headersObserved = true;
+                resolve(value);
+            });
+        });
+        abortTimer = setTimeout(() => controller.abort(), 25);
+        try {
+            await bodyBytes(response, signal, deadline);
+        } catch (error) {
+            assert.equal(error.name, "AbortError");
+            rejected = true;
+        }
+        assert(rejected && response.destroyed && headersObserved, "quiet SDK body did not abort");
+    } finally {
+        clearTimeout(budgetTimer);
+        clearTimeout(abortTimer);
+        if (headerAbort) signal.removeEventListener("abort", headerAbort);
+        controller.abort();
+        response?.destroy();
+        request?.destroy();
+        heldReply?.destroy();
+        server.closeAllConnections();
+        if (server.listening) await new Promise(resolve => server.close(resolve));
+    }
+    remaining(deadline);
+    return { quietBodyRejected: rejected, headersObserved, destroyed: response.destroyed };
+};
diff --git a/tests/lambda-fixtures/iac.js b/tests/lambda-fixtures/iac.js
new file mode 100644
index 00000000..15f5b3e0
--- /dev/null
+++ b/tests/lambda-fixtures/iac.js
@@ -0,0 +1,45 @@
+"use strict";
+
+const { performance } = require("node:perf_hooks");
+const runtime = require("./pulumi/iac_runtime");
+const { input } = require("./pulumi/iac_input");
+let counter = 0;
+
+class IacFixtureFailure extends Error {
+    constructor(stage) { super("bounded managed IaC fixture failed at " + stage); this.name = "IacFixtureFailure"; }
+}
+
+exports.handler = async (event, context) => {
+    let session, stage = "validation";
+    try {
+        counter += 1;
+        runtime.check(counter <= 16 && typeof context.getRemainingTimeInMillis === "function");
+        const remaining = context.getRemainingTimeInMillis();
+        runtime.check(Number.isFinite(remaining) && remaining > 1000);
+        const deadline = performance.now() + Math.min(700000, remaining - 1000);
+        const probe = event && typeof event === "object" && !Array.isArray(event) && event.mode === "probe";
+        let data;
+        if (probe) {
+            runtime.check(Object.keys(event).length === 1 && typeof context.awsRequestId === "string" &&
+                /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(context.awsRequestId));
+        } else data = input(event, context.awsRequestId);
+        stage = "provenance";
+        const versions = await runtime.source(deadline);
+        stage = "versions";
+        runtime.check(versions.cli === "3.273.0" && versions.sdk === "3.273.0" && versions.aws === "7.52.1" &&
+            versions.provider === "7.52.1" && versions.dynamodb === "3.1105.0" && versions.node === "24.22.1");
+        if (probe) {
+            return { probe: true, requestId: context.awsRequestId, versions, counter, architecture: process.arch };
+        }
+        const { Session } = require("./pulumi/iac_session");
+        session = new Session(data, deadline, versions);
+        stage = "setup";
+        await session.setup();
+        stage = "lifecycle";
+        return await session.lifecycle();
+    } catch {
+        // Function errors are physically retired by InstanceExecutor before the
+        // observed invocation completes, including separately grouped plugins.
+        throw new IacFixtureFailure(stage);
+    } finally { session?.client.destroy(); }
+};
diff --git a/tests/lambda-fixtures/image.Dockerfile b/tests/lambda-fixtures/image.Dockerfile
new file mode 100644
index 00000000..2daf87ef
--- /dev/null
+++ b/tests/lambda-fixtures/image.Dockerfile
@@ -0,0 +1,9 @@
+FROM public.ecr.aws/lambda/provided:al2023@sha256:612c98f126c2a95e77a016d56fed50a83055e11d636132ee6ebdd461f01b9617
+ARG IMAGE_REVISION
+ENV IMAGE_FIXTURE_REVISION=${IMAGE_REVISION}
+COPY --chmod=0555 bootstrap /image-bootstrap
+COPY --chmod=0555 bootstrap /alternate-bootstrap
+WORKDIR /var/task
+USER 1000:1000
+ENTRYPOINT ["/image-bootstrap"]
+CMD ["inherited-command"]
diff --git a/tests/lambda-fixtures/negative_images.py b/tests/lambda-fixtures/negative_images.py
new file mode 100644
index 00000000..cdbb04b7
--- /dev/null
+++ b/tests/lambda-fixtures/negative_images.py
@@ -0,0 +1,57 @@
+"""Deterministic, non-executable Docker archives with genuine platform metadata.
+
+These explicit fixture caches test preparation validation, not container execution.
+No filesystem paths or archive member names come from image input.
+"""
+import argparse
+import hashlib
+import io
+import json
+from pathlib import Path
+import tarfile
+
+
+def encoded(value):
+    return json.dumps(value, sort_keys=True, separators=(",", ":")).encode("ascii")
+
+
+def archive(members):
+    output = io.BytesIO()
+    with tarfile.open(fileobj=output, mode="w", format=tarfile.USTAR_FORMAT) as target:
+        for name, value in members:
+            info = tarfile.TarInfo(name)
+            info.size, info.uid, info.gid, info.mode, info.mtime = len(value), 1000, 1000, 0o444, 0
+            target.addfile(info, io.BytesIO(value))
+    result = output.getvalue()
+    assert len(result) <= 65536
+    return result
+
+
+def image(selected, kind):
+    if selected not in ("arm64", "amd64") or kind not in ("os", "architecture"):
+        raise ValueError("unsupported fixed negative fixture")
+    system = "windows" if kind == "os" else "linux"
+    architecture = "amd64" if kind == "os" or selected == "arm64" else "arm64"
+    layer = archive([("fixture.txt", b"Rustack platform validation fixture\n")])
+    config = encoded({"architecture":architecture, "os":system,
+                      "config":{"User":"1000:1000", "Entrypoint":["/not-a-runtime"], "WorkingDir":"/"},
+                      "rootfs":{"type":"layers", "diff_ids":["sha256:" + hashlib.sha256(layer).hexdigest()]}})
+    identity = hashlib.sha256(config).hexdigest()
+    manifest = [{"Config":identity + ".json", "RepoTags":[f"rustack-invalid-{kind}:{selected}"],
+                 "Layers":["layer/layer.tar"]}]
+    return archive([(identity + ".json", config), ("layer/layer.tar", layer),
+                    ("manifest.json", encoded(manifest))])
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("architecture", choices=("arm64", "amd64"))
+    parser.add_argument("output", type=Path)
+    args = parser.parse_args()
+    args.output.mkdir(parents=True, exist_ok=True)
+    for kind in ("os", "architecture"):
+        (args.output / (kind + ".tar")).write_bytes(image(args.architecture, kind))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/lambda-fixtures/no-runtime.Dockerfile b/tests/lambda-fixtures/no-runtime.Dockerfile
new file mode 100644
index 00000000..861584e7
--- /dev/null
+++ b/tests/lambda-fixtures/no-runtime.Dockerfile
@@ -0,0 +1,6 @@
+FROM public.ecr.aws/lambda/provided:al2023@sha256:612c98f126c2a95e77a016d56fed50a83055e11d636132ee6ebdd461f01b9617
+COPY bootstrap /no-runtime
+WORKDIR /var/task
+USER 1000:1000
+ENTRYPOINT ["/no-runtime"]
+CMD []
diff --git a/tests/lambda-fixtures/node.Dockerfile b/tests/lambda-fixtures/node.Dockerfile
new file mode 100644
index 00000000..76d92597
--- /dev/null
+++ b/tests/lambda-fixtures/node.Dockerfile
@@ -0,0 +1,4 @@
+FROM public.ecr.aws/lambda/nodejs:24@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79
+COPY node.js /var/task/node.js
+USER 1000:1000
+CMD ["node.handler"]
diff --git a/tests/lambda-fixtures/node.js b/tests/lambda-fixtures/node.js
new file mode 100644
index 00000000..3365f9c5
--- /dev/null
+++ b/tests/lambda-fixtures/node.js
@@ -0,0 +1,69 @@
+"use strict";
+
+const fs = require("node:fs");
+const { randomUUID } = require("node:crypto");
+
+let counter = 0;
+
+class NodeFixtureError extends Error {
+    constructor() {
+        super("intentional Node fixture failure");
+        this.name = "NodeFixtureError";
+    }
+}
+
+function filesystem() {
+    const target = "/var/task/node-write-probe";
+    let rootReadOnly = false;
+    try {
+        const fd = fs.openSync(target, "wx", 0o600);
+        fs.closeSync(fd);
+        fs.unlinkSync(target);
+    } catch (error) {
+        if (error.code !== "EROFS") throw error;
+        rootReadOnly = true;
+    }
+    if (!rootReadOnly) throw new Error("Node fixture root is writable");
+    const temporary = "/tmp/node-" + randomUUID();
+    try {
+        fs.writeFileSync(temporary, "node-private-roundtrip", { mode: 0o600, flag: "wx" });
+        return {
+            rootReadOnly,
+            temporaryRoundtrip: fs.readFileSync(temporary, "utf8") === "node-private-roundtrip",
+            temporaryMode: fs.statSync(temporary).mode & 0o777,
+        };
+    } finally {
+        fs.unlinkSync(temporary);
+    }
+}
+
+async function compute(event, context, multiplier, handler) {
+    if (!event || !Number.isSafeInteger(event.value) || Math.abs(event.value) > 1000000) {
+        throw new Error("bounded integer fixture value required");
+    }
+    counter += 1;
+    if (event.fail) throw new NodeFixtureError();
+    if (event.logs) {
+        console.log("NODE_STDOUT_CAPTURE");
+        console.error("NODE_STDERR_CAPTURE");
+    }
+    return {
+        computed: event.value * multiplier,
+        counter,
+        runtime: "node24",
+        nodeVersion: process.versions.node,
+        architecture: process.arch,
+        uid: process.getuid(),
+        requestId: context.awsRequestId,
+        functionName: context.functionName,
+        functionVersion: context.functionVersion,
+        invokedArn: context.invokedFunctionArn,
+        memoryMb: context.memoryLimitInMB,
+        configuredValue: process.env.TEST_VALUE,
+        handler,
+        ...filesystem(),
+    };
+}
+
+exports.handler = async (event, context) => compute(event, context, 2, "handler");
+exports.alternate = async (event, context) => compute(event, context, 3, "alternate");
diff --git a/tests/lambda-fixtures/pulumi.Dockerfile b/tests/lambda-fixtures/pulumi.Dockerfile
new file mode 100644
index 00000000..b656d6bb
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi.Dockerfile
@@ -0,0 +1,11 @@
+FROM public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79
+COPY --from=pulumi-tools / /opt/pulumi/
+COPY pulumi/package.json pulumi/package-lock.json /var/task/pulumi/
+RUN cd /var/task/pulumi && npm ci --ignore-scripts --no-fund --no-audit --registry=https://registry.npmjs.org --userconfig=/tmp/npm-user --globalconfig=/tmp/npm-global --cache=/tmp/npm-cache && rm -rf /tmp/npm-cache
+COPY pulumi/*.js /var/task/pulumi/
+COPY iac.js /var/task/iac.js
+RUN node /var/task/pulumi/image_identity.js && node --test /var/task/pulumi/*-controls.js && /opt/pulumi/bin/pulumi version
+RUN set -eu; image_bytes="$(du -sbx /)"; image_bytes="${image_bytes%%[!0-9]*}"; test "$image_bytes" -le 4294967296; printf 'unpackedImageBytes=%s\n' "$image_bytes"
+ENV GOMAXPROCS=1 UV_THREADPOOL_SIZE=2
+USER 1000:1000
+CMD ["iac.handler"]
diff --git a/tests/lambda-fixtures/pulumi/.gitignore b/tests/lambda-fixtures/pulumi/.gitignore
new file mode 100644
index 00000000..c96f4b19
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+.rustack-pulumi-install.lock
diff --git a/tests/lambda-fixtures/pulumi/child-controls.js b/tests/lambda-fixtures/pulumi/child-controls.js
new file mode 100644
index 00000000..7d57ae9d
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/child-controls.js
@@ -0,0 +1,69 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const { performance } = require("node:perf_hooks");
+const fs = require("node:fs/promises");
+const path = require("node:path");
+const os = require("node:os");
+const { setTimeout: delay } = require("node:timers/promises");
+const { execute } = require("./child_owner");
+
+function options(extra = {}) { return { deadline: performance.now() + 3000, cwd: __dirname,
+    env: { PATH: process.env.PATH }, grace: 100, ...extra }; }
+function absent(pid) { assert.throws(() => process.kill(pid, 0), { code: "ESRCH" }); }
+
+test("test_should_join_real_child_exit_and_both_pipes", async () => {
+    let pid;
+    const result = await execute(process.execPath, ["-e", 'process.stdout.write("out");process.stderr.write("err");process.exitCode=7'],
+        options({ hold: async owner => { pid = owner.pid; } }));
+    assert.equal(result.code, 7);
+    assert.equal(result.stdout.toString(), "out");
+    assert.equal(result.stderr.toString(), "err");
+    absent(pid);
+});
+
+test("test_should_escalate_and_join_sigint_resistant_child_on_hold_failure", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "iac-child-"));
+    const marker = path.join(root, "ready");
+    let pid;
+    try {
+        await assert.rejects(execute(process.execPath, ["-e",
+            'process.on("SIGINT",()=>{});require("node:fs").writeFileSync(process.argv[1],"ready",{flag:"wx",mode:0o600});setInterval(()=>{},10)', marker],
+        options({ hold: async owner => {
+            pid = owner.pid;
+            while (owner.alive()) {
+                try { await fs.stat(marker); break; }
+                catch (error) { if (error.code !== "ENOENT") throw error; }
+                await delay(10);
+            }
+            assert.ok(owner.alive());
+            throw new Error("hold rejected");
+        } })), error => error.cause?.message === "hold rejected" && error.signal === "SIGKILL");
+        absent(pid);
+    } finally { await fs.rm(root, { recursive: true }); }
+});
+
+test("test_should_join_child_after_original_deadline_or_output_cap", async () => {
+    for (const source of ['process.on("SIGINT",()=>{});setInterval(()=>{},10)', 'process.stdout.write("x".repeat(10000));setInterval(()=>{},10)']) {
+        let pid;
+        await assert.rejects(execute(process.execPath, ["-e", source], options({ deadline: performance.now() + 200, cap: 1024,
+            hold: async owner => { pid = owner.pid; } })));
+        absent(pid);
+    }
+});
+
+test("test_should_join_spawn_failure_without_waiting_for_exit_event", async () => {
+    await assert.rejects(execute("/nonexistent/rustack-iac-command", [], options()));
+});
+
+test("test_should_retain_bounded_diagnostics_after_root_exits_before_live_gate", async () => {
+    let pid;
+    await assert.rejects(execute(process.execPath, ["-e", 'process.stderr.write("owned private diagnostic");process.exitCode=9'],
+        options({ hold: async owner => {
+            pid = owner.pid;
+            while (owner.alive()) await delay(10);
+            throw new Error("live gate missing");
+        } })), error => error.code === 9 && error.stderr.toString() === "owned private diagnostic" &&
+            error.cause?.message === "live gate missing");
+    absent(pid);
+});
diff --git a/tests/lambda-fixtures/pulumi/child_owner.js b/tests/lambda-fixtures/pulumi/child_owner.js
new file mode 100644
index 00000000..f77dadd4
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/child_owner.js
@@ -0,0 +1,70 @@
+"use strict";
+
+const { spawn } = require("node:child_process");
+const { performance } = require("node:perf_hooks");
+
+class CommandFailure extends Error {
+    constructor(result, cause) {
+        super("bounded IaC command failed", { cause });
+        Object.assign(this, result);
+    }
+}
+
+// The function namespace owns plugins in independent process groups. This owner
+// joins the direct CLI and both pipes, including a root that exits before EOF.
+async function execute(command, args, options) {
+    const { deadline, cwd, env, hold, grace = 5000, cap = 1024 * 1024 } = options;
+    if (!Number.isFinite(deadline) || deadline <= performance.now() || grace < 1 || grace > 5000 ||
+        !Number.isSafeInteger(cap) || cap < 1 || cap > 1024 * 1024) throw new Error("invalid CLI owner limits");
+    const child = spawn(command, args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+    const controller = new AbortController();
+    const streams = [child.stdout, child.stderr], outputs = [[], []], sizes = [0, 0];
+    let exited = false, forced = false, problem, escalation;
+    function stop() {
+        forced = true;
+        controller.abort();
+        for (const stream of streams) stream.destroy();
+        if (!exited) {
+            child.kill("SIGINT");
+            if (!escalation) escalation = setTimeout(() => { if (!exited) child.kill("SIGKILL"); }, grace);
+        }
+    }
+    const drained = streams.map((stream, index) => new Promise(resolve => {
+        stream.on("data", chunk => {
+            sizes[index] += chunk.length;
+            if (sizes[index] > cap) { problem = new Error("IaC command output cap"); stop(); }
+            else outputs[index].push(chunk);
+        });
+        stream.once("error", () => { problem = new Error("IaC command pipe failed"); stop(); });
+        stream.once("close", resolve);
+    }));
+    const done = new Promise(resolve => {
+        child.once("error", () => { problem = new Error("IaC command spawn failed"); });
+        child.once("exit", (code, signal) => { exited = true; resolve({ code, signal }); });
+        child.once("close", (code, signal) => { if (!exited) { exited = true; resolve({ code, signal }); } });
+    });
+    const timer = setTimeout(stop, Math.max(1, deadline - performance.now()));
+    let status, failure;
+    try {
+        if (hold) await hold({ pid: child.pid, deadline, alive: () => !exited && !forced, signal: controller.signal });
+        status = await done;
+        await Promise.all(drained);
+        if (forced || problem || performance.now() >= deadline || status.signal !== null || !Number.isInteger(status.code)) {
+            throw new Error("bounded IaC command failed");
+        }
+    } catch (error) {
+        failure = error;
+    } finally {
+        if (!exited || streams.some(stream => !stream.closed)) stop();
+        status = await done;
+        await Promise.all(drained);
+        clearTimeout(timer);
+        clearTimeout(escalation);
+        controller.abort();
+    }
+    const result = { ...status, stdout: Buffer.concat(outputs[0]), stderr: Buffer.concat(outputs[1]) };
+    if (failure) throw new CommandFailure(result, failure);
+    return result;
+}
+
+module.exports = { execute, CommandFailure };
diff --git a/tests/lambda-fixtures/pulumi/dependency-controls.js b/tests/lambda-fixtures/pulumi/dependency-controls.js
new file mode 100644
index 00000000..ba29688b
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/dependency-controls.js
@@ -0,0 +1,102 @@
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const { mkdtemp, mkdir, writeFile, rm } = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const { setImmediate: immediate } = require("node:timers/promises");
+const { Worker } = require("node:worker_threads");
+const test = require("node:test");
+const Arborist = require("@npmcli/arborist");
+const mapWorkspaces = require("@npmcli/map-workspaces");
+const packlist = require("npm-packlist");
+const glob = require("glob");
+const minimatch = require("minimatch");
+
+async function workspace(run) {
+    const root = await mkdtemp(path.join(os.tmpdir(), "rustack-iac-dependencies-"));
+    try {
+        const pkg = { name: "iac-workspace", version: "1.0.0", private: true, workspaces: ["packages/*"] };
+        await writeFile(path.join(root, "package.json"), JSON.stringify(pkg));
+        for (const name of ["a", "b"]) {
+            const directory = path.join(root, "packages", name);
+            await mkdir(directory, { recursive: true });
+            await writeFile(path.join(directory, "package.json"), JSON.stringify({ name: "iac-" + name, version: "1.0.0" }));
+            await writeFile(path.join(directory, "index.js"), '"use strict";\n');
+        }
+        return await run(root, pkg);
+    } finally {
+        await rm(root, { recursive: true });
+    }
+}
+
+test("test_should_load_the_exact_patched_sdk_commonjs_exports", () => {
+    for (const [name, expected] of Object.entries({
+        "@pulumi/pulumi": "3.273.0", "@pulumi/aws": "7.52.1", glob: "14.0.3", minimatch: "11.0.3",
+    })) assert.equal(require(name + "/package.json").version, expected);
+    assert.equal(typeof require("@pulumi/pulumi").secret, "function");
+    assert.equal(typeof require("@pulumi/aws").sfn.StateMachine, "function");
+    assert.equal(typeof glob.Glob, "function");
+    assert.equal(typeof minimatch.Minimatch, "function");
+});
+
+test("test_should_map_actual_workspaces_with_patched_glob_and_minimatch", async () => workspace(async (root, pkg) => {
+    const expected = ["packages/a/package.json", "packages/b/package.json"];
+    assert.deepEqual(glob.globSync("packages/*/package.json", { cwd: root }).sort(), expected);
+    assert.deepEqual((await glob.glob("packages/*/package.json", { cwd: root })).sort(), expected);
+    const mapped = await mapWorkspaces({ cwd: root, pkg });
+    assert.deepEqual([...mapped.keys()].sort(), ["iac-a", "iac-b"]);
+    const matcher = new minimatch.Minimatch("packages/*/package.json");
+    assert(expected.every(value => matcher.match(value)));
+    assert.equal(matcher.match("packages/a/index.js"), false);
+}));
+
+test("test_should_load_the_real_dependency_graph_and_pack_workspace_files", async () => {
+    const tree = await new Arborist({ path: __dirname }).loadActual();
+    assert.equal(tree.edgesOut.get("@pulumi/aws").to.package.version, "7.52.1");
+    assert.equal(tree.edgesOut.get("@pulumi/pulumi").to.package.version, "3.273.0");
+    await workspace(async root => {
+        const local = await new Arborist({ path: root }).loadActual();
+        const files = await packlist(local);
+        assert(files.includes("package.json"));
+        assert(files.includes("packages/a/index.js"));
+        assert(files.includes("packages/b/index.js"));
+        assert(files.every(value => !value.split(path.sep).includes("node_modules")));
+    });
+});
+
+test("test_should_abort_glob_before_directory_traversal_and_remain_stopped", async () => workspace(async root => {
+    let reads = 0;
+    const observed = { ...fs, readdir(...args) { reads += 1; return fs.readdir(...args); } };
+    const controller = new AbortController();
+    controller.abort(new Error("fixture walk aborted"));
+    await assert.rejects(glob.glob("**/*", { cwd: root, fs: observed, signal: controller.signal }), /fixture walk aborted/);
+    await immediate();
+    await immediate();
+    assert.equal(reads, 0);
+}));
+
+test("test_should_bound_amplifying_matcher_work_in_an_owned_worker", async () => {
+    const source = `
+        const { parentPort, workerData } = require("node:worker_threads");
+        const { Minimatch } = require(workerData.module);
+        const matcher = new Minimatch("**/../".repeat(64) + "leaf", { optimizationLevel: 2 });
+        parentPort.postMessage({ matched: matcher.match("leaf"), patterns: matcher.set.length });
+    `;
+    const worker = new Worker(source, { eval: true, workerData: { module: require.resolve("minimatch") } });
+    let timer;
+    try {
+        const result = await new Promise((resolve, reject) => {
+            timer = setTimeout(() => reject(new Error("bounded matcher observation expired")), 3000);
+            worker.once("message", resolve);
+            worker.once("error", reject);
+            worker.once("exit", code => { if (code !== 0) reject(new Error("matcher worker failed")); });
+        });
+        assert.equal(typeof result.matched, "boolean");
+        assert(Number.isSafeInteger(result.patterns) && result.patterns <= 256);
+    } finally {
+        clearTimeout(timer);
+        await worker.terminate();
+    }
+});
diff --git a/tests/lambda-fixtures/pulumi/evidence-controls.js b/tests/lambda-fixtures/pulumi/evidence-controls.js
new file mode 100644
index 00000000..265cf220
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/evidence-controls.js
@@ -0,0 +1,54 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const { randomUUID } = require("node:crypto");
+const { performance } = require("node:perf_hooks");
+const { read } = require("./evidence_reader");
+
+async function workspace(run) {
+    const directory = "/tmp/iac-" + randomUUID();
+    await fs.mkdir(directory, { mode: 0o700 });
+    try { await fs.mkdir(directory + "/logs"); return await run(directory); }
+    finally { await fs.rm(directory, { recursive: true }); }
+}
+test("test_should_read_actual_files_into_bounded_complete_ustar_without_mutation", async () => workspace(async directory => {
+    const data = Buffer.from("actual independent file bytes");
+    await fs.writeFile(directory + "/logs/4-create.stderr", data, { mode: 0o600 });
+    const chunks = [];
+    await read(directory, "logs", async value => { chunks.push(value); }, performance.now() + 3000);
+    const archive = Buffer.concat(chunks);
+    assert.equal(archive.subarray(0, 4).toString(), "logs");
+    assert.equal(archive.subarray(257, 263).toString(), "ustar\0");
+    assert.equal(archive.subarray(1024, 1024 + data.length).toString(), data.toString());
+    assert.deepEqual(archive.subarray(-1024), Buffer.alloc(1024));
+    assert.deepEqual(await fs.readFile(directory + "/logs/4-create.stderr"), data);
+    assert.deepEqual(await fs.readdir(directory + "/logs"), ["4-create.stderr"]);
+}));
+test("test_should_reject_evidence_links_oversized_files_and_expired_reader", async () => workspace(async directory => {
+    await fs.symlink("/etc/passwd", directory + "/logs/link");
+    await assert.rejects(read(directory, "logs", async () => {}, performance.now() + 3000));
+    await fs.unlink(directory + "/logs/link");
+    const handle = await fs.open(directory + "/logs/large", "wx", 0o600);
+    try { await handle.truncate(2 * 1024 * 1024 + 1); } finally { await handle.close(); }
+    await assert.rejects(read(directory, "logs", async () => {}, performance.now() + 3000));
+    await assert.rejects(read(directory, "logs", async () => {}, performance.now() - 1));
+}));
+test("test_should_refuse_excessive_entries_and_non_fixture_roots", async () => workspace(async directory => {
+    for (let index = 0; index < 129; index += 1) await fs.writeFile(directory + "/logs/" + index, "");
+    await assert.rejects(read(directory, "logs", async () => {}, performance.now() + 3000));
+    await assert.rejects(read(directory, "project", async () => {}, performance.now() + 3000));
+    await assert.rejects(read("/tmp/unrelated", "logs", async () => {}, performance.now() + 3000));
+}));
+
+test("test_should_encode_real_long_backend_paths_using_ustar_prefix", async () => workspace(async directory => {
+    const component = "a".repeat(70), name = "b".repeat(50) + ".stdout";
+    await fs.mkdir(directory + "/logs/" + component);
+    await fs.writeFile(directory + "/logs/" + component + "/" + name, "long actual file");
+    const chunks = [];
+    await read(directory, "logs", async value => { chunks.push(value); }, performance.now() + 3000);
+    const raw = Buffer.concat(chunks), file = raw.subarray(1024, 1536);
+    assert.equal(file.subarray(0, 100).toString().replace(/\0.*$/s, ""), name);
+    assert.equal(file.subarray(345, 500).toString().replace(/\0.*$/s, ""), "logs/" + component);
+    assert.equal(raw.subarray(1536, 1552).toString(), "long actual file");
+}));
diff --git a/tests/lambda-fixtures/pulumi/evidence_reader.js b/tests/lambda-fixtures/pulumi/evidence_reader.js
new file mode 100644
index 00000000..677844af
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/evidence_reader.js
@@ -0,0 +1,94 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { once } = require("node:events");
+const { performance } = require("node:perf_hooks");
+const CAP = 16 * 1024 * 1024;
+function check(value) { if (!value) throw new Error("bounded evidence reader failed"); }
+function octal(header, start, length, value) {
+    const text = value.toString(8).padStart(length - 1, "0") + "\0";
+    check(text.length === length);
+    header.write(text, start, length, "ascii");
+}
+function header(name, size, directory) {
+    const output = Buffer.alloc(512);
+    check(Buffer.byteLength(name) <= 256);
+    const split = Buffer.byteLength(name) <= 100 ? -1 : name.lastIndexOf("/");
+    const prefix = split < 0 ? "" : name.slice(0, split);
+    const suffix = split < 0 ? name : name.slice(split + 1);
+    check(Buffer.byteLength(prefix) <= 155 && Buffer.byteLength(suffix) <= 100);
+    output.write(suffix, 0, 100, "utf8");
+    output.write(prefix, 345, 155, "utf8");
+    octal(output, 100, 8, directory ? 0o700 : 0o600);
+    octal(output, 108, 8, 1000); octal(output, 116, 8, 1000);
+    octal(output, 124, 12, size); octal(output, 136, 12, 0);
+    output.fill(32, 148, 156); output[156] = directory ? 53 : 48;
+    output.write("ustar\0", 257, 6, "ascii"); output.write("00", 263, 2, "ascii");
+    const checksum = output.reduce((total, value) => total + value, 0);
+    output.write(checksum.toString(8).padStart(6, "0") + "\0 ", 148, 8, "ascii");
+    return output;
+}
+async function read(workspace, root, write, deadline) {
+    check(/^\/tmp\/iac-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(workspace));
+    check(["backend", "logs"].includes(root));
+    const base = fs.lstatSync(workspace);
+    check(base.isDirectory() && !base.isSymbolicLink() && base.uid === process.getuid());
+    let total = 0, entries = 0;
+    async function emit(value) {
+        check(performance.now() < deadline);
+        total += value.length;
+        check(total <= CAP);
+        await write(value);
+        check(performance.now() < deadline);
+    }
+    async function visit(relative, depth) {
+        check(++entries <= 128 && depth <= 8 && Buffer.byteLength(relative) <= 256 &&
+            /^[A-Za-z0-9_.\/-]+$/.test(relative) && relative.split("/").every(value => !["", ".", ".."].includes(value)));
+        const file = path.join(workspace, relative), stat = fs.lstatSync(file);
+        check(!stat.isSymbolicLink() && stat.uid === process.getuid());
+        if (stat.isDirectory()) {
+            await emit(header(relative, 0, true));
+            const directory = fs.opendirSync(file), names = [];
+            try {
+                let entry;
+                while ((entry = directory.readSync()) !== null) {
+                    check(entries + names.length < 128);
+                    names.push(entry.name);
+                }
+            } finally { directory.closeSync(); }
+            for (const name of names.sort()) await visit(relative + "/" + name, depth + 1);
+        } else {
+            check(stat.isFile() && stat.nlink === 1 && stat.size <= 2 * 1024 * 1024);
+            const descriptor = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+            let content;
+            try {
+                const opened = fs.fstatSync(descriptor);
+                check(opened.isFile() && opened.ino === stat.ino && opened.dev === stat.dev && opened.size === stat.size);
+                content = Buffer.alloc(opened.size + 1);
+                let offset = 0, received;
+                while ((received = fs.readSync(descriptor, content, offset, content.length - offset, null)) !== 0) {
+                    offset += received;
+                    check(offset <= opened.size);
+                }
+                const after = fs.fstatSync(descriptor);
+                check(offset === opened.size && after.size === opened.size && after.mtimeMs === opened.mtimeMs);
+                content = content.subarray(0, offset);
+            } finally { fs.closeSync(descriptor); }
+            await emit(header(relative, content.length, false));
+            await emit(content);
+            if (content.length % 512) await emit(Buffer.alloc(512 - content.length % 512));
+        }
+    }
+    await visit(root, 1);
+    await emit(Buffer.alloc(1024));
+}
+async function main() {
+    check(process.getuid() === 1000 && process.getgid() === 1000 && process.argv.length === 4);
+    const requestId = process.argv[2], root = process.argv[3];
+    await read("/tmp/iac-" + requestId, root, async value => {
+        if (!process.stdout.write(value)) await once(process.stdout, "drain");
+    }, performance.now() + 10000);
+}
+if (require.main === module) main().catch(() => { process.stderr.write("bounded evidence reader failed\n"); process.exitCode = 1; });
+module.exports = { read };
diff --git a/tests/lambda-fixtures/pulumi/iac_input.js b/tests/lambda-fixtures/pulumi/iac_input.js
new file mode 100644
index 00000000..22b1370b
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/iac_input.js
@@ -0,0 +1,20 @@
+"use strict";
+const support = require("./program_support");
+const { check } = require("./iac_runtime");
+
+function input(event, requestId) {
+    check(event && typeof event === "object" && !Array.isArray(event) &&
+        Buffer.byteLength(JSON.stringify(event)) <= 8192 && Object.keys(event).length === 5 &&
+        Object.keys(event).every(key => ["mode", "nonce", "table", "businessArn", "target"].includes(key)));
+    check(["lifecycle", "stop"].includes(event.mode) && typeof event.table === "string" &&
+        /^[A-Za-z0-9_.-]{3,128}$/.test(event.table));
+    check(typeof requestId === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(requestId));
+    const workspace = "/tmp/iac-" + requestId;
+    const config = support.validate({ nonce: event.nonce, endpoint: process.env.AWS_ENDPOINT_URL,
+        businessArn: event.businessArn, target: event.target, role: "arn:aws:iam::000000000000:role/ImageIac",
+        kmsKey: "arn:aws:kms:us-east-1:000000000000:key/00000000-0000-4000-8000-000000000000",
+        emptyConfig: workspace + "/empty-config" });
+    return { event, config, workspace, requestId };
+}
+
+module.exports = { input };
diff --git a/tests/lambda-fixtures/pulumi/iac_runtime.js b/tests/lambda-fixtures/pulumi/iac_runtime.js
new file mode 100644
index 00000000..bfdcab72
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/iac_runtime.js
@@ -0,0 +1,126 @@
+"use strict";
+
+const fs = require("node:fs/promises");
+const { createReadStream, constants } = require("node:fs");
+const { createHash } = require("node:crypto");
+const path = require("node:path");
+const { execute, CommandFailure } = require("./child_owner");
+const { performance } = require("node:perf_hooks");
+const { setTimeout: delay } = require("node:timers/promises");
+
+const TOOLS = "/opt/pulumi";
+const PROVIDER = "plugins/resource-aws-v7.52.1/pulumi-resource-aws";
+const FILES = ["bin/pulumi", "bin/pulumi-language-nodejs", PROVIDER];
+const ARCHIVES = {
+    arm64: ["c2e1b600b37d9d84551259b6f391f5035e336dfe63c49412f22d855a91995ed5", "1976366b71dc08d8827a04fbb8eaf50a0d1ec5757726e593b6d7c27e7636daf8"],
+    x64: ["ec08f86671fd58f0a186540e1cee00066393beaf5c6716b0075f690919800432", "2e705824a2103dd6e3dc66744ba2d55cad55d665476b3ffcd8ce024cf4cab081"],
+};
+function check(value) { if (!value) throw new Error("bounded IaC runtime validation failed"); }
+function fresh(deadline) { check(Number.isFinite(deadline) && performance.now() < deadline); }
+async function bytes(file, cap) {
+    const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const info = await handle.stat();
+        check(info.isFile() && info.size <= cap);
+        const value = Buffer.alloc(cap + 1);
+        let offset = 0;
+        while (offset < value.length) {
+            const { bytesRead } = await handle.read(value, offset, value.length - offset, null);
+            if (!bytesRead) break;
+            offset += bytesRead;
+        }
+        check(offset <= cap);
+        return value.subarray(0, offset);
+    } finally { await handle.close(); }
+}
+async function hash(file, cap, deadline) {
+    const state = createHash("sha256");
+    let size = 0;
+    for await (const chunk of createReadStream(file, { highWaterMark: 65536 })) {
+        fresh(deadline);
+        size += chunk.length;
+        check(size <= cap);
+        state.update(chunk);
+    }
+    fresh(deadline);
+    return { sha256: state.digest("hex"), bytes: size };
+}
+async function source(deadline) {
+    fresh(deadline);
+    check(process.getuid() === 1000 && ARCHIVES[process.arch] !== undefined);
+    const data = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await bytes(TOOLS + "/manifest.json", 16384)));
+    check(data.schemaVersion === 1 && data.cli === "3.273.0" && data.provider === "7.52.1" &&
+        data.architecture === (process.arch === "x64" ? "amd64" : "arm64") &&
+        JSON.stringify(data.archives) === JSON.stringify(ARCHIVES[process.arch]) &&
+        Array.isArray(data.files) && data.files.length === 3 &&
+        new Set(data.files.map(value => value.path)).size === 3);
+    for (const entry of data.files) {
+        check(FILES.includes(entry.path) && /^[0-9a-f]{64}$/.test(entry.sha256) &&
+            Number.isSafeInteger(entry.bytes) && entry.bytes >= 64 && entry.bytes <= 2 * 1024 ** 3);
+        const file = path.join(TOOLS, entry.path), info = await fs.lstat(file);
+        check(info.isFile() && !info.isSymbolicLink() && info.size === entry.bytes && (info.mode & 0o111) === 0o111);
+        const actual = await hash(file, 2 * 1024 ** 3, deadline);
+        check(actual.bytes === entry.bytes && actual.sha256 === entry.sha256);
+    }
+    return { cli: "3.273.0", provider: "7.52.1", sdk: require("@pulumi/pulumi/package.json").version,
+        aws: require("@pulumi/aws/package.json").version, node: process.versions.node,
+        dynamodb: require("@aws-sdk/client-dynamodb/package.json").version };
+}
+async function processes(workspace) {
+    const entries = await fs.readdir("/proc");
+    const pids = entries.filter(value => /^[0-9]+$/.test(value));
+    check(pids.length <= 256);
+    const found = [];
+    for (const pid of pids) {
+        try {
+            const command = (await bytes("/proc/" + pid + "/cmdline", 4096)).toString("utf8");
+            if (!command.includes(TOOLS + "/") && !command.includes(workspace + "/project") &&
+                !command.startsWith(workspace + "/home/plugins/")) continue;
+            const status = (await bytes("/proc/" + pid + "/stat", 4096)).toString("ascii");
+            const fields = status.slice(status.lastIndexOf(")") + 2).trim().split(/\s+/);
+            const group = Number(fields[2]);
+            check(Number.isSafeInteger(group) && group > 0 && group < 2 ** 31 && found.length < 32);
+            found.push({ pid: Number(pid), group, provider: command.includes(PROVIDER),
+                language: command.includes("/pulumi-language-nodejs"), cli: command.startsWith(TOOLS + "/bin/pulumi\0") });
+        } catch (error) { if (error.code !== "ENOENT" && error.code !== "ESRCH") throw error; }
+    }
+    return found;
+}
+async function waitFile(file, deadline, alive) {
+    while (performance.now() < deadline && alive()) {
+        try { return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await bytes(file, 8192))); }
+        catch (error) { if (error.code !== "ENOENT") throw error; }
+        await delay(Math.min(50, deadline - performance.now()));
+    }
+    throw new Error("IaC command did not reach its live gate");
+}
+async function run(session, label, arguments_, environment, hold) {
+    check(/^[a-z0-9-]{1,32}$/.test(label) && session.ordinal < 20);
+    fresh(session.deadline);
+    const ordinal = ++session.ordinal;
+    const deadline = Math.min(session.deadline, performance.now() + 90000);
+    let status, failure;
+    try {
+        status = await execute(TOOLS + "/bin/pulumi", arguments_, {
+        cwd: session.workspace + "/project", deadline,
+        env: { ...environment, RUSTACK_IAC_COMMAND: String(ordinal) },
+        hold: hold ? state => hold({ ...state, ordinal }) : undefined,
+        });
+    } catch (error) {
+        if (!(error instanceof CommandFailure)) throw error;
+        status = error;
+        failure = error;
+    }
+    const { stdout, stderr } = status;
+    session.outputBytes += stdout.length + stderr.length;
+    check(session.outputBytes <= 16 * 1024 * 1024);
+    for (const [suffix, value] of [["stdout", stdout], ["stderr", stderr]]) {
+        await fs.writeFile(path.join(session.workspace, "logs", String(ordinal) + "-" + label + "." + suffix), value,
+            { flag: "wx", mode: 0o600 });
+    }
+    if (failure) throw failure;
+    check((await processes(session.workspace)).length === 0);
+    return { code: status.code, stdout, stderr, ordinal };
+}
+
+module.exports = { check, fresh, bytes, hash, source, processes, waitFile, run, TOOLS };
diff --git a/tests/lambda-fixtures/pulumi/iac_session.js b/tests/lambda-fixtures/pulumi/iac_session.js
new file mode 100644
index 00000000..8d055813
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/iac_session.js
@@ -0,0 +1,196 @@
+"use strict";
+
+const fs = require("node:fs/promises");
+const { randomBytes, createHash } = require("node:crypto");
+const path = require("node:path");
+const { performance } = require("node:perf_hooks");
+const { setTimeout: delay } = require("node:timers/promises");
+const { DynamoDBClient, PutItemCommand, GetItemCommand } = require("@aws-sdk/client-dynamodb");
+const runtime = require("./iac_runtime");
+const support = require("./program_support");
+const { check, fresh, bytes } = runtime;
+const { CommandFailure } = require("./child_owner");
+const PROJECT = "rustack-iac";
+const STACK = "fixture";
+
+const { input } = require("./iac_input");
+
+class Session {
+    constructor(data, deadline, versions) {
+        Object.assign(this, data);
+        this.deadline = deadline;
+        this.versions = versions;
+        this.ordinal = 0;
+        this.outputBytes = 0;
+        this.records = [];
+        this.client = new DynamoDBClient({ maxAttempts: 1 });
+    }
+    async send(command) {
+        fresh(this.deadline);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), Math.min(4000, this.deadline - performance.now()));
+        try {
+            const value = await this.client.send(command, { abortSignal: controller.signal });
+            fresh(this.deadline);
+            return value;
+        } finally { clearTimeout(timer); controller.abort(); }
+    }
+    async setup() {
+        await fs.mkdir(this.workspace, { mode: 0o700 });
+        for (const name of ["project", "home", "backend", "logs"]) await fs.mkdir(path.join(this.workspace, name), { mode: 0o700 });
+        await fs.symlink(runtime.TOOLS + "/plugins", this.workspace + "/home/plugins");
+        await fs.symlink(__dirname + "/node_modules", this.workspace + "/project/node_modules");
+        for (const name of ["program.js", "program_support.js"]) await fs.copyFile(path.join(__dirname, name), this.workspace + "/project/" + name);
+        await fs.writeFile(this.workspace + "/project/Pulumi.yaml", "name: " + PROJECT + "\nruntime:\n  name: nodejs\n  options:\n    typescript: false\nmain: program.js\n", { flag: "wx", mode: 0o600 });
+        await fs.writeFile(this.workspace + "/project/package.json", '{"private":true,"main":"program.js"}', { flag: "wx", mode: 0o600 });
+        await fs.writeFile(this.workspace + "/empty-config", "", { flag: "wx", mode: 0o600 });
+        await fs.writeFile(this.workspace + "/config.json", JSON.stringify(this.config), { flag: "wx", mode: 0o600 });
+        const key = process.env.AWS_ACCESS_KEY_ID, secret = process.env.AWS_SECRET_ACCESS_KEY;
+        check(typeof key === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(key) &&
+            typeof secret === "string" && /^[\x21-\x7e]{1,256}$/.test(secret));
+        this.environment = {
+            PATH: "/opt/pulumi/bin:/var/lang/bin:/usr/bin:/bin", LANG: "C.UTF-8",
+            USER: "rustack-iac", LOGNAME: "rustack-iac",
+            NODE_PATH: __dirname + "/node_modules:/var/runtime/node_modules:/var/lang/lib/node_modules",
+            GOMAXPROCS: "1", UV_THREADPOOL_SIZE: "2",
+            AWS_ACCESS_KEY_ID: key, AWS_SECRET_ACCESS_KEY: secret, AWS_REGION: "us-east-1",
+            AWS_DEFAULT_REGION: "us-east-1", AWS_EC2_METADATA_DISABLED: "true",
+            AWS_CONFIG_FILE: this.config.emptyConfig, AWS_SHARED_CREDENTIALS_FILE: this.config.emptyConfig,
+            AWS_ENDPOINT_URL: this.config.endpoint, AWS_IGNORE_CONFIGURED_ENDPOINT_URLS: "false",
+            PULUMI_HOME: this.workspace + "/home", PULUMI_BACKEND_URL: "file://" + this.workspace + "/backend",
+            PULUMI_CONFIG_PASSPHRASE: randomBytes(32).toString("hex"), PULUMI_SKIP_UPDATE_CHECK: "true",
+            PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION: "true", PULUMI_IGNORE_AMBIENT_PLUGINS: "true",
+            RUSTACK_IAC_CONFIG: this.workspace + "/config.json",
+        };
+    }
+    gateId(ordinal, stage) { return "gate:" + this.event.nonce + ":" + this.event.mode + ":" + ordinal + ":" + stage; }
+    async record(stage, details = {}) {
+        const row = { nonce: this.event.nonce, mode: this.event.mode, stage, ordinal: this.ordinal,
+            requestId: this.requestId, targetArn: "arn:aws:states:us-east-1:000000000000:stateMachine:" + this.config.target,
+            ...details };
+        const payload = JSON.stringify(row);
+        const item = { id: { S: this.event.nonce + ":" + this.event.mode + ":" + stage }, payload: { S: payload } };
+        check(Buffer.byteLength(JSON.stringify(item)) <= 2048);
+        await this.send(new PutItemCommand({ TableName: this.event.table, Item: item }));
+    }
+    async grant(stage, deadline, alive = () => true) {
+        deadline = Math.min(deadline, this.deadline);
+        while (performance.now() < deadline && alive()) {
+            const result = await this.send(new GetItemCommand({ TableName: this.event.table,
+                Key: { id: { S: this.gateId(this.ordinal, stage) } }, ConsistentRead: true }));
+            fresh(deadline);
+            if (result.Item) {
+                check(Object.keys(result.Item).length === 2 && result.Item.id?.S === this.gateId(this.ordinal, stage) &&
+                    result.Item.open?.BOOL === true);
+                return;
+            }
+            await delay(Math.min(100, Math.max(1, deadline - performance.now())));
+        }
+        throw new Error("IaC host grant expired");
+    }
+    async held(stage, owner) {
+        const file = support.stagePath(this.workspace, owner.ordinal, stage, false);
+        const phase = await runtime.waitFile(file, owner.deadline, owner.alive);
+        check(Object.keys(phase).length === 4 && phase.nonce === this.config.nonce && phase.stage === stage &&
+            phase.ordinal === owner.ordinal && phase.arn === "arn:aws:states:us-east-1:000000000000:stateMachine:" + this.config.target);
+        const processes = await runtime.processes(this.workspace);
+        check(owner.alive() && processes.some(value => value.cli && value.pid === owner.pid) &&
+            processes.some(value => value.language) && processes.some(value => value.provider));
+        await this.record(stage, { processes, versions: this.versions });
+        await this.grant(stage, owner.deadline, owner.alive);
+        check(owner.alive());
+        await support.publishJSON(support.stagePath(this.workspace, owner.ordinal, stage, true), {
+            nonce: this.config.nonce, ordinal: owner.ordinal, stage,
+        }, owner.deadline);
+    }
+    async commandFailure(label, code, stdout, stderr, cause) {
+        const text = Buffer.concat([stdout, stderr]).toString("utf8");
+        const patterns = [
+            ["module-missing", /Cannot find module|MODULE_NOT_FOUND/],
+            ["plugin-missing", /plugin.*not found|could not find.*plugin|Missing.*plugin/i],
+            ["home-missing", /HOME|home directory/], ["user-missing", /unknown user|userid|user: Current/],
+            ["permission", /permission denied|EACCES/], ["readonly", /read-only|EROFS/],
+            ["syntax", /SyntaxError|Unexpected token/], ["invalid-flag", /unknown flag/],
+            ["provider-validation", /ValidationException/], ["connection", /connection refused|ENOTFOUND|network is unreachable/i],
+        ];
+        const category = patterns.find(([, pattern]) => pattern.test(text))?.[0] ??
+            (cause?.message === "IaC command did not reach its live gate" ? "gate-not-reached" :
+                cause?.message === "bounded IaC runtime validation failed" ? "gate-validation" : "other");
+        await this.record("command-failed", { label, code: Number.isInteger(code) && code >= 0 && code <= 255 ? code : null, category });
+        await this.grant("failure-audit", Math.min(this.deadline, performance.now() + 20000));
+    }
+    async command(label, args, value = 23, unsupported = "none", gate = "none") {
+        await this.record("command-start", { label });
+        let result;
+        try {
+            result = await runtime.run(this, label, args, { ...this.environment,
+            RUSTACK_IAC_VALUE: String(value), RUSTACK_IAC_UNSUPPORTED: unsupported, RUSTACK_IAC_GATE: gate },
+            gate === "none" ? undefined : owner => this.held(gate, owner));
+        } catch (error) {
+            if (error instanceof CommandFailure) {
+                await this.commandFailure(label, error.code, error.stdout, error.stderr, error.cause);
+            }
+            throw error;
+        }
+        const diagnostic = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat([result.stdout, result.stderr]));
+        await this.record("command-end", { label, code: result.code, validationException: diagnostic.includes("ValidationException") });
+        const accepted = unsupported === "none" ? result.code === 0 : result.code !== 0 && diagnostic.includes("ValidationException");
+        if (!accepted) await this.commandFailure(label, result.code, result.stdout, result.stderr);
+        check(accepted);
+        const hash = data => createHash("sha256").update(data).digest("hex");
+        this.records.push({ ordinal: result.ordinal, label, code: result.code,
+            stdoutSha256: hash(result.stdout), stderrSha256: hash(result.stderr) });
+        check(this.records.length <= 20);
+        return diagnostic;
+    }
+    async checkpoint(stage, present) {
+        const relative = "backend/.pulumi/stacks/" + PROJECT + "/" + STACK + ".json";
+        let actual;
+        try { actual = await bytes(this.workspace + "/" + relative, 2 * 1024 * 1024); }
+        catch (error) { check(!present && error.code === "ENOENT"); }
+        check(present === (actual !== undefined));
+        const checkpoint = { path: relative, present, bytes: actual?.length ?? 0,
+            sha256: actual ? createHash("sha256").update(actual).digest("hex") : "" };
+        await this.record(stage, { checkpoint, commands: this.records.map(({ ordinal, label, code }) => ({ ordinal, label, code })) });
+        await this.grant(stage, Math.min(this.deadline, performance.now() + 60000));
+    }
+    async lifecycle() {
+        const shared = ["--stack", STACK, "--non-interactive", "--color", "never"];
+        const up = ["up", "--yes", "--skip-preview", ...shared];
+        const refresh = ["refresh", "--yes", "--expect-no-changes", ...shared];
+        const version = await this.command("version", ["version"]);
+        check(version.trim() === "v3.273.0");
+        await this.command("login", ["login", this.environment.PULUMI_BACKEND_URL, "--non-interactive"]);
+        await this.command("init", ["stack", "init", STACK, "--secrets-provider", "passphrase", "--non-interactive"]);
+        await this.command("create", up, 21, "none", "created");
+        // The Stop resource never grants its initial up; this path is positive only.
+        check(this.event.mode === "lifecycle");
+        await this.command("refresh-created", refresh, 21);
+        await this.record("refreshed-created");
+        await this.grant("refreshed-created", Math.min(this.deadline, performance.now() + 60000));
+        await this.command("update", up, 23, "none", "updated");
+        await this.command("refresh-updated", refresh);
+        await this.record("refreshed-updated");
+        await this.grant("refreshed-updated", Math.min(this.deadline, performance.now() + 60000));
+        for (const unsupported of ["publish", "logging", "encryption"]) {
+            await this.command("reject-" + unsupported, up, 23, unsupported);
+            await this.record("rejected-" + unsupported);
+            await this.grant("rejected-" + unsupported, Math.min(this.deadline, performance.now() + 60000));
+            await this.command("recover-" + unsupported, up);
+            const diagnostic = await this.command("settle-" + unsupported, [...up, "--expect-no-changes"]);
+            check(diagnostic.includes("unchanged"));
+            await this.record("recovered-" + unsupported);
+            await this.grant("recovered-" + unsupported, Math.min(this.deadline, performance.now() + 60000));
+        }
+        await this.checkpoint("pre-destroy", true);
+        await this.command("destroy", ["destroy", "--yes", ...shared]);
+        await this.checkpoint("post-destroy", true);
+        await this.command("remove", ["stack", "rm", STACK, "--yes", "--non-interactive"]);
+        await this.checkpoint("post-removal", false);
+        check(this.ordinal === 18);
+        await this.record("finished", { versions: this.versions, commandCount: this.ordinal });
+        return { requestId: this.requestId, versions: this.versions, commandCount: this.ordinal };
+    }
+}
+
+module.exports = { input, Session };
diff --git a/tests/lambda-fixtures/pulumi/image_identity.js b/tests/lambda-fixtures/pulumi/image_identity.js
new file mode 100644
index 00000000..d7070244
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/image_identity.js
@@ -0,0 +1,17 @@
+"use strict";
+
+// Image-build-only: Go's DIY backend requires an actual POSIX user lookup.
+const fs = require("node:fs");
+const assert = require("node:assert/strict");
+assert.equal(process.getuid(), 0);
+for (const [file, entry, count] of [
+    ["/etc/passwd", "rustack-iac:x:1000:1000:Rustack IaC:/tmp:/sbin/nologin", 7],
+    ["/etc/group", "rustack-iac:x:1000:", 4],
+]) {
+    const source = fs.readFileSync(file);
+    assert.ok(source.length <= 65536);
+    const records = source.toString("ascii").split("\n").filter(Boolean).map(value => value.split(":"));
+    assert.ok(records.every(fields => fields.length === count));
+    assert.ok(records.every(fields => fields[0] !== "rustack-iac" && fields[2] !== "1000"));
+    fs.appendFileSync(file, entry + "\n");
+}
diff --git a/tests/lambda-fixtures/pulumi/input-controls.js b/tests/lambda-fixtures/pulumi/input-controls.js
new file mode 100644
index 00000000..c10117a9
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/input-controls.js
@@ -0,0 +1,29 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+const runtime = require("./iac_runtime");
+const actualInput = require("./iac_input");
+
+test("test_should_reject_malformed_payload_before_any_provenance_io", async () => {
+    let reads = 0;
+    const module = { exports: {} };
+    vm.runInNewContext(fs.readFileSync(path.join(__dirname, "../iac.js"), "utf8"), {
+        exports: module.exports,
+        require(name) {
+            if (name === "node:perf_hooks") return require(name);
+            if (name === "./pulumi/iac_runtime") return { ...runtime, source: async () => { reads += 1; throw new Error("unexpected IO"); } };
+            if (name === "./pulumi/iac_input") return actualInput;
+            throw new Error("unexpected prevalidation dependency");
+        },
+    });
+    const context = { getRemainingTimeInMillis: () => 720000, awsRequestId: "00000000-0000-4000-8000-000000000000" };
+    for (const event of [null, [], {}, { mode: "probe", extra: true }, { mode: "lifecycle" },
+        { mode: "lifecycle", nonce: "x".repeat(8192), table: "abc", businessArn: "bad", target: "abc" }]) {
+        await assert.rejects(module.exports.handler(event, context), { name: "IacFixtureFailure" });
+    }
+    await assert.rejects(module.exports.handler({ mode: "probe" }, { ...context, awsRequestId: "bad" }));
+    assert.equal(reads, 0);
+});
diff --git a/tests/lambda-fixtures/pulumi/package-lock.json b/tests/lambda-fixtures/pulumi/package-lock.json
new file mode 100644
index 00000000..52ebe430
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/package-lock.json
@@ -0,0 +1,2716 @@
+{
+  "name": "rustack-workflows-iac-image",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "rustack-workflows-iac-image",
+      "version": "0.1.0",
+      "dependencies": {
+        "@pulumi/aws": "7.52.1",
+        "@pulumi/pulumi": "3.273.0"
+      }
+    },
+    "node_modules/@gar/promise-retry": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@gar/promise-retry/-/promise-retry-1.0.3.tgz",
+      "integrity": "sha512-GmzA9ckNokPypTg10pgpeHNQe7ph+iIKKmhKu3Ob9ANkswreCx7R3cKmY781K8QK3AqVL3xVh9A42JvIAbkkSA==",
+      "license": "MIT",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@grpc/grpc-js": {
+      "version": "1.14.7",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.7.tgz",
+      "integrity": "sha512-W4W/fcBMGRVtG6dW2c7cw2mnpS3hvbBd+oQXjh2iYFTZDk1JJmcNqkM5KSaPubQpamlUUurrlb7G1s9NJeERmQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@grpc/proto-loader": "^0.8.0",
+        "@js-sdsl/ordered-map": "^4.4.2"
+      },
+      "engines": {
+        "node": ">=12.10.0"
+      }
+    },
+    "node_modules/@grpc/proto-loader": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.1.tgz",
+      "integrity": "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "lodash.camelcase": "^4.3.0",
+        "long": "^5.0.0",
+        "protobufjs": "^7.5.5",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz",
+      "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==",
+      "license": "BlueOak-1.0.0"
+    },
+    "node_modules/@isaacs/string-locale-compare": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/string-locale-compare/-/string-locale-compare-1.1.0.tgz",
+      "integrity": "sha512-SQ7Kzhh9+D+ZW9MA0zkYv3VXhIDNx+LzM6EJ+/65I3QY+enU6Itte7E5XX7EWrqLW2FN4n06GWzBnPoC3th2aQ==",
+      "license": "ISC"
+    },
+    "node_modules/@js-sdsl/ordered-map": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/@js-sdsl/ordered-map/-/ordered-map-4.4.2.tgz",
+      "integrity": "sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/js-sdsl"
+      }
+    },
+    "node_modules/@logdna/tail-file": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@logdna/tail-file/-/tail-file-2.2.0.tgz",
+      "integrity": "sha512-XGSsWDweP80Fks16lwkAUIr54ICyBs6PsI4mpfTLQaWgEJRtY9xEV+PeyDpJ+sJEGZxqINlpmAwe/6tS1pP8Ng==",
+      "license": "SEE LICENSE IN LICENSE",
+      "engines": {
+        "node": ">=10.3.0"
+      }
+    },
+    "node_modules/@npmcli/agent": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-4.0.2.tgz",
+      "integrity": "sha512-EUEuWAxnL07Sp5/iC/1X6Xj+XThUvnbei9zfRWZdEXa7lss9RTHMhAHBeg+MZ5To9s/gGaSI+UwZTPdYMvKSeg==",
+      "license": "ISC",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.1",
+        "lru-cache": "^11.2.1",
+        "socks-proxy-agent": "^8.0.3"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/arborist": {
+      "version": "9.9.3",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-9.9.3.tgz",
+      "integrity": "sha512-OxRSMNRPzL2/x2zsVrzdMZItfNj3cVXZIYgGNlUaBRUyH16YKdwN1r9z+I13keR1mjVNKelMfi2a7A/0JJ4NCw==",
+      "license": "ISC",
+      "dependencies": {
+        "@gar/promise-retry": "^1.0.0",
+        "@isaacs/string-locale-compare": "^1.1.0",
+        "@npmcli/fs": "^5.0.0",
+        "@npmcli/installed-package-contents": "^4.0.0",
+        "@npmcli/map-workspaces": "^5.0.0",
+        "@npmcli/metavuln-calculator": "^9.0.2",
+        "@npmcli/name-from-folder": "^4.0.0",
+        "@npmcli/node-gyp": "^5.0.0",
+        "@npmcli/package-json": "^7.0.0",
+        "@npmcli/query": "^5.0.0",
+        "@npmcli/redact": "^4.0.0",
+        "@npmcli/run-script": "^10.0.0",
+        "bin-links": "^6.0.0",
+        "cacache": "^20.0.1",
+        "common-ancestor-path": "^2.0.0",
+        "hosted-git-info": "^9.0.0",
+        "json-stringify-nice": "^1.1.4",
+        "lru-cache": "^11.2.1",
+        "minimatch": "^10.0.3",
+        "nopt": "^9.0.0",
+        "npm-install-checks": "^8.0.0",
+        "npm-package-arg": "^13.0.0",
+        "npm-pick-manifest": "^11.0.1",
+        "npm-registry-fetch": "^19.0.0",
+        "pacote": "^21.0.2",
+        "parse-conflict-json": "^5.0.1",
+        "proc-log": "^6.0.0",
+        "proggy": "^4.0.0",
+        "promise-all-reject-late": "^1.0.0",
+        "promise-call-limit": "^3.0.1",
+        "semver": "^7.3.7",
+        "ssri": "^13.0.0",
+        "treeverse": "^3.0.0",
+        "walk-up-path": "^4.0.0"
+      },
+      "bin": {
+        "arborist": "bin/index.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/fs": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-5.0.0.tgz",
+      "integrity": "sha512-7OsC1gNORBEawOa5+j2pXN9vsicaIOH5cPXxoR6fJOmH6/EXpJB2CajXOu1fPRFun2m1lktEFX11+P89hqO/og==",
+      "license": "ISC",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/git": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/git/-/git-7.0.2.tgz",
+      "integrity": "sha512-oeolHDjExNAJAnlYP2qzNjMX/Xi9bmu78C9dIGr4xjobrSKbuMYCph8lTzn4vnW3NjIqVmw/f8BCfouqyJXlRg==",
+      "license": "ISC",
+      "dependencies": {
+        "@gar/promise-retry": "^1.0.0",
+        "@npmcli/promise-spawn": "^9.0.0",
+        "ini": "^6.0.0",
+        "lru-cache": "^11.2.1",
+        "npm-pick-manifest": "^11.0.1",
+        "proc-log": "^6.0.0",
+        "semver": "^7.3.5",
+        "which": "^6.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/git/node_modules/ini": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-6.0.0.tgz",
+      "integrity": "sha512-IBTdIkzZNOpqm7q3dRqJvMaldXjDHWkEDfrwGEQTs5eaQMWV+djAhR+wahyNNMAa+qpbDUhBMVt4ZKNwpPm7xQ==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/installed-package-contents": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/installed-package-contents/-/installed-package-contents-4.0.0.tgz",
+      "integrity": "sha512-yNyAdkBxB72gtZ4GrwXCM0ZUedo9nIbOMKfGjt6Cu6DXf0p8y1PViZAKDC8q8kv/fufx0WTjRBdSlyrvnP7hmA==",
+      "license": "ISC",
+      "dependencies": {
+        "npm-bundled": "^5.0.0",
+        "npm-normalize-package-bin": "^5.0.0"
+      },
+      "bin": {
+        "installed-package-contents": "bin/index.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/map-workspaces": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/@npmcli/map-workspaces/-/map-workspaces-5.0.3.tgz",
+      "integrity": "sha512-o2grssXo1e774E5OtEwwrgoszYRh0lqkJH+Pb9r78UcqdGJRDRfhpM8DvZPjzNLLNYeD/rNbjOKM3Ss5UABROw==",
+      "license": "ISC",
+      "dependencies": {
+        "@npmcli/name-from-folder": "^4.0.0",
+        "@npmcli/package-json": "^7.0.0",
+        "glob": "^13.0.0",
+        "minimatch": "^10.0.3"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/metavuln-calculator": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-9.0.3.tgz",
+      "integrity": "sha512-94GLSYhLXF2t2LAC7pDwLaM4uCARzxShyAQKsirmlNcpidH89VA4/+K1LbJmRMgz5gy65E/QBBWQdUvGLe2Frg==",
+      "license": "ISC",
+      "dependencies": {
+        "cacache": "^20.0.0",
+        "json-parse-even-better-errors": "^5.0.0",
+        "pacote": "^21.0.0",
+        "proc-log": "^6.0.0",
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/name-from-folder": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/name-from-folder/-/name-from-folder-4.0.0.tgz",
+      "integrity": "sha512-qfrhVlOSqmKM8i6rkNdZzABj8MKEITGFAY+4teqBziksCQAOLutiAxM1wY2BKEd8KjUSpWmWCYxvXr0y4VTlPg==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/node-gyp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/node-gyp/-/node-gyp-5.0.0.tgz",
+      "integrity": "sha512-uuG5HZFXLfyFKqg8QypsmgLQW7smiRjVc45bqD/ofZZcR/uxEjgQU8qDPv0s9TEeMUiAAU/GC5bR6++UdTirIQ==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/package-json": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/@npmcli/package-json/-/package-json-7.0.5.tgz",
+      "integrity": "sha512-iVuTlG3ORq2iaVa1IWUxAO/jIp77tUKBhoMjuzYW2kL4MLN1bi/ofqkZ7D7OOwh8coAx1/S2ge0rMdGv8sLSOQ==",
+      "license": "ISC",
+      "dependencies": {
+        "@npmcli/git": "^7.0.0",
+        "glob": "^13.0.0",
+        "hosted-git-info": "^9.0.0",
+        "json-parse-even-better-errors": "^5.0.0",
+        "proc-log": "^6.0.0",
+        "semver": "^7.5.3",
+        "spdx-expression-parse": "^4.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/promise-spawn": {
+      "version": "9.0.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-9.0.2.tgz",
+      "integrity": "sha512-h7b1j0egrruBm/32eVA6/zMw5VJxxaB3vT+uVGGQ4SAAMrQVFHNuzL4+EAXn66j+huj0jApINc1fW3fC+kVoeA==",
+      "license": "ISC",
+      "dependencies": {
+        "which": "^6.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/query": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/query/-/query-5.0.0.tgz",
+      "integrity": "sha512-8TZWfTQOsODpLqo9SVhVjHovmKXNpevHU0gO9e+y4V4fRIOneiXy0u0sMP9LmS71XivrEWfZWg50ReH4WRT4aQ==",
+      "license": "ISC",
+      "dependencies": {
+        "postcss-selector-parser": "^7.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/redact": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/redact/-/redact-4.0.0.tgz",
+      "integrity": "sha512-gOBg5YHMfZy+TfHArfVogwgfBeQnKbbGo3pSUyK/gSI0AVu+pEiDVcKlQb0D8Mg1LNRZILZ6XG8I5dJ4KuAd9Q==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@npmcli/run-script": {
+      "version": "10.0.4",
+      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-10.0.4.tgz",
+      "integrity": "sha512-mGUWr1uMnf0le2TwfOZY4SFxZGXGfm4Jtay/nwAa2FLNAKXUoUwaGwBMNH36UHPtinWfTSJ3nqFQr0091CxVGg==",
+      "license": "ISC",
+      "dependencies": {
+        "@npmcli/node-gyp": "^5.0.0",
+        "@npmcli/package-json": "^7.0.0",
+        "@npmcli/promise-spawn": "^9.0.0",
+        "node-gyp": "^12.1.0",
+        "proc-log": "^6.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@opentelemetry/api": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
+      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@opentelemetry/api-logs": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.220.0.tgz",
+      "integrity": "sha512-CmVa4ImJ+ynfrPMNaAXHET6Bhb44SwzmfyVJFq9ni2jgXJR/l7C6gfVFddNmHP+ZOkP9cf4f9DBe68qVLTHc9w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@opentelemetry/context-async-hooks": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/context-async-hooks/-/context-async-hooks-2.12.0.tgz",
+      "integrity": "sha512-iK/1nD7mmZVkuYjVjkdFBiCvzntJdFny1S3CYbUYyOq7V5enL6XX+gJ7eh965L1LnS11VA8mQ7Ej/ck04SB0MQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/core": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.12.0.tgz",
+      "integrity": "sha512-1HsSAuvT4/my0QrXWsyXFdWjKaPeCHsismKZgEEIb8NK13LP6DrMRlsUbvD/0F9mDWK3xDom9AMv3IscxgOnOQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/exporter-trace-otlp-grpc": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-trace-otlp-grpc/-/exporter-trace-otlp-grpc-0.220.0.tgz",
+      "integrity": "sha512-bv1xmNhmNwIM6MdUBw4yYuJeVcEViVLk3uD69vOQMwueHBnfyl/u0HnBlB1FNY/Te0UOzJzvcbyR8wN6b+iGbA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@grpc/grpc-js": "^1.14.3",
+        "@opentelemetry/otlp-exporter-base": "0.220.0",
+        "@opentelemetry/otlp-grpc-exporter-base": "0.220.0",
+        "@opentelemetry/otlp-transformer": "0.220.0",
+        "@opentelemetry/sdk-trace": "2.9.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/exporter-zipkin": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-zipkin/-/exporter-zipkin-2.12.0.tgz",
+      "integrity": "sha512-XfHO6VxPkVD/QaXqgppdHK2DTqmtHLH06ggslhm5hVYAS+dwD3okaeIyhxXBbhmWn9HhCYcv285eK1TgyF0wYQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.12.0",
+        "@opentelemetry/resources": "2.12.0",
+        "@opentelemetry/sdk-trace": "2.12.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.0.0"
+      }
+    },
+    "node_modules/@opentelemetry/exporter-zipkin/node_modules/@opentelemetry/sdk-trace": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace/-/sdk-trace-2.12.0.tgz",
+      "integrity": "sha512-ImVuRQ6faOsTi1Wna88s2avgrrf/iDgXPigIeynkUhjstMuoQUDOJXgkez2j1mlU4btjXcXBGa+q7qKFYR3GsA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.12.0",
+        "@opentelemetry/resources": "2.12.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/instrumentation": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation/-/instrumentation-0.220.0.tgz",
+      "integrity": "sha512-xQx3E2WxP1mDvKzxLxX+CTCtNLa560YJZ3087qYHerl2YmiKpv7AH+dAy7vmx+eVrZ5BwhfWUAVoKOoxCNHcpw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.220.0",
+        "import-in-the-middle": "^3.0.0",
+        "require-in-the-middle": "^8.0.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/instrumentation-grpc": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/instrumentation-grpc/-/instrumentation-grpc-0.220.0.tgz",
+      "integrity": "sha512-U1EF8KKu52XwH2ybUkjVDmaVQZGf3mXirRSw1KJQrOV5aymgJgkPJV7+kRPqawZe0rpVc/BK+pPSyMWuQoyJJQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/instrumentation": "0.220.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/otlp-exporter-base": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.220.0.tgz",
+      "integrity": "sha512-CXYo8UD5Mn9YbgebO2EL4wejtA+gxLmLiu6HCk2KH2BR7XhFN6/6p1UlCb23DYCjeYkndevLHuejCCN1yx4+OQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/otlp-transformer": "0.220.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/otlp-exporter-base/node_modules/@opentelemetry/core": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.9.0.tgz",
+      "integrity": "sha512-m2nckMT80NnmjTYSPjJQObBJ+8dgkoajEOUbznL8AHZ3T3yHRk2P7gI1PhEBc1+lOnrYE9UWrWHqJDsmqjmNbw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/otlp-grpc-exporter-base": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-grpc-exporter-base/-/otlp-grpc-exporter-base-0.220.0.tgz",
+      "integrity": "sha512-/eIkBPMBTIvM3x/0mDX4aJeSkYifYClnBPr68PL1h5LV4VQv4+SV6CGrpiZ4fIWDnobVmhTWCm1J/QRdAWUfvA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@grpc/grpc-js": "^1.14.3",
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/otlp-exporter-base": "0.220.0",
+        "@opentelemetry/otlp-transformer": "0.220.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/otlp-grpc-exporter-base/node_modules/@opentelemetry/core": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.9.0.tgz",
+      "integrity": "sha512-m2nckMT80NnmjTYSPjJQObBJ+8dgkoajEOUbznL8AHZ3T3yHRk2P7gI1PhEBc1+lOnrYE9UWrWHqJDsmqjmNbw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/otlp-transformer": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.220.0.tgz",
+      "integrity": "sha512-lXGrv7KXZ0gNH9SVNUaa6vv6phVYGvJxfXAlMbzbakiXru75f5MZl8Z7oqiMMQD77riVHJCFlQvbZs/VVN2/4A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.220.0",
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/resources": "2.9.0",
+        "@opentelemetry/sdk-logs": "0.220.0",
+        "@opentelemetry/sdk-metrics": "2.9.0",
+        "@opentelemetry/sdk-trace": "2.9.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": "^1.3.0"
+      }
+    },
+    "node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/core": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.9.0.tgz",
+      "integrity": "sha512-m2nckMT80NnmjTYSPjJQObBJ+8dgkoajEOUbznL8AHZ3T3yHRk2P7gI1PhEBc1+lOnrYE9UWrWHqJDsmqjmNbw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/resources": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.9.0.tgz",
+      "integrity": "sha512-jyA5MBLQ+Dkl3+JsZkUoUvL7yHvU64kLsvpXKarWm6347Sl1t1bXFTFykUePNpT5WH5pm9a2Qtt03iIYQhZ1Fg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/resources": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.12.0.tgz",
+      "integrity": "sha512-+rSRoOdln6NhXTVcBdHSlZxJDNzwxadeweK2ltZO3tVtfp6aklABc06xclDk6ovRR+EiGgIcSbh/6NgjFhnb3A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.12.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-logs": {
+      "version": "0.220.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.220.0.tgz",
+      "integrity": "sha512-WywcTkQtv2iNmt+6y5Kcd4rzvx9bLVsBa2Nwcmg01IUaBTkTow3W4d9KE5vNBpEDtb9tp21WcRBY/lANRrApYA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api-logs": "0.220.0",
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/resources": "2.9.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.4.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-logs/node_modules/@opentelemetry/core": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.9.0.tgz",
+      "integrity": "sha512-m2nckMT80NnmjTYSPjJQObBJ+8dgkoajEOUbznL8AHZ3T3yHRk2P7gI1PhEBc1+lOnrYE9UWrWHqJDsmqjmNbw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-logs/node_modules/@opentelemetry/resources": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.9.0.tgz",
+      "integrity": "sha512-jyA5MBLQ+Dkl3+JsZkUoUvL7yHvU64kLsvpXKarWm6347Sl1t1bXFTFykUePNpT5WH5pm9a2Qtt03iIYQhZ1Fg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-metrics": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.9.0.tgz",
+      "integrity": "sha512-Xx8RGS4H5XEBl01WuCreMIpiah9cCXMbSkeuIePPdD2cUpq/vUzYmj8E/MK1OsbOc93FuAD4jfn2WOacKwLn7Q==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/resources": "2.9.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.9.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-metrics/node_modules/@opentelemetry/core": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.9.0.tgz",
+      "integrity": "sha512-m2nckMT80NnmjTYSPjJQObBJ+8dgkoajEOUbznL8AHZ3T3yHRk2P7gI1PhEBc1+lOnrYE9UWrWHqJDsmqjmNbw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-metrics/node_modules/@opentelemetry/resources": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.9.0.tgz",
+      "integrity": "sha512-jyA5MBLQ+Dkl3+JsZkUoUvL7yHvU64kLsvpXKarWm6347Sl1t1bXFTFykUePNpT5WH5pm9a2Qtt03iIYQhZ1Fg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace/-/sdk-trace-2.9.0.tgz",
+      "integrity": "sha512-sGA19HvtrrSKYsseHphluH6j3p6Xa3fqc7c7y8f/7mYWejc1lyDFcpSdD1kYa50HCLUeEo4zA5bW0pniaPszuw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/resources": "2.9.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace-base": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.12.0.tgz",
+      "integrity": "sha512-JOERgZCxRM06FEJ5kEWxlSRChah6MmXDx3KwCruqEv/iEyLkTokCSemf2y1w8oIHtfrr8EVTpzebq/31vn2Cpg==",
+      "deprecated": "Use @opentelemetry/sdk-trace package",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.12.0",
+        "@opentelemetry/resources": "2.12.0",
+        "@opentelemetry/sdk-trace": "2.12.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace-base/node_modules/@opentelemetry/sdk-trace": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace/-/sdk-trace-2.12.0.tgz",
+      "integrity": "sha512-ImVuRQ6faOsTi1Wna88s2avgrrf/iDgXPigIeynkUhjstMuoQUDOJXgkez2j1mlU4btjXcXBGa+q7qKFYR3GsA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.12.0",
+        "@opentelemetry/resources": "2.12.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace-node": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-node/-/sdk-trace-node-2.12.0.tgz",
+      "integrity": "sha512-9DufH1IlmQMoKAfot5y/FhTP1RnmhLb5K6eKmJO/bvzPjYwPAazoiAUbTZFdPbqxOXN0FEbhZx/e6SB1Og4jmg==",
+      "deprecated": "Use @opentelemetry/sdk-trace package",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/context-async-hooks": "2.12.0",
+        "@opentelemetry/core": "2.12.0",
+        "@opentelemetry/sdk-trace-base": "2.12.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace/node_modules/@opentelemetry/core": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.9.0.tgz",
+      "integrity": "sha512-m2nckMT80NnmjTYSPjJQObBJ+8dgkoajEOUbznL8AHZ3T3yHRk2P7gI1PhEBc1+lOnrYE9UWrWHqJDsmqjmNbw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.0.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/sdk-trace/node_modules/@opentelemetry/resources": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.9.0.tgz",
+      "integrity": "sha512-jyA5MBLQ+Dkl3+JsZkUoUvL7yHvU64kLsvpXKarWm6347Sl1t1bXFTFykUePNpT5WH5pm9a2Qtt03iIYQhZ1Fg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/core": "2.9.0",
+        "@opentelemetry/semantic-conventions": "^1.29.0"
+      },
+      "engines": {
+        "node": "^18.19.0 || >=20.6.0"
+      },
+      "peerDependencies": {
+        "@opentelemetry/api": ">=1.3.0 <1.10.0"
+      }
+    },
+    "node_modules/@opentelemetry/semantic-conventions": {
+      "version": "1.44.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.44.0.tgz",
+      "integrity": "sha512-E3JkOlMBi3N8OGGkbl7tFyqk2MAS6/lySRZBK3Mu7AzjF1fT8oIChH9ChE48SUWzDn9Kdwta+G/p5LJ4xW4CLQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@protobufjs/aspromise": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
+      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/base64": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
+      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/codegen": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
+      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/eventemitter": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
+      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/fetch": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
+      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.1"
+      }
+    },
+    "node_modules/@protobufjs/float": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
+      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/path": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
+      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/pool": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
+      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/utf8": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.2.tgz",
+      "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@pulumi/aws": {
+      "version": "7.52.1",
+      "resolved": "https://registry.npmjs.org/@pulumi/aws/-/aws-7.52.1.tgz",
+      "integrity": "sha512-EkiZJacWBqwxq+LLeiDA131OWaoFGAnPKKx8aCpcn6lWKyYNqdZIgUhY8OrHefYtirWL5rnabDuPJ9YuluTPQQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@pulumi/pulumi": "^3.142.0",
+        "mime": "^2.0.0"
+      }
+    },
+    "node_modules/@pulumi/pulumi": {
+      "version": "3.273.0",
+      "resolved": "https://registry.npmjs.org/@pulumi/pulumi/-/pulumi-3.273.0.tgz",
+      "integrity": "sha512-Yh2k0Kry4u5LM730KUO5HZFnqHdlW9ypoQ8zgO0Tqam1G6urFXjIUTUaLxvWrdsm6gKCoyVS6CPdeOGcV+Msvg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@grpc/grpc-js": "^1.10.1",
+        "@logdna/tail-file": "^2.0.6",
+        "@npmcli/arborist": "^9.0.0",
+        "@opentelemetry/api": "^1.9",
+        "@opentelemetry/core": "^2.9",
+        "@opentelemetry/exporter-trace-otlp-grpc": "^0.220",
+        "@opentelemetry/exporter-zipkin": "^2.9",
+        "@opentelemetry/instrumentation": "^0.220",
+        "@opentelemetry/instrumentation-grpc": "^0.220",
+        "@opentelemetry/resources": "^2.9",
+        "@opentelemetry/sdk-trace-base": "^2.9",
+        "@opentelemetry/sdk-trace-node": "^2.9",
+        "@opentelemetry/semantic-conventions": "^1.42",
+        "@types/google-protobuf": "^3.15.5",
+        "@types/semver": "^7.5.6",
+        "execa": "^5.1.0",
+        "google-protobuf": "^3.21.4",
+        "ini": "^2.0.0",
+        "js-yaml": "^4.3.2",
+        "minimist": "^1.2.6",
+        "normalize-package-data": "^6.0.0",
+        "require-from-string": "^2.0.1",
+        "semver": "^7.5.2",
+        "source-map-support": "^0.5.6",
+        "upath": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "peerDependencies": {
+        "ts-node": ">= 7.0.1 < 12",
+        "typescript": ">= 3.8.3 < 7"
+      },
+      "peerDependenciesMeta": {
+        "ts-node": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@sigstore/bundle": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-4.0.0.tgz",
+      "integrity": "sha512-NwCl5Y0V6Di0NexvkTqdoVfmjTaQwoLM236r89KEojGmq/jMls8S+zb7yOwAPdXvbwfKDlP+lmXgAL4vKSQT+A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@sigstore/protobuf-specs": "^0.5.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@sigstore/core": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-3.2.1.tgz",
+      "integrity": "sha512-qRsxPnCrbC/puegGxKuynfnxgLiHqWStrSjxkoB4YKqq3Z3s4cyZyj42ZdWFAEblNP65C+rBH8EuREHIXoi83g==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@sigstore/protobuf-specs": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.5.2.tgz",
+      "integrity": "sha512-SQqvFMt4V78fdjcDdYX6HbiVSOR4QK3ZgwCa2KOsopAgPIHy1rU5UDUmzLl02r5oyyaYcYHR1hpwDRk/yUe+Mw==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/@sigstore/sign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/@sigstore/sign/-/sign-4.1.1.tgz",
+      "integrity": "sha512-Hf4xglukg0XXQ2RiD5vSoLjdPe8OBUPA8XeVjUObheuDcWdYWrnH/BNmxZCzkAy68MzmNCxXLeurJvs6hcP2OQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@gar/promise-retry": "^1.0.2",
+        "@sigstore/bundle": "^4.0.0",
+        "@sigstore/core": "^3.2.0",
+        "@sigstore/protobuf-specs": "^0.5.0",
+        "make-fetch-happen": "^15.0.4",
+        "proc-log": "^6.1.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@sigstore/tuf": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-4.0.2.tgz",
+      "integrity": "sha512-TCAzTy0xzdP79EnxSjq9KQ3eaR7+FmudLC6eRKknVKZbV7ZNlGLClAAQb/HMNJ5n2OBNk2GT1tEmU0xuPr+SLQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@sigstore/protobuf-specs": "^0.5.0",
+        "tuf-js": "^4.1.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@sigstore/verify": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@sigstore/verify/-/verify-3.1.1.tgz",
+      "integrity": "sha512-qv7+G3J2cc6wwFj3yKvXOamzqhMwSk1ogPGmhpS8iXllcPrJaIIBA+4HbttlHVu1pqWTdmaCH/WE7UOC51kdoA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@sigstore/bundle": "^4.0.0",
+        "@sigstore/core": "^3.2.1",
+        "@sigstore/protobuf-specs": "^0.5.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@tufjs/canonical-json": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@tufjs/canonical-json/-/canonical-json-2.0.0.tgz",
+      "integrity": "sha512-yVtV8zsdo8qFHe+/3kw81dSLyF7D576A5cCFCi4X7B39tWT7SekaEFUnvnWJHz+9qO7qJTah1JbrDjWKqFtdWA==",
+      "license": "MIT",
+      "engines": {
+        "node": "^16.14.0 || >=18.0.0"
+      }
+    },
+    "node_modules/@tufjs/models": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/@tufjs/models/-/models-4.1.0.tgz",
+      "integrity": "sha512-Y8cK9aggNRsqJVaKUlEYs4s7CvQ1b1ta2DVPyAimb0I2qhzjNk+A+mxvll/klL0RlfuIUei8BF7YWiua4kQqww==",
+      "license": "MIT",
+      "dependencies": {
+        "@tufjs/canonical-json": "2.0.0",
+        "minimatch": "^10.1.1"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/@types/google-protobuf": {
+      "version": "3.15.12",
+      "resolved": "https://registry.npmjs.org/@types/google-protobuf/-/google-protobuf-3.15.12.tgz",
+      "integrity": "sha512-40um9QqwHjRS92qnOaDpL7RmDK15NuZYo9HihiJRbYkMQZlWnuH8AdvbMy8/o6lgLmKbDUKa+OALCltHdbOTpQ==",
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "26.6.6",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.6.tgz",
+      "integrity": "sha512-MzQj+8Kx3XI40OmUAE6Qoh58ZMNstNNMwn2nfd3qWsfe7nDNSqJNzes4njhz6AHwrSHOffSLwXU6yb474Q4aog==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.9.0"
+      }
+    },
+    "node_modules/@types/semver": {
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==",
+      "license": "MIT"
+    },
+    "node_modules/abbrev": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-4.0.0.tgz",
+      "integrity": "sha512-a1wflyaL0tHtJSmLSOVybYhy22vRih4eduhhrkcjgrWGnRfrZtovJ2FRjxuTtkkj47O/baf0R86QU5OuYpz8fA==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
+    },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/bin-links": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-6.0.3.tgz",
+      "integrity": "sha512-Qg5FD7/YSReWJB1zaM8VIi1l4O637JKK/WPaF/JzJGy/9FcMDWtSklF0dOX5S9X2OMrPGhifIHIKuwtHG0IGFg==",
+      "license": "ISC",
+      "dependencies": {
+        "cmd-shim": "^8.0.0",
+        "npm-normalize-package-bin": "^5.0.0",
+        "proc-log": "^6.0.0",
+        "read-cmd-shim": "^6.0.0",
+        "write-file-atomic": "^7.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "license": "MIT"
+    },
+    "node_modules/cacache": {
+      "version": "20.0.4",
+      "resolved": "https://registry.npmjs.org/cacache/-/cacache-20.0.4.tgz",
+      "integrity": "sha512-M3Lab8NPYlZU2exsL3bMVvMrMqgwCnMWfdZbK28bn3pK6APT/Te/I8hjRPNu1uwORY9a1eEQoifXbKPQMfMTOA==",
+      "license": "ISC",
+      "dependencies": {
+        "@npmcli/fs": "^5.0.0",
+        "fs-minipass": "^3.0.0",
+        "glob": "^13.0.0",
+        "lru-cache": "^11.1.0",
+        "minipass": "^7.0.3",
+        "minipass-collect": "^2.0.1",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "p-map": "^7.0.2",
+        "ssri": "^13.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/cjs-module-lexer": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.3.0.tgz",
+      "integrity": "sha512-lmNyBzi6iYiqyrExTctfmjd8tInx+dHu9PBomTfH5RXS53c27JMFJgzNv5TyAnm3PgGf+MLy0+Ws41/HlVxdKQ==",
+      "license": "MIT"
+    },
+    "node_modules/cliui": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.1",
+        "wrap-ansi": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/cmd-shim": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/cmd-shim/-/cmd-shim-8.0.0.tgz",
+      "integrity": "sha512-Jk/BK6NCapZ58BKUxlSI+ouKRbjH1NLZCgJkYoab+vEHUY3f6OzpNBN9u7HFSv9J6TRDGs4PLOHezoKGaFRSCA==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "license": "MIT"
+    },
+    "node_modules/common-ancestor-path": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/common-ancestor-path/-/common-ancestor-path-2.0.0.tgz",
+      "integrity": "sha512-dnN3ibLeoRf2HNC+OlCiNc5d2zxbLJXOtiZUudNFSXZrNSydxcCsSpRzXwfu7BBWCIfHPw+xTayeBvJCP/D8Ng==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/cross-spawn/node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/cross-spawn/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/cssesc": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
+      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+      "license": "MIT",
+      "bin": {
+        "cssesc": "bin/cssesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/env-paths": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
+      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/es-module-lexer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-3.0.4.tgz",
+      "integrity": "sha512-BldNY5mwkVu+cQ5Ymn3e6hB9Sx8XHx4ZevWbiUyZbfKxJxYO27Hf0wfzkxIaD5CAJMaGl3YspKELj0ff/7nCMA==",
+      "license": "MIT"
+    },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/execa": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+      "license": "MIT",
+      "dependencies": {
+        "cross-spawn": "^7.0.3",
+        "get-stream": "^6.0.0",
+        "human-signals": "^2.1.0",
+        "is-stream": "^2.0.0",
+        "merge-stream": "^2.0.0",
+        "npm-run-path": "^4.0.1",
+        "onetime": "^5.1.2",
+        "signal-exit": "^3.0.3",
+        "strip-final-newline": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/execa?sponsor=1"
+      }
+    },
+    "node_modules/exponential-backoff": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
+      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fs-minipass": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
+      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+      }
+    },
+    "node_modules/get-caller-file": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "license": "ISC",
+      "engines": {
+        "node": "6.* || 8.* || >= 10.*"
+      }
+    },
+    "node_modules/get-stream": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/glob": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-14.0.3.tgz",
+      "integrity": "sha512-A1vjIwC3qpdCso45Iw127gnp7sPhqgY8lUQhDrArIs+GbmfaaVPFuoyy7WyLT9EPZCRZ7j7aLdwUhQmHWesEow==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^11.0.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^3.0.0"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/google-protobuf": {
+      "version": "3.21.4",
+      "resolved": "https://registry.npmjs.org/google-protobuf/-/google-protobuf-3.21.4.tgz",
+      "integrity": "sha512-MnG7N936zcKTco4Jd2PX2U96Kf9PxygAPKBug+74LHzmHXmceN16MmRcdgZv+DGef/S9YvQAfRsNCn4cjf9yyQ==",
+      "license": "(BSD-3-Clause AND Apache-2.0)"
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "license": "ISC"
+    },
+    "node_modules/hosted-git-info": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.3.tgz",
+      "integrity": "sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==",
+      "license": "ISC",
+      "dependencies": {
+        "lru-cache": "^11.1.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/http-cache-semantics": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz",
+      "integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==",
+      "license": "BSD-2-Clause"
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/human-signals": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
+      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=10.17.0"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/ignore-walk": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-8.0.0.tgz",
+      "integrity": "sha512-FCeMZT4NiRQGh+YkeKMtWrOmBgWjHjMJ26WQWrRQyoyzqevdaGSakUaJW5xQYmjLlUVk2qUnCjYVBax9EKKg8A==",
+      "license": "ISC",
+      "dependencies": {
+        "minimatch": "^10.0.3"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/import-in-the-middle": {
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/import-in-the-middle/-/import-in-the-middle-3.5.3.tgz",
+      "integrity": "sha512-usm/IiY63VtOyx/dm7uEoZV+EsanCDmwRUroQZIkFLGu1NVXZ8mZqIOhaN4QIJ7EsbMTuQbJXwCySCx+ozMA8g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "cjs-module-lexer": "^2.2.0",
+        "es-module-lexer": "^3.0.3",
+        "module-details-from-path": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/ini": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-2.0.0.tgz",
+      "integrity": "sha512-7PnF4oN3CvZF23ADhA5wRaYEQpJ8qygSkbtTXWBeXWXmEVRXK+1ITciHWwHhsjv1TmW0MgacIv6hEi5pX5NQdA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ip-address": {
+      "version": "10.7.5",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz",
+      "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz",
+      "integrity": "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/js-yaml": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/json-parse-even-better-errors": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-5.0.0.tgz",
+      "integrity": "sha512-ZF1nxZ28VhQouRWhUcVlUIN3qwSgPuswK05s/HIaoetAoE/9tngVmCHjSxmSQPav1nd+lPtTL0YZ/2AFdR/iYQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/json-stringify-nice": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/json-stringify-nice/-/json-stringify-nice-1.1.4.tgz",
+      "integrity": "sha512-5Z5RFW63yxReJ7vANgW6eZFGWaQvnPE3WNmZoOJrSkGju2etKA2L5rrOa1sm877TVTFt57A80BH1bArcmlLfPw==",
+      "license": "ISC",
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jsonparse": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz",
+      "integrity": "sha512-POQXvpdL69+CluYsillJ7SUhKvytYjW9vG/GKpnf+xP8UWgYEM/RaMzHHofbALDiKbbP1W8UEYmgGl39WkPZsg==",
+      "engines": [
+        "node >= 0.2.0"
+      ],
+      "license": "MIT"
+    },
+    "node_modules/just-diff": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/just-diff/-/just-diff-6.0.2.tgz",
+      "integrity": "sha512-S59eriX5u3/QhMNq3v/gm8Kd0w8OS6Tz2FS1NG4blv+z0MuQcBRJyFWjdovM0Rad4/P4aUPFtnkNjMjyMlMSYA==",
+      "license": "MIT"
+    },
+    "node_modules/just-diff-apply": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/just-diff-apply/-/just-diff-apply-5.5.0.tgz",
+      "integrity": "sha512-OYTthRfSh55WOItVqwpefPtNt2VdKsq5AnAK6apdtR6yCH8pr0CmSr710J0Mf+WdQy7K/OzMy7K2MgAfdQURDw==",
+      "license": "MIT"
+    },
+    "node_modules/lodash.camelcase": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/lodash.camelcase/-/lodash.camelcase-4.3.0.tgz",
+      "integrity": "sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==",
+      "license": "MIT"
+    },
+    "node_modules/long": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
+      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/lru-cache": {
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/make-fetch-happen": {
+      "version": "15.0.6",
+      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-15.0.6.tgz",
+      "integrity": "sha512-Je0fLJ0F5atA7F+eIlLzk+Wkcl57JDf4kf+EW8xiP5E31xOQxkIxTbgf1Oi1Lw9tRI9UEMRdI5Vz2xTzoNU1Jw==",
+      "license": "ISC",
+      "dependencies": {
+        "@gar/promise-retry": "^1.0.0",
+        "@npmcli/agent": "^4.0.0",
+        "@npmcli/redact": "^4.0.0",
+        "cacache": "^20.0.1",
+        "http-cache-semantics": "^4.1.1",
+        "minipass": "^7.0.2",
+        "minipass-fetch": "^5.0.0",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "negotiator": "^1.0.0",
+        "proc-log": "^6.0.0",
+        "ssri": "^13.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/merge-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
+      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
+      "license": "MIT"
+    },
+    "node_modules/mime": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
+      "integrity": "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/mimic-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
+      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz",
+      "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/nonrecursive-glob-match": "^1.0.3",
+        "brace-expansion": "^5.0.12"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/minipass-collect": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
+      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/minipass-fetch": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-5.0.2.tgz",
+      "integrity": "sha512-2d0q2a8eCi2IRg/IGubCNRJoYbA1+YPXAzQVRFmB45gdGZafyivnZ5YSEfo3JikbjGxOdntGFvBQGqaSMXlAFQ==",
+      "license": "MIT",
+      "dependencies": {
+        "minipass": "^7.0.3",
+        "minipass-sized": "^2.0.0",
+        "minizlib": "^3.0.1"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      },
+      "optionalDependencies": {
+        "iconv-lite": "^0.7.2"
+      }
+    },
+    "node_modules/minipass-flush": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz",
+      "integrity": "sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/minipass-flush/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-flush/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "license": "ISC"
+    },
+    "node_modules/minipass-pipeline": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
+      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-pipeline/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-pipeline/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "license": "ISC"
+    },
+    "node_modules/minipass-sized": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-2.0.0.tgz",
+      "integrity": "sha512-zSsHhto5BcUVM2m1LurnXY6M//cGhVaegT71OfOXoprxT6o780GZd792ea6FfrQkuU4usHZIUczAQMRUE2plzA==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "license": "MIT",
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/module-details-from-path": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.4.tgz",
+      "integrity": "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==",
+      "license": "MIT"
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
+      "integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/node-gyp": {
+      "version": "12.4.0",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-12.4.0.tgz",
+      "integrity": "sha512-OMcPNvqTCFUnNaBlmdgq+lfNqY7gTiSmNRDjY3uAXRyudeKZEZxu3CLtjMQrx4zZxCX2b/mpNqTtwuCJgXhHkw==",
+      "license": "MIT",
+      "dependencies": {
+        "env-paths": "^2.2.0",
+        "exponential-backoff": "^3.1.1",
+        "graceful-fs": "^4.2.6",
+        "nopt": "^9.0.0",
+        "proc-log": "^6.0.0",
+        "semver": "^7.3.5",
+        "tar": "^7.5.4",
+        "tinyglobby": "^0.2.12",
+        "undici": "^6.25.0",
+        "which": "^6.0.0"
+      },
+      "bin": {
+        "node-gyp": "bin/node-gyp.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/nopt": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-9.0.0.tgz",
+      "integrity": "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw==",
+      "license": "ISC",
+      "dependencies": {
+        "abbrev": "^4.0.0"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/normalize-package-data": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-6.0.2.tgz",
+      "integrity": "sha512-V6gygoYb/5EmNI+MEGrWkC+e6+Rr7mTmfHrxDbLzxQogBkgzo76rkok0Am6thgSF7Mv2nLOajAJj5vDJZEFn7g==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "hosted-git-info": "^7.0.0",
+        "semver": "^7.3.5",
+        "validate-npm-package-license": "^3.0.4"
+      },
+      "engines": {
+        "node": "^16.14.0 || >=18.0.0"
+      }
+    },
+    "node_modules/normalize-package-data/node_modules/hosted-git-info": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-7.0.2.tgz",
+      "integrity": "sha512-puUZAUKT5m8Zzvs72XWy3HtvVbTWljRE66cP60bxJzAqf2DgICo7lYTY2IHUmLnNpjYvw5bvmoHvPc0QO2a62w==",
+      "license": "ISC",
+      "dependencies": {
+        "lru-cache": "^10.0.1"
+      },
+      "engines": {
+        "node": "^16.14.0 || >=18.0.0"
+      }
+    },
+    "node_modules/normalize-package-data/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "license": "ISC"
+    },
+    "node_modules/npm-bundled": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/npm-bundled/-/npm-bundled-5.0.0.tgz",
+      "integrity": "sha512-JLSpbzh6UUXIEoqPsYBvVNVmyrjVZ1fzEFbqxKkTJQkWBO3xFzFT+KDnSKQWwOQNbuWRwt5LSD6HOTLGIWzfrw==",
+      "license": "ISC",
+      "dependencies": {
+        "npm-normalize-package-bin": "^5.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/npm-install-checks": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/npm-install-checks/-/npm-install-checks-8.0.0.tgz",
+      "integrity": "sha512-ScAUdMpyzkbpxoNekQ3tNRdFI8SJ86wgKZSQZdUxT+bj0wVFpsEMWnkXP0twVe1gJyNF5apBWDJhhIbgrIViRA==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "semver": "^7.1.1"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/npm-normalize-package-bin": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-5.0.0.tgz",
+      "integrity": "sha512-CJi3OS4JLsNMmr2u07OJlhcrPxCeOeP/4xq67aWNai6TNWWbTrlNDgl8NcFKVlcBKp18GPj+EzbNIgrBfZhsag==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/npm-package-arg": {
+      "version": "13.0.2",
+      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-13.0.2.tgz",
+      "integrity": "sha512-IciCE3SY3uE84Ld8WZU23gAPPV9rIYod4F+rc+vJ7h7cwAJt9Vk6TVsK60ry7Uj3SRS3bqRRIGuTp9YVlk6WNA==",
+      "license": "ISC",
+      "dependencies": {
+        "hosted-git-info": "^9.0.0",
+        "proc-log": "^6.0.0",
+        "semver": "^7.3.5",
+        "validate-npm-package-name": "^7.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/npm-packlist": {
+      "version": "10.0.4",
+      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-10.0.4.tgz",
+      "integrity": "sha512-uMW73iajD8hiH4ZBxEV3HC+eTnppIqwakjOYuvgddnalIw2lJguKviK1pcUJDlIWm1wSJkchpDZDSVVsZEYRng==",
+      "license": "ISC",
+      "dependencies": {
+        "ignore-walk": "^8.0.0",
+        "proc-log": "^6.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/npm-pick-manifest": {
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-11.0.3.tgz",
+      "integrity": "sha512-buzyCfeoGY/PxKqmBqn1IUJrZnUi1VVJTdSSRPGI60tJdUhUoSQFhs0zycJokDdOznQentgrpf8LayEHyyYlqQ==",
+      "license": "ISC",
+      "dependencies": {
+        "npm-install-checks": "^8.0.0",
+        "npm-normalize-package-bin": "^5.0.0",
+        "npm-package-arg": "^13.0.0",
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/npm-registry-fetch": {
+      "version": "19.1.1",
+      "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-19.1.1.tgz",
+      "integrity": "sha512-TakBap6OM1w0H73VZVDf44iFXsOS3h+L4wVMXmbWOQroZgFhMch0juN6XSzBNlD965yIKvWg2dfu7NSiaYLxtw==",
+      "license": "ISC",
+      "dependencies": {
+        "@npmcli/redact": "^4.0.0",
+        "jsonparse": "^1.3.1",
+        "make-fetch-happen": "^15.0.0",
+        "minipass": "^7.0.2",
+        "minipass-fetch": "^5.0.0",
+        "minizlib": "^3.0.1",
+        "npm-package-arg": "^13.0.0",
+        "proc-log": "^6.0.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/npm-run-path": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/onetime": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
+      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-fn": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-map": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.1.1.tgz",
+      "integrity": "sha512-6Lh3jQPLthYujSrlw6ccWXBGZTkoTCz27Hd92g79LH/kjAbgoEu0t442cCCNbegPSJsA0lwDX8z0bcKtkpA32g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/pacote": {
+      "version": "21.5.2",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-21.5.2.tgz",
+      "integrity": "sha512-rifBXawDMv3nLvABWr1kTpSk0UjeglTT4Vt9t8nU9xSnfdZcCTy+FOjO6TgXWAS77lIfbZlRkl2eKQcdY0++jA==",
+      "license": "ISC",
+      "dependencies": {
+        "@gar/promise-retry": "^1.0.0",
+        "@npmcli/git": "^7.0.0",
+        "@npmcli/installed-package-contents": "^4.0.0",
+        "@npmcli/package-json": "^7.0.0",
+        "@npmcli/promise-spawn": "^9.0.0",
+        "@npmcli/run-script": "^10.0.0",
+        "cacache": "^20.0.0",
+        "fs-minipass": "^3.0.0",
+        "minipass": "^7.0.2",
+        "npm-package-arg": "^13.0.0",
+        "npm-packlist": "^10.0.1",
+        "npm-pick-manifest": "^11.0.1",
+        "npm-registry-fetch": "^19.0.0",
+        "proc-log": "^6.0.0",
+        "sigstore": "^4.0.0",
+        "ssri": "^13.0.0",
+        "tar": "^7.4.3"
+      },
+      "bin": {
+        "pacote": "bin/index.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/parse-conflict-json": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/parse-conflict-json/-/parse-conflict-json-5.0.1.tgz",
+      "integrity": "sha512-ZHEmNKMq1wyJXNwLxyHnluPfRAFSIliBvbK/UiOceROt4Xh9Pz0fq49NytIaeaCUf5VR86hwQ/34FCcNU5/LKQ==",
+      "license": "ISC",
+      "dependencies": {
+        "json-parse-even-better-errors": "^5.0.0",
+        "just-diff": "^6.0.0",
+        "just-diff-apply": "^5.2.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-3.0.0.tgz",
+      "integrity": "sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/postcss-selector-parser": {
+      "version": "7.1.7",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.7.tgz",
+      "integrity": "sha512-wWBro/7hJ40ye6TPiXkUQoXKCw23xSsjriUvqd7Uls9Sso3oLiON1flc18cCdnjgCRXw4fBVqUJJeOdDTh3P3g==",
+      "license": "MIT",
+      "dependencies": {
+        "cssesc": "^3.0.0",
+        "util-deprecate": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/proc-log": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-6.1.0.tgz",
+      "integrity": "sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/proggy": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/proggy/-/proggy-4.0.0.tgz",
+      "integrity": "sha512-MbA4R+WQT76ZBm/5JUpV9yqcJt92175+Y0Bodg3HgiXzrmKu7Ggq+bpn6y6wHH+gN9NcyKn3yg1+d47VaKwNAQ==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/promise-all-reject-late": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/promise-all-reject-late/-/promise-all-reject-late-1.0.1.tgz",
+      "integrity": "sha512-vuf0Lf0lOxyQREH7GDIOUMLS7kz+gs8i6B+Yi8dC68a2sychGrHTJYghMBD6k7eUcH0H5P73EckCA48xijWqXw==",
+      "license": "ISC",
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/promise-call-limit": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/promise-call-limit/-/promise-call-limit-3.0.2.tgz",
+      "integrity": "sha512-mRPQO2T1QQVw11E7+UdCJu7S61eJVWknzml9sC1heAdj1jxl0fWMBypIt9ZOcLFf8FkG995ZD7RnVk7HH72fZw==",
+      "license": "ISC",
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/protobufjs": {
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
+      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
+        "@types/node": ">=13.7.0",
+        "long": "^5.3.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/read-cmd-shim": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/read-cmd-shim/-/read-cmd-shim-6.0.0.tgz",
+      "integrity": "sha512-1zM5HuOfagXCBWMN83fuFI/x+T/UhZ7k+KIzhrHXcQoeX5+7gmaDYjELQHmmzIodumBHeByBJT4QYS7ufAgs7A==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/require-in-the-middle": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/require-in-the-middle/-/require-in-the-middle-8.0.1.tgz",
+      "integrity": "sha512-QT7FVMXfWOYFbeRBF6nu+I6tr2Tf3u0q8RIEjNob/heKY/nh7drD/k7eeMFmSQgnTtCzLDcCu/XEnpW2wk4xCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.3.5",
+        "module-details-from-path": "^1.0.3"
+      },
+      "engines": {
+        "node": ">=9.3.0 || >=8.10.0 <9.0.0"
+      }
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "license": "ISC"
+    },
+    "node_modules/sigstore": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-4.1.1.tgz",
+      "integrity": "sha512-endqECJkfhozrXMK5ngu/UAA0xVcVEFdnHJCElGaExypjW+HK5i6zu3NteLoaX/iFbRUbC3+DjttQs0GARr+5w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@sigstore/bundle": "^4.0.0",
+        "@sigstore/core": "^3.2.1",
+        "@sigstore/protobuf-specs": "^0.5.0",
+        "@sigstore/sign": "^4.1.1",
+        "@sigstore/tuf": "^4.0.2",
+        "@sigstore/verify": "^3.1.1"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/smart-buffer": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks": {
+      "version": "2.8.10",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.10.tgz",
+      "integrity": "sha512-e0VyvkVTwVYViNovRkZ9aodhxVlyoMn7eJhVUPxZ+eK9P/7CBkxvvsBOHqFPEH416726W8tLXXXjKwqgTErrCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ip-address": "^10.1.1",
+        "smart-buffer": "^4.2.0"
+      },
+      "engines": {
+        "node": ">= 10.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks-proxy-agent": {
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
+      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "^4.3.4",
+        "socks": "^2.8.3"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "node_modules/spdx-correct": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
+      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "spdx-expression-parse": "^3.0.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-correct/node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-exceptions": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
+      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
+      "license": "CC-BY-3.0"
+    },
+    "node_modules/spdx-expression-parse": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-4.0.0.tgz",
+      "integrity": "sha512-Clya5JIij/7C6bRR22+tnGXbc4VKlibKSVj2iHvVeX5iMW7s1SIQlqu699JkODJJIhh/pUu8L0/VLh8xflD+LQ==",
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-license-ids": {
+      "version": "3.0.24",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.24.tgz",
+      "integrity": "sha512-cLS9TtWkIQFyLkJ3/5aFQAOHOSKTlOs/7WDut/XPSdjom1fJhUdkepeJAKXa9Y05+FabHd0sti+Et559vDtkpQ==",
+      "license": "CC0-1.0"
+    },
+    "node_modules/ssri": {
+      "version": "13.0.1",
+      "resolved": "https://registry.npmjs.org/ssri/-/ssri-13.0.1.tgz",
+      "integrity": "sha512-QUiRf1+u9wPTL/76GTYlKttDEBWV1ga9ZXW8BG6kfdeyyM8LGPix9gROyg9V2+P0xNyF3X2Go526xKFdMZrHSQ==",
+      "license": "ISC",
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-final-newline": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
+      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/tar": {
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/treeverse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/treeverse/-/treeverse-3.0.0.tgz",
+      "integrity": "sha512-gcANaAnd2QDZFmHFEOF4k7uc1J/6a6z3DJMd/QwEyxLoKGiptJRwid582r7QIsFlFMIZ3SnxfS52S4hm2DHkuQ==",
+      "license": "ISC",
+      "engines": {
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+      }
+    },
+    "node_modules/tuf-js": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/tuf-js/-/tuf-js-4.1.0.tgz",
+      "integrity": "sha512-50QV99kCKH5P/Vs4E2Gzp7BopNV+KzTXqWeaxrfu5IQJBOULRsTIS9seSsOVT8ZnGXzCyx55nYWAi4qJzpZKEQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tufjs/models": "4.1.0",
+        "debug": "^4.4.3",
+        "make-fetch-happen": "^15.0.1"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/undici": {
+      "version": "6.29.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",
+      "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "license": "MIT"
+    },
+    "node_modules/upath": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/upath/-/upath-1.2.0.tgz",
+      "integrity": "sha512-aZwGpamFO61g3OlfT7OQCHqhGnW43ieH9WZeP7QxN/G/jS4jfqUkZxoryvJgVPEcrl5NL/ggHsSmLMHuH64Lhg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4",
+        "yarn": "*"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/validate-npm-package-license": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
+      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "spdx-correct": "^3.0.0",
+        "spdx-expression-parse": "^3.0.0"
+      }
+    },
+    "node_modules/validate-npm-package-license/node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/validate-npm-package-name": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-7.0.2.tgz",
+      "integrity": "sha512-hVDIBwsRruT73PbK7uP5ebUt+ezEtCmzZz3F59BSr2F6OVFnJ/6h8liuvdLrQ88Xmnk6/+xGGuq+pG9WwTuy3A==",
+      "license": "ISC",
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/walk-up-path": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/walk-up-path/-/walk-up-path-4.0.0.tgz",
+      "integrity": "sha512-3hu+tD8YzSLGuFYtPRb48vdhKMi0KQV5sn+uWr8+7dMEq/2G/dtLrdDinkLjqq5TIbIBjYJ4Ax/n3YiaW7QM8A==",
+      "license": "ISC",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/which": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/which/-/which-6.0.1.tgz",
+      "integrity": "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg==",
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^4.0.0"
+      },
+      "bin": {
+        "node-which": "bin/which.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/write-file-atomic": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-7.0.1.tgz",
+      "integrity": "sha512-OTIk8iR8/aCRWBqvxrzxR0hgxWpnYBblY1S5hDWBQfk/VFmJwzmJgQFN3WsoUKHISv2eAwe+PpbUzyL1CKTLXg==",
+      "license": "ISC",
+      "dependencies": {
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/write-file-atomic/node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/y18n": {
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/yargs": {
+      "version": "17.7.3",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
+      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^8.0.1",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.3",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^21.1.1"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/yargs-parser": {
+      "version": "21.1.1",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    }
+  }
+}
diff --git a/tests/lambda-fixtures/pulumi/package.json b/tests/lambda-fixtures/pulumi/package.json
new file mode 100644
index 00000000..777845bf
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "rustack-workflows-iac-image",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Pinned Pulumi lifecycle consumer inside a managed Rustack image Lambda.",
+  "dependencies": {
+    "@pulumi/aws": "7.52.1",
+    "@pulumi/pulumi": "3.273.0"
+  },
+  "overrides": {
+    "glob": "14.0.3",
+    "minimatch": "11.0.3"
+  }
+}
diff --git a/tests/lambda-fixtures/pulumi/program-controls.js b/tests/lambda-fixtures/pulumi/program-controls.js
new file mode 100644
index 00000000..70013f63
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/program-controls.js
@@ -0,0 +1,101 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const { randomUUID } = require("node:crypto");
+const { performance } = require("node:perf_hooks");
+const { setTimeout: delay } = require("node:timers/promises");
+const { validate, resourceArgs, gateResource, stagePath, smallJSON, publishJSON } = require("./program_support");
+
+function config(workspace) {
+    return { nonce: "a".repeat(32), endpoint: "http://127.0.0.1:4566", target: "IacTarget",
+        businessArn: "arn:aws:lambda:us-east-1:000000000000:function:Business",
+        role: "arn:aws:iam::000000000000:role/ImageIac",
+        kmsKey: "arn:aws:kms:us-east-1:000000000000:key/00000000-0000-4000-8000-000000000000",
+        emptyConfig: workspace + "/empty-config" };
+}
+const arn = "arn:aws:states:us-east-1:000000000000:stateMachine:IacTarget";
+
+test("test_should_validate_literal_program_contract_and_negative_shapes", () => {
+    const source = config("/tmp/iac-" + randomUUID());
+    assert.equal(validate(source), source);
+    for (const value of [21, 23]) {
+        const args = resourceArgs(source, value, "none");
+        assert.equal(JSON.parse(args.definition).States.Call.Parameters.Payload.value, value);
+        assert.deepEqual(args.tags, { Fixture: source.nonce, Value: String(value) });
+    }
+    assert.equal(resourceArgs(source, 23, "publish").publish, true);
+    assert.equal(resourceArgs(source, 23, "logging").loggingConfiguration.level, "ALL");
+    assert.equal(resourceArgs(source, 23, "encryption").encryptionConfiguration.type, "CUSTOMER_MANAGED_KMS_KEY");
+    assert.throws(() => validate({ ...source, extra: 1 }));
+    assert.throws(() => resourceArgs(source, 22, "none"));
+    assert.throws(() => validate({ ...source, endpoint: "http://user@127.0.0.1:4566" }));
+});
+
+test("test_should_skip_known_arn_preview_and_recovery_gates_without_io", async () => {
+    const workspace = "/tmp/iac-" + randomUUID(), source = config(workspace);
+    assert.equal(await gateResource(arn, source, { dryRun: true, stage: "created" }), arn);
+    assert.equal(await gateResource(arn, source, { dryRun: false, stage: "none" }), arn);
+    await assert.rejects(fs.stat(workspace), { code: "ENOENT" });
+});
+
+test("test_should_bind_live_gate_to_nonce_ordinal_and_stage", async () => {
+    const workspace = "/tmp/iac-" + randomUUID(), source = config(workspace);
+    await fs.mkdir(workspace, { mode: 0o700 });
+    const options = { dryRun: false, stage: "created", ordinal: 4, workspace, deadline: performance.now() + 3000 };
+    let settled = false;
+    const owned = gateResource(arn, source, options).finally(() => { settled = true; });
+    try {
+        while (!await fs.stat(stagePath(workspace, 4, "created", false)).catch(() => false)) await delay(10);
+        await publishJSON(stagePath(workspace, 3, "created", true), { nonce: source.nonce, ordinal: 3, stage: "created" }, options.deadline);
+        await delay(75);
+        assert.equal(settled, false);
+        await publishJSON(stagePath(workspace, 4, "created", true), { nonce: source.nonce, ordinal: 4, stage: "created" }, options.deadline);
+        assert.equal(await owned, arn);
+    } finally { await owned.catch(() => {}); await fs.rm(workspace, { recursive: true }); }
+});
+
+test("test_should_reject_wrong_nonce_invalid_utf8_and_symlink_control_files", async () => {
+    const workspace = "/tmp/iac-" + randomUUID(), source = config(workspace);
+    await fs.mkdir(workspace, { mode: 0o700 });
+    try {
+        await fs.writeFile(stagePath(workspace, 4, "created", true), JSON.stringify({ nonce: "b".repeat(32), ordinal: 4, stage: "created" }));
+        await assert.rejects(gateResource(arn, source, { dryRun: false, stage: "created", ordinal: 4,
+            workspace, deadline: performance.now() + 2000 }));
+        await fs.writeFile(workspace + "/invalid", Buffer.from([34, 255, 34]));
+        await assert.rejects(smallJSON(workspace + "/invalid", 512));
+        await fs.symlink(workspace + "/invalid", workspace + "/link");
+        await assert.rejects(smallJSON(workspace + "/link", 512));
+        await fs.writeFile(workspace + "/oversize", " ".repeat(513));
+        await assert.rejects(smallJSON(workspace + "/oversize", 512));
+    } finally { await fs.rm(workspace, { recursive: true }); }
+});
+
+test("test_should_publish_complete_phase_and_grant_atomically_without_replacement", async () => {
+    const { publishJSON } = require("./program_support");
+    const workspace = "/tmp/iac-" + randomUUID();
+    await fs.mkdir(workspace, { mode: 0o700 });
+    try {
+        for (const grant of [false, true]) {
+            const file = stagePath(workspace, 4, "created", grant);
+            const value = { nonce: "a".repeat(32), ordinal: 4, stage: "created" };
+            let release, reached;
+            const held = new Promise(resolve => { release = resolve; });
+            const ready = new Promise(resolve => { reached = resolve; });
+            const owned = publishJSON(file, value, performance.now() + 3000, async temporary => {
+                assert.deepEqual(await smallJSON(temporary, 512), value);
+                assert.equal((await fs.stat(temporary)).mode & 0o777, 0o600);
+                reached();
+                await held;
+            });
+            try {
+                await Promise.race([ready, owned.then(() => { throw new Error("publication passed its held barrier"); })]);
+                await assert.rejects(fs.stat(file), { code: "ENOENT" });
+            } finally { release(); await owned; }
+            assert.deepEqual(await smallJSON(file, 512), value);
+            await assert.rejects(publishJSON(file, { ...value, nonce: "b".repeat(32) }, performance.now() + 3000), { code: "EEXIST" });
+            assert.deepEqual(await smallJSON(file, 512), value);
+            assert.equal((await fs.readdir(workspace)).filter(name => name.includes("pending")).length, 0);
+        }
+    } finally { await fs.rm(workspace, { recursive: true }); }
+});
diff --git a/tests/lambda-fixtures/pulumi/program.js b/tests/lambda-fixtures/pulumi/program.js
new file mode 100644
index 00000000..4fc032b8
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/program.js
@@ -0,0 +1,35 @@
+"use strict";
+
+const { performance } = require("node:perf_hooks");
+const pulumi = require("@pulumi/pulumi");
+const aws = require("@pulumi/aws");
+const support = require("./program_support");
+
+module.exports = (async () => {
+    const file = process.env.RUSTACK_IAC_CONFIG;
+    if (typeof file !== "string" || !/^\/tmp\/iac-[0-9a-f-]{36}\/config.json$/.test(file)) {
+        throw new Error("invalid IaC configuration path");
+    }
+    const config = support.validate(await support.smallJSON(file, 8192));
+    const key = process.env.AWS_ACCESS_KEY_ID, secret = process.env.AWS_SECRET_ACCESS_KEY;
+    if (typeof key !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(key) ||
+        typeof secret !== "string" || !/^[\x21-\x7e]{1,256}$/.test(secret)) {
+        throw new Error("missing explicit IaC fixture credentials");
+    }
+    const provider = new aws.Provider("local", {
+        accessKey: pulumi.secret(key), secretKey: pulumi.secret(secret), region: "us-east-1",
+        endpoints: [{ sfn: config.endpoint }], maxRetries: 0,
+        skipCredentialsValidation: true, skipMetadataApiCheck: true, skipRegionValidation: true,
+        skipRequestingAccountId: true, sharedConfigFiles: [config.emptyConfig],
+        sharedCredentialsFiles: [config.emptyConfig],
+    }, { version: "7.52.1" });
+    const value = Number(process.env.RUSTACK_IAC_VALUE);
+    const args = support.resourceArgs(config, value, process.env.RUSTACK_IAC_UNSUPPORTED);
+    const machine = new aws.sfn.StateMachine("target", args, { provider, version: "7.52.1" });
+    const ordinal = Number(process.env.RUSTACK_IAC_COMMAND);
+    const stage = process.env.RUSTACK_IAC_GATE;
+    return { targetArn: machine.arn.apply(arn => support.gateResource(arn, config, {
+        dryRun: pulumi.runtime.isDryRun(), stage, ordinal,
+        workspace: file.slice(0, -"/config.json".length), deadline: performance.now() + 60000,
+    })), value };
+})();
diff --git a/tests/lambda-fixtures/pulumi/program_support.js b/tests/lambda-fixtures/pulumi/program_support.js
new file mode 100644
index 00000000..05d0f6d2
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi/program_support.js
@@ -0,0 +1,121 @@
+"use strict";
+
+const fs = require("node:fs/promises");
+const { constants } = require("node:fs");
+const path = require("node:path");
+const { performance } = require("node:perf_hooks");
+const { randomUUID } = require("node:crypto");
+const { setTimeout: delay } = require("node:timers/promises");
+
+function check(value) {
+    if (!value) throw new Error("invalid bounded IaC program input");
+}
+function validate(config) {
+    check(config && typeof config === "object" && !Array.isArray(config));
+    check(Object.keys(config).length === 7 && Object.keys(config).every(key =>
+        ["nonce", "endpoint", "businessArn", "target", "role", "kmsKey", "emptyConfig"].includes(key)));
+    check(typeof config.nonce === "string" && /^[0-9a-f]{32}$/.test(config.nonce));
+    const origin = new URL(config.endpoint);
+    check(origin.protocol === "http:" && !origin.username && !origin.password && origin.pathname === "/" &&
+        !origin.search && !origin.hash && config.endpoint.length <= 256);
+    check(/^arn:aws:lambda:us-east-1:000000000000:function:[A-Za-z0-9_-]{1,64}$/.test(config.businessArn));
+    check(typeof config.target === "string" && /^[A-Za-z0-9_-]{1,80}$/.test(config.target));
+    check(/^arn:aws:iam::000000000000:role\/[A-Za-z0-9_-]{1,64}$/.test(config.role));
+    check(/^arn:aws:kms:us-east-1:000000000000:key\/[0-9a-f-]{36}$/.test(config.kmsKey));
+    check(typeof config.emptyConfig === "string" && config.emptyConfig.length <= 512 &&
+        /^\/tmp\/iac-[0-9a-f-]{36}\/empty-config$/.test(config.emptyConfig));
+    return config;
+}
+function resourceArgs(config, value, unsupported) {
+    validate(config);
+    check(value === 21 || value === 23);
+    check(["none", "publish", "logging", "encryption"].includes(unsupported));
+    const args = {
+        name: config.target, roleArn: config.role, type: "STANDARD",
+        definition: JSON.stringify({ StartAt: "Call", States: { Call: {
+            Type: "Task", Resource: "arn:aws:states:::lambda:invoke",
+            Parameters: { FunctionName: config.businessArn, Payload: { value } },
+            ResultSelector: { "computed.$": "$.Payload.computed", "requestId.$": "$.Payload.requestId",
+                "nodeVersion.$": "$.Payload.nodeVersion", "architecture.$": "$.Payload.architecture",
+                "counter.$": "$.Payload.counter" }, End: true,
+        } } }),
+        tags: { Fixture: config.nonce, Value: String(value) },
+    };
+    if (unsupported === "publish") args.publish = true;
+    if (unsupported === "logging") args.loggingConfiguration = { level: "ALL", includeExecutionData: false,
+        logDestination: "arn:aws:logs:us-east-1:000000000000:log-group:" + config.target + ":*" };
+    if (unsupported === "encryption") args.encryptionConfiguration = {
+        type: "CUSTOMER_MANAGED_KMS_KEY", kmsKeyId: config.kmsKey,
+    };
+    return args;
+}
+function stagePath(workspace, ordinal, stage, grant) {
+    check(typeof workspace === "string" && /^\/tmp\/iac-[0-9a-f-]{36}$/.test(workspace));
+    check(Number.isSafeInteger(ordinal) && ordinal >= 1 && ordinal <= 20);
+    check(["created", "updated"].includes(stage) && typeof grant === "boolean");
+    return path.join(workspace, (grant ? "grant-" : "phase-") + ordinal + "-" + stage + ".json");
+}
+async function smallJSON(file, cap) {
+    check(Number.isSafeInteger(cap) && cap >= 1 && cap <= 8192);
+    const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const info = await handle.stat();
+        check(info.isFile() && info.size <= cap);
+        const buffer = Buffer.alloc(cap + 1);
+        let offset = 0;
+        while (offset < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, null);
+            if (!bytesRead) break;
+            offset += bytesRead;
+        }
+        check(offset <= cap);
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, offset)));
+    } finally {
+        await handle.close();
+    }
+}
+async function publishJSON(file, value, deadline, beforePublish = async () => {}) {
+    check(typeof file === "string" && /^\/tmp\/iac-[0-9a-f-]{36}\/(phase|grant)-[0-9]{1,2}-(created|updated)\.json$/.test(file));
+    const data = JSON.stringify(value);
+    check(Buffer.byteLength(data) <= 512 && Number.isFinite(deadline) && performance.now() < deadline);
+    const temporary = file + ".pending-" + randomUUID();
+    let owned = false;
+    try {
+        const handle = await fs.open(temporary, "wx", 0o600);
+        owned = true;
+        try { await handle.writeFile(data); } finally { await handle.close(); }
+        await beforePublish(temporary);
+        check(performance.now() < deadline);
+        // Link publishes only fully written bytes, and never replaces a grant.
+        await fs.link(temporary, file);
+        check(performance.now() < deadline);
+    } finally { if (owned) await fs.unlink(temporary); }
+}
+
+async function gateResource(arn, config, options) {
+    validate(config);
+    check(typeof arn === "string" && arn.length <= 256 && arn ===
+        "arn:aws:states:us-east-1:000000000000:stateMachine:" + config.target);
+    check(typeof options.dryRun === "boolean" && ["none", "created", "updated"].includes(options.stage));
+    if (options.dryRun || options.stage === "none") return arn;
+    check(Number.isFinite(options.deadline) && performance.now() < options.deadline);
+    const file = stagePath(options.workspace, options.ordinal, options.stage, false);
+    const grant = stagePath(options.workspace, options.ordinal, options.stage, true);
+    await publishJSON(file, { nonce: config.nonce, stage: options.stage,
+        ordinal: options.ordinal, arn }, options.deadline);
+    while (performance.now() < options.deadline) {
+        try {
+            const value = await smallJSON(grant, 512);
+            check(Object.keys(value).length === 3 && value.nonce === config.nonce &&
+                value.ordinal === options.ordinal && value.stage === options.stage);
+            check(performance.now() < options.deadline);
+            return arn;
+        } catch (error) {
+            if (error.code !== "ENOENT") throw error;
+        }
+        await delay(Math.min(50, options.deadline - performance.now()));
+    }
+    throw new Error("IaC program gate expired");
+}
+
+module.exports = { validate, resourceArgs, stagePath, smallJSON, gateResource, publishJSON };
diff --git a/tests/lambda-fixtures/pulumi_tools.py b/tests/lambda-fixtures/pulumi_tools.py
new file mode 100644
index 00000000..9bb94a5c
--- /dev/null
+++ b/tests/lambda-fixtures/pulumi_tools.py
@@ -0,0 +1,316 @@
+"""Provision checksummed Linux Pulumi executables without executing downloaded code."""
+
+import argparse
+import contextlib
+import fcntl
+import gzip
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import tempfile
+import time
+import urllib.request
+
+
+CLI = "3.273.0"
+AWS = "7.52.1"
+COMPRESSED = 512 * 1024 * 1024
+EXPANDED = 2 * 1024 * 1024 * 1024
+HASHES = {
+    "arm64": ("c2e1b600b37d9d84551259b6f391f5035e336dfe63c49412f22d855a91995ed5",
+              "1976366b71dc08d8827a04fbb8eaf50a0d1ec5757726e593b6d7c27e7636daf8"),
+    "amd64": ("ec08f86671fd58f0a186540e1cee00066393beaf5c6716b0075f690919800432",
+              "2e705824a2103dd6e3dc66744ba2d55cad55d665476b3ffcd8ce024cf4cab081"),
+}
+SELECTED = {"pulumi/pulumi": "bin/pulumi", "pulumi/pulumi-language-nodejs": "bin/pulumi-language-nodejs"}
+PROVIDER = "plugins/resource-aws-v" + AWS + "/pulumi-resource-aws"
+
+
+class ToolError(ValueError):
+    """A fixed, non-content-bearing artifact validation failure."""
+
+
+def check(value):
+    if not value:
+        raise ToolError("invalid bounded Pulumi tool artifact")
+
+
+def fresh(deadline):
+    check(time.monotonic() < deadline)
+
+
+def digest(path, limit, deadline):
+    check(path.is_file() and not path.is_symlink() and path.stat().st_size <= limit)
+    state, count = hashlib.sha256(), 0
+    with path.open("rb") as stream:
+        while True:
+            fresh(deadline)
+            data = stream.read(65536)
+            if not data:
+                break
+            count += len(data)
+            check(count <= limit)
+            state.update(data)
+    fresh(deadline)
+    return state.hexdigest(), count
+
+
+def download(url, expected, cache, deadline):
+    path = cache / (expected + ".tar.gz")
+    if path.exists():
+        actual, _ = digest(path, COMPRESSED, deadline)
+        check(actual == expected)
+        return path
+    temporary = None
+    try:
+        with tempfile.NamedTemporaryFile(dir=cache, prefix=".download-", delete=False) as output:
+            temporary = Path(output.name)
+            request = urllib.request.Request(url, headers={"User-Agent": "rustack-iac-fixture"})
+            with urllib.request.urlopen(request, timeout=10) as response:
+                check(response.status == 200 and response.url.startswith("https://"))
+                count, state = 0, hashlib.sha256()
+                while True:
+                    fresh(deadline)
+                    chunk = response.read(65536)
+                    if not chunk:
+                        break
+                    count += len(chunk)
+                    check(count <= COMPRESSED)
+                    state.update(chunk)
+                    output.write(chunk)
+            check(state.hexdigest() == expected)
+            fresh(deadline)
+        os.replace(temporary, path)
+        temporary = None
+        return path
+    finally:
+        if temporary is not None:
+            temporary.unlink(missing_ok=True)
+
+
+def number(field):
+    value = field.strip(b" \0")
+    check(bool(value) and all(48 <= byte <= 55 for byte in value))
+    return int(value, 8)
+
+
+def text(field):
+    head, separator, tail = field.partition(b"\0")
+    check(not separator or not tail.strip(b"\0"))
+    return head.decode("ascii")
+
+
+def name(value, directory=False):
+    check(len(value.encode()) <= 512 and "\\" not in value)
+    if directory and value in (".", "./"):
+        return ""
+    if value.startswith("./"):
+        value = value[2:]
+    if directory and value.endswith("/"):
+        value = value[:-1]
+    parts = value.split("/")
+    check(all(part not in ("", ".", "..") and re.fullmatch(r"[A-Za-z0-9_.+-]+", part) for part in parts))
+    return "/".join(parts)
+
+
+def pax(data):
+    values, at = {}, 0
+    while at < len(data):
+        end = data.find(b" ", at, at + 8)
+        check(end > at and data[at:end].isdigit())
+        count = int(data[at:end])
+        check(count > end - at + 2 and at + count <= len(data))
+        record = data[end + 1:at + count]
+        check(record.endswith(b"\n"))
+        key, separator, value = record[:-1].partition(b"=")
+        check(separator and len(key) <= 64 and re.fullmatch(rb"[A-Za-z0-9_.-]+", key)
+              and len(value) <= 512 and key not in values
+              and key in (b"path", b"mtime", b"atime", b"ctime", b"comment", b"charset"))
+        values[key] = value
+        at += count
+    return values
+
+
+def unpack(archive, destination, selected, architecture, deadline):
+    check(architecture in HASHES and 1 <= len(selected) <= 3)
+    found, seen, total, members, pending, global_fields = {}, set(), 0, 0, {}, {}
+    with gzip.open(archive, "rb") as stream:
+        def read(size):
+            nonlocal total
+            fresh(deadline)
+            check(0 <= size <= 65536)
+            data = stream.read(size)
+            total += len(data)
+            check(total <= EXPANDED)
+            fresh(deadline)
+            return data
+        while True:
+            header = read(512)
+            check(len(header) == 512)
+            if header == bytes(512):
+                check(read(512) == bytes(512))
+                trailing = read(10241)
+                check(len(trailing) <= 10240 and not trailing.strip(b"\0"))
+                check(not read(1))
+                break
+            members += 1
+            check(members <= 4096)
+            check(number(header[148:156]) == sum(header[:148]) + 256 + sum(header[156:]))
+            check(header[257:263] in (b"ustar\0", b"ustar "))
+            kind, size = header[156:157], number(header[124:136])
+            check(size <= EXPANDED and total + size <= EXPANDED)
+            raw = text(header[:100])
+            prefix = text(header[345:500])
+            if prefix:
+                raw = prefix + "/" + raw
+            if kind in (b"x", b"g"):
+                check(size <= 4096)
+                body = read(size)
+                check(len(body) == size)
+                fields = pax(body)
+                if b"path" in fields:
+                    name(fields[b"path"].decode("ascii"))
+                if kind == b"g":
+                    check(b"path" not in fields)
+                    global_fields.update(fields)
+                else:
+                    check(not pending)
+                    pending = fields
+            else:
+                check(kind in (b"0", b"\0", b"5"))
+                fields = {**global_fields, **pending}
+                pending = {}
+                member = name(fields.get(b"path", raw.encode()).decode("ascii"), kind == b"5")
+                check(member not in seen)
+                seen.add(member)
+                check(kind != b"5" or size == 0)
+                target = selected.get(member)
+                if target is not None:
+                    check(kind != b"5" and member not in found and size >= 64)
+                    path = destination / target if destination is not None else None
+                    if path is not None:
+                        path.parent.mkdir(parents=True, exist_ok=True)
+                        check(not path.exists())
+                    state, first = hashlib.sha256(), b""
+                    with path.open("xb") if path is not None else contextlib.nullcontext() as output:
+                        left = size
+                        while left:
+                            chunk = read(min(left, 65536))
+                            check(bool(chunk))
+                            if len(first) < 64:
+                                first += chunk[:64 - len(first)]
+                            if output is not None:
+                                output.write(chunk)
+                            state.update(chunk)
+                            left -= len(chunk)
+                    machine = 183 if architecture == "arm64" else 62
+                    check(first[:6] == b"\x7fELF\x02\x01" and int.from_bytes(first[18:20], "little") == machine)
+                    if path is not None:
+                        path.chmod(0o755)
+                    found[member] = {"path": target, "sha256": state.hexdigest(), "bytes": size}
+                else:
+                    left = size
+                    while left:
+                        chunk = read(min(left, 65536))
+                        check(bool(chunk))
+                        left -= len(chunk)
+            padding = (-size) % 512
+            check(read(padding) == bytes(padding))
+        check(not pending and found.keys() == selected.keys())
+    return list(found.values())
+
+
+def validate_tree(root, deadline):
+    files = set(SELECTED.values()) | {PROVIDER, "manifest.json"}
+    directories = {"bin", "plugins", "plugins/resource-aws-v" + AWS}
+    seen_files, seen_directories, stack, total = set(), set(), [root], 0
+    while stack:
+        fresh(deadline)
+        directory = stack.pop()
+        info = directory.lstat()
+        check(stat.S_ISDIR(info.st_mode) and stat.S_IMODE(info.st_mode) == 0o755 and info.st_uid == os.getuid())
+        with os.scandir(directory) as entries:
+            for entry in entries:
+                fresh(deadline)
+                relative = str(Path(entry.path).relative_to(root))
+                info = entry.stat(follow_symlinks=False)
+                check(not stat.S_ISLNK(info.st_mode) and info.st_uid == os.getuid())
+                if stat.S_ISDIR(info.st_mode):
+                    check(relative in directories and relative not in seen_directories)
+                    seen_directories.add(relative)
+                    stack.append(Path(entry.path))
+                else:
+                    check(stat.S_ISREG(info.st_mode) and relative in files and relative not in seen_files and info.st_nlink == 1)
+                    expected_mode = 0o644 if relative == "manifest.json" else 0o755
+                    check(stat.S_IMODE(info.st_mode) == expected_mode)
+                    total += info.st_size
+                    check(total <= EXPANDED and (relative != "manifest.json" or info.st_size <= 16384))
+                    seen_files.add(relative)
+                check(len(seen_files) + len(seen_directories) <= 7)
+    check(seen_files == files and seen_directories == directories)
+
+
+def prepare(destination, architecture):
+    check(destination.is_absolute() and len(str(destination).encode()) <= 4096 and not destination.is_symlink())
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    deadline = time.monotonic() + 600
+    lock_path = destination.parent / ".pulumi-tools.lock"
+    fd = os.open(lock_path, os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW | os.O_CLOEXEC, 0o600)
+    with os.fdopen(fd, "r+b") as lock:
+        info = os.fstat(lock.fileno())
+        check(stat.S_ISREG(info.st_mode) and info.st_uid == os.getuid() and info.st_nlink == 1 and stat.S_IMODE(info.st_mode) == 0o600)
+        while True:
+            try:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                break
+            except BlockingIOError:
+                fresh(deadline)
+                time.sleep(0.025)
+        cli_hash, aws_hash = HASHES[architecture]
+        cache = destination.parent / "pulumi-archives"
+        cache.mkdir(exist_ok=True)
+        cli_arch = "arm64" if architecture == "arm64" else "x64"
+        cli = download("https://get.pulumi.com/releases/sdk/pulumi-v" + CLI + "-linux-" + cli_arch + ".tar.gz", cli_hash, cache, deadline)
+        provider = download("https://github.com/pulumi/pulumi-aws/releases/download/v" + AWS + "/pulumi-resource-aws-v" + AWS + "-linux-" + architecture + ".tar.gz", aws_hash, cache, deadline)
+        if destination.exists():
+            validate_tree(destination, deadline)
+            manifest = destination / "manifest.json"
+            check(manifest.is_file() and not manifest.is_symlink() and manifest.stat().st_size <= 16384)
+            expected_files = unpack(cli, None, SELECTED, architecture, deadline)
+            expected_files += unpack(provider, None, {"pulumi-resource-aws": PROVIDER}, architecture, deadline)
+            expected = {"schemaVersion": 1, "architecture": architecture, "cli": CLI, "provider": AWS,
+                        "archives": [cli_hash, aws_hash], "files": expected_files}
+            check(json.loads(manifest.read_bytes()) == expected)
+            for entry in expected_files:
+                path = destination / entry["path"]
+                for part in path.relative_to(destination).parents:
+                    directory = destination / part
+                    check(directory.is_dir() and not directory.is_symlink())
+                value, size = digest(path, EXPANDED, deadline)
+                check(value == entry["sha256"] and size == entry["bytes"])
+            return
+        with tempfile.TemporaryDirectory(dir=destination.parent, prefix=".pulumi-tools-") as temporary:
+            stage = Path(temporary) / "tools"
+            stage.mkdir()
+            files = unpack(cli, stage, SELECTED, architecture, deadline)
+            files += unpack(provider, stage, {"pulumi-resource-aws": PROVIDER}, architecture, deadline)
+            data = {"schemaVersion": 1, "architecture": architecture, "cli": CLI, "provider": AWS,
+                    "archives": [cli_hash, aws_hash], "files": files}
+            (stage / "manifest.json").write_text(json.dumps(data, sort_keys=True) + "\n")
+            (stage / "manifest.json").chmod(0o644)
+            for directory in (stage, stage / "bin", stage / "plugins", stage / "plugins" / ("resource-aws-v" + AWS)):
+                directory.chmod(0o755)
+            validate_tree(stage, deadline)
+            fresh(deadline)
+            os.rename(stage, destination)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("architecture", choices=tuple(HASHES))
+    parser.add_argument("destination", type=Path)
+    args = parser.parse_args()
+    prepare(args.destination, args.architecture)
diff --git a/tests/lambda-fixtures/runtime-verifier/Cargo.toml b/tests/lambda-fixtures/runtime-verifier/Cargo.toml
new file mode 100644
index 00000000..ffc7d5a9
--- /dev/null
+++ b/tests/lambda-fixtures/runtime-verifier/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "rustack-lambda-runtime-verifier"
+description = "Linux Native consumer for identical provided-runtime ZIP qualification"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+publish = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+base64 = { workspace = true }
+rustack-lambda-core = { workspace = true }
+rustack-lambda-model = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+tokio = { workspace = true }
diff --git a/tests/lambda-fixtures/runtime-verifier/src/main.rs b/tests/lambda-fixtures/runtime-verifier/src/main.rs
new file mode 100644
index 00000000..a559af44
--- /dev/null
+++ b/tests/lambda-fixtures/runtime-verifier/src/main.rs
@@ -0,0 +1,210 @@
+//! Actual production Native provider inside an explicitly owned Linux verifier.
+#![forbid(unsafe_code)]
+
+use std::{
+    env::consts::{ARCH, OS},
+    io::ErrorKind,
+    time::Duration,
+};
+
+use anyhow::{Context, Result, bail, ensure};
+use base64::{Engine, engine::general_purpose::STANDARD};
+use rustack_lambda_core::{
+    config::LambdaConfig,
+    executor::ExecutorBackend,
+    provider::{InvokeKind, InvokeOutcome, RustackLambda},
+    storage::{FunctionStore, compute_sha256},
+};
+use rustack_lambda_model::{
+    input::CreateFunctionInput,
+    types::{Environment, FunctionCode},
+};
+use serde::Deserialize;
+use serde_json::{Value, json};
+use tokio::{
+    fs,
+    io::AsyncReadExt,
+    time::{Instant, timeout, timeout_at},
+};
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+struct Manifest {
+    architecture: String,
+    zip_sha256: String,
+    code_marker: String,
+}
+impl Manifest {
+    fn validate(&self) -> Result<()> {
+        let architecture = match ARCH {
+            "aarch64" => "arm64",
+            "x86_64" => "x86_64",
+            _ => bail!("unsupported Native verifier architecture"),
+        };
+        ensure!(
+            OS == "linux" && self.architecture == architecture,
+            "Native verifier platform mismatch"
+        );
+        ensure!(self.zip_sha256.len() == 44, "ZIP digest length");
+        let digest = STANDARD
+            .decode(&self.zip_sha256)
+            .context("decode ZIP digest")?;
+        ensure!(
+            digest.len() == 32 && STANDARD.encode(digest) == self.zip_sha256,
+            "noncanonical ZIP digest"
+        );
+        ensure!(
+            (1..=16).contains(&self.code_marker.len())
+                && self.code_marker.bytes().all(|b| b.is_ascii_alphanumeric()),
+            "revision marker bound"
+        );
+        Ok(())
+    }
+}
+async fn read(path: &str, maximum: u64) -> Result<Vec<u8>> {
+    timeout(Duration::from_secs(30), async {
+        let metadata = fs::symlink_metadata(path)
+            .await
+            .context("inspect fixed input")?;
+        ensure!(
+            metadata.is_file() && metadata.len() <= maximum,
+            "input must be a bounded regular file"
+        );
+        let file = fs::File::open(path).await.context("open fixed input")?;
+        let mut bytes = Vec::new();
+        file.take(maximum.checked_add(1).context("input bound overflow")?)
+            .read_to_end(&mut bytes)
+            .await
+            .context("read fixed input")?;
+        ensure!(u64::try_from(bytes.len())? <= maximum, "input byte limit");
+        Ok(bytes)
+    })
+    .await
+    .context("input observation expired")?
+}
+async fn call(provider: &RustackLambda, n: i64) -> Result<Value> {
+    let event = serde_json::to_vec(&json!({"n":n}))?;
+    let result = provider
+        .invoke("native-zip", None, &event, InvokeKind::RequestResponse)
+        .await
+        .context("invoke actual Native code")?;
+    let InvokeOutcome::Sync(result) = result else {
+        bail!("expected synchronous Native result");
+    };
+    ensure!(
+        result.function_error.is_none(),
+        "Native handler reported failure"
+    );
+    serde_json::from_slice(&result.payload).context("decode computed Native response")
+}
+async fn exercise(
+    provider: &RustackLambda,
+    manifest: &Manifest,
+    zip: Vec<u8>,
+) -> Result<Vec<Value>> {
+    let code = FunctionCode {
+        zip_file: Some(STANDARD.encode(zip)),
+        ..Default::default()
+    };
+    let created = provider
+        .create_function(CreateFunctionInput {
+            function_name: "native-zip".into(),
+            runtime: Some("provided.al2023".into()),
+            handler: Some("handler.entry".into()),
+            role: "arn:aws:iam::000000000000:role/test-role".into(),
+            code,
+            architectures: Some(vec![manifest.architecture.clone()]),
+            timeout: Some(20),
+            environment: Some(Environment {
+                variables: Some(
+                    [
+                        ("WORKFLOW_MODE".into(), "1".into()),
+                        ("PROVIDED_QUALIFICATION".into(), "1".into()),
+                    ]
+                    .into_iter()
+                    .collect(),
+                ),
+            }),
+            ..Default::default()
+        })
+        .await
+        .context("deploy exact ZIP through Native provider")?;
+    ensure!(
+        created.code_sha256.as_deref() == Some(manifest.zip_sha256.as_str()),
+        "Native code identity changed"
+    );
+    let cold = call(provider, 21).await?;
+    let warm = call(provider, 23).await?;
+    ensure!(
+        cold.get("computed") == Some(&json!(42)) && warm.get("computed") == Some(&json!(46)),
+        "Native computation mismatch"
+    );
+    ensure!(
+        cold.get("providedCounter") == Some(&json!(1))
+            && warm.get("providedCounter") == Some(&json!(2)),
+        "Native cold/warm reuse mismatch"
+    );
+    ensure!(
+        cold.get("codeMarker").and_then(Value::as_str) == Some(manifest.code_marker.as_str())
+            && warm.get("codeMarker") == cold.get("codeMarker"),
+        "Native revision mismatch"
+    );
+    let pid = cold
+        .get("pid")
+        .and_then(Value::as_u64)
+        .context("Native child PID")?;
+    ensure!(
+        (2..(1_u64 << 31)).contains(&pid) && warm.get("pid").and_then(Value::as_u64) == Some(pid),
+        "Native warm child identity mismatch"
+    );
+    Ok(vec![cold, warm])
+}
+#[tokio::main(flavor = "current_thread")]
+async fn main() -> Result<()> {
+    let manifest: Manifest = serde_json::from_slice(&read("/var/task/manifest.json", 4096).await?)
+        .context("decode bounded manifest")?;
+    manifest.validate()?;
+    let zip = read("/var/task/input.zip", 50 * 1024 * 1024).await?;
+    ensure!(
+        compute_sha256(&zip) == manifest.zip_sha256,
+        "original ZIP digest mismatch"
+    );
+    let provider = RustackLambda::with_store(
+        FunctionStore::new("/tmp/native-store"),
+        LambdaConfig {
+            executor: ExecutorBackend::Native,
+            max_warm_instances: 1,
+            ..Default::default()
+        },
+    );
+    let observed = timeout_at(
+        Instant::now() + Duration::from_secs(90),
+        exercise(&provider, &manifest, zip),
+    )
+    .await
+    .context("Native operation observation expired")
+    .and_then(|result| result);
+    let cleanup = provider
+        .shutdown_before(Instant::now() + Duration::from_secs(30))
+        .await
+        .context("join actual Native children and IO");
+    cleanup?;
+    let observed = observed?;
+    let pid = observed
+        .first()
+        .and_then(|v| v.get("pid"))
+        .and_then(Value::as_u64)
+        .context("observed Native child")?;
+    let absence = timeout(Duration::from_secs(5), fs::metadata(format!("/proc/{pid}")))
+        .await
+        .context("Native child absence observation expired")?;
+    ensure!(
+        matches!(absence, Err(error) if error.kind() == ErrorKind::NotFound),
+        "Native child still exists after joined cleanup"
+    );
+    println!(
+        "{}",
+        json!({"schemaVersion":1,"kind":"native-same-zip","zipSha256":manifest.zip_sha256,"joined":true,"observed":observed})
+    );
+    Ok(())
+}
diff --git a/tests/lambda-fixtures/server-config.yaml b/tests/lambda-fixtures/server-config.yaml
new file mode 100644
index 00000000..83994d5d
--- /dev/null
+++ b/tests/lambda-fixtures/server-config.yaml
@@ -0,0 +1,11 @@
+budgets:
+  startupSeconds: 180
+  shutdownSeconds: 60
+  lambdaDockerIoSeconds: 60
+  lambdaDockerStartSeconds: 60
+  lambdaDockerCleanupSeconds: 60
+  lambdaDockerEnvironments: 2
+  lambdaDockerImagePins: 16
+  lambdaDockerDeploymentJobs: 2
+  lambdaDockerMemoryBytes: 805306368
+  workflowDispatches: 2
diff --git a/tests/lambda-fixtures/server.Dockerfile b/tests/lambda-fixtures/server.Dockerfile
new file mode 100644
index 00000000..396c9b65
--- /dev/null
+++ b/tests/lambda-fixtures/server.Dockerfile
@@ -0,0 +1,16 @@
+# syntax=docker/dockerfile:1
+ARG BASE_IMAGE=public.ecr.aws/lambda/provided@sha256:612c98f126c2a95e77a016d56fed50a83055e11d636132ee6ebdd461f01b9617
+FROM ${BASE_IMAGE}
+USER 0:0
+RUN mkdir -p /data /etc/rustack /run/rustack \
+    && chown 65532:65532 /data \
+    && chmod 0700 /data \
+    && touch /run/rustack/docker.sock
+COPY --chmod=0555 rustack /rustack
+COPY --chmod=0444 config.yaml /etc/rustack/config.yaml
+WORKDIR /data
+USER 65532:65532
+EXPOSE 4566
+HEALTHCHECK NONE
+ENTRYPOINT ["/rustack"]
+CMD []
diff --git a/tests/workflows/action-required-suites.json b/tests/workflows/action-required-suites.json
new file mode 100644
index 00000000..a146d98a
--- /dev/null
+++ b/tests/workflows/action-required-suites.json
@@ -0,0 +1,11 @@
+{
+  "schemaVersion": 1,
+  "profile": "rustack-composite-action-v1",
+  "qualification": "action-process-controls",
+  "suites": [
+    {
+      "id": "composite-action",
+      "tests": ["test_should_execute_actual_action_process_controls"]
+    }
+  ]
+}
diff --git a/tests/workflows/action_required_suites.py b/tests/workflows/action_required_suites.py
new file mode 100644
index 00000000..d9558744
--- /dev/null
+++ b/tests/workflows/action_required_suites.py
@@ -0,0 +1,36 @@
+"""One independent Action process suite; not Native or Docker qualification."""
+import argparse
+from pathlib import Path
+import sys
+
+from required_suites import MANIFEST_LIMIT, INVENTORY_LIMIT, ManifestError, parse_manifest, read_regular, verify
+
+SUITES = frozenset(("composite-action",))
+CASE = "test_should_execute_actual_action_process_controls"
+
+
+def decode(raw):
+    result = parse_manifest(raw, expected_suites=SUITES, profile="rustack-composite-action-v1",
+                            qualification="action-process-controls")
+    if result["composite-action"] != frozenset((CASE,)):
+        raise ManifestError("Action process case changed")
+    return result
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("inventory_directory", type=Path)
+    arguments = parser.parse_args()
+    try:
+        required = decode(read_regular(Path(__file__).with_name("action-required-suites.json"), MANIFEST_LIMIT))
+        inventory = read_regular(arguments.inventory_directory / "composite-action.txt", INVENTORY_LIMIT)
+        count = verify(required, {"composite-action": inventory}, expected_suites=SUITES)
+    except ManifestError as error:
+        print("Action resource manifest rejected: " + str(error), file=sys.stderr)
+        return 1
+    print("Action resource manifest verified: " + str(count) + " exact independent process suite")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/workflows/callback-cases.json b/tests/workflows/callback-cases.json
new file mode 100644
index 00000000..71ed5477
--- /dev/null
+++ b/tests/workflows/callback-cases.json
@@ -0,0 +1,14 @@
+{
+  "source": "https://docs.aws.amazon.com/step-functions/latest/dg/connect-lambda.html",
+  "cases": [
+    {"id":"early","mode":"early","status":"SUCCEEDED"},
+    {"id":"late","mode":"late","status":"SUCCEEDED"},
+    {"id":"external-failure","mode":"externalFailure","status":"FAILED","error":"CallbackExternalFailure"},
+    {"id":"invocation-failure","mode":"invocationFailure","status":"FAILED","error":"CallbackInvocationFailure"},
+    {"id":"retry","mode":"retry","status":"SUCCEEDED"},
+    {"id":"heartbeat","mode":"heartbeat","status":"SUCCEEDED"},
+    {"id":"absolute-timeout","mode":"absoluteTimeout","status":"FAILED","error":"States.Timeout"},
+    {"id":"heartbeat-timeout","mode":"heartbeatTimeout","status":"FAILED","error":"States.HeartbeatTimeout"},
+    {"id":"stop","mode":"stop","status":"ABORTED","error":"Stopped"}
+  ]
+}
diff --git a/tests/workflows/callback_image_sdk.py b/tests/workflows/callback_image_sdk.py
new file mode 100644
index 00000000..46f4d8f6
--- /dev/null
+++ b/tests/workflows/callback_image_sdk.py
@@ -0,0 +1,309 @@
+"""Actual managed-image callbacks with independent Event work and safe control rows."""
+
+import json
+import os
+from pathlib import Path
+import re
+import sys
+import time
+import uuid
+
+from callback_image_support import ScanBudget
+from lambda_fault_support import Metadata, invoke_json, poll_response
+from node_image_sdk import deployed
+
+
+VERSION = "3.1105.0"
+VERSIONS = {"lambda": VERSION, "sfn": VERSION, "dynamodb": VERSION}
+GROUPS = {"causal": ("early", "late", "externalFailure", "invocationFailure"),
+          "timing": ("retry", "heartbeat", "absoluteTimeout", "heartbeatTimeout", "stop")}
+FIELDS = {"id", "nonce", "role", "requestId", "tokenHash", "stage", "retry", "heartbeats",
+          "historySafe", "closedToken", "oldTokenRejected", "sdkVersion"}
+
+
+def canonical_uuid(value):
+    assert isinstance(value, str) and len(value) == 36 and str(uuid.UUID(value, version=4)) == value
+
+
+def catalog(group):
+    assert group in GROUPS
+    raw = Path(__file__).with_name("callback-cases.json").read_bytes()
+    assert len(raw) <= 8192
+    source = json.loads(raw)
+    assert source["source"] == "https://docs.aws.amazon.com/step-functions/latest/dg/connect-lambda.html"
+    assert len(source["cases"]) == 9
+    selected = [case for case in source["cases"] if case["mode"] in GROUPS[group]]
+    assert tuple(case["mode"] for case in selected) == GROUPS[group]
+    return selected
+
+
+class Driver:
+    def __init__(self, function, states, dynamodb, metadata, architecture, group):
+        self.function, self.states, self.ddb = function, states, dynamodb
+        self.metadata, self.architecture, self.group = metadata, architecture, group
+        suffix = uuid.uuid4().hex
+        self.a, self.b, self.table = "CbDispatch-" + suffix, "CbWorker-" + suffix, "ImageCallback" + suffix
+        self.scanner = ScanBudget()
+        self.executions, self.workers = [], []
+        self.b_ids = set()
+        self.a_ids = set()
+
+    def ids(self):
+        return {row["Id"] for row in self.metadata.rows()}
+
+    def probe(self, name):
+        response, value = invoke_json(self.function, name, {"mode": "probe"})
+        assert "FunctionError" not in response and value["probe"] is True and value["versions"] == VERSIONS
+        assert value["architecture"] == {"arm64": "arm64", "x86_64": "x64"}[self.architecture]
+        assert type(value["counter"]) is int and 1 <= value["counter"] <= 128
+        canonical_uuid(value["requestId"])
+        return value
+
+    def prepare(self, image):
+        self.ddb.create_table(TableName=self.table, BillingMode="PAY_PER_REQUEST",
+            KeySchema=[{"AttributeName": "id", "KeyType": "HASH"}],
+            AttributeDefinitions=[{"AttributeName": "id", "AttributeType": "S"}])
+        poll_response(lambda: self.ddb.describe_table(TableName=self.table),
+                      lambda value: value["Table"]["TableStatus"] == "ACTIVE", 30)
+        for name, handler in ((self.a, "callback.dispatcher"), (self.b, "callback.worker")):
+            self.function.create_function(FunctionName=name, Role="arn:aws:iam::000000000000:role/ImageCallback",
+                PackageType="Image", Architectures=[self.architecture], Timeout=45, MemorySize=256,
+                Code={"ImageUri": image}, ImageConfig={"Command": [handler]},
+                Environment={"Variables": {"AWS_PROFILE": "captured-callback-poison",
+                    "AWS_ENDPOINT_URL": "http://127.0.0.1:9"}})
+            configuration = deployed(self.function, name)
+            variables = configuration["Environment"]["Variables"]
+            assert "AWS_ACCESS_KEY_ID" not in variables and "AWS_SECRET_ACCESS_KEY" not in variables
+            self.function.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+            assert self.function.get_function_concurrency(FunctionName=name)["ReservedConcurrentExecutions"] == 1
+        assert self.probe(self.b)["counter"] == 1
+        self.b_ids = self.ids()
+        assert len(self.b_ids) == 2
+        assert self.probe(self.a)["counter"] == 1
+        self.a_ids = self.ids() - self.b_ids
+        assert len(self.a_ids) == 2 and self.ids() == self.a_ids | self.b_ids
+
+    def rows(self):
+        response = self.ddb.scan(TableName=self.table, ConsistentRead=True, Limit=65)
+        items = response["Items"]
+        assert not response.get("LastEvaluatedKey") and len(items) <= 64
+        records = []
+        for item in items:
+            assert len(json.dumps(item).encode()) <= 2048
+            if set(item) == {"id", "open"}:
+                assert set(item["id"]) == {"S"} and set(item["open"]) == {"BOOL"}
+                assert re.fullmatch(r"gate:[0-9a-f]{32}:[01]:(return|finish|heartbeats)", item["id"]["S"])
+                assert type(item["open"]["BOOL"]) is bool
+                continue
+            assert set(item) == FIELDS
+            row = {}
+            for key, value in item.items():
+                kind = "N" if key in ("retry", "heartbeats") else "BOOL" if key in (
+                    "historySafe", "closedToken", "oldTokenRejected") else "S"
+                assert set(value) == {kind}
+                row[key] = int(value[kind]) if kind == "N" else value[kind]
+            canonical_uuid(row["id"])
+            assert row["id"] == row["requestId"] and row["role"] in ("A", "B")
+            assert re.fullmatch(r"[0-9a-f]{32}", row["nonce"])
+            assert row["stage"] in ("consumed", "callback", "accepted", "waiting", "heartbeat", "finished")
+            assert 0 <= row["retry"] <= 1 and 0 <= row["heartbeats"] <= 100 and row["sdkVersion"] == VERSION
+            assert all(type(row[key]) is bool for key in ("historySafe", "closedToken", "oldTokenRejected"))
+            self.scanner.add_hashes([row["tokenHash"]])
+            records.append(row)
+        return records
+
+    def observe(self, nonce, role, retry, stages):
+        def read():
+            found = [row for row in self.rows() if row["nonce"] == nonce and row["role"] == role
+                     and row["retry"] == retry]
+            assert len(found) <= 1, "duplicate image callback invocation"
+            return found[0] if found else None
+        return poll_response(read, lambda row: row is not None and row["stage"] in stages, 30)
+
+    def gate(self, nonce, kind, retry=0):
+        assert isinstance(nonce, str) and re.fullmatch(r"[0-9a-f]{32}", nonce)
+        assert kind in ("return", "finish", "heartbeats") and type(retry) is int and retry in (0, 1)
+        self.ddb.put_item(TableName=self.table,
+            Item={"id": {"S": "gate:" + nonce + ":" + str(retry) + ":" + kind}, "open": {"BOOL": True}})
+
+    def history(self, arn):
+        value = self.states.get_execution_history(executionArn=arn, includeExecutionData=True, maxResults=1000)
+        assert not value.get("nextToken") and len(value["events"]) <= 256
+        encoded = json.dumps(value, default=str).encode()
+        self.scanner.scan(encoded)
+        return value["events"]
+
+    def running(self, arn):
+        assert self.states.describe_execution(executionArn=arn)["status"] == "RUNNING"
+
+    def submitted(self, arn):
+        return poll_response(lambda: self.history(arn),
+            lambda events: any(event["type"] == "TaskSubmitted" for event in events), 30)
+
+    def terminal(self, arn):
+        return poll_response(lambda: self.states.describe_execution(executionArn=arn),
+                             lambda result: result["status"] != "RUNNING", 30)
+
+    def create(self, definition):
+        return self.states.create_state_machine(name="Callback" + uuid.uuid4().hex,
+            roleArn="arn:aws:iam::000000000000:role/ImageCallback", type="STANDARD",
+            definition=json.dumps(definition))["stateMachineArn"]
+
+    def unrelated(self):
+        definition = {"StartAt": "Call", "States": {"Call": {"Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:" + self.a,
+            "Parameters": {"mode": "compute", "n": 21}, "End": True}}}
+        machine = self.create(definition)
+        arn = self.states.start_execution(stateMachineArn=machine)["executionArn"]
+        self.executions.append(arn)
+        value = self.terminal(arn)
+        assert value["status"] == "SUCCEEDED" and json.loads(value["output"])["computed"] == 42
+
+    def definition(self, case, nonce):
+        task = {"Type": "Task", "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",
+            "Parameters": {"FunctionName": self.a, "InvocationType": "RequestResponse", "Payload": {
+                "token.$": "$$.Task.Token", "executionArn.$": "$$.Execution.Id", "nonce": nonce,
+                "table": self.table, "worker": self.b, "n": 21,
+                "retry.$": "$$.State.RetryCount", "mode": case["mode"]}}, "TimeoutSeconds": 60, "End": True}
+        if case["mode"] in ("heartbeat", "absoluteTimeout", "heartbeatTimeout"):
+            task["HeartbeatSeconds"] = 3
+        if case["mode"] == "absoluteTimeout":
+            task["TimeoutSeconds"] = 8
+        if case["mode"] == "retry":
+            task["Retry"] = [{"ErrorEquals": ["CallbackRetry"], "IntervalSeconds": 1, "MaxAttempts": 1}]
+        return {"StartAt": "Call", "TimeoutSeconds": 120, "States": {"Call": task}}
+
+    def drain_worker(self, nonce):
+        complete = self.observe(nonce, "B", 0, ("finished",))
+        assert complete["historySafe"] and complete["closedToken"]
+        self.workers.append(complete["requestId"])
+        from botocore.exceptions import ClientError
+        def probe():
+            try:
+                return self.probe(self.b)
+            except ClientError as error:
+                assert error.response["Error"]["Code"] == "TooManyRequestsException"
+                return None
+        poll_response(probe, lambda value: value is not None, 30)
+        return complete
+
+    def verify(self, case, arn, attempts, completed):
+        result = self.terminal(arn)
+        assert result["status"] == case["status"] and result.get("error") == case.get("error")
+        if case["status"] == "SUCCEEDED":
+            output = json.loads(result["output"])
+            assert output == {"value": 42, "sdk": "node", "requestId": completed["requestId"],
+                              "retry": completed["retry"]}
+        events = self.history(arn)
+        submitted = []
+        for index, event in enumerate(events, start=1):
+            assert event["id"] == index and event.get("previousEventId", 0) == (0 if index == 2 else index - 1)
+            if event["type"] == "TaskScheduled":
+                parameters = json.loads(event["taskScheduledEventDetails"]["parameters"])
+                assert parameters["Payload"]["token"] is None
+            if event["type"] == "TaskSubmitted":
+                detail = event["taskSubmittedEventDetails"]
+                metadata = json.loads(detail["output"])
+                request = metadata["SdkResponseMetadata"]["RequestId"]
+                assert request in {row["requestId"] for row in attempts}
+                assert metadata["ExecutedVersion"] == "$LATEST" and metadata["SdkHttpMetadata"]["HttpStatusCode"] == 200
+                assert detail["outputDetails"]["truncated"] is True
+                submitted.append(request)
+        count = 0 if case["mode"] in ("stop", "invocationFailure") else 2 if case["mode"] == "retry" else 1
+        assert len(submitted) == len(set(submitted)) == count
+
+    def exercise(self, case):
+        nonce = uuid.uuid4().hex
+        machine = self.create(self.definition(case, nonce))
+        arn = self.states.start_execution(stateMachineArn=machine, name="run-" + nonce)["executionArn"]
+        self.executions.append(arn)
+        mode = case["mode"]
+        first = self.observe(nonce, "A", 0, ("callback",) if mode in (
+            "early", "externalFailure", "invocationFailure", "retry") else ("accepted",))
+        attempts, complete = [first], first
+        self.running(arn)
+        if mode in ("early", "externalFailure", "invocationFailure", "retry"):
+            assert first["historySafe"] and first["closedToken"]
+            assert not any(event["type"] == "TaskSubmitted" for event in self.history(arn))
+            self.gate(nonce, "return")
+            if mode == "retry":
+                second = self.observe(nonce, "A", 1, ("callback",))
+                assert second["oldTokenRejected"] and second["historySafe"] and second["closedToken"]
+                assert second["requestId"] != first["requestId"] and second["tokenHash"] != first["tokenHash"]
+                assert self.ids() == self.a_ids | self.b_ids
+                attempts.append(second)
+                complete = second
+                self.running(arn)
+                self.gate(nonce, "return", retry=1)
+        else:
+            waiting = self.observe(nonce, "B", 0, ("waiting",))
+            assert waiting["tokenHash"] == first["tokenHash"] and self.ids() == self.a_ids | self.b_ids
+            if mode == "stop":
+                self.states.stop_execution(executionArn=arn, error="Stopped")
+                self.metadata.wait_ids(self.b_ids, time.monotonic() + 30)
+            else:
+                if mode == "heartbeat":
+                    time.sleep(3.6)
+                    self.running(arn)
+                    assert not any(event["type"] == "TaskSubmitted" for event in self.history(arn))
+                    self.gate(nonce, "return")
+                self.submitted(arn)
+                self.running(arn)
+                if mode == "late":
+                    self.unrelated()
+                    self.running(arn)
+                if mode in ("heartbeat", "absoluteTimeout"):
+                    self.gate(nonce, "heartbeats")
+                if mode == "heartbeat":
+                    time.sleep(3.6)
+                    self.running(arn)
+                    beat = self.observe(nonce, "B", 0, ("heartbeat",))
+                    assert beat["heartbeats"] >= 4
+                if mode in ("absoluteTimeout", "heartbeatTimeout"):
+                    self.terminal(arn)
+            self.gate(nonce, "finish")
+            complete = self.drain_worker(nonce)
+            if mode == "absoluteTimeout":
+                assert complete["heartbeats"] >= 4
+        self.verify(case, arn, attempts, complete)
+        if mode == "invocationFailure":
+            self.metadata.wait_ids(self.b_ids, time.monotonic() + 30)
+
+
+def exercise(endpoint, image, architecture, socket, owner, engine, group):
+    import boto3
+    from botocore.config import Config
+    settings = dict(endpoint_url=endpoint, region_name="us-east-1", aws_access_key_id="local-key",
+                    aws_secret_access_key="local-secret", config=Config(retries={"max_attempts": 0},
+                    connect_timeout=2, read_timeout=60))
+    clients = []
+    try:
+        for service in ("lambda", "stepfunctions", "dynamodb"):
+            clients.append(boto3.client(service, **settings))
+        driver = Driver(*clients, Metadata(socket, owner, engine), architecture, group)
+        driver.prepare(image)
+        cases = catalog(group)
+        for case in cases:
+            driver.exercise(case)
+        rows = driver.rows()
+        assert {row["requestId"] for row in rows if row["role"] == "B"} == set(driver.workers)
+        assert all(row["stage"] == "finished" for row in rows if row["role"] == "B")
+        report = {"schemaVersion": 1, "group": group, "cases": [case["mode"] for case in cases],
+            "versions": VERSIONS, "functions": [driver.a, driver.b], "executions": driver.executions,
+            "workerRequests": driver.workers, "hashes": sorted(driver.scanner.hashes),
+            "historyCandidates": driver.scanner.candidates, "historyBytes": driver.scanner.history_bytes}
+        assert len(json.dumps(report).encode()) <= 16384
+        return report
+    finally:
+        for client in reversed(clients):
+            client.close()
+
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+    try:
+        print(json.dumps(exercise(*sys.argv[1:])), flush=True)
+    except Exception:
+        # SDK failures can contain request credentials; only a fixed diagnostic crosses stdout/stderr.
+        print("image callback driver failed", file=sys.stderr, flush=True)
+        sys.exit(1)
diff --git a/tests/workflows/callback_image_support.py b/tests/workflows/callback_image_support.py
new file mode 100644
index 00000000..cb132aa9
--- /dev/null
+++ b/tests/workflows/callback_image_support.py
@@ -0,0 +1,79 @@
+"""Bounded secret-free hash observations for real image callback consumers."""
+
+import hashlib
+import re
+
+
+class PrivacyScanError(ValueError):
+    """A scan failed without including candidate or credential data."""
+
+
+class ScanBudget:
+    """One aggregate history candidate budget, continued by the Rust archive audit."""
+
+    MAX_CANDIDATES = 65536
+    MAX_SOURCE_BYTES = 1024 * 1024
+    MAX_HISTORY_BYTES = 16 * 1024 * 1024
+    MAX_CHUNKS = 4096
+
+    def __init__(self, hashes=(), *, limit=MAX_CANDIDATES, candidates=0):
+        if (type(limit) is not int or not 1 <= limit <= self.MAX_CANDIDATES
+                or type(candidates) is not int or not 0 <= candidates <= limit):
+            raise PrivacyScanError("invalid callback scan budget")
+        self.limit = limit
+        self.candidates = candidates
+        self.history_bytes = 0
+        self.failed = False
+        self.hashes = set()
+        self.add_hashes(hashes)
+
+    def reject(self, message):
+        self.failed = True
+        raise PrivacyScanError(message)
+
+    def add_hashes(self, hashes):
+        if self.failed:
+            raise PrivacyScanError("callback scan already failed")
+        if not isinstance(hashes, (list, tuple, set)) or len(hashes) > 64:
+            self.reject("invalid callback hash collection")
+        for value in hashes:
+            if not isinstance(value, str) or re.fullmatch(r"[0-9a-f]{64}", value) is None:
+                self.reject("invalid callback hash")
+            self.hashes.add(value)
+            if len(self.hashes) > 64:
+                self.reject("callback hash collection cap")
+
+    def scan(self, data):
+        if self.failed:
+            raise PrivacyScanError("callback scan already failed")
+        if not self.hashes:
+            self.reject("callback scan requires observed hashes")
+        if not isinstance(data, (bytes, bytearray)) or len(data) > self.MAX_SOURCE_BYTES:
+            self.reject("callback history source cap")
+        if self.history_bytes + len(data) > self.MAX_HISTORY_BYTES:
+            self.reject("callback history aggregate byte cap")
+        self.history_bytes += len(data)
+        run = 0
+        for offset, value in enumerate(data):
+            run = run + 1 if 48 <= value <= 57 or 97 <= value <= 102 else 0
+            if run < 64:
+                continue
+            if self.candidates == self.limit:
+                self.reject("callback aggregate candidate cap")
+            self.candidates += 1
+            candidate = data[offset - 63:offset + 1]
+            if hashlib.sha256(candidate).hexdigest() in self.hashes:
+                self.reject("callback credential found in observed data")
+
+    def scan_chunks(self, chunks):
+        """Collect one capped source before scanning so chunk boundaries cannot hide data."""
+        if self.failed:
+            raise PrivacyScanError("callback scan already failed")
+        data = bytearray()
+        for count, chunk in enumerate(chunks, start=1):
+            if count > self.MAX_CHUNKS or not isinstance(chunk, (bytes, bytearray)):
+                self.reject("callback source chunk cap")
+            if len(data) + len(chunk) > self.MAX_SOURCE_BYTES:
+                self.reject("callback history source cap")
+            data.extend(chunk)
+        self.scan(data)
diff --git a/tests/workflows/custom_ric_sdk.py b/tests/workflows/custom_ric_sdk.py
new file mode 100644
index 00000000..0682428c
--- /dev/null
+++ b/tests/workflows/custom_ric_sdk.py
@@ -0,0 +1,398 @@
+"""Ordinary boto3 acceptance of independent custom Rust RIC images."""
+import concurrent.futures
+import contextlib
+import hmac
+import http.server
+import json
+import os
+import socket
+import sys
+import threading
+import time
+import uuid
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+import boto3
+from botocore.config import Config
+
+
+def unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        assert key not in result, "duplicate collector field"
+        result[key] = value
+    return result
+
+
+class Collector(http.server.ThreadingHTTPServer):
+    """Two bounded causal barriers; valid completions stay held until both reject."""
+    daemon_threads = False
+    block_on_close = True
+
+    def __init__(self):
+        self.condition = threading.Condition()
+        self.token = uuid.uuid4().hex
+        self.consumed = {}
+        self.checked = {}
+        self.aborted = False
+        self.deadline = time.monotonic() + 90
+        self.slots = threading.BoundedSemaphore(4)
+        self.connections = set()
+        super().__init__(("0.0.0.0", 0), Handler)
+
+    def get_request(self):
+        connection, address = super().get_request()
+        connection.settimeout(2)
+        with self.condition:
+            self.connections.add(connection)
+        return connection, address
+
+    def shutdown_request(self, request):
+        try:
+            super().shutdown_request(request)
+        finally:
+            with self.condition:
+                if request.fileno() < 0:
+                    self.connections.discard(request)
+                self.condition.notify_all()
+
+    def process_request(self, request, address):
+        if not self.slots.acquire(blocking=False):
+            self.shutdown_request(request)
+            return
+        try:
+            super().process_request(request, address)
+        except BaseException:
+            self.slots.release()
+            raise
+
+    def process_request_thread(self, request, address):
+        try:
+            super().process_request_thread(request, address)
+        finally:
+            self.slots.release()
+
+    def abort(self, close_connections=True):
+        with self.condition:
+            self.aborted = True
+            self.condition.notify_all()
+            connections = tuple(self.connections) if close_connections else ()
+        for connection in connections:
+            try:
+                connection.shutdown(socket.SHUT_RDWR)
+            except OSError:
+                pass
+
+    def exchange(self, path, event):
+        with self.condition:
+            assert time.monotonic() < self.deadline and not self.aborted
+            lane, request_id = event["lane"], event["requestId"]
+            assert lane in ("A", "B") and str(uuid.UUID(request_id)) == request_id
+            if path == "/consume":
+                assert lane not in self.consumed and request_id not in self.consumed.values()
+                assert set(event) == {"lane", "requestId"}
+                self.consumed[lane] = request_id
+                state = self.consumed
+            else:
+                assert path == "/checked" and len(self.consumed) == 2
+                assert set(event) == {"lane", "requestId", "statuses"}
+                assert self.consumed[lane] == request_id and lane not in self.checked
+                assert event["statuses"] == [400, 400, 400]
+                self.checked[lane] = request_id
+                state = self.checked
+            self.condition.notify_all()
+            while len(state) != 2 and not self.aborted:
+                remaining = self.deadline - time.monotonic()
+                assert remaining > 0, "causal barrier deadline"
+                self.condition.wait(remaining)
+            assert not self.aborted and time.monotonic() < self.deadline
+            if path == "/consume":
+                return {"foreignRequestId": self.consumed["B" if lane == "A" else "A"]}
+            return {"release": True}
+
+
+class BoundedHeaders:
+    def __init__(self, stream):
+        self.stream, self.remaining = stream, 4096
+
+    def readline(self, limit=-1):
+        bound = self.remaining + 1 if limit < 0 else min(limit, self.remaining + 1)
+        line = self.stream.readline(bound)
+        self.remaining -= len(line)
+        if self.remaining < 0:
+            raise ValueError("collector header limit")
+        return line
+
+    def __getattr__(self, name):
+        return getattr(self.stream, name)
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+
+    def handle(self):
+        self.rfile = BoundedHeaders(self.rfile)
+        try:
+            super().handle()
+        except (OSError, ValueError):
+            self.server.abort(close_connections=False)
+            self.close_connection = True
+
+    def log_message(self, *_args):
+        pass
+
+    def do_POST(self):
+        self.connection.settimeout(15)
+        observer = None
+        keep_alive, reply_written = False, None
+        try:
+            assert len(self.headers.get_all("x-fixture-token", [])) == 1
+            assert hmac.compare_digest(self.headers["x-fixture-token"], self.server.token)
+            assert len(self.headers.get_all("Content-Length", [])) == 1
+            assert "Transfer-Encoding" not in self.headers
+            length = int(self.headers["Content-Length"])
+            assert 0 < length <= 2048
+            raw = self.rfile.read(length)
+            assert len(raw) == length
+            event = json.loads(raw, object_pairs_hook=unique_object)
+            policy = getattr(self.server, "transport_policy", None)
+            if policy is not None:
+                keep_alive, reply_written = policy(self.connection, self.path, event)
+                assert type(keep_alive) is bool and callable(reply_written)
+            observer = getattr(self.server, "observe_transport", None)
+            if observer is not None:
+                observer_context = observer(self.path, "accepted")
+            result = self.server.exchange(self.path, event)
+            data, code = json.dumps(result).encode(), 200
+        except BaseException:
+            self.server.abort(close_connections=False)
+            data, code = b'{}', 400
+        self.send_response(code)
+        self.send_header("Content-Length", str(len(data)))
+        self.send_header("Connection", "keep-alive" if code == 200 and keep_alive else "close")
+        self.end_headers()
+        self.wfile.write(data)
+        self.close_connection = not (code == 200 and keep_alive)
+        if code == 200 and reply_written is not None:
+            reply_written()
+        if code == 200 and observer is not None:
+            observer(self.path, "written", observer_context)
+
+
+@contextlib.contextmanager
+def collecting(factory=Collector):
+    server = factory()
+    worker = threading.Thread(target=server.serve_forever, kwargs={"poll_interval": 0.05})
+    worker.start()
+    try:
+        yield server
+    finally:
+        server.abort()
+        server.shutdown()
+        server.server_close()
+        worker.join(5)
+        assert not worker.is_alive(), "collector thread did not join"
+
+
+class Matrix:
+    def __init__(self, endpoint, image, architecture):
+        self.client = boto3.client(
+            "lambda", endpoint_url=endpoint, region_name="us-east-1",
+            aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+            config=Config(retries={"max_attempts": 0}, connect_timeout=2, read_timeout=60),
+        )
+        self.image, self.architecture = image, architecture
+        self.functions = []
+
+    def settled(self, name, updating=False):
+        deadline = time.monotonic() + 120
+        while True:
+            state = self.client.get_function_configuration(FunctionName=name)
+            if state["State"] == "Active" and (not updating or state["LastUpdateStatus"] == "Successful"):
+                return state
+            assert state["State"] != "Failed" and state.get("LastUpdateStatus") != "Failed", state
+            assert time.monotonic() < deadline, "image deployment did not settle"
+            time.sleep(0.025)
+
+    def create(self, **fields):
+        name = "CustomImage" + uuid.uuid4().hex
+        self.client.create_function(
+            FunctionName=name, Role="arn:aws:iam::000000000000:role/Docker",
+            PackageType="Image", Architectures=[self.architecture], Timeout=fields.pop("Timeout", 30),
+            MemorySize=fields.pop("MemorySize", 128), Code={"ImageUri": self.image}, **fields,
+        )
+        self.functions.append(name)
+        self.settled(name)
+        return name
+
+    def invoke(self, name, event=None, qualifier=None, failed=False, client=None):
+        options = {} if qualifier is None else {"Qualifier": qualifier}
+        response = (self.client if client is None else client).invoke(FunctionName=name, Payload=json.dumps(event or {}).encode(), **options)
+        with response["Payload"] as body:
+            raw = body.read(65537)
+        assert len(raw) <= 65536
+        assert response["StatusCode"] == 200
+        assert response.get("FunctionError") == ("Unhandled" if failed else None)
+        return json.loads(raw), response.get("ExecutedVersion")
+
+    def cleanup(self):
+        errors = []
+        for name in self.functions:
+            try:
+                self.client.delete_function(FunctionName=name)
+            except BaseException as error:
+                errors.append(error)
+        assert not errors, "custom image function cleanup failed"
+
+    def defaults_and_error(self):
+        name = self.create()
+        ids = set()
+        for value, counter in ((35, 1), (0, 2)):
+            output, _ = self.invoke(name, {"value": value})
+            assert output["computed"] == value + 7 and output["counter"] == counter
+            assert output["imageRevision"] == "A" and output["cwd"] == "/var/task"
+            assert output["arguments"] == ["/image-bootstrap", "inherited-command"]
+            assert str(uuid.UUID(output["requestId"])) == output["requestId"]
+            ids.add(output["requestId"])
+        assert len(ids) == 2
+        error, _ = self.invoke(name, {"mode": "error"}, failed=True)
+        assert error["errorType"] == "ImageFixtureError"
+        output, _ = self.invoke(name, {"value": 10})
+        assert output["computed"] == 17
+
+    def overrides(self):
+        empty = self.create(ImageConfig={"Command": []})
+        output, _ = self.invoke(empty)
+        assert output["arguments"] == ["/image-bootstrap"]
+        literal = "$(touch /tmp/rustack-shell-side-effect); printf NOT_A_SHELL"
+        replaced = self.create(ImageConfig={"EntryPoint": ["/alternate-bootstrap"],
+                                           "Command": [literal], "WorkingDirectory": "/tmp"})
+        output, _ = self.invoke(replaced)
+        assert output["arguments"] == ["/alternate-bootstrap", literal]
+        assert output["cwd"] == "/tmp" and output["shellSideEffect"] is False
+        cleared = self.create(ImageConfig={"EntryPoint": [], "Command": ["/image-bootstrap", "empty-entry"]})
+        output, _ = self.invoke(cleared)
+        assert output["arguments"] == ["/image-bootstrap", "empty-entry"]
+
+    def concurrent_identity(self, host):
+        with collecting() as collector:
+            environment = {"IMAGE_FIXTURE_COLLECTOR": f"{host}:{collector.server_port}",
+                           "IMAGE_FIXTURE_TOKEN": collector.token}
+            names = [self.create(Environment={"Variables": dict(environment, IMAGE_FIXTURE_LANE=lane)})
+                     for lane in ("A", "B")]
+            for name in names:
+                self.invoke(name, {"value": 0})  # Seed the stale-ID control in each warm process.
+            with concurrent.futures.ThreadPoolExecutor(max_workers=2) as pool:
+                jobs = [pool.submit(self.invoke, name, {"value": value, "mode": "barrier-forge"})
+                        for name, value in zip(names, (35, 93), strict=True)]
+                outputs = [job.result(timeout=120)[0] for job in jobs]
+            assert [output["computed"] for output in outputs] == [42, 100]
+            assert all(output["counter"] == 2 and output["forgedStatuses"] == [400, 400, 400]
+                       for output in outputs)
+            assert len({output["requestId"] for output in outputs}) == 2
+            assert collector.consumed == collector.checked
+            assert set(collector.consumed.values()) == {output["requestId"] for output in outputs}
+
+    def deploy_revision(self, name, tag):
+        self.client.create_function(FunctionName=name, Role="arn:aws:iam::000000000000:role/Docker",
+                                    PackageType="Image", Architectures=[self.architecture], Timeout=30,
+                                    MemorySize=128, Code={"ImageUri": tag})
+        self.settled(name)
+        version = self.client.publish_version(FunctionName=name)["Version"]
+        assert version == "1"
+        self.client.create_alias(FunctionName=name, Name="live", FunctionVersion=version)
+        result, executed = self.invoke(name, {"value": 35}, qualifier="live")
+        assert result["imageRevision"] == "A" and result["computed"] == 42 and executed == "1"
+
+    def inflight_revision(self, tag, host):
+        with collecting() as collector:
+            environment = {"IMAGE_FIXTURE_COLLECTOR": f"{host}:{collector.server_port}",
+                           "IMAGE_FIXTURE_TOKEN": collector.token}
+            original = self.create(Environment={"Variables": dict(environment, IMAGE_FIXTURE_LANE="A")})
+            version = self.client.publish_version(FunctionName=original)["Version"]
+            self.invoke(original, qualifier=version)
+            helper = self.create(Environment={"Variables": dict(environment, IMAGE_FIXTURE_LANE="B")})
+            self.invoke(helper)
+            with concurrent.futures.ThreadPoolExecutor(max_workers=2) as pool:
+                old = pool.submit(self.invoke, original, {"value":35, "mode":"barrier-forge"}, version)
+                with collector.condition:
+                    while "A" not in collector.consumed and not collector.aborted:
+                        remaining = collector.deadline - time.monotonic()
+                        assert remaining > 0, "published A did not consume its event"
+                        collector.condition.wait(remaining)
+                    assert not collector.aborted and "B" not in collector.consumed
+                self.client.update_function_code(FunctionName=original, ImageUri=tag)
+                state = self.settled(original, updating=True)
+                assert state["LastUpdateStatus"] == "Successful"
+                with collector.condition:
+                    assert set(collector.consumed) == {"A"} and not collector.checked
+                assert not old.done(), "old revision escaped its causal hold"
+                other = pool.submit(self.invoke, helper, {"value":93, "mode":"barrier-forge"})
+                output, executed = old.result(timeout=120)
+                helper_output, _ = other.result(timeout=120)
+            assert output["imageRevision"] == "A" and output["computed"] == 42 and executed == version
+            assert output["requestId"] == collector.consumed["A"]
+            assert output["forgedStatuses"] == helper_output["forgedStatuses"] == [400, 400, 400]
+            assert collector.checked == collector.consumed
+            latest, _ = self.invoke(original)
+            assert latest["imageRevision"] == "B", "latest did not select B after A completed"
+
+    def update_revision(self, name, tag):
+        self.functions.append(name)
+        for qualifier in (None, "1", "live"):
+            output, _ = self.invoke(name, qualifier=qualifier)
+            assert output["imageRevision"] == "A", "tag movement changed captured code"
+        self.client.update_function_code(FunctionName=name, ImageUri=tag)
+        self.settled(name, updating=True)
+        output, _ = self.invoke(name)
+        assert output["imageRevision"] == "B"
+        version = self.client.publish_version(FunctionName=name)["Version"]
+        assert version == "2"
+        self.client.update_alias(FunctionName=name, Name="live", FunctionVersion=version)
+        for qualifier, expected in (("1", "A"), ("2", "B"), ("live", "B")):
+            output, executed = self.invoke(name, qualifier=qualifier)
+            assert output["imageRevision"] == expected
+            assert executed == ("2" if qualifier == "live" else qualifier)
+            assert output["invokedArn"].endswith(":" + qualifier)
+
+
+def main():
+    endpoint, image, architecture, phase, host, name, tag = sys.argv[1:]
+    matrix = Matrix(endpoint, image, architecture)
+    try:
+        if phase == "contracts":
+            matrix.defaults_and_error()
+            matrix.overrides()
+            matrix.concurrent_identity(host)
+            cases = ["custom-ric-compute-error", "imageconfig-inherit-clear-replace", "literal-argv", "active-cross-invocation-rejection"]
+        elif phase == "deploy":
+            matrix.deploy_revision(name, tag)
+            cases = ["published-A"]
+        else:
+            assert phase == "update"
+            matrix.update_revision(name, tag)
+            matrix.inflight_revision(tag, host)
+            # The separate in-flight/helper resources occupy both configured
+            # environment slots; the original published/latest launches are cold.
+            for qualifier, expected in (("1", "A"), (None, "B")):
+                output, executed = matrix.invoke(name, qualifier=qualifier)
+                assert output["imageRevision"] == expected and output["counter"] == 1
+                assert executed == ("1" if qualifier == "1" else "$LATEST")
+            cases = ["tag-move-retains-A", "update-selects-B", "published-alias-isolation", "published-inflight-A-completes-after-B-update"]
+    finally:
+        primary = sys.exc_info()[1]
+        try:
+            matrix.cleanup()
+        except BaseException:
+            if primary is None:
+                raise
+            primary.add_note("custom image function cleanup also failed")
+    report = {"schemaVersion": 1, "cases": cases}
+    if phase == "update":
+        report["coldRevisionCounters"] = [1, 1]
+    print(json.dumps(report), flush=True)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/workflows/docker-required-suites.json b/tests/workflows/docker-required-suites.json
new file mode 100644
index 00000000..126e7968
--- /dev/null
+++ b/tests/workflows/docker-required-suites.json
@@ -0,0 +1,130 @@
+{
+  "schemaVersion": 1,
+  "profile": "rustack-docker-image-v1",
+  "qualification": "docker-image-functional",
+  "suites": [
+    {
+      "id": "docker-core",
+      "tests": [
+        "docker::binding::tests::real::test_should_bind_real_installation_across_reacquisition_and_reject_other_daemon",
+        "docker::recovery::code::tests::real::test_should_recover_real_code_volume_and_unstarted_loader_across_reacquisition",
+        "docker::pull::tests::real::test_should_pull_approved_immutable_image_prepare_live_pin_and_join_cleanup",
+        "docker::recovery::images::tests::test_should_recover_real_private_alias_across_directory_reacquisition::case_1_unknown_visible",
+        "docker::recovery::images::tests::test_should_recover_real_private_alias_across_directory_reacquisition::case_2_committed_absent",
+        "docker::recovery::namespace::tests::real::test_should_reconcile_real_namespace_and_preserve_unrecorded_observations::case_1_recorded",
+        "docker::recovery::namespace::tests::real::test_should_reconcile_real_namespace_and_preserve_unrecorded_observations::case_2_orphan_container",
+        "docker::recovery::namespace::tests::real::test_should_reconcile_real_namespace_and_preserve_unrecorded_observations::case_3_orphan_alias",
+        "docker::recovery::tests::test_should_reconcile_real_previous_run_containers_from_durable_intents"
+      ]
+    },
+    {
+      "id": "docker-endpoint",
+      "tests": [
+        "test_should_qualify_actual_container_endpoint_and_retain_physical_retirement::case_1_matching",
+        "test_should_qualify_actual_container_endpoint_and_retain_physical_retirement::case_2_wrong_instance",
+        "test_should_qualify_actual_container_endpoint_and_retain_physical_retirement::case_3_unavailable_listener",
+        "test_should_qualify_actual_container_endpoint_and_retain_physical_retirement::case_4_abandoned"
+      ]
+    },
+    {
+      "id": "docker-environment",
+      "tests": [
+        "test_should_enforce_captured_handler_timeout_and_replace_the_retired_pooled_environment",
+        "test_should_isolate_requested_log_tails_across_logging_silent_and_uncaptured_warm_calls",
+        "test_should_join_pool_retirement_after_cancelling_an_observed_running_handler::case_1_abandoned",
+        "test_should_join_pool_retirement_after_cancelling_an_observed_running_handler::case_2_awaited_settlement",
+        "test_should_own_real_initialization_warm_calls_function_error_and_cleanup",
+        "test_should_pool_real_warm_calls_and_evict_capacity_across_revision_changes",
+        "test_should_retire_running_code_after_abandoned_call_and_join_all_owned_io"
+      ]
+    },
+    {
+      "id": "docker-executor",
+      "tests": [
+        "test_should_deploy_publish_alias_and_invoke_real_images_through_boto3_http"
+      ]
+    },
+    {
+      "id": "docker-probe",
+      "tests": [
+        "test_should_qualify_actual_kernel_limits_and_join_probe_retirement::case_1_disconnected",
+        "test_should_qualify_actual_kernel_limits_and_join_probe_retirement::case_2_operator_bridge"
+      ]
+    },
+    {
+      "id": "docker-wire",
+      "tests": [
+        "test_should_execute_real_ric_over_production_wire_with_large_binary_frames_and_cleanup",
+        "test_should_preserve_empty_overrides_in_actual_docker_create_merging",
+        "code::test_should_upload_zip_code_to_a_private_volume_and_consume_it_read_only",
+        "code::test_should_prepare_code_with_retained_owner_and_consume_it_read_only",
+        "code::test_should_execute_the_same_provided_zip_bytes_through_real_linux_native_and_join_children"
+      ]
+    },
+    {
+      "id": "ordinary-startup",
+      "tests": [
+        "test_should_enforce_image_callback_retry_heartbeat_timeouts_and_stop",
+        "test_should_execute_custom_ric_imageconfig_and_immutable_revisions_through_ordinary_service",
+        "test_should_execute_image_sdk_and_nested_asl_from_a_server_container",
+        "test_should_execute_image_sdk_and_nested_asl_from_the_release_image",
+        "test_should_execute_local_s3_and_dynamodb_from_an_explicit_image_sdk_context",
+        "test_should_execute_official_node_image_with_signed_sdks_and_asl",
+        "test_should_execute_ordinary_provided_zip_and_join_owned_retirement::case_1_deployments",
+        "test_should_execute_ordinary_provided_zip_and_join_owned_retirement::case_2_faults",
+        "test_should_execute_ordinary_provided_zip_and_join_owned_retirement::case_3_initializing",
+        "test_should_execute_ordinary_provided_zip_and_join_owned_retirement::case_4_busy",
+        "test_should_execute_real_image_callbacks_before_and_after_lambda_response",
+        "test_should_manage_a_real_image_workflow_through_pulumi_lifecycle",
+        "test_should_measure_one_hundred_warm_image_invocations",
+        "test_should_measure_twenty_preloaded_cold_image_environments",
+        "test_should_preserve_live_warm_instance_during_other_owner_crash_recovery",
+        "test_should_preserve_previous_snapshot_when_docker_cleanup_cannot_be_confirmed",
+        "test_should_qualify_ordinary_binary_and_retain_negative_startup_cleanup::case_1_disconnected",
+        "test_should_qualify_ordinary_binary_and_retain_negative_startup_cleanup::case_2_connected",
+        "test_should_qualify_ordinary_binary_and_retain_negative_startup_cleanup::case_3_missing_relay",
+        "test_should_qualify_ordinary_binary_and_retain_negative_startup_cleanup::case_4_legacy",
+        "test_should_qualify_ordinary_binary_and_retain_negative_startup_cleanup::case_5_wrong_endpoint",
+        "test_should_refuse_provided_zip_archives_without_configured_runtime",
+        "test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup",
+        "test_should_refuse_unreachable_server_container_gateway_and_join_startup_cleanup",
+        "test_should_reject_wrong_image_sdk_credentials_without_ambient_fallback",
+        "test_should_restore_provided_zip_archives_without_replay_and_preserve_invalid_generations",
+        "test_should_restore_real_image_archive_and_preserve_generations_after_rejection",
+        "test_should_restore_saved_image_after_tag_move_and_reject_absent_or_foreign_candidates",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_01_allocating",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_02_cleanup",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_03_daemon_loss",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_04_deployment_saturation",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_05_create_io_timeout",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_06_delete_ack_timeout",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_07_interrupted_pull",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_08_negative_images",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_09_runtime_http_bounds",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_10_global_execution_limit",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_11_default_function_limit",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_12_independent_memory_limit",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_13_independent_environment_limit",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_14_zip_allocating",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_15_zip_cleanup",
+        "test_should_retain_actual_management_io_through_cancellation_and_deployment_faults::case_16_composite_pressure",
+        "test_should_retire_the_pulumi_plugin_tree_after_controller_stop",
+        "test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts",
+        "test_should_settle_real_image_faults_and_public_cancellation_admission::case_1_typed_faults",
+        "test_should_settle_real_image_faults_and_public_cancellation_admission::case_2_initializing_disconnect",
+        "test_should_settle_real_image_faults_and_public_cancellation_admission::case_3_busy_disconnect",
+        "test_should_settle_real_image_faults_and_public_cancellation_admission::case_4_accepted_work_shutdown"
+      ]
+    },
+    {
+      "id": "relay-runtime",
+      "tests": [
+        "test_should_cancel_a_running_official_ric_and_remove_both_containers",
+        "test_should_compute_reuse_and_report_official_ric_handler_errors",
+        "test_should_drive_real_ric_through_host_client_and_join_its_streams",
+        "test_should_exit_on_close_eof_truncation_and_io_timeout_with_owned_pipes",
+        "test_should_reconcile_failed_setup_and_reap_an_expired_cli_helper"
+      ]
+    }
+  ]
+}
diff --git a/tests/workflows/docker_functional.py b/tests/workflows/docker_functional.py
new file mode 100644
index 00000000..0db74797
--- /dev/null
+++ b/tests/workflows/docker_functional.py
@@ -0,0 +1,100 @@
+"""Explicit Linux/Desktop resource controller with engine-bound command evidence."""
+import hashlib
+import ipaddress
+import json
+import os
+from pathlib import Path
+import re
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import ActionError
+import rootless_platform as storage
+import rootless_resources as resources
+from docker_required_suites import parse_manifest
+from functional_inventory import execute
+from linux_performance import Runner, bounded_read, deadline_guard, document, require, safe_path
+from rootless_functional import SUITES, artifact_seal, environment, observe_clean, retain_source_seal, run_case, source_seal
+from image_performance_images import catalog, fenced
+
+
+def run(config_path, root, owner, deadline):
+    require(not os.path.lexists(root), "docker-functional-evidence-exists")
+    raw = bounded_read(config_path, 65536)
+    config = document(raw)
+    require(isinstance(config, dict) and set(config) == {"socket", "otherSocket", "daemonSocket", "socketGid",
+        "network", "gateway", "fixtures", "sdk", "target", "buildReceipt"}, "docker-functional-config")
+    socket, other, daemon, fixtures, sdk, target = (safe_path(config[key]) for key in
+        ("socket", "otherSocket", "daemonSocket", "fixtures", "sdk", "target"))
+    require(isinstance(config["socketGid"], str) and re.fullmatch(r"0|[1-9][0-9]{0,9}", config["socketGid"])
+            and int(config["socketGid"]) <= 4294967295 and isinstance(config["network"], str)
+            and re.fullmatch(r"[A-Za-z0-9_.-]{1,64}", config["network"]), "docker-functional-topology")
+    gateway = ipaddress.IPv4Address(config["gateway"])
+    require(gateway.is_private and not gateway.is_unspecified and not gateway.is_multicast, "docker-functional-gateway")
+    endpoint = "unix://" + str(socket)
+    result = owner.run(["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline)
+    require(result.code == 0 and result.stderr == b"", "docker-functional-engine")
+    engine = result.stdout.decode().strip()
+    require(str(socket) != str(other), "docker-functional-distinct-daemons")
+    peer = owner.run(["docker", "--host", "unix://" + str(other), "info", "--format", "{{.ID}}"], deadline)
+    require(peer.code == 0 and peer.stderr == b"" and peer.stdout.decode().strip() != engine, "docker-functional-peer")
+    peer_engine = peer.stdout.decode().strip()
+    peer_ids = catalog(owner, "unix://" + str(other), deadline, peer_engine)
+    network = document(fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "network", "inspect", config["network"]], deadline))
+    require(isinstance(network, list) and len(network) == 1 and network[0].get("Driver") == "bridge"
+            and network[0].get("Name") == config["network"], "docker-functional-network")
+    root.mkdir(mode=0o700)
+    before = source_seal(owner, deadline)
+    artifacts = artifact_seal(fixtures, sdk)
+    manifest_raw = bounded_read(Path(__file__).with_name("docker-required-suites.json"), 65536)
+    required = parse_manifest(manifest_raw)
+    require(set(required) == set(SUITES), "docker-functional-manifest")
+    selected = environment({"socket":{"path":str(daemon)}, "namespaceSocketGid":int(config["socketGid"])},
+                           endpoint, {"name":config["network"]}, fixtures, sdk, other)
+    selected["RUSTACK_RUNTIME_GATEWAY_HOST"] = str(gateway)
+    owner.environment.update(selected)
+    ids = catalog(owner, endpoint, deadline, engine)
+    images = {name:resources.captured(owner, endpoint, name, deadline, engine) for name in resources.FULL_SOURCES}
+    built_path = safe_path(config["buildReceipt"])
+    built = document(bounded_read(built_path, 65536))
+    current_seal = hashlib.sha256(json.dumps(before, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    require(built.get("sourceSealSha256") == current_seal and built.get("engine") == engine
+            and built.get("allChildGroupsJoined") is True
+            and set(built.get("images", {})) == set(resources.REFRESH_SOURCES)
+            and all(images[name] == image for name, image in built["images"].items())
+            and hashlib.sha256(bounded_read(built_path.parent / "build.log", 16 * 1024 * 1024)).hexdigest() == built.get("logSha256"),
+            "docker-functional-stale-production-images")
+    source = retain_source_seal(root, before)
+    storage.publish(root / "entry.json", {"schemaVersion":1, "engine":engine, **source, "environment":selected,
+        "targetDirectory":str(target), "artifacts":artifacts, "images":images,
+        "manifestSha256":hashlib.sha256(manifest_raw).hexdigest(), "configSha256":hashlib.sha256(raw).hexdigest()})
+    initial = root / "before"; initial.mkdir(mode=0o700)
+    observe_clean(owner, endpoint, engine, deadline, initial)
+    rows = execute(owner, ["cargo", "test", "--locked", "--target-dir", str(target)], SUITES, required, required,
+                   root, deadline, run_case, resources.verify_output,
+                   lambda directory: observe_clean(owner, endpoint, engine, deadline, directory))
+    require(source_seal(owner, deadline) == before and artifact_seal(fixtures, sdk) == artifacts
+            and bounded_read(config_path, 65536) == raw and catalog(owner, endpoint, deadline, engine) == ids
+            and all(resources.captured(owner, endpoint, name, deadline, engine) == image for name, image in images.items())
+            and catalog(owner, "unix://" + str(other), deadline, peer_engine) == peer_ids,
+            "docker-functional-source-changed")
+    failed = [row["name"] for row in rows if row["code"] != 0]
+    storage.publish(root / "report.json", {"schemaVersion":1, "engine":engine, "attempted":len(rows),
+        "passed":len(rows)-len(failed), "failed":failed, "rows":rows, "scope":"complete-functional-inventory",
+        "allChildGroupsJoined":not owner.unsettled})
+    return 1 if failed else 0
+
+
+def main():
+    try:
+        require(len(sys.argv) == 3, "docker-functional-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard(3600, owner) as deadline:
+            return run(safe_path(sys.argv[1]), safe_path(sys.argv[2]), owner, deadline)
+    except (ActionError, OSError, ValueError, TypeError, KeyError):
+        print("docker-functional-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/docker_io_proxy.py b/tests/workflows/docker_io_proxy.py
new file mode 100644
index 00000000..29dcd4c1
--- /dev/null
+++ b/tests/workflows/docker_io_proxy.py
@@ -0,0 +1,524 @@
+"""Transparent, bounded real-daemon IO barriers for ordinary-server acceptance."""
+import contextlib
+import json
+import re
+import selectors
+import socket
+import threading
+import traceback
+import time
+import urllib.parse
+import uuid
+
+from custom_ric_sdk import unique_object
+from lambda_fault_support import identity
+
+
+class ProtocolError(ValueError):
+    """Static fixture framing failure, without request or daemon bytes."""
+
+
+def reject_constant(_value):
+    raise ProtocolError("non-JSON pull number")
+
+
+def exact(stream, count, deadline):
+    output = bytearray()
+    while len(output) < count:
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise ProtocolError("proxy IO deadline")
+        stream.settimeout(min(3, remaining))
+        try:
+            part = stream.recv(min(16384, count - len(output)))
+        except socket.timeout:
+            continue
+        if not part:
+            raise EOFError("proxy stream ended")
+        if time.monotonic() >= deadline:
+            raise ProtocolError("proxy late IO completion")
+        output.extend(part)
+    return bytes(output)
+
+
+def line(stream, deadline, maximum=4096):
+    output = bytearray()
+    while len(output) <= maximum:
+        output.extend(exact(stream, 1, deadline))
+        if len(output) > maximum:
+            raise ProtocolError("proxy line cap")
+        if output.endswith(b"\r\n"):
+            return bytes(output)
+    raise ProtocolError("proxy line cap")
+
+
+def head(stream, deadline):
+    first = line(stream, deadline)
+    raw, fields = bytearray(first), {}
+    for _ in range(65):
+        value = line(stream, deadline)
+        raw.extend(value)
+        if len(raw) > 16384:
+            raise ProtocolError("proxy header cap")
+        if value == b"\r\n":
+            return first, fields, bytes(raw)
+        name, separator, value = value[:-2].partition(b":")
+        if not separator or re.fullmatch(rb"[!#$%&'*+.^_`|~0-9A-Za-z-]+", name) is None:
+            raise ProtocolError("proxy header syntax")
+        name = name.lower()
+        if name in fields:
+            raise ProtocolError("proxy duplicate header")
+        fields[name] = value.strip()
+    raise ProtocolError("proxy header count")
+
+
+def framing(fields):
+    if b"content-length" in fields and b"transfer-encoding" in fields:
+        raise ProtocolError("proxy ambiguous body framing")
+    if b"transfer-encoding" in fields and fields[b"transfer-encoding"].lower() != b"chunked":
+        raise ProtocolError("proxy unsupported transfer coding")
+    length = fields.get(b"content-length", b"0")
+    if re.fullmatch(rb"[0-9]{1,10}", length) is None:
+        raise ProtocolError("proxy invalid body length")
+    return int(length)
+
+
+def body(stream, fields, maximum, deadline):
+    length = framing(fields)
+    if b"transfer-encoding" not in fields:
+        if length > maximum:
+            raise ProtocolError("proxy body cap")
+        value = exact(stream, length, deadline)
+        return value, value
+    raw, decoded = bytearray(), bytearray()
+    while True:
+        chunk = line(stream, deadline)
+        size = chunk[:-2]
+        if re.fullmatch(rb"[0-9A-Fa-f]{1,8}", size) is None:
+            raise ProtocolError("proxy invalid chunk size")
+        size = int(size, 16)
+        if size > maximum - len(decoded) or len(raw) + len(chunk) > maximum + 16384:
+            raise ProtocolError("proxy chunk body cap")
+        raw.extend(chunk)
+        if size == 0:
+            trailer_bytes = 0
+            for _ in range(65):
+                trailer = line(stream, deadline)
+                trailer_bytes += len(trailer)
+                if trailer_bytes > 16384:
+                    raise ProtocolError("proxy trailer cap")
+                if len(raw) + len(trailer) > maximum + 16384:
+                    raise ProtocolError("proxy encoded body cap")
+                raw.extend(trailer)
+                if trailer == b"\r\n":
+                    return bytes(raw), bytes(decoded)
+            raise ProtocolError("proxy trailer count")
+        if len(raw) + size + 2 > maximum + 16384:
+            raise ProtocolError("proxy encoded body cap")
+        value = exact(stream, size, deadline)
+        ending = exact(stream, 2, deadline)
+        if ending != b"\r\n":
+            raise ProtocolError("proxy truncated chunk")
+        raw.extend(value + ending)
+        decoded.extend(value)
+
+
+def duplex(left, right, stopped, deadline):
+    """Stream upgrades without read-ahead; propagate each half-close separately."""
+    peers = {left: right, right: left}
+    with selectors.DefaultSelector() as selected:
+        for stream in peers:
+            stream.settimeout(1)
+            selected.register(stream, selectors.EVENT_READ)
+        while selected.get_map() and not stopped.is_set():
+            if time.monotonic() >= deadline:
+                raise ProtocolError("proxy tunnel deadline")
+            for key, _ in selected.select(0.1):
+                source, target = key.fileobj, peers[key.fileobj]
+                value = source.recv(16384)
+                if value:
+                    target.sendall(value)
+                else:
+                    selected.unregister(source)
+                    with contextlib.suppress(OSError):
+                        target.shutdown(socket.SHUT_WR)
+
+
+class Progress:
+    """Validate a bounded real NDJSON stream without retaining daemon messages."""
+    def __init__(self):
+        self.pending, self.count = bytearray(), 0
+
+    def feed(self, value):
+        for part in value.splitlines(keepends=True):
+            if len(self.pending) + len(part) > 65536:
+                raise ProtocolError("pull progress line cap")
+            self.pending.extend(part)
+            if self.pending.endswith(b"\n"):
+                row = json.loads(self.pending, object_pairs_hook=unique_object, parse_constant=reject_constant)
+                if not isinstance(row, dict) or "error" in row or "errorDetail" in row:
+                    raise ProtocolError("real pull error record")
+                if not isinstance(row.get("status"), str) or not row["status"]:
+                    raise ProtocolError("pull missing progress status")
+                self.count += 1
+                if self.count > 65536:
+                    raise ProtocolError("pull progress count cap")
+                self.pending.clear()
+
+    def finish(self):
+        if self.pending or not self.count:
+            raise ProtocolError("pull missing complete progress")
+
+
+def interrupted_pull(backend, client, headers, deadline, cut):
+    """Cut only the front stream; positively drain the retained backend framing."""
+    framing(headers)
+    if headers.get(b"transfer-encoding", b"").lower() != b"chunked":
+        raise ProtocolError("real pull must be chunked")
+    progress, decoded, encoded, severed = Progress(), 0, 0, False
+    maximum = 16 * 1024 * 1024
+    while True:
+        chunk = line(backend, deadline)
+        if re.fullmatch(rb"[0-9A-Fa-f]{1,8}\r\n", chunk) is None:
+            raise ProtocolError("pull chunk size")
+        size = int(chunk[:-2], 16)
+        encoded += len(chunk) + (size + 2 if size else 0)
+        decoded += size
+        if decoded > maximum or encoded > maximum + 65536:
+            raise ProtocolError("pull stream cap")
+        if not size:
+            trailer_bytes = 0
+            for _ in range(65):
+                trailer = line(backend, deadline)
+                trailer_bytes += len(trailer)
+                if trailer_bytes > 16384 or encoded + trailer_bytes > maximum + 65536:
+                    raise ProtocolError("pull trailer cap")
+                if trailer == b"\r\n":
+                    progress.finish()
+                    if not severed:
+                        raise ProtocolError("pull never interrupted")
+                    if time.monotonic() >= deadline:
+                        raise ProtocolError("pull late terminal completion")
+                    return progress.count
+            raise ProtocolError("pull trailer count")
+        if not severed:
+            client.sendall(chunk)
+        remaining = size
+        while remaining:
+            value = exact(backend, min(16384, remaining), deadline)
+            progress.feed(value)
+            if not severed:
+                client.sendall(value)
+                if progress.count:
+                    client.shutdown(socket.SHUT_WR)
+                    severed = True
+                    cut()
+            remaining -= len(value)
+        ending = exact(backend, 2, deadline)
+        if ending != b"\r\n":
+            raise ProtocolError("pull truncated backend chunk")
+        if not severed:
+            client.sendall(ending)
+
+
+class Proxy:
+    def __init__(self, path, daemon, restore=None):
+        assert path.startswith("/") and daemon.startswith("/")
+        assert len(path.encode()) < 104 and len(daemon.encode()) < 104
+        self.path, self.daemon, self.restore_marker = path, daemon, restore
+        self.condition = threading.Condition()
+        self.stopped = threading.Event()
+        self.deadline = time.monotonic() + 480
+        self.sockets, self.workers, self.records, self.starts, self.errors = set(), [], {}, set(), []
+        self.rule, self.observed, self.released, self.unavailable = None, [], False, False
+        self.released_records = set()
+        self.failed_image = None
+        self.pull_reference, self.pull_cut, self.pull_done, self.pull_count = None, False, False, 0
+        self.listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        self.listener.bind(path)
+        self.listener.listen(64)
+        self.listener.settimeout(0.05)
+        self.worker = threading.Thread(target=self.serve)
+        self.worker.start()
+
+    def arm(self, kind, owner, count=1):
+        assert kind in ("create", "delete", "delete_ack", "pair_delete", "tag") and count in (1, 2)
+        assert kind != "pair_delete" or count == 2
+        identity(owner)
+        with self.condition:
+            assert self.rule is None and not self.unavailable
+            self.rule = (kind, owner, count, time.monotonic() + 30)
+            self.observed, self.released = [], False
+
+    def gate(self, kind, record):
+        with self.condition:
+            rule = self.rule
+            if rule is None or rule[0] != kind or len(self.observed) >= rule[2]:
+                return
+            if kind == "tag":
+                if record["owner"] != rule[1]:
+                    return
+            elif record["owner"] != rule[1] or record["role"] not in (
+                    ("function", "relay") if kind == "pair_delete" else ("function",)):
+                return
+            assert time.monotonic() < rule[3]
+            self.observed.append(dict(record))
+            self.condition.notify_all()
+            while not self.released and record.get("id") not in self.released_records and not self.stopped.is_set():
+                remaining = rule[3] - time.monotonic()
+                assert remaining > 0, "proxy gate lease expired"
+                self.condition.wait(remaining)
+            assert not self.stopped.is_set() and time.monotonic() < rule[3]
+
+    def wait(self, count, deadline):
+        with self.condition:
+            while len(self.observed) < count and not self.errors:
+                remaining = deadline - time.monotonic()
+                assert remaining > 0, "actual daemon operation gate was not observed"
+                self.condition.wait(remaining)
+            assert not self.errors and time.monotonic() < deadline
+            return [dict(row) for row in self.observed]
+
+    def release(self):
+        with self.condition:
+            assert self.rule is not None
+            self.released = True
+            self.condition.notify_all()
+
+    def release_function(self):
+        with self.condition:
+            assert self.rule is not None and self.rule[0] == "pair_delete"
+            assert not self.released and not self.stopped.is_set() and time.monotonic() < self.rule[3]
+            assert len(self.observed) == 1 and self.observed[0]["role"] == "function"
+            key = self.observed[0]["id"]
+            assert not self.released_records
+            self.released_records.add(key)
+            self.condition.notify_all()
+
+    def restore(self):
+        with self.condition:
+            self.unavailable = False
+            self.failed_image = None
+            self.released = True
+            self.condition.notify_all()
+
+    def fail_image(self, image):
+        assert isinstance(image, str) and 0 < len(image) <= 1024
+        with self.condition:
+            self.failed_image = image
+
+    def loss(self):
+        with self.condition:
+            self.unavailable = True
+            for stream in tuple(self.sockets):
+                with contextlib.suppress(OSError):
+                    stream.shutdown(socket.SHUT_RDWR)
+
+    def interrupt_pull(self, reference):
+        assert re.fullmatch(r"public\.ecr\.aws:443/lambda/nodejs@sha256:[0-9a-f]{64}", reference)
+        with self.condition:
+            assert self.pull_reference is None
+            self.pull_reference = reference
+
+    def wait_pull_cut(self, deadline):
+        """Join publication after actual front shutdown, before backend drain."""
+        with self.condition:
+            while not self.pull_cut and not self.errors:
+                remaining = min(deadline, self.deadline) - time.monotonic()
+                assert remaining > 0, "actual front pull cut was not published"
+                self.condition.wait(remaining)
+            assert self.pull_cut and not self.errors
+            assert time.monotonic() < min(deadline, self.deadline)
+
+    def wait_pull(self, deadline):
+        with self.condition:
+            while not self.pull_done and not self.errors:
+                remaining = deadline - time.monotonic()
+                assert remaining > 0, "actual backend pull did not settle"
+                self.condition.wait(remaining)
+            assert self.pull_done and self.pull_cut and self.pull_count > 0 and not self.errors
+            assert time.monotonic() < deadline
+            return self.pull_count
+
+    def pull(self, backend, client):
+        deadline = min(self.deadline, time.monotonic() + 120)
+        try:
+            first, fields, raw = head(backend, deadline)
+            if first.split(b" ", 2)[1] != b"200":
+                raise ProtocolError("real pull HTTP failure")
+            client.sendall(raw)
+            def cut():
+                with self.condition:
+                    self.pull_cut = True
+                    self.condition.notify_all()
+            count = interrupted_pull(backend, client, fields, deadline, cut)
+            with self.condition:
+                if time.monotonic() >= deadline:
+                    raise ProtocolError("pull late completion publication")
+                self.pull_done, self.pull_count = True, count
+                self.condition.notify_all()
+        except BaseException as error:
+            # A truncated/error backend is never a qualifying front-stream cut.
+            self.failure(error)
+
+    def serve(self):
+        try:
+            while not self.stopped.is_set():
+                if self.restore_marker is not None and self.restore_marker.is_file():
+                    self.restore()
+                if time.monotonic() >= self.deadline:
+                    raise ProtocolError("proxy process deadline")
+                try:
+                    client, _ = self.listener.accept()
+                except socket.timeout:
+                    continue
+                with self.condition:
+                    finished = [worker for worker in self.workers if not worker.is_alive()]
+                    for worker in finished:
+                        worker.join()
+                        self.workers.remove(worker)
+                    if self.unavailable or len(self.workers) >= 64:
+                        client.close()
+                        continue
+                    self.sockets.add(client)
+                    worker = threading.Thread(target=self.connection, args=(client,))
+                    self.workers.append(worker)
+                    worker.start()
+        except OSError as error:
+            if not self.stopped.is_set():
+                self.failure(error)
+        except BaseException as error:
+            self.failure(error)
+
+    def failure(self, error):
+        with self.condition:
+            if not self.errors:
+                frame = traceback.extract_tb(error.__traceback__)[-1]
+                self.errors.append(type(error).__name__ + " at " + frame.name + ":" + str(frame.lineno))
+            self.condition.notify_all()
+
+    def request_limit(self, method, target, path, fields):
+        if method != b"PUT":
+            return 1024 * 1024
+        match = re.fullmatch(r"/containers/([0-9a-f]{64})/archive", path)
+        if not match:
+            raise ProtocolError("proxy only supports scoped archive PUT")
+        query = urllib.parse.parse_qs(urllib.parse.urlsplit(target.decode("ascii")).query, strict_parsing=True)
+        if query != {"path":["/var/task"], "noOverwriteDirNonDir":["true"], "copyUIDGID":["false"]}:
+            raise ProtocolError("proxy archive destination")
+        if fields.get(b"content-type") != b"application/x-tar":
+            raise ProtocolError("proxy archive media type")
+        with self.condition:
+            known = self.records.get(match[1])
+        if known is None or known["role"] != "code-loader":
+            raise ProtocolError("unknown archive loader")
+        return 282 * 1024 * 1024
+
+    def connection(self, client):
+        backend = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        try:
+            backend.settimeout(3)
+            with self.condition:
+                self.sockets.add(backend)
+            backend.connect(self.daemon)
+            for position in range(2):
+                first, fields, raw = head(client, time.monotonic() + 5)
+                method, target, version = first[:-2].split(b" ")
+                assert method in (b"GET", b"POST", b"PUT", b"DELETE") and version == b"HTTP/1.1"
+                assert len(target) <= 2048 and re.fullmatch(rb"/[!-~]*", target)
+                assert b"transfer-encoding" not in fields
+                path = urllib.parse.unquote(urllib.parse.urlsplit(target.decode("ascii")).path)
+                path = re.sub(r"^/v1\.[0-9]{2}(?=/)", "", path)
+                maximum = self.request_limit(method, target, path, fields)
+                payload, _ = body(client, fields, maximum, time.monotonic() + (60 if method == b"PUT" else 5))
+                create = method == b"POST" and path == "/containers/create"
+                tag = method == b"POST" and path.startswith("/images/") and path.endswith("/tag")
+                record = None
+                if create:
+                    value = json.loads(payload, object_pairs_hook=unique_object)
+                    labels = value["Labels"]
+                    record = {"owner":identity(labels["rustack.lambda.ownerId"]),
+                              "role":labels["rustack.lambda.role"]}
+                deletion = None
+                if method == b"DELETE" and path.startswith("/containers/"):
+                    key = path[len("/containers/"):]
+                    with self.condition:
+                        known = self.records.get(key)
+                    if known is not None:
+                        deletion = dict(known, id=key)
+                        self.gate("delete", dict(known, id=key))
+                        self.gate("pair_delete", dict(known, id=key))
+                if method == b"POST" and path.startswith("/containers/") and path.endswith("/start"):
+                    with self.condition:
+                        assert len(self.starts) < 128
+                        self.starts.add(path[len("/containers/"):-len("/start")])
+                backend.sendall(raw + payload)
+                if method == b"POST" and path == "/images/create":
+                    query = urllib.parse.parse_qs(urllib.parse.urlsplit(target.decode("ascii")).query, strict_parsing=True)
+                    with self.condition:
+                        expected = self.pull_reference
+                    actual = query.get("fromImage", [""])[0]
+                    if query.get("tag"):
+                        actual += "@" + query["tag"][0]
+                    if expected is not None and actual == expected:
+                        self.pull(backend, client)
+                        return
+                with self.condition:
+                    failed_image = self.failed_image
+                if failed_image is not None and method == b"GET" and path == "/images/" + failed_image + "/json":
+                    return
+                if path == "/info" or create or tag or deletion is not None:
+                    first, headers, raw = head(backend, time.monotonic() + 60)
+                    status = int(first.split(b" ", 2)[1])
+                    encoded, decoded = body(backend, headers, (1 if create else 2) * 1024 * 1024,
+                                            time.monotonic() + 60)
+                    if create and status == 201:
+                        key = json.loads(decoded, object_pairs_hook=unique_object)["Id"]
+                        assert re.fullmatch(r"[0-9a-f]{64}", key)
+                        with self.condition:
+                            assert len(self.records) < 128
+                            self.records[key] = record
+                        self.gate("create", dict(record, id=key))
+                    if tag and status == 201:
+                        query = urllib.parse.parse_qs(urllib.parse.urlsplit(target.decode("ascii")).query, strict_parsing=True)
+                        repository = query["repo"][0]
+                        match = re.fullmatch(r"rustack-internal/lambda-([0-9a-f]{32})/[0-9a-f]{32}", repository)
+                        assert match and re.fullmatch(r"[0-9a-f]{32}", query["tag"][0])
+                        self.gate("tag", {"owner":str(uuid.UUID(hex=match[1])),
+                                          "alias":repository + ":" + query["tag"][0]})
+                    if deletion is not None and status == 204:
+                        self.gate("delete_ack", deletion)
+                    client.sendall(raw + encoded)
+                    if path == "/info" and position == 0 and fields.get(b"connection", b"").lower() != b"close":
+                        continue
+                duplex(client, backend, self.stopped, self.deadline)
+                return
+            raise ProtocolError("proxy unexpected third request")
+        except (OSError, EOFError):
+            # Peer loss/half-close is expected in the cancellation and loss cases.
+            pass
+        except BaseException as error:
+            self.failure(error)
+        finally:
+            with self.condition:
+                self.sockets.discard(client)
+                self.sockets.discard(backend)
+            client.close()
+            backend.close()
+
+    def close(self):
+        self.stopped.set()
+        with self.condition:
+            self.released = True
+            self.condition.notify_all()
+            for stream in tuple(self.sockets):
+                with contextlib.suppress(OSError):
+                    stream.shutdown(socket.SHUT_RDWR)
+        self.listener.close()
+        deadline = time.monotonic() + 5
+        self.worker.join(max(0, deadline - time.monotonic()))
+        assert not self.worker.is_alive(), "proxy accept owner did not join"
+        for worker in self.workers:
+            worker.join(max(0, deadline - time.monotonic()))
+            assert not worker.is_alive(), "proxy connection owner did not join"
+        assert not self.errors, "proxy framing/worker failure: " + repr(self.errors)
diff --git a/tests/workflows/docker_lambda_sdk.py b/tests/workflows/docker_lambda_sdk.py
new file mode 100644
index 00000000..8cc77577
--- /dev/null
+++ b/tests/workflows/docker_lambda_sdk.py
@@ -0,0 +1,116 @@
+"""Real boto3 -> Lambda HTTP/provider -> Docker Executor composition evidence.
+
+The Rust harness supplies controlled readiness for a fresh explicit-daemon scope.
+This does not qualify the unfinished production startup coordinator.
+"""
+
+import base64
+import json
+import sys
+
+import boto3
+from botocore.config import Config
+from botocore.exceptions import ClientError
+
+
+def main(endpoint, image, architecture):
+    client = boto3.client(
+        "lambda", endpoint_url=endpoint, region_name="us-east-1",
+        aws_access_key_id="test", aws_secret_access_key="test",
+        config=Config(connect_timeout=10, read_timeout=120, retries={"max_attempts": 0}),
+    )
+    name = "executor-image-fixture"
+    created = False
+    try:
+        client.create_function(
+            FunctionName=name, PackageType="Image", Code={"ImageUri": image},
+            Architectures=[architecture], MemorySize=192, Timeout=30,
+            Role="arn:aws:iam::000000000000:role/lambda-test",
+            Environment={"Variables": {"TEST_VALUE": "version-one"}},
+        )
+        created = True
+        client.get_waiter("function_active_v2").wait(
+            FunctionName=name, WaiterConfig={"Delay": 1, "MaxAttempts": 120},
+        )
+        version = client.publish_version(FunctionName=name)["Version"]
+        assert version == "1"
+        client.create_alias(FunctionName=name, Name="prod", FunctionVersion=version)
+
+        def invoke(event, qualifier="prod", logs="Tail", failed=False):
+            response = client.invoke(
+                FunctionName=name, Qualifier=qualifier,
+                Payload=json.dumps(event).encode(), LogType=logs,
+            )
+            assert response["StatusCode"] == 200, response
+            assert response["ExecutedVersion"] == (version if qualifier == "prod" else qualifier)
+            with response["Payload"] as body:
+                raw = body.read(6 * 1024 * 1024 + 1)
+            assert len(raw) <= 6 * 1024 * 1024
+            assert response.get("FunctionError") == ("Unhandled" if failed else None)
+            tail = response.get("LogResult")
+            if logs == "Tail":
+                assert tail is not None
+                tail = base64.b64decode(tail, validate=True)
+                assert len(tail) <= 4096
+            else:
+                assert tail is None
+            return json.loads(raw), tail
+
+        first, tail = invoke({"value": 35, "logs": True, "policy": True, "response_bytes": 1024 * 1024})
+        assert first["computed"] == 42 and first["counter"] == 1
+        assert first["functionVersion"] == version
+        assert first["functionName"] == name
+        assert first["invokedArn"] == f"arn:aws:lambda:us-east-1:000000000000:function:{name}:prod"
+        assert first["configuredValue"] == "version-one"
+        assert b"WIRE_STDOUT_CAPTURE" in tail and b"WIRE_STDERR_CAPTURE" in tail
+        second, tail = invoke({"value": 1})
+        assert second["counter"] == 2 and tail == b""
+        third, tail = invoke({"value": 2, "logs": True, "response_bytes": 1024 * 1024}, logs="None")
+        assert third["counter"] == 3 and tail is None
+        failure, _ = invoke({"fail": True}, failed=True)
+        assert failure["errorType"] == "ValueError"
+        assert "intentional P0 failure" in failure["errorMessage"]
+        replacement, _ = invoke({"value": 3})
+        assert replacement["counter"] == 1
+
+        client.update_function_configuration(
+            FunctionName=name, Environment={"Variables": {"TEST_VALUE": "version-two"}},
+        )
+        client.get_waiter("function_updated_v2").wait(
+            FunctionName=name, WaiterConfig={"Delay": 1, "MaxAttempts": 120},
+        )
+        latest, _ = invoke({"value": 4, "policy": True}, qualifier="$LATEST")
+        assert latest["configuredValue"] == "version-two" and latest["counter"] == 1
+        assert latest["functionVersion"] == "$LATEST"
+        assert latest["invokedArn"] == f"arn:aws:lambda:us-east-1:000000000000:function:{name}:$LATEST"
+        dry = client.invoke(FunctionName=name, Qualifier="$LATEST", InvocationType="DryRun")
+        assert dry["StatusCode"] == 204
+        after_dry, _ = invoke({"value": 5}, qualifier="$LATEST")
+        assert after_dry["counter"] == 2
+        old, _ = invoke({"value": 6, "policy": True})
+        assert old["configuredValue"] == "version-one" and old["functionVersion"] == version
+        assert old["invokedArn"] == f"arn:aws:lambda:us-east-1:000000000000:function:{name}:prod"
+        client.update_function_configuration(FunctionName=name, Timeout=1)
+        client.get_waiter("function_updated_v2").wait(
+            FunctionName=name, WaiterConfig={"Delay": 1, "MaxAttempts": 120},
+        )
+        try:
+            invoke({"value": 7, "sleep": True}, qualifier="$LATEST")
+        except ClientError as error:
+            assert error.response["Error"]["Code"] == "ServiceException"
+            assert "timed out after 1s" in error.response["Error"]["Message"]
+        else:
+            raise AssertionError("handler timeout returned successful output")
+        after_timeout, _ = invoke({"value": 8}, qualifier="$LATEST")
+        assert after_timeout["counter"] == 1
+        print(json.dumps({"computed": first["computed"], "version": version,
+                          "warmCounters": [first["counter"], second["counter"], third["counter"]],
+                          "functionError": failure["errorType"], "replacementCounter": replacement["counter"], "timeoutReplacementCounter": after_timeout["counter"]}))
+    finally:
+        if created:
+            client.delete_function(FunctionName=name)
+        client.close()
+
+
+if __name__ == "__main__":
+    main(*sys.argv[1:])
diff --git a/tests/workflows/docker_required_suites.py b/tests/workflows/docker_required_suites.py
new file mode 100644
index 00000000..96f10028
--- /dev/null
+++ b/tests/workflows/docker_required_suites.py
@@ -0,0 +1,44 @@
+"""Exact functional Docker resources; this policy cannot certify a full release."""
+import argparse
+from pathlib import Path
+import sys
+
+from required_suites import (
+    INVENTORY_LIMIT, MANIFEST_LIMIT, ManifestError, parse_manifest as decode_manifest,
+    read_regular, verify as verify_exact,
+)
+
+
+SUITES = frozenset(("ordinary-startup", "docker-core", "docker-environment", "docker-executor",
+                    "docker-endpoint", "docker-probe", "docker-wire", "relay-runtime"))
+
+
+def parse_manifest(raw):
+    return decode_manifest(raw, expected_suites=SUITES, profile="rustack-docker-image-v1",
+                           qualification="docker-image-functional")
+
+
+def verify(required, inventories):
+    return verify_exact(required, inventories, expected_suites=SUITES)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("inventory_directory", type=Path)
+    args = parser.parse_args()
+    try:
+        required = parse_manifest(read_regular(
+            Path(__file__).with_name("docker-required-suites.json"), MANIFEST_LIMIT))
+        inventories = {identity:read_regular(args.inventory_directory / (identity + ".txt"), INVENTORY_LIMIT)
+                       for identity in SUITES}
+        count = verify(required, inventories)
+    except ManifestError as error:
+        print("Docker resource manifest rejected: " + str(error), file=sys.stderr)
+        return 1
+    print("Docker resource manifest verified: 8 suites, " + str(count)
+          + " exact resource tests; docker-image-functional.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/docker_startup_sdk.py b/tests/workflows/docker_startup_sdk.py
new file mode 100644
index 00000000..dd81dfc6
--- /dev/null
+++ b/tests/workflows/docker_startup_sdk.py
@@ -0,0 +1,36 @@
+"""Pinned ordinary boto3 acceptance of the actual production Docker binary."""
+import json
+import os
+import sys
+import time
+import uuid
+
+print(os.getpid(), flush=True)
+import boto3
+from botocore.config import Config
+
+endpoint, image, architecture = sys.argv[1:]
+client = boto3.client("lambda", endpoint_url=endpoint, region_name="us-east-1",
+                      aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                      config=Config(retries={"max_attempts": 0}, connect_timeout=2, read_timeout=60))
+name = "BotoDocker" + uuid.uuid4().hex
+client.create_function(FunctionName=name, Role="arn:aws:iam::000000000000:role/Docker",
+                       PackageType="Image", Architectures=[architecture], Timeout=30,
+                       Code={"ImageUri": image})
+deadline = time.monotonic() + 120
+while True:
+    state = client.get_function_configuration(FunctionName=name)["State"]
+    if state == "Active":
+        break
+    assert state != "Failed" and time.monotonic() < deadline
+    time.sleep(0.025)
+for value, counter in ((35, 1), (0, 2)):
+    reply = client.invoke(FunctionName=name, Payload=json.dumps({"value": value}).encode())
+    output = json.load(reply["Payload"])
+    assert reply["StatusCode"] == 200 and "FunctionError" not in reply
+    assert output["computed"] == value + 7 and output["counter"] == counter and output["uid"] == 1000
+reply = client.invoke(FunctionName=name, Payload=b'{"value":1,"fail":true}')
+assert reply["StatusCode"] == 200 and reply["FunctionError"] == "Unhandled"
+reply["Payload"].read()
+client.delete_function(FunctionName=name)
+print(json.dumps({"schemaVersion": 1, "computed": 42, "warmCounter": 2, "functionError": True}), flush=True)
diff --git a/tests/workflows/evidence/botocore-wire.json b/tests/workflows/evidence/botocore-wire.json
new file mode 100644
index 00000000..fb308d8f
--- /dev/null
+++ b/tests/workflows/evidence/botocore-wire.json
@@ -0,0 +1,22 @@
+{
+  "boto3": "1.43.118",
+  "botocore": "1.43.118",
+  "protocol": "json",
+  "target": "AWSStepFunctions.StartExecution",
+  "preservesRawInput": true,
+  "timestamps": [
+    {
+      "epoch": 0.125,
+      "iso": "1970-01-01T00:00:00.125000+00:00"
+    },
+    {
+      "epoch": -0.125,
+      "iso": "1969-12-31T23:59:59.875000+00:00"
+    }
+  ],
+  "errorCodes": [
+    "TaskTimedOut",
+    "InvalidToken"
+  ],
+  "awsRequests": 0
+}
diff --git a/tests/workflows/evidence/relay-amd64.json b/tests/workflows/evidence/relay-amd64.json
new file mode 100644
index 00000000..eb93b56e
--- /dev/null
+++ b/tests/workflows/evidence/relay-amd64.json
@@ -0,0 +1,45 @@
+{
+  "architecture": "amd64",
+  "attachEof": [
+    {
+      "runningAfterShutdown": true,
+      "stdinOnce": false
+    },
+    {
+      "runningAfterShutdown": false,
+      "stdinOnce": true
+    }
+  ],
+  "cancelledBusyFunction": true,
+  "closeAck": true,
+  "coldMs": 2526,
+  "errorType": "ValueError",
+  "labelReconciliation": true,
+  "noPublishedRuntimePorts": true,
+  "outputs": [
+    {
+      "computed": 42,
+      "counter": 1,
+      "memoryMax": "201326592",
+      "pidsMax": "256",
+      "requestId": "426463ee-6a63-4a99-ac42-b67075694b96",
+      "rootReadOnly": true,
+      "uid": 1000
+    },
+    {
+      "computed": 7,
+      "counter": 2,
+      "memoryMax": "201326592",
+      "pidsMax": "256",
+      "requestId": "2c470034-bda1-4414-97cf-edeeec4110ce",
+      "rootReadOnly": true,
+      "uid": 1000
+    }
+  ],
+  "runId": "19e31db5-376e-4149-b362-af0210f98a8e",
+  "qualification": "x86_64 Linux guest under QEMU on an arm64 host; functional evidence, not native x86 performance",
+  "rustVersion": "1.99.1",
+  "dockerServerVersion": "29.5.2",
+  "host": "macOS 27 / Apple M5",
+  "observedAt": "2026-10-25"
+}
diff --git a/tests/workflows/evidence/relay-arm64.json b/tests/workflows/evidence/relay-arm64.json
new file mode 100644
index 00000000..7dff6dca
--- /dev/null
+++ b/tests/workflows/evidence/relay-arm64.json
@@ -0,0 +1,45 @@
+{
+  "architecture": "arm64",
+  "attachEof": [
+    {
+      "runningAfterShutdown": true,
+      "stdinOnce": false
+    },
+    {
+      "runningAfterShutdown": false,
+      "stdinOnce": true
+    }
+  ],
+  "cancelledBusyFunction": true,
+  "closeAck": true,
+  "coldMs": 122,
+  "errorType": "ValueError",
+  "labelReconciliation": true,
+  "noPublishedRuntimePorts": true,
+  "outputs": [
+    {
+      "computed": 42,
+      "counter": 1,
+      "memoryMax": "201326592",
+      "pidsMax": "256",
+      "requestId": "26d86ab5-d555-4030-afd6-bf070ef8cb55",
+      "rootReadOnly": true,
+      "uid": 1000
+    },
+    {
+      "computed": 7,
+      "counter": 2,
+      "memoryMax": "201326592",
+      "pidsMax": "256",
+      "requestId": "731ec28f-ff9b-40cf-8d4a-07e28478b053",
+      "rootReadOnly": true,
+      "uid": 1000
+    }
+  ],
+  "runId": "b51a309e-613c-475d-b647-07e2257f88b1",
+  "qualification": "macOS arm64 host, native aarch64 VZ guest; not Docker Desktop/rootless qualification",
+  "rustVersion": "1.99.1",
+  "dockerServerVersion": "29.5.2",
+  "host": "macOS 27 / Apple M5",
+  "observedAt": "2026-10-25"
+}
diff --git a/tests/workflows/fake_action_cli.py b/tests/workflows/fake_action_cli.py
new file mode 100644
index 00000000..817079ee
--- /dev/null
+++ b/tests/workflows/fake_action_cli.py
@@ -0,0 +1,89 @@
+"""Private controlled Docker/curl executable; never accesses a real daemon."""
+import json
+import os
+from pathlib import Path
+import sys
+import time
+
+root = Path(__file__).resolve().parent
+model_path = root / "model.json"
+model = json.loads(model_path.read_text())
+args = sys.argv[1:]
+with (root / "events.jsonl").open("a") as stream:
+    stream.write(json.dumps({"tool": Path(sys.argv[0]).name, "args": args, "pid": os.getpid(),
+                             "at": time.monotonic(), "environment": sorted(os.environ)}) + "\n")
+def save():
+    model_path.write_text(json.dumps(model))
+def emit(value):
+    print(json.dumps(value, separators=(",", ":")))
+mode = model.get("mode", "success")
+if Path(sys.argv[0]).name == "curl":
+    if mode == "missing-http":
+        raise SystemExit(22)
+    if mode == "late-http":
+        time.sleep(2)
+    if mode == "unrelated-http":
+        emit({"message": "unrelated200"})
+    elif mode == "not-ready":
+        emit({"ready": False, "services": {"s3": "running"}})
+    else:
+        emit({"ready": True, "services": {"s3": "running", "stepfunctions": "running"}})
+    print("302" if mode == "redirect-http" else "200", end="", file=sys.stderr)
+    raise SystemExit(0)
+if args[:2] == ["--host", "unix:///tmp/rustack-action-control.sock"]:
+    args = args[2:]
+elif args[:2] == ["context", "inspect"]:
+    emit(model.get("contextEndpoint", "unix:///tmp/rustack-action-control.sock"))
+    raise SystemExit(0)
+else:
+    raise SystemExit(71)
+if args[0] == "info":
+    emit("86c8bc6d-e4d7-4f2d-8492-cba249018921" if model.get("changed") else model["engine"])
+elif args[:2] == ["image", "ls"]:
+    if mode == "lookup-failure":
+        raise SystemExit(1)
+    if not model.get("missing"):
+        emit(model["source"])
+elif args[:2] == ["pull", "--quiet"]:
+    model["missing"] = False
+    save()
+    print(model["source"])
+elif args[:2] == ["image", "inspect"]:
+    emit({"id": model["source"], "os": "linux", "architecture": "arm64"})
+elif args[0] == "run":
+    if mode == "foreign-name":
+        raise SystemExit(125)
+    model["labels"] = dict(args[i + 1].split("=", 1) for i, arg in enumerate(args) if arg == "--label")
+    model["serverEnvironment"] = dict(line.split("=", 1) for line in Path(args[args.index("--env-file") + 1]).read_text().splitlines())
+    model["running"] = mode != "exited-cid"
+    model["changed"] = mode == "changed-engine"
+    save()
+    print(model["cid"])
+elif args[:2] == ["container", "inspect"]:
+    if args[-1] != model["cid"]:
+        raise SystemExit(72)
+    port = "5555" if mode == "wrong-publication" else model.get("port", "4566")
+    mapping = {"4566/tcp": [{"HostIp": "127.0.0.1", "HostPort": port}]}
+    emit({"id": model["cid"], "name": "/rustack", "image": model["source"], "reference": model["source"],
+          "labels": model["labels"], "running": model.get("running", False), "dead": False, "oom": False,
+          "exit": 0, "startedAt": "2026-10-31T00:00:00.123Z", "health": "starting" if mode == "never-healthy" else "healthy",
+          "ports": mapping, "bindings": mapping, "restart": {"Name": "no", "MaximumRetryCount": 0}})
+elif args[:3] == ["kill", "--signal", "TERM"]:
+    if args[-1] != model["cid"]:
+        raise SystemExit(73)
+    model["running"] = False
+    save()
+    print(model["cid"])
+elif args[0] == "wait":
+    print("0")
+elif args[:2] == ["container", "rm"]:
+    if args[-1] != model["cid"] or model.get("running"):
+        raise SystemExit(74)
+    model["removed"] = True
+    save()
+    print(model["cid"])
+elif args[:2] == ["container", "ls"]:
+    if not model.get("removed"):
+        emit(model["cid"])
+else:
+    raise SystemExit(75)
diff --git a/tests/workflows/functional_inventory.py b/tests/workflows/functional_inventory.py
new file mode 100644
index 00000000..fff31f2b
--- /dev/null
+++ b/tests/workflows/functional_inventory.py
@@ -0,0 +1,32 @@
+"""Shared exact compiled inventory and retained one-resource command sequence."""
+import time
+import json
+
+from linux_performance import require
+from required_suites import parse_inventory
+import rootless_platform as storage
+
+
+def execute(owner, cargo, suites, required, selected, root, deadline, run_case, verify_output, clean):
+    for identity, selector in suites.items():
+        directory = root / ("inventory-" + identity)
+        directory.mkdir(mode=0o700)
+        result = run_case(owner, cargo + selector + ["--", "--ignored", "--list", "--color", "never"],
+                          min(deadline, time.monotonic() + 300), directory)
+        require(result.code == 0 and parse_inventory(result.stdout) == required[identity], "functional-compiled-inventory")
+    rows = []
+    for identity, selector in suites.items():
+        for name in sorted(selected.get(identity, ())):
+            directory = root / ("case-%03d" % (len(rows) + 1))
+            directory.mkdir(mode=0o700)
+            result = run_case(owner, cargo + selector + ["--", "--ignored", "--exact", name, "--show-output", "--test-threads=1"],
+                              min(deadline, time.monotonic() + 1200), directory)
+            try:
+                if result.code == 0:
+                    verify_output(result.stdout, {name})
+            finally:
+                clean(directory)
+            rows.append({"suite":identity, "name":name, "code":result.code, "evidence":str(directory)})
+            storage.publish(root / ("progress-%03d.json" % len(rows)), rows[-1])
+            print(json.dumps({"resource":len(rows), "name":name, "code":result.code}), flush=True)
+    return rows
diff --git a/tests/workflows/gate_command.py b/tests/workflows/gate_command.py
new file mode 100644
index 00000000..45d59e4b
--- /dev/null
+++ b/tests/workflows/gate_command.py
@@ -0,0 +1,48 @@
+"""Bound only command diagnostics; preserve the workload's filesystem limits."""
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+
+LOG_LIMIT = 16 * 1024 * 1024
+
+
+def run(path, arguments):
+    if not arguments or arguments[0] not in ("cargo", "make"):
+        raise ValueError("gate-command-policy")
+    program = shutil.which(arguments[0])
+    if program is None:
+        raise ValueError("gate-command-unavailable")
+    # This child inherits our process group. The outer Runner retains all
+    # command/group retirement authority, including on diagnostic overflow.
+    with path.open("xb") as log:
+        os.chmod(path, 0o600)
+        child = subprocess.Popen([program] + arguments[1:], stdin=subprocess.DEVNULL,
+                                 stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+        count = 0
+        try:
+            while True:
+                block = child.stdout.read(min(8192, LOG_LIMIT - count + 1))
+                if not block:
+                    break
+                count += len(block)
+                if count > LOG_LIMIT:
+                    raise ValueError("gate-log-bound")
+                log.write(block)
+            code = child.wait()
+            log.flush()
+            os.fsync(log.fileno())
+            return code
+        finally:
+            child.stdout.close()
+
+
+if __name__ == "__main__":
+    try:
+        if len(sys.argv) < 4:
+            raise ValueError("gate-arguments")
+        sys.exit(run(Path(sys.argv[1]), sys.argv[2:]))
+    except (OSError, ValueError):
+        print("gate-command-failed", file=sys.stderr)
+        sys.exit(2)
diff --git a/tests/workflows/handler_sdk_image.py b/tests/workflows/handler_sdk_image.py
new file mode 100644
index 00000000..a72e9415
--- /dev/null
+++ b/tests/workflows/handler_sdk_image.py
@@ -0,0 +1,152 @@
+"""Real default-provider image SDK calls to the strict local S3/DynamoDB gateway."""
+import ipaddress
+import json
+import os
+import sys
+import time
+import urllib.parse
+import uuid
+
+from lambda_fault_support import Metadata, invoke_json, poll_response
+from node_image_sdk import deployed
+
+VERSION = "3.1105.0"
+UNSET = ("AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_SDK_LOAD_CONFIG", "AWS_SESSION_TOKEN",
+         "AWS_SECURITY_TOKEN", "AWS_ACCESS_KEY", "AWS_SECRET_KEY", "AWS_WEB_IDENTITY_TOKEN_FILE",
+         "AWS_ROLE_ARN", "AWS_ROLE_SESSION_NAME", "AWS_CONTAINER_CREDENTIALS_FULL_URI",
+         "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI", "AWS_CONTAINER_AUTHORIZATION_TOKEN",
+         "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", "AWS_EC2_METADATA_SERVICE_ENDPOINT",
+         "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE", "AWS_ENDPOINT_URL_S3", "AWS_ENDPOINT_URL_DYNAMODB")
+
+
+def inspect_sdk_environment(metadata, endpoint, gateway, secret):
+    host = ipaddress.ip_address(gateway)
+    visible = "http://" + ("[" + str(host) + "]" if host.version == 6 else str(host))
+    visible += ":" + str(urllib.parse.urlsplit(endpoint).port) + "/"
+    return inspect_sdk_origin(metadata, visible, secret)
+
+
+def inspect_sdk_origin(metadata, visible, secret):
+    """Project only safe IDs after checking the independently supplied origin."""
+    rows = metadata.rows()
+    assert len(rows) == 2 and {r["Labels"]["rustack.lambda.role"] for r in rows} == {"function", "relay"}
+    projected = {}
+    for row in rows:
+        inspected = metadata.get("/containers/" + row["Id"] + "/json")
+        assert inspected["State"]["Running"] is True
+        entries = inspected["Config"]["Env"]
+        assert isinstance(entries, list) and len(entries) <= 320
+        assert all(isinstance(entry, str) and len(entry.encode()) <= 4097 and "\x00" not in entry for entry in entries)
+        assert sum(len(entry.encode()) for entry in entries) <= 80 * 1024
+        env = {}
+        for entry in entries:
+            key, separator, value = entry.partition("=")
+            assert key not in env
+            env[key] = value if separator else None
+        role = row["Labels"]["rustack.lambda.role"]
+        if role == "function":
+            assert env["AWS_ACCESS_KEY_ID"] == "local-key"
+            assert env["AWS_SECRET_ACCESS_KEY"] == secret
+            assert env["AWS_ENDPOINT_URL"] == visible
+            assert all(env.get(key) is None for key in UNSET)
+            assert env["AWS_EC2_METADATA_DISABLED"] == "true"
+            assert env["AWS_CONFIG_FILE"] == env["AWS_SHARED_CREDENTIALS_FILE"] == "/dev/null"
+        else:
+            assert "AWS_ACCESS_KEY_ID" not in env and "AWS_SECRET_ACCESS_KEY" not in env
+        projected[role] = row["Id"]
+    return projected
+
+
+def configuration_omits_sdk(configuration):
+    variables = configuration["Environment"]["Variables"]
+    assert "AWS_ACCESS_KEY_ID" not in variables and "AWS_SECRET_ACCESS_KEY" not in variables
+    assert variables["AWS_PROFILE"] == "captured-poison"
+    assert variables["AWS_ENDPOINT_URL"] == "http://127.0.0.1:9"
+    encoded = json.dumps(configuration)
+    assert "local-secret" not in encoded and "sdk-wrong-secret" not in encoded
+
+
+def exercise(endpoint, image, architecture, socket, owner, engine, mode, gateway):
+    import boto3
+    from botocore.config import Config
+    assert mode in ("positive", "wrong")
+    settings = dict(endpoint_url=endpoint, region_name="us-east-1", aws_access_key_id="local-key",
+                    aws_secret_access_key="local-secret",
+                    config=Config(retries={"max_attempts": 0}, connect_timeout=2, read_timeout=60,
+                                  s3={"addressing_style": "path"}))
+    clients = []
+    try:
+        for service in ("lambda", "s3", "dynamodb"):
+            clients.append(boto3.client(service, **settings))
+        function, s3, dynamodb = clients
+        suffix = uuid.uuid4().hex
+        name, bucket, table = "HandlerSdk" + suffix, "sdk-bucket-" + suffix, "SdkTable" + suffix
+        s3.create_bucket(Bucket=bucket)
+        dynamodb.create_table(TableName=table, BillingMode="PAY_PER_REQUEST",
+            KeySchema=[{"AttributeName": "id", "KeyType": "HASH"}],
+            AttributeDefinitions=[{"AttributeName": "id", "AttributeType": "S"}])
+        poll_response(lambda: dynamodb.describe_table(TableName=table),
+                      lambda value: value["Table"]["TableStatus"] == "ACTIVE", 30)
+        function.create_function(FunctionName=name, Role="arn:aws:iam::000000000000:role/HandlerSdk",
+            PackageType="Image", Architectures=[architecture], Timeout=30, MemorySize=256,
+            Code={"ImageUri": image}, ImageConfig={"Command": ["handler-sdk.bodyControl" if mode == "positive" else "handler-sdk.handler"]}, Environment={"Variables": {
+                "AWS_PROFILE": "captured-poison", "AWS_ENDPOINT_URL": "http://127.0.0.1:9",
+                "AWS_ENDPOINT_URL_DYNAMODB": "http://127.0.0.1:9"}})
+        configuration_omits_sdk(deployed(function, name))
+        metadata = Metadata(socket, owner, engine)
+        if mode == "positive":
+            response, controlled = invoke_json(function, name, {})
+            assert "FunctionError" not in response and controlled == {
+                "quietBodyRejected": True, "headersObserved": True, "destroyed": True}
+            function.update_function_configuration(FunctionName=name, ImageConfig={"Command": ["handler-sdk.handler"]})
+            configuration_omits_sdk(deployed(function, name))
+            previous = None
+            for value, expected, counter, key, literal in (
+                    (21, 42, 1, "first", b"rustack-sdk:21:42"),
+                    (23, 46, 2, "second", b"rustack-sdk:23:46")):
+                response, output = invoke_json(function, name, dict(bucket=bucket, table=table,
+                    key=key, value=value, mode="roundtrip"))
+                assert "FunctionError" not in response
+                assert output["computed"] == expected and output["counter"] == counter
+                assert output["selectorsCleared"] is True
+                assert output["versions"] == {"s3": VERSION, "dynamodb": VERSION}
+                assert output["architecture"] == {"arm64": "arm64", "x86_64": "x64"}[architecture]
+                assert output["nodeVersion"].startswith("24.")
+                object_body = s3.get_object(Bucket=bucket, Key=key)["Body"]
+                try:
+                    assert object_body.read(4097) == literal
+                finally:
+                    object_body.close()
+                item = dynamodb.get_item(TableName=table, Key={"id": {"S": key}}, ConsistentRead=True)
+                assert item["Item"]["result"] == {"N": str(expected)}
+                current = inspect_sdk_environment(metadata, endpoint, gateway, "local-secret")
+                if previous is not None:
+                    assert current == previous, "warm SDK environment changed"
+                previous = current
+                s3.delete_object(Bucket=bucket, Key=key)
+            cases = ["quiet-body-abort", "local-s3-dynamodb-cold-warm", "authoritative-SDK-env", "metadata-secret-omission"]
+        else:
+            for selected, error, message in (
+                    ("deny-s3", "SdkS3AuthorizationError", "actual SDK AccessDenied/403 " + VERSION),
+                    ("deny-dynamodb", "SdkDynamoAuthorizationError", "actual SDK AccessDeniedException/400 " + VERSION)):
+                response, output = invoke_json(function, name, dict(bucket=bucket, table=table,
+                    key="denied", value=21, mode=selected))
+                assert response.get("FunctionError") == "Unhandled"
+                assert output["errorType"] == error and output["errorMessage"] == message
+                metadata.wait_ids(set(), time.monotonic() + 30)
+            assert "Item" not in dynamodb.get_item(TableName=table, Key={"id": {"S": "denied"}})
+            assert s3.list_objects_v2(Bucket=bucket).get("KeyCount", 0) == 0
+            cases = ["explicit-invalid-s3-authorization", "explicit-invalid-dynamodb-authorization", "no-ambient-fallback"]
+        configuration_omits_sdk(function.get_function_configuration(FunctionName=name))
+        function.delete_function(FunctionName=name)
+        s3.delete_bucket(Bucket=bucket)
+        dynamodb.delete_table(TableName=table)
+        return {"schemaVersion": 1, "mode": mode, "versions": {"s3": VERSION, "dynamodb": VERSION}, "cases": cases}
+    finally:
+        for client in reversed(clients):
+            client.close()
+
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+    print(json.dumps(exercise(*sys.argv[1:])), flush=True)
diff --git a/tests/workflows/image_performance_channel.py b/tests/workflows/image_performance_channel.py
new file mode 100644
index 00000000..c952e488
--- /dev/null
+++ b/tests/workflows/image_performance_channel.py
@@ -0,0 +1,102 @@
+"""Bounded initialization-owned sockets for the flood fixture control protocol."""
+import time
+
+from image_performance_support import canonical, integer, require
+
+
+class FloodChannel:
+    def __init__(self, connection, function, serial):
+        require(isinstance(function, str) and 1 <= len(function) <= 64 and function.isascii()
+                and all(value.isalnum() or value in "_-" for value in function), "flood-channel-function")
+        require(integer(serial, 1, 100) and connection.fileno() >= 0, "flood-channel-origin")
+        self.connection, self.function, self.serial = connection, function, serial
+        self.phase, self.request, self.ready_ns, self.submitted_ns = "new", None, None, None
+        self.finished = False
+
+    def accept(self, connection, path, event):
+        require(connection is self.connection and connection.fileno() >= 0, "flood-channel-replaced")
+        require(isinstance(event, dict) and event.get("functionName") == self.function, "flood-channel-identity")
+        if path == "/flood-ready":
+            require(self.phase == "new" and set(event) == {"functionName"}, "flood-channel-ready-order")
+            self.phase = "readyReply"
+            return True
+        request = canonical(event.get("requestId"))
+        if path == "/flood-begin":
+            require(self.phase == "ready" and self.submitted_ns is not None, "flood-channel-begin-order")
+            self.request, self.phase = request, "beginReply"
+            return True
+        require(path == "/flood-end" and self.phase == "begin" and request == self.request,
+                "flood-channel-end-order")
+        self.phase = "endReply"
+        return False
+
+    def written(self, path, clock=time.monotonic_ns):
+        expected = {"/flood-ready": ("readyReply", "ready"),
+                    "/flood-begin": ("beginReply", "begin"), "/flood-end": ("endReply", "complete")}
+        require(path in expected and self.phase == expected[path][0], "flood-channel-write-order")
+        self.phase = expected[path][1]
+        if path == "/flood-ready":
+            self.ready_ns = clock()
+
+    def submit(self, started):
+        require(self.phase == "ready" and self.submitted_ns is None and self.connection.fileno() >= 0
+                and type(started) is int and type(self.ready_ns) is int and 0 < self.ready_ns < started,
+                "flood-channel-not-prepared")
+        self.submitted_ns = started
+
+    def finish(self, request):
+        require(self.phase == "complete" and not self.finished and self.connection.fileno() < 0
+                and self.request == canonical(request), "flood-channel-not-closed")
+        self.finished = True
+
+
+class FloodChannels:
+    """One current strong socket owner; its collector serializes every mutation."""
+    def __init__(self):
+        self.current = None
+        self.prepared = self.ready_before_invoke = self.same_connection = self.closed = 0
+
+    def accept(self, connection, path, event):
+        if path == "/flood-ready":
+            require(self.prepared < 100 and (self.current is None
+                    or (self.current.finished and self.current.connection.fileno() < 0
+                        and self.current.connection is not connection)), "flood-channel-premature-replacement")
+            function = event.get("functionName") if isinstance(event, dict) else None
+            require(self.current is None or function == self.current.function, "flood-channel-function-changed")
+            self.current = FloodChannel(connection, function, self.prepared + 1)
+        channel = self.current
+        require(channel is not None, "flood-channel-missing")
+        keep_alive = channel.accept(connection, path, event)
+
+        def written():
+            channel.written(path)
+            if path == "/flood-ready":
+                self.prepared += 1
+
+        return keep_alive, written
+
+    def ready(self, cycle):
+        channel = self.current
+        return (channel is not None and channel.serial == self.prepared == cycle
+                and channel.phase == "ready" and channel.ready_ns is not None
+                and channel.connection.fileno() >= 0)
+
+    def submit(self, cycle, started):
+        require(self.current is not None and self.current.serial == self.prepared == cycle,
+                "flood-channel-cycle")
+        self.current.submit(started)
+        self.ready_before_invoke += 1
+        return self.current
+
+    def finish(self, channel, request):
+        require(channel is self.current, "flood-channel-cycle-changed")
+        channel.finish(request)
+        self.same_connection += 1
+        self.closed += 1
+
+    def summary(self):
+        values = {"prepared": self.prepared, "readyBeforeInvoke": self.ready_before_invoke,
+                  "sameConnection": self.same_connection, "closed": self.closed}
+        require(all(value == 100 for value in values.values()) and self.current is not None
+                and self.current.finished, "flood-channel-count")
+        return values
diff --git a/tests/workflows/image_performance_images.py b/tests/workflows/image_performance_images.py
new file mode 100644
index 00000000..7c247f4f
--- /dev/null
+++ b/tests/workflows/image_performance_images.py
@@ -0,0 +1,226 @@
+"""Three explicit local images, bounded file-output saves and fenced imports."""
+import hashlib
+import os
+from pathlib import Path
+import resource
+import shutil
+import stat
+import sys
+import tempfile
+import time
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from linux_performance import MIB, Runner, deadline_guard, profile, safe_path, status
+from image_performance_support import MeasurementError, decode, encode, require
+from metadata import endpoint as local_endpoint, engine_id, source_id
+
+SOURCES = ("rustack/lambda-runtime:integration-arm64", "rustack-p0-handler:arm64", "rustack-custom-ric:a-arm64")
+LIMIT = 1024 * MIB
+
+
+def call(owner, arguments, deadline, seconds=10):
+    reply = owner.run(arguments, min(deadline, time.monotonic() + seconds))
+    require(reply.code == 0 and reply.stderr == b"", "image-preparation-command")
+    return reply.stdout
+
+
+def fenced(owner, endpoint, engine, arguments, deadline, seconds=10):
+    def identity():
+        current = call(owner, ["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline).decode().strip()
+        require(current == engine, "image-operation-daemon-changed")
+    identity()
+    try:
+        return call(owner, arguments, deadline, seconds)
+    finally:
+        identity()
+
+
+def image(owner, endpoint, name, deadline, engine):
+    value = decode(fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "inspect", name,
+        "--format", '{"id":{{json .Id}},"os":{{json .Os}},"architecture":{{json .Architecture}},"bytes":{{json .Size}}}'], deadline))
+    require(isinstance(value, dict) and value.get("os") == "linux" and value.get("architecture") == "arm64"
+            and type(value.get("bytes")) is int and 0 < value["bytes"] <= LIMIT, "source-platform")
+    source_id(value["id"])
+    return value
+
+
+def cache_alias(immutable):
+    source_id(immutable)
+    return "rustack-workflows-cache:d102-" + immutable[7:]
+
+
+def retain_content(owner, endpoint, immutable, deadline, engine):
+    alias = cache_alias(immutable)
+    raw = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "ls", "--all",
+        "--no-trunc", "--filter", "reference=" + alias, "--format", "{{.ID}}"], deadline)
+    require(raw in (b"", (immutable + "\n").encode()), "operator-cache-alias-conflict")
+    if not raw:
+        fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "tag", immutable, alias], deadline)
+    observed = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "inspect", alias,
+        "--format", "{{.Id}}"], deadline)
+    require(observed == (immutable + "\n").encode(), "operator-cache-id-differs")
+    return alias
+
+
+def anchor(owner, endpoint, expected, deadline, engine):
+    alias = retain_content(owner, endpoint, expected["id"], deadline, engine)
+    require(image(owner, endpoint, alias, deadline, engine) == expected, "operator-cache-alias-differs")
+    return alias
+
+
+def source_references(architecture):
+    require(architecture in ("arm64", "amd64"), "source-cache-architecture")
+    return tuple(name + architecture for name in ("rustack/lambda-runtime:integration-", "rustack-p0-handler:",
+        "rustack-custom-ric:a-", "rustack-custom-ric:b-", "rustack-no-runtime:",
+        "rustack/workflows-server:integration-", "rustack/workflows-release:integration-"))
+
+
+def retain_sources(socket, architecture, owner, deadline):
+    references = source_references(architecture)
+    endpoint = "unix://" + str(safe_path(socket))
+    local_endpoint(endpoint)
+    engine = call(owner, ["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline).decode().strip()
+    engine_id(engine)
+    preserved = []
+    for reference in references:
+        raw = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "ls", "--all", "--no-trunc",
+            "--filter", "reference=" + reference, "--format", "{{.ID}}"], deadline)
+        ids = raw.decode("ascii").splitlines()
+        require(len(ids) <= 1, "source-cache-reference-count")
+        if ids:
+            immutable = source_id(ids[0])
+            alias = retain_content(owner, endpoint, immutable, deadline, engine)
+            preserved.append({"reference": reference, "id": immutable, "cacheAlias": alias})
+    for row in preserved:
+        actual = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "inspect", row["reference"],
+            "--format", "{{.Id}}"], deadline)
+        require(actual == (row["id"] + "\n").encode(), "source-cache-reference-changed")
+    require(call(owner, ["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline).decode().strip() == engine,
+            "source-cache-daemon-changed")
+    return {"schemaVersion": 1, "engine": engine, "architecture": architecture,
+            "referenceCount": len(references), "preserved": preserved}
+
+
+def catalog(owner, endpoint, deadline, engine):
+    raw = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "ls", "--all", "--quiet", "--no-trunc"], deadline)
+    values = raw.decode("ascii").splitlines()
+    require(len(values) <= 256, "image-inventory-budget")
+    for value in values: source_id(value)
+    return set(values)
+
+
+def hash_file(path, deadline):
+    descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    digest, count = hashlib.sha256(), 0
+    with os.fdopen(descriptor, "rb") as stream:
+        metadata = os.fstat(stream.fileno())
+        require(stat.S_ISREG(metadata.st_mode) and metadata.st_nlink == 1
+                and 0 < metadata.st_size <= LIMIT, "image-archive-file")
+        while True:
+            require(time.monotonic() < deadline, "image-archive-deadline")
+            block = stream.read(MIB)
+            if not block: break
+            count += len(block)
+            require(count <= LIMIT, "image-archive-byte-budget")
+            digest.update(block)
+        require(count == metadata.st_size, "image-archive-changed")
+    return count, digest.hexdigest()
+
+
+def file_limit(soft, hard, remaining):
+    require(type(remaining) is int and 1 <= remaining <= 2 * LIMIT, "image-remaining-budget")
+    return min([LIMIT, remaining] + [value for value in (soft, hard) if value != resource.RLIM_INFINITY])
+
+
+def save(socket, archive, immutable, remaining):
+    socket, archive = safe_path(socket), safe_path(archive)
+    source_id(immutable)
+    program = shutil.which("docker")
+    require(program is not None, "docker-executable")
+    soft, hard = resource.getrlimit(resource.RLIMIT_FSIZE)
+    cap = file_limit(soft, hard, int(remaining))
+    resource.setrlimit(resource.RLIMIT_FSIZE, (cap, cap))
+    os.execv(program, [program, "--host", "unix://" + str(socket), "image", "save", "--output", str(archive), immutable])
+
+
+def prepare(selected, socket, directory, owner, deadline):
+    selected, socket, directory = profile(selected), safe_path(socket), safe_path(directory)
+    require(not os.path.lexists(directory / "image-preparation.json"), "preparation-receipt-exists")
+    allocation = status(owner, selected, deadline)
+    target, source = allocation["docker_socket"], "unix://" + str(socket)
+    local_endpoint(target)
+    local_endpoint(source)
+    require(target != source, "distinct-image-daemons")
+    identities = {}
+    for key, endpoint in (("source", source), ("target", target)):
+        identities[key] = call(owner, ["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline).decode().strip()
+        engine_id(identities[key])
+    require(identities["source"] != identities["target"], "distinct-image-daemon-identities")
+    before = {key: catalog(owner, endpoint, deadline, identities[key]) for key, endpoint in (("source", source), ("target", target))}
+    expected = {name: image(owner, source, name, deadline, identities["source"]) for name in SOURCES}
+    require(len({row["id"] for row in expected.values()}) == 3, "distinct-source-images")
+    directory.mkdir(parents=True, exist_ok=True)
+    root = Path(tempfile.mkdtemp(prefix="image-transfer-", dir=directory))
+    rows, total = [], 0
+    for index, name in enumerate(SOURCES):
+        remaining = 2 * LIMIT - total
+        require(remaining > 0, "image-total-budget-before-save")
+        archive = root / (str(index) + ".tar")
+        with archive.open("xb"):
+            archive.chmod(0o600)
+        immutable = expected[name]["id"]
+        fenced(owner, source, identities["source"], [sys.executable, "-I", "-B", str(Path(__file__).resolve()),
+            "save", str(socket), str(archive), immutable, str(remaining), "v1"], deadline, 120)
+        size, digest = hash_file(archive, deadline)
+        total += size
+        require(size <= remaining and total <= 2 * LIMIT
+                and image(owner, source, immutable, deadline, identities["source"]) == expected[name], "source-changed-or-total-budget")
+        # The only accepted archives are produced here by this fenced local CLI.
+        # No caller-supplied TAR is extracted or interpreted by Python.
+        fenced(owner, target, identities["target"], ["docker", "--host", target, "image", "load", "--input", str(archive)], deadline, 120)
+        require(image(owner, target, immutable, deadline, identities["target"]) == expected[name], "imported-image-differs")
+        alias = anchor(owner, target, expected[name], deadline, identities["target"])
+        require(hash_file(archive, deadline) == (size, digest), "import-archive-changed")
+        rows.append({"name": name, "image": expected[name], "cacheAlias": alias, "archive": str(archive), "bytes": size, "sha256": digest})
+    for key, endpoint in (("source", source), ("target", target)):
+        observed = call(owner, ["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline).decode().strip()
+        require(observed == identities[key], "image-daemon-changed")
+        after = catalog(owner, endpoint, deadline, identities[key])
+        require(after == before[key] | ({row["id"] for row in expected.values()} if key == "target" else set()),
+                "image-inventory-changed")
+    result = {"schemaVersion": 1, "profile": selected, "engines": identities, "images": rows,
+              "sourceIdsPreserved": sorted(before["source"]), "targetIdsPreserved": sorted(before["target"])}
+    (directory / "image-preparation.json").write_bytes(encode(result) + b"\n")
+    return result
+
+
+def main():
+    try:
+        require(len(sys.argv) in (5, 6, 7) and sys.argv[1] in ("prepare", "save", "retain"), "image-preparation-arguments")
+        require(sys.argv[-1] == "v1", "preparation-schema")
+        if sys.argv[1] == "save":
+            require(len(sys.argv) == 7, "save-arguments")
+            save(*sys.argv[2:6])
+        elif sys.argv[1] == "prepare":
+            require(len(sys.argv) == 6, "preparation-arguments")
+            owner = Runner(os.environ)
+            with deadline_guard(600, owner) as deadline:
+                print(encode(prepare(*sys.argv[2:5], owner, deadline)).decode(), flush=True)
+        else:
+            require(len(sys.argv) == 5, "source-cache-arguments")
+            owner = Runner(os.environ)
+            with deadline_guard(120, owner) as deadline:
+                result = retain_sources(*sys.argv[2:4], owner, deadline)
+                print("WORKFLOWS_SOURCE_CACHE " + encode(result).decode(), flush=True)
+        return 0
+    except MeasurementError as error:
+        print("image-performance-preparation-failed:" + str(error), file=sys.stderr)
+        return 2
+    except Exception:
+        print("image-performance-preparation-failed", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/workflows/image_performance_report.py b/tests/workflows/image_performance_report.py
new file mode 100644
index 00000000..c9f09f82
--- /dev/null
+++ b/tests/workflows/image_performance_report.py
@@ -0,0 +1,106 @@
+"""Validate retained raw measurement evidence after physical server shutdown."""
+import os
+from pathlib import Path
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from image_performance_support import MeasurementError, cold_stages, decode, encode, exact_samples, integer, live, overhead, require, samples, verify_stages
+from linux_performance import bounded_read, deadline_guard
+from settings import ActionError
+
+
+def validate(value, phase, log=None, baseline=b""):
+    fields = {"schemaVersion", "phase", "referenceQualification", "os", "architecture", "python",
+              "sdkVersion", "baselineProcess", "measurement", "emptyAfterWorkload"}
+    require(isinstance(value, dict) and set(value) in (fields, fields | {"debugAssertions"}), "measurement-fields")
+    if "debugAssertions" in value:
+        require(type(value["debugAssertions"]) is bool, "measurement-build-mode")
+    require(type(value["schemaVersion"]) is int and value["schemaVersion"] == 1 and value["phase"] == phase
+            and value["referenceQualification"] == "pending" and value["emptyAfterWorkload"] is True
+            and value["sdkVersion"] == "1.43.118" and value["os"] in ("linux", "darwin")
+            and value["architecture"] in ("aarch64", "arm64", "x86_64"), "measurement-identity")
+    measured = value["measurement"]
+    require(isinstance(measured, dict), "measurement-shape")
+    if phase == "warm":
+        require(set(measured) == {"totalNanos", "handlerNanos", "overhead"}
+                and isinstance(measured["totalNanos"], list) and isinstance(measured["handlerNanos"], list)
+                and len(measured["totalNanos"]) == len(measured["handlerNanos"]) == 100, "warm-count")
+        values = [overhead(full, user) for full, user in zip(measured["totalNanos"], measured["handlerNanos"])]
+        require(exact_samples(measured["overhead"], 100) == samples(values, 100)
+                and measured["overhead"]["p95Micros"] <= 50000, "warm-ranks-or-budget")
+    elif phase == "cold":
+        require(set(measured) in ({"latency", "environments", "uniqueContainers"},
+                                 {"latency", "environments", "uniqueContainers", "initialization"})
+                and type(measured["uniqueContainers"]) is int and measured["uniqueContainers"] == 40,
+                "cold-shape")
+        require(exact_samples(measured["latency"], 20)
+                and measured["latency"]["p95Micros"] <= 5000000, "cold-ranks-or-budget")
+        if log is None:
+            require("initialization" in measured, "cold-log-required")
+            verify_stages(measured["initialization"], measured["environments"], measured["latency"]["observedMicros"])
+        else:
+            stages = cold_stages(log, measured["environments"], measured["latency"]["observedMicros"], baseline)
+            if "initialization" in measured:
+                require(stages == measured["initialization"], "cold-stages-changed")
+            measured["initialization"] = stages
+    else:
+        require(phase == "cycles" and set(measured) == {"readiness", "timeout", "floods", "processStats",
+            "completedCycles", "containerHighWater", "emptyAfterEachTimeout", "runtimeTaskBaseline",
+            "taskQuiescence", "liveBrackets", "primingInvocations", "primingCleanupConfirmed", "controlChannels"}, "cycle-shape")
+        require(type(measured["completedCycles"]) is int and measured["completedCycles"] == 100
+                and type(measured["containerHighWater"]) is int and measured["containerHighWater"] == 2
+                and measured["emptyAfterEachTimeout"] is True
+                and type(measured["primingInvocations"]) is int and measured["primingInvocations"] == 1
+                and measured["primingCleanupConfirmed"] is True
+                and integer(measured["runtimeTaskBaseline"], 1, 4096), "cycle-cleanup")
+        channels = measured["controlChannels"]
+        require(isinstance(channels, dict) and set(channels) == {"prepared", "readyBeforeInvoke", "sameConnection", "closed"}
+                and all(integer(value, 100, 100) for value in channels.values()), "cycle-control-channels")
+        for key in ("readiness", "timeout", "taskQuiescence"):
+            exact_samples(measured[key], 100)
+        require(measured["taskQuiescence"]["maxMicros"] < 2000000, "task-quiescence-budget")
+        require(isinstance(measured["floods"], list) and isinstance(measured["liveBrackets"], list)
+                and len(measured["floods"]) == len(measured["liveBrackets"]) == 100, "flood-count")
+        requests = set()
+        for flood, bracket, duration in zip(measured["floods"], measured["liveBrackets"],
+                                          measured["readiness"]["observedMicros"]):
+            require(isinstance(bracket, list) and len(bracket) == 3, "live-bracket-shape")
+            live(bracket[0], bracket[1], duration, bracket[2], flood)
+            require(flood["requestId"] not in requests, "flood-request-reused")
+            requests.add(flood["requestId"])
+        require(isinstance(measured["processStats"], list) and len(measured["processStats"]) == 100,
+                "process-stats-count")
+        for row in measured["processStats"]:
+            require(isinstance(row, dict) and set(row) == {"rssKiB", "tasks", "runtimeTasks"}
+                    and type(row["runtimeTasks"]) is int and row["runtimeTasks"] == measured["runtimeTaskBaseline"],
+                    "runtime-task-growth")
+            if value["os"] == "linux":
+                require(integer(row["rssKiB"], 1, 8 * 1024 * 1024) and integer(row["tasks"], 1, 4096),
+                        "linux-process-stats")
+            else:
+                require(row["rssKiB"] is None and row["tasks"] is None, "host-process-stats")
+    encode(value)
+    return value
+
+
+def main():
+    try:
+        require(len(sys.argv) == 5, "report-arguments")
+        print(os.getpid(), flush=True)
+        with deadline_guard(8):
+            value = decode(bounded_read(Path(sys.argv[1]), 32768))
+            raw = bounded_read(Path(sys.argv[2]), 32768)
+            baseline = bounded_read(Path(sys.argv[4]), 32768)
+            print(encode(validate(value, sys.argv[3], raw, baseline)).decode(), flush=True)
+        return 0
+    except MeasurementError as error:
+        print("image-performance-report-rejected:" + str(error), file=sys.stderr)
+        return 2
+    except (ActionError, OSError, ValueError, TypeError, KeyError, RecursionError):
+        print("image-performance-report-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/workflows/image_performance_sdk.py b/tests/workflows/image_performance_sdk.py
new file mode 100644
index 00000000..b080cbd7
--- /dev/null
+++ b/tests/workflows/image_performance_sdk.py
@@ -0,0 +1,441 @@
+"""Signed real-image workloads; private owner joins this child before publication."""
+import concurrent.futures
+import contextlib
+import http.client
+import importlib.metadata
+import json
+import os
+from pathlib import Path
+import platform
+import re
+import sys
+import time
+import urllib.parse
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from image_performance_channel import FloodChannels
+from image_performance_support import MeasurementError, canonical, encode, integer, live, micros, overhead, require, samples, wait_task_baseline
+
+
+def capability(endpoint, connection=None, path="/_rustack/capabilities"):
+    address = urllib.parse.urlsplit(endpoint)
+    require(address.scheme == "http" and address.hostname in ("127.0.0.1", "localhost"), "sdk-endpoint")
+    owned = connection is None
+    if owned:
+        connection = http.client.HTTPConnection(address.hostname, address.port, timeout=2)
+    began = time.monotonic_ns()
+    try:
+        require(path in ("/_rustack/capabilities", "/_health/ready"), "health-path")
+        connection.request("GET", path)
+        response = connection.getresponse()
+        raw = response.read(65537)
+        require(response.status == 200 and len(raw) <= 65536, "health-response")
+        value = json.loads(raw)
+        require(value["ready"] is True, "unready")
+        if path == "/_rustack/capabilities":
+            require(value["workers"]["docker"]["ready"] is True, "docker-unready")
+        else:
+            require(isinstance(value.get("services"), dict)
+                    and value["services"]
+                    and all(state in ("running", "disabled") for state in value["services"].values()), "health-services")
+        elapsed = micros(time.monotonic_ns() - began)
+        require(elapsed < 2000000, "late-health")
+        return value, elapsed
+    finally:
+        if owned:
+            connection.close()
+
+
+FLOOD_PHASES = frozenset(("beginAccepted", "beginObserved", "beginResponseWritten", "endAccepted",
+    "endObserved", "endResponseWritten", "beforeStarted", "beforeFinished", "healthStarted", "healthFinished",
+    "pairStarted", "pairFinished", "afterStarted", "afterFinished", "releaseChecked", "releaseInserted", "releaseRejected", "released", "completionCallbackObserved"))
+
+
+class FloodTimeline:
+    """One bounded current-cycle clock, serialized by its collector condition."""
+    def __init__(self, cycle, started):
+        require(integer(cycle, 1, 100) and type(started) is int and started > 0, "flood-timeline-origin")
+        self.cycle, self.started, self.events = cycle, started, {"submitted": 0}
+
+    def stamp(self, phase, clock=time.monotonic_ns):
+        require(phase in FLOOD_PHASES and phase not in self.events, "flood-timeline-phase")
+        self.events[phase] = micros(clock() - self.started)
+
+    def snapshot(self):
+        return {"cycle": self.cycle, "timingsMicros": dict(self.events)}
+
+
+def admission(value):
+    return value["workers"]["lambdaAdmission"]["activeExecutions"]
+
+
+def wait_flood_channel(collector, accepted, cutoff, clock=time.monotonic_ns):
+    """Observe collector completion under an existing absolute phase cutoff."""
+    with collector.condition:
+        while True:
+            require(clock() < cutoff, "flood-channel-observation-expired")
+            require(not collector.aborted, "flood-channel-observation-aborted")
+            if accepted():
+                require(clock() < cutoff, "flood-channel-observation-expired")
+                return
+            remaining = cutoff - clock()
+            require(remaining > 0, "flood-channel-observation-expired")
+            collector.condition.wait(min(0.01, remaining / 1000000000))
+
+
+def release_flood(collector, future, request, selected, pair, ready):
+    """Observe the live pair before final liveness checks and release atomically."""
+    collector.stamp("beforeStarted")
+    before, _ = ready()
+    collector.stamp("beforeFinished")
+    collector.stamp("healthStarted")
+    _, observed = ready("/_health/ready")
+    collector.stamp("healthFinished")
+    collector.stamp("pairStarted")
+    current, _ = pair()
+    collector.stamp("pairFinished")
+    collector.stamp("afterStarted")
+    after, _ = ready()
+    collector.stamp("afterFinished")
+    completed = future.done()
+    require(admission(before) == admission(after) == 1 and not completed
+            and current == selected, "health-not-during-live-flood")
+    with collector.condition:
+        collector.stamp("releaseChecked")
+        require(not future.done(), "flood-completed-before-release")
+        collector.released.add(request)
+        collector.stamp("releaseInserted")
+        if future.done():
+            collector.released.remove(request)
+            collector.stamp("releaseRejected")
+            raise MeasurementError("flood-completed-during-release")
+        collector.stamp("released")
+        collector.condition.notify_all()
+    return before, after, observed, completed
+
+
+def flood_failure(collector, phase, expected, future):
+    with collector.condition:
+        result = {"phase": phase, "expected": expected, "begun": len(collector.started),
+                  "released": len(collector.released), "ended": len(collector.ended), "outcome": "pending"}
+        timeline = getattr(collector, "timeline", None)
+        if timeline is not None:
+            result.update(timeline.snapshot())
+        channels = getattr(collector, "channels", None)
+        if channels is not None:
+            result["controlChannelPhase"] = channels.current.phase if channels.current is not None else "absent"
+            result["controlPrepared"] = channels.prepared
+    if future.done():
+        try:
+            future.result(timeout=0)
+            result["outcome"] = "unexpected-success"
+        except Exception as error:
+            response = getattr(error, "response", {})
+            detail = response.get("Error", {}) if isinstance(response, dict) else {}
+            if not isinstance(detail, dict): detail = {}
+            message = detail.get("Message", "")
+            if not isinstance(message, str): message = ""
+            if detail.get("Code") == "ServiceException":
+                result["outcome"] = ("handler-timeout" if "function timed out after 1s" in message else
+                    "function-exit" if "function exited with status" in message else "service-error")
+            else:
+                result["outcome"] = "sdk-or-response-error"
+    return result
+
+
+def observe_flood(collector, rows, count, phase, future):
+    began = time.monotonic_ns()
+    try:
+        return collector.wait_for(rows, count)
+    except MeasurementError:
+        diagnostic = flood_failure(collector, phase, count, future)
+        diagnostic["elapsedMicros"] = micros(time.monotonic_ns() - began)
+        print("image-performance-flood-failure " + encode(diagnostic).decode(), file=sys.stderr, flush=True)
+        raise
+
+
+def process_stats(pid):
+    if sys.platform != "linux":
+        return {"rssKiB": None, "tasks": None}
+    raw = Path("/proc") / str(pid) / "status"
+    with raw.open("rb") as stream:
+        text = stream.read(65537)
+    require(len(text) <= 65536, "process-status-bound")
+    rss = re.search(rb"^VmRSS:\s+(\d+) kB$", text, re.M)
+    tasks = re.search(rb"^Threads:\s+(\d+)$", text, re.M)
+    require(rss is not None and tasks is not None, "process-status-shape")
+    return {"rssKiB": int(rss[1]), "tasks": int(tasks[1])}
+
+
+def exercise(endpoint, image, architecture, phase, socket, owner, engine, gateway, pid):
+    from custom_ric_sdk import Collector, Matrix, collecting
+    from lambda_fault_support import Metadata
+    from botocore.exceptions import ClientError
+
+    class Flood(Collector):
+        def __init__(self):
+            self.started, self.ended, self.released = {}, {}, set()
+            self.timeline = None
+            self.channels = FloodChannels()
+            super().__init__()
+            self.deadline = time.monotonic() + 400
+
+        def stamp(self, phase, timeline=None):
+            with self.condition:
+                selected = self.timeline if timeline is None else timeline
+                require(selected is not None, "flood-timeline-missing")
+                selected.stamp(phase)
+
+        def transport_policy(self, connection, path, event):
+            with self.condition:
+                keep_alive, complete = self.channels.accept(connection, path, event)
+            def written():
+                with self.condition:
+                    complete()
+                    self.condition.notify_all()
+            return keep_alive, written
+
+        def observe_transport(self, path, phase, timeline=None):
+            if path == "/flood-ready":
+                return None
+            key = {("/flood-begin", "accepted"): "beginAccepted",
+                   ("/flood-begin", "written"): "beginResponseWritten",
+                   ("/flood-end", "accepted"): "endAccepted",
+                   ("/flood-end", "written"): "endResponseWritten"}.get((path, phase))
+            require(key is not None, "flood-transport-phase")
+            with self.condition:
+                selected = self.timeline if timeline is None else timeline
+                self.stamp(key, selected)
+                return selected
+
+        def exchange(self, path, event):
+            with self.condition:
+                require(not self.aborted and time.monotonic() < self.deadline, "flood-expired")
+                require(isinstance(event["functionName"], str) and len(event["functionName"]) <= 64,
+                        "flood-function")
+                if path == "/flood-ready":
+                    require(set(event) == {"functionName"}, "flood-ready")
+                    return {"ready": True}
+                request = canonical(event["requestId"])
+                if path == "/flood-begin":
+                    require(set(event) == {"functionName", "requestId", "beforeBytes"}
+                            and request not in self.started and len(self.started) < 100
+                            and integer(event["beforeBytes"], 1, 1048575), "flood-begin")
+                    self.stamp("beginObserved")
+                    self.started[request] = event
+                    self.condition.notify_all()
+                    cutoff = min(self.deadline, time.monotonic() + 2)
+                    while request not in self.released and not self.aborted:
+                        remaining = cutoff - time.monotonic()
+                        require(remaining > 0, "flood-release-expired")
+                        self.condition.wait(remaining)
+                    require(not self.aborted, "flood-aborted")
+                    return {"release": True}
+                require(path == "/flood-end" and request in self.released and request not in self.ended
+                        and set(event) == {"functionName", "requestId", "beforeBytes", "afterBytes"}
+                        and event["functionName"] == self.started[request]["functionName"]
+                        and event["beforeBytes"] == self.started[request]["beforeBytes"], "flood-end")
+                result = {key: event[key] for key in ("requestId", "beforeBytes", "afterBytes")}
+                live(1, 1, 1, False, result)
+                self.stamp("endObserved")
+                self.ended[request] = result
+                self.condition.notify_all()
+                return {"recorded": True}
+
+        def wait_for(self, rows, count):
+            cutoff = time.monotonic() + 3
+            with self.condition:
+                while len(rows) < count and not self.aborted:
+                    remaining = cutoff - time.monotonic()
+                    require(remaining > 0, "flood-observation-expired")
+                    self.condition.wait(remaining)
+                require(not self.aborted and len(rows) == count, "flood-observation-count")
+                return list(rows)[-1]
+
+    matrix = Matrix(endpoint, image, architecture)
+    metadata = Metadata(socket, owner, engine)
+    address = urllib.parse.urlsplit(endpoint)
+    health_connection = http.client.HTTPConnection(address.hostname, address.port, timeout=2)
+    request_ids, containers, environments = set(), set(), []
+
+    def pair():
+        rows = metadata.rows()
+        require(len(rows) == 2 and all(row.get("State") == "running" for row in rows)
+                and {row["Labels"]["rustack.lambda.role"] for row in rows}
+                == {"function", "relay"}, "environment-pair")
+        identities = {row["Labels"]["rustack.lambda.environmentId"] for row in rows}
+        require(len(identities) == 1, "pair-affiliation")
+        return {row["Id"] for row in rows}, canonical(next(iter(identities)))
+
+    def create(**fields):
+        name = matrix.create(**fields)
+        matrix.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+        return name
+
+    def invoke(name, counter, delay=0):
+        started = time.monotonic_ns()
+        output, _ = matrix.invoke(name, {"mode": "timed", "value": 35, "delayMillis": delay})
+        elapsed = time.monotonic_ns() - started
+        require(output["computed"] == 42 and output["counter"] == counter
+                and output["imageRevision"] == "A", "handler-computation")
+        request = canonical(output["requestId"])
+        require(request not in request_ids, "duplicate-request")
+        request_ids.add(request)
+        handler = output["handlerNanos"]
+        overhead(elapsed, handler)
+        return elapsed, handler
+
+    def delete(name):
+        cutoff = time.monotonic() + 15
+        matrix.client.delete_function(FunctionName=name)
+        matrix.functions.remove(name)
+        metadata.wait_ids(set(), cutoff)
+        while True:
+            value, _ = ready()
+            require(time.monotonic() < cutoff, "idle-retirement-capacity-expired")
+            capacity = value["workers"]["docker"]["capacity"]
+            if capacity["allocated"] == capacity["memoryBytes"] == capacity["quarantined"] == 0:
+                break
+            time.sleep(0.01)
+
+    def ready(path="/_rustack/capabilities"):
+        return capability(endpoint, health_connection, path)
+
+    def settled_tasks():
+        settled, _ = ready()
+        require(admission(settled) == 0 and settled["workers"]["lambdaAdmission"]["acceptedInvocations"] == 0,
+                "invocation-capacity-leak")
+        capacity = settled["workers"]["docker"]["capacity"]
+        require(capacity["allocated"] == capacity["memoryBytes"] == capacity["quarantined"] == 0
+                and capacity["accepting"] is True and capacity["workerFailed"] is False,
+                "environment-capacity-leak")
+        return settled["workers"]["runtimeTasks"]
+
+    try:
+        require(not metadata.ids(), "nonempty-initial-namespace")
+        baseline = process_stats(pid)
+        if phase == "warm":
+            name = create()
+            invoke(name, 1)
+            original, environment = pair()
+            total, handler, adapter = [], [], []
+            for counter in range(2, 102):
+                full, user = invoke(name, counter, 10)
+                total.append(full); handler.append(user); adapter.append(overhead(full, user))
+                require(pair() == (original, environment), "warm-environment-changed")
+            measured = {"totalNanos": total, "handlerNanos": handler, "overhead": samples(adapter, 100)}
+            require(measured["overhead"]["p95Micros"] <= 50000, "warm-overhead-budget")
+            delete(name)
+        elif phase == "cold":
+            durations = []
+            for _ in range(20):
+                require(not metadata.ids(), "cold-environment-reused")
+                name = create()
+                elapsed, _ = invoke(name, 1)
+                selected, environment = pair()
+                require(not selected & containers and environment not in environments, "cold-identity-reused")
+                containers.update(selected); environments.append(environment); durations.append(micros(elapsed))
+                delete(name)
+            measured = {"latency": samples(durations, 20), "environments": environments,
+                        "uniqueContainers": len(containers)}
+            require(measured["latency"]["p95Micros"] <= 5000000, "cold-budget")
+        else:
+            require(phase == "cycles", "workload-phase")
+            health, timeouts, floods, stats, quiescence, brackets = [], [], [], [], [], []
+            with collecting(Flood) as collector, concurrent.futures.ThreadPoolExecutor(max_workers=1) as workers:
+                priming = create()
+                invoke(priming, 1)
+                delete(priming)
+                name = create(Timeout=1, Environment={"Variables": {
+                    "IMAGE_FIXTURE_COLLECTOR": gateway + ":" + str(collector.server_port),
+                    "IMAGE_FIXTURE_TOKEN": collector.token, "IMAGE_FIXTURE_INIT_MODE": "flood"}})
+                initial, _ = ready()
+                task_baseline = initial["workers"]["runtimeTasks"]
+                for index in range(100):
+                    initialization_cutoff = time.monotonic_ns() + 20000000000
+                    invoke(name, 1)
+                    wait_flood_channel(collector, lambda: collector.channels.ready(index + 1), initialization_cutoff)
+                    with metadata.pinned():
+                        selected, _ = pair()
+                        with collector.condition:
+                            started = time.monotonic_ns()
+                            channel = collector.channels.submit(index + 1, started)
+                            timeline = FloodTimeline(index + 1, started)
+                            collector.timeline = timeline
+                        future = workers.submit(matrix.invoke, name, {"mode": "timed-log-flood", "delayMillis": 5000})
+                        future.add_done_callback(lambda _done, selected=timeline: collector.stamp("completionCallbackObserved", selected))
+                        request = observe_flood(collector, collector.started, index + 1, "begin", future)
+                        try:
+                            before, after, observed, completed = release_flood(
+                                collector, future, request, selected, pair, ready)
+                        except (MeasurementError, OSError, http.client.HTTPException):
+                            diagnostic = flood_failure(collector, "live", index + 1, future)
+                            print("image-performance-flood-failure " + encode(diagnostic).decode(), file=sys.stderr, flush=True)
+                            raise
+                        observe_flood(collector, collector.ended, index + 1, "end", future)
+                        flood = collector.ended[request]
+                        live(admission(before), admission(after), observed, completed, flood)
+                        brackets.append([admission(before), admission(after), completed])
+                    try:
+                        future.result(timeout=65)
+                    except ClientError as error:
+                        returned = time.monotonic_ns()
+                        require(error.response["Error"]["Code"] == "ServiceException"
+                                and "function timed out after 1s" in error.response["Error"].get("Message", ""),
+                                "timeout-classification")
+                    else:
+                        raise MeasurementError("timeout-returned-success")
+                    timeouts.append(micros(returned - started)); health.append(observed); floods.append(flood)
+                    require(not metadata.ids(), "timeout-returned-before-retirement")
+                    wait_flood_channel(collector, lambda: channel.phase == "complete" and channel.connection.fileno() < 0,
+                                       returned + 2000000000)
+                    with collector.condition:
+                        collector.channels.finish(channel, request)
+                    elapsed, tasks = wait_task_baseline(settled_tasks, task_baseline, returned)
+                    quiescence.append(elapsed)
+                    current = process_stats(pid)
+                    current["runtimeTasks"] = tasks
+                    stats.append(current)
+                delete(name)
+            measured = {"readiness": samples(health, 100), "timeout": samples(timeouts, 100),
+                        "floods": floods, "processStats": stats, "completedCycles": 100,
+                        "containerHighWater": 2, "emptyAfterEachTimeout": True,
+                        "runtimeTaskBaseline": task_baseline, "taskQuiescence": samples(quiescence, 100),
+                        "liveBrackets": brackets, "primingInvocations": 1, "primingCleanupConfirmed": True,
+                        "controlChannels": collector.channels.summary()}
+        return {"schemaVersion": 1, "phase": phase, "referenceQualification": "pending",
+                "os": sys.platform, "architecture": platform.machine(), "python": platform.python_version(),
+                "sdkVersion": importlib.metadata.version("boto3"), "baselineProcess": baseline,
+                "measurement": measured, "emptyAfterWorkload": True}
+    finally:
+        matrix.cleanup()
+        matrix.client.close()
+        health_connection.close()
+
+
+def main():
+    require(len(sys.argv) == 12, "workload-arguments")
+    print(os.getpid(), flush=True)
+    sdk_root = sys.argv[11]
+    if sdk_root != "-":
+        from linux_performance import safe_path
+        sys.path.insert(0, str(safe_path(sdk_root)))
+    from linux_performance import deadline_guard
+    with deadline_guard(400):
+        require(importlib.metadata.version("boto3") == importlib.metadata.version("botocore") == "1.43.118",
+                "sdk-version")
+        result = exercise(*sys.argv[1:9], int(sys.argv[9]))
+        require(sys.argv[10] == "v1", "workload-schema")
+        print(encode(result).decode(), flush=True)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except MeasurementError as error:
+        print("image-performance-workload-failed:" + str(error), file=sys.stderr)
+        raise SystemExit(2) from None
+    except Exception:
+        print("image-performance-workload-failed", file=sys.stderr)
+        raise SystemExit(2) from None
diff --git a/tests/workflows/image_performance_support.py b/tests/workflows/image_performance_support.py
new file mode 100644
index 00000000..0774162e
--- /dev/null
+++ b/tests/workflows/image_performance_support.py
@@ -0,0 +1,141 @@
+"""Exact sample, cold-stage and live-flood oracles; no SDK or network dependency."""
+import json
+import hashlib
+from pathlib import Path
+import re
+import sys
+import time
+import uuid
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "tools/github-action"))
+from metadata import document
+
+
+class MeasurementError(ValueError):
+    """Fixed local diagnostic codes, without candidate or SDK payload values."""
+
+
+def require(condition, code):
+    if not condition:
+        raise MeasurementError(code)
+
+
+def integer(value, low, high):
+    return type(value) is int and low <= value <= high
+
+
+def micros(nanos):
+    require(integer(nanos, 0, 480000000000), "duration-bound")
+    return (nanos + 999) // 1000
+
+
+def samples(values, count):
+    require(count in (20, 100) and isinstance(values, list) and len(values) == count
+            and all(integer(value, 0, 480000000) for value in values), "sample-count-or-range")
+    ranked = sorted(values)
+    return {"observedMicros": values, "p50Micros": ranked[(count - 1) // 2],
+            "p95Micros": ranked[(95 * count + 99) // 100 - 1], "maxMicros": ranked[-1]}
+
+
+def overhead(total, handler):
+    require(integer(total, 1, 60000000000) and integer(handler, 1, total), "handler-clock")
+    return micros(total - handler)
+
+
+def exact_samples(value, count):
+    require(isinstance(value, dict) and set(value) == {"observedMicros", "p50Micros", "p95Micros", "maxMicros"}
+            and all(integer(value[key], 0, 480000000) for key in ("p50Micros", "p95Micros", "maxMicros"))
+            and value == samples(value["observedMicros"], count), "sample-ranks")
+    return value
+
+
+def wait_task_baseline(read, baseline, started, clock=time.monotonic_ns, pause=time.sleep):
+    require(integer(baseline, 1, 4096), "runtime-task-baseline")
+    cutoff = started + 2000000000
+    while True:
+        require(clock() < cutoff, "task-quiescence-before-observation")
+        value = read()
+        observed = clock()
+        require(observed < cutoff and integer(value, 1, 4096), "task-quiescence-late-observation")
+        if value == baseline:
+            return micros(observed - started), value
+        pause(min(0.005, (cutoff - observed) / 1000000000))
+
+
+def canonical(value):
+    require(isinstance(value, str) and len(value) == 36 and str(uuid.UUID(value)) == value,
+            "environment-identity")
+    return value
+
+
+def cold_stages(raw, environments, total_micros, baseline=b""):
+    require(isinstance(raw, bytes) and len(raw) <= 32768, "initialization-log-bound")
+    require(isinstance(baseline, bytes) and len(baseline) <= 32768 and raw.startswith(baseline)
+            and (not baseline or baseline.endswith(b"\n")), "initialization-baseline")
+    require(len(environments) == len(set(environments)) == len(total_micros) == 20,
+            "cold-identity-count")
+    expected = {canonical(name): value for name, value in zip(environments, total_micros)}
+    observed = {}
+    text = re.sub(rb"\x1b\[[0-9;]*m", b"", raw[len(baseline):]).decode("utf-8")
+    for line in text.splitlines():
+        if "rustack_lambda_core::docker::initialization" not in line:
+            continue
+        require(len(line.encode()) <= 1024, "initialization-line-bound")
+        match = re.search(r"Image environment ready environment_id=([0-9a-f-]{36}) "
+                          r"relay_micros=([0-9]{1,12}) ric_micros=([0-9]{1,12})$", line)
+        require(match is not None, "initialization-event-shape")
+        name, relay, ric = match[1], int(match[2]), int(match[3])
+        canonical(name)
+        require(name in expected and name not in observed and relay + ric <= expected[name] + 2,
+                "initialization-affiliation-or-clock")
+        observed[name] = (relay, ric)
+    require(set(observed) == set(expected), "initialization-event-count")
+    return {"relay": samples([observed[name][0] for name in environments], 20),
+            "functionRic": samples([observed[name][1] for name in environments], 20),
+            "startupBaseline": {"bytes": len(baseline), "sha256": hashlib.sha256(baseline).hexdigest()},
+            "events": [{"environmentId": name, "relayMicros": row[0], "ricMicros": row[1]}
+                       for name, row in observed.items()]}
+
+
+def verify_stages(value, environments, total_micros):
+    require(isinstance(value, dict) and set(value) == {"relay", "functionRic", "startupBaseline", "events"}
+            and isinstance(value["events"], list) and len(value["events"]) == 20, "cold-normalized-events")
+    before = value["startupBaseline"]
+    require(isinstance(before, dict) and set(before) == {"bytes", "sha256"}
+            and integer(before["bytes"], 0, 32768) and isinstance(before["sha256"], str)
+            and re.fullmatch(r"[0-9a-f]{64}", before["sha256"]) is not None, "cold-baseline-proof")
+    rows = []
+    for event in value["events"]:
+        require(isinstance(event, dict) and set(event) == {"environmentId", "relayMicros", "ricMicros"}
+                and integer(event["relayMicros"], 0, 480000000) and integer(event["ricMicros"], 0, 480000000),
+                "cold-normalized-event")
+        name = canonical(event["environmentId"])
+        rows.append(("rustack_lambda_core::docker::initialization: Image environment ready environment_id="
+                     + name + " relay_micros=" + str(event["relayMicros"]) + " ric_micros=" + str(event["ricMicros"])).encode())
+    normalized = cold_stages(b"\n".join(rows), environments, total_micros)
+    require(exact_samples(value["relay"], 20) == normalized["relay"]
+            and exact_samples(value["functionRic"], 20) == normalized["functionRic"],
+            "cold-normalized-ranks")
+    return value
+
+
+def live(before, after, ready_micros, completed, flood):
+    require(before == after == 1 and integer(before, 1, 1) and integer(after, 1, 1)
+            and integer(ready_micros, 0, 1999999) and completed is False, "nonlive-health")
+    require(isinstance(flood, dict) and set(flood) == {"requestId", "beforeBytes", "afterBytes"},
+            "flood-evidence-shape")
+    canonical(flood["requestId"])
+    require(integer(flood["beforeBytes"], 1, 1048575)
+            and integer(flood["afterBytes"], flood["beforeBytes"] + 1, 1048575), "inactive-flood")
+
+
+def decode(raw, maximum=32768):
+    require(maximum in (32768, 65536), "measurement-byte-policy")
+    return document(raw, maximum=maximum, string_limit=4096, member_limit=4096)
+
+
+def encode(value):
+    raw = json.dumps(value, separators=(",", ":"), allow_nan=False).encode()
+    require(len(raw) <= 32768, "measurement-report-bound")
+    decode(raw)
+    return raw
diff --git a/tests/workflows/image_refresh_build.py b/tests/workflows/image_refresh_build.py
new file mode 100644
index 00000000..06968d54
--- /dev/null
+++ b/tests/workflows/image_refresh_build.py
@@ -0,0 +1,66 @@
+"""Build current production fixtures behind retained source caches and receipts."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import sys
+import time
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import ActionError
+import rootless_platform as storage
+from image_performance_images import catalog, fenced
+from linux_performance import MIB, QualificationError, Runner, bounded_read, deadline_guard, require, safe_path
+from rootless_functional import source_seal
+from rootless_resources import REFRESH_SOURCES, captured
+
+TARGETS = ("lambda-runtime-image", "lambda-custom-ric-images", "lambda-workflows-server-image", "lambda-workflows-release-image")
+NAMES = REFRESH_SOURCES
+
+
+def run(directory, socket, builder, owner, deadline):
+    require(not os.path.lexists(directory), "refresh-build-evidence-exists")
+    directory.mkdir(mode=0o700)
+    source = source_seal(owner, deadline)
+    hashed = hashlib.sha256(json.dumps(source, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    endpoint = "unix://" + str(socket)
+    engine = owner.run(["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline)
+    require(engine.code == 0 and engine.stderr == b"", "refresh-build-engine")
+    engine = engine.stdout.decode().strip()
+    ids = catalog(owner, endpoint, deadline, engine)
+    before = {name: captured(owner, endpoint, name, deadline, engine) for name in NAMES}
+    storage.publish(directory / "intent.json", {"sourceSealSha256": hashed, "engine": engine,
+        "sourceSocket": str(socket), "originalIds": sorted(ids), "before": before, "targets": list(TARGETS)})
+    # The source cache guard must settle before any build can move a fixture tag.
+    arguments = ["make", "--no-print-directory", "-j1", "workflows-retain-fixture-sources"]
+    require(builder and len(builder) <= 256 and all(character.isalnum() or character in "_./ -" for character in builder), "refresh-builder")
+    arguments += list(TARGETS) + ["WORKFLOWS_ARCH=arm64", "WORKFLOWS_DOCKER_SOCKET=" + str(socket), "WORKFLOWS_IMAGE_BUILDER=" + builder]
+    log = directory / "build.log"
+    wrapper = [sys.executable, "-I", "-B", str(Path(__file__).with_name("gate_command.py")), str(log)] + arguments
+    reply = owner.run(wrapper, deadline)
+    require(reply.code == 0 and reply.stdout == reply.stderr == b"", "refresh-build-failed")
+    require(source_seal(owner, deadline) == source, "refresh-build-source-changed")
+    after = {name: captured(owner, endpoint, name, deadline, engine) for name in NAMES}
+    final_ids = catalog(owner, endpoint, deadline, engine)
+    require(ids <= final_ids, "refresh-build-lost-original-image")
+    report = {"schemaVersion": 1, "sourceSealSha256": hashed, "engine": engine, "sourceSocket": str(socket),
+              "originalIds": sorted(ids), "resultIds": sorted(final_ids), "before": before, "images": after,
+              "targets": list(TARGETS), "logSha256": hashlib.sha256(bounded_read(log, 16 * MIB)).hexdigest(),
+              "allChildGroupsJoined": not owner.unsettled}
+    storage.publish(directory / "report.json", report)
+
+
+def main():
+    try:
+        require(len(sys.argv) == 4, "refresh-build-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard(3600, owner) as deadline:
+            run(safe_path(sys.argv[1]), safe_path(sys.argv[2]), sys.argv[3], owner, deadline)
+        return 0
+    except (ActionError, OSError, ValueError, TypeError, KeyError):
+        print("refresh-build-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/lambda_admission_sdk.py b/tests/workflows/lambda_admission_sdk.py
new file mode 100644
index 00000000..87067eba
--- /dev/null
+++ b/tests/workflows/lambda_admission_sdk.py
@@ -0,0 +1,395 @@
+"""Actual Runtime HTTP bounds and independently binding execution/resource ceilings."""
+import base64
+import contextlib
+import json
+import http.client
+import time
+import urllib.parse
+import uuid
+
+import boto3
+from botocore.config import Config
+from botocore.exceptions import ClientError
+
+from custom_ric_sdk import collecting, unique_object
+from lambda_fault_support import Hold
+
+
+def wait_work(matrix, accepted, active, deadline):
+    address = urllib.parse.urlsplit(matrix.endpoint)
+    while True:
+        remaining = deadline - time.monotonic()
+        assert remaining > 0, "actual invocation ownership never reached the required counts"
+        connection = http.client.HTTPConnection(address.hostname, address.port, timeout=min(2, remaining))
+        try:
+            connection.request("GET", "/_rustack/capabilities")
+            response = connection.getresponse()
+            raw = response.read(65537)
+            assert response.status == 200 and len(raw) <= 65536
+            work = json.loads(raw, object_pairs_hook=unique_object)["workers"]["lambdaAdmission"]
+            assert work["limits"] == {"acceptedInvocations":128,"activeExecutions":32,"defaultFunctionExecutions":8}
+            assert work["accepting"] is True and time.monotonic() < deadline
+            assert type(work["acceptedInvocations"]) is type(work["activeExecutions"]) is int
+            assert 0 <= work["acceptedInvocations"] <= 128 and 0 <= work["activeExecutions"] <= 32
+            if work["acceptedInvocations"] == accepted and work["activeExecutions"] == active:
+                return work
+        finally:
+            connection.close()
+        time.sleep(0.025)
+
+
+def capacity(matrix, allocated, memory):
+    address = urllib.parse.urlsplit(matrix.endpoint)
+    connection = http.client.HTTPConnection(address.hostname, address.port, timeout=2)
+    try:
+        connection.request("GET", "/_rustack/capabilities")
+        response = connection.getresponse()
+        raw = response.read(65537)
+        assert response.status == 200 and len(raw) <= 65536
+        actual = json.loads(raw, object_pairs_hook=unique_object)["workers"]["docker"]["capacity"]
+        assert actual == {"allocated":allocated,"memoryBytes":memory * 1024 * 1024,
+                          "quarantined":0,"accepting":True,"workerFailed":False}
+        return actual
+    finally:
+        connection.close()
+
+
+class QuotaHold(Hold):
+    """Only first handlers block; bounded computing events publish unique tickets."""
+    def __init__(self):
+        super().__init__("busy")
+        self.deadline = time.monotonic() + 150
+        self.tickets, self.completed = set(), {}
+
+    def expect_tickets(self, count):
+        with self.condition:
+            assert type(count) is int and 1 <= count <= 30 and not self.tickets and not self.completed
+            self.tickets = set(range(count))
+
+    def exchange(self, path, event):
+        if path == "/hold":
+            return super().exchange(path, event)
+        with self.condition:
+            assert path == "/completed" and not self.aborted and time.monotonic() < self.deadline
+            assert set(event) == {"ticket", "functionName", "requestId", "computed", "counter"}
+            ticket = event["ticket"]
+            assert type(ticket) is int and ticket in self.tickets and ticket not in self.completed
+            assert event["functionName"] in self.expected and event["computed"] == 15
+            assert type(event["counter"]) is int and 1 <= event["counter"] <= 30
+            assert str(uuid.UUID(event["requestId"])) == event["requestId"]
+            assert all(row["requestId"] != event["requestId"] for row in self.completed.values())
+            self.completed[ticket] = dict(event)
+            self.condition.notify_all()
+            return {"recorded":True}
+
+    def wait_completed(self, deadline):
+        with self.condition:
+            while set(self.completed) != self.tickets and not self.aborted:
+                remaining = min(deadline, self.deadline) - time.monotonic()
+                assert remaining > 0, "acknowledged event computation never completed"
+                self.condition.wait(remaining)
+            assert self.tickets and not self.aborted and time.monotonic() < min(deadline, self.deadline)
+            return dict(self.completed)
+
+
+def wait_absent(matrix, old, deadline):
+    assert len(old) == 2
+    while True:
+        current = matrix.metadata.ids()
+        assert time.monotonic() < deadline, "old pair did not physically retire"
+        if current.isdisjoint(old):
+            return current
+        time.sleep(0.025)
+
+
+def raw_result(connection, expected, message=None):
+    assert connection.sock is not None
+    connection.sock.settimeout(30)
+    response = connection.getresponse()
+    raw = response.read(65537)
+    assert response.status == expected and len(raw) <= 65536
+    value = json.loads(raw, object_pairs_hook=unique_object)
+    if expected == 500:
+        assert response.getheader("x-amzn-errortype") == "ServiceException"
+        assert message in value.get("message", value.get("Message", ""))
+    else:
+        assert response.getheader("x-amz-function-error") is None
+    return value
+
+
+def retire(matrix, name):
+    matrix.expect_error(lambda: matrix.invoke(name, {"mode":"exit"}), "ServiceException",
+                        "function exited with status 42; oom=false")
+
+
+def held_exit(matrix, hold, name):
+    before = matrix.metadata.rows()
+    ids = {row["Id"] for row in before}
+    matrix.proxy.arm("pair_delete", matrix.metadata.owner, 2)
+    hold.release_target(name)
+    record = matrix.proxy.wait(1, time.monotonic() + 20)[0]
+    assert record["id"] in ids and matrix.metadata.ids() == ids
+    function = matrix.metadata.get("/containers/" + record["id"] + "/json")
+    assert function["State"]["Running"] is False and function["State"]["ExitCode"] == 42
+    assert "AWS_LAMBDA_FUNCTION_NAME=" + name in function["Config"]["Env"]
+    environment = function["Config"]["Labels"]["rustack.lambda.environmentId"]
+    old = {row["Id"] for row in before if row["Labels"]["rustack.lambda.environmentId"] == environment}
+    assert len(old) == 2 and not matrix.proxy.released
+    return ids, old
+
+
+def held_relay(matrix, ids, old):
+    function = matrix.proxy.observed[0]["id"]
+    matrix.proxy.release_function()
+    record = matrix.proxy.wait(2, time.monotonic() + 15)[1]
+    assert record["role"] == "relay" and record["id"] in old and record["id"] != function
+    expected = ids - {function}
+    assert matrix.metadata.ids() == expected and not matrix.proxy.released
+    return expected
+
+
+def pair(matrix):
+    rows = matrix.metadata.rows()
+    assert len(rows) == 2
+    roles, environments = set(), set()
+    for row in rows:
+        role = row["Labels"]["rustack.lambda.role"]
+        roles.add(role)
+        environments.add(row["Labels"]["rustack.lambda.environmentId"])
+        inspected = matrix.metadata.get("/containers/" + row["Id"] + "/json")
+        assert inspected["State"]["Running"] is True
+        memory = (128 if role == "function" else 64) * 1024 * 1024
+        assert inspected["HostConfig"]["Memory"] == inspected["HostConfig"]["MemorySwap"] == memory
+    assert roles == {"function", "relay"} and len(environments) == 1
+    return {row["Id"] for row in rows}
+
+
+def runtime_bounds(matrix):
+    name = matrix.create()
+    response = matrix.client.invoke(FunctionName=name, LogType="Tail", Payload=b'{"mode":"framing","value":8}')
+    with response["Payload"] as body:
+        raw = body.read(65537)
+    assert response["StatusCode"] == 200 and "FunctionError" not in response and len(raw) <= 65536
+    output = json.loads(raw, object_pairs_hook=unique_object)
+    assert output["computed"] == 15 and output["counter"] == 1
+    assert output["forgedStatuses"] == [405,431,413,413,400]
+    assert str(uuid.UUID(output["requestId"])) == output["requestId"]
+    logs = base64.b64decode(response.get("LogResult", ""), validate=True)
+    assert len(logs) <= 4096 and b"runtime-boundary-secret" not in logs
+    before = pair(matrix)
+    warm, _ = matrix.invoke(name, {"value":8})
+    assert warm["computed"] == 15 and warm["counter"] == 2 and warm["requestId"] != output["requestId"]
+    assert matrix.metadata.ids() == before
+    retire(matrix, name)
+    matrix.metadata.wait_ids(set(), time.monotonic() + 15)
+    matrix.ready()
+    matrix.delete(name)
+    return ["runtime-http-405-431-413-413-400", "same-attempt-computed-result", "warm-counter-two", "retired-healthy"]
+
+
+def resource_pressure(matrix, host, phase):
+    wait_work(matrix, 0, 0, time.monotonic() + 5)
+    with collecting(QuotaHold) as hold:
+        variables = {"IMAGE_FIXTURE_COLLECTOR":f"{host}:{hold.server_port}", "IMAGE_FIXTURE_TOKEN":hold.token}
+        names = [matrix.create(Timeout=900, Environment={"Variables":variables}) for _ in range(2)]
+        hold.targets(names)
+        for name in names:
+            matrix.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+        a = matrix.raw_invoke(names[0], {"mode":"hold-exit"})
+        b = None
+        try:
+            hold.wait_seen(1, time.monotonic() + 20)
+            first = pair(matrix)
+            b = matrix.raw_invoke(names[1], {"mode":"hold", "value":8})
+            matrix.expect_error(lambda: matrix.invoke(names[1]), "TooManyRequestsException")
+            wait_work(matrix, 2, 2, time.monotonic() + 5)
+            assert matrix.metadata.ids() == first and names[1] not in hold.observed
+            held, old = held_exit(matrix, hold, names[0])
+            assert held == first == old
+            capacity(matrix, 1, 192)
+            wait_work(matrix, 2, 2, time.monotonic() + 5)
+            matrix.expect_error(lambda: matrix.invoke(names[1]), "TooManyRequestsException")
+            assert matrix.metadata.ids() == first and names[1] not in hold.observed
+            relay_only = held_relay(matrix, held, old)
+            wait_work(matrix, 2, 2, time.monotonic() + 5)
+            capacity(matrix, 1, 192)
+            matrix.expect_error(lambda: matrix.invoke(names[1]), "TooManyRequestsException")
+            assert matrix.metadata.ids() == relay_only and names[1] not in hold.observed
+            matrix.proxy.release()
+            raw_result(a, 500, "function exited with status 42; oom=false")
+            seen = hold.wait_seen(2, time.monotonic() + 30)
+            replacement = pair(matrix)
+            assert replacement.isdisjoint(old)
+            wait_work(matrix, 1, 1, time.monotonic() + 5)
+            hold.release_target(names[1])
+            output = raw_result(b, 200)
+            assert output["computed"] == 15 and output["counter"] == 1
+            assert output["requestId"] == seen[names[1]]["requestId"]
+            retire(matrix, names[1])
+            matrix.metadata.wait_ids(set(), time.monotonic() + 15)
+            wait_work(matrix, 0, 0, time.monotonic() + 5)
+            matrix.ready()
+            for name in names:
+                matrix.delete(name)
+        finally:
+            a.close()
+            if b is not None:
+                b.close()
+            matrix.proxy.restore()
+    return [phase + "-independent-ceiling", "admitted-B-waits-without-allocation",
+            "retained-until-old-pair-retired", "B-cold-computed-recovery"]
+
+
+def execution_pressure(matrix, host, global_limit):
+    wait_work(matrix, 0, 0, time.monotonic() + 5)
+    with collecting(QuotaHold) as hold:
+        variables = {"IMAGE_FIXTURE_COLLECTOR":f"{host}:{hold.server_port}", "IMAGE_FIXTURE_TOKEN":hold.token}
+        names = [matrix.create(Timeout=900, Environment={"Variables":variables}) for _ in range(2 if global_limit else 1)]
+        probe = matrix.create() if global_limit else names[0]
+        hold.targets(names)
+        if global_limit:
+            for name in names:
+                matrix.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=32)
+                assert matrix.client.get_function_concurrency(FunctionName=name)["ReservedConcurrentExecutions"] == 32
+        else:
+            assert "ReservedConcurrentExecutions" not in matrix.client.get_function_concurrency(FunctionName=probe)
+        total = 30 if global_limit else 7
+        hold.expect_tickets(total)
+        try:
+            for name in names:
+                matrix.event(name, {"mode":"hold-exit"})
+            hold.wait_seen(len(names), time.monotonic() + 20)
+            physical = matrix.metadata.pair_limits() if global_limit else pair(matrix)
+            for ticket in range(total):
+                name = names[ticket // 15] if global_limit else names[0]
+                matrix.event(name, {"mode":"counted", "value":8, "ticket":ticket})
+            count = 32 if global_limit else 8
+            wait_work(matrix, count, count, time.monotonic() + 10)
+            matrix.expect_error(lambda: matrix.invoke(probe), "TooManyRequestsException")
+            assert matrix.metadata.ids() == physical and not hold.completed
+            held, old = held_exit(matrix, hold, names[0])
+            assert held == physical
+            capacity(matrix, len(names), len(names) * 192)
+            wait_work(matrix, count, count, time.monotonic() + 5)
+            matrix.expect_error(lambda: matrix.invoke(probe), "TooManyRequestsException")
+            assert matrix.metadata.ids() == physical and not hold.completed
+            relay_only = held_relay(matrix, held, old)
+            wait_work(matrix, count, count, time.monotonic() + 5)
+            capacity(matrix, len(names), len(names) * 192)
+            matrix.expect_error(lambda: matrix.invoke(probe), "TooManyRequestsException")
+            assert matrix.metadata.ids() == relay_only and not hold.completed
+            matrix.proxy.release()
+            wait_absent(matrix, old, time.monotonic() + 15)
+            completed = hold.wait_completed(time.monotonic() + 70)
+            assert len(completed) == total
+            with contextlib.closing(boto3.client("lambda", endpoint_url=matrix.endpoint, region_name="us-east-1",
+                    aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                    config=matrix.client.meta.config.merge(Config(read_timeout=30)))) as client:
+                # Only explicit429 may lag the already observed event computations.
+                deadline = time.monotonic() + 40
+                while True:
+                    try:
+                        output, _ = matrix.invoke(probe, {"value":8}, client=client)
+                        assert time.monotonic() < deadline and output["computed"] == 15
+                        break
+                    except ClientError as error:
+                        assert error.response["Error"]["Code"] == "TooManyRequestsException"
+                        assert time.monotonic() < deadline
+                        time.sleep(0.025)
+            if not global_limit:
+                assert output["counter"] == 8
+                assert sorted(row["counter"] for row in completed.values()) == list(range(1, 8))
+            else:
+                hold.release_target(names[1])
+            retire(matrix, probe)
+            matrix.metadata.wait_ids(set(), time.monotonic() + 15)
+            wait_work(matrix, 0, 0, time.monotonic() + 5)
+            matrix.ready()
+            for name in dict.fromkeys(names + [probe]):
+                matrix.delete(name)
+        finally:
+            matrix.proxy.restore()
+    phase = "global_limit" if global_limit else "default_limit"
+    return [phase + "-positive-capacity-proof", "held-delete-retains-charge",
+            "physical-retirement-before-recovery", "computed-recovery"]
+
+
+def composite_pressure(matrix, host):
+    """Large nested frames and actual malformed Runtime IO while Stop is live."""
+    settings = dict(endpoint_url=matrix.endpoint, region_name="us-east-1", aws_access_key_id="local-key",
+                    aws_secret_access_key="local-secret", config=Config(retries={"max_attempts": 0},
+                    connect_timeout=2, read_timeout=5))
+    with contextlib.closing(boto3.client("stepfunctions", **settings)) as states, collecting(lambda: Hold("busy")) as hold:
+        variables = {"IMAGE_FIXTURE_COLLECTOR":f"{host}:{hold.server_port}", "IMAGE_FIXTURE_TOKEN":hold.token}
+        blocked = matrix.create(Timeout=120, Environment={"Variables":variables})
+        framing = matrix.create()
+        hold.targets([blocked])
+        suffix = uuid.uuid4().hex
+        machines, executions = [], []
+        role = "arn:aws:iam::000000000000:role/Docker"
+        def create(name, definition):
+            arn = states.create_state_machine(name=name + suffix, roleArn=role,
+                    definition=json.dumps(definition, separators=(",", ":")))["stateMachineArn"]
+            machines.append(arn)
+            return arn
+        try:
+            child = create("PressureChild", {"StartAt":"M", "States":{"M":{"Type":"Map", "ItemsPath":"$.items",
+                "MaxConcurrency":1, "Iterator":{"StartAt":"T", "States":{"T":{"Type":"Task",
+                    "Resource":"arn:aws:states:::lambda:invoke", "Parameters":{"FunctionName":blocked,"Payload":{"mode.$":"$.mode","value.$":"$.value"}},
+                    "End":True}}}, "End":True}}})
+            parent = create("PressureParent", {"StartAt":"C", "States":{"C":{"Type":"Task",
+                "Resource":"arn:aws:states:::states:startExecution.sync:2",
+                "Parameters":{"StateMachineArn":child,"Input.$":"$"}, "End":True}}})
+            event = {"items":[{"mode":"hold", "value":8, "nested":{"padding":"x" * (128 * 1024)}}]}
+            execution = states.start_execution(stateMachineArn=parent, input=json.dumps(event))["executionArn"]
+            executions.append(execution)
+            hold.wait_seen(1, time.monotonic() + 30)
+            held = pair(matrix)
+            # Independent runtime slot hits real oversized HTTP frame limits while
+            # the parent/Map/child and its handler still own the large input.
+            output, _ = matrix.invoke(framing, {"mode":"framing", "value":8})
+            assert output["computed"] == 15 and output["forgedStatuses"] == [405,431,413,413,400]
+            assert held <= matrix.metadata.ids() and len(matrix.metadata.ids()) == 4
+            for _ in range(3):
+                began = time.monotonic()
+                matrix.ready()
+                assert states.describe_execution(executionArn=execution)["status"] == "RUNNING"
+                assert time.monotonic() - began < 2, "control plane starved by nested payload/frame pressure"
+            began = time.monotonic()
+            states.stop_execution(executionArn=execution, error="PressureStop", cause="bounded control")
+            assert time.monotonic() - began < 2, "Stop starved under pressure"
+            cutoff = time.monotonic() + 20
+            while states.describe_execution(executionArn=execution)["status"] == "RUNNING":
+                assert time.monotonic() < cutoff
+                time.sleep(0.025)
+            assert states.describe_execution(executionArn=execution)["status"] == "ABORTED"
+            wait_absent(matrix, held, cutoff)
+            retire(matrix, framing)
+            matrix.metadata.wait_ids(set(), time.monotonic() + 15)
+            quota = create("PressureQuota", {"StartAt":"P", "States":{"P":{"Type":"Pass", "Parameters":{
+                "a.$":"$.padding", "b.$":"$.padding", "c.$":"$.padding"}, "End":True}}})
+            failed = states.start_execution(stateMachineArn=quota, input=json.dumps({"padding":"q" * (100 * 1024)}))["executionArn"]
+            executions.append(failed)
+            cutoff = time.monotonic() + 10
+            while True:
+                result = states.describe_execution(executionArn=failed)
+                if result["status"] != "RUNNING":
+                    assert result["status"] == "FAILED" and result["error"] == "States.DataLimitExceeded"
+                    break
+                assert time.monotonic() < cutoff
+                time.sleep(0.025)
+            matrix.ready()
+            fresh, _ = matrix.invoke(framing, {"value":8})
+            assert fresh["computed"] == 15 and fresh["counter"] == 1
+            retire(matrix, framing)
+            matrix.metadata.wait_ids(set(), time.monotonic() + 15)
+        finally:
+            for arn in executions:
+                if states.describe_execution(executionArn=arn)["status"] == "RUNNING":
+                    states.stop_execution(executionArn=arn)
+            for arn in reversed(machines):
+                states.delete_state_machine(stateMachineArn=arn)
+        matrix.delete(blocked)
+        matrix.delete(framing)
+    return ["large-nested-map-owned-child", "oversized-runtime-frame-under-load", "live-ready-and-stop",
+            "physical-pair-retirement", "typed-payload-quota", "cold-slot-recovery"]
diff --git a/tests/workflows/lambda_fault_sdk.py b/tests/workflows/lambda_fault_sdk.py
new file mode 100644
index 00000000..ea44b601
--- /dev/null
+++ b/tests/workflows/lambda_fault_sdk.py
@@ -0,0 +1,220 @@
+"""Real Image faults, causal client disconnects and accepted-work shutdown."""
+import contextlib
+import http.client
+import json
+import os
+import sys
+import time
+import urllib.parse
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+import boto3
+from botocore.config import Config
+from botocore.auth import SigV4Auth
+from botocore.awsrequest import AWSRequest
+from botocore.credentials import Credentials
+from botocore.exceptions import ClientError
+
+from custom_ric_sdk import Matrix, collecting
+from lambda_fault_support import Hold, Metadata, recover_before
+
+
+class Faults(Matrix):
+    def __init__(self, endpoint, image, architecture, metadata):
+        super().__init__(endpoint, image, architecture)
+        self.endpoint, self.metadata = endpoint, metadata
+
+    def ready(self):
+        endpoint = urllib.parse.urlsplit(self.endpoint)
+        connection = http.client.HTTPConnection(endpoint.hostname, endpoint.port, timeout=3)
+        try:
+            connection.request("GET", "/_rustack/capabilities")
+            response = connection.getresponse()
+            raw = response.read(65537)
+            assert response.status == 200 and len(raw) <= 65536
+            status = json.loads(raw)
+            assert status["ready"] is True and status["workers"]["docker"]["ready"] is True
+        finally:
+            connection.close()
+
+    def expect_error(self, operation, code, message=None):
+        try:
+            operation()
+        except ClientError as error:
+            assert error.response["Error"]["Code"] == code, error.response["Error"]["Code"]
+            assert error.response["ResponseMetadata"]["HTTPStatusCode"] == {"TooManyRequestsException":429, "ServiceException":500, "ResourceNotFoundException":404, "ResourceConflictException":409, "ResourceNotReadyException":502}.get(code, 400)
+            text = error.response["Error"].get("Message", "")
+            assert "fixture-init-payload-sentinel" not in text
+            if message is not None:
+                assert message in text, "infrastructure failure was misclassified: " + text
+        else:
+            raise AssertionError("negative Image operation unexpectedly succeeded")
+
+    def delete(self, name):
+        self.client.delete_function(FunctionName=name)
+        self.functions.remove(name)
+
+    def fault_matrix(self):
+        cases = [
+            ("init-error", "error", {}, "function initialization failed", 30),
+            ("prepoll-exit", "exit", {}, "function exited with status 42; oom=false", 30),
+            ("bootstrap-timeout", "stall", {}, "function bootstrap initialization deadline exceeded", 30),
+            ("handler-exit", None, {"mode":"exit"}, "function exited with status 42; oom=false", 30),
+            ("cgroup-oom", None, {"mode":"oom"}, "function exited with status 137; oom=true", 30),
+            ("handler-timeout", None, {"delayMillis":5000}, "function timed out after 1s", 1),
+        ]
+        completed = []
+        for case, mode, event, message, timeout in cases:
+            environment = {} if mode is None else {"IMAGE_FIXTURE_INIT_MODE":mode}
+            name = self.create(Timeout=timeout, Environment={"Variables":environment})
+            before = self.metadata.ids()
+            self.expect_error(lambda: self.invoke(name, event), "ServiceException", message)
+            assert self.metadata.ids() <= before, "failed environment survived the returned error"
+            self.ready()
+            self.client.update_function_configuration(FunctionName=name, Environment={"Variables":{}}, Timeout=30)
+            self.settled(name, updating=True)
+            output, _ = self.invoke(name, {"value":8})
+            assert output["computed"] == 15 and output["counter"] == 1 and output["imageRevision"] == "A"
+            self.delete(name)
+            completed.append(case)
+        return completed
+
+    def raw_invoke(self, name, event):
+        endpoint = urllib.parse.urlsplit(self.endpoint)
+        path = "/2015-03-31/functions/" + name + "/invocations"
+        body = json.dumps(event).encode()
+        request = AWSRequest(method="POST", url=self.endpoint + path, data=body,
+                             headers={"Content-Type":"application/json", "X-Amz-Invocation-Type":"RequestResponse"})
+        SigV4Auth(Credentials("local-key", "local-secret"), "lambda", "us-east-1").add_auth(request)
+        connection = http.client.HTTPConnection(endpoint.hostname, endpoint.port, timeout=3)
+        try:
+            connection.request("POST", path, body, dict(request.headers))
+        except BaseException:
+            connection.close()
+            raise
+        return connection
+
+    def disconnected(self, host, stage):
+        with collecting(lambda: Hold(stage)) as collector:
+            variables = {"IMAGE_FIXTURE_COLLECTOR":f"{host}:{collector.server_port}",
+                         "IMAGE_FIXTURE_TOKEN":collector.token}
+            if stage == "initializing":
+                variables["IMAGE_FIXTURE_INIT_MODE"] = "hold"
+            name = self.create(Timeout=900, Environment={"Variables":variables})
+            collector.targets([name])
+            self.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=0)
+            baseline = self.metadata.ids()
+            self.expect_error(lambda: self.invoke(name), "TooManyRequestsException")
+            assert self.metadata.ids() == baseline
+            # Only these malformed wire controls disable botocore's local range
+            # check; signing and the actual service boundary remain enabled.
+            with contextlib.closing(boto3.client("lambda", endpoint_url=self.endpoint, region_name="us-east-1",
+                              aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                              config=self.client.meta.config.merge(Config(parameter_validation=False)))) as malformed:
+                for invalid in (-1, 1001):
+                    self.expect_error(lambda: malformed.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=invalid), "InvalidParameterValueException")
+                    assert self.client.get_function_concurrency(FunctionName=name)["ReservedConcurrentExecutions"] == 0
+            self.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+            started = time.monotonic()
+            cutoff = started + 15
+            assert collector.deadline > cutoff + 5
+            connection = self.raw_invoke(name, {"value":35, "mode":"hold" if stage == "busy" else "compute"})
+            try:
+                observed = collector.wait_seen(1, started + 10)[name]
+                active = self.metadata.ids()
+                assert len(active) == 2 and not baseline
+                assert observed["stage"] == stage
+                self.expect_error(lambda: self.invoke(name), "TooManyRequestsException")
+                assert self.metadata.ids() == active
+            finally:
+                connection.close()
+            self.metadata.wait_ids(set(), cutoff)
+            assert time.monotonic() < cutoff < collector.deadline
+            self.ready()
+            self.client.update_function_configuration(FunctionName=name, Environment={"Variables":{}})
+            self.settled(name, updating=True)
+            output, _ = self.cold_recovery(name, min(cutoff, time.monotonic() + 5))
+            assert output["computed"] == 15 and output["counter"] == 1
+            self.delete(name)
+        return ["reserved-zero-no-allocation", "reserved-range-atomic", "held-reserved-one", stage + "-disconnect-removal-before-expiry", "cold-recovery"]
+
+    def cold_recovery(self, name, deadline):
+        def invoke(remaining):
+            connect = min(0.1, remaining / 10)
+            with contextlib.closing(boto3.client(
+                    "lambda", endpoint_url=self.endpoint, region_name="us-east-1",
+                    aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                    config=self.client.meta.config.merge(Config(
+                        connect_timeout=connect, read_timeout=remaining - connect)))) as client:
+                return self.invoke(name, {"value":8}, client=client)
+        return recover_before(deadline, invoke, lambda: not self.metadata.ids())
+
+    def event(self, name, event):
+        reply = self.client.invoke(FunctionName=name, InvocationType="Event", Payload=json.dumps(event).encode())
+        payload = reply.get("Payload")
+        if payload is not None:
+            payload.close()
+        assert reply["StatusCode"] == 202
+
+    def saturation(self, host):
+        too_large = self.create(MemorySize=512)
+        before = self.metadata.ids()
+        started = time.monotonic()
+        self.expect_error(lambda: self.invoke(too_large), "TooManyRequestsException")
+        assert time.monotonic() - started < 5 and self.metadata.ids() == before
+        self.delete(too_large)
+        self.ready()
+        def shutdown_hold():
+            hold = Hold("busy")
+            hold.deadline = time.monotonic() + 180
+            return hold
+        with collecting(shutdown_hold) as collector:
+            variables = {"IMAGE_FIXTURE_COLLECTOR":f"{host}:{collector.server_port}",
+                         "IMAGE_FIXTURE_TOKEN":collector.token}
+            names = [self.create(Timeout=900, Environment={"Variables":variables}) for _ in range(2)]
+            collector.targets(names)
+            for name in names:
+                self.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+                self.event(name, {"mode":"hold"})
+            collector.wait_seen(2, min(time.monotonic() + 20, collector.deadline - 20))
+            physical = self.metadata.pair_limits()
+            for index in range(126):
+                self.event(names[index % 2], {"mode":"hold"})
+            self.expect_error(lambda: self.event(names[0], {}), "TooManyRequestsException")
+            assert self.metadata.ids() == physical
+            assert time.monotonic() + 80 < collector.deadline
+            self.ready()
+            # A second bounded PID barrier hands shutdown to the exact Rust child owner.
+            print(os.getpid(), flush=True)
+            self.metadata.wait_ids(set(), min(time.monotonic() + 75, collector.deadline - 5))
+            assert time.monotonic() < collector.deadline - 5
+        return ["impossible-memory-429", "event-capacity-128", "event-129-throttled", "two-pairs-384MiB", "held-backlog-shutdown-cutoff"]
+
+
+def main():
+    endpoint, image, architecture, phase, host, path, owner, engine = sys.argv[1:]
+    matrix = Faults(endpoint, image, architecture, Metadata(path, owner, engine))
+    shutdown = phase == "saturation"
+    try:
+        if phase == "faults":
+            cases = matrix.fault_matrix()
+        elif phase in ("initializing", "busy"):
+            cases = matrix.disconnected(host, phase)
+        else:
+            assert shutdown
+            cases = matrix.saturation(host)
+    finally:
+        if not shutdown:
+            primary = sys.exc_info()[1]
+            try:
+                matrix.cleanup()
+            except BaseException:
+                if primary is None:
+                    raise
+                primary.add_note("fault fixture function cleanup also failed")
+    print(json.dumps({"schemaVersion":1, "cases":cases}), flush=True)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/workflows/lambda_fault_support.py b/tests/workflows/lambda_fault_support.py
new file mode 100644
index 00000000..fa3b8072
--- /dev/null
+++ b/tests/workflows/lambda_fault_support.py
@@ -0,0 +1,271 @@
+"""Bounded causal holds and independent read-only actual-daemon observations."""
+import contextlib
+import http.client
+import json
+import socket
+import time
+import threading
+import urllib.parse
+import uuid
+
+from botocore.exceptions import ClientError
+
+from custom_ric_sdk import Collector, unique_object
+
+
+
+def poll_response(read, accepted, seconds, clock=time.monotonic, sleep=time.sleep):
+    """Fence every SDK observation before dispatch and after response."""
+    cutoff = clock() + seconds
+    while True:
+        if clock() >= cutoff:
+            raise TimeoutError("SDK observer expired before dispatch")
+        response = read()
+        if clock() >= cutoff:
+            raise TimeoutError("SDK observer response expired")
+        if accepted(response):
+            return response
+        sleep(0.025)
+
+
+def invoke_json(client, name, event, **arguments):
+    response = client.invoke(FunctionName=name, Payload=json.dumps(event).encode(), **arguments)
+    body = response["Payload"]
+    try:
+        raw = body.read(65537)
+    finally:
+        body.close()
+    assert len(raw) <= 65536 and response["StatusCode"] == 200
+    return response, json.loads(raw, object_pairs_hook=unique_object)
+
+def recover_before(deadline, invoke, empty, clock=time.monotonic, pause=time.sleep):
+    """Accept only timely success; retain only explicit, allocation-free throttling."""
+    while True:
+        remaining = deadline - clock()
+        assert remaining > 0, "recovery observation deadline expired before invocation"
+        try:
+            result = invoke(remaining)
+        except ClientError as error:
+            if error.response["Error"]["Code"] != "TooManyRequestsException":
+                raise
+            assert clock() < deadline, "joined cleanup never returned the reserved slot"
+            assert empty(), "a throttled recovery allocated a new environment"
+            remaining = deadline - clock()
+            assert remaining > 0, "recovery metadata exceeded its observation deadline"
+            pause(min(0.025, remaining))
+        else:
+            assert clock() < deadline, "recovery succeeded after its observation deadline"
+            return result
+
+
+class Hold(Collector):
+    def __init__(self, stage):
+        self.stage, self.expected, self.observed = stage, set(), {}
+        self.released = False
+        self.released_targets = set()
+        super().__init__()
+
+    def targets(self, names):
+        assert 1 <= len(names) <= 2 and len(set(names)) == len(names)
+        assert all(0 < len(name) <= 64 and name.isascii()
+                   and all(c.isalnum() or c in "_-" for c in name) for name in names)
+        with self.condition:
+            assert not self.observed
+            self.expected = set(names)
+
+    def wait_seen(self, count, deadline):
+        with self.condition:
+            while len(self.observed) < count and not self.aborted:
+                remaining = min(deadline, self.deadline) - time.monotonic()
+                assert remaining > 0, "fixture stage was not observed before its cutoff"
+                self.condition.wait(remaining)
+            assert not self.aborted and time.monotonic() < min(deadline, self.deadline)
+            return dict(self.observed)
+
+    def release_target(self, name):
+        with self.condition:
+            assert not self.aborted and time.monotonic() < self.deadline
+            assert name in self.expected and name in self.observed and name not in self.released_targets
+            self.released_targets.add(name)
+            self.condition.notify_all()
+
+    def exchange(self, path, event):
+        with self.condition:
+            assert path == "/hold" and not self.aborted and time.monotonic() < self.deadline
+            assert set(event) == {"stage", "functionName", "pid", "requestId"}
+            name = event["functionName"]
+            assert event["stage"] == self.stage and name in self.expected and name not in self.observed
+            assert type(event["pid"]) is int and 0 < event["pid"] < 2**31
+            if self.stage == "busy":
+                assert str(uuid.UUID(event["requestId"])) == event["requestId"]
+            else:
+                assert self.stage == "initializing" and event["requestId"] is None
+            self.observed[name] = event
+            self.condition.notify_all()
+            while not self.released and name not in self.released_targets and not self.aborted:
+                remaining = self.deadline - time.monotonic()
+                assert remaining > 0, "fixture hold lease expired"
+                self.condition.wait(remaining)
+            assert not self.aborted and time.monotonic() < self.deadline
+            return {"release": True}
+
+
+class UnixHTTP(http.client.HTTPConnection):
+    def __init__(self, path):
+        super().__init__("docker", timeout=3)
+        self.path = path
+
+    def connect(self):
+        self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        self.sock.settimeout(self.timeout)
+        self.sock.connect(self.path)
+
+
+def identity(text):
+    assert isinstance(text, str) and len(text) == 36
+    parsed = uuid.UUID(text)
+    assert parsed.int != 0 and str(parsed) == text
+    return text
+
+
+class Metadata:
+    def __init__(self, path, owner, engine):
+        assert isinstance(path, str) and path.startswith("/") and len(path.encode()) <= 4096
+        assert "\x00" not in path
+        self.path, self.owner, self.engine, self.api = path, identity(owner), identity(engine), None
+        self._lock = threading.RLock()
+        self._pinned = None
+
+    @staticmethod
+    def read(connection, path):
+        connection.request("GET", path)
+        response = connection.getresponse()
+        assert response.status == 200, "independent metadata GET failed"
+        raw = response.read(1024 * 1024 + 1)
+        assert len(raw) <= 1024 * 1024, "independent metadata body cap"
+        return json.loads(raw, object_pairs_hook=unique_object)
+
+    def _fence(self, connection):
+        connection.connect()
+        peer = connection.sock
+        assert peer is not None, "metadata connection missing"
+        connection.auto_open = False
+        if self.api is None:
+            version = self._read_peer(connection, peer, "/version")
+            def minor(value):
+                assert isinstance(value, str) and 4 <= len(value) <= 6 and value.startswith("1.")
+                number = value[2:]
+                assert number.isascii() and number.isdigit() and str(int(number)) == number
+                return int(number)
+            maximum = min(53, minor(version["ApiVersion"]))
+            assert 44 <= maximum and minor(version["MinAPIVersion"]) <= maximum
+            self.api = "1." + str(maximum)
+        current = identity(self._read_peer(connection, peer, "/v" + self.api + "/info")["ID"])
+        assert self.engine == current, "independent metadata daemon changed"
+        return peer
+
+    @classmethod
+    def _read_peer(cls, connection, peer, path):
+        try:
+            assert connection.sock is peer and peer.fileno() >= 0, "metadata peer lost or replaced"
+            value = cls.read(connection, path)
+            assert connection.sock is peer and peer.fileno() >= 0, "metadata peer lost or replaced"
+            return value
+        finally:
+            if connection.sock is not peer:
+                peer.close()
+
+    @contextlib.contextmanager
+    def pinned(self):
+        """Fence once before a timed bracket; never reconnect inside that bracket."""
+        assert self._lock.acquire(blocking=False), "concurrent metadata use"
+        connection = None
+        try:
+            assert self._pinned is None, "nested metadata pin"
+            connection = UnixHTTP(self.path)
+            peer = self._fence(connection)
+            self._pinned = (connection, peer)
+            try:
+                yield self
+            finally:
+                self._pinned = None
+        finally:
+            if connection is not None:
+                connection.close()
+            self._lock.release()
+
+    def get(self, path):
+        assert self._lock.acquire(blocking=False), "concurrent metadata use"
+        connection = None
+        try:
+            assert path.startswith(("/containers/", "/images/")) and len(path) <= 2048
+            if path.startswith("/images/"):
+                alias = urllib.parse.unquote(path[len("/images/"):-len("/json")])
+                assert path.endswith("/json") and alias.startswith("rustack-internal/lambda-" + uuid.UUID(self.owner).hex + "/")
+            if self._pinned is not None:
+                current, peer = self._pinned
+            else:
+                connection = UnixHTTP(self.path)
+                current, peer = connection, self._fence(connection)
+            return self._read_peer(current, peer, "/v" + self.api + path)
+        finally:
+            if connection is not None:
+                connection.close()
+            self._lock.release()
+
+    def image_id(self, alias):
+        assert isinstance(alias, str) and len(alias) <= 256
+        result = self.get("/images/" + urllib.parse.quote(alias, safe="") + "/json")
+        key = result["Id"]
+        assert isinstance(key, str) and len(key) == 71 and key.startswith("sha256:")
+        assert all(character in "0123456789abcdef" for character in key[7:])
+        return key
+
+    def rows(self):
+        query = urllib.parse.urlencode({"all": "true", "filters": json.dumps({
+            "label": ["rustack.lambda.ownerId=" + self.owner]})})
+        rows = self.get("/containers/json?" + query)
+        assert isinstance(rows, list) and len(rows) <= 128
+        seen = set()
+        for row in rows:
+            key = row["Id"]
+            assert isinstance(key, str) and len(key) == 64 and all(c in "0123456789abcdef" for c in key)
+            assert key not in seen
+            seen.add(key)
+            labels = row["Labels"]
+            assert isinstance(labels, dict) and len(labels) <= 32
+            assert labels["rustack.lambda.ownerId"] == self.owner
+            assert labels["rustack.lambda.role"] in ("function", "relay")
+            for label in ("runId", "environmentId", "functionResourceId"):
+                identity(labels["rustack.lambda." + label])
+        return rows
+
+    def ids(self):
+        return {row["Id"] for row in self.rows()}
+
+    def wait_ids(self, expected, deadline):
+        while True:
+            current = self.ids()
+            assert time.monotonic() < deadline, "physical retirement missed its causal cutoff"
+            if current == expected:
+                return
+            time.sleep(0.025)
+
+    def pair_limits(self):
+        rows = self.rows()
+        assert len(rows) == 4
+        environments, total = {}, 0
+        for row in rows:
+            labels = row["Labels"]
+            role, environment = labels["rustack.lambda.role"], labels["rustack.lambda.environmentId"]
+            environments.setdefault(environment, set()).add(role)
+            inspected = self.get("/containers/" + row["Id"] + "/json")
+            assert inspected["Id"] == row["Id"] and inspected["Config"]["Labels"] == labels
+            assert inspected["State"]["Running"] is True
+            memory = inspected["HostConfig"]["Memory"]
+            assert memory == (128 if role == "function" else 64) * 1024 * 1024
+            assert inspected["HostConfig"]["MemorySwap"] == memory
+            total += memory
+        assert len(environments) == 2 and all(roles == {"function", "relay"} for roles in environments.values())
+        assert total == 384 * 1024 * 1024
+        return {row["Id"] for row in rows}
diff --git a/tests/workflows/lambda_io_fault_sdk.py b/tests/workflows/lambda_io_fault_sdk.py
new file mode 100644
index 00000000..0608237e
--- /dev/null
+++ b/tests/workflows/lambda_io_fault_sdk.py
@@ -0,0 +1,384 @@
+"""Owned real-daemon proxy plus signed public lifecycle/deployment acceptance."""
+import json
+import os
+import http.client
+import urllib.parse
+from pathlib import Path
+import sys
+import time
+import traceback
+import uuid
+
+print(os.getpid(), flush=True)
+import boto3
+from botocore.config import Config
+
+from custom_ric_sdk import collecting
+from docker_io_proxy import Proxy
+from lambda_fault_sdk import Faults
+from lambda_fault_support import Hold, Metadata
+from provided_zip_io import ProvidedIo
+from lambda_admission_sdk import execution_pressure, resource_pressure, runtime_bounds, composite_pressure
+from required_suites import read_regular
+
+
+class IoCases(Faults):
+    def __init__(self, endpoint, image, other, architecture, metadata, proxy):
+        super().__init__(endpoint, image, architecture, metadata)
+        config = self.client.meta.config.merge(Config(read_timeout=10))
+        self.client.close()
+        self.client = boto3.client("lambda", endpoint_url=endpoint, region_name="us-east-1",
+                                   aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                                   config=config)
+        self.other, self.proxy = other, proxy
+        self.server_lost = False
+
+    def state(self, name, predicate):
+        deadline = time.monotonic() + 20
+        while True:
+            assert time.monotonic() < deadline, "deployment observation expired"
+            result = self.client.get_function_configuration(FunctionName=name)
+            assert time.monotonic() < deadline, "late deployment state observation"
+            if predicate(result):
+                return result
+            time.sleep(0.025)
+
+    def cold(self, name):
+        self.client.update_function_configuration(FunctionName=name, Environment={"Variables":{}})
+        self.settled(name, updating=True)
+        output, _ = self.cold_recovery(name, time.monotonic() + 5)
+        assert output["computed"] == 15 and output["counter"] == 1
+
+    def cancel_io(self, host, phase):
+        with collecting(lambda: Hold("initializing")) as hold:
+            variables = {} if phase == "delete" else {
+                "IMAGE_FIXTURE_INIT_MODE":"hold", "IMAGE_FIXTURE_TOKEN":hold.token,
+                "IMAGE_FIXTURE_COLLECTOR":f"{host}:{hold.server_port}"}
+            name = self.create(Timeout=900, Environment={"Variables":variables})
+            hold.targets([name])
+            self.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+            self.proxy.arm(phase, self.metadata.owner)
+            connection = self.raw_invoke(name, {"mode":"exit"} if phase == "delete" else {})
+            try:
+                record = self.proxy.wait(1, time.monotonic() + 15)[0]
+                rows = self.metadata.rows()
+                ids = {row["Id"] for row in rows}
+                assert len(ids) == 2 and record["id"] in ids
+                function = self.metadata.get("/containers/" + record["id"] + "/json")
+                assert function["State"]["Running"] is False
+                if phase == "create":
+                    assert function["State"]["Status"] == "created"
+                else:
+                    assert function["State"]["ExitCode"] == 42
+                connection.close()
+                self.expect_error(lambda: self.invoke(name), "TooManyRequestsException")
+                assert self.metadata.ids() == ids
+                assert len(self.proxy.observed) == 1 and not self.proxy.released
+                self.proxy.release()
+                self.metadata.wait_ids(set(), time.monotonic() + 10)
+                if phase == "create":
+                    assert record["id"] not in self.proxy.starts, "canceled allocation started user code"
+                assert not hold.observed
+                self.ready()
+                self.cold(name)
+                self.delete(name)
+            finally:
+                connection.close()
+                self.proxy.restore()
+        return [phase + "-held-real-io", "retained-reserved-slot", "caller-disconnected",
+                "post-release-physical-retirement", "cold-computed-recovery"]
+
+    def loss_update(self):
+        name = self.create()
+        output, _ = self.invoke(name, {"value":8})
+        assert output["computed"] == 15 and output["imageRevision"] == "A"
+        published = self.client.publish_version(FunctionName=name)["Version"]
+        before = self.client.get_function_configuration(FunctionName=name)
+        self.proxy.fail_image(self.other)
+        try:
+            self.client.update_function_code(FunctionName=name, ImageUri=self.other)
+            failed = self.state(name, lambda row: row.get("LastUpdateStatus") == "Failed")
+            assert failed["State"] == "Active"
+            assert failed["CodeSha256"] == before["CodeSha256"]
+            assert failed["RevisionId"] == before["RevisionId"]
+        finally:
+            self.proxy.restore()
+        self.client.update_function_configuration(FunctionName=name, Environment={"Variables":{"RECOVERED":"1"}})
+        self.settled(name, updating=True)
+        output, _ = self.invoke(name, {"value":8}, qualifier=published)
+        assert output["computed"] == 15 and output["imageRevision"] == "A"
+        self.client.update_function_code(FunctionName=name, ImageUri=self.other)
+        self.settled(name, updating=True)
+        output, _ = self.invoke(name, {"value":8})
+        assert output["computed"] == 15 and output["imageRevision"] == "B"
+        missing = "MissingImage" + uuid.uuid4().hex
+        self.client.create_function(FunctionName=missing, Role="arn:aws:iam::000000000000:role/Docker",
+                                    PackageType="Image", Architectures=[self.architecture],
+                                    Code={"ImageUri":"rustack-custom-ric:absent-" + uuid.uuid4().hex})
+        self.functions.append(missing)
+        failed = self.state(missing, lambda row: row["State"] == "Failed")
+        assert failed["State"] != "Active"
+        self.expect_error(lambda: self.invoke(missing), "ResourceNotReadyException")
+        assert len(self.metadata.ids()) >= 2, "full-loss stage lacked live environment IO"
+        self.server_lost = True
+        self.proxy.loss()
+        held = self.raw_invoke(name, {})
+        address = urllib.parse.urlsplit(self.endpoint)
+        deadline = time.monotonic() + 10
+        try:
+            while True:
+                assert time.monotonic() < deadline, "full transport loss did not revoke readiness"
+                connection = http.client.HTTPConnection(address.hostname, address.port, timeout=1)
+                try:
+                    connection.request("GET", "/_rustack/capabilities")
+                    response = connection.getresponse()
+                    raw = response.read(65537)
+                    assert response.status in (200, 503) and len(raw) <= 65536
+                    value = json.loads(raw)
+                    if value["ready"] is False and value["workers"]["docker"]["ready"] is False:
+                        assert time.monotonic() < deadline
+                        break
+                finally:
+                    connection.close()
+                time.sleep(0.025)
+            self.expect_error(lambda: self.invoke(name), "ServiceException", "Docker execution is not available")
+        finally:
+            held.close()
+            self.proxy.restore()
+        return ["image-management-ack-lost", "failed-update-preserves-active-A",
+                "published-A-preserved", "recovered-B-computation", "missing-source-never-active",
+                "full-loss-revokes-readiness"]
+
+    def deadline_io(self, phase):
+        name = self.create(Timeout=900)
+        self.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+        create = phase == "create_timeout"
+        self.proxy.arm("create" if create else "delete_ack", self.metadata.owner)
+        connection = self.raw_invoke(name, {} if create else {"mode":"exit"})
+        try:
+            record = self.proxy.wait(1, time.monotonic() + 15)[0]
+            cutoff = time.monotonic() + 15
+            rows = self.metadata.rows()
+            if create:
+                assert len(rows) == 2 and record["id"] in {row["Id"] for row in rows}
+                function = self.metadata.get("/containers/" + record["id"] + "/json")
+                assert function["State"]["Running"] is False and function["State"]["Status"] == "created"
+            else:
+                assert record["id"] not in {row["Id"] for row in rows}, "DELETE ack gate preceded effect"
+                assert len(rows) == 1, "DELETE ack did not retain relay cleanup"
+                self.expect_error(lambda: self.invoke(name), "TooManyRequestsException")
+            self.metadata.wait_ids(set(), cutoff)
+            assert not self.proxy.released, "fixture released IO before deadline settlement"
+            response = connection.getresponse()
+            payload = response.read(65537)
+            assert response.status == 500 and len(payload) <= 65536
+            assert response.getheader("x-amzn-errortype") == "ServiceException"
+            error = json.loads(payload)
+            text = error.get("message", error.get("Message", ""))
+            expected = "deadline" if create else "function exited with status 42; oom=false"
+            assert expected in text, "incorrect IO deadline/primary failure: " + text
+            assert time.monotonic() < cutoff and not self.proxy.released
+            if create:
+                assert record["id"] not in self.proxy.starts, "timed-out allocation started user code"
+            self.proxy.release()
+            self.ready()
+            self.cold(name)
+            self.delete(name)
+        finally:
+            connection.close()
+            self.proxy.restore()
+        return [phase + "-held-after-effect", "live-caller-production-io-expiration",
+                "physical-retirement-before-release", "typed-primary-error", "cold-computed-recovery"]
+
+    def pending(self, name, image):
+        self.client.create_function(FunctionName=name, Role="arn:aws:iam::000000000000:role/Docker",
+                                    PackageType="Image", Architectures=[self.architecture],
+                                    MemorySize=128, Code={"ImageUri":image})
+        self.functions.append(name)
+
+    def negative_images(self, images):
+        assert len(images) == 3
+        assert not self.metadata.ids()
+        for image in images[:2]:
+            name = "InvalidImage" + uuid.uuid4().hex
+            self.pending(name, image)
+            failed = self.state(name, lambda row: row["State"] == "Failed")
+            assert failed["StateReasonCode"] == "InvalidImage"
+            assert not self.metadata.ids(), "incompatible artifact allocated an environment"
+            self.expect_error(lambda: self.invoke(name), "ResourceNotReadyException")
+            self.client.update_function_code(FunctionName=name, ImageUri=self.image)
+            self.settled(name, updating=True)
+            output, _ = self.invoke(name, {"value":8})
+            assert output["computed"] == 15 and output["counter"] == 1
+            self.expect_error(lambda: self.invoke(name, {"mode":"exit"}), "ServiceException",
+                              "function exited with status 42; oom=false")
+            self.delete(name)
+            self.metadata.wait_ids(set(), time.monotonic() + 10)
+        name = "NoRuntime" + uuid.uuid4().hex
+        self.pending(name, images[2])
+        self.settled(name)
+        connection = self.raw_invoke(name, {})
+        try:
+            cutoff = time.monotonic() + 4
+            while True:
+                assert time.monotonic() < cutoff, "protocol-free process never observed running"
+                functions = [row for row in self.metadata.rows() if row["Labels"]["rustack.lambda.role"] == "function"]
+                if len(functions) == 1:
+                    live = self.metadata.get("/containers/" + functions[0]["Id"] + "/json")
+                    if live["State"]["Running"]:
+                        assert time.monotonic() < cutoff
+                        break
+                time.sleep(0.025)
+            connection.sock.settimeout(10)
+            response = connection.getresponse()
+            raw = response.read(65537)
+            assert response.status == 500 and len(raw) <= 65536
+            assert response.getheader("x-amzn-errortype") == "ServiceException"
+            error = json.loads(raw)
+            assert "function bootstrap initialization deadline exceeded" in error.get("message", error.get("Message", ""))
+        finally:
+            connection.close()
+        assert not self.metadata.ids()
+        self.ready()
+        self.client.update_function_code(FunctionName=name, ImageUri=self.image)
+        self.settled(name, updating=True)
+        output, _ = self.invoke(name, {"value":8})
+        assert output["computed"] == 15 and output["counter"] == 1
+        self.delete(name)
+        return ["real-wrong-os-rejected", "real-wrong-architecture-rejected",
+                "protocol-free-bootstrap-timeout", "cold-computed-recovery"]
+
+    def interrupted_update(self, fixtures):
+        assert len(fixtures) == 3
+        name = self.create()
+        output, _ = self.invoke(name, {"value":8})
+        assert output["computed"] == 15 and output["imageRevision"] == "A"
+        version = self.client.publish_version(FunctionName=name)["Version"]
+        before = self.client.get_function_configuration(FunctionName=name)
+        self.proxy.interrupt_pull(fixtures[1])
+        self.client.update_function_code(FunctionName=name, ImageUri=fixtures[1])
+        failed = self.state(name, lambda row: row.get("LastUpdateStatus") == "Failed")
+        self.proxy.wait_pull_cut(time.monotonic() + 30)
+        assert failed["State"] == "Active" and failed["CodeSha256"] == before["CodeSha256"]
+        assert failed["RevisionId"] == before["RevisionId"]
+        output, _ = self.invoke(name, {"value":8}, qualifier=version)
+        assert output["computed"] == 15 and output["imageRevision"] == "A"
+        self.proxy.wait_pull(time.monotonic() + 120)
+        self.client.update_function_code(FunctionName=name, ImageUri=self.other)
+        self.settled(name, updating=True)
+        output, _ = self.invoke(name, {"value":8})
+        assert output["computed"] == 15 and output["imageRevision"] == "B"
+        self.delete(name)
+        return ["actual-ifMissing-pull", "truncated-progress-rejected", "failed-update-preserves-active-A",
+                "backend-pull-positively-drained", "recovered-B-computation"]
+
+    def saturation(self):
+        names = ["Deploy" + uuid.uuid4().hex for _ in range(3)]
+        self.proxy.arm("tag", self.metadata.owner, 2)
+        self.pending(names[0], self.image)
+        self.pending(names[1], self.other)
+        tagged = self.proxy.wait(2, time.monotonic() + 15)
+        assert len({self.metadata.image_id(row["alias"]) for row in tagged}) == 2
+        for name in names[:2]:
+            assert self.client.get_function_configuration(FunctionName=name)["State"] == "Pending"
+        self.expect_error(lambda: self.pending(names[2], self.image), "TooManyRequestsException")
+        self.expect_error(lambda: self.client.get_function(FunctionName=names[2]), "ResourceNotFoundException")
+        self.delete(names[0])
+        self.expect_error(lambda: self.pending(names[2], self.image), "TooManyRequestsException")
+        self.proxy.release()
+        self.settled(names[1])
+        self.expect_error(lambda: self.client.get_function(FunctionName=names[0]), "ResourceNotFoundException")
+        output, _ = self.invoke(names[1], {"value":8})
+        assert output["computed"] == 15 and output["imageRevision"] == "B"
+        self.pending(names[2], self.image)
+        self.settled(names[2])
+        output, _ = self.invoke(names[2], {"value":8})
+        assert output["computed"] == 15 and output["imageRevision"] == "A"
+        return ["two-held-pending-deployments", "third-rejected-before-insertion",
+                "deleted-preparation-retains-capacity", "deleted-job-never-resurrects", "capacity-recovery-computation"]
+
+
+def wait_file(path, deadline, maximum=2048, abort=None):
+    while not path.exists():
+        assert abort is None or not abort.exists(), "parent canceled fixture handoff"
+        assert time.monotonic() < deadline, "parent fixture handoff deadline"
+        time.sleep(0.025)
+    assert time.monotonic() < deadline
+    return read_regular(path, maximum)
+
+
+def main():
+    root, daemon, image, other, architecture, phase, host = sys.argv[1:]
+    root = Path(root)
+    proxy = Proxy(str(root / "engine.sock"), daemon, root / "restore")
+    print(os.getpid(), flush=True)
+    failed, cases, matrix = False, [], None
+    try:
+        config = json.loads(wait_file(root / "config.json", time.monotonic() + 200, abort=root / "stop"))
+        assert set(config) == {"endpoint", "owner", "engine", "fixtures"}
+        metadata = Metadata(daemon, config["owner"], config["engine"])
+        if phase in ("zip_create", "zip_delete"):
+            codes = [read_regular(Path(path), 50 * 1024 * 1024) for path in (image, other)]
+            matrix = ProvidedIo(config["endpoint"], codes, architecture, metadata, proxy)
+        else:
+            matrix = IoCases(config["endpoint"], image, other, architecture, metadata, proxy)
+        if phase in ("zip_create", "zip_delete"):
+            cases = matrix.cancel_io(host, phase.removeprefix("zip_"))
+        elif phase in ("create", "delete"):
+            cases = matrix.cancel_io(host, phase)
+        elif phase in ("create_timeout", "delete_timeout"):
+            cases = matrix.deadline_io(phase)
+        elif phase == "loss":
+            cases = matrix.loss_update()
+        elif phase == "negative":
+            cases = matrix.negative_images(config["fixtures"])
+        elif phase == "pull":
+            cases = matrix.interrupted_update(config["fixtures"])
+        elif phase == "composite_pressure":
+            cases = composite_pressure(matrix, host)
+        elif phase == "runtime_bounds":
+            cases = runtime_bounds(matrix)
+        elif phase in ("memory_limit", "environment_limit"):
+            cases = resource_pressure(matrix, host, phase)
+        elif phase in ("global_limit", "default_limit"):
+            cases = execution_pressure(matrix, host, phase == "global_limit")
+        else:
+            assert phase == "saturation"
+            cases = matrix.saturation()
+    except BaseException:
+        failed = True
+        traceback.print_exc(file=sys.stderr)
+    finally:
+        proxy.restore()
+        if proxy.pull_reference is not None:
+            try:
+                count = proxy.wait_pull(time.monotonic() + 120)
+                receipt = {"reference":config["fixtures"][1], "expectedId":config["fixtures"][2],
+                           "complete":True, "records":count}
+                temporary = root / "pull-complete.pending"
+                temporary.write_bytes(json.dumps(receipt).encode())
+                temporary.replace(root / "pull-complete.json")
+            except BaseException:
+                failed = True
+                traceback.print_exc(file=sys.stderr)
+        if matrix is not None:
+            try:
+                if not matrix.server_lost:
+                    matrix.cleanup()
+                matrix.client.close()
+            except BaseException:
+                failed = True
+                traceback.print_exc(file=sys.stderr)
+        print(os.getpid(), flush=True)
+        try:
+            wait_file(root / "stop", time.monotonic() + 90)
+        finally:
+            proxy.close()
+    if failed:
+        return 1
+    print(json.dumps({"schemaVersion":1, "cases":cases}))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/linux_image_performance.py b/tests/workflows/linux_image_performance.py
new file mode 100644
index 00000000..8fc386bd
--- /dev/null
+++ b/tests/workflows/linux_image_performance.py
@@ -0,0 +1,160 @@
+"""Run exact image resources in native arm64 Linux with retained owned evidence."""
+import json
+import ipaddress
+import os
+from pathlib import Path
+import re
+import platform
+import sys
+import tempfile
+import time
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from image_performance_images import SOURCES, cache_alias, call, fenced, image
+from image_performance_support import MeasurementError, decode, require
+from image_performance_report import validate
+from linux_performance import Runner, artifact, bounded_read, deadline_guard, fingerprint, profile, safe_path, status
+
+CASES = ("test_should_measure_one_hundred_warm_image_invocations",
+         "test_should_measure_twenty_preloaded_cold_image_environments",
+         "test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts")
+PHASES = ("warm", "cold", "cycles")
+
+
+def network(owner, endpoint, deadline, engine):
+    value = decode(fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "network", "inspect", "rustack-d102-linux",
+        "--format", '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"labels":{{json .Labels}},"ipam":{{json .IPAM.Config}}}'], deadline))
+    require(isinstance(value, dict) and re.fullmatch(r"[0-9a-f]{64}", value.get("id", "")) is not None
+            and value.get("name") == "rustack-d102-linux" and value.get("driver") == "bridge"
+            and value.get("labels", {}).get("rustack.workflows.task") == "D102"
+            and len(value.get("ipam", [])) == 1, "linux-performance-network")
+    gateway = value["ipam"][0]["Gateway"]
+    require(isinstance(gateway, str) and len(gateway) <= 15, "linux-performance-gateway")
+    address = ipaddress.IPv4Address(gateway)
+    require(any(address in ipaddress.IPv4Network(cidr) for cidr in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")),
+            "linux-performance-private-gateway")
+    return value, gateway
+
+
+def qualified(raw, case, phase):
+    text = raw.decode("utf-8")
+    terminal = re.findall(r"^test result: ok\. 1 passed; 0 failed; 0 ignored; 0 measured; [0-9]+ filtered out; "
+                          r"finished in [0-9.]+s$", text, re.M)
+    require(len(terminal) == 1 and ("test " + case + " ... ") in text, "linux-resource-summary")
+    rows = re.findall(r"(?:^|\.\.\. )WORKFLOWS_IMAGE_PERFORMANCE ([^\r\n]*)$", text, re.M)
+    require(len(rows) == 1, "linux-resource-report-count")
+    value = decode(rows[0].encode())
+    require(value.get("phase") == phase and value.get("os") == "linux" and value.get("architecture") == "aarch64"
+            and value.get("referenceQualification") == "pending" and value.get("emptyAfterWorkload") is True
+            and value.get("sdkVersion") == "1.43.118", "linux-resource-report-identity")
+    require(isinstance(value.get("python"), str) and re.fullmatch(r"3\.12\.[0-9]{1,3}", value["python"]) is not None,
+            "linux-resource-python")
+    require(value.get("debugAssertions") is True, "linux-resource-build-mode")
+    validate(value, phase)
+    return value
+
+
+def guest(binary, server, sdk, prepared, owner, deadline):
+    require(sys.platform == "linux" and os.uname().machine == "aarch64" and len(os.sched_getaffinity(0)) == 4,
+            "linux-image-platform")
+    require(sys.version_info[:2] == (3, 12), "linux-image-python-version")
+    sources = decode(bounded_read(prepared, 32768))
+    endpoint = "unix:///var/run/docker.sock"
+    engine = call(owner, ["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline).decode().strip()
+    profile(sources["profile"])
+    require(sources["engines"]["target"] == engine and len(sources["images"]) == 3, "linux-prepared-engine")
+    for name, row in zip(SOURCES, sources["images"]):
+        require(row["name"] == name and image(owner, endpoint, row["image"]["id"], deadline, engine) == row["image"], "linux-prepared-image")
+    def caches():
+        for row in sources["images"]:
+            require(row["cacheAlias"] == cache_alias(row["image"]["id"])
+                    and image(owner, endpoint, row["cacheAlias"], deadline, engine) == row["image"],
+                    "linux-operator-cache-alias")
+    caches()
+    bridge, gateway = network(owner, endpoint, deadline, engine)
+    before = {"test": fingerprint(binary), "server": fingerprint(server)}
+    owner.environment.update(RUSTACK_RUNTIME_DOCKER_SOCKET="/var/run/docker.sock", RUSTACK_RUNTIME_ARCH="arm64",
+        RUSTACK_RUNTIME_IMAGE=sources["images"][0]["image"]["id"],
+        RUSTACK_RUNTIME_HANDLER_IMAGE=sources["images"][1]["image"]["id"],
+        RUSTACK_CUSTOM_IMAGE_A=sources["images"][2]["image"]["id"],
+        RUSTACK_RUNTIME_NETWORK=bridge["id"], RUSTACK_RUNTIME_GATEWAY_HOST=gateway,
+        RUSTACK_WORKFLOWS_PYTHON="/usr/bin/python3", RUSTACK_WORKFLOWS_SDK_SITE_PACKAGES=str(sdk))
+    listing = call(owner, [str(binary), "--ignored", "--list", "--format", "terse"], deadline).decode().splitlines()
+    names = [line[:-6] for line in listing if line.endswith(": test")]
+    from docker_required_suites import parse_manifest
+    required = parse_manifest(bounded_read(Path(__file__).with_name("docker-required-suites.json"), 32768))
+    require(len(names) == len(set(names)) == len(required["ordinary-startup"]) and set(names) == set(required["ordinary-startup"])
+            and set(CASES) <= set(names), "linux-performance-inventory")
+    # The complete canonical resource manifest is checked by the required host preflight;
+    # the guest selects these same three exact cases from the actual ELF listing.
+    root = Path(tempfile.mkdtemp(prefix="rustack-d102-linux-"))
+    reports = []
+    for case, phase in zip(CASES, PHASES):
+        reply = owner.run([str(binary), case, "--ignored", "--exact", "--nocapture", "--test-threads=1"],
+                          min(deadline, time.monotonic() + 480), stdout_limit=65536)
+        (root / (phase + ".stdout")).write_bytes(reply.stdout)
+        (root / (phase + ".stderr")).write_bytes(reply.stderr)
+        require(reply.code == 0 and reply.stderr == b"", "linux-image-resource-failed")
+        reports.append(qualified(reply.stdout, case, phase))
+    caches()
+    require(before == {"test": fingerprint(binary), "server": fingerprint(server)}
+            and bridge == network(owner, endpoint, deadline, engine)[0] and not owner.unsettled, "linux-image-postcondition")
+    return {"schemaVersion": 1, "referenceQualification": "pending", "binarySha256": before,
+            "engine": engine, "network": bridge, "evidenceRoot": str(root), "reports": reports,
+            "exactResourcesPassed": list(CASES), "processGroupsJoined": True, "python": platform.python_version()}
+
+
+def host(selected, build, sdk, owner, deadline):
+    selected, build, sdk = profile(selected), safe_path(build), safe_path(sdk)
+    require(sdk.is_dir(), "sdk-package-root")
+    require(not any(os.path.lexists(build.parent / ("image-guest." + suffix))
+                    for suffix in ("stdout", "stderr")), "guest-receipt-exists")
+    allocation = status(owner, selected, deadline)
+    binary, server = artifact(bounded_read(build, 4 * 1024 * 1024), "docker_startup")
+    prepared = build.parent / "image-preparation.json"
+    before = {"test": fingerprint(binary), "server": fingerprint(server)}
+    reply = owner.run(["colima", "-p", selected, "ssh", "--", "python3", "-I", "-B",
+                      str(safe_path(str(Path(__file__).resolve()))), "guest", str(binary), str(server), str(sdk), str(prepared)],
+                     min(deadline, time.monotonic() + 1600), stdout_limit=65536)
+    # Keep raw failures in the explicit task evidence directory before decoding.
+    for suffix, raw in (("stdout", reply.stdout), ("stderr", reply.stderr)):
+        with (build.parent / ("image-guest." + suffix)).open("xb") as stream:
+            stream.write(raw)
+    require(reply.code == 0 and reply.stderr == b"", "linux-image-guest-failed")
+    result = decode(reply.stdout, maximum=65536)
+    require(result.get("binarySha256") == before and result.get("exactResourcesPassed") == list(CASES)
+            and result.get("processGroupsJoined") is True and result.get("referenceQualification") == "pending",
+            "linux-image-result-affiliation")
+    require(before == {"test": fingerprint(binary), "server": fingerprint(server)}
+            and allocation == status(owner, selected, deadline), "linux-image-host-postcondition")
+    result["profileConfiguration"] = allocation
+    return result
+
+
+def main():
+    try:
+        require(len(sys.argv) in (5, 6) and sys.argv[1] in ("host", "guest"), "linux-image-arguments")
+        owner = Runner(os.environ if sys.argv[1] == "host" else {"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"})
+        seconds = 1650 if sys.argv[1] == "host" else 1500
+        with deadline_guard(seconds, owner) as deadline:
+            if sys.argv[1] == "host":
+                require(len(sys.argv) == 5, "linux-image-host-arguments")
+                result = host(*sys.argv[2:], owner, deadline)
+            else:
+                require(len(sys.argv) == 6, "linux-image-guest-arguments")
+                result = guest(*(safe_path(value) for value in sys.argv[2:]), owner, deadline)
+            raw = json.dumps(result, separators=(",", ":"), allow_nan=False).encode()
+            require(len(raw) <= 65536, "linux-image-result-bound")
+            print(raw.decode(), flush=True)
+        return 0
+    except MeasurementError as error:
+        print("linux-image-performance-failed:" + str(error), file=sys.stderr)
+        return 2
+    except Exception:
+        print("linux-image-performance-failed", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/workflows/linux_performance.py b/tests/workflows/linux_performance.py
new file mode 100644
index 00000000..36b82588
--- /dev/null
+++ b/tests/workflows/linux_performance.py
@@ -0,0 +1,349 @@
+"""Direct Linux SDK measurements with exact inventories and joined process owners."""
+import hashlib
+from contextlib import contextmanager
+import json
+import os
+from pathlib import Path
+import platform
+import re
+import resource
+import signal
+import stat
+import struct
+import sys
+import time
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT / "tools/github-action"))
+from process_owner import Runner
+from metadata import document as bounded_document
+from settings import ActionError
+
+MIB = 1024 * 1024
+CASES = (
+    "performance::test_should_measure_one_hundred_fifty_state_signed_sdk_executions",
+    "performance::test_should_keep_health_and_stop_responsive_and_reuse_one_execution_slot",
+)
+CONTROLS = tuple("performance::tests::" + name for name in (
+    "test_should_use_exact_nearest_ranks_and_preserve_sample_order",
+    "test_should_round_up_and_enforce_exact_p95_budget",
+    "test_should_reject_ready_results_at_the_expired_observation_boundary",
+    "test_should_reject_exhaustion_readiness_at_the_two_second_boundary",
+    "test_should_reject_broken_predecessors_and_wrong_or_missing_state_exits",
+    "test_should_refuse_post_terminal_probes_as_live_load_evidence",
+))
+LIMITS = {"openExecutions": 1, "transitions": 1000000, "historyEvents": 25000,
+          "historyBytes": 33554432, "totalHistoryBytes": 134217728}
+
+
+class QualificationError(ValueError):
+    """Only fixed locally defined codes may reach public diagnostics."""
+
+
+def require(condition, code):
+    if not condition:
+        raise QualificationError(code)
+
+
+def check_deadline(deadline):
+    require(time.monotonic() < deadline, "qualification-deadline")
+
+
+@contextmanager
+def deadline_guard(seconds, owner=None):
+    """Cover local file IO and report publication as well as owned children."""
+    require(signal.getitimer(signal.ITIMER_REAL) == (0.0, 0.0), "existing-deadline")
+    def expired(number, _frame):
+        if owner is not None and owner.retiring:
+            # Retirement has its own original three-second physical join bound.
+            # Interrupting that join would discard ownership of the child group.
+            return
+        raise QualificationError("qualification-deadline" if number == signal.SIGALRM
+                                 else "qualification-interrupted")
+    previous = {number: signal.signal(number, expired)
+                for number in (signal.SIGALRM, signal.SIGTERM, signal.SIGINT, signal.SIGHUP)}
+    cutoff = time.monotonic() + seconds
+    signal.setitimer(signal.ITIMER_REAL, seconds)
+    try:
+        yield cutoff
+        check_deadline(cutoff)
+    finally:
+        signal.setitimer(signal.ITIMER_REAL, 0)
+        for number, handler in previous.items():
+            signal.signal(number, handler)
+
+
+def document(raw, limit=65536):
+    require(isinstance(raw, bytes) and 0 < len(raw) <= limit, "document-bound")
+    try:
+        return bounded_document(raw, maximum=limit, string_limit=16384)
+    except ActionError:
+        raise QualificationError("document-shape") from None
+
+
+def safe_path(value):
+    require(isinstance(value, str) and 0 < len(value.encode()) <= 4096
+            and re.fullmatch(r"/[A-Za-z0-9_./-]+", value) is not None
+            and all(part not in ("", ".", "..") for part in value[1:].split("/")), "unsafe-path")
+    return Path(value)
+
+
+def profile(value):
+    require(isinstance(value, str)
+            and re.fullmatch(r"rustack-workflows-[a-z0-9-]{1,40}", value) is not None,
+            "unsafe-profile")
+    return value
+
+
+def bounded_read(path, limit):
+    # No device/FIFO/symlink may enter the reader. All inputs are selected artifacts.
+    descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    with os.fdopen(descriptor, "rb") as stream:
+        metadata = os.fstat(stream.fileno())
+        require(stat.S_ISREG(metadata.st_mode) and metadata.st_size <= limit, "file-bound")
+        raw = stream.read(limit + 1)
+        require(len(raw) <= limit, "file-bound")
+        return raw
+
+
+def fingerprint(path):
+    raw = bounded_read(safe_path(str(path)), 256 * MIB)
+    require(64 <= len(raw) <= 256 * MIB and raw[:6] == b"\x7fELF\x02\x01"
+            and struct.unpack_from("<H", raw, 18)[0] == 183, "arm64-elf")
+    return hashlib.sha256(raw).hexdigest()
+
+
+def artifact(raw, test_name="workflows_sdk"):
+    require(test_name in ("workflows_sdk", "docker_startup"), "cargo-target-policy")
+    require(0 < len(raw) <= 4 * MIB, "cargo-stream-bound")
+    require(raw.count(b"\n") <= 4096, "cargo-record-budget")
+    lines = raw.split(b"\n")
+    if lines[-1] == b"":
+        lines.pop()
+    require(1 <= len(lines) <= 4096, "cargo-record-budget")
+    records = [document(line, 262144) for line in lines]
+    require(records and all(isinstance(row, dict) for row in records), "cargo-stream-shape")
+    require(records[-1] == {"reason": "build-finished", "success": True}, "cargo-build-result")
+    selected = []
+    for row in records:
+        if row.get("reason") == "compiler-artifact":
+            require(isinstance(row.get("target"), dict) and isinstance(row.get("profile"), dict),
+                    "cargo-artifact-shape")
+        if row.get("reason") == "compiler-artifact" and row.get("target", {}).get("name") == test_name:
+            require(row.get("profile", {}).get("test") is True
+                    and row.get("target", {}).get("kind") == ["test"], "cargo-test-artifact")
+            selected.append(safe_path(row.get("executable")))
+    require(len(selected) == 1, "cargo-test-artifact-count")
+    binary = selected[0]
+    require(binary.parent.name == "deps" and binary.parent.parent.name == "debug"
+            and binary.parent.parent.parent.name == "aarch64-unknown-linux-gnu"
+            and re.fullmatch(re.escape(test_name) + r"-[0-9a-f]{16}", binary.name) is not None,
+            "cargo-target-path")
+    server = binary.parent.parent / "rustack"
+    servers = [row for row in records if row.get("reason") == "compiler-artifact"
+               and row.get("target", {}).get("name") == "rustack"
+               and row.get("target", {}).get("kind") == ["bin"]
+               and row.get("executable") == str(server)]
+    require(len(servers) == 1, "cargo-server-artifact-count")
+    return binary, server
+
+
+def inventory(raw):
+    text = raw.decode("utf-8")
+    lines = text.splitlines()
+    names = [line[:-6] for line in lines if line.endswith(": test")]
+    require(len(names) == len(set(names)) == 8
+            and set(names) == set(CASES + CONTROLS)
+            and len(lines) == 8, "test-inventory")
+
+
+def summary(raw, passed, ignored):
+    text = raw.decode("utf-8")
+    found = re.findall(r"^test result: ok\. (\d+) passed; (\d+) failed; (\d+) ignored; "
+                       r"(\d+) measured; (\d+) filtered out; finished in [0-9.]+s$", text, re.M)
+    require(len(found) == 1 and found[0][:4] == (str(passed), "0", str(ignored), "0"),
+            "test-terminal-summary")
+    return text
+
+
+def integer(value, low, high):
+    return type(value) is int and low <= value <= high
+
+
+def samples(value, ceiling):
+    require(isinstance(value, dict) and set(value) == {
+        "count", "observedMicros", "p50Micros", "p95Micros", "maxMicros"}, "sample-shape")
+    raw = value["observedMicros"]
+    require(type(value["count"]) is int and value["count"] == 100
+            and isinstance(raw, list) and len(raw) == 100
+            and all(integer(item, 1, ceiling) for item in raw), "sample-bound")
+    ranked = sorted(raw)
+    for key, rank in (("p50Micros", 49), ("p95Micros", 94), ("maxMicros", 99)):
+        require(type(value[key]) is int and value[key] == ranked[rank], "sample-rank")
+
+
+def measurement(raw, kind):
+    text = summary(raw, 1, 0)
+    reports = [line.encode() for line in re.findall(
+        r"(?:^|\.\.\. )WORKFLOWS_PERFORMANCE ([^\r\n]*)$", text, re.M)]
+    require(len(reports) == 1, "measurement-count")
+    return validate_report(document(reports[0]), kind)
+
+
+def validate_report(value, kind):
+    require(isinstance(value, dict) and set(value) == {
+        "schemaVersion", "host", "limits", "nativeProcessesObserved", "serverJoined", "measurement"},
+        "report-shape")
+    require(type(value["schemaVersion"]) is int and value["schemaVersion"] == 1
+            and type(value["nativeProcessesObserved"]) is int and value["nativeProcessesObserved"] == 0
+            and value["serverJoined"] is True and value["limits"] == LIMITS
+            and all(type(number) is int for number in value["limits"].values()), "report-cleanup-limits")
+    host = value["host"]
+    require(isinstance(host, dict) and set(host) == {"os", "architecture", "availableLogicalCpus",
+            "debugAssertions", "referenceQualification"} and host["os"] == "linux"
+            and host["architecture"] == "aarch64" and type(host["availableLogicalCpus"]) is int
+            and host["availableLogicalCpus"] == 4 and host["debugAssertions"] is True
+            and host["referenceQualification"] == "pending", "measurement-host")
+    measured = value["measurement"]
+    require(isinstance(measured, dict) and measured.get("kind") == kind, "measurement-kind")
+    if kind == "pureLatency":
+        require(set(measured) == {"kind", "stateCount", "inputBytes", "executions", "budgetMicros", "latency"}
+                and all(type(measured[key]) is int and measured[key] == expected for key, expected in
+                        (("stateCount", 50), ("inputBytes", 1024), ("executions", 100), ("budgetMicros", 100000))),
+                "latency-contract")
+        samples(measured["latency"], 1999999)
+        require(measured["latency"]["p95Micros"] <= 100000, "latency-budget")
+    else:
+        require(set(measured) == {"kind", "openExecutionSlots", "completedCycles", "inputBytes",
+                "historyEventHighWater", "exhaustion", "readiness", "stop"}
+                and all(type(measured[key]) is int and measured[key] == expected for key, expected in
+                        (("openExecutionSlots", 1), ("completedCycles", 100), ("inputBytes", 1024)))
+                and integer(measured["historyEventHighWater"], 1, 25000), "loop-contract")
+        for key in ("readiness", "stop"):
+            samples(measured[key], 1999999)
+        exhaustion = measured["exhaustion"]
+        require(isinstance(exhaustion, dict) and set(exhaustion) == {
+                "probeCount", "liveProbeCount", "maxReadinessMicros"}
+                and integer(exhaustion["probeCount"], 1, 1000000)
+                and integer(exhaustion["liveProbeCount"], 1, exhaustion["probeCount"])
+                and integer(exhaustion["maxReadinessMicros"], 1, 1999999), "exhaustion-contract")
+    return value
+
+
+def command(owner, arguments, deadline, budget):
+    reply = owner.run(arguments, min(deadline, time.monotonic() + budget), stdout_limit=65536)
+    require(reply.code == 0 and not reply.stderr, "command-failed")
+    return reply.stdout
+
+
+def guest(binary, server, deadline, owner):
+    require(sys.platform == "linux" and platform.machine() == "aarch64"
+            and len(os.sched_getaffinity(0)) == 4, "guest-platform")
+    memory = bounded_read(Path("/proc/meminfo"), 65536).decode("ascii")
+    match = re.search(r"^MemTotal:\s+(\d+) kB$", memory, re.M)
+    require(match is not None and 7 * 1024 * 1024 <= int(match[1]) <= 8 * 1024 * 1024, "guest-memory")
+    before = {"test": fingerprint(binary), "server": fingerprint(server)}
+    inventory(command(owner, [str(binary), "performance::", "--list", "--format", "terse"], deadline, 10))
+    summary(command(owner, [str(binary), "performance::", "--test-threads=1"], deadline, 30), 6, 2)
+    reports = []
+    for case, kind in zip(CASES, ("pureLatency", "loopResponsiveness")):
+        reports.append(measurement(command(owner, [str(binary), case, "--ignored", "--exact",
+                           "--nocapture", "--test-threads=1"], deadline, 220), kind))
+    require(before == {"test": fingerprint(binary), "server": fingerprint(server)}
+            and time.monotonic() < deadline and not owner.unsettled, "guest-artifact-or-deadline")
+    return {"schemaVersion": 1, "referenceQualification": "pending", "binarySha256": before,
+            "kernel": platform.release(), "python": platform.python_version(),
+            "observedMemoryKiB": int(match[1]), "availableLogicalCpus": len(os.sched_getaffinity(0)),
+            "childHighWaterRssKiB": resource.getrusage(resource.RUSAGE_CHILDREN).ru_maxrss,
+            "controlsPassed": 6, "exactResourcesPassed": list(CASES), "reports": reports,
+            "processGroupsJoined": True}
+
+
+def status(owner, selected, deadline):
+    value = document(command(owner, ["colima", "-p", selected, "status", "--json"], deadline, 10))
+    require(isinstance(value, dict) and value.get("arch") == "aarch64" and value.get("cpu") == 4
+            and value.get("memory") == 8 * 1024 * MIB and value.get("runtime") == "docker"
+            and value.get("driver") == "macOS Virtualization.Framework", "profile-allocation")
+    return value
+
+
+def host(selected, build, deadline, owner):
+    selected = profile(selected)
+    raw = bounded_read(safe_path(build), 4 * MIB)
+    binary, server = artifact(raw)
+    before = {"test": fingerprint(binary), "server": fingerprint(server)}
+    configuration = status(owner, selected, deadline)
+    result = document(command(owner, ["colima", "-p", selected, "ssh", "--", "python3", "-I", "-B",
+                      str(safe_path(str(Path(__file__).resolve()))), "guest", str(binary), str(server)],
+                      deadline, 500))
+    require(isinstance(result, dict) and set(result) == {"schemaVersion", "referenceQualification",
+            "binarySha256", "kernel", "python", "observedMemoryKiB", "availableLogicalCpus",
+            "childHighWaterRssKiB", "controlsPassed", "exactResourcesPassed", "reports", "processGroupsJoined"},
+            "guest-result-shape")
+    require(type(result["schemaVersion"]) is int and result["schemaVersion"] == 1
+            and result["binarySha256"] == before and result["referenceQualification"] == "pending"
+            and result["processGroupsJoined"] is True and type(result["controlsPassed"]) is int
+            and result["controlsPassed"] == 6 and result["exactResourcesPassed"] == list(CASES)
+            and type(result["availableLogicalCpus"]) is int and result["availableLogicalCpus"] == 4
+            and integer(result["observedMemoryKiB"], 7 * 1024 * 1024, 8 * 1024 * 1024)
+            and integer(result["childHighWaterRssKiB"], 1, 8 * 1024 * 1024), "guest-result-provenance")
+    require(isinstance(result["reports"], list) and len(result["reports"]) == 2, "guest-report-count")
+    for value, kind in zip(result["reports"], ("pureLatency", "loopResponsiveness")):
+        validate_report(value, kind)
+    require(isinstance(result["kernel"], str) and re.fullmatch(r"[A-Za-z0-9_.+-]{1,256}", result["kernel"])
+            and isinstance(result["python"], str) and re.fullmatch(r"3\.[0-9]{1,3}\.[0-9]{1,3}", result["python"]),
+            "guest-version-shape")
+    require(before == {"test": fingerprint(binary), "server": fingerprint(server)}
+            and configuration == status(owner, selected, deadline), "host-artifact-or-profile-change")
+    result.update(profile=selected, profileConfiguration=configuration,
+                  virtualization="native-aarch64-vz; physical CPU dedication unproven",
+                  cargoArtifactStreamSha256=hashlib.sha256(raw).hexdigest())
+    return result
+
+
+def provision(selected, target, deadline, owner):
+    selected = profile(selected)
+    require(sys.platform == "darwin" and platform.machine() == "arm64", "provision-platform")
+    target = safe_path(target)
+    require(target.is_dir(), "target-directory")
+    safe_path(str(ROOT))
+    require(not os.path.lexists(Path.home() / ".colima" / selected), "existing-profile")
+    # The new profile owns no user resources. Never activate or edit an existing VM.
+    reply = owner.run(["colima", "start", selected, "--arch", "aarch64", "--vm-type", "vz",
+                      "--cpus", "4", "--memory", "8", "--disk", "24", "--runtime", "docker",
+                      "--activate=false", "--vz-rosetta=false", "--binfmt=false", "--ssh-config=false",
+                      "--mount", str(ROOT), "--mount", str(target)], deadline, stdout_limit=65536)
+    require(reply.code == 0, "provision-failed-profile-retained")
+    return {"profile": selected, "configuration": status(owner, selected, deadline),
+            "referenceQualification": "pending", "profileRetained": True}
+
+
+def main():
+    try:
+        require(len(sys.argv) == 4 and sys.argv[1] in ("guest", "host", "provision"), "arguments")
+        mode = sys.argv[1]
+        owner = Runner({"PATH": "/usr/bin:/bin"} if mode == "guest" else os.environ)
+        with deadline_guard({"guest": 450, "host": 530, "provision": 330}[mode], owner) as deadline:
+            if mode == "guest":
+                binary, server = safe_path(sys.argv[2]), safe_path(sys.argv[3])
+                require(binary.parent.parent / "rustack" == server, "guest-server-path")
+                result = guest(binary, server, deadline, owner)
+            elif mode == "provision":
+                result = provision(sys.argv[2], sys.argv[3], deadline, owner)
+            else:
+                result = host(sys.argv[2], sys.argv[3], deadline, owner)
+            encoded = json.dumps(result, separators=(",", ":"), allow_nan=False)
+            require(len(encoded.encode()) <= 65536, "result-bound")
+            check_deadline(deadline)
+            print(encoded, flush=True)
+        return 0
+    except (ActionError, QualificationError) as error:
+        print("linux-performance-qualification-failed:" + str(error), file=sys.stderr)
+        return 2
+    except (OSError, ValueError, KeyError, TypeError, RecursionError, struct.error):
+        print("linux-performance-qualification-failed", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/workflows/localstack-required.json b/tests/workflows/localstack-required.json
new file mode 100644
index 00000000..122b7361
--- /dev/null
+++ b/tests/workflows/localstack-required.json
@@ -0,0 +1,235 @@
+{
+  "schemaVersion": 1,
+  "vendorCommit": "45dfee8ce27df00fcac3f91b8071c8156eb5c5c7",
+  "groups": {
+    "pure": [
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_decl_version_1_0",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_access[$.items[0]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_access[$.items[10]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.item.items[*]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.item.items[1:5].itemValue]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.item.items[1:5]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.item.items[1:]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.item.items[:1]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.items[*].itemValue]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.items[*]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.items[1:].itemValue]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.items[1:]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.items[:1].itemValue]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$.items[:1]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_json_path_array_wildcard_or_slice_with_no_input[$[*]]",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_fail",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_fail_empty",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_fail_intrinsic",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_fail_path",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_pass_result",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_pass_result_jsonpaths",
+      "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_pass_result_null_input_output_paths",
+      "tests/aws/services/stepfunctions/v2/callback/test_callback.py::TestCallback::test_start_execution_sync",
+      "tests/aws/services/stepfunctions/v2/callback/test_callback.py::TestCallback::test_start_execution_sync2",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_boolean_equals.py::TestBooleanEquals::test_boolean_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_boolean_equals.py::TestBooleanEquals::test_boolean_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_is_operators.py::TestIsOperators::test_is_boolean",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_is_operators.py::TestIsOperators::test_is_null",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_is_operators.py::TestIsOperators::test_is_numeric",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_is_operators.py::TestIsOperators::test_is_present",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_is_operators.py::TestIsOperators::test_is_string",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_greater_than",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_greater_than_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_greater_than_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_greater_than_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_less_than",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_less_than_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_less_than_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py::TestNumerics::test_numeric_less_than_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_greater_than",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_greater_than_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_greater_than_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_greater_than_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_less_than",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_less_than_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_less_than_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py::TestStrings::test_string_less_than_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_greater_than",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_greater_than_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_greater_than_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_greater_than_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_less_than",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_less_than_equals",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_less_than_equals_path",
+      "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py::TestTimestamps::test_timestamp_less_than_path",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestArray::test_array_0",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestArray::test_array_2",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestArray::test_array_contains",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestArray::test_array_get_item",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestArray::test_array_length",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestArray::test_array_partition",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.py::TestGeneric::test_context_json_path",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.py::TestGeneric::test_escape_sequence",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.py::TestGeneric::test_format_1",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.py::TestGeneric::test_nested_calls_1",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.py::TestGeneric::test_nested_calls_2",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_json_manipulation.py::TestJsonManipulation::test_json_merge",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_json_manipulation.py::TestJsonManipulation::test_json_merge_escaped_argument",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_json_manipulation.py::TestJsonManipulation::test_json_to_string",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_json_manipulation.py::TestJsonManipulation::test_string_to_json",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_math_operations.py::TestMathOperations::test_math_add",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_string_operations.py::TestStringOperations::test_string_split",
+      "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_string_operations.py::TestStringOperations::test_string_split_context_object",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_map_state",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_map_state_legacy",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_map_state_legacy_config_inline",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_map_state_nested",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_map_state_no_processor_config",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state[PARALLEL_STATE]",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state[PARALLEL_STATE_PARAMETERS]",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state_catch",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state_fail",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state_nested",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state_order",
+      "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state_retry"
+    ],
+    "docker": [
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_no_such_function",
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_no_such_function_catch",
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_raise_custom_exception",
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_raise_exception",
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_raise_exception_catch",
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_raise_exception_catch_output_path[$.Payload]",
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_raise_exception_catch_output_path[$.no.such.path]",
+      "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py::TestTaskServiceLambda::test_raise_exception_catch_output_path[None]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_bytes_payload",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[0.0]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[0_0]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[0_1]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[HelloWorld]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[True]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[json_value5]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[json_value6]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_pipe",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_string_payload",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_lambda_task_filter_parameters_input",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_bytes_payload",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[0.0]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[0_0]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[0_1]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[HelloWorld]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[True]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[json_value5]",
+      "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[json_value6]",
+      "tests/aws/services/stepfunctions/v2/timeouts/test_timeouts.py::TestTimeouts::test_fixed_timeout_lambda",
+      "tests/aws/services/stepfunctions/v2/timeouts/test_timeouts.py::TestTimeouts::test_fixed_timeout_service_lambda",
+      "tests/aws/services/stepfunctions/v2/timeouts/test_timeouts.py::TestTimeouts::test_fixed_timeout_service_lambda_with_path",
+      "tests/aws/services/stepfunctions/v2/timeouts/test_timeouts.py::TestTimeouts::test_global_timeout"
+    ]
+  },
+  "files": {
+    "tests/aws/services/stepfunctions/v2/base/test_base.py": "09bc60134cb30d08e58885f32f58fdba3ca0ee9f7daa46dd64f921572748bfcc",
+    "tests/aws/services/stepfunctions/v2/base/test_base.snapshot.json": "40af5564000a47c1f88b03c1aab1576521a3c903a84aabbf0ee857f35112ee96",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py": "6b6ad203ab6f48f0f46649b958278f70ce594f1625b17fe1a51ca8d7883fb868",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.snapshot.json": "238da872d1aafa3ca1448f50303c1386250714377f53c7cc20a6ba5dd20faa1a",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_math_operations.py": "faa5c0741dd5a507c353821a91d21a5f5d61e4f0c2f2958b081b58c3166f459c",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_math_operations.snapshot.json": "4bfac0f2871c5e4a1dbe116a676f83d2a9ddb27d500da25c1f526669ac2b120e",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_string_operations.py": "6e37d7ea995a1c35a82f1c3eaab79de4413698dd8f617d0841df3cc06e6b9110",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_string_operations.snapshot.json": "19fcee70522f26a80089ca7e14efccc81a1e4690a42430f87fcd85d806e52692",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_json_manipulation.py": "be2034d556342136afd37cb6d819fdc0fe9428976fb8ddca9ae5240cc1a29402",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_json_manipulation.snapshot.json": "a12cd5bd0b76a6cc27b2ac82b9eb7d9770517decb87edb759ee91f46f2fac8c9",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.py": "bf442aa3932019ac3854010a6b8b132718b411508859fdd7f8de3aa5128ec70d",
+    "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_generic.snapshot.json": "59f4486b778aed0516e7eac3406f0cb66df7595690a0fe79a0ed9ea1a51d1bdb",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_boolean_equals.py": "b003a395911936641337aa0e0a574b9834c3e90f679fcd5219a8eed103652ef1",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_boolean_equals.snapshot.json": "35b65f7ebc1a960d4613efe8ffba31042f950ffd32a1a710d59e744f2ad0ff4a",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.py": "5627d01f2e9b7809f7b2285f1d2fe7402d28ae1f053f71638504c23a873a1c8f",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_numeric.snapshot.json": "9e4bef875b00a76801aaa3d1710efe17bb8b97dd180b2d857d1ab9c1bfe8386f",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.py": "7759b66bdefd39b89cae17a307f5c33da8902ed914484f4188bfb194b061c47c",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_string_operators.snapshot.json": "070486dd25566b11215e771f024df0f1bf8bfc423f6d721a43079b70466b1a7c",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.py": "fed1f40d8af11c93c234b3c0407c3eee8b225946871439770e9f975da90b88b6",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_timestamp_operators.snapshot.json": "8e7c43999b6cc0add12b7162aa171bf2d5c65ce8948eff1287c8e27098d9ec00",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_is_operators.py": "b69ae100980411fe983088d9e7eb216967f40d98d8431640455751271c37fd97",
+    "tests/aws/services/stepfunctions/v2/choice_operators/test_is_operators.snapshot.json": "60766d5a803df94f1c158b48f72983640f6fc44ca616a7e1a8c3ed7f520096f4",
+    "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py": "2e5e89f437eb57f93e4428cded7ef5aa33f403ae20391b6e21599e8f28cb7952",
+    "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.snapshot.json": "746af4189d7e2a0b8a71cb700aa87460e3fab871f06a1a89a0100dab760fb976",
+    "tests/aws/services/stepfunctions/v2/callback/test_callback.py": "a0bf164dc262004c50bac5d4c0d67987af05288324e688863019b9f94712ce2b",
+    "tests/aws/services/stepfunctions/v2/callback/test_callback.snapshot.json": "5ca9f88a1c05556651b28ab35a0ba7a42e9a9d0d4a4bee925e5e2d31688683e8",
+    "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py": "1ff44507a04900b9faac65da22efcad8ee1cf747409cbdfb2c98d5dd4ab2ef49",
+    "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.snapshot.json": "06bd8d4b4cfe10c6746cafaa0ee4751d2e1b6a54ae1e5f629dfab51e558d6f4f",
+    "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py": "99ffc453f3937a634eb98b4060dfe7cbbf58fe3cf858f5e29a2c39fbb5157f02",
+    "tests/aws/services/stepfunctions/v2/services/test_lambda_task.snapshot.json": "67c29472659326dad67cbb2064a1206b2b4a94b879061b2e836764e25e3fc7f4",
+    "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.py": "8c7f46eff1cfdb7824f1006f450ec62dd027d03b96985f5639b781202145c1a1",
+    "tests/aws/services/stepfunctions/v2/error_handling/test_task_service_lambda.snapshot.json": "2785261514c5c2b055b7266c1e8edcc70b0739e64dc2a68f3c8841c0a6589265",
+    "tests/aws/services/stepfunctions/v2/timeouts/test_timeouts.py": "a66067a6b62515c2dab64c205da5a1b307ec498d20a66fa8155a2cd6bd06d3bb",
+    "tests/aws/services/stepfunctions/v2/timeouts/test_timeouts.snapshot.json": "2d96e491f60e7c3b60f6ff2da272867fc02eabe81fc001b317879368224a5a43",
+    "tests/aws/services/stepfunctions/templates/services/lambdafunctions/id_function.py": "d48ceb277e00997e311378efc938014995501a96b29576dbcf56aeddaa8a5bbe",
+    "tests/aws/services/stepfunctions/templates/services/lambdafunctions/return_bytes_str.py": "51399de12f2d9330dd086fe3e645a2865f4195f2c779b4a6d34bc65b2a62746f",
+    "tests/aws/services/stepfunctions/templates/errorhandling/lambdafunctions/raise_exception.py": "26ed5813c16498e2d73a3ef415bd0ef5668dc69e9432f554725d8f22224cbda0",
+    "tests/aws/services/stepfunctions/templates/errorhandling/lambdafunctions/raise_custom_exception.py": "52e4aa09fd526d5646cb3ea702b3b4013f73be9a3d14a33ff0ab154d12b62be9",
+    "tests/aws/services/stepfunctions/templates/timeouts/lambdafunctions/wait_60_seconds.py": "bacd628dff1f384a6c7c96aaf12e5b435b0928e32db2306691fdb88456e173af",
+    "tests/aws/services/stepfunctions/lambda_functions/base/echo_function.py": "6803ac747466c630c8eb29407c4a99ca5a22f26d1bf20d22ebccb63581fc5a20",
+    "tests/aws/conftest.py": "d6070ab56db7023dbce8338f2faedde1dba69e7641719f8fe91446976b591354",
+    "localstack-core/localstack/testing/snapshots/transformer_utility.py": "b055ca1d3db6e0a52aeb693f732abfbeaad00e4ee3423f1b627d0b3862518d05"
+  },
+  "exclusions": [
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/base/test_base.py::test_state_pass_regex_json_path",
+      "reason": "no recorded AWS snapshot in pinned upstream"
+    },
+    {
+      "scope": "JSONata/variables, EXPRESS, Activities, distributed Map, arbitrary service integrations",
+      "reason": "outside supported Rustack profile"
+    },
+    {
+      "scope": "ECR image CRUD/versions and managed Python ZIP deployment",
+      "reason": "original fixtures require ECR or managed runtime packaging; no silent replacement"
+    },
+    {
+      "scope": "SQS/SNS callback and heartbeat fixtures",
+      "reason": "require unsupported Step Functions integrations; own Lambda callback tests remain separate"
+    },
+    {
+      "scope": "MathRandom, ArrayRange, ArrayUnique, Base64/hash intrinsics",
+      "reason": "outside intrinsic allowlist"
+    },
+    {
+      "scope": "Format2 object substitutions, IsTimestamp upstream skip, EventBridge/logging",
+      "reason": "Initial selection excluded Format2 under the scalar-only profile, superseded by D114; it remains unexecuted in this unchanged inventory. IsTimestamp has an upstream skip; EventBridge/logging remain unsupported."
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/base/test_base.py::TestSnfBase::test_state_pass_regex_json_path_base",
+      "reason": "template uses JSONPath predicate [?(@.status == 0)], explicitly outside the bounded path profile; excluded before first execution"
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestSfnIntrinsicFunctionsArray::test_array_get_item",
+      "reason": "snapshot retains a removed upstream class/method ID; current-class baseline is selected instead"
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/intrinsic_functions/test_array.py::TestSfnIntrinsicFunctionsArray::test_array_length",
+      "reason": "snapshot retains a removed upstream class/method ID; current-class baseline is selected instead"
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/scenarios/test_base_scenarios.py::TestBaseScenarios::test_parallel_state",
+      "reason": "snapshot retains pre-parameterization ID; original current parameterized nodes are selected instead"
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[None]",
+      "reason": "snapshot retains a removed parameter ID, absent from pinned upstream source; rejected by collection before any Docker workload execution"
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/services/test_lambda_task.py::TestTaskLambda::test_invoke_json_values[json_value7]",
+      "reason": "snapshot retains a removed parameter ID, absent from pinned upstream source; rejected by collection before any Docker workload execution"
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[None]",
+      "reason": "snapshot retains a removed parameter ID, absent from pinned upstream source; rejected by collection before any Docker workload execution"
+    },
+    {
+      "scope": "tests/aws/services/stepfunctions/v2/services/test_lambda_task_service.py::TestTaskServiceLambda::test_invoke_json_values[json_value7]",
+      "reason": "snapshot retains a removed parameter ID, absent from pinned upstream source; rejected by collection before any Docker workload execution"
+    }
+  ]
+}
diff --git a/tests/workflows/localstack-requirements.txt b/tests/workflows/localstack-requirements.txt
new file mode 100644
index 00000000..54c2ac39
--- /dev/null
+++ b/tests/workflows/localstack-requirements.txt
@@ -0,0 +1,64 @@
+# Exact external-test import closure; cbor2 5.x retains the pinned upstream _decoder API.
+annotated-types==0.8.0
+antlr4-python3-runtime==4.13.2
+asn1crypto==1.5.1
+attrs==26.1.0
+boto3==1.43.118
+botocore==1.43.118
+cachebox==5.2.3
+cachetools==7.2.8
+cbor2==5.9.0
+certifi==2026.10.23
+cffi==2.1.1
+charset-normalizer==3.5.2
+cryptography==50.0.2
+decorator==5.3.1
+deepdiff==9.1.0
+dill==0.3.6
+dnslib==0.9.26
+dnspython==2.9.1
+docker==7.2.0
+h11==0.16.0
+idna==3.20
+iniconfig==2.3.1
+jmespath==1.1.0
+json5==0.17.3
+jsonpatch==1.38
+jsonpath-ng==1.15.0
+jsonpath-rw==1.4.0
+jsonpointer==3.6
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+localstack-snapshot==0.3.4
+markdown-it-py==4.2.0
+markupsafe==3.0.4
+mdurl==0.1.2
+orderly-set==5.5.0
+packaging==26.3
+pluggy==1.7.0
+plux==1.16.0
+ply==3.11
+psutil==7.2.2
+pycparser==3.12
+pydantic==2.14.2
+pydantic-core==2.50.2
+pygments==2.21.0
+pytest==9.2.0
+python-dateutil==2.9.0.post0
+python-dotenv==1.2.4
+pyyaml==6.0.3
+referencing==0.37.0
+requests==2.34.2
+requests-aws4auth==1.4.0
+rich==15.0.0
+rolo==0.8.9
+rpds-py==2026.9.1
+s3transfer==0.19.3
+semver==3.1.0
+six==1.17.0
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+urllib3==2.8.0
+werkzeug==3.1.9
+wsproto==1.3.2
+xmltodict==1.0.4
diff --git a/tests/workflows/localstack_compat.py b/tests/workflows/localstack_compat.py
new file mode 100644
index 00000000..01946dd3
--- /dev/null
+++ b/tests/workflows/localstack_compat.py
@@ -0,0 +1,206 @@
+"""Run original upstream tests in-process under an externally owned Rustack server."""
+from contextlib import redirect_stderr, redirect_stdout
+import importlib.metadata
+import json
+import os
+import re
+from pathlib import Path
+import sys
+import urllib.parse
+
+from localstack_policy import (MANIFEST, PIN, ROOT, VENDOR, digest, guards, manifest, private,
+                               publish, read, require, upstream)
+
+
+class Log:
+    """Bound pytest diagnostics without imposing filesystem limits on workloads."""
+    def __init__(self, path):
+        self.output = path.open("xb")
+        os.chmod(path, 0o600)
+        self.count = 0
+
+    def write(self, value):
+        raw = value.encode("utf-8")
+        self.count += len(raw)
+        require(self.count <= 16 * 1024 * 1024, "compat-diagnostics-bound")
+        self.output.write(raw)
+        return len(value)
+
+    def flush(self):
+        self.output.flush()
+
+    def close(self):
+        self.flush()
+        os.fsync(self.output.fileno())
+        self.output.close()
+
+    def isatty(self):
+        return False
+
+
+def environment():
+    guards([], os.environ)
+    os.environ.update(PYTEST_DISABLE_PLUGIN_AUTOLOAD="1", PYTHONDONTWRITEBYTECODE="1",
+                      AWS_EC2_METADATA_DISABLED="true", AWS_CONFIG_FILE="/dev/null",
+                      AWS_SHARED_CREDENTIALS_FILE="/dev/null", AWS_DEFAULT_REGION="us-east-1")
+    packages = {dist.metadata["Name"].lower().replace("_", "-"):dist.version
+                for dist in importlib.metadata.distributions()}
+    expected = {}
+    for line in read(Path(__file__).with_name("localstack-requirements.txt"), 65536).decode().splitlines():
+        if line and not line.startswith("#"):
+            name, version = line.split("==")
+            expected[name.lower().replace("_", "-")] = version
+    require(all(packages.get(name) == version for name, version in expected.items())
+            and set(packages) == set(expected) | {"localstack-core"}, "compat-dependency-drift")
+    return packages
+
+
+def source_seal():
+    from linux_performance import Runner
+    from rootless_functional import source_seal as seal
+    import time
+    return digest(json.dumps(seal(Runner(os.environ), time.monotonic() + 30),
+                             sort_keys=True, separators=(",", ":")).encode())
+
+
+def image_receipt(path, endpoint):
+    import time
+    from linux_performance import Runner
+    from localstack_images import validate_receipt
+    raw = read(Path(path))
+    value = json.loads(raw)
+    executable = Path(value["dockerExecutable"])
+    require(executable.is_absolute() and executable.is_file(), "compat-docker-executable")
+    # Runner intentionally inherits only explicit process settings. Rust's owner
+    # clears PATH; give these read-only Docker commands the recorded executable.
+    owner = Runner({"PATH":str(executable.parent) + ":/usr/bin:/bin"})
+    validate_receipt(Path(path), endpoint, owner, time.monotonic() + 60)
+    return value, digest(raw)
+
+
+def pytest_arguments(root, nodes):
+    return ["--rootdir=" + str(VENDOR), "--noconftest", "--override-ini=addopts=",
+            "--override-ini=log_level=WARNING", "--tb=short", "-q", "--color=no", "-o", "cache_dir=" + str(root / "pytest-cache")] + [
+            str(VENDOR / node.split("::")[0]) + "::" + node.split("::", 1)[1] for node in nodes]
+
+
+def preflight(root, mode, images_path, docker_endpoint):
+    require(mode in ("pure", "docker"), "compat-mode")
+    private(root)
+    environment()
+    upstream()
+    value, hashed = manifest()
+    image_hash = None
+    if mode == "docker":
+        _, image_hash = image_receipt(images_path, docker_endpoint)
+    # Import the real modules before starting Rustack, so fixture dependency errors
+    # cannot leave an execution environment behind.
+    sys.path.insert(0, str(VENDOR))
+    for module in sorted({node.split("::")[0][:-3].replace("/", ".") for node in value["groups"][mode]}):
+        __import__(module)
+    from localstack.testing.snapshots.transformer_utility import TransformerUtility
+    require(callable(TransformerUtility.stepfunctions_api), "compat-upstream-snapshot-transformers")
+    import pytest
+    from localstack_fixtures import Fixtures
+    collecting = Fixtures(root, "http://127.0.0.1:1", mode, value["groups"][mode], {}, {}, collecting=True)
+    log = Log(root / "preflight-pytest.log")
+    try:
+        with redirect_stdout(log), redirect_stderr(log):
+            code = pytest.main(pytest_arguments(root, value["groups"][mode]) + ["--collect-only"],
+                               plugins=[collecting])
+    finally:
+        log.close()
+    require(code == 0 and sorted(collecting.collected) == sorted(value["groups"][mode]),
+            "compat-preflight-collection")
+    publish(root / "intent.json", {"schemaVersion":1, "vendorCommit":PIN,
+        "manifestSha256":hashed, "mode":mode, "nodes":value["groups"][mode],
+        "packages":environment(), "sourceSealSha256":source_seal(),
+        "imageReceiptSha256":image_hash, "dockerEndpoint":docker_endpoint,
+        "serverExecutable":json.loads(read(root / "server-intent.json", 65536))})
+
+
+def run(root, mode, endpoint, images_path):
+    private(root)
+    packages = environment()
+    upstream()
+    value, hashed = manifest()
+    intent = json.loads(read(root / "intent.json", 1024 * 1024))
+    require(intent["mode"] == mode and intent["manifestSha256"] == hashed
+            and intent["nodes"] == value["groups"][mode] and intent["packages"] == packages
+            and intent["sourceSealSha256"] == source_seal(),
+            "compat-intent-changed")
+    parsed = urllib.parse.urlsplit(endpoint)
+    require(parsed.scheme == "http" and parsed.hostname == "127.0.0.1" and parsed.port
+            and not parsed.username and not parsed.password and parsed.path == ""
+            and not parsed.query and not parsed.fragment, "compat-local-endpoint")
+    images = {}
+    if mode == "docker":
+        image_value, image_hash = image_receipt(images_path, intent["dockerEndpoint"])
+        require(image_hash == intent["imageReceiptSha256"], "compat-image-receipt-changed")
+        images = image_value["handlers"]
+    sys.path.insert(0, str(VENDOR))
+    import pytest
+    from localstack_snapshot.pytest import snapshot as snapshot_plugin
+    from localstack_fixtures import Fixtures
+    credentials = json.loads(read(root / "auth.json", 1024))
+    require(set(credentials) == {"accessKey", "secretKey"}
+            and all(isinstance(v, str) and 1 <= len(v) <= 128 for v in credentials.values()),
+            "compat-owned-authentication")
+    plugin = Fixtures(root, endpoint, mode, intent["nodes"], images, credentials)
+    arguments = pytest_arguments(root, intent["nodes"]) + ["--junitxml=" + str(root / "junit.xml")]
+    guards(arguments, os.environ)
+    log = Log(root / "pytest.log")
+    try:
+        with redirect_stdout(log), redirect_stderr(log):
+            code = pytest.main(arguments, plugins=[snapshot_plugin, plugin])
+    finally:
+        log.close()
+    successful = False
+    rejection = None
+    try:
+        require(code == 0, "compat-pytest-failed")
+        plugin.result()
+        successful = True
+    except ValueError as error:
+        rejection = str(error)
+    upstream()
+    require(manifest()[1] == hashed, "compat-final-manifest-drift")
+    require(source_seal() == intent["sourceSealSha256"], "compat-final-source-drift")
+    if mode == "docker":
+        require(image_receipt(images_path, intent["dockerEndpoint"])[1] == intent["imageReceiptSha256"],
+                "compat-final-image-drift")
+    report = {"schemaVersion":1, "vendorCommit":PIN, "manifestSha256":hashed, "mode":mode,
+        "endpoint":endpoint, "sourceSealSha256":intent["sourceSealSha256"],
+        "serverExecutable":intent["serverExecutable"],
+        "expected":len(intent["nodes"]), "collected":len(plugin.collected),
+        "passed":sum(all(row.get(phase) == "passed" for phase in ("setup", "call", "teardown"))
+                     and not row.get("xfail") for row in plugin.rows.values()),
+        "successful":successful, "pytestExitCode":int(code), "rejection":rejection,
+        "nodes":plugin.rows, "snapshots":plugin.snapshots, "packages":packages,
+        "logSha256":digest(read(root / "pytest.log")), "upstreamBaselinesUnchanged":True,
+        "packaging":"original Python3.12 source/runtime in RIC Image; upstream requested managed ZIP" if mode == "docker" else "no Lambda",
+        "exclusions":value["exclusions"]}
+    publish(root / "report.json", report)
+    print(json.dumps({"expected":report["expected"], "passed":report["passed"],
+                      "successful":successful, "evidence":str(root)}), flush=True)
+    return 0 if successful else 1
+
+
+def main():
+    require(len(sys.argv) == 6 and sys.argv[1] in ("preflight", "run"), "compat-arguments")
+    root, mode = Path(sys.argv[2]), sys.argv[3]
+    if sys.argv[1] == "preflight":
+        preflight(root, mode, sys.argv[4], sys.argv[5])
+        return 0
+    require(len(sys.argv) == 6, "compat-run-arguments")
+    return run(root, mode, sys.argv[4], sys.argv[5])
+
+
+if __name__ == "__main__":
+    try:
+        print(os.getpid(), flush=True)
+        sys.exit(main())
+    except (OSError, ValueError, KeyError, TypeError) as error:
+        reason = str(error) if re.fullmatch(r"compat-[a-z0-9-]{1,80}", str(error)) else type(error).__name__
+        print("localstack-compatibility-rejected:" + reason, file=sys.stderr)
+        sys.exit(2)
diff --git a/tests/workflows/localstack_fixtures.py b/tests/workflows/localstack_fixtures.py
new file mode 100644
index 00000000..3c2e4a08
--- /dev/null
+++ b/tests/workflows/localstack_fixtures.py
@@ -0,0 +1,217 @@
+"""Fixture-only adapter; upstream test bodies and snapshot assertions are unchanged."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import signal
+
+import boto3
+from botocore.config import Config
+import pytest
+from localstack_snapshot.snapshots import SnapshotAssertionError, SnapshotSession
+
+from localstack_policy import VENDOR, digest, exact, outcomes, publish, read, require
+
+ROLE = "arn:aws:iam::000000000000:role/Workflows"
+
+
+class RecordedSession(SnapshotSession):
+    """Record verification outcome without changing upstream comparison semantics."""
+    checked = False
+    comparisons = 0
+    passed = False
+
+    def _assert_all(self, *args, **kwargs):
+        self.checked = True
+        try:
+            results = super()._assert_all(*args, **kwargs)
+        except SnapshotAssertionError as error:
+            self.comparisons = len(error.result)
+            raise
+        self.comparisons = len(results)
+        self.passed = bool(results) and all(bool(result) for result in results)
+        return results
+
+
+class Clients:
+    """Explicit signed local clients; no credential or endpoint discovery."""
+    def __init__(self, endpoint, credentials):
+        self.endpoint = endpoint
+        self.credentials = credentials
+        self.clients = {}
+
+    def __getattr__(self, name):
+        require(name in ("stepfunctions", "lambda_"), "compat-service-outside-profile")
+        if name not in self.clients:
+            self.clients[name] = boto3.client(name.rstrip("_"), endpoint_url=self.endpoint,
+                region_name="us-east-1", aws_access_key_id=self.credentials["accessKey"],
+                aws_secret_access_key=self.credentials["secretKey"],
+                config=Config(signature_version="v4", connect_timeout=2, read_timeout=10,
+                              retries={"max_attempts": 0}))
+        return self.clients[name]
+
+    def close(self):
+        for client in self.clients.values():
+            client.close()
+
+
+class Fixtures:
+    """Private snapshot sessions, exact outcomes and public-API cleanup ownership."""
+    def __init__(self, evidence, endpoint, mode, selected, images, credentials, collecting=False):
+        self.root = evidence
+        self.endpoint = endpoint
+        self.mode = mode
+        self.selected = selected
+        self.images = images
+        self.credentials = credentials
+        self.rows = {}
+        self.snapshots = {}
+        self.collected = []
+        self.collecting = collecting
+
+    def pytest_configure(self, config):
+        for marker in ("aws_validated", "aws_needs_fixing", "requires_docker", "skip_snapshot_verify"):
+            config.addinivalue_line("markers", marker)
+
+    def pytest_collection_finish(self, session):
+        self.collected = [item.nodeid for item in session.items]
+        publish(self.root / ("preflight-collection.json" if self.collecting else "collection.json"), self.collected)
+        exact(self.selected, self.collected)
+
+    @pytest.hookimpl(tryfirst=True)
+    def pytest_runtest_setup(self, item):
+        def expired(_number, _frame):
+            raise TimeoutError("compat-case-deadline")
+        self.previous_signal = signal.signal(signal.SIGALRM, expired)
+        signal.setitimer(signal.ITIMER_REAL, 180)
+
+    @pytest.hookimpl(trylast=True)
+    def pytest_runtest_teardown(self, item, nextitem):
+        signal.setitimer(signal.ITIMER_REAL, 0)
+        signal.signal(signal.SIGALRM, self.previous_signal)
+
+    def pytest_runtest_logreport(self, report):
+        row = self.rows.setdefault(report.nodeid, {})
+        row[report.when] = report.outcome
+        row["xfail"] = row.get("xfail", False) or bool(getattr(report, "wasxfail", False))
+
+    @pytest.fixture
+    def aws_client(self):
+        clients = Clients(self.endpoint, self.credentials)
+        try:
+            yield clients
+        finally:
+            clients.close()
+
+    @pytest.fixture
+    def create_state_machine_iam_role(self):
+        return lambda target_aws_client: ROLE
+
+    @pytest.fixture
+    def create_state_machine(self, aws_client, create_lambda_function):
+        owned = []
+        def create(clients, **kwargs):
+            reply = clients.stepfunctions.create_state_machine(**kwargs)
+            owned.append((clients.stepfunctions, reply["stateMachineArn"]))
+            return reply
+        yield create
+        errors = []
+        for client, arn in reversed(owned):
+            try:
+                token = None
+                for _ in range(32):
+                    result = client.list_executions(stateMachineArn=arn, statusFilter="RUNNING",
+                        **({"nextToken": token} if token else {}))
+                    for execution in result["executions"]:
+                        client.stop_execution(executionArn=execution["executionArn"])
+                    token = result.get("nextToken")
+                    if not token:
+                        break
+                require(not token, "compat-cleanup-pagination")
+                client.delete_state_machine(stateMachineArn=arn)
+            except Exception as error:
+                errors.append(type(error).__name__)
+        require(not errors, "compat-machine-cleanup-failed")
+
+    @pytest.fixture
+    def create_lambda_function(self, aws_client):
+        owned = []
+        def create(*, func_name, handler_file, runtime, **kwargs):
+            require(self.mode == "docker" and not kwargs and runtime == "python3.12",
+                    "compat-unadapted-lambda-fixture")
+            source = Path(handler_file).resolve(strict=True)
+            name = str(source.relative_to(VENDOR))
+            require(name in self.images and digest(read(source)) == self.images[name]["handlerSha256"],
+                    "compat-handler-drift")
+            reply = aws_client.lambda_.create_function(FunctionName=func_name, Role=ROLE,
+                PackageType="Image", Code={"ImageUri": self.images[name]["imageId"]},
+                Architectures=["arm64"], Timeout=30, MemorySize=128,
+                Environment={"Variables":{}}, Tags={})
+            owned.append(func_name)
+            aws_client.lambda_.get_waiter("function_active_v2").wait(FunctionName=func_name,
+                WaiterConfig={"Delay": 1, "MaxAttempts": 30})
+            return {"CreateFunctionResponse": reply, "CreateEventSourceMappingResponse":None}
+        yield create
+        errors = []
+        for name in reversed(owned):
+            try:
+                aws_client.lambda_.delete_function(FunctionName=name)
+            except Exception as error:
+                errors.append(type(error).__name__)
+        require(not errors, "compat-function-cleanup-failed")
+
+    @pytest.fixture
+    def _snapshot_session(self, request):
+        source = Path(str(request.fspath)).with_suffix(".snapshot.json")
+        raw = read(source)
+        key = hashlib.sha256(request.node.nodeid.encode()).hexdigest()
+        directory = self.root / ("snapshot-" + key)
+        directory.mkdir(mode=0o700)
+        base = directory / "upstream"
+        baseline = base.with_suffix(".snapshot.json")
+        baseline.write_bytes(raw)
+        os.chmod(baseline, 0o600)
+        session = RecordedSession(base_file_path=str(base), scope_key=request.node.nodeid,
+                                  update=False, raw=False, verify=True)
+        require(isinstance(session.recorded_state, dict) and session.recorded_state, "compat-snapshot-key")
+        expected_keys = set(session.recorded_state)
+        self.snapshots[request.node.nodeid] = {"baselineSha256": digest(raw),
+            "source": str(source.relative_to(VENDOR)), "directory": directory.name,
+            "recordedDate": json.loads(raw)[request.node.nodeid]["recorded-date"]}
+        try:
+            yield session
+        finally:
+            require(digest(read(source)) == digest(raw) == digest(read(baseline)),
+                    "compat-baseline-mutated")
+            require(session.update is False and session.raw is False and session.verify is True,
+                    "compat-verification-disabled")
+            publish(directory / "observations.json", json.loads(json.dumps(session.observed_state,
+                default=str)))
+            assertions = {"keys": sorted(session.called_keys), "expectedKeys": sorted(expected_keys),
+                "checked": session.checked, "comparisons": session.comparisons, "passed": session.passed,
+                "upstreamSkipPaths": getattr(session, "skip_verification_paths", [])}
+            publish(directory / "assertions.json", assertions)
+            self.snapshots[request.node.nodeid]["assertions"] = assertions
+
+    @pytest.fixture
+    def snapshot(self, request, _snapshot_session):
+        # Import this fixture as an ordinary function, never register the AWS
+        # conftest's LocalStack lifecycle hooks. This preserves its exact base
+        # normalizers and AWS-specific TransformerUtility without copying them.
+        from tests.aws.conftest import snapshot as upstream_snapshot
+        return upstream_snapshot.__wrapped__(request, _snapshot_session,
+                                               "000000000000", "us-east-1")
+
+    @pytest.fixture
+    def sfn_snapshot(self, snapshot):
+        snapshot.add_transformers_list(snapshot.transform.stepfunctions_api())
+        return snapshot
+
+    def result(self):
+        exact(self.selected, self.collected)
+        outcomes(self.selected, self.rows)
+        require(set(self.snapshots) == set(self.selected), "compat-missing-snapshot-session")
+        require(all(row["assertions"]["checked"] and row["assertions"]["passed"]
+                and row["assertions"]["keys"] == row["assertions"]["expectedKeys"]
+                for row in self.snapshots.values()), "compat-incomplete-snapshot-assertions")
+        return {"nodes": self.rows, "snapshots": self.snapshots}
diff --git a/tests/workflows/localstack_images.py b/tests/workflows/localstack_images.py
new file mode 100644
index 00000000..8695a213
--- /dev/null
+++ b/tests/workflows/localstack_images.py
@@ -0,0 +1,145 @@
+"""Build original upstream handlers into individually owned immutable RIC images."""
+import json
+import os
+from pathlib import Path
+import sys
+import uuid
+import shutil
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from localstack_policy import VENDOR, digest, manifest, publish, read, require, upstream
+from linux_performance import Runner, deadline_guard
+from image_performance_images import catalog, fenced, image, retain_content
+
+BASE = "public.ecr.aws/lambda/python:3.12@sha256:ab3f7e33c838a04d8750648f4cd1250ef8c20f6137904a3bbccd90da95e4157a"
+HANDLERS = (
+    "tests/aws/services/stepfunctions/templates/services/lambdafunctions/id_function.py",
+    "tests/aws/services/stepfunctions/templates/services/lambdafunctions/return_bytes_str.py",
+    "tests/aws/services/stepfunctions/templates/errorhandling/lambdafunctions/raise_exception.py",
+    "tests/aws/services/stepfunctions/templates/errorhandling/lambdafunctions/raise_custom_exception.py",
+    "tests/aws/services/stepfunctions/templates/timeouts/lambdafunctions/wait_60_seconds.py",
+    "tests/aws/services/stepfunctions/lambda_functions/base/echo_function.py",
+)
+
+
+def recipe():
+    return ("FROM " + BASE + "\nCOPY --chmod=0444 handler.py /var/task/handler.py\n"
+            "USER 1000:1000\nCMD [\"handler.handler\"]\n").encode()
+
+
+def build_arguments(builder, context, name):
+    return [str(builder), "build", "--load", "--provenance=false", "--progress=quiet",
+            "--metadata-file", str(context / "metadata.json"), "--platform", "linux/arm64",
+            "--tag", name, str(context)]
+
+
+def validate_builds(root, value):
+    original = json.loads(read(root / "intent.json"))
+    require(original["engine"] == value["engine"] and original["endpoint"] == value["endpoint"]
+            and original["manifestSha256"] == value["manifestSha256"] and original["base"] == BASE,
+            "compat-image-build-affiliation")
+    builder = Path(value["builderExecutable"])
+    require(builder.is_absolute(), "compat-image-builder")
+    for index, source in enumerate(HANDLERS):
+        context = root / ("handler-%d" % index)
+        require(not context.is_symlink(), "compat-image-context-substitution")
+        row = value["handlers"][source]
+        saved = read(context / "result.json")
+        require(digest(saved) == row["buildResultSha256"]
+                and json.loads(saved) == {k:v for k,v in row.items() if k != "buildResultSha256"},
+                "compat-image-result-affiliation")
+        raw = read(VENDOR / source, 65536)
+        require(read(context / "handler.py", 65536) == raw and read(context / "Dockerfile") == recipe()
+                and digest(raw) == row["handlerSha256"], "compat-image-build-inputs")
+        intent_raw = read(context / "build-intent.json")
+        intent = json.loads(intent_raw)
+        name = "rustack-localstack-compat:" + original["nonce"] + "-" + str(index)
+        require(intent == {"argv":build_arguments(builder, context, name), "engine":value["engine"],
+                "source":source, "handlerSha256":digest(raw), "dockerfileSha256":digest(recipe())}
+                and digest(intent_raw) == row["buildIntentSha256"], "compat-image-build-intent")
+        metadata_raw = read(context / "metadata.json", 65536)
+        metadata = json.loads(metadata_raw)
+        require(row["imageId"] in (metadata.get("containerimage.digest"), metadata.get("containerimage.config.digest"))
+                and digest(metadata_raw) == row["metadataSha256"]
+                and digest(read(context / "build.stdout", 65536)) == row["buildStdoutSha256"],
+                "compat-image-build-output")
+
+
+def validate_receipt(path, endpoint, owner, deadline):
+    value = json.loads(read(path))
+    require(value.get("schemaVersion") == 1 and value.get("allChildGroupsJoined") is True
+            and value.get("endpoint") == endpoint and value.get("base") == BASE
+            and value.get("manifestSha256") == manifest()[1]
+            and set(value.get("handlers", {})) == set(HANDLERS), "compat-image-receipt")
+    validate_builds(path.parent, value)
+    engine = value["engine"]
+    for source, row in value["handlers"].items():
+        require(digest(read(VENDOR / source)) == row["handlerSha256"]
+                and image(owner, endpoint, row["imageId"], deadline, engine) == row["image"]
+                and row["image"]["id"] == row["imageId"], "compat-image-live-binding")
+    return value
+
+
+def run(root, socket, builder, owner, deadline):
+    upstream()
+    _, hashed = manifest()
+    require(root.is_absolute() and socket.is_absolute() and builder.is_absolute()
+            and not root.exists() and builder.is_file(), "compat-image-paths")
+    root.mkdir(mode=0o700)
+    endpoint = "unix://" + str(socket)
+    result = owner.run(["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline)
+    require(result.code == 0 and not result.stderr, "compat-image-engine")
+    engine = result.stdout.decode().strip()
+    original = catalog(owner, endpoint, deadline, engine)
+    nonce = uuid.uuid4().hex
+    publish(root / "intent.json", {"engine":engine, "endpoint":endpoint, "manifestSha256":hashed,
+        "originalIds":sorted(original), "base":BASE, "nonce":nonce})
+    handlers = {}
+    owner.environment["DOCKER_HOST"] = endpoint
+    for index, source in enumerate(HANDLERS):
+        context = root / ("handler-%d" % index)
+        context.mkdir(mode=0o700)
+        raw = read(VENDOR / source, 65536)
+        (context / "handler.py").write_bytes(raw)
+        os.chmod(context / "handler.py", 0o444)
+        recipe_raw = recipe()
+        (context / "Dockerfile").write_bytes(recipe_raw)
+        name = "rustack-localstack-compat:" + nonce + "-" + str(index)
+        existing = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "ls", "-a",
+            "--filter", "reference=" + name, "--format", "{{.ID}}"], deadline)
+        require(not existing, "compat-image-tag-conflict")
+        arguments = build_arguments(builder, context, name)
+        publish(context / "build-intent.json", {"argv":arguments, "engine":engine,
+            "source":source, "handlerSha256":digest(raw), "dockerfileSha256":digest(recipe_raw)})
+        output = fenced(owner, endpoint, engine, arguments, deadline, 180)
+        (context / "build.stdout").write_bytes(output)
+        metadata = image(owner, endpoint, name, deadline, engine)
+        build_metadata = json.loads(read(context / "metadata.json", 65536))
+        require(metadata["id"] in (build_metadata.get("containerimage.digest"),
+                build_metadata.get("containerimage.config.digest")), "compat-image-addressable-build-output")
+        alias = retain_content(owner, endpoint, metadata["id"], deadline, engine)
+        handlers[source] = {"imageId":metadata["id"], "image":metadata, "handlerSha256":digest(raw),
+            "tag":name, "cacheAlias":alias, "metadataSha256":digest(read(context / "metadata.json", 65536)),
+            "buildIntentSha256":digest(read(context / "build-intent.json")), "buildStdoutSha256":digest(output)}
+        publish(context / "result.json", handlers[source])
+        handlers[source]["buildResultSha256"] = digest(read(context / "result.json"))
+    upstream()
+    require(manifest()[1] == hashed and original <= catalog(owner, endpoint, deadline, engine),
+            "compat-image-postconditions")
+    publish(root / "images.json", {"schemaVersion":1, "engine":engine, "endpoint":endpoint,
+        "manifestSha256":hashed, "base":BASE, "handlers":handlers,
+        "dockerExecutable":shutil.which("docker"), "builderExecutable":str(builder),
+        "originalIds":sorted(original), "resultIds":sorted(catalog(owner, endpoint, deadline, engine)),
+        "allChildGroupsJoined":not owner.unsettled})
+
+
+if __name__ == "__main__":
+    try:
+        require(len(sys.argv) == 4, "compat-image-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard(1200, owner) as deadline:
+            run(Path(sys.argv[1]), Path(sys.argv[2]), Path(sys.argv[3]), owner, deadline)
+    except (ValueError, OSError, KeyError, TypeError):
+        print("localstack-handler-images-rejected", file=sys.stderr)
+        sys.exit(2)
diff --git a/tests/workflows/localstack_policy.py b/tests/workflows/localstack_policy.py
new file mode 100644
index 00000000..14860812
--- /dev/null
+++ b/tests/workflows/localstack_policy.py
@@ -0,0 +1,120 @@
+"""Exact external-test inventory and immutable upstream baseline policy."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+
+ROOT = Path(__file__).resolve().parents[2]
+VENDOR = ROOT / "vendors/localstack"
+MANIFEST = Path(__file__).with_name("localstack-required.json")
+PIN = "45dfee8ce27df00fcac3f91b8071c8156eb5c5c7"
+FILE_LIMIT = 16 * 1024 * 1024
+
+
+def require(condition, code):
+    if not condition:
+        raise ValueError(code)
+
+
+def read(path, limit=FILE_LIMIT):
+    require(not path.is_symlink(), "compat-symlink")
+    metadata = path.stat()
+    require(stat.S_ISREG(metadata.st_mode) and metadata.st_size <= limit, "compat-file-bound")
+    with path.open("rb") as source:
+        raw = source.read(limit + 1)
+    require(len(raw) <= limit, "compat-file-growth")
+    return raw
+
+
+def digest(raw):
+    return hashlib.sha256(raw).hexdigest()
+
+
+def relative(value):
+    require(isinstance(value, str) and len(value) <= 1024 and
+            re.fullmatch(r"[A-Za-z0-9_./-]+", value) and
+            all(part not in ("", ".", "..") for part in value.split("/")), "compat-relative-path")
+    return VENDOR / value
+
+
+def manifest():
+    raw = read(MANIFEST, 1024 * 1024)
+    value = json.loads(raw)
+    require(set(value) == {"schemaVersion", "vendorCommit", "groups", "files", "exclusions"}
+            and value["schemaVersion"] == 1 and value["vendorCommit"] == PIN
+            and set(value["groups"]) == {"pure", "docker"}, "compat-manifest-shape")
+    names = []
+    for nodes in value["groups"].values():
+        require(isinstance(nodes, list) and 1 <= len(nodes) <= 512, "compat-inventory-bound")
+        for node in nodes:
+            require(isinstance(node, str) and len(node.encode()) <= 2048 and "::" in node
+                    and not any(ord(c) < 32 for c in node), "compat-node-id")
+            relative(node.split("::")[0])
+        names.extend(nodes)
+    require(len(names) == len(set(names)), "compat-repeated-node")
+    require(isinstance(value["files"], dict) and 1 <= len(value["files"]) <= 256,
+            "compat-file-inventory")
+    for path, expected in value["files"].items():
+        require(re.fullmatch(r"[0-9a-f]{64}", expected) and digest(read(relative(path))) == expected,
+                "compat-upstream-file-drift")
+    for node in names:
+        path = node.split("::")[0]
+        snapshot = path[:-3] + ".snapshot.json"
+        require(path in value["files"] and snapshot in value["files"], "compat-unbound-node")
+        recorded = json.loads(read(relative(snapshot)))
+        require(node in recorded and isinstance(recorded[node].get("recorded-content"), dict)
+                and bool(recorded[node]["recorded-content"]), "compat-missing-baseline")
+    return value, digest(raw)
+
+
+def upstream():
+    import time
+    from linux_performance import Runner
+    owner = Runner(os.environ)
+    def git(*args):
+        reply = owner.run(["git", "-C", str(VENDOR), *args], time.monotonic() + 20,
+                          stdout_limit=65536)
+        require(reply.code == 0 and not reply.stderr, "compat-git-diagnostics")
+        return reply.stdout.decode().strip()
+    require(git("rev-parse", "HEAD") == PIN and not git("status", "--porcelain", "--untracked-files=normal"),
+            "compat-vendor-drift")
+
+
+def guards(arguments, environment):
+    forbidden = ("--snapshot-update", "--snapshot-raw", "--snapshot-skip-all", "--collect-only",
+                 "--lf", "--last-failed", "--maxfail", "-x")
+    require(not any(arg == flag or arg.startswith(flag + "=") for arg in arguments for flag in forbidden),
+            "compat-forbidden-option")
+    require(not any(environment.get(key) for key in ("SNAPSHOT_UPDATE", "SNAPSHOT_RAW", "PYTEST_ADDOPTS",
+            "PYTEST_PLUGINS", "TEST_TARGET", "AWS_PROFILE", "AWS_DEFAULT_PROFILE")), "compat-ambient-option")
+
+
+def exact(expected, collected):
+    require(len(collected) == len(set(collected)) and sorted(collected) == sorted(expected),
+            "compat-collection-mismatch")
+
+
+def outcomes(expected, rows):
+    exact(expected, list(rows))
+    require(all(row.get("setup") == row.get("call") == row.get("teardown") == "passed"
+                and not row.get("xfail") for row in rows.values()), "compat-unsuccessful-node")
+
+
+def private(path):
+    require(path.is_absolute() and not path.is_symlink() and path.resolve(strict=True) == path,
+            "compat-evidence-path")
+    info = path.stat()
+    require(stat.S_ISDIR(info.st_mode) and info.st_uid == os.getuid()
+            and stat.S_IMODE(info.st_mode) == 0o700, "compat-evidence-ownership")
+
+
+def publish(path, value):
+    raw = json.dumps(value, separators=(",", ":"), allow_nan=False).encode()
+    require(len(raw) <= FILE_LIMIT, "compat-report-bound")
+    with path.open("xb") as output:
+        os.chmod(path, 0o600)
+        output.write(raw)
+        output.flush()
+        os.fsync(output.fileno())
diff --git a/tests/workflows/native_gates.py b/tests/workflows/native_gates.py
new file mode 100644
index 00000000..2b66565d
--- /dev/null
+++ b/tests/workflows/native_gates.py
@@ -0,0 +1,35 @@
+"""Record the complete existing Native gate and separate Action owner, unchanged."""
+import os
+from pathlib import Path
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import ActionError, Runner, deadline_guard, require, safe_path
+from rust_gates import run
+
+GATES = (
+    ("native", ["make", "--no-print-directory", "-j1", "verify-workflows-native"]),
+    ("action", ["make", "--no-print-directory", "-j1", "test-workflows-action-fixture"]),
+)
+DOUBLED = (
+    "persistence::test_should_restart_named_native_snapshots_without_replay_and_lose_only_unsaved_work",
+    "performance::test_should_measure_one_hundred_fifty_state_signed_sdk_executions",
+    "performance::test_should_keep_health_and_stop_responsive_and_reuse_one_execution_slot",
+)
+HTTP = "test_should_exchange_signed_boto3_requests_with_typed_transport"
+
+
+def main():
+    try:
+        require(len(sys.argv) == 2, "native-gates-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard(2400, owner) as deadline:
+            run(safe_path(sys.argv[1]), owner, deadline, gates=GATES)
+        return 0
+    except (ActionError, OSError, ValueError, TypeError, KeyError):
+        print("native-gates-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/nested-cases.json b/tests/workflows/nested-cases.json
new file mode 100644
index 00000000..33f21a8c
--- /dev/null
+++ b/tests/workflows/nested-cases.json
@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "profile": "rustack-standard-jsonpath-nested-v1",
+  "source": "https://docs.aws.amazon.com/step-functions/latest/dg/connect-stepfunctions.html",
+  "cases": [
+    {"id":"accept", "suffix":"", "input":{"answer":42}, "expected":{"answer":42}},
+    {"id":"sync", "suffix":".sync", "input":{"answer":42}, "expected":{"answer":42}},
+    {"id":"sync2", "suffix":".sync:2", "input":{"answer":42}, "expected":{"answer":42}},
+    {"id":"null-default", "suffix":".sync:2", "input":null, "expected":{}},
+    {"id":"serialized-null", "suffix":".sync:2", "input":"null", "expected":null},
+    {"id":"serialized-object", "suffix":".sync", "input":" { \"answer\":42 } ", "expected":{"answer":42}}
+  ]
+}
diff --git a/tests/workflows/node_image_sdk.py b/tests/workflows/node_image_sdk.py
new file mode 100644
index 00000000..584c53e3
--- /dev/null
+++ b/tests/workflows/node_image_sdk.py
@@ -0,0 +1,142 @@
+"""Ordinary signed Node24 image consumption; importing performs no SDK IO."""
+import base64
+import json
+import os
+import re
+import sys
+import uuid
+
+from lambda_fault_support import Metadata, invoke_json, poll_response
+
+
+def invoke(client, name, value, *, qualifier=None, fail=False, logs=False):
+    arguments = {}
+    if qualifier is not None:
+        arguments["Qualifier"] = qualifier
+    if logs:
+        arguments["LogType"] = "Tail"
+    return invoke_json(client, name, {"value": value, "fail": fail, "logs": logs}, **arguments)
+
+
+def check(output, name, architecture, expected, counter, version, handler):
+    assert output["computed"] == expected and output["counter"] == counter
+    assert output["runtime"] == "node24" and re.fullmatch(r"24\.\d+\.\d+", output["nodeVersion"])
+    assert output["architecture"] == {"arm64": "arm64", "x86_64": "x64"}[architecture]
+    assert output["uid"] == 1000 and output["rootReadOnly"] is True
+    assert output["temporaryRoundtrip"] is True and output["temporaryMode"] == 0o600
+    assert output["functionName"] == name and output["functionVersion"] == version
+    assert output["memoryMb"] == "256" and output["configuredValue"] == "node-configured"
+    assert output["handler"] == handler
+    uuid.UUID(output["requestId"])
+
+
+def deployed(client, name):
+    def accepted(value):
+        assert value["State"] != "Failed" and value.get("LastUpdateStatus") != "Failed"
+        return value["State"] == "Active" and value.get("LastUpdateStatus", "Successful") == "Successful"
+    return poll_response(lambda: client.get_function_configuration(FunctionName=name), accepted, 120)
+
+
+def observe_environments(metadata, stage):
+    rows = []
+    for row in metadata.rows():
+        if row["Labels"]["rustack.lambda.role"] != "function":
+            continue
+        inspected = metadata.get("/containers/" + row["Id"] + "/json")
+        version = [entry.split("=", 1)[1] for entry in inspected["Config"]["Env"]
+                   if entry.startswith("AWS_LAMBDA_FUNCTION_VERSION=")]
+        state = inspected["State"]
+        observed = {"id": row["Id"], "version": version,
+                    "command": inspected["Config"]["Cmd"], "running": state["Running"],
+                    "exitCode": state["ExitCode"], "oom": state["OOMKilled"]}
+        rows.append(observed)
+    print(json.dumps({"nodeEnvironmentObservation": stage, "functions": rows}), file=sys.stderr, flush=True)
+    assert rows and all(row["running"] for row in rows), "Node function unexpectedly exited"
+
+
+def exercise(endpoint, image, architecture, socket, owner, engine):
+    import boto3
+    from botocore.config import Config
+    settings = dict(endpoint_url=endpoint, region_name="us-east-1",
+                    aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                    config=Config(retries={"max_attempts": 0}, connect_timeout=2, read_timeout=60))
+    client = boto3.client("lambda", **settings)
+    states = boto3.client("stepfunctions", **settings)
+    name = "NodeOfficial" + uuid.uuid4().hex
+    metadata = Metadata(socket, owner, engine)
+    try:
+        created = client.create_function(FunctionName=name,
+            Role="arn:aws:iam::000000000000:role/NodeFixture", PackageType="Image",
+            Architectures=[architecture], Timeout=30, MemorySize=256, Code={"ImageUri": image},
+            Environment={"Variables": {"TEST_VALUE": "node-configured"}})
+        arn = created["FunctionArn"]
+        deployed(client, name)
+        for value, expected, counter in ((21, 42, 1), (23, 46, 2)):
+            response, output = invoke(client, name, value, logs=counter == 1)
+            assert "FunctionError" not in response
+            check(output, name, architecture, expected, counter, "$LATEST", "handler")
+            assert output["invokedArn"] == arn
+            if counter == 1:
+                tail = base64.b64decode(response["LogResult"], validate=True)
+                assert len(tail) <= 4096 and b"NODE_STDOUT_CAPTURE" in tail and b"NODE_STDERR_CAPTURE" in tail
+        version = client.publish_version(FunctionName=name)["Version"]
+        assert version == "1"
+        client.create_alias(FunctionName=name, Name="live", FunctionVersion=version)
+        response, output = invoke(client, name, 7, qualifier="live")
+        assert "FunctionError" not in response and response["ExecutedVersion"] == version
+        check(output, name, architecture, 14, 1, version, "handler")
+        assert output["invokedArn"] == arn + ":live"
+        client.update_function_configuration(FunctionName=name, ImageConfig={"Command": ["node.alternate"]})
+        configuration = deployed(client, name)
+        assert configuration["ImageConfigResponse"]["ImageConfig"]["Command"] == ["node.alternate"]
+        response, output = invoke(client, name, 7)
+        assert "FunctionError" not in response
+        check(output, name, architecture, 21, 1, "$LATEST", "alternate")
+        response, output = invoke(client, name, 7, qualifier=version)
+        assert "FunctionError" not in response and response["ExecutedVersion"] == version
+        check(output, name, architecture, 14, 2, version, "handler")
+        assert output["invokedArn"] == arn + ":1"
+        response, output = invoke(client, name, 7, qualifier="live")
+        assert "FunctionError" not in response and response["ExecutedVersion"] == version
+        check(output, name, architecture, 14, 3, version, "handler")
+        assert output["invokedArn"] == arn + ":live"
+        observe_environments(metadata, "before-latest-error")
+        response, output = invoke(client, name, 7, fail=True)
+        assert response["FunctionError"] == "Unhandled" and output["errorType"] == "NodeFixtureError"
+        observe_environments(metadata, "after-latest-error")
+        for value, expected, counter in ((21, 63, 1), (23, 69, 2)):
+            response, output = invoke(client, name, value)
+            assert "FunctionError" not in response
+            check(output, name, architecture, expected, counter, "$LATEST", "alternate")
+        observe_environments(metadata, "after-latest-recovery")
+        response, output = invoke(client, name, 7, qualifier="live")
+        assert "FunctionError" not in response and response["ExecutedVersion"] == version
+        check(output, name, architecture, 14, 4, version, "handler")
+        assert output["invokedArn"] == arn + ":live"
+        definition = {"StartAt": "Node", "States": {"Node": {"Type": "Task",
+            "Resource": "arn:aws:states:::lambda:invoke", "Parameters": {
+                "FunctionName": arn + ":live", "Payload.$": "$"},
+            "OutputPath": "$.Payload", "End": True}}}
+        machine = states.create_state_machine(name="NodeWorkflow" + uuid.uuid4().hex,
+            roleArn="arn:aws:iam::000000000000:role/NodeFixture", definition=json.dumps(definition))["stateMachineArn"]
+        execution = states.start_execution(stateMachineArn=machine, input='{"value":21}')["executionArn"]
+        terminal = poll_response(lambda: states.describe_execution(executionArn=execution),
+                                 lambda value: value["status"] != "RUNNING", 120)
+        assert terminal["status"] == "SUCCEEDED", {
+            "error": terminal.get("error"), "cause": terminal.get("cause")}
+        output = json.loads(terminal["output"])
+        assert output["computed"] == 42 and output["handler"] == "handler" and output["counter"] == 5
+        assert output["functionVersion"] == version and output["invokedArn"] == arn + ":live"
+        states.delete_state_machine(stateMachineArn=machine)
+        client.delete_function(FunctionName=name)
+        return {"schemaVersion": 1, "nodeVersion": output["nodeVersion"], "cases": [
+            "cold-warm-context-filesystem-logs", "published-alias-command-isolation",
+            "FunctionError-replacement-warm", "ASL-node-computation"]}
+    finally:
+        states.close()
+        client.close()
+
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+    print(json.dumps(exercise(*sys.argv[1:])), flush=True)
diff --git a/tests/workflows/platform_receipt.py b/tests/workflows/platform_receipt.py
new file mode 100644
index 00000000..b48bfe70
--- /dev/null
+++ b/tests/workflows/platform_receipt.py
@@ -0,0 +1,55 @@
+"""Observe an explicit daemon after resource qualification; no context mutation."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import ActionError
+import rootless_platform as storage
+from linux_performance import Runner, deadline_guard, document, require, safe_path
+from image_performance_images import fenced
+from rootless_functional import source_seal
+from rootless_resources import private_aliases
+
+FORMAT = ('{"engineId":{{json .ID}},"os":{{json .OSType}},"architecture":{{json .Architecture}},'
+          '"operatingSystem":{{json .OperatingSystem}},"securityOptions":{{json .SecurityOptions}}}')
+
+
+def run(socket, output, owner, deadline):
+    endpoint = "unix://" + str(socket)
+    before = source_seal(owner, deadline)
+    reply = owner.run(["docker", "--host", endpoint, "info", "--format", FORMAT], deadline)
+    require(reply.code == 0 and reply.stderr == b"", "platform-info")
+    value = document(reply.stdout)
+    require(set(value) == {"engineId", "os", "architecture", "operatingSystem", "securityOptions"}
+            and value["os"] == "linux" and value["architecture"] in ("arm64", "aarch64")
+            and isinstance(value["securityOptions"], list) and len(value["securityOptions"]) <= 32
+            and all(isinstance(row, str) and len(row) <= 256 for row in value["securityOptions"])
+            and isinstance(value["operatingSystem"], str) and len(value["operatingSystem"]) <= 256, "platform-info-shape")
+    for tail in (["ps", "--all", "--quiet"], ["volume", "ls", "--quiet"]):
+        require(fenced(owner, endpoint, value["engineId"], ["docker", "--host", endpoint] + tail, deadline) == b"", "platform-resource-remnant")
+    raw = fenced(owner, endpoint, value["engineId"], ["docker", "--host", endpoint, "image", "ls", "--all", "--format", "{{.Repository}}:{{.Tag}}"], deadline)
+    private_aliases(raw)
+    require(source_seal(owner, deadline) == before, "platform-source-changed")
+    storage.publish(output, {"schemaVersion":1, "sourceSealSha256":hashlib.sha256(json.dumps(before,
+        sort_keys=True, separators=(",", ":")).encode()).hexdigest(), "daemon":value, "endpoint":endpoint,
+        "containersAbsent":True, "volumesAbsent":True, "privateAliasesAbsent":True,
+        "allChildGroupsJoined":not owner.unsettled})
+
+
+def main():
+    try:
+        require(len(sys.argv) == 3, "platform-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard(90, owner) as deadline:
+            run(safe_path(sys.argv[1]), safe_path(sys.argv[2]), owner, deadline)
+        return 0
+    except (ActionError, OSError, ValueError, TypeError, KeyError):
+        print("platform-receipt-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/provenance.json b/tests/workflows/provenance.json
new file mode 100644
index 00000000..5da63cd1
--- /dev/null
+++ b/tests/workflows/provenance.json
@@ -0,0 +1,17 @@
+{
+  "schemaVersion": 1,
+  "retrievedAt": "2026-10-25",
+  "awsModelCommit": "18e485ce1c8dbf29d47e5ce00d9b8513da95912c",
+  "awsModelSha256": "38dd64c074f5c05320978970dafa6e0f199ab2e33b6065232002e8a603c5f6ed",
+  "rustSdkSfn": "1.123.0",
+  "boto3": "1.43.118",
+  "botocore": "1.43.118",
+  "bollard": "0.21.1",
+  "winnow": "1.0.4",
+  "cloudDifferentialEvidence": false,
+  "vendorLocalstackCommit": "45dfee8ce27df00fcac3f91b8071c8156eb5c5c7",
+  "upstreamAwsValidationDates": {
+    "nestedSync": "2023-06-30",
+    "nestedSync2": "2023-08-12"
+  }
+}
diff --git a/tests/workflows/provided_zip_archive_sdk.py b/tests/workflows/provided_zip_archive_sdk.py
new file mode 100644
index 00000000..b4b4d096
--- /dev/null
+++ b/tests/workflows/provided_zip_archive_sdk.py
@@ -0,0 +1,145 @@
+"""Signed mixed ZIP/Image archive preparation and post-restart computation."""
+import contextlib
+import json
+import os
+from pathlib import Path
+import sys
+import time
+import uuid
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+
+import boto3
+from botocore.config import Config
+
+from lambda_fault_support import Metadata
+from provided_zip_sdk import Provided, digest
+from required_suites import read_regular
+
+
+def canonical(value):
+    return json.loads(json.dumps(value, default=lambda value: value.isoformat()))
+
+
+def execution(sfn, arn):
+    deadline = time.monotonic() + 90
+    while True:
+        result = sfn.describe_execution(executionArn=arn)
+        assert time.monotonic() < deadline, "archive workflow observation expired"
+        if result["status"] != "RUNNING":
+            assert result["status"] == "SUCCEEDED", result
+            return {key: canonical(result[key]) for key in
+                ("executionArn", "stateMachineArn", "status", "input", "output", "startDate", "stopDate")}
+        time.sleep(0.025)
+
+
+def history(sfn, arn):
+    reply = sfn.get_execution_history(executionArn=arn, maxResults=100)
+    assert "nextToken" not in reply and 1 <= len(reply["events"]) <= 100
+    return canonical(reply["events"])
+
+
+def configuration(matrix, name, qualifier=None):
+    options = {} if qualifier is None else {"Qualifier": qualifier}
+    reply = matrix.client.get_function_configuration(FunctionName=name, **options)
+    keys = ("FunctionArn", "CodeSha256", "CodeSize", "RevisionId", "Version",
+        "PackageType", "Runtime", "Handler", "Timeout", "MemorySize", "Architectures", "Environment")
+    return {key: canonical(reply.get(key)) for key in keys}
+
+
+def image_call(matrix, name, counter):
+    reply = matrix.client.invoke(FunctionName=name, Payload=b'{"value":35}')
+    with reply["Payload"] as stream:
+        raw = stream.read(65537)
+    assert len(raw) <= 65536 and reply["StatusCode"] == 200 and "FunctionError" not in reply
+    output = json.loads(raw)
+    assert output["computed"] == 42 and output["counter"] == counter and output["uid"] == 1000
+    return output
+
+
+def prepare(matrix, sfn, image):
+    name = matrix.create()
+    matrix.computed(name, 21, counter=1)
+    matrix.computed(name, 23, counter=2)
+    assert matrix.client.publish_version(FunctionName=name)["Version"] == "1"
+    alias = matrix.client.create_alias(FunctionName=name, Name="live", FunctionVersion="1")
+    matrix.client.update_function_code(FunctionName=name, ZipFile=matrix.codes[1])
+    assert matrix.settled(name, updating=True)["CodeSha256"] == digest(matrix.codes[1])
+    matrix.computed(name, 21, marker="B", counter=1)
+    _, version = matrix.computed(name, 23, qualifier="live", counter=1)
+    assert version == "1"
+    definition = {"StartAt":"Compute", "States":{"Compute":{"Type":"Task",
+        "Resource":"arn:aws:states:::lambda:invoke", "Parameters":{
+        "FunctionName":name, "Qualifier":"live", "Payload.$":"$"}, "End":True}}}
+    machine = sfn.create_state_machine(name="ZipArchive" + uuid.uuid4().hex,
+        roleArn="arn:aws:iam::000000000000:role/StepFunctions", definition=json.dumps(definition))["stateMachineArn"]
+    arn = sfn.start_execution(stateMachineArn=machine, input='{"n":21}')["executionArn"]
+    completed = execution(sfn, arn)
+    Provided.checked(json.loads(completed["output"])["Payload"], 21, "A")
+    image_name = "ZipArchiveImage" + uuid.uuid4().hex
+    matrix.client.create_function(FunctionName=image_name, Role="arn:aws:iam::000000000000:role/Docker",
+        PackageType="Image", Architectures=[matrix.architecture], Code={"ImageUri":image},
+        Timeout=30, MemorySize=128)
+    matrix.functions.append(image_name)
+    matrix.settled(image_name)
+    image_call(matrix, image_name, 1)
+    image_call(matrix, image_name, 2)
+    return {"name":name, "image":image_name, "latest":configuration(matrix, name),
+        "published":configuration(matrix, name, "1"), "imageConfig":configuration(matrix, image_name),
+        "aliasVersion":alias["FunctionVersion"], "aliasRevision":alias["RevisionId"],
+        "execution":completed, "history":history(sfn, arn), "machine":machine}
+
+
+def verify(matrix, sfn, saved):
+    # Qualification has retired its own probes; no archived work was resumed.
+    assert matrix.metadata.ids() == set(), "startup allocated a replay environment"
+    name = saved["name"]
+    assert configuration(matrix, name) == saved["latest"]
+    assert configuration(matrix, name, "1") == saved["published"]
+    assert configuration(matrix, saved["image"]) == saved["imageConfig"]
+    alias = matrix.client.get_alias(FunctionName=name, Name="live")
+    assert (alias["FunctionVersion"], alias["RevisionId"]) == (saved["aliasVersion"], saved["aliasRevision"])
+    arn = saved["execution"]["executionArn"]
+    assert execution(sfn, arn) == saved["execution"] and history(sfn, arn) == saved["history"]
+    matrix.computed(name, 21, marker="B", counter=1)
+    matrix.computed(name, 23, marker="B", counter=2)
+    _, executed = matrix.computed(name, 21, qualifier="live", counter=1)
+    assert executed == "1"
+    matrix.computed(name, 23, qualifier="1", counter=2)
+    image_call(matrix, saved["image"], 1)
+    image_call(matrix, saved["image"], 2)
+    fresh = sfn.start_execution(stateMachineArn=saved["machine"], input='{"n":23}')["executionArn"]
+    completed = execution(sfn, fresh)
+    Provided.checked(json.loads(completed["output"])["Payload"], 23, "A")
+    assert fresh != arn and execution(sfn, arn) == saved["execution"] and history(sfn, arn) == saved["history"]
+    return saved
+
+
+def main():
+    endpoint, zip_a, zip_b, architecture, image, phase, checkpoint, socket, owner, engine = sys.argv[1:]
+    codes = [read_regular(Path(path), 50 * 1024 * 1024) for path in (zip_a, zip_b)]
+    matrix = Provided(endpoint, codes, architecture, Metadata(socket, owner, engine))
+    try:
+        with contextlib.closing(boto3.client("stepfunctions", endpoint_url=endpoint,
+                region_name="us-east-1", aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                config=Config(retries={"max_attempts":0}, connect_timeout=2, read_timeout=60))) as sfn:
+            if phase == "prepare":
+                saved = prepare(matrix, sfn, image)
+            else:
+                assert phase == "verify"
+                original = json.loads(read_regular(Path(checkpoint), 65536))
+                assert original["zipSha256"] == [digest(code) for code in codes]
+                saved = verify(matrix, sfn, original["checkpoint"])
+            matrix.ready()
+    finally:
+        # Preserve control-plane resources for the archive owner; no live invocations remain.
+        matrix.client.close()
+    print(json.dumps({"schemaVersion":1, "zipSha256":[digest(code) for code in codes],
+        "phase":phase, "cases":(["original-ZIP-revisions", "mixed-Image", "terminal-history-checkpoint"]
+            if phase == "prepare" else ["original-ZIP-revisions", "mixed-Image", "terminal-history-no-replay", "cold-warm-after-restart"]),
+        "checkpoint":saved}), flush=True)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/workflows/provided_zip_fixture.py b/tests/workflows/provided_zip_fixture.py
new file mode 100644
index 00000000..26ed9259
--- /dev/null
+++ b/tests/workflows/provided_zip_fixture.py
@@ -0,0 +1,67 @@
+"""Deterministic immutable Linux ZIP bytes shared by Docker and Native resources."""
+import base64
+import hashlib
+import io
+import json
+from pathlib import Path
+import stat
+import sys
+import zipfile
+
+LIMIT = 50 * 1024 * 1024
+
+
+def digest(raw):
+    return base64.b64encode(hashlib.sha256(raw).digest()).decode("ascii")
+
+
+def package(bootstrap, marker):
+    assert marker in (b"A", b"B")
+    target = io.BytesIO()
+    with zipfile.ZipFile(target, "w", compression=zipfile.ZIP_STORED) as archive:
+        for name, raw, mode in (("bootstrap", bootstrap, 0o755), ("revision.txt", marker, 0o644)):
+            info = zipfile.ZipInfo(name, (1980, 1, 1, 0, 0, 0))
+            info.create_system = 3
+            info.external_attr = (stat.S_IFREG | mode) << 16
+            info.compress_type = zipfile.ZIP_STORED
+            archive.writestr(info, raw)
+    raw = target.getvalue()
+    assert len(raw) <= LIMIT
+    return raw
+
+
+def linux_elf(raw, architecture):
+    machine = {"arm64":183, "amd64":62}[architecture]
+    assert len(raw) >= 64 and raw[:7] == b"\x7fELF\x02\x01\x01"
+    assert int.from_bytes(raw[16:18], "little") in (2, 3)
+    assert int.from_bytes(raw[18:20], "little") == machine
+    assert int.from_bytes(raw[20:24], "little") == 1 and int.from_bytes(raw[52:54], "little") == 64
+
+
+def read(path):
+    with path.open("rb") as stream:
+        raw = stream.read(LIMIT + 1)
+    assert raw and len(raw) <= LIMIT
+    return raw
+
+
+def build(source, architecture, directory):
+    raw = read(source)
+    linux_elf(raw, architecture)
+    directory.mkdir(parents=True, exist_ok=True)
+    outputs = {}
+    for marker in (b"A", b"B"):
+        code = package(raw, marker)
+        name = "provided-" + marker.decode("ascii").lower() + ".zip"
+        pending = directory / (name + ".pending")
+        pending.write_bytes(code)
+        pending.replace(directory / name)
+        outputs[marker.decode("ascii")] = {"file":name, "bytes":len(code), "sha256":digest(code)}
+    manifest = {"schemaVersion":1, "architecture":architecture, "bootstrapSha256":digest(raw), "artifacts":outputs}
+    (directory / "provided-zip-manifest.json").write_text(json.dumps(manifest, sort_keys=True) + "\n")
+    print(json.dumps(manifest, sort_keys=True))
+
+
+if __name__ == "__main__":
+    assert len(sys.argv) == 4
+    build(Path(sys.argv[1]), sys.argv[2], Path(sys.argv[3]))
diff --git a/tests/workflows/provided_zip_io.py b/tests/workflows/provided_zip_io.py
new file mode 100644
index 00000000..9f62c0b7
--- /dev/null
+++ b/tests/workflows/provided_zip_io.py
@@ -0,0 +1,52 @@
+"""Causal allocation/cleanup disconnects through the same real daemon proxy."""
+import time
+
+from custom_ric_sdk import collecting
+from lambda_fault_support import Hold
+from provided_zip_sdk import Provided, variables
+
+
+class ProvidedIo(Provided):
+    def __init__(self, endpoint, codes, architecture, metadata, proxy):
+        super().__init__(endpoint, codes, architecture, metadata)
+        self.proxy, self.server_lost = proxy, False
+
+    def cancel_io(self, host, phase):
+        assert phase in ("create", "delete")
+        with collecting(lambda: Hold("initializing")) as hold:
+            environment = variables() if phase == "delete" else variables(
+                PROVIDED_HOLD_STAGE="initializing", IMAGE_FIXTURE_TOKEN=hold.token,
+                IMAGE_FIXTURE_COLLECTOR=f"{host}:{hold.server_port}")
+            name = self.create(Timeout=900, Environment={"Variables":environment})
+            hold.targets([name])
+            self.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+            self.proxy.arm(phase, self.metadata.owner)
+            event = {"n":21} if phase == "create" else {"n":21,"providedAction":"exit"}
+            connection = self.raw_invoke(name, event)
+            try:
+                record = self.proxy.wait(1, time.monotonic() + 20)[0]
+                rows = self.metadata.rows()
+                ids = {row["Id"] for row in rows}
+                assert len(ids) == 2 and record["id"] in ids
+                function = self.metadata.get("/containers/" + record["id"] + "/json")
+                assert function["State"]["Running"] is False
+                assert function["State"]["Status"] == ("created" if phase == "create" else "exited")
+                if phase == "delete":
+                    assert function["State"]["ExitCode"] == 23
+                connection.close()
+                self.expect_error(lambda: self.invoke(name, {"n":23}), "TooManyRequestsException")
+                assert self.metadata.ids() == ids
+                assert len(self.proxy.observed) == 1 and not self.proxy.released
+                self.proxy.release()
+                self.metadata.wait_ids(set(), time.monotonic() + 15)
+                if phase == "create":
+                    assert record["id"] not in self.proxy.starts
+                assert not hold.observed
+                self.ready()
+                self.cold(name)
+                self.delete(name)
+            finally:
+                connection.close()
+                self.proxy.restore()
+        return ["zip_" + phase + "-held-real-io", "retained-reserved-slot", "caller-disconnected",
+                "post-release-physical-retirement", "cold-computed-recovery"]
diff --git a/tests/workflows/provided_zip_sdk.py b/tests/workflows/provided_zip_sdk.py
new file mode 100644
index 00000000..29d430a8
--- /dev/null
+++ b/tests/workflows/provided_zip_sdk.py
@@ -0,0 +1,221 @@
+"""Signed ordinary provided.al2023 deployment, computation and causal cancellation."""
+import base64
+import contextlib
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import sys
+import time
+import uuid
+import zipfile
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+import boto3
+from botocore.config import Config
+
+from custom_ric_sdk import collecting
+from lambda_fault_sdk import Faults
+from lambda_fault_support import Hold, Metadata, recover_before
+from required_suites import read_regular
+
+
+def digest(raw):
+    return base64.b64encode(hashlib.sha256(raw).digest()).decode("ascii")
+
+
+def variables(**extra):
+    return dict(WORKFLOW_MODE="1", PROVIDED_QUALIFICATION="1", **extra)
+
+
+class Provided(Faults):
+    def __init__(self, endpoint, codes, architecture, metadata):
+        super().__init__(endpoint, "unused", architecture, metadata)
+        self.codes = codes
+
+    def create(self, **fields):
+        name = "ProvidedZip" + uuid.uuid4().hex
+        self.client.create_function(
+            FunctionName=name, Role="arn:aws:iam::000000000000:role/Docker",
+            Runtime="provided.al2023", Handler="handler.entry", PackageType="Zip",
+            Architectures=[self.architecture], Timeout=fields.pop("Timeout", 30),
+            MemorySize=128, Code={"ZipFile": self.codes[0]},
+            Environment=fields.pop("Environment", {"Variables":variables()}), **fields)
+        self.functions.append(name)
+        assert self.settled(name)["CodeSha256"] == digest(self.codes[0])
+        return name
+
+    def invoke(self, name, event=None, qualifier=None, failed=False, client=None):
+        options = {} if qualifier is None else {"Qualifier":qualifier}
+        reply = (self.client if client is None else client).invoke(FunctionName=name,
+            Payload=json.dumps(event or {}).encode(), **options)
+        with reply["Payload"] as body:
+            raw = body.read(65537)
+        assert len(raw) <= 65536 and reply["StatusCode"] == 200
+        output = json.loads(raw)
+        if output.get("errorType") == "ProvidedQualificationError":
+            raise AssertionError("provided fixture observation failed: " + output["errorMessage"])
+        assert reply.get("FunctionError") == ("Unhandled" if failed else None)
+        return output, reply.get("ExecutedVersion")
+
+    @staticmethod
+    def checked(output, n, marker, counter=None):
+        assert output["computed"] == n * 2 and output["codeMarker"] == marker
+        assert output["pid"] == 1
+        assert output["providedSandbox"] == {"codeReadOnly":True, "codeUid":0,
+                "codeGid":0, "codeMode":0o555, "tmpWritable":True}
+        assert str(uuid.UUID(output["request_id"])) == output["request_id"]
+        if counter is not None:
+            assert output["providedCounter"] == counter
+        return output
+
+    def computed(self, name, n, marker="A", counter=None, qualifier=None):
+        output, executed = self.invoke(name, {"n":n}, qualifier=qualifier)
+        return self.checked(output, n, marker, counter), executed
+
+    def cold(self, name):
+        self.client.update_function_configuration(FunctionName=name, Environment={"Variables":variables()}, Timeout=30)
+        self.settled(name, updating=True)
+        def invoke(remaining):
+            connect = min(0.1, remaining / 10)
+            with contextlib.closing(boto3.client("lambda", endpoint_url=self.endpoint,
+                    region_name="us-east-1", aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                    config=self.client.meta.config.merge(Config(connect_timeout=connect, read_timeout=remaining-connect)))) as client:
+                output, _ = self.invoke(name, {"n":21}, client=client)
+                return self.checked(output, 21, "A", 1)
+        recover_before(time.monotonic() + 10, invoke, lambda: not self.metadata.ids())
+
+    def deployments(self):
+        name = self.create()
+        self.computed(name, 21, counter=1)
+        self.computed(name, 23, counter=2)
+        version = self.client.publish_version(FunctionName=name)["Version"]
+        assert version == "1"
+        self.client.create_alias(FunctionName=name, Name="live", FunctionVersion=version)
+        self.computed(name, 21, qualifier="live")
+        before = self.client.get_function_configuration(FunctionName=name)
+        invalid = io.BytesIO()
+        with zipfile.ZipFile(invalid, "w") as archive:
+            archive.writestr("bootstrap", b"not a Linux executable")
+        self.expect_error(lambda: self.client.update_function_code(FunctionName=name, ZipFile=invalid.getvalue()), "InvalidParameterValueException")
+        after = self.client.get_function_configuration(FunctionName=name)
+        assert (after["RevisionId"], after["CodeSha256"]) == (before["RevisionId"], before["CodeSha256"])
+        self.expect_error(lambda: self.client.update_function_configuration(FunctionName=name, Runtime="python3.13"), "InvalidParameterValueException")
+        after = self.client.get_function_configuration(FunctionName=name)
+        assert (after["RevisionId"], after["CodeSha256"]) == (before["RevisionId"], before["CodeSha256"])
+        self.client.update_function_code(FunctionName=name, ZipFile=self.codes[1])
+        assert self.settled(name, updating=True)["CodeSha256"] == digest(self.codes[1])
+        self.computed(name, 21, marker="B", counter=1)
+        old, executed = self.computed(name, 23, qualifier="live")
+        assert old["codeMarker"] == "A" and executed == "1"
+        # Repeated immutable revision changes exercise eviction and snapshot IO.
+        for marker, index in (("A",0), ("B",1), ("A",0), ("B",1)):
+            self.client.update_function_code(FunctionName=name, ZipFile=self.codes[index])
+            assert self.settled(name, updating=True)["CodeSha256"] == digest(self.codes[index])
+            self.computed(name, 21, marker=marker, counter=1)
+            preserved, executed = self.computed(name, 23, qualifier="live")
+            assert preserved["codeMarker"] == "A" and executed == "1"
+        self.client.update_alias(FunctionName=name, Name="live", FunctionVersion=self.client.publish_version(FunctionName=name)["Version"])
+        self.computed(name, 21, marker="B", qualifier="live")
+        self.workflow(name)
+        self.delete(name)
+        return ["cold-warm-readonly", "transactional-rejection", "immutable-A-B-alias", "ASL-Lambda-computation"]
+
+    def workflow(self, name):
+        with contextlib.closing(boto3.client("stepfunctions", endpoint_url=self.endpoint,
+                region_name="us-east-1", aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                config=Config(retries={"max_attempts":0}, connect_timeout=2, read_timeout=60))) as sfn:
+            definition = {"StartAt":"Compute", "States":{"Compute":{"Type":"Task",
+                "Resource":"arn:aws:states:::lambda:invoke", "Parameters":{"FunctionName":name, "Qualifier":"live", "Payload.$":"$"}, "End":True}}}
+            machine = sfn.create_state_machine(name="ProvidedZip" + uuid.uuid4().hex,
+                roleArn="arn:aws:iam::000000000000:role/StepFunctions", definition=json.dumps(definition))["stateMachineArn"]
+            try:
+                execution = sfn.start_execution(stateMachineArn=machine, input='{"n":21}')["executionArn"]
+                deadline = time.monotonic() + 90
+                while True:
+                    result = sfn.describe_execution(executionArn=execution)
+                    assert time.monotonic() < deadline
+                    if result["status"] != "RUNNING":
+                        break
+                    time.sleep(0.025)
+                assert result["status"] == "SUCCEEDED", result
+                self.checked(json.loads(result["output"])["Payload"], 21, "B")
+            finally:
+                sfn.delete_state_machine(stateMachineArn=machine)
+
+    def faults(self):
+        completed = []
+        cases = (("init-error", {"INIT_FAIL":"1"}, {}, "function initialization failed", 30),
+                 ("handler-exit", {}, {"providedAction":"exit", "n":21}, "function exited with status 23; oom=false", 30),
+                 ("handler-timeout", {"SLEEP_SECS":"5"}, {"n":21}, "function timed out after 1s", 1))
+        for label, extra, event, message, seconds in cases:
+            name = self.create(Timeout=seconds, Environment={"Variables":variables(**extra)})
+            before = self.metadata.ids()
+            self.expect_error(lambda: self.invoke(name, event), "ServiceException", message)
+            assert self.metadata.ids() <= before, "failed environment survived returned error"
+            self.ready()
+            self.cold(name)
+            self.delete(name)
+            completed.append(label)
+        name = self.create()
+        output, _ = self.invoke(name, {}, failed=True)
+        assert output["errorType"] == "WorkflowInputError"
+        self.computed(name, 21, counter=1)
+        self.delete(name)
+        return completed + ["FunctionError-recovery"]
+
+    def disconnect(self, host, stage):
+        with collecting(lambda: Hold(stage)) as hold:
+            name = self.create(Timeout=900, Environment={"Variables":variables(
+                PROVIDED_HOLD_STAGE=stage, IMAGE_FIXTURE_TOKEN=hold.token,
+                IMAGE_FIXTURE_COLLECTOR=f"{host}:{hold.server_port}")})
+            hold.targets([name])
+            self.client.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+            started = time.monotonic()
+            cutoff = started + 20
+            assert hold.deadline > cutoff + 5
+            connection = self.raw_invoke(name, {"n":21})
+            try:
+                observed = hold.wait_seen(1, started + 15)[name]
+                assert observed["stage"] == stage and len(self.metadata.ids()) == 2
+                self.expect_error(lambda: self.invoke(name, {"n":23}), "TooManyRequestsException")
+            finally:
+                connection.close()
+            self.metadata.wait_ids(set(), cutoff)
+            assert time.monotonic() < cutoff < hold.deadline and not hold.released
+            self.ready()
+            self.cold(name)
+            self.delete(name)
+        return [stage + "-causal-disconnect", "physical-retirement", "cold-recovery"]
+
+
+def main():
+    endpoint, zip_a, zip_b, architecture, phase, host, socket, owner, engine = sys.argv[1:]
+    codes = [read_regular(Path(path), 50 * 1024 * 1024) for path in (zip_a, zip_b)]
+    assert codes[0] != codes[1]
+    matrix = Provided(endpoint, codes, architecture, Metadata(socket, owner, engine))
+    try:
+        if phase == "deployments":
+            cases = matrix.deployments()
+        elif phase == "faults":
+            cases = matrix.faults()
+        else:
+            assert phase in ("initializing", "busy")
+            cases = matrix.disconnect(host, phase)
+        matrix.ready()
+    finally:
+        primary = sys.exc_info()[1]
+        try:
+            matrix.cleanup()
+            matrix.client.close()
+        except BaseException:
+            if primary is None:
+                raise
+            primary.add_note("ZIP fixture cleanup also failed")
+    print(json.dumps({"schemaVersion":1, "zipSha256":[digest(code) for code in codes], "cases":cases}), flush=True)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/workflows/pulumi_archive.py b/tests/workflows/pulumi_archive.py
new file mode 100644
index 00000000..026a68bc
--- /dev/null
+++ b/tests/workflows/pulumi_archive.py
@@ -0,0 +1,299 @@
+"""Independent, bounded read-only tool-container archive and checkpoint oracle."""
+
+import hashlib
+from datetime import datetime
+import json
+import os
+from pathlib import Path
+import re
+import time
+
+from custom_ric_sdk import unique_object
+from lambda_fault_support import UnixHTTP
+
+CAP = 16 * 1024 * 1024
+FILE_CAP = 2 * 1024 * 1024
+SIGNATURE = "4dabf18193072939515e22adb298388d"
+SECRET = "1b47061264138c4ac30d75fd1eb44270"
+
+
+def require(value):
+    if not value:
+        raise ValueError("bounded IaC archive validation failed")
+
+
+def private(data, secrets):
+    require(isinstance(data, bytes) and len(data) <= CAP and len(secrets) == 2)
+    for secret in secrets:
+        require(isinstance(secret, bytes) and 1 <= len(secret) <= 256)
+        require(secret not in data)
+
+
+def document(data, secrets):
+    private(data, secrets)
+    try:
+        value = json.loads(data.decode("utf-8"), object_pairs_hook=unique_object)
+        pending, count = [(value, 0)], 0
+        while pending:
+            current, depth = pending.pop()
+            count += 1
+            require(depth <= 64 and count <= 65536)
+            if isinstance(current, str):
+                private(current.encode("utf-8"), secrets)
+            elif isinstance(current, dict):
+                require(len(current) <= 4096)
+                pending.extend((entry, depth + 1) for pair in current.items() for entry in pair)
+            elif isinstance(current, list):
+                require(len(current) <= 4096)
+                pending.extend((entry, depth + 1) for entry in current)
+        return value
+    except (ValueError, UnicodeError, RecursionError, AssertionError):
+        raise ValueError("bounded IaC JSON privacy validation failed") from None
+
+
+def log_private(data, secrets):
+    """Scan raw output and every bounded JSON string token in mixed CLI text."""
+    private(data, secrets)
+    require(len(data) <= FILE_CAP)
+    try:
+        text = data.decode("utf-8", "strict")
+        offset, tokens = 0, 0
+        while offset < len(text):
+            if text[offset] != '"':
+                offset += 1
+                continue
+            start = offset
+            offset += 1
+            escaped = False
+            while offset < len(text):
+                current = text[offset]
+                offset += 1
+                if current == '"' and not escaped:
+                    break
+                escaped = current == "\\" and not escaped
+            else:
+                raise ValueError("unclosed CLI JSON string")
+            tokens += 1
+            require(tokens <= 65536)
+            value = json.loads(text[start:offset])
+            require(isinstance(value, str))
+            private(value.encode("utf-8"), secrets)
+    except (ValueError, UnicodeError):
+        raise ValueError("bounded IaC log privacy validation failed") from None
+
+
+def evidence_directory(value):
+    require(isinstance(value, str) and len(value.encode()) <= 4096 and "\x00" not in value and os.path.isabs(value))
+    # macOS /var and /tmp are system aliases. Normalize the already-owned root,
+    # then create a new private child rather than assuming tempfile's mode.
+    root = Path(value).resolve(strict=True)
+    require(root.is_dir() and root.stat().st_uid == os.getuid())
+    private_root = root / "iac-private"
+    private_root.mkdir(mode=0o700)
+    require(private_root.stat().st_mode & 0o777 == 0o700)
+    return private_root
+
+
+def number(field):
+    require(not field.startswith(bytes([128])))
+    value = field.rstrip(b"\x00 ").lstrip(b" ") or b"0"
+    require(all(48 <= c <= 55 for c in value))
+    return int(value, 8)
+
+
+def unpack(data, root, secrets):
+    require(isinstance(data, bytes) and len(data) <= CAP and len(data) % 512 == 0)
+    private(data, secrets)
+    require(root in ("backend", "logs"))
+    offset, entries, files = 0, 0, {}
+    while offset + 512 <= len(data):
+        header = data[offset:offset + 512]
+        offset += 512
+        if header == bytes(512):
+            require(data[offset:offset + 512] == bytes(512) and not any(data[offset:]))
+            return files
+        entries += 1
+        require(entries <= 128 and number(header[148:156]) == sum(header[:148]) + 8 * 32 + sum(header[156:]))
+        require(header[257:263] in (b"ustar\x00", b"ustar "))
+        name = header[:100].split(b"\x00", 1)[0]
+        prefix = header[345:500].split(b"\x00", 1)[0]
+        name = ((prefix + b"/") if prefix else b"") + name
+        require(len(name) <= 512 and b"\\" not in name and not name.startswith(b"/"))
+        name = name.decode("utf-8", "strict").rstrip("/")
+        parts = name.split("/")
+        require(1 <= len(parts) <= 8 and all(part not in ("", ".", "..") for part in parts) and parts[0] == root)
+        size, kind = number(header[124:136]), header[156:157]
+        require(size <= FILE_CAP and kind in (b"0", b"\x00", b"5") and not any(header[157:257]))
+        require(offset + ((size + 511) // 512) * 512 <= len(data))
+        body = data[offset:offset + size]
+        require(not any(data[offset + size:offset + ((size + 511) // 512) * 512]))
+        offset += ((size + 511) // 512) * 512
+        if kind == b"5":
+            require(size == 0)
+            continue
+        require(name not in files)
+        log_private(body, secrets)
+        if name.endswith((".json", ".json.bak")):
+            document(body, secrets)
+        elif root == "logs":
+            require(name.endswith((".stdout", ".stderr")))
+        files[name] = body
+    raise ValueError("truncated IaC archive")
+
+
+def checkpoint(files, observation, stage, target_arn, secrets):
+    require(set(observation) == {"path", "present", "bytes", "sha256"})
+    require(observation["path"] == "backend/.pulumi/stacks/rustack-iac/fixture.json")
+    source = files.get(observation["path"])
+    require(observation["present"] is (stage != "post-removal"))
+    if stage == "post-removal":
+        require(source is None and observation["bytes"] == 0 and observation["sha256"] == "")
+        return
+    require(source is not None and len(source) == observation["bytes"] and hashlib.sha256(source).hexdigest() == observation["sha256"])
+    value = document(source, secrets)
+    require(value.get("version") == 3)
+    current = value["checkpoint"]
+    require(isinstance(current, dict) and current.get("stack") == "organization/rustack-iac/fixture")
+    latest = current.get("latest")
+    require(isinstance(latest, dict) and isinstance(latest.get("manifest"), dict))
+    manifest = latest["manifest"]
+    version = manifest.get("version")
+    require(version in ("3.273.0", "v3.273.0") and
+            manifest.get("magic") == hashlib.sha256(version.encode()).hexdigest())
+    stamp = manifest.get("time")
+    require(isinstance(stamp, str) and len(stamp) <= 64 and
+            re.fullmatch(r"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,9})?(?:Z|[+-][0-9]{2}:[0-9]{2})", stamp) is not None)
+    require(datetime.fromisoformat(stamp.replace("Z", "+00:00")).tzinfo is not None)
+    resources = latest.get("resources", [])
+    require(isinstance(resources, list) and 0 <= len(resources) <= 3)
+    require(all(isinstance(entry, dict) for entry in resources))
+    targets = [entry for entry in resources if entry.get("type") == "aws:sfn/stateMachine:StateMachine"]
+    if stage == "pre-destroy":
+        require(len(targets) == 1 and targets[0]["id"] == target_arn)
+        providers = [entry for entry in resources if entry.get("type") == "pulumi:providers:aws"]
+        require(len(providers) == 1)
+        for name in ("accessKey", "secretKey"):
+            encrypted = providers[0]["inputs"][name]
+            require(isinstance(encrypted, dict) and encrypted.get(SIGNATURE) == SECRET and
+                    isinstance(encrypted.get("ciphertext"), str) and 1 <= len(encrypted["ciphertext"]) <= 4096 and
+                    "plaintext" not in encrypted and "value" not in encrypted)
+    else:
+        require(stage == "post-destroy" and not targets)
+
+
+def exec_stream(response, cutoff):
+    data, frames = bytearray(), 0
+    def exact(count, allow_eof=False):
+        result = bytearray()
+        while len(result) < count:
+            require(time.monotonic() < cutoff)
+            value = response.read(min(65536, count - len(result)))
+            require(time.monotonic() < cutoff)
+            if not value and allow_eof and not result:
+                return None
+            require(value)
+            result.extend(value)
+        return bytes(result)
+    while True:
+        header = exact(8, allow_eof=True)
+        if header is None:
+            break
+        frames += 1
+        require(frames <= 4096 and header[0] in (1, 2) and header[1:4] == bytes(3))
+        size = int.from_bytes(header[4:], "big")
+        require(0 < size <= 2 * 1024 * 1024 and len(data) + size <= CAP)
+        content = exact(size)
+        require(header[0] == 1)  # Reader errors never cross the host diagnostic boundary.
+        data.extend(content)
+    return bytes(data)
+
+
+def exec_complete(observed, key, container, command):
+    config = observed["ProcessConfig"]
+    require(observed["ID"] == key and observed["ContainerID"] == container and
+            config["entrypoint"] == command[0] and config["arguments"] == command[1:] and
+            config["privileged"] is False and config["tty"] is False and config["user"] == "1000:1000" and
+            type(observed["Running"]) is bool)
+    if observed["Running"]:
+        return False
+    require(type(observed["ExitCode"]) is int and observed["ExitCode"] == 0)
+    return True
+
+
+class Archive:
+    def __init__(self, metadata, row, source, secrets):
+        self.metadata, self.row, self.source, self.secrets = metadata, row, source, secrets
+        require(re.fullmatch(r"sha256:[0-9a-f]{64}", source) is not None)
+        require(row["Labels"]["rustack.lambda.role"] == "function")
+
+    def request(self, method, target, payload, cutoff):
+        require(time.monotonic() < cutoff)
+        connection = UnixHTTP(self.metadata.path)
+        try:
+            identity = self.metadata.read(connection, "/v" + self.metadata.api + "/info")["ID"]
+            require(identity == self.metadata.engine and connection.sock is not None)
+            encoded = json.dumps(payload, separators=(",", ":")).encode() if payload is not None else None
+            require(encoded is None or len(encoded) <= 2048)
+            connection.request(method, "/v" + self.metadata.api + target, body=encoded,
+                               headers={"Content-Type": "application/json"} if encoded is not None else {})
+            response = connection.getresponse()
+            require(response.status in (200, 201))
+            raw = response.read(65537)
+            require(len(raw) <= 65536 and time.monotonic() < cutoff)
+            return document(raw, self.secrets)
+        finally:
+            connection.close()
+
+    def exec_read(self, request_id, root, cutoff):
+        command = ["/var/lang/bin/node", "/var/task/pulumi/evidence_reader.js", request_id, root]
+        self.progress = "exec-create"
+        created = self.request("POST", "/containers/" + self.row["Id"] + "/exec", {
+            "AttachStdin": False, "AttachStdout": True, "AttachStderr": True, "Tty": False,
+            "Privileged": False, "User": "1000:1000", "Cmd": command,
+        }, cutoff)
+        require(set(created) == {"Id"} and re.fullmatch(r"[0-9a-f]{64}", created["Id"]) is not None)
+        key = created["Id"]
+        connection = UnixHTTP(self.metadata.path)
+        try:
+            identity = self.metadata.read(connection, "/v" + self.metadata.api + "/info")["ID"]
+            require(identity == self.metadata.engine and connection.sock is not None)
+            self.progress = "exec-start"
+            connection.request("POST", "/v" + self.metadata.api + "/exec/" + key + "/start",
+                               body=b'{"Detach":false,"Tty":false}', headers={"Content-Type": "application/json"})
+            response = connection.getresponse()
+            require(response.status == 200)
+            self.progress = "exec-stream"
+            data = exec_stream(response, cutoff)
+        finally:
+            connection.close()
+        self.progress = "exec-join"
+        while True:
+            observed = self.request("GET", "/exec/" + key + "/json", None, cutoff)
+            if exec_complete(observed, key, self.row["Id"], command):
+                require(time.monotonic() < cutoff)
+                return data
+            require(observed["Running"] is True and time.monotonic() < cutoff)
+            time.sleep(min(0.025, max(0, cutoff - time.monotonic())))
+
+    def read(self, request_id, root, retain=None):
+        require(re.fullmatch(r"[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}", request_id) is not None)
+        require(root in ("backend", "logs"))
+        cutoff = time.monotonic() + 20
+        self.progress = "inspect"
+        current = self.metadata.get("/containers/" + self.row["Id"] + "/json")
+        require(current["Id"] == self.row["Id"] and current["Config"]["Labels"] == self.row["Labels"] and
+                current["State"]["Running"] is True and current["Image"] == self.source)
+        data = self.exec_read(request_id, root, cutoff)
+        self.progress = "retain"
+        if retain is not None:
+            # Retain only the bounded raw TAR; no archive path becomes a host path.
+            require(retain.name == "iac-failure-" + request_id + "-" + root + ".tar")
+            descriptor = os.open(retain, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+            with os.fdopen(descriptor, "wb") as output:
+                require(output.write(data) == len(data))
+            require(time.monotonic() < cutoff)
+        self.progress = "unpack"
+        result = unpack(data, root, self.secrets)
+        require(time.monotonic() < cutoff)
+        self.progress = "complete"
+        return result
diff --git a/tests/workflows/pulumi_dependencies.py b/tests/workflows/pulumi_dependencies.py
new file mode 100644
index 00000000..7a9c5f46
--- /dev/null
+++ b/tests/workflows/pulumi_dependencies.py
@@ -0,0 +1,88 @@
+"""Serialize the task-owned, locked Pulumi fixture dependency installation."""
+
+import fcntl
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import stat
+import subprocess
+import sys
+import time
+
+
+SOURCE = Path(__file__).resolve().parent.parent / "lambda-fixtures" / "pulumi"
+VERSIONS = {"@pulumi/aws": "7.52.1", "@pulumi/pulumi": "3.273.0", "glob": "14.0.3", "minimatch": "11.0.3"}
+
+
+def manifest():
+    raw = (SOURCE / "package-lock.json").read_bytes()
+    assert len(raw) <= 2 * 1024 * 1024
+    lock = json.loads(raw)
+    assert lock["lockfileVersion"] == 3 and len(lock["packages"]) <= 1024
+    for key, value in lock["packages"].items():
+        if key:
+            assert value["resolved"].startswith("https://registry.npmjs.org/")
+            assert value["integrity"].startswith("sha512-")
+    return hashlib.sha256(raw + (SOURCE / "package.json").read_bytes()).hexdigest()
+
+
+def installed(fingerprint):
+    base = SOURCE / "node_modules"
+    try:
+        if (base / ".rustack-iac-lock").read_text() != fingerprint:
+            return False
+        for name, expected in VERSIONS.items():
+            path = base / name / "package.json"
+            if path.is_symlink() or json.loads(path.read_bytes())["version"] != expected:
+                return False
+        return True
+    except (OSError, ValueError, KeyError):
+        return False
+
+
+def prepare(cache):
+    assert cache.is_absolute() and not cache.is_symlink()
+    cache.mkdir(parents=True, exist_ok=True)
+    fingerprint = manifest()
+    flags = os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_CLOEXEC
+    fd = os.open(SOURCE / ".rustack-pulumi-install.lock", flags, 0o600)
+    with os.fdopen(fd, "r+b") as lock:
+        info = os.fstat(lock.fileno())
+        assert stat.S_ISREG(info.st_mode) and info.st_nlink == 1 and info.st_uid == os.getuid()
+        assert stat.S_IMODE(info.st_mode) == 0o600
+        deadline = time.monotonic() + 300
+        while True:
+            try:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                break
+            except BlockingIOError:
+                assert time.monotonic() < deadline, "fixture dependency lock expired"
+                time.sleep(0.025)
+        configs = cache / "config"
+        configs.mkdir(exist_ok=True)
+        for kind in ("user", "global"):
+            path = configs / kind
+            if not path.exists():
+                path.write_bytes(b"")
+            assert path.is_file() and not path.is_symlink() and path.stat().st_size == 0
+        if installed(fingerprint):
+            return
+        executable = shutil.which("npm")
+        assert executable is not None
+        environment = {"PATH": os.environ["PATH"], "LC_ALL": "C", "NPM_CONFIG_UPDATE_NOTIFIER": "false"}
+        remaining = deadline - time.monotonic()
+        assert remaining > 0
+        subprocess.run([executable, "ci", "--ignore-scripts", "--no-fund", "--registry=https://registry.npmjs.org",
+            "--userconfig=" + str(configs / "user"), "--globalconfig=" + str(configs / "global"),
+            "--cache=" + str(cache)], cwd=SOURCE, env=environment, stdin=subprocess.DEVNULL,
+            check=True, timeout=remaining)
+        assert time.monotonic() < deadline
+        (SOURCE / "node_modules" / ".rustack-iac-lock").write_text(fingerprint)
+        assert installed(fingerprint), "fixture dependency installation differs"
+
+
+if __name__ == "__main__":
+    assert len(sys.argv) == 2
+    prepare(Path(sys.argv[1]))
diff --git a/tests/workflows/pulumi_image_sdk.py b/tests/workflows/pulumi_image_sdk.py
new file mode 100644
index 00000000..591b1e9f
--- /dev/null
+++ b/tests/workflows/pulumi_image_sdk.py
@@ -0,0 +1,351 @@
+"""Real Pulumi CLI lifecycle in an owned image Lambda; this child spawns no process."""
+
+import hashlib
+import json
+import os
+import re
+import sys
+import time
+import uuid
+
+from botocore.exceptions import ClientError
+from custom_ric_sdk import unique_object
+from lambda_fault_support import Metadata, invoke_json, poll_response
+from node_image_sdk import deployed
+from pulumi_archive import Archive, checkpoint, document, evidence_directory, private, require
+
+VERSIONS = {"cli": "3.273.0", "provider": "7.52.1", "sdk": "3.273.0", "aws": "7.52.1",
+            "node": "24.22.1", "dynamodb": "3.1105.0"}
+COMMANDS = ("version", "login", "init", "create", "refresh-created", "update", "refresh-updated",
+            "reject-publish", "recover-publish", "settle-publish", "reject-logging", "recover-logging", "settle-logging",
+            "reject-encryption", "recover-encryption", "settle-encryption", "destroy", "remove")
+STAGES = (("created", 4), ("refreshed-created", 5), ("updated", 6), ("refreshed-updated", 7),
+          ("rejected-publish", 8), ("recovered-publish", 10), ("rejected-logging", 11), ("recovered-logging", 13),
+          ("rejected-encryption", 14), ("recovered-encryption", 16),
+          ("pre-destroy", 16), ("post-destroy", 17), ("post-removal", 18))
+SECRETS = (b"local-key", b"local-secret")
+
+
+def canonical_uuid(value):
+    require(isinstance(value, str) and len(value) == 36 and str(uuid.UUID(value, version=4)) == value)
+
+
+def expected_definition(business, value):
+    require(value in (21, 23))
+    return {"StartAt": "Call", "States": {"Call": {"Type": "Task", "Resource": "arn:aws:states:::lambda:invoke",
+        "Parameters": {"FunctionName": business, "Payload": {"value": value}},
+        "ResultSelector": {"computed.$": "$.Payload.computed", "requestId.$": "$.Payload.requestId",
+            "nodeVersion.$": "$.Payload.nodeVersion", "architecture.$": "$.Payload.architecture",
+            "counter.$": "$.Payload.counter"}, "End": True}}}
+
+
+class Driver:
+    def __init__(self, function, states, ddb, metadata, architecture, mode, evidence_root):
+        require(mode in ("lifecycle", "stop"))
+        self.function, self.states, self.ddb, self.metadata = function, states, ddb, metadata
+        self.architecture, self.mode, self.nonce = architecture, mode, uuid.uuid4().hex
+        self.tool, self.business, self.table = "IacTool" + self.nonce, "IacBusiness" + self.nonce, "IacControl" + self.nonce
+        self.target, self.controller = "IacTarget" + self.nonce, "IacController" + self.nonce
+        self.target_arn = "arn:aws:states:us-east-1:000000000000:stateMachine:" + self.target
+        self.role = "arn:aws:iam::000000000000:role/ImageIac"
+        self.executions, self.observations, self.audit_stages = [], [], []
+        self.business_requests, self.business_counter = [], 0
+        self.deadline = time.monotonic() + 960
+        self.progress = "start"
+        self.evidence_root = evidence_directory(evidence_root)
+
+    def fresh(self):
+        require(time.monotonic() < self.deadline)
+
+    def prepare(self, tool_image, business_image):
+        self.progress = "create-table"
+        self.ddb.create_table(TableName=self.table, BillingMode="PAY_PER_REQUEST",
+            KeySchema=[{"AttributeName": "id", "KeyType": "HASH"}], AttributeDefinitions=[{"AttributeName": "id", "AttributeType": "S"}])
+        poll_response(lambda: self.ddb.describe_table(TableName=self.table), lambda row: row["Table"]["TableStatus"] == "ACTIVE", 30)
+        for name, image, memory, timeout in ((self.business, business_image, 256, 30), (self.tool, tool_image, 1024, 720)):
+            self.progress = "create-business" if name == self.business else "create-tool"
+            result = self.function.create_function(FunctionName=name, Role=self.role, PackageType="Image",
+                Architectures=[self.architecture], Timeout=timeout, MemorySize=memory, Code={"ImageUri": image})
+            if name == self.business:
+                self.business_arn = result["FunctionArn"]
+            self.progress = "deploy-business" if name == self.business else "deploy-tool"
+            deployed(self.function, name)
+            self.function.put_function_concurrency(FunctionName=name, ReservedConcurrentExecutions=1)
+            require(self.function.get_function_concurrency(FunctionName=name)["ReservedConcurrentExecutions"] == 1)
+        self.progress = "probe-business"
+        self.business_probe()
+        self.business_ids = self.metadata.ids()
+        require(len(self.business_ids) == 2)
+        self.progress = "probe-tool"
+        response, probe = invoke_json(self.function, self.tool, {"mode": "probe"})
+        if "FunctionError" in response:
+            reason = probe.get("errorMessage")
+            allowed = {"bounded managed IaC fixture failed at " + stage for stage in
+                       ("validation", "provenance", "versions", "setup", "lifecycle")}
+            if reason in allowed:
+                print(reason, file=sys.stderr, flush=True)
+        require("FunctionError" not in response and probe["probe"] is True and probe["versions"] == VERSIONS and probe["counter"] == 1)
+        require(probe["architecture"] == {"arm64": "arm64", "x86_64": "x64"}[self.architecture])
+        canonical_uuid(probe["requestId"])
+        self.progress = "inspect-pairs"
+        rows = self.metadata.rows()
+        self.tool_ids = {row["Id"] for row in rows} - self.business_ids
+        require(len(self.tool_ids) == 2)
+        function_rows = [row for row in rows if row["Id"] in self.tool_ids and row["Labels"]["rustack.lambda.role"] == "function"]
+        require(len(function_rows) == 1)
+        inspected = self.metadata.get("/containers/" + function_rows[0]["Id"] + "/json")
+        resolved = self.function.get_function(FunctionName=self.tool)["Code"]["ResolvedImageUri"]
+        require(resolved == "local://" + inspected["Image"])
+        self.archive = Archive(self.metadata, function_rows[0], resolved[len("local://"):], SECRETS)
+        total = 0
+        for row in rows:
+            inspected = self.metadata.get("/containers/" + row["Id"] + "/json")
+            memory = inspected["HostConfig"]["Memory"]
+            require(memory == (64 if row["Labels"]["rustack.lambda.role"] == "relay" else
+                              1024 if row["Id"] in self.tool_ids else 256) * 1024 * 1024)
+            require(inspected["HostConfig"]["MemorySwap"] == memory and inspected["State"]["Running"] is True)
+            total += memory
+        require(total == 1408 * 1024 * 1024)
+
+    def remember_business(self, value):
+        canonical_uuid(value["requestId"])
+        require(value["requestId"] not in self.business_requests and len(self.business_requests) < 16 and
+                type(value["counter"]) is int and value["counter"] == self.business_counter + 1)
+        self.business_requests.append(value["requestId"])
+        self.business_counter = value["counter"]
+
+    def business_probe(self):
+        response, value = invoke_json(self.function, self.business, {"value": 7})
+        require("FunctionError" not in response and value["computed"] == 14 and value["uid"] == 1000 and
+                value["rootReadOnly"] is True and value["temporaryRoundtrip"] is True)
+        self.remember_business(value)
+
+    def start(self):
+        event = {"mode": self.mode, "nonce": self.nonce, "table": self.table, "businessArn": self.business_arn, "target": self.target}
+        definition = {"StartAt": "Tool", "TimeoutSeconds": 840, "States": {"Tool": {
+            "Type": "Task", "Resource": "arn:aws:states:::lambda:invoke", "TimeoutSeconds": 780,
+            "Parameters": {"FunctionName": self.tool, "Payload": event}, "End": True}}}
+        self.controller_arn = self.states.create_state_machine(name=self.controller, roleArn=self.role,
+            definition=json.dumps(definition), type="STANDARD")["stateMachineArn"]
+        self.controller_execution = self.states.start_execution(stateMachineArn=self.controller_arn)["executionArn"]
+
+    def observe(self, stage, ordinal):
+        self.progress = "observe-" + stage
+        def read():
+            self.fresh()
+            controller = self.states.describe_execution(executionArn=self.controller_execution)
+            if controller["status"] != "RUNNING":
+                cause = controller.get("cause", "")
+                for label in ("validation", "provenance", "versions", "setup", "lifecycle"):
+                    if "bounded managed IaC fixture failed at " + label in cause:
+                        print("managed tool failed at " + label, file=sys.stderr, flush=True)
+                for kind in ("command-start", "command-end", "command-failed"):
+                    result = self.ddb.get_item(TableName=self.table, ConsistentRead=True,
+                        Key={"id": {"S": self.nonce + ":" + self.mode + ":" + kind}})
+                    if "Item" in result:
+                        progress = document(result["Item"]["payload"]["S"].encode(), SECRETS)
+                        if progress.get("label") in COMMANDS and type(progress.get("ordinal")) is int and 0 <= progress["ordinal"] <= 20:
+                            code = progress.get("code")
+                            require(code is None or type(code) is int and 0 <= code <= 255)
+                            category = progress.get("category", "none")
+                            require(category in ("none", "module-missing", "plugin-missing", "home-missing", "user-missing", "permission",
+                                                 "readonly", "syntax", "invalid-flag", "provider-validation", "connection", "gate-not-reached", "gate-validation", "other"))
+                            print("managed tool " + kind + ":" + progress["label"] + ":" + str(progress["ordinal"]) + ":" + str(code) + ":" + category,
+                                  file=sys.stderr, flush=True)
+            require(controller["status"] == "RUNNING")
+            response = self.ddb.get_item(TableName=self.table, ConsistentRead=True,
+                Key={"id": {"S": self.nonce + ":" + self.mode + ":" + stage}})
+            self.fresh()
+            if "Item" not in response:
+                failure = self.ddb.get_item(TableName=self.table, ConsistentRead=True,
+                    Key={"id": {"S": self.nonce + ":" + self.mode + ":command-failed"}})
+                if "Item" in failure:
+                    failed = document(failure["Item"]["payload"]["S"].encode(), SECRETS)
+                    require(failed["nonce"] == self.nonce and failed["mode"] == self.mode and
+                            failed["label"] in COMMANDS and type(failed["ordinal"]) is int and 1 <= failed["ordinal"] <= 20)
+                    canonical_uuid(failed["requestId"])
+                    self.archive.read(failed["requestId"], "logs", self.evidence_root /
+                        ("iac-failure-" + failed["requestId"] + "-logs.tar"))
+                    raise ValueError("actual CLI failed before required live gate")
+            return response
+        result = poll_response(read, lambda row: "Item" in row, min(120, self.deadline - time.monotonic()))
+        item = result["Item"]
+        require(set(item) == {"id", "payload"} and len(json.dumps(item).encode()) <= 2048 and set(item["payload"]) == {"S"})
+        row = document(item["payload"]["S"].encode(), SECRETS)
+        require(row["nonce"] == self.nonce and row["mode"] == self.mode and row["stage"] == stage and
+                row["ordinal"] == ordinal and row["targetArn"] == self.target_arn)
+        canonical_uuid(row["requestId"])
+        if not hasattr(self, "request_id"):
+            self.request_id = row["requestId"]
+        require(row["requestId"] == self.request_id)
+        if stage in ("created", "updated"):
+            require(set(row) == {"nonce", "mode", "stage", "ordinal", "requestId", "targetArn", "processes", "versions"} and row["versions"] == VERSIONS)
+            processes = row["processes"]
+            require(isinstance(processes, list) and 3 <= len(processes) <= 32)
+            for process in processes:
+                require(set(process) == {"pid", "group", "provider", "language", "cli"} and
+                        all(type(process[key]) is int and 0 < process[key] < 2**31 for key in ("pid", "group")) and
+                        all(type(process[key]) is bool for key in ("provider", "language", "cli")))
+            require(all(any(process[kind] for process in processes) for kind in ("provider", "language", "cli")))
+            require(len({process["pid"] for process in processes}) == len(processes))
+        require(self.metadata.ids() == self.business_ids | self.tool_ids)
+        self.observations.append({"stage": stage, "ordinal": ordinal})
+        return row
+
+    def grant(self, stage, ordinal):
+        self.fresh()
+        self.ddb.put_item(TableName=self.table, Item={"id": {"S": "gate:" + self.nonce + ":" + self.mode + ":" + str(ordinal) + ":" + stage}, "open": {"BOOL": True}})
+        self.fresh()
+
+    def target_state(self, value):
+        response = self.states.describe_state_machine(stateMachineArn=self.target_arn)
+        require(response["stateMachineArn"] == self.target_arn and response["name"] == self.target and
+                response["roleArn"] == self.role and response["type"] == "STANDARD" and response["status"] == "ACTIVE")
+        require(json.loads(response["definition"], object_pairs_hook=unique_object) == expected_definition(self.business_arn, value))
+        tags = self.states.list_tags_for_resource(resourceArn=self.target_arn)["tags"]
+        require(len(tags) == 2 and {tag["key"]: tag["value"] for tag in tags} == {"Fixture": self.nonce, "Value": str(value)})
+        versions = self.states.list_state_machine_versions(stateMachineArn=self.target_arn, maxResults=1000)
+        require(versions["stateMachineVersions"] == [] and not versions.get("nextToken"))
+        revision = response["revisionId"]
+        require(isinstance(revision, str) and 1 <= len(revision) <= 256)
+        return revision, hashlib.sha256(response["definition"].encode()).hexdigest()
+
+    def execute_target(self, expected):
+        arn = self.states.start_execution(stateMachineArn=self.target_arn)["executionArn"]
+        require(isinstance(arn, str) and len(arn) <= 256 and
+                arn.startswith("arn:aws:states:us-east-1:000000000000:execution:" + self.target + ":") and
+                arn not in self.executions)
+        self.executions.append(arn)
+        result = poll_response(lambda: self.states.describe_execution(executionArn=arn), lambda row: row["status"] != "RUNNING", 40)
+        require(result["status"] == "SUCCEEDED")
+        value = document(result["output"].encode(), SECRETS)
+        require(set(value) == {"computed", "requestId", "nodeVersion", "architecture", "counter"} and value["computed"] == expected and
+                value["nodeVersion"] == "24.22.1" and value["architecture"] == {"arm64": "arm64", "x86_64": "x64"}[self.architecture] and
+                type(value["counter"]) is int and value["counter"] >= 2)
+        self.remember_business(value)
+
+    def absent_target(self):
+        try:
+            self.states.describe_state_machine(stateMachineArn=self.target_arn)
+        except ClientError as error:
+            require(error.response["Error"]["Code"] == "StateMachineDoesNotExist")
+        else:
+            raise ValueError("IaC target still exists")
+        listed = self.states.list_state_machines(maxResults=1000)
+        require(not listed.get("nextToken") and all(row["stateMachineArn"] != self.target_arn for row in listed["stateMachines"]))
+
+    def audit(self, stage, row):
+        require(set(row) == {"nonce", "mode", "stage", "ordinal", "requestId", "targetArn", "checkpoint", "commands"})
+        count = row["ordinal"]
+        require(isinstance(row["commands"], list) and len(row["commands"]) == count)
+        for command, (ordinal, label) in zip(row["commands"], enumerate(COMMANDS[:count], 1), strict=True):
+            require(set(command) == {"ordinal", "label", "code"} and command["ordinal"] == ordinal and command["label"] == label)
+            require(type(command["code"]) is int and (1 <= command["code"] <= 255 if label.startswith("reject-") else command["code"] == 0))
+        backend = self.archive.read(self.request_id, "backend")
+        checkpoint(backend, row["checkpoint"], stage, self.target_arn, SECRETS)
+        logs = self.archive.read(self.request_id, "logs")
+        require(len(logs) == count * 2)
+        for ordinal, label in enumerate(COMMANDS[:count], 1):
+            stdout = logs["logs/" + str(ordinal) + "-" + label + ".stdout"]
+            stderr = logs["logs/" + str(ordinal) + "-" + label + ".stderr"]
+            private(stdout + stderr, SECRETS)
+            if label.startswith("reject-"):
+                require(b"ValidationException" in stdout + stderr)
+            elif label == "version":
+                require(stdout.strip() == b"v3.273.0")
+        self.audit_stages.append(stage)
+
+    def exercise(self):
+        self.start()
+        row = self.observe("created", 4)
+        initial = self.target_state(21)
+        self.execute_target(42)
+        if self.mode == "stop":
+            self.states.stop_execution(executionArn=self.controller_execution, error="Stopped")
+            self.metadata.wait_ids(self.business_ids, time.monotonic() + 40)
+            result = self.states.describe_execution(executionArn=self.controller_execution)
+            require(result["status"] == "ABORTED" and result["error"] == "Stopped")
+            self.business_probe()
+            require(self.metadata.ids() == self.business_ids)
+            self.states.delete_state_machine(stateMachineArn=self.target_arn)
+            self.absent_target()
+            self.states.delete_state_machine(stateMachineArn=self.controller_arn)
+            return
+        self.grant("created", 4)
+        self.observe("refreshed-created", 5)
+        require(self.target_state(21) == initial)
+        self.grant("refreshed-created", 5)
+        self.observe("updated", 6)
+        updated = self.target_state(23)
+        require(updated[0] != initial[0] and updated[1] != initial[1])
+        self.execute_target(46)
+        self.grant("updated", 6)
+        self.observe("refreshed-updated", 7)
+        require(self.target_state(23) == updated)
+        self.grant("refreshed-updated", 7)
+        for negative, ordinal in (("publish", 8), ("logging", 11), ("encryption", 14)):
+            stage = "rejected-" + negative
+            self.observe(stage, ordinal)
+            require(self.target_state(23) == updated)
+            self.execute_target(46)
+            self.grant(stage, ordinal)
+            recovered = "recovered-" + negative
+            self.observe(recovered, ordinal + 2)
+            actual = self.target_state(23)
+            require(actual[1] == updated[1])
+            updated = actual
+            self.execute_target(46)
+            self.grant(recovered, ordinal + 2)
+        for stage, ordinal in STAGES[-3:]:
+            row = self.observe(stage, ordinal)
+            if stage == "pre-destroy":
+                require(self.target_state(23) == updated)
+            else:
+                self.absent_target()
+            self.audit(stage, row)
+            self.grant(stage, ordinal)
+        result = poll_response(lambda: self.states.describe_execution(executionArn=self.controller_execution), lambda value: value["status"] != "RUNNING", 30)
+        require(result["status"] == "SUCCEEDED")
+        output = document(result["output"].encode(), SECRETS)["Payload"]
+        require(output == {"requestId": self.request_id, "versions": VERSIONS, "commandCount": 18})
+        self.absent_target()
+        self.states.delete_state_machine(stateMachineArn=self.controller_arn)
+        self.business_probe()
+
+
+def exercise(endpoint, tool_image, business_image, architecture, socket, owner, engine, mode, evidence_root):
+    import boto3
+    from botocore.config import Config
+    clients = []
+    try:
+        settings = dict(endpoint_url=endpoint, region_name="us-east-1", aws_access_key_id="local-key", aws_secret_access_key="local-secret",
+                        config=Config(retries={"max_attempts": 0}, connect_timeout=2, read_timeout=100))
+        for service in ("lambda", "stepfunctions", "dynamodb"):
+            clients.append(boto3.client(service, **settings))
+        driver = Driver(*clients, Metadata(socket, owner, engine), architecture, mode, evidence_root)
+        try:
+            driver.prepare(tool_image, business_image)
+            driver.exercise()
+        except Exception as error:
+            kind = "sdk" if isinstance(error, ClientError) else "timeout" if isinstance(error, TimeoutError) else "validation"
+            print("managed IaC observation failed: " + driver.progress + ":" + kind, file=sys.stderr, flush=True)
+            point = getattr(getattr(driver, "archive", None), "progress", None)
+            if point in ("inspect", "connect", "request", "status-200", "status-400", "status-403", "status-404", "status-500", "status-other", "read", "retain", "unpack", "exec-create", "exec-start", "exec-stream", "exec-join"):
+                print("managed IaC archive failed: " + point, file=sys.stderr, flush=True)
+            raise
+        return {"schemaVersion": 1, "mode": mode, "versions": VERSIONS, "stages": driver.observations,
+            "audits": driver.audit_stages, "commands": list(COMMANDS) if mode == "lifecycle" else list(COMMANDS[:4]),
+            "executions": driver.executions, "businessRequests": driver.business_requests, "requestId": driver.request_id,
+            "physicalStop": mode == "stop", "actualDestroy": mode == "lifecycle"}
+    finally:
+        for client in reversed(clients):
+            client.close()
+
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+    try:
+        print(json.dumps(exercise(*sys.argv[1:])), flush=True)
+    except Exception:
+        print("managed image IaC driver failed", file=sys.stderr, flush=True)
+        sys.exit(1)
diff --git a/tests/workflows/release_bundle.py b/tests/workflows/release_bundle.py
new file mode 100644
index 00000000..cb921929
--- /dev/null
+++ b/tests/workflows/release_bundle.py
@@ -0,0 +1,62 @@
+"""Copy only validated, explicitly referenced release evidence into an artifact."""
+import os
+from pathlib import Path
+import stat
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import ActionError
+from linux_performance import Runner, deadline_guard, require
+from release_qualification import assemble, member
+
+
+def pack(source, destination, owner, deadline):
+    metadata = source.stat()
+    require(stat.S_ISDIR(metadata.st_mode) and metadata.st_uid == os.getuid()
+            and stat.S_IMODE(metadata.st_mode) == 0o700, "bundle-private-source")
+    require(not os.path.lexists(destination), "bundle-destination-exists")
+    report = assemble(source, owner, deadline)
+    require(report["candidateRunId"] == os.environ.get("CANDIDATE_RUN_ID"), "bundle-candidate-run")
+    selected = {"bundle.json"} | set(report["candidateSeals"])
+    for candidate in report["candidates"].values():
+        selected.add(candidate["archive"])
+    for lane in report["lanes"].values():
+        selected.add(lane["path"])
+        selected.update(lane["receipts"])
+    require(len(selected) <= 2048, "bundle-file-count")
+    destination.mkdir(mode=0o700)
+    total = 0
+    for name in sorted(selected):
+        path = member(source, name, 2 * 1024 * 1024 * 1024, minimum=0)
+        total += path.stat().st_size
+        require(total <= 6 * 1024 * 1024 * 1024, "bundle-total-bound")
+        target = destination / name
+        target.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        with path.open("rb") as incoming, target.open("xb") as outgoing:
+            os.chmod(target, 0o600)
+            remaining = path.stat().st_size
+            while remaining:
+                block = incoming.read(min(remaining, 1024 * 1024))
+                require(block, "bundle-copy-truncated")
+                remaining -= len(block)
+                outgoing.write(block)
+            require(incoming.read(1) == b"", "bundle-copy-grew")
+            outgoing.flush()
+            os.fsync(outgoing.fileno())
+    require(assemble(destination, owner, deadline) == report, "bundle-copy-changed")
+
+
+def main():
+    try:
+        require(len(sys.argv) == 3, "bundle-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard(600, owner) as deadline:
+            pack(Path(sys.argv[1]).resolve(strict=True), Path(sys.argv[2]).absolute(), owner, deadline)
+        return 0
+    except (ActionError, OSError, ValueError, TypeError, KeyError):
+        print("release-bundle-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/release_delivery.py b/tests/workflows/release_delivery.py
new file mode 100644
index 00000000..c10b66ab
--- /dev/null
+++ b/tests/workflows/release_delivery.py
@@ -0,0 +1,174 @@
+"""Immutable candidate sealing and promotion; registry effects are explicit only."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import tarfile
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import ActionError
+import release_json as storage
+from release_json import document
+from linux_performance import Runner, bounded_read, deadline_guard, require
+from release_qualification import archive_hash, archive_identity, assemble, digest, member
+from rootless_functional import source_seal
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def checked(owner, arguments, deadline):
+    reply = owner.run(arguments, deadline, stdout_limit=65536)
+    require(reply.code == 0 and reply.stderr == b"", "delivery-command-failed")
+    return reply.stdout
+
+
+def source_identity(owner, deadline):
+    commit = checked(owner, ["git", "-C", str(ROOT), "rev-parse", "HEAD"], deadline).decode().strip()
+    source = source_seal(owner, deadline)
+    seal = digest(json.dumps(source, sort_keys=True, separators=(",", ":")).encode())
+    return commit, seal
+
+
+def seal(root, architecture, owner, deadline):
+    require(architecture in ("arm64", "amd64"), "delivery-architecture")
+    commit, source = source_identity(owner, deadline)
+    name = "release-" + architecture + ".tar"
+    size, hashed = archive_hash(member(root, name, 2 * 1024 * 1024 * 1024))
+    image = "rustack/workflows-release:integration-" + architecture
+    raw = checked(owner, ["docker", "image", "inspect", image, "--format",
+        '{"id":{{json .Id}},"os":{{json .Os}},"architecture":{{json .Architecture}}}'], deadline)
+    value = document(raw)
+    require(set(value) == {"id", "os", "architecture"} and value["os"] == "linux"
+            and value["architecture"] == architecture and re.fullmatch(r"sha256:[0-9a-f]{64}", value["id"]),
+            "delivery-image-platform")
+    config_digest = archive_identity(root / name, architecture, value["id"])
+    if architecture == "arm64":
+        from release_image import ARCHIVE_LIMIT, verify
+        verify(bounded_read(root / name, ARCHIVE_LIMIT), "arm64", config_digest)
+    storage.publish(root / ("candidate-" + architecture + ".json"), {"schemaVersion":1, "commit":commit,
+        "sourceSealSha256":source, "architecture":architecture, "archive":name, "archiveBytes":size,
+        "archiveSha256":hashed, "imageId":value["id"], "configDigest":config_digest})
+
+
+def authenticated_api(owner, endpoint, deadline):
+    token = os.environ.get("GH_TOKEN", "")
+    require(1 <= len(token) <= 4096 and "\n" not in token and "\r" not in token, "delivery-api-credential")
+    previous = owner.environment.pop("GH_TOKEN", None)
+    owner.environment["GH_TOKEN"] = token
+    try:
+        return checked(owner, ["gh", "api", endpoint], deadline)
+    finally:
+        owner.environment.pop("GH_TOKEN", None)
+        if previous is not None:
+            owner.environment["GH_TOKEN"] = previous
+
+
+def check_runs(owner, deadline):
+    repository, commit = os.environ.get("GITHUB_REPOSITORY", ""), os.environ.get("GITHUB_SHA", "")
+    require(re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", repository), "delivery-repository")
+    requested = (("CANDIDATE_RUN_ID", ".github/workflows/release-docker.yml"),
+                 ("QUALIFICATION_RUN_ID", ".github/workflows/qualify-workflows.yml"))
+    if "EVIDENCE_RUN_ID" in os.environ:
+        requested = (("CANDIDATE_RUN_ID", ".github/workflows/release-docker.yml"), ("EVIDENCE_RUN_ID", ".github/workflows/workflows-evidence.yml"))
+    for variable, workflow in requested:
+        run = os.environ.get(variable, "")
+        require(re.fullmatch(r"[1-9][0-9]{0,19}", run), "delivery-run-id")
+        value = document(authenticated_api(owner, "repos/" + repository + "/actions/runs/" + run, deadline))
+        require(value.get("conclusion") == "success" and value.get("status") == "completed"
+                and value.get("head_sha") == commit and (workflow is None or value.get("path") == workflow)
+                and value.get("head_repository", {}).get("full_name") == repository
+                and value.get("event") in ("push", "workflow_dispatch"), "delivery-run-affiliation")
+
+
+def verify(root, owner, deadline):
+    check_runs(owner, deadline)
+    report = assemble(root, owner, deadline)
+    require(report["candidateRunId"] == os.environ.get("CANDIDATE_RUN_ID"), "delivery-candidate-run-differs")
+    saved = document(bounded_read(root / "release-report.json", 1024 * 1024))
+    require(report == saved, "delivery-report-changed")
+    # Verify loaded config IDs before registry credentials are introduced.
+    for architecture, value in report["candidates"].items():
+        archive = member(root, value["archive"], 2 * 1024 * 1024 * 1024)
+        loaded = owner.run(["docker", "image", "load", "--input", str(archive)], deadline)
+        require(loaded.code == 0, "delivery-load-failed")
+        raw = checked(owner, ["docker", "image", "inspect", value["imageId"], "--format", "{{.Id}}"], deadline)
+        require(raw.decode().strip() == value["imageId"], "delivery-loaded-image-differs")
+    return report
+
+
+def pushed_digest(stdout, stderr):
+    require(len(stdout) <= 65536 and len(stderr) <= 65536, "delivery-push-output-bound")
+    matches = re.findall(rb"digest: (sha256:[0-9a-f]{64}) size: [0-9]+", stdout + b"\n" + stderr)
+    require(len(matches) == 1, "delivery-push-digest")
+    return matches[0].decode("ascii")
+
+
+def registry_manifest(raw, expected_digest, expected_config):
+    require(1 <= len(raw) <= 65536, "delivery-manifest-bound")
+    require("sha256:" + digest(raw) == expected_digest
+            or (raw.endswith(b"\n") and "sha256:" + digest(raw[:-1]) == expected_digest), "delivery-manifest-digest-differs")
+    value = document(raw)
+    require(value.get("schemaVersion") == 2 and value.get("mediaType") in
+            ("application/vnd.oci.image.manifest.v1+json", "application/vnd.docker.distribution.manifest.v2+json")
+            and isinstance(value.get("config"), dict) and value["config"].get("digest") == expected_config,
+            "delivery-unqualified-registry-config")
+
+
+def promote(root, owner, deadline):
+    report = verify(root, owner, deadline)
+    repository = os.environ["GITHUB_REPOSITORY"].lower()
+    version = os.environ.get("RELEASE_VERSION", "")
+    require(re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version) is not None and len(version) <= 32,
+            "delivery-release-version")
+    image = "ghcr.io/" + repository.rsplit("/", 1)[0] + "/rustack"
+    commit = report["commit"]
+    digests = []
+    for architecture, value in sorted(report["candidates"].items()):
+        target = image + ":candidate-" + commit + "-" + architecture
+        checked(owner, ["docker", "image", "tag", value["imageId"], target], deadline)
+        reply = owner.run(["docker", "image", "push", target], deadline, stdout_limit=65536)
+        require(reply.code == 0, "delivery-push-failed")
+        hashed = pushed_digest(reply.stdout, reply.stderr)
+        raw = checked(owner, ["docker", "buildx", "imagetools", "inspect", image + "@" + hashed, "--raw"], deadline)
+        registry_manifest(raw, hashed, value["configDigest"])
+        digests.append(image + "@" + hashed)
+    major, minor, _ = version.split(".")
+    arguments = ["docker", "buildx", "imagetools", "create"]
+    for tag in (version, major + "." + minor, major, "latest"):
+        arguments += ["--tag", image + ":" + tag]
+    reply = owner.run(arguments + digests, deadline)
+    require(reply.code == 0, "delivery-manifest-failed")
+    storage.publish(root / "promotion.json", {"schemaVersion":1, "commit":commit, "version":version,
+        "registryManifests":digests, "sourceImageIds":{key: value["imageId"] for key, value in report["candidates"].items()},
+        "allChildGroupsJoined":not owner.unsettled})
+
+
+def main():
+    try:
+        if len(sys.argv) == 2 and sys.argv[1] == "input-runs":
+            owner = Runner(os.environ)
+            with deadline_guard(60, owner) as deadline:
+                check_runs(owner, deadline)
+            return 0
+        require(len(sys.argv) >= 3, "delivery-arguments")
+        mode, root = sys.argv[1], Path(sys.argv[2]).resolve(strict=True)
+        owner = Runner(os.environ)
+        with deadline_guard(900, owner) as deadline:
+            if mode == "seal":
+                require(len(sys.argv) == 4, "delivery-seal-arguments")
+                seal(root, sys.argv[3], owner, deadline)
+            elif mode in ("verify", "promote"):
+                require(len(sys.argv) == 3, "delivery-promote-arguments")
+                if mode == "verify": verify(root, owner, deadline)
+                else: promote(root, owner, deadline)
+            else: require(False, "delivery-mode")
+        return 0
+    except (ActionError, OSError, ValueError, TypeError, KeyError, RecursionError, tarfile.TarError):
+        print("release-delivery-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/release_image.py b/tests/workflows/release_image.py
new file mode 100644
index 00000000..df735af5
--- /dev/null
+++ b/tests/workflows/release_image.py
@@ -0,0 +1,360 @@
+"""Bounded inspection of the actual release image; no container or extraction."""
+import gzip
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import re
+import resource
+import signal
+import shutil
+import stat
+import struct
+import sys
+import tarfile
+import tempfile
+import time
+import zlib
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[2] / "tools/github-action"))
+from metadata import document, endpoint, source_id, engine_id
+from process_owner import Runner
+from settings import ActionError
+
+MIB = 1024 * 1024
+ARCHIVE_LIMIT = 128 * MIB
+EXPANDED_LIMIT = 256 * MIB
+BINARY_LIMIT = 128 * MIB
+ENVIRONMENT = ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+               "GATEWAY_LISTEN=0.0.0.0:4566", "LOG_LEVEL=info", "SERVICES="]
+INSPECT = ('{"id":{{json .Id}},"os":{{json .Os}},"architecture":{{json .Architecture}},'
+           '"bytes":{{json .Size}},"config":{{json .Config}}}')
+TREE = {
+    "rustack": (0, 0, 0o755, "file"),
+    "etc": (0, 0, 0o755, "directory"),
+    "etc/ssl": (0, 0, 0o755, "directory"),
+    "etc/ssl/certs": (0, 0, 0o755, "directory"),
+    "etc/ssl/certs/ca-certificates.crt": (0, 0, 0o644, "file"),
+    "tmp": (65532, 65532, 0o1777, "directory"),
+    "data": (65532, 65532, 0o700, "directory"),
+    "run": (0, 0, 0o555, "directory"),
+    "run/rustack": (0, 0, 0o555, "directory"),
+    "run/rustack/docker.sock": (0, 0, 0o444, "file"),
+}
+
+
+class ImageError(ValueError):
+    """Fixed diagnostic codes, without candidate values or archive contents."""
+
+
+def require(condition, code):
+    if not condition:
+        raise ImageError(code)
+
+
+def digest(raw):
+    return "sha256:" + hashlib.sha256(raw).hexdigest()
+
+
+def configuration(value):
+    require(isinstance(value, dict), "image-configuration")
+    require(value.get("User") == "65532:65532" and value.get("WorkingDir") == "/data"
+            and value.get("Entrypoint") == ["/rustack"] and value.get("Cmd") in (None, [])
+            and value.get("Volumes") in (None, {}) and value.get("OnBuild") in (None, [])
+            and value.get("Env") == ENVIRONMENT, "image-configuration")
+    health = value.get("Healthcheck")
+    require(isinstance(health, dict) and set(health) <= {
+        "Test", "Interval", "Timeout", "StartPeriod", "StartInterval", "Retries"}, "image-health")
+    require(health.get("Test") == ["CMD", "/rustack", "--health-check"]
+            and health.get("Interval") == 2_000_000_000 and health.get("Timeout") == 4_000_000_000
+            and health.get("StartPeriod") == 1_000_000_000 and health.get("Retries") == 3
+            and health.get("StartInterval", 0) == 0
+            and all(type(health.get(key, 0)) is int for key in
+                    ("Interval", "Timeout", "StartPeriod", "StartInterval", "Retries")), "image-health")
+
+
+def canonical(name):
+    require(isinstance(name, str) and 0 < len(name.encode()) <= 256
+            and re.fullmatch(r"[A-Za-z0-9_.+/-]+", name) is not None
+            and all(part not in ("", ".", "..") for part in name.split("/")), "archive-path")
+    return name
+
+
+def _timing_pax(raw):
+    require(0 < len(raw) <= 1024, "archive-pax-bytes")
+    seen = set()
+    while raw:
+        space = raw.find(b" ")
+        require(1 <= space <= 4 and raw[:space].isdigit(), "archive-pax-length")
+        length = int(raw[:space])
+        require(space + 3 <= length <= len(raw), "archive-pax-length")
+        line, raw = raw[:length], raw[length:]
+        require(line.endswith(b"\n"), "archive-pax-newline")
+        key, separator, value = line[space + 1:-1].partition(b"=")
+        require(separator and key in (b"mtime", b"atime", b"ctime") and key not in seen
+                and 0 < len(value) <= 64 and re.fullmatch(rb"-?[0-9]+(?:\.[0-9]{1,9})?", value),
+                "archive-pax-field")
+        seen.add(key)
+    require(1 <= len(seen) <= 3, "archive-pax-fields")
+
+
+def _signature(member):
+    name = member.name[:-1] if member.isdir() and member.name.endswith("/") else member.name
+    return (canonical(name), member.uid, member.gid, member.mode, member.size, member.type, member.linkname)
+
+
+def _physical(raw, maximum_members):
+    offset, count, pending = 0, 0, False
+    members, physical_names = {}, set()
+    while offset + 512 <= len(raw):
+        block = raw[offset:offset + 512]
+        if not any(block):
+            require(len(raw) - offset >= 1024 and not any(raw[offset:]) and not pending,
+                    "archive-trailing")
+            return members
+        count += 1
+        require(count <= maximum_members, "archive-physical-count")
+        kind = block[156:157]
+        require(kind in (tarfile.REGTYPE, tarfile.AREGTYPE, tarfile.DIRTYPE, tarfile.XHDTYPE),
+                "archive-physical-type")
+        member = tarfile.TarInfo.frombuf(block, "utf-8", "strict")
+        name = _signature(member)[0]
+        require(name not in physical_names and member.type == kind and not member.linkname
+                and 0 <= member.size <= len(raw) and 0 <= member.uid <= 0xffffffff
+                and 0 <= member.gid <= 0xffffffff and 0 <= member.mode <= 0o7777,
+                "archive-physical-header")
+        physical_names.add(name)
+        start = offset + 512
+        padded = ((member.size + 511) // 512) * 512
+        require(start + padded <= len(raw), "archive-physical-size")
+        require(not any(raw[start + member.size:start + padded]), "archive-padding")
+        if kind == tarfile.XHDTYPE:
+            require(not pending and 0 < member.size <= 1024, "archive-pax-chain-or-size")
+            _timing_pax(raw[start:start + member.size])
+            pending = True
+        else:
+            require(member.isfile() or (member.isdir() and member.size == 0), "archive-physical-type")
+            members[name] = _signature(member)
+            pending = False
+        offset = start + padded
+    raise ImageError("archive-terminator")
+
+
+class Contents:
+    """A small regular-member table over bounded bytes; never filesystem extraction."""
+    def __init__(self, raw, maximum_members):
+        require(isinstance(raw, bytes) and 1024 <= len(raw) <= EXPANDED_LIMIT
+                and len(raw) % 512 == 0, "archive-bytes")
+        physical = _physical(raw, maximum_members)
+        self.archive = tarfile.open(fileobj=io.BytesIO(raw), mode="r:")
+        self.members = {}
+        for member in self.archive:
+            name = _signature(member)[0]
+            require(physical.get(name) == _signature(member), "archive-normalization")
+            require(len(self.members) < maximum_members and name not in self.members
+                    and (member.isfile() or (member.isdir() and member.size == 0)) and not member.linkname
+                    and 0 <= member.size <= len(raw), "archive-member")
+            require(set(member.pax_headers) <= {"mtime", "atime", "ctime"}
+                    and all(isinstance(v, str) and len(v) <= 64
+                            and re.fullmatch(r"-?[0-9]+(?:\.[0-9]{1,9})?", v)
+                            for v in member.pax_headers.values()), "archive-pax")
+            self.members[name] = member
+        require(set(self.members) == set(physical), "archive-normalized-members")
+        position = self.archive.fileobj.tell()
+        require(len(raw) - position >= 512 and not any(raw[position:]), "archive-trailing")
+
+    def read(self, name, maximum):
+        member = self.members.get(canonical(name))
+        require(member is not None and member.isfile() and member.size <= maximum, "archive-input")
+        with self.archive.extractfile(member) as source:
+            value = source.read(maximum + 1)
+        require(len(value) == member.size, "archive-truncated")
+        if name.startswith("blobs/sha256/"):
+            require(name == "blobs/sha256/" + digest(value)[7:], "archive-blob-digest")
+        return value
+
+
+def elf(raw, architecture):
+    require(len(raw) >= 64 and raw[:7] == b"\x7fELF\x02\x01\x01"
+            and struct.unpack_from("<H", raw, 16)[0] in (2, 3)
+            and struct.unpack_from("<I", raw, 20)[0] == 1, "image-elf")
+    machine = struct.unpack_from("<H", raw, 18)[0]
+    require(machine == {"arm64": 183, "amd64": 62}[architecture], "image-machine")
+    offset = struct.unpack_from("<Q", raw, 32)[0]
+    size, count = struct.unpack_from("<HH", raw, 54)
+    require(size == 56 and 1 <= count <= 128 and offset >= 64
+            and offset + size * count <= len(raw), "image-program-headers")
+    require(all(struct.unpack_from("<I", raw, offset + size * i)[0] != 3
+                for i in range(count)), "image-interpreter")
+    return machine
+
+
+def verify(raw, architecture, expected_id):
+    """Bind the saved graph and exact scratch filesystem to a captured image ID."""
+    try:
+        require(architecture in ("arm64", "amd64") and len(raw) <= ARCHIVE_LIMIT, "image-input")
+        source_id(expected_id)
+        outer = Contents(raw, 128)
+        manifests = document(outer.read("manifest.json", 16384))
+        require(isinstance(manifests, list) and len(manifests) == 1
+                and isinstance(manifests[0], dict), "image-manifest")
+        manifest = manifests[0]
+        config_raw = outer.read(manifest.get("Config"), 65536)
+        config_digest = digest(config_raw)
+        config = document(config_raw, maximum=65536, string_limit=4096)
+        require(isinstance(config, dict) and config.get("os") == "linux"
+                and config.get("architecture") == architecture, "image-platform")
+        configuration(config.get("config"))
+        root = config.get("rootfs")
+        layers = manifest.get("Layers")
+        require(isinstance(root, dict) and root.get("type") == "layers"
+                and isinstance(layers, list) and 1 <= len(layers) <= 8
+                and isinstance(root.get("diff_ids"), list)
+                and len(root["diff_ids"]) == len(layers), "image-layers")
+        graph = None
+        if expected_id != config_digest:
+            graph = document(outer.read("blobs/sha256/" + expected_id[7:], 65536), maximum=65536)
+            require(isinstance(graph, dict) and graph.get("schemaVersion") == 2
+                    and isinstance(graph.get("config"), dict)
+                    and graph["config"].get("digest") == config_digest
+                    and graph["config"].get("size") == len(config_raw)
+                    and isinstance(graph.get("layers"), list)
+                    and len(graph["layers"]) == len(layers), "image-identity")
+        filesystem, binary, total = {}, None, 0
+        for index, (name, expected) in enumerate(zip(layers, root["diff_ids"])):
+            stored = outer.read(name, ARCHIVE_LIMIT)
+            if graph is not None:
+                descriptor = graph["layers"][index]
+                require(isinstance(descriptor, dict) and descriptor.get("digest") == digest(stored)
+                        and descriptor.get("size") == len(stored), "image-layer-identity")
+            layer_raw = stored
+            if stored.startswith(b"\x1f\x8b"):
+                with gzip.GzipFile(fileobj=io.BytesIO(stored)) as compressed:
+                    layer_raw = compressed.read(EXPANDED_LIMIT - total + 1)
+            total += len(layer_raw)
+            require(total <= EXPANDED_LIMIT and digest(layer_raw) == expected, "image-layer-digest")
+            layer = Contents(layer_raw, 32)
+            for path, member in layer.members.items():
+                require(path in TREE, "image-extra-path")
+                kind = "file" if member.isfile() else "directory"
+                require((member.uid, member.gid, member.mode, kind) == TREE[path], "image-file-policy")
+                require(member.size == 0 if kind == "directory" or path.endswith("docker.sock")
+                        else member.size > 0, "image-file-size")
+                filesystem[path] = dict(uid=member.uid, gid=member.gid, mode=member.mode,
+                                        bytes=member.size, kind=kind)
+                if path == "rustack":
+                    binary = layer.read(path, BINARY_LIMIT)
+                elif path.endswith("ca-certificates.crt"):
+                    layer.read(path, MIB)
+        require(set(filesystem) == set(TREE) and binary is not None, "image-filesystem")
+        machine = elf(binary, architecture)
+        return dict(schemaVersion=1, image=expected_id, architecture=architecture,
+                    binarySha256=digest(binary), binaryBytes=len(binary), elfMachine=machine,
+                    elfInterpreter=False, configurationSha256=config_digest,
+                    archiveSha256=digest(raw), expandedBytes=total, filesystem=filesystem)
+    except ImageError:
+        raise
+    except (ActionError, EOFError, OSError, ValueError, TypeError, KeyError, struct.error, tarfile.TarError, zlib.error):
+        raise ImageError("image-archive-invalid") from None
+
+
+def _limit_file_output():
+    # This standalone fixture process and every exec child retain the kernel
+    # bound. No preexec callback or second process supervisor is involved.
+    soft, hard = resource.getrlimit(resource.RLIMIT_FSIZE)
+    available = [ARCHIVE_LIMIT] + [value for value in (soft, hard)
+                                 if value != resource.RLIM_INFINITY]
+    maximum = min(available)
+    require(maximum > 0, "image-file-limit")
+    resource.setrlimit(resource.RLIMIT_FSIZE, (maximum, maximum))
+
+
+def execute(architecture, socket, reference, program):
+    require(architecture in ("arm64", "amd64") and isinstance(reference, str)
+            and re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._/@:+-]{0,255}", reference), "image-arguments")
+    selected = endpoint("unix://" + socket)
+    require(isinstance(program, str) and 0 < len(os.fsencode(program)) <= 4096
+            and all(32 <= ord(char) <= 126 for char in program)
+            and (program == "docker" or program.startswith("/")), "image-cli")
+    runner = Runner(os.environ)
+    runner.pin_endpoint()
+    original = time.monotonic() + 180
+    def interrupted(_signal, _frame):
+        if not runner.retiring:
+            raise ImageError("image-observation-interrupted")
+    for number in (signal.SIGALRM, signal.SIGINT, signal.SIGTERM):
+        signal.signal(number, interrupted)
+    signal.setitimer(signal.ITIMER_REAL, 180)
+    def command(parts, cutoff):
+        reply = runner.run(base + parts, min(cutoff, original))
+        require(reply.code == 0, "image-command")
+        return reply.stdout
+    def engine(cutoff):
+        return engine_id(document(command(["info", "--format", "{{json .ID}}"],
+                                           min(cutoff, time.monotonic() + 5))))
+    try:
+        resolved = shutil.which(program)
+        require(resolved is not None and Path(resolved).is_file(), "image-cli")
+        base = [str(Path(resolved).resolve()), "--host", selected]
+        _limit_file_output()
+        root = Path(tempfile.mkdtemp(prefix="rustack-release-image-"))
+        require(stat.S_IMODE(root.stat().st_mode) == 0o700, "image-private-root")
+        print(json.dumps({"releaseImageEvidence": str(root)}), flush=True)
+        captured = engine(original)
+        def observed(parts, seconds):
+            cutoff = min(original, time.monotonic() + seconds)
+            require(engine(cutoff) == captured, "image-daemon-changed")
+            result = command(parts, cutoff)
+            require(engine(cutoff) == captured and time.monotonic() < cutoff, "image-late-observation")
+            return result
+        view_raw = observed(["image", "inspect", "--format", INSPECT, reference], 10)
+        view = document(view_raw, string_limit=4096)
+        require(isinstance(view, dict) and view.get("os") == "linux"
+                and view.get("architecture") == architecture and type(view.get("bytes")) is int
+                and 1 <= view["bytes"] <= 64 * MIB, "image-inspection")
+        selected_id = source_id(view.get("id"))
+        configuration(view.get("config"))
+        path = root / "image.tar"
+        observed(["image", "save", "--output", str(path), selected_id], 120)
+        remaining = min(10, original - time.monotonic())
+        require(remaining > 0, "image-original-deadline")
+        signal.setitimer(signal.ITIMER_REAL, remaining)
+        descriptor = os.open(path, os.O_RDONLY | os.O_NONBLOCK | os.O_NOFOLLOW)
+        with os.fdopen(descriptor, "rb") as source:
+            info = os.fstat(source.fileno())
+            require(stat.S_ISREG(info.st_mode) and info.st_nlink == 1
+                    and 0 < info.st_size <= ARCHIVE_LIMIT, "image-archive-file")
+            raw = source.read(ARCHIVE_LIMIT + 1)
+        require(len(raw) == info.st_size, "image-archive-observation")
+        os.chmod(path, 0o600)
+        report = verify(raw, architecture, selected_id)
+        require(time.monotonic() < original, "image-original-deadline")
+        report.update(engine=captured, reference=reference, inspectedImageBytes=view["bytes"],
+                      inspectionSha256=digest(view_raw), privateArchive=str(path))
+        target = root / "report.json"
+        descriptor = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(descriptor, "w") as output:
+            json.dump(report, output, indent=2)
+            output.write("\n")
+        require(time.monotonic() < original, "image-original-deadline")
+        print("Actual release image artifact verified: linux/" + architecture + "; " + selected_id)
+    finally:
+        signal.setitimer(signal.ITIMER_REAL, 0)
+
+
+def main():
+    try:
+        require(len(sys.argv) == 5, "image-arguments")
+        execute(*sys.argv[1:])
+    except ImageError as error:
+        print("Release image artifact rejected: " + str(error), file=sys.stderr)
+        return 1
+    except (ActionError, OSError, ValueError):
+        print("Release image artifact rejected: command-or-io", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/workflows/release_json.py b/tests/workflows/release_json.py
new file mode 100644
index 00000000..e47ea722
--- /dev/null
+++ b/tests/workflows/release_json.py
@@ -0,0 +1,78 @@
+"""Bounded release-evidence JSON with duplicate, depth and number rejection."""
+import json
+import math
+import os
+
+LIMIT = 1024 * 1024
+
+
+def document(raw):
+    if not isinstance(raw, bytes) or not 1 <= len(raw) <= LIMIT:
+        raise ValueError("release-json-byte-bound")
+    text = raw.decode("utf-8")
+    depth, quoted, escaped = 0, False, False
+    for character in text:
+        if quoted:
+            if character == '"' and not escaped:
+                quoted = False
+            escaped = character == "\\" and not escaped
+        elif character == '"':
+            quoted, escaped = True, False
+        elif character in "[{":
+            depth += 1
+            if depth > 16:
+                raise ValueError("release-json-depth")
+        elif character in "]}":
+            depth -= 1
+            if depth < 0:
+                raise ValueError("release-json-depth")
+    if quoted or depth:
+        raise ValueError("release-json-shape")
+    def pairs(rows):
+        result = {}
+        for key, value in rows:
+            if key in result or len(key.encode()) > 256:
+                raise ValueError("release-json-duplicate-key")
+            result[key] = value
+        return result
+    def integer(value):
+        if len(value) > 20:
+            raise ValueError("release-json-integer")
+        return int(value)
+    def floating(value):
+        number = float(value)
+        if not math.isfinite(number):
+            raise ValueError("release-json-float")
+        return number
+    def constant(_value):
+        raise ValueError("release-json-constant")
+    result = json.loads(text, object_pairs_hook=pairs, parse_int=integer, parse_float=floating, parse_constant=constant)
+    pending, count = [result], 0
+    while pending:
+        item = pending.pop()
+        count += 1
+        if count > 32768:
+            raise ValueError("release-json-member-bound")
+        if isinstance(item, str) and len(item.encode()) > 16384:
+            raise ValueError("release-json-string-bound")
+        if isinstance(item, dict):
+            pending.extend(item.values())
+        elif isinstance(item, list):
+            pending.extend(item)
+    return result
+
+
+def publish(path, value):
+    raw = json.dumps(value, separators=(",", ":"), allow_nan=False).encode()
+    if len(raw) > LIMIT:
+        raise ValueError("release-json-output-bound")
+    with path.open("xb") as output:
+        os.chmod(path, 0o600)
+        output.write(raw)
+        output.flush()
+        os.fsync(output.fileno())
+    descriptor = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
+    try:
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
diff --git a/tests/workflows/release_qualification.py b/tests/workflows/release_qualification.py
new file mode 100644
index 00000000..f42684d5
--- /dev/null
+++ b/tests/workflows/release_qualification.py
@@ -0,0 +1,468 @@
+"""Fail-closed, same-source final release evidence assembler (never publishes)."""
+from collections import Counter
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import sys
+import tarfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import ActionError
+import release_json as storage
+from release_json import document
+from linux_performance import MIB, QualificationError, Runner, bounded_read, deadline_guard, require
+from rootless_functional import source_seal
+
+ROOT = Path(__file__).resolve().parents[2]
+LANES = ("rust", "native", "linux-arm64", "rootless-arm64", "desktop", "reference", "release")
+HEX = r"[0-9a-f]{64}"
+COMMIT = r"[0-9a-f]{40}"
+LANE_LOG_BUDGET = 256 * MIB
+
+
+def digest(value):
+    return hashlib.sha256(value).hexdigest()
+
+
+def member(root, name, maximum, minimum=1):
+    require(isinstance(name, str) and re.fullmatch(r"[A-Za-z0-9_./-]{1,240}", name)
+            and all(part not in ("", ".", "..") for part in name.split("/")), "release-member-path")
+    path = root
+    for part in name.split("/"):
+        path = path / part
+        require(not path.is_symlink(), "release-member-symlink")
+    metadata = path.stat()
+    require(stat.S_ISREG(metadata.st_mode) and minimum <= metadata.st_size <= maximum, "release-member-bound")
+    return path
+
+
+def read(root, name, maximum=MIB, minimum=1):
+    return bounded_read(member(root, name, maximum, minimum), maximum)
+
+
+def archive_hash(path):
+    metadata = path.stat()
+    require(stat.S_ISREG(metadata.st_mode) and 1 <= metadata.st_size <= 2 * 1024 * MIB, "release-archive-bound")
+    size, hashed = 0, hashlib.sha256()
+    with path.open("rb") as source:
+        while True:
+            block = source.read(MIB)
+            if not block:
+                break
+            size += len(block)
+            require(size <= metadata.st_size, "release-archive-grew")
+            hashed.update(block)
+    require(size == metadata.st_size, "release-archive-changed")
+    return size, hashed.hexdigest()
+
+
+def archive_preflight(path):
+    size = path.stat().st_size
+    require(1024 <= size <= 2 * 1024 * MIB and size % 512 == 0, "release-physical-tar-size")
+    position, count, pending = 0, 0, False
+    with path.open("rb") as source:
+        while position < size:
+            header = source.read(512)
+            require(len(header) == 512, "release-physical-tar-truncated")
+            position += 512
+            if not any(header):
+                require(not pending and source.read(512) == bytes(512), "release-physical-tar-end")
+                while True:
+                    block = source.read(65536)
+                    if not block:
+                        return
+                    require(not any(block), "release-physical-tar-trailing")
+            count += 1
+            require(count <= 2048 and header[156:157] in (b"0", b"\0", b"5", b"x"), "release-physical-tar-type")
+            encoded = header[124:136].strip(b" \0")
+            checksum = header[148:156].strip(b" \0")
+            require(encoded and all(48 <= byte <= 55 for byte in encoded)
+                    and checksum and all(48 <= byte <= 55 for byte in checksum), "release-physical-tar-number")
+            length = int(encoded, 8)
+            require(int(checksum, 8) == sum(header[:148]) + 8 * 32 + sum(header[156:]), "release-physical-tar-checksum")
+            padded = ((length + 511) // 512) * 512
+            require(length <= 2 * 1024 * MIB and position + padded <= size, "release-physical-tar-body")
+            if header[156:157] == b"x":
+                from release_image import _timing_pax
+                require(not pending and 1 <= length <= 1024, "release-physical-pax-bound")
+                _timing_pax(source.read(length))
+                source.seek(padded - length, 1)
+                pending = True
+            else:
+                source.seek(padded, 1)
+                pending = False
+            position += padded
+    require(False, "release-physical-tar-missing-end")
+
+
+def archive_identity(path, architecture, image_id):
+    archive_preflight(path)
+    configs, manifest, count, total = {}, None, 0, 0
+    with tarfile.open(path, mode="r|") as archive:
+        for entry in archive:
+            count += 1
+            total += entry.size
+            require(count <= 1024 and total <= 2 * 1024 * MIB and len(entry.name) <= 512
+                    and not entry.name.startswith("/")
+                    and all(part not in (".", "..") for part in entry.name.rstrip("/").split("/"))
+                    and (entry.isfile() or entry.isdir()), "release-archive-member")
+            if entry.name == "manifest.json" or (entry.isfile() and entry.size <= MIB
+                    and (entry.name.endswith(".json") or re.fullmatch(r"blobs/sha256/" + HEX, entry.name))):
+                source = archive.extractfile(entry)
+                require(source is not None, "release-archive-config-file")
+                raw = source.read(MIB + 1)
+                require(len(raw) <= MIB, "release-archive-config-bound")
+                if entry.name == "manifest.json":
+                    require(manifest is None, "release-archive-duplicate-manifest")
+                    manifest = document(raw)
+                else:
+                    require(entry.name not in configs and len(configs) < 64, "release-archive-config-count")
+                    configs[entry.name] = raw
+    require(isinstance(manifest, list) and len(manifest) == 1 and isinstance(manifest[0], dict), "release-archive-manifest")
+    selected = manifest[0].get("Config")
+    require(isinstance(selected, str) and selected in configs, "release-archive-config-reference")
+    raw = configs[selected]
+    config = document(raw)
+    config_digest = "sha256:" + digest(raw)
+    require(config.get("architecture") == architecture and config.get("os") == "linux", "release-archive-config-identity")
+    current, visited = image_id, set()
+    while current != config_digest:
+        require(re.fullmatch("sha256:" + HEX, current) is not None and current not in visited and len(visited) < 3,
+                "release-archive-identity-graph")
+        visited.add(current)
+        graph_raw = configs.get("blobs/sha256/" + current[7:])
+        require(graph_raw is not None and "sha256:" + digest(graph_raw) == current, "release-archive-addressable-image")
+        graph = document(graph_raw)
+        if isinstance(graph.get("config"), dict):
+            require(graph["config"].get("digest") == config_digest
+                    and graph["config"].get("size") == len(raw), "release-archive-graph-config")
+            current = config_digest
+        else:
+            manifests = graph.get("manifests")
+            require(isinstance(manifests, list) and len(manifests) == 1 and isinstance(manifests[0], dict),
+                    "release-archive-single-platform-index")
+            current = manifests[0].get("digest")
+    return config_digest
+
+
+def exact_names(file):
+    manifest = document(bounded_read(ROOT / "tests/workflows" / file, 65536))
+    return {name for suite in manifest["suites"] for name in suite["tests"]}
+
+
+def expected_names(lane):
+    if lane == "rust":
+        return set()
+    if lane == "native":
+        return exact_names("required-suites.json") | exact_names("action-required-suites.json")
+    if lane in ("linux-arm64", "rootless-arm64", "desktop"):
+        return exact_names("docker-required-suites.json")
+    if lane == "reference":
+        from linux_performance import CASES
+        return set(CASES) | {"test_should_measure_one_hundred_warm_image_invocations",
+            "test_should_measure_twenty_preloaded_cold_image_environments",
+            "test_should_reuse_one_image_slot_after_one_hundred_log_flood_timeouts"}
+    return {"test_should_execute_image_sdk_and_nested_asl_from_the_release_image",
+            "test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup"}
+
+
+def identity(value, commit, seal):
+    require(type(value.get("schemaVersion")) is int and value["schemaVersion"] == 1 and value.get("commit") == commit
+            and value.get("sourceSealSha256") == seal, "release-source-binding")
+
+
+def candidate(root, name, commit, seal):
+    raw = read(root, name)
+    value = document(raw)
+    require(set(value) == {"schemaVersion", "commit", "sourceSealSha256", "architecture", "archive",
+                          "archiveBytes", "archiveSha256", "imageId", "configDigest"}, "release-candidate-shape")
+    identity(value, commit, seal)
+    require(value["architecture"] in ("arm64", "amd64")
+            and re.fullmatch("sha256:" + HEX, value["imageId"]) is not None, "release-candidate-identity")
+    path = member(root, value["archive"], 2 * 1024 * MIB)
+    size, hashed = archive_hash(path)
+    require(type(value["archiveBytes"]) is int and (size, hashed) ==
+            (value["archiveBytes"], value["archiveSha256"]), "release-candidate-archive")
+    require(archive_identity(path, value["architecture"], value["imageId"]) == value["configDigest"], "release-candidate-config-digest")
+    if value["architecture"] == "arm64":
+        from release_image import ARCHIVE_LIMIT, verify
+        verify(bounded_read(path, ARCHIVE_LIMIT), "arm64", value["configDigest"])
+    return value, digest(raw)
+
+
+def bound_document(root, name, receipts):
+    require(isinstance(name, str) and name in receipts, "release-unbound-producer-report")
+    return document(read(root, name))
+
+
+def release_resource(value, image_id):
+    require(isinstance(value, dict) and set(value) == {"schemaVersion", "profile", "mode", "architecture",
+            "server", "shutdown", "cleanup"} and type(value["schemaVersion"]) is int and value["schemaVersion"] == 1 and value["profile"] == "release"
+            and value["architecture"] == "arm64" and value["mode"] in ("sdk-nested", "gateway-rejection"), "release-consumer-shape")
+    server, shutdown, cleanup = value["server"], value["shutdown"], value["cleanup"]
+    require(isinstance(server, dict) and isinstance(shutdown, dict) and isinstance(cleanup, dict)
+            and server.get("source") == image_id and isinstance(server.get("id"), str)
+            and re.fullmatch(HEX, server["id"]) is not None
+            and shutdown.get("id") == server["id"] and shutdown.get("engine") == cleanup.get("engine") == server.get("engine")
+            and isinstance(server.get("engine"), str) and re.fullmatch(r"[0-9a-f-]{36}", server["engine"])
+            and shutdown.get("physicallyStopped") is True and type(shutdown.get("exitCode")) is int
+            and (shutdown["exitCode"] == 0 if value["mode"] == "sdk-nested" else 1 <= shutdown["exitCode"] <= 255)
+            and cleanup.get("schemaVersion") == 1 and cleanup.get("serverAbsent") is True
+            and cleanup.get("volumeAbsent") is True and cleanup.get("uncertain") is False,
+            "release-consumer-candidate-or-cleanup")
+    sources = cleanup.get("sourcesPreserved")
+    require(isinstance(sources, list) and len(sources) == 3 and all(isinstance(row, list) and len(row) == 2 for row in sources)
+            and sources[0][1] == image_id, "release-consumer-source-preservation")
+
+
+def execution_resources(root, qualification, receipts, seal, engine, endpoint):
+    from rootless_functional import SUITES
+    from rootless_resources import verify_output
+    from docker_required_suites import parse_manifest
+    required_raw = bounded_read(ROOT / "tests/workflows/docker-required-suites.json", 65536)
+    required = parse_manifest(required_raw)
+    count = sum(len(names) for names in required.values())
+    report = bound_document(root, qualification["executionReport"], receipts)
+    entry = bound_document(root, qualification["executionEntry"], receipts)
+    require(report.get("schemaVersion") == 1 and report.get("engine") == entry.get("engine") == engine
+            and report.get("scope") == "complete-functional-inventory" and report.get("failed") == []
+            and report.get("attempted") == report.get("passed") == count
+            and report.get("allChildGroupsJoined") is True and entry.get("sourceSealSha256") == seal
+            and entry.get("manifestSha256") == digest(required_raw)
+            and isinstance(entry.get("environment"), dict)
+            and "unix://" + entry["environment"].get("RUSTACK_RUNTIME_DOCKER_SOCKET", "") == endpoint,
+            "release-platform-execution-affiliation")
+    rows, cases = report.get("rows"), qualification["caseReceipts"]
+    require(isinstance(rows, list) and isinstance(cases, list) and len(rows) == len(cases) == count,
+            "release-platform-case-count")
+    seen = set()
+    for row, case in zip(rows, cases):
+        require(isinstance(case, dict) and set(case) == {"suite", "name", "intent", "result", "stdout", "stderr"}
+                and isinstance(row, dict) and row.get("suite") == case["suite"] and row.get("name") == case["name"]
+                and type(row.get("code")) is int and row["code"] == 0 and case["suite"] in required and case["name"] in required[case["suite"]]
+                and case["name"] not in seen, "release-platform-exact-case")
+        seen.add(case["name"])
+        for role, basename in (("intent", "intent.json"), ("result", "result.json"), ("stdout", "stdout"), ("stderr", "stderr")):
+            require(case[role] in receipts and Path(case[role]).name == basename
+                    and Path(case[role]).parent.name == Path(row.get("evidence", "")).name,
+                    "release-platform-case-binding")
+        intent = bound_document(root, case["intent"], receipts)
+        result = bound_document(root, case["result"], receipts)
+        require(type(result.get("code")) is int and result["code"] == 0 and result.get("stdoutSha256") == receipts[case["stdout"]]
+                and result.get("stderrSha256") == receipts[case["stderr"]], "release-platform-case-result")
+        expected = ["cargo", "test", "--locked", "--target-dir", entry.get("targetDirectory")]
+        expected += SUITES[case["suite"]] + ["--", "--ignored", "--exact", case["name"], "--show-output", "--test-threads=1"]
+        require(intent.get("argv") == expected, "release-platform-case-argv")
+        verify_output(read(root, case["stdout"], 16 * MIB), {case["name"]})
+
+
+def command_producer(root, details, hashed, seal, commands):
+    require(set(details) == {"gates", "report", "entry", "intents"}
+            and details["gates"] == [name for name, _ in commands], "release-rust-gates")
+    require(isinstance(details["intents"], list) and len(details["intents"]) == len(commands), "release-rust-intents")
+    report = bound_document(root, details["report"], hashed)
+    entry = bound_document(root, details["entry"], hashed)
+    require(report.get("schemaVersion") == entry.get("schemaVersion") == 1
+            and report.get("sourceSealSha256") == entry.get("sourceSealSha256") == seal
+            and report.get("allChildGroupsJoined") is True
+            and entry.get("gates") == [{"name":name, "argv":argv} for name, argv in commands]
+            and isinstance(report.get("gates"), list) and len(report["gates"]) == len(commands), "release-rust-producer")
+    for row, (gate, argv), intent_path in zip(report["gates"], commands, details["intents"]):
+        require(isinstance(row, dict) and row.get("name") == gate and row.get("argv") == argv
+                and type(row.get("code")) is int and row["code"] == 0, "release-rust-command")
+        logs = [name for name in hashed if Path(name).name == gate + ".log"]
+        require(len(logs) == 1 and hashed[logs[0]] == row.get("logSha256"), "release-rust-log-binding")
+        intent = bound_document(root, intent_path, hashed)
+        invocation = intent.get("argv")
+        require(isinstance(invocation, list) and len(invocation) == len(argv) + 5
+                and invocation[1:3] == ["-I", "-B"] and Path(invocation[3]).name == "gate_command.py"
+                and Path(invocation[4]).name == gate + ".log" and invocation[5:] == argv, "release-rust-intent-argv")
+        if gate != "fmt":
+            require(len(read(root, logs[0], 16 * MIB)) > 0, "release-empty-rust-log")
+        if gate in ("test", "feature-test", "doctest", "feature-doctest"):
+            log = read(root, logs[0], 16 * MIB).decode()
+            summaries = re.findall(r"^test result: ok\. [0-9]+ passed; ([0-9]+) failed;", log, re.MULTILINE)
+            require(summaries and all(value == "0" for value in summaries), "release-rust-test-summary")
+
+
+def lane(root, lane_path, label, commit, seal, candidate_ids):
+    raw = read(root, lane_path)
+    value = document(raw)
+    require(set(value) == {"schemaVersion", "lane", "commit", "sourceSealSha256", "status",
+            "allChildGroupsJoined", "tests", "receipts", "qualification"}, "release-lane-shape")
+    identity(value, commit, seal)
+    require(value["lane"] == label and value["status"] == "passed"
+            and value["allChildGroupsJoined"] is True, "release-lane-not-passed")
+    tests = value["tests"]
+    expected = expected_names(label)
+    require(isinstance(tests, list) and all(isinstance(row, str) for row in tests)
+            and len(tests) == len(set(tests)) and set(tests) == expected, "release-exact-inventory")
+    receipts = value["receipts"]
+    require(isinstance(receipts, list) and 1 <= len(receipts) <= 512, "release-receipt-count")
+    limits = {name:1 for name in expected}
+    if label == "native":
+        from native_gates import DOUBLED
+        require(set(DOUBLED) <= expected and len(set(DOUBLED)) == 3, "release-native-catalog-drift")
+        limits.update({name:2 for name in DOUBLED})
+    seen, observed, hashed = set(), Counter(), {}
+    total = 0
+    release_resources = []
+    for row in receipts:
+        require(isinstance(row, dict) and set(row) == {"path", "sha256", "code", "groupJoined"}
+                and type(row["code"]) is int and row["code"] == 0 and row["groupJoined"] is True
+                and row["path"] not in seen, "release-receipt-shape")
+        seen.add(row["path"])
+        path = member(root, row["path"], 16 * MIB, minimum=0)
+        total += path.stat().st_size
+        require(total <= LANE_LOG_BUDGET, "release-lane-log-budget")
+        content = bounded_read(path, 16 * MIB)
+        require(digest(content) == row["sha256"], "release-receipt-hash")
+        hashed[row["path"]] = row["sha256"]
+        text = content.decode("utf-8")
+        if label == "release":
+            for record in re.findall(r"(?:^|\.\.\. )WORKFLOWS_RELEASE_RESOURCE ([^\r\n]*)$", text, re.MULTILINE):
+                require(len(record) <= 16384 and len(release_resources) < 2, "release-consumer-receipt-bound")
+                release_resources.append(document(record.encode()))
+        require(not re.search(r"^test result: FAILED|^test .* \.\.\. FAILED$", text, re.MULTILINE), "release-failed-test")
+        if label in ("linux-arm64", "rootless-arm64", "desktop", "reference"):
+            continue  # These inventories come from bound typed producers below.
+        pattern = r"^test ([A-Za-z0-9_:]+) \.\.\. (?!ignored\b)" if label == "native" else r"^test ([A-Za-z0-9_:]+) \.\.\. ok$"
+        for match in re.finditer(pattern, text, re.MULTILINE):
+            test_name = match.group(1)
+            require(len(test_name) <= 512, "release-test-name-bound")
+            if test_name in expected:
+                observed[test_name] += 1
+                require(observed[test_name] <= limits[test_name], "release-repeated-resource")
+    if label not in ("linux-arm64", "rootless-arm64", "desktop", "reference"):
+        require(all(observed[test] == limits[test] for test in expected), "release-missing-or-repeated-test")
+    qualification = value["qualification"]
+    require(isinstance(qualification, dict), "release-qualification-shape")
+    if label == "rust":
+        from rust_gates import GATES
+        command_producer(root, qualification, hashed, seal, GATES)
+    elif label == "reference":
+        require(set(qualification) == {"referenceQualification", "os", "architecture", "physicalCpus", "exclusive",
+            "pureP95Micros", "warmOverheadP95Micros", "coldEndToEndP95Micros", "loadCycles", "pureReport", "imageReport"}
+            and qualification["referenceQualification"] == "qualified" and qualification["os"] == "linux"
+            and qualification["architecture"] == "arm64" and qualification["exclusive"] is True
+            and type(qualification["physicalCpus"]) is int and qualification["physicalCpus"] >= 4,
+            "release-reference-attestation")
+        for key, cap in (("pureP95Micros", 100000), ("warmOverheadP95Micros", 50000), ("coldEndToEndP95Micros", 5000000)):
+            require(type(qualification[key]) is int and 0 < qualification[key] <= cap, "release-reference-budget")
+        require(type(qualification["loadCycles"]) is int and qualification["loadCycles"] == 100, "release-load-count")
+        from linux_performance import CASES, validate_report
+        from image_performance_report import validate as validate_image
+        from linux_image_performance import CASES as IMAGE_CASES
+        pure = bound_document(root, qualification["pureReport"], hashed)
+        images = bound_document(root, qualification["imageReport"], hashed)
+        require(pure.get("processGroupsJoined") is True and pure.get("exactResourcesPassed") == list(CASES)
+                and isinstance(pure.get("reports"), list) and len(pure["reports"]) == 2, "release-reference-pure-producer")
+        for report, kind in zip(pure["reports"], ("pureLatency", "loopResponsiveness")):
+            validate_report(report, kind)
+        require(images.get("processGroupsJoined") is True and images.get("exactResourcesPassed") == list(IMAGE_CASES)
+                and len(set(CASES) | set(IMAGE_CASES)) == 5 and set(CASES) | set(IMAGE_CASES) == expected
+                and isinstance(images.get("reports"), list)
+                and len(images["reports"]) == 3, "release-reference-image-producer")
+        for report, phase in zip(images["reports"], ("warm", "cold", "cycles")):
+            require(report.get("os") == "linux" and report.get("architecture") in ("arm64", "aarch64"), "release-reference-image-platform")
+            validate_image(report, phase)
+        require(qualification["pureP95Micros"] == pure["reports"][0]["measurement"]["latency"]["p95Micros"]
+                and qualification["warmOverheadP95Micros"] == images["reports"][0]["measurement"]["overhead"]["p95Micros"]
+                and qualification["coldEndToEndP95Micros"] == images["reports"][1]["measurement"]["latency"]["p95Micros"]
+                and qualification["loadCycles"] == images["reports"][2]["measurement"]["completedCycles"], "release-reference-summary-differs")
+    elif label in ("linux-arm64", "rootless-arm64", "desktop"):
+        require(set(qualification) == {"os", "architecture", "engineId", "rootless", "desktop", "zeroOwnedRemnants", "platformReport", "executionReport", "executionEntry", "caseReceipts"}
+            and qualification["os"] == "linux" and qualification["architecture"] == "arm64"
+            and qualification["rootless"] is (label == "rootless-arm64")
+            and qualification["desktop"] is (label == "desktop") and qualification["zeroOwnedRemnants"] is True
+            and isinstance(qualification["engineId"], str) and 1 <= len(qualification["engineId"]) <= 128,
+            "release-platform-kind")
+        actual = bound_document(root, qualification["platformReport"], hashed)
+        require(actual.get("schemaVersion") == 1 and actual.get("sourceSealSha256") == seal
+                and actual.get("containersAbsent") is actual.get("volumesAbsent") is actual.get("privateAliasesAbsent") is True
+                and actual.get("allChildGroupsJoined") is True and isinstance(actual.get("daemon"), dict), "release-platform-producer")
+        daemon = actual["daemon"]
+        require(daemon.get("os") == "linux" and daemon.get("architecture") in ("arm64", "aarch64")
+                and daemon.get("engineId") == qualification["engineId"]
+                and isinstance(daemon.get("securityOptions"), list)
+                and ("name=rootless" in daemon["securityOptions"]) is qualification["rootless"]
+                and isinstance(daemon.get("operatingSystem"), str)
+                and daemon["operatingSystem"].startswith("Docker Desktop") is qualification["desktop"], "release-platform-attribution")
+        execution_resources(root, qualification, hashed, seal, daemon["engineId"], actual.get("endpoint"))
+    elif label == "release":
+        require(qualification == {"imageId": candidate_ids["arm64"], "zeroOwnedRemnants": True}, "release-tested-candidate")
+        require(len(release_resources) == 2 and {row.get("mode") for row in release_resources} ==
+                {"sdk-nested", "gateway-rejection"}, "release-consumer-modes")
+        for row in release_resources:
+            release_resource(row, candidate_ids["arm64"])
+    else:
+        from native_gates import GATES, HTTP
+        require(set(qualification) == {"nativeChildrenJoined", "gates", "report", "entry", "intents"}
+                and qualification["nativeChildrenJoined"] is True, "release-native-cleanup")
+        details = {key:value for key, value in qualification.items() if key != "nativeChildrenJoined"}
+        command_producer(root, details, hashed, seal, GATES)
+        for gate, _ in GATES:
+            paths = [name for name in hashed if Path(name).name == gate + ".log"]
+            require(len(paths) == 1, "release-native-gate-log")
+            text = read(root, paths[0], 16 * MIB).decode()
+            summaries = re.findall(r"^test result: (ok|FAILED)\. ([0-9]+) passed; ([0-9]+) failed; ([0-9]+) ignored;", text, re.MULTILINE)
+            require(summaries and all(row[0] == "ok" and row[2] == "0" for row in summaries), "release-native-terminal-summary")
+            if gate == "action":
+                require(summaries == [("ok", "1", "0", "0")], "release-action-terminal-summary")
+            else:
+                match = re.search(r"^test " + re.escape(HTTP) + r" \.\.\. (?!ignored)", text, re.MULTILINE)
+                require(match is not None, "release-native-http-start")
+                terminal = re.search(r"^test result: (ok|FAILED)\. ([0-9]+) passed; ([0-9]+) failed; ([0-9]+) ignored;",
+                                     text[match.end():], re.MULTILINE)
+                require(terminal is not None and terminal.groups() == ("ok", "1", "0", "0"), "release-native-http-terminal")
+    return {"path": lane_path, "sha256": digest(raw), "receipts": hashed}
+
+
+def assemble(root, owner, deadline):
+    bundle = document(read(root, "bundle.json"))
+    require(set(bundle) == {"schemaVersion", "commit", "sourceSealSha256", "candidateRunId", "candidates", "lanes"}
+            and type(bundle["schemaVersion"]) is int and bundle["schemaVersion"] == 1 and isinstance(bundle["candidateRunId"], str)
+            and re.fullmatch(r"[1-9][0-9]{0,19}|local", bundle["candidateRunId"]) is not None and re.fullmatch(COMMIT, bundle["commit"]) is not None
+            and re.fullmatch(HEX, bundle["sourceSealSha256"]) is not None, "release-bundle-shape")
+    commit = owner.run(["git", "-C", str(ROOT), "rev-parse", "HEAD"], deadline)
+    require(commit.code == 0 and commit.stderr == b"" and commit.stdout.decode().strip() == bundle["commit"], "release-commit")
+    source_before = source_seal(owner, deadline)
+    seal = digest(json.dumps(source_before, sort_keys=True, separators=(",", ":")).encode())
+    require(seal == bundle["sourceSealSha256"], "release-current-source")
+    require(isinstance(bundle["candidates"], list) and len(bundle["candidates"]) == 2
+            and isinstance(bundle["lanes"], dict) and set(bundle["lanes"]) == set(LANES), "release-missing-lane")
+    candidates, candidate_hashes = {}, {}
+    for name in bundle["candidates"]:
+        value, hashed = candidate(root, name, bundle["commit"], seal)
+        require(value["architecture"] not in candidates, "release-duplicate-candidate")
+        candidates[value["architecture"]] = value
+        candidate_hashes[name] = hashed
+    require(set(candidates) == {"arm64", "amd64"}, "release-candidate-architectures")
+    ids = {key: value["imageId"] for key, value in candidates.items()}
+    lanes = {label: lane(root, bundle["lanes"][label], label, bundle["commit"], seal, ids) for label in LANES}
+    require(source_seal(owner, deadline) == source_before, "release-source-changed-during-validation")
+    return {"schemaVersion": 1, "status": "passed", "commit": bundle["commit"], "sourceSealSha256": seal,
+            "candidateRunId": bundle["candidateRunId"], "bundleSha256": digest(read(root, "bundle.json")), "candidates": candidates,
+            "candidateSeals": candidate_hashes, "lanes": lanes, "waivers": ["D100-linux-x86_64-execution"],
+            "allChildGroupsJoined": not owner.unsettled}
+
+
+def main():
+    try:
+        require(len(sys.argv) == 3, "release-arguments")
+        root, output = Path(sys.argv[1]).resolve(strict=True), Path(sys.argv[2])
+        owner = Runner(os.environ)
+        with deadline_guard(300, owner) as deadline:
+            report = assemble(root, owner, deadline)
+            storage.publish(output, report)
+        return 0
+    except (ActionError, OSError, ValueError, TypeError, KeyError, RecursionError, tarfile.TarError):
+        print("release-qualification-rejected", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/required-suites.json b/tests/workflows/required-suites.json
new file mode 100644
index 00000000..dec2c77b
--- /dev/null
+++ b/tests/workflows/required-suites.json
@@ -0,0 +1,48 @@
+{
+  "schemaVersion": 1,
+  "profile": "rustack-standard-jsonpath-v1",
+  "qualification": "native-workflow-only",
+  "suites": [
+    {
+      "id": "native-bridge",
+      "tests": [
+        "stepfunctions_bridge::tests::native::callback::native_e2e_should_observe_callbacks_before_and_after_real_return_prioritize_failure_and_reap_cancelled_process",
+        "stepfunctions_bridge::tests::native::native_e2e_should_cancel_actual_process_on_stop_and_task_timeout",
+        "stepfunctions_bridge::tests::native::native_e2e_should_catch_actual_function_error",
+        "stepfunctions_bridge::tests::native::native_e2e_should_execute_and_cancel_real_child_through_atomic_registry_port",
+        "stepfunctions_bridge::tests::native::native_e2e_should_execute_captured_registry_revisions_and_read_after_machine_deletion",
+        "stepfunctions_bridge::tests::native::native_e2e_should_execute_computation_and_return_actual_invocation_metadata",
+        "stepfunctions_bridge::tests::native::native_e2e_should_execute_overlapping_parallel_functions_through_structured_owner",
+        "stepfunctions_bridge::tests::native::native_e2e_should_execute_real_lambda_through_typed_http_api_and_paginated_history",
+        "stepfunctions_bridge::tests::native::native_e2e_should_kill_and_reap_timed_out_owned_probe_before_returning_error",
+        "stepfunctions_bridge::tests::native::native_e2e_should_preserve_function_timeout_class_for_asl_catch",
+        "stepfunctions_bridge::tests::native::native_e2e_should_preserve_optimized_payload_json_types_and_default",
+        "stepfunctions_bridge::tests::native::native_e2e_should_resolve_alias_again_on_retry_and_capture_new_version",
+        "stepfunctions_bridge::tests::native::native_e2e_should_restore_without_replay_and_execute_new_lambda_requests",
+        "stepfunctions_bridge::tests::native::native_e2e_should_retry_function_error_and_recalculate_parameters",
+        "stepfunctions_bridge::tests::native::registered_callback::native_e2e_should_execute_registered_asl_callbacks_and_join_consumed_native_cancellation"
+      ]
+    },
+    {
+      "id": "registered-sdk",
+      "tests": [
+        "performance::test_should_keep_health_and_stop_responsive_and_reuse_one_execution_slot",
+        "performance::test_should_measure_one_hundred_fifty_state_signed_sdk_executions",
+        "persistence::test_should_restart_named_native_snapshots_without_replay_and_lose_only_unsaved_work",
+        "test_should_accept_ordinary_boto3_through_actual_runtime",
+        "test_should_accept_ordinary_rust_sdk_through_actual_runtime",
+        "test_should_execute_documented_pure_workflow_in_owned_strict_service",
+        "test_should_join_actual_server_and_native_children_after_fixture_gate_release_failure",
+        "test_should_reap_actual_python_after_observed_execution_timeout",
+        "test_should_run_actual_nested_native_with_one_dispatch_slot",
+        "test_should_run_signed_rust_and_boto3_handler_callbacks_with_one_dispatch_slot"
+      ]
+    },
+    {
+      "id": "typed-http-sdk",
+      "tests": [
+        "test_should_exchange_signed_boto3_requests_with_typed_transport"
+      ]
+    }
+  ]
+}
diff --git a/tests/workflows/required_suites.py b/tests/workflows/required_suites.py
new file mode 100644
index 00000000..4f691d35
--- /dev/null
+++ b/tests/workflows/required_suites.py
@@ -0,0 +1,169 @@
+"""Bounded exact-inventory decoder and native workflow resource entrypoint.
+
+Make owns compilation, inventory creation and subsequent resource execution.
+This module validates data only; manifest contents never become commands.
+"""
+
+import argparse
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import sys
+
+
+SUITES = frozenset(("native-bridge", "registered-sdk", "typed-http-sdk"))
+MANIFEST_LIMIT = 65_536
+INVENTORY_LIMIT = 32_768
+NAME = re.compile(r"[A-Za-z0-9_]+(?:::[A-Za-z0-9_]+)*", re.ASCII)
+SUMMARY = re.compile(r"([0-9]{1,4}) tests?, ([0-9]{1,4}) benchmarks?", re.ASCII)
+
+
+class ManifestError(ValueError):
+    """A fixed diagnostic with no untrusted input or filesystem contents."""
+
+
+def read_regular(path, limit):
+    """Read a small regular file without following a final symlink or FIFO."""
+    try:
+        if not stat.S_ISREG(path.lstat().st_mode):
+            raise ManifestError("input must be a regular file")
+        flags = os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0)
+        descriptor = os.open(path, flags)
+        with os.fdopen(descriptor, "rb") as source:
+            if not stat.S_ISREG(os.fstat(source.fileno()).st_mode):
+                raise ManifestError("opened input must be a regular file")
+            value = source.read(limit + 1)
+        if len(value) > limit:
+            raise ManifestError("input byte limit exceeded")
+        return value
+    except OSError:
+        raise ManifestError("cannot read required inventory input") from None
+
+
+def _object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ManifestError("duplicate manifest field")
+        result[key] = value
+    return result
+
+
+def _name(value):
+    if not isinstance(value, str) or len(value) > 256 or NAME.fullmatch(value) is None:
+        raise ManifestError("invalid required test name")
+    return value
+
+
+def parse_manifest(raw, *, expected_suites=SUITES, profile="rustack-standard-jsonpath-v1",
+                   qualification="native-workflow-only"):
+    """Validate the complete bounded schema, suite set and exact test names."""
+    if len(raw) > MANIFEST_LIMIT:
+        raise ManifestError("manifest byte limit exceeded")
+    try:
+        document = json.loads(raw.decode("utf-8"), object_pairs_hook=_object)
+    except (ValueError, RecursionError, UnicodeError):
+        raise ManifestError("invalid manifest encoding or duplicate fields") from None
+    if not isinstance(document, dict) or set(document) != {
+        "schemaVersion", "profile", "qualification", "suites"
+    }:
+        raise ManifestError("invalid manifest fields")
+    if type(document["schemaVersion"]) is not int or document["schemaVersion"] != 1:
+        raise ManifestError("unsupported manifest schema")
+    if document["profile"] != profile:
+        raise ManifestError("unsupported workflow profile")
+    if document["qualification"] != qualification:
+        raise ManifestError("unsupported manifest qualification")
+    suites = document["suites"]
+    if not isinstance(suites, list) or len(suites) != len(expected_suites):
+        raise ManifestError("incomplete required suite set")
+    result = {}
+    for suite in suites:
+        if not isinstance(suite, dict) or set(suite) != {"id", "tests"}:
+            raise ManifestError("invalid suite fields")
+        identity = suite["id"]
+        if not isinstance(identity, str) or identity not in expected_suites or identity in result:
+            raise ManifestError("unknown or repeated required suite")
+        tests = suite["tests"]
+        if not isinstance(tests, list) or not 1 <= len(tests) <= 128:
+            raise ManifestError("invalid required test count")
+        names = frozenset(_name(name) for name in tests)
+        if len(names) != len(tests):
+            raise ManifestError("duplicate required test")
+        if identity == "native-bridge" and any(
+            not name.startswith("stepfunctions_bridge::tests::native::")
+            or not name.rsplit("::", 1)[-1].startswith("native_e2e")
+            for name in names
+        ):
+            raise ManifestError("bridge case is outside the Native selection")
+        result[identity] = names
+    if set(result) != expected_suites:
+        raise ManifestError("incomplete required suite set")
+    return result
+
+
+def parse_inventory(raw):
+    """Accept only exact ignored-test names followed by one consistent summary."""
+    if len(raw) > INVENTORY_LIMIT:
+        raise ManifestError("compiled inventory byte limit exceeded")
+    try:
+        lines = [line[:-1] if line.endswith("\r") else line for line in raw.decode("utf-8").split("\n")]
+    except UnicodeError:
+        raise ManifestError("invalid compiled inventory encoding") from None
+    names = set()
+    summary = None
+    for line in lines:
+        if not line:
+            continue
+        if summary is not None:
+            raise ManifestError("unexpected data after inventory summary")
+        if line.endswith(": test"):
+            name = _name(line[:-6])
+            if name in names or len(names) >= 128:
+                raise ManifestError("duplicate or excessive compiled test names")
+            names.add(name)
+        else:
+            match = SUMMARY.fullmatch(line)
+            if match is None:
+                raise ManifestError("unknown compiled inventory line")
+            summary = (int(match[1]), int(match[2]))
+    if not names or summary != (len(names), 0):
+        raise ManifestError("missing or inconsistent compiled inventory summary")
+    return frozenset(names)
+
+
+def verify(required, inventories, *, expected_suites=SUITES):
+    """Require exact complete agreement, including unexpected ignored cases."""
+    if set(required) != expected_suites or set(inventories) != expected_suites:
+        raise ManifestError("incomplete inventory inputs")
+    for identity in sorted(expected_suites):
+        if parse_inventory(inventories[identity]) != required[identity]:
+            raise ManifestError("compiled inventory differs from required suite: " + identity)
+    return sum(map(len, required.values()))
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("inventory_directory", type=Path)
+    args = parser.parse_args()
+    try:
+        required = parse_manifest(read_regular(
+            Path(__file__).with_name("required-suites.json"), MANIFEST_LIMIT
+        ))
+        inventories = {
+            identity: read_regular(args.inventory_directory / (identity + ".txt"), INVENTORY_LIMIT)
+            for identity in SUITES
+        }
+        count = verify(required, inventories)
+    except ManifestError as error:
+        print("Workflow resource manifest rejected: " + str(error), file=sys.stderr)
+        return 1
+    print("Workflow resource manifest verified: 3 suites, " + str(count)
+          + " exact resource tests; native-workflow-only.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/requirements.txt b/tests/workflows/requirements.txt
new file mode 100644
index 00000000..52c9e9d0
--- /dev/null
+++ b/tests/workflows/requirements.txt
@@ -0,0 +1,2 @@
+boto3==1.43.118
+botocore==1.43.118
diff --git a/tests/workflows/rootless_functional.py b/tests/workflows/rootless_functional.py
new file mode 100644
index 00000000..45cd4da2
--- /dev/null
+++ b/tests/workflows/rootless_functional.py
@@ -0,0 +1,271 @@
+"""Complete preloaded rootless resource inventory; any failed case fails the gate."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import stat
+import sys
+import time
+import uuid
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import rootless_platform as bootstrap
+import rootless_resources as resources
+from functional_inventory import execute as execute_inventory
+from linux_performance import (MIB, QualificationError, Runner, bounded_read, deadline_guard,
+                               document, require, safe_path)
+from image_performance_images import catalog, fenced
+from docker_required_suites import parse_manifest
+from required_suites import parse_inventory
+from settings import ActionError
+
+SCRIPT = Path(__file__).resolve()
+ROOT = SCRIPT.parents[2]
+SUITES = {
+    "ordinary-startup": ["-p", "rustack-cli", "--test", "docker_startup", "--no-default-features",
+                         "--features", "lambda,stepfunctions,s3,dynamodb"],
+    "docker-core": ["-p", "rustack-lambda-core", "--lib"],
+    "docker-environment": ["-p", "rustack-lambda-core", "--test", "docker_environment"],
+    "docker-executor": ["-p", "rustack-lambda-core", "--test", "docker_executor"],
+    "docker-endpoint": ["-p", "rustack-lambda-core", "--test", "docker_endpoint"],
+    "docker-probe": ["-p", "rustack-lambda-core", "--test", "docker_probe"],
+    "docker-wire": ["-p", "rustack-lambda-core", "--test", "docker_wire"],
+    "relay-runtime": ["-p", "rustack-lambda-runtime", "--test", "docker"],
+}
+SERVER_CASES = frozenset((
+    "test_should_execute_image_sdk_and_nested_asl_from_a_server_container",
+    "test_should_execute_image_sdk_and_nested_asl_from_the_release_image",
+    "test_should_refuse_unreachable_server_container_gateway_and_join_startup_cleanup",
+    "test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup",
+))
+
+
+def forward_remaining(raw):
+    text = raw.decode("ascii").strip()
+    require(re.fullmatch(r"(?:[0-9]{1,2}:)?[0-9]{2}:[0-9]{2}", text) is not None,
+            "functional-forward-age")
+    parts = [int(part) for part in text.split(":")]
+    require(parts[-1] < 60 and parts[-2] < 60, "functional-forward-age")
+    age = parts[-1] + parts[-2] * 60 + (parts[0] * 3600 if len(parts) == 3 else 0)
+    # Kernel elapsed age starts at process creation, before its first deadline.
+    # Three seconds cover ps's whole-second truncation and observation transit.
+    remaining = 3600 - age - 3
+    require(remaining > 1200, "functional-forward-lifetime")
+    return remaining
+
+
+def source_paths(owner, deadline):
+    cutoff = min(deadline, time.monotonic() + 30)
+    result = set()
+    roots = ("apps", "crates", "tests", "tools", "patches", "assets", ".github", ".cargo", "examples", "codegen/src", "codegen/services/stepfunctions.toml",
+             "codegen/smithy-model/stepfunctions.json", "codegen/smithy-model/stepfunctions.provenance.json")
+    for directory in roots:
+        reply = owner.run(["git", "-C", str(ROOT), "ls-files", "--cached", "--others",
+                           "--exclude-standard", "-z", "--", directory],
+                          min(cutoff, time.monotonic() + 10), stdout_limit=65536)
+        require(reply.code == 0 and reply.stderr == b"", "functional-source-inventory")
+        for raw in reply.stdout.split(b"\0"):
+            if not raw:
+                continue
+            name = raw.decode("utf-8")
+            require(re.fullmatch(r"[A-Za-z0-9_@./+-]{1,512}", name) is not None
+                    and all(part not in ("", ".", "..") for part in name.split("/")), "functional-source-path")
+            result.add(ROOT / name)
+            require(len(result) <= 4096, "functional-source-count")
+    return result
+
+
+def source_seal(owner, deadline):
+    paths = set()
+    suffixes = {".rs", ".py", ".js", ".json", ".yaml", ".yml", ".toml", ".lock", ".txt", ".Dockerfile", ".sh"}
+    for path in source_paths(owner, deadline):
+        if path.suffix in suffixes or path.name == "Dockerfile":
+            paths.add(path)
+    paths.update(ROOT / name for name in ("Makefile", "Dockerfile", "Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "action.yml", "rustfmt.toml", ".rustfmt.toml", "deny.toml", ".dockerignore"))
+    return {str(path.relative_to(ROOT)): hashlib.sha256(bounded_read(path, 4 * MIB)).hexdigest()
+            for path in sorted(paths) if path.is_file()}
+
+
+def artifact_seal(fixtures, sdk):
+    selected = {"provided-a": fixtures / "provided/provided-a.zip", "provided-b": fixtures / "provided/provided-b.zip",
+                "code-bootstrap": fixtures / "zip-code-bootstrap/bootstrap",
+                "native-verifier": fixtures / "native-verifier/rustack-lambda-runtime-verifier/bootstrap",
+                "sdk-interpreter": sdk}
+    result = {}
+    for role, path in selected.items():
+        resolved = path.resolve(strict=True)
+        metadata = os.lstat(resolved)
+        require(stat.S_ISREG(metadata.st_mode) and 1 <= metadata.st_size <= 256 * MIB,
+                "functional-artifact-bound")
+        raw = bounded_read(resolved, 256 * MIB)
+        result[role] = {"path": str(path), "resolved": str(resolved), "bytes": len(raw),
+                        "mode": stat.S_IMODE(metadata.st_mode), "sha256": hashlib.sha256(raw).hexdigest()}
+    return result
+
+
+def retain_source_seal(root, values):
+    require(isinstance(values, dict) and 1 <= len(values) <= 4096, "functional-source-seal-count")
+    ordered = sorted(values.items())
+    files = []
+    for offset in range(0, len(ordered), 128):
+        name = "source-%03d.json" % (offset // 128)
+        bootstrap.publish(root / name, dict(ordered[offset:offset + 128]))
+        files.append(name)
+    encoded = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
+    require(len(encoded) <= MIB, "functional-source-seal-bound")
+    return {"sourceSealFiles": files, "sourceSealSha256": hashlib.sha256(encoded).hexdigest()}
+
+
+def observation_budget(started, remaining, observed):
+    require(isinstance(started, (int, float)) and isinstance(observed, (int, float))
+            and observed >= started, "functional-forward-clock")
+    seconds = min(2700, remaining) - (observed - started)
+    require(seconds > 1200, "functional-forward-observation-expired")
+    return seconds
+
+
+def environment(proof, endpoint, bridge, fixtures, sdk, other):
+    docker = shutil.which("docker")
+    require(docker is not None and sdk.is_file(), "functional-tools")
+    for part in ("provided/provided-a.zip", "provided/provided-b.zip", "zip-code-bootstrap/bootstrap",
+                 "native-verifier/rustack-lambda-runtime-verifier/bootstrap"):
+        require((fixtures / part).is_file(), "functional-fixture-artifact")
+    return {
+        "RUSTACK_RUNTIME_DOCKER_SOCKET": endpoint[7:], "RUSTACK_OTHER_DOCKER_SOCKET": str(other),
+        "RUSTACK_RUNTIME_ARCH": "arm64", "RUSTACK_RUNTIME_IMAGE": resources.SOURCES[0],
+        "RUSTACK_RUNTIME_NETWORK": bridge["name"], "RUSTACK_RUNTIME_GATEWAY_HOST": "192.168.5.2",
+        "RUSTACK_PROVIDED_ZIP_A": str(fixtures / "provided/provided-a.zip"),
+        "RUSTACK_PROVIDED_ZIP_B": str(fixtures / "provided/provided-b.zip"),
+        "RUSTACK_ZIP_NATIVE_VERIFIER": str(fixtures / "native-verifier/rustack-lambda-runtime-verifier/bootstrap"),
+        "RUSTACK_ZIP_CODE_BOOTSTRAP": str(fixtures / "zip-code-bootstrap/bootstrap"),
+        "RUSTACK_ZIP_BASE_IMAGE": resources.FULL_SOURCES[7], "RUSTACK_PULL_IMAGE": resources.FULL_SOURCES[8],
+        "RUSTACK_CUSTOM_IMAGE_A": "rustack-custom-ric:a-arm64", "RUSTACK_CUSTOM_IMAGE_B": "rustack-custom-ric:b-arm64",
+        "RUSTACK_NODE_IMAGE": "rustack-official-node:arm64", "RUSTACK_HANDLER_SDK_IMAGE": "rustack-handler-sdk:arm64",
+        "RUSTACK_CALLBACK_IMAGE": "rustack-callback:arm64", "RUSTACK_PULUMI_IMAGE": "rustack-pulumi:arm64",
+        "RUSTACK_SERVER_IMAGE": "rustack/workflows-server:integration-arm64",
+        "RUSTACK_RELEASE_IMAGE": "rustack/workflows-release:integration-arm64",
+        "RUSTACK_SERVER_DAEMON_SOCKET": proof["socket"]["path"],
+        "RUSTACK_SERVER_SOCKET_GID": str(proof["namespaceSocketGid"]),
+        "RUSTACK_DOCKER_BIN": docker, "RUSTACK_WORKFLOWS_PYTHON": str(sdk),
+    }
+
+
+def observe_clean(owner, endpoint, engine, deadline, evidence):
+    for kind, tail in (("containers", ["ps", "--all", "--quiet"]), ("volumes", ["volume", "ls", "--quiet"])):
+        raw = fenced(owner, endpoint, engine, ["docker", "--host", endpoint] + tail, deadline)
+        bootstrap.write_new(evidence / (kind + ".stdout"), raw)
+        require(raw == b"", "functional-resource-remnant")
+    raw = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "ls", "--all", "--format", "{{.Repository}}:{{.Tag}}"], deadline)
+    bootstrap.write_new(evidence / "aliases.stdout", raw)
+    resources.private_aliases(raw)
+    require(not any(row.startswith("public.ecr.aws:443/lambda/nodejs") for row in raw.decode().splitlines()),
+            "functional-pull-alias-remnant")
+
+
+def run_case(owner, arguments, cutoff, directory):
+    bootstrap.publish(directory / "intent.json", {"argv": arguments, "callerCutoffMonotonic": cutoff,
+                      "ownerPid": os.getpid()})
+    result = owner.run(arguments, cutoff, stdout_limit=65536)
+    bootstrap.write_new(directory / "stdout", result.stdout)
+    bootstrap.write_new(directory / "stderr", result.stderr)
+    bootstrap.publish(directory / "result.json", {"code": result.code,
+                      "stdoutSha256": hashlib.sha256(result.stdout).hexdigest(),
+                      "stderrSha256": hashlib.sha256(result.stderr).hexdigest()})
+    return result
+
+
+def execute(proof, control, preparation, target, fixtures, sdk, other, owner, deadline, server_focus=False):
+    endpoint, engine = resources.connection(str(control), proof, owner, deadline)
+    image_raw = bounded_read(preparation / "images.json", 65536)
+    images = resources.image_receipt(document(image_raw), engine)
+    require(images["selection"] == "full" and images["sourceSocket"] == str(other), "functional-full-fixtures")
+    bridge = document(bounded_read(preparation / "network.json", 65536))
+    require(bridge["engine"] == engine, "functional-network-engine")
+    actual = resources.network(document(fenced(owner, endpoint, engine, ["docker", "--host", endpoint,
+        "network", "inspect", bridge["id"]], deadline)), bridge["name"], bridge["nonce"])
+    require(actual["Id"] == bridge["id"], "functional-network-id")
+    entry = document(bounded_read(preparation / "entry.json", 65536))
+    resources.require_producer(preparation, entry)
+    manifest_raw = bounded_read(SCRIPT.with_name("docker-required-suites.json"), 65536)
+    required = parse_manifest(manifest_raw)
+    require(set(required) == set(SUITES) and all(required.values()),
+            "functional-complete-inventory")
+    root = preparation / ("functional-" + uuid.uuid4().hex)
+    root.mkdir(mode=0o700)
+    before = source_seal(owner, deadline)
+    build_raw = bounded_read(preparation / "build-receipt.json", 65536)
+    built = document(build_raw)
+    current_seal = hashlib.sha256(json.dumps(before, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    require(built.get("sourceSealSha256") == current_seal and built.get("allChildGroupsJoined") is True,
+            "functional-stale-production-images")
+    artifacts = artifact_seal(fixtures, sdk)
+    selected_environment = environment(proof, endpoint, bridge, fixtures, sdk, other)
+    owner.environment.update(selected_environment)
+    source_proof = retain_source_seal(root, before)
+    bootstrap.publish(root / "entry.json", {"schemaVersion":1, "engine": engine, "profile": proof["profile"], "ownerPid": os.getpid(),
+        **source_proof, "artifacts": artifacts, "manifestSha256": hashlib.sha256(manifest_raw).hexdigest(),
+        "imageReceiptSha256": hashlib.sha256(image_raw).hexdigest(), "controllerSha256": resources.sha(SCRIPT),
+        "resourceControllerSha256": resources.sha(resources.SCRIPT), "environment": selected_environment, "targetDirectory":str(target)})
+    bootstrap.write_new(root / "controller.py", bounded_read(SCRIPT, MIB))
+    bootstrap.write_new(root / "resource-controller.py", bounded_read(resources.SCRIPT, MIB))
+    baseline = root / "before"
+    baseline.mkdir(mode=0o700)
+    observe_clean(owner, endpoint, engine, deadline, baseline)
+    cargo = ["cargo", "test", "--locked", "--target-dir", str(target)]
+    selected = {"ordinary-startup": SERVER_CASES} if server_focus else required
+    require(SERVER_CASES <= required["ordinary-startup"], "functional-server-case-inventory")
+    expected_count = sum(len(names) for names in selected.values())
+    rows = execute_inventory(owner, cargo, SUITES, required, selected, root, deadline, run_case,
+        resources.verify_output, lambda directory: observe_clean(owner, endpoint, engine, deadline, directory))
+    require(len(rows) == expected_count and source_seal(owner, deadline) == before and artifact_seal(fixtures, sdk) == artifacts
+            and bounded_read(SCRIPT.with_name("docker-required-suites.json"), 65536) == manifest_raw,
+            "functional-source-or-inventory-changed")
+    require(catalog(owner, "unix://" + str(other), deadline, images["sourceEngine"]) == set(images["sourceIds"]),
+            "functional-original-source-ids-changed")
+    for row in images["images"]:
+        require(resources.captured(owner, endpoint, row["name"], deadline, engine) == row["image"]
+                and resources.captured(owner, endpoint, row["cacheAlias"], deadline, engine, row["name"]) == row["image"]
+                and resources.captured(owner, "unix://" + str(other), row["name"], deadline, images["sourceEngine"]) == row["image"],
+                "functional-source-image-changed")
+    failed = [row["name"] for row in rows if row["code"] != 0]
+    report = {"schemaVersion": 1, "engine": engine, "attempted": len(rows), "passed": expected_count - len(failed),
+              "scope": "server-focused-only" if server_focus else "complete-functional-inventory",
+              "failed": failed, "platformQualification": "failed" if failed else "pending",
+              "rows": rows, "evidence": str(root), "allChildGroupsJoined": not owner.unsettled}
+    bootstrap.publish(root / "report.json", report)
+    print(json.dumps(report, separators=(",", ":")), flush=True)
+    return 1 if failed else 0
+
+
+def main():
+    try:
+        server_focus = len(sys.argv) == 9 and sys.argv[1] == "--server-focus"
+        arguments = sys.argv[2:] if server_focus else sys.argv[1:]
+        require(len(arguments) == 7, "functional-arguments")
+        proof = resources.attestation(arguments[0])
+        control, preparation, target, fixtures, sdk, other = (safe_path(value) for value in arguments[1:])
+        owner = Runner(os.environ)
+        forward_entry = document(bounded_read(control / "entry.json", 65536))
+        pid = forward_entry.get("ownerPid")
+        require(type(pid) is int and 1 <= pid <= 999999999, "functional-forward-pid")
+        started = time.monotonic()
+        resources.require_process_identity(forward_entry.get("ownerIdentity"),
+            resources.process_identity(pid, owner, started + 10))
+        elapsed = owner.run(["ps", "-p", str(pid), "-o", "etime="], started + 10)
+        require(elapsed.code == 0 and elapsed.stderr == b"", "functional-forward-observation")
+        remaining = forward_remaining(elapsed.stdout)
+        seconds = observation_budget(started, remaining, time.monotonic())
+        with deadline_guard(seconds, owner) as deadline:
+            return execute(proof, control, preparation, target, fixtures, sdk, other, owner, deadline, server_focus=server_focus)
+    except (ActionError, QualificationError) as error:
+        print("rootless-functional-failed:" + str(error), file=sys.stderr)
+        return 2
+    except (OSError, ValueError, KeyError, TypeError, RecursionError):
+        print("rootless-functional-failed", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/rootless_platform.py b/tests/workflows/rootless_platform.py
new file mode 100644
index 00000000..dc101942
--- /dev/null
+++ b/tests/workflows/rootless_platform.py
@@ -0,0 +1,691 @@
+"""Owned native ARM rootless bootstrap and independent, bounded attestation."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import platform
+import pwd
+import re
+import stat
+import sys
+import time
+import urllib.request
+import uuid
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from linux_performance import (MIB, QualificationError, Runner, bounded_read,
+                               deadline_guard, document, profile, provision, require,
+                               safe_path, status)
+from settings import ActionError
+
+KEY_FINGERPRINT = "9DC858229FC7DD38854AE2D88D81803C0EBFCD88"
+SCRIPT = Path(__file__).resolve()
+CONTROLLERS = {"cpu", "memory", "pids"}
+ENTRY_KEYS = {"schemaVersion", "profile", "nonce", "scriptSha256", "targetDirectory"}
+SYSTEM_FILE_PUBLISHER = r'''
+import hashlib, os, pathlib, stat, sys, tempfile
+source, target = pathlib.Path(sys.argv[1]), pathlib.Path(sys.argv[2])
+allowed = {"/etc/apt/keyrings/rustack-d103-docker.asc",
+           "/etc/apt/sources.list.d/rustack-d103-docker.sources"}
+if str(target) not in allowed:
+    sys.exit(2)
+parent = os.lstat(target.parent)
+if not stat.S_ISDIR(parent.st_mode) or parent.st_uid != 0 or stat.S_IMODE(parent.st_mode) != 0o755:
+    sys.exit(2)
+fd = os.open(source, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+with os.fdopen(fd, "rb") as stream:
+    metadata = os.fstat(stream.fileno())
+    if not stat.S_ISREG(metadata.st_mode) or metadata.st_uid != int(sys.argv[4]) or metadata.st_size > 65536:
+        sys.exit(2)
+    raw = stream.read(65537)
+if not raw or len(raw) > 65536 or hashlib.sha256(raw).hexdigest() != sys.argv[3]:
+    sys.exit(2)
+fd, temporary = tempfile.mkstemp(prefix=".rustack-d103-", dir=target.parent)
+try:
+    with os.fdopen(fd, "wb") as stream:
+        os.fchmod(stream.fileno(), 0o644)
+        stream.write(raw)
+        stream.flush()
+        os.fsync(stream.fileno())
+    try:
+        os.link(temporary, target, follow_symlinks=False)
+    except FileExistsError:
+        pass
+    fd = os.open(target, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    with os.fdopen(fd, "rb") as stream:
+        metadata = os.fstat(stream.fileno())
+        if (not stat.S_ISREG(metadata.st_mode) or metadata.st_uid != 0
+                or stat.S_IMODE(metadata.st_mode) != 0o644 or metadata.st_size != len(raw)
+                or stream.read(65537) != raw):
+            sys.exit(2)
+    descriptor = os.open(target.parent, os.O_RDONLY | os.O_DIRECTORY)
+    try:
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+finally:
+    os.unlink(temporary)
+'''
+
+
+def token(value):
+    require(isinstance(value, str) and re.fullmatch(r"[0-9a-f]{32}", value) is not None,
+            "rootless-nonce")
+    return value
+
+
+def script_hash():
+    return hashlib.sha256(bounded_read(SCRIPT, MIB)).hexdigest()
+
+
+def write_new(path, raw):
+    require(isinstance(raw, bytes) and len(raw) <= 65536, "rootless-output-bound")
+    with open(path, "xb") as stream:
+        os.chmod(path, 0o600)
+        stream.write(raw)
+        stream.flush()
+        os.fsync(stream.fileno())
+    descriptor = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
+    try:
+        os.fsync(descriptor)
+    finally:
+        os.close(descriptor)
+
+
+def publish(path, value):
+    write_new(path, json.dumps(value, separators=(",", ":"), allow_nan=False).encode())
+
+
+def entry(value, selected, current_source=True):
+    require(isinstance(value, dict) and set(value) == ENTRY_KEYS
+            and type(value["schemaVersion"]) is int and value["schemaVersion"] == 1
+            and value["profile"] == profile(selected)
+            and isinstance(value["scriptSha256"], str)
+            and re.fullmatch(r"[0-9a-f]{64}", value["scriptSha256"])
+            and (not current_source or value["scriptSha256"] == script_hash()), "rootless-entry")
+    token(value["nonce"])
+    safe_path(value["targetDirectory"])
+    return value
+
+
+class Commands:
+    """Reuse the joined child owner; retain raw bounded setup results privately."""
+
+    def __init__(self, owner, deadline, evidence=None):
+        self.owner, self.deadline, self.evidence = owner, deadline, evidence
+        self.sequence = 0
+        self.job_nonce = uuid.uuid4().hex
+
+    def run(self, arguments, seconds=15, clean=False):
+        self.sequence += 1
+        cutoff = min(self.deadline, time.monotonic() + seconds)
+        privileged = arguments[:2] == ["sudo", "-n"]
+        if privileged:
+            # Root children cannot rely on an unprivileged owner's signalling
+            # authority. The root manager independently caps and kills their
+            # complete service cgroup, even if the SSH/controller disappears.
+            lifetime = int(cutoff - time.monotonic()) - 6
+            require(self.evidence is not None and lifetime >= 1 and len(arguments) >= 3
+                    and arguments[2] in ("python3", "env", "install", "loginctl"),
+                    "rootless-privileged-command-budget")
+            unit = "rustack-d103-" + self.job_nonce + "-%03d" % self.sequence
+            arguments = ["sudo", "-n", "systemd-run", "--quiet", "--wait", "--pipe", "--collect",
+                         "--unit=" + unit, "--property=Type=exec", "--property=Restart=no",
+                         "--property=RuntimeMaxSec=%ds" % lifetime, "--property=TimeoutStopSec=2s",
+                         "--property=TimeoutStartSec=2s", "--property=KillMode=control-group",
+                         "--property=SendSIGKILL=yes", "/usr/bin/" + arguments[2]] + arguments[3:]
+        if self.evidence is not None:
+            publish(self.evidence / ("command-%03d.intent.json" % self.sequence),
+                    {"argv": arguments, "callerCutoffMonotonic": cutoff, "ownerPid": os.getpid()})
+        if privileged:
+            require(time.monotonic() + lifetime + 6 <= cutoff, "rootless-privileged-intent-late")
+        result = self.owner.run(arguments, cutoff,
+                                stdout_limit=65536)
+        if self.evidence is not None:
+            base = self.evidence / ("command-%03d" % self.sequence)
+            publish(base.with_suffix(".json"), {"argv": arguments, "code": result.code,
+                    "stdoutSha256": hashlib.sha256(result.stdout).hexdigest(),
+                    "stderrSha256": hashlib.sha256(result.stderr).hexdigest()})
+            write_new(base.with_suffix(".stdout"), result.stdout)
+            write_new(base.with_suffix(".stderr"), result.stderr)
+        require(result.code == 0 and (not clean or result.stderr == b""), "rootless-command")
+        return result.stdout
+
+
+def version(raw):
+    value = raw.decode("ascii").strip()
+    require(re.fullmatch(r"[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}", value) is not None,
+            "rootless-engine-version")
+    return value
+
+
+def key_fingerprint(raw):
+    lines = raw.decode("ascii").splitlines()
+    require(1 <= len(lines) <= 64, "rootless-key-bound")
+    primary = [index for index, line in enumerate(lines) if line.startswith("pub:")]
+    fingerprints = [line.split(":")[9] for line in lines if line.startswith("fpr:")
+                    and len(line.split(":")) > 9]
+    require(len(primary) == 1 and fingerprints and fingerprints[0] == KEY_FINGERPRINT,
+            "rootless-key-fingerprint")
+
+
+def mappings(raw, uid):
+    require(isinstance(raw, bytes) and len(raw) <= 4096, "rootless-map-bound")
+    rows = [line.split() for line in raw.decode("ascii").splitlines()]
+    require(len(rows) == 2 and all(len(row) == 3 and all(item.isdecimal() for item in row)
+                                 for row in rows), "rootless-map-shape")
+    values = [[int(item) for item in row] for row in rows]
+    require(values[0] == [0, uid, 1] and values[1][0] == 1
+            and 65536 <= values[1][2] <= 1073741824 and 65536 <= values[1][1]
+            and values[1][1] + values[1][2] <= 4294967295,
+            "rootless-map-policy")
+    return values
+
+
+def process_uid(raw, uid):
+    require(len(raw) <= 32768, "rootless-process-bound")
+    lines = [line.split()[1:] for line in raw.decode("ascii").splitlines()
+             if line.startswith("Uid:")]
+    require(len(lines) == 1 and lines[0] == [str(uid)] * 4, "rootless-process-uid")
+
+
+def info(value):
+    require(isinstance(value, dict) and set(value) == {"id", "os", "arch", "version",
+            "security", "cgroupVersion", "cgroupDriver", "warnings"}, "rootless-info-shape")
+    require(isinstance(value["id"], str) and re.fullmatch(r"[a-zA-Z0-9:-]{1,128}", value["id"])
+            is not None and value["os"] == "linux" and value["arch"] == "aarch64"
+            and value["cgroupVersion"] == "2" and value["cgroupDriver"] == "systemd",
+            "rootless-info-policy")
+    require(isinstance(value["version"], str), "rootless-engine-version")
+    version(value["version"].encode("ascii"))
+    security = value["security"]
+    require(isinstance(security, list) and 1 <= len(security) <= 16
+            and all(isinstance(item, str) and len(item) <= 256 for item in security)
+            and "name=rootless" in security, "rootless-security")
+    require(value["warnings"] in (None, []), "rootless-daemon-warning")
+    return value
+
+
+def result_proof(value, nonce):
+    keys = {"schemaVersion", "platformQualification", "uid", "gid", "socket", "namespaceSocketGid", "serviceMainPid", "dockerdPid",
+            "uidMap", "gidMap", "controllers", "rootless", "rootfulEngineId", "kernel",
+            "referenceQualification", "scriptSha256", "nonce", "rootlessExtrasVersion", "packages",
+            "delegation"}
+    require(isinstance(value, dict) and set(value) == keys
+            and type(value["schemaVersion"]) is int and value["schemaVersion"] == 1
+            and value["nonce"] == token(nonce) and value["scriptSha256"] == script_hash()
+            and value["platformQualification"] == value["referenceQualification"] == "pending",
+            "rootless-guest-receipt")
+    require(type(value["uid"]) is int and 1 <= value["uid"] <= 65535
+            and type(value["gid"]) is int and 1 <= value["gid"] <= 65535
+            and all(type(value[key]) is int and 1 <= value[key] <= 999999999
+                    for key in ("serviceMainPid", "dockerdPid")), "rootless-receipt-process")
+    controllers = value["controllers"]
+    require(isinstance(controllers, list) and 3 <= len(controllers) <= 16
+            and all(isinstance(item, str) and re.fullmatch(r"[a-z]{1,16}", item) for item in controllers)
+            and sorted(set(controllers)) == controllers and CONTROLLERS <= set(controllers),
+            "rootless-delegation")
+    proof = value["delegation"]
+    require(isinstance(proof, dict) and set(proof) == {"manager", "service"}, "rootless-delegation-proof")
+    for kind in ("manager", "service"):
+        item = proof[kind]
+        require(isinstance(item, dict) and set(item) == {"declared", "available", "enabled", "controlUid", "controlWritable"}
+                and type(item["controlUid"]) is int and item["controlUid"] == value["uid"]
+                and item["controlWritable"] is True, "rootless-delegation-owner")
+        for key in ("declared", "available", "enabled"):
+            names = item[key]
+            require(isinstance(names, list) and len(names) <= 16
+                    and all(isinstance(name, str) and re.fullmatch(r"[a-z]{1,16}", name) for name in names)
+                    and sorted(set(names)) == names, "rootless-delegation-controller-shape")
+        require(CONTROLLERS <= set(item["declared"]) and CONTROLLERS <= set(item["available"])
+                and (kind != "manager" or CONTROLLERS <= set(item["enabled"])), "rootless-delegation")
+    require(proof["manager"]["available"] == controllers, "rootless-controller-evidence")
+    socket = value["socket"]
+    require(isinstance(socket, dict) and set(socket) == {"path", "uid", "gid", "mode", "inode"}
+            and socket["path"] == "/run/user/%d/docker.sock" % value["uid"]
+            and type(socket["uid"]) is int and socket["uid"] == value["uid"]
+            and type(socket["gid"]) is int and 0 <= socket["gid"] <= 4294967295
+            and type(socket["mode"]) is int and socket["mode"] in (0o600, 0o660, 0o1600, 0o1660)
+            and type(socket["inode"]) is int and 1 <= socket["inode"] < 2 ** 64,
+            "rootless-receipt-socket")
+    for key, outside in (("uidMap", value["uid"]), ("gidMap", value["gid"])):
+        rows = value[key]
+        require(isinstance(rows, list) and len(rows) == 2
+                and all(isinstance(row, list) and len(row) == 3
+                        and all(type(item) is int and 0 <= item <= 4294967295 for item in row)
+                        for row in rows), "rootless-receipt-map")
+        mappings(("\n".join(" ".join(str(item) for item in row) for row in rows)).encode(), outside)
+    require(type(value["namespaceSocketGid"]) is int
+            and value["namespaceSocketGid"] == namespace_gid(socket["gid"], value["gidMap"]),
+            "rootless-socket-gid-map")
+    observed = info(value["rootless"])
+    require(isinstance(value["rootfulEngineId"], str)
+            and re.fullmatch(r"[a-zA-Z0-9:-]{1,128}", value["rootfulEngineId"])
+            and value["rootfulEngineId"] != observed["id"], "rootless-rootful-identity")
+    require(value["rootlessExtrasVersion"] == "5:" + observed["version"] + "-1~ubuntu.24.04~noble"
+            and isinstance(value["kernel"], str)
+            and re.fullmatch(r"[A-Za-z0-9_.+-]{1,256}", value["kernel"]), "rootless-receipt-version")
+    packages = value["packages"]
+    require(isinstance(packages, dict) and set(packages) == {"uidmap", "dbus-user-session",
+            "slirp4netns", "docker-ce-rootless-extras", "repositoryCandidate"}
+            and all(isinstance(item, str) and re.fullmatch(r"[A-Za-z0-9.+:~_-]{1,128}", item)
+                    for item in packages.values())
+            and packages["docker-ce-rootless-extras"] == value["rootlessExtrasVersion"],
+            "rootless-receipt-packages")
+    return value
+
+
+def socket_proof(path, uid):
+    metadata = os.lstat(path)
+    require(stat.S_ISSOCK(metadata.st_mode) and metadata.st_uid == uid
+            and stat.S_IMODE(metadata.st_mode) & 0o007 == 0, "rootless-socket-policy")
+    parent = os.lstat(path.parent)
+    require(stat.S_ISDIR(parent.st_mode) and parent.st_uid == uid
+            and stat.S_IMODE(parent.st_mode) == 0o700, "rootless-runtime-directory")
+    return {"path": str(path), "uid": metadata.st_uid, "gid": metadata.st_gid,
+            "mode": stat.S_IMODE(metadata.st_mode), "inode": metadata.st_ino}
+
+
+def namespace_gid(host_gid, rows):
+    found = [inside + host_gid - outside for inside, outside, count in rows
+             if outside <= host_gid < outside + count]
+    require(len(found) == 1, "rootless-socket-gid-map")
+    return found[0]
+
+
+def guest_base():
+    require(sys.platform == "linux" and platform.machine() == "aarch64"
+            and 1 <= os.getuid() <= 65535, "rootless-guest-platform")
+    release = bounded_read(Path("/usr/lib/os-release"), 16384).splitlines()
+    require(b"ID=ubuntu" in release and b'VERSION_ID="24.04"' in release, "rootless-guest-distribution")
+    uid = os.getuid()
+    runtime = Path("/run/user") / str(uid)
+    require(os.environ.get("XDG_RUNTIME_DIR") == str(runtime), "rootless-runtime-path")
+    account = pwd.getpwuid(uid)
+    require(re.fullmatch(r"[a-z_][a-z0-9_-]{0,31}", account.pw_name) is not None,
+            "rootless-account")
+    return uid, runtime, account.pw_name
+
+
+def user_command(runtime, arguments):
+    return ["env", "DBUS_SESSION_BUS_ADDRESS=unix:path=" + str(runtime / "bus")] + arguments
+
+
+def guest_fresh(nonce):
+    token(nonce)
+    uid, runtime, _user = guest_base()
+    require(not os.path.lexists(Path.home() / ".local/state/rustack-rootless-d103")
+            and not os.path.lexists(Path.home() / ".config/systemd/user/docker.service")
+            and not os.path.lexists(runtime / "docker.sock")
+            and not os.path.lexists(Path.home() / ".local/share/docker"), "rootless-guest-not-fresh")
+    return {"nonce": nonce, "uid": uid, "scriptSha256": script_hash(), "rootlessStateAbsent": True}
+
+
+def cgroup_control(base, uid, declared):
+    available = bounded_read(base / "cgroup.controllers", 4096).decode("ascii").split()
+    enabled = bounded_read(base / "cgroup.subtree_control", 4096).decode("ascii").split()
+    control = os.lstat(base / "cgroup.subtree_control")
+    require(1 <= len(available) <= 16 and CONTROLLERS <= set(available)
+            and CONTROLLERS <= set(declared) and control.st_uid == uid
+            and os.access(base / "cgroup.subtree_control", os.W_OK), "rootless-delegation")
+    return {"declared": sorted(declared), "available": sorted(available), "enabled": sorted(enabled),
+            "controlUid": control.st_uid, "controlWritable": True}
+
+
+def delegation(uid, commands):
+    base = Path("/sys/fs/cgroup/user.slice") / ("user-%d.slice" % uid) / ("user@%d.service" % uid)
+    raw = commands.run(["systemctl", "show", "user@%d.service" % uid,
+                        "--property=Delegate", "--property=DelegateControllers"], clean=True)
+    properties = dict(line.split("=", 1) for line in raw.decode("ascii").splitlines())
+    require(set(properties) == {"Delegate", "DelegateControllers"}
+            and properties["Delegate"] == "yes", "rootless-manager-delegation")
+    result = cgroup_control(base, uid, properties["DelegateControllers"].split())
+    require(CONTROLLERS <= set(result["enabled"]), "rootless-manager-enabled-controllers")
+    return result
+
+
+def guest_attest(commands):
+    uid, runtime, _user = guest_base()
+    require(Path("/sys/fs/cgroup/cgroup.controllers").is_file(), "rootless-cgroup-v2")
+    manager = delegation(uid, commands)
+    controllers = manager["available"]
+    socket = runtime / "docker.sock"
+    before = socket_proof(socket, uid)
+    service = commands.run(user_command(runtime, ["systemctl", "--user", "show", "docker.service",
+        "--property=ActiveState", "--property=MainPID", "--property=ControlGroup", "--property=Delegate",
+        "--property=DelegateControllers"]), clean=True)
+    properties = dict(line.split("=", 1) for line in service.decode("ascii").splitlines())
+    require(set(properties) == {"ActiveState", "MainPID", "ControlGroup", "Delegate", "DelegateControllers"}
+            and properties["ActiveState"] == "active" and properties["Delegate"] == "yes"
+            and re.fullmatch(r"[1-9][0-9]{0,8}", properties["MainPID"]) is not None,
+            "rootless-service")
+    main_pid = int(properties["MainPID"])
+    process_uid(bounded_read(Path("/proc") / str(main_pid) / "status", 32768), uid)
+    control_group = properties["ControlGroup"]
+    require(re.fullmatch(r"/user.slice/user-%d.slice/user@%d.service/[a-zA-Z0-9_.@/-]{1,128}" % (uid, uid),
+                         control_group) is not None and ".." not in control_group.split("/"),
+            "rootless-service-cgroup")
+    cgroup = Path("/sys/fs/cgroup") / control_group[1:]
+    service_control = cgroup_control(cgroup, uid, properties["DelegateControllers"].split())
+    # Before workloads, the dockerd process must belong to this exact user service.
+    processes = []
+    visited = 0
+    for base, dirs, _files in os.walk(cgroup, followlinks=False):
+        visited += 1
+        require(visited <= 64 and len(dirs) <= 64, "rootless-cgroup-tree-bound")
+        rows = bounded_read(Path(base) / "cgroup.procs", 32768).decode("ascii").split()
+        require(len(rows) <= 1024, "rootless-process-count")
+        for row in rows:
+            require(re.fullmatch(r"[1-9][0-9]{0,8}", row) is not None, "rootless-process-id")
+            proc = Path("/proc") / row
+            if bounded_read(proc / "comm", 256).strip() == b"dockerd":
+                processes.append(int(row))
+    require(len(processes) == 1, "rootless-dockerd-process")
+    daemon = Path("/proc") / str(processes[0])
+    process_uid(bounded_read(daemon / "status", 32768), uid)
+    uid_map = mappings(bounded_read(daemon / "uid_map", 4096), uid)
+    gid_map = mappings(bounded_read(daemon / "gid_map", 4096), os.getgid())
+    endpoint = "unix://" + str(socket)
+    template = '{"id":{{json .ID}},"os":{{json .OSType}},"arch":{{json .Architecture}},"version":{{json .ServerVersion}},"security":{{json .SecurityOptions}},"cgroupVersion":{{json .CgroupVersion}},"cgroupDriver":{{json .CgroupDriver}},"warnings":{{json .Warnings}}}'
+    docker = ["docker", "--host", endpoint]
+    observed = info(document(commands.run(docker + ["info", "--format", template], clean=True)))
+    rootful = commands.run(["docker", "--host", "unix:///var/run/docker.sock", "info", "--format", "{{.ID}}"], clean=True).decode("ascii").strip()
+    require(re.fullmatch(r"[a-zA-Z0-9:-]{1,128}", rootful) is not None
+            and rootful != observed["id"], "rootless-rootful-identity")
+    observed_again = info(document(commands.run(docker + ["info", "--format", template], clean=True)))
+    require(observed == observed_again and socket_proof(socket, uid) == before
+            and delegation(uid, commands) == manager
+            and cgroup_control(cgroup, uid, properties["DelegateControllers"].split()) == service_control,
+            "rootless-attestation-changed")
+    process_uid(bounded_read(daemon / "status", 32768), uid)
+    packages = {}
+    for package in ("uidmap", "dbus-user-session", "slirp4netns", "docker-ce-rootless-extras"):
+        packages[package] = commands.run(["dpkg-query", "-W", "-f=${Version}", package], clean=True).decode("ascii")
+    policy = commands.run(["apt-cache", "policy", "docker-ce-rootless-extras"], clean=True).decode("ascii")
+    candidates = re.findall(r"^  Candidate: ([A-Za-z0-9.+:~_-]{1,128})$", policy, re.MULTILINE)
+    require(len(candidates) == 1, "rootless-repository-candidate")
+    packages["repositoryCandidate"] = candidates[0]
+    return {"schemaVersion": 1, "platformQualification": "pending", "uid": uid, "gid": os.getgid(),
+            "socket": before, "serviceMainPid": main_pid, "dockerdPid": processes[0],
+            "namespaceSocketGid": namespace_gid(before["gid"], gid_map),
+            "uidMap": uid_map, "gidMap": gid_map, "controllers": controllers,
+            "rootless": observed, "rootfulEngineId": rootful, "kernel": platform.release(),
+            "referenceQualification": "pending", "scriptSha256": script_hash(), "packages": packages,
+            "delegation": {"manager": manager, "service": service_control}}
+
+
+def install_file(commands, source, target, mode):
+    require(mode == "0644", "rootless-system-file-mode")
+    raw = bounded_read(source, 65536)
+    if os.path.lexists(target):
+        metadata = os.lstat(target)
+        require(stat.S_ISREG(metadata.st_mode) and metadata.st_uid == 0
+                and stat.S_IMODE(metadata.st_mode) == 0o644 and bounded_read(target, 65536) == raw,
+                "rootless-system-file-conflict")
+    commands.run(["sudo", "-n", "python3", "-I", "-B", "-c", SYSTEM_FILE_PUBLISHER,
+                  str(source), str(target), hashlib.sha256(raw).hexdigest(), str(os.getuid())])
+
+
+def existing_repository(commands, sources=Path("/etc/apt/sources.list.d"), main=Path("/etc/apt/sources.list"),
+                        key=Path("/etc/apt/keyrings/docker.asc")):
+    paths = list(sources.iterdir())
+    require(len(paths) <= 64, "rootless-apt-source-count")
+    paths = [path for path in paths if path.suffix in (".list", ".sources")]
+    if os.path.lexists(main):
+        paths.append(main)
+    docker = []
+    for path in paths:
+        raw = bounded_read(path, 65536)
+        if b"download.docker.com" in raw:
+            metadata = os.lstat(path)
+            require(stat.S_ISREG(metadata.st_mode) and metadata.st_uid == 0
+                    and stat.S_IMODE(metadata.st_mode) == 0o644, "rootless-existing-source-metadata")
+            docker.append((path, raw))
+    if not docker:
+        return False
+    canonical = ("deb [arch=arm64 signed-by=" + str(key)
+                 + "] https://download.docker.com/linux/ubuntu noble stable\n").encode()
+    require(docker == [(sources / "docker.list", canonical)], "rootless-existing-source-shape")
+    metadata = os.lstat(key)
+    require(stat.S_ISREG(metadata.st_mode) and metadata.st_uid == 0
+            and stat.S_IMODE(metadata.st_mode) == 0o644, "rootless-existing-key-metadata")
+    bounded_read(key, 65536)
+    key_fingerprint(commands.run(["gpg", "--batch", "--with-colons", "--show-keys", str(key)]))
+    return True
+
+
+def guest_recover(nonce, owner_source, commands):
+    """Re-attest a completed install whose final observer rejected its report."""
+    uid, runtime, _user = guest_base()
+    token(nonce)
+    require(re.fullmatch(r"[0-9a-f]{64}", owner_source) is not None, "rootless-recovery-source")
+    state = Path.home() / ".local/state/rustack-rootless-d103"
+    metadata = os.lstat(state)
+    require(stat.S_ISDIR(metadata.st_mode) and metadata.st_uid == uid
+            and stat.S_IMODE(metadata.st_mode) == 0o700, "rootless-recovery-directory")
+    previous = document(bounded_read(state / "entry.json", 65536))
+    require(previous == {"nonce": nonce, "scriptSha256": owner_source, "uid": uid}
+            and hashlib.sha256(bounded_read(state / "source.py", 65536)).hexdigest() == owner_source,
+            "rootless-recovery-owner")
+    require(document(bounded_read(state / "failure.json", 65536))
+            == {"nonce": nonce, "outcome": "failed-profile-retained"}
+            and not os.path.lexists(state / "result.json"), "rootless-recovery-outcome")
+    paths = list(state.iterdir())
+    require(len(paths) <= 512, "rootless-recovery-file-count")
+    intents = sorted(path for path in paths if re.fullmatch(r"command-[0-9]{3}\.intent\.json", path.name))
+    require(1 <= len(intents) <= 64, "rootless-recovery-command-count")
+    require([path.name for path in intents] == ["command-%03d.intent.json" % number
+            for number in range(1, len(intents) + 1)], "rootless-recovery-command-sequence")
+    numbered = {path.name for path in paths if path.name.startswith("command-")}
+    expected = {"command-%03d%s" % (number, suffix) for number in range(1, len(intents) + 1)
+                for suffix in (".intent.json", ".json", ".stdout", ".stderr")}
+    require(numbered == expected, "rootless-recovery-command-files")
+    installs, observed, rootful, units = 0, [], [], []
+    for path in intents:
+        intent = document(bounded_read(path, 65536))
+        base = state / path.name.removesuffix(".intent.json")
+        result = document(bounded_read(base.with_suffix(".json"), 65536))
+        require(isinstance(intent, dict) and set(intent) == {"argv", "callerCutoffMonotonic", "ownerPid"}
+                and isinstance(result, dict) and set(result) == {"argv", "code", "stdoutSha256", "stderrSha256"}
+                and type(result["code"]) is int and result["code"] == 0
+                and result["argv"] == intent["argv"], "rootless-recovery-incomplete-command")
+        arguments = result["argv"]
+        require(isinstance(arguments, list) and 1 <= len(arguments) <= 128
+                and all(isinstance(item, str) for item in arguments)
+                and sum(len(item.encode()) for item in arguments) <= 32768, "rootless-recovery-command-bound")
+        stdout = bounded_read(base.with_suffix(".stdout"), 65536)
+        stderr = bounded_read(base.with_suffix(".stderr"), 32768)
+        require(hashlib.sha256(stdout).hexdigest() == result["stdoutSha256"]
+                and hashlib.sha256(stderr).hexdigest() == result["stderrSha256"], "rootless-recovery-raw-command")
+        if arguments[-3:] == ["dockerd-rootless-setuptool.sh", "install", "--force"]:
+            installs += 1
+        if arguments[:3] == ["docker", "--host", "unix://" + str(runtime / "docker.sock")]:
+            observed.append(info(document(stdout)))
+        if arguments[:5] == ["docker", "--host", "unix:///var/run/docker.sock", "info", "--format"]:
+            rootful.append(stdout.decode("ascii").strip())
+        for argument in arguments:
+            if argument.startswith("--unit=rustack-d103-"):
+                require(re.fullmatch(r"--unit=rustack-d103-[0-9a-f]{32}-[0-9]{3}", argument) is not None,
+                        "rootless-recovery-unit")
+                units.append(argument[7:] + ".service")
+    require(installs == 1 and len(observed) == 2 and observed[0] == observed[1]
+            and len(rootful) == 1 and 1 <= len(units) <= 32, "rootless-recovery-install-proof")
+    for unit in units:
+        require(commands.run(["systemctl", "list-units", "--all", "--plain", "--no-legend", "--full", unit],
+                             clean=True) == b"", "rootless-recovery-job-not-retired")
+    result = guest_attest(commands)
+    require(result["rootless"] == observed[0] and result["rootfulEngineId"] == rootful[0],
+            "rootless-recovery-engine-changed")
+    result.update(nonce=nonce, rootlessExtrasVersion=result["packages"]["docker-ce-rootless-extras"])
+    return result_proof(result, nonce)
+
+
+def guest_setup(nonce, owner, deadline):
+    token(nonce)
+    uid, runtime, user = guest_base()
+    state = Path.home() / ".local/state/rustack-rootless-d103"
+    require(not os.path.lexists(state), "rootless-guest-already-owned")
+    require(not os.path.lexists(Path.home() / ".config/systemd/user/docker.service")
+            and not os.path.lexists(runtime / "docker.sock")
+            and not os.path.lexists(Path.home() / ".local/share/docker"), "rootless-guest-not-fresh")
+    state.mkdir(mode=0o700, parents=True)
+    write_new(state / "source.py", bounded_read(SCRIPT, MIB))
+    publish(state / "entry.json", {"nonce": nonce, "scriptSha256": script_hash(), "uid": uid})
+    commands = Commands(owner, deadline, state)
+    try:
+        for name in ("subuid", "subgid"):
+            rows = [line.split(":") for line in bounded_read(Path("/etc") / name, 65536).decode().splitlines()]
+            require(any(len(row) == 3 and row[0] == user and row[1].isdigit() and row[2].isdigit()
+                        and int(row[1]) >= 65536 and int(row[2]) >= 65536 for row in rows), "rootless-subordinate-ids")
+        delegation(uid, commands)
+        engine = version(commands.run(["docker", "--host", "unix:///var/run/docker.sock", "version",
+                                      "--format", "{{.Server.Version}}"], clean=True))
+        key_path = state / "docker.asc"
+        with urllib.request.urlopen("https://download.docker.com/linux/ubuntu/gpg", timeout=30) as response:
+            require(response.geturl() == "https://download.docker.com/linux/ubuntu/gpg", "rootless-key-origin")
+            write_new(key_path, response.read(65537))
+        key_fingerprint(commands.run(["gpg", "--batch", "--with-colons", "--show-keys", str(key_path)]))
+        if not existing_repository(commands):
+            key_target = Path("/etc/apt/keyrings/rustack-d103-docker.asc")
+            commands.run(["sudo", "-n", "install", "-d", "-m", "0755", str(key_target.parent)])
+            install_file(commands, key_path, key_target, "0644")
+            source = state / "docker.sources"
+            write_new(source, ("Types: deb\nURIs: https://download.docker.com/linux/ubuntu\nSuites: noble\n"
+                               "Components: stable\nArchitectures: arm64\nSigned-By: " + str(key_target) + "\n").encode())
+            install_file(commands, source, Path("/etc/apt/sources.list.d/rustack-d103-docker.sources"), "0644")
+        apt = ["sudo", "-n", "env", "DEBIAN_FRONTEND=noninteractive", "apt-get",
+               "-o", "Acquire::Retries=0", "-o", "Acquire::http::Timeout=30",
+               "-o", "Acquire::https::Timeout=30", "-o", "APT::Update::Error-Mode=any"]
+        commands.run(apt + ["update"], 300)
+        package_version = "5:" + engine + "-1~ubuntu.24.04~noble"
+        commands.run(apt + ["install", "-y", "--no-upgrade", "--no-install-recommends", "uidmap",
+                           "dbus-user-session", "slirp4netns", "docker-ce-rootless-extras=" + package_version], 300)
+        package = commands.run(["dpkg-query", "-W", "-f=${Version}", "docker-ce-rootless-extras"], clean=True).decode()
+        require(package == package_version, "rootless-package-version")
+        configuration = state / "docker-client"
+        configuration.mkdir(mode=0o700)
+        owner.environment["DOCKER_CONFIG"] = str(configuration)
+        commands.run(["sudo", "-n", "loginctl", "enable-linger", user], 60)
+        # Packages add user units after the existing login manager was started.
+        # Its private systemd socket works before the session DBus socket exists.
+        commands.run(["systemctl", "--user", "daemon-reload"], 60)
+        commands.run(["systemctl", "--user", "start", "dbus.socket"], 60)
+        commands.run(user_command(runtime, ["dockerd-rootless-setuptool.sh", "install", "--force"]), 60)
+        result = guest_attest(commands)
+        result.update(nonce=nonce, rootlessExtrasVersion=package)
+        result_proof(result, nonce)
+        publish(state / "result.json", result)
+        return result
+    except BaseException:
+        publish(state / "failure.json", {"nonce": nonce, "outcome": "failed-profile-retained"})
+        raise
+
+
+def host(mode, selected, target_or_evidence, evidence_arg, owner, deadline):
+    selected = profile(selected)
+    require(selected.startswith("rustack-workflows-rootless-"), "rootless-profile-name")
+    creating = mode in ("provision", "resume", "recover-attest")
+    recovery_source = None
+    evidence = safe_path(evidence_arg if creating else target_or_evidence)
+    if creating:
+        require(sys.platform == "darwin" and platform.machine() == "arm64", "provision-platform")
+        require(not os.path.lexists(evidence), "rootless-existing-evidence")
+        previous = None
+        if mode == "provision":
+            require(not os.path.lexists(Path.home() / ".colima" / selected), "existing-profile")
+            target = safe_path(target_or_evidence)
+        else:
+            prior = safe_path(target_or_evidence)
+            metadata = os.lstat(prior)
+            require(stat.S_ISDIR(metadata.st_mode) and metadata.st_uid == os.getuid()
+                    and stat.S_IMODE(metadata.st_mode) == 0o700, "rootless-evidence-directory")
+            previous = bounded_read(prior / "entry.json", 65536)
+            old = entry(document(previous), selected, current_source=False)
+            target = safe_path(old["targetDirectory"])
+        require(target.is_dir(), "target-directory")
+        evidence.mkdir(mode=0o700)
+        write_new(evidence / "source.py", bounded_read(SCRIPT, MIB))
+        receipt = {"schemaVersion": 1, "profile": selected, "nonce": old["nonce"] if mode == "recover-attest" else uuid.uuid4().hex,
+                   "scriptSha256": script_hash(), "targetDirectory": str(target)}
+        publish(evidence / "entry.json", receipt)
+        if mode == "provision":
+            provision(selected, str(target), min(deadline, time.monotonic() + 330), owner)
+        else:
+            publish(evidence / ("recovery-parent.json" if mode == "recover-attest" else "resume-parent.json"), {"previousEvidence": str(prior),
+                    "previousEntrySha256": hashlib.sha256(previous).hexdigest(), "previousEntry": old})
+            if mode == "recover-attest":
+                recovery_source = old["scriptSha256"]
+            else:
+                fresh = document(Commands(owner, deadline).run(["colima", "-p", selected, "ssh", "--",
+                    "python3", "-I", "-B", str(SCRIPT), "guest-fresh", receipt["nonce"]], 30, clean=True))
+                require(isinstance(fresh, dict) and set(fresh) == {"nonce", "uid", "scriptSha256", "rootlessStateAbsent"}
+                        and fresh["nonce"] == receipt["nonce"] and fresh["scriptSha256"] == script_hash()
+                        and type(fresh["uid"]) is int and 1 <= fresh["uid"] <= 65535
+                        and fresh["rootlessStateAbsent"] is True, "rootless-fresh-proof")
+                publish(evidence / "fresh-proof.json", fresh)
+    else:
+        metadata = os.lstat(evidence)
+        require(stat.S_ISDIR(metadata.st_mode) and metadata.st_uid == os.getuid()
+                and stat.S_IMODE(metadata.st_mode) == 0o700, "rootless-evidence-directory")
+        receipt = entry(document(bounded_read(evidence / "entry.json", 65536)), selected)
+        if (evidence / "recovery-parent.json").exists():
+            parent = document(bounded_read(evidence / "recovery-parent.json", 65536))
+            old = entry(parent["previousEntry"], selected, current_source=False)
+            require(old["nonce"] == receipt["nonce"], "rootless-recovery-nonce")
+            recovery_source = old["scriptSha256"]
+    configuration = status(owner, selected, deadline)
+    installing = mode in ("provision", "resume")
+    commands = Commands(owner, deadline, evidence if creating else None)
+    guest_mode = "guest-recover" if recovery_source else "guest-setup" if installing else "guest-attest"
+    raw = commands.run(["colima", "-p", selected, "ssh", "--", "python3", "-I", "-B", str(SCRIPT),
+                        guest_mode, receipt["nonce"]] + ([recovery_source] if recovery_source else []),
+                       1100 if installing else 70, clean=True)
+    result = result_proof(document(raw), receipt["nonce"])
+    require(script_hash() == receipt["scriptSha256"] and status(owner, selected, deadline) == configuration,
+            "rootless-host-source-or-profile-changed")
+    result.update(profile=selected, profileConfiguration=configuration, profileRetained=True)
+    publish(evidence / ("result.json" if creating else "attestation-" + uuid.uuid4().hex + ".json"), result)
+    return result
+
+
+def main():
+    try:
+        mode = sys.argv[1] if len(sys.argv) > 1 else ""
+        require((mode in ("provision", "resume", "recover-attest") and len(sys.argv) == 5)
+                or (mode == "attest" and len(sys.argv) == 4)
+                or (mode == "guest-recover" and len(sys.argv) == 4)
+                or (mode in ("guest-setup", "guest-attest", "guest-fresh") and len(sys.argv) == 3), "rootless-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard({"provision": 1500, "resume": 1200, "recover-attest": 90, "attest": 90, "guest-setup": 1100,
+                             "guest-attest": 65, "guest-recover": 65, "guest-fresh": 10}[mode], owner) as deadline:
+            if mode == "guest-setup":
+                result = guest_setup(sys.argv[2], owner, deadline)
+            elif mode == "guest-attest":
+                nonce = token(sys.argv[2])
+                state = Path.home() / ".local/state/rustack-rootless-d103"
+                previous = result_proof(document(bounded_read(state / "result.json", 65536)), nonce)
+                result = guest_attest(Commands(owner, deadline))
+                require(result["rootless"]["id"] == previous["rootless"]["id"]
+                        and result["rootfulEngineId"] == previous["rootfulEngineId"], "rootless-engine-changed")
+                result.update(nonce=nonce, rootlessExtrasVersion=previous["rootlessExtrasVersion"])
+                result_proof(result, nonce)
+            elif mode == "guest-fresh":
+                result = guest_fresh(sys.argv[2])
+            elif mode == "guest-recover":
+                result = guest_recover(sys.argv[2], sys.argv[3], Commands(owner, deadline))
+            else:
+                result = host(mode, sys.argv[2], sys.argv[3], sys.argv[4] if mode in ("provision", "resume", "recover-attest") else None,
+                              owner, deadline)
+            require(time.monotonic() < deadline, "rootless-late-result")
+            print(json.dumps(result, separators=(",", ":"), allow_nan=False), flush=True)
+        return 0
+    except (ActionError, QualificationError) as error:
+        print("rootless-qualification-failed:" + str(error), file=sys.stderr)
+        return 2
+    except (OSError, ValueError, KeyError, TypeError, RecursionError):
+        print("rootless-qualification-failed", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/rootless_resources.py b/tests/workflows/rootless_resources.py
new file mode 100644
index 00000000..4d857c86
--- /dev/null
+++ b/tests/workflows/rootless_resources.py
@@ -0,0 +1,423 @@
+"""Fenced rootless fixture transport and unchanged actual Rust kernel resources."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import sys
+import time
+import uuid
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import rootless_platform as bootstrap
+from linux_performance import (MIB, QualificationError, Runner, bounded_read, deadline_guard,
+                               document, profile, require, safe_path, status, summary)
+from image_performance_images import (LIMIT, cache_alias, catalog, fenced, hash_file, image, retain_content)
+from required_suites import parse_inventory
+from docker_required_suites import parse_manifest
+from settings import ActionError
+from metadata import engine_id, source_id
+
+SCRIPT = Path(__file__).resolve()
+SOURCES = ("rustack/lambda-runtime:integration-arm64", "rustack-p0-handler:arm64")
+FULL_SOURCES = SOURCES + (
+    "rustack-custom-ric:a-arm64", "rustack-custom-ric:b-arm64", "rustack-no-runtime:arm64",
+    "rustack-invalid-os:arm64", "rustack-invalid-architecture:arm64",
+    "public.ecr.aws/lambda/provided@sha256:612c98f126c2a95e77a016d56fed50a83055e11d636132ee6ebdd461f01b9617",
+    "public.ecr.aws/lambda/nodejs@sha256:92b7cccd985332238af80ac8da42d6965d418552e88955e315da4e3c0c76ca79",
+    "rustack-official-node:arm64", "rustack-handler-sdk:arm64", "rustack-callback:arm64",
+    "rustack-pulumi:arm64", "rustack/workflows-server:integration-arm64", "rustack/workflows-release:integration-arm64")
+REFRESH_SOURCES = (SOURCES[0], FULL_SOURCES[2], FULL_SOURCES[3], FULL_SOURCES[13], FULL_SOURCES[14])
+LABEL = "rustack.workflows.rootless"
+
+
+def sha(path):
+    return hashlib.sha256(bounded_read(path, MIB)).hexdigest()
+
+
+def attestation(path):
+    path = safe_path(path)
+    metadata = os.lstat(path)
+    require(stat.S_ISDIR(metadata.st_mode) and metadata.st_uid == os.getuid()
+            and stat.S_IMODE(metadata.st_mode) == 0o700, "resource-attestation-directory")
+    value = document(bounded_read(path / "result.json", 65536))
+    require(isinstance(value, dict) and value.get("profileRetained") is True,
+            "resource-attestation")
+    base = {key: item for key, item in value.items()
+            if key not in ("profile", "profileConfiguration", "profileRetained")}
+    bootstrap.result_proof(base, base.get("nonce"))
+    profile(value["profile"])
+    return value
+
+
+def private(path):
+    metadata = os.lstat(path)
+    require(stat.S_ISDIR(metadata.st_mode) and metadata.st_uid == os.getuid()
+            and stat.S_IMODE(metadata.st_mode) == 0o700, "resource-private-directory")
+
+
+def socket_metadata(path):
+    require(len(os.fsencode(path)) <= 100, "resource-socket-path-bound")
+    private(path.parent)
+    metadata = os.lstat(path)
+    require(stat.S_ISSOCK(metadata.st_mode) and metadata.st_uid == os.getuid()
+            and stat.S_IMODE(metadata.st_mode) & 0o007 == 0, "resource-forward-socket")
+    return {"path": str(path), "inode": metadata.st_ino, "uid": metadata.st_uid}
+
+
+def process_identity(pid, owner, deadline):
+    require(type(pid) is int and 1 <= pid <= 999999999, "resource-forward-pid")
+    raw = owner.run(["ps", "-p", str(pid), "-o", "lstart=", "-o", "uid="],
+                    min(deadline, time.monotonic() + 10))
+    require(raw.code == 0 and raw.stderr == b"", "resource-forward-process-observation")
+    parts = raw.stdout.decode("ascii").split()
+    require(len(parts) == 6 and re.fullmatch(r"[0-9]{1,10}", parts[-1])
+            and re.fullmatch(r"[A-Za-z]{3} [A-Za-z]{3} [0-9]{1,2} [0-9]{2}:[0-9]{2}:[0-9]{2} [0-9]{4}",
+                             " ".join(parts[:-1])), "resource-forward-process-identity")
+    return {"start": " ".join(parts[:-1]), "uid": int(parts[-1])}
+
+
+def require_process_identity(expected, actual):
+    require(isinstance(expected, dict) and set(expected) == {"start", "uid"}
+            and type(expected["uid"]) is int and expected["uid"] == os.getuid()
+            and expected == actual, "resource-forward-process-reused")
+
+
+def connection(control, proof, owner, deadline):
+    control = safe_path(control)
+    private(control)
+    entry = document(bounded_read(control / "entry.json", 65536))
+    require(isinstance(entry, dict) and set(entry) == {"profile", "engine", "ownerPid", "ownerIdentity", "nonce", "scriptSha256", "socket"}
+            and entry["profile"] == proof["profile"] and entry["engine"] == proof["rootless"]["id"]
+            and entry["scriptSha256"] == sha(SCRIPT) and type(entry["ownerPid"]) is int
+            and entry["ownerPid"] > 0 and not os.path.lexists(control / "final.json"), "resource-forward-owner")
+    bootstrap.token(entry["nonce"])
+    require_process_identity(entry["ownerIdentity"], process_identity(entry["ownerPid"], owner, deadline))
+    socket = control / "docker.sock"
+    require(entry["socket"] == str(socket), "resource-forward-path")
+    observed = socket_metadata(socket)
+    record = control / "socket-observed.json"
+    if not record.exists():
+        bootstrap.publish(record, observed)
+    else:
+        require(document(bounded_read(record, 65536)) == observed, "resource-forward-socket-changed")
+    endpoint = "unix://" + str(socket)
+    engine = proof["rootless"]["id"]
+    fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "info", "--format", "{{.ID}}"], deadline)
+    return endpoint, engine
+
+
+def forward(proof, directory, owner, deadline):
+    directory = safe_path(directory)
+    require(directory.parent == Path("/tmp") and len(os.fsencode(directory / "docker.sock")) <= 100,
+            "resource-forward-directory-policy")
+    require(not os.path.lexists(directory), "resource-forward-directory-exists")
+    directory.mkdir(mode=0o700)
+    nonce = uuid.uuid4().hex
+    socket = directory / "docker.sock"
+    bootstrap.publish(directory / "entry.json", {"profile": proof["profile"], "engine": proof["rootless"]["id"],
+        "ownerPid": os.getpid(), "ownerIdentity": process_identity(os.getpid(), owner, deadline),
+        "nonce": nonce, "scriptSha256": sha(SCRIPT), "socket": str(socket)})
+    config = Path.home() / ".colima/_lima" / ("colima-" + proof["profile"]) / "ssh.config"
+    bounded_read(config, 65536)
+    arguments = ["ssh", "-F", str(config), "-o", "ControlMaster=no", "-o", "ControlPath=none",
+                 "-o", "ControlPersist=no", "-o", "ExitOnForwardFailure=yes", "-o", "ServerAliveInterval=5",
+                 "-o", "ServerAliveCountMax=2", "-o", "LogLevel=ERROR", "-N", "-T", "-n",
+                 "-L", str(socket) + ":" + proof["socket"]["path"], "lima-colima-" + proof["profile"]]
+    bootstrap.publish(directory / "intent.json", {"argv": arguments, "cutoffMonotonic": deadline})
+    try:
+        reply = owner.run(arguments, deadline)
+        require(reply.code == 0 and not reply.stderr, "resource-forward-ssh-exit")
+    finally:
+        removed = not os.path.lexists(socket)
+        if not owner.unsettled and not removed and (directory / "socket-observed.json").exists():
+            require(document(bounded_read(directory / "socket-observed.json", 65536)) == socket_metadata(socket),
+                    "resource-forward-cleanup-substitution")
+            socket.unlink()
+            removed = True
+        bootstrap.publish(directory / "final.json", {"ownerPid": os.getpid(), "nonce": nonce,
+            "childGroupJoined": not owner.unsettled, "socketRemoved": removed})
+
+
+def network(value, expected_name, nonce):
+    require(isinstance(value, list) and len(value) == 1 and isinstance(value[0], dict), "resource-network-shape")
+    row = value[0]
+    require(row.get("Name") == expected_name and isinstance(row.get("Id"), str)
+            and re.fullmatch(r"[0-9a-f]{64}", row["Id"]) and row.get("Driver") == "bridge"
+            and row.get("Scope") == "local" and row.get("Labels") == {LABEL: nonce}
+            and row.get("Containers") == {} and row.get("Internal") is False
+            and isinstance(row.get("IPAM"), dict) and row["IPAM"].get("Driver") == "default"
+            and isinstance(row["IPAM"].get("Config"), list) and len(row["IPAM"]["Config"]) == 1,
+            "resource-network-ownership")
+    return row
+
+
+def captured(owner, endpoint, name, deadline, engine, expected_name=None):
+    negative = {"rustack-invalid-os:arm64": ("windows", "amd64"),
+                "rustack-invalid-architecture:arm64": ("linux", "amd64")}
+    selected = expected_name if expected_name is not None else name
+    if selected not in negative:
+        return image(owner, endpoint, name, deadline, engine)
+    raw = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "inspect", name, "--format",
+        '{"id":{{json .Id}},"os":{{json .Os}},"architecture":{{json .Architecture}},"bytes":{{json .Size}}}'], deadline)
+    value = document(raw)
+    require(isinstance(value, dict) and set(value) == {"id", "os", "architecture", "bytes"}
+            and (value["os"], value["architecture"]) == negative[selected]
+            and type(value["bytes"]) is int and 1 <= value["bytes"] <= 65536, "resource-negative-image")
+    source_id(value["id"])
+    return value
+
+
+def tag_policy(present, immutable, old=None):
+    source_id(immutable)
+    if old is not None:
+        source_id(old)
+    permitted = (b"", (immutable + "\n").encode()) if old is None else ((old + "\n").encode(), (immutable + "\n").encode())
+    require(present in permitted, "resource-target-tag-conflict")
+    return present != (immutable + "\n").encode()
+
+
+def prepare(proof, source_socket, control, directory, owner, deadline, full=False, previous=None, build=None):
+    directory, source_socket = safe_path(directory), safe_path(source_socket)
+    require(not os.path.lexists(directory), "resource-evidence-exists")
+    directory.mkdir(mode=0o700)
+    bootstrap.write_new(directory / "producer.py", bounded_read(SCRIPT, MIB))
+    endpoint, engine = connection(control, proof, owner, deadline)
+    source = "unix://" + str(source_socket)
+    commands = bootstrap.Commands(owner, deadline, directory)
+    source_engine = commands.run(["docker", "--host", source, "info", "--format", "{{.ID}}"], clean=True).decode().strip()
+    require(source != endpoint and source_engine != engine, "resource-distinct-daemons")
+    before_source = catalog(owner, source, deadline, source_engine)
+    before_target = catalog(owner, endpoint, deadline, engine)
+    selected = FULL_SOURCES if full else SOURCES
+    budget = (4 if full else 2) * LIMIT
+    expected = {name: captured(owner, source, name, deadline, source_engine) for name in selected}
+    bootstrap.publish(directory / "entry.json", {"profile": proof["profile"], "engine": engine,
+        "sourceEngine": source_engine, "sources": expected, "sourceIds": sorted(before_source),
+        "targetIds": sorted(before_target), "scriptSha256": sha(SCRIPT)})
+    prior = None
+    if previous is not None:
+        previous, build = safe_path(previous), safe_path(build)
+        private(previous)
+        private(build)
+        prior_raw = bounded_read(previous / "images.json", 65536)
+        prior = image_receipt(document(prior_raw), engine)
+        require_producer(previous, document(bounded_read(previous / "entry.json", 65536)))
+        require(full and prior["selection"] == "full" and prior["sourceEngine"] == source_engine
+                and prior["sourceSocket"] == str(source_socket) and set(prior["sourceIds"]) <= before_source,
+                "resource-refresh-affiliation")
+        build_raw = bounded_read(build / "report.json", 65536)
+        built = document(build_raw)
+        from rootless_functional import source_seal
+        current = hashlib.sha256(json.dumps(source_seal(owner, deadline), sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+        require(built.get("sourceSealSha256") == current, "resource-refresh-stale-build")
+        allowed = REFRESH_SOURCES
+        require(built.get("schemaVersion") == 1 and built.get("engine") == source_engine
+                and built.get("sourceSocket") == str(source_socket) and built.get("allChildGroupsJoined") is True
+                and set(built.get("images", {})) == set(allowed)
+                and all(built["images"][name] == expected[name] for name in allowed), "resource-refresh-build")
+        require(hashlib.sha256(bounded_read(build / "build.log", 16 * MIB)).hexdigest() == built.get("logSha256"), "resource-refresh-build-log")
+        for row in prior["images"]:
+            name = row["name"]
+            require(captured(owner, endpoint, name, deadline, engine) == row["image"]
+                    and captured(owner, endpoint, row["cacheAlias"], deadline, engine, name) == row["image"],
+                    "resource-refresh-old-anchor")
+            require(name in allowed or expected[name] == row["image"], "resource-refresh-nonallowlisted-image")
+        bootstrap.write_new(directory / "build-receipt.json", build_raw)
+        bootstrap.publish(directory / "refresh.json", {"previous": str(previous), "previousReceiptSha256":
+            hashlib.sha256(prior_raw).hexdigest(), "buildReceiptSha256": hashlib.sha256(build_raw).hexdigest()})
+    rows, total = [], 0
+    for index, name in enumerate(selected):
+        archive = directory / ("image-%d.tar" % index)
+        bootstrap.write_new(archive, b"")
+        immutable = expected[name]["id"]
+        arguments = [sys.executable, "-I", "-B", str(SCRIPT.with_name("image_performance_images.py")),
+                     "save", str(source_socket), str(archive), immutable, str(min(2 * LIMIT, budget - total)), "v1"]
+        bootstrap.publish(directory / ("image-%d.intent.json" % index), {"argv": arguments})
+        fenced(owner, source, source_engine, arguments, deadline, 120)
+        size, digest = hash_file(archive, deadline)
+        total += size
+        require(total <= budget, "resource-archive-total-budget")
+        fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "load", "--input", str(archive)], deadline, 120)
+        require(captured(owner, endpoint, immutable, deadline, engine, name) == expected[name], "resource-import-differs")
+        cache = retain_content(owner, endpoint, immutable, deadline, engine)
+        require(captured(owner, endpoint, cache, deadline, engine, name) == expected[name], "resource-cache-differs")
+        if "@sha256:" in name:
+            pull = ["docker", "--host", endpoint, "image", "pull", "--platform", "linux/arm64", name]
+            bootstrap.publish(directory / ("image-%d-digest.intent.json" % index), {"argv": pull, "expectedId": immutable})
+            fenced(owner, endpoint, engine, pull, deadline, 120)
+            require(image(owner, endpoint, name, deadline, engine) == expected[name], "resource-import-digest-differs")
+            require(hash_file(archive, deadline) == (size, digest), "resource-import-changed")
+            rows.append({"name": name, "image": expected[name], "archive": str(archive), "bytes": size,
+                         "sha256": digest, "cacheAlias": cache})
+            continue
+        present = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "ls", "--all", "--no-trunc",
+            "--filter", "reference=" + name, "--format", "{{.ID}}"], deadline)
+        old = next((row["image"]["id"] for row in prior["images"] if row["name"] == name), None) if prior else None
+        if tag_policy(present, immutable, old):
+            bootstrap.publish(directory / ("image-%d-tag.intent.json" % index),
+                {"name": name, "oldId": old, "newId": immutable, "engine": engine})
+            fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "tag", immutable, name], deadline)
+        require(captured(owner, endpoint, name, deadline, engine) == expected[name]
+                and hash_file(archive, deadline) == (size, digest), "resource-import-changed")
+        rows.append({"name": name, "image": expected[name], "archive": str(archive), "bytes": size,
+                     "sha256": digest, "cacheAlias": cache})
+    require(catalog(owner, source, deadline, source_engine) == before_source
+            and all(captured(owner, source, name, deadline, source_engine) == expected[name] for name in selected)
+            and catalog(owner, endpoint, deadline, engine) == before_target | {row["image"]["id"] for row in rows},
+            "resource-source-or-target-changed")
+    bootstrap.publish(directory / "images.json", {"engine": engine, "sourceEngine": source_engine,
+        "sourceSocket": str(source_socket), "sourceIds": sorted(before_source), "images": rows,
+        "selection": "full" if full else "kernel"})
+    nonce = uuid.uuid4().hex
+    name = "rustack-rootless-d104-" + nonce[:12]
+    bootstrap.publish(directory / "network-intent.json", {"engine": engine, "name": name, "nonce": nonce})
+    identity = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "network", "create", "--driver", "bridge",
+        "--label", LABEL + "=" + nonce, name], deadline).decode().strip()
+    row = network(document(fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "network", "inspect", identity], deadline)), name, nonce)
+    require(row["Id"] == identity, "resource-network-id")
+    bootstrap.publish(directory / "network.json", {"engine": engine, "name": name, "nonce": nonce, "id": identity,
+        "inspection": row})
+    return {"images": len(rows), "archiveBytes": total, "engine": engine, "network": identity}
+
+
+def verify_output(raw, expected):
+    summary(raw, len(expected), 0)
+    text = raw.decode()
+    require(not re.search(r"^test result: FAILED|^test .* \.\.\. FAILED$", text, re.MULTILINE), "resource-failed-status")
+    rows = re.findall(r"^test ([A-Za-z0-9_:]+) \.\.\. (?!ignored\b)", text, re.MULTILINE)
+    require(len(rows) == len(expected) and set(rows) == set(expected), "resource-exact-success-rows")
+
+
+def private_aliases(raw):
+    require(isinstance(raw, bytes) and len(raw) <= 32768, "resource-alias-inventory-bound")
+    rows = raw.decode("ascii").splitlines()
+    require(len(rows) <= 256 and all(0 < len(row) <= 1024 for row in rows), "resource-alias-inventory-shape")
+    for row in rows:
+        familiar = row
+        for prefix in ("docker.io/", "index.docker.io/"):
+            if familiar.startswith(prefix):
+                familiar = familiar[len(prefix):]
+                break
+        if familiar.startswith("library/"):
+            familiar = familiar[len("library/"):]
+        require(not familiar.startswith(("rustack-internal/lambda-", "rustack-test-source")),
+                "resource-private-alias-remnant")
+
+
+def require_producer(preparation, entry):
+    require(isinstance(entry, dict) and isinstance(entry.get("scriptSha256"), str)
+            and re.fullmatch(r"[0-9a-f]{64}", entry["scriptSha256"]), "resource-producer-record")
+    require(sha(preparation / "producer.py") == entry["scriptSha256"], "resource-producer-source")
+
+
+def image_receipt(value, engine):
+    require(isinstance(value, dict) and set(value) == {"engine", "sourceEngine", "sourceSocket", "sourceIds", "images", "selection"}
+            and value["engine"] == engine and value["sourceEngine"] != engine, "resource-image-receipt")
+    require(value["selection"] in ("kernel", "full"), "resource-image-selection")
+    engine_id(value["sourceEngine"])
+    safe_path(value["sourceSocket"])
+    require(isinstance(value["sourceIds"], list) and len(value["sourceIds"]) <= 256
+            and len(set(value["sourceIds"])) == len(value["sourceIds"]), "resource-source-id-list")
+    for identity in value["sourceIds"]:
+        source_id(identity)
+    rows = value["images"]
+    selected = FULL_SOURCES if value["selection"] == "full" else SOURCES
+    require(isinstance(rows, list) and len(rows) == len(selected), "resource-image-count")
+    total = 0
+    for name, row in zip(selected, rows):
+        require(isinstance(row, dict) and set(row) == {"name", "image", "archive", "bytes", "sha256", "cacheAlias"}
+                and row["name"] == name and isinstance(row["image"], dict)
+                and set(row["image"]) == {"id", "os", "architecture", "bytes"}, "resource-image-row")
+        captured = row["image"]
+        source_id(captured["id"])
+        platform = ("windows", "amd64") if name == "rustack-invalid-os:arm64" else ("linux", "amd64") if name == "rustack-invalid-architecture:arm64" else ("linux", "arm64")
+        require((captured["os"], captured["architecture"]) == platform
+                and type(captured["bytes"]) is int and 1 <= captured["bytes"] <= LIMIT
+                and row["cacheAlias"] == cache_alias(captured["id"])
+                and type(row["bytes"]) is int and 1 <= row["bytes"] <= LIMIT
+                and isinstance(row["sha256"], str) and re.fullmatch(r"[0-9a-f]{64}", row["sha256"]),
+                "resource-image-policy")
+        safe_path(row["archive"])
+        total += row["bytes"]
+    require(total <= (4 if value["selection"] == "full" else 2) * LIMIT, "resource-archive-total-budget")
+    return value
+
+
+def kernel(proof, control, directory, target, owner, deadline):
+    directory, target = safe_path(directory), safe_path(target)
+    private(directory)
+    endpoint, engine = connection(control, proof, owner, deadline)
+    images = image_receipt(document(bounded_read(directory / "images.json", 65536)), engine)
+    entry = document(bounded_read(directory / "entry.json", 65536))
+    require_producer(directory, entry)
+    bridge = document(bounded_read(directory / "network.json", 65536))
+    require(images["engine"] == bridge["engine"] == engine, "resource-receipt-engine")
+    live = network(document(fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "network", "inspect", bridge["id"]], deadline)), bridge["name"], bridge["nonce"])
+    require(live["Id"] == bridge["id"], "resource-network-id")
+    owner.environment.update(RUSTACK_RUNTIME_DOCKER_SOCKET=endpoint[7:], RUSTACK_RUNTIME_ARCH="arm64",
+        RUSTACK_RUNTIME_IMAGE=SOURCES[0], RUSTACK_RUNTIME_NETWORK=bridge["name"])
+    attempt = uuid.uuid4().hex
+    commands = bootstrap.Commands(owner, deadline, directory / ("kernel-" + attempt))
+    commands.evidence.mkdir(mode=0o700)
+    arguments = ["cargo", "test", "--locked", "--target-dir", str(target), "-p", "rustack-lambda-core", "--test", "docker_probe", "--"]
+    required = parse_manifest(bounded_read(SCRIPT.with_name("docker-required-suites.json"), 65536))["docker-probe"]
+    actual = parse_inventory(commands.run(arguments + ["--ignored", "--list", "--color", "never"], 300))
+    require(actual == required and len(required) == 2, "resource-kernel-inventory")
+    raw = commands.run(arguments + ["--ignored", "--test-threads=1", "--nocapture"], 300)
+    verify_output(raw, required)
+    for tail in (["ps", "--all", "--quiet"], ["volume", "ls", "--quiet"]):
+        require(fenced(owner, endpoint, engine, ["docker", "--host", endpoint] + tail, deadline) == b"", "resource-remnants")
+    aliases = fenced(owner, endpoint, engine, ["docker", "--host", endpoint, "image", "ls", "--all", "--format", "{{.Repository}}:{{.Tag}}"], deadline)
+    bootstrap.write_new(commands.evidence / "aliases.stdout", aliases)
+    private_aliases(aliases)
+    for row in images["images"]:
+        require(captured(owner, endpoint, row["cacheAlias"], deadline, engine, row["name"]) == row["image"]
+                and captured(owner, endpoint, row["name"], deadline, engine) == row["image"], "resource-source-image-lost")
+    source = "unix://" + images["sourceSocket"]
+    require(catalog(owner, source, deadline, images["sourceEngine"]) == set(images["sourceIds"])
+            and all(captured(owner, source, row["name"], deadline, images["sourceEngine"]) == row["image"]
+                    for row in images["images"]), "resource-original-source-changed")
+    result = {"schemaVersion": 1, "engine": engine, "exactResourcesPassed": sorted(required),
+              "kernelPolicyQualified": True, "platformQualification": "pending", "scriptSha256": sha(SCRIPT),
+              "attempt": attempt, "rawEvidence": str(commands.evidence)}
+    bootstrap.publish(directory / ("kernel-result-" + attempt + ".json"), result)
+    return result
+
+
+def main():
+    mode = sys.argv[1] if len(sys.argv) > 1 else ""
+    try:
+        require((mode == "forward" and len(sys.argv) == 4)
+                or (mode in ("prepare", "prepare-full", "kernel") and len(sys.argv) == 6)
+                or (mode == "refresh-full" and len(sys.argv) == 8), "resource-arguments")
+        proof = attestation(sys.argv[2])
+        owner = Runner(os.environ)
+        with deadline_guard(3600 if mode == "forward" else 700, owner) as deadline:
+            require(status(owner, proof["profile"], deadline) == proof["profileConfiguration"], "resource-profile-changed")
+            if mode == "forward":
+                forward(proof, sys.argv[3], owner, deadline)
+                result = {"forwardJoined": True}
+            elif mode == "refresh-full":
+                result = prepare(proof, *sys.argv[3:6], owner, deadline, full=True, previous=sys.argv[6], build=sys.argv[7])
+            elif mode in ("prepare", "prepare-full"):
+                result = prepare(proof, *sys.argv[3:], owner, deadline, full=mode == "prepare-full")
+            else:
+                result = kernel(proof, *sys.argv[3:], owner, deadline)
+            print(json.dumps(result, separators=(",", ":")), flush=True)
+        return 0
+    except (ActionError, QualificationError) as error:
+        if mode == "forward" and str(error) == "qualification-interrupted":
+            result = document(bounded_read(safe_path(sys.argv[3]) / "final.json", 65536))
+            if result["childGroupJoined"] is True and result["socketRemoved"] is True:
+                return 0
+        print("rootless-resource-failed:" + str(error), file=sys.stderr)
+        return 2
+    except (OSError, ValueError, KeyError, TypeError, RecursionError):
+        print("rootless-resource-failed", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/rust_gates.py b/tests/workflows/rust_gates.py
new file mode 100644
index 00000000..e62ada04
--- /dev/null
+++ b/tests/workflows/rust_gates.py
@@ -0,0 +1,88 @@
+"""One source-sealed Rust verification sequence with bounded owned diagnostics."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import sys
+import time
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import rootless_platform as storage
+from rootless_functional import retain_source_seal, source_seal
+from linux_performance import QualificationError, Runner, bounded_read, deadline_guard, require, safe_path
+from settings import ActionError
+
+GATES = (
+    ("build", ["cargo", "build", "--locked", "--workspace", "--all-targets"]),
+    ("feature-build", ["cargo", "build", "--locked", "--workspace", "--all-targets", "--features", "stepfunctions"]),
+    ("test", ["cargo", "test", "--locked", "--workspace", "--all-targets"]),
+    ("feature-test", ["cargo", "test", "--locked", "--workspace", "--all-targets", "--features", "stepfunctions"]),
+    ("doctest", ["cargo", "test", "--locked", "--workspace", "--doc"]),
+    ("feature-doctest", ["cargo", "test", "--locked", "--workspace", "--features", "stepfunctions", "--doc"]),
+    ("fmt", ["make", "fmt-check"]),
+    ("clippy", ["cargo", "clippy", "--locked", "--workspace", "--all-targets", "--", "-D", "warnings"]),
+    ("feature-clippy", ["cargo", "clippy", "--locked", "--workspace", "--all-targets", "--features", "stepfunctions", "--", "-D", "warnings"]),
+    ("rustdoc", ["cargo", "doc", "--locked", "--workspace", "--no-deps"]),
+    ("feature-rustdoc", ["cargo", "doc", "--locked", "--workspace", "--no-deps", "--features", "stepfunctions"]),
+    ("strict-core", ["cargo", "clippy", "--locked", "-p", "rustack-lambda-core", "--lib", "--no-deps", "--",
+                     "-D", "warnings", "-W", "clippy::pedantic", "-W", "clippy::unwrap_used",
+                     "-W", "clippy::expect_used", "-W", "clippy::indexing_slicing", "-W", "clippy::panic"]),
+    ("strict-consumer", ["cargo", "clippy", "--locked", "-p", "rustack-cli", "--bin", "rustack", "--test", "docker_startup",
+                         "--no-default-features", "--features", "lambda,stepfunctions,s3,dynamodb", "--no-deps", "--",
+                         "-D", "warnings", "-W", "clippy::pedantic"]),
+    ("audit", ["cargo", "audit"]),
+    ("deny", ["cargo", "deny", "check"]),
+)
+
+
+def run(directory, owner, deadline, gates=None):
+    selected = GATES if gates is None else gates
+    require(not os.path.lexists(directory), "rust-gates-evidence-exists")
+    directory.mkdir(mode=0o700)
+    before = source_seal(owner, deadline)
+    source = retain_source_seal(directory, before)
+    storage.publish(directory / "entry.json", {"schemaVersion": 1, "ownerPid": os.getpid(), **source,
+        "gates": [{"name": name, "argv": argv} for name, argv in selected]})
+    rows = []
+    for name, arguments in selected:
+        require(source_seal(owner, deadline) == before, "rust-gates-source-changed")
+        if name in ("rustdoc", "feature-rustdoc"):
+            owner.environment["RUSTDOCFLAGS"] = "-D warnings"
+        else:
+            owner.environment.pop("RUSTDOCFLAGS", None)
+        log = directory / (name + ".log")
+        cutoff = min(deadline, time.monotonic() + 900)
+        invocation = [sys.executable, "-I", "-B", str(Path(__file__).with_name("gate_command.py")), str(log)] + arguments
+        storage.publish(directory / (name + ".intent.json"), {"argv": invocation, "cutoffMonotonic": cutoff})
+        started = time.monotonic()
+        result = owner.run(invocation, cutoff)
+        row = {"name": name, "argv": arguments, "code": result.code,
+               "seconds": time.monotonic() - started,
+               "logSha256": hashlib.sha256(bounded_read(log, 16 * 1024 * 1024)).hexdigest()}
+        rows.append(row)
+        storage.publish(directory / (name + ".json"), row)
+        print(json.dumps({"gate": name, "code": result.code}), flush=True)
+        require(result.code == 0 and result.stdout == result.stderr == b"", "rust-gate-failed")
+    require(source_seal(owner, deadline) == before, "rust-gates-source-changed")
+    report = {"schemaVersion": 1, **source, "gates": rows, "allChildGroupsJoined": not owner.unsettled}
+    storage.publish(directory / "report.json", report)
+    return report
+
+
+def main():
+    try:
+        require(len(sys.argv) == 2, "rust-gates-arguments")
+        owner = Runner(os.environ)
+        with deadline_guard(5400, owner) as deadline:
+            run(safe_path(sys.argv[1]), owner, deadline)
+        return 0
+    except (ActionError, QualificationError) as error:
+        print("rust-gates-failed:" + str(error), file=sys.stderr)
+        return 2
+    except (OSError, ValueError, KeyError, TypeError):
+        print("rust-gates-failed", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/workflows/sdk-cases.json b/tests/workflows/sdk-cases.json
new file mode 100644
index 00000000..2624c7fc
--- /dev/null
+++ b/tests/workflows/sdk-cases.json
@@ -0,0 +1,755 @@
+{
+  "schemaVersion": 1,
+  "profile": "rustack-standard-jsonpath-v1",
+  "evidence": "Document-derived literal expectations, not an AWS-observed execution or Rustack-evaluator oracle. Builds on semantic-cases.json and its pinned provenance.",
+  "sources": {
+    "asl": "https://states-language.net/spec.html",
+    "pipeline": "https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html",
+    "errors": "https://docs.aws.amazon.com/step-functions/latest/dg/concepts-error-handling.html",
+    "intrinsics": "https://docs.aws.amazon.com/step-functions/latest/dg/intrinsic-functions.html",
+    "paths": "https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-paths.html",
+    "choice": "https://docs.aws.amazon.com/step-functions/latest/dg/state-choice.html",
+    "quotas": "../../specs/rustack-workflows-60-operations-design.md#12-tunable-budgets"
+  },
+  "localBudgets": {
+    "workflowTransitions": 80,
+    "workflowHistoryBytes": 1048576,
+    "workflowTotalHistoryBytes": 8388608
+  },
+  "cases": [
+    {
+      "id": "paths",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Pass",
+            "Parameters": {
+              "quoted.$": "$['odd.key']",
+              "ids.$": "$.items[*].id",
+              "slice.$": "$.values[1:3]",
+              "index.$": "$.values[0]"
+            },
+            "End": true
+          }
+        }
+      },
+      "input": {
+        "odd.key": 17,
+        "items": [
+          {
+            "id": 7
+          },
+          {
+            "id": 9
+          }
+        ],
+        "values": [
+          3,
+          5,
+          8
+        ]
+      },
+      "expectedOutput": {
+        "quoted": 17,
+        "ids": [
+          7,
+          9
+        ],
+        "slice": [
+          5,
+          8
+        ],
+        "index": 3
+      },
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "paths"
+        ]
+      }
+    },
+    {
+      "id": "intrinsics",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Pass",
+            "Parameters": {
+              "format.$": "States.Format('x-{}', $.n)",
+              "from.$": "States.StringToJson($.encoded)",
+              "to.$": "States.JsonToString($.obj)",
+              "array.$": "States.Array(1, 2)",
+              "length.$": "States.ArrayLength($.items)",
+              "get.$": "States.ArrayGetItem($.items, 1)",
+              "contains.$": "States.ArrayContains($.items, 2)",
+              "partition.$": "States.ArrayPartition($.items, 2)",
+              "split.$": "States.StringSplit('a,b;;c', ',;')",
+              "add.$": "States.MathAdd(-1.5, 0)",
+              "uuid.$": "States.UUID()",
+              "merge.$": "States.JsonMerge($.left, $.right, false)"
+            },
+            "End": true
+          }
+        }
+      },
+      "input": {
+        "n": 7,
+        "encoded": "{\"n\":7}",
+        "obj": {
+          "n": 7
+        },
+        "items": [
+          1,
+          2,
+          3
+        ],
+        "left": {
+          "a": 1,
+          "same": 0
+        },
+        "right": {
+          "b": 2,
+          "same": 3
+        }
+      },
+      "uuidField": "uuid",
+      "expectedOutput": {
+        "format": "x-7",
+        "from": {
+          "n": 7
+        },
+        "to": "{\"n\":7}",
+        "array": [
+          1,
+          2
+        ],
+        "length": 3,
+        "get": 2,
+        "contains": true,
+        "partition": [
+          [
+            1,
+            2
+          ],
+          [
+            3
+          ]
+        ],
+        "split": [
+          "a",
+          "b",
+          "c"
+        ],
+        "add": -1,
+        "merge": {
+          "a": 1,
+          "b": 2,
+          "same": 3
+        }
+      },
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "intrinsics"
+        ]
+      }
+    },
+    {
+      "id": "choice-wait-succeed",
+      "definition": {
+        "StartAt": "Choose",
+        "States": {
+          "Choose": {
+            "Type": "Choice",
+            "Choices": [
+              {
+                "And": [
+                  {
+                    "Variable": "$.missing",
+                    "IsPresent": false
+                  },
+                  {
+                    "Variable": "$.v",
+                    "IsNull": true
+                  },
+                  {
+                    "Variable": "$.name",
+                    "StringMatches": "report-*.txt"
+                  },
+                  {
+                    "Variable": "$.when",
+                    "TimestampLessThan": "2030-01-01T00:00:00Z"
+                  }
+                ],
+                "Next": "Wait"
+              }
+            ],
+            "Default": "Fail"
+          },
+          "Wait": {
+            "Type": "Wait",
+            "Seconds": 0,
+            "Next": "Done"
+          },
+          "Done": {
+            "Type": "Succeed"
+          },
+          "Fail": {
+            "Type": "Fail",
+            "Error": "WrongBranch"
+          }
+        }
+      },
+      "input": {
+        "v": null,
+        "name": "report-42.txt",
+        "when": "2026-01-01T00:00:00Z"
+      },
+      "expectedOutput": {
+        "v": null,
+        "name": "report-42.txt",
+        "when": "2026-01-01T00:00:00Z"
+      },
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "choice",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "pipeline",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkCompute",
+            "End": true,
+            "InputPath": "$.request",
+            "Parameters": {
+              "n.$": "$.n"
+            },
+            "ResultSelector": {
+              "answer.$": "$.computed"
+            },
+            "ResultPath": "$.result",
+            "OutputPath": "$"
+          }
+        }
+      },
+      "input": {
+        "ignored": 9,
+        "request": {
+          "n": 21
+        },
+        "trace": "keep"
+      },
+      "expectedOutput": {
+        "ignored": 9,
+        "request": {
+          "n": 21
+        },
+        "trace": "keep",
+        "result": {
+          "answer": 42
+        }
+      },
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "pipeline",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "direct",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkCompute",
+            "End": true,
+            "Parameters": {
+              "n.$": "$.n"
+            },
+            "ResultSelector": {
+              "answer.$": "$.computed"
+            }
+          }
+        }
+      },
+      "input": {
+        "n": 21
+      },
+      "expectedOutput": {
+        "answer": 42
+      },
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "pipeline",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "optimized",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Task",
+            "Resource": "arn:aws:states:::lambda:invoke",
+            "End": true,
+            "Parameters": {
+              "FunctionName": "SdkCompute",
+              "Payload": {
+                "n.$": "$.n"
+              }
+            }
+          }
+        }
+      },
+      "input": {
+        "n": 21
+      },
+      "optimizedComputed": 42,
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "pipeline",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "retry",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkRetry",
+            "End": true,
+            "Parameters": {
+              "n.$": "$.n",
+              "retryCount.$": "$$.State.RetryCount"
+            },
+            "Retry": [
+              {
+                "ErrorEquals": [
+                  "WorkflowTransient"
+                ],
+                "IntervalSeconds": 1,
+                "MaxAttempts": 1,
+                "BackoffRate": 2,
+                "JitterStrategy": "FULL"
+              }
+            ],
+            "ResultSelector": {
+              "answer.$": "$.computed",
+              "attempt.$": "$.retryCount"
+            }
+          }
+        }
+      },
+      "input": {
+        "n": 21
+      },
+      "expectedOutput": {
+        "answer": 42,
+        "attempt": 1
+      },
+      "taskAttempts": 2,
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "function-error-catch",
+      "definition": {
+        "StartAt": "Call",
+        "States": {
+          "Call": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkFail",
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "TestError"
+                ],
+                "ResultPath": "$.failure",
+                "Next": "Recovered"
+              }
+            ],
+            "End": true
+          },
+          "Recovered": {
+            "Type": "Pass",
+            "Parameters": {
+              "error.$": "$.failure.Error",
+              "cause.$": "States.StringToJson($.failure.Cause)"
+            },
+            "End": true
+          }
+        }
+      },
+      "input": {},
+      "expectedOutput": {
+        "error": "TestError",
+        "cause": {
+          "errorMessage": "boom",
+          "errorType": "TestError"
+        }
+      },
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "task-timeout",
+      "definition": {
+        "StartAt": "Call",
+        "States": {
+          "Call": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkSlow",
+            "TimeoutSeconds": 1,
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "States.Timeout"
+                ],
+                "Next": "Recovered",
+                "ResultPath": null
+              }
+            ],
+            "End": true
+          },
+          "Recovered": {
+            "Type": "Pass",
+            "Result": "task-timeout",
+            "End": true
+          }
+        }
+      },
+      "input": {},
+      "expectedOutput": "task-timeout",
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "function-timeout",
+      "definition": {
+        "StartAt": "Call",
+        "States": {
+          "Call": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkFunctionTimeout",
+            "TimeoutSeconds": 5,
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "Sandbox.Timedout"
+                ],
+                "Next": "Recovered",
+                "ResultPath": null
+              }
+            ],
+            "End": true
+          },
+          "Recovered": {
+            "Type": "Pass",
+            "Result": "function-timeout",
+            "End": true
+          }
+        }
+      },
+      "input": {},
+      "expectedOutput": "function-timeout",
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "execution-timeout",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkSlow",
+            "End": true,
+            "TimeoutSeconds": 5,
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "States.ALL"
+                ],
+                "Next": "Caught"
+              }
+            ]
+          },
+          "Caught": {
+            "Type": "Pass",
+            "Result": "wrong",
+            "End": true
+          }
+        },
+        "TimeoutSeconds": 1
+      },
+      "input": {},
+      "expectedStatus": "TIMED_OUT",
+      "expectedError": null,
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "runtime-fatal",
+      "definition": {
+        "StartAt": "Call",
+        "States": {
+          "Call": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkCompute",
+            "Parameters": {
+              "n.$": "$.missing"
+            },
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "States.ALL"
+                ],
+                "Next": "Caught"
+              }
+            ],
+            "End": true
+          },
+          "Caught": {
+            "Type": "Pass",
+            "Result": "wrong",
+            "End": true
+          }
+        }
+      },
+      "input": {},
+      "expectedStatus": "FAILED",
+      "expectedError": "States.Runtime",
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "data-limit-all",
+      "definition": {
+        "StartAt": "Call",
+        "States": {
+          "Call": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkCompute",
+            "Parameters": {
+              "large.$": "States.Format('{}{}', $.large, $.large)"
+            },
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "States.ALL"
+                ],
+                "ResultPath": null,
+                "Next": "Caught"
+              }
+            ],
+            "End": true
+          },
+          "Caught": {
+            "Type": "Pass",
+            "Result": "caught",
+            "End": true
+          }
+        }
+      },
+      "input": {},
+      "largeInputBytes": 140000,
+      "expectedStatus": "FAILED",
+      "expectedError": "States.DataLimitExceeded",
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "data-limit-explicit",
+      "definition": {
+        "StartAt": "Call",
+        "States": {
+          "Call": {
+            "Type": "Task",
+            "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkCompute",
+            "Parameters": {
+              "large.$": "States.Format('{}{}', $.large, $.large)"
+            },
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "States.DataLimitExceeded"
+                ],
+                "ResultPath": null,
+                "Next": "Caught"
+              }
+            ],
+            "End": true
+          },
+          "Caught": {
+            "Type": "Pass",
+            "Result": "caught",
+            "End": true
+          }
+        }
+      },
+      "input": {},
+      "largeInputBytes": 140000,
+      "expectedOutput": "caught",
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "errors",
+          "asl"
+        ]
+      }
+    },
+    {
+      "id": "transition-limit",
+      "definition": {
+        "StartAt": "Loop",
+        "States": {
+          "Loop": {
+            "Type": "Pass",
+            "Next": "Again"
+          },
+          "Again": {
+            "Type": "Choice",
+            "Choices": [
+              {
+                "Variable": "$.again",
+                "BooleanEquals": true,
+                "Next": "Loop"
+              }
+            ],
+            "Default": "Done"
+          },
+          "Done": {
+            "Type": "Succeed"
+          }
+        }
+      },
+      "input": {
+        "again": true
+      },
+      "expectedStatus": "FAILED",
+      "expectedError": "Rustack.TransitionLimitExceeded",
+      "evidence": {
+        "kind": "localQuotaPolicy",
+        "sources": [
+          "quotas"
+        ]
+      }
+    },
+    {
+      "id": "history-byte-limit",
+      "definition": {
+        "StartAt": "Loop",
+        "States": {
+          "Loop": {
+            "Type": "Pass",
+            "Next": "Again"
+          },
+          "Again": {
+            "Type": "Choice",
+            "Choices": [
+              {
+                "Variable": "$.again",
+                "BooleanEquals": true,
+                "Next": "Loop"
+              }
+            ],
+            "Default": "Done"
+          },
+          "Done": {
+            "Type": "Succeed"
+          }
+        }
+      },
+      "input": {
+        "again": true
+      },
+      "largeInputBytes": 80000,
+      "expectedStatus": "FAILED",
+      "expectedError": "States.HistoryLimitExceeded",
+      "evidence": {
+        "kind": "localQuotaPolicy",
+        "sources": [
+          "quotas"
+        ]
+      }
+    },
+    {
+      "id": "explicit-fail",
+      "definition": {
+        "StartAt": "Run",
+        "States": {
+          "Run": {
+            "Type": "Fail",
+            "Error": "FixtureFailure",
+            "Cause": "quoted \"value\" 🙂"
+          }
+        }
+      },
+      "input": {},
+      "expectedStatus": "FAILED",
+      "expectedError": "FixtureFailure",
+      "expectedCause": "quoted \"value\" 🙂",
+      "evidence": {
+        "kind": "documentDerived",
+        "sources": [
+          "asl"
+        ]
+      }
+    }
+  ],
+  "retrievedAt": "2026-10-26"
+}
diff --git a/tests/workflows/semantic-cases.json b/tests/workflows/semantic-cases.json
new file mode 100644
index 00000000..b7ead24c
--- /dev/null
+++ b/tests/workflows/semantic-cases.json
@@ -0,0 +1,659 @@
+{
+  "schemaVersion": 1,
+  "profile": "rustack-standard-jsonpath-v1",
+  "evidence": "Official-document-derived expectations; not AWS-observed executions and not an interpreter test result.",
+  "retrievedAt": "2026-10-25",
+  "sources": {
+    "asl": "https://states-language.net/spec.html",
+    "pipeline": "https://docs.aws.amazon.com/step-functions/latest/dg/input-output-inputpath-params.html",
+    "paths": "https://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-paths.html",
+    "choice": "https://docs.aws.amazon.com/step-functions/latest/dg/state-choice.html",
+    "intrinsics": "https://docs.aws.amazon.com/step-functions/latest/dg/intrinsic-functions.html",
+    "errors": "https://docs.aws.amazon.com/step-functions/latest/dg/concepts-error-handling.html",
+    "nested": "https://docs.aws.amazon.com/step-functions/latest/dg/connect-stepfunctions.html",
+    "start": "https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html",
+    "success": "https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html",
+    "smithy": "https://smithy.io/2.0/aws/protocols/aws-json-1_0-protocol.html#shape-serialization",
+    "nestedSnapshots": "vendors/localstack/tests/aws/services/stepfunctions/v2/callback/test_callback.snapshot.json@45dfee8ce27df00fcac3f91b8071c8156eb5c5c7",
+    "nestedDates": "https://github.com/aws/aws-cdk/issues/5474"
+  },
+  "cases": [
+    {
+      "id": "path-member-index",
+      "kind": "path",
+      "source": "paths",
+      "path": "$.orders[0].total",
+      "input": {
+        "orders": [
+          {
+            "total": 23
+          }
+        ]
+      },
+      "expected": 23
+    },
+    {
+      "id": "path-quoted-member",
+      "kind": "path",
+      "source": "paths",
+      "path": "$['odd.key']",
+      "input": {
+        "odd.key": 17
+      },
+      "expected": 17
+    },
+    {
+      "id": "path-slice",
+      "kind": "path",
+      "source": "pipeline",
+      "path": "$.items[0:2]",
+      "input": {
+        "items": [
+          3,
+          5,
+          8
+        ]
+      },
+      "expected": [
+        3,
+        5
+      ]
+    },
+    {
+      "id": "path-single-selection",
+      "kind": "path",
+      "source": "paths",
+      "path": "$.items[*].id",
+      "input": {
+        "items": [
+          {
+            "id": 7
+          }
+        ]
+      },
+      "expected": [
+        7
+      ]
+    },
+    {
+      "id": "path-null",
+      "kind": "path",
+      "source": "asl",
+      "path": "$.value",
+      "input": {
+        "value": null
+      },
+      "expected": null
+    },
+    {
+      "id": "path-missing",
+      "kind": "path",
+      "source": "errors",
+      "path": "$.missing",
+      "input": {},
+      "expectedError": "States.Runtime"
+    },
+    {
+      "id": "path-context",
+      "kind": "path",
+      "source": "asl",
+      "path": "$$.Execution.Id",
+      "input": {},
+      "context": {
+        "Execution": {
+          "Id": "arn:aws:states:us-east-1:000000000000:execution:P0:one"
+        }
+      },
+      "expected": "arn:aws:states:us-east-1:000000000000:execution:P0:one"
+    },
+    {
+      "id": "pipeline-original-input-merge",
+      "kind": "pipeline",
+      "source": "pipeline",
+      "input": {
+        "keep": 9,
+        "request": {
+          "number": 4
+        }
+      },
+      "inputPath": "$.request",
+      "parameters": {
+        "value.$": "$.number"
+      },
+      "rawResult": {
+        "status": 200,
+        "payload": {
+          "doubled": 8
+        }
+      },
+      "resultSelector": {
+        "value.$": "$.payload.doubled"
+      },
+      "resultPath": "$.result",
+      "outputPath": "$",
+      "expectedTaskInput": {
+        "value": 4
+      },
+      "expected": {
+        "keep": 9,
+        "request": {
+          "number": 4
+        },
+        "result": {
+          "value": 8
+        }
+      }
+    },
+    {
+      "id": "pipeline-null-input",
+      "kind": "pipeline",
+      "source": "pipeline",
+      "input": {
+        "unused": 4
+      },
+      "inputPath": null,
+      "rawResult": {
+        "answer": 7
+      },
+      "resultPath": "$",
+      "outputPath": "$",
+      "expectedTaskInput": {},
+      "expected": {
+        "answer": 7
+      }
+    },
+    {
+      "id": "pipeline-discard-result",
+      "kind": "pipeline",
+      "source": "asl",
+      "input": {
+        "keep": 4
+      },
+      "inputPath": "$",
+      "rawResult": {
+        "discard": 9
+      },
+      "resultPath": null,
+      "outputPath": "$",
+      "expectedTaskInput": {
+        "keep": 4
+      },
+      "expected": {
+        "keep": 4
+      }
+    },
+    {
+      "id": "pipeline-null-output",
+      "kind": "pipeline",
+      "source": "asl",
+      "input": {
+        "keep": 4
+      },
+      "inputPath": "$",
+      "rawResult": {
+        "discard": 9
+      },
+      "resultPath": "$",
+      "outputPath": null,
+      "expectedTaskInput": {
+        "keep": 4
+      },
+      "expected": {}
+    },
+    {
+      "id": "intrinsic-format",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.Format('job-{}-{}', $.kind, $.id)",
+      "input": {
+        "kind": "image",
+        "id": 7
+      },
+      "expected": "job-image-7"
+    },
+    {
+      "id": "intrinsic-string-to-json",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.StringToJson($.text)",
+      "input": {
+        "text": "{\"count\":7}"
+      },
+      "expected": {
+        "count": 7
+      }
+    },
+    {
+      "id": "intrinsic-json-to-string",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.JsonToString($.value)",
+      "input": {
+        "value": {
+          "count": 7
+        }
+      },
+      "expected": "{\"count\":7}"
+    },
+    {
+      "id": "intrinsic-array",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.Array($.first, $.second)",
+      "input": {
+        "first": 2,
+        "second": 5
+      },
+      "expected": [
+        2,
+        5
+      ]
+    },
+    {
+      "id": "intrinsic-array-length",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.ArrayLength($.items)",
+      "input": {
+        "items": [
+          3,
+          7,
+          11
+        ]
+      },
+      "expected": 3
+    },
+    {
+      "id": "intrinsic-array-get-item",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.ArrayGetItem($.items, 1)",
+      "input": {
+        "items": [
+          3,
+          7,
+          11
+        ]
+      },
+      "expected": 7
+    },
+    {
+      "id": "intrinsic-array-contains",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.ArrayContains($.items, 7)",
+      "input": {
+        "items": [
+          3,
+          7,
+          11
+        ]
+      },
+      "expected": true
+    },
+    {
+      "id": "intrinsic-array-partition",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.ArrayPartition($.items, 2)",
+      "input": {
+        "items": [
+          3,
+          7,
+          11
+        ]
+      },
+      "expected": [
+        [
+          3,
+          7
+        ],
+        [
+          11
+        ]
+      ]
+    },
+    {
+      "id": "intrinsic-string-split",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.StringSplit($.text, '+=:')",
+      "input": {
+        "text": "red+green=blue:gold"
+      },
+      "expected": [
+        "red",
+        "green",
+        "blue",
+        "gold"
+      ]
+    },
+    {
+      "id": "intrinsic-math-add",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.MathAdd($.left, $.right)",
+      "input": {
+        "left": 2.6,
+        "right": 3.4
+      },
+      "expected": 6
+    },
+    {
+      "id": "intrinsic-json-merge",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.JsonMerge($.left, $.right, false)",
+      "input": {
+        "left": {
+          "nested": {
+            "a": 1
+          },
+          "keep": 7
+        },
+        "right": {
+          "nested": {
+            "b": 2
+          }
+        }
+      },
+      "expected": {
+        "nested": {
+          "b": 2
+        },
+        "keep": 7
+      }
+    },
+    {
+      "id": "intrinsic-uuid",
+      "kind": "intrinsic",
+      "source": "intrinsics",
+      "expression": "States.UUID()",
+      "input": {},
+      "expectedPattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+    },
+    {
+      "id": "choice-missing-guard",
+      "kind": "choice",
+      "source": "choice",
+      "input": {},
+      "rule": {
+        "And": [
+          {
+            "Variable": "$.optional",
+            "IsPresent": true
+          },
+          {
+            "Variable": "$.optional",
+            "StringEquals": "yes"
+          }
+        ]
+      },
+      "expected": false
+    },
+    {
+      "id": "choice-wrong-type",
+      "kind": "choice",
+      "source": "asl",
+      "input": {
+        "value": "7"
+      },
+      "rule": {
+        "Variable": "$.value",
+        "NumericEquals": 7
+      },
+      "expected": false
+    },
+    {
+      "id": "choice-is-null",
+      "kind": "choice",
+      "source": "asl",
+      "input": {
+        "value": null
+      },
+      "rule": {
+        "Variable": "$.value",
+        "IsNull": true
+      },
+      "expected": true
+    },
+    {
+      "id": "choice-string-matches",
+      "kind": "choice",
+      "source": "choice",
+      "input": {
+        "value": "build-123.json"
+      },
+      "rule": {
+        "Variable": "$.value",
+        "StringMatches": "build-*.json"
+      },
+      "expected": true
+    },
+    {
+      "id": "retry-zero",
+      "kind": "retry",
+      "source": "errors",
+      "retry": [
+        {
+          "ErrorEquals": [
+            "States.ALL"
+          ],
+          "MaxAttempts": 0
+        }
+      ],
+      "failures": [
+        "ExampleError"
+      ],
+      "expectedAttempts": 1,
+      "expectedDelays": []
+    },
+    {
+      "id": "retry-backoff",
+      "kind": "retry",
+      "source": "errors",
+      "retry": [
+        {
+          "ErrorEquals": [
+            "ExampleError"
+          ],
+          "IntervalSeconds": 2,
+          "BackoffRate": 3,
+          "MaxAttempts": 2
+        }
+      ],
+      "failures": [
+        "ExampleError",
+        "ExampleError",
+        "ExampleError"
+      ],
+      "expectedAttempts": 3,
+      "expectedDelays": [
+        2,
+        6
+      ]
+    },
+    {
+      "id": "retry-capped",
+      "kind": "retry",
+      "source": "errors",
+      "retry": [
+        {
+          "ErrorEquals": [
+            "ExampleError"
+          ],
+          "IntervalSeconds": 2,
+          "BackoffRate": 3,
+          "MaxDelaySeconds": 4,
+          "MaxAttempts": 2
+        }
+      ],
+      "failures": [
+        "ExampleError",
+        "ExampleError",
+        "ExampleError"
+      ],
+      "expectedAttempts": 3,
+      "expectedDelays": [
+        2,
+        4
+      ]
+    },
+    {
+      "id": "matcher-timeout",
+      "kind": "errorMatcher",
+      "source": "errors",
+      "error": "States.Timeout",
+      "matcher": "States.TaskFailed",
+      "expected": false
+    },
+    {
+      "id": "matcher-runtime",
+      "kind": "errorMatcher",
+      "source": "errors",
+      "error": "States.Runtime",
+      "matcher": "States.ALL",
+      "expected": false
+    },
+    {
+      "id": "matcher-data-limit-all",
+      "kind": "errorMatcher",
+      "source": "errors",
+      "error": "States.DataLimitExceeded",
+      "matcher": "States.ALL",
+      "expected": false
+    },
+    {
+      "id": "matcher-data-limit-explicit",
+      "kind": "errorMatcher",
+      "source": "errors",
+      "error": "States.DataLimitExceeded",
+      "matcher": "States.DataLimitExceeded",
+      "expected": true
+    },
+    {
+      "id": "nested-sync-string",
+      "kind": "nestedResult",
+      "source": "nestedSnapshots",
+      "resource": "arn:aws:states:::states:startExecution.sync",
+      "childOutput": {
+        "computed": 42
+      },
+      "expectedOutput": "{\"computed\":42}",
+      "childInput": {
+        "value": 7
+      },
+      "expectedInput": "{\"value\":7}"
+    },
+    {
+      "id": "nested-sync-json",
+      "kind": "nestedResult",
+      "source": "nestedSnapshots",
+      "resource": "arn:aws:states:::states:startExecution.sync:2",
+      "childOutput": {
+        "computed": 42
+      },
+      "expectedOutput": {
+        "computed": 42
+      },
+      "childInput": {
+        "value": 7
+      },
+      "expectedInput": {
+        "value": 7
+      }
+    },
+    {
+      "id": "wire-input-string",
+      "kind": "wire",
+      "source": "start",
+      "operation": "StartExecution",
+      "request": {
+        "stateMachineArn": "arn:aws:states:us-east-1:000000000000:stateMachine:P0",
+        "name": "one",
+        "input": "{ \"value\": 7 }"
+      },
+      "expectedTarget": "AWSStepFunctions.StartExecution"
+    },
+    {
+      "id": "callback-completed",
+      "kind": "callbackError",
+      "source": "success",
+      "tokenState": "completed",
+      "expectedError": "TaskTimedOut"
+    },
+    {
+      "id": "callback-cancelled",
+      "kind": "callbackError",
+      "source": "success",
+      "tokenState": "cancelled",
+      "expectedError": "TaskTimedOut"
+    },
+    {
+      "id": "callback-expired",
+      "kind": "callbackError",
+      "source": "success",
+      "tokenState": "expired",
+      "expectedError": "TaskTimedOut"
+    },
+    {
+      "id": "callback-retried",
+      "kind": "callbackError",
+      "source": "success",
+      "tokenState": "revoked",
+      "expectedError": "TaskTimedOut"
+    },
+    {
+      "id": "callback-unknown",
+      "kind": "callbackError",
+      "source": "success",
+      "tokenState": "unknown",
+      "expectedError": "InvalidToken"
+    },
+    {
+      "id": "timestamp-fractional",
+      "kind": "wireTimestamp",
+      "source": "smithy",
+      "epochSeconds": 0.125,
+      "expectedWireType": "number"
+    },
+    {
+      "id": "timestamp-negative",
+      "kind": "wireTimestamp",
+      "source": "smithy",
+      "epochSeconds": -0.125,
+      "expectedWireType": "number"
+    },
+    {
+      "id": "nested-dates-milliseconds",
+      "kind": "nestedTimestamp",
+      "source": "nestedDates",
+      "epochSeconds": 1.125,
+      "expectedStartDate": 1125,
+      "evidenceLimitation": "Historic direct AWS result; current live AWS differential not performed."
+    },
+    {
+      "id": "nested-null-input-default",
+      "kind": "nestedInput",
+      "source": "nestedSnapshots",
+      "input": null,
+      "expectedApiInput": "{}"
+    },
+    {
+      "id": "nested-string-input-preserved",
+      "kind": "nestedInput",
+      "source": "start",
+      "input": "{ \"value\": 7 }",
+      "expectedApiInput": "{ \"value\": 7 }"
+    },
+    {
+      "id": "nested-object-input",
+      "kind": "nestedInput",
+      "source": "nestedSnapshots",
+      "input": {
+        "value": 7
+      },
+      "expectedApiInput": "{\"value\":7}"
+    }
+  ]
+}
diff --git a/tests/workflows/server_container_oracle.py b/tests/workflows/server_container_oracle.py
new file mode 100644
index 00000000..9d1327ad
--- /dev/null
+++ b/tests/workflows/server_container_oracle.py
@@ -0,0 +1,47 @@
+"""Independent literal computations and the container's internal SDK origin."""
+import re
+
+ORIGINS = frozenset(("server_container_sdk.py", "server_container_oracle.py",
+                     "handler_sdk_image.py", "lambda_fault_support.py", "stepfunctions_history.py",
+                     "stepfunctions_nested.py"))
+
+
+def failure_origin(error):
+    """Return public source coordinates only; never format the exception."""
+    trace, origin = error.__traceback__, "unknown"
+    for _ in range(32):
+        if trace is None:
+            return origin
+        name = trace.tb_frame.f_code.co_filename.rsplit("/", 1)[-1]
+        if name in ORIGINS and 1 <= trace.tb_lineno <= 10000:
+            origin = name + ":" + str(trace.tb_lineno)
+        trace = trace.tb_next
+    return "unknown"
+
+
+def internal_origin(value):
+    assert isinstance(value, str) and re.fullmatch(r"http://rustack-server-[0-9a-f]{32}:4566/", value)
+    return value
+
+
+def container_id(value):
+    assert isinstance(value, str) and re.fullmatch(r"[0-9a-f]{64}", value)
+    return value
+
+
+def result(value, computed, counter, architecture):
+    assert isinstance(value, dict) and set(value) == {
+        "computed", "counter", "versions", "selectorsCleared", "nodeVersion", "architecture"}
+    assert type(value["computed"]) is int and value["computed"] == computed
+    assert type(value["counter"]) is int and value["counter"] == counter
+    assert value["versions"] == {"s3": "3.1105.0", "dynamodb": "3.1105.0"}
+    assert value["selectorsCleared"] is True and value["nodeVersion"] == "24.22.1"
+    assert value["architecture"] == {"arm64": "arm64", "x86_64": "x64"}[architecture]
+
+
+def warm(previous, current):
+    assert isinstance(current, dict) and set(current) == {"function", "relay"}
+    assert container_id(current["function"]) != container_id(current["relay"])
+    if previous is not None:
+        assert previous == current, "server-container warm environment changed"
+    return current
diff --git a/tests/workflows/server_container_sdk.py b/tests/workflows/server_container_sdk.py
new file mode 100644
index 00000000..d7197c87
--- /dev/null
+++ b/tests/workflows/server_container_sdk.py
@@ -0,0 +1,166 @@
+"""Actual signed clients and managed handler SDKs through a Linux server container."""
+import json
+import os
+import re
+import sys
+import time
+import uuid
+
+from handler_sdk_image import configuration_omits_sdk, inspect_sdk_origin
+from lambda_fault_support import Metadata, invoke_json, poll_response
+from node_image_sdk import deployed
+from server_container_oracle import container_id, failure_origin, internal_origin, result, warm
+from stepfunctions_nested import check_history
+from stepfunctions_history import assert_omitted, history
+
+
+def independent_data(s3, dynamodb, bucket, table, key, expected, literal):
+    body = s3.get_object(Bucket=bucket, Key=key)["Body"]
+    try:
+        assert body.read(4097) == literal
+    finally:
+        body.close()
+    item = dynamodb.get_item(TableName=table, Key={"id": {"S": key}}, ConsistentRead=True)
+    assert item["Item"]["result"] == {"N": str(expected)}
+
+
+def environment(metadata, gateway, previous, name, sdk_source, relay_source, network):
+    pair = warm(previous, inspect_sdk_origin(metadata, gateway, "local-secret"))
+    for role, cid in pair.items():
+        view = metadata.get("/containers/" + cid + "/json")
+        assert view["Id"] == container_id(cid) and view["State"]["Running"] is True
+        assert view["Image"] == {
+            "function": sdk_source, "relay": relay_source}[role]
+        host = view["HostConfig"]
+        assert host["ReadonlyRootfs"] is True and host["Privileged"] is False
+        assert not host.get("Binds") and not host.get("Mounts") and not host.get("VolumesFrom")
+        assert not host.get("PortBindings") and host["PublishAllPorts"] is False
+        assert all(mount.get("Type") == "tmpfs" and mount.get("Destination") == "/tmp"
+                   for mount in view.get("Mounts", []))
+        if role == "function":
+            assert host["NetworkMode"] == "container:" + pair["relay"]
+            assert "AWS_LAMBDA_FUNCTION_NAME=" + name in view["Config"]["Env"]
+        else:
+            assert host["NetworkMode"] == network
+    return pair
+
+
+def exercise(endpoint, image, architecture, socket, owner, engine, gateway, sdk_source, relay_source, network, progress):
+    import boto3
+    from botocore.config import Config
+    assert re.fullmatch(r"http://127\.0\.0\.1:[1-9][0-9]{0,4}", endpoint)
+    assert 1 <= int(endpoint.rsplit(":", 1)[1]) <= 65535
+    assert isinstance(image, str) and 0 < len(image.encode()) <= 256 and not any(c.isspace() for c in image)
+    assert architecture in ("arm64", "x86_64")
+    internal_origin(gateway)
+    assert all(re.fullmatch(r"sha256:[0-9a-f]{64}", source) for source in (sdk_source, relay_source))
+    container_id(network)
+    metadata = Metadata(socket, owner, engine)
+    settings = dict(endpoint_url=endpoint, region_name="us-east-1", aws_access_key_id="local-key",
+                    aws_secret_access_key="local-secret",
+                    config=Config(retries={"max_attempts": 0}, connect_timeout=2, read_timeout=60,
+                                  s3={"addressing_style": "path"}))
+    clients = []
+    try:
+        for service in ("lambda", "s3", "dynamodb", "stepfunctions"):
+            clients.append(boto3.client(service, **settings))
+        function, s3, dynamodb, sfn = clients
+        suffix = uuid.uuid4().hex
+        name, bucket, table = "ServerSdk" + suffix, "server-sdk-" + suffix, "ServerTable" + suffix
+        progress["stage"] = "create-data"
+        s3.create_bucket(Bucket=bucket)
+        dynamodb.create_table(TableName=table, BillingMode="PAY_PER_REQUEST",
+            KeySchema=[{"AttributeName": "id", "KeyType": "HASH"}],
+            AttributeDefinitions=[{"AttributeName": "id", "AttributeType": "S"}])
+        poll_response(lambda: dynamodb.describe_table(TableName=table),
+                      lambda value: value["Table"]["TableStatus"] == "ACTIVE", 30)
+        progress["stage"] = "create-function"
+        function.create_function(FunctionName=name, Role="arn:aws:iam::000000000000:role/ServerSdk",
+            PackageType="Image", Architectures=[architecture], Timeout=30, MemorySize=256,
+            Code={"ImageUri": image}, ImageConfig={"Command": ["handler-sdk.handler"]},
+            Environment={"Variables": {"AWS_PROFILE": "captured-poison",
+                "AWS_ENDPOINT_URL": "http://127.0.0.1:9", "AWS_ENDPOINT_URL_DYNAMODB": "http://127.0.0.1:9"}})
+        configuration_omits_sdk(deployed(function, name))
+        pair = None
+        for value, expected, counter, key, literal in (
+                (21, 42, 1, "first", b"rustack-sdk:21:42"),
+                (23, 46, 2, "second", b"rustack-sdk:23:46")):
+            progress["stage"] = "direct-" + key
+            response, output = invoke_json(function, name, dict(bucket=bucket, table=table,
+                key=key, value=value, mode="roundtrip"))
+            assert "FunctionError" not in response
+            result(output, expected, counter, architecture)
+            independent_data(s3, dynamodb, bucket, table, key, expected, literal)
+            pair = environment(metadata, gateway, pair, name, sdk_source, relay_source, network)
+        progress["stage"] = "nested"
+        child_name, parent_name, child_run = "ServerChild" + suffix, "ServerParent" + suffix, "ChildRun" + suffix
+        child_definition = {"StartAt": "Call", "TimeoutSeconds": 90, "States": {
+            "Call": {"Type": "Task", "Resource": "arn:aws:states:::lambda:invoke",
+                     "Parameters": {"FunctionName": name, "Payload.$": "$"},
+                     "OutputPath": "$.Payload", "TimeoutSeconds": 60, "End": True}}}
+        role = "arn:aws:iam::000000000000:role/ServerSdk"
+        child = sfn.create_state_machine(name=child_name, roleArn=role,
+                                        definition=json.dumps(child_definition))["stateMachineArn"]
+        parent_definition = {"StartAt": "Child", "TimeoutSeconds": 120, "States": {
+            "Child": {"Type": "Task", "Resource": "arn:aws:states:::states:startExecution.sync:2",
+                      "Parameters": {"StateMachineArn": child, "Input.$": "$", "Name": child_run},
+                      "OutputPath": "$.Output", "TimeoutSeconds": 90, "End": True}}}
+        parent = sfn.create_state_machine(name=parent_name, roleArn=role,
+                                         definition=json.dumps(parent_definition))["stateMachineArn"]
+        event = dict(bucket=bucket, table=table, key="third", value=25, mode="roundtrip")
+        parent_execution = sfn.start_execution(stateMachineArn=parent, name="ParentRun" + suffix,
+                                              input=json.dumps(event))["executionArn"]
+        terminal = poll_response(lambda: sfn.describe_execution(executionArn=parent_execution),
+                                 lambda value: value["status"] != "RUNNING", 90)
+        assert terminal["status"] == "SUCCEEDED"
+        output = json.loads(terminal["output"])
+        result(output, 50, 3, architecture)
+        independent_data(s3, dynamodb, bucket, table, "third", 50, b"rustack-sdk:25:50")
+        events = history(sfn, parent_execution)
+        submitted = [event for event in events if event["type"] == "TaskSubmitted"]
+        assert len(submitted) == 1
+        child_execution = json.loads(submitted[0]["taskSubmittedEventDetails"]["output"])["ExecutionArn"]
+        assert child_execution == "arn:aws:states:us-east-1:000000000000:execution:" + child_name + ":" + child_run
+        assert child_execution != parent_execution
+        check_history(sfn, parent_execution, ".sync:2", child_execution, history, assert_omitted)
+        child_terminal = sfn.describe_execution(executionArn=child_execution)
+        assert child_terminal["status"] == "SUCCEEDED" and child_terminal["stateMachineArn"] == child
+        result(json.loads(child_terminal["output"]), 50, 3, architecture)
+        child_events = history(sfn, child_execution)
+        assert [event["type"] for event in child_events] == ["ExecutionStarted", "TaskStateEntered",
+            "TaskScheduled", "TaskStarted", "TaskSucceeded", "TaskStateExited", "ExecutionSucceeded"]
+        for index, child_event in enumerate(child_events):
+            assert child_event["id"] == index + 1 and child_event.get("previousEventId", 0) == (0 if index == 1 else index)
+        pair = environment(metadata, gateway, pair, name, sdk_source, relay_source, network)
+        progress["stage"] = "delete-data"
+        configuration_omits_sdk(function.get_function_configuration(FunctionName=name))
+        sfn.delete_state_machine(stateMachineArn=parent)
+        sfn.delete_state_machine(stateMachineArn=child)
+        for key in ("first", "second", "third"):
+            s3.delete_object(Bucket=bucket, Key=key)
+        s3.delete_bucket(Bucket=bucket)
+        dynamodb.delete_table(TableName=table)
+        # Keep this exact warm pair alive: only the server shutdown may retire it.
+        metadata.wait_ids(set(pair.values()), time.monotonic() + 10)
+        return {"schemaVersion": 1, "cases": ["direct-sdk-cold", "direct-sdk-warm", "nested-sync2-sdk",
+                    "internal-dns-origin", "no-server-mounts", "warm-for-shutdown"],
+                "versions": {"s3": "3.1105.0", "dynamodb": "3.1105.0", "node": "24.22.1"},
+                "computed": [42, 46, 50], "counters": [1, 2, 3], "warm": pair,
+                "parentExecution": parent_execution, "childExecution": child_execution}
+    finally:
+        for client in reversed(clients):
+            client.close()
+
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+    progress = {"stage": "input"}
+    try:
+        assert len(sys.argv) == 11
+        observed = exercise(*sys.argv[1:], progress)
+        print(json.dumps(observed), flush=True)
+    except Exception as error:
+        # Fixed stages only; tracebacks could reproduce credential-bearing source.
+        print("server-container SDK oracle failed at " + progress["stage"], file=sys.stderr)
+        print("origin " + failure_origin(error), file=sys.stderr)
+        raise SystemExit(1)
diff --git a/tests/workflows/server_linker.py b/tests/workflows/server_linker.py
new file mode 100755
index 00000000..3037feba
--- /dev/null
+++ b/tests/workflows/server_linker.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Translate the one obsolete GNU optimization argument for Zig0.16 only."""
+import os
+from pathlib import Path
+import sys
+
+
+def command(arguments, environment):
+    """Keep every effective linker option and diagnostic; never invoke a shell."""
+    if environment.get("CARGO_ZIGBUILD_ZIG_VERSION") != "0.16.0":
+        raise ValueError("unsupported server linker compatibility version")
+    target = environment.get("WORKFLOWS_SERVER_LINKER_TARGET")
+    if target not in ("aarch64-linux-gnu", "x86_64-linux-gnu"):
+        raise ValueError("unsupported server linker target")
+    program = environment.get("WORKFLOWS_SERVER_LINKER_TOOL", "")
+    if not (0 < len(os.fsencode(program)) <= 4096 and Path(program).is_absolute()
+            and not any(ord(character) < 32 or ord(character) == 127 for character in program)):
+        raise ValueError("invalid explicit server linker tool")
+    if not (1 <= len(arguments) <= 4096
+            and all(isinstance(arg, str) and len(os.fsencode(arg)) <= 16384 and "\x00" not in arg
+                    for arg in arguments)
+            and sum(len(os.fsencode(arg)) + 1 for arg in arguments) <= 4 * 1024 * 1024):
+        raise ValueError("server linker argv bound")
+    filtered = [arg for arg in arguments if arg != "-Wl,-O1"]
+    return program, [program, "zig", "cc", "--", "-g", "-fno-sanitize=all", "-target", target, *filtered]
+
+
+def main():
+    try:
+        program, arguments = command(sys.argv[1:], os.environ)
+        os.execv(program, arguments)
+    except (OSError, ValueError):
+        print("server linker compatibility boundary failed", file=sys.stderr)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/workflows/stepfunctions_history.py b/tests/workflows/stepfunctions_history.py
new file mode 100644
index 00000000..2e5c5cfb
--- /dev/null
+++ b/tests/workflows/stepfunctions_history.py
@@ -0,0 +1,31 @@
+"""Import-safe bounded history observations shared by ordinary SDK consumers."""
+
+
+def history(sfn, arn, reverse=False, data=True, *, invoke=None):
+    events, tokens = [], set()
+    token = None
+    while True:
+        params = dict(executionArn=arn, maxResults=7, reverseOrder=reverse, includeExecutionData=data)
+        if token is not None:
+            params["nextToken"] = token
+        page = (sfn.get_execution_history(**params) if invoke is None
+                else invoke(sfn, "get_execution_history", **params))
+        assert isinstance(page["events"], list) and len(page["events"]) <= 7
+        events.extend(page["events"])
+        assert len(events) <= 1000
+        token = page.get("nextToken")
+        if token is None:
+            return events
+        assert isinstance(token, str) and 1 <= len(token.encode()) <= 1024 and token.isascii()
+        assert token not in tokens and len(tokens) < 200
+        tokens.add(token)
+
+
+def assert_omitted(events):
+    for event in events:
+        for details in ["executionStartedEventDetails", "executionSucceededEventDetails", "stateEnteredEventDetails",
+                        "stateExitedEventDetails", "taskSucceededEventDetails", "taskSubmittedEventDetails",
+                        "lambdaFunctionScheduledEventDetails", "lambdaFunctionSucceededEventDetails"]:
+            if details in event:
+                assert not {"input", "output", "inputDetails", "outputDetails"} & set(event[details])
+        assert "taskScheduledEventDetails" not in event
diff --git a/tests/workflows/stepfunctions_http_sdk.py b/tests/workflows/stepfunctions_http_sdk.py
new file mode 100644
index 00000000..63691b20
--- /dev/null
+++ b/tests/workflows/stepfunctions_http_sdk.py
@@ -0,0 +1,45 @@
+"""Ordinary boto3 against a controlled typed HTTP handler, not an ASL engine."""
+
+import json
+import sys
+import uuid
+
+import boto3
+from botocore.config import Config
+from botocore.exceptions import ClientError
+
+client = boto3.client(
+    "stepfunctions",
+    endpoint_url=sys.argv[1],
+    region_name="us-east-1",
+    aws_access_key_id="local-key",
+    aws_secret_access_key="local-secret",
+    config=Config(signature_version="v4", retries={"max_attempts": 0}, connect_timeout=3, read_timeout=5),
+)
+try:
+    started = client.start_execution(
+        stateMachineArn="arn:aws:states:us-east-1:000000000000:stateMachine:wire",
+        name="wire",
+        input=' {"n":7}',
+        traceHeader="",
+    )
+    assert started["executionArn"].endswith(":execution:wire:execution")
+    assert started["startDate"].timestamp() == -1.25
+    uuid.UUID(started["ResponseMetadata"]["RequestId"])
+    listed = client.list_state_machines()
+    assert listed["stateMachines"] == []
+    try:
+        client.describe_execution(executionArn=started["executionArn"])
+        raise AssertionError("expected typed fixture rejection")
+    except ClientError as error:
+        assert error.response["Error"]["Code"] == "ExecutionDoesNotExist"
+        assert error.response["Error"]["Message"] == "fixture missing"
+    try:
+        client.create_activity(name="outside-profile")
+        raise AssertionError("expected unsupported-operation rejection")
+    except ClientError as error:
+        assert error.response["Error"]["Code"] == "UnsupportedOperation"
+        assert error.response["ResponseMetadata"]["HTTPStatusCode"] == 400
+    print(json.dumps({"transportOnly": True, "signedCalls": 4, "epochSeconds": -1.25}))
+finally:
+    client.close()
diff --git a/tests/workflows/stepfunctions_nested.py b/tests/workflows/stepfunctions_nested.py
new file mode 100644
index 00000000..291bad86
--- /dev/null
+++ b/tests/workflows/stepfunctions_nested.py
@@ -0,0 +1,113 @@
+"""Nested ASL acceptance through the actual service and ordinary boto3."""
+
+import io
+import json
+import platform
+import time
+import zipfile
+from pathlib import Path
+
+from stepfunctions_structured import absent
+
+
+def definition(child, suffix, value):
+    return {"StartAt": "T", "States": {"T": {"Type": "Task", "Resource": "arn:aws:states:::states:startExecution" + suffix,
+                                           "Parameters": {"StateMachineArn": child, "Input": value}, "End": True}}}
+
+
+def check_history(sfn, arn, suffix, child, history, omitted):
+    events = history(sfn, arn)
+    kinds = [e["type"] for e in events]
+    expected = ["ExecutionStarted", "TaskStateEntered", "TaskScheduled", "TaskStarted"]
+    if suffix:
+        expected.append("TaskSubmitted")
+    if kinds[-1] == "ExecutionSucceeded":
+        expected += ["TaskSucceeded", "TaskStateExited", "ExecutionSucceeded"]
+        assert kinds == expected, kinds
+    for index, event in enumerate(events):
+        assert event["id"] == index + 1 and event.get("previousEventId", 0) == (0 if index == 1 else index)
+        if event["type"] == "TaskSubmitted":
+            details = event["taskSubmittedEventDetails"]
+            assert details["resourceType"] == "states" and details["resource"] == "startExecution" + suffix
+            assert json.loads(details["output"])["ExecutionArn"] == child
+    reverse = history(sfn, arn, reverse=True, data=False)
+    omitted(reverse)
+    assert [(e["id"], e.get("previousEventId", 0)) for e in reverse] == [(e["id"], e.get("previousEventId", 0)) for e in reversed(events)]
+
+
+def exercise(sfn, lam, bootstrap, markers, create, call, terminal, history, omitted):
+    catalog = json.loads(Path(__file__).with_name("nested-cases.json").read_text())
+    assert catalog["schemaVersion"] == 1 and catalog["profile"] == "rustack-standard-jsonpath-nested-v1"
+    assert len(catalog["cases"]) == 6 and len({c["id"] for c in catalog["cases"]}) == 6
+    child = create(sfn, "SdkNestedEcho", {"StartAt": "D", "States": {"D": {"Type": "Pass", "End": True}}})
+    for case in catalog["cases"]:
+        suffix = case["suffix"]
+        machine = create(sfn, "SdkNested-" + case["id"], definition(child, suffix, case["input"]))
+        arn = call(sfn, "start_execution", stateMachineArn=machine, input="{}", name="Run")["executionArn"]
+        result = terminal(sfn, arn)
+        assert result["status"] == "SUCCEEDED", result
+        output = json.loads(result["output"])
+        nested = terminal(sfn, output["ExecutionArn"])
+        assert json.loads(nested["output"]) == case["expected"]
+        assert isinstance(output["StartDate"], int) and abs(output["StartDate"] - int(nested["startDate"].timestamp() * 1000)) <= 1
+        if suffix:
+            assert output["Status"] == "SUCCEEDED" and output["StateMachineArn"] == child
+            assert output["InputDetails"] == output["OutputDetails"] == {"Included": True}
+            if suffix == ".sync":
+                assert isinstance(output["Input"], str) and isinstance(output["Output"], str)
+                assert json.loads(output["Input"]) == json.loads(output["Output"]) == case["expected"]
+                if isinstance(case["input"], str):
+                    assert output["Input"] == case["input"]
+            else:
+                assert output["Input"] == output["Output"] == case["expected"]
+        check_history(sfn, arn, suffix, output["ExecutionArn"], history, omitted)
+    for stop in [False, True]:
+        gated(sfn, lam, bootstrap, markers, stop, create, call, terminal, history, omitted)
+    return len(catalog["cases"])
+
+
+def gated(sfn, lam, bootstrap, markers, stop, create, call, terminal, history, omitted):
+    name = "SdkNestedStop" if stop else "SdkNestedCompute"
+    directory = Path(markers).parent / name
+    directory.mkdir()
+    (directory / "consumed").mkdir()
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as archive:
+        info = zipfile.ZipInfo("bootstrap")
+        info.external_attr = 0o755 << 16
+        archive.writestr(info, Path(bootstrap).read_bytes())
+    lam.create_function(FunctionName=name, Runtime="provided.al2023", Role="arn:aws:iam::000000000000:role/Workflows",
+                        Handler="bootstrap", Code={"ZipFile": buffer.getvalue()}, Timeout=900,
+                        Architectures=["arm64" if platform.machine().lower() in ("arm64", "aarch64") else "x86_64"],
+                        Environment={"Variables": {"WORKFLOW_MODE": "1", "PROCESS_MARKER_DIR": str(markers),
+                                                   "WORKFLOW_INVOCATION_DIR": str(directory / "consumed"),
+                                                   "WORKFLOW_GATE_FILE": str(directory / "release")}})
+    child = create(sfn, name + "Child", {"StartAt": "L", "States": {"L": {"Type": "Task", "Resource": "arn:aws:lambda:us-east-1:000000000000:function:" + name, "End": True}}})
+    machine = create(sfn, name + "Parent", definition(child, ".sync:2", {"n": 21}))
+    arn = call(sfn, "start_execution", stateMachineArn=machine, input="{}")["executionArn"]
+    deadline = time.monotonic() + 10
+    while True:
+        files = list((directory / "consumed").glob("*.json"))
+        assert len(files) <= 1 and all(f.stat().st_size <= 1024 for f in files)
+        if files:
+            marker = json.loads(files[0].read_bytes())
+            break
+        assert time.monotonic() < deadline, "nested Native handler did not consume"
+        time.sleep(0.005)
+    submitted = [e for e in history(sfn, arn) if e["type"] == "TaskSubmitted"]
+    assert len(submitted) == 1
+    child_arn = json.loads(submitted[0]["taskSubmittedEventDetails"]["output"])["ExecutionArn"]
+    if stop:
+        call(sfn, "stop_execution", executionArn=arn, error="NestedStopped")
+        assert terminal(sfn, arn)["status"] == "ABORTED"
+        assert terminal(sfn, child_arn)["status"] == "ABORTED"
+        absent(marker["pid"])
+    else:
+        (directory / "release").write_bytes(b"release")
+        result = terminal(sfn, arn)
+        assert result["status"] == "SUCCEEDED", result
+        output = json.loads(result["output"])
+        assert output["ExecutionArn"] == child_arn
+        assert output["Output"]["computed"] == 42
+        assert output["Output"]["pid"] == marker["pid"] and output["Output"]["request_id"] == marker["request_id"]
+        check_history(sfn, arn, ".sync:2", child_arn, history, omitted)
diff --git a/tests/workflows/stepfunctions_sdk.py b/tests/workflows/stepfunctions_sdk.py
new file mode 100644
index 00000000..53c02617
--- /dev/null
+++ b/tests/workflows/stepfunctions_sdk.py
@@ -0,0 +1,292 @@
+"""Pinned ordinary boto3 acceptance of the actual Rustack ASL/Native runtime."""
+
+import copy
+import io
+import json
+import platform
+import sys
+import time
+import uuid
+import zipfile
+from concurrent.futures import ThreadPoolExecutor
+from datetime import datetime
+from pathlib import Path
+from urllib.parse import urlsplit
+
+import boto3
+from stepfunctions_structured import exercise as structured_exercise
+from stepfunctions_nested import exercise as nested_exercise
+from stepfunctions_history import assert_omitted, history as read_history
+import botocore
+from botocore.config import Config
+from botocore.exceptions import ClientError
+
+assert boto3.__version__ == "1.43.118" and botocore.__version__ == "1.43.118"
+ENDPOINT, BOOTSTRAP, MARKERS = sys.argv[1:]
+assert urlsplit(ENDPOINT).scheme == "http" and urlsplit(ENDPOINT).hostname == "127.0.0.1"
+ROLE = "arn:aws:iam::000000000000:role/Workflows"
+PREFIX = "arn:aws:states:us-east-1:000000000000:"
+ACTIONS = set()
+
+
+def client(service, secret="local-secret"):
+    return boto3.client(
+        service, endpoint_url=ENDPOINT, region_name="us-east-1",
+        aws_access_key_id="local-key", aws_secret_access_key=secret,
+        config=Config(signature_version="v4", retries={"total_max_attempts": 1}, connect_timeout=2, read_timeout=15),
+    )
+
+
+def call(sfn, action, **args):
+    result = getattr(sfn, action)(**args)
+    ACTIONS.add(action)
+    assert 200 <= result["ResponseMetadata"]["HTTPStatusCode"] < 300
+    uuid.UUID(result["ResponseMetadata"]["RequestId"])
+    return result
+
+
+def rejected(sfn, action, code, **args):
+    try:
+        call(sfn, action, **args)
+    except ClientError as error:
+        assert error.response["Error"]["Code"] == code, error.response
+        return
+    raise AssertionError(f"{action} unexpectedly accepted")
+
+
+def deploy(lam):
+    bootstrap = Path(BOOTSTRAP).read_bytes()
+    assert 0 < len(bootstrap) <= 32 * 1024 * 1024
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as archive:
+        info = zipfile.ZipInfo("bootstrap")
+        info.external_attr = 0o755 << 16
+        archive.writestr(info, bootstrap)
+    for name, env, timeout in [
+        ("SdkCompute", {"WORKFLOW_MODE": "1"}, 5),
+        ("SdkRetry", {"WORKFLOW_MODE": "1", "WORKFLOW_FAIL_ONCE": "1"}, 5),
+        ("SdkFail", {"FAIL_MODE": "panic"}, 5),
+        ("SdkSlow", {"SLEEP_SECS": "5"}, 5),
+        ("SdkFunctionTimeout", {"SLEEP_SECS": "5"}, 1),
+    ]:
+        lam.create_function(FunctionName=name, Runtime="provided.al2023", Role=ROLE, Handler="bootstrap",
+                            Code={"ZipFile": buffer.getvalue()}, Timeout=timeout,
+                            Architectures=["arm64" if platform.machine().lower() in ("arm64", "aarch64") else "x86_64"],
+                            Environment={"Variables": {**env, "PROCESS_MARKER_DIR": MARKERS}})
+    gates = Path(MARKERS).parent / "gates"
+    lam.create_function(FunctionName="SdkGate", Runtime="provided.al2023", Role=ROLE, Handler="bootstrap",
+                        Code={"ZipFile": buffer.getvalue()}, Timeout=900,
+                        Architectures=["arm64" if platform.machine().lower() in ("arm64", "aarch64") else "x86_64"],
+                        Environment={"Variables": {"WORKFLOW_MODE": "1", "PROCESS_MARKER_DIR": MARKERS,
+                                                  "INVOCATION_FILE": str(gates / "entered"),
+                                                  "WORKFLOW_GATE_FILE": str(gates / "release")}})
+    response = lam.invoke(FunctionName="SdkCompute", Payload=b'{"n":21}')
+    try:
+        output = json.loads(response["Payload"].read(262145))
+        assert response["StatusCode"] == 200 and "FunctionError" not in response
+        assert output["computed"] == 42 and output["pid"] > 1
+    finally:
+        response["Payload"].close()
+
+
+def create(sfn, name, definition):
+    result = call(sfn, "create_state_machine", name=name, roleArn=ROLE, definition=json.dumps(definition))
+    assert result["stateMachineArn"].startswith(PREFIX + "stateMachine:")
+    assert isinstance(result["creationDate"], datetime)
+    assert abs(result["creationDate"].timestamp() - time.time()) < 60
+    return result["stateMachineArn"]
+
+
+def terminal(sfn, arn):
+    deadline = time.monotonic() + 20
+    while time.monotonic() < deadline:
+        result = call(sfn, "describe_execution", executionArn=arn)
+        if result["status"] != "RUNNING":
+            return result
+        time.sleep(0.015)
+    raise AssertionError("execution did not terminate")
+
+
+def history(sfn, arn, reverse=False, data=True):
+    return read_history(sfn, arn, reverse=reverse, data=data, invoke=call)
+
+
+def pagination(sfn, arn, events):
+    reverse = history(sfn, arn, reverse=True, data=False)
+    assert [(event["id"], event.get("previousEventId", 0)) for event in reverse] == [(event["id"], event.get("previousEventId", 0)) for event in reversed(events)]
+    assert_omitted(reverse)
+    first = call(sfn, "get_execution_history", executionArn=arn, maxResults=1)
+    token = first["nextToken"]
+    next_page = call(sfn, "get_execution_history", executionArn=arn, maxResults=1, nextToken=token)
+    replay = call(sfn, "get_execution_history", executionArn=arn, maxResults=1, nextToken=token)
+    assert next_page["events"] == replay["events"]
+    rejected(sfn, "get_execution_history", "InvalidToken", executionArn=arn, maxResults=2, nextToken=token)
+    rejected(sfn, "get_execution_history", "InvalidToken", executionArn=arn, nextToken="0" * 64)
+
+
+def catalog(sfn):
+    fixture = json.loads(Path(__file__).with_name("sdk-cases.json").read_text())
+    assert fixture["schemaVersion"] == 1 and fixture["profile"] == "rustack-standard-jsonpath-v1"
+    assert len(fixture["cases"]) == 17
+    identifiers = set()
+    for case in fixture["cases"]:
+        allowed = {"id", "definition", "input", "expectedOutput", "uuidField", "optimizedComputed", "taskAttempts", "expectedStatus", "expectedError", "expectedCause", "largeInputBytes", "evidence"}
+        assert set(case) <= allowed and {"id", "definition", "input", "evidence"} <= set(case)
+        assert case["id"] not in identifiers
+        identifiers.add(case["id"])
+        assert sum(key in case for key in ("expectedOutput", "optimizedComputed", "expectedError")) == 1
+        assert case["evidence"]["sources"] and set(case["evidence"]["sources"]) <= set(fixture["sources"])
+        value = copy.deepcopy(case["input"])
+        if "largeInputBytes" in case:
+            value["large"] = "x" * case["largeInputBytes"]
+        machine = create(sfn, "SdkCase-" + case["id"], case["definition"])
+        raw = json.dumps(value, separators=(",", ":"), ensure_ascii=False)
+        started = call(sfn, "start_execution", stateMachineArn=machine, name="Run", input=raw)
+        result = terminal(sfn, started["executionArn"])
+        assert result["status"] == case.get("expectedStatus", "SUCCEEDED"), (case["id"], result)
+        assert result["input"] == raw
+        assert isinstance(started["startDate"], datetime) and result["startDate"] == started["startDate"]
+        assert result["stopDate"] >= result["startDate"]
+        if "expectedOutput" in case:
+            output = json.loads(result["output"])
+            if "uuidField" in case:
+                assert uuid.UUID(output.pop(case["uuidField"])).version == 4
+            assert output == case["expectedOutput"], (case["id"], output)
+        if "optimizedComputed" in case:
+            output = json.loads(result["output"])
+            assert output["Payload"]["computed"] == case["optimizedComputed"]
+            assert output["Payload"]["pid"] > 1
+            assert output["StatusCode"] == 200 and output["SdkHttpMetadata"]["HttpStatusCode"] == 200
+            assert output["ExecutedVersion"] == "$LATEST"
+            assert output["SdkResponseMetadata"]["RequestId"] == output["Payload"]["request_id"]
+            uuid.UUID(output["Payload"]["request_id"])
+        if "expectedError" in case:
+            if case["expectedError"] is None:
+                assert "error" not in result and "cause" not in result and "output" not in result, (case["id"], result)
+            else:
+                assert result["error"] == case["expectedError"], (case["id"], result)
+        if "expectedCause" in case:
+            assert result["cause"] == case["expectedCause"]
+        events = history(sfn, started["executionArn"])
+        assert events
+        for index, event in enumerate(events, 1):
+            assert event["id"] == index and event.get("previousEventId", 0) == (0 if index == 2 else index - 1)
+            assert isinstance(event["timestamp"], datetime) and event["timestamp"] >= result["startDate"]
+        expected_terminal = {"SUCCEEDED": "ExecutionSucceeded", "FAILED": "ExecutionFailed", "TIMED_OUT": "ExecutionTimedOut"}
+        assert events[-1]["type"] == expected_terminal[result["status"]]
+        if "taskAttempts" in case:
+            assert sum(event["type"].endswith("Scheduled") for event in events) == case["taskAttempts"]
+        if case["id"] == "optimized":
+            pagination(sfn, started["executionArn"], events)
+    return len(fixture["cases"])
+
+
+def pure(value):
+    return {"StartAt": "Done", "States": {"Done": {"Type": "Pass", "Result": {"revision": value}, "End": True}}}
+
+
+def controls(sfn):
+    old = {"StartAt": "Gate", "States": {"Gate": {"Type": "Task", "Resource": "arn:aws:lambda:us-east-1:000000000000:function:SdkGate",
+                                                     "Parameters": {"n": 21}, "ResultSelector": {"revision": "old"}, "End": True}}}
+    machine = create(sfn, "SdkControl", old)
+    described = call(sfn, "describe_state_machine", stateMachineArn=machine)
+    assert described["definition"] == json.dumps(old)
+    call(sfn, "tag_resource", resourceArn=machine, tags=[{"key": "owner", "value": "sdk"}])
+    assert call(sfn, "list_tags_for_resource", resourceArn=machine)["tags"] == [{"key": "owner", "value": "sdk"}]
+    call(sfn, "untag_resource", resourceArn=machine, tagKeys=["owner"])
+    assert call(sfn, "list_tags_for_resource", resourceArn=machine)["tags"] == []
+    raw = ' {"n":1}'
+    def start():
+        return call(sfn, "start_execution", stateMachineArn=machine, name="Same", input=raw)
+    with ThreadPoolExecutor(max_workers=2) as workers:
+        left, right = list(workers.map(lambda _: start(), range(2)))
+    assert left["executionArn"] == right["executionArn"] and left["startDate"] == right["startDate"]
+    rejected(sfn, "start_execution", "ExecutionAlreadyExists", stateMachineArn=machine, name="Same", input="{}")
+    rejected(sfn, "start_execution", "InvalidExecutionInput", stateMachineArn=machine, name="Same", input="{")
+    entered = Path(MARKERS).parent / "gates" / "entered"
+    cutoff = time.monotonic() + 15
+    while True:
+        try:
+            raw_marker = entered.read_bytes()
+            assert len(raw_marker) <= 512
+            marker = json.loads(raw_marker)
+            assert marker["pid"] > 1
+            uuid.UUID(marker["request_id"])
+            break
+        except (FileNotFoundError, json.JSONDecodeError):
+            assert time.monotonic() < cutoff, "handler did not consume the event"
+            time.sleep(0.005)
+    uuid.UUID(described["revisionId"])
+    updated = call(sfn, "update_state_machine", stateMachineArn=machine, definition=json.dumps(pure("new")))
+    uuid.UUID(updated["revisionId"])
+    assert updated["revisionId"] != described["revisionId"]
+    captured = call(sfn, "describe_state_machine_for_execution", executionArn=left["executionArn"])
+    uuid.UUID(captured["revisionId"])
+    assert captured["definition"] == json.dumps(old) and captured["revisionId"] == described["revisionId"]
+    assert captured["updateDate"] == described["creationDate"]
+    new = call(sfn, "start_execution", stateMachineArn=machine, name="New")
+    assert json.loads(terminal(sfn, new["executionArn"])["output"]) == {"revision": "new"}
+    (Path(MARKERS).parent / "gates" / "release").write_bytes(b"release")
+    assert json.loads(terminal(sfn, left["executionArn"])["output"]) == {"revision": "old"}
+    rejected(sfn, "start_execution", "ExecutionAlreadyExists", stateMachineArn=machine, name="Same", input=raw)
+    wait = {"StartAt": "Wait", "States": {"Wait": {"Type": "Wait", "Seconds": 3600, "End": True}}}
+    call(sfn, "update_state_machine", stateMachineArn=machine, definition=json.dumps(wait))
+    stopped = call(sfn, "start_execution", stateMachineArn=machine, name="Stop")
+    call(sfn, "stop_execution", executionArn=stopped["executionArn"], error="", cause='quoted "stop" 🙂')
+    result = terminal(sfn, stopped["executionArn"])
+    assert result["status"] == "ABORTED" and result["error"] == "" and result["cause"] == 'quoted "stop" 🙂'
+    page = call(sfn, "list_executions", stateMachineArn=machine, maxResults=1)
+    captures = {item["executionArn"] for item in page["executions"]}
+    token = page.get("nextToken")
+    call(sfn, "update_state_machine", stateMachineArn=machine, definition=json.dumps(pure("late")))
+    late = call(sfn, "start_execution", stateMachineArn=machine, name="Late")
+    terminal(sfn, late["executionArn"])
+    first_history = call(sfn, "get_execution_history", executionArn=left["executionArn"], maxResults=1)
+    call(sfn, "delete_state_machine", stateMachineArn=machine)
+    seen = set()
+    while token is not None:
+        assert token not in seen and len(seen) < 10
+        seen.add(token)
+        page = call(sfn, "list_executions", stateMachineArn=machine, maxResults=1, nextToken=token)
+        captures.update(item["executionArn"] for item in page["executions"])
+        token = page.get("nextToken")
+    assert len(captures) == 3 and late["executionArn"] not in captures
+    call(sfn, "get_execution_history", executionArn=left["executionArn"], maxResults=1, nextToken=first_history["nextToken"])
+    assert call(sfn, "describe_execution", executionArn=left["executionArn"])["input"] == raw
+    machines = []
+    for count, page in enumerate(sfn.get_paginator("list_state_machines").paginate(maxResults=2), 1):
+        assert count <= 64
+        ACTIONS.add("list_state_machines")
+        machines.extend(item["name"] for item in page["stateMachines"])
+        assert len(machines) < 64
+    assert "SdkCase-optimized" in machines and "SdkControl" not in machines
+    assert call(sfn, "validate_state_machine_definition", definition=json.dumps(pure("valid")), severity="WARNING")["result"] == "OK"
+    for definition in [
+        {"StartAt": "Missing", "States": {}},
+        {"StartAt": "Run", "States": {"Run": {"Type": "Pass", "InputPath": "$[", "End": True}}},
+        {"StartAt": "Run", "States": {"Run": {"Type": "Pass", "Parameters": {"duplicate": 1, "duplicate.$": "$.n"}, "End": True}}},
+    ]:
+        invalid = call(sfn, "validate_state_machine_definition", definition=json.dumps(definition))
+        assert invalid["result"] == "FAIL" and invalid["diagnostics"]
+    rejected(sfn, "create_activity", "UnsupportedOperation", name="unsupported")
+
+
+sfn, lam, bad = client("stepfunctions"), client("lambda"), client("stepfunctions", "wrong-local-secret")
+try:
+    rejected(bad, "list_state_machines", "AccessDeniedException")
+    deploy(lam)
+    cases = catalog(sfn)
+    controls(sfn)
+    nested_cases = nested_exercise(sfn, lam, BOOTSTRAP, MARKERS, create, call, terminal, history, assert_omitted)
+    structured_cases = structured_exercise(sfn, lam, BOOTSTRAP, MARKERS, create, call, terminal, history, assert_omitted)
+    required = {"create_state_machine", "describe_state_machine", "update_state_machine", "delete_state_machine",
+                "list_state_machines", "start_execution", "stop_execution", "describe_execution",
+                "describe_state_machine_for_execution", "list_executions", "get_execution_history",
+                "validate_state_machine_definition", "tag_resource", "untag_resource", "list_tags_for_resource"}
+    assert required <= ACTIONS, required - ACTIONS
+    print(json.dumps({"realBinary": True, "actualNative": True, "strictAuth": True, "catalogCases": cases,
+                      "nestedCases": nested_cases, "nestedLifecycle": 2, "m1Actions": len(required), "structuredCases": structured_cases, "structuredLifecycle": 2, "cloudDifferential": False, "dockerQualified": False}))
+finally:
+    sfn.close()
+    lam.close()
+    bad.close()
diff --git a/tests/workflows/stepfunctions_structured.py b/tests/workflows/stepfunctions_structured.py
new file mode 100644
index 00000000..407b2109
--- /dev/null
+++ b/tests/workflows/stepfunctions_structured.py
@@ -0,0 +1,133 @@
+"""Independent SDK checks for structured frames and real consumed Native calls."""
+
+import io
+import json
+import os
+import platform
+import time
+import uuid
+import zipfile
+from pathlib import Path
+
+
+def check_history(sfn, arn, round_kind, history):
+    events = history(sfn, arn)
+    assert events
+    for index, event in enumerate(events, 1):
+        assert event["id"] == index and 0 <= event.get("previousEventId", 0) < index
+    assert any(event["type"] == round_kind for event in events), round_kind
+    reverse = history(sfn, arn, reverse=True, data=False)
+    assert [(e["id"], e.get("previousEventId", 0)) for e in reverse] == [(e["id"], e.get("previousEventId", 0)) for e in reversed(events)]
+    by_id = {event["id"]: event for event in events}
+    for event in events:
+        if event["type"] == "MapIterationStarted":
+            assert by_id[event["previousEventId"]]["type"] in ("MapStateStarted", "PassStateExited", "WaitStateExited", "TaskStateExited", "ParallelStateExited", "MapStateExited", "SucceedStateExited")
+    return events
+
+
+def catalog(sfn, create, call, terminal, history):
+    fixture = json.loads(Path(__file__).with_name("structured-cases.json").read_text())
+    assert fixture["schemaVersion"] == 1 and fixture["profile"] == "rustack-standard-jsonpath-structured-v1"
+    assert len(fixture["cases"]) == 6 and len({case["id"] for case in fixture["cases"]}) == 6
+    for case in fixture["cases"]:
+        assert {"id", "definition", "input", "expectedOutput", "round"} <= set(case)
+        machine = create(sfn, "SdkStructured-" + case["id"], case["definition"])
+        started = call(sfn, "start_execution", stateMachineArn=machine, name="Run", input=json.dumps(case["input"]))
+        result = terminal(sfn, started["executionArn"])
+        assert result["status"] == "SUCCEEDED", (case["id"], result)
+        assert json.loads(result["output"]) == case["expectedOutput"], (case["id"], result)
+        events = check_history(sfn, started["executionArn"], case["round"], history)
+        if "taskAttempts" in case:
+            assert sum(event["type"].endswith("Scheduled") for event in events) == case["taskAttempts"]
+    return len(fixture["cases"])
+
+
+def deploy_gate(lam, bootstrap, markers, stop):
+    directory = Path(markers).parent / ("fanout-stop" if stop else "fanout-overlap")
+    directory.mkdir()
+    (directory / "consumed").mkdir()
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as archive:
+        info = zipfile.ZipInfo("bootstrap")
+        info.external_attr = 0o755 << 16
+        archive.writestr(info, Path(bootstrap).read_bytes())
+    function = "SdkFanoutStop" if stop else "SdkFanoutGate"
+    lam.create_function(FunctionName=function, Runtime="provided.al2023", Role="arn:aws:iam::000000000000:role/Workflows",
+                        Handler="bootstrap", Code={"ZipFile": buffer.getvalue()}, Timeout=900,
+                        Architectures=["arm64" if platform.machine().lower() in ("arm64", "aarch64") else "x86_64"],
+                        Environment={"Variables": {"WORKFLOW_MODE": "1", "PROCESS_MARKER_DIR": str(markers),
+                                                   "WORKFLOW_INVOCATION_DIR": str(directory / "consumed"),
+                                                   "WORKFLOW_GATE_FILE": str(directory / "release")}})
+    return directory, function
+
+
+def consumed(directory):
+    deadline = time.monotonic() + 10
+    while time.monotonic() < deadline:
+        files = list((directory / "consumed").glob("*.json"))
+        assert len(files) <= 2 and all(path.stat().st_size <= 1024 for path in files)
+        markers = set()
+        for path in files:
+            value = json.loads(path.read_bytes())
+            assert value["pid"] > 1 and uuid.UUID(value["request_id"]).version == 4
+            markers.add((value["pid"], value["request_id"]))
+        if len(markers) == 2:
+            assert len({pid for pid, _ in markers}) == 2 and len({request for _, request in markers}) == 2
+            return markers
+        time.sleep(0.005)
+    raise AssertionError("two Native handlers did not consume before release")
+
+
+def absent(pid):
+    deadline = time.monotonic() + 5
+    while time.monotonic() < deadline:
+        try:
+            os.kill(pid, 0)
+        except ProcessLookupError:
+            return
+        time.sleep(0.02)
+    raise AssertionError("stopped Native handler PID survived")
+
+
+def gated(sfn, lam, bootstrap, markers, stop, create, call, terminal, history):
+    directory, function = deploy_gate(lam, bootstrap, markers, stop)
+    task = {"StartAt": "Call", "States": {"Call": {"Type": "Task", "Resource": "arn:aws:lambda:us-east-1:000000000000:function:" + function, "End": True}}}
+    branches = [{"StartAt": "M", "States": {"M": {"Type": "Map", "MaxConcurrency": 2, "ItemProcessor": task, "End": True}}}] if stop else [task, task]
+    definition = {"StartAt": "P", "States": {"P": {"Type": "Parallel", "Branches": branches, "End": True}}}
+    machine = create(sfn, "SdkStructuredStop" if stop else "SdkStructuredOverlap", definition)
+    started = call(sfn, "start_execution", stateMachineArn=machine, name="Run", input=json.dumps([{"n": 21}, {"n": 7}] if stop else {"n": 21}))
+    observed = consumed(directory)
+    if stop:
+        call(sfn, "stop_execution", executionArn=started["executionArn"], error="SdkStructuredStop", cause="consumed nested tasks")
+        result = terminal(sfn, started["executionArn"])
+        assert result["status"] == "ABORTED" and result["error"] == "SdkStructuredStop"
+        for pid, _ in observed:
+            absent(pid)
+        events = check_history(sfn, started["executionArn"], "MapIterationAborted", history)
+        aborted = [event for event in events if event["type"] == "MapIterationAborted"]
+        assert len(aborted) == 2 and {event["mapIterationAbortedEventDetails"]["index"] for event in aborted} == {0, 1}
+        assert events[-1]["type"] == "ExecutionAborted"
+    else:
+        (directory / "release").write_bytes(b"release")
+        result = terminal(sfn, started["executionArn"])
+        assert result["status"] == "SUCCEEDED", result
+        output = json.loads(result["output"])
+        assert len(output) == 2 and all(value["computed"] == 42 for value in output)
+        assert {(value["pid"], value["request_id"]) for value in output} == observed
+        events = check_history(sfn, started["executionArn"], "ParallelStateSucceeded", history)
+        fork = next(event["id"] for event in events if event["type"] == "ParallelStateStarted")
+        entries = [event for event in events if event["type"] == "TaskStateEntered"]
+        assert len(entries) == 2 and all(event["previousEventId"] == fork for event in entries)
+
+
+def exercise(sfn, lam, bootstrap, markers, create, call, terminal, history, assert_omitted):
+    original_history = history
+    def checked_history(*args, **kwargs):
+        events = original_history(*args, **kwargs)
+        if kwargs.get("data") is False:
+            assert_omitted(events)
+        return events
+    cases = catalog(sfn, create, call, terminal, checked_history)
+    for stop in [False, True]:
+        gated(sfn, lam, bootstrap, markers, stop, create, call, terminal, checked_history)
+    return cases
diff --git a/tests/workflows/structured-cases.json b/tests/workflows/structured-cases.json
new file mode 100644
index 00000000..e1492042
--- /dev/null
+++ b/tests/workflows/structured-cases.json
@@ -0,0 +1,290 @@
+{
+  "schemaVersion": 1,
+  "profile": "rustack-standard-jsonpath-structured-v1",
+  "sources": {
+    "map": "https://docs.aws.amazon.com/step-functions/latest/dg/state-map-inline.html",
+    "parallel": "https://docs.aws.amazon.com/step-functions/latest/dg/state-parallel.html",
+    "history": "https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetExecutionHistory.html"
+  },
+  "cases": [
+    {
+      "id": "parallel-order",
+      "definition": {
+        "StartAt": "D",
+        "States": {
+          "D": {
+            "Type": "Parallel",
+            "Branches": [
+              {
+                "StartAt": "D",
+                "States": {
+                  "D": {
+                    "Type": "Pass",
+                    "Result": {
+                      "branch": 0
+                    },
+                    "End": true
+                  }
+                }
+              },
+              {
+                "StartAt": "D",
+                "States": {
+                  "D": {
+                    "Type": "Pass",
+                    "Result": {
+                      "branch": 1
+                    },
+                    "End": true
+                  }
+                }
+              }
+            ],
+            "End": true
+          }
+        }
+      },
+      "input": {},
+      "expectedOutput": [
+        {
+          "branch": 0
+        },
+        {
+          "branch": 1
+        }
+      ],
+      "round": "ParallelStateSucceeded"
+    },
+    {
+      "id": "map-selector",
+      "definition": {
+        "StartAt": "D",
+        "States": {
+          "D": {
+            "Type": "Map",
+            "ItemProcessor": {
+              "StartAt": "D",
+              "States": {
+                "D": {
+                  "Type": "Pass",
+                  "End": true
+                }
+              }
+            },
+            "End": true,
+            "ItemsPath": "$.items",
+            "MaxConcurrencyPath": "$.limit",
+            "ItemSelector": {
+              "index.$": "$$.Map.Item.Index",
+              "value.$": "$$.Map.Item.Value"
+            }
+          }
+        }
+      },
+      "input": {
+        "items": [
+          3,
+          null,
+          1
+        ],
+        "limit": 2
+      },
+      "expectedOutput": [
+        {
+          "index": 0,
+          "value": 3
+        },
+        {
+          "index": 1,
+          "value": null
+        },
+        {
+          "index": 2,
+          "value": 1
+        }
+      ],
+      "round": "MapStateSucceeded"
+    },
+    {
+      "id": "empty-map",
+      "definition": {
+        "StartAt": "D",
+        "States": {
+          "D": {
+            "Type": "Map",
+            "ItemProcessor": {
+              "StartAt": "D",
+              "States": {
+                "D": {
+                  "Type": "Pass",
+                  "End": true
+                }
+              }
+            },
+            "End": true
+          }
+        }
+      },
+      "input": [],
+      "expectedOutput": [],
+      "round": "MapStateSucceeded"
+    },
+    {
+      "id": "nested-parallel-map",
+      "definition": {
+        "StartAt": "D",
+        "States": {
+          "D": {
+            "Type": "Parallel",
+            "Branches": [
+              {
+                "StartAt": "D",
+                "States": {
+                  "D": {
+                    "Type": "Map",
+                    "ItemProcessor": {
+                      "StartAt": "D",
+                      "States": {
+                        "D": {
+                          "Type": "Pass",
+                          "Result": {
+                            "ok": true
+                          },
+                          "End": true
+                        }
+                      }
+                    },
+                    "End": true
+                  }
+                }
+              },
+              {
+                "StartAt": "D",
+                "States": {
+                  "D": {
+                    "Type": "Pass",
+                    "Result": "second",
+                    "End": true
+                  }
+                }
+              }
+            ],
+            "End": true
+          }
+        }
+      },
+      "input": [
+        0,
+        1
+      ],
+      "expectedOutput": [
+        [
+          {
+            "ok": true
+          },
+          {
+            "ok": true
+          }
+        ],
+        "second"
+      ],
+      "round": "ParallelStateSucceeded"
+    },
+    {
+      "id": "parallel-catch",
+      "definition": {
+        "StartAt": "P",
+        "States": {
+          "P": {
+            "Type": "Parallel",
+            "Branches": [
+              {
+                "StartAt": "D",
+                "States": {
+                  "D": {
+                    "Type": "Fail",
+                    "Error": "BusinessFailed",
+                    "Cause": "literal"
+                  }
+                }
+              }
+            ],
+            "Catch": [
+              {
+                "ErrorEquals": [
+                  "BusinessFailed"
+                ],
+                "ResultPath": null,
+                "Next": "Recovered"
+              }
+            ],
+            "End": true
+          },
+          "Recovered": {
+            "Type": "Pass",
+            "Result": {
+              "recovered": true
+            },
+            "End": true
+          }
+        }
+      },
+      "input": {
+        "keep": 7
+      },
+      "expectedOutput": {
+        "recovered": true
+      },
+      "round": "ParallelStateFailed"
+    },
+    {
+      "id": "lambda-map",
+      "definition": {
+        "StartAt": "D",
+        "States": {
+          "D": {
+            "Type": "Map",
+            "ItemProcessor": {
+              "StartAt": "D",
+              "States": {
+                "D": {
+                  "Type": "Task",
+                  "Resource": "arn:aws:states:::lambda:invoke",
+                  "Parameters": {
+                    "FunctionName": "SdkCompute",
+                    "Payload.$": "$"
+                  },
+                  "ResultSelector": {
+                    "value.$": "$.Payload.computed"
+                  },
+                  "OutputPath": "$.value",
+                  "End": true
+                }
+              }
+            },
+            "End": true,
+            "MaxConcurrency": 2
+          }
+        }
+      },
+      "input": [
+        {
+          "n": 1
+        },
+        {
+          "n": 2
+        },
+        {
+          "n": 3
+        }
+      ],
+      "expectedOutput": [
+        2,
+        4,
+        6
+      ],
+      "round": "MapStateSucceeded",
+      "taskAttempts": 3
+    }
+  ]
+}
diff --git a/tests/workflows/test_action_required_suites.py b/tests/workflows/test_action_required_suites.py
new file mode 100644
index 00000000..04631785
--- /dev/null
+++ b/tests/workflows/test_action_required_suites.py
@@ -0,0 +1,45 @@
+"""The separate Action inventory cannot drift or impersonate another profile."""
+import copy
+import json
+from pathlib import Path
+import unittest
+
+from action_required_suites import CASE, SUITES, decode
+from required_suites import MANIFEST_LIMIT, ManifestError, read_regular, verify
+from test_required_suites import encoded, listing
+
+
+def document():
+    return json.loads(read_regular(Path(__file__).with_name("action-required-suites.json"), MANIFEST_LIMIT))
+
+
+class ActionManifestControls(unittest.TestCase):
+    def test_should_require_the_one_exact_independent_process_case(self):
+        required = decode(encoded(document()))
+        self.assertEqual(required, {"composite-action": frozenset((CASE,))})
+        self.assertEqual(verify(required, {"composite-action": listing([CASE])}, expected_suites=SUITES), 1)
+        for names in ([], ["renamed"], [CASE, "unexpected"], [CASE, CASE]):
+            with self.subTest(names=names), self.assertRaises(ManifestError):
+                verify(required, {"composite-action": listing(names)}, expected_suites=SUITES)
+
+    def test_should_reject_manifest_and_resource_scope_drift(self):
+        for change in ({"qualification": "docker-image-functional"}, {"qualification": "native-workflow-only"},
+                       {"profile": "rustack-standard-jsonpath-v1"}, {"schemaVersion": True}, {"extra": 1}):
+            with self.subTest(change=change), self.assertRaises(ManifestError):
+                decode(encoded(dict(document(), **change)))
+        for mutate in (lambda row: row["suites"].clear(),
+                       lambda row: row["suites"][0].update(id="ordinary-startup"),
+                       lambda row: row["suites"][0].update(tests=["renamed"]),
+                       lambda row: row["suites"][0].update(tests=[CASE, "unexpected"]),
+                       lambda row: row["suites"].append(copy.deepcopy(row["suites"][0]))):
+            value = document()
+            mutate(value)
+            with self.assertRaises(ManifestError):
+                decode(encoded(value))
+        for name in ("required-suites.json", "docker-required-suites.json"):
+            with self.assertRaises(ManifestError):
+                decode(read_regular(Path(__file__).with_name(name), MANIFEST_LIMIT))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_botocore_wire.py b/tests/workflows/test_botocore_wire.py
new file mode 100644
index 00000000..2c744f75
--- /dev/null
+++ b/tests/workflows/test_botocore_wire.py
@@ -0,0 +1,65 @@
+"""Offline SDK wire evidence; these tests do not execute an ASL interpreter."""
+
+import json
+from datetime import datetime
+from pathlib import Path
+import unittest
+
+import boto3
+import botocore
+import botocore.parsers
+import botocore.serialize
+import botocore.session
+
+
+class StepFunctionsWireEvidence(unittest.TestCase):
+    """Check independently implemented SDK serialization and parsing."""
+
+    @classmethod
+    def setUpClass(cls):
+        root = Path(__file__).parent
+        cls.provenance = json.loads((root / "provenance.json").read_text())
+        cls.fixtures = json.loads((root / "semantic-cases.json").read_text())
+        cls.service = botocore.session.get_session().get_service_model("stepfunctions")
+
+    def test_should_match_pinned_sdk_versions(self):
+        self.assertEqual(boto3.__version__, self.provenance["boto3"])
+        self.assertEqual(botocore.__version__, self.provenance["botocore"])
+
+    def test_should_preserve_json_string_input_and_target(self):
+        fixture = next(c for c in self.fixtures["cases"] if c["id"] == "wire-input-string")
+        serializer = botocore.serialize.create_serializer(self.service.metadata["protocol"])
+        request = serializer.serialize_to_request(
+            fixture["request"], self.service.operation_model(fixture["operation"])
+        )
+        self.assertEqual(request["headers"]["X-Amz-Target"], fixture["expectedTarget"])
+        self.assertEqual(json.loads(request["body"]), fixture["request"])
+
+    def test_should_parse_fractional_and_negative_epoch_seconds(self):
+        parser = botocore.parsers.ResponseParserFactory().create_parser("json")
+        output = self.service.operation_model("CreateStateMachine").output_shape
+        for fixture in self.fixtures["cases"]:
+            if fixture["kind"] != "wireTimestamp":
+                continue
+            with self.subTest(case=fixture["id"]):
+                value = fixture["epochSeconds"]
+                body = json.dumps({
+                    "creationDate": value,
+                    "stateMachineArn": "arn:aws:states:us-east-1:000000000000:stateMachine:P0",
+                }).encode()
+                parsed = parser.parse({"body": body, "headers": {}, "status_code": 200}, output)
+                self.assertIsInstance(parsed["creationDate"], datetime)
+                self.assertEqual(parsed["creationDate"].timestamp(), value)
+
+    def test_should_parse_callback_error_codes_without_network(self):
+        parser = botocore.parsers.ResponseParserFactory().create_parser("json")
+        output = self.service.operation_model("SendTaskSuccess").output_shape
+        for code in {"TaskTimedOut", "InvalidToken"}:
+            with self.subTest(code=code):
+                body = json.dumps({"__type": code, "message": "fixture"}).encode()
+                parsed = parser.parse({"body": body, "headers": {}, "status_code": 400}, output)
+                self.assertEqual(parsed["Error"]["Code"], code)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_callback_image.py b/tests/workflows/test_callback_image.py
new file mode 100644
index 00000000..59c29040
--- /dev/null
+++ b/tests/workflows/test_callback_image.py
@@ -0,0 +1,104 @@
+"""Privacy-oracle controls independent of the callback image and ASL evaluator."""
+
+import hashlib
+import unittest
+
+from callback_image_support import PrivacyScanError, ScanBudget
+from callback_image_sdk import Driver, catalog
+
+
+TOKEN = b"0123456789abcdef" * 4
+HASH = hashlib.sha256(TOKEN).hexdigest()
+OTHER_HASH = hashlib.sha256(b"b" * 64).hexdigest()
+
+
+class CallbackPrivacyControls(unittest.TestCase):
+    def test_should_detect_exact_and_every_shifted_embedded_token(self):
+        for prefix in range(64):
+            with self.subTest(prefix=prefix):
+                scanner = ScanBudget([HASH])
+                with self.assertRaisesRegex(PrivacyScanError, "credential found"):
+                    scanner.scan(b"a" * prefix + TOKEN + b"b" * 63)
+                self.assertTrue(scanner.failed)
+
+    def test_should_detect_token_split_at_every_decoder_boundary(self):
+        for boundary in range(1, len(TOKEN)):
+            with self.subTest(boundary=boundary):
+                scanner = ScanBudget([HASH])
+                with self.assertRaisesRegex(PrivacyScanError, "credential found"):
+                    scanner.scan_chunks([b'{"value":"' + TOKEN[:boundary], TOKEN[boundary:] + b'"}'])
+
+    def test_should_charge_all_overlapping_windows_across_sources(self):
+        scanner = ScanBudget([OTHER_HASH], limit=3)
+        scanner.scan(b"a" * 65)
+        self.assertEqual(scanner.candidates, 2)
+        scanner.scan(b"c" * 64)
+        self.assertEqual(scanner.candidates, 3)
+        with self.assertRaisesRegex(PrivacyScanError, "aggregate candidate cap"):
+            scanner.scan(b"d" * 64)
+        with self.assertRaisesRegex(PrivacyScanError, "already failed"):
+            scanner.scan(b"safe")
+
+    def test_should_accept_exact_global_cap_and_reject_next_source(self):
+        scanner = ScanBudget([OTHER_HASH])
+        scanner.scan(b"a" * (ScanBudget.MAX_CANDIDATES + 63))
+        self.assertEqual(scanner.candidates, ScanBudget.MAX_CANDIDATES)
+        with self.assertRaisesRegex(PrivacyScanError, "aggregate candidate cap"):
+            scanner.scan_chunks([b"c" * 32, b"c" * 32])
+
+    def test_should_reject_invalid_hashes_and_budget_before_scanning(self):
+        for hashes in (["invalid"], ["A" * 64], [HASH] * 65, HASH, [1]):
+            with self.subTest(kind=type(hashes).__name__), self.assertRaises(PrivacyScanError):
+                ScanBudget(hashes)
+        for values in ({"limit": 0}, {"limit": 65537}, {"candidates": -1}, {"candidates": 65537}):
+            with self.subTest(values=values), self.assertRaises(PrivacyScanError):
+                ScanBudget([HASH], **values)
+        with self.assertRaisesRegex(PrivacyScanError, "requires observed hashes"):
+            ScanBudget().scan(b"safe")
+
+    def test_should_bound_chunks_sources_and_aggregate_history_bytes(self):
+        with self.assertRaisesRegex(PrivacyScanError, "source cap"):
+            ScanBudget([HASH]).scan(b"z" * (ScanBudget.MAX_SOURCE_BYTES + 1))
+        with self.assertRaisesRegex(PrivacyScanError, "chunk cap"):
+            ScanBudget([HASH]).scan_chunks([b""] * (ScanBudget.MAX_CHUNKS + 1))
+        scanner = ScanBudget([HASH])
+        for _ in range(16):
+            scanner.scan(b"z" * ScanBudget.MAX_SOURCE_BYTES)
+        with self.assertRaisesRegex(PrivacyScanError, "aggregate byte cap"):
+            scanner.scan(b"z")
+
+
+class CallbackGateControls(unittest.TestCase):
+    def test_should_keep_retry_return_grants_distinct_and_reject_invalid_keys(self):
+        class Table:
+            def __init__(self):
+                self.keys = []
+
+            def put_item(self, *, TableName, Item):
+                self.keys.append(Item["id"]["S"])
+
+        table = Table()
+        driver = Driver(None, None, table, None, "arm64", "timing")
+        nonce = "1" * 32
+        driver.gate(nonce, "return")
+        driver.gate(nonce, "return", retry=1)
+        self.assertEqual(table.keys, ["gate:" + nonce + ":0:return", "gate:" + nonce + ":1:return"])
+        for selected, kind, retry in (("invalid", "return", 0), (nonce, "unknown", 0),
+                                      (nonce, "return", 2), (nonce, "return", True)):
+            with self.subTest(kind=kind, retry=retry), self.assertRaises(AssertionError):
+                driver.gate(selected, kind, retry)
+        self.assertEqual(len(table.keys), 2)
+
+    def test_should_bind_both_groups_to_all_nine_independent_catalog_cases(self):
+        first, second = catalog("causal"), catalog("timing")
+        self.assertEqual(len(first), 4)
+        self.assertEqual(len(second), 5)
+        self.assertEqual(len({case["mode"] for case in first + second}), 9)
+        self.assertEqual([(case["mode"], case["status"], case.get("error")) for case in second], [
+            ("retry", "SUCCEEDED", None), ("heartbeat", "SUCCEEDED", None),
+            ("absoluteTimeout", "FAILED", "States.Timeout"),
+            ("heartbeatTimeout", "FAILED", "States.HeartbeatTimeout"), ("stop", "ABORTED", "Stopped")])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_custom_ric_collector.py b/tests/workflows/test_custom_ric_collector.py
new file mode 100644
index 00000000..0b9cc8f4
--- /dev/null
+++ b/tests/workflows/test_custom_ric_collector.py
@@ -0,0 +1,94 @@
+"""Causal barrier failure controls, including real quiet/header sockets."""
+import concurrent.futures
+import http.client
+import json
+import socket
+import time
+import unittest
+import uuid
+
+from custom_ric_sdk import Collector, collecting
+
+
+class CollectorTests(unittest.TestCase):
+    def test_should_join_quiet_and_partial_header_connections_on_shutdown(self):
+        for payload in (b"", b"POST /consume HTTP/1.1\r\nX-Held: "):
+            started = time.monotonic()
+            with collecting() as collector:
+                peer = socket.create_connection(("127.0.0.1", collector.server_port), timeout=2)
+                try:
+                    peer.sendall(payload)
+                    deadline = time.monotonic() + 2
+                    while True:
+                        with collector.condition:
+                            if collector.connections:
+                                break
+                        self.assertLess(time.monotonic(), deadline)
+                        time.sleep(0.005)
+                except BaseException:
+                    peer.close()
+                    raise
+            with peer:
+                try:
+                    self.assertEqual(peer.recv(1), b"")
+                except ConnectionResetError:
+                    # Closing an unread partial request may retire TCP with RST.
+                    pass
+            self.assertLess(time.monotonic() - started, 3)
+            self.assertFalse(collector.connections)
+
+    def test_should_reject_expired_barrier_even_with_both_lanes_ready(self):
+        collector = Collector()
+        try:
+            collector.consumed = {"A": str(uuid.uuid4()), "B": str(uuid.uuid4())}
+            collector.checked = {"B": collector.consumed["B"]}
+            collector.deadline = time.monotonic() - 1
+            with self.assertRaises(AssertionError):
+                collector.exchange("/checked", {"lane":"A", "requestId":collector.consumed["A"], "statuses":[400]*3})
+            self.assertNotIn("A", collector.checked)
+        finally:
+            collector.server_close()
+
+    def test_should_exchange_both_active_ids_and_release_only_after_both_checks(self):
+        with collecting() as collector:
+            ids = {lane: str(uuid.uuid4()) for lane in ("A", "B")}
+            def post(path, value):
+                connection = http.client.HTTPConnection("127.0.0.1", collector.server_port, timeout=3)
+                try:
+                    connection.request("POST", path, json.dumps(value), {"x-fixture-token":collector.token})
+                    response = connection.getresponse()
+                    self.assertEqual(response.status, 200)
+                    return json.loads(response.read(2049))
+                finally:
+                    connection.close()
+            with concurrent.futures.ThreadPoolExecutor(max_workers=2) as pool:
+                first = pool.submit(post, "/consume", {"lane":"A", "requestId":ids["A"]})
+                deadline = time.monotonic() + 2
+                while "A" not in collector.consumed:
+                    self.assertLess(time.monotonic(), deadline)
+                    time.sleep(0.005)
+                self.assertFalse(first.done())
+                second = pool.submit(post, "/consume", {"lane":"B", "requestId":ids["B"]})
+                self.assertEqual(first.result(3), {"foreignRequestId":ids["B"]})
+                self.assertEqual(second.result(3), {"foreignRequestId":ids["A"]})
+                first = pool.submit(post, "/checked", {"lane":"A", "requestId":ids["A"], "statuses":[400]*3})
+                deadline = time.monotonic() + 2
+                while "A" not in collector.checked:
+                    self.assertLess(time.monotonic(), deadline)
+                    time.sleep(0.005)
+                self.assertFalse(first.done())
+                second = pool.submit(post, "/checked", {"lane":"B", "requestId":ids["B"], "statuses":[400]*3})
+                self.assertEqual(first.result(3), {"release":True})
+                self.assertEqual(second.result(3), {"release":True})
+
+    def test_should_abort_on_bad_token_and_oversized_headers(self):
+        for extra in (b"x-fixture-token: wrong\r\nContent-Length: 2\r\n\r\n{}", b"X-Oversized: " + b"x"*4096 + b"\r\n\r\n"):
+            with collecting() as collector:
+                with socket.create_connection(("127.0.0.1", collector.server_port), timeout=2) as peer:
+                    peer.sendall(b"POST /consume HTTP/1.1\r\nHost: localhost\r\n" + extra)
+                    peer.recv(1024)
+                self.assertTrue(collector.aborted)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_docker_io_proxy.py b/tests/workflows/test_docker_io_proxy.py
new file mode 100644
index 00000000..1ee845b2
--- /dev/null
+++ b/tests/workflows/test_docker_io_proxy.py
@@ -0,0 +1,517 @@
+"""Protocol and lifecycle controls for the transparent actual-daemon fault proxy."""
+import concurrent.futures
+import contextlib
+import http.client
+import importlib
+import io
+import json
+from pathlib import Path
+import socket
+import tempfile
+import threading
+import time
+import unittest
+import urllib.parse
+import uuid
+from unittest.mock import patch
+
+from docker_io_proxy import Progress, ProtocolError, Proxy, body, exact, head, interrupted_pull, line
+from lambda_fault_support import UnixHTTP
+
+
+@contextlib.contextmanager
+def daemon(handler, connections=1):
+    assert connections in (1, 2)
+    with tempfile.TemporaryDirectory(prefix="rio-", dir="/tmp") as root:
+        path = str(Path(root) / "daemon.sock")
+        listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        listener.bind(path)
+        listener.listen(2)
+        listener.settimeout(0.05)
+        stop, streams, errors = threading.Event(), [], []
+        def serve():
+            try:
+                served = 0
+                while not stop.is_set() and served < connections:
+                    try:
+                        stream, _ = listener.accept()
+                    except socket.timeout:
+                        continue
+                    streams.append(stream)
+                    try:
+                        handler(stream)
+                    finally:
+                        stream.close()
+                    served += 1
+            except (OSError, EOFError):
+                pass
+            except BaseException as error:
+                errors.append(error)
+        worker = threading.Thread(target=serve)
+        worker.start()
+        proxy = Proxy(str(Path(root) / "proxy.sock"), path)
+        try:
+            yield proxy
+        finally:
+            try:
+                proxy.close()
+            finally:
+                stop.set()
+                for stream in streams:
+                    with contextlib.suppress(OSError):
+                        stream.shutdown(socket.SHUT_RDWR)
+                listener.close()
+                worker.join(3)
+                assert not worker.is_alive(), "controlled daemon did not join"
+            assert not errors, "controlled daemon had an unexpected failure"
+
+
+def request(stream):
+    first, fields, _ = head(stream, time.monotonic() + 2)
+    _, decoded = body(stream, fields, 1024 * 1024, time.monotonic() + 2)
+    return first, decoded
+
+
+class ProxyControls(unittest.TestCase):
+    def test_should_release_function_delete_without_releasing_the_paired_relay(self):
+        owner, function, relay = str(uuid.uuid4()), "e"*64, "f"*64
+        effects = []
+        def backend(stream):
+            first, _ = request(stream)
+            effects.append(first.split(b" ")[1].decode().rsplit("/", 1)[1])
+            stream.sendall(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+        with daemon(backend, connections=2) as proxy:
+            proxy.records[function] = {"owner":owner,"role":"function"}
+            proxy.records[relay] = {"owner":owner,"role":"relay"}
+            proxy.arm("pair_delete", owner, 2)
+            with self.assertRaises(AssertionError):
+                proxy.release_function()
+            self.assertEqual(proxy.released_records, set())
+            def client(key):
+                connection = UnixHTTP(proxy.path)
+                try:
+                    connection.request("DELETE", "/v1.53/containers/" + key)
+                    response = connection.getresponse()
+                    response.read()
+                    return response.status
+                finally:
+                    connection.close()
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                try:
+                    first = pool.submit(client, function)
+                    self.assertEqual(proxy.wait(1, time.monotonic() + 2)[0]["id"], function)
+                    self.assertEqual(effects, [])
+                    proxy.release_function()
+                    self.assertEqual(first.result(2), 204)
+                    second = pool.submit(client, relay)
+                    self.assertEqual(proxy.wait(2, time.monotonic() + 2)[1]["id"], relay)
+                    self.assertEqual(effects, [function])
+                    self.assertFalse(second.done())
+                    self.assertFalse(proxy.released)
+                    with self.assertRaises(AssertionError):
+                        proxy.release_function()
+                    proxy.release()
+                    self.assertEqual(second.result(2), 204)
+                    self.assertEqual(effects, [function, relay])
+                finally:
+                    proxy.restore()
+
+    def test_should_reject_late_ready_io_instead_of_publishing_completion(self):
+        writer, reader = socket.socketpair()
+        try:
+            writer.sendall(b"ready")
+            with patch("docker_io_proxy.time.monotonic", side_effect=[0.0, 2.0]):
+                with self.assertRaises(ProtocolError):
+                    exact(reader, 5, 1.0)
+        finally:
+            writer.close()
+            reader.close()
+
+    def test_should_hold_delete_ack_after_the_effect_without_releasing_early(self):
+        owner, key, effected = str(uuid.uuid4()), "c"*64, threading.Event()
+        def backend(stream):
+            request(stream)
+            effected.set()
+            stream.sendall(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+        with daemon(backend) as proxy:
+            proxy.records[key] = {"owner":owner, "role":"function"}
+            proxy.arm("delete_ack", owner)
+            def client():
+                connection = UnixHTTP(proxy.path)
+                try:
+                    connection.request("DELETE", "/v1.53/containers/" + key)
+                    reply = connection.getresponse()
+                    reply.read()
+                    return reply.status
+                finally:
+                    connection.close()
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                result = pool.submit(client)
+                self.assertEqual(proxy.wait(1, time.monotonic() + 2)[0]["id"], key)
+                self.assertTrue(effected.is_set())
+                self.assertFalse(result.done())
+                proxy.release()
+                self.assertEqual(result.result(2), 204)
+
+    def test_should_truncate_only_pull_front_body_and_positively_drain_backend(self):
+        reference = "public.ecr.aws:443/lambda/nodejs@sha256:" + "a"*64
+        finish, publish, reached = threading.Event(), threading.Event(), threading.Event()
+        def deferred_cut(backend, client, headers, deadline, cut):
+            def delayed():
+                reached.set()
+                assert publish.wait(2), "cut publication barrier was abandoned"
+                cut()
+            return interrupted_pull(backend, client, headers, deadline, delayed)
+        def backend(stream):
+            request(stream)
+            first, second = b'{"status":"Downloading"}\n', b'{"status":"Complete"}\n'
+            stream.sendall(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" +
+                           format(len(first), "x").encode() + b"\r\n" + first + b"\r\n")
+            assert finish.wait(2), "backend drain barrier was abandoned"
+            stream.sendall(format(len(second), "x").encode() + b"\r\n" + second + b"\r\n0\r\n\r\n")
+        with patch("docker_io_proxy.interrupted_pull", side_effect=deferred_cut), daemon(backend) as proxy:
+            proxy.interrupt_pull(reference)
+            connection = UnixHTTP(proxy.path)
+            try:
+                connection.request("POST", "/v1.53/images/create?" + urllib.parse.urlencode({
+                    "fromImage":reference.split("@")[0], "tag":reference.split("@")[1]}))
+                reply = connection.getresponse()
+                with self.assertRaises(http.client.IncompleteRead):
+                    reply.read()
+                connection.close()
+                self.assertTrue(reached.wait(2))
+                with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                    observed = pool.submit(proxy.wait_pull_cut, time.monotonic() + 2)
+                    try:
+                        self.assertFalse(observed.done())
+                    finally:
+                        publish.set()
+                    self.assertIsNone(observed.result(2))
+                self.assertFalse(proxy.pull_done)
+                finish.set()
+                self.assertEqual(proxy.wait_pull(time.monotonic() + 2), 2)
+            finally:
+                publish.set()
+                finish.set()
+                connection.close()
+
+    def test_should_refuse_pull_error_duplicate_incomplete_and_oversized_progress(self):
+        for value in (b'{"error":"denied","status":"failed"}\n', b'{"errorDetail":{"code":1},"status":"failed"}\n',
+                      b'{"error":"","status":"ok"}\n', b'{"error":null,"status":"ok"}\n', b'{"errorDetail":{},"status":"ok"}\n',
+                      b'{"status":"ok","detail":NaN}\n', b'{"status":"ok","detail":Infinity}\n',
+                      b'{"status":"a","status":"b"}\n', b'{"status":"missing newline"}',
+                      b'{}\n', b'{"status":"' + b'x'*65536 + b'"}\n', b''):
+            with self.subTest(value=value[:60]), self.assertRaises((ProtocolError, ValueError, AssertionError)):
+                progress = Progress()
+                progress.feed(value)
+                progress.finish()
+        progress = Progress()
+        progress.feed(b'{"sta')
+        progress.feed(b'tus":"ok"}\n')
+        progress.finish()
+        self.assertEqual(progress.count, 1)
+        progress = Progress()
+        progress.feed(b'{"status":"ok"}\n' * 65536)
+        progress.finish()
+        with self.assertRaises(ProtocolError):
+            progress.feed(b'{"status":"excess"}\n')
+
+    def test_should_refuse_positive_pull_completion_on_truncated_backend_framing(self):
+        for value in (b'10\r\n{"status":"ok"}\n', b'10\r\n{"status":"ok"}\n\r\n', b'0\r\n\r\n', b'1000001\r\n'):
+            backend, writer = socket.socketpair()
+            client, observer = socket.socketpair()
+            try:
+                writer.sendall(value)
+                writer.shutdown(socket.SHUT_WR)
+                with self.assertRaises((EOFError, ProtocolError)):
+                    interrupted_pull(backend, client, {b"transfer-encoding":b"chunked"},
+                                     time.monotonic() + 2, lambda: None)
+            finally:
+                for stream in (backend, writer, client, observer):
+                    stream.close()
+
+    def test_should_not_emit_process_handshakes_when_importing_fault_helpers(self):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            for module in ("lambda_fault_sdk", "provided_zip_sdk", "provided_zip_archive_sdk", "provided_zip_io"):
+                importlib.import_module(module)
+        self.assertEqual(output.getvalue(), "")
+
+    def test_should_preserve_chunked_identity_and_operation_on_one_backend_connection(self):
+        for operation in ("/v1.53/images/source/json", "/info"):
+            requests = []
+            engine = str(uuid.uuid4())
+            def backend(stream):
+                requests.append(request(stream)[0])
+                payload = json.dumps({"ID":engine}).encode()
+                stream.sendall(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" +
+                               format(len(payload), "x").encode() + b"\r\n" + payload + b"\r\n0\r\n\r\n")
+                requests.append(request(stream)[0])
+                stream.sendall(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\n{}")
+            with daemon(backend) as proxy:
+                connection = UnixHTTP(proxy.path)
+                try:
+                    connection.request("GET", "/info")
+                    self.assertEqual(json.loads(connection.getresponse().read()), {"ID":engine})
+                    connection.request("GET", operation)
+                    self.assertEqual(connection.getresponse().read(), b"{}")
+                finally:
+                    connection.close()
+            self.assertEqual(requests, [b"GET /info HTTP/1.1\r\n", ("GET " + operation + " HTTP/1.1\r\n").encode()])
+
+    def test_should_forward_upgrade_bytes_and_preserve_independent_half_close(self):
+        observed = []
+        def backend(stream):
+            request(stream)
+            stream.sendall(b"HTTP/1.1 101 UPGRADED\r\nConnection: Upgrade\r\nUpgrade: tcp\r\n\r\nfirst")
+            data = bytearray()
+            while True:
+                part = stream.recv(1024)
+                if not part:
+                    break
+                data.extend(part)
+            observed.append(bytes(data))
+            stream.sendall(b"last")
+        with daemon(backend) as proxy, socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+            client.settimeout(2)
+            client.connect(proxy.path)
+            client.sendall(b"POST /v1.53/containers/id/attach HTTP/1.1\r\nContent-Length: 0\r\n\r\n")
+            first, _, _ = head(client, time.monotonic() + 2)
+            self.assertTrue(first.startswith(b"HTTP/1.1 101 "))
+            self.assertEqual(exact(client, 5, time.monotonic() + 2), b"first")
+            client.sendall(b"control")
+            client.shutdown(socket.SHUT_WR)
+            self.assertEqual(exact(client, 4, time.monotonic() + 2), b"last")
+            self.assertEqual(client.recv(1), b"")
+        self.assertEqual(observed, [b"control"])
+
+    def test_should_hold_create_ack_only_after_the_backend_effect_and_exact_owner(self):
+        owner, key, effects = str(uuid.uuid4()), "a" * 64, []
+        def backend(stream):
+            _, payload = request(stream)
+            effects.append(json.loads(payload))
+            reply = json.dumps({"Id":key}).encode()
+            stream.sendall(b"HTTP/1.1 201 Created\r\nContent-Length: " + str(len(reply)).encode() + b"\r\n\r\n" + reply)
+        with daemon(backend) as proxy:
+            proxy.arm("create", owner)
+            proxy.gate("create", {"owner":str(uuid.uuid4()), "role":"function", "id":"b"*64})
+            self.assertFalse(proxy.observed)
+            def client():
+                connection = UnixHTTP(proxy.path)
+                try:
+                    connection.request("POST", "/v1.53/containers/create", json.dumps({
+                        "Labels":{"rustack.lambda.ownerId":owner, "rustack.lambda.role":"function"}}))
+                    return json.loads(connection.getresponse().read())
+                finally:
+                    connection.close()
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                result = pool.submit(client)
+                self.assertEqual(proxy.wait(1, time.monotonic() + 2)[0]["id"], key)
+                self.assertEqual(len(effects), 1)
+                self.assertFalse(result.done())
+                proxy.release()
+                self.assertEqual(result.result(2), {"Id":key})
+
+    def test_should_hold_private_tag_ack_after_effect_and_scope_it_to_the_owner(self):
+        owner, run, pin = (uuid.uuid4() for _ in range(3))
+        repository = "rustack-internal/lambda-" + owner.hex + "/" + run.hex
+        target = "/v1.53/images/sha256:" + "a"*64 + "/tag?" + urllib.parse.urlencode({"repo":repository, "tag":pin.hex})
+        effected = threading.Event()
+        def backend(stream):
+            first, _ = request(stream)
+            self.assertEqual(first, ("POST " + target + " HTTP/1.1\r\n").encode())
+            effected.set()
+            stream.sendall(b"HTTP/1.1 201 Created\r\nContent-Length: 0\r\n\r\n")
+        with daemon(backend) as proxy:
+            proxy.arm("tag", str(owner))
+            proxy.gate("tag", {"owner":str(uuid.uuid4()), "alias":"foreign"})
+            self.assertFalse(proxy.observed)
+            def client():
+                connection = UnixHTTP(proxy.path)
+                try:
+                    connection.request("POST", target)
+                    reply = connection.getresponse()
+                    reply.read()
+                    return reply.status
+                finally:
+                    connection.close()
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                result = pool.submit(client)
+                observed = proxy.wait(1, time.monotonic() + 2)
+                self.assertTrue(effected.is_set())
+                self.assertEqual(observed[0]["alias"], repository + ":" + pin.hex)
+                self.assertFalse(result.done())
+                proxy.release()
+                self.assertEqual(result.result(2), 201)
+
+    def test_should_drop_only_the_selected_image_ack_after_forwarding_real_io(self):
+        effected = threading.Event()
+        def backend(stream):
+            first, _ = request(stream)
+            self.assertEqual(first, b"GET /v1.53/images/source:b/json HTTP/1.1\r\n")
+            effected.set()
+            stream.sendall(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\n{}")
+        with daemon(backend) as proxy:
+            proxy.fail_image("source:b")
+            connection = UnixHTTP(proxy.path)
+            try:
+                connection.request("GET", "/v1.53/images/source:b/json")
+                with self.assertRaises((http.client.RemoteDisconnected, OSError)):
+                    connection.getresponse()
+                self.assertTrue(effected.wait(1))
+            finally:
+                connection.close()
+            proxy.restore()
+            self.assertIsNone(proxy.failed_image)
+
+    def test_should_hold_delete_before_forwarding_the_recorded_effect(self):
+        owner, key, effected = str(uuid.uuid4()), "b"*64, threading.Event()
+        def backend(stream):
+            first, _ = request(stream)
+            self.assertEqual(first, ("DELETE /v1.53/containers/" + key + " HTTP/1.1\r\n").encode())
+            effected.set()
+            stream.sendall(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+        with daemon(backend) as proxy:
+            proxy.records[key] = {"owner":owner, "role":"function"}
+            proxy.arm("delete", owner)
+            def client():
+                connection = UnixHTTP(proxy.path)
+                try:
+                    connection.request("DELETE", "/v1.53/containers/" + key)
+                    reply = connection.getresponse()
+                    reply.read()
+                    return reply.status
+                finally:
+                    connection.close()
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                result = pool.submit(client)
+                proxy.wait(1, time.monotonic() + 2)
+                self.assertFalse(effected.is_set())
+                proxy.release()
+                self.assertEqual(result.result(2), 204)
+                self.assertTrue(effected.is_set())
+
+    def test_should_reject_ambiguous_oversized_duplicate_or_truncated_framing(self):
+        values = [
+            b"GET / HTTP/1.1\r\nContent-Length: 0\r\nTransfer-Encoding: chunked\r\n\r\n",
+            b"GET / HTTP/1.1\r\nContent-Length: -1\r\n\r\n",
+            b"GET / HTTP/1.1\r\nContent-Length: 2000000\r\n\r\n",
+            b"GET / HTTP/1.1\r\nContent-Length: 0\r\nContent-Length: 0\r\n\r\n",
+            b"GET / HTTP/1.1\r\nTransfer-Encoding: gzip\r\n\r\n",
+            b"GET / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n200000\r\n",
+            b"GET / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n2\r\na",
+            b"GET / HTTP/1.1\r\n" + b"a"*4097 + b"\r\n\r\n",
+        ]
+        for value in values:
+            left, right = socket.socketpair()
+            try:
+                left.sendall(value)
+                left.shutdown(socket.SHUT_WR)
+                with self.subTest(value=value[:80]), self.assertRaises((ProtocolError, EOFError)):
+                    _, fields, _ = head(right, time.monotonic() + 2)
+                    body(right, fields, 1024 * 1024, time.monotonic() + 2)
+            finally:
+                left.close()
+                right.close()
+
+    def test_should_enforce_exact_encoded_chunk_and_terminated_line_caps(self):
+        wire = b"1\r\na\r\n" * 3412 + b"0\r\n\r\n"
+        self.assertEqual(len(wire), 4093 + 16384)
+        for value, valid in ((wire, True), (wire[:-5] + b"00\r\n\r\n", False)):
+            left, right = socket.socketpair()
+            left.settimeout(2)
+            try:
+                with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                    sent = pool.submit(left.sendall, value)
+                    if valid:
+                        raw, decoded = body(right, {b"transfer-encoding":b"chunked"}, 4093, time.monotonic() + 2)
+                        self.assertEqual(raw, value)
+                        self.assertEqual(decoded, b"a"*3412)
+                    else:
+                        with self.assertRaises(ProtocolError):
+                            body(right, {b"transfer-encoding":b"chunked"}, 4093, time.monotonic() + 2)
+                    sent.result(2)
+            finally:
+                left.close()
+                right.close()
+        for count, valid in ((4096, True), (4097, False)):
+            left, right = socket.socketpair()
+            try:
+                left.sendall(b"x"*(count-2) + b"\r\n")
+                if valid:
+                    self.assertEqual(len(line(right, time.monotonic() + 2)), 4096)
+                else:
+                    with self.assertRaises(ProtocolError):
+                        line(right, time.monotonic() + 2)
+            finally:
+                left.close()
+                right.close()
+
+    def test_should_refuse_expired_gate_without_recording_ready_evidence(self):
+        with daemon(lambda stream: None) as proxy:
+            owner = str(uuid.uuid4())
+            proxy.arm("create", owner)
+            proxy.rule = proxy.rule[:-1] + (time.monotonic() - 1,)
+            with self.assertRaises(AssertionError):
+                proxy.gate("create", {"owner":owner, "role":"function", "id":"a"*64})
+            self.assertFalse(proxy.observed)
+
+    def test_should_scope_large_archive_bodies_to_recorded_loader_and_fixed_destination(self):
+        with daemon(lambda stream: None) as proxy:
+            key = "a" * 64
+            path = "/containers/" + key + "/archive"
+            target = ("/v1.53" + path + "?path=%2Fvar%2Ftask&noOverwriteDirNonDir=true&copyUIDGID=false").encode()
+            fields = {b"content-type":b"application/x-tar"}
+            for role in (None, "function", "relay"):
+                proxy.records = {} if role is None else {key:{"role":role}}
+                with self.subTest(role=role), self.assertRaises(ProtocolError):
+                    proxy.request_limit(b"PUT", target, path, fields)
+            proxy.records = {key:{"role":"code-loader"}}
+            self.assertEqual(proxy.request_limit(b"PUT", target, path, fields), 282 * 1024 * 1024)
+            for changed, destination, headers in ((target.replace(b"var%2Ftask", b"tmp"), path, fields),
+                    (target + b"&copyUIDGID=true", path, fields), (target.replace(b"noOverwriteDirNonDir=true", b"noOverwriteDirNonDir=false"), path, fields), (target, path, {}),
+                    (target, "/containers/short/archive", fields)):
+                with self.subTest(target=changed), self.assertRaises(ProtocolError):
+                    proxy.request_limit(b"PUT", changed, destination, headers)
+            self.assertEqual(proxy.request_limit(b"POST", target, path, fields), 1024 * 1024)
+
+    def test_should_forward_recorded_archive_larger_than_json_without_rewriting_bytes(self):
+        payload = b"x" * (1024 * 1024 + 1024)
+        key = "b" * 64
+        def backend(stream):
+            first, fields, _ = head(stream, time.monotonic() + 3)
+            self.assertTrue(first.startswith(("PUT /v1.53/containers/" + key + "/archive?").encode()))
+            _, decoded = body(stream, fields, len(payload), time.monotonic() + 3)
+            self.assertEqual(decoded, payload)
+            stream.sendall(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n")
+        with daemon(backend) as proxy:
+            proxy.records[key] = {"role":"code-loader", "owner":str(uuid.uuid4())}
+            connection = UnixHTTP(proxy.path)
+            try:
+                connection.request("PUT", "/v1.53/containers/" + key + "/archive?path=%2Fvar%2Ftask&noOverwriteDirNonDir=true&copyUIDGID=false",
+                    payload, {"Content-Type":"application/x-tar"})
+                response = connection.getresponse()
+                self.assertEqual(response.status, 200)
+                self.assertEqual(response.read(), b"")
+            finally:
+                connection.close()
+
+    def test_should_join_quiet_and_partial_header_connections_on_abort(self):
+        def backend(stream):
+            while stream.recv(1024):
+                pass
+        for initial in (b"", b"GET /info HTTP/1.1\r\nX-Partial:"):
+            with daemon(backend) as proxy, socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
+                client.connect(proxy.path)
+                client.sendall(initial)
+                deadline = time.monotonic() + 2
+                while len(proxy.sockets) < 2:
+                    self.assertLess(time.monotonic(), deadline)
+                    time.sleep(0.005)
+                started = time.monotonic()
+                proxy.close()
+                self.assertLess(time.monotonic() - started, 2)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_docker_required_suites.py b/tests/workflows/test_docker_required_suites.py
new file mode 100644
index 00000000..3cb89c07
--- /dev/null
+++ b/tests/workflows/test_docker_required_suites.py
@@ -0,0 +1,76 @@
+"""Docker policy stays exact and cannot accept a native-only/release manifest."""
+import copy
+import json
+from pathlib import Path
+import unittest
+
+from docker_required_suites import SUITES, parse_manifest, verify
+from required_suites import MANIFEST_LIMIT, ManifestError, read_regular
+from test_required_suites import encoded, listing
+
+
+def document():
+    return {"schemaVersion":1, "profile":"rustack-docker-image-v1", "qualification":"docker-image-functional",
+            "suites":[{"id":suite, "tests":["test_should_execute_" + suite.replace("-", "_")]}
+                      for suite in sorted(SUITES)]}
+
+
+class DockerManifestControls(unittest.TestCase):
+    def test_should_require_every_exact_suite_and_load_frozen_eighty_three_resources(self):
+        required = parse_manifest(encoded(document()))
+        self.assertEqual(verify(required, {key:listing(names) for key,names in required.items()}), 8)
+        frozen = parse_manifest(read_regular(Path(__file__).with_name("docker-required-suites.json"), MANIFEST_LIMIT))
+        self.assertEqual(sum(map(len, frozen.values())), 83)
+        self.assertEqual(len(frozen["ordinary-startup"]), 50)
+        self.assertEqual(len(frozen["docker-core"]), 9)
+        self.assertEqual(len(frozen["relay-runtime"]), 5)
+
+    def test_should_refuse_native_release_unknown_or_duplicate_scope(self):
+        for change in ({"qualification":"full-release"}, {"qualification":"native-workflow-only"},
+                       {"profile":"rustack-standard-jsonpath-v1"}, {"schemaVersion":True}, {"extra":1}):
+            with self.subTest(change=change), self.assertRaises(ManifestError):
+                parse_manifest(encoded(dict(document(), **change)))
+        for mutate in (lambda row: row["suites"].pop(),
+                       lambda row: row["suites"][0].update(id="native-bridge"),
+                       lambda row: row["suites"][0].update(id=row["suites"][1]["id"])):
+            value = document()
+            mutate(value)
+            with self.assertRaises(ManifestError):
+                parse_manifest(encoded(value))
+        native = Path(__file__).with_name("required-suites.json").read_bytes()
+        with self.assertRaises(ManifestError):
+            parse_manifest(native)
+
+    def test_should_reject_drift_in_any_compiled_target_including_removed_ignored_tests(self):
+        required = parse_manifest(encoded(document()))
+        inventories = {key:listing(names) for key,names in required.items()}
+        for suite in SUITES:
+            for replacement in (listing([]), listing(["renamed"]),
+                                listing(list(required[suite]) + ["unexpected_resource"])):
+                changed = dict(inventories, **{suite:replacement})
+                with self.subTest(suite=suite), self.assertRaises(ManifestError):
+                    verify(required, changed)
+        with self.assertRaises(ManifestError):
+            verify(required, {key:value for key,value in inventories.items() if key != "relay-runtime"})
+
+    def test_should_keep_strict_bounded_schema_and_inventory_decoding(self):
+        for mutation in (lambda row: row["suites"][0].update(tests=["same", "same"]),
+                         lambda row: row["suites"][0].update(tests=["bad;command"]),
+                         lambda row: row["suites"][0].update(tests=["x"*257]),
+                         lambda row: row["suites"][0].update(tests=["case"]*129)):
+            value = copy.deepcopy(document())
+            mutation(value)
+            with self.assertRaises(ManifestError):
+                parse_manifest(encoded(value))
+        for value in (b" "*(MANIFEST_LIMIT+1), b"\xff", b"{", b'{"schemaVersion":1,"schemaVersion":1}'):
+            with self.assertRaises(ManifestError):
+                parse_manifest(value)
+        required = parse_manifest(encoded(document()))
+        inventories = {key:listing(names) for key,names in required.items()}
+        for raw in (b"case: test\n2 tests, 0 benchmarks", b"case: test\n1 test, 1 benchmark", b"bad name: test", b"\xff"):
+            with self.assertRaises(ManifestError):
+                verify(required, dict(inventories, **{"docker-core":raw}))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_github_action.py b/tests/workflows/test_github_action.py
new file mode 100644
index 00000000..f2e81360
--- /dev/null
+++ b/tests/workflows/test_github_action.py
@@ -0,0 +1,338 @@
+"""Actual Action entrypoint controls through private fake CLI processes."""
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import time
+import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
+
+APP = Path(__file__).resolve().parents[2] / "tools/github-action"
+sys.path.insert(0, str(APP))
+import metadata
+from process_owner import Runner
+from settings import ActionError, DEFAULTS, Settings
+
+
+class SettingsControls(unittest.TestCase):
+    def test_should_validate_all_domains_before_effects(self):
+        Settings.load({})
+        with self.assertRaises(ActionError):
+            Settings.load({"RUSTACK_ACTION_ACCESS_KEY": "", "RUSTACK_ACTION_SECRET_KEY": "", "RUSTACK_ACTION_S3_SKIP_AUTH": "false"})
+        for key, values in {
+            "image-tag": ["$(touch marker)", "x;true", "a/b", "a\n", "a" * 129],
+            "port": ["0", "01", "65536", "1;true", "4566\n"],
+            "wait-timeout": ["0", "01", "301", "1\n"],
+            "default-region": ["US-EAST-1", "x y", "-east", "a" * 65],
+            "log-level": ["INFO", "info;true"], "persistence": ["True", "false\n"],
+            "stepfunctions-skip-auth": ["yes", "true\n"],
+            "services": ["s3,s3", "s3,", "s3, lambda", "unknown"],
+            "secret-key": ["", "x\ny", "x\ry", "a" * 513, "雪"],
+        }.items():
+            for value in values:
+                with self.subTest(field=key), self.assertRaises(ActionError):
+                    Settings.load({"RUSTACK_ACTION_" + key.upper().replace("-", "_"): value})
+
+    def test_should_preserve_literal_authentication_and_redact_debug(self):
+        secret = "opaque$(touch marker)`command`%0A=with spaces"
+        settings = Settings.load({"RUSTACK_ACTION_SECRET_KEY": secret})
+        self.assertEqual(settings.docker_environment()["SECRET_KEY"], secret)
+        self.assertNotIn(secret, repr(settings))
+        self.assertEqual(Settings.load({"RUSTACK_ACTION_ACCESS_KEY": "", "RUSTACK_ACTION_SECRET_KEY": ""})
+                         .caller_environment()["AWS_SECRET_ACCESS_KEY"], "")
+
+
+class MetadataControls(unittest.TestCase):
+    def test_should_reject_deep_duplicate_nonfinite_and_excessive_json_before_acceptance(self):
+        for body in [b'{"ready":true,"ready":false}', b'[' * 9 + b'0' + b']' * 9,
+                     b'{"number":1e9999}', b'{"number":NaN}', b'"' + b'x' * 257 + b'"',
+                     b'"\\ud800"', b'[' + b'0,' * 512 + b'0]']:
+            with self.subTest(bodyBytes=len(body)), self.assertRaises(ActionError):
+                metadata.document(body)
+
+    def test_should_require_structured_ready_and_local_canonical_identity(self):
+        metadata.readiness(b'{"ready":true,"services":{"stepfunctions":"running"}}')
+        for body in [b'{"ready":false,"services":{"s3":"running"}}', b'{"ready":true,"services":{}}',
+                     b'{"ready":true,"services":{"s3":"starting"}}', b'{"message":"ok"}']:
+            with self.assertRaises(ActionError):
+                metadata.readiness(body)
+        for value in ["tcp://localhost:2375", "unix://relative", "unix:///run/../docker.sock", "unix:///run//docker.sock"]:
+            with self.assertRaises(ActionError):
+                metadata.endpoint(value)
+
+
+class ProcessControls(unittest.TestCase):
+    def test_should_join_success_and_keep_bounded_output_private(self):
+        runner = Runner({"PATH": os.defpath})
+        reply = runner.run([sys.executable, "-c", "print('joined')"], time.monotonic() + 3)
+        self.assertEqual(reply.stdout, b"joined\n")
+        self.assertNotIn("joined", repr(reply))
+        self.assertFalse(runner.unsettled)
+
+    def test_should_kill_and_join_a_stalled_actual_child(self):
+        with tempfile.TemporaryDirectory() as directory:
+            pid_file = Path(directory) / "pid"
+            code = "import os,time,pathlib;pathlib.Path(" + repr(str(pid_file)) + ").write_text(str(os.getpid()));time.sleep(30)"
+            real_cutoff = time.monotonic() + 5
+            start = time.monotonic()
+            entered = False
+            def clock():
+                nonlocal entered
+                if time.monotonic() >= real_cutoff:
+                    raise ActionError("controlled-child-entry-deadline")
+                if pid_file.exists() and pid_file.read_text().isdigit():
+                    entered = True
+                    return start + 2
+                return start
+            runner = Runner({"PATH": os.defpath}, clock=clock)
+            with self.assertRaises(ActionError):
+                runner.run([sys.executable, "-c", code], start + 1)
+            self.assertTrue(entered)
+            pid = int(pid_file.read_text())
+            with self.assertRaises(ProcessLookupError):
+                os.kill(pid, 0)
+            self.assertFalse(runner.unsettled)
+
+    def test_should_never_discharge_a_group_on_permission_denial(self):
+        child = SimpleNamespace(pid=1234, poll=lambda: 0)
+        with patch("os.killpg", side_effect=PermissionError):
+            self.assertTrue(Runner._alive(child))
+
+    def test_should_retire_a_causally_entered_actual_descendant_group(self):
+        with tempfile.TemporaryDirectory() as directory:
+            ready = Path(directory) / "descendant"
+            identities = Path(directory) / "identities"
+            descendant = "import os,time,pathlib;pathlib.Path(" + repr(str(ready)) + ").write_text(str(os.getpid()));time.sleep(30)"
+            parent = ("import os,time,pathlib,json,signal,subprocess,sys\n"
+                      "p=subprocess.Popen([sys.executable,'-c'," + repr(descendant) + "])\n"
+                      "def stop(_s,_f):\n p.wait(timeout=2)\n raise SystemExit(0)\n"
+                      "signal.signal(signal.SIGTERM,stop)\n"
+                      "ready=pathlib.Path(" + repr(str(ready)) + ")\n"
+                      "while not ready.exists() or not ready.read_text().isdigit(): time.sleep(.005)\n"
+                      "pathlib.Path(" + repr(str(identities)) + ").write_text(json.dumps([os.getpid(),int(ready.read_text())]))\n"
+                      "time.sleep(30)\n")
+            start, outer = time.monotonic(), time.monotonic() + 5
+            entered = None
+            def clock():
+                nonlocal entered
+                if time.monotonic() >= outer:
+                    raise ActionError("controlled-descendant-entry-deadline")
+                if identities.exists():
+                    try:
+                        observed = json.loads(identities.read_text())
+                    except ValueError:
+                        return start
+                    if len(observed) == 2 and all(type(pid) is int and pid > 0 for pid in observed):
+                        entered = observed
+                        return start + 2
+                return start
+            runner = Runner({"PATH": os.defpath}, clock=clock)
+            with self.assertRaises(ActionError):
+                runner.run([sys.executable, "-c", parent], start + 1)
+            self.assertIsNotNone(entered)
+            for pid in entered:
+                with self.assertRaises(ProcessLookupError):
+                    os.kill(pid, 0)
+            self.assertFalse(runner.unsettled)
+
+    def test_should_close_and_join_stdout_and_stderr_floods(self):
+        for stream in ["stdout", "stderr"]:
+            runner = Runner({"PATH": os.defpath})
+            with self.assertRaises(ActionError):
+                runner.run([sys.executable, "-c", "import sys,time;sys." + stream + ".buffer.write(b'x'*131072);time.sleep(30)"],
+                           time.monotonic() + 3)
+            self.assertFalse(runner.unsettled)
+
+
+class ActualActionControls(unittest.TestCase):
+    def setUp(self):
+        metadata_path = os.environ.get("RUSTACK_ACTION_TEST_METADATA")
+        if metadata_path is None:
+            raise RuntimeError("Run make test-workflows-release-fixture to read actual Action YAML")
+        raw = Path(metadata_path).read_bytes()
+        assert len(raw) <= 131072
+        self.action = json.loads(raw)
+        self.assertEqual(self.action["defaults"], DEFAULTS)
+        self.root = tempfile.TemporaryDirectory(prefix="case-", dir=Path(metadata_path).parent)
+        self.addCleanup(self.root.cleanup)
+        self.directory = Path(self.root.name)
+        self.bin = self.directory / "bin"
+        self.bin.mkdir()
+        for name in ("docker", "curl"):
+            target = self.bin / name
+            target.write_text("#!" + sys.executable + "\n" + Path(__file__).with_name("fake_action_cli.py").read_text())
+            target.chmod(0o700)
+        (self.bin / "python3").symlink_to(sys.executable)
+        self.model = {"mode": "success", "engine": "725b98b4-e588-41b8-9cf5-54a5ad70c89f",
+                      "source": "sha256:" + "b" * 64, "cid": "a" * 64}
+        self.output = self.directory / "output"
+        self.export = self.directory / "env"
+        self.output.write_bytes(b"")
+        self.export.write_bytes(b"")
+
+    def run_action(self, inputs=None, mode="success", missing=False, host_environment=None):
+        values = dict(DEFAULTS, **(inputs or {}))
+        self.model.update(mode=mode, port=values["port"], missing=missing)
+        (self.bin / "model.json").write_text(json.dumps(self.model))
+        environment = {"PATH": str(self.bin) + os.pathsep + os.defpath, "HOME": self.root.name,
+                       "RUNNER_TEMP": self.root.name, "GITHUB_OUTPUT": str(self.output), "GITHUB_ENV": str(self.export),
+                       "PYTHONDONTWRITEBYTECODE": "1"}
+        for name, expression in self.action["environment"].items():
+            if expression == "${{ github.action_path }}":
+                environment[name] = str(APP.parents[1])
+            else:
+                prefix, suffix = "${{ inputs.", " }}"
+                self.assertTrue(expression.startswith(prefix) and expression.endswith(suffix))
+                environment[name] = values[expression[len(prefix):-len(suffix)]]
+        environment.update(host_environment or {})
+        before = time.monotonic()
+        driver = Runner(environment)
+        driver.environment = environment
+        reply = driver.run(["/bin/bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", self.action["run"]],
+                           time.monotonic() + 600, working_directory=self.directory)
+        self.assertLessEqual(len(reply.stdout), 32768)
+        self.assertLessEqual(len(reply.stderr), 32768)
+        events = self.bin / "events.jsonl"
+        observed = [json.loads(line) for line in events.read_text().splitlines()] if events.exists() else []
+        model = json.loads((self.bin / "model.json").read_text())
+        return reply, observed, model, time.monotonic() - before
+
+    def test_should_execute_the_actual_run_body_and_handoff_exact_metadata(self):
+        reply, events, model, _ = self.run_action()
+        self.assertEqual(reply.code, 0)
+        self.assertTrue(model["running"])
+        self.assertFalse(model.get("removed", False))
+        self.assertIn("container_id=" + model["cid"], self.output.read_text())
+        self.assertIn("AWS_ENDPOINT_URL=http://localhost:4566\n", self.export.read_text())
+        self.assertFalse(list(self.directory.glob("rustack-action-*")))
+        self.assertTrue(any(event["tool"] == "curl" for event in events))
+
+    def test_should_reject_shell_payloads_before_any_child_or_output(self):
+        for key, value in [("image-tag", "$(touch injected)"), ("port", "4566;touch injected"),
+                           ("wait-timeout", "1$(touch injected)"), ("default-region", "US-EAST-1"),
+                           ("log-level", "info'"), ("services", "s3\nSECRET_KEY=bad"),
+                           ("stepfunctions-skip-auth", "true;touch injected")]:
+            reply, events, _, _ = self.run_action({key: value})
+            self.assertNotEqual(reply.code, 0)
+            self.assertEqual(events, [])
+            self.assertEqual(self.output.read_bytes(), b"")
+            self.assertEqual(self.export.read_bytes(), b"")
+            self.assertFalse((self.directory / "injected").exists())
+
+    def test_should_keep_credential_metacharacters_literal_and_out_of_argv(self):
+        secret = "private$(touch injected)`whoami`%0A=opaque"
+        reply, events, model, _ = self.run_action({"secret-key": secret})
+        self.assertEqual(reply.code, 0)
+        self.assertEqual(model["serverEnvironment"]["SECRET_KEY"], secret)
+        self.assertNotIn(secret, json.dumps([event["args"] for event in events]))
+        self.assertNotIn(secret, reply.stderr.decode())
+        self.assertFalse((self.directory / "injected").exists())
+        self.assertIn("AWS_SECRET_ACCESS_KEY=" + secret + "\n", self.export.read_text())
+
+    def test_should_omit_absent_credentials_and_reject_enabled_strict_auth_before_children(self):
+        empty = {"access-key": "", "secret-key": ""}
+        reply, _, model, _ = self.run_action(empty)
+        self.assertEqual(reply.code, 0)
+        self.assertNotIn("ACCESS_KEY", model["serverEnvironment"])
+        self.assertNotIn("SECRET_KEY", model["serverEnvironment"])
+        self.assertIn("AWS_SECRET_ACCESS_KEY=\n", self.export.read_text())
+
+    def test_should_resolve_explicit_context_before_host(self):
+        reply, events, _, _ = self.run_action(host_environment={"DOCKER_CONTEXT": "selected", "DOCKER_HOST": "unix:///tmp/wrong.sock"})
+        self.assertEqual(reply.code, 0)
+        self.assertEqual(events[0]["args"][-2:], ["--", "selected"])
+        self.assertTrue(all(e["args"][:2] == ["--host", "unix:///tmp/rustack-action-control.sock"]
+                            for e in events if e["tool"] == "docker" and e["args"][0] != "context"))
+
+    def test_should_refuse_an_effective_remote_context_despite_a_local_host_variable(self):
+        self.model["contextEndpoint"] = "ssh://remote"
+        reply, events, _, _ = self.run_action(host_environment={"DOCKER_CONTEXT": "remote", "DOCKER_HOST": "unix:///tmp/wrong.sock"})
+        self.assertNotEqual(reply.code, 0)
+        self.assertEqual(len(events), 1)
+        self.assertEqual(events[0]["args"][:2], ["context", "inspect"])
+
+    def test_should_reject_redirect_status_and_disable_ambient_curl_configuration(self):
+        reply, events, model, _ = self.run_action(mode="redirect-http")
+        self.assertNotEqual(reply.code, 0)
+        self.assertTrue(model.get("removed"))
+        curl = next(e for e in events if e["tool"] == "curl")
+        self.assertEqual(curl["args"][0], "--disable")
+        self.assertIn("%{stderr}%{http_code}", curl["args"])
+
+    def test_should_fail_a_fifo_handoff_without_blocking_and_join_exact_cleanup(self):
+        self.output.unlink()
+        os.mkfifo(self.output, 0o600)
+        reply, _, model, elapsed = self.run_action()
+        self.assertNotEqual(reply.code, 0)
+        self.assertTrue(model.get("removed"))
+        self.assertLess(elapsed, 5)
+
+    def test_should_pull_once_only_after_successful_absence(self):
+        reply, events, _, _ = self.run_action(missing=True)
+        self.assertEqual(reply.code, 0)
+        self.assertEqual(sum("pull" in event["args"] for event in events), 1)
+
+    def test_should_never_treat_lookup_failure_as_absence(self):
+        reply, events, _, _ = self.run_action(mode="lookup-failure")
+        self.assertNotEqual(reply.code, 0)
+        self.assertFalse(any("pull" in e["args"] or "run" in e["args"] for e in events))
+
+    def test_should_leave_a_foreign_existing_name_uninspected_and_untouched(self):
+        reply, events, _, _ = self.run_action(mode="foreign-name")
+        self.assertNotEqual(reply.code, 0)
+        self.assertFalse(any("rm" in e["args"] or "container" in e["args"] for e in events))
+
+    def test_should_refuse_unrelated_http_and_remove_only_the_exact_stopped_id(self):
+        reply, events, model, _ = self.run_action(mode="unrelated-http")
+        self.assertNotEqual(reply.code, 0)
+        self.assertTrue(model.get("removed"))
+        removal = [e for e in events if "rm" in e["args"]]
+        self.assertEqual(len(removal), 1)
+        self.assertEqual(removal[0]["args"][-1], model["cid"])
+        self.assertFalse(any("--force" in e["args"] or "-f" in e["args"] for e in events))
+
+    def test_should_refuse_ready_false(self):
+        reply, _, model, _ = self.run_action(mode="not-ready")
+        self.assertNotEqual(reply.code, 0)
+        self.assertTrue(model.get("removed"))
+
+    def test_should_refuse_wrong_publication_and_exited_container(self):
+        for mode in ("wrong-publication", "exited-cid"):
+            with self.subTest(mode=mode):
+                reply, _, model, _ = self.run_action(mode=mode)
+                self.assertNotEqual(reply.code, 0)
+                self.assertTrue(model.get("removed"))
+                self.assertEqual(self.output.read_bytes(), b"")
+
+    def test_should_refuse_daemon_rebinding_without_mutating_the_other_engine(self):
+        reply, events, _, _ = self.run_action(mode="changed-engine")
+        self.assertNotEqual(reply.code, 0)
+        self.assertFalse(any("kill" in e["args"] or "rm" in e["args"] for e in events))
+
+    def test_should_honor_real_seconds_and_join_failed_readiness_cleanup(self):
+        reply, events, model, elapsed = self.run_action({"wait-timeout": "1"}, mode="never-healthy")
+        self.assertNotEqual(reply.code, 0)
+        self.assertGreaterEqual(elapsed, 1)
+        self.assertLess(elapsed, 8)
+        self.assertTrue(model.get("removed"))
+        run = next(e for e in events if "run" in e["args"])
+        stop = next(e for e in events if "kill" in e["args"])
+        self.assertGreaterEqual(stop["at"] - run["at"], 0.95)
+
+    def test_should_never_accept_a_late_http_success(self):
+        reply, _, model, _ = self.run_action({"wait-timeout": "1"}, mode="late-http")
+        self.assertNotEqual(reply.code, 0)
+        self.assertTrue(model.get("removed"))
+        self.assertEqual(self.output.read_bytes(), b"")
+
+
+if __name__ == "__main__":
+    print(os.getpid(), flush=True)
+    if len(sys.argv) != 2:
+        raise SystemExit("Use make test-workflows-action-fixture")
+    os.environ["RUSTACK_ACTION_TEST_METADATA"] = sys.argv[1]
+    result = unittest.TextTestRunner(verbosity=2).run(unittest.defaultTestLoader.loadTestsFromModule(sys.modules[__name__]))
+    print(json.dumps({"schemaVersion": 1, "cases": result.testsRun, "successful": result.wasSuccessful()}))
+    raise SystemExit(0 if result.wasSuccessful() else 1)
diff --git a/tests/workflows/test_handler_sdk_image.py b/tests/workflows/test_handler_sdk_image.py
new file mode 100644
index 00000000..08f431a2
--- /dev/null
+++ b/tests/workflows/test_handler_sdk_image.py
@@ -0,0 +1,79 @@
+"""SDK consumer ownership and private metadata projection controls."""
+import json
+import unittest
+
+from handler_sdk_image import UNSET, inspect_sdk_environment
+from lambda_fault_support import invoke_json
+
+
+class Body:
+    def __init__(self, data):
+        self.data, self.closed, self.limit = data, False, None
+
+    def read(self, limit):
+        self.limit = limit
+        return self.data
+
+    def close(self):
+        self.closed = True
+
+
+class Client:
+    def __init__(self, body):
+        self.body = body
+
+    def invoke(self, **_):
+        return {"StatusCode": 200, "Payload": self.body}
+
+
+class Metadata:
+    def __init__(self, duplicate=False):
+        self.duplicate = duplicate
+
+    def rows(self):
+        return [{"Id": role, "Labels": {"rustack.lambda.role": role}} for role in ("function", "relay")]
+
+    def get(self, path):
+        env = []
+        if "/function/" in path:
+            env = ["AWS_ACCESS_KEY_ID=local-key", "AWS_SECRET_ACCESS_KEY=private-sdk-secret",
+                   "AWS_ENDPOINT_URL=http://192.0.2.1:4566/", "AWS_EC2_METADATA_DISABLED=true",
+                   "AWS_CONFIG_FILE=/dev/null", "AWS_SHARED_CREDENTIALS_FILE=/dev/null", *UNSET]
+            if self.duplicate:
+                env.append("AWS_PROFILE=duplicate")
+        return {"State": {"Running": True}, "Config": {"Env": env}}
+
+
+class HandlerSdkControls(unittest.TestCase):
+    def test_should_close_successful_bounded_invoke_body(self):
+        body = Body(b'{"computed":42}')
+        _, value = invoke_json(Client(body), "fixture", {"value": 21})
+        self.assertEqual(value, {"computed": 42})
+        self.assertTrue(body.closed)
+        self.assertEqual(body.limit, 65537)
+
+    def test_should_close_oversized_invoke_body_before_reporting_error(self):
+        body = Body(b"x" * 65537)
+        with self.assertRaises(AssertionError):
+            invoke_json(Client(body), "fixture", {})
+        self.assertTrue(body.closed)
+
+    def test_should_close_malformed_or_duplicate_json_invoke_body(self):
+        for data in (b"{", b'{"computed":42,"computed":43}'):
+            body = Body(data)
+            with self.assertRaises((ValueError, AssertionError)):
+                invoke_json(Client(body), "fixture", {})
+            self.assertTrue(body.closed)
+
+    def test_should_project_only_nonsecret_environment_identities(self):
+        value = inspect_sdk_environment(Metadata(), "http://127.0.0.1:4566", "192.0.2.1", "private-sdk-secret")
+        self.assertEqual(value, {"function": "function", "relay": "relay"})
+        self.assertNotIn("private-sdk-secret", json.dumps(value))
+
+    def test_should_refuse_duplicate_environment_fields_without_projecting_secrets(self):
+        with self.assertRaises(AssertionError):
+            inspect_sdk_environment(Metadata(True), "http://127.0.0.1:4566", "192.0.2.1", "private-sdk-secret")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_image_performance.py b/tests/workflows/test_image_performance.py
new file mode 100644
index 00000000..8e24177c
--- /dev/null
+++ b/tests/workflows/test_image_performance.py
@@ -0,0 +1,452 @@
+"""Independent literal sample, causal-flood, cold-stage and accounting controls."""
+import copy
+import json
+from pathlib import Path
+import subprocess
+import sys
+import unittest
+import uuid
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+from image_performance_report import validate
+from image_performance_support import cold_stages, decode, exact_samples, live, overhead, samples, verify_stages, wait_task_baseline
+from settings import ActionError
+
+
+def warm():
+    return {"schemaVersion": 1, "phase": "warm", "referenceQualification": "pending", "os": "linux",
+            "architecture": "aarch64", "python": "3.12.3", "sdkVersion": "1.43.118",
+            "baselineProcess": {"rssKiB": 10000, "tasks": 8}, "emptyAfterWorkload": True,
+            "measurement": {"totalNanos": [15000001] * 100, "handlerNanos": [10000001] * 100,
+                            "overhead": {"observedMicros": [5000] * 100,
+                                         "p50Micros": 5000, "p95Micros": 5000, "maxMicros": 5000}}}
+
+
+def identities():
+    return [str(uuid.UUID(int=index + 1)) for index in range(20)]
+
+
+def logs(names):
+    return b"\n".join(("INFO rustack_lambda_core::docker::initialization: Image environment ready "
+                       "environment_id=" + name + " relay_micros=100 ric_micros=200").encode() for name in names)
+
+
+class ImageCacheModel:
+    first = "sha256:" + "a" * 64
+    second = "sha256:" + "b" * 64
+
+    def __init__(self, reference=None, move=False, malformed=None):
+        self.reference, self.move, self.malformed = reference, move, malformed
+        self.aliases = {reference: self.first} if reference else {}
+        self.tags = []
+
+    def dispatch(self, owner, endpoint, engine, arguments, deadline):
+        operation = arguments[4]
+        if operation == "ls":
+            reference = arguments[arguments.index("--filter") + 1].removeprefix("reference=")
+            if reference == self.reference and self.malformed is not None: return self.malformed
+            return (self.aliases[reference] + "\n").encode() if reference in self.aliases else b""
+        if operation == "inspect":
+            assert arguments[5] in self.aliases
+            return (self.aliases[arguments[5]] + "\n").encode()
+        assert operation == "tag"
+        immutable, alias = arguments[5:7]
+        assert immutable in (self.first, self.second)
+        self.tags.append((immutable, alias))
+        self.aliases[alias] = immutable
+        if self.move: self.aliases[self.reference] = self.second
+        return b""
+
+
+class ImagePerformanceControls(unittest.TestCase):
+    def test_should_retain_old_source_ids_across_a_later_fixture_tag_rebuild(self):
+        import image_performance_images as source
+        model = ImageCacheModel("rustack/lambda-runtime:integration-arm64")
+        with patch.object(source, "call", return_value=b"12345678-1234-4234-8234-123456789abc\n"), \
+             patch.object(source, "fenced", side_effect=model.dispatch):
+            result = source.retain_sources("/tmp/socket", "arm64", None, 100)
+        self.assertEqual(result["referenceCount"], 7)
+        self.assertEqual(len(result["preserved"]), 1)
+        row = result["preserved"][0]
+        self.assertEqual(row["id"], model.first)
+        self.assertEqual(model.tags, [(model.first, row["cacheAlias"])])
+        model.aliases[model.reference] = model.second
+        self.assertEqual(model.aliases[row["cacheAlias"]], model.first)
+
+    def test_should_reject_a_source_alias_move_and_preserve_only_the_captured_id(self):
+        import image_performance_images as source
+        model = ImageCacheModel("rustack/lambda-runtime:integration-arm64", move=True)
+        with patch.object(source, "call", return_value=b"12345678-1234-4234-8234-123456789abc\n"), \
+             patch.object(source, "fenced", side_effect=model.dispatch), self.assertRaises(ValueError):
+            source.retain_sources("/tmp/socket", "arm64", None, 100)
+        self.assertEqual(model.tags, [(model.first, source.cache_alias(model.first))])
+        self.assertEqual(model.aliases[source.cache_alias(model.first)], model.first)
+
+    def test_should_allow_initial_provisioning_but_reject_invalid_or_ambiguous_source_identity(self):
+        import image_performance_images as source
+        model = ImageCacheModel()
+        with patch.object(source, "call", return_value=b"12345678-1234-4234-8234-123456789abc\n"), \
+             patch.object(source, "fenced", side_effect=model.dispatch):
+            self.assertEqual(source.retain_sources("/tmp/socket", "arm64", None, 100)["preserved"], [])
+        self.assertEqual(model.tags, [])
+        for malformed in (b"invalid\n", (model.first + "\n" + model.second + "\n").encode()):
+            model = ImageCacheModel("rustack/lambda-runtime:integration-arm64", malformed=malformed)
+            with patch.object(source, "call", return_value=b"12345678-1234-4234-8234-123456789abc\n"), \
+                 patch.object(source, "fenced", side_effect=model.dispatch), self.assertRaises((ValueError, ActionError)):
+                source.retain_sources("/tmp/socket", "arm64", None, 100)
+            self.assertEqual(model.tags, [])
+        with patch.object(source, "call") as dispatched, self.assertRaises(ValueError):
+            source.retain_sources("/tmp/socket", "unrecognized", None, 100)
+        dispatched.assert_not_called()
+
+    def test_should_retain_sources_before_any_canonical_fixture_build(self):
+        lines = (Path(__file__).resolve().parents[2] / "Makefile").read_text().splitlines()
+        start = lines.index("lambda-docker-fixtures:")
+        self.assertEqual(lines[start + 1], "\t@$(MAKE) --no-print-directory -j1 workflows-retain-fixture-sources")
+        self.assertIn("lambda-runtime-image", lines[start + 2])
+
+    def test_should_propagate_the_original_barrier_failure_with_bounded_private_diagnostics(self):
+        import concurrent.futures
+        import contextlib
+        import io
+        import threading
+        from image_performance_sdk import observe_flood
+        from image_performance_support import MeasurementError
+        failure = MeasurementError("flood-observation-expired")
+        def waiting(rows, count): raise failure
+        collector = SimpleNamespace(condition=threading.Condition(), started={}, released=set(), ended={}, wait_for=waiting)
+        future = concurrent.futures.Future()
+        output = io.StringIO()
+        with contextlib.redirect_stderr(output), self.assertRaises(MeasurementError) as raised:
+            observe_flood(collector, {}, 94, "begin", future)
+        self.assertIs(raised.exception, failure)
+        report = json.loads(output.getvalue().split(" ", 1)[1])
+        self.assertEqual((report["phase"], report["expected"], report["outcome"]), ("begin", 94, "pending"))
+        self.assertGreaterEqual(report["elapsedMicros"], 0)
+        self.assertLess(len(output.getvalue()), 512)
+
+    def test_should_refuse_a_pair_lookup_that_outlives_the_live_observation(self):
+        import threading
+        from image_performance_sdk import release_flood
+        active, calls = [1], []
+        def ready(path="/_rustack/capabilities"):
+            calls.append("health" if path == "/_health/ready" else "capabilities")
+            return {"workers":{"lambdaAdmission":{"activeExecutions":active[0]}}}, 10
+        def pair():
+            calls.append("pair")
+            active[0] = 0
+            return {"same-container"}, "environment"
+        collector = SimpleNamespace(condition=threading.Condition(), released=set(), stamp=Mock())
+        with self.assertRaisesRegex(ValueError, "health-not-during"):
+            release_flood(collector, SimpleNamespace(done=lambda:False), "request", {"same-container"}, pair, ready)
+        self.assertEqual(calls, ["capabilities", "health", "pair", "capabilities"])
+        self.assertEqual(collector.released, set())
+
+    def test_should_recheck_completion_under_the_release_condition(self):
+        import threading
+        from image_performance_sdk import release_flood
+        collector = SimpleNamespace(condition=threading.Condition(), released=set(), stamp=Mock())
+        future = SimpleNamespace(done=Mock(side_effect=[False, True]))
+        ready = lambda *_args: ({"workers":{"lambdaAdmission":{"activeExecutions":1}}}, 10)
+        with self.assertRaisesRegex(ValueError, "completed-before-release"):
+            release_flood(collector, future, "request", {"container"}, lambda:({"container"}, "environment"), ready)
+        self.assertEqual(collector.released, set())
+        self.assertEqual(future.done.call_count, 2)
+        self.assertNotIn("released", [call.args[0] for call in collector.stamp.call_args_list])
+
+    def test_should_withdraw_release_if_the_future_finishes_during_flag_publication(self):
+        import concurrent.futures
+        import threading
+        from image_performance_sdk import release_flood
+        future = concurrent.futures.Future()
+        class FinishOnInsert(set):
+            def add(self, value):
+                super().add(value)
+                future.set_result(None)
+        condition = threading.Condition()
+        collector = SimpleNamespace(condition=condition, released=FinishOnInsert(), stamp=Mock())
+        ready = lambda *_args: ({"workers":{"lambdaAdmission":{"activeExecutions":1}}}, 10)
+        with patch.object(condition, "notify_all", wraps=condition.notify_all) as notify:
+            with self.assertRaisesRegex(ValueError, "completed-during-release"):
+                release_flood(collector, future, "request", {"container"}, lambda:({"container"}, "environment"), ready)
+            notify.assert_not_called()
+        self.assertEqual(collector.released, set())
+        stamps = [call.args[0] for call in collector.stamp.call_args_list]
+        self.assertEqual(stamps[-2:], ["releaseInserted", "releaseRejected"])
+        self.assertNotIn("released", stamps)
+
+    def test_should_release_only_after_current_pair_capability_and_completion_proofs(self):
+        import threading
+        from image_performance_sdk import release_flood
+        collector = SimpleNamespace(condition=threading.Condition(), released=set(), stamp=Mock())
+        future = SimpleNamespace(done=Mock(side_effect=[False, False, False]))
+        ready = lambda *_args: ({"workers":{"lambdaAdmission":{"activeExecutions":1}}}, 10)
+        before, after, health, completed = release_flood(collector, future, "request", {"container"},
+            lambda:({"container"}, "environment"), ready)
+        self.assertEqual((before, after), (ready()[0], ready()[0]))
+        self.assertEqual((health, completed, collector.released), (10, False, {"request"}))
+        self.assertEqual([call.args[0] for call in collector.stamp.call_args_list][-3:], ["releaseChecked", "releaseInserted", "released"])
+
+    def test_should_bound_timeline_fields_and_publish_only_fixed_current_cycle_timings(self):
+        import concurrent.futures
+        import threading
+        from image_performance_sdk import FloodTimeline, flood_failure
+        trace = FloodTimeline(89, 1000000)
+        trace.stamp("pairStarted", clock=lambda:1001000)
+        trace.stamp("pairFinished", clock=lambda:2100000)
+        for phase in ("pairStarted", "private-secret"):
+            with self.assertRaises(ValueError): trace.stamp(phase, clock=lambda:2200000)
+        with self.assertRaises(ValueError): trace.stamp("released", clock=lambda:999999)
+        collector = SimpleNamespace(condition=threading.Condition(), started={}, released=set(), ended={}, timeline=trace)
+        report = flood_failure(collector, "live", 89, concurrent.futures.Future())
+        self.assertEqual(report["cycle"], 89)
+        self.assertEqual(report["timingsMicros"], {"submitted":0, "pairStarted":1, "pairFinished":1100})
+        self.assertNotIn("private-secret", json.dumps(report))
+
+    def test_should_not_observe_or_accept_a_channel_after_its_original_cutoff(self):
+        import threading
+        from image_performance_sdk import wait_flood_channel
+        collector = SimpleNamespace(condition=threading.Condition(), aborted=False)
+        read = Mock(return_value=True)
+        with self.assertRaisesRegex(ValueError, "observation-expired"):
+            wait_flood_channel(collector, read, 10, clock=lambda:10)
+        read.assert_not_called()
+        with self.assertRaisesRegex(ValueError, "observation-expired"):
+            wait_flood_channel(collector, read, 10, clock=Mock(side_effect=[1, 10]))
+        read.assert_called_once()
+
+    def test_should_retain_fixed_flood_phase_counts_and_completed_invocation_outcome(self):
+        import concurrent.futures
+        import threading
+        from image_performance_sdk import flood_failure
+        collector = SimpleNamespace(condition=threading.Condition(), started={"secret": {}}, released=set(), ended={})
+        future = concurrent.futures.Future()
+        self.assertEqual(flood_failure(collector, "begin", 2, future),
+                         {"phase": "begin", "expected": 2, "begun": 1, "released": 0, "ended": 0, "outcome": "pending"})
+        class Failure(Exception):
+            response = {"Error": {"Code": "ServiceException", "Message": "function exited with status 1; secret"}}
+        future.set_exception(Failure("secret"))
+        result = flood_failure(collector, "end", 2, future)
+        self.assertEqual(result["phase"], "end")
+        self.assertEqual(result["outcome"], "function-exit")
+        self.assertNotIn("secret", json.dumps(result))
+        future = concurrent.futures.Future(); future.set_result(None)
+        self.assertEqual(flood_failure(collector, "begin", 1, future)["outcome"], "unexpected-success")
+
+    def test_should_anchor_imported_content_and_reject_conflicting_cache_aliases(self):
+        import image_performance_images as source
+        expected = {"id": "sha256:" + "a" * 64}
+        alias = "rustack-workflows-cache:d102-" + "a" * 64
+        for listing, expected_tags in ((b"", 1), ((expected["id"] + "\n").encode(), 0)):
+            tags = []
+            def dispatch(owner, endpoint, engine, arguments, deadline):
+                if arguments[4] == "ls": return listing
+                if arguments[4] == "inspect": return (expected["id"] + "\n").encode()
+                self.assertEqual(arguments[4], "tag")
+                tags.append(arguments[-3:])
+                return b""
+            with patch.object(source, "fenced", side_effect=dispatch), \
+                 patch.object(source, "image", return_value=expected):
+                self.assertEqual(source.anchor(None, "unix:///tmp/socket", expected, 100, "engine"), alias)
+                self.assertEqual(len(tags), expected_tags)
+                if expected_tags: self.assertEqual(tags, [["tag", expected["id"], alias]])
+        with patch.object(source, "fenced", return_value=("sha256:" + "b" * 64 + "\n").encode()) as dispatch, \
+             patch.object(source, "image") as inspect:
+            with self.assertRaises(ValueError): source.anchor(None, "unix:///tmp/socket", expected, 100, "engine")
+            self.assertEqual(dispatch.call_count, 1)
+            inspect.assert_not_called()
+
+    def test_should_include_the_initial_task_observation_and_reject_its_late_match(self):
+        now = [0]
+        def first():
+            now[0] += 1000000
+            return 15
+        self.assertEqual(wait_task_baseline(first, 15, 0, clock=lambda: now[0]), (1000, 15))
+        now[0] = 0
+        def late():
+            now[0] = 2000000000
+            return 15
+        with self.assertRaises(ValueError): wait_task_baseline(late, 15, 0, clock=lambda: now[0])
+        invoked = []
+        with self.assertRaises(ValueError):
+            wait_task_baseline(lambda: invoked.append(True), 15, 0, clock=lambda: 2000000000)
+        self.assertFalse(invoked)
+    def test_should_probe_the_actual_readiness_route_inside_the_live_bracket(self):
+        from image_performance_sdk import capability
+        class Connection:
+            path = None
+            status = 200
+            def request(self, method, path): self.path = path
+            def getresponse(self): return self
+            def read(self, limit): return b'{"ready":true,"services":{"lambda":"running","s3":"disabled"}}'
+        connection = Connection()
+        result, duration = capability("http://127.0.0.1:4566", connection, "/_health/ready")
+        self.assertEqual(connection.path, "/_health/ready")
+        self.assertTrue(result["ready"])
+        self.assertLess(duration, 2000000)
+
+    def test_should_bound_remaining_aggregate_budget_and_save_only_the_captured_id(self):
+        import image_performance_images as source
+        infinity = source.resource.RLIM_INFINITY
+        self.assertEqual(source.file_limit(infinity, infinity, 2 * source.LIMIT), source.LIMIT)
+        self.assertEqual(source.file_limit(4096, 8192, source.LIMIT), 4096)
+        self.assertEqual(source.file_limit(infinity, infinity, 2048), 2048)
+        for remaining in (0, True, 2 * source.LIMIT + 1):
+            with self.assertRaises(ValueError): source.file_limit(infinity, infinity, remaining)
+        immutable = "sha256:" + "a" * 64
+        with patch.object(source.shutil, "which", return_value="/usr/bin/docker"), \
+             patch.object(source.resource, "getrlimit", return_value=(infinity, infinity)), \
+             patch.object(source.resource, "setrlimit") as cap, patch.object(source.os, "execv") as execute:
+            source.save("/tmp/docker.sock", "/tmp/archive", immutable, "2048")
+            cap.assert_called_once_with(source.resource.RLIMIT_FSIZE, (2048, 2048))
+            self.assertEqual(execute.call_args.args[1][-1], immutable)
+            self.assertNotIn(source.SOURCES[0], execute.call_args.args[1])
+
+    def test_should_fence_each_effect_and_retain_uncertainty_without_retry(self):
+        import image_performance_images as source
+        class Owner:
+            def __init__(self, replies): self.replies, self.calls = iter(replies), []
+            def run(self, arguments, deadline):
+                self.calls.append(arguments)
+                return SimpleNamespace(code=0, stdout=next(self.replies), stderr=b"")
+        expected = "12345678-1234-4234-8234-123456789abc"
+        other = b"11111111-1111-4111-8111-111111111111\n"
+        before = Owner([other])
+        with self.assertRaises(ValueError): source.fenced(before, "unix:///tmp/docker.sock", expected, ["effect"], float("inf"))
+        self.assertEqual(len(before.calls), 1)
+        after = Owner([expected.encode() + b"\n", b"done", other])
+        with self.assertRaises(ValueError): source.fenced(after, "unix:///tmp/docker.sock", expected, ["effect"], float("inf"))
+        self.assertEqual(sum(arguments == ["effect"] for arguments in after.calls), 1)
+
+    def test_should_import_each_isolated_entrypoint_and_fail_closed_on_missing_arguments(self):
+        for name in ("image_performance_images.py", "linux_image_performance.py",
+                     "image_performance_report.py", "image_performance_sdk.py"):
+            result = subprocess.run([sys.executable, "-I", "-B", str(Path(__file__).with_name(name))],
+                                    stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=5)
+            with self.subTest(name=name):
+                self.assertEqual(result.returncode, 2)
+                self.assertNotIn(b"Traceback", result.stderr)
+                self.assertNotIn(b"ModuleNotFoundError", result.stderr)
+
+    def test_should_use_nearest_ranks_for_twenty_and_one_hundred_ordered_samples(self):
+        for count, expected in ((20, (10, 19, 20)), (100, (50, 95, 100))):
+            values = list(range(count, 0, -1))
+            result = samples(values, count)
+            self.assertEqual(result["observedMicros"], values)
+            self.assertEqual(tuple(result[key] for key in ("p50Micros", "p95Micros", "maxMicros")), expected)
+        for values, count in (([1] * 99, 100), ([1] * 21, 20), ([True] * 100, 100), ([1] * 10, 10)):
+            with self.assertRaises(ValueError):
+                samples(values, count)
+
+    def test_should_subtract_nanoseconds_before_rounding_and_reject_invalid_handler_clock(self):
+        self.assertEqual(overhead(1001, 999), 1)
+        self.assertEqual(overhead(2001, 1000), 2)
+        self.assertEqual(overhead(1000, 1000), 0)
+        for total, handler in ((1, 2), (0, 0), (1, True), (60000000001, 1)):
+            with self.assertRaises(ValueError):
+                overhead(total, handler)
+
+    def test_should_accept_actual_raw_warm_shape_and_reject_mutated_ranks_count_and_budget(self):
+        validate(warm(), "warm")
+        for change in ("count", "rank", "handler", "budget", "cleanup", "reference"):
+            value = warm()
+            if change == "count": value["measurement"]["totalNanos"].pop()
+            elif change == "rank": value["measurement"]["overhead"]["p95Micros"] += 1
+            elif change == "handler": value["measurement"]["handlerNanos"][0] = 60000000000
+            elif change == "cleanup": value["emptyAfterWorkload"] = False
+            elif change == "reference": value["referenceQualification"] = "qualified"
+            else:
+                value["measurement"]["totalNanos"] = [61000001] * 100
+                value["measurement"]["overhead"] = samples([51000] * 100, 100)
+            with self.subTest(change=change), self.assertRaises(ValueError):
+                validate(value, "warm")
+
+    def test_should_reject_boolean_rank_even_when_python_equality_would_match_one(self):
+        value = samples([1] * 100, 100)
+        value["p50Micros"] = True
+        with self.assertRaises(ValueError):
+            exact_samples(value, 100)
+        names = identities()
+        stages = cold_stages(logs(names).replace(b"=100", b"=1").replace(b"=200", b"=1"), names, [2] * 20)
+        stages["relay"]["p95Micros"] = True
+        with self.assertRaises(ValueError): verify_stages(stages, names, [2] * 20)
+
+    def test_should_affiliate_twenty_exact_cold_stages_by_identity_rather_than_line_order(self):
+        names = identities()
+        value = cold_stages(logs(list(reversed(names))), names, [301] * 20)
+        self.assertEqual(value["relay"]["observedMicros"], [100] * 20)
+        self.assertEqual(value["functionRic"]["observedMicros"], [200] * 20)
+        for raw in (logs(names[:-1]), logs(names + names[:1]), logs(identities()[1:] + [str(uuid.uuid4())]),
+                    logs(names).replace(b"ric_micros=200", b"ric_micros=400"),
+                    logs(names).replace(b"relay_micros=100", b"relay_micros=unknown"), b"x" * 32769):
+            with self.assertRaises(ValueError):
+                cold_stages(raw, names, [301] * 20)
+
+    def test_should_require_live_work_and_a_positive_unexhausted_flood_span(self):
+        flood = {"requestId": str(uuid.uuid4()), "beforeBytes": 1024, "afterBytes": 4096}
+        live(1, 1, 1999999, False, flood)
+        for before, after, ready, done in ((0, 1, 1, False), (1, 0, 1, False),
+                                         (1, 1, 2000000, False), (1, 1, 1, True), (True, 1, 1, False)):
+            with self.assertRaises(ValueError):
+                live(before, after, ready, done, flood)
+        for begin, end in ((0, 1), (1024, 1024), (4096, 1024), (1024, 1048576)):
+            with self.assertRaises(ValueError):
+                live(1, 1, 1, False, dict(flood, beforeBytes=begin, afterBytes=end))
+
+    def test_should_exclude_only_the_unchanged_complete_pre_sdk_log_prefix(self):
+        names = identities()
+        startup = logs([str(uuid.uuid4()), str(uuid.uuid4())]) + b"\n"
+        raw = startup + logs(names)
+        value = cold_stages(raw, names, [301] * 20, startup)
+        verify_stages(value, names, [301] * 20)
+        for baseline in (startup[:-1], b"different\n", raw):
+            with self.assertRaises(ValueError):
+                cold_stages(raw, names, [301] * 20, baseline)
+        changed = copy.deepcopy(value)
+        changed["events"][0]["environmentId"] = str(uuid.uuid4())
+        with self.assertRaises(ValueError): verify_stages(changed, names, [301] * 20)
+        changed = copy.deepcopy(value)
+        changed["relay"]["p95Micros"] += 1
+        with self.assertRaises(ValueError): verify_stages(changed, names, [301] * 20)
+
+    def test_should_reject_cycle_task_growth_nonlive_brackets_and_missing_priming(self):
+        value = warm()
+        value["phase"] = "cycles"
+        value["measurement"] = {"readiness": samples([100] * 100, 100), "timeout": samples([1200000] * 100, 100),
+            "floods": [{"requestId": str(uuid.uuid4()), "beforeBytes": 1024, "afterBytes": 4096} for _ in range(100)],
+            "processStats": [{"rssKiB": 10000, "tasks": 8, "runtimeTasks": 15} for _ in range(100)],
+            "completedCycles": 100, "containerHighWater": 2, "emptyAfterEachTimeout": True,
+            "runtimeTaskBaseline": 15, "taskQuiescence": samples([100] * 100, 100),
+            "liveBrackets": [[1, 1, False] for _ in range(100)], "primingInvocations": 1, "primingCleanupConfirmed": True,
+            "controlChannels": {"prepared":100,"readyBeforeInvoke":100,"sameConnection":100,"closed":100}}
+        validate(value, "cycles")
+        for mutation in ("growth", "bracket", "priming", "timeout-count", "quiescence", "request-reuse", "channel-count", "channel-shape"):
+            broken = copy.deepcopy(value)
+            measured = broken["measurement"]
+            if mutation == "growth": measured["processStats"][-1]["runtimeTasks"] = 16
+            elif mutation == "bracket": measured["liveBrackets"][0][2] = True
+            elif mutation == "priming": measured["primingCleanupConfirmed"] = False
+            elif mutation == "timeout-count": measured["timeout"]["observedMicros"].pop()
+            elif mutation == "request-reuse": measured["floods"][-1] = measured["floods"][0]
+            elif mutation == "channel-count": measured["controlChannels"]["sameConnection"] = 99
+            elif mutation == "channel-shape": measured["controlChannels"]["extra"] = 100
+            else: measured["taskQuiescence"] = samples([2000000] * 100, 100)
+            with self.subTest(mutation=mutation), self.assertRaises(ValueError):
+                validate(broken, "cycles")
+
+    def test_should_keep_existing_decoder_member_default_and_bound_measurement_expansion(self):
+        from metadata import document
+        raw = json.dumps(list(range(513))).encode()
+        with self.assertRaises(ActionError): document(raw)
+        self.assertEqual(decode(raw), list(range(513)))
+        for value in (b"[" * 9 + b"0" + b"]" * 9,
+                      json.dumps(list(range(4097))).encode(), b" " * 32769,
+                      b'{"x":1,"x":2}', b'{"x":NaN}'):
+            with self.assertRaises(ActionError): decode(value)
+        for limit in (True, 0, 4097):
+            with self.assertRaises(ActionError): document(b"{}", member_limit=limit)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_image_performance_channel.py b/tests/workflows/test_image_performance_channel.py
new file mode 100644
index 00000000..de370647
--- /dev/null
+++ b/tests/workflows/test_image_performance_channel.py
@@ -0,0 +1,99 @@
+"""Pure socket-identity and phase controls for initialization-owned flood channels."""
+import unittest
+import uuid
+
+from image_performance_channel import FloodChannel, FloodChannels
+
+
+class Socket:
+    def __init__(self, descriptor=7):
+        self.descriptor = descriptor
+
+    def fileno(self):
+        return self.descriptor
+
+
+class ChannelControls(unittest.TestCase):
+    def ready(self, channels, connection):
+        keep, written = channels.accept(connection, "/flood-ready", {"functionName":"Flood"})
+        self.assertTrue(keep)
+        self.assertEqual(channels.prepared, 0)
+        written()
+        self.assertEqual(channels.prepared, 1)
+        return channels.submit(1, channels.current.ready_ns + 1)
+
+    def test_should_require_written_ready_then_same_socket_begin_and_end_then_physical_close(self):
+        channels, connection, request = FloodChannels(), Socket(), str(uuid.uuid4())
+        channel = self.ready(channels, connection)
+        body = {"functionName":"Flood", "requestId":request}
+        keep, written = channels.accept(connection, "/flood-begin", body)
+        self.assertTrue(keep)
+        with self.assertRaises(ValueError): channels.accept(connection, "/flood-end", body)
+        written()
+        keep, written = channels.accept(connection, "/flood-end", body)
+        self.assertFalse(keep)
+        with self.assertRaises(ValueError): channels.finish(channel, request)
+        written()
+        with self.assertRaises(ValueError): channels.finish(channel, request)
+        connection.descriptor = -1
+        channels.finish(channel, request)
+        self.assertEqual((channels.prepared, channels.ready_before_invoke, channels.same_connection, channels.closed), (1,1,1,1))
+        with self.assertRaises(ValueError): channels.finish(channel, request)
+
+    def test_should_reject_reconnected_objects_even_when_the_descriptor_is_reused(self):
+        channels, connection = FloodChannels(), Socket()
+        self.ready(channels, connection)
+        event = {"functionName":"Flood", "requestId":str(uuid.uuid4())}
+        with self.assertRaisesRegex(ValueError, "replaced"):
+            channels.accept(Socket(connection.fileno()), "/flood-begin", event)
+        with self.assertRaises(ValueError):
+            channels.accept(Socket(), "/flood-ready", {"functionName":"Flood"})
+        connection.descriptor = -1
+        with self.assertRaisesRegex(ValueError, "replaced"):
+            channels.accept(connection, "/flood-begin", event)
+
+    def test_should_reject_unwritten_ready_replayed_submission_and_wrong_identity(self):
+        channels, connection = FloodChannels(), Socket()
+        _, written = channels.accept(connection, "/flood-ready", {"functionName":"Flood"})
+        with self.assertRaises(ValueError): channels.submit(1, 100)
+        written()
+        when = channels.current.ready_ns + 1
+        channel = channels.submit(1, when)
+        with self.assertRaises(ValueError): channels.submit(1, when + 1)
+        with self.assertRaises(ValueError):
+            channels.accept(connection, "/flood-begin", {"functionName":"Other", "requestId":str(uuid.uuid4())})
+        request = str(uuid.uuid4())
+        _, written = channels.accept(connection, "/flood-begin", {"functionName":"Flood", "requestId":request})
+        written()
+        with self.assertRaises(ValueError):
+            channels.accept(connection, "/flood-end", {"functionName":"Flood", "requestId":str(uuid.uuid4())})
+        self.assertEqual(channel.phase, "begin")
+
+    def test_should_bound_identifiers_phase_replies_and_incomplete_summary(self):
+        for name in ("", "x" * 65, "a/b", "雪"):
+            with self.assertRaises(ValueError): FloodChannel(Socket(), name, 1)
+        channel = FloodChannel(Socket(), "Flood", 1)
+        with self.assertRaises(ValueError): channel.written("/flood-ready")
+        with self.assertRaises(ValueError):
+            channel.accept(channel.connection, "/flood-ready", {"functionName":"Flood", "extra":True})
+        channels = FloodChannels()
+        with self.assertRaises(ValueError): channels.summary()
+
+    def test_should_count_exactly_one_hundred_distinct_closed_channels_without_replay(self):
+        channels = FloodChannels()
+        for cycle in range(1, 101):
+            connection, request = Socket(), str(uuid.uuid4())
+            _, written = channels.accept(connection, "/flood-ready", {"functionName":"Flood"})
+            written()
+            channel = channels.submit(cycle, channels.current.ready_ns + 1)
+            for phase in ("begin", "end"):
+                _, written = channels.accept(connection, "/flood-" + phase, {"functionName":"Flood", "requestId":request})
+                written()
+            connection.descriptor = -1
+            channels.finish(channel, request)
+        self.assertEqual(channels.summary(), {"prepared":100,"readyBeforeInvoke":100,"sameConnection":100,"closed":100})
+        with self.assertRaises(ValueError): channels.accept(Socket(), "/flood-ready", {"functionName":"Flood"})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_lambda_admission.py b/tests/workflows/test_lambda_admission.py
new file mode 100644
index 00000000..fbf0943a
--- /dev/null
+++ b/tests/workflows/test_lambda_admission.py
@@ -0,0 +1,92 @@
+"""Causal per-target release and finite, unique asynchronous completion evidence."""
+import concurrent.futures
+import json
+import time
+from types import SimpleNamespace
+import unittest
+import uuid
+from unittest.mock import Mock, patch
+
+from custom_ric_sdk import collecting
+from lambda_admission_sdk import QuotaHold, wait_work
+
+
+def held(name):
+    return {"stage":"busy", "functionName":name, "pid":1, "requestId":str(uuid.uuid4())}
+
+
+def completed(ticket):
+    return {"ticket":ticket, "functionName":"A", "requestId":str(uuid.uuid4()), "computed":15, "counter":1}
+
+
+class AdmissionControls(unittest.TestCase):
+    def test_should_reject_lower_actual_counts_even_when_reported_limits_match(self):
+        for accepted, active, expected in [(8,1,8), (32,8,32), (7,8,8), (0,24,0)]:
+            with self.subTest(accepted=accepted, active=active, expected=expected):
+                response = Mock(status=200)
+                response.read.return_value = json.dumps({"workers":{"lambdaAdmission":{
+                    "acceptedInvocations":accepted,"activeExecutions":active,"accepting":True,
+                    "limits":{"acceptedInvocations":128,"activeExecutions":32,"defaultFunctionExecutions":8}}}}).encode()
+                connection = Mock()
+                connection.getresponse.return_value = response
+                with patch("lambda_admission_sdk.http.client.HTTPConnection", return_value=connection), \
+                     patch("lambda_admission_sdk.time.monotonic", side_effect=[0,0,2]), \
+                     patch("lambda_admission_sdk.time.sleep"), \
+                     self.assertRaisesRegex(AssertionError, "ownership never reached"):
+                    wait_work(SimpleNamespace(endpoint="http://127.0.0.1:9999"), expected, expected, 1)
+                connection.close.assert_called_once()
+
+    def test_should_release_only_the_observed_target_and_join_the_aborted_peer(self):
+        with collecting(QuotaHold) as hold:
+            hold.targets(["A", "B"])
+            pool = concurrent.futures.ThreadPoolExecutor(max_workers=2)
+            try:
+                a = pool.submit(hold.exchange, "/hold", held("A"))
+                b = pool.submit(hold.exchange, "/hold", held("B"))
+                hold.wait_seen(2, time.monotonic() + 2)
+                with self.assertRaises(AssertionError):
+                    hold.release_target("Unknown")
+                self.assertEqual(hold.released_targets, set())
+                hold.release_target("A")
+                self.assertEqual(a.result(2), {"release":True})
+                self.assertFalse(b.done())
+                with self.assertRaises(AssertionError):
+                    hold.release_target("A")
+                hold.abort()
+                with self.assertRaises(AssertionError):
+                    b.result(2)
+            finally:
+                hold.abort()
+                pool.shutdown(wait=True)
+
+    def test_should_refuse_expired_release_without_mutation(self):
+        with collecting(QuotaHold) as hold:
+            hold.targets(["A"])
+            hold.observed["A"] = held("A")
+            hold.deadline = time.monotonic() - 1
+            with self.assertRaises(AssertionError):
+                hold.release_target("A")
+            self.assertEqual(hold.released_targets, set())
+
+    def test_should_require_unique_expected_actual_computations_before_ready(self):
+        with collecting(QuotaHold) as hold:
+            hold.targets(["A"])
+            hold.expect_tickets(2)
+            first = completed(0)
+            self.assertEqual(hold.exchange("/completed", first), {"recorded":True})
+            invalid = [dict(first), dict(completed(1), requestId=first["requestId"]),
+                       dict(completed(1), computed=0), dict(completed(1), counter=0),
+                       dict(completed(1), functionName="Unknown"), dict(completed(1), ticket=True),
+                       dict(completed(1), ticket=2)]
+            for row in invalid:
+                with self.subTest(row=row), self.assertRaises(AssertionError):
+                    hold.exchange("/completed", row)
+                self.assertEqual(hold.completed, {0:first})
+            hold.exchange("/completed", completed(1))
+            self.assertEqual(set(hold.wait_completed(time.monotonic() + 2)), {0,1})
+            with self.assertRaises(AssertionError):
+                hold.wait_completed(time.monotonic() - 1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_lambda_faults.py b/tests/workflows/test_lambda_faults.py
new file mode 100644
index 00000000..b642d0e9
--- /dev/null
+++ b/tests/workflows/test_lambda_faults.py
@@ -0,0 +1,394 @@
+"""Controls that prevent cancellation/metadata observations from passing vacuously."""
+import concurrent.futures
+import contextlib
+import json
+from http.client import HTTPException
+import socketserver
+import tempfile
+import threading
+import time
+import unittest
+import uuid
+from unittest.mock import Mock, patch
+
+from botocore.exceptions import ClientError
+from custom_ric_sdk import collecting
+from lambda_fault_support import Hold, Metadata, recover_before
+
+
+@contextlib.contextmanager
+def engine_fixture(engine, rows, change=False, close_inventory=False):
+    with tempfile.TemporaryDirectory(prefix="rustack-fault-", dir="/tmp") as root:
+        path = root + "/engine.sock"
+        calls = []
+        infos = []
+        class Handler(socketserver.StreamRequestHandler):
+            def handle(self):
+                self.connection.settimeout(2)
+                try:
+                    for _ in range(4):
+                        line = self.rfile.readline(4097)
+                        if not line:
+                            return
+                        assert len(line) <= 4096
+                        method, target, _version = line.decode().split()
+                        assert method == "GET"
+                        used = len(line)
+                        while True:
+                            header = self.rfile.readline(4097)
+                            used += len(header)
+                            assert header and used <= 4096
+                            if header == b"\r\n":
+                                break
+                        calls.append(target)
+                        if target == "/version":
+                            body = {"ApiVersion":"1.53", "MinAPIVersion":"1.44"}
+                        elif target.endswith("/info"):
+                            infos.append(target)
+                            body = {"ID":str(uuid.uuid4()) if change and len(infos) > 1 else engine}
+                        else:
+                            assert target.startswith("/v1.53/containers/json?")
+                            body = rows
+                        raw = json.dumps(body).encode()
+                        self.wfile.write(b"HTTP/1.1 200 OK\r\nContent-Length: " + str(len(raw)).encode() + b"\r\n\r\n" + raw)
+                        self.wfile.flush()
+                        if close_inventory and "/containers/" in target:
+                            return
+                except (OSError, AssertionError):
+                    return
+        with socketserver.UnixStreamServer(path, Handler) as server:
+            worker = threading.Thread(target=server.serve_forever, kwargs={"poll_interval":0.01})
+            worker.start()
+            try:
+                yield path, calls
+            finally:
+                server.shutdown()
+                worker.join(3)
+                assert not worker.is_alive()
+
+
+class FaultControls(unittest.TestCase):
+    def test_should_refuse_recovery_after_deadline_before_any_invocation(self):
+        invoke = Mock()
+        with self.assertRaisesRegex(AssertionError, "before invocation"):
+            recover_before(5, invoke, Mock(), clock=lambda: 5)
+        invoke.assert_not_called()
+
+    def test_should_refuse_first_attempt_success_after_deadline(self):
+        invoke = Mock(return_value="late")
+        with self.assertRaisesRegex(AssertionError, "succeeded after"):
+            recover_before(5, invoke, Mock(), clock=Mock(side_effect=[1, 5]))
+        invoke.assert_called_once_with(4)
+
+    def test_should_accept_timely_recovery_only_after_allocation_free_throttle(self):
+        throttle = ClientError({"Error":{"Code":"TooManyRequestsException"}}, "Invoke")
+        invoke, empty, pause = Mock(side_effect=[throttle, "ready"]), Mock(return_value=True), Mock()
+        self.assertEqual(recover_before(5, invoke, empty,
+                         clock=Mock(side_effect=[1, 2, 2, 3, 4]), pause=pause), "ready")
+        self.assertEqual(invoke.call_args_list[0].args, (4,))
+        self.assertEqual(invoke.call_args_list[1].args, (2,))
+        empty.assert_called_once()
+        pause.assert_called_once_with(0.025)
+
+    def test_should_propagate_non_throttle_recovery_error(self):
+        failure = ClientError({"Error":{"Code":"ServiceException"}}, "Invoke")
+        empty = Mock()
+        with self.assertRaises(ClientError) as observed:
+            recover_before(5, Mock(side_effect=failure), empty, clock=lambda: 1)
+        self.assertIs(observed.exception, failure)
+        empty.assert_not_called()
+
+    def test_should_require_causal_stage_and_explicit_release(self):
+        with collecting(lambda: Hold("busy")) as hold:
+            hold.targets(["HeldFunction"])
+            event = {"stage":"busy", "functionName":"HeldFunction", "pid":1, "requestId":str(uuid.uuid4())}
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                result = pool.submit(hold.exchange, "/hold", event)
+                observed = hold.wait_seen(1, time.monotonic() + 2)
+                self.assertEqual(observed, {"HeldFunction":event})
+                self.assertFalse(result.done())
+                with hold.condition:
+                    hold.released = True
+                    hold.condition.notify_all()
+                self.assertEqual(result.result(2), {"release":True})
+
+    def test_should_refuse_expired_or_wrong_initialization_evidence_without_mutation(self):
+        hold = Hold("initializing")
+        try:
+            hold.targets(["HeldFunction"])
+            event = {"stage":"initializing", "functionName":"HeldFunction", "pid":1, "requestId":str(uuid.uuid4())}
+            with self.assertRaises(AssertionError):
+                hold.exchange("/hold", event)
+            self.assertEqual(hold.observed, {})
+            event["requestId"] = None
+            hold.deadline = time.monotonic() - 1
+            with self.assertRaises(AssertionError):
+                hold.exchange("/hold", event)
+            with self.assertRaises(AssertionError):
+                hold.wait_seen(0, time.monotonic() + 2)
+            self.assertEqual(hold.observed, {})
+        finally:
+            hold.server_close()
+
+    def test_should_refuse_wrong_daemon_before_interpreting_an_empty_inventory(self):
+        expected, wrong, owner = (str(uuid.uuid4()) for _ in range(3))
+        with engine_fixture(wrong, []) as (path, calls):
+            metadata = Metadata(path, owner, expected)
+            with self.assertRaises(AssertionError):
+                metadata.ids()
+            self.assertFalse(any("/containers/" in target for target in calls))
+
+    def test_should_refuse_daemon_change_on_subsequent_observation(self):
+        engine, owner = str(uuid.uuid4()), str(uuid.uuid4())
+        with engine_fixture(engine, [], change=True) as (path, calls):
+            metadata = Metadata(path, owner, engine)
+            self.assertEqual(metadata.ids(), set())
+            with self.assertRaises(AssertionError):
+                metadata.ids()
+            self.assertEqual(sum("/containers/" in target for target in calls), 1)
+
+    def test_should_refuse_foreign_container_in_a_scoped_inventory(self):
+        engine, owner = str(uuid.uuid4()), str(uuid.uuid4())
+        row = {"Id":"a"*64, "Labels":{"rustack.lambda.ownerId":str(uuid.uuid4())}}
+        with engine_fixture(engine, [row]) as (path, _calls):
+            metadata = Metadata(path, owner, engine)
+            with self.assertRaises(AssertionError):
+                metadata.ids()
+
+    def test_should_refuse_foreign_private_image_before_forwarding_its_inspection(self):
+        engine, owner, foreign = (str(uuid.uuid4()) for _ in range(3))
+        with engine_fixture(engine, []) as (path, calls):
+            metadata = Metadata(path, owner, engine)
+            alias = "rustack-internal/lambda-" + uuid.UUID(foreign).hex + "/" + uuid.uuid4().hex + ":" + uuid.uuid4().hex
+            with self.assertRaises(AssertionError):
+                metadata.image_id(alias)
+            self.assertFalse(any("/images/" in target for target in calls))
+
+    def test_should_bound_metadata_body_before_materializing_json(self):
+        engine, owner = str(uuid.uuid4()), str(uuid.uuid4())
+        with engine_fixture(engine, "x"*(1024*1024+1)) as (path, _calls):
+            metadata = Metadata(path, owner, engine)
+            with self.assertRaises(AssertionError):
+                metadata.ids()
+
+    def test_should_pin_one_verified_peer_and_resume_per_operation_fencing(self):
+        engine, owner = str(uuid.uuid4()), str(uuid.uuid4())
+        with engine_fixture(engine, []) as (path, calls):
+            metadata = Metadata(path, owner, engine)
+            with metadata.pinned():
+                self.assertEqual(metadata.ids(), set())
+                self.assertEqual(metadata.ids(), set())
+                with self.assertRaisesRegex(AssertionError, "nested"):
+                    with metadata.pinned():
+                        self.fail("nested pin admitted")
+                with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                    with self.assertRaisesRegex(AssertionError, "concurrent"):
+                        pool.submit(metadata.ids).result(2)
+                self.assertEqual(sum(target.endswith("/info") for target in calls), 1)
+            self.assertEqual(metadata.ids(), set())
+            self.assertEqual(sum(target.endswith("/info") for target in calls), 2)
+
+    def test_should_reject_closed_peer_without_reconnecting(self):
+        engine, owner = str(uuid.uuid4()), str(uuid.uuid4())
+        with engine_fixture(engine, [], close_inventory=True) as (path, calls):
+            metadata = Metadata(path, owner, engine)
+            with metadata.pinned():
+                self.assertEqual(metadata.ids(), set())
+                with self.assertRaises((OSError, AssertionError, HTTPException)):
+                    metadata.ids()
+            self.assertEqual(sum(target.endswith("/info") for target in calls), 1)
+            self.assertEqual(sum("/containers/" in target for target in calls), 1)
+            self.assertIsNone(metadata._pinned)
+
+    def test_should_reject_socket_replacement_and_close_the_retained_peer(self):
+        engine, owner = str(uuid.uuid4()), str(uuid.uuid4())
+        with engine_fixture(engine, []) as (path, _calls):
+            metadata = Metadata(path, owner, engine)
+            with metadata.pinned():
+                connection, peer = metadata._pinned
+                replacement = Mock()
+                def replace(_connection, _path):
+                    connection.sock = replacement
+                    return []
+                with patch.object(Metadata, "read", side_effect=replace):
+                    with self.assertRaisesRegex(AssertionError, "replaced"):
+                        metadata.ids()
+                self.assertEqual(peer.fileno(), -1)
+            replacement.close.assert_called_once()
+
+    def test_should_close_a_pin_when_workload_fails_and_refuse_wrong_engine(self):
+        engine, owner = str(uuid.uuid4()), str(uuid.uuid4())
+        with engine_fixture(engine, []) as (path, calls):
+            metadata = Metadata(path, owner, engine)
+            with self.assertRaisesRegex(ValueError, "workload"):
+                with metadata.pinned():
+                    peer = metadata._pinned[1]
+                    raise ValueError("workload")
+            self.assertEqual(peer.fileno(), -1)
+            self.assertIsNone(metadata._pinned)
+            wrong = Metadata(path, owner, str(uuid.uuid4()))
+            with self.assertRaisesRegex(AssertionError, "daemon changed"):
+                with wrong.pinned():
+                    self.fail("wrong engine admitted")
+            self.assertIsNone(wrong._pinned)
+            self.assertFalse(any("/containers/" in target for target in calls))
+
+    def test_should_observe_authenticated_collector_acceptance_and_response_write_with_bound_context(self):
+        import http.client
+        from custom_ric_sdk import Collector
+        marker = object()
+        class Observed(Collector):
+            def __init__(self):
+                super().__init__()
+                self.observed = []
+            def observe_transport(self, path, phase, context=None):
+                with self.condition:
+                    if phase == "written":
+                        assert context is marker
+                    self.observed.append((path, phase))
+                    self.condition.notify_all()
+                    return marker
+            def exchange(self, path, event):
+                assert path == "/flood-begin" and event == {}
+                return {"release":True}
+        with collecting(Observed) as server:
+            connection = http.client.HTTPConnection("127.0.0.1", server.server_port, timeout=2)
+            try:
+                connection.request("POST", "/flood-begin", body=b"{}", headers={"x-fixture-token":server.token})
+                response = connection.getresponse()
+                self.assertEqual(response.status, 200)
+                self.assertEqual(json.loads(response.read()), {"release":True})
+                deadline = time.monotonic() + 2
+                with server.condition:
+                    while len(server.observed) < 2:
+                        remaining = deadline - time.monotonic()
+                        self.assertGreater(remaining, 0)
+                        server.condition.wait(remaining)
+                self.assertEqual(server.observed, [("/flood-begin", "accepted"), ("/flood-begin", "written")])
+            finally:
+                connection.close()
+        with collecting(Observed) as server:
+            connection = http.client.HTTPConnection("127.0.0.1", server.server_port, timeout=2)
+            try:
+                connection.request("POST", "/flood-begin", body=b"{}", headers={"x-fixture-token":"wrong"})
+                response = connection.getresponse()
+                self.assertEqual(response.status, 400)
+                self.assertEqual(response.read(), b"{}")
+                self.assertEqual(server.observed, [])
+            finally:
+                connection.close()
+
+    def test_should_use_exactly_one_authenticated_http_channel_and_reject_reconnection(self):
+        import http.client
+        from custom_ric_sdk import Collector
+        from image_performance_channel import FloodChannels
+        from image_performance_sdk import wait_flood_channel
+        class ChannelCollector(Collector):
+            def __init__(self, held=False):
+                super().__init__()
+                self.channels = FloodChannels()
+                self.ready_entered, self.close_entered = threading.Event(), threading.Event()
+                self.release_ready, self.release_close = threading.Event(), threading.Event()
+                if not held:
+                    self.release_ready.set()
+                    self.release_close.set()
+            def transport_policy(self, connection, path, event):
+                with self.condition:
+                    keep, complete = self.channels.accept(connection, path, event)
+                def written():
+                    if path == "/flood-ready":
+                        self.ready_entered.set()
+                        assert self.release_ready.wait(2)
+                    with self.condition:
+                        complete()
+                        self.condition.notify_all()
+                return keep, written
+            def shutdown_request(self, request):
+                self.close_entered.set()
+                assert self.release_close.wait(2)
+                super().shutdown_request(request)
+            def exchange(self, path, event):
+                return {"ready":True} if path == "/flood-ready" else {"recorded":True}
+        def post(connection, server, phase, body):
+            connection.request("POST", "/flood-" + phase, body=json.dumps(body).encode(),
+                               headers={"x-fixture-token":server.token})
+            response = connection.getresponse()
+            response.read()
+            return response
+        def wait(server, accepted):
+            deadline = time.monotonic() + 2
+            with server.condition:
+                while not accepted():
+                    remaining = deadline - time.monotonic()
+                    self.assertGreater(remaining, 0)
+                    server.condition.wait(min(0.01, remaining))
+        with collecting(lambda:ChannelCollector(held=True)) as server:
+            connection = http.client.HTTPConnection("127.0.0.1", server.server_port, timeout=2)
+            try:
+                with concurrent.futures.ThreadPoolExecutor(max_workers=1) as observations:
+                    initialization_cutoff = time.monotonic_ns() + 2000000000
+                    response = post(connection, server, "ready", {"functionName":"Flood"})
+                    self.assertEqual((response.status, response.getheader("Connection")), (200, "keep-alive"))
+                    peer = connection.sock
+                    self.assertTrue(server.ready_entered.wait(2))
+                    self.assertEqual(server.channels.current.phase, "readyReply")
+                    entered = threading.Event()
+                    def prepared():
+                        entered.set()
+                        return server.channels.ready(1)
+                    waiter = observations.submit(wait_flood_channel, server, prepared, initialization_cutoff)
+                    self.assertTrue(entered.wait(2))
+                    self.assertFalse(waiter.done())
+                    server.release_ready.set()
+                    waiter.result(2)
+                    with server.condition:
+                        channel = server.channels.submit(1, time.monotonic_ns())
+                    request = str(uuid.uuid4())
+                    response = post(connection, server, "begin", {"functionName":"Flood", "requestId":request})
+                    self.assertEqual(response.status, 200)
+                    self.assertIs(connection.sock, peer)
+                    closure_cutoff = time.monotonic_ns() + 2000000000
+                    response = post(connection, server, "end", {"functionName":"Flood", "requestId":request})
+                    self.assertEqual((response.status, response.getheader("Connection")), (200, "close"))
+                    self.assertIsNone(connection.sock)
+                    self.assertTrue(server.close_entered.wait(2))
+                    self.assertGreaterEqual(channel.connection.fileno(), 0)
+                    entered = threading.Event()
+                    def closed():
+                        entered.set()
+                        return channel.phase == "complete" and channel.connection.fileno() < 0
+                    waiter = observations.submit(wait_flood_channel, server, closed, closure_cutoff)
+                    self.assertTrue(entered.wait(2))
+                    self.assertFalse(waiter.done())
+                    server.release_close.set()
+                    waiter.result(2)
+                    with server.condition:
+                        server.channels.finish(channel, request)
+                    self.assertEqual(server.channels.same_connection, 1)
+            finally:
+                server.release_ready.set()
+                server.release_close.set()
+                connection.close()
+        with collecting(ChannelCollector) as server:
+            first = http.client.HTTPConnection("127.0.0.1", server.server_port, timeout=2)
+            replacement = http.client.HTTPConnection("127.0.0.1", server.server_port, timeout=2)
+            try:
+                self.assertEqual(post(first, server, "ready", {"functionName":"Flood"}).status, 200)
+                wait(server, lambda:server.channels.prepared == 1)
+                with server.condition:
+                    server.channels.submit(1, time.monotonic_ns())
+                response = post(replacement, server, "begin", {"functionName":"Flood", "requestId":str(uuid.uuid4())})
+                self.assertEqual((response.status, response.getheader("Connection")), (400, "close"))
+                self.assertEqual(server.channels.current.phase, "ready")
+                self.assertEqual(server.channels.same_connection, 0)
+            finally:
+                first.close()
+                replacement.close()
+
+    def test_should_reject_nil_identity_before_opening_a_socket(self):
+        with self.assertRaises(AssertionError):
+            Metadata("/not-an-existing-socket", str(uuid.UUID(int=0)), str(uuid.uuid4()))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_linux_performance.py b/tests/workflows/test_linux_performance.py
new file mode 100644
index 00000000..054ba188
--- /dev/null
+++ b/tests/workflows/test_linux_performance.py
@@ -0,0 +1,279 @@
+"""Literal independent controls for Linux artifact, workload and cutoff evidence."""
+import copy
+import json
+import os
+from pathlib import Path
+import signal
+import struct
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from unittest.mock import patch
+
+import linux_performance as subject
+
+
+def sample():
+    return {"count": 100, "observedMicros": list(range(100, 0, -1)),
+            "p50Micros": 50, "p95Micros": 95, "maxMicros": 100}
+
+
+def report(kind="pureLatency"):
+    measured = {"kind": "pureLatency", "stateCount": 50, "inputBytes": 1024,
+                "executions": 100, "budgetMicros": 100000, "latency": sample()}
+    if kind == "loopResponsiveness":
+        measured = {"kind": kind, "openExecutionSlots": 1, "completedCycles": 100,
+                    "inputBytes": 1024, "historyEventHighWater": 1000,
+                    "exhaustion": {"probeCount": 10, "liveProbeCount": 9, "maxReadinessMicros": 100},
+                    "readiness": sample(), "stop": sample()}
+    return {"schemaVersion": 1, "host": {"os": "linux", "architecture": "aarch64",
+            "availableLogicalCpus": 4, "debugAssertions": True, "referenceQualification": "pending"},
+            "limits": {"openExecutions": 1, "transitions": 1000000, "historyEvents": 25000,
+                       "historyBytes": 33554432, "totalHistoryBytes": 134217728},
+            "nativeProcessesObserved": 0, "serverJoined": True, "measurement": measured}
+
+
+def output(value, inline=False):
+    prefix = "test performance::case ... " if inline else ""
+    return (prefix + "WORKFLOWS_PERFORMANCE " + json.dumps(value) + "\n"
+            "test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 7 filtered out; finished in 1.00s\n").encode()
+
+
+def cargo_records():
+    base = "/tmp/target/aarch64-unknown-linux-gnu/debug/"
+    return [{"reason": "compiler-artifact", "target": {"name": "rustack", "kind": ["bin"]},
+             "profile": {"test": False}, "executable": base + "rustack"},
+            {"reason": "compiler-artifact", "target": {"name": "workflows_sdk", "kind": ["test"]},
+             "profile": {"test": True}, "executable": base + "deps/workflows_sdk-0123456789abcdef"},
+            {"reason": "build-finished", "success": True}]
+
+
+def cargo_stream(records):
+    return b"\n".join(json.dumps(row).encode() for row in records)
+
+
+class LinuxPerformanceControls(unittest.TestCase):
+    def test_should_accept_literal_workloads_and_inline_rust_output(self):
+        for kind in ("pureLatency", "loopResponsiveness"):
+            for inline in (False, True):
+                value = report(kind)
+                self.assertEqual(subject.measurement(output(value, inline), kind), value)
+
+    def test_should_reject_zero_test_success_duplicate_or_wrong_reports(self):
+        raw = output(report())
+        for changed in (raw.replace(b"1 passed", b"0 passed"),
+                        raw.replace(b"0 ignored", b"1 ignored"),
+                        raw + raw.splitlines()[0] + b"\n", raw.splitlines()[-1],
+                        raw.replace(b"pureLatency", b"loopResponsiveness"),
+                        raw.replace(b'"schemaVersion": 1', b'"schemaVersion": 1,"schemaVersion": 1')):
+            with self.assertRaises(ValueError):
+                subject.measurement(changed, "pureLatency")
+
+    def test_should_reject_platform_limits_cleanup_and_reference_claim_mutations(self):
+        for section, key, value in (("host", "os", "macos"), ("host", "architecture", "x86_64"),
+                ("host", "availableLogicalCpus", 8), ("host", "debugAssertions", False),
+                ("host", "referenceQualification", "qualified"), ("limits", "historyBytes", 1),
+                (None, "nativeProcessesObserved", 1), (None, "serverJoined", False),
+                (None, "schemaVersion", True)):
+            changed = report()
+            (changed[section] if section else changed)[key] = value
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.measurement(output(changed), "pureLatency")
+
+    def test_should_recompute_ranks_and_enforce_budget_without_losing_order(self):
+        for key, value in (("count", 99), ("p95Micros", 96), ("observedMicros", [1] * 99),
+                           ("observedMicros", [True] * 100), ("maxMicros", 99)):
+            changed = report()
+            changed["measurement"]["latency"][key] = value
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.measurement(output(changed), "pureLatency")
+        changed = report()
+        changed["measurement"]["latency"] = {"count": 100, "observedMicros": [100001] * 100,
+                                             "p50Micros": 100001, "p95Micros": 100001, "maxMicros": 100001}
+        with self.assertRaisesRegex(ValueError, "latency-budget"):
+            subject.measurement(output(changed), "pureLatency")
+
+    def test_should_reject_nonlive_exhaustion_and_two_second_health_results(self):
+        original = report("loopResponsiveness")
+        for key, value in (("liveProbeCount", 0), ("liveProbeCount", 11),
+                           ("probeCount", True), ("maxReadinessMicros", 2000000)):
+            changed = copy.deepcopy(original)
+            changed["measurement"]["exhaustion"][key] = value
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.measurement(output(changed), "loopResponsiveness")
+
+    def test_should_require_exact_complete_unique_inventory(self):
+        names = subject.CASES + subject.CONTROLS
+        raw = ("\n".join(name + ": test" for name in names) + "\n").encode()
+        subject.inventory(raw)
+        for changed in (raw.replace(names[0].encode(), b"unknown"), raw + raw,
+                        raw.replace(names[0].encode(), names[1].encode()), raw[:-1] + b"extra"):
+            with self.assertRaises(ValueError):
+                subject.inventory(changed)
+
+    def test_should_bind_one_test_and_its_actual_sibling_server_artifact(self):
+        records = cargo_records()
+        test, server = subject.artifact(cargo_stream(records))
+        self.assertEqual(test.parent.parent / "rustack", server)
+        mutations = [records[:-1], [*records[:-1], records[1], records[-1]], records[1:]]
+        for change in ("target", "test", "path", "success"):
+            changed = copy.deepcopy(records)
+            if change == "target":
+                changed[1]["target"]["kind"] = ["bin"]
+            elif change == "test":
+                changed[1]["profile"]["test"] = False
+            elif change == "path":
+                changed[1]["executable"] = str(test).replace("aarch64", "x86_64")
+            else:
+                changed[-1]["success"] = False
+            mutations.append(changed)
+        for changed in mutations:
+            with self.assertRaises(ValueError):
+                subject.artifact(cargo_stream(changed))
+
+    def test_should_bound_cargo_record_count_before_decoding(self):
+        records = [{"reason": "build-script-executed"}] * 4093 + cargo_records()
+        subject.artifact(cargo_stream(records))
+        with patch.object(subject, "document", side_effect=AssertionError("decoded before admission")):
+            with self.assertRaisesRegex(ValueError, "cargo-record-budget"):
+                subject.artifact(b"{}\n" * 4097)
+
+    def test_should_select_only_an_explicit_allowlisted_linux_test_target(self):
+        records = cargo_records()
+        records[1]["target"]["name"] = "docker_startup"
+        records[1]["executable"] = records[1]["executable"].replace("workflows_sdk", "docker_startup")
+        selected, _ = subject.artifact(cargo_stream(records), "docker_startup")
+        self.assertTrue(selected.name.startswith("docker_startup-"))
+        for name in ("workflows_sdk", "untrusted", "docker_startup;id"):
+            with self.assertRaises(ValueError): subject.artifact(cargo_stream(records), name)
+
+    def test_should_reject_remote_shell_paths_profiles_and_document_expansion(self):
+        for path in ("relative", "/tmp/a b", "/tmp/../test", "/tmp//test", "/tmp/$(id)",
+                     "/tmp/a\n", "/tmp/" + "a" * 4096):
+            with self.assertRaises(ValueError):
+                subject.safe_path(path)
+        for selected in ("default", "rustack-workflows-x;id", "rustack-workflows-" + "x" * 41):
+            with self.assertRaises(ValueError):
+                subject.profile(selected)
+        for raw in (b'{"x":1,"x":2}', b'{"x":NaN}', b"x" * 65537,
+                    b"[" * 1000 + b"0" + b"]" * 1000,
+                    b'{"x":"' + b"x" * 16385 + b'"}', b"[" + b"0," * 512 + b"0]"):
+            with self.assertRaises(ValueError):
+                subject.document(raw)
+
+    def test_should_reject_wrong_elf_symlinks_and_changed_hashes(self):
+        with tempfile.TemporaryDirectory() as root:
+            path = Path(root) / "test"
+            elf = bytearray(64)
+            elf[:6] = b"\x7fELF\x02\x01"
+            struct.pack_into("<H", elf, 18, 183)
+            path.write_bytes(elf)
+            original = subject.fingerprint(path)
+            elf[-1] = 1
+            path.write_bytes(elf)
+            self.assertNotEqual(subject.fingerprint(path), original)
+            struct.pack_into("<H", elf, 18, 62)
+            path.write_bytes(elf)
+            with self.assertRaises(ValueError):
+                subject.fingerprint(path)
+            link = Path(root) / "link"
+            link.symlink_to(path)
+            with self.assertRaises(OSError):
+                subject.fingerprint(link)
+            fifo = Path(root) / "fifo"
+            os.mkfifo(fifo)
+            with self.assertRaises(ValueError):
+                subject.bounded_read(fifo, 100)
+
+    def test_should_reject_late_preflight_and_enforce_original_io_alarm(self):
+        with patch.object(subject.time, "monotonic", return_value=100):
+            with self.assertRaisesRegex(ValueError, "qualification-deadline"):
+                subject.check_deadline(100)
+        before = signal.getsignal(signal.SIGALRM)
+        with self.assertRaisesRegex(ValueError, "qualification-deadline"):
+            with subject.deadline_guard(0.01):
+                # A blocked local observation must not escape the guest cutoff.
+                signal.pause()
+        self.assertEqual(signal.getsignal(signal.SIGALRM), before)
+        self.assertEqual(signal.getitimer(signal.ITIMER_REAL), (0, 0))
+
+    def test_should_join_held_child_when_alarm_arrives_during_retirement(self):
+        with tempfile.TemporaryDirectory() as root:
+            pidfile = Path(root) / "pid"
+            script = ("import os,signal,time,pathlib;signal.signal(signal.SIGTERM,signal.SIG_IGN);"
+                      "pathlib.Path(" + repr(str(pidfile)) + ").write_text(str(os.getpid()));time.sleep(10)")
+            state = {"entered": None, "alarmDelivered": False}
+            def clock():
+                return 0 if state["entered"] is None else time.monotonic() - state["entered"]
+            owner = subject.Runner({"PATH": "/usr/bin:/bin"}, clock=clock)
+            def deliver_during_retirement():
+                cutoff = time.monotonic() + 4
+                while not pidfile.exists() and time.monotonic() < cutoff:
+                    time.sleep(0.005)
+                if not pidfile.exists():
+                    return
+                state["entered"] = time.monotonic()
+                while not owner.retiring and time.monotonic() < cutoff:
+                    time.sleep(0.005)
+                if owner.retiring:
+                    state["alarmDelivered"] = True
+                    os.kill(os.getpid(), signal.SIGALRM)
+            sender = threading.Thread(target=deliver_during_retirement)
+            with subject.deadline_guard(9, owner):
+                sender.start()
+                try:
+                    with self.assertRaises(subject.ActionError):
+                        owner.run([sys.executable, "-I", "-B", "-c", script], 0.15)
+                finally:
+                    sender.join(timeout=5)
+                self.assertFalse(sender.is_alive())
+                self.assertTrue(state["alarmDelivered"])
+            pid = int(pidfile.read_text())
+            self.assertFalse(owner.unsettled)
+            for observe in (os.kill, os.killpg):
+                with self.assertRaises(ProcessLookupError):
+                    observe(pid, 0)
+
+    def test_should_join_actual_child_groups_on_owner_term_hup_and_int(self):
+        for interruption in (signal.SIGTERM, signal.SIGHUP, signal.SIGINT):
+            with self.subTest(interruption=interruption), tempfile.TemporaryDirectory() as root:
+                pidfile = Path(root) / "pid"
+                child_code = ("import os,time,pathlib;pathlib.Path(" + repr(str(pidfile))
+                              + ").write_text(str(os.getpid()));time.sleep(10)")
+                owner_code = ("import sys,time;sys.path.insert(0," + repr(str(Path(subject.__file__).parent))
+                              + ");import linux_performance as m;owner=m.Runner({'PATH':'/usr/bin:/bin'})\n"
+                              "try:\n with m.deadline_guard(9,owner):\n  owner.run("
+                              + repr([sys.executable, "-I", "-B", "-c", child_code])
+                              + ",time.monotonic()+8)\nexcept (m.ActionError,m.QualificationError):sys.exit(2)\n")
+                parent = subprocess.Popen([sys.executable, "-I", "-B", "-c", owner_code],
+                                          stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                                          start_new_session=True)
+                child_pid = None
+                try:
+                    cutoff = time.monotonic() + 3
+                    while not pidfile.exists() and time.monotonic() < cutoff and parent.poll() is None:
+                        time.sleep(0.005)
+                    self.assertTrue(pidfile.exists(), "child never entered")
+                    child_pid = int(pidfile.read_text())
+                    os.kill(parent.pid, interruption)
+                    stdout, stderr = parent.communicate(timeout=5)
+                    self.assertEqual((parent.returncode, stdout, stderr), (2, b"", b""))
+                    for observe in (os.kill, os.killpg):
+                        with self.assertRaises(ProcessLookupError):
+                            observe(child_pid, 0)
+                finally:
+                    if parent.poll() is None:
+                        os.killpg(parent.pid, signal.SIGKILL)
+                    parent.communicate(timeout=5)
+                    if child_pid is not None:
+                        try:
+                            os.killpg(child_pid, signal.SIGKILL)
+                        except ProcessLookupError:
+                            pass
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_localstack_policy.py b/tests/workflows/test_localstack_policy.py
new file mode 100644
index 00000000..cfdacea5
--- /dev/null
+++ b/tests/workflows/test_localstack_policy.py
@@ -0,0 +1,156 @@
+"""Negative controls for external oracle integrity and ownership boundaries."""
+import json
+import os
+from pathlib import Path
+import tempfile
+import sys
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+
+from localstack_snapshot.snapshots import SnapshotAssertionError
+
+from localstack_policy import exact, guards, manifest, outcomes, private, relative
+from localstack_fixtures import Fixtures, RecordedSession
+import localstack_images as images
+from localstack_policy import digest, publish, read
+
+
+class PolicyTests(unittest.TestCase):
+    def test_should_pin_every_required_node_to_a_recorded_upstream_baseline(self):
+        value, hashed = manifest()
+        self.assertEqual(len(hashed), 64)
+        self.assertEqual({key:len(nodes) for key, nodes in value["groups"].items()},
+                         {"pure":91, "docker":32})
+
+    def test_should_reject_missing_extra_and_repeated_collection(self):
+        for nodes in (["a"], ["a", "b", "c"], ["a", "a"]):
+            with self.subTest(nodes=nodes), self.assertRaisesRegex(ValueError, "collection"):
+                exact(["a", "b"], nodes)
+
+    def test_should_reject_failed_skipped_xfailed_and_missing_teardown(self):
+        good = {"setup":"passed", "call":"passed", "teardown":"passed", "xfail":False}
+        for changes in ({"call":"failed"}, {"call":"skipped"}, {"xfail":True}, {"teardown":None}):
+            with self.subTest(changes=changes), self.assertRaisesRegex(ValueError, "unsuccessful"):
+                outcomes(["a"], {"a":{**good, **changes}})
+
+    def test_should_forbid_snapshot_updates_skip_all_and_test_selection_flags(self):
+        for flag in ("--snapshot-update", "--snapshot-raw", "--snapshot-skip-all", "--collect-only",
+                     "--maxfail=1", "--lf", "-x"):
+            with self.subTest(flag=flag), self.assertRaisesRegex(ValueError, "forbidden"):
+                guards([flag], {})
+
+    def test_should_forbid_ambient_cloud_and_pytest_configuration(self):
+        for name in ("AWS_PROFILE", "AWS_DEFAULT_PROFILE", "TEST_TARGET", "PYTEST_ADDOPTS", "PYTEST_PLUGINS",
+                     "SNAPSHOT_UPDATE", "SNAPSHOT_RAW"):
+            with self.subTest(name=name), self.assertRaisesRegex(ValueError, "ambient"):
+                guards([], {name:"1"})
+
+    def test_should_reject_traversal_and_absolute_vendor_references(self):
+        for value in ("../secret", "/tmp/file", "a//b", "a/./b", "a/../b", "a\\b"):
+            with self.subTest(value=value), self.assertRaisesRegex(ValueError, "relative"):
+                relative(value)
+
+    def test_should_reject_nonprivate_and_symlinked_evidence(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory).resolve()
+            os.chmod(path, 0o755)
+            with self.assertRaisesRegex(ValueError, "ownership"):
+                private(path)
+            os.chmod(path, 0o700)
+            link = path / "link"
+            link.symlink_to(path, target_is_directory=True)
+            with self.assertRaisesRegex(ValueError, "evidence"):
+                private(link)
+
+    def test_should_preserve_upstream_semantic_assertions_and_baseline_bytes(self):
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory) / "oracle"
+            baseline = base.with_suffix(".snapshot.json")
+            original = json.dumps({"node":{"recorded-date":"upstream", "recorded-content":{
+                "result":{"output":42, "error":"OriginalError"}}}}).encode()
+            baseline.write_bytes(original)
+            for wrong in ({"output":43, "error":"OriginalError"}, {"output":42, "error":"ChangedError"}):
+                session = RecordedSession(base_file_path=str(base), scope_key="node", update=False, verify=True)
+                session.match("result", wrong)
+                with self.assertRaises(SnapshotAssertionError):
+                    session._assert_all()
+                self.assertTrue(session.checked)
+                self.assertFalse(session.passed)
+                self.assertEqual(baseline.read_bytes(), original)
+
+    def test_should_not_accept_a_session_that_compares_nothing(self):
+        with tempfile.TemporaryDirectory() as directory:
+            session = RecordedSession(base_file_path=str(Path(directory) / "empty"),
+                                      scope_key="node", update=False, verify=True)
+            self.assertEqual(session._assert_all(), [])
+            self.assertFalse(session.passed)
+
+    def test_should_install_the_original_aws_snapshot_transformers(self):
+        with tempfile.TemporaryDirectory() as directory, patch.object(sys, "path", [str(images.VENDOR), *sys.path]):
+            base = Path(directory) / "oracle"
+            session = RecordedSession(base_file_path=str(base), scope_key="node", update=False, verify=True)
+            request = SimpleNamespace(fspath=SimpleNamespace(dirname="tests/aws/services/stepfunctions/v2"))
+            plugin = Fixtures(Path(directory), "http://127.0.0.1:1", "pure", [], {}, {})
+            observed = Fixtures.snapshot.__wrapped__(plugin, request, session)
+            self.assertIs(observed, session)
+            self.assertTrue(callable(observed.transform.stepfunctions_api))
+            self.assertTrue(callable(observed.transform.sfn_sm_create_arn))
+
+    def test_should_fail_the_case_when_machine_cleanup_cannot_be_confirmed(self):
+        with tempfile.TemporaryDirectory() as directory:
+            plugin = Fixtures(Path(directory), "http://127.0.0.1:1", "pure", [], {}, {})
+            client = SimpleNamespace(create_state_machine=lambda **_: {"stateMachineArn":"arn"},
+                list_executions=lambda **_: {"executions":[]}, delete_state_machine=lambda **_: None)
+            owner = Fixtures.create_state_machine.__wrapped__(plugin, None, None)
+            create = next(owner)
+            create(SimpleNamespace(stepfunctions=client), name="test")
+            with patch.object(client, "delete_state_machine", side_effect=OSError("unavailable")):
+                with self.assertRaisesRegex(ValueError, "cleanup-failed"):
+                    next(owner)
+
+    def test_should_accept_upstream_positional_and_keyword_role_factory_calls(self):
+        with tempfile.TemporaryDirectory() as directory:
+            plugin = Fixtures(Path(directory), "http://127.0.0.1:1", "pure", [], {}, {})
+            factory = Fixtures.create_state_machine_iam_role.__wrapped__(plugin)
+            self.assertEqual(factory(None), factory(target_aws_client=None))
+
+    def test_should_reject_substituted_image_receipt_and_build_metadata(self):
+        source = images.HANDLERS[0]
+        with tempfile.TemporaryDirectory() as directory, patch.object(images, "HANDLERS", (source,)):
+            root = Path(directory).resolve()
+            context = root / "handler-0"
+            context.mkdir()
+            raw = read(images.VENDOR / source)
+            (context / "handler.py").write_bytes(raw)
+            (context / "Dockerfile").write_bytes(images.recipe())
+            (context / "build.stdout").write_bytes(b"build complete")
+            image_id = "sha256:" + "a" * 64
+            metadata = {"containerimage.digest":image_id, "containerimage.config.digest":"sha256:" + "b" * 64}
+            publish(context / "metadata.json", metadata)
+            name = "rustack-localstack-compat:nonce-0"
+            publish(context / "build-intent.json", {"argv":images.build_arguments(Path("/builder"), context, name),
+                "engine":"engine", "source":source, "handlerSha256":digest(raw),
+                "dockerfileSha256":digest(images.recipe())})
+            row = {"imageId":image_id, "handlerSha256":digest(raw),
+                "buildIntentSha256":digest(read(context / "build-intent.json")),
+                "metadataSha256":digest(read(context / "metadata.json")),
+                "buildStdoutSha256":digest(read(context / "build.stdout"))}
+            publish(context / "result.json", row)
+            row["buildResultSha256"] = digest(read(context / "result.json"))
+            value = {"engine":"engine", "endpoint":"unix:///socket", "base":images.BASE,
+                "manifestSha256":"seal", "builderExecutable":"/builder", "handlers":{source:row}}
+            publish(root / "intent.json", {"engine":"engine", "endpoint":"unix:///socket",
+                "base":images.BASE, "manifestSha256":"seal", "nonce":"nonce"})
+            images.validate_builds(root, value)
+            row["imageId"] = "sha256:" + "c" * 64
+            with self.assertRaisesRegex(ValueError, "result-affiliation"):
+                images.validate_builds(root, value)
+            row["imageId"] = image_id
+            (context / "metadata.json").write_text(json.dumps({"containerimage.digest":"sha256:" + "d" * 64}))
+            with self.assertRaisesRegex(ValueError, "build-output"):
+                images.validate_builds(root, value)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_negative_images.py b/tests/workflows/test_negative_images.py
new file mode 100644
index 00000000..f830e2ed
--- /dev/null
+++ b/tests/workflows/test_negative_images.py
@@ -0,0 +1,62 @@
+"""The incompatible artifacts have deterministic real image identities/platforms."""
+import hashlib
+import importlib.util
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import tarfile
+import tempfile
+import unittest
+
+spec = importlib.util.spec_from_file_location("negative_images", Path(__file__).parents[1] / "lambda-fixtures/negative_images.py")
+negative = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(negative)
+
+
+class NegativeImageControls(unittest.TestCase):
+    def test_should_reject_invalid_provisioning_before_cli_with_optimization_enabled(self):
+        environment = {"PATH":os.environ.get("PATH", "/usr/bin:/bin"),
+                       "PYTHONOPTIMIZE":"1", "PYTHONPATH":"/explicit-untrusted-module-path"}
+        with tempfile.TemporaryDirectory(prefix="rustack-cache-guard-") as root:
+            executable = str(Path(root) / "must-not-exist")
+            for option, message in (("WORKFLOWS_ARCH=invalid", "WORKFLOWS_ARCH must be arm64 or amd64"),
+                                    ("WORKFLOWS_PULL_IMAGE=public.ecr.aws/lambda/nodejs:latest", "immutable public Node fixture required"),
+                                    ("WORKFLOWS_PULL_IMAGE=foreign.example/private@sha256:" + "a"*64, "immutable public Node fixture required")):
+                with self.subTest(option=option):
+                    result = subprocess.run(["make", "lambda-pull-fixture-image", "WORKFLOWS_ARCH=arm64",
+                                             "WORKFLOWS_DOCKER_BIN=" + executable,
+                                             "WORKFLOWS_DOCKER_SOCKET=/unused/fixture.sock", option],
+                                            cwd=Path(__file__).resolve().parents[2], env=environment,
+                                            capture_output=True, text=True, timeout=10)
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertIn(message, result.stderr)
+                    self.assertNotIn("FileNotFoundError", result.stderr)
+
+    def test_should_build_deterministic_nonempty_content_addressed_platforms(self):
+        for selected in ("arm64", "amd64"):
+            for kind in ("os", "architecture"):
+                raw = negative.image(selected, kind)
+                self.assertEqual(raw, negative.image(selected, kind))
+                self.assertLessEqual(len(raw), 65536)
+                with tarfile.open(fileobj=io.BytesIO(raw)) as archive:
+                    manifest = json.load(archive.extractfile("manifest.json"))[0]
+                    config = archive.extractfile(manifest["Config"]).read()
+                    self.assertEqual(manifest["Config"], hashlib.sha256(config).hexdigest() + ".json")
+                    metadata = json.loads(config)
+                    self.assertEqual(metadata["os"], "windows" if kind == "os" else "linux")
+                    if kind == "architecture":
+                        self.assertNotEqual(metadata["architecture"], selected)
+                    layer = archive.extractfile(manifest["Layers"][0]).read()
+                    self.assertEqual(metadata["rootfs"]["diff_ids"], ["sha256:" + hashlib.sha256(layer).hexdigest()])
+                    self.assertTrue(all(member.isfile() and member.uid == 1000 and member.mtime == 0 for member in archive))
+
+    def test_should_refuse_unrecognized_platform_or_artifact_kind(self):
+        for selected, kind in (("../arm64", "os"), ("arm64", "../os"), ("x86_64", "architecture")):
+            with self.assertRaises(ValueError):
+                negative.image(selected, kind)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_node_image.py b/tests/workflows/test_node_image.py
new file mode 100644
index 00000000..487aaff4
--- /dev/null
+++ b/tests/workflows/test_node_image.py
@@ -0,0 +1,44 @@
+"""The ordinary Node observer rejects responses at or beyond its original cutoff."""
+import unittest
+
+from node_image_sdk import poll_response
+
+
+class NodeObserverControls(unittest.TestCase):
+    def observe(self, ticks, responses):
+        times = iter(ticks)
+        values = iter(responses)
+        return poll_response(lambda: next(values), lambda value: value == "done", 90,
+                             clock=lambda: next(times), sleep=lambda _: None)
+
+    def test_should_accept_terminal_before_original_cutoff(self):
+        self.assertEqual(self.observe([0, 0, 89], ["done"]), "done")
+
+    def test_should_reject_terminal_at_original_cutoff(self):
+        with self.assertRaises(TimeoutError):
+            self.observe([0, 0, 90], ["done"])
+
+    def test_should_reject_late_terminal_after_running(self):
+        with self.assertRaises(TimeoutError):
+            self.observe([0, 0, 1, 2, 91], ["running", "done"])
+
+
+    def test_should_reject_expired_initial_observer_without_dispatch(self):
+        reads = []
+        ticks = iter([0, 90])
+        with self.assertRaises(TimeoutError):
+            poll_response(lambda: reads.append("read"), lambda _: True, 90,
+                          clock=lambda: next(ticks))
+        self.assertEqual(reads, [])
+
+    def test_should_not_dispatch_again_after_running_observer_expires(self):
+        reads = []
+        ticks = iter([0, 0, 1, 90])
+        with self.assertRaises(TimeoutError):
+            poll_response(lambda: reads.append("read") or "running", lambda _: False, 90,
+                          clock=lambda: next(ticks), sleep=lambda _: None)
+        self.assertEqual(reads, ["read"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_provided_zip_archive.py b/tests/workflows/test_provided_zip_archive.py
new file mode 100644
index 00000000..a01750c9
--- /dev/null
+++ b/tests/workflows/test_provided_zip_archive.py
@@ -0,0 +1,42 @@
+"""Clock fences for the ordinary archive observer; no cloud or Docker calls."""
+import unittest
+from unittest.mock import Mock, patch
+
+import provided_zip_archive_sdk as archive
+
+
+def completed():
+    return dict(executionArn="execution", stateMachineArn="machine", status="SUCCEEDED",
+                input="{}", output="{}", startDate=0, stopDate=1)
+
+
+class ArchiveClockControls(unittest.TestCase):
+    def test_should_accept_terminal_response_observed_before_original_cutoff(self):
+        client = Mock()
+        client.describe_execution.return_value = completed()
+        with patch.object(archive.time, "monotonic", side_effect=[0, 89]):
+            self.assertEqual(archive.execution(client, "execution"), completed())
+        client.describe_execution.assert_called_once_with(executionArn="execution")
+
+    def test_should_reject_terminal_response_at_original_cutoff(self):
+        client = Mock()
+        client.describe_execution.return_value = completed()
+        with patch.object(archive.time, "monotonic", side_effect=[0, 90]):
+            with self.assertRaisesRegex(AssertionError, "observation expired"):
+                archive.execution(client, "execution")
+
+    def test_should_reject_terminal_response_after_original_cutoff(self):
+        client = Mock()
+        client.describe_execution.return_value = completed()
+        with patch.object(archive.time, "monotonic", side_effect=[0, 91]):
+            with self.assertRaisesRegex(AssertionError, "observation expired"):
+                archive.execution(client, "execution")
+
+    def test_should_preserve_original_cutoff_across_running_then_terminal_observation(self):
+        client = Mock()
+        client.describe_execution.side_effect = [dict(status="RUNNING"), completed()]
+        with patch.object(archive.time, "monotonic", side_effect=[0, 1, 91]), patch.object(archive.time, "sleep") as sleep:
+            with self.assertRaisesRegex(AssertionError, "observation expired"):
+                archive.execution(client, "execution")
+        self.assertEqual(client.describe_execution.call_count, 2)
+        sleep.assert_called_once_with(0.025)
diff --git a/tests/workflows/test_provided_zip_fixture.py b/tests/workflows/test_provided_zip_fixture.py
new file mode 100644
index 00000000..8b21d745
--- /dev/null
+++ b/tests/workflows/test_provided_zip_fixture.py
@@ -0,0 +1,50 @@
+"""Deterministic same-artifact packaging controls; no runtime substitution."""
+import io
+import json
+from pathlib import Path
+import tempfile
+import unittest
+import zipfile
+
+from provided_zip_fixture import build, digest, linux_elf, package
+
+
+class ProvidedZipControls(unittest.TestCase):
+    def test_should_preserve_exact_bootstrap_bytes_and_stable_distinct_revisions(self):
+        bootstrap = b"ELF fixture bytes" * 100
+        a, b = package(bootstrap, b"A"), package(bootstrap, b"B")
+        self.assertEqual(a, package(bootstrap, b"A"))
+        self.assertNotEqual(a, b)
+        self.assertNotEqual(digest(a), digest(b))
+        for raw, marker in ((a,b"A"), (b,b"B")):
+            with zipfile.ZipFile(io.BytesIO(raw)) as archive:
+                self.assertEqual(archive.namelist(), ["bootstrap", "revision.txt"])
+                self.assertEqual(archive.read("bootstrap"), bootstrap)
+                self.assertEqual(archive.read("revision.txt"), marker)
+                self.assertEqual(archive.getinfo("bootstrap").external_attr >> 16, 0o100755)
+                self.assertEqual(archive.getinfo("revision.txt").external_attr >> 16, 0o100644)
+
+    def test_should_reject_wrong_machine_or_incomplete_elf_before_packaging(self):
+        raw = bytearray(64)
+        raw[:7] = b"\x7fELF\x02\x01\x01"
+        for a, b, value in ((16,18,2),(18,20,183),(20,24,1),(52,54,64)):
+            raw[a:b] = value.to_bytes(b-a,"little")
+        linux_elf(raw,"arm64")
+        for data, arch in ((raw,"amd64"),(raw[:63],"arm64"),(b"bad", "arm64")):
+            with self.subTest(architecture=arch), self.assertRaises(AssertionError):
+                linux_elf(data,arch)
+        with tempfile.TemporaryDirectory() as root:
+            source = Path(root)/"bootstrap"
+            source.write_bytes(raw)
+            target = Path(root)/"provided"
+            build(source,"arm64",target)
+            manifest = json.loads((target/"provided-zip-manifest.json").read_text())
+            for info in manifest["artifacts"].values():
+                data = (target/info["file"]).read_bytes()
+                self.assertEqual(info["bytes"],len(data))
+                self.assertEqual(info["sha256"],digest(data))
+            self.assertFalse(list(target.glob("*.pending")))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_pulumi_archive.py b/tests/workflows/test_pulumi_archive.py
new file mode 100644
index 00000000..08080197
--- /dev/null
+++ b/tests/workflows/test_pulumi_archive.py
@@ -0,0 +1,156 @@
+"""Controls for the independent archive oracle; no fabricated acceptance state."""
+import hashlib
+import copy
+import time
+import io
+import json
+import tarfile
+import tempfile
+from pathlib import Path
+import unittest
+
+from pulumi_archive import CAP, SIGNATURE, SECRET, checkpoint, document, evidence_directory, exec_complete, exec_stream, unpack
+
+SECRETS = (b"local-key", b"local-secret")
+PATH = "backend/.pulumi/stacks/rustack-iac/fixture.json"
+ARN = "arn:aws:states:us-east-1:000000000000:stateMachine:Target"
+MANIFEST = {"version": "3.273.0", "magic": hashlib.sha256(b"3.273.0").hexdigest(), "time": "2026-10-31T07:00:00Z"}
+STACK = "organization/rustack-iac/fixture"
+
+
+def archive(name, value, kind=tarfile.REGTYPE):
+    out = io.BytesIO()
+    with tarfile.open(fileobj=out, mode="w", format=tarfile.USTAR_FORMAT) as stream:
+        item = tarfile.TarInfo(name)
+        item.type, item.size = kind, len(value)
+        stream.addfile(item, io.BytesIO(value))
+    return out.getvalue()
+
+
+class ArchiveTests(unittest.TestCase):
+    def test_should_refuse_truncated_oversized_stderr_or_expired_exec_streams(self):
+        def frame(body, kind=1):
+            return bytes([kind, 0, 0, 0]) + len(body).to_bytes(4, "big") + body
+        valid = frame(b"actual") + frame(b" bytes")
+        self.assertEqual(exec_stream(io.BytesIO(valid), time.monotonic() + 2), b"actual bytes")
+        invalid = [valid[:7], valid[:-1], frame(b"private error", 2), frame(b"wrong stream", 0),
+                   bytes([1, 0, 0, 0]) + (2 * 1024 * 1024 + 1).to_bytes(4, "big"), frame(b"a") * 4097,
+                   frame(b"a" * (2 * 1024 * 1024)) * 9]
+        for raw in invalid:
+            with self.assertRaises(ValueError):
+                exec_stream(io.BytesIO(raw), time.monotonic() + 2)
+        with self.assertRaises(ValueError):
+            exec_stream(io.BytesIO(valid), time.monotonic() - 1)
+
+    def test_should_join_only_matching_unprivileged_successful_exec_identity(self):
+        command = ["/var/lang/bin/node", "/var/task/pulumi/evidence_reader.js", "request", "logs"]
+        observed = {"ID": "a" * 64, "ContainerID": "b" * 64, "Running": False, "ExitCode": 0,
+            "ProcessConfig": {"entrypoint": command[0], "arguments": command[1:], "privileged": False,
+                              "tty": False, "user": "1000:1000"}}
+        self.assertTrue(exec_complete(observed, "a" * 64, "b" * 64, command))
+        self.assertFalse(exec_complete({**observed, "Running": True}, "a" * 64, "b" * 64, command))
+        for key, value in (("ID", "c" * 64), ("ContainerID", "c" * 64), ("ExitCode", 1), ("ExitCode", False), ("Running", 0)):
+            with self.assertRaises(ValueError):
+                exec_complete({**observed, key: value}, "a" * 64, "b" * 64, command)
+        for key, value in (("entrypoint", "/bin/sh"), ("arguments", []), ("user", "0"), ("privileged", True), ("tty", True)):
+            invalid = copy.deepcopy(observed)
+            invalid["ProcessConfig"][key] = value
+            with self.assertRaises(ValueError):
+                exec_complete(invalid, "a" * 64, "b" * 64, command)
+
+    def test_should_normalize_owned_evidence_alias_and_exclusively_create_private_child(self):
+        with tempfile.TemporaryDirectory(dir="/tmp") as directory:
+            created = evidence_directory(directory)
+            self.assertEqual(created, Path(directory).resolve() / "iac-private")
+            self.assertEqual(created.stat().st_mode & 0o777, 0o700)
+            with self.assertRaises(FileExistsError):
+                evidence_directory(directory)
+        for invalid in ("relative", "\x00", "x" * 4097):
+            with self.assertRaises(ValueError):
+                evidence_directory(invalid)
+
+    def test_should_reject_plaintext_and_json_escaped_secrets(self):
+        for secret in SECRETS:
+            for raw in (b'{"value":"' + secret + b'"}', json.dumps({"value": "".join("\\u%04x" % c for c in secret)}).encode().replace(b"\\\\u", b"\\u")):
+                with self.assertRaises(ValueError):
+                    document(raw, SECRETS)
+                for name in ("backend/actual.json", "backend/fixture.json.bak", "backend/metadata.yaml"):
+                    with self.assertRaises(ValueError):
+                        unpack(archive(name, raw), "backend", SECRETS)
+
+    def test_should_scan_json_strings_in_actual_stdout_and_stderr_archive_names(self):
+        for suffix in ("stdout", "stderr"):
+            for secret in SECRETS:
+                escaped = "".join("\\u%04x" % c for c in secret)
+                raw = ('CLI diagnostic: {"credential":"' + escaped + '"}\n').encode()
+                with self.assertRaises(ValueError):
+                    unpack(archive("logs/8-reject-publish." + suffix, raw), "logs", SECRETS)
+            for raw in (b'prefix "unclosed', b'prefix "bad\\q"', b'prefix "\xff"'):
+                with self.assertRaises(ValueError):
+                    unpack(archive("logs/8-reject-publish." + suffix, raw), "logs", SECRETS)
+            safe = b'plain output\n{"message":"safe \\u0061"}\n'
+            self.assertEqual(unpack(archive("logs/1-version." + suffix, safe), "logs", SECRETS),
+                             {"logs/1-version." + suffix: safe})
+
+    def test_should_reject_archive_traversal_specials_truncation_trailing_and_caps(self):
+        for name, kind in (("backend/../escape", tarfile.REGTYPE), ("/backend/file", tarfile.REGTYPE),
+                           ("backend/link", tarfile.SYMTYPE), ("backend/fifo", tarfile.FIFOTYPE)):
+            with self.assertRaises(ValueError):
+                unpack(archive(name, b"", kind), "backend", SECRETS)
+        valid = archive("backend/actual.json", b'{}')
+        for raw in (valid + b"x" * 512, bytes(CAP + 512), valid[:1024]):
+            with self.assertRaises(ValueError):
+                unpack(raw, "backend", SECRETS)
+        self.assertEqual(unpack(valid, "backend", SECRETS), {"backend/actual.json": b'{}'})
+        with self.assertRaises(ValueError):
+            unpack(archive("backend/huge", b"a" * (2 * 1024 * 1024 + 1)), "backend", SECRETS)
+
+    def test_should_require_live_encrypted_inputs_before_destroy_and_distinct_later_states(self):
+        encrypted = {SIGNATURE: SECRET, "ciphertext": "v1:encrypted-private-input"}
+        resources = [{"type": "pulumi:pulumi:Stack"}, {"type": "pulumi:providers:aws",
+            "inputs": {"accessKey": encrypted, "secretKey": encrypted}},
+            {"type": "aws:sfn/stateMachine:StateMachine", "id": ARN}]
+        def source(entries):
+            raw = json.dumps({"version": 3, "checkpoint": {"stack": STACK, "latest": {"manifest": MANIFEST, "resources": entries}}}).encode()
+            return {PATH: raw}, {"path": PATH, "present": True, "bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest()}
+        files, observation = source(resources)
+        checkpoint(files, observation, "pre-destroy", ARN, SECRETS)
+        with self.assertRaises(ValueError):
+            checkpoint(files, observation, "post-destroy", ARN, SECRETS)
+        files, observation = source(resources[:1])
+        checkpoint(files, observation, "post-destroy", ARN, SECRETS)
+        with self.assertRaises(ValueError):
+            checkpoint(files, observation, "pre-destroy", ARN, SECRETS)
+        checkpoint({}, {"path": PATH, "present": False, "bytes": 0, "sha256": ""}, "post-removal", ARN, SECRETS)
+        with self.assertRaises(ValueError):
+            checkpoint(files, {"path": PATH, "present": False, "bytes": 0, "sha256": ""}, "post-removal", ARN, SECRETS)
+
+    def test_should_accept_only_real_stack_and_manifest_with_omitted_empty_resources(self):
+        valid = {"version": 3, "checkpoint": {"stack": STACK, "latest": {"manifest": MANIFEST}}}
+        def observed(value):
+            raw = json.dumps(value).encode()
+            return {PATH: raw}, {"path": PATH, "present": True, "bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest()}
+        files, info = observed(valid)
+        checkpoint(files, info, "post-destroy", ARN, SECRETS)
+        with self.assertRaises(ValueError):
+            checkpoint(files, info, "pre-destroy", ARN, SECRETS)
+        with self.assertRaises(ValueError):
+            checkpoint(files, {**info, "sha256": "0" * 64}, "post-destroy", ARN, SECRETS)
+        invalid = [{}, {"stack": STACK}, {"stack": STACK, "latest": {}},
+                   {"stack": "other", "latest": {"manifest": MANIFEST}},
+                   {"latest": {"manifest": MANIFEST}}]
+        invalid.extend({"stack": STACK, "latest": {"manifest": {**MANIFEST, key: value}}}
+                       for key, value in (("version", "0.0.0"), ("magic", "0" * 64), ("time", "not-a-time")))
+        for current in invalid:
+            files, info = observed({"version": 3, "checkpoint": current})
+            with self.assertRaises(ValueError):
+                checkpoint(files, info, "post-destroy", ARN, SECRETS)
+
+    def test_should_reject_duplicate_json_keys_and_excessive_depth(self):
+        for raw in (b'{"x":1,"x":2}', b"[" * 66 + b"0" + b"]" * 66):
+            with self.assertRaises(ValueError):
+                document(raw, SECRETS)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_pulumi_dependencies.py b/tests/workflows/test_pulumi_dependencies.py
new file mode 100644
index 00000000..6fdf4914
--- /dev/null
+++ b/tests/workflows/test_pulumi_dependencies.py
@@ -0,0 +1,86 @@
+"""No-network installation-root lock and private-cache controls."""
+
+import fcntl
+from pathlib import Path
+import tempfile
+import threading
+import unittest
+from unittest.mock import patch
+
+import pulumi_dependencies as fixture
+
+
+class DependencyOwnershipControls(unittest.TestCase):
+    def test_should_serialize_one_installation_with_distinct_cache_roots(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = root / "source"
+            source.mkdir()
+            entered, released, blocked, ready = (threading.Event() for _ in range(4))
+            calls, errors = [], []
+            original_flock = fcntl.flock
+
+            def observed_lock(fd, operation):
+                try:
+                    return original_flock(fd, operation)
+                except BlockingIOError:
+                    blocked.set()
+                    raise
+
+            def install(*args, **kwargs):
+                calls.append((args, kwargs))
+                (source / "node_modules").mkdir()
+                entered.set()
+                if not released.wait(10):
+                    raise TimeoutError("fixture install grant expired")
+                ready.set()
+
+            def run(cache):
+                try:
+                    fixture.prepare(cache)
+                except BaseException as error:
+                    errors.append(error)
+
+            with patch.object(fixture, "SOURCE", source), patch.object(fixture, "manifest", return_value="fixed-lock"), \
+                 patch.object(fixture, "installed", side_effect=lambda _: ready.is_set()), \
+                 patch.object(fixture.subprocess, "run", side_effect=install), \
+                 patch.object(fixture.fcntl, "flock", side_effect=observed_lock):
+                first = threading.Thread(target=run, args=(root / "cache-a",))
+                second = threading.Thread(target=run, args=(root / "cache-b",))
+                first.start()
+                try:
+                    self.assertTrue(entered.wait(10), "first install did not acquire its lock")
+                    second.start()
+                    self.assertTrue(blocked.wait(10), "second cache did not contend on the installation lock")
+                    self.assertEqual(len(calls), 1)
+                finally:
+                    released.set()
+                    first.join(10)
+                    if second.ident is not None:
+                        second.join(10)
+                self.assertFalse(first.is_alive())
+                self.assertFalse(second.is_alive())
+            self.assertEqual(errors, [])
+            self.assertEqual(len(calls), 1)
+            self.assertEqual((source / "node_modules" / ".rustack-iac-lock").read_text(), "fixed-lock")
+            for cache in ("cache-a", "cache-b"):
+                for kind in ("user", "global"):
+                    self.assertEqual((root / cache / "config" / kind).read_bytes(), b"")
+
+    def test_should_reject_nonempty_configuration_even_when_installation_is_ready(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = root / "source"
+            source.mkdir()
+            cache = root / "cache"
+            (cache / "config").mkdir(parents=True)
+            (cache / "config" / "user").write_text("registry=https://untrusted.invalid\n")
+            with patch.object(fixture, "SOURCE", source), patch.object(fixture, "manifest", return_value="fixed-lock"), \
+                 patch.object(fixture, "installed", return_value=True), patch.object(fixture.subprocess, "run") as execute:
+                with self.assertRaises(AssertionError):
+                    fixture.prepare(cache)
+                execute.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_pulumi_replay.py b/tests/workflows/test_pulumi_replay.py
new file mode 100644
index 00000000..adefdcc6
--- /dev/null
+++ b/tests/workflows/test_pulumi_replay.py
@@ -0,0 +1,37 @@
+"""No-network controls for replay resistance in the actual SDK consumer."""
+import json
+import tempfile
+import unittest
+import uuid
+
+from pulumi_image_sdk import Driver
+
+
+class ReplayedStates:
+    def __init__(self, flavor):
+        self.flavor, self.calls, self.request_id = flavor, 0, str(uuid.uuid4())
+
+    def start_execution(self, **_arguments):
+        self.calls += 1
+        ordinal = 1 if self.flavor == "arn" else self.calls
+        return {"executionArn": self.driver.target_arn.replace(":stateMachine:", ":execution:") + ":Replay" + str(ordinal)}
+
+    def describe_execution(self, **_arguments):
+        counter = 2 if self.flavor == "counter" else self.calls + 1
+        request = self.request_id if self.flavor == "request" else str(uuid.uuid4())
+        return {"status": "SUCCEEDED", "output": json.dumps({"computed": 46, "counter": counter,
+            "requestId": request, "nodeVersion": "24.22.1", "architecture": "arm64"})}
+
+
+class ReplayControls(unittest.TestCase):
+    def test_should_refuse_old_execution_uuid_or_counter_as_a_later_valid_46(self):
+        for flavor in ("arn", "request", "counter"):
+            with self.subTest(flavor=flavor), tempfile.TemporaryDirectory() as root:
+                states = ReplayedStates(flavor)
+                driver = Driver(None, states, None, None, "arm64", "lifecycle", root)
+                states.driver = driver
+                driver.business_counter = 1
+                driver.business_requests.append(str(uuid.uuid4()))
+                driver.execute_target(46)
+                with self.assertRaises(ValueError):
+                    driver.execute_target(46)
diff --git a/tests/workflows/test_pulumi_tools.py b/tests/workflows/test_pulumi_tools.py
new file mode 100644
index 00000000..ee5d4419
--- /dev/null
+++ b/tests/workflows/test_pulumi_tools.py
@@ -0,0 +1,179 @@
+"""Bounded artifact, provenance and cache controls; never executes downloaded code."""
+
+import gzip
+import hashlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import tarfile
+import tempfile
+import time
+import unittest
+from unittest.mock import patch
+
+
+SPEC = importlib.util.spec_from_file_location("pulumi_tools", Path(__file__).resolve().parent.parent / "lambda-fixtures" / "pulumi_tools.py")
+TOOLS = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(TOOLS)
+
+
+def elf(machine=183):
+    value = bytearray(64)
+    value[:6] = b"\x7fELF\x02\x01"
+    value[18:20] = machine.to_bytes(2, "little")
+    return bytes(value)
+
+
+def archive(root, label, entries):
+    raw = io.BytesIO()
+    with tarfile.open(fileobj=raw, mode="w", format=tarfile.USTAR_FORMAT) as out:
+        for name, value, kind in entries:
+            entry = tarfile.TarInfo(name)
+            entry.type = kind
+            entry.mode = 0o755
+            entry.size = len(value) if kind not in (tarfile.SYMTYPE, tarfile.LNKTYPE) else 0
+            if kind in (tarfile.SYMTYPE, tarfile.LNKTYPE):
+                entry.linkname = "outside"
+            out.addfile(entry, io.BytesIO(value))
+    path = root / (label + ".tar.gz")
+    path.write_bytes(gzip.compress(raw.getvalue()))
+    return path
+
+
+class PulumiToolControls(unittest.TestCase):
+    def observe(self, source, destination, architecture="arm64", selected=None):
+        return TOOLS.unpack(source, destination, selected or {"pulumi/pulumi": "bin/pulumi"}, architecture, time.monotonic() + 10)
+
+    def test_should_extract_only_expected_matching_architecture_executables(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = archive(root, "valid", [("pulumi/pulumi", elf(), tarfile.REGTYPE), ("pulumi/extra", b"ignored", tarfile.REGTYPE)])
+            result = self.observe(source, root / "out")
+            self.assertEqual(result, [{"path": "bin/pulumi", "sha256": hashlib.sha256(elf()).hexdigest(), "bytes": 64}])
+            self.assertEqual((root / "out/bin/pulumi").read_bytes(), elf())
+            self.assertFalse((root / "out/extra").exists())
+            self.assertEqual(self.observe(source, None), result)
+
+    def test_should_accept_only_the_zero_sized_archive_root_directory_spelling(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = archive(root, "root", [("./", b"", tarfile.DIRTYPE), ("./pulumi/pulumi", elf(), tarfile.REGTYPE)])
+            self.assertEqual(len(self.observe(source, root / "out")), 1)
+            for spelling in ("././", "../", "/"):
+                with self.subTest(spelling=spelling), self.assertRaises(TOOLS.ToolError):
+                    TOOLS.name(spelling, True)
+
+    def test_should_refuse_wrong_elf_architecture_before_publishing_tools(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = archive(root, "wrong", [("pulumi/pulumi", elf(62), tarfile.REGTYPE)])
+            with self.assertRaises(TOOLS.ToolError):
+                self.observe(source, root / "out")
+
+    def test_should_reject_linked_special_and_traversal_entries(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            for index, (name, kind) in enumerate([
+                ("pulumi/pulumi", tarfile.SYMTYPE), ("pulumi/pulumi", tarfile.LNKTYPE),
+                ("pulumi/pulumi", tarfile.FIFOTYPE), ("../pulumi", tarfile.REGTYPE),
+                ("/absolute", tarfile.REGTYPE), ("a/../pulumi", tarfile.REGTYPE), ("a\\pulumi", tarfile.REGTYPE),
+            ]):
+                with self.subTest(name=name, kind=kind):
+                    source = archive(root, str(index), [(name, elf(), kind)])
+                    with self.assertRaises(TOOLS.ToolError):
+                        self.observe(source, root / ("out" + str(index)))
+
+    def test_should_refuse_duplicate_missing_and_expired_selected_files(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            item = ("pulumi/pulumi", elf(), tarfile.REGTYPE)
+            for label, entries in [("duplicate", [item, item]), ("missing", [("other", elf(), tarfile.REGTYPE)])]:
+                with self.subTest(label=label), self.assertRaises(TOOLS.ToolError):
+                    self.observe(archive(root, label, entries), root / label)
+            source = archive(root, "expired", [item])
+            with self.assertRaises(TOOLS.ToolError):
+                TOOLS.unpack(source, root / "late", {"pulumi/pulumi": "bin/pulumi"}, "arm64", time.monotonic())
+
+    def test_should_bound_plain_expansion_and_pax_before_metadata_allocation(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = archive(root, "size", [("pulumi/pulumi", elf() * 32, tarfile.REGTYPE)])
+            with patch.object(TOOLS, "EXPANDED", 1024), self.assertRaises(TOOLS.ToolError):
+                self.observe(source, root / "out")
+            pax = archive(root, "pax", [("PaxHeaders/large", b"x" * 4097, tarfile.XHDTYPE)])
+            with self.assertRaises(TOOLS.ToolError):
+                self.observe(pax, root / "pax-out")
+            with self.assertRaises(TOOLS.ToolError):
+                TOOLS.pax(b"14 size=900000\n")
+
+    def test_should_reject_truncated_wrong_crc_and_nonzero_trailing_archives(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = archive(root, "source", [("pulumi/pulumi", elf(), tarfile.REGTYPE)])
+            encoded = source.read_bytes()
+            for label, data in [("truncated", encoded[:-4]), ("crc", encoded[:-8] + bytes(8)),
+                                ("trailing", gzip.compress(gzip.decompress(encoded) + b"not-padding"))]:
+                with self.subTest(label=label):
+                    broken = root / (label + ".gz")
+                    broken.write_bytes(data)
+                    with self.assertRaises((TOOLS.ToolError, EOFError, OSError)):
+                        self.observe(broken, root / label)
+
+    def test_should_anchor_cached_binary_hashes_to_verified_archive_bytes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            cli = archive(root, "cli", [(value, elf(), tarfile.REGTYPE) for value in TOOLS.SELECTED])
+            provider = archive(root, "aws", [("pulumi-resource-aws", elf(), tarfile.REGTYPE)])
+            destination = root / "installed"
+            def source(url, *unused):
+                return cli if "get.pulumi.com" in url else provider
+            with patch.object(TOOLS, "download", side_effect=source):
+                TOOLS.prepare(destination, "arm64")
+                manifest = destination / "manifest.json"
+                data = json.loads(manifest.read_bytes())
+                changed = elf()[:-1] + b"1"
+                (destination / "bin/pulumi").write_bytes(changed)
+                next(entry for entry in data["files"] if entry["path"] == "bin/pulumi")["sha256"] = hashlib.sha256(changed).hexdigest()
+                manifest.write_text(json.dumps(data))
+                with self.assertRaises(TOOLS.ToolError):
+                    TOOLS.prepare(destination, "arm64")
+
+    def test_should_reject_linked_cache_ancestors_even_for_unchanged_valid_bytes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            cli = archive(root, "cli", [(value, elf(), tarfile.REGTYPE) for value in TOOLS.SELECTED])
+            provider = archive(root, "aws", [("pulumi-resource-aws", elf(), tarfile.REGTYPE)])
+            destination = root / "installed"
+            with patch.object(TOOLS, "download", side_effect=lambda url, *args: cli if "get.pulumi.com" in url else provider):
+                TOOLS.prepare(destination, "arm64")
+                (destination / "bin").rename(root / "outside")
+                (destination / "bin").symlink_to(root / "outside", target_is_directory=True)
+                with self.assertRaises(TOOLS.ToolError):
+                    TOOLS.prepare(destination, "arm64")
+
+    def test_should_refuse_extra_linked_and_nonexecutable_cached_entries(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            cli = archive(root, "cli", [(value, elf(), tarfile.REGTYPE) for value in TOOLS.SELECTED])
+            provider = archive(root, "aws", [("pulumi-resource-aws", elf(), tarfile.REGTYPE)])
+            with patch.object(TOOLS, "download", side_effect=lambda url, *args: cli if "get.pulumi.com" in url else provider):
+                for kind in ("extra", "link", "mode", "directory"):
+                    with self.subTest(kind=kind):
+                        destination = root / kind
+                        TOOLS.prepare(destination, "arm64")
+                        if kind == "extra":
+                            with (destination / "unexpected").open("wb") as output:
+                                output.truncate(TOOLS.EXPANDED + 1)
+                        elif kind == "link":
+                            (destination / "unexpected").symlink_to(root / "outside")
+                        elif kind == "mode":
+                            (destination / "bin/pulumi").chmod(0o644)
+                        else:
+                            (destination / "unexpected").mkdir()
+                        with self.assertRaises(TOOLS.ToolError):
+                            TOOLS.prepare(destination, "arm64")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_release_image.py b/tests/workflows/test_release_image.py
new file mode 100644
index 00000000..0bfaa4c0
--- /dev/null
+++ b/tests/workflows/test_release_image.py
@@ -0,0 +1,271 @@
+"""Actual saved-graph and filesystem contract controls, without a daemon."""
+import gzip
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import struct
+import sys
+import tempfile
+import time
+import tarfile
+import unittest
+from unittest.mock import patch
+
+import release_image as subject
+
+
+# Independent literals from release-image design §3.3, not the verifier table.
+FILESYSTEM = {
+    "rustack": (0, 0, 0o755, "file"),
+    "etc": (0, 0, 0o755, "directory"),
+    "etc/ssl": (0, 0, 0o755, "directory"),
+    "etc/ssl/certs": (0, 0, 0o755, "directory"),
+    "etc/ssl/certs/ca-certificates.crt": (0, 0, 0o644, "file"),
+    "tmp": (65532, 65532, 0o1777, "directory"),
+    "data": (65532, 65532, 0o700, "directory"),
+    "run": (0, 0, 0o555, "directory"),
+    "run/rustack": (0, 0, 0o555, "directory"),
+    "run/rustack/docker.sock": (0, 0, 0o444, "file"),
+}
+ENVIRONMENT = ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+               "GATEWAY_LISTEN=0.0.0.0:4566", "LOG_LEVEL=info", "SERVICES="]
+
+
+def digest(raw):
+    return "sha256:" + hashlib.sha256(raw).hexdigest()
+
+
+def encoded(value):
+    return json.dumps(value, separators=(",", ":")).encode()
+
+
+def archive(rows):
+    output = io.BytesIO()
+    with tarfile.open(fileobj=output, mode="w", format=tarfile.USTAR_FORMAT) as saved:
+        for name, body, uid, gid, mode, kind in rows:
+            header = tarfile.TarInfo(name)
+            header.uid, header.gid, header.mode = uid, gid, mode
+            header.type = tarfile.DIRTYPE if kind == "directory" else tarfile.REGTYPE
+            header.size = len(body)
+            saved.addfile(header, io.BytesIO(body))
+    return output.getvalue()
+
+
+def physical(name, kind, body):
+    header = tarfile.TarInfo(name)
+    header.type, header.size, header.mode = kind, len(body), 0o644
+    return header.tobuf(format=tarfile.USTAR_FORMAT) + body + b"\0" * ((-len(body)) % 512)
+
+
+def pax(key, value):
+    payload = key + b"=" + value + b"\n"
+    size = len(payload) + 2
+    for _ in range(5):
+        line = str(size).encode() + b" " + payload
+        if len(line) == size:
+            return line
+        size = len(line)
+    raise AssertionError("fixture PAX length")
+
+
+def image(architecture="arm64", compressed=True, change=None, graph_id=True):
+    binary = bytearray(120)
+    binary[:7] = b"\x7fELF\x02\x01\x01"
+    struct.pack_into("<HHI", binary, 16, 2, {"arm64":183, "amd64":62}[architecture], 1)
+    struct.pack_into("<Q", binary, 32, 64)
+    struct.pack_into("<HH", binary, 54, 56, 1)
+    struct.pack_into("<I", binary, 64, 1)
+    rows = [(name, bytes(binary) if name == "rustack" else b"ca-fixture" if name.endswith(".crt") else b"",
+             uid, gid, mode, kind) for name,(uid,gid,mode,kind) in FILESYSTEM.items()]
+    health = dict(Test=["CMD", "/rustack", "--health-check"], Interval=2_000_000_000,
+                  Timeout=4_000_000_000, StartPeriod=1_000_000_000, Retries=3)
+    config = dict(architecture=architecture, os="linux", config=dict(User="65532:65532", WorkingDir="/data",
+        Entrypoint=["/rustack"], Env=list(ENVIRONMENT), Healthcheck=health),
+        rootfs=dict(type="layers", diff_ids=[]))
+    state = dict(rows=rows, config=config, layer_suffix=b"", outer_suffix=b"", diff=None)
+    if change:
+        change(state)
+    layer = state.get("layer_prefix", b"") + archive(state["rows"]) + state["layer_suffix"]
+    stored = gzip.compress(layer, mtime=0) if compressed else layer
+    if "stored_change" in state:
+        stored = state["stored_change"](stored)
+    config["rootfs"]["diff_ids"] = [state["diff"] or digest(layer)]
+    config_raw = encoded(config)
+    config_digest, layer_digest = digest(config_raw), digest(stored)
+    graph_raw = encoded(dict(schemaVersion=2, config=dict(digest=config_digest, size=len(config_raw)),
+                            layers=[dict(digest=layer_digest, size=len(stored))]))
+    graph_digest = digest(graph_raw)
+    path = lambda digest: "blobs/sha256/" + digest[7:]
+    manifest = encoded([dict(Config=path(config_digest), Layers=[path(layer_digest)], RepoTags=None)])
+    rows = [("blobs", b"", 0, 0, 0o755, "directory"),
+            ("blobs/sha256", b"", 0, 0, 0o755, "directory")]
+    rows += [(name, data, 0, 0, 0o644, "file") for name,data in
+             [("manifest.json",manifest),(path(config_digest),config_raw),
+              (path(layer_digest),stored),(path(graph_digest),graph_raw)]]
+    return archive(rows) + state["outer_suffix"], graph_digest if graph_id else config_digest
+
+
+def replace_row(state, name, **changes):
+    index = next(i for i,row in enumerate(state["rows"]) if row[0] == name)
+    values = dict(zip(("name", "body", "uid", "gid", "mode", "kind"), state["rows"][index]))
+    values.update(changes)
+    state["rows"][index] = tuple(values[key] for key in ("name", "body", "uid", "gid", "mode", "kind"))
+
+
+class ReleaseArtifactControls(unittest.TestCase):
+    def test_should_bind_both_elf_machines_gzip_plain_and_manifest_or_config_identity(self):
+        for architecture in ("arm64", "amd64"):
+            for compressed in (True, False):
+                for graph_id in (True, False):
+                    raw, identity = image(architecture, compressed, graph_id=graph_id)
+                    report = subject.verify(raw, architecture, identity)
+                    self.assertEqual(report["image"], identity)
+                    self.assertEqual(report["elfMachine"], {"arm64":183, "amd64":62}[architecture])
+                    self.assertFalse(report["elfInterpreter"])
+
+    def test_should_reject_actual_top_level_copy_mode_regression_and_wrong_ownership(self):
+        for name,changes in [("data", dict(mode=0o755)), ("tmp", dict(mode=0o755)),
+                             ("run", dict(mode=0o755)), ("data", dict(uid=0)),
+                             ("tmp", dict(gid=0)), ("run/rustack/docker.sock", dict(mode=0o666))]:
+            raw, identity = image(change=lambda state: replace_row(state, name, **changes))
+            with self.subTest(name=name,changes=changes), self.assertRaises(subject.ImageError):
+                subject.verify(raw, "arm64", identity)
+
+    def test_should_reject_extra_duplicate_unsafe_or_nonempty_directory_paths(self):
+        for name,body,kind in [("extra",b"unexpected","file"), ("tmp",b"","directory"),
+                               ("../outside",b"x","file"), ("/absolute",b"x","file"),
+                               ("empty",b"not-empty","directory")]:
+            raw, identity = image(change=lambda state: state["rows"].append((name,body,0,0,0o755,kind)))
+            with self.subTest(name=name), self.assertRaises(subject.ImageError):
+                subject.verify(raw, "arm64", identity)
+
+    def test_should_reject_changed_platform_program_headers_interpreter_and_executable(self):
+        def changed(state, offset, value):
+            binary = bytearray(state["rows"][0][1]);binary[offset:offset+len(value)] = value
+            replace_row(state, "rustack", body=bytes(binary))
+        for offset,value in [(18,struct.pack("<H",62)),(64,struct.pack("<I",3)),(0,b"nope"),
+                             (54,struct.pack("<H",0)),(56,struct.pack("<H",129))]:
+            raw, identity = image(change=lambda state: changed(state, offset, value))
+            with self.subTest(offset=offset), self.assertRaises(subject.ImageError):
+                subject.verify(raw, "arm64", identity)
+        raw, identity = image()
+        with self.assertRaises(subject.ImageError):
+            subject.verify(raw, "amd64", identity)
+
+    def test_should_reject_changed_image_user_command_health_and_credential_environment(self):
+        for key,value in [("User","0:0"),("Cmd",["shell"]),("Volumes",{"/extra":{}}),
+                          ("Env",ENVIRONMENT+["SECRET_KEY=must-not-appear"]),
+                          ("OnBuild",["RUN untrusted"])]:
+            raw, identity = image(change=lambda state: state["config"]["config"].update({key:value}))
+            with self.subTest(key=key), self.assertRaises(subject.ImageError):
+                subject.verify(raw, "arm64", identity)
+        for key,value in [("Test",["NONE"]),("Timeout",1),("StartInterval",False),("Retries",True)]:
+            raw, identity = image(change=lambda state: state["config"]["config"]["Healthcheck"].update({key:value}))
+            with self.subTest(key=key), self.assertRaises(subject.ImageError):
+                subject.verify(raw, "arm64", identity)
+
+    def test_should_reject_graph_and_layer_digest_substitution(self):
+        raw, identity = image()
+        with self.assertRaises(subject.ImageError):
+            subject.verify(raw, "arm64", digest(b"foreign"))
+        raw, identity = image(change=lambda state: state.update(diff=digest(b"wrong layer")))
+        with self.assertRaises(subject.ImageError):
+            subject.verify(raw, "arm64", identity)
+        altered = bytearray(raw)
+        # Modify payload while retaining a canonical checksum-valid outer tar header.
+        with tarfile.open(fileobj=io.BytesIO(raw),mode="r:") as saved:
+            member = next(m for m in saved if m.name.startswith("blobs/sha256/") and m.isfile())
+        altered[member.offset_data] ^= 1
+        with self.assertRaises(subject.ImageError):
+            subject.verify(bytes(altered), "arm64", identity)
+
+    def test_should_reject_truncated_and_concatenated_archives(self):
+        for change in (lambda state: state.update(layer_suffix=b"x"*512),
+                       lambda state: state.update(outer_suffix=b"x"*512)):
+            raw, identity = image(change=change)
+            with self.assertRaises(subject.ImageError):
+                subject.verify(raw, "arm64", identity)
+        raw, identity = image()
+        for truncated in (raw[:512],raw[:-1]):
+            with self.assertRaises(subject.ImageError):
+                subject.verify(truncated,"arm64",identity)
+
+    def test_should_bound_saved_and_expanded_bytes_before_acceptance(self):
+        raw, identity = image()
+        with patch.object(subject,"ARCHIVE_LIMIT",len(raw)-1), self.assertRaises(subject.ImageError):
+            subject.verify(raw,"arm64",identity)
+        raw, identity = image(change=lambda state: replace_row(state,"etc/ssl/certs/ca-certificates.crt",body=b"x"*65536))
+        with patch.object(subject,"EXPANDED_LIMIT",16384), self.assertRaises(subject.ImageError):
+            subject.verify(raw,"arm64",identity)
+
+    def test_should_normalize_truncated_gzip_and_crc_failures_without_tracebacks(self):
+        for change in (lambda raw: raw[:2], lambda raw: raw[:-4],
+                       lambda raw: raw[:-8] + bytes([raw[-8] ^ 1]) + raw[-7:],
+                       lambda raw: raw[:10] + b"\x07" + raw[-8:]):
+            raw, identity = image(change=lambda state: state.update(stored_change=change))
+            with self.assertRaises(subject.ImageError) as caught:
+                subject.verify(raw, "arm64", identity)
+            self.assertEqual(str(caught.exception), "image-archive-invalid")
+
+    def test_should_enforce_the_inherited_kernel_file_limit_during_child_output(self):
+        runner = subject.Runner({"PATH": os.defpath})
+        with tempfile.TemporaryDirectory() as name:
+            target = str(Path(name) / "limited")
+            writer = ("import os,errno; p=" + repr(target) + ";"
+                      "fd=os.open(p,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600);"
+                      "assert os.write(fd,b'x'*8192)==4096;\n"
+                      "try: os.write(fd,b'x')\n"
+                      "except OSError as error: assert error.errno==errno.EFBIG\n"
+                      "else: raise AssertionError('file bound missing')\n"
+                      "finally: os.close(fd)\n")
+            tools = str(Path(sys.modules[subject.document.__module__].__file__).parent)
+            code = ("import sys,os,time; sys.path[:0]="
+                    + repr([str(Path(subject.__file__).parent), tools])
+                    + ";import release_image as s;s.ARCHIVE_LIMIT=4096;s._limit_file_output();"
+                    "r=s.Runner({'PATH':os.defpath});reply=r.run("
+                    + repr([sys.executable,"-B","-c",writer])
+                    + ",time.monotonic()+3);assert reply.code==0;print('inherited bound enforced')")
+            reply = runner.run([sys.executable,"-B","-c",code],time.monotonic()+5)
+            self.assertEqual(reply.code,0)
+            self.assertEqual(reply.stdout,b"inherited bound enforced\n")
+            self.assertEqual(Path(target).stat().st_size,4096)
+
+    def test_should_accept_one_bounded_timing_pax_without_changing_member_identity(self):
+        prefix = physical("PaxHeaders.0/rustack",tarfile.XHDTYPE,pax(b"mtime",b"1.25"))
+        raw, identity = image(change=lambda state: state.update(layer_prefix=prefix))
+        report = subject.verify(raw,"arm64",identity)
+        self.assertEqual(report["filesystem"]["data"]["mode"],0o700)
+
+    def test_should_reject_hidden_gnu_global_or_chained_pax_before_normalized_iteration(self):
+        timing = pax(b"mtime",b"1")
+        prefixes = [physical("gnudata",tarfile.GNUTYPE_LONGNAME,b"rustack\0"),
+                    physical("gnulink",tarfile.GNUTYPE_LONGLINK,b"\0"),
+                    physical("global",tarfile.XGLTYPE,timing),
+                    physical("local-one",tarfile.XHDTYPE,timing)
+                    + physical("local-two",tarfile.XHDTYPE,pax(b"atime",b"1")),
+                    physical("local",tarfile.XHDTYPE,pax(b"path",b"rustack")),
+                    physical("large",tarfile.XHDTYPE,b"x"*2048)]
+        for prefix in prefixes:
+            raw, identity = image(change=lambda state: state.update(layer_prefix=prefix))
+            with self.subTest(kind=prefix[156:157]), self.assertRaises(subject.ImageError):
+                subject.verify(raw,"arm64",identity)
+        header = tarfile.TarInfo("huge")
+        header.size = 0x7fffffff
+        raw = header.tobuf(format=tarfile.USTAR_FORMAT) + b"\0"*1024
+        with self.assertRaises(subject.ImageError):
+            subject.Contents(raw,128)
+
+    def test_should_reject_links_devices_and_fifos_without_extraction(self):
+        for kind in (tarfile.SYMTYPE,tarfile.LNKTYPE,tarfile.CHRTYPE,tarfile.FIFOTYPE):
+            output=io.BytesIO()
+            with tarfile.open(fileobj=output,mode="w") as saved:
+                header=tarfile.TarInfo("target");header.type=kind;header.linkname="outside" if kind in (tarfile.SYMTYPE,tarfile.LNKTYPE) else ""
+                saved.addfile(header)
+            with self.subTest(kind=kind), self.assertRaises(subject.ImageError):
+                subject.Contents(output.getvalue(),128)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_release_qualification.py b/tests/workflows/test_release_qualification.py
new file mode 100644
index 00000000..ff750f7f
--- /dev/null
+++ b/tests/workflows/test_release_qualification.py
@@ -0,0 +1,409 @@
+"""Literal delivery controls; no daemon, network, build or publication."""
+import contextlib
+import copy
+import io
+import json
+import os
+from pathlib import Path
+import tarfile
+import tempfile
+import unittest
+from unittest.mock import Mock, patch
+
+import release_delivery as delivery
+import release_json
+import release_qualification as subject
+from rust_gates import GATES
+from settings import ActionError
+
+COMMIT, SEAL = "a" * 40, "b" * 64
+IMAGE = "sha256:" + "c" * 64
+OTHER = "sha256:" + "d" * 64
+ENGINE = "7bbe02f2-0571-42f9-a4a3-a36a81425357"
+
+
+def store(root, name, value):
+    path = root / name
+    path.parent.mkdir(parents=True, exist_ok=True)
+    raw = value if isinstance(value, bytes) else json.dumps(value, separators=(",", ":")).encode()
+    path.write_bytes(raw)
+    return {"path":name, "sha256":subject.digest(raw), "code":0, "groupJoined":True}
+
+
+def envelope(label):
+    return {"schemaVersion":1, "lane":label, "commit":COMMIT, "sourceSealSha256":SEAL,
+            "status":"passed", "allChildGroupsJoined":True, "tests":sorted(subject.expected_names(label)),
+            "receipts":[], "qualification":{}}
+
+
+def resource(mode="sdk-nested"):
+    return {"schemaVersion":1, "profile":"release", "mode":mode, "architecture":"arm64",
+        "server":{"id":"e" * 64, "engine":ENGINE, "source":IMAGE, "nonce":"f" * 32, "volume":"owned"},
+        "shutdown":{"id":"e" * 64, "engine":ENGINE, "physicallyStopped":True,
+                    "exitCode":0 if mode == "sdk-nested" else 1},
+        "cleanup":{"schemaVersion":1, "engine":ENGINE, "serverAbsent":True, "volumeAbsent":True,
+            "uncertain":False, "sourcesPreserved":[["release", IMAGE], ["sdk", OTHER], ["relay", OTHER]]}}
+
+
+def release_lane(root):
+    value = envelope("release")
+    modes = {"test_should_execute_image_sdk_and_nested_asl_from_the_release_image":"sdk-nested",
+             "test_should_refuse_unreachable_release_image_gateway_and_join_startup_cleanup":"gateway-rejection"}
+    for index, name in enumerate(value["tests"]):
+        raw = ("test " + name + " ... ok\nWORKFLOWS_RELEASE_RESOURCE " + json.dumps(resource(modes[name]))
+               + "\ntest result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.00s\n").encode()
+        value["receipts"].append(store(root, "release/case%d.log" % index, raw))
+    value["qualification"] = {"imageId":IMAGE, "zeroOwnedRemnants":True}
+    store(root, "release.json", value)
+    return value
+
+
+def rust_lane(root):
+    value = envelope("rust")
+    rows, intents = [], []
+    for name, argv in GATES:
+        log = b"" if name == "fmt" else b"Finished verification\ntest unrelated::resource ... ok\n"
+        if name in ("test", "feature-test", "doctest", "feature-doctest"):
+            log += b"test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s\n"
+        receipt = store(root, "rust/" + name + ".log", log)
+        value["receipts"].append(receipt)
+        rows.append({"name":name, "argv":argv, "code":0, "seconds":1, "logSha256":receipt["sha256"]})
+        intent = "rust/" + name + ".intent.json"
+        intents.append(intent)
+        value["receipts"].append(store(root, intent, {"argv":["/python", "-I", "-B", "/gate_command.py",
+                                                           "/evidence/" + name + ".log"] + argv, "cutoffMonotonic":100}))
+    value["receipts"].append(store(root, "rust/report.json", {"schemaVersion":1, "sourceSealSha256":SEAL,
+        "gates":rows, "allChildGroupsJoined":True}))
+    value["receipts"].append(store(root, "rust/entry.json", {"schemaVersion":1, "sourceSealSha256":SEAL,
+        "ownerPid":100, "gates":[{"name":name, "argv":argv} for name, argv in GATES]}))
+    value["qualification"] = {"gates":[name for name, _ in GATES], "report":"rust/report.json",
+                              "entry":"rust/entry.json", "intents":intents}
+    store(root, "rust.json", value)
+    return value
+
+
+def reference_lane(root):
+    from linux_performance import CASES
+    from linux_image_performance import CASES as IMAGE_CASES
+    from test_linux_performance import report as pure
+    from test_image_performance import warm, identities, logs
+    from image_performance_support import cold_stages, samples
+    warm_report = warm()
+    cold_report = copy.deepcopy(warm_report)
+    cold_report["phase"] = "cold"
+    names = identities()
+    cold_report["measurement"] = {"latency":samples([301] * 20, 20), "environments":names,
+        "uniqueContainers":40, "initialization":cold_stages(logs(names), names, [301] * 20)}
+    cycle_report = copy.deepcopy(warm_report)
+    cycle_report["phase"] = "cycles"
+    cycle_report["measurement"] = {"readiness":samples([10] * 100, 100), "timeout":samples([1000000] * 100, 100),
+        "floods":[{"requestId":"00000000-0000-0000-0000-%012x" % (index + 1), "beforeBytes":1024, "afterBytes":2048}
+                  for index in range(100)], "processStats":[{"rssKiB":10000,"tasks":8,"runtimeTasks":4}] * 100,
+        "completedCycles":100, "containerHighWater":2, "emptyAfterEachTimeout":True, "runtimeTaskBaseline":4,
+        "taskQuiescence":samples([100] * 100, 100), "liveBrackets":[[1,1,False]] * 100,
+        "primingInvocations":1, "primingCleanupConfirmed":True,
+        "controlChannels":{"prepared":100,"readyBeforeInvoke":100,"sameConnection":100,"closed":100}}
+    value = envelope("reference")
+    value["receipts"] = [
+        store(root, "reference/pure.json", {"processGroupsJoined":True,
+            "exactResourcesPassed":list(CASES),
+            "reports":[pure(), pure("loopResponsiveness")]}),
+        store(root, "reference/images.json", {"processGroupsJoined":True,"exactResourcesPassed":list(IMAGE_CASES),"reports":[warm_report,cold_report,cycle_report]})]
+    value["qualification"] = {"referenceQualification":"qualified", "os":"linux", "architecture":"arm64",
+        "physicalCpus":4, "exclusive":True, "pureP95Micros":95, "warmOverheadP95Micros":5000,
+        "coldEndToEndP95Micros":301, "loadCycles":100, "pureReport":"reference/pure.json", "imageReport":"reference/images.json"}
+    store(root, "reference.json", value)
+    return value
+
+
+def platform_lane(root, execution_engine=ENGINE):
+    from rootless_functional import SUITES
+    from docker_required_suites import parse_manifest
+    value = envelope("rootless-arm64")
+    manifest_raw = (subject.ROOT / "tests/workflows/docker-required-suites.json").read_bytes()
+    required = parse_manifest(manifest_raw)
+    rows, cases = [], []
+    for suite in SUITES:
+        for name in sorted(required[suite]):
+            directory = "platform/case-%03d" % (len(rows) + 1)
+            output = ("test " + name + " ... inherited SDK output\nok\ntest result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.00s\n").encode()
+            stdout = store(root, directory + "/stdout", output)
+            stderr = store(root, directory + "/stderr", b"")
+            arguments = ["cargo", "test", "--locked", "--target-dir", "/tmp/target"] + SUITES[suite]
+            arguments += ["--", "--ignored", "--exact", name, "--show-output", "--test-threads=1"]
+            intent = store(root, directory + "/intent.json", {"argv":arguments})
+            result = store(root, directory + "/result.json", {"code":0,"stdoutSha256":stdout["sha256"],"stderrSha256":stderr["sha256"]})
+            value["receipts"].extend([stdout,stderr,intent,result])
+            rows.append({"suite":suite,"name":name,"code":0,"evidence":"/original/" + Path(directory).name})
+            cases.append({"suite":suite,"name":name,"stdout":stdout["path"],"stderr":stderr["path"],
+                          "intent":intent["path"],"result":result["path"]})
+    value["receipts"].append(store(root, "platform/execution.json", {"schemaVersion":1,"engine":execution_engine,
+        "scope":"complete-functional-inventory","attempted":len(rows),"passed":len(rows),"failed":[],
+        "allChildGroupsJoined":True,"rows":rows}))
+    value["receipts"].append(store(root, "platform/entry.json", {"engine":execution_engine,"sourceSealSha256":SEAL,
+        "manifestSha256":subject.digest(manifest_raw), "environment":{"RUSTACK_RUNTIME_DOCKER_SOCKET":"/tmp/rootless.sock"},
+        "targetDirectory":"/tmp/target"}))
+    value["receipts"].append(store(root, "platform/platform.json", {"schemaVersion":1,"sourceSealSha256":SEAL,
+        "containersAbsent":True,"volumesAbsent":True,"privateAliasesAbsent":True,"allChildGroupsJoined":True,
+        "endpoint":"unix:///tmp/rootless.sock", "daemon":{"engineId":ENGINE,"os":"linux","architecture":"aarch64",
+        "operatingSystem":"Ubuntu","securityOptions":["name=rootless"]}}))
+    value["qualification"] = {"os":"linux","architecture":"arm64","engineId":ENGINE,"rootless":True,"desktop":False,
+        "zeroOwnedRemnants":True,"platformReport":"platform/platform.json","executionReport":"platform/execution.json",
+        "executionEntry":"platform/entry.json","caseReceipts":cases}
+    store(root, "platform.json", value)
+    return value
+
+
+def native_lane(root, adjustment=0, http_passes=1):
+    from native_gates import GATES as commands, DOUBLED, HTTP
+    value = envelope("native")
+    rows, intents = [], []
+    resource_names = subject.exact_names("required-suites.json")
+    lines = []
+    for name in sorted(resource_names - {HTTP}):
+        count = 2 if name in DOUBLED else 1
+        if name == DOUBLED[0]: count += adjustment
+        for _ in range(count):
+            lines.append("test " + name + " ... child output\nok")
+    lines += ["test " + HTTP + " ... inherited uv output\nok", "test result: ok. %d passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.00s" % http_passes]
+    bodies = {"native":("\n".join(lines) + "\n").encode(),
+        "action":b"test test_should_execute_actual_action_process_controls ... ok\ntest result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.00s\n"}
+    for name, argv in commands:
+        receipt = store(root, "recorded/" + name + ".log", bodies[name])
+        value["receipts"].append(receipt)
+        rows.append({"name":name,"argv":argv,"code":0,"seconds":1,"logSha256":receipt["sha256"]})
+        intent = "recorded/" + name + ".intent.json"
+        intents.append(intent)
+        value["receipts"].append(store(root, intent, {"argv":["/python","-I","-B","/gate_command.py","/recorded/" + name + ".log"] + argv}))
+    value["receipts"].append(store(root, "recorded/report.json", {"schemaVersion":1,"sourceSealSha256":SEAL,"gates":rows,"allChildGroupsJoined":True}))
+    value["receipts"].append(store(root, "recorded/entry.json", {"schemaVersion":1,"sourceSealSha256":SEAL,"gates":[{"name":name,"argv":argv} for name,argv in commands]}))
+    value["qualification"] = {"nativeChildrenJoined":True,"gates":[name for name,_ in commands],"report":"recorded/report.json","entry":"recorded/entry.json","intents":intents}
+    store(root, "native.json", value)
+    return value
+
+
+class ReleaseQualificationControls(unittest.TestCase):
+    def test_should_preserve_the_requested_envelope_path_and_hash_for_every_lane_branch(self):
+        factories = (("rust", "rust.json", rust_lane), ("native", "native.json", native_lane),
+                     ("reference", "reference.json", reference_lane),
+                     ("rootless-arm64", "platform.json", platform_lane),
+                     ("release", "release.json", release_lane))
+        for label, lane_path, factory in factories:
+            with self.subTest(label=label), tempfile.TemporaryDirectory() as temporary:
+                root = Path(temporary)
+                factory(root)
+                checked = subject.lane(root, lane_path, label, COMMIT, SEAL, {"arm64":IMAGE})
+                self.assertEqual(checked["path"], lane_path)
+                self.assertEqual(checked["sha256"], subject.digest((root / lane_path).read_bytes()))
+
+    def test_should_bind_both_actual_release_modes_to_the_candidate_and_cleanup(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            release_lane(root)
+            subject.lane(root, "release.json", "release", COMMIT, SEAL, {"arm64":IMAGE})
+            with self.assertRaises(ValueError):
+                subject.lane(root, "release.json", "release", COMMIT, SEAL, {"arm64":OTHER})
+            for field, changed in (("source", OTHER), ("id", "short")):
+                row = resource()
+                row["server"][field] = changed
+                with self.subTest(field=field), self.assertRaises(ValueError): subject.release_resource(row, IMAGE)
+            row = resource()
+            row["cleanup"]["uncertain"] = True
+            with self.assertRaises(ValueError): subject.release_resource(row, IMAGE)
+
+    def test_should_reject_A_consumer_evidence_even_when_envelope_claims_candidate_B(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            value = release_lane(root)
+            value["qualification"]["imageId"] = OTHER
+            store(root, "release.json", value)
+            with self.assertRaises(ValueError): subject.lane(root, "release.json", "release", COMMIT, SEAL, {"arm64":OTHER})
+
+    def test_should_require_rust_producer_intents_and_preserve_empty_fmt_log(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            value = rust_lane(root)
+            subject.lane(root, "rust.json", "rust", COMMIT, SEAL, {})
+            for mutation in ("missing-report", "unjoined", "wrong-source", "empty-log", "failed-command"):
+                changed = copy.deepcopy(value)
+                if mutation == "missing-report": changed["qualification"]["report"] = "missing.json"
+                elif mutation == "unjoined": changed["allChildGroupsJoined"] = False
+                elif mutation == "wrong-source": changed["sourceSealSha256"] = "0" * 64
+                elif mutation == "empty-log":
+                    changed["receipts"][0] = store(root, "rust/build.log", b"")
+                else: changed["receipts"][0]["code"] = 101
+                store(root, "rust.json", changed)
+                with self.subTest(mutation=mutation), self.assertRaises(ValueError):
+                    subject.lane(root, "rust.json", "rust", COMMIT, SEAL, {})
+                value = rust_lane(root)
+
+    def test_should_reject_missing_duplicate_or_changed_raw_resource_results(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            value = release_lane(root)
+            for mutation in ("missing", "duplicate", "failed", "hash"):
+                changed = copy.deepcopy(value)
+                if mutation == "missing": changed["receipts"].pop()
+                elif mutation == "duplicate": changed["receipts"].append(changed["receipts"][0])
+                elif mutation == "failed": changed["receipts"][0]["code"] = 101
+                else: changed["receipts"][0]["sha256"] = "0" * 64
+                store(root, "release.json", changed)
+                with self.subTest(mutation=mutation), self.assertRaises(ValueError):
+                    subject.lane(root, "release.json", "release", COMMIT, SEAL, {"arm64":IMAGE})
+
+    def test_should_reject_arbitrary_rust_log_names_without_producer_reports(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            value = envelope("rust")
+            value["receipts"] = [store(root, name + ".log", b"claimed success") for name, _ in GATES]
+            value["qualification"] = {"gates":[name for name, _ in GATES]}
+            store(root, "rust.json", value)
+            with self.assertRaises(ValueError): subject.lane(root, "rust.json", "rust", COMMIT, SEAL, {})
+
+    def test_should_validate_recorded_native_interleaving_and_exact_existing_stage_multiplicities(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            native_lane(root)
+            subject.lane(root, "native.json", "native", COMMIT, SEAL, {})
+            for adjustment in (-1, 1):
+                native_lane(root, adjustment=adjustment)
+                with self.subTest(adjustment=adjustment), self.assertRaises(ValueError):
+                    subject.lane(root, "native.json", "native", COMMIT, SEAL, {})
+            native_lane(root, http_passes=2)
+            with self.assertRaisesRegex(ValueError, "http-terminal"):
+                subject.lane(root, "native.json", "native", COMMIT, SEAL, {})
+
+    def test_should_bind_every_platform_case_to_the_same_executing_engine(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            platform_lane(root)
+            subject.lane(root, "platform.json", "rootless-arm64", COMMIT, SEAL, {})
+            platform_lane(root, "56b0fabd-452d-46a5-ac75-5b4063ab4061")
+            with self.assertRaisesRegex(ValueError, "execution-affiliation"):
+                subject.lane(root, "platform.json", "rootless-arm64", COMMIT, SEAL, {})
+
+    def test_should_reject_symlinks_absolute_paths_and_parent_traversal(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            store(root, "real", b"receipt")
+            (root / "link").symlink_to(root / "real")
+            for name in ("../real", "/real", "x//real", "link"):
+                with self.subTest(name=name), self.assertRaises(ValueError): subject.member(root, name, 1024)
+
+    def test_should_preflight_large_extensions_before_tarfile_can_allocate(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            path = Path(temporary) / "large.tar"
+            for kind in (tarfile.XHDTYPE, tarfile.GNUTYPE_LONGNAME):
+                header = tarfile.TarInfo("extension")
+                header.type, header.size = kind, 2 * 1024 * 1024
+                with path.open("wb") as output:
+                    output.write(header.tobuf())
+                    output.truncate(3 * 1024 * 1024)
+                with patch.object(tarfile, "open", side_effect=AssertionError("eager parser entered")), self.assertRaises(ValueError):
+                    subject.archive_identity(path, "arm64", IMAGE)
+
+    def test_should_match_archive_config_bytes_architecture_and_manifest_reference(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            path = Path(temporary) / "image.tar"
+            config = b'{"os":"linux","architecture":"arm64"}'
+            identity = "sha256:" + subject.digest(config)
+            with tarfile.open(path, "w") as archive:
+                for name, raw in (("config.json", config), ("manifest.json", b'[{"Config":"config.json","Layers":[]}]')):
+                    entry = tarfile.TarInfo(name); entry.size = len(raw)
+                    archive.addfile(entry, io.BytesIO(raw))
+            subject.archive_identity(path, "arm64", identity)
+            with self.assertRaises(ValueError): subject.archive_identity(path, "arm64", OTHER)
+            with self.assertRaises(ValueError): subject.archive_identity(path, "amd64", identity)
+
+    def test_should_recompute_reference_metrics_from_raw_producer_samples(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            value = reference_lane(root)
+            subject.lane(root, "reference.json", "reference", COMMIT, SEAL, {})
+            value["qualification"]["warmOverheadP95Micros"] = 1
+            store(root, "reference.json", value)
+            with self.assertRaisesRegex(ValueError, "summary-differs"):
+                subject.lane(root, "reference.json", "reference", COMMIT, SEAL, {})
+
+    def test_should_reject_missing_duplicate_or_reordered_reference_producer_names(self):
+        for name in ("pure", "images"):
+            for mutation in ("missing", "duplicate", "reordered"):
+                with self.subTest(name=name, mutation=mutation), tempfile.TemporaryDirectory() as temporary:
+                    root = Path(temporary)
+                    value = reference_lane(root)
+                    path = "reference/" + name + ".json"
+                    report = json.loads((root / path).read_bytes())
+                    original = report["exactResourcesPassed"]
+                    if mutation == "missing":
+                        report.pop("exactResourcesPassed")
+                    elif mutation == "duplicate":
+                        report["exactResourcesPassed"] = [original[0]] * len(original)
+                    else:
+                        report["exactResourcesPassed"] = list(reversed(original))
+                    receipt = store(root, path, report)
+                    value["receipts"] = [receipt if row["path"] == path else row for row in value["receipts"]]
+                    store(root, "reference.json", value)
+                    with self.assertRaisesRegex(ValueError, "producer"):
+                        subject.lane(root, "reference.json", "reference", COMMIT, SEAL, {})
+
+    def test_should_enforce_aggregate_lane_log_bytes_at_the_exact_boundary(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            value = release_lane(root)
+            total = sum((root / row["path"]).stat().st_size for row in value["receipts"])
+            with patch.object(subject, "LANE_LOG_BUDGET", total):
+                subject.lane(root, "release.json", "release", COMMIT, SEAL, {"arm64":IMAGE})
+            with patch.object(subject, "LANE_LOG_BUDGET", total - 1), self.assertRaisesRegex(ValueError, "log-budget"):
+                subject.lane(root, "release.json", "release", COMMIT, SEAL, {"arm64":IMAGE})
+
+    def test_should_reject_duplicate_deep_nonfinite_and_oversized_json(self):
+        for raw in (b'{"a":1,"a":2}', b'{"v":NaN}', b'[' * 17 + b'0' + b']' * 17,
+                    b'{"v":123456789012345678901}', b'"' + b'x' * 16385 + b'"'):
+            with self.assertRaises(ValueError): release_json.document(raw)
+
+    def test_should_scope_api_token_to_the_owned_gh_call_and_remove_it_on_failure(self):
+        owner = Mock(environment={"PATH":"/tools"})
+        def observe(arguments, deadline, stdout_limit):
+            self.assertEqual(owner.environment["GH_TOKEN"], "private-token")
+            self.assertNotIn("private-token", " ".join(arguments))
+            raise OSError("controlled failure")
+        owner.run.side_effect = observe
+        with patch.dict(os.environ, {"GH_TOKEN":"private-token"}), self.assertRaises(OSError):
+            delivery.authenticated_api(owner, "repos/owner/repo/actions/runs/1", 100)
+        self.assertEqual(owner.environment, {"PATH":"/tools"})
+
+    def test_should_emit_only_fixed_cli_errors_after_owned_command_retirement_failure(self):
+        import docker_functional
+        import image_refresh_build
+        import platform_receipt
+        import release_bundle
+        with tempfile.TemporaryDirectory() as temporary:
+            selected = Path(temporary)
+            cases = [(subject,"assemble",["program",temporary,str(selected / "report")]),
+                     (delivery,"verify",["program","verify",temporary]),
+                     (release_bundle,"pack",["program",temporary,str(selected / "copy")]),
+                     (docker_functional,"run",["program",str(selected / "config"),str(selected / "evidence")]),
+                     (platform_receipt,"run",["program","/tmp/socket",str(selected / "platform")]),
+                     (image_refresh_build,"run",["program",str(selected / "build"),"/tmp/socket","docker buildx"])]
+            for module, name, arguments in cases:
+                stderr = io.StringIO()
+                with self.subTest(module=module.__name__), patch.object(module.sys,"argv",arguments), \
+                     patch.object(module,name,side_effect=ActionError("controlled-retirement")), contextlib.redirect_stderr(stderr):
+                    self.assertEqual(module.main(), 2)
+                    self.assertNotIn("Traceback", stderr.getvalue())
+                    self.assertNotIn("controlled-retirement", stderr.getvalue())
+
+    def test_should_use_the_push_digest_and_reject_foreign_remote_config(self):
+        raw = json.dumps({"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json",
+                          "config":{"digest":IMAGE},"layers":[]}).encode()
+        digest = "sha256:" + subject.digest(raw)
+        pushed = ("tag: digest: " + digest + " size: 123\n").encode()
+        self.assertEqual(delivery.pushed_digest(pushed, b""), digest)
+        delivery.registry_manifest(raw, digest, IMAGE)
+        with self.assertRaises(ValueError): delivery.registry_manifest(raw, digest, OTHER)
+        with self.assertRaises(ValueError): delivery.registry_manifest(raw + b" ", digest, IMAGE)
+        with self.assertRaises(ValueError): delivery.pushed_digest(pushed + pushed, b"")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_required_suites.py b/tests/workflows/test_required_suites.py
new file mode 100644
index 00000000..65d88a04
--- /dev/null
+++ b/tests/workflows/test_required_suites.py
@@ -0,0 +1,125 @@
+"""Positive and drift/failure controls for exact resource qualification."""
+
+import copy
+import json
+import os
+from pathlib import Path
+import tempfile
+import unittest
+
+from required_suites import (
+    INVENTORY_LIMIT, MANIFEST_LIMIT, ManifestError, SUITES, parse_inventory,
+    parse_manifest, read_regular, verify,
+)
+
+
+def document():
+    return {
+        "schemaVersion": 1,
+        "profile": "rustack-standard-jsonpath-v1",
+        "qualification": "native-workflow-only",
+        "suites": [
+            {"id": "native-bridge", "tests": ["stepfunctions_bridge::tests::native::native_e2e_real"]},
+            {"id": "registered-sdk", "tests": ["test_should_use_real_sdk"]},
+            {"id": "typed-http-sdk", "tests": ["test_should_use_typed_http"]},
+        ],
+    }
+
+
+def encoded(value):
+    return json.dumps(value).encode()
+
+
+def listing(names):
+    return ("\n".join(name + ": test" for name in names)
+            + "\n\n" + str(len(names)) + " tests, 0 benchmarks\n").encode()
+
+
+class RequiredSuitesTests(unittest.TestCase):
+    def test_should_accept_complete_exact_inventories(self):
+        required = parse_manifest(encoded(document()))
+        inventories = {identity: listing(names) for identity, names in required.items()}
+        self.assertEqual(verify(required, inventories), 3)
+        actual = parse_manifest(read_regular(Path(__file__).with_name("required-suites.json"), MANIFEST_LIMIT))
+        self.assertEqual(set(actual), SUITES)
+
+    def test_should_reject_missing_renamed_extra_or_no_longer_ignored_cases(self):
+        required = parse_manifest(encoded(document()))
+        inventories = {identity: listing(names) for identity, names in required.items()}
+        for names in [[], ["renamed"], ["test_should_use_real_sdk", "unexpected"]]:
+            changed = dict(inventories, **{"registered-sdk": listing(names)})
+            with self.subTest(names=names), self.assertRaises(ManifestError):
+                verify(required, changed)
+        with self.assertRaises(ManifestError):
+            verify(required, {"registered-sdk": inventories["registered-sdk"]})
+
+    def test_should_reject_schema_profile_scope_and_field_drift(self):
+        changes = [
+            {"schemaVersion": True}, {"schemaVersion": 2}, {"profile": "other"},
+            {"qualification": "full-release"}, {"extra": 1}, {"suites": []},
+            {"suites": {}},
+        ]
+        for change in changes:
+            value = dict(document(), **change)
+            with self.subTest(change=change), self.assertRaises(ManifestError):
+                parse_manifest(encoded(value))
+        for value in [b"{", b"\xff", b"[]", encoded(document()).decode().encode("utf-16"), b'{' + b'"schemaVersion":1,' * 2 + b'"suites":[]}']:
+            with self.subTest(raw=value), self.assertRaises(ManifestError):
+                parse_manifest(value)
+
+    def test_should_reject_duplicate_unknown_and_unbounded_suite_members(self):
+        mutations = [
+            lambda value: value["suites"].append(copy.deepcopy(value["suites"][0])),
+            lambda value: value["suites"][0].update(id="other"),
+            lambda value: value["suites"][1].update(id="native-bridge"),
+            lambda value: value["suites"][0].update(extra=True),
+            lambda value: value["suites"][0].update(tests=["ordinary_case"]),
+            lambda value: value["suites"][1].update(tests=[]),
+            lambda value: value["suites"][1].update(tests=["same", "same"]),
+            lambda value: value["suites"][1].update(tests=["case"] * 129),
+            lambda value: value["suites"][1].update(tests=["a" * 257]),
+            lambda value: value["suites"][1].update(tests=["bad;command"]),
+            lambda value: value["suites"][1].update(tests=["café"]),
+            lambda value: value["suites"][1].update(tests=[7]),
+        ]
+        for index, mutate in enumerate(mutations):
+            value = document()
+            mutate(value)
+            with self.subTest(index=index), self.assertRaises(ManifestError):
+                parse_manifest(encoded(value))
+
+    def test_should_reject_forged_and_ambiguous_inventory_text(self):
+        for raw in [
+            b"", b"0 tests, 0 benchmarks", b"case: test\n2 tests, 0 benchmarks",
+            b"case: test\n1 test, 1 benchmark", b"case: test\ncase: test\n2 tests, 0 benchmarks",
+            b"case: test\n1 test, 0 benchmarks\nextra: test", b"unexpected line",
+            b"case: test\n", b"\xff", b"bad name: test\n1 test, 0 benchmarks",
+            b"case: test\n1 test, 0 benchmarks\n1 test, 0 benchmarks",
+            b"case: test\v1 test, 0 benchmarks",
+        ]:
+            with self.subTest(raw=raw), self.assertRaises(ManifestError):
+                parse_inventory(raw)
+        self.assertEqual(parse_inventory(b"case: test\n1 test, 0 benchmarks\n"), frozenset(["case"]))
+
+    def test_should_enforce_byte_limits_and_reject_nonregular_files(self):
+        for parse, maximum in [(parse_manifest, MANIFEST_LIMIT), (parse_inventory, INVENTORY_LIMIT)]:
+            with self.assertRaises(ManifestError):
+                parse(b" " * (maximum + 1))
+        with tempfile.TemporaryDirectory() as name:
+            root = Path(name)
+            regular = root / "regular"
+            regular.write_bytes(b"1234")
+            self.assertEqual(read_regular(regular, 4), b"1234")
+            with self.assertRaises(ManifestError):
+                read_regular(regular, 3)
+            link = root / "link"
+            link.symlink_to(regular)
+            fifo = root / "fifo"
+            os.mkfifo(fifo)
+            for path in [root, link, fifo, root / "missing"]:
+                with self.subTest(path=path.name), self.assertRaises(ManifestError):
+                    read_regular(path, 4)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_rootless_platform.py b/tests/workflows/test_rootless_platform.py
new file mode 100644
index 00000000..f57a06bd
--- /dev/null
+++ b/tests/workflows/test_rootless_platform.py
@@ -0,0 +1,404 @@
+"""Independent rootless identity/ownership negatives; no Docker or VM is used."""
+import os
+import json
+from pathlib import Path
+import socket
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest.mock import Mock, patch
+
+import rootless_platform as subject
+
+
+NONCE = "0123456789abcdef" * 2
+
+
+def report():
+    return {"schemaVersion": 1, "platformQualification": "pending", "uid": 501, "gid": 1000,
+            "namespaceSocketGid": 0,
+            "socket": {"path": "/run/user/501/docker.sock", "uid": 501, "gid": 1000,
+                       "mode": 0o660, "inode": 1234},
+            "serviceMainPid": 2020, "dockerdPid": 2021,
+            "uidMap": [[0, 501, 1], [1, 524288, 65536]],
+            "gidMap": [[0, 1000, 1], [1, 524288, 65536]],
+            "controllers": ["cpu", "cpuset", "io", "memory", "pids"],
+            "rootless": {"id": "first-engine", "os": "linux", "arch": "aarch64", "version": "29.5.2",
+                         "security": ["name=seccomp,profile=builtin", "name=rootless", "name=cgroupns"],
+                         "cgroupVersion": "2", "cgroupDriver": "systemd", "warnings": None},
+            "rootfulEngineId": "second-engine", "kernel": "6.8.0-117-generic",
+            "referenceQualification": "pending", "scriptSha256": subject.script_hash(), "nonce": NONCE,
+            "rootlessExtrasVersion": "5:29.5.2-1~ubuntu.24.04~noble",
+            "delegation": {kind: {"declared": ["cpu", "cpuset", "io", "memory", "pids"],
+                                  "available": ["cpu", "cpuset", "io", "memory", "pids"],
+                                  "enabled": ["cpu", "memory", "pids"] if kind == "manager" else [],
+                                  "controlUid": 501, "controlWritable": True} for kind in ("manager", "service")},
+            "packages": {"uidmap": "1:4.13+dfsg1", "dbus-user-session": "1.14.10-4ubuntu4.1",
+                         "slirp4netns": "1.2.1-1build2",
+                         "docker-ce-rootless-extras": "5:29.5.2-1~ubuntu.24.04~noble",
+                         "repositoryCandidate": "5:29.9.2-1~ubuntu.24.04~noble"}}
+
+
+class RootlessPlatformControls(unittest.TestCase):
+    def test_should_accept_literal_independent_identity_proof(self):
+        value = report()
+        self.assertEqual(subject.result_proof(value, NONCE), value)
+
+    def test_should_reject_rootful_masquerade_and_missing_resource_controls(self):
+        for key, replacement in (("security", ["name=seccomp"]), ("cgroupVersion", "1"),
+                                 ("cgroupDriver", "none"), ("warnings", ["No memory limit support"]),
+                                 ("arch", "x86_64"), ("os", "windows"), ("version", True)):
+            changed = report()
+            changed["rootless"][key] = replacement
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.result_proof(changed, NONCE)
+
+    def test_should_reject_missing_unknown_or_duplicate_receipt_fields(self):
+        for changed in ({}, dict(report(), unknown=1), {k: v for k, v in report().items() if k != "nonce"}):
+            with self.assertRaises(ValueError):
+                subject.result_proof(changed, NONCE)
+        with self.assertRaises(ValueError):
+            subject.document(b'{"schemaVersion":1,"schemaVersion":1}')
+
+    def test_should_reject_forged_process_socket_and_qualification_claims(self):
+        for key, value in (("uid", 0), ("uid", True), ("serviceMainPid", 0), ("dockerdPid", True),
+                           ("nonce", "0" * 32), ("scriptSha256", "0" * 64),
+                           ("platformQualification", "qualified"), ("referenceQualification", "qualified"),
+                           ("rootfulEngineId", "first-engine"), ("kernel", "kernel\nforged"),
+                           ("rootlessExtrasVersion", "5:29.9.2-1~ubuntu.24.04~noble")):
+            changed = dict(report(), **{key: value})
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.result_proof(changed, NONCE)
+        for key, value in (("uid", True), ("uid", 0), ("gid", True), ("mode", 0o666),
+                           ("inode", 0), ("path", "/var/run/docker.sock")):
+            changed = report()
+            changed["socket"][key] = value
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.result_proof(changed, NONCE)
+
+    def test_should_require_all_delegated_controllers_and_no_duplicates(self):
+        for value in (["memory", "pids"], ["cpu", "memory"], ["cpu", "memory", "pids", "pids"],
+                      ["cpu", "memory", True], ["pids", "memory", "cpu"]):
+            changed = dict(report(), controllers=value)
+            with self.assertRaises(ValueError):
+                subject.result_proof(changed, NONCE)
+
+    def test_should_reject_available_but_undelegated_or_unwritable_controllers(self):
+        for kind, key, value in (("manager", "enabled", ["memory", "pids"]),
+                                  ("manager", "declared", ["memory", "pids"]),
+                                  ("service", "declared", ["memory", "pids"]),
+                                  ("service", "controlUid", 0), ("manager", "controlWritable", False)):
+            changed = report()
+            changed["delegation"][kind][key] = value
+            with self.subTest(kind=kind, key=key), self.assertRaises(ValueError):
+                subject.result_proof(changed, NONCE)
+
+    def test_should_reject_identity_maps_root_mappings_and_unbounded_ranges(self):
+        for raw in (b"0 0 4294967295\n", b"0 0 1\n1 524288 65536\n", b"0 501 1\n1 5 65536\n",
+                    b"0 501 1\n1 524288 65535\n", b"0 501 1\n1 4294967295 65536\n",
+                    b"0 501 1\n1 524288 65536\n2 700000 1\n", b"0 x 1\n1 524288 65536\n"):
+            with self.subTest(raw=raw), self.assertRaises(ValueError):
+                subject.mappings(raw, 501)
+        self.assertEqual(subject.mappings(b"0 501 1\n1 524288 65536\n", 501),
+                         [[0, 501, 1], [1, 524288, 65536]])
+
+    def test_should_reject_boolean_or_wrong_uid_and_gid_map_receipts(self):
+        for key in ("uidMap", "gidMap"):
+            for value in ([[False, 501, 1], [1, 524288, 65536]], [[0, 0, 1], [1, 524288, 65536]], []):
+                changed = dict(report(), **{key: value})
+                with self.subTest(key=key), self.assertRaises(ValueError):
+                    subject.result_proof(changed, NONCE)
+
+    def test_should_require_every_process_uid_to_be_unprivileged_owner(self):
+        subject.process_uid(b"Name:\tdockerd\nUid:\t501\t501\t501\t501\n", 501)
+        for raw in (b"Uid:\t0 0 0 0\n", b"Uid:\t501 0 501 501\n", b"Uid:\t501 501 501\n",
+                    b"Uid:\t501 501 501 501\nUid:\t501 501 501 501\n", b"Name:\tdockerd\n"):
+            with self.assertRaises(ValueError):
+                subject.process_uid(raw, 501)
+
+    def test_should_pin_key_primary_fingerprint_and_exact_engine_version(self):
+        valid = b"pub:-:4096:1:key:0:0::-:::scSC:\nfpr:::::::::" + subject.KEY_FINGERPRINT.encode() + b":\n"
+        subject.key_fingerprint(valid)
+        for raw in (valid.replace(b"9DC8", b"0000"), valid + valid, b"fpr:::::::::" + subject.KEY_FINGERPRINT.encode()):
+            with self.assertRaises(ValueError):
+                subject.key_fingerprint(raw)
+        self.assertEqual(subject.version(b"29.5.2\n"), "29.5.2")
+        for raw in (b"29.5.2;unsafe", b"", b"29.5.2-dev", b"29.5"):
+            with self.assertRaises(ValueError):
+                subject.version(raw)
+
+    def test_should_reject_mismatched_installed_package_and_bad_candidate(self):
+        for key, value in (("docker-ce-rootless-extras", "5:29.9.2-1~ubuntu.24.04~noble"),
+                           ("repositoryCandidate", "(none)"), ("uidmap", "bad\nline")):
+            changed = report()
+            changed["packages"][key] = value
+            with self.assertRaises(ValueError):
+                subject.result_proof(changed, NONCE)
+
+    def test_should_bind_entry_to_profile_nonce_and_current_source(self):
+        valid = {"schemaVersion": 1, "profile": "rustack-workflows-rootless-arm64", "nonce": NONCE,
+                 "scriptSha256": subject.script_hash(), "targetDirectory": "/tmp/target"}
+        subject.entry(valid, valid["profile"])
+        for key, value in (("schemaVersion", True), ("profile", "rustack-workflows-arm64"),
+                           ("nonce", "../unsafe"), ("scriptSha256", "0" * 64), ("targetDirectory", "/tmp/../target")):
+            changed = dict(valid, **{key: value})
+            with self.assertRaises(ValueError):
+                subject.entry(changed, valid["profile"])
+
+    def test_should_refuse_existing_vm_before_creating_evidence_or_dispatch(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            selected = "rustack-workflows-rootless-arm64"
+            (root / ".colima" / selected).mkdir(parents=True)
+            evidence = root / "evidence"
+            owner = Mock()
+            with patch.object(subject.Path, "home", return_value=root), \
+                    patch.object(subject.sys, "platform", "darwin"), \
+                    patch.object(subject.platform, "machine", return_value="arm64"):
+                with self.assertRaisesRegex(ValueError, "existing-profile"):
+                    subject.host("provision", selected, str(root), str(evidence), owner, 100)
+            self.assertFalse(evidence.exists())
+            owner.run.assert_not_called()
+
+    def test_should_refuse_existing_guest_service_before_installing_packages(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            service = root / ".config/systemd/user/docker.service"
+            service.parent.mkdir(parents=True)
+            service.write_text("unrelated unit")
+            owner = Mock()
+            with patch.object(subject.Path, "home", return_value=root), \
+                    patch.object(subject, "guest_base", return_value=(501, root / "run", "tchen")):
+                with self.assertRaisesRegex(ValueError, "rootless-guest-not-fresh"):
+                    subject.guest_setup(NONCE, owner, 100)
+            self.assertEqual(service.read_text(), "unrelated unit")
+            owner.run.assert_not_called()
+
+    def test_should_keep_raw_command_receipts_and_refuse_nonzero_or_stderr(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            owner = Mock()
+            owner.run.return_value = SimpleNamespace(code=0, stdout=b"answer", stderr=b"")
+            command = subject.Commands(owner, 12345, Path(temporary))
+            with patch.object(subject.time, "monotonic", return_value=12300):
+                self.assertEqual(command.run(["fixed", "argument"], 10, clean=True), b"answer")
+            owner.run.assert_called_once_with(["fixed", "argument"], 12310, stdout_limit=65536)
+            self.assertEqual((Path(temporary) / "command-001.stdout").read_bytes(), b"answer")
+            owner.run.return_value = SimpleNamespace(code=0, stdout=b"", stderr=b"warning")
+            with self.assertRaises(ValueError):
+                command.run(["fixed"], clean=True)
+            owner.run.return_value = SimpleNamespace(code=1, stdout=b"", stderr=b"")
+            with self.assertRaises(ValueError):
+                command.run(["fixed"])
+
+    def test_should_independently_bound_privileged_service_cgroup_before_caller_cutoff(self):
+        owner = Mock()
+        owner.run.return_value = SimpleNamespace(code=0, stdout=b"", stderr=b"")
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        command = subject.Commands(owner, 1000, Path(temporary.name))
+        with patch.object(subject.time, "monotonic", return_value=500):
+            command.run(["sudo", "-n", "env", "DEBIAN_FRONTEND=noninteractive", "apt-get", "update"], 300)
+        arguments, cutoff = owner.run.call_args[0]
+        self.assertEqual(cutoff, 800)
+        self.assertEqual(arguments[:7], ["sudo", "-n", "systemd-run", "--quiet", "--wait", "--pipe", "--collect"])
+        for setting in ("RuntimeMaxSec=294s", "TimeoutStopSec=2s", "TimeoutStartSec=2s",
+                        "KillMode=control-group", "SendSIGKILL=yes", "Restart=no"):
+            self.assertIn("--property=" + setting, arguments)
+        self.assertEqual(arguments[-4:], ["/usr/bin/env", "DEBIAN_FRONTEND=noninteractive", "apt-get", "update"])
+        with patch.object(subject.time, "monotonic", return_value=995):
+            with self.assertRaisesRegex(ValueError, "rootless-privileged-command-budget"):
+                command.run(["sudo", "-n", "env", "apt-get", "update"], 300)
+
+    def test_should_persist_exact_privileged_intent_before_dispatch_and_preserve_on_lost_result(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            def interrupted(arguments, *_args, **_keywords):
+                intent = subject.document((root / "command-001.intent.json").read_bytes())
+                self.assertEqual(intent["argv"], arguments)
+                self.assertEqual(intent["ownerPid"], os.getpid())
+                self.assertTrue(any(item.startswith("--unit=rustack-d103-") for item in arguments))
+                raise OSError("lost SSH observation")
+            owner = Mock()
+            owner.run.side_effect = interrupted
+            command = subject.Commands(owner, 1000, root)
+            with patch.object(subject.time, "monotonic", return_value=500):
+                with self.assertRaises(OSError):
+                    command.run(["sudo", "-n", "install", "--version"])
+            self.assertTrue((root / "command-001.intent.json").is_file())
+            self.assertFalse((root / "command-001.json").exists())
+            self.assertEqual((root / "command-001.intent.json").stat().st_mode & 0o777, 0o600)
+
+    def test_should_refuse_privileged_effect_when_intent_io_consumes_retirement_slack(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            owner = Mock()
+            command = subject.Commands(owner, 1000, Path(temporary))
+            clock = [500]
+            publish = subject.publish
+            def delayed(path, value):
+                publish(path, value)
+                clock[0] += 2
+            with patch.object(subject.time, "monotonic", side_effect=lambda: clock[0]), \
+                    patch.object(subject, "publish", side_effect=delayed):
+                with self.assertRaisesRegex(ValueError, "rootless-privileged-intent-late"):
+                    command.run(["sudo", "-n", "install", "--version"])
+            owner.run.assert_not_called()
+
+    def test_should_refuse_fresh_setup_resumption_after_any_guest_entry(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            state = root / ".local/state/rustack-rootless-d103"
+            state.mkdir(parents=True)
+            with patch.object(subject.Path, "home", return_value=root), \
+                    patch.object(subject, "guest_base", return_value=(501, root / "run", "tchen")):
+                with self.assertRaisesRegex(ValueError, "rootless-guest-not-fresh"):
+                    subject.guest_fresh(NONCE)
+
+    def test_should_reject_replacing_system_key_or_repository_file(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            source, target = Path(temporary) / "source", Path(temporary) / "target"
+            source.write_bytes(b"expected")
+            target.write_bytes(b"unrelated")
+            commands = Mock()
+            with self.assertRaisesRegex(ValueError, "rootless-system-file-conflict"):
+                subject.install_file(commands, source, target, "0644")
+            self.assertEqual(target.read_bytes(), b"unrelated")
+            commands.run.assert_not_called()
+
+    def test_should_reuse_verified_canonical_repo_and_reject_conflicting_sources(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            sources = root / "sources"
+            sources.mkdir()
+            main, key = root / "main", root / "docker.asc"
+            key.write_bytes(b"public key")
+            key.chmod(0o644)
+            canonical = ("deb [arch=arm64 signed-by=" + str(key)
+                         + "] https://download.docker.com/linux/ubuntu noble stable\n")
+            source = sources / "docker.list"
+            source.write_text(canonical)
+            source.chmod(0o644)
+            commands = Mock()
+            commands.run.return_value = (b"pub:-:4096:1:key:0:0::-:::scSC:\nfpr:::::::::"
+                                         + subject.KEY_FINGERPRINT.encode() + b":\n")
+            original = os.lstat
+            def root_metadata(*arguments, **keywords):
+                value = original(*arguments, **keywords)
+                return SimpleNamespace(st_mode=value.st_mode, st_uid=0, st_size=value.st_size)
+            with patch.object(os, "lstat", side_effect=root_metadata):
+                self.assertTrue(subject.existing_repository(commands, sources, main, key))
+                duplicate = sources / "duplicate.list"
+                duplicate.write_text(canonical)
+                duplicate.chmod(0o644)
+                with self.assertRaisesRegex(ValueError, "rootless-existing-source-shape"):
+                    subject.existing_repository(commands, sources, main, key)
+                duplicate.unlink()
+                source.write_text(canonical.replace("noble stable", "noble test"))
+                with self.assertRaisesRegex(ValueError, "rootless-existing-source-shape"):
+                    subject.existing_repository(commands, sources, main, key)
+
+    def test_should_preserve_concurrent_publication_and_remove_only_private_temporary(self):
+        # Exercise the actual publication algorithm in a local directory. Only
+        # the fixed destination and root UID metadata are adapted for this test.
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            root.chmod(0o755)
+            source, target = root / "source", root / "target"
+            source.write_bytes(b"expected")
+            code = subject.SYSTEM_FILE_PUBLISHER.replace("/etc/apt/keyrings/rustack-d103-docker.asc", str(target))
+            original_lstat, original_fstat = os.lstat, os.fstat
+            def root_metadata(value):
+                return SimpleNamespace(st_mode=value.st_mode, st_uid=0, st_size=value.st_size)
+            def concurrent_link(*_arguments, **_keywords):
+                target.write_bytes(b"other publisher")
+                raise FileExistsError()
+            arguments = ["publisher", str(source), str(target),
+                         subject.hashlib.sha256(source.read_bytes()).hexdigest(), "0"]
+            with patch.object(subject.sys, "argv", arguments), \
+                    patch.object(os, "lstat", side_effect=lambda *a, **k: root_metadata(original_lstat(*a, **k))), \
+                    patch.object(os, "fstat", side_effect=lambda *a, **k: root_metadata(original_fstat(*a, **k))), \
+                    patch.object(os, "link", side_effect=concurrent_link):
+                with self.assertRaises(SystemExit) as error:
+                    exec(compile(code, "rootless-system-file-publisher", "exec"), {})
+            self.assertEqual(error.exception.code, 2)
+            self.assertEqual(target.read_bytes(), b"other publisher")
+            self.assertEqual(sorted(path.name for path in root.iterdir()), ["source", "target"])
+
+    def test_should_require_private_actual_socket_and_reject_symlink_or_world_access(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            endpoint = root / "docker.sock"
+            with socket.socket(socket.AF_UNIX) as channel:
+                channel.bind(str(endpoint))
+                endpoint.chmod(0o600)
+                self.assertEqual(subject.socket_proof(endpoint, os.getuid())["mode"], 0o600)
+                endpoint.chmod(0o666)
+                with self.assertRaises(ValueError):
+                    subject.socket_proof(endpoint, os.getuid())
+                endpoint.chmod(0o600)
+                alias = root / "alias"
+                alias.symlink_to(endpoint)
+                with self.assertRaises(ValueError):
+                    subject.socket_proof(alias, os.getuid())
+
+    def test_should_preserve_sticky_socket_mode_and_map_daemon_group_through_subgids(self):
+        value = report()
+        value["socket"].update(gid=525278, mode=0o1660)
+        value["namespaceSocketGid"] = 991
+        self.assertEqual(subject.result_proof(value, NONCE), value)
+        value["namespaceSocketGid"] = 525278
+        with self.assertRaisesRegex(ValueError, "rootless-socket-gid-map"):
+            subject.result_proof(value, NONCE)
+
+    def test_should_recover_only_complete_joined_install_proof_and_reject_missing_raw_or_live_job(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            state = root / ".local/state/rustack-rootless-d103"
+            state.mkdir(parents=True, mode=0o700)
+            historical = b"historical bootstrap source\n"
+            owner_hash = subject.hashlib.sha256(historical).hexdigest()
+            subject.write_new(state / "source.py", historical)
+            subject.publish(state / "entry.json", {"nonce": NONCE, "scriptSha256": owner_hash, "uid": 501})
+            subject.publish(state / "failure.json", {"nonce": NONCE, "outcome": "failed-profile-retained"})
+            value = report()
+            unit = "rustack-d103-" + "a" * 32 + "-001"
+            data = [( ["sudo", "-n", "systemd-run", "--unit=" + unit, "/usr/bin/env", "apt-get", "update"], b""),
+                    (["env", "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/501/bus", "dockerd-rootless-setuptool.sh", "install", "--force"], b""),
+                    (["docker", "--host", "unix:///run/user/501/docker.sock", "info", "--format", "fixed"], json.dumps(value["rootless"]).encode()),
+                    (["docker", "--host", "unix:///run/user/501/docker.sock", "info", "--format", "fixed"], json.dumps(value["rootless"]).encode()),
+                    (["docker", "--host", "unix:///var/run/docker.sock", "info", "--format", "{{.ID}}"], b"second-engine\n")]
+            for number, (arguments, raw) in enumerate(data, 1):
+                base = state / ("command-%03d" % number)
+                subject.publish(state / (base.name + ".intent.json"),
+                                {"argv": arguments, "callerCutoffMonotonic": 1000, "ownerPid": 999})
+                subject.publish(base.with_suffix(".json"), {"argv": arguments, "code": 0,
+                    "stdoutSha256": subject.hashlib.sha256(raw).hexdigest(),
+                    "stderrSha256": subject.hashlib.sha256(b"").hexdigest()})
+                subject.write_new(base.with_suffix(".stdout"), raw)
+                subject.write_new(base.with_suffix(".stderr"), b"")
+            commands = Mock()
+            commands.run.return_value = b""
+            original_lstat = os.lstat
+            def metadata(*arguments, **keywords):
+                stat = original_lstat(*arguments, **keywords)
+                return SimpleNamespace(st_mode=stat.st_mode, st_uid=501, st_size=stat.st_size)
+            with patch.object(subject.Path, "home", return_value=root), \
+                    patch.object(subject, "guest_base", return_value=(501, Path("/run/user/501"), "tchen")), \
+                    patch.object(os, "lstat", side_effect=metadata), \
+                    patch.object(subject, "guest_attest", side_effect=lambda _commands: report()):
+                self.assertEqual(subject.guest_recover(NONCE, owner_hash, commands), report())
+                commands.run.return_value = b"exact service still active\n"
+                with self.assertRaisesRegex(ValueError, "rootless-recovery-job-not-retired"):
+                    subject.guest_recover(NONCE, owner_hash, commands)
+                commands.run.return_value = b""
+                raw_path = state / "command-001.stdout"
+                raw_path.write_bytes(b"changed")
+                with self.assertRaisesRegex(ValueError, "rootless-recovery-raw-command"):
+                    subject.guest_recover(NONCE, owner_hash, commands)
+                raw_path.write_bytes(b"")
+                (state / "command-001.intent.json").unlink()
+                with self.assertRaisesRegex(ValueError, "rootless-recovery-command-sequence"):
+                    subject.guest_recover(NONCE, owner_hash, commands)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_rootless_resources.py b/tests/workflows/test_rootless_resources.py
new file mode 100644
index 00000000..377bd47f
--- /dev/null
+++ b/tests/workflows/test_rootless_resources.py
@@ -0,0 +1,263 @@
+"""Rootless resource guard controls without Docker, SSH or Cargo execution."""
+import copy
+import os
+from pathlib import Path
+import socket
+import tempfile
+import unittest
+from unittest.mock import Mock, patch
+from types import SimpleNamespace
+
+import rootless_resources as subject
+import rootless_functional as functional
+
+
+ENGINE = "7bbe02f2-0571-42f9-a4a3-a36a81425357"
+NONCE = "a" * 32
+
+
+def network():
+    return [{"Id": "f" * 64, "Name": "rustack-rootless-d104-" + NONCE[:12], "Driver": "bridge",
+             "Scope": "local", "Internal": False, "Labels": {subject.LABEL: NONCE}, "Containers": {},
+             "IPAM": {"Driver": "default", "Config": [{"Subnet": "172.18.0.0/16", "Gateway": "172.18.0.1"}]}}]
+
+
+def images():
+    rows = []
+    for index, name in enumerate(subject.SOURCES):
+        identity = "sha256:" + str(index) * 64
+        rows.append({"name": name, "image": {"id": identity, "os": "linux", "architecture": "arm64", "bytes": 100},
+                     "archive": "/tmp/image-%d.tar" % index, "bytes": 1024, "sha256": "c" * 64,
+                     "cacheAlias": "rustack-workflows-cache:d102-" + str(index) * 64})
+    return {"engine": ENGINE, "sourceEngine": "56b0fabd-452d-46a5-ac75-5b4063ab4061",
+            "sourceSocket": "/tmp/source.sock", "sourceIds": ["sha256:" + "0" * 64], "images": rows, "selection": "kernel"}
+
+
+def output(names):
+    return ("\n".join("test " + name + " ... ok" for name in names)
+            + "\ntest result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s\n").encode()
+
+
+class RootlessResourceControls(unittest.TestCase):
+    def test_should_promote_only_the_exact_receipted_old_target_and_preserve_foreign_tags(self):
+        old, new, foreign = ("sha256:" + character * 64 for character in "abc")
+        self.assertTrue(subject.tag_policy((old + "\n").encode(), new, old))
+        self.assertFalse(subject.tag_policy((new + "\n").encode(), new, old))
+        self.assertTrue(subject.tag_policy(b"", new))
+        for present, previous in ((b"", old), ((foreign + "\n").encode(), old), ((old + "\n").encode(), None)):
+            with self.assertRaises(ValueError): subject.tag_policy(present, new, previous)
+
+    def test_should_reject_reused_forward_pid_or_different_process_owner(self):
+        expected = {"start": "Sat Oct 31 15:00:00 2026", "uid": os.getuid()}
+        subject.require_process_identity(expected, expected.copy())
+        with self.assertRaises(ValueError):
+            subject.require_process_identity(expected, dict(expected, start="Sat Oct 31 15:01:00 2026"))
+        with self.assertRaises(ValueError):
+            subject.require_process_identity(expected, dict(expected, uid=os.getuid() + 1))
+
+    def test_should_charge_delayed_forward_observation_to_its_original_cutoff(self):
+        self.assertEqual(functional.observation_budget(100, 2700, 110), 2690)
+        with self.assertRaises(ValueError):
+            functional.observation_budget(100, 1205, 110)
+
+    def test_should_detect_changed_python_consumer_and_local_artifact(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            consumer = root / "tests/workflows/consumer.py"
+            consumer.parent.mkdir(parents=True)
+            consumer.write_bytes(b"first consumer")
+            with patch.object(functional, "ROOT", root), patch.object(functional, "source_paths", return_value={consumer}):
+                before = functional.source_seal(Mock(), 1000)
+                consumer.write_bytes(b"changed consumer")
+                self.assertNotEqual(functional.source_seal(Mock(), 1000), before)
+            for part in ("provided/provided-a.zip", "provided/provided-b.zip", "zip-code-bootstrap/bootstrap",
+                         "native-verifier/rustack-lambda-runtime-verifier/bootstrap", "sdk-python"):
+                path = root / part
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(b"original artifact")
+            before = functional.artifact_seal(root, root / "sdk-python")
+            (root / "provided/provided-a.zip").write_bytes(b"changed artifact")
+            self.assertNotEqual(functional.artifact_seal(root, root / "sdk-python"), before)
+
+    def test_should_retain_large_source_inventory_in_bounded_complete_shards(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            values = {"crates/example/src/file_%04d.rs" % index: "%064x" % index for index in range(1000)}
+            proof = functional.retain_source_seal(root, values)
+            restored = {}
+            for name in proof["sourceSealFiles"]:
+                raw = (root / name).read_bytes()
+                self.assertLessEqual(len(raw), 65536)
+                restored.update(subject.document(raw))
+            self.assertEqual(restored, values)
+            self.assertEqual(len(proof["sourceSealFiles"]), 8)
+
+    def test_should_use_kernel_elapsed_age_without_comparing_process_local_monotonic_epochs(self):
+        self.assertEqual(functional.forward_remaining(b" 00:10\n"), 3587)
+        self.assertEqual(functional.forward_remaining(b" 10:00\n"), 2997)
+        for raw in (b"01:00:00", b"39:57", b"00:60", b"bad", b"1-00:00:00"):
+            with self.assertRaises(ValueError):
+                functional.forward_remaining(raw)
+
+    def test_should_preserve_failed_resource_exit_and_raw_streams_after_join(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            owner = Mock()
+            owner.run.return_value = SimpleNamespace(code=101, stdout=b"2 failed", stderr=b"CPU mismatch")
+            root = Path(temporary)
+            result = functional.run_case(owner, ["cargo", "test", "--exact", "fixed"], 1000, root)
+            self.assertEqual(result.code, 101)
+            self.assertEqual((root / "stdout").read_bytes(), b"2 failed")
+            self.assertEqual((root / "stderr").read_bytes(), b"CPU mismatch")
+            self.assertEqual(subject.document((root / "result.json").read_bytes())["code"], 101)
+
+    def test_should_use_mapped_server_gid_and_only_fixed_fixture_environment(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            for part in ("provided/provided-a.zip", "provided/provided-b.zip", "zip-code-bootstrap/bootstrap",
+                         "native-verifier/rustack-lambda-runtime-verifier/bootstrap", "sdk-python"):
+                path = root / part
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(b"fixture")
+            proof = {"socket": {"path": "/run/user/501/docker.sock", "gid": 525278}, "namespaceSocketGid": 991}
+            with patch.object(functional.shutil, "which", return_value="/usr/bin/docker"):
+                value = functional.environment(proof, "unix:///tmp/owned.sock", {"name": "owned-bridge"},
+                                               root, root / "sdk-python", Path("/tmp/other.sock"))
+            self.assertEqual(value["RUSTACK_SERVER_SOCKET_GID"], "991")
+            self.assertEqual(value["RUSTACK_SERVER_DAEMON_SOCKET"], "/run/user/501/docker.sock")
+            self.assertEqual(value["RUSTACK_ZIP_BASE_IMAGE"], subject.FULL_SOURCES[7])
+            self.assertEqual(value["RUSTACK_PULL_IMAGE"], subject.FULL_SOURCES[8])
+            self.assertNotIn("AWS_SECRET_ACCESS_KEY", value)
+
+    def test_should_bind_every_manifest_suite_to_fixed_source_owned_cargo_target(self):
+        required = functional.parse_manifest((Path(__file__).parent / "docker-required-suites.json").read_bytes())
+        self.assertEqual(set(functional.SUITES), set(required))
+        self.assertEqual(sum(len(names) for names in required.values()), 83)
+        self.assertEqual(functional.SUITES["docker-probe"], ["-p", "rustack-lambda-core", "--test", "docker_probe"])
+
+    def test_should_reject_private_aliases_in_all_default_hub_spellings(self):
+        subject.private_aliases(b"rustack-workflows-cache:d102-abc\n<none>:<none>\n")
+        for prefix in ("", "docker.io/", "index.docker.io/", "docker.io/library/", "index.docker.io/library/", "library/"):
+            for name in ("rustack-internal/lambda-install:pin", "rustack-test-source:fixture"):
+                with self.subTest(prefix=prefix, name=name), self.assertRaises(ValueError):
+                    subject.private_aliases((prefix + name + "\n").encode())
+
+    def test_should_require_exact_full_fixture_set_and_only_declared_negative_platforms(self):
+        value = images()
+        value.update(selection="full", images=[])
+        self.assertEqual(len(set(subject.FULL_SOURCES)), 15)
+        for index, name in enumerate(subject.FULL_SOURCES):
+            row = copy.deepcopy(images()["images"][0])
+            row.update(name=name, archive="/tmp/image-%d.tar" % index)
+            row["image"]["id"] = "sha256:" + ("%064x" % index)
+            row["cacheAlias"] = "rustack-workflows-cache:d102-" + ("%064x" % index)
+            if name == "rustack-invalid-os:arm64":
+                row["image"].update(os="windows", architecture="amd64")
+            if name == "rustack-invalid-architecture:arm64":
+                row["image"].update(architecture="amd64")
+            value["images"].append(row)
+        self.assertEqual(subject.image_receipt(value, ENGINE), value)
+        value["images"][0]["image"]["os"] = "windows"
+        with self.assertRaises(ValueError):
+            subject.image_receipt(value, ENGINE)
+
+    def test_should_accept_exact_distinct_success_rows_and_reject_forged_or_ignored_results(self):
+        names = {"probe::case_1_disconnected", "probe::case_2_operator_bridge"}
+        raw = output(sorted(names))
+        subject.verify_output(raw, names)
+        subject.verify_output(raw.replace(b" ... ok", b" ... inherited SDK output\nok"), names)
+        for changed in (raw.replace(b"2 passed", b"0 passed"), raw.replace(b"0 ignored", b"1 ignored"),
+                        raw.replace(b"case_1_disconnected", b"case_2_operator_bridge"),
+                        raw.replace(b"case_1_disconnected", b"case_3_extra"), raw + raw,
+                        raw.replace(b" ... ok", b" ... ignored"),
+                        raw + b"test unrelated ... FAILED\n", raw.replace(b"test probe::case_1", b"probe::case_1")):
+            with self.assertRaises(ValueError):
+                subject.verify_output(changed, names)
+
+    def test_should_observe_cleanup_even_when_a_successful_child_transcript_is_rejected(self):
+        from functional_inventory import execute
+        owner, observe = Mock(), Mock()
+        run = Mock(side_effect=[SimpleNamespace(code=0, stdout=b"sample: test\n1 test, 0 benchmarks\n"),
+                                SimpleNamespace(code=0, stdout=b"malformed transcript")])
+        verify = Mock(side_effect=ValueError("invalid transcript"))
+        with tempfile.TemporaryDirectory() as temporary:
+            with self.assertRaisesRegex(ValueError, "invalid transcript"):
+                execute(owner, ["cargo"], {"suite":[]}, {"suite":{"sample"}}, {"suite":{"sample"}},
+                        Path(temporary), 100, run, verify, observe)
+            observe.assert_called_once_with(Path(temporary) / "case-001")
+
+    def test_should_accept_owned_empty_bridge_and_reject_foreign_or_attached_network(self):
+        value = network()
+        name = value[0]["Name"]
+        self.assertEqual(subject.network(value, name, NONCE), value[0])
+        for key, replacement in (("Labels", {}), ("Id", "f" * 63), ("Name", "foreign"),
+                                 ("Driver", "host"), ("Scope", "swarm"), ("Internal", True),
+                                 ("Containers", {"container": {}}), ("IPAM", {"Config": []})):
+            changed = copy.deepcopy(value)
+            changed[0][key] = replacement
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.network(changed, name, NONCE)
+
+    def test_should_accept_bounded_image_receipt_and_reject_engine_or_inventory_changes(self):
+        value = images()
+        self.assertEqual(subject.image_receipt(value, ENGINE), value)
+        for key, replacement in (("engine", "other"), ("sourceEngine", ENGINE), ("sourceSocket", "/tmp/../socket"),
+                                 ("sourceIds", ["bad"]), ("images", [])):
+            changed = dict(value, **{key: replacement})
+            with self.subTest(key=key), self.assertRaises((ValueError, subject.ActionError)):
+                subject.image_receipt(changed, ENGINE)
+
+    def test_should_reject_wrong_tag_platform_cache_archive_and_bool_sizes(self):
+        for key, replacement in (("name", "foreign"), ("bytes", True), ("bytes", subject.LIMIT + 1),
+                                 ("archive", "/tmp/../escape"), ("sha256", "f" * 63),
+                                 ("cacheAlias", "foreign:tag")):
+            changed = images()
+            changed["images"][0][key] = replacement
+            with self.subTest(key=key), self.assertRaises(ValueError):
+                subject.image_receipt(changed, ENGINE)
+        for key, replacement in (("os", "windows"), ("architecture", "amd64"), ("bytes", 0), ("id", "bad")):
+            changed = images()
+            changed["images"][0]["image"][key] = replacement
+            with self.assertRaises((ValueError, subject.ActionError)):
+                subject.image_receipt(changed, ENGINE)
+
+    def test_should_reject_preexisting_forward_directory_without_dispatch(self):
+        with tempfile.TemporaryDirectory(prefix="rootless-test-", dir="/tmp") as temporary:
+            owner = Mock()
+            with self.assertRaisesRegex(ValueError, "resource-forward-directory-exists"):
+                subject.forward({"profile": "rustack-workflows-rootless-arm64-v2"}, temporary, owner, 100)
+            owner.run.assert_not_called()
+
+    def test_should_reject_socket_substitution_and_path_exhaustion(self):
+        with tempfile.TemporaryDirectory(prefix="rootless-test-", dir="/tmp") as temporary:
+            root = Path(temporary)
+            path = root / "docker.sock"
+            with socket.socket(socket.AF_UNIX) as channel:
+                channel.bind(str(path))
+                path.chmod(0o600)
+                observed = subject.socket_metadata(path)
+                self.assertEqual(observed["uid"], os.getuid())
+                alias = root / "alias"
+                alias.symlink_to(path)
+                with self.assertRaises(ValueError):
+                    subject.socket_metadata(alias)
+                path.chmod(0o666)
+                with self.assertRaises(ValueError):
+                    subject.socket_metadata(path)
+            with self.assertRaises(ValueError):
+                subject.socket_metadata(root / ("x" * 101))
+
+    def test_should_refuse_stale_forward_owner_before_connecting_to_daemon(self):
+        with tempfile.TemporaryDirectory(prefix="rootless-test-", dir="/tmp") as temporary:
+            root = Path(temporary)
+            subject.bootstrap.publish(root / "entry.json", {"profile": "rustack-workflows-rootless-arm64-v2",
+                "engine": ENGINE, "ownerPid": os.getpid(), "nonce": NONCE,
+                "scriptSha256": "0" * 64, "socket": str(root / "docker.sock")})
+            owner = Mock()
+            with self.assertRaisesRegex(ValueError, "resource-forward-owner"):
+                subject.connection(str(root), {"profile": "rustack-workflows-rootless-arm64-v2",
+                                              "rootless": {"id": ENGINE}}, owner, 100)
+            owner.run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_server_container_import.py b/tests/workflows/test_server_container_import.py
new file mode 100644
index 00000000..efd06add
--- /dev/null
+++ b/tests/workflows/test_server_container_import.py
@@ -0,0 +1,56 @@
+"""Importing a consumer must not parse CLI arguments or construct SDK clients."""
+import importlib.util
+import io
+from pathlib import Path
+import sys
+import unittest
+from unittest.mock import patch
+
+import server_container_sdk
+
+
+class ServerContainerImportControls(unittest.TestCase):
+    def test_should_compare_actual_image_ids_without_widening_private_alias_observation(self):
+        pair = {"function": "a" * 64, "relay": "b" * 64}
+        sources = {"function": "sha256:" + "c" * 64, "relay": "sha256:" + "d" * 64}
+        name, network = "ServerSdkControl", "e" * 64
+        views = {}
+        for role, cid in pair.items():
+            views["/containers/" + cid + "/json"] = {
+                "Id": cid, "Image": sources[role], "State": {"Running": True},
+                "Config": {"Image": "private-alias" if role == "function" else sources[role],
+                           "Env": ["AWS_LAMBDA_FUNCTION_NAME=" + name]},
+                "HostConfig": {"ReadonlyRootfs": True, "Privileged": False, "PublishAllPorts": False,
+                               "NetworkMode": "container:" + pair["relay"] if role == "function" else network},
+                "Mounts": [{"Type": "tmpfs", "Destination": "/tmp"}]}
+        class Metadata:
+            def get(self, path):
+                return views[path]  # Non-container paths cannot escape this independent reader.
+        def observe():
+            return server_container_sdk.environment(Metadata(), "gateway", None, name,
+                sources["function"], sources["relay"], network)
+        with patch.object(server_container_sdk, "inspect_sdk_origin", return_value=pair):
+            self.assertEqual(observe(), pair)
+            for role, cid in pair.items():
+                view = views["/containers/" + cid + "/json"]
+                view["Image"] = "sha256:" + "f" * 64
+                with self.assertRaises(AssertionError):
+                    observe()
+                view["Image"] = sources[role]
+
+    def test_should_import_the_consumer_without_argv_or_sdk_side_effects(self):
+        source = Path(__file__).with_name("server_container_sdk.py")
+        specification = importlib.util.spec_from_file_location("server_container_import_control", source)
+        module = importlib.util.module_from_spec(specification)
+        output = io.StringIO()
+        with patch.object(sys, "argv", ["import-control", "deliberately-not-cli-arguments"]), \
+             patch.object(sys, "stdout", output), \
+             patch("boto3.client", side_effect=AssertionError("client created during import")) as client:
+            specification.loader.exec_module(module)
+        self.assertTrue(callable(module.exercise))
+        self.assertEqual(output.getvalue(), "")
+        client.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_server_container_oracle.py b/tests/workflows/test_server_container_oracle.py
new file mode 100644
index 00000000..c6874d8e
--- /dev/null
+++ b/tests/workflows/test_server_container_oracle.py
@@ -0,0 +1,52 @@
+"""A stale computation, environment or public host origin cannot qualify."""
+import unittest
+
+from server_container_oracle import failure_origin, internal_origin, result, warm
+
+
+class ServerContainerOracleControls(unittest.TestCase):
+    def test_should_project_only_bounded_allowlisted_source_coordinates(self):
+        try:
+            result({}, 50, 3, "arm64")
+        except AssertionError as error:
+            self.assertRegex(failure_origin(error), r"^server_container_oracle\.py:[1-9][0-9]{0,3}$")
+        try:
+            exec(compile("raise ValueError('local-secret')", "credential-bearing-path.py", "exec"))
+        except ValueError as error:
+            self.assertEqual(failure_origin(error), "unknown")
+        self.assertEqual(failure_origin(ValueError("local-secret")), "unknown")
+
+    def output(self):
+        return {"computed": 50, "counter": 3, "versions": {"s3": "3.1105.0", "dynamodb": "3.1105.0"},
+                "selectorsCleared": True, "nodeVersion": "24.22.1", "architecture": "arm64"}
+
+    def test_should_require_the_literal_fresh_computation_counter_and_sdk_cohort(self):
+        result(self.output(), 50, 3, "arm64")
+        for changes in ({"computed": 46}, {"counter": 2}, {"computed": True}, {"counter": True},
+                        {"nodeVersion": "24.0.0"}, {"selectorsCleared": False},
+                        {"architecture": "x64"}, {"versions": {"s3": "3.1105.0"}}, {"extra": 1}):
+            with self.subTest(changes=changes), self.assertRaises(AssertionError):
+                result(dict(self.output(), **changes), 50, 3, "arm64")
+
+    def test_should_reject_the_host_published_origin_as_the_internal_gateway(self):
+        valid = "http://rustack-server-" + "a" * 32 + ":4566/"
+        self.assertEqual(internal_origin(valid), valid)
+        for value in ("http://127.0.0.1:4566/", valid.replace(":4566", ":49153"),
+                      valid.replace("http:", "https:"), valid + "path", valid.rstrip("/"),
+                      valid.replace("a" * 32, "A" * 32)):
+            with self.assertRaises(AssertionError):
+                internal_origin(value)
+
+    def test_should_require_the_same_distinct_complete_environment_pair(self):
+        pair = {"function": "a" * 64, "relay": "b" * 64}
+        self.assertEqual(warm(None, pair), pair)
+        self.assertEqual(warm(pair, dict(pair)), pair)
+        for current in ({"function": "c" * 64, "relay": "b" * 64},
+                        {"function": "a" * 64, "relay": "a" * 64},
+                        {"function": "short", "relay": "b" * 64}, dict(pair, extra="c" * 64)):
+            with self.assertRaises(AssertionError):
+                warm(pair, current)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_server_linker.py b/tests/workflows/test_server_linker.py
new file mode 100644
index 00000000..7c9f4d47
--- /dev/null
+++ b/tests/workflows/test_server_linker.py
@@ -0,0 +1,46 @@
+"""Only a known semantic no-op may change on the real cross-link path."""
+import unittest
+
+from server_linker import command
+
+
+class LinkerCompatibilityControls(unittest.TestCase):
+    def environment(self, **changes):
+        return dict({"CARGO_ZIGBUILD_ZIG_VERSION": "0.16.0",
+                     "WORKFLOWS_SERVER_LINKER_TARGET": "aarch64-linux-gnu",
+                     "WORKFLOWS_SERVER_LINKER_TOOL": "/tools/cargo-zigbuild"}, **changes)
+
+    def test_should_translate_only_the_exact_obsolete_optimization_argument(self):
+        original = ["input with spaces.o", "-Wl,-O1", "-Wl,-O10", "-Wl,-O2", "-O1",
+                    "-Wl,-O1,--gc-sections", "-Wl,--version-script=/tmp/list", "-lgcc_s", "-Werror"]
+        program, argv = command(original, self.environment())
+        self.assertEqual(program, "/tools/cargo-zigbuild")
+        self.assertEqual(argv[:8], [program, "zig", "cc", "--", "-g", "-fno-sanitize=all",
+                                   "-target", "aarch64-linux-gnu"])
+        self.assertEqual(argv[8:], [original[0], *original[2:]])
+        self.assertEqual(original[1], "-Wl,-O1")
+
+    def test_should_preserve_all_other_arguments_and_the_selected_target(self):
+        for index in range(128):
+            original = ["-Wl,--gc-sections", "arg" + str(index), "-Wl,-O" + str(index + 2), "library.rlib"]
+            _, argv = command(original, self.environment(WORKFLOWS_SERVER_LINKER_TARGET="x86_64-linux-gnu"))
+            self.assertEqual(argv[7], "x86_64-linux-gnu")
+            self.assertEqual(argv[8:], original)
+
+    def test_should_reject_unknown_versions_targets_and_tool_paths_before_execution(self):
+        for changes in ({"CARGO_ZIGBUILD_ZIG_VERSION": "0.15.2"},
+                        {"CARGO_ZIGBUILD_ZIG_VERSION": "0.17.0"},
+                        {"WORKFLOWS_SERVER_LINKER_TARGET": "aarch64-linux-musl"},
+                        {"WORKFLOWS_SERVER_LINKER_TOOL": "cargo-zigbuild"},
+                        {"WORKFLOWS_SERVER_LINKER_TOOL": "/tmp/tool\n"}):
+            with self.subTest(changes=changes), self.assertRaises(ValueError):
+                command(["file.o"], self.environment(**changes))
+
+    def test_should_bound_the_complete_argument_vector(self):
+        for arguments in ([], ["x"] * 4097, ["x" * 16385], ["x\x00y"], ["x" * 16384] * 257):
+            with self.assertRaises(ValueError):
+                command(arguments, self.environment())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/workflows/test_stepfunctions_history.py b/tests/workflows/test_stepfunctions_history.py
new file mode 100644
index 00000000..e3df16ad
--- /dev/null
+++ b/tests/workflows/test_stepfunctions_history.py
@@ -0,0 +1,53 @@
+"""Shared history observations preserve pagination, action tracking and omission."""
+import unittest
+
+from stepfunctions_history import assert_omitted, history
+
+
+class Client:
+    def __init__(self, pages):
+        self.pages = iter(pages)
+        self.calls = []
+
+    def get_execution_history(self, **params):
+        self.calls.append(params)
+        return next(self.pages)
+
+
+class HistoryControls(unittest.TestCase):
+    def test_should_preserve_the_snapshot_cursor_and_query_flags(self):
+        client = Client([{"events": [{"id": 3}], "nextToken": "cursor"}, {"events": [{"id": 2}]}])
+        self.assertEqual(history(client, "execution", reverse=True, data=False), [{"id": 3}, {"id": 2}])
+        self.assertEqual(client.calls, [dict(executionArn="execution", maxResults=7, reverseOrder=True,
+                                           includeExecutionData=False),
+            dict(executionArn="execution", maxResults=7, reverseOrder=True,
+                 includeExecutionData=False, nextToken="cursor")])
+
+    def test_should_keep_the_existing_cli_action_tracking_port(self):
+        client = Client([{"events": []}])
+        actions = []
+        def invoke(selected, method, **params):
+            actions.append(method)
+            return selected.get_execution_history(**params)
+        self.assertEqual(history(client, "execution", invoke=invoke), [])
+        self.assertEqual(actions, ["get_execution_history"])
+
+    def test_should_reject_duplicate_oversized_or_unbounded_page_metadata(self):
+        for pages in ([{"events": [], "nextToken": "same"}] * 2,
+                      [{"events": [{}] * 8}], [{"events": [], "nextToken": "x" * 1025}],
+                      [{"events": [], "nextToken": True}],
+                      [{"events": [], "nextToken": str(index)} for index in range(201)]):
+            with self.assertRaises(AssertionError):
+                history(Client(pages), "execution")
+
+    def test_should_require_data_omission_in_every_supported_history_projection(self):
+        assert_omitted([{"type": "ExecutionSucceeded", "executionSucceededEventDetails": {}}])
+        for event in ({"executionSucceededEventDetails": {"output": "private"}},
+                      {"taskSubmittedEventDetails": {"outputDetails": {}}},
+                      {"taskScheduledEventDetails": {}}):
+            with self.assertRaises(AssertionError):
+                assert_omitted([event])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/github-action/docker_client.py b/tools/github-action/docker_client.py
new file mode 100644
index 00000000..5094f2d2
--- /dev/null
+++ b/tools/github-action/docker_client.py
@@ -0,0 +1,67 @@
+"""Pinned local daemon operations, fenced by its immutable engine identity."""
+import time
+
+import metadata
+from settings import ActionError
+
+
+class Client:
+    def __init__(self, runner, program, environment, deadline):
+        self.runner, self.program = runner, program
+        context = environment.get("DOCKER_CONTEXT")
+        selected = None if context else environment.get("DOCKER_HOST")
+        if not selected:
+            arguments = [program, "context", "inspect", "--format", "{{json .Endpoints.docker.Host}}"]
+            if context:
+                if not isinstance(context, str) or not 1 <= len(context) <= 128 or not context.isascii() or any(ord(c) < 32 or ord(c) > 126 for c in context):
+                    raise ActionError("daemon-context-name")
+                arguments.extend(["--", context])
+            reply = runner.run(arguments,
+                               min(deadline, time.monotonic() + 5))
+            if reply.code != 0:
+                raise ActionError("daemon-context-lookup")
+            selected = metadata.document(reply.stdout, string_limit=4096)
+        self.endpoint = metadata.endpoint(selected)
+        runner.pin_endpoint()
+        self.engine = self._identity(deadline)
+
+    def _raw(self, parts, deadline, seconds):
+        reply = self.runner.run([self.program, "--host", self.endpoint, *parts],
+                                min(deadline, time.monotonic() + seconds))
+        if reply.code != 0:
+            raise ActionError("docker-command-failed")
+        if time.monotonic() >= deadline:
+            raise ActionError("docker-late-observation")
+        return reply.stdout
+
+    def _identity(self, deadline):
+        body = self._raw(["info", "--format", "{{json .ID}}"], deadline, 5)
+        return metadata.engine_id(metadata.document(body))
+
+    def call(self, parts, deadline, seconds=10):
+        if self._identity(deadline) != self.engine:
+            raise ActionError("daemon-identity-changed")
+        result = self._raw(parts, deadline, seconds)
+        if self._identity(deadline) != self.engine:
+            raise ActionError("daemon-identity-changed")
+        return result
+
+    def image(self, reference, deadline):
+        listing = self.call(["image", "ls", "--no-trunc", "--filter", "reference=" + reference,
+                             "--format", "{{json .ID}}"], deadline)
+        lines = listing.splitlines()
+        if len(lines) > 1:
+            raise ActionError("ambiguous-local-image")
+        if lines:
+            metadata.source_id(metadata.document(lines[0]))
+        else:
+            self.call(["pull", "--quiet", reference], deadline, 300)
+        view = metadata.document(self.call(["image", "inspect", "--format", metadata.IMAGE_FORMAT, reference], deadline))
+        if (not isinstance(view, dict) or view.get("os") != "linux"
+                or view.get("architecture") not in ("arm64", "amd64")):
+            raise ActionError("image-platform")
+        return metadata.source_id(view.get("id"))
+
+    def inspect(self, cid, source, nonce, deadline):
+        view = metadata.document(self.call(["container", "inspect", "--format", metadata.CONTAINER_FORMAT, cid], deadline))
+        return metadata.owned(view, cid, source, self.engine, nonce)
diff --git a/tools/github-action/metadata.py b/tools/github-action/metadata.py
new file mode 100644
index 00000000..4a2a4f4c
--- /dev/null
+++ b/tools/github-action/metadata.py
@@ -0,0 +1,161 @@
+"""Bounded public daemon metadata and exact Action-container affiliation."""
+import json
+import math
+import re
+import uuid
+
+from settings import ActionError
+
+NONCE_LABEL = "rustack.github-action.nonce"
+ENGINE_LABEL = "rustack.github-action.engine"
+IMAGE_FORMAT = '{"id":{{json .Id}},"os":{{json .Os}},"architecture":{{json .Architecture}}}'
+CONTAINER_FORMAT = ('{"id":{{json .Id}},"name":{{json .Name}},"image":{{json .Image}},'
+                    '"reference":{{json .Config.Image}},"labels":{{json .Config.Labels}},'
+                    '"running":{{json .State.Running}},"dead":{{json .State.Dead}},'
+                    '"oom":{{json .State.OOMKilled}},"exit":{{json .State.ExitCode}},'
+                    '"startedAt":{{json .State.StartedAt}},"health":{{json .State.Health.Status}},'
+                    '"ports":{{json .NetworkSettings.Ports}},'
+                    '"bindings":{{json .HostConfig.PortBindings}},'
+                    '"restart":{{json .HostConfig.RestartPolicy}}}')
+
+
+def document(raw, maximum=32768, string_limit=256, member_limit=512):
+    if type(member_limit) is not int or not 1 <= member_limit <= 4096:
+        raise ActionError("metadata-member-policy")
+    if not isinstance(raw, bytes) or len(raw) > maximum:
+        raise ActionError("metadata-byte-budget")
+    try:
+        text = raw.decode("utf-8")
+    except UnicodeDecodeError:
+        raise ActionError("metadata-encoding") from None
+    depth, quoted, escaped, size = 0, False, False, 0
+    for char in text:
+        if quoted:
+            if char == '"' and not escaped:
+                quoted = False
+            else:
+                size += len(char.encode("utf-8"))
+                if size > string_limit:
+                    raise ActionError("metadata-string-budget")
+                escaped = char == "\\" and not escaped
+        elif char == '"':
+            quoted, size = True, 0
+        elif char in "[{":
+            depth += 1
+            if depth > 8:
+                raise ActionError("metadata-depth-budget")
+        elif char in "]}":
+            depth -= 1
+            if depth < 0:
+                raise ActionError("metadata-shape")
+    if quoted or depth:
+        raise ActionError("metadata-shape")
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            if key in result or len(key.encode("utf-8")) > 256:
+                raise ActionError("metadata-duplicate-or-key")
+            result[key] = value
+        return result
+    def constant(_value):
+        raise ActionError("metadata-number")
+    def finite(value):
+        number = float(value)
+        if not math.isfinite(number):
+            raise ActionError("metadata-number")
+        return number
+    try:
+        value = json.loads(text, object_pairs_hook=unique, parse_constant=constant, parse_float=finite)
+    except (ValueError, RecursionError):
+        raise ActionError("metadata-json") from None
+    pending, members = [value], 0
+    while pending:
+        current = pending.pop()
+        if isinstance(current, str):
+            try:
+                if len(current.encode("utf-8")) > string_limit:
+                    raise ActionError("metadata-string-budget")
+            except UnicodeEncodeError:
+                raise ActionError("metadata-encoding") from None
+        if isinstance(current, (dict, list)):
+            members += len(current)
+            if members > member_limit:
+                raise ActionError("metadata-member-budget")
+            pending.extend(current.values() if isinstance(current, dict) else current)
+    return value
+
+
+def identifier(value):
+    if not isinstance(value, str) or re.fullmatch(r"[0-9a-f]{64}", value) is None:
+        raise ActionError("container-identity")
+    return value
+
+
+def source_id(value):
+    if not isinstance(value, str) or re.fullmatch(r"sha256:[0-9a-f]{64}", value) is None:
+        raise ActionError("image-identity")
+    return value
+
+
+def engine_id(value):
+    try:
+        parsed = uuid.UUID(value)
+    except (ValueError, AttributeError, TypeError):
+        raise ActionError("daemon-identity") from None
+    if parsed.int == 0 or str(parsed) != value:
+        raise ActionError("daemon-identity")
+    return value
+
+
+def endpoint(value):
+    if not isinstance(value, str) or not value.startswith("unix://"):
+        raise ActionError("local-unix-daemon-required")
+    path = value[7:]
+    if len(path.encode("utf-8")) > 4096 or re.fullmatch(r"/[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_.-]+)*", path) is None:
+        raise ActionError("local-unix-daemon-required")
+    if any(part in (".", "..") for part in path.split("/")[1:]):
+        raise ActionError("local-unix-daemon-required")
+    return value
+
+
+def owned(view, cid, source, engine, nonce):
+    if not isinstance(view, dict):
+        raise ActionError("container-metadata")
+    labels = view.get("labels")
+    if (view.get("id") != cid or view.get("image") != source or view.get("reference") != source
+            or view.get("name") != "/rustack" or not isinstance(labels, dict)
+            or labels.get(NONCE_LABEL) != nonce or labels.get(ENGINE_LABEL) != engine):
+        raise ActionError("container-affiliation")
+    if (type(view.get("running")) is not bool or type(view.get("exit")) is not int
+            or not 0 <= view["exit"] <= 255 or view.get("dead") is not False or view.get("oom") is not False):
+        raise ActionError("container-state")
+    return view
+
+
+def publication(view, port):
+    expected = {"4566/tcp": [{"HostIp": "127.0.0.1", "HostPort": str(port)}]}
+    if (view.get("ports") != expected or view.get("bindings") != expected
+            or view.get("restart") != {"Name": "no", "MaximumRetryCount": 0}):
+        raise ActionError("container-publication")
+    started = view.get("startedAt")
+    if (not isinstance(started, str) or not 1 <= len(started) <= 64
+            or not started.isascii() or any(ord(c) < 32 or ord(c) > 126 for c in started)):
+        raise ActionError("container-start-identity")
+    if view.get("running") is not True:
+        raise ActionError("container-exited-before-handoff")
+    if view.get("health") not in ("healthy", "starting", "unhealthy"):
+        raise ActionError("container-health-metadata")
+    return started, view["health"] == "healthy"
+
+
+def readiness(raw):
+    value = document(raw, maximum=65536)
+    if not isinstance(value, dict) or value.get("ready") is not True:
+        raise ActionError("http-not-ready")
+    services = value.get("services")
+    if not isinstance(services, dict) or not 1 <= len(services) <= 32:
+        raise ActionError("http-services")
+    for name, state in services.items():
+        if (not isinstance(name, str) or re.fullmatch(r"[a-z0-9][a-z0-9_-]{0,63}", name) is None
+                or state not in ("running", "disabled")):
+            raise ActionError("http-services")
diff --git a/tools/github-action/process_owner.py b/tools/github-action/process_owner.py
new file mode 100644
index 00000000..da37b394
--- /dev/null
+++ b/tools/github-action/process_owner.py
@@ -0,0 +1,153 @@
+"""One direct child group, bounded pipes and physically joined observations."""
+from dataclasses import dataclass, field
+import os
+import selectors
+import signal
+import subprocess
+import time
+
+from settings import ActionError
+
+
+@dataclass(frozen=True)
+class Reply:
+    code: int
+    stdout: bytes = field(repr=False)
+    stderr: bytes = field(repr=False)
+
+
+class Runner:
+    def __init__(self, environment, clock=time.monotonic):
+        self.clock = clock
+        allowed = ("PATH", "HOME", "DOCKER_CONFIG", "DOCKER_HOST", "DOCKER_CONTEXT",
+                   "DOCKER_API_VERSION", "XDG_RUNTIME_DIR")
+        self.environment = {key: environment[key] for key in allowed if key in environment}
+        self.environment.update(LC_ALL="C", PYTHONDONTWRITEBYTECODE="1")
+        self.unsettled = False
+        self.retiring = False
+
+    def pin_endpoint(self):
+        self.environment.pop("DOCKER_HOST", None)
+        self.environment.pop("DOCKER_CONTEXT", None)
+
+    @staticmethod
+    def _alive(child):
+        try:
+            os.killpg(child.pid, 0)
+            return True
+        except ProcessLookupError:
+            return False
+        except PermissionError:
+            # Exited, unreaped Darwin groups can report EPERM. Reap our
+            # direct child and retry in the bounded observation loop. A
+            # denial remains present/unproven; it never means absence.
+            child.poll()
+            return True
+
+    @staticmethod
+    def _signal(child, value):
+        try:
+            os.killpg(child.pid, value)
+        except ProcessLookupError:
+            return
+        except PermissionError:
+            child.poll()
+            try:
+                os.killpg(child.pid, value)
+            except (ProcessLookupError, PermissionError):
+                # Only a later ESRCH observation may discharge the group.
+                # Persistent denial expires as unsettled retirement.
+                return
+
+    def _retire(self, child, selector):
+        self.retiring = True
+        try:
+            self._retire_group(child, selector)
+        finally:
+            self.retiring = False
+
+    def _retire_group(self, child, selector):
+        cutoff = time.monotonic() + 3
+        kill_at = cutoff - 2
+        self._signal(child, signal.SIGTERM)
+        while time.monotonic() < cutoff:
+            child.poll()
+            if time.monotonic() >= kill_at:
+                self._signal(child, signal.SIGKILL)
+            try:
+                self._discard(selector, min(0.025, max(0, cutoff - time.monotonic())))
+            except OSError:
+                # IO failure cannot bypass process retirement. These are our
+                # exact failed pipe handles, never unrelated descriptors.
+                for key in list(selector.get_map().values()):
+                    selector.unregister(key.fileobj)
+                    key.fileobj.close()
+            if child.returncode is not None and not self._alive(child) and not selector.get_map():
+                child.wait(timeout=0)
+                return
+        self.unsettled = True
+        child.poll()
+        raise ActionError("child-retirement-unsettled")
+
+    @staticmethod
+    def _discard(selector, seconds):
+        for key, _ in selector.select(seconds):
+            try:
+                value = os.read(key.fd, 8192)
+            except BlockingIOError:
+                continue
+            if not value:
+                selector.unregister(key.fileobj)
+                key.fileobj.close()
+
+    def run(self, arguments, deadline, stdout_limit=32768, working_directory=None):
+        if stdout_limit not in (32768, 65536):
+            raise ActionError("child-output-policy")
+        if self.unsettled or self.clock() >= deadline:
+            raise ActionError("child-deadline-before-dispatch")
+        if not arguments or len(arguments) > 128 or sum(len(os.fsencode(a)) for a in arguments) > 32768:
+            raise ActionError("child-argument-budget")
+        child = None
+        selector = selectors.DefaultSelector()
+        try:
+            child = subprocess.Popen(arguments, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
+                                     stderr=subprocess.PIPE, env=self.environment, start_new_session=True, cwd=working_directory)
+            for stream, label in ((child.stdout, "stdout"), (child.stderr, "stderr")):
+                os.set_blocking(stream.fileno(), False)
+                selector.register(stream, selectors.EVENT_READ, label)
+            output = {"stdout": bytearray(), "stderr": bytearray()}
+            limits = {"stdout": stdout_limit, "stderr": 32768}
+            while selector.get_map() or child.poll() is None:
+                remaining = deadline - self.clock()
+                if remaining <= 0:
+                    raise ActionError("child-deadline")
+                for key, _ in selector.select(min(remaining, 0.05)):
+                    try:
+                        block = os.read(key.fd, min(8192, limits[key.data] - len(output[key.data]) + 1))
+                    except BlockingIOError:
+                        continue
+                    if not block:
+                        selector.unregister(key.fileobj)
+                        key.fileobj.close()
+                    else:
+                        output[key.data].extend(block)
+                        if len(output[key.data]) > limits[key.data]:
+                            raise ActionError("child-output-budget")
+            child.wait(timeout=0)
+            if self._alive(child):
+                raise ActionError("child-group-outlived-command")
+            if self.clock() >= deadline:
+                raise ActionError("child-late-result")
+            return Reply(child.returncode, bytes(output["stdout"]), bytes(output["stderr"]))
+        except BaseException:
+            if child is not None:
+                self._retire(child, selector)
+            raise
+        finally:
+            for key in list(selector.get_map().values()):
+                key.fileobj.close()
+            selector.close()
+            if child is not None:
+                for stream in (child.stdout, child.stderr):
+                    if stream is not None:
+                        stream.close()
diff --git a/tools/github-action/runtime.py b/tools/github-action/runtime.py
new file mode 100644
index 00000000..b7b42ab3
--- /dev/null
+++ b/tools/github-action/runtime.py
@@ -0,0 +1,254 @@
+"""Single composite-Action producer: validate, own launch, qualify, hand off."""
+import os
+from pathlib import Path
+import re
+import shutil
+import signal
+import stat
+import sys
+import tempfile
+import time
+import uuid
+import json
+
+from docker_client import Client
+import metadata
+from process_owner import Runner
+from settings import ActionError, Settings
+
+
+def safe_path(value):
+    if not isinstance(value, str) or not value or not os.path.isabs(value):
+        raise ActionError("runner-path")
+    if len(os.fsencode(value)) > 4096 or any(ord(char) < 32 or ord(char) == 127 for char in value):
+        raise ActionError("runner-path")
+    return Path(value)
+
+
+def write_exclusive(path, body):
+    if len(body) > 8192:
+        raise ActionError("private-file-budget")
+    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+    with os.fdopen(descriptor, "wb") as stream:
+        stream.write(body)
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+def append_runner_file(path, body):
+    if len(body) > 8192:
+        raise ActionError("runner-output-budget")
+    descriptor = os.open(path, os.O_WRONLY | os.O_APPEND | os.O_NOFOLLOW | os.O_NONBLOCK)
+    with os.fdopen(descriptor, "ab") as stream:
+        observed = os.fstat(stream.fileno())
+        if not stat.S_ISREG(observed.st_mode) or observed.st_nlink != 1 or observed.st_size > 1048576:
+            raise ActionError("runner-output-file")
+        stream.write(body)
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+def lines(values):
+    return "".join(key + "=" + value + "\n" for key, value in values.items()).encode("ascii")
+
+
+class Owner:
+    def __init__(self, settings, environment):
+        self.launch_cutoff = time.monotonic() + 420
+        self.settings = settings
+        self.environment = environment
+        self.runner = Runner(environment)
+        self.program = shutil.which("docker", path=environment.get("PATH"))
+        self.curl = shutil.which("curl", path=environment.get("PATH"))
+        if not self.program or not self.curl:
+            raise ActionError("required-command-unavailable")
+        parent = safe_path(environment.get("RUNNER_TEMP"))
+        self.output = safe_path(environment.get("GITHUB_OUTPUT"))
+        self.export = safe_path(environment.get("GITHUB_ENV"))
+        self.path = Path(tempfile.mkdtemp(prefix="rustack-action-", dir=parent))
+        os.chmod(self.path, 0o700)
+        self.env_file = self.path / "server.env"
+        self.nonce = str(uuid.uuid4())
+        self.stage = "launch"
+        self.client, self.source, self.cid = None, None, None
+        self.uncertain, self.handed_off = False, False
+
+    def record(self, name, value, deadline=None):
+        cutoff = self.launch_cutoff if deadline is None else deadline
+        if time.monotonic() >= cutoff:
+            raise ActionError("private-file-deadline")
+        write_exclusive(self.path / name, (json.dumps(value, separators=(",", ":")) + "\n").encode("ascii"))
+        if time.monotonic() >= cutoff:
+            raise ActionError("private-file-late-observation")
+
+    def launch(self):
+        self.stage = "select-daemon"
+        self.client = Client(self.runner, self.program, self.environment, self.launch_cutoff)
+        self.record("intent.json", {"schemaVersion": 1, "engine": self.client.engine, "nonce": self.nonce,
+                                    "reference": self.settings.reference, "name": "rustack", "port": self.settings.port})
+        self.stage = "image"
+        self.source = self.client.image(self.settings.reference, self.launch_cutoff)
+        self.record("source.json", {"schemaVersion": 1, "engine": self.client.engine, "image": self.source,
+                                    "nonce": self.nonce})
+        write_exclusive(self.env_file, lines(self.settings.docker_environment()))
+        self.stage = "start"
+        arguments = ["run", "--detach", "--name", "rustack", "--restart=no",
+                     "--publish", "127.0.0.1:" + str(self.settings.port) + ":4566",
+                     "--label", metadata.NONCE_LABEL + "=" + self.nonce,
+                     "--label", metadata.ENGINE_LABEL + "=" + self.client.engine,
+                     "--env-file", str(self.env_file), self.source]
+        self.uncertain = True
+        try:
+            reply = self.client.call(arguments, self.launch_cutoff, 60)
+        finally:
+            self.remove_input()
+        if not reply.endswith(b"\n"):
+            raise ActionError("container-start-reply")
+        try:
+            self.cid = metadata.identifier(reply[:-1].decode("ascii"))
+        except UnicodeDecodeError:
+            raise ActionError("container-start-reply") from None
+        self.ready_cutoff = time.monotonic() + self.settings.wait_seconds
+        self.record("server.json", {"schemaVersion": 1, "engine": self.client.engine, "image": self.source,
+                                    "nonce": self.nonce, "id": self.cid}, self.ready_cutoff)
+        self.client.inspect(self.cid, self.source, self.nonce, self.ready_cutoff)
+        self.uncertain = False
+
+    def ready(self):
+        self.stage = "readiness"
+        while True:
+            if time.monotonic() >= self.ready_cutoff:
+                raise ActionError("readiness-deadline")
+            view = self.client.inspect(self.cid, self.source, self.nonce, self.ready_cutoff)
+            started, healthy = metadata.publication(view, self.settings.port)
+            if healthy:
+                remaining = self.ready_cutoff - time.monotonic()
+                if remaining <= 0:
+                    raise ActionError("readiness-deadline")
+                seconds = min(3, remaining)
+                args = [self.curl, "--disable", "--silent", "--show-error", "--fail", "--noproxy", "*",
+                        "--write-out", "%{stderr}%{http_code}", "--proto", "=http",
+                        "--connect-timeout", str(min(2, seconds)), "--max-time", str(seconds),
+                        "--url", "http://127.0.0.1:" + str(self.settings.port) + "/_health/ready"]
+                reply = self.runner.run(args, min(self.ready_cutoff, time.monotonic() + seconds), 65536)
+                if reply.code == 0:
+                    if reply.stderr != b"200":
+                        raise ActionError("http-status")
+                    metadata.readiness(reply.stdout)
+                    final = self.client.inspect(self.cid, self.source, self.nonce, self.ready_cutoff)
+                    after, still_healthy = metadata.publication(final, self.settings.port)
+                    if started != after or not still_healthy:
+                        raise ActionError("container-changed-during-readiness")
+                    if time.monotonic() >= self.ready_cutoff:
+                        raise ActionError("readiness-late-result")
+                    return
+            remaining = self.ready_cutoff - time.monotonic()
+            if remaining <= 0:
+                raise ActionError("readiness-deadline")
+            time.sleep(min(0.5, remaining))
+
+    def handoff(self):
+        self.stage = "handoff"
+        if time.monotonic() >= self.ready_cutoff:
+            raise ActionError("handoff-deadline")
+        append_runner_file(self.export, lines(self.settings.caller_environment()))
+        append_runner_file(self.output, lines({"container_id": self.cid, "endpoint": self.settings.endpoint}))
+        if time.monotonic() >= self.ready_cutoff:
+            raise ActionError("handoff-late-result")
+        shutil.rmtree(self.path)
+        self.handed_off = True
+        print("Rustack is ready at " + self.settings.endpoint, flush=True)
+
+    def remove_input(self):
+        try:
+            self.env_file.unlink()
+        except FileNotFoundError:
+            pass
+
+    def cleanup(self):
+        self.remove_input()
+        if self.runner.unsettled:
+            return "retained-unsettled-child"
+        if self.uncertain:
+            return "retained-uncertain"
+        if self.handed_off:
+            return "caller-owned"
+        if not self.cid:
+            return "no-known-container"
+        cutoff = time.monotonic() + 90
+        view = self.client.inspect(self.cid, self.source, self.nonce, cutoff)
+        if view["running"]:
+            self.uncertain = True
+            reply = self.client.call(["kill", "--signal", "TERM", self.cid], cutoff)
+            if reply != (self.cid + "\n").encode("ascii"):
+                raise ActionError("cleanup-signal-reply")
+            self.uncertain = False
+        reply = self.client.call(["wait", self.cid], cutoff, 70)
+        if reply != b"0\n":
+            raise ActionError("cleanup-unexpected-exit")
+        final = self.client.inspect(self.cid, self.source, self.nonce, cutoff)
+        if final["running"] is not False or final["exit"] != 0:
+            raise ActionError("cleanup-unsettled-server")
+        self.uncertain = True
+        reply = self.client.call(["container", "rm", self.cid], cutoff)
+        if reply != (self.cid + "\n").encode("ascii"):
+            raise ActionError("cleanup-remove-reply")
+        remaining = self.client.call(["container", "ls", "--all", "--no-trunc", "--filter", "id=" + self.cid,
+                                      "--format", "{{json .ID}}"], cutoff)
+        if remaining.strip():
+            raise ActionError("cleanup-container-still-present")
+        self.uncertain = False
+        if self.path.is_dir():
+            self.record("cleanup.json", {"schemaVersion": 1, "engine": self.client.engine, "id": self.cid,
+                                         "serverAbsent": True, "uncertain": False}, cutoff)
+        return "removed"
+
+
+def main(environment):
+    owner = None
+    stage = "input"
+    interrupted = False
+    def interrupt(_number, _frame):
+        nonlocal interrupted
+        if not interrupted:
+            interrupted = True
+            if owner is None or not owner.runner.retiring:
+                raise ActionError("interrupted")
+    try:
+        settings = Settings.load(environment)
+        for value in (settings.authentication.access, settings.authentication.secret):
+            if value:
+                escaped = value.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+                print("::add-mask::" + escaped, flush=True)
+        signal.signal(signal.SIGTERM, interrupt)
+        signal.signal(signal.SIGINT, interrupt)
+        owner = Owner(settings, environment)
+        owner.launch()
+        owner.ready()
+        owner.handoff()
+        return 0
+    except BaseException as error:
+        cleanup = "no-owner"
+        if owner is not None:
+            stage = owner.stage
+            try:
+                cleanup = owner.cleanup()
+            except BaseException:
+                cleanup = "retained-cleanup-failure"
+        code = error.args[0] if isinstance(error, ActionError) and len(error.args) == 1 else "internal-error"
+        if not isinstance(code, str) or re.fullmatch(r"[a-z][a-z0-9-]{0,63}", code) is None:
+            code = "internal-error"
+        print("::error::Rustack Action failed at " + stage + " (" + code + ")", file=sys.stderr)
+        print("Cleanup status: " + cleanup, file=sys.stderr)
+        if owner is not None:
+            if owner.cid:
+                print("Owned container ID: " + owner.cid, file=sys.stderr)
+            print("Retained private evidence: " + str(owner.path), file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 1:
+        print("::error::Rustack Action accepts inputs through environment only", file=sys.stderr)
+        raise SystemExit(2)
+    raise SystemExit(main(os.environ))
diff --git a/tools/github-action/settings.py b/tools/github-action/settings.py
new file mode 100644
index 00000000..4a19a57a
--- /dev/null
+++ b/tools/github-action/settings.py
@@ -0,0 +1,102 @@
+"""Validated composite-Action inputs; opaque authentication values stay private."""
+from dataclasses import dataclass, field
+import re
+
+
+class ActionError(Exception):
+    """A fixed diagnostic code, never an external value or subprocess output."""
+
+
+SERVICES = frozenset(("s3", "dynamodb", "dynamodbstreams", "sqs", "ssm", "sns", "lambda",
+                      "stepfunctions", "events", "logs", "kms", "kinesis", "secretsmanager",
+                      "ses", "apigatewayv2", "cloudwatch", "iam", "sts", "cloudfront"))
+FLAGS = ("s3", "dynamodb", "sqs", "ssm", "sns", "lambda", "stepfunctions")
+DEFAULTS = {"image-tag": "latest", "port": "4566", "default-region": "us-east-1",
+            "log-level": "info", "wait-timeout": "30", "access-key": "test", "secret-key": "test",
+            "persistence": "false", "services": "",
+            **{service + "-skip-auth": "true" for service in FLAGS}}
+
+
+@dataclass(frozen=True)
+class Authentication:
+    access: str = field(repr=False)
+    secret: str = field(repr=False)
+
+
+@dataclass(frozen=True)
+class Settings:
+    tag: str
+    port: int
+    region: str
+    log_level: str
+    wait_seconds: int
+    authentication: Authentication
+    flags: tuple
+    persistence: str
+    services: str
+
+    @classmethod
+    def load(cls, environment):
+        values = {}
+        for key, default in DEFAULTS.items():
+            value = environment.get("RUSTACK_ACTION_" + key.upper().replace("-", "_"), default)
+            if not isinstance(value, str):
+                raise ActionError("input-" + key)
+            try:
+                raw = value.encode("ascii")
+            except UnicodeEncodeError:
+                raise ActionError("input-" + key) from None
+            if len(raw) > 512 or any(byte < 32 or byte > 126 for byte in raw):
+                raise ActionError("input-" + key)
+            values[key] = value
+        def require(key, pattern):
+            if re.fullmatch(pattern, values[key]) is None:
+                raise ActionError("input-" + key)
+        def decimal(key, maximum, digits):
+            require(key, "[1-9][0-9]{0," + str(digits - 1) + "}")
+            number = int(values[key])
+            if number > maximum:
+                raise ActionError("input-" + key)
+            return number
+        require("image-tag", r"[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}")
+        port = decimal("port", 65535, 5)
+        wait = decimal("wait-timeout", 300, 3)
+        require("default-region", r"[a-z0-9][a-z0-9-]{0,63}")
+        if values["log-level"] not in ("error", "warn", "info", "debug", "trace"):
+            raise ActionError("input-log-level")
+        for key in ["persistence", *[name + "-skip-auth" for name in FLAGS]]:
+            if values[key] not in ("true", "false"):
+                raise ActionError("input-" + key)
+        selected = values["services"].split(",") if values["services"] else []
+        if len(selected) > 32 or len(selected) != len(set(selected)) or any(s not in SERVICES for s in selected):
+            raise ActionError("input-services")
+        access, secret = values["access-key"], values["secret-key"]
+        if bool(access) != bool(secret):
+            raise ActionError("input-authentication-pair")
+        enabled = set(selected) if selected else SERVICES
+        if not access and any(service in enabled and values[service + "-skip-auth"] == "false" for service in FLAGS):
+            raise ActionError("input-strict-authentication-pair")
+        return cls(values["image-tag"], port, values["default-region"], values["log-level"], wait,
+                   Authentication(access, secret), tuple((s, values[s + "-skip-auth"]) for s in FLAGS),
+                   values["persistence"], values["services"])
+
+    @property
+    def reference(self):
+        return "ghcr.io/tyrchen/rustack:" + self.tag
+
+    @property
+    def endpoint(self):
+        return "http://localhost:" + str(self.port)
+
+    def docker_environment(self):
+        values = {"DEFAULT_REGION": self.region, "LOG_LEVEL": self.log_level,
+                  "PERSISTENCE": self.persistence, "SERVICES": self.services}
+        if self.authentication.access:
+            values.update(ACCESS_KEY=self.authentication.access, SECRET_KEY=self.authentication.secret)
+        values.update((name.upper() + "_SKIP_SIGNATURE_VALIDATION", value) for name, value in self.flags)
+        return values
+
+    def caller_environment(self):
+        return {"AWS_ENDPOINT_URL": self.endpoint, "LOCALSTACK_ENDPOINT": self.endpoint,
+                "AWS_DEFAULT_REGION": self.region, "AWS_ACCESS_KEY_ID": self.authentication.access,
+                "AWS_SECRET_ACCESS_KEY": self.authentication.secret}
diff --git a/tools/workflows-spikes/.dockerignore b/tools/workflows-spikes/.dockerignore
new file mode 100644
index 00000000..81ad77ad
--- /dev/null
+++ b/tools/workflows-spikes/.dockerignore
@@ -0,0 +1,2 @@
+**
+!handler.py
diff --git a/tools/workflows-spikes/Cargo.lock b/tools/workflows-spikes/Cargo.lock
new file mode 100644
index 00000000..2fe28111
--- /dev/null
+++ b/tools/workflows-spikes/Cargo.lock
@@ -0,0 +1,1364 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "bollard"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbe8358268799ebb3e4df23cb9d47f4c72bbc4f5247e2fa6a1bf7b6c0baea220"
+dependencies = [
+ "base64",
+ "bollard-stubs",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "pin-project-lite",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_urlencoded",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.53.1-rc.29.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce412eb6f7096743011dc3cb5c674caeb24ced61d8c498fe07cf7998a4fea889"
+dependencies = [
+ "serde",
+ "serde_json",
+ "serde_repr",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "ciborium"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
+dependencies = [
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half",
+]
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "zerocopy",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fab3637d6b04a8037af8a266fdf6cf92ea957e8c53981a2bf6136572531025bf"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "httparse",
+ "hyper",
+ "libc",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+
+[[package]]
+name = "icu_properties"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+
+[[package]]
+name = "icu_provider"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
+
+[[package]]
+name = "libc"
+version = "0.2.191"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mio"
+version = "1.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "rustack-lambda-runtime"
+version = "0.9.0"
+dependencies = [
+ "bytes",
+ "ciborium",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "serde",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "tracing-core",
+ "tracing-subscriber",
+ "typed-builder",
+ "uuid",
+]
+
+[[package]]
+name = "rustack-workflows-spikes"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "bollard",
+ "bytes",
+ "ciborium",
+ "futures",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "rustack-lambda-runtime",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "tracing-log",
+ "tracing-subscriber",
+ "uuid",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.54.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "serde",
+ "serde_json",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+ "tracing-serde",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typed-builder"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31aa81521b70f94402501d848ccc0ecaa8f93c8eb6999eb9747e72287757ffda"
+dependencies = [
+ "typed-builder-macro",
+]
+
+[[package]]
+name = "typed-builder-macro"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "076a02dc54dd46795c2e9c8282ed40bcfb1e22747e955de9389a1de28190fb26"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a0e2d11620c50695fe12bbbfde96b3477fe606e7284c22d505c12ce51214514"
+dependencies = [
+ "getrandom",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "want"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/tools/workflows-spikes/Cargo.toml b/tools/workflows-spikes/Cargo.toml
new file mode 100644
index 00000000..c113952b
--- /dev/null
+++ b/tools/workflows-spikes/Cargo.toml
@@ -0,0 +1,34 @@
+[package]
+name = "rustack-workflows-spikes"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[workspace]
+
+[dependencies]
+anyhow = "1.0"
+thiserror = "2.0"
+bollard = { version = "=0.21.1", default-features = false, features = ["pipe"] }
+bytes = { version = "1.12", features = ["serde"] }
+ciborium = "0.2"
+futures = "0.3"
+hyper = { version = "1.12", features = ["server", "http1"] }
+hyper-util = { version = "0.1", features = ["tokio"] }
+http-body-util = "0.1"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+tokio = { version = "1.54", features = ["rt-multi-thread", "macros", "net", "sync", "time", "io-util", "io-std"] }
+uuid = { version = "1.26", features = ["v4"] }
+
+[dev-dependencies]
+rustack-lambda-runtime = { path = "../../crates/rustack-lambda-runtime" }
+tempfile = "3.27"
+tracing = "0.1"
+tracing-log = "0.2"
+tracing-subscriber = { version = "0.3", features = ["fmt"] }
+
+[lints.rust]
+rust_2024_compatibility = "warn"
+missing_docs = "warn"
+missing_debug_implementations = "warn"
diff --git a/tools/workflows-spikes/Handler.Dockerfile b/tools/workflows-spikes/Handler.Dockerfile
new file mode 100644
index 00000000..22ab04b8
--- /dev/null
+++ b/tools/workflows-spikes/Handler.Dockerfile
@@ -0,0 +1,8 @@
+FROM public.ecr.aws/lambda/python:3.13@sha256:e0237850eecd760896365e768bac1526ea01098e325fa590e5bc735b26d5dbb9
+COPY handler.py /var/task/handler.py
+ENV AWS_LAMBDA_RUNTIME_API=outside:9001 \
+    AWS_LAMBDA_FUNCTION_NAME=image-default \
+    AWS_REGION=image-region \
+    TEST_VALUE=image-default
+USER 1000:1000
+CMD ["handler.handler"]
diff --git a/tools/workflows-spikes/Relay.Dockerfile b/tools/workflows-spikes/Relay.Dockerfile
new file mode 100644
index 00000000..cb9baccb
--- /dev/null
+++ b/tools/workflows-spikes/Relay.Dockerfile
@@ -0,0 +1,5 @@
+FROM public.ecr.aws/lambda/provided:al2023@sha256:612c98f126c2a95e77a016d56fed50a83055e11d636132ee6ebdd461f01b9617
+COPY bootstrap /relay
+USER 1000:1000
+ENTRYPOINT ["/relay"]
+CMD []
diff --git a/tools/workflows-spikes/handler.py b/tools/workflows-spikes/handler.py
new file mode 100644
index 00000000..9cba847a
--- /dev/null
+++ b/tools/workflows-spikes/handler.py
@@ -0,0 +1,54 @@
+"""Real official-RIC handler used by the isolated P0 transport experiment."""
+
+import os
+import sys
+from pathlib import Path
+import time
+
+counter = 0
+
+
+def handler(event, context):
+    global counter
+    counter += 1
+    if event.get("logs"):
+        print("WIRE_STDOUT_CAPTURE", flush=True)
+        print("WIRE_STDERR_CAPTURE", file=sys.stderr, flush=True)
+    if event.get("fail"):
+        raise ValueError("intentional P0 failure")
+    if event.get("sleep"):
+        print("P0_BUSY_START=" + context.aws_request_id, flush=True)
+        time.sleep(60)
+    cgroup = Path("/sys/fs/cgroup")
+    response = {
+        "computed": event["value"] + 7,
+        "counter": counter,
+        "uid": os.getuid(),
+        "requestId": context.aws_request_id,
+        "memoryMax": (cgroup / "memory.max").read_text().strip(),
+        "pidsMax": (cgroup / "pids.max").read_text().strip(),
+        "rootReadOnly": bool(os.statvfs("/").f_flag & os.ST_RDONLY),
+    }
+    if "padding" in event:
+        response["inputBytes"] = len(event["padding"].encode("utf-8"))
+    if event.get("response_bytes"):
+        response["large"] = "r" * event["response_bytes"]
+    if event.get("policy"):
+        temporary = os.statvfs("/tmp")
+        status = dict(
+            line.split(":", 1) for line in Path("/proc/self/status").read_text().splitlines()
+            if ":" in line
+        )
+        response["tmpBytes"] = temporary.f_blocks * temporary.f_frsize
+        response["tmpMode"] = os.stat("/tmp").st_mode & 0o7777
+        response["swapMax"] = (cgroup / "memory.swap.max").read_text().strip()
+        response["cpuMax"] = (cgroup / "cpu.max").read_text().strip()
+        response["capEff"] = status["CapEff"].strip()
+        response["noNewPrivs"] = status["NoNewPrivs"].strip()
+        response["taskRoot"] = os.environ.get("LAMBDA_TASK_ROOT")
+        response["functionName"] = os.environ.get("AWS_LAMBDA_FUNCTION_NAME")
+        response["functionVersion"] = os.environ.get("AWS_LAMBDA_FUNCTION_VERSION")
+        response["invokedArn"] = context.invoked_function_arn
+        response["region"] = os.environ.get("AWS_REGION")
+        response["configuredValue"] = os.environ.get("TEST_VALUE")
+    return response
diff --git a/tools/workflows-spikes/src/bin/driver.rs b/tools/workflows-spikes/src/bin/driver.rs
new file mode 100644
index 00000000..34304c0c
--- /dev/null
+++ b/tools/workflows-spikes/src/bin/driver.rs
@@ -0,0 +1,524 @@
+//! Docker attach + official RIC feasibility driver. Never contacts AWS APIs.
+#![forbid(unsafe_code)]
+
+use std::{
+    collections::{BTreeSet, HashMap},
+    env,
+    time::Duration,
+};
+
+use anyhow::{Context, Result, bail, ensure};
+use bollard::{
+    API_DEFAULT_VERSION, Docker,
+    container::{AttachContainerResults, LogOutput},
+    errors::Error as DockerError,
+    models::{ContainerCreateBody, HostConfig},
+    query_parameters::{
+        AttachContainerOptionsBuilder, ListContainersOptionsBuilder, LogsOptionsBuilder,
+        RemoveContainerOptionsBuilder,
+    },
+};
+use bytes::{Bytes, BytesMut};
+use futures::StreamExt;
+use rustack_workflows_spikes::{Frame, MAX_FRAME, decode, write_frame};
+use serde_json::{Value, json};
+use tokio::{
+    io::AsyncWriteExt,
+    time::{Instant, sleep, timeout},
+};
+use uuid::Uuid;
+
+async fn next_frame(attach: &mut AttachContainerResults, buffer: &mut BytesMut) -> Result<Frame> {
+    timeout(Duration::from_secs(45), async {
+        loop {
+            if buffer.len() >= 4 {
+                let prefix: [u8; 4] = buffer.get(..4).context("length prefix")?.try_into()?;
+                let n = usize::try_from(u32::from_be_bytes(prefix))?;
+                ensure!(n <= MAX_FRAME, "frame exceeded cap");
+                if buffer.len() >= n + 4 {
+                    let complete = buffer.split_to(n + 4);
+                    return Ok(decode(complete.get(4..).context("body slice")?)?);
+                }
+            }
+            match attach.output.next().await {
+                Some(Ok(LogOutput::StdOut { message })) => {
+                    ensure!(
+                        buffer
+                            .len()
+                            .checked_add(message.len())
+                            .context("buffer overflow")?
+                            <= MAX_FRAME + 4096,
+                        "buffer exceeded cap"
+                    );
+                    buffer.extend_from_slice(&message);
+                }
+                Some(Ok(LogOutput::StdErr { message })) => {
+                    bail!("relay diagnostic: {}", String::from_utf8_lossy(&message))
+                }
+                Some(Ok(_)) => bail!("unexpected Docker stream"),
+                Some(Err(error)) => return Err(error.into()),
+                None => bail!("attach stream ended"),
+            }
+        }
+    })
+    .await
+    .context("relay frame deadline")?
+}
+
+fn limits(memory: i64, cpus: i64) -> HostConfig {
+    HostConfig {
+        memory: Some(memory),
+        nano_cpus: Some(cpus),
+        pids_limit: Some(64),
+        readonly_rootfs: Some(true),
+        cap_drop: Some(vec!["ALL".into()]),
+        security_opt: Some(vec!["no-new-privileges:true".into()]),
+        tmpfs: Some(HashMap::from([(
+            "/tmp".into(),
+            "rw,noexec,nosuid,size=536870912".into(),
+        )])),
+        ..Default::default()
+    }
+}
+
+#[derive(Debug)]
+struct Environment {
+    identity: String,
+    relay: String,
+    function: String,
+    attach: AttachContainerResults,
+    buffer: BytesMut,
+}
+
+fn owner_labels(identity: &str, run_id: &str) -> HashMap<String, String> {
+    HashMap::from([
+        ("rustack.p0.environment".into(), identity.into()),
+        ("rustack.p0.run".into(), run_id.into()),
+    ])
+}
+
+async fn create_relay(
+    docker: &Docker,
+    architecture: &str,
+    identity: &str,
+    run_id: &str,
+    stdin_once: bool,
+) -> Result<String> {
+    Ok(docker
+        .create_container(
+            None,
+            ContainerCreateBody {
+                image: Some(format!("rustack-p0-relay:{architecture}")),
+                user: Some("1000:1000".into()),
+                env: Some(vec![format!("SPIKE_ENVIRONMENT_UUID={identity}")]),
+                labels: Some(owner_labels(identity, run_id)),
+                attach_stdin: Some(true),
+                attach_stdout: Some(true),
+                attach_stderr: Some(true),
+                open_stdin: Some(true),
+                stdin_once: Some(stdin_once),
+                tty: Some(false),
+                host_config: Some(limits(64 * 1024 * 1024, 100_000_000)),
+                ..Default::default()
+            },
+        )
+        .await?
+        .id)
+}
+
+async fn create_function(
+    docker: &Docker,
+    architecture: &str,
+    identity: &str,
+    relay: &str,
+    run_id: &str,
+) -> Result<String> {
+    let mut host = limits(192 * 1024 * 1024, 1_000_000_000);
+    host.network_mode = Some(format!("container:{relay}"));
+    host.pids_limit = Some(256);
+    Ok(docker
+        .create_container(
+            None,
+            ContainerCreateBody {
+                image: Some(format!("rustack-p0-handler:{architecture}")),
+                user: Some("1000:1000".into()),
+                labels: Some(owner_labels(identity, run_id)),
+                env: Some(vec![
+                    "AWS_LAMBDA_RUNTIME_API=127.0.0.1:9001".into(),
+                    "AWS_LAMBDA_FUNCTION_NAME=spike".into(),
+                    "AWS_LAMBDA_FUNCTION_VERSION=$LATEST".into(),
+                    "AWS_LAMBDA_FUNCTION_MEMORY_SIZE=192".into(),
+                    "AWS_REGION=us-east-1".into(),
+                    "AWS_DEFAULT_REGION=us-east-1".into(),
+                ]),
+                host_config: Some(host),
+                ..Default::default()
+            },
+        )
+        .await?
+        .id)
+}
+
+async fn expect_kind(
+    attach: &mut AttachContainerResults,
+    buffer: &mut BytesMut,
+    kind: &str,
+) -> Result<Frame> {
+    let frame = next_frame(attach, buffer)
+        .await
+        .with_context(|| format!("await {kind}"))?;
+    ensure!(
+        frame.kind == kind,
+        "unexpected control variant awaiting {kind}"
+    );
+    Ok(frame)
+}
+
+async fn create_environment(
+    docker: &Docker,
+    ids: &mut Vec<String>,
+    architecture: &str,
+    run_id: &str,
+) -> Result<Environment> {
+    let identity = Uuid::new_v4().to_string();
+    let relay = create_relay(docker, architecture, &identity, run_id, true).await?;
+    ids.push(relay.clone());
+    let mut attach = docker
+        .attach_container(
+            &relay,
+            Some(
+                AttachContainerOptionsBuilder::default()
+                    .stdin(true)
+                    .stdout(true)
+                    .stderr(true)
+                    .stream(true)
+                    .logs(false)
+                    .build(),
+            ),
+        )
+        .await?;
+    docker.start_container(&relay, None).await?;
+    let mut buffer = BytesMut::new();
+    expect_kind(&mut attach, &mut buffer, "hello").await?;
+    expect_kind(&mut attach, &mut buffer, "ready").await?;
+    let function = create_function(docker, architecture, &identity, &relay, run_id).await?;
+    ids.push(function.clone());
+    docker.start_container(&function, None).await?;
+    let ready = expect_kind(&mut attach, &mut buffer, "bootstrapReady").await?;
+    ensure!(ready.environment == identity, "foreign bootstrap readiness");
+    Ok(Environment {
+        identity,
+        relay,
+        function,
+        attach,
+        buffer,
+    })
+}
+
+async fn invoke(environment: &mut Environment, payload: Bytes, kind: &str) -> Result<Frame> {
+    let request = Uuid::new_v4().to_string();
+    write_frame(
+        &mut environment.attach.input,
+        &Frame::new(&environment.identity, "invoke", &request, payload),
+    )
+    .await?;
+    let result = expect_kind(&mut environment.attach, &mut environment.buffer, kind).await?;
+    ensure!(
+        result.request_id == request && result.environment == environment.identity,
+        "foreign invocation result"
+    );
+    Ok(result)
+}
+
+fn check_output(body: &Value, value: i32, count: i32) -> Result<()> {
+    for (field, expected) in [
+        ("computed", json!(value + 7)),
+        ("counter", json!(count)),
+        ("uid", json!(1000)),
+        ("memoryMax", json!("201326592")),
+        ("pidsMax", json!("256")),
+        ("rootReadOnly", json!(true)),
+    ] {
+        ensure!(
+            body.get(field) == Some(&expected),
+            "unexpected fixture output: {field}"
+        );
+    }
+    Ok(())
+}
+
+async fn wait_handler_started(docker: &Docker, function: &str, request: &str) -> Result<()> {
+    let marker = format!("P0_BUSY_START={request}");
+    let mut stream = docker.logs(
+        function,
+        Some(
+            LogsOptionsBuilder::default()
+                .stdout(true)
+                .stderr(true)
+                .follow(true)
+                .tail("20")
+                .build(),
+        ),
+    );
+    timeout(Duration::from_secs(45), async {
+        let mut bytes = Vec::new();
+        while let Some(message) = stream.next().await {
+            match message? {
+                LogOutput::StdOut { message } | LogOutput::StdErr { message } => {
+                    ensure!(
+                        bytes
+                            .len()
+                            .checked_add(message.len())
+                            .context("log size overflow")?
+                            <= 16 * 1024,
+                        "fixture logs exceeded cap"
+                    );
+                    bytes.extend_from_slice(&message);
+                    if bytes
+                        .windows(marker.len())
+                        .any(|chunk| chunk == marker.as_bytes())
+                    {
+                        return Ok(());
+                    }
+                }
+                _ => bail!("unexpected function log stream"),
+            }
+        }
+        bail!("handler exited before busy marker")
+    })
+    .await
+    .context("handler start deadline")?
+}
+
+async fn exercise(
+    docker: &Docker,
+    ids: &mut Vec<String>,
+    architecture: &str,
+    run_id: &str,
+) -> Result<Value> {
+    let start = Instant::now();
+    let mut environment = create_environment(docker, ids, architecture, run_id).await?;
+    let cold_ms = start.elapsed().as_millis();
+    let mut outputs = Vec::new();
+    for (value, count) in [(35, 1), (0, 2)] {
+        let result = invoke(
+            &mut environment,
+            Bytes::from(serde_json::to_vec(&json!({"value":value}))?),
+            "result",
+        )
+        .await?;
+        let body: Value = serde_json::from_slice(&result.payload)?;
+        check_output(&body, value, count)?;
+        outputs.push(body);
+    }
+    let error = invoke(
+        &mut environment,
+        Bytes::from_static(br#"{"fail":true}"#),
+        "error",
+    )
+    .await?;
+    let failure: Value = serde_json::from_slice(&error.payload)?;
+    ensure!(
+        failure.get("errorType") == Some(&json!("ValueError")),
+        "RIC error type lost"
+    );
+    let inspected = docker.inspect_container(&environment.relay, None).await?;
+    if let Some(ports) = inspected
+        .network_settings
+        .and_then(|settings| settings.ports)
+    {
+        ensure!(
+            ports.values().all(Option::is_none),
+            "Runtime API ports published"
+        );
+    }
+    let request = Uuid::new_v4().to_string();
+    write_frame(
+        &mut environment.attach.input,
+        &Frame::new(
+            &environment.identity,
+            "invoke",
+            &request,
+            Bytes::from_static(br#"{"sleep":true}"#),
+        ),
+    )
+    .await?;
+    wait_handler_started(docker, &environment.function, &request).await?;
+    docker
+        .remove_container(
+            &environment.function,
+            Some(RemoveContainerOptionsBuilder::default().force(true).build()),
+        )
+        .await?;
+    write_frame(
+        &mut environment.attach.input,
+        &Frame::new(&environment.identity, "close", "", Bytes::new()),
+    )
+    .await?;
+    expect_kind(&mut environment.attach, &mut environment.buffer, "ack").await?;
+    Ok(
+        json!({"architecture":architecture,"coldMs":cold_ms,"outputs":outputs,"errorType":failure.get("errorType"),"noPublishedRuntimePorts":true,"closeAck":true,"cancelledBusyFunction":true}),
+    )
+}
+
+async fn relay_is_running(docker: &Docker, relay: &str) -> Result<bool> {
+    docker
+        .inspect_container(relay, None)
+        .await?
+        .state
+        .and_then(|state| state.running)
+        .context("missing container state")
+}
+
+async fn probe_attach_eof(
+    docker: &Docker,
+    architecture: &str,
+    run_id: &str,
+    ids: &mut Vec<String>,
+) -> Result<Value> {
+    let mut observations = Vec::new();
+    for stdin_once in [false, true] {
+        let identity = Uuid::new_v4().to_string();
+        let relay = create_relay(docker, architecture, &identity, run_id, stdin_once).await?;
+        ids.push(relay.clone());
+        let mut attach = docker
+            .attach_container(
+                &relay,
+                Some(
+                    AttachContainerOptionsBuilder::default()
+                        .stdin(true)
+                        .stdout(true)
+                        .stderr(true)
+                        .stream(true)
+                        .build(),
+                ),
+            )
+            .await?;
+        docker.start_container(&relay, None).await?;
+        let mut buffer = BytesMut::new();
+        expect_kind(&mut attach, &mut buffer, "hello").await?;
+        expect_kind(&mut attach, &mut buffer, "ready").await?;
+        attach.input.shutdown().await?;
+        if stdin_once {
+            timeout(Duration::from_secs(20), async {
+                while relay_is_running(docker, &relay).await? {
+                    sleep(Duration::from_millis(25)).await;
+                }
+                Ok::<(), anyhow::Error>(())
+            })
+            .await
+            .context("relay did not exit after stdin EOF")??;
+        } else {
+            sleep(Duration::from_millis(500)).await;
+        }
+        observations.push(json!({"stdinOnce":stdin_once,"runningAfterShutdown":relay_is_running(docker, &relay).await?}));
+    }
+    Ok(json!(observations))
+}
+
+async fn owned_containers(docker: &Docker, run_id: &str) -> Result<Vec<String>> {
+    let filter: HashMap<String, Vec<String>> =
+        HashMap::from([("label".into(), vec![format!("rustack.p0.run={run_id}")])]);
+    let listed = docker
+        .list_containers(Some(
+            ListContainersOptionsBuilder::default()
+                .all(true)
+                .filters(&filter)
+                .build(),
+        ))
+        .await?;
+    ensure!(listed.len() <= 8, "unexpected probe resource count");
+    listed
+        .into_iter()
+        .map(|record| record.id.context("owned container lacks ID"))
+        .collect()
+}
+
+async fn cleanup_owned(docker: &Docker, run_id: &str, ids: &[String]) -> Result<()> {
+    timeout(Duration::from_secs(20), async {
+        let mut candidates: BTreeSet<String> = ids.iter().cloned().collect();
+        let mut errors = Vec::new();
+        for _ in 0..3 {
+            candidates.extend(owned_containers(docker, run_id).await?);
+            for id in &candidates {
+                match docker
+                    .remove_container(
+                        id,
+                        Some(RemoveContainerOptionsBuilder::default().force(true).build()),
+                    )
+                    .await
+                {
+                    Ok(())
+                    | Err(DockerError::DockerResponseServerError {
+                        status_code: 404, ..
+                    }) => {}
+                    Err(error) => errors.push(error),
+                }
+            }
+            sleep(Duration::from_millis(200)).await;
+        }
+        ensure!(
+            owned_containers(docker, run_id).await?.is_empty(),
+            "probe-owned containers remain: run {run_id}"
+        );
+        ensure!(
+            errors.is_empty(),
+            "cleanup had uncertain failures for run {run_id}"
+        );
+        Ok::<(), anyhow::Error>(())
+    })
+    .await
+    .context("owned cleanup deadline")?
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let socket = env::args().nth(1).context("socket argument required")?;
+    let architecture = env::args().nth(2).context("architecture required")?;
+    ensure!(
+        matches!(architecture.as_str(), "arm64" | "amd64"),
+        "invalid architecture"
+    );
+    let docker = Docker::connect_with_unix(&socket, 60, API_DEFAULT_VERSION)?
+        .negotiate_version()
+        .await?;
+    let run_id = Uuid::new_v4().to_string();
+    let mut ids = Vec::new();
+    let outcome = timeout(Duration::from_secs(180), async {
+        let mut evidence = exercise(&docker, &mut ids, &architecture, &run_id).await?;
+        let eof = probe_attach_eof(&docker, &architecture, &run_id, &mut ids).await?;
+        evidence
+            .as_object_mut()
+            .context("evidence object")?
+            .insert("attachEof".into(), eof);
+        // Deliberately omit this ID from the registry to simulate losing a create response.
+        let _unrecorded = create_relay(
+            &docker,
+            &architecture,
+            &Uuid::new_v4().to_string(),
+            &run_id,
+            true,
+        )
+        .await?;
+        evidence
+            .as_object_mut()
+            .context("evidence object")?
+            .insert("runId".into(), json!(run_id));
+        Ok::<Value, anyhow::Error>(evidence)
+    })
+    .await
+    .context("spike deadline")
+    .and_then(|value| value);
+    cleanup_owned(&docker, &run_id, &ids).await?;
+    match outcome {
+        Ok(mut evidence) => {
+            evidence
+                .as_object_mut()
+                .context("evidence object")?
+                .insert("labelReconciliation".into(), json!(true));
+            println!("{}", serde_json::to_string_pretty(&evidence)?);
+            Ok(())
+        }
+        Err(error) => Err(error),
+    }
+}
diff --git a/tools/workflows-spikes/src/bin/relay.rs b/tools/workflows-spikes/src/bin/relay.rs
new file mode 100644
index 00000000..91a46d10
--- /dev/null
+++ b/tools/workflows-spikes/src/bin/relay.rs
@@ -0,0 +1,203 @@
+//! Temporary experiment relay: real HTTP Runtime API with framed CBOR stdio.
+#![forbid(unsafe_code)]
+
+use std::{
+    convert::Infallible,
+    time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+use anyhow::{Context, Result, bail, ensure};
+use bytes::Bytes;
+use http_body_util::{BodyExt, Full, Limited};
+use hyper::{
+    Request, Response, StatusCode, body::Incoming, server::conn::http1, service::service_fn,
+};
+use hyper_util::rt::TokioIo;
+use rustack_workflows_spikes::{Frame, read_frame, write_frame};
+use tokio::{
+    net::TcpListener,
+    sync::{mpsc, oneshot, watch},
+    task::JoinSet,
+    time::timeout,
+};
+
+#[derive(Debug)]
+struct ApiRequest {
+    method: String,
+    path: String,
+    body: Bytes,
+    reply: oneshot::Sender<Response<Full<Bytes>>>,
+}
+
+fn response(status: StatusCode, body: Bytes) -> Response<Full<Bytes>> {
+    let mut response = Response::new(Full::new(body));
+    *response.status_mut() = status;
+    response
+}
+
+async fn serve(
+    request: Request<Incoming>,
+    tx: mpsc::Sender<ApiRequest>,
+) -> Result<Response<Full<Bytes>>, Infallible> {
+    let method = request.method().to_string();
+    let path = request.uri().path().to_owned();
+    let result = timeout(
+        Duration::from_secs(5),
+        Limited::new(request.into_body(), 6 * 1024 * 1024).collect(),
+    )
+    .await;
+    let body = match result {
+        Ok(Ok(body)) => body.to_bytes(),
+        _ => return Ok(response(StatusCode::BAD_REQUEST, Bytes::new())),
+    };
+    let (reply, rx) = oneshot::channel();
+    if tx
+        .send(ApiRequest {
+            method,
+            path,
+            body,
+            reply,
+        })
+        .await
+        .is_err()
+    {
+        return Ok(response(StatusCode::SERVICE_UNAVAILABLE, Bytes::new()));
+    }
+    Ok(match rx.await {
+        Ok(value) => value,
+        Err(_) => response(StatusCode::SERVICE_UNAVAILABLE, Bytes::new()),
+    })
+}
+
+async fn http_server(
+    listener: TcpListener,
+    tx: mpsc::Sender<ApiRequest>,
+    mut stop: watch::Receiver<bool>,
+) -> Result<()> {
+    let mut connections = JoinSet::new();
+    loop {
+        tokio::select! {
+            _ = stop.changed() => break,
+            connection = listener.accept() => {
+                let (socket, _) = connection?;
+                ensure!(connections.len() < 8, "connection cap");
+                let tx = tx.clone();
+                connections.spawn(async move {
+                    http1::Builder::new().serve_connection(TokioIo::new(socket), service_fn(move |request| serve(request, tx.clone()))).await
+                });
+            }
+            completed = connections.join_next(), if !connections.is_empty() => {
+                if let Some(completed) = completed { completed??; }
+            }
+        }
+    }
+    connections.abort_all();
+    while connections.join_next().await.is_some() {}
+    Ok(())
+}
+
+async fn run() -> Result<()> {
+    let environment = std::env::var("SPIKE_ENVIRONMENT_UUID").context("environment identity")?;
+    ensure!(environment.len() == 36, "invalid environment identity");
+    let listener = TcpListener::bind(("127.0.0.1", 9001)).await?;
+    let (api_tx, mut api_rx) = mpsc::channel(8);
+    let (control_tx, mut control_rx) = mpsc::channel(8);
+    let (stop_tx, stop_rx) = watch::channel(false);
+    let mut workers = JoinSet::new();
+    workers.spawn(http_server(listener, api_tx, stop_rx));
+    workers.spawn(async move {
+        let mut input = tokio::io::stdin();
+        loop {
+            let frame = read_frame(&mut input).await?;
+            let close = frame.kind == "close";
+            control_tx.send(frame).await.context("control receiver")?;
+            if close {
+                return std::future::pending::<Result<()>>().await;
+            }
+        }
+    });
+    let mut output = tokio::io::stdout();
+    write_frame(
+        &mut output,
+        &Frame::new(&environment, "hello", "", Bytes::new()),
+    )
+    .await?;
+    write_frame(
+        &mut output,
+        &Frame::new(&environment, "ready", "", Bytes::new()),
+    )
+    .await?;
+    let mut poll: Option<oneshot::Sender<Response<Full<Bytes>>>> = None;
+    let mut job: Option<Frame> = None;
+    let mut delivered = false;
+    let mut bootstrap_seen = false;
+    let outcome: Result<()> = async {
+        loop {
+            tokio::select! {
+                frame = control_rx.recv() => {
+                    let Some(frame) = frame else { bail!("control EOF") };
+                    ensure!(frame.environment == environment, "foreign environment");
+                    match frame.kind.as_str() {
+                        "invoke" => { ensure!(job.is_none(), "concurrent invocation"); job = Some(frame); delivered = false; }
+                        "close" => { write_frame(&mut output, &Frame::new(&environment, "ack", "", Bytes::new())).await?; break; }
+                        _ => bail!("unexpected control variant"),
+                    }
+                }
+                request = api_rx.recv() => {
+                    let Some(request) = request else { bail!("API channel closed") };
+                    if request.method == "GET" && request.path == "/2018-06-01/runtime/invocation/next" {
+                        if poll.is_some() || delivered {
+                            let _ = request.reply.send(response(StatusCode::CONFLICT, Bytes::new()));
+                        } else {
+                            poll = Some(request.reply);
+                            if !bootstrap_seen {
+                                write_frame(&mut output, &Frame::new(&environment, "bootstrapReady", "", Bytes::new())).await?;
+                                bootstrap_seen = true;
+                            }
+                        }
+                    } else if request.method == "POST" && request.path == "/2018-06-01/runtime/init/error" {
+                        let _ = request.reply.send(response(StatusCode::ACCEPTED, Bytes::new()));
+                        write_frame(&mut output, &Frame::new(&environment, "initError", "", request.body)).await?;
+                    } else if let Some(active) = &job {
+                        let success = format!("/2018-06-01/runtime/invocation/{}/response", active.request_id);
+                        let failure = format!("/2018-06-01/runtime/invocation/{}/error", active.request_id);
+                        if request.method == "POST" && delivered && (request.path == success || request.path == failure) {
+                            let kind = if request.path == success { "result" } else { "error" };
+                            let _ = request.reply.send(response(StatusCode::ACCEPTED, Bytes::new()));
+                            write_frame(&mut output, &Frame::new(&environment, kind, &active.request_id, request.body)).await?;
+                            job = None; delivered = false;
+                        } else { let _ = request.reply.send(response(StatusCode::BAD_REQUEST, Bytes::new())); }
+                    } else { let _ = request.reply.send(response(StatusCode::BAD_REQUEST, Bytes::new())); }
+                }
+                worker = workers.join_next(), if !workers.is_empty() => {
+                    if let Some(worker) = worker { worker??; }
+                    bail!("relay worker terminated");
+                }
+                () = tokio::time::sleep(Duration::from_secs(120)) => bail!("idle lease expired"),
+            }
+            if !delivered && let Some(active) = &job && let Some(reply) = poll.take() {
+                        let deadline = SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis().checked_add(10_000).context("deadline overflow")?;
+                        let mut event = response(StatusCode::OK, active.payload.clone());
+                        for (key, value) in [
+                            ("lambda-runtime-aws-request-id", active.request_id.clone()),
+                            ("lambda-runtime-deadline-ms", deadline.to_string()),
+                            ("lambda-runtime-invoked-function-arn", "arn:aws:lambda:us-east-1:000000000000:function:spike".into()),
+                            ("lambda-runtime-trace-id", "Root=1-00000000-000000000000000000000000;Sampled=0".into()),
+                            ("content-type", "application/json".into()),
+                        ] { event.headers_mut().insert(key, value.parse()?); }
+                        reply.send(event).map_err(|_| anyhow::anyhow!("RIC disconnected before delivery"))?;
+                        delivered = true;
+            }
+        }
+        Ok(())
+    }.await;
+    let _ = stop_tx.send(true);
+    workers.abort_all();
+    while workers.join_next().await.is_some() {}
+    outcome
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    run().await
+}
diff --git a/tools/workflows-spikes/src/diagnostics_tests.rs b/tools/workflows-spikes/src/diagnostics_tests.rs
new file mode 100644
index 00000000..02590006
--- /dev/null
+++ b/tools/workflows-spikes/src/diagnostics_tests.rs
@@ -0,0 +1,166 @@
+//! Verify the production filter against actual Bollard log-facade call sites.
+
+use std::{
+    io::{self, Write},
+    sync::{Arc, Mutex},
+    time::Duration,
+};
+
+use anyhow::{Context, Result, ensure};
+use bollard::{
+    API_DEFAULT_VERSION, Docker, container::LogOutput, models::ContainerCreateBody,
+    query_parameters::LogsOptionsBuilder,
+};
+use futures::StreamExt;
+use rustack_lambda_runtime::diagnostics::runtime_dispatch;
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::{UnixListener, UnixStream},
+    time::timeout,
+};
+use tracing::instrument::WithSubscriber;
+use tracing_log::{LogTracer, log::LevelFilter};
+
+#[derive(Clone, Debug, Default)]
+struct Capture(Arc<Mutex<Vec<u8>>>);
+impl Write for Capture {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        let mut output = self
+            .0
+            .lock()
+            .map_err(|_| io::Error::other("capture lock failed"))?;
+        if output.len().saturating_add(bytes.len()) > 1024 * 1024 {
+            return Err(io::Error::other("capture exceeded cap"));
+        }
+        output.extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+async fn request(listener: &UnixListener) -> Result<UnixStream> {
+    let (mut stream, _) = listener.accept().await?;
+    let mut bytes = Vec::new();
+    let end = loop {
+        if let Some(position) = bytes.windows(4).position(|bytes| bytes == b"\r\n\r\n") {
+            break position + 4;
+        }
+        ensure!(bytes.len() < 16 * 1024, "fixture header exceeded cap");
+        let mut buffer = [0; 512];
+        let read = stream.read(&mut buffer).await?;
+        ensure!(read > 0, "fixture header EOF");
+        bytes.extend_from_slice(buffer.get(..read).context("fixture slice")?);
+    };
+    let header = std::str::from_utf8(bytes.get(..end).context("fixture header")?)?;
+    let length = header
+        .lines()
+        .find_map(|line| {
+            line.split_once(':')
+                .filter(|(key, _)| key.eq_ignore_ascii_case("content-length"))
+                .map(|(_, value)| value.trim().parse::<usize>())
+        })
+        .transpose()?
+        .unwrap_or(0);
+    ensure!(length <= 4096, "fixture body exceeded cap");
+    let received = bytes
+        .len()
+        .checked_sub(end)
+        .context("fixture body offset")?;
+    let remaining = length
+        .checked_sub(received)
+        .context("fixture body length")?;
+    stream.read_exact(&mut vec![0; remaining]).await?;
+    Ok(stream)
+}
+
+async fn respond(stream: &mut UnixStream, body: &[u8]) -> Result<()> {
+    let header = format!(
+        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+        body.len()
+    );
+    stream.write_all(header.as_bytes()).await?;
+    stream.write_all(body).await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_should_filter_actual_bollard_request_response_and_truncated_decoder_logs()
+-> Result<()> {
+    LogTracer::builder()
+        .with_max_level(LevelFilter::Trace)
+        .init()?;
+    let directory = tempfile::tempdir()?;
+    let socket = directory.path().join("docker.sock");
+    let listener = UnixListener::bind(&socket)?;
+    let mut server = tokio::spawn(async move {
+        let mut create = request(&listener).await?;
+        respond(
+            &mut create,
+            br#"{"Id":"probe","Warnings":["secret_bollard_response"]}"#,
+        )
+        .await?;
+        drop(create);
+        let mut logs = request(&listener).await?;
+        let mut truncated = vec![1, 0, 0, 0, 0, 0, 0, 100];
+        truncated.extend_from_slice(b"secret_bollard_trailing");
+        respond(&mut logs, &truncated).await?;
+        Ok::<_, anyhow::Error>(())
+    });
+    let capture = Capture::default();
+    let writer = capture.clone();
+    let subscriber = tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::TRACE)
+        .with_ansi(false)
+        .with_writer(move || writer.clone())
+        .finish();
+    let outcome = async {
+        tracing::debug!("compatibility_application_marker");
+        let dispatch = runtime_dispatch();
+        let docker = Docker::connect_with_socket(socket.to_str().context("fixture socket UTF-8")?, 3, API_DEFAULT_VERSION)?;
+        let created = docker.create_container(None, ContainerCreateBody { env: Some(vec!["SECRET=secret_bollard_request".into()]), ..Default::default() }).with_subscriber(dispatch.clone()).await?;
+        ensure!(created.id == "probe", "Bollard create response mismatch");
+        // logs() constructs its HTTP future synchronously. Cover construction
+        // as well as every stream poll with the production dispatch policy.
+        let mut logs = tracing::dispatcher::with_default(&dispatch, || docker.logs("secret_bollard_target", Some(LogsOptionsBuilder::default().stdout(true).build())));
+        async {
+            let output = logs.next().await.context("expected EOF fallback record")??;
+            ensure!(matches!(output, LogOutput::Console { message } if message.as_ref() == b"secret_bollard_trailing"), "upstream EOF behavior changed");
+            ensure!(logs.next().await.is_none(), "unexpected extra fallback record");
+            Ok::<_, anyhow::Error>(())
+        }.with_subscriber(dispatch).await
+    }.with_subscriber(subscriber).await;
+    let joined = match timeout(Duration::from_secs(3), &mut server).await {
+        Ok(result) => result.context("join fixture server")?,
+        Err(_) => {
+            server.abort();
+            let _ = server.await;
+            Err(anyhow::anyhow!("fixture server deadline"))
+        }
+    };
+    outcome.and(joined)?;
+    let shown = String::from_utf8(
+        capture
+            .0
+            .lock()
+            .map_err(|_| anyhow::anyhow!("capture lock failed"))?
+            .clone(),
+    )?;
+    ensure!(
+        shown.contains("compatibility_application_marker"),
+        "application logs were lost"
+    );
+    for secret in [
+        "secret_bollard_request",
+        "secret_bollard_response",
+        "secret_bollard_target",
+        "secret_bollard_trailing",
+    ] {
+        ensure!(
+            !shown.contains(secret),
+            "Bollard payload reached infrastructure logs"
+        );
+    }
+    Ok(())
+}
diff --git a/tools/workflows-spikes/src/lib.rs b/tools/workflows-spikes/src/lib.rs
new file mode 100644
index 00000000..6ef203de
--- /dev/null
+++ b/tools/workflows-spikes/src/lib.rs
@@ -0,0 +1,280 @@
+//! Bounded control framing for the isolated Docker feasibility experiment.
+//!
+//! This tool verifies transport feasibility with trusted fixture peers. It is not
+//! the production Runtime API or a hardened external CBOR deserializer.
+#![forbid(unsafe_code)]
+
+#[cfg(all(test, unix))]
+mod diagnostics_tests;
+
+use std::{
+    fmt,
+    io::{self, Cursor},
+    num::TryFromIntError,
+};
+
+use bytes::Bytes;
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
+
+/// Maximum frame in this feasibility experiment.
+pub const MAX_FRAME: usize = 6 * 1024 * 1024 + 64 * 1024;
+
+/// Framing failures without payload-bearing diagnostics.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum FrameError {
+    /// Encoding the envelope failed.
+    #[error("control envelope encoding failed")]
+    Encode(#[from] ciborium::ser::Error<io::Error>),
+    /// Decoding the envelope failed.
+    #[error("control envelope decoding failed")]
+    Decode(#[from] ciborium::de::Error<io::Error>),
+    /// Reading or writing the transport failed.
+    #[error("control transport IO failed")]
+    Io(#[from] io::Error),
+    /// A length does not fit the target integer type.
+    #[error("control length conversion failed")]
+    Length(#[from] TryFromIntError),
+    /// A frame exceeds the allocation budget.
+    #[error("oversized control frame")]
+    TooLarge,
+    /// More than one CBOR item was present.
+    #[error("trailing control data")]
+    TrailingData,
+    /// The control version is unsupported.
+    #[error("unsupported control protocol")]
+    UnsupportedVersion,
+}
+
+/// Fixed message schema for experiment-owned peers only.
+#[derive(Serialize, Deserialize)]
+#[non_exhaustive]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct Frame {
+    /// Protocol version.
+    pub version: u32,
+    /// Environment identity.
+    pub environment: String,
+    /// Message variant.
+    pub kind: String,
+    /// Invocation identity, empty outside invocation messages.
+    pub request_id: String,
+    /// Raw event/result bytes, omitted from Debug.
+    pub payload: Bytes,
+}
+
+impl Frame {
+    /// Build a control message from trusted fixture metadata.
+    ///
+    /// ```
+    /// use bytes::Bytes;
+    /// use rustack_workflows_spikes::Frame;
+    /// let frame = Frame::new("fixture", "ready", "", Bytes::new());
+    /// assert_eq!(frame.version, 1);
+    /// ```
+    #[must_use]
+    pub fn new(environment: &str, kind: &str, request_id: &str, payload: Bytes) -> Self {
+        Self {
+            version: 1,
+            environment: environment.into(),
+            kind: kind.into(),
+            request_id: request_id.into(),
+            payload,
+        }
+    }
+}
+
+/// Encode a complete length-prefixed frame.
+///
+/// # Errors
+/// Returns an encoding or length error, or rejects an oversized frame.
+///
+/// ```
+/// use bytes::Bytes;
+/// use rustack_workflows_spikes::{Frame, encode};
+/// # fn main() -> anyhow::Result<()> {
+/// let bytes = encode(&Frame::new("fixture", "ready", "", Bytes::new()))?;
+/// assert!(bytes.len() > 4);
+/// # Ok(()) }
+/// ```
+pub fn encode(frame: &Frame) -> Result<Vec<u8>, FrameError> {
+    let mut body = Vec::new();
+    ciborium::into_writer(frame, &mut body)?;
+    if body.len() > MAX_FRAME {
+        return Err(FrameError::TooLarge);
+    }
+    let length = u32::try_from(body.len())?.to_be_bytes();
+    let capacity = body.len().checked_add(4).ok_or(FrameError::TooLarge)?;
+    let mut out = Vec::with_capacity(capacity);
+    out.extend_from_slice(&length);
+    out.extend_from_slice(&body);
+    Ok(out)
+}
+
+/// Decode one already bounded message body from a trusted fixture peer.
+///
+/// # Errors
+/// Rejects oversized, malformed, trailing or unsupported-version data.
+///
+/// ```
+/// use rustack_workflows_spikes::decode;
+/// assert!(decode(&[]).is_err());
+/// ```
+pub fn decode(body: &[u8]) -> Result<Frame, FrameError> {
+    if body.len() > MAX_FRAME {
+        return Err(FrameError::TooLarge);
+    }
+    let mut cursor = Cursor::new(body);
+    let frame: Frame = ciborium::from_reader(&mut cursor)?;
+    if usize::try_from(cursor.position())? != body.len() {
+        return Err(FrameError::TrailingData);
+    }
+    if frame.version != 1 {
+        return Err(FrameError::UnsupportedVersion);
+    }
+    Ok(frame)
+}
+
+/// Read a bounded frame from a dedicated reader task.
+///
+/// # Errors
+/// Propagates transport, decoding and length failures.
+///
+/// ```no_run
+/// # async fn example() -> anyhow::Result<()> {
+/// let mut stdin = tokio::io::stdin();
+/// let _frame = rustack_workflows_spikes::read_frame(&mut stdin).await?;
+/// # Ok(()) }
+/// ```
+pub async fn read_frame<R: AsyncRead + Unpin>(reader: &mut R) -> Result<Frame, FrameError> {
+    let length = usize::try_from(reader.read_u32().await?)?;
+    if length > MAX_FRAME {
+        return Err(FrameError::TooLarge);
+    }
+    let mut body = vec![0; length];
+    reader.read_exact(&mut body).await?;
+    decode(&body)
+}
+
+/// Write and flush a complete frame.
+///
+/// # Errors
+/// Propagates encoding and transport failures.
+///
+/// ```no_run
+/// # async fn example(frame: rustack_workflows_spikes::Frame) -> anyhow::Result<()> {
+/// let mut stdout = tokio::io::stdout();
+/// rustack_workflows_spikes::write_frame(&mut stdout, &frame).await?;
+/// # Ok(()) }
+/// ```
+pub async fn write_frame<W: AsyncWrite + Unpin>(
+    writer: &mut W,
+    frame: &Frame,
+) -> Result<(), FrameError> {
+    writer.write_all(&encode(frame)?).await?;
+    writer.flush().await?;
+    Ok(())
+}
+
+impl fmt::Debug for Frame {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Frame")
+            .field("version", &self.version)
+            .field("environment", &self.environment)
+            .field("kind", &self.kind)
+            .field("request_id", &self.request_id)
+            .field("payload_bytes", &self.payload.len())
+            .finish()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::ErrorKind;
+
+    use anyhow::Result;
+    use bytes::Bytes;
+    use tokio::io::AsyncWriteExt;
+
+    use super::{Frame, FrameError, MAX_FRAME, decode, encode, read_frame};
+
+    #[tokio::test]
+    async fn test_should_round_trip_fragmented_binary_frame() -> Result<()> {
+        let payload = Bytes::from((0_u8..=255).collect::<Vec<_>>());
+        let frame = Frame::new(
+            "test-environment",
+            "invoke",
+            "test-attempt",
+            payload.clone(),
+        );
+        let encoded = encode(&frame)?;
+        let (mut writer, mut reader) = tokio::io::duplex(16);
+        let task = tokio::spawn(async move {
+            for chunk in encoded.chunks(3) {
+                writer.write_all(chunk).await?;
+            }
+            Ok::<(), std::io::Error>(())
+        });
+        let decoded = read_frame(&mut reader).await?;
+        task.await??;
+        assert_eq!(decoded.payload, payload);
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_reject_trailing_cbor_data() -> Result<()> {
+        let mut body = Vec::new();
+        ciborium::into_writer(&Frame::new("env", "ready", "", Bytes::new()), &mut body)?;
+        body.push(0);
+        assert!(decode(&body).is_err());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_should_reject_oversized_prefix_before_body_read() -> Result<()> {
+        let prefix = u32::try_from(MAX_FRAME + 1)?.to_be_bytes();
+        let mut reader = prefix.as_slice();
+        assert!(read_frame(&mut reader).await.is_err());
+        Ok(())
+    }
+
+    #[test]
+    fn test_should_redact_payload_in_debug() {
+        let debug = format!(
+            "{:?}",
+            Frame::new(
+                "env",
+                "invoke",
+                "attempt",
+                Bytes::from_static(b"secret-marker")
+            )
+        );
+        assert!(!debug.contains("secret-marker"));
+        assert!(debug.contains("payload_bytes"));
+    }
+    #[tokio::test]
+    async fn test_should_detect_clean_eof() {
+        let mut input = b"".as_slice();
+        assert!(
+            matches!(read_frame(&mut input).await, Err(FrameError::Io(error)) if error.kind() == ErrorKind::UnexpectedEof)
+        );
+    }
+
+    #[tokio::test]
+    async fn test_should_detect_truncated_prefix_eof() {
+        let mut input = b"\0\0\0".as_slice();
+        assert!(
+            matches!(read_frame(&mut input).await, Err(FrameError::Io(error)) if error.kind() == ErrorKind::UnexpectedEof)
+        );
+    }
+
+    #[tokio::test]
+    async fn test_should_detect_truncated_body_eof() {
+        let mut input = b"\0\0\0\x02\xa0".as_slice();
+        assert!(
+            matches!(read_frame(&mut input).await, Err(FrameError::Io(error)) if error.kind() == ErrorKind::UnexpectedEof)
+        );
+    }
+}
diff --git a/vendors/bollard b/vendors/bollard
new file mode 160000
index 00000000..f9ec79e7
--- /dev/null
+++ b/vendors/bollard
@@ -0,0 +1 @@
+Subproject commit f9ec79e7546edfb674b1066c44a68815cb52251c
diff --git a/vendors/moby b/vendors/moby
new file mode 160000
index 00000000..af898abe
--- /dev/null
+++ b/vendors/moby
@@ -0,0 +1 @@
+Subproject commit af898abe44662d9554fb15ee4d4a7307f1b8e315
diff --git a/vendors/pulumi b/vendors/pulumi
new file mode 160000
index 00000000..874c77a7
--- /dev/null
+++ b/vendors/pulumi
@@ -0,0 +1 @@
+Subproject commit 874c77a73039cf013d6a685a15293843de2b0e01